@cleocode/cleo 2026.4.107 → 2026.4.108

package/dist/cli/index.js

@@ -557,7 +557,7 @@ function createSuccessResult() {
 function isErrorResult(result) {
   return !result.success;
 }
-var ThinAgentViolationError;
+var ThinAgentViolationError, LifecycleScopeDeniedError;
 var init_errors = __esm({
   "packages/contracts/src/errors.ts"() {
     "use strict";
@@ -585,6 +585,26 @@ var init_errors = __esm({
       /** Numeric exit code aligned with {@link ExitCode.THIN_AGENT_VIOLATION}. */
       exitCode = 68 /* THIN_AGENT_VIOLATION */;
     };
+    LifecycleScopeDeniedError = class extends Error {
+      /**
+       * @param epicId      - The epic whose lifecycle mutation was blocked.
+       * @param sessionScope - Human-readable description of the current session scope.
+       */
+      constructor(epicId, sessionScope) {
+        super(
+          `E_LIFECYCLE_SCOPE_DENIED: lifecycle stage advancement for epic '${epicId}' requires a session scoped to that epic or an owner override. Current session scope: ${sessionScope}. Use CLEO_OWNER_OVERRIDE=1 if this is an authorized operation.`
+        );
+        this.epicId = epicId;
+        this.sessionScope = sessionScope;
+        this.name = "LifecycleScopeDeniedError";
+      }
+      epicId;
+      sessionScope;
+      /** Stable LAFS error code string for envelope emission. */
+      code = "E_LIFECYCLE_SCOPE_DENIED";
+      /** Numeric exit code aligned with {@link ExitCode.TASK_NOT_IN_SCOPE} (34). */
+      exitCode = 34 /* TASK_NOT_IN_SCOPE */;
+    };
   }
 });
 
@@ -881,12 +901,12 @@ var init_session2 = __esm({
     "use strict";
     SessionView = class _SessionView {
       _sessions;
-      constructor(sessions2) {
-        this._sessions = sessions2;
+      constructor(sessions3) {
+        this._sessions = sessions3;
       }
       /** Create a SessionView from a Session array. */
-      static from(sessions2) {
-        return new _SessionView(sessions2);
+      static from(sessions3) {
+        return new _SessionView(sessions3);
       }
       /** All sessions in the view (readonly). */
       get all() {
@@ -2148,10 +2168,10 @@ var init_subquery = __esm({
     init_entity();
     Subquery = class {
       static [entityKind] = "Subquery";
-      constructor(sql18, fields, alias, isWith = false, usedTables = []) {
+      constructor(sql19, fields, alias, isWith = false, usedTables = []) {
         this._ = {
           brand: "Subquery",
-          sql: sql18,
+          sql: sql19,
           selectedFields: fields,
           alias,
           isWith,
@@ -2582,8 +2602,8 @@ var init_sql = __esm({
         isSelectionField = false;
         /** @internal */
         origin;
-        constructor(sql18, fieldAlias) {
-          this.sql = sql18;
+        constructor(sql19, fieldAlias) {
+          this.sql = sql19;
           this.fieldAlias = fieldAlias;
         }
         getSQL() {
@@ -3661,8 +3681,8 @@ var init_custom = __esm({
       mapFromJsonValue(value) {
         return typeof this.mapJson === "function" ? this.mapJson(value) : this.mapFromDriverValue(value);
       }
-      jsonSelectIdentifier(identifier, sql18, arrayDimensions) {
-        if (typeof this.forJsonSelect === "function") return this.forJsonSelect(identifier, sql18, arrayDimensions);
+      jsonSelectIdentifier(identifier, sql19, arrayDimensions) {
+        if (typeof this.forJsonSelect === "function") return this.forJsonSelect(identifier, sql19, arrayDimensions);
         const rawType = this.getSQLType().toLowerCase();
         const parenPos = rawType.indexOf("(");
         switch (parenPos + 1 ? rawType.slice(0, parenPos) : rawType) {
@@ -3672,7 +3692,7 @@ var init_custom = __esm({
           case "numeric":
           case "bigint": {
             const arrVal = "[]".repeat(arrayDimensions ?? 0);
-            return sql18`${identifier}::text${sql18.raw(arrVal).if(arrayDimensions)}`;
+            return sql19`${identifier}::text${sql19.raw(arrVal).if(arrayDimensions)}`;
           }
           default:
             return identifier;
@@ -6624,17 +6644,17 @@ var init_custom2 = __esm({
       mapFromJsonValue(value) {
         return typeof this.mapJson === "function" ? this.mapJson(value) : this.mapFromDriverValue(value);
       }
-      jsonSelectIdentifier(identifier, sql18) {
-        if (typeof this.forJsonSelect === "function") return this.forJsonSelect(identifier, sql18);
+      jsonSelectIdentifier(identifier, sql19) {
+        if (typeof this.forJsonSelect === "function") return this.forJsonSelect(identifier, sql19);
         const rawType = this.getSQLType().toLowerCase();
         const parenPos = rawType.indexOf("(");
         switch (parenPos + 1 ? rawType.slice(0, parenPos) : rawType) {
           case "numeric":
           case "decimal":
           case "bigint":
-            return sql18`cast(${identifier} as text)`;
+            return sql19`cast(${identifier} as text)`;
           case "blob":
-            return sql18`hex(${identifier})`;
+            return sql19`hex(${identifier})`;
           default:
             return identifier;
         }
@@ -8375,8 +8395,8 @@ var init_dialect = __esm({
         const returningSql = returning ? sql` returning ${this.buildSelection(returning, { isSingleTable: true })}` : void 0;
         return sql`${withSql}insert into ${table} ${insertOrder} ${valuesSql}${onConflict?.length ? sql.join(onConflict) : void 0}${returningSql}`;
       }
-      sqlToQuery(sql18, invokeSource) {
-        return sql18.toQuery({
+      sqlToQuery(sql19, invokeSource) {
+        return sql19.toQuery({
           casing: this.casing,
           escapeName: this.escapeName,
           escapeParam: this.escapeParam,
@@ -9473,8 +9493,8 @@ var init_db = __esm({
 });
 
 // node_modules/.pnpm/drizzle-orm@1.0.0-beta.22-ec7b61d_@opentelemetry+api@1.9.0_@sinclair+typebox@0.34.49_@t_a07afdeca00339cf8cd15f0f0c1cd4e1/node_modules/drizzle-orm/cache/core/cache.js
-async function hashQuery(sql18, params) {
-  const dataToHash = `${sql18}-${JSON.stringify(params, (_2, v2) => typeof v2 === "bigint" ? `${v2}n` : v2)}`;
+async function hashQuery(sql19, params) {
+  const dataToHash = `${sql19}-${JSON.stringify(params, (_2, v2) => typeof v2 === "bigint" ? `${v2}n` : v2)}`;
   const data = new TextEncoder().encode(dataToHash);
   const hashBuffer = await crypto.subtle.digest("SHA-256", data);
   return [...new Uint8Array(hashBuffer)].map((b2) => b2.toString(16).padStart(2, "0")).join("");
@@ -9653,8 +9673,8 @@ var init_session3 = __esm({
       values(query) {
         return this.prepareOneTimeQuery(this.dialect.sqlToQuery(query), void 0, "run", false).values();
       }
-      async count(sql18) {
-        return (await this.values(sql18))[0][0];
+      async count(sql19) {
+        return (await this.values(sql19))[0][0];
       }
       /** @internal */
       extractRawValuesValueFromBatchResult(_result) {
@@ -12637,17 +12657,6 @@ var init_migrator = __esm({
   }
 });
 
-// node_modules/.pnpm/drizzle-orm@1.0.0-beta.22-ec7b61d_@opentelemetry+api@1.9.0_@sinclair+typebox@0.34.49_@t_a07afdeca00339cf8cd15f0f0c1cd4e1/node_modules/drizzle-orm/node-sqlite/migrator.js
-function migrate(db, config2) {
-  const migrations = readMigrationFiles(config2);
-  return db.dialect.migrate(migrations, db.session, config2);
-}
-var init_migrator2 = __esm({
-  "node_modules/.pnpm/drizzle-orm@1.0.0-beta.22-ec7b61d_@opentelemetry+api@1.9.0_@sinclair+typebox@0.34.49_@t_a07afdeca00339cf8cd15f0f0c1cd4e1/node_modules/drizzle-orm/node-sqlite/migrator.js"() {
-    init_migrator();
-  }
-});
-
 // packages/core/src/store/migration-manager.ts
 import { copyFileSync, existsSync as existsSync5 } from "node:fs";
 function tableExists(nativeDb, tableName) {
@@ -12808,10 +12817,27 @@ function reconcileJournal(nativeDb, migrationsFolder, existenceTable, logSubsyst
         });
       }
       if (alterMatches.length === 0) {
+        const stripped = fullSql.replace(/--[^\n]*/g, "").replace(/\/\*[\s\S]*?\*\//g, "").trim();
+        if (stripped === "") {
+          const log15 = getLogger(logSubsystem);
+          log15.debug(
+            { migration: migration.name },
+            `Migration ${migration.name} is a comment-only baseline marker \u2014 marking applied on existing DB.`
+          );
+          insertJournalEntry(
+            nativeDb,
+            migration.hash,
+            migration.folderMillis,
+            migration.name ?? ""
+          );
+          continue;
+        }
         const renameRe = /ALTER\s+TABLE\s+[`"]?\w+[`"]?\s+RENAME\s+TO\s+[`"]?\w+[`"]?/i;
         const createTableRe = /CREATE\s+TABLE/i;
         if (renameRe.test(fullSql) && createTableRe.test(fullSql)) {
           probeAndMarkApplied(nativeDb, migration, logSubsystem);
+        } else if (createTableRe.test(fullSql)) {
+          probeAndMarkApplied(nativeDb, migration, logSubsystem);
         }
         continue;
       }
@@ -12892,11 +12918,28 @@ function isDuplicateColumnError(err) {
   if (!(err instanceof Error)) return false;
   return /duplicate column name/i.test(err.message);
 }
+function isExecutableStatement(stmt) {
+  if (stmt.trim() === "") return false;
+  const stripped = stmt.replace(/--[^\n]*/g, "").replace(/\/\*[\s\S]*?\*\//g, "").trim();
+  return stripped !== "";
+}
+function sanitizeMigrationStatements(migrations) {
+  return migrations.map((migration) => ({
+    ...migration,
+    sql: migration.sql.filter(isExecutableStatement)
+  }));
+}
+function migrateSanitized(db, config2) {
+  const raw = readMigrationFiles(config2);
+  const sanitized = sanitizeMigrationStatements(raw);
+  const dbInternal = db;
+  dbInternal.dialect.migrate(sanitized, dbInternal.session, config2);
+}
 function migrateWithRetry(db, migrationsFolder, nativeDb, existenceTable, logSubsystem) {
   let duplicateColumnReconciled = false;
   for (let attempt = 1; attempt <= MAX_MIGRATION_RETRIES; attempt++) {
     try {
-      migrate(db, { migrationsFolder });
+      migrateSanitized(db, { migrationsFolder });
       return;
     } catch (err) {
       if (isDuplicateColumnError(err) && !duplicateColumnReconciled && nativeDb !== void 0 && existenceTable !== void 0 && logSubsystem !== void 0) {
@@ -12936,7 +12979,6 @@ var init_migration_manager = __esm({
   "packages/core/src/store/migration-manager.ts"() {
     "use strict";
     init_migrator();
-    init_migrator2();
     init_logger();
     MAX_MIGRATION_RETRIES = 5;
     MIGRATION_RETRY_BASE_DELAY_MS = 100;
@@ -13042,12 +13084,12 @@ function detachAgentFromProject(db, agentId) {
 }
 function listProjectAgentRefs(db, opts) {
   const enabledOnly = opts?.enabledOnly ?? true;
-  const sql18 = enabledOnly ? `SELECT agent_id, attached_at, role, capabilities_override, last_used_at, enabled
+  const sql19 = enabledOnly ? `SELECT agent_id, attached_at, role, capabilities_override, last_used_at, enabled
        FROM project_agent_refs WHERE enabled = 1
        ORDER BY attached_at DESC` : `SELECT agent_id, attached_at, role, capabilities_override, last_used_at, enabled
        FROM project_agent_refs
        ORDER BY attached_at DESC`;
-  const rows = db.prepare(sql18).all();
+  const rows = db.prepare(sql19).all();
   return rows.map((r) => ({
     agentId: r.agent_id,
     attachedAt: r.attached_at,
@@ -13866,7 +13908,7 @@ function runNexusMigrations(nativeDb, db) {
   let lastError;
   for (let attempt = 1; attempt <= MAX_RETRIES; attempt++) {
     try {
-      migrate(db, { migrationsFolder });
+      migrateSanitized(db, { migrationsFolder });
       ensureColumns(
         nativeDb,
         "nexus_nodes",
@@ -13949,7 +13991,6 @@ var init_nexus_sqlite = __esm({
     "use strict";
     init_migrator();
     init_node_sqlite();
-    init_migrator2();
     init_paths();
     init_migration_manager();
     init_nexus_schema();
@@ -13963,6 +14004,277 @@ var init_nexus_sqlite = __esm({
   }
 });
 
+// packages/core/src/store/signaldock-schema.ts
+var signaldock_schema_exports = {};
+__export(signaldock_schema_exports, {
+  accounts: () => accounts,
+  agentCapabilities: () => agentCapabilities,
+  agentConnections: () => agentConnections,
+  agentSkills: () => agentSkills,
+  agents: () => agents,
+  capabilities: () => capabilities,
+  claimCodes: () => claimCodes,
+  orgAgentKeys: () => orgAgentKeys,
+  organization: () => organization,
+  sessions: () => sessions,
+  skills: () => skills,
+  users: () => users,
+  verifications: () => verifications
+});
+import { sql as sql4 } from "drizzle-orm";
+var users, organization, agents, claimCodes, capabilities, skills, agentCapabilities, agentSkills, agentConnections, accounts, sessions, verifications, orgAgentKeys;
+var init_signaldock_schema = __esm({
+  "packages/core/src/store/signaldock-schema.ts"() {
+    "use strict";
+    init_sqlite_core();
+    users = sqliteTable(
+      "users",
+      {
+        id: text2("id").primaryKey(),
+        email: text2("email").notNull().unique(),
+        passwordHash: text2("password_hash").notNull(),
+        name: text2("name"),
+        slug: text2("slug"),
+        defaultAgentId: text2("default_agent_id"),
+        username: text2("username"),
+        displayUsername: text2("display_username"),
+        emailVerified: integer2("email_verified").notNull().default(0),
+        image: text2("image"),
+        role: text2("role").notNull().default("user"),
+        banned: integer2("banned").notNull().default(0),
+        banReason: text2("ban_reason"),
+        banExpires: text2("ban_expires"),
+        twoFactorEnabled: integer2("two_factor_enabled").notNull().default(0),
+        metadata: text2("metadata"),
+        createdAt: integer2("created_at").notNull(),
+        updatedAt: integer2("updated_at").notNull()
+      },
+      (table) => [index("idx_users_slug").on(table.slug)]
+    );
+    organization = sqliteTable(
+      "organization",
+      {
+        id: text2("id").primaryKey().notNull(),
+        name: text2("name").notNull(),
+        slug: text2("slug"),
+        logo: text2("logo"),
+        metadata: text2("metadata"),
+        ownerId: text2("owner_id"),
+        createdAt: integer2("created_at").notNull().default(sql4`(strftime('%s','now'))`),
+        updatedAt: integer2("updated_at").notNull().default(sql4`(strftime('%s','now'))`)
+      },
+      (table) => [index("idx_organization_slug").on(table.slug)]
+    );
+    agents = sqliteTable(
+      "agents",
+      {
+        id: text2("id").primaryKey(),
+        agentId: text2("agent_id").notNull().unique(),
+        name: text2("name").notNull(),
+        description: text2("description"),
+        class: text2("class").notNull().default("custom"),
+        privacyTier: text2("privacy_tier").notNull().default("public"),
+        ownerId: text2("owner_id").references(() => users.id),
+        endpoint: text2("endpoint"),
+        webhookSecret: text2("webhook_secret"),
+        capabilities: text2("capabilities").notNull().default("[]"),
+        skills: text2("skills").notNull().default("[]"),
+        avatar: text2("avatar"),
+        messagesSent: integer2("messages_sent").notNull().default(0),
+        messagesReceived: integer2("messages_received").notNull().default(0),
+        conversationCount: integer2("conversation_count").notNull().default(0),
+        friendCount: integer2("friend_count").notNull().default(0),
+        status: text2("status").notNull().default("online"),
+        lastSeen: integer2("last_seen"),
+        paymentConfig: text2("payment_config"),
+        apiKeyHash: text2("api_key_hash"),
+        organizationId: text2("organization_id").references(() => organization.id, {
+          onDelete: "set null"
+        }),
+        createdAt: integer2("created_at").notNull(),
+        updatedAt: integer2("updated_at").notNull(),
+        transportType: text2("transport_type").notNull().default("http"),
+        apiKeyEncrypted: text2("api_key_encrypted"),
+        apiBaseUrl: text2("api_base_url").notNull().default("https://api.signaldock.io"),
+        classification: text2("classification"),
+        transportConfig: text2("transport_config").notNull().default("{}"),
+        isActive: integer2("is_active").notNull().default(1),
+        lastUsedAt: integer2("last_used_at"),
+        requiresReauth: integer2("requires_reauth").notNull().default(0),
+        // T897 v3 columns
+        /** Tier taxonomy from ADR-044: project, global, packaged, fallback. */
+        tier: text2("tier").notNull().default("global"),
+        /** Whether this agent is permitted to spawn sub-agents. */
+        canSpawn: integer2("can_spawn").notNull().default(0),
+        /** Orchestration level: 0=worker, 1=lead, 2=orchestrator. */
+        orchLevel: integer2("orch_level").notNull().default(2),
+        /** Agent ID this agent reports to (parent in hierarchy). */
+        reportsTo: text2("reports_to"),
+        /** Absolute path to the agent's .cant definition file. */
+        cantPath: text2("cant_path"),
+        /** SHA-256 checksum of the .cant file at install time. */
+        cantSha256: text2("cant_sha256"),
+        /** Installation provenance: seed, user, manual. */
+        installedFrom: text2("installed_from"),
+        /** ISO 8601 timestamp when the agent was installed. */
+        installedAt: text2("installed_at")
+      },
+      (table) => [
+        index("agents_owner_idx").on(table.ownerId),
+        index("agents_class_idx").on(table.class),
+        index("agents_privacy_idx").on(table.privacyTier),
+        index("agents_org_idx").on(table.organizationId),
+        index("idx_agents_transport_type").on(table.transportType),
+        index("idx_agents_is_active").on(table.isActive),
+        index("idx_agents_last_used").on(table.lastUsedAt),
+        // Partial index: only rows where requires_reauth = 1.
+        // NOTE: drizzle-orm sqlite-core does not directly support WHERE on index.
+        // The partial index is created by the migration SQL but omitted from the
+        // schema definition (drizzle does not generate WHERE clauses for indexes).
+        // T897 indexes:
+        index("idx_agents_tier").on(table.tier),
+        index("idx_agents_cant_path").on(table.cantPath)
+      ]
+    );
+    claimCodes = sqliteTable(
+      "claim_codes",
+      {
+        id: text2("id").primaryKey(),
+        agentId: text2("agent_id").notNull().references(() => agents.id),
+        code: text2("code").notNull().unique(),
+        expiresAt: integer2("expires_at").notNull(),
+        usedAt: integer2("used_at"),
+        usedBy: text2("used_by").references(() => users.id),
+        createdAt: integer2("created_at").notNull()
+      },
+      (table) => [index("claim_codes_agent_idx").on(table.agentId)]
+    );
+    capabilities = sqliteTable("capabilities", {
+      id: text2("id").primaryKey(),
+      slug: text2("slug").notNull().unique(),
+      name: text2("name").notNull(),
+      description: text2("description").notNull(),
+      category: text2("category").notNull(),
+      createdAt: integer2("created_at").notNull()
+    });
+    skills = sqliteTable("skills", {
+      id: text2("id").primaryKey(),
+      slug: text2("slug").notNull().unique(),
+      name: text2("name").notNull(),
+      description: text2("description").notNull(),
+      category: text2("category").notNull(),
+      createdAt: integer2("created_at").notNull()
+    });
+    agentCapabilities = sqliteTable(
+      "agent_capabilities",
+      {
+        agentId: text2("agent_id").notNull().references(() => agents.id),
+        capabilityId: text2("capability_id").notNull().references(() => capabilities.id)
+      },
+      (table) => [primaryKey({ columns: [table.agentId, table.capabilityId] })]
+    );
+    agentSkills = sqliteTable(
+      "agent_skills",
+      {
+        agentId: text2("agent_id").notNull().references(() => agents.id),
+        skillId: text2("skill_id").notNull().references(() => skills.id),
+        /** Skill attachment provenance: cant, manual, computed. */
+        source: text2("source").notNull().default("manual"),
+        /** ISO 8601 timestamp when the skill was attached to this agent. */
+        attachedAt: text2("attached_at").notNull().default(sql4`(datetime('now'))`)
+      },
+      (table) => [
+        primaryKey({ columns: [table.agentId, table.skillId] }),
+        index("idx_agent_skills_source").on(table.source)
+      ]
+    );
+    agentConnections = sqliteTable(
+      "agent_connections",
+      {
+        id: text2("id").primaryKey().notNull(),
+        agentId: text2("agent_id").notNull(),
+        transportType: text2("transport_type").notNull().default("http"),
+        connectionId: text2("connection_id"),
+        connectedAt: integer2("connected_at").notNull(),
+        lastHeartbeat: integer2("last_heartbeat").notNull(),
+        connectionMetadata: text2("connection_metadata"),
+        createdAt: integer2("created_at").notNull()
+      },
+      (table) => [
+        index("idx_agent_connections_agent").on(table.agentId),
+        index("idx_agent_connections_transport").on(table.transportType),
+        index("idx_agent_connections_heartbeat").on(table.lastHeartbeat),
+        unique().on(table.agentId, table.connectionId)
+      ]
+    );
+    accounts = sqliteTable(
+      "accounts",
+      {
+        id: text2("id").primaryKey().notNull(),
+        userId: text2("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
+        accountId: text2("account_id").notNull(),
+        providerId: text2("provider_id").notNull(),
+        accessToken: text2("access_token"),
+        refreshToken: text2("refresh_token"),
+        idToken: text2("id_token"),
+        accessTokenExpiresAt: text2("access_token_expires_at"),
+        refreshTokenExpiresAt: text2("refresh_token_expires_at"),
+        scope: text2("scope"),
+        password: text2("password"),
+        createdAt: text2("created_at").notNull(),
+        updatedAt: text2("updated_at").notNull()
+      },
+      (table) => [
+        index("idx_accounts_user_id").on(table.userId),
+        unique("idx_accounts_provider").on(table.providerId, table.accountId)
+      ]
+    );
+    sessions = sqliteTable(
+      "sessions",
+      {
+        id: text2("id").primaryKey().notNull(),
+        userId: text2("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
+        token: text2("token").notNull().unique(),
+        ipAddress: text2("ip_address"),
+        userAgent: text2("user_agent"),
+        expiresAt: text2("expires_at").notNull(),
+        activeOrganizationId: text2("active_organization_id"),
+        impersonatedBy: text2("impersonated_by"),
+        active: integer2("active").notNull().default(1),
+        createdAt: text2("created_at").notNull(),
+        updatedAt: text2("updated_at").notNull()
+      },
+      (table) => [index("idx_sessions_user_id").on(table.userId)]
+    );
+    verifications = sqliteTable(
+      "verifications",
+      {
+        id: text2("id").primaryKey().notNull(),
+        identifier: text2("identifier").notNull(),
+        value: text2("value").notNull(),
+        expiresAt: text2("expires_at").notNull(),
+        createdAt: text2("created_at").notNull(),
+        updatedAt: text2("updated_at").notNull()
+      },
+      (table) => [index("idx_verifications_identifier").on(table.identifier)]
+    );
+    orgAgentKeys = sqliteTable(
+      "org_agent_keys",
+      {
+        id: text2("id").primaryKey().notNull(),
+        organizationId: text2("organization_id").notNull().references(() => organization.id, { onDelete: "cascade" }),
+        agentId: text2("agent_id").notNull().references(() => agents.id, { onDelete: "cascade" }),
+        createdBy: text2("created_by").notNull(),
+        createdAt: integer2("created_at").notNull()
+      },
+      (table) => [
+        index("org_agent_keys_org_idx").on(table.organizationId),
+        index("org_agent_keys_agent_idx").on(table.agentId)
+      ]
+    );
+  }
+});
+
 // packages/core/src/store/signaldock-sqlite.ts
 var signaldock_sqlite_exports = {};
 __export(signaldock_sqlite_exports, {
@@ -13976,11 +14288,12 @@ __export(signaldock_sqlite_exports, {
   ensureSignaldockDb: () => ensureSignaldockDb,
   getGlobalSignaldockDbPath: () => getGlobalSignaldockDbPath,
   getGlobalSignaldockNativeDb: () => getGlobalSignaldockNativeDb,
-  getSignaldockDbPath: () => getSignaldockDbPath
+  getSignaldockDbPath: () => getSignaldockDbPath,
+  resolveSignaldockMigrationsFolder: () => resolveSignaldockMigrationsFolder
 });
 import { existsSync as existsSync8, mkdirSync as mkdirSync3 } from "node:fs";
-import { createRequire as createRequire2 } from "node:module";
-import { join as join8 } from "node:path";
+import { dirname as dirname5, join as join8 } from "node:path";
+import { fileURLToPath as fileURLToPath2 } from "node:url";
 function getGlobalSignaldockDbPath() {
   const cleoHome = getCleoHome();
   const dbPath = join8(cleoHome, GLOBAL_SIGNALDOCK_DB_FILENAME);
@@ -13999,54 +14312,23 @@ function getSignaldockDbPath(cwd) {
   }
   return getGlobalSignaldockDbPath();
 }
-function readColumnSet(db, table) {
-  const rows = db.prepare(`PRAGMA table_info(${table})`).all();
-  return new Set(rows.map((r) => r.name));
-}
-function applyV3ColumnAlters(db) {
-  for (const [table, additions] of Object.entries(V3_COLUMN_ADDITIONS)) {
-    const existing = readColumnSet(db, table);
-    for (const { name: name2, ddl } of additions) {
-      if (!existing.has(name2)) {
-        db.exec(`ALTER TABLE ${table} ${ddl}`);
-      }
-    }
+function resolveSignaldockMigrationsFolder() {
+  const __filename = fileURLToPath2(import.meta.url);
+  let current = dirname5(__filename);
+  const root = "/";
+  for (let depth = 0; depth < 8 && current !== root; depth++) {
+    const candidate = join8(current, "migrations", "drizzle-signaldock");
+    if (existsSync8(candidate)) return candidate;
+    current = dirname5(current);
   }
+  const fallback = join8(dirname5(__filename), "..", "..", "migrations", "drizzle-signaldock");
+  return fallback;
 }
-function applyGlobalSignaldockSchema(db) {
-  db.exec(`
-    CREATE TABLE IF NOT EXISTS _signaldock_meta (
-      key TEXT PRIMARY KEY,
-      value TEXT NOT NULL,
-      updated_at INTEGER NOT NULL DEFAULT (strftime('%s', 'now'))
-    )
-  `);
-  db.exec(`
-    CREATE TABLE IF NOT EXISTS _signaldock_migrations (
-      name TEXT PRIMARY KEY,
-      applied_at INTEGER NOT NULL DEFAULT (strftime('%s', 'now'))
-    )
-  `);
-  for (const migration of GLOBAL_EMBEDDED_MIGRATIONS) {
-    const applied = db.prepare("SELECT name FROM _signaldock_migrations WHERE name = ?").get(migration.name);
-    if (applied) continue;
-    db.exec("BEGIN TRANSACTION");
-    try {
-      if (migration.preApply) {
-        migration.preApply(db);
-      }
-      db.exec(migration.sql);
-      db.prepare("INSERT INTO _signaldock_migrations (name) VALUES (?)").run(migration.name);
-      db.exec("COMMIT");
-    } catch (err) {
-      db.exec("ROLLBACK");
-      throw err;
-    }
-  }
-  db.exec(`
-    INSERT OR REPLACE INTO _signaldock_meta (key, value, updated_at)
-    VALUES ('schema_version', '${GLOBAL_SIGNALDOCK_SCHEMA_VERSION}', strftime('%s', 'now'))
-  `);
+function runSignaldockMigrations(nativeDb) {
+  const migrationsFolder = resolveSignaldockMigrationsFolder();
+  reconcileJournal(nativeDb, migrationsFolder, "agents", "signaldock");
+  const db = drizzle({ client: nativeDb, schema: signaldock_schema_exports });
+  migrateSanitized(db, { migrationsFolder });
 }
 async function ensureGlobalSignaldockDb() {
   const dbPath = getGlobalSignaldockDbPath();
@@ -14055,29 +14337,24 @@ async function ensureGlobalSignaldockDb() {
   if (!existsSync8(cleoHome)) {
     mkdirSync3(cleoHome, { recursive: true });
   }
-  const db = new DatabaseSyncClass(dbPath);
+  const nativeDb = openNativeDatabase(dbPath);
   try {
-    db.exec("PRAGMA journal_mode = WAL");
-    db.exec("PRAGMA busy_timeout = 5000");
-    db.exec("PRAGMA synchronous = NORMAL");
-    db.exec("PRAGMA foreign_keys = ON");
-    db.exec("PRAGMA cache_size = -64000");
     const hasSchema = (() => {
       try {
-        const result = db.prepare("SELECT name FROM sqlite_master WHERE type='table' AND name='agents'").get();
+        const result = nativeDb.prepare("SELECT name FROM sqlite_master WHERE type='table' AND name='agents'").get();
         return !!result;
       } catch {
         return false;
       }
     })();
-    applyGlobalSignaldockSchema(db);
-    _globalSignaldockNativeDb = db;
+    runSignaldockMigrations(nativeDb);
+    _globalSignaldockNativeDb = nativeDb;
     return {
       action: alreadyExists && hasSchema ? "exists" : "created",
       path: dbPath
     };
   } catch (err) {
-    db.close();
+    nativeDb.close();
     _globalSignaldockNativeDb = null;
     throw err;
   }
@@ -14102,19 +14379,28 @@ async function checkGlobalSignaldockDbHealth() {
       foreignKeysEnabled: false
     };
   }
-  const db = new DatabaseSyncClass(dbPath);
+  const nativeDb = openNativeDatabase(dbPath, { readonly: true });
   try {
-    const tables = db.prepare(
+    const tables = nativeDb.prepare(
       "SELECT COUNT(*) as count FROM sqlite_master WHERE type='table' AND name NOT LIKE 'sqlite_%'"
     ).get();
-    const journalMode = db.prepare("PRAGMA journal_mode").get();
-    const fkEnabled = db.prepare("PRAGMA foreign_keys").get();
+    const journalMode = nativeDb.prepare("PRAGMA journal_mode").get();
+    const fkEnabled = nativeDb.prepare("PRAGMA foreign_keys").get();
     let schemaVersion = null;
     try {
-      const meta3 = db.prepare("SELECT value FROM _signaldock_meta WHERE key = 'schema_version'").get();
-      schemaVersion = meta3?.value ?? null;
+      const journalRow = nativeDb.prepare('SELECT COUNT(*) as cnt FROM "__drizzle_migrations"').get();
+      if (journalRow && journalRow.cnt > 0) {
+        schemaVersion = GLOBAL_SIGNALDOCK_SCHEMA_VERSION;
+      }
     } catch {
     }
+    if (!schemaVersion) {
+      try {
+        const meta3 = nativeDb.prepare("SELECT value FROM _signaldock_meta WHERE key = 'schema_version'").get();
+        schemaVersion = meta3?.value ?? null;
+      } catch {
+      }
+    }
     return {
       exists: true,
       path: dbPath,
@@ -14124,7 +14410,7 @@ async function checkGlobalSignaldockDbHealth() {
       foreignKeysEnabled: fkEnabled.foreign_keys === 1
     };
   } finally {
-    db.close();
+    nativeDb.close();
   }
 }
 async function checkSignaldockDbHealth(cwd) {
@@ -14149,274 +14435,18 @@ function _resetGlobalSignaldockDb_TESTING_ONLY() {
     _globalSignaldockNativeDb = null;
   }
 }
-var _require2, DatabaseSyncClass, GLOBAL_SIGNALDOCK_DB_FILENAME, GLOBAL_SIGNALDOCK_SCHEMA_VERSION, SIGNALDOCK_SCHEMA_VERSION, GLOBAL_EMBEDDED_MIGRATIONS, V3_COLUMN_ADDITIONS, _globalSignaldockNativeDb;
+var GLOBAL_SIGNALDOCK_DB_FILENAME, GLOBAL_SIGNALDOCK_SCHEMA_VERSION, SIGNALDOCK_SCHEMA_VERSION, _globalSignaldockNativeDb;
 var init_signaldock_sqlite = __esm({
   "packages/core/src/store/signaldock-sqlite.ts"() {
     "use strict";
+    init_node_sqlite();
     init_paths();
-    _require2 = createRequire2(import.meta.url);
-    ({ DatabaseSync: DatabaseSyncClass } = _require2("node:sqlite"));
+    init_migration_manager();
+    init_signaldock_schema();
+    init_sqlite2();
     GLOBAL_SIGNALDOCK_DB_FILENAME = "signaldock.db";
     GLOBAL_SIGNALDOCK_SCHEMA_VERSION = "2026.4.12";
     SIGNALDOCK_SCHEMA_VERSION = GLOBAL_SIGNALDOCK_SCHEMA_VERSION;
-    GLOBAL_EMBEDDED_MIGRATIONS = [
-      {
-        name: "2026-04-12-000000_initial_global_signaldock",
-        sql: `-- Global-tier signaldock.db initial migration (T310, ADR-037 \xA72.2).
--- Consolidated from pre-T310 incremental migrations. Global identity and
--- cloud-sync tables only. Project-local messaging state is in conduit.db.
-
--- Cloud-sync: user accounts (zero rows in pure-local mode).
-CREATE TABLE IF NOT EXISTS users (
-    id TEXT PRIMARY KEY,
-    email TEXT NOT NULL UNIQUE,
-    password_hash TEXT NOT NULL,
-    name TEXT,
-    slug TEXT,
-    default_agent_id TEXT,
-    username TEXT,
-    display_username TEXT,
-    email_verified INTEGER NOT NULL DEFAULT 0,
-    image TEXT,
-    role TEXT NOT NULL DEFAULT 'user',
-    banned INTEGER NOT NULL DEFAULT 0,
-    ban_reason TEXT,
-    ban_expires TEXT,
-    two_factor_enabled INTEGER NOT NULL DEFAULT 0,
-    metadata TEXT,
-    created_at INTEGER NOT NULL,
-    updated_at INTEGER NOT NULL
-);
-CREATE UNIQUE INDEX IF NOT EXISTS idx_users_slug ON users(slug);
-
--- Cloud-sync: organization/team records.
-CREATE TABLE IF NOT EXISTS organization (
-    id TEXT PRIMARY KEY NOT NULL,
-    name TEXT NOT NULL,
-    slug TEXT,
-    logo TEXT,
-    metadata TEXT,
-    owner_id TEXT,
-    created_at INTEGER NOT NULL DEFAULT (strftime('%s','now')),
-    updated_at INTEGER NOT NULL DEFAULT (strftime('%s','now'))
-);
-CREATE UNIQUE INDEX IF NOT EXISTS idx_organization_slug ON organization(slug);
-
--- Global identity: canonical agent registry (cross-project).
--- api_key_encrypted uses KDF: HMAC-SHA256(machine-key || global-salt, agentId) \u2014 ADR-037 \xA75.
--- requires_reauth=1 is set during T310 migration for all pre-existing agents.
-CREATE TABLE IF NOT EXISTS agents (
-    id TEXT PRIMARY KEY,
-    agent_id TEXT NOT NULL UNIQUE,
-    name TEXT NOT NULL,
-    description TEXT,
-    class TEXT NOT NULL DEFAULT 'custom',
-    privacy_tier TEXT NOT NULL DEFAULT 'public',
-    owner_id TEXT REFERENCES users(id),
-    endpoint TEXT,
-    webhook_secret TEXT,
-    capabilities TEXT NOT NULL DEFAULT '[]',
-    skills TEXT NOT NULL DEFAULT '[]',
-    avatar TEXT,
-    messages_sent INTEGER NOT NULL DEFAULT 0,
-    messages_received INTEGER NOT NULL DEFAULT 0,
-    conversation_count INTEGER NOT NULL DEFAULT 0,
-    friend_count INTEGER NOT NULL DEFAULT 0,
-    status TEXT NOT NULL DEFAULT 'online',
-    last_seen INTEGER,
-    payment_config TEXT,
-    api_key_hash TEXT,
-    organization_id TEXT REFERENCES organization(id) ON DELETE SET NULL,
-    created_at INTEGER NOT NULL,
-    updated_at INTEGER NOT NULL,
-    transport_type TEXT NOT NULL DEFAULT 'http',
-    api_key_encrypted TEXT,
-    api_base_url TEXT NOT NULL DEFAULT 'https://api.signaldock.io',
-    classification TEXT,
-    transport_config TEXT NOT NULL DEFAULT '{}',
-    is_active INTEGER NOT NULL DEFAULT 1,
-    last_used_at INTEGER,
-    requires_reauth INTEGER NOT NULL DEFAULT 0
-);
-CREATE UNIQUE INDEX IF NOT EXISTS agents_agent_id_idx ON agents(agent_id);
-CREATE INDEX IF NOT EXISTS agents_owner_idx ON agents(owner_id);
-CREATE INDEX IF NOT EXISTS agents_class_idx ON agents(class);
-CREATE INDEX IF NOT EXISTS agents_privacy_idx ON agents(privacy_tier);
-CREATE INDEX IF NOT EXISTS agents_org_idx ON agents(organization_id);
-CREATE INDEX IF NOT EXISTS idx_agents_transport_type ON agents(transport_type);
-CREATE INDEX IF NOT EXISTS idx_agents_is_active ON agents(is_active);
-CREATE INDEX IF NOT EXISTS idx_agents_last_used ON agents(last_used_at);
-CREATE INDEX IF NOT EXISTS idx_agents_reauth ON agents(requires_reauth) WHERE requires_reauth = 1;
-
--- Cloud-sync: one-time agent claim tokens (api.signaldock.io provisioning).
-CREATE TABLE IF NOT EXISTS claim_codes (
-    id TEXT PRIMARY KEY,
-    agent_id TEXT NOT NULL REFERENCES agents(id),
-    code TEXT NOT NULL UNIQUE,
-    expires_at INTEGER NOT NULL,
-    used_at INTEGER,
-    used_by TEXT REFERENCES users(id),
-    created_at INTEGER NOT NULL
-);
-CREATE UNIQUE INDEX IF NOT EXISTS claim_codes_code_idx ON claim_codes(code);
-CREATE INDEX IF NOT EXISTS claim_codes_agent_idx ON claim_codes(agent_id);
-
--- Identity catalog: pre-seeded capability slugs (19 entries).
-CREATE TABLE IF NOT EXISTS capabilities (
-    id TEXT PRIMARY KEY,
-    slug TEXT NOT NULL UNIQUE,
-    name TEXT NOT NULL,
-    description TEXT NOT NULL,
-    category TEXT NOT NULL,
-    created_at INTEGER NOT NULL
-);
-
--- Identity catalog: pre-seeded skill slugs (36 entries).
-CREATE TABLE IF NOT EXISTS skills (
-    id TEXT PRIMARY KEY,
-    slug TEXT NOT NULL UNIQUE,
-    name TEXT NOT NULL,
-    description TEXT NOT NULL,
-    category TEXT NOT NULL,
-    created_at INTEGER NOT NULL
-);
-
--- Junction: agent <-> capability catalog bindings.
-CREATE TABLE IF NOT EXISTS agent_capabilities (
-    agent_id TEXT NOT NULL REFERENCES agents(id),
-    capability_id TEXT NOT NULL REFERENCES capabilities(id),
-    PRIMARY KEY (agent_id, capability_id)
-);
-
--- Junction: agent <-> skill catalog bindings.
-CREATE TABLE IF NOT EXISTS agent_skills (
-    agent_id TEXT NOT NULL REFERENCES agents(id),
-    skill_id TEXT NOT NULL REFERENCES skills(id),
-    PRIMARY KEY (agent_id, skill_id)
-);
-
--- Live transport connection tracking (heartbeat state).
-CREATE TABLE IF NOT EXISTS agent_connections (
-    id TEXT PRIMARY KEY NOT NULL,
-    agent_id TEXT NOT NULL,
-    transport_type TEXT NOT NULL DEFAULT 'http',
-    connection_id TEXT,
-    connected_at BIGINT NOT NULL,
-    last_heartbeat BIGINT NOT NULL,
-    connection_metadata TEXT,
-    created_at BIGINT NOT NULL,
-    FOREIGN KEY (agent_id) REFERENCES agents(agent_id) ON DELETE CASCADE,
-    UNIQUE(agent_id, connection_id)
-);
-CREATE INDEX IF NOT EXISTS idx_agent_connections_agent ON agent_connections(agent_id);
-CREATE INDEX IF NOT EXISTS idx_agent_connections_transport ON agent_connections(transport_type);
-CREATE INDEX IF NOT EXISTS idx_agent_connections_heartbeat ON agent_connections(last_heartbeat);
-
--- Cloud-sync: OAuth/provider accounts.
-CREATE TABLE IF NOT EXISTS accounts (
-    id TEXT PRIMARY KEY NOT NULL,
-    user_id TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
-    account_id TEXT NOT NULL,
-    provider_id TEXT NOT NULL,
-    access_token TEXT,
-    refresh_token TEXT,
-    id_token TEXT,
-    access_token_expires_at TEXT,
-    refresh_token_expires_at TEXT,
-    scope TEXT,
-    password TEXT,
-    created_at TEXT NOT NULL,
-    updated_at TEXT NOT NULL
-);
-CREATE INDEX IF NOT EXISTS idx_accounts_user_id ON accounts(user_id);
-CREATE UNIQUE INDEX IF NOT EXISTS idx_accounts_provider ON accounts(provider_id, account_id);
-
--- Cloud-sync: authenticated sessions.
-CREATE TABLE IF NOT EXISTS sessions (
-    id TEXT PRIMARY KEY NOT NULL,
-    user_id TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
-    token TEXT NOT NULL UNIQUE,
-    ip_address TEXT,
-    user_agent TEXT,
-    expires_at TEXT NOT NULL,
-    active_organization_id TEXT,
-    impersonated_by TEXT,
-    active INTEGER NOT NULL DEFAULT 1,
-    created_at TEXT NOT NULL,
-    updated_at TEXT NOT NULL
-);
-CREATE UNIQUE INDEX IF NOT EXISTS idx_sessions_token ON sessions(token);
-CREATE INDEX IF NOT EXISTS idx_sessions_user_id ON sessions(user_id);
-
--- Cloud-sync: email/2FA verification tokens.
-CREATE TABLE IF NOT EXISTS verifications (
-    id TEXT PRIMARY KEY NOT NULL,
-    identifier TEXT NOT NULL,
-    value TEXT NOT NULL,
-    expires_at TEXT NOT NULL,
-    created_at TEXT NOT NULL,
-    updated_at TEXT NOT NULL
-);
-CREATE INDEX IF NOT EXISTS idx_verifications_identifier ON verifications(identifier);
-
--- Org-scoped agent API keys (cloud use; zero rows locally).
-CREATE TABLE IF NOT EXISTS org_agent_keys (
-    id TEXT PRIMARY KEY NOT NULL,
-    organization_id TEXT NOT NULL REFERENCES organization(id) ON DELETE CASCADE,
-    agent_id TEXT NOT NULL REFERENCES agents(id) ON DELETE CASCADE,
-    created_by TEXT NOT NULL,
-    created_at INTEGER NOT NULL
-);
-CREATE INDEX IF NOT EXISTS org_agent_keys_org_idx ON org_agent_keys(organization_id);
-CREATE INDEX IF NOT EXISTS org_agent_keys_agent_idx ON org_agent_keys(agent_id);`
-      },
-      {
-        name: "2026-04-17-213120_T897_agent_registry_v3",
-        sql: `-- T889 / T897: agent_registry v3 \u2014 add tier, canSpawn, cantPath, checksum, orch fields.
--- Column additions are filtered at application time by applyV3ColumnAlters()
--- because SQLite does NOT support \`ADD COLUMN IF NOT EXISTS\`. Index creates
--- use IF NOT EXISTS natively.
-
-CREATE INDEX IF NOT EXISTS idx_agents_tier ON agents(tier);
-CREATE INDEX IF NOT EXISTS idx_agents_cant_path ON agents(cant_path);
-CREATE INDEX IF NOT EXISTS idx_agent_skills_source ON agent_skills(source);`,
-        preApply: applyV3ColumnAlters
-      }
-    ];
-    V3_COLUMN_ADDITIONS = {
-      agents: [
-        {
-          name: "tier",
-          ddl: "ADD COLUMN tier TEXT NOT NULL DEFAULT 'global' CHECK (tier IN ('project','global','packaged','fallback'))"
-        },
-        {
-          name: "can_spawn",
-          ddl: "ADD COLUMN can_spawn INTEGER NOT NULL DEFAULT 0 CHECK (can_spawn IN (0,1))"
-        },
-        {
-          name: "orch_level",
-          ddl: "ADD COLUMN orch_level INTEGER NOT NULL DEFAULT 2 CHECK (orch_level BETWEEN 0 AND 2)"
-        },
-        { name: "reports_to", ddl: "ADD COLUMN reports_to TEXT" },
-        { name: "cant_path", ddl: "ADD COLUMN cant_path TEXT" },
-        { name: "cant_sha256", ddl: "ADD COLUMN cant_sha256 TEXT" },
-        {
-          name: "installed_from",
-          ddl: "ADD COLUMN installed_from TEXT CHECK (installed_from IN ('seed','user','manual') OR installed_from IS NULL)"
-        },
-        { name: "installed_at", ddl: "ADD COLUMN installed_at TEXT" }
-      ],
-      agent_skills: [
-        {
-          name: "source",
-          ddl: "ADD COLUMN source TEXT NOT NULL DEFAULT 'manual' CHECK (source IN ('cant','manual','computed'))"
-        },
-        {
-          name: "attached_at",
-          ddl: "ADD COLUMN attached_at TEXT NOT NULL DEFAULT (datetime('now'))"
-        }
-      ]
-    };
     _globalSignaldockNativeDb = null;
   }
 });
@@ -14699,7 +14729,7 @@ var init_status_registry2 = __esm({
 });
 
 // packages/core/src/agents/agent-schema.ts
-import { sql as sql4 } from "drizzle-orm";
+import { sql as sql5 } from "drizzle-orm";
 var AGENT_INSTANCE_STATUSES2, AGENT_TYPES2, agentInstances, agentErrorLog;
 var init_agent_schema = __esm({
   "packages/core/src/agents/agent-schema.ts"() {
@@ -14732,8 +14762,8 @@ var init_agent_schema = __esm({
         // Application-layer validation via agentExistsInSignaldockDb (T238).
         sessionId: text2("session_id"),
         taskId: text2("task_id"),
-        startedAt: text2("started_at").notNull().default(sql4`(datetime('now'))`),
-        lastHeartbeat: text2("last_heartbeat").notNull().default(sql4`(datetime('now'))`),
+        startedAt: text2("started_at").notNull().default(sql5`(datetime('now'))`),
+        lastHeartbeat: text2("last_heartbeat").notNull().default(sql5`(datetime('now'))`),
         stoppedAt: text2("stopped_at"),
         errorCount: integer2("error_count").notNull().default(0),
         totalTasksCompleted: integer2("total_tasks_completed").notNull().default(0),
@@ -14760,7 +14790,7 @@ var init_agent_schema = __esm({
         }).notNull(),
         message: text2("message").notNull(),
         stack: text2("stack"),
-        occurredAt: text2("occurred_at").notNull().default(sql4`(datetime('now'))`),
+        occurredAt: text2("occurred_at").notNull().default(sql5`(datetime('now'))`),
         resolved: integer2("resolved", { mode: "boolean" }).notNull().default(false)
       },
       (table) => [
@@ -14773,7 +14803,7 @@ var init_agent_schema = __esm({
 });
 
 // packages/core/src/store/chain-schema.ts
-import { sql as sql5 } from "drizzle-orm";
+import { sql as sql6 } from "drizzle-orm";
 var warpChains, warpChainInstances;
 var init_chain_schema = __esm({
   "packages/core/src/store/chain-schema.ts"() {
@@ -14789,8 +14819,8 @@ var init_chain_schema = __esm({
         definition: text2("definition").notNull(),
         // JSON-serialized WarpChain
         validated: integer2("validated", { mode: "boolean" }).default(false),
-        createdAt: text2("created_at").default(sql5`(datetime('now'))`),
-        updatedAt: text2("updated_at").default(sql5`(datetime('now'))`)
+        createdAt: text2("created_at").default(sql6`(datetime('now'))`),
+        updatedAt: text2("updated_at").default(sql6`(datetime('now'))`)
       },
       (table) => [index("idx_warp_chains_name").on(table.name)]
     );
@@ -14808,8 +14838,8 @@ var init_chain_schema = __esm({
         currentStage: text2("current_stage"),
         gateResults: text2("gate_results"),
         // JSON array of GateResult
-        createdAt: text2("created_at").default(sql5`(datetime('now'))`),
-        updatedAt: text2("updated_at").default(sql5`(datetime('now'))`)
+        createdAt: text2("created_at").default(sql6`(datetime('now'))`),
+        updatedAt: text2("updated_at").default(sql6`(datetime('now'))`)
       },
       (table) => [
         index("idx_warp_instances_chain").on(table.chainId),
@@ -14870,7 +14900,7 @@ __export(tasks_schema_exports, {
   pipelineManifest: () => pipelineManifest,
   releaseManifests: () => releaseManifests,
   schemaMeta: () => schemaMeta,
-  sessions: () => sessions,
+  sessions: () => sessions2,
   statusRegistryTable: () => statusRegistryTable,
   taskDependencies: () => taskDependencies,
   taskRelations: () => taskRelations,
@@ -14880,8 +14910,8 @@ __export(tasks_schema_exports, {
   warpChainInstances: () => warpChainInstances,
   warpChains: () => warpChains
 });
-import { sql as sql6 } from "drizzle-orm";
-var TASK_PRIORITIES, TASK_TYPES, TASK_ROLES, TASK_SCOPES, TASK_SEVERITIES, TASK_SIZES, LIFECYCLE_STAGE_NAMES, LIFECYCLE_GATE_RESULTS, LIFECYCLE_EVIDENCE_TYPES, TOKEN_USAGE_METHODS, TOKEN_USAGE_CONFIDENCE, TOKEN_USAGE_TRANSPORTS, TASK_RELATION_TYPES, LIFECYCLE_TRANSITION_TYPES, EXTERNAL_LINK_TYPES, SYNC_DIRECTIONS, tasks, taskDependencies, taskRelations, sessions, taskWorkHistory, lifecyclePipelines, lifecycleStages, lifecycleGateResults, lifecycleEvidence, lifecycleTransitions, manifestEntries, pipelineManifest, releaseManifests, schemaMeta, auditLog, tokenUsage, architectureDecisions, adrTaskLinks, adrRelations, externalTaskLinks, BACKGROUND_JOB_STATUSES, backgroundJobs, statusRegistryTable, ATTACHMENT_OWNER_TYPES, attachments, attachmentRefs, experiments;
+import { sql as sql7 } from "drizzle-orm";
+var TASK_PRIORITIES, TASK_TYPES, TASK_ROLES, TASK_SCOPES, TASK_SEVERITIES, TASK_SIZES, LIFECYCLE_STAGE_NAMES, LIFECYCLE_GATE_RESULTS, LIFECYCLE_EVIDENCE_TYPES, TOKEN_USAGE_METHODS, TOKEN_USAGE_CONFIDENCE, TOKEN_USAGE_TRANSPORTS, TASK_RELATION_TYPES, LIFECYCLE_TRANSITION_TYPES, EXTERNAL_LINK_TYPES, SYNC_DIRECTIONS, tasks, taskDependencies, taskRelations, sessions2, taskWorkHistory, lifecyclePipelines, lifecycleStages, lifecycleGateResults, lifecycleEvidence, lifecycleTransitions, manifestEntries, pipelineManifest, releaseManifests, schemaMeta, auditLog, tokenUsage, architectureDecisions, adrTaskLinks, adrRelations, externalTaskLinks, BACKGROUND_JOB_STATUSES, backgroundJobs, statusRegistryTable, ATTACHMENT_OWNER_TYPES, attachments, attachmentRefs, experiments;
 var init_tasks_schema = __esm({
   "packages/core/src/store/tasks-schema.ts"() {
     "use strict";
@@ -14971,7 +15001,7 @@ var init_tasks_schema = __esm({
         epicLifecycle: text2("epic_lifecycle"),
         noAutoComplete: integer2("no_auto_complete", { mode: "boolean" }),
         // Timestamps
-        createdAt: text2("created_at").notNull().default(sql6`(datetime('now'))`),
+        createdAt: text2("created_at").notNull().default(sql7`(datetime('now'))`),
         updatedAt: text2("updated_at"),
         completedAt: text2("completed_at"),
         cancelledAt: text2("cancelled_at"),
@@ -14985,7 +15015,7 @@ var init_tasks_schema = __esm({
         // Provenance tracking
         createdBy: text2("created_by"),
         modifiedBy: text2("modified_by"),
-        sessionId: text2("session_id").references(() => sessions.id, {
+        sessionId: text2("session_id").references(() => sessions2.id, {
           onDelete: "set null"
         }),
         // T060: pipeline stage name (RCASD-IVTR+C). Stored as a plain stage name string.
@@ -15014,12 +15044,11 @@ var init_tasks_schema = __esm({
         // T944 role/scope axes
         index("idx_tasks_role").on(table.role),
         index("idx_tasks_scope").on(table.scope),
-        index("idx_tasks_role_status").on(table.role, table.status)
-        // T1126 — partial index for Tier-2 proposal rate-limiter.
-        // Drizzle ORM beta.22 does not support partial indexes in sqliteTable,
-        // so the canonical definition lives in the raw SQL migration:
-        //   packages/cleo/migrations/drizzle-tasks/20260421000001_t1126-sentient-proposal-index
-        // Re-run `drizzle-kit generate` will NOT emit this index.
+        index("idx_tasks_role_status").on(table.role, table.status),
+        // T1126 / T1174 — partial index now schema-expressed (see .where() call below).
+        // The corresponding migration is packages/core/migrations/drizzle-tasks/20260421000002_t1126-sentient-proposal-index/
+        // which remains in place for existing DBs' journal continuity.
+        index("idx_tasks_sentient_proposals_today").on(sql7`date(${table.createdAt})`).where(sql7`${table.labelsJson} LIKE '%sentient-tier2%'`)
       ]
     );
     taskDependencies = sqliteTable(
@@ -15048,7 +15077,7 @@ var init_tasks_schema = __esm({
         index("idx_task_relations_related_to").on(table.relatedTo)
       ]
     );
-    sessions = sqliteTable(
+    sessions2 = sqliteTable(
       "sessions",
       {
         id: text2("id").primaryKey(),
@@ -15066,13 +15095,13 @@ var init_tasks_schema = __esm({
         tasksCompletedJson: text2("tasks_completed_json").default("[]"),
         tasksCreatedJson: text2("tasks_created_json").default("[]"),
         handoffJson: text2("handoff_json"),
-        startedAt: text2("started_at").notNull().default(sql6`(datetime('now'))`),
+        startedAt: text2("started_at").notNull().default(sql7`(datetime('now'))`),
         endedAt: text2("ended_at"),
         // Session chain columns (T4959)
-        previousSessionId: text2("previous_session_id").references(() => sessions.id, {
+        previousSessionId: text2("previous_session_id").references(() => sessions2.id, {
           onDelete: "set null"
         }),
-        nextSessionId: text2("next_session_id").references(() => sessions.id, {
+        nextSessionId: text2("next_session_id").references(() => sessions2.id, {
           onDelete: "set null"
         }),
         agentIdentifier: text2("agent_identifier"),
@@ -15101,9 +15130,9 @@ var init_tasks_schema = __esm({
       "task_work_history",
       {
         id: integer2("id").primaryKey({ autoIncrement: true }),
-        sessionId: text2("session_id").notNull().references(() => sessions.id, { onDelete: "cascade" }),
+        sessionId: text2("session_id").notNull().references(() => sessions2.id, { onDelete: "cascade" }),
         taskId: text2("task_id").notNull().references(() => tasks.id, { onDelete: "cascade" }),
-        setAt: text2("set_at").notNull().default(sql6`(datetime('now'))`),
+        setAt: text2("set_at").notNull().default(sql7`(datetime('now'))`),
         clearedAt: text2("cleared_at")
       },
       (table) => [index("idx_work_history_session").on(table.sessionId)]
@@ -15117,9 +15146,9 @@ var init_tasks_schema = __esm({
           enum: LIFECYCLE_PIPELINE_STATUSES
         }).notNull().default("active"),
         currentStageId: text2("current_stage_id"),
-        startedAt: text2("started_at").notNull().default(sql6`(datetime('now'))`),
+        startedAt: text2("started_at").notNull().default(sql7`(datetime('now'))`),
         completedAt: text2("completed_at"),
-        updatedAt: text2("updated_at").default(sql6`(datetime('now'))`),
+        updatedAt: text2("updated_at").default(sql7`(datetime('now'))`),
         version: integer2("version").notNull().default(1)
       },
       (table) => [
@@ -15171,7 +15200,7 @@ var init_tasks_schema = __esm({
         result: text2("result", {
           enum: LIFECYCLE_GATE_RESULTS
         }).notNull(),
-        checkedAt: text2("checked_at").notNull().default(sql6`(datetime('now'))`),
+        checkedAt: text2("checked_at").notNull().default(sql7`(datetime('now'))`),
         checkedBy: text2("checked_by").notNull(),
         details: text2("details"),
         reason: text2("reason")
@@ -15187,7 +15216,7 @@ var init_tasks_schema = __esm({
         type: text2("type", {
           enum: LIFECYCLE_EVIDENCE_TYPES
         }).notNull(),
-        recordedAt: text2("recorded_at").notNull().default(sql6`(datetime('now'))`),
+        recordedAt: text2("recorded_at").notNull().default(sql7`(datetime('now'))`),
         recordedBy: text2("recorded_by"),
         description: text2("description")
       },
@@ -15204,7 +15233,7 @@ var init_tasks_schema = __esm({
           enum: LIFECYCLE_TRANSITION_TYPES
         }).notNull().default("automatic"),
         transitionedBy: text2("transitioned_by"),
-        createdAt: text2("created_at").notNull().default(sql6`(datetime('now'))`)
+        createdAt: text2("created_at").notNull().default(sql7`(datetime('now'))`)
       },
       (table) => [index("idx_lifecycle_transitions_pipeline_id").on(table.pipelineId)]
     );
@@ -15225,7 +15254,7 @@ var init_tasks_schema = __esm({
         findingsJson: text2("findings_json").default("[]"),
         linkedTasksJson: text2("linked_tasks_json").default("[]"),
         createdBy: text2("created_by"),
-        createdAt: text2("created_at").notNull().default(sql6`(datetime('now'))`)
+        createdAt: text2("created_at").notNull().default(sql7`(datetime('now'))`)
       },
       (table) => [
         index("idx_manifest_entries_pipeline_id").on(table.pipelineId),
@@ -15237,7 +15266,7 @@ var init_tasks_schema = __esm({
       "pipeline_manifest",
       {
         id: text2("id").primaryKey(),
-        sessionId: text2("session_id").references(() => sessions.id, { onDelete: "set null" }),
+        sessionId: text2("session_id").references(() => sessions2.id, { onDelete: "set null" }),
         taskId: text2("task_id").references(() => tasks.id, { onDelete: "set null" }),
         epicId: text2("epic_id").references(() => tasks.id, { onDelete: "set null" }),
         type: text2("type").notNull(),
@@ -15295,7 +15324,7 @@ var init_tasks_schema = __esm({
       "audit_log",
       {
         id: text2("id").primaryKey(),
-        timestamp: text2("timestamp").notNull().default(sql6`(datetime('now'))`),
+        timestamp: text2("timestamp").notNull().default(sql7`(datetime('now'))`),
         action: text2("action").notNull(),
         taskId: text2("task_id").notNull(),
         actor: text2("actor").notNull().default("system"),
@@ -15332,14 +15361,14 @@ var init_tasks_schema = __esm({
       "token_usage",
       {
         id: text2("id").primaryKey(),
-        createdAt: text2("created_at").notNull().default(sql6`(datetime('now'))`),
+        createdAt: text2("created_at").notNull().default(sql7`(datetime('now'))`),
         provider: text2("provider").notNull().default("unknown"),
         model: text2("model"),
         transport: text2("transport", { enum: TOKEN_USAGE_TRANSPORTS }).notNull().default("unknown"),
         gateway: text2("gateway"),
         domain: text2("domain"),
         operation: text2("operation"),
-        sessionId: text2("session_id").references(() => sessions.id, { onDelete: "set null" }),
+        sessionId: text2("session_id").references(() => sessions2.id, { onDelete: "set null" }),
         taskId: text2("task_id").references(() => tasks.id, { onDelete: "set null" }),
         requestId: text2("request_id"),
         inputChars: integer2("input_chars").notNull().default(0),
@@ -15384,7 +15413,7 @@ var init_tasks_schema = __esm({
           { onDelete: "set null" }
         ),
         content: text2("content").notNull(),
-        createdAt: text2("created_at").notNull().default(sql6`(datetime('now'))`),
+        createdAt: text2("created_at").notNull().default(sql7`(datetime('now'))`),
         updatedAt: text2("updated_at"),
         // ADR-017 §5.3 extension columns
         date: text2("date").notNull().default(""),
@@ -15454,7 +15483,7 @@ var init_tasks_schema = __esm({
         /** Arbitrary provider-specific metadata (JSON). */
         metadataJson: text2("metadata_json").default("{}"),
         /** When the link was first established. */
-        linkedAt: text2("linked_at").notNull().default(sql6`(datetime('now'))`),
+        linkedAt: text2("linked_at").notNull().default(sql7`(datetime('now'))`),
         /** When the external task was last synchronized. */
         lastSyncAt: text2("last_sync_at")
       },
@@ -15626,9 +15655,9 @@ __export(sqlite_exports, {
   schema: () => tasks_schema_exports
 });
 import { copyFileSync as copyFileSync4, existsSync as existsSync10, mkdirSync as mkdirSync5, renameSync, unlinkSync as unlinkSync2 } from "node:fs";
-import { createRequire as createRequire3 } from "node:module";
-import { dirname as dirname5, join as join10, resolve as resolve3, sep } from "node:path";
-import { fileURLToPath as fileURLToPath2 } from "node:url";
+import { createRequire as createRequire2 } from "node:module";
+import { dirname as dirname6, join as join10, resolve as resolve3, sep } from "node:path";
+import { fileURLToPath as fileURLToPath3 } from "node:url";
 import { eq as eq2 } from "drizzle-orm";
 function openNativeDatabase(path15, options) {
   const db = new DatabaseSync3(path15, {
@@ -15737,7 +15766,7 @@ async function getDb(cwd) {
   _initPromise = (async () => {
     const dbPath = requestedPath;
     _dbPath = dbPath;
-    mkdirSync5(dirname5(dbPath), { recursive: true });
+    mkdirSync5(dirname6(dbPath), { recursive: true });
     const nativeDb = openNativeDatabase(dbPath);
     _nativeDb = nativeDb;
     const db = drizzle({ client: nativeDb, schema: tasks_schema_exports });
@@ -15787,8 +15816,8 @@ async function getDb(cwd) {
   }
 }
 function resolveMigrationsFolder() {
-  const __filename = fileURLToPath2(import.meta.url);
-  const __dirname = dirname5(__filename);
+  const __filename = fileURLToPath3(import.meta.url);
+  const __dirname = dirname6(__filename);
   const isBundled = __dirname.endsWith("/dist") || __dirname.endsWith("\\dist");
   const pkgRoot = isBundled ? join10(__dirname, "..") : join10(__dirname, "..", "..");
   return join10(pkgRoot, "migrations", "drizzle-tasks");
@@ -15858,7 +15887,7 @@ async function closeAllDatabases() {
   } catch {
   }
 }
-var _require3, DatabaseSync3, DB_FILENAME2, SQLITE_SCHEMA_VERSION, SCHEMA_VERSION, _db, _nativeDb, _dbPath, _initPromise, _gitTrackingChecked, MIN_BACKUP_TASK_COUNT, REQUIRED_TASK_COLUMNS, REQUIRED_SESSION_COLUMNS;
+var _require2, DatabaseSync3, DB_FILENAME2, SQLITE_SCHEMA_VERSION, SCHEMA_VERSION, _db, _nativeDb, _dbPath, _initPromise, _gitTrackingChecked, MIN_BACKUP_TASK_COUNT, REQUIRED_TASK_COLUMNS, REQUIRED_SESSION_COLUMNS;
 var init_sqlite2 = __esm({
   "packages/core/src/store/sqlite.ts"() {
     "use strict";
@@ -15869,8 +15898,8 @@ var init_sqlite2 = __esm({
     init_sqlite_backup();
     init_tasks_schema();
     init_migration_manager();
-    _require3 = createRequire3(import.meta.url);
-    ({ DatabaseSync: DatabaseSync3 } = _require3("node:sqlite"));
+    _require2 = createRequire2(import.meta.url);
+    ({ DatabaseSync: DatabaseSync3 } = _require2("node:sqlite"));
     DB_FILENAME2 = "tasks.db";
     SQLITE_SCHEMA_VERSION = "2.0.0";
     SCHEMA_VERSION = SQLITE_SCHEMA_VERSION;
@@ -15908,11 +15937,11 @@ __export(atomic_exports, {
 });
 import { existsSync as existsSync11 } from "node:fs";
 import { mkdir, readFile, rename, unlink } from "node:fs/promises";
-import { dirname as dirname6 } from "node:path";
+import { dirname as dirname7 } from "node:path";
 import writeFileAtomic from "write-file-atomic";
 async function atomicWrite(filePath, data, options) {
   try {
-    await mkdir(dirname6(filePath), { recursive: true });
+    await mkdir(dirname7(filePath), { recursive: true });
     await writeFileAtomic(filePath, data, {
       encoding: options?.encoding ?? "utf8",
       mode: options?.mode
@@ -15989,8 +16018,8 @@ async function cleanupMigrationArtifacts(backupPath) {
 }
 async function validateSqliteDatabase(dbPath) {
   try {
-    const { createRequire: createRequire24 } = await import("node:module");
-    const _req = createRequire24(import.meta.url);
+    const { createRequire: createRequire23 } = await import("node:module");
+    const _req = createRequire23(import.meta.url);
     const { DatabaseSync: DatabaseSync11 } = _req("node:sqlite");
     const db = new DatabaseSync11(dbPath, { readOnly: true });
     const integrityRow = db.prepare("PRAGMA integrity_check").get();
@@ -16206,7 +16235,7 @@ __export(config_exports, {
 });
 import { existsSync as existsSync12 } from "node:fs";
 import { mkdir as mkdir3, writeFile } from "node:fs/promises";
-import { dirname as dirname7 } from "node:path";
+import { dirname as dirname8 } from "node:path";
 function getNestedValue(obj, path15) {
   const parts = path15.split(".");
   let current = obj;
@@ -16329,7 +16358,7 @@ function parseConfigValue(value) {
 async function setConfigValue(key, value, cwd, opts) {
   const configPath = opts?.global ? getGlobalConfigPath() : getConfigPath(cwd);
   if (!existsSync12(configPath)) {
-    const dir = dirname7(configPath);
+    const dir = dirname8(configPath);
     await mkdir3(dir, { recursive: true });
     await writeFile(configPath, "{}", "utf-8");
   }
@@ -16343,7 +16372,7 @@ async function applyStrictnessPreset(preset, cwd, opts) {
   const definition = STRICTNESS_PRESETS[preset];
   const configPath = opts?.global ? getGlobalConfigPath() : getConfigPath(cwd);
   if (!existsSync12(configPath)) {
-    const dir = dirname7(configPath);
+    const dir = dirname8(configPath);
     await mkdir3(dir, { recursive: true });
     await writeFile(configPath, "{}", "utf-8");
   }
@@ -16646,15 +16675,15 @@ __export(memory_sqlite_exports, {
   resolveBrainMigrationsFolder: () => resolveBrainMigrationsFolder
 });
 import { mkdirSync as mkdirSync6 } from "node:fs";
-import { createRequire as createRequire4 } from "node:module";
-import { dirname as dirname8, join as join12 } from "node:path";
-import { fileURLToPath as fileURLToPath3 } from "node:url";
+import { createRequire as createRequire3 } from "node:module";
+import { dirname as dirname9, join as join12 } from "node:path";
+import { fileURLToPath as fileURLToPath4 } from "node:url";
 function getBrainDbPath(cwd) {
   return join12(getCleoDirAbsolute(cwd), DB_FILENAME3);
 }
 function resolveBrainMigrationsFolder() {
-  const __filename = fileURLToPath3(import.meta.url);
-  const __dirname = dirname8(__filename);
+  const __filename = fileURLToPath4(import.meta.url);
+  const __dirname = dirname9(__filename);
   const isBundled = __dirname.endsWith("/dist") || __dirname.endsWith("\\dist");
   const pkgRoot = isBundled ? join12(__dirname, "..") : join12(__dirname, "..", "..");
   return join12(pkgRoot, "migrations", "drizzle-brain");
@@ -16869,7 +16898,7 @@ function runBrainMigrations(nativeDb, db) {
 }
 function loadBrainVecExtension(nativeDb) {
   try {
-    const sqliteVec = _require4("sqlite-vec");
+    const sqliteVec = _require3("sqlite-vec");
     sqliteVec.load(nativeDb);
     return true;
   } catch {
@@ -16905,7 +16934,7 @@ async function getBrainDb(cwd) {
   _initPromise2 = (async () => {
     const dbPath = requestedPath;
     _dbPath2 = dbPath;
-    mkdirSync6(dirname8(dbPath), { recursive: true });
+    mkdirSync6(dirname9(dbPath), { recursive: true });
     const nativeDb = openNativeDatabase(dbPath, { allowExtension: true });
     _nativeDb2 = nativeDb;
     _vecLoaded = loadBrainVecExtension(nativeDb);
@@ -16964,7 +16993,7 @@ function resetBrainDbState() {
 function getBrainNativeDb() {
   return _nativeDb2;
 }
-var _require4, DB_FILENAME3, BRAIN_SCHEMA_VERSION, _db2, _nativeDb2, _dbPath2, _initPromise2, _vecLoaded;
+var _require3, DB_FILENAME3, BRAIN_SCHEMA_VERSION, _db2, _nativeDb2, _dbPath2, _initPromise2, _vecLoaded;
 var init_memory_sqlite = __esm({
   "packages/core/src/store/memory-sqlite.ts"() {
     "use strict";
@@ -16973,7 +17002,7 @@ var init_memory_sqlite = __esm({
     init_memory_schema();
     init_migration_manager();
     init_sqlite2();
-    _require4 = createRequire4(import.meta.url);
+    _require3 = createRequire3(import.meta.url);
     DB_FILENAME3 = "brain.db";
     BRAIN_SCHEMA_VERSION = "1.0.0";
     _db2 = null;
@@ -17106,9 +17135,9 @@ async function reconcileOrphanedRefs(cwd) {
   return result;
 }
 async function sessionExistsInTasksDb(sessionId, tasksDb) {
-  const { sessions: sessions2 } = await Promise.resolve().then(() => (init_tasks_schema(), tasks_schema_exports));
+  const { sessions: sessions3 } = await Promise.resolve().then(() => (init_tasks_schema(), tasks_schema_exports));
   const { eq: eqOp } = await import("drizzle-orm");
-  const result = await tasksDb.select({ id: sessions2.id }).from(sessions2).where(eqOp(sessions2.id, sessionId)).all();
+  const result = await tasksDb.select({ id: sessions3.id }).from(sessions3).where(eqOp(sessions3.id, sessionId)).all();
   return result.length > 0;
 }
 var init_cross_db_cleanup = __esm({
@@ -17203,7 +17232,7 @@ async function upsertSession(db, session) {
     gradeMode: session.gradeMode ? 1 : null
   };
   const { id: _id, ...setFields } = values;
-  await db.insert(sessions).values(values).onConflictDoUpdate({ target: sessions.id, set: setFields }).run();
+  await db.insert(sessions2).values(values).onConflictDoUpdate({ target: sessions2.id, set: setFields }).run();
 }
 async function updateDependencies(db, taskId, depends, validIds) {
   await db.delete(taskDependencies).where(eq4(taskDependencies.taskId, taskId)).run();
@@ -17304,7 +17333,7 @@ __export(registry_exports2, {
   updateAgentStatus: () => updateAgentStatus
 });
 import { randomBytes } from "node:crypto";
-import { and as and3, eq as eq5, inArray as inArray3, lt as lt2, sql as sql7 } from "drizzle-orm";
+import { and as and3, eq as eq5, inArray as inArray3, lt as lt2, sql as sql8 } from "drizzle-orm";
 function generateAgentId() {
   const now2 = /* @__PURE__ */ new Date();
   const ts2 = now2.toISOString().replace(/[-:T]/g, "").substring(0, 14);
@@ -17386,7 +17415,7 @@ async function updateAgentStatus(id, opts, cwd) {
 }
 async function incrementTasksCompleted(id, cwd) {
   const db = await getDb(cwd);
-  await db.update(agentInstances).set({ totalTasksCompleted: sql7`${agentInstances.totalTasksCompleted} + 1` }).where(eq5(agentInstances.id, id));
+  await db.update(agentInstances).set({ totalTasksCompleted: sql8`${agentInstances.totalTasksCompleted} + 1` }).where(eq5(agentInstances.id, id));
 }
 async function listAgentInstances(filters, cwd) {
   const db = await getDb(cwd);
@@ -17532,7 +17561,7 @@ __export(sqlite_data_accessor_exports, {
   createSqliteDataAccessor: () => createSqliteDataAccessor,
   setMetaValue: () => setMetaValue
 });
-import { and as and4, eq as eq6, inArray as inArray4, isNull as isNull2, like as like2, ne as ne2, notInArray as notInArray2, or as or3, sql as sql8 } from "drizzle-orm";
+import { and as and4, eq as eq6, inArray as inArray4, isNull as isNull2, like as like2, ne as ne2, notInArray as notInArray2, or as or3, sql as sql9 } from "drizzle-orm";
 function generateAuditLogId() {
   const epoch = Math.floor(Date.now() / 1e3);
   const rand = Math.random().toString(36).slice(2, 8);
@@ -17629,21 +17658,21 @@ async function createSqliteDataAccessor(cwd) {
     // ---- loadSessions ----
     async loadSessions() {
       const db = await getDb(cwd);
-      const sessionRows = await db.select().from(sessions).all();
+      const sessionRows = await db.select().from(sessions2).all();
       return sessionRows.map(rowToSession);
     },
     // ---- saveSessions ----
-    async saveSessions(sessions2) {
+    async saveSessions(sessions3) {
       const db = await getDb(cwd);
-      const existingRows = await db.select({ id: sessions.id }).from(sessions).all();
+      const existingRows = await db.select({ id: sessions2.id }).from(sessions2).all();
       const existingIds = new Set(existingRows.map((r) => r.id));
-      const incomingIds = new Set(sessions2.map((s3) => s3.id));
+      const incomingIds = new Set(sessions3.map((s3) => s3.id));
       for (const eid of existingIds) {
         if (!incomingIds.has(eid)) {
-          await db.delete(sessions).where(eq6(sessions.id, eid)).run();
+          await db.delete(sessions2).where(eq6(sessions2.id, eid)).run();
         }
       }
-      for (const session of sessions2) {
+      for (const session of sessions3) {
         await upsertSession(db, session);
       }
     },
@@ -17722,7 +17751,7 @@ async function createSqliteDataAccessor(cwd) {
     },
     async getActiveSession() {
       const db = await getDb(cwd);
-      const rows = await db.select().from(sessions).where(eq6(sessions.status, "active")).orderBy(sql8`${sessions.startedAt} DESC`).limit(1).all();
+      const rows = await db.select().from(sessions2).where(eq6(sessions2.status, "active")).orderBy(sql9`${sessions2.startedAt} DESC`).limit(1).all();
       if (rows.length === 0 || !rows[0]) return null;
       return rowToSession(rows[0]);
     },
@@ -17732,7 +17761,7 @@ async function createSqliteDataAccessor(cwd) {
     },
     async removeSingleSession(sessionId) {
       const db = await getDb(cwd);
-      await db.delete(sessions).where(eq6(sessions.id, sessionId)).run();
+      await db.delete(sessions2).where(eq6(sessions2.id, sessionId)).run();
       void cleanupBrainRefsOnSessionDelete(sessionId, cwd);
     },
     // ---- Targeted query methods (Phase 2 modernization) ----
@@ -17777,24 +17806,24 @@ async function createSqliteDataAccessor(cwd) {
         conditions.push(like2(tasks.labelsJson, `%${JSON.stringify(filters.label)}%`));
       }
       const where = conditions.length > 0 ? and4(...conditions) : void 0;
-      const countResult = await db.select({ count: sql8`count(*)` }).from(tasks).where(where).get();
+      const countResult = await db.select({ count: sql9`count(*)` }).from(tasks).where(where).get();
       const total = countResult?.count ?? 0;
       let orderClause;
       switch (filters.orderBy) {
         case "createdAt":
-          orderClause = sql8`${tasks.createdAt} ASC`;
+          orderClause = sql9`${tasks.createdAt} ASC`;
           break;
         case "updatedAt":
-          orderClause = sql8`${tasks.updatedAt} DESC NULLS LAST`;
+          orderClause = sql9`${tasks.updatedAt} DESC NULLS LAST`;
           break;
         case "priority": {
-          orderClause = sql8`CASE ${tasks.priority}
+          orderClause = sql9`CASE ${tasks.priority}
             WHEN 'critical' THEN 0 WHEN 'high' THEN 1
             WHEN 'medium' THEN 2 WHEN 'low' THEN 3 ELSE 4 END ASC`;
           break;
         }
         default:
-          orderClause = sql8`${tasks.position} ASC, ${tasks.createdAt} ASC`;
+          orderClause = sql9`${tasks.position} ASC, ${tasks.createdAt} ASC`;
       }
       let query = db.select().from(tasks).where(where).orderBy(orderClause);
       if (filters.limit !== void 0) {
@@ -17825,12 +17854,12 @@ async function createSqliteDataAccessor(cwd) {
         conditions.push(eq6(tasks.parentId, filters.parentId));
       }
       const where = conditions.length > 0 ? and4(...conditions) : void 0;
-      const result = await db.select({ count: sql8`count(*)` }).from(tasks).where(where).get();
+      const result = await db.select({ count: sql9`count(*)` }).from(tasks).where(where).get();
       return result?.count ?? 0;
     },
     async getChildren(parentId) {
       const db = await getDb(cwd);
-      const rows = await db.select().from(tasks).where(and4(eq6(tasks.parentId, parentId), ne2(tasks.status, "archived"))).orderBy(sql8`${tasks.position} ASC, ${tasks.createdAt} ASC`).all();
+      const rows = await db.select().from(tasks).where(and4(eq6(tasks.parentId, parentId), ne2(tasks.status, "archived"))).orderBy(sql9`${tasks.position} ASC, ${tasks.createdAt} ASC`).all();
       const tasks2 = rows.map(rowToTask);
       if (tasks2.length > 0) {
         const allIds = await getAllTaskIds();
@@ -17841,12 +17870,12 @@ async function createSqliteDataAccessor(cwd) {
     },
     async countChildren(parentId) {
       const db = await getDb(cwd);
-      const result = await db.select({ count: sql8`count(*)` }).from(tasks).where(and4(eq6(tasks.parentId, parentId), ne2(tasks.status, "archived"))).get();
+      const result = await db.select({ count: sql9`count(*)` }).from(tasks).where(and4(eq6(tasks.parentId, parentId), ne2(tasks.status, "archived"))).get();
       return result?.count ?? 0;
     },
     async countActiveChildren(parentId) {
       const db = await getDb(cwd);
-      const result = await db.select({ count: sql8`count(*)` }).from(tasks).where(
+      const result = await db.select({ count: sql9`count(*)` }).from(tasks).where(
         and4(
           eq6(tasks.parentId, parentId),
           notInArray2(tasks.status, [...TERMINAL_TASK_STATUSES])
@@ -21239,19 +21268,19 @@ async function updateCapacity(id, capacity, cwd) {
   return { ...existing, capacity: capacityStr };
 }
 async function getAvailableCapacity(cwd) {
-  const agents = await listAgentInstances({ status: ["active", "idle"] }, cwd);
-  return agents.reduce((sum, agent) => sum + parseCapacity(agent.capacity), 0);
+  const agents2 = await listAgentInstances({ status: ["active", "idle"] }, cwd);
+  return agents2.reduce((sum, agent) => sum + parseCapacity(agent.capacity), 0);
 }
 async function findLeastLoadedAgent(agentType, cwd) {
   const filters = agentType ? { status: ["active", "idle"], agentType } : { status: ["active", "idle"] };
-  const agents = await listAgentInstances(filters, cwd);
-  if (agents.length === 0) return null;
-  let best = agents[0];
+  const agents2 = await listAgentInstances(filters, cwd);
+  if (agents2.length === 0) return null;
+  let best = agents2[0];
   let bestCapacity = parseCapacity(best.capacity);
-  for (let i = 1; i < agents.length; i++) {
-    const cap = parseCapacity(agents[i].capacity);
+  for (let i = 1; i < agents2.length; i++) {
+    const cap = parseCapacity(agents2[i].capacity);
     if (cap > bestCapacity) {
-      best = agents[i];
+      best = agents2[i];
       bestCapacity = cap;
     }
   }
@@ -21262,9 +21291,9 @@ async function isOverloaded(threshold = 0.1, cwd) {
   return capacity < threshold;
 }
 async function getCapacitySummary(threshold = 0.1, cwd) {
-  const agents = await listAgentInstances({ status: ["active", "idle"] }, cwd);
-  const totalCapacity = agents.reduce((sum, a) => sum + parseCapacity(a.capacity), 0);
-  const activeAgentCount = agents.length;
+  const agents2 = await listAgentInstances({ status: ["active", "idle"] }, cwd);
+  const totalCapacity = agents2.reduce((sum, a) => sum + parseCapacity(a.capacity), 0);
+  const activeAgentCount = agents2.length;
   return {
     totalCapacity,
     activeAgentCount,
@@ -21307,8 +21336,8 @@ async function checkAgentHealth2(agentId, thresholdMs = STALE_THRESHOLD_MS, cwd)
   return buildHealthStatus(agent, thresholdMs);
 }
 async function detectStaleAgents(thresholdMs = STALE_THRESHOLD_MS, cwd) {
-  const agents = await listAgentInstances({ status: ALIVE_STATUSES }, cwd);
-  return agents.map((a) => buildHealthStatus(a, thresholdMs)).filter((s3) => s3.stale).sort((a, b2) => b2.heartbeatAgeMs - a.heartbeatAgeMs);
+  const agents2 = await listAgentInstances({ status: ALIVE_STATUSES }, cwd);
+  return agents2.map((a) => buildHealthStatus(a, thresholdMs)).filter((s3) => s3.stale).sort((a, b2) => b2.heartbeatAgeMs - a.heartbeatAgeMs);
 }
 async function detectCrashedAgents(thresholdMs = STALE_THRESHOLD_MS, cwd) {
   const activeAgents = await listAgentInstances({ status: "active" }, cwd);
@@ -21740,9 +21769,9 @@ function checkProviderCapability(provider, capabilityPath) {
   }
   return providerSupports(provider, capabilityPath);
 }
-function checkProviderCapabilities(providerId, capabilities) {
+function checkProviderCapabilities(providerId, capabilities2) {
   const results = {};
-  for (const cap of capabilities) {
+  for (const cap of capabilities2) {
     results[cap] = providerSupportsById(providerId, cap);
   }
   return results;
@@ -21836,11 +21865,11 @@ var init_tree_sitter_languages = __esm({
 
 // packages/nexus/src/code/parser.ts
 import { readFileSync as readFileSync8 } from "node:fs";
-import { createRequire as createRequire5 } from "node:module";
+import { createRequire as createRequire4 } from "node:module";
 import { relative } from "node:path";
 function tryRequire(id) {
   try {
-    return _require5(id);
+    return _require4(id);
   } catch {
     return null;
   }
@@ -22032,12 +22061,12 @@ function batchParse(filePaths, projectRoot) {
   const totalSymbols = results.reduce((sum, r) => sum + r.symbols.length, 0);
   return { results, skipped, totalSymbols };
 }
-var _require5, _ParserClass, _QueryClass, _parserInstance, _availabilityChecked, _available, _grammarCache, GRAMMAR_SPECS, QUERY_PATTERNS, _queryCache;
+var _require4, _ParserClass, _QueryClass, _parserInstance, _availabilityChecked, _available, _grammarCache, GRAMMAR_SPECS, QUERY_PATTERNS, _queryCache;
 var init_parser = __esm({
   "packages/nexus/src/code/parser.ts"() {
     "use strict";
     init_tree_sitter_languages();
-    _require5 = createRequire5(import.meta.url);
+    _require4 = createRequire4(import.meta.url);
     _ParserClass = null;
     _QueryClass = null;
     _parserInstance = null;
@@ -24306,7 +24335,7 @@ var init_leiden = __esm({
 });
 
 // packages/nexus/src/pipeline/community-processor.ts
-import { createRequire as createRequire6 } from "node:module";
+import { createRequire as createRequire5 } from "node:module";
 async function detectCommunities(graph) {
   let symbolCount = 0;
   for (const node of graph.nodes.values()) {
@@ -24536,13 +24565,13 @@ function calculateCohesion(memberIds, gGraph) {
   if (totalEdges === 0) return 1;
   return Math.min(1, internalEdges / totalEdges);
 }
-var _require6, GraphCtor, CLUSTERING_EDGE_TYPES, SYMBOL_KINDS, MIN_CONFIDENCE_LARGE, LEIDEN_RESOLUTION;
+var _require5, GraphCtor, CLUSTERING_EDGE_TYPES, SYMBOL_KINDS, MIN_CONFIDENCE_LARGE, LEIDEN_RESOLUTION;
 var init_community_processor = __esm({
   "packages/nexus/src/pipeline/community-processor.ts"() {
     "use strict";
     init_leiden();
-    _require6 = createRequire6(import.meta.url);
-    GraphCtor = _require6("graphology");
+    _require5 = createRequire5(import.meta.url);
+    GraphCtor = _require5("graphology");
     CLUSTERING_EDGE_TYPES = /* @__PURE__ */ new Set(["calls", "extends", "implements"]);
     SYMBOL_KINDS = /* @__PURE__ */ new Set(["function", "method", "class", "interface"]);
     MIN_CONFIDENCE_LARGE = 0.5;
@@ -26835,10 +26864,10 @@ var init_rust_extractor = __esm({
 // packages/nexus/src/pipeline/workers/worker-pool.ts
 import fs5 from "node:fs";
 import os from "node:os";
-import { fileURLToPath as fileURLToPath4 } from "node:url";
+import { fileURLToPath as fileURLToPath5 } from "node:url";
 import { Worker } from "node:worker_threads";
 function createWorkerPool(workerUrl, poolSize) {
-  const workerPath = fileURLToPath4(workerUrl);
+  const workerPath = fileURLToPath5(workerUrl);
   if (!fs5.existsSync(workerPath)) {
     throw new Error(`Worker script not found: ${workerPath}`);
   }
@@ -26961,12 +26990,12 @@ var init_worker_pool = __esm({
 
 // packages/nexus/src/pipeline/parse-loop.ts
 import fs6 from "node:fs/promises";
-import { fileURLToPath as fileURLToPath5 } from "node:url";
-import { createRequire as createRequire7 } from "node:module";
+import { fileURLToPath as fileURLToPath6 } from "node:url";
+import { createRequire as createRequire6 } from "node:module";
 function getParserClass() {
   if (_available2 !== null) return _ParserClass2;
   try {
-    const mod = _require7("tree-sitter");
+    const mod = _require6("tree-sitter");
     _ParserClass2 = mod;
     _available2 = true;
   } catch {
@@ -26989,7 +27018,7 @@ function loadGrammar2(langKey) {
     return null;
   }
   try {
-    const mod = _require7(spec.pkg);
+    const mod = _require6(spec.pkg);
     const grammar = spec.prop ? mod[spec.prop] : mod;
     _grammarCache2.set(langKey, grammar ?? null);
     return grammar ?? null;
@@ -27058,7 +27087,7 @@ async function runParallelParseLoop(parseableFiles, graph, symbolTable, importCt
   let workerUrl;
   try {
     workerUrl = new URL("./workers/parse-worker.js", import.meta.url);
-    const workerPath = fileURLToPath5(workerUrl);
+    const workerPath = fileURLToPath6(workerUrl);
     const { existsSync: existsSync148 } = await import("node:fs");
     if (!existsSync148(workerPath)) {
       return null;
@@ -27367,7 +27396,7 @@ async function runParseLoop(files, graph, symbolTable, importCtx, repoPath, opti
   );
   return { allHeritage, allCalls, barrelMap };
 }
-var WORKER_FILE_THRESHOLD, WORKER_BYTE_THRESHOLD, _require7, _ParserClass2, _parserInstance2, _available2, _grammarCache2, GRAMMAR_SPECS2, TREE_SITTER_MAX_CHARS;
+var WORKER_FILE_THRESHOLD, WORKER_BYTE_THRESHOLD, _require6, _ParserClass2, _parserInstance2, _available2, _grammarCache2, GRAMMAR_SPECS2, TREE_SITTER_MAX_CHARS;
 var init_parse_loop = __esm({
   "packages/nexus/src/pipeline/parse-loop.ts"() {
     "use strict";
@@ -27380,7 +27409,7 @@ var init_parse_loop = __esm({
     init_worker_pool();
     WORKER_FILE_THRESHOLD = 15;
     WORKER_BYTE_THRESHOLD = 512 * 1024;
-    _require7 = createRequire7(import.meta.url);
+    _require6 = createRequire6(import.meta.url);
     _ParserClass2 = null;
     _parserInstance2 = null;
     _available2 = null;
@@ -30084,8 +30113,8 @@ function checkFts5Available(nativeDb) {
   }
   return _fts5Available;
 }
-function execDDL(nativeDb, sql18) {
-  nativeDb.prepare(sql18).run();
+function execDDL(nativeDb, sql19) {
+  nativeDb.prepare(sql19).run();
 }
 function ensureFts5Tables(nativeDb) {
   if (!checkFts5Available(nativeDb)) {
@@ -30703,8 +30732,8 @@ import { execFile as execFile2 } from "node:child_process";
 import { promisify as promisify2 } from "node:util";
 async function computeHandoff(projectRoot, options) {
   const accessor = await getAccessor(projectRoot);
-  const sessions2 = await accessor.loadSessions();
-  const session = sessions2.find((s3) => s3.id === options.sessionId);
+  const sessions3 = await accessor.loadSessions();
+  const session = sessions3.find((s3) => s3.id === options.sessionId);
   if (!session) {
     throw new CleoError(31 /* SESSION_NOT_FOUND */, `Session '${options.sessionId}' not found`);
   }
@@ -30789,8 +30818,8 @@ function getScopeTaskIds(session, tasks2) {
 }
 async function persistHandoff(projectRoot, sessionId, handoff) {
   const accessor = await getAccessor(projectRoot);
-  const sessions2 = await accessor.loadSessions();
-  const session = sessions2.find((s3) => s3.id === sessionId);
+  const sessions3 = await accessor.loadSessions();
+  const session = sessions3.find((s3) => s3.id === sessionId);
   if (!session) {
     throw new CleoError(31 /* SESSION_NOT_FOUND */, `Session '${sessionId}' not found`);
   }
@@ -30799,8 +30828,8 @@ async function persistHandoff(projectRoot, sessionId, handoff) {
 }
 async function getHandoff(projectRoot, sessionId) {
   const accessor = await getAccessor(projectRoot);
-  const sessions2 = await accessor.loadSessions();
-  const session = sessions2.find((s3) => s3.id === sessionId);
+  const sessions3 = await accessor.loadSessions();
+  const session = sessions3.find((s3) => s3.id === sessionId);
   if (!session) return null;
   if (typeof session.handoffJson === "string") {
     try {
@@ -30812,8 +30841,8 @@ async function getHandoff(projectRoot, sessionId) {
 }
 async function getLastHandoff(projectRoot, scope) {
   const accessor = await getAccessor(projectRoot);
-  const sessions2 = await accessor.loadSessions();
-  let endedSessions = sessions2.filter((s3) => s3.status === "ended" && s3.endedAt);
+  const sessions3 = await accessor.loadSessions();
+  let endedSessions = sessions3.filter((s3) => s3.status === "ended" && s3.endedAt);
   if (scope) {
     endedSessions = endedSessions.filter((s3) => {
       if (scope.type === "global") {
@@ -30903,8 +30932,8 @@ async function captureGitState(projectRoot) {
 async function computeChainPosition(projectRoot, sessionId) {
   try {
     const accessor = await getAccessor(projectRoot);
-    const sessions2 = await accessor.loadSessions();
-    const sessionMap = new Map(sessions2.map((s3) => [s3.id, s3]));
+    const sessions3 = await accessor.loadSessions();
+    const sessionMap = new Map(sessions3.map((s3) => [s3.id, s3]));
     let current = sessionId;
     let position = 1;
     const visited = /* @__PURE__ */ new Set();
@@ -30967,8 +30996,8 @@ __export(memory_bridge_exports, {
 });
 import { existsSync as existsSync29, mkdirSync as mkdirSync8, readFileSync as readFileSync18, writeFileSync as writeFileSync2 } from "node:fs";
 import { join as join32 } from "node:path";
-function typedAll2(db, sql18, ...params) {
-  return db.prepare(sql18).all(...params);
+function typedAll2(db, sql19, ...params) {
+  return db.prepare(sql19).all(...params);
 }
 async function generateMemoryBridgeContent(projectRoot, config2) {
   const cfg = { ...DEFAULT_CONFIG2, ...config2 };
@@ -31269,7 +31298,7 @@ var init_memory_bridge = __esm({
 
 // packages/core/src/sessions/agent-session-adapter.ts
 import { appendFile, mkdir as mkdir4 } from "node:fs/promises";
-import { dirname as dirname9, resolve as resolvePath } from "node:path";
+import { dirname as dirname10, resolve as resolvePath } from "node:path";
 function getReceiptsAuditPath(projectRoot) {
   return resolvePath(projectRoot, ".cleo", "audit", "receipts.jsonl");
 }
@@ -31360,7 +31389,7 @@ async function wrapWithAgentSession(options, fn2) {
 }
 async function persistReceipt(projectRoot, receipt) {
   const path15 = getReceiptsAuditPath(projectRoot);
-  await mkdir4(dirname9(path15), { recursive: true });
+  await mkdir4(dirname10(path15), { recursive: true });
   const line2 = `${JSON.stringify(receipt)}
 `;
   await appendFile(path15, line2, { encoding: "utf-8" });
@@ -53755,7 +53784,7 @@ __export(graph_memory_bridge_exports, {
   queryMemoriesForCode: () => queryMemoriesForCode
 });
 import { existsSync as existsSync32 } from "node:fs";
-import { createRequire as createRequire8 } from "node:module";
+import { createRequire as createRequire7 } from "node:module";
 function extractFilePaths(text3) {
   const paths = /* @__PURE__ */ new Set();
   for (const m2 of text3.matchAll(FILE_PATH_PATTERN)) {
@@ -54358,7 +54387,7 @@ async function linkConduitMessagesToSymbols(projectRoot) {
   }
   return result;
 }
-var _require8, DatabaseSync4, FILE_PATH_PATTERN, SYMBOL_PATTERN, SYMBOL_STOP_WORDS2;
+var _require7, DatabaseSync4, FILE_PATH_PATTERN, SYMBOL_PATTERN, SYMBOL_STOP_WORDS2;
 var init_graph_memory_bridge = __esm({
   "packages/core/src/memory/graph-memory-bridge.ts"() {
     "use strict";
@@ -54367,8 +54396,8 @@ var init_graph_memory_bridge = __esm({
     init_memory_sqlite();
     init_nexus_sqlite();
     init_typed_query();
-    _require8 = createRequire8(import.meta.url);
-    ({ DatabaseSync: DatabaseSync4 } = _require8("node:sqlite"));
+    _require7 = createRequire7(import.meta.url);
+    ({ DatabaseSync: DatabaseSync4 } = _require7("node:sqlite"));
     FILE_PATH_PATTERN = /(?:^|\s|['"`(])([a-zA-Z0-9_\-./]+\.(?:ts|tsx|js|jsx|rs|go|py|mjs|cjs))(?:$|\s|['"`)])/g;
     SYMBOL_PATTERN = /\b([a-zA-Z_][a-zA-Z0-9_]*(?:[A-Z][a-zA-Z0-9_]*)+|[a-zA-Z_]{4,}[a-zA-Z0-9_]*)\b/g;
     SYMBOL_STOP_WORDS2 = /* @__PURE__ */ new Set([
@@ -58704,14 +58733,14 @@ var init_intelligence_hooks = __esm({
 // packages/core/src/conduit/local-transport.ts
 import { randomUUID as randomUUID2 } from "node:crypto";
 import { existsSync as existsSync33 } from "node:fs";
-import { createRequire as createRequire9 } from "node:module";
-var _require9, DatabaseSyncClass2, LocalTransport;
+import { createRequire as createRequire8 } from "node:module";
+var _require8, DatabaseSyncClass, LocalTransport;
 var init_local_transport = __esm({
   "packages/core/src/conduit/local-transport.ts"() {
     "use strict";
     init_conduit_sqlite();
-    _require9 = createRequire9(import.meta.url);
-    ({ DatabaseSync: DatabaseSyncClass2 } = _require9("node:sqlite"));
+    _require8 = createRequire8(import.meta.url);
+    ({ DatabaseSync: DatabaseSyncClass } = _require8("node:sqlite"));
     LocalTransport = class {
       name = "local";
       state = null;
@@ -58730,7 +58759,7 @@ var init_local_transport = __esm({
         if (!existsSync33(dbPath)) {
           throw new Error(`LocalTransport: conduit.db not found at ${dbPath}. Run: cleo init`);
         }
-        const db = new DatabaseSyncClass2(dbPath);
+        const db = new DatabaseSyncClass(dbPath);
         db.exec("PRAGMA journal_mode = WAL");
         db.exec("PRAGMA busy_timeout = 5000");
         db.exec("PRAGMA foreign_keys = ON");
@@ -59556,7 +59585,7 @@ __export(pipeline_exports, {
   listPipelines: () => listPipelines,
   pipelineExists: () => pipelineExists
 });
-import { and as and8, asc as asc3, desc as desc3, eq as eq11, sql as sql9 } from "drizzle-orm";
+import { and as and8, asc as asc3, desc as desc3, eq as eq11, sql as sql10 } from "drizzle-orm";
 async function initializePipeline(taskId, options = {}) {
   const db = await getDb();
   const now2 = /* @__PURE__ */ new Date();
@@ -59617,7 +59646,7 @@ async function getPipeline(taskId) {
   }
   const row = result[0];
   const isActive = row.status === "active";
-  const transitionResult = await db.select({ count: sql9`count(*)` }).from(lifecycleTransitions).where(eq11(lifecycleTransitions.pipelineId, row.id)).all();
+  const transitionResult = await db.select({ count: sql10`count(*)` }).from(lifecycleTransitions).where(eq11(lifecycleTransitions.pipelineId, row.id)).all();
   const transitionCount = Number(transitionResult[0]?.count || 0);
   return {
     id: taskId,
@@ -59748,7 +59777,7 @@ async function listPipelines(options = {}) {
   return Promise.all(
     results.map(async (row) => {
       const isActive = row.status === "active";
-      const transitionResult = await db.select({ count: sql9`count(*)` }).from(lifecycleTransitions).where(eq11(lifecycleTransitions.pipelineId, row.id)).all();
+      const transitionResult = await db.select({ count: sql10`count(*)` }).from(lifecycleTransitions).where(eq11(lifecycleTransitions.pipelineId, row.id)).all();
       const transitionCount = Number(transitionResult[0]?.count || 0);
       return {
         id: row.taskId,
@@ -59826,16 +59855,16 @@ async function cancelPipeline(taskId, reason) {
 }
 async function pipelineExists(taskId) {
   const db = await getDb();
-  const result = await db.select({ count: sql9`count(*)` }).from(lifecyclePipelines).where(eq11(lifecyclePipelines.taskId, taskId)).all();
+  const result = await db.select({ count: sql10`count(*)` }).from(lifecyclePipelines).where(eq11(lifecyclePipelines.taskId, taskId)).all();
   return (result[0]?.count || 0) > 0;
 }
 async function getPipelineStatistics() {
   const db = await getDb();
-  const totalResult = await db.select({ count: sql9`count(*)` }).from(lifecyclePipelines).all();
+  const totalResult = await db.select({ count: sql10`count(*)` }).from(lifecyclePipelines).all();
   const total = Number(totalResult[0]?.count || 0);
   const byStatusResult = await db.select({
     status: lifecyclePipelines.status,
-    count: sql9`count(*)`
+    count: sql10`count(*)`
   }).from(lifecyclePipelines).groupBy(lifecyclePipelines.status).all();
   const byStatus = {
     active: 0,
@@ -59853,7 +59882,7 @@ async function getPipelineStatistics() {
   }
   const byStageResult = await db.select({
     stage: lifecyclePipelines.currentStageId,
-    count: sql9`count(*)`
+    count: sql10`count(*)`
   }).from(lifecyclePipelines).groupBy(lifecyclePipelines.currentStageId).all();
   const byStage = {};
   for (const row of byStageResult) {
@@ -60191,15 +60220,15 @@ var init_briefing = __esm({
 
 // packages/core/src/sessions/find.ts
 async function findSessions(accessor, params) {
-  let sessions2 = await accessor.loadSessions();
+  let sessions3 = await accessor.loadSessions();
   if (params?.status) {
-    sessions2 = sessions2.filter((s3) => s3.status === params.status);
+    sessions3 = sessions3.filter((s3) => s3.status === params.status);
   }
   if (params?.scope) {
     const scopeParts = params.scope.split(":");
     const scopeType = scopeParts[0];
     const scopeId = scopeParts[1];
-    sessions2 = sessions2.filter((s3) => {
+    sessions3 = sessions3.filter((s3) => {
       if (s3.scope.type !== scopeType) return false;
       if (scopeId && s3.scope.rootTaskId !== scopeId && s3.scope.epicId !== scopeId) return false;
       return true;
@@ -60207,15 +60236,15 @@ async function findSessions(accessor, params) {
   }
   if (params?.query) {
     const q2 = params.query.toLowerCase();
-    sessions2 = sessions2.filter(
+    sessions3 = sessions3.filter(
       (s3) => s3.id.toLowerCase().includes(q2) || s3.name.toLowerCase().includes(q2)
     );
   }
-  sessions2.sort((a, b2) => new Date(b2.startedAt).getTime() - new Date(a.startedAt).getTime());
+  sessions3.sort((a, b2) => new Date(b2.startedAt).getTime() - new Date(a.startedAt).getTime());
   if (params?.limit && params.limit > 0) {
-    sessions2 = sessions2.slice(0, params.limit);
+    sessions3 = sessions3.slice(0, params.limit);
   }
-  return sessions2.map(toMinimal);
+  return sessions3.map(toMinimal);
 }
 function toMinimal(s3) {
   return {
@@ -60237,12 +60266,12 @@ var init_find2 = __esm({
 // packages/core/src/sessions/session-archive.ts
 async function archiveSessions(projectRoot, olderThan) {
   const accessor = await getAccessor(projectRoot);
-  const sessions2 = await accessor.loadSessions();
-  if (!sessions2 || sessions2.length === 0) {
+  const sessions3 = await accessor.loadSessions();
+  if (!sessions3 || sessions3.length === 0) {
     return { archived: [], count: 0 };
   }
   const archivedIds = [];
-  for (const session of sessions2) {
+  for (const session of sessions3) {
     if (session.status === "active") continue;
     if (session.status !== "ended" && session.status !== "orphaned" && session.status !== "suspended")
       continue;
@@ -60266,8 +60295,8 @@ var init_session_archive = __esm({
 // packages/core/src/sessions/session-cleanup.ts
 async function cleanupSessions(projectRoot) {
   const accessor = await getAccessor(projectRoot);
-  const sessions2 = await accessor.loadSessions();
-  if (sessions2.length === 0) {
+  const sessions3 = await accessor.loadSessions();
+  if (sessions3.length === 0) {
     return { removed: [], autoEnded: [], cleaned: false };
   }
   const removed = [];
@@ -60276,7 +60305,7 @@ async function cleanupSessions(projectRoot) {
   const autoEndDays = typeof configDays === "number" && configDays > 0 ? configDays : DEFAULT_AUTO_END_DAYS;
   const autoEndMs = autoEndDays * 24 * 60 * 60 * 1e3;
   const now2 = Date.now();
-  for (const session of sessions2) {
+  for (const session of sessions3) {
     if (session.status === "active") {
       const sessionTime = new Date(session.startedAt).getTime();
       if (now2 - sessionTime > autoEndMs) {
@@ -60331,8 +60360,8 @@ async function getContextDrift(projectRoot, params) {
   };
   let session;
   if (params?.sessionId) {
-    const sessions2 = await accessor.loadSessions();
-    session = sessions2.find((s3) => s3.id === params.sessionId);
+    const sessions3 = await accessor.loadSessions();
+    session = sessions3.find((s3) => s3.id === params.sessionId);
     if (!session) {
       throw new CleoError(31 /* SESSION_NOT_FOUND */, `Session '${params.sessionId}' not found`);
     }
@@ -60471,8 +60500,8 @@ var init_session_memory_bridge = __esm({
 // packages/core/src/sessions/session-show.ts
 async function showSession(projectRoot, sessionId) {
   const accessor = await getAccessor(projectRoot);
-  const sessions2 = await accessor.loadSessions();
-  const session = sessions2.find((s3) => s3.id === sessionId);
+  const sessions3 = await accessor.loadSessions();
+  const session = sessions3.find((s3) => s3.id === sessionId);
   if (session) {
     return session;
   }
@@ -60555,8 +60584,8 @@ var init_session_stats = __esm({
 // packages/core/src/sessions/session-suspend.ts
 async function suspendSession(projectRoot, sessionId, reason) {
   const accessor = await getAccessor(projectRoot);
-  const sessions2 = await accessor.loadSessions();
-  const session = sessions2.find((s3) => s3.id === sessionId);
+  const sessions3 = await accessor.loadSessions();
+  const session = sessions3.find((s3) => s3.id === sessionId);
   if (!session) {
     throw new CleoError(31 /* SESSION_NOT_FOUND */, `Session '${sessionId}' not found`);
   }
@@ -60591,8 +60620,8 @@ var init_session_suspend = __esm({
 // packages/core/src/sessions/session-switch.ts
 async function switchSession(projectRoot, sessionId) {
   const accessor = await getAccessor(projectRoot);
-  const sessions2 = await accessor.loadSessions();
-  const targetSession = sessions2.find((s3) => s3.id === sessionId);
+  const sessions3 = await accessor.loadSessions();
+  const targetSession = sessions3.find((s3) => s3.id === sessionId);
   if (!targetSession) {
     throw new CleoError(31 /* SESSION_NOT_FOUND */, `Session '${sessionId}' not found`);
   }
@@ -60640,12 +60669,12 @@ var init_session_view = __esm({
     "use strict";
     SessionView2 = class _SessionView {
       _sessions;
-      constructor(sessions2) {
-        this._sessions = sessions2;
+      constructor(sessions3) {
+        this._sessions = sessions3;
       }
       /** Create a SessionView from a Session array. */
-      static from(sessions2) {
-        return new _SessionView(sessions2);
+      static from(sessions3) {
+        return new _SessionView(sessions3);
       }
       /** All sessions in the view (readonly). */
       get all() {
@@ -60870,14 +60899,14 @@ async function readSessions(cwd, accessor) {
   const acc = accessor ?? await getAccessor(cwd);
   return acc.loadSessions();
 }
-async function saveSessions(sessions2, cwd, accessor) {
+async function saveSessions(sessions3, cwd, accessor) {
   const acc = accessor ?? await getAccessor(cwd);
-  await acc.saveSessions(sessions2);
+  await acc.saveSessions(sessions3);
 }
 async function startSession(options, cwd, accessor) {
   const scope = parseScope2(options.scope);
-  const sessions2 = await readSessions(cwd, accessor);
-  const activeSessions = sessions2.filter((s3) => s3.status === "active");
+  const sessions3 = await readSessions(cwd, accessor);
+  const activeSessions = sessions3.filter((s3) => s3.status === "active");
   for (const active of activeSessions) {
     if (active.scope.type === scope.type && active.scope.epicId === scope.epicId) {
       throw new CleoError(
@@ -60922,7 +60951,7 @@ async function startSession(options, cwd, accessor) {
     process.env.CLEO_SESSION_ID = session.id;
     process.env.CLEO_SESSION_GRADE_ID = session.id;
   }
-  sessions2.push(session);
+  sessions3.push(session);
   const acc = accessor ?? await getAccessor(cwd);
   await acc.upsertSingleSession(session);
   try {
@@ -60959,12 +60988,12 @@ async function startSession(options, cwd, accessor) {
   return session;
 }
 async function endSession(options = {}, cwd, accessor) {
-  const sessions2 = await readSessions(cwd, accessor);
+  const sessions3 = await readSessions(cwd, accessor);
   let session;
   if (options.sessionId) {
-    session = sessions2.find((s3) => s3.id === options.sessionId);
+    session = sessions3.find((s3) => s3.id === options.sessionId);
   } else {
-    session = sessions2.filter((s3) => s3.status === "active").sort(
+    session = sessions3.filter((s3) => s3.status === "active").sort(
       (a, b2) => new Date(b2.startedAt).getTime() - new Date(a.startedAt).getTime()
     )[0];
   }
@@ -61023,15 +61052,15 @@ async function endSession(options = {}, cwd, accessor) {
   return session;
 }
 async function sessionStatus(cwd, accessor) {
-  const sessions2 = await readSessions(cwd, accessor);
-  const active = sessions2.filter((s3) => s3.status === "active").sort(
+  const sessions3 = await readSessions(cwd, accessor);
+  const active = sessions3.filter((s3) => s3.status === "active").sort(
     (a, b2) => new Date(b2.startedAt).getTime() - new Date(a.startedAt).getTime()
   )[0];
   return active ?? null;
 }
 async function resumeSession(sessionId, cwd, accessor) {
-  const sessions2 = await readSessions(cwd, accessor);
-  const session = sessions2.find((s3) => s3.id === sessionId);
+  const sessions3 = await readSessions(cwd, accessor);
+  const session = sessions3.find((s3) => s3.id === sessionId);
   if (!session) {
     throw new CleoError(31 /* SESSION_NOT_FOUND */, `Session not found: ${sessionId}`, {
       fix: "Use 'cleo session list' to see available sessions"
@@ -61051,28 +61080,28 @@ async function resumeSession(sessionId, cwd, accessor) {
   return session;
 }
 async function listSessions(options = {}, cwd, accessor) {
-  let sessions2 = await readSessions(cwd, accessor);
+  let sessions3 = await readSessions(cwd, accessor);
   if (options.status) {
-    sessions2 = sessions2.filter((s3) => s3.status === options.status);
+    sessions3 = sessions3.filter((s3) => s3.status === options.status);
   }
-  sessions2.sort(
+  sessions3.sort(
     (a, b2) => new Date(b2.startedAt).getTime() - new Date(a.startedAt).getTime()
   );
   if (options.limit) {
-    sessions2 = sessions2.slice(0, options.limit);
+    sessions3 = sessions3.slice(0, options.limit);
   }
-  for (const s3 of sessions2) {
+  for (const s3 of sessions3) {
     Object.assign(s3, { _next: sessionListItemNext(s3.id) });
   }
-  return sessions2;
+  return sessions3;
 }
 async function gcSessions(maxAgeHours = 24, cwd, accessor) {
-  let sessions2 = await readSessions(cwd, accessor);
+  let sessions3 = await readSessions(cwd, accessor);
   const now2 = Date.now();
   const maxAgeMs = maxAgeHours * 60 * 60 * 1e3;
   const orphaned = [];
   const removed = [];
-  for (const session of sessions2) {
+  for (const session of sessions3) {
     if (session.status === "active") {
       const age = now2 - new Date(session.startedAt).getTime();
       if (age > maxAgeMs) {
@@ -61083,7 +61112,7 @@ async function gcSessions(maxAgeHours = 24, cwd, accessor) {
     }
   }
   const thirtyDaysMs = 30 * 24 * 60 * 60 * 1e3;
-  sessions2 = sessions2.filter((s3) => {
+  sessions3 = sessions3.filter((s3) => {
     if (s3.status === "active") return true;
     const endedAt = s3.endedAt ? new Date(s3.endedAt).getTime() : new Date(s3.startedAt).getTime();
     if (now2 - endedAt > thirtyDaysMs) {
@@ -61093,7 +61122,7 @@ async function gcSessions(maxAgeHours = 24, cwd, accessor) {
     return true;
   });
   const acc = accessor ?? await getAccessor(cwd);
-  for (const session of sessions2) {
+  for (const session of sessions3) {
     if (orphaned.includes(session.id)) {
       await acc.upsertSingleSession(session);
     }
@@ -62699,7 +62728,7 @@ var init_codebase_map = __esm({
 
 // packages/core/src/compliance/store.ts
 import { appendFileSync as appendFileSync3, existsSync as existsSync35, mkdirSync as mkdirSync11, readFileSync as readFileSync20 } from "node:fs";
-import { dirname as dirname10, join as join37 } from "node:path";
+import { dirname as dirname11, join as join37 } from "node:path";
 function getComplianceJsonlPath(projectRoot) {
   return join37(projectRoot, ".cleo", "metrics", "COMPLIANCE.jsonl");
 }
@@ -62935,13 +62964,13 @@ async function getSkillReliability(opts) {
     stats2.passRateSum += c.compliance_pass_rate ?? 0;
     stats2.violations += c.violation_count ?? 0;
   }
-  const skills = Object.entries(byAgent).map(([id, stats2]) => ({
+  const skills2 = Object.entries(byAgent).map(([id, stats2]) => ({
     agentId: id,
     totalChecks: stats2.count,
     avgPassRate: stats2.count > 0 ? Math.round(stats2.passRateSum / stats2.count * 1e3) / 1e3 : 0,
     totalViolations: stats2.violations
   }));
-  return { skills, total: skills.length };
+  return { skills: skills2, total: skills2.length };
 }
 async function getValueMetrics(days = 7, cwd) {
   const manifestPath = getManifestPath(cwd);
@@ -63636,7 +63665,7 @@ async function checkContextThreshold(opts) {
 }
 async function listContextSessions(cwd) {
   const cleoDir = getCleoDir2(cwd);
-  const sessions2 = [];
+  const sessions3 = [];
   const statesDir = join39(cleoDir, "context-states");
   if (existsSync37(statesDir)) {
     for (const file2 of readdirSync16(statesDir)) {
@@ -63644,7 +63673,7 @@ async function listContextSessions(cwd) {
         const filePath = join39(statesDir, file2);
         try {
           const state = JSON.parse(readFileSync22(filePath, "utf-8"));
-          sessions2.push({
+          sessions3.push({
             file: basename3(filePath),
             sessionId: state.sessionId ?? null,
             percentage: state.contextWindow?.percentage ?? 0,
@@ -63660,7 +63689,7 @@ async function listContextSessions(cwd) {
   if (existsSync37(singletonFile)) {
     try {
       const state = JSON.parse(readFileSync22(singletonFile, "utf-8"));
-      sessions2.push({
+      sessions3.push({
         file: ".context-state.json",
         sessionId: state.sessionId ?? "global",
         percentage: state.contextWindow?.percentage ?? 0,
@@ -63670,7 +63699,7 @@ async function listContextSessions(cwd) {
     } catch {
     }
   }
-  return { sessions: sessions2, count: sessions2.length };
+  return { sessions: sessions3, count: sessions3.length };
 }
 var init_context = __esm({
   "packages/core/src/context/index.ts"() {
@@ -63891,7 +63920,7 @@ var init_hooks = __esm({
 
 // packages/core/src/identity/cleo-identity.ts
 import { chmod, constants, mkdir as mkdir6, readFile as readFile6, writeFile as writeFile5 } from "node:fs/promises";
-import { dirname as dirname11, join as join40 } from "node:path";
+import { dirname as dirname12, join as join40 } from "node:path";
 import { AgentIdentity, identityFromSeed, verifySignature } from "llmtxt/identity";
 function getCleoIdentityPath(cwd) {
   return join40(getCleoDirAbsolute(cwd), KEY_RELATIVE_PATH);
@@ -63952,7 +63981,7 @@ async function generateAndPersistIdentity(keyPath) {
     sk: bytesToHex(seed),
     pk: identity.pubkeyHex
   };
-  await mkdir6(dirname11(keyPath), { recursive: true });
+  await mkdir6(dirname12(keyPath), { recursive: true });
   await writeFile5(keyPath, JSON.stringify(file2), { mode: 384 });
   try {
     await chmod(keyPath, constants.S_IRUSR | constants.S_IWUSR);
@@ -66425,10 +66454,10 @@ import { execFile as execFile3 } from "node:child_process";
 import { randomUUID as randomUUID3 } from "node:crypto";
 import { existsSync as existsSync41, constants as fsConstants3, readFileSync as readFileSync26, statSync as statSync8 } from "node:fs";
 import { access as access3, copyFile as copyFile2, mkdir as mkdir8, readdir as readdir3, readFile as readFile8, rm as rm2, writeFile as writeFile7 } from "node:fs/promises";
-import { createRequire as createRequire10 } from "node:module";
+import { createRequire as createRequire9 } from "node:module";
 import { homedir as getHomedir } from "node:os";
-import { dirname as dirname12, join as join44, resolve as resolve5 } from "node:path";
-import { fileURLToPath as fileURLToPath6 } from "node:url";
+import { dirname as dirname13, join as join44, resolve as resolve5 } from "node:path";
+import { fileURLToPath as fileURLToPath7 } from "node:url";
 import { promisify as promisify3 } from "node:util";
 async function fileExists(path15) {
   try {
@@ -66462,8 +66491,8 @@ async function removeCleoFromRootGitignore(projectRoot) {
   return { removed: true };
 }
 function getPackageRoot() {
-  const thisFile = fileURLToPath6(import.meta.url);
-  return resolve5(dirname12(thisFile), "..");
+  const thisFile = fileURLToPath7(import.meta.url);
+  return resolve5(dirname13(thisFile), "..");
 }
 function getGitignoreContent() {
   try {
@@ -66681,7 +66710,7 @@ async function ensureProjectContext(projectRoot, opts) {
   const context = detectProjectType2(projectRoot);
   try {
     const schemaPath = join44(
-      dirname12(fileURLToPath6(import.meta.url)),
+      dirname13(fileURLToPath7(import.meta.url)),
       "../schemas/project-context.schema.json"
     );
     if (existsSync41(schemaPath)) {
@@ -67291,7 +67320,7 @@ function resolveIdentitySourcePath() {
   );
   if (existsSync41(monorepoPath)) return monorepoPath;
   try {
-    const require2 = createRequire10(import.meta.url);
+    const require2 = createRequire9(import.meta.url);
     const pkgJson = require2.resolve("@cleocode/cleo-os/package.json");
     const pkgDir = pkgJson.replace(/\/package\.json$/, "");
     const installedPath = join44(pkgDir, "starter-bundle", "CLEOOS-IDENTITY.md");
@@ -68602,7 +68631,7 @@ var init_stages = __esm({
 // packages/core/src/lifecycle/stage-artifacts.ts
 import { existsSync as existsSync44 } from "node:fs";
 import { readFile as readFile9, writeFile as writeFile8 } from "node:fs/promises";
-import { dirname as dirname13, join as join47, relative as relative7 } from "node:path";
+import { dirname as dirname14, join as join47, relative as relative7 } from "node:path";
 function stageSlug(stage) {
   return stage.replace(/_/g, "-");
 }
@@ -68640,7 +68669,7 @@ function toWorkspaceRelative(path15, cwd) {
 function buildRelatedLinks(epicId, stage, absolutePath, cwd) {
   const prereqs = STAGE_PREREQUISITES[stage] ?? [];
   const related = [{ type: "task", id: epicId }];
-  const artifactDir = dirname13(absolutePath);
+  const artifactDir = dirname14(absolutePath);
   for (const prereq of prereqs) {
     const prereqDir = getStagePath(epicId, prereq, cwd);
     const prereqFile = join47(prereqDir, `${epicId}-${stageSlug(prereq)}.md`);
@@ -68898,7 +68927,7 @@ function discoverSkillsInDir(dir) {
   if (!existsSync45(dir)) {
     return [];
   }
-  const skills = [];
+  const skills2 = [];
   try {
     const entries = readdirSync20(dir);
     for (const entry of entries) {
@@ -68908,7 +68937,7 @@ function discoverSkillsInDir(dir) {
         if (statSync9(entryPath).isDirectory()) {
           const skill = discoverSkill(entryPath);
           if (skill) {
-            skills.push(skill);
+            skills2.push(skill);
           }
         }
       } catch {
@@ -68916,22 +68945,22 @@ function discoverSkillsInDir(dir) {
     }
   } catch {
   }
-  return skills;
+  return skills2;
 }
 function discoverAllSkills(cwd) {
   const searchPaths = getSkillSearchPaths(cwd);
   const seen = /* @__PURE__ */ new Set();
-  const skills = [];
+  const skills2 = [];
   for (const sp of searchPaths) {
     const found = discoverSkillsInDir(sp.path);
     for (const skill of found) {
       if (!seen.has(skill.dirName)) {
         seen.add(skill.dirName);
-        skills.push(skill);
+        skills2.push(skill);
       }
     }
   }
-  return skills;
+  return skills2;
 }
 function findSkill(name2, cwd) {
   const { canonical } = mapSkillName(name2);
@@ -68965,15 +68994,15 @@ function toSkillSummary(skill) {
 }
 function generateManifest(cwd) {
   const searchPaths = getSkillSearchPaths(cwd);
-  const skills = discoverAllSkills(cwd);
+  const skills2 = discoverAllSkills(cwd);
   return {
     _meta: {
       generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
       ttlSeconds: 300,
-      skillCount: skills.length,
+      skillCount: skills2.length,
       searchPaths: searchPaths.map((p2) => p2.path)
     },
-    skills: skills.map(toSkillSummary)
+    skills: skills2.map(toSkillSummary)
   };
 }
 function resolveTemplatePath(name2, cwd) {
@@ -69175,11 +69204,11 @@ function getCatalogMatrix() {
     return null;
   }
 }
-function dispatchByLabels(task, skills) {
+function dispatchByLabels(task, skills2) {
   const labels = task.labels ?? [];
   if (labels.length === 0) return null;
   const labelSet = new Set(labels.map((l) => l.toLowerCase()));
-  for (const skill of skills) {
+  for (const skill of skills2) {
     const tags = skill.frontmatter.tags ?? [];
     for (const tag of tags) {
       if (labelSet.has(tag.toLowerCase())) {
@@ -69251,8 +69280,8 @@ function dispatchByKeyword(task) {
   return null;
 }
 function autoDispatch(task, cwd) {
-  const skills = discoverAllSkills(cwd);
-  const labelResult = dispatchByLabels(task, skills);
+  const skills2 = discoverAllSkills(cwd);
+  const labelResult = dispatchByLabels(task, skills2);
   if (labelResult) return labelResult;
   const catalogResult = dispatchByCatalog(task);
   if (catalogResult) return catalogResult;
@@ -73150,7 +73179,7 @@ function getSkillReliability2(options = {}, cwd) {
     if (!bySkill.has(skill)) bySkill.set(skill, []);
     bySkill.get(skill).push(e);
   }
-  const skills = Array.from(bySkill.entries()).map(([skill, group]) => {
+  const skills2 = Array.from(bySkill.entries()).map(([skill, group]) => {
     const avgPassRate = group.reduce((s3, e) => s3 + (e.compliance?.compliance_pass_rate ?? 0), 0) / group.length;
     const avgAdherence = group.reduce((s3, e) => s3 + (e.compliance?.rule_adherence_score ?? 0), 0) / group.length;
     const totalViolations = group.reduce((s3, e) => s3 + (e.compliance?.violation_count ?? 0), 0);
@@ -73164,11 +73193,11 @@ function getSkillReliability2(options = {}, cwd) {
       reliability
     };
   }).sort((a, b2) => b2.reliability - a.reliability);
-  const totalSkills = skills.length;
-  const avgReliability = totalSkills > 0 ? skills.reduce((s3, sk) => s3 + sk.reliability, 0) / totalSkills : 0;
+  const totalSkills = skills2.length;
+  const avgReliability = totalSkills > 0 ? skills2.reduce((s3, sk) => s3 + sk.reliability, 0) / totalSkills : 0;
   return {
     success: true,
-    result: { skills, summary: { totalSkills, avgReliability } }
+    result: { skills: skills2, summary: { totalSkills, avgReliability } }
   };
 }
 async function logSessionMetrics(metricsJson, cwd) {
@@ -73326,7 +73355,7 @@ var init_enums = __esm({
 // packages/core/src/metrics/token-estimation.ts
 import { existsSync as existsSync55, readFileSync as readFileSync36, statSync as statSync12 } from "node:fs";
 import { appendFile as appendFile3, mkdir as mkdir13 } from "node:fs/promises";
-import { dirname as dirname14, join as join59 } from "node:path";
+import { dirname as dirname15, join as join59 } from "node:path";
 function getTokenFilePath(cwd) {
   return join59(getCleoDir(cwd), "metrics", "TOKEN_USAGE.jsonl");
 }
@@ -73344,7 +73373,7 @@ function estimateTokensFromFile(filePath) {
 async function logTokenEvent(eventType, tokens, source, taskId, context, cwd) {
   if (!isTrackingEnabled()) return;
   const tokenFile = getTokenFilePath(cwd);
-  await mkdir13(dirname14(tokenFile), { recursive: true });
+  await mkdir13(dirname15(tokenFile), { recursive: true });
   const entry = {
     timestamp: isoTimestamp(),
     event_type: eventType,
@@ -73867,7 +73896,7 @@ var init_agent_outputs = __esm({
 // packages/core/src/migration/checksum.ts
 import { createHash as createHash12 } from "node:crypto";
 import { readFileSync as readFileSync38 } from "node:fs";
-import { createRequire as createRequire11 } from "node:module";
+import { createRequire as createRequire10 } from "node:module";
 async function computeChecksum2(filePath) {
   const content = readFileSync38(filePath);
   return createHash12("sha256").update(content).digest("hex");
@@ -73909,12 +73938,12 @@ async function compareChecksums(filePath1, filePath2) {
   const checksum2 = await computeChecksum2(filePath2);
   return checksum1 === checksum2;
 }
-var _require10, DatabaseSync5;
+var _require9, DatabaseSync5;
 var init_checksum = __esm({
   "packages/core/src/migration/checksum.ts"() {
     "use strict";
-    _require10 = createRequire11(import.meta.url);
-    ({ DatabaseSync: DatabaseSync5 } = _require10("node:sqlite"));
+    _require9 = createRequire10(import.meta.url);
+    ({ DatabaseSync: DatabaseSync5 } = _require9("node:sqlite"));
   }
 });
 
@@ -73938,7 +73967,7 @@ import {
   statSync as statSync14,
   unlinkSync as unlinkSync3
 } from "node:fs";
-import { dirname as dirname15, join as join61, relative as relative8 } from "node:path";
+import { dirname as dirname16, join as join61, relative as relative8 } from "node:path";
 function createMigrationLogger(cleoDir, config2) {
   return new MigrationLogger(cleoDir, config2);
 }
@@ -73994,7 +74023,7 @@ var init_logger3 = __esm({
         };
         const timestamp3 = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
         this.logPath = join61(cleoDir, "logs", `migration-${timestamp3}.jsonl`);
-        const logsDir = dirname15(this.logPath);
+        const logsDir = dirname16(this.logPath);
         if (!existsSync57(logsDir)) {
           mkdirSync15(logsDir, { recursive: true });
         }
@@ -75071,7 +75100,7 @@ __export(migrate_json_to_sqlite_exports, {
 import { randomUUID as randomUUID4 } from "node:crypto";
 import { existsSync as existsSync61, readFileSync as readFileSync42, renameSync as renameSync4 } from "node:fs";
 import { join as join66 } from "node:path";
-import { sql as sql10 } from "drizzle-orm";
+import { sql as sql11 } from "drizzle-orm";
 async function migrateJsonToSqlite() {
   const jsonPath = getRegistryPath();
   if (!existsSync61(jsonPath)) return 0;
@@ -75127,9 +75156,9 @@ async function migrateJsonToSqlite() {
     }).onConflictDoUpdate({
       target: projectRegistry.projectHash,
       set: {
-        projectPath: sql10`excluded.project_path`,
-        name: sql10`excluded.name`,
-        lastSeen: sql10`(datetime('now'))`
+        projectPath: sql11`excluded.project_path`,
+        name: sql11`excluded.name`,
+        lastSeen: sql11`(datetime('now'))`
       }
     });
     migrated++;
@@ -76928,7 +76957,7 @@ var init_tasks_bridge = __esm({
 
 // packages/core/src/reconciliation/link-store.ts
 import { randomUUID as randomUUID6 } from "node:crypto";
-import { and as and9, eq as eq13, sql as sql11 } from "drizzle-orm";
+import { and as and9, eq as eq13, sql as sql12 } from "drizzle-orm";
 async function getLinksByProvider(providerId, cwd) {
   const db = await getDb(cwd);
   const rows = await db.select().from(externalTaskLinks).where(eq13(externalTaskLinks.providerId, providerId));
@@ -76953,7 +76982,7 @@ async function ensureExternalTaskLinksTable(cwd) {
   const db = await getDb(cwd);
   try {
     db.run(
-      sql11.raw(`
+      sql12.raw(`
         CREATE TABLE IF NOT EXISTS external_task_links (
           id text PRIMARY KEY NOT NULL,
           task_id text NOT NULL REFERENCES tasks(id) ON DELETE CASCADE,
@@ -76970,15 +76999,15 @@ async function ensureExternalTaskLinksTable(cwd) {
       `)
     );
     db.run(
-      sql11.raw(
+      sql12.raw(
         `CREATE UNIQUE INDEX IF NOT EXISTS uq_ext_links_task_provider_external ON external_task_links(task_id, provider_id, external_id)`
       )
     );
     db.run(
-      sql11.raw(`CREATE INDEX IF NOT EXISTS idx_ext_links_task_id ON external_task_links(task_id)`)
+      sql12.raw(`CREATE INDEX IF NOT EXISTS idx_ext_links_task_id ON external_task_links(task_id)`)
     );
     db.run(
-      sql11.raw(
+      sql12.raw(
         `CREATE INDEX IF NOT EXISTS idx_ext_links_provider_id ON external_task_links(provider_id)`
       )
     );
@@ -79282,9 +79311,9 @@ async function loadProjectACL(projectPath) {
   try {
     const { loadConfig: loadConfig4 } = await Promise.resolve().then(() => (init_config(), config_exports));
     const config2 = await loadConfig4(projectPath);
-    const agents = config2?.authorizedAgents;
-    if (Array.isArray(agents) && agents.length > 0) {
-      return { authorizedAgents: agents };
+    const agents2 = config2?.authorizedAgents;
+    if (Array.isArray(agents2) && agents2.length > 0) {
+      return { authorizedAgents: agents2 };
     }
   } catch {
     await logAclFailure(projectPath);
@@ -79502,13 +79531,13 @@ async function workspaceStatus() {
 }
 async function workspaceAgents() {
   const projects = await nexusList();
-  const agents = [];
+  const agents2 = [];
   for (const project of projects) {
     try {
       const acc = await getAccessor(project.path);
       const instances = await acc.listAgentInstances();
       for (const inst of instances) {
-        agents.push({
+        agents2.push({
           agentId: inst.id,
           agentType: inst.agentType,
           status: inst.status,
@@ -79520,7 +79549,7 @@ async function workspaceAgents() {
     } catch {
     }
   }
-  return agents;
+  return agents2;
 }
 var RATE_LIMIT_WINDOW_MS, RATE_LIMIT_MAX_OPS, rateLimitCounters, DEFAULT_ACL, TASK_REF_PATTERN, VERB_TO_OPERATION;
 var init_workspace = __esm({
@@ -80196,12 +80225,12 @@ var init_skill_paths = __esm({
 
 // packages/core/src/orchestration/spawn-prompt.ts
 import { existsSync as existsSync67, readFileSync as readFileSync45 } from "node:fs";
-import { dirname as dirname16, join as join73, resolve as resolve9 } from "node:path";
-import { fileURLToPath as fileURLToPath7 } from "node:url";
+import { dirname as dirname17, join as join73, resolve as resolve9 } from "node:path";
+import { fileURLToPath as fileURLToPath8 } from "node:url";
 function locateCleoInjectionTemplate() {
-  const thisFile = fileURLToPath7(import.meta.url);
+  const thisFile = fileURLToPath8(import.meta.url);
   const candidates = [];
-  let dir = dirname16(thisFile);
+  let dir = dirname17(thisFile);
   for (let i = 0; i < 8; i++) {
     const direct = join73(dir, "templates", "CLEO-INJECTION.md");
     if (existsSync67(direct)) return direct;
@@ -80210,7 +80239,7 @@ function locateCleoInjectionTemplate() {
     if (parent === dir) break;
     dir = parent;
   }
-  let baseDir = dirname16(thisFile);
+  let baseDir = dirname17(thisFile);
   for (let i = 0; i < 8; i++) {
     const nm = join73(baseDir, "node_modules", "@cleocode", "core", "templates", "CLEO-INJECTION.md");
     if (existsSync67(nm)) return nm;
@@ -81077,7 +81106,7 @@ var init_context2 = __esm({
 
 // packages/core/src/orchestration/harness-hint.ts
 import { existsSync as existsSync69, mkdirSync as mkdirSync16, readFileSync as readFileSync47, renameSync as renameSync5, writeFileSync as writeFileSync6 } from "node:fs";
-import { dirname as dirname17, join as join74 } from "node:path";
+import { dirname as dirname18, join as join74 } from "node:path";
 function coerceHarnessHint(value) {
   if (!value) return void 0;
   return HARNESS_HINT_VALUES.has(value) ? value : void 0;
@@ -81142,7 +81171,7 @@ function resolveHarnessHint(options = {}) {
 }
 async function persistHarnessProfile(projectRoot, hint) {
   const finalPath = harnessProfilePath(projectRoot);
-  const cleoDir = dirname17(finalPath);
+  const cleoDir = dirname18(finalPath);
   if (!existsSync69(cleoDir)) {
     mkdirSync16(cleoDir, { recursive: true });
   }
@@ -81184,7 +81213,7 @@ var init_harness_hint = __esm({
 
 // packages/core/src/orchestration/hierarchy.ts
 function buildDefaultHierarchy() {
-  const agents = {
+  const agents2 = {
     owner: {
       agentId: "owner",
       displayName: "Owner (HITL)",
@@ -81287,7 +81316,7 @@ function buildDefaultHierarchy() {
     }
   };
   return {
-    agents,
+    agents: agents2,
     primeId: "cleoos-opus-orchestrator",
     projectIds: ["cleocode", "signaldock"]
   };
@@ -81375,7 +81404,7 @@ var init_api_key_kdf = __esm({
 // packages/core/src/store/agent-registry-accessor.ts
 import { randomBytes as randomBytes13 } from "node:crypto";
 import { existsSync as existsSync70, mkdirSync as mkdirSync17, readFileSync as readFileSync48, statSync as statSync19, writeFileSync as writeFileSync7 } from "node:fs";
-import { createRequire as createRequire12 } from "node:module";
+import { createRequire as createRequire11 } from "node:module";
 import { join as join75 } from "node:path";
 function readMachineKey() {
   const keyPath = join75(getCleoHome(), "machine-key");
@@ -81456,7 +81485,7 @@ function rowToResolvedAgent(row) {
   if (!extended.cantPath || !extended.cantSha256) {
     return null;
   }
-  const skills = JSON.parse(row.skills);
+  const skills2 = JSON.parse(row.skills);
   return {
     agentId: row.agent_id,
     tier: extended.tier,
@@ -81465,7 +81494,7 @@ function rowToResolvedAgent(row) {
     canSpawn: extended.canSpawn,
     orchLevel: extended.orchLevel,
     reportsTo: extended.reportsTo,
-    skills,
+    skills: skills2,
     source: extended.tier,
     aliasApplied: false
   };
@@ -81490,10 +81519,10 @@ function openConduitDb(projectRoot) {
   db.exec("PRAGMA journal_mode = WAL");
   return db;
 }
-function syncJunctionTables(db, agentUuid, capabilities, skills) {
+function syncJunctionTables(db, agentUuid, capabilities2, skills2) {
   db.prepare("DELETE FROM agent_capabilities WHERE agent_id = ?").run(agentUuid);
   db.prepare("DELETE FROM agent_skills WHERE agent_id = ?").run(agentUuid);
-  for (const cap of capabilities) {
+  for (const cap of capabilities2) {
     const capRow = db.prepare("SELECT id FROM capabilities WHERE slug = ?").get(cap);
     if (capRow) {
       db.prepare(
@@ -81501,7 +81530,7 @@ function syncJunctionTables(db, agentUuid, capabilities, skills) {
       ).run(agentUuid, capRow.id);
     }
   }
-  for (const skill of skills) {
+  for (const skill of skills2) {
     const skillRow = db.prepare("SELECT id FROM skills WHERE slug = ?").get(skill);
     if (skillRow) {
       db.prepare("INSERT OR IGNORE INTO agent_skills (agent_id, skill_id) VALUES (?, ?)").run(
@@ -81695,7 +81724,7 @@ function getProjectAgentRef2(projectRoot, agentId) {
     conduitDb.close();
   }
 }
-var _require11, DatabaseSync6, MACHINE_KEY_LENGTH, AgentRegistryAccessor;
+var _require10, DatabaseSync6, MACHINE_KEY_LENGTH, AgentRegistryAccessor;
 var init_agent_registry_accessor = __esm({
   "packages/core/src/store/agent-registry-accessor.ts"() {
     "use strict";
@@ -81704,8 +81733,8 @@ var init_agent_registry_accessor = __esm({
     init_conduit_sqlite();
     init_global_salt();
     init_signaldock_sqlite();
-    _require11 = createRequire12(import.meta.url);
-    ({ DatabaseSync: DatabaseSync6 } = _require11("node:sqlite"));
+    _require10 = createRequire11(import.meta.url);
+    ({ DatabaseSync: DatabaseSync6 } = _require10("node:sqlite"));
     MACHINE_KEY_LENGTH = 32;
     AgentRegistryAccessor = class {
       /**
@@ -82028,9 +82057,9 @@ var init_agent_registry_accessor = __esm({
 // packages/core/src/store/agent-resolver.ts
 import { createHash as createHash15 } from "node:crypto";
 import { accessSync as accessSync2, readFileSync as readFileSync49 } from "node:fs";
-import { createRequire as createRequire13 } from "node:module";
-import { dirname as dirname18, join as join76, resolve as resolve10 } from "node:path";
-import { fileURLToPath as fileURLToPath8 } from "node:url";
+import { createRequire as createRequire12 } from "node:module";
+import { dirname as dirname19, join as join76, resolve as resolve10 } from "node:path";
+import { fileURLToPath as fileURLToPath9 } from "node:url";
 function resolveAgent(db, agentId, options = {}) {
   let effectiveId = agentId;
   let aliasApplied = false;
@@ -82142,7 +82171,7 @@ function tryResolveFallback(agentId, options) {
   };
 }
 function resolveDefaultSeedDir() {
-  const here = dirname18(fileURLToPath8(import.meta.url));
+  const here = dirname19(fileURLToPath9(import.meta.url));
   return resolve10(here, "..", "..", "..", "agents", "seed-agents");
 }
 function fileExists2(path15) {
@@ -82158,7 +82187,7 @@ var init_agent_resolver = __esm({
   "packages/core/src/store/agent-resolver.ts"() {
     "use strict";
     init_agent_registry_accessor();
-    _resolverRequire = createRequire13(import.meta.url);
+    _resolverRequire = createRequire12(import.meta.url);
     ({ DatabaseSync: _DatabaseSync } = _resolverRequire("node:sqlite"));
     DEPRECATED_ALIASES = Object.freeze({
       "cleoos-opus-orchestrator": "cleo-prime"
@@ -82846,7 +82875,7 @@ async function getOtelSummary() {
     return { message: "No token tracking data yet", events: 0 };
   }
   const totalTokens = entries.reduce((sum, e) => sum + (e.estimated_tokens ?? 0), 0);
-  const sessions2 = entries.filter((e) => e.event_type === "session_start");
+  const sessions3 = entries.filter((e) => e.event_type === "session_start");
   const spawns = entries.filter((e) => e.event_type !== "session_start");
   const byType = {};
   for (const e of entries) {
@@ -82859,8 +82888,8 @@ async function getOtelSummary() {
     totalEvents: entries.length,
     totalTokens,
     sessions: {
-      count: sessions2.length,
-      tokens: sessions2.reduce((s3, e) => s3 + (e.estimated_tokens ?? 0), 0)
+      count: sessions3.length,
+      tokens: sessions3.reduce((s3, e) => s3 + (e.estimated_tokens ?? 0), 0)
     },
     spawns: {
       count: spawns.length,
@@ -82872,17 +82901,17 @@ async function getOtelSummary() {
 }
 async function getOtelSessions(opts) {
   const entries = readJsonlFile3(getTokenFilePath2());
-  let sessions2 = entries.filter((e) => e.event_type === "session_start");
+  let sessions3 = entries.filter((e) => e.event_type === "session_start");
   if (opts.session) {
-    sessions2 = sessions2.filter((e) => {
+    sessions3 = sessions3.filter((e) => {
       const ctx = e.context ?? {};
       return ctx.session_id === opts.session;
     });
   }
   if (opts.task) {
-    sessions2 = sessions2.filter((e) => e.task_id === opts.task);
+    sessions3 = sessions3.filter((e) => e.task_id === opts.task);
   }
-  return { sessions: sessions2, count: sessions2.length };
+  return { sessions: sessions3, count: sessions3.length };
 }
 async function getOtelSpawns(opts) {
   const entries = readJsonlFile3(getTokenFilePath2());
@@ -84386,7 +84415,7 @@ var init_release_config = __esm({
 
 // packages/core/src/release/ci.ts
 import { existsSync as existsSync75, mkdirSync as mkdirSync18, readFileSync as readFileSync53, writeFileSync as writeFileSync9 } from "node:fs";
-import { dirname as dirname19, join as join79 } from "node:path";
+import { dirname as dirname20, join as join79 } from "node:path";
 function getPlatformPath(platform6) {
   return PLATFORM_PATHS[platform6];
 }
@@ -84501,7 +84530,7 @@ function writeCIConfig(platform6, options = {}) {
   if (options.dryRun) {
     return { action: "would_write", path: outputPath, content };
   }
-  mkdirSync18(dirname19(outputPath), { recursive: true });
+  mkdirSync18(dirname20(outputPath), { recursive: true });
   writeFileSync9(outputPath, content, "utf-8");
   return { action: "wrote", path: outputPath, content };
 }
@@ -88019,7 +88048,7 @@ var init_input_sanitization = __esm({
 // packages/core/src/security/owner-override-auth.ts
 import { createHmac as createHmac2 } from "node:crypto";
 import { appendFileSync as appendFileSync8, mkdirSync as mkdirSync19 } from "node:fs";
-import { dirname as dirname20 } from "node:path";
+import { dirname as dirname21 } from "node:path";
 function isAgentRoleForbidden() {
   const currentRole = process.env["CLEO_AGENT_ROLE"];
   if (BOOTSTRAP_AGENT_ROLE && FORBIDDEN_OVERRIDE_ROLES.has(BOOTSTRAP_AGENT_ROLE)) {
@@ -88062,7 +88091,7 @@ function resetOverrideCount(sessionId) {
 function appendOwnerOverrideAudit(projectRoot, record2) {
   const bypassPath = `${projectRoot}/.cleo/audit/force-bypass.jsonl`;
   try {
-    mkdirSync19(dirname20(bypassPath), { recursive: true });
+    mkdirSync19(dirname21(bypassPath), { recursive: true });
     appendFileSync8(bypassPath, `${JSON.stringify(record2)}
 `, { encoding: "utf-8" });
   } catch {
@@ -88316,7 +88345,7 @@ var init_install = __esm({
 
 // packages/core/src/skills/agents/registry.ts
 import { existsSync as existsSync81, mkdirSync as mkdirSync21, readdirSync as readdirSync27, readFileSync as readFileSync57, writeFileSync as writeFileSync11 } from "node:fs";
-import { dirname as dirname21, join as join85 } from "node:path";
+import { dirname as dirname22, join as join85 } from "node:path";
 function getRegistryPath2() {
   return join85(getCleoHome(), "agent-registry.json");
 }
@@ -88339,7 +88368,7 @@ function readRegistry2() {
 }
 function saveRegistry(registry2) {
   const registryPath = getRegistryPath2();
-  const dir = dirname21(registryPath);
+  const dir = dirname22(registryPath);
   if (!existsSync81(dir)) {
     mkdirSync21(dir, { recursive: true });
   }
@@ -89276,8 +89305,8 @@ async function sessionInit(epicId, cwd) {
   let activeSessionId = null;
   let activeScope = null;
   try {
-    const sessions2 = await acc.loadSessions();
-    let active = sessions2.filter((s3) => s3.status === "active");
+    const sessions3 = await acc.loadSessions();
+    let active = sessions3.filter((s3) => s3.status === "active");
     if (epicId && active.length > 0) {
       const epicScoped = active.filter(
         (s3) => s3.scope?.rootTaskId === epicId || s3.scope?.epicId === epicId
@@ -90177,7 +90206,7 @@ __export(snapshot_exports, {
 import { createHash as createHash16 } from "node:crypto";
 import { existsSync as existsSync90 } from "node:fs";
 import { mkdir as mkdir16, readFile as readFile15, writeFile as writeFile11 } from "node:fs/promises";
-import { dirname as dirname22, join as join93 } from "node:path";
+import { dirname as dirname23, join as join93 } from "node:path";
 function toSnapshotTask(task) {
   return {
     id: task.id,
@@ -90233,7 +90262,7 @@ async function exportSnapshot(cwd) {
   };
 }
 async function writeSnapshot(snapshot, outputPath) {
-  const dir = dirname22(outputPath);
+  const dir = dirname23(outputPath);
   if (!existsSync90(dir)) {
     await mkdir16(dir, { recursive: true });
   }
@@ -91733,7 +91762,7 @@ async function convertStickyToSessionNote(stickyId, sessionId, projectRoot) {
   }
   const { readSessions: readSessions2, saveSessions: saveSessions2, sessionStatus: sessionStatus3 } = await Promise.resolve().then(() => (init_sessions2(), sessions_exports2));
   try {
-    const sessions2 = await readSessions2(projectRoot);
+    const sessions3 = await readSessions2(projectRoot);
     let targetSessionId = sessionId;
     if (!targetSessionId) {
       const activeSession = await sessionStatus3(projectRoot);
@@ -91750,7 +91779,7 @@ async function convertStickyToSessionNote(stickyId, sessionId, projectRoot) {
         }
       };
     }
-    const session = sessions2.find((s3) => s3.id === targetSessionId);
+    const session = sessions3.find((s3) => s3.id === targetSessionId);
     if (!session) {
       return {
         success: false,
@@ -91762,7 +91791,7 @@ async function convertStickyToSessionNote(stickyId, sessionId, projectRoot) {
     }
     const timestampedNote = `${(/* @__PURE__ */ new Date()).toISOString().replace("T", " ").replace(/\.\d+Z$/, " UTC")}: ${sticky.content}`;
     session.notes.push(timestampedNote);
-    await saveSessions2(sessions2, projectRoot);
+    await saveSessions2(sessions3, projectRoot);
     const convertedTo = { type: "session_note", id: targetSessionId };
     await accessor.updateStickyNote(stickyId, {
       status: "converted",
@@ -92319,9 +92348,9 @@ async function auditData(projectRoot, opts) {
     if (existsSync93(sessPath)) {
       try {
         const data = JSON.parse(readFileSync67(sessPath, "utf-8"));
-        const sessions2 = data.sessions ?? [];
+        const sessions3 = data.sessions ?? [];
         const sessionIds = /* @__PURE__ */ new Set();
-        for (const s3 of sessions2) {
+        for (const s3 of sessions3) {
           if (sessionIds.has(s3.id)) {
             issues.push({
               severity: "error",
@@ -92331,7 +92360,7 @@ async function auditData(projectRoot, opts) {
           }
           sessionIds.add(s3.id);
         }
-        for (const s3 of sessions2) {
+        for (const s3 of sessions3) {
           if (!s3.scope?.rootTaskId) {
             issues.push({
               severity: "warning",
@@ -92398,7 +92427,7 @@ import {
   unlinkSync as unlinkSync6,
   writeFileSync as writeFileSync16
 } from "node:fs";
-import { dirname as dirname23, join as join97 } from "node:path";
+import { dirname as dirname24, join as join97 } from "node:path";
 function safeSqliteSnapshot(db, destPath) {
   if (!db) return false;
   db.exec("PRAGMA wal_checkpoint(TRUNCATE)");
@@ -92407,7 +92436,7 @@ function safeSqliteSnapshot(db, destPath) {
   return true;
 }
 function atomicWriteSync(destPath, data) {
-  mkdirSync25(dirname23(destPath), { recursive: true });
+  mkdirSync25(dirname24(destPath), { recursive: true });
   const tmp = `${destPath}.${process.pid}.${Date.now()}.tmp`;
   try {
     writeFileSync16(tmp, data);
@@ -92669,8 +92698,8 @@ async function cleanupSystem(projectRoot, params) {
       if (existsSync95(sessPath)) {
         try {
           const data = JSON.parse(readFileSync69(sessPath, "utf-8"));
-          const sessions2 = data.sessions ?? [];
-          const stale = sessions2.filter(
+          const sessions3 = data.sessions ?? [];
+          const stale = sessions3.filter(
             (s3) => {
               if (s3.status !== "active") return false;
               if (params.olderThan && s3.lastActivity) {
@@ -92685,7 +92714,7 @@ async function cleanupSystem(projectRoot, params) {
           }
           if (!dryRun && stale.length > 0) {
             const staleIds = new Set(stale.map((s3) => s3.id));
-            data.sessions = sessions2.filter((s3) => !staleIds.has(s3.id));
+            data.sessions = sessions3.filter((s3) => !staleIds.has(s3.id));
             writeFileSync17(sessPath, JSON.stringify(data, null, 2), "utf-8");
           }
         } catch {
@@ -92904,10 +92933,10 @@ import {
   unlinkSync as unlinkSync8,
   writeFileSync as writeFileSync18
 } from "node:fs";
-import { basename as basename14, dirname as dirname24, join as join101 } from "node:path";
+import { basename as basename14, dirname as dirname25, join as join101 } from "node:path";
 import * as lockfile2 from "proper-lockfile";
 function rotateBackup(filePath) {
-  const dir = dirname24(filePath);
+  const dir = dirname25(filePath);
   const name2 = basename14(filePath);
   const backupDir = join101(dir, ".backups");
   if (!existsSync97(backupDir)) {
@@ -92935,7 +92964,7 @@ function rotateBackup(filePath) {
   }
 }
 function writeJsonFileAtomic(filePath, data, indent = 2) {
-  const dir = dirname24(filePath);
+  const dir = dirname25(filePath);
   const tempPath = join101(dir, `.${basename14(filePath)}.${randomBytes15(6).toString("hex")}.tmp`);
   const content = JSON.stringify(data, null, indent) + "\n";
   writeFileSync18(tempPath, content, "utf-8");
@@ -94016,11 +94045,11 @@ __export(parser_exports, {
   parseFile: () => parseFile2
 });
 import { readFileSync as readFileSync72 } from "node:fs";
-import { createRequire as createRequire14 } from "node:module";
+import { createRequire as createRequire13 } from "node:module";
 import { relative as relative11 } from "node:path";
 function tryRequire2(id) {
   try {
-    return _require12(id);
+    return _require11(id);
   } catch {
     return null;
   }
@@ -94212,12 +94241,12 @@ function batchParse2(filePaths, projectRoot) {
   const totalSymbols = results.reduce((sum, r) => sum + r.symbols.length, 0);
   return { results, skipped, totalSymbols };
 }
-var _require12, _ParserClass3, _QueryClass2, _parserInstance3, _availabilityChecked2, _available3, _grammarCache3, GRAMMAR_SPECS3, QUERY_PATTERNS2, _queryCache2;
+var _require11, _ParserClass3, _QueryClass2, _parserInstance3, _availabilityChecked2, _available3, _grammarCache3, GRAMMAR_SPECS3, QUERY_PATTERNS2, _queryCache2;
 var init_parser4 = __esm({
   "packages/core/src/code/parser.ts"() {
     "use strict";
     init_tree_sitter_languages2();
-    _require12 = createRequire14(import.meta.url);
+    _require11 = createRequire13(import.meta.url);
     _ParserClass3 = null;
     _QueryClass2 = null;
     _parserInstance3 = null;
@@ -94323,9 +94352,9 @@ __export(dependencies_exports, {
   getDependencySpecs: () => getDependencySpecs
 });
 import { execFileSync as execFileSync12 } from "node:child_process";
-import { createRequire as createRequire15 } from "node:module";
-import { dirname as dirname25 } from "node:path";
-import { fileURLToPath as fileURLToPath9 } from "node:url";
+import { createRequire as createRequire14 } from "node:module";
+import { dirname as dirname26 } from "node:path";
+import { fileURLToPath as fileURLToPath10 } from "node:url";
 function tryExec(cmd, args, timeoutMs = 3e3) {
   try {
     return execFileSync12(cmd, args, {
@@ -94394,7 +94423,7 @@ async function checkTreeSitter() {
   let version2;
   if (available) {
     try {
-      const pkgJson = _require13("tree-sitter/package.json");
+      const pkgJson = _require12("tree-sitter/package.json");
       version2 = pkgJson.version;
     } catch {
       version2 = void 0;
@@ -94463,17 +94492,17 @@ function checkSimpleTool(name2, category, errorMsg, fixHint) {
 function checkCantNapi() {
   let available = false;
   try {
-    const binary2 = _require13.resolve("../../../cant/napi/cant.linux-x64-gnu.node", {
+    const binary2 = _require12.resolve("../../../cant/napi/cant.linux-x64-gnu.node", {
       paths: [_dirname]
     });
-    _require13(binary2);
+    _require12(binary2);
     available = true;
   } catch {
     try {
-      const fallback = _require13.resolve("../../../../crates/cant-napi/index.cjs", {
+      const fallback = _require12.resolve("../../../../crates/cant-napi/index.cjs", {
         paths: [_dirname]
       });
-      _require13(fallback);
+      _require12(fallback);
       available = true;
     } catch {
       available = false;
@@ -94494,15 +94523,15 @@ function checkCantNapi() {
 function checkLafsNapi() {
   let available = false;
   try {
-    _require13.resolve("@cleocode/lafs-native", { paths: [_dirname] });
-    _require13("@cleocode/lafs-native");
+    _require12.resolve("@cleocode/lafs-native", { paths: [_dirname] });
+    _require12("@cleocode/lafs-native");
     available = true;
   } catch {
     try {
-      const fallback = _require13.resolve("../../../../crates/lafs-napi/index.cjs", {
+      const fallback = _require12.resolve("../../../../crates/lafs-napi/index.cjs", {
         paths: [_dirname]
       });
-      _require13(fallback);
+      _require12(fallback);
       available = true;
     } catch {
       available = false;
@@ -94591,13 +94620,13 @@ async function checkAllDependencies() {
     warnings
   };
 }
-var _require13, _dirname, DEPENDENCY_SPECS;
+var _require12, _dirname, DEPENDENCY_SPECS;
 var init_dependencies = __esm({
   "packages/core/src/system/dependencies.ts"() {
     "use strict";
     init_platform();
-    _require13 = createRequire15(import.meta.url);
-    _dirname = dirname25(fileURLToPath9(import.meta.url));
+    _require12 = createRequire14(import.meta.url);
+    _dirname = dirname26(fileURLToPath10(import.meta.url));
     DEPENDENCY_SPECS = [
       // ── Required ────────────────────────────────────────────────────────────
       {
@@ -94677,12 +94706,12 @@ __export(project_health_exports, {
   probeDb: () => probeDb
 });
 import { access as fsAccess, readFile as readFile18, stat as stat3 } from "node:fs/promises";
-import { createRequire as createRequire16 } from "node:module";
-import { dirname as dirname26, join as join103 } from "node:path";
+import { createRequire as createRequire15 } from "node:module";
+import { dirname as dirname27, join as join103 } from "node:path";
 function getDatabaseSyncCtor() {
   if (_databaseSyncCtor !== void 0) return _databaseSyncCtor;
   try {
-    const mod = _require14("node:sqlite");
+    const mod = _require13("node:sqlite");
     _databaseSyncCtor = mod.DatabaseSync;
   } catch {
     _databaseSyncCtor = null;
@@ -95096,15 +95125,15 @@ async function writeHealthBack(reports, log15) {
   }
 }
 function _parentDirOf(dbPath) {
-  return dirname26(dbPath);
+  return dirname27(dbPath);
 }
-var _require14, _databaseSyncCtor, TASKS_DB, BRAIN_DB, CONDUIT_DB, NEXUS_DB, SIGNALDOCK_DB, CONFIG_JSON, PROJECT_INFO_JSON, DB_EXPECTED_VERSIONS, JSON_EXPECTED_VERSIONS;
+var _require13, _databaseSyncCtor, TASKS_DB, BRAIN_DB, CONDUIT_DB, NEXUS_DB, SIGNALDOCK_DB, CONFIG_JSON, PROJECT_INFO_JSON, DB_EXPECTED_VERSIONS, JSON_EXPECTED_VERSIONS;
 var init_project_health = __esm({
   "packages/core/src/system/project-health.ts"() {
     "use strict";
     init_logger();
     init_paths();
-    _require14 = createRequire16(import.meta.url);
+    _require13 = createRequire15(import.meta.url);
     TASKS_DB = "tasks.db";
     BRAIN_DB = "brain.db";
     CONDUIT_DB = "conduit.db";
@@ -95129,7 +95158,7 @@ var init_project_health = __esm({
 // packages/core/src/system/health.ts
 import { execFileSync as execFileSync13 } from "node:child_process";
 import { existsSync as existsSync99, readFileSync as readFileSync73, statSync as statSync21 } from "node:fs";
-import { createRequire as createRequire17 } from "node:module";
+import { createRequire as createRequire16 } from "node:module";
 import { join as join104 } from "node:path";
 function resolveStructuredLogPath(cleoDir) {
   const defaultPath = join104(cleoDir, "logs", "cleo.log");
@@ -95261,7 +95290,7 @@ async function getSystemHealth(projectRoot, opts) {
   const sdDbPath = join104(cleoDir, "signaldock.db");
   if (existsSync99(sdDbPath)) {
     try {
-      const { DatabaseSync: SdDb } = _require15("node:sqlite");
+      const { DatabaseSync: SdDb } = _require14("node:sqlite");
       const sdDb = new SdDb(sdDbPath);
       try {
         const tables = sdDb.prepare(
@@ -95417,8 +95446,8 @@ async function getSystemDiagnostics(projectRoot, opts) {
   if (existsSync99(dbPath)) {
     try {
       const accessor = await getAccessor(projectRoot);
-      const sessions2 = await accessor.loadSessions();
-      const activeSessions = sessions2.filter((s3) => s3.status === "active");
+      const sessions3 = await accessor.loadSessions();
+      const activeSessions = sessions3.filter((s3) => s3.status === "active");
       if (activeSessions.length > 3) {
         diagChecks.push({
           name: "stale_sessions",
@@ -96138,7 +96167,7 @@ async function startupHealthCheck(projectRoot) {
     system
   };
 }
-var _require15, databaseSyncCtor, STALE_JSON_FILES;
+var _require14, databaseSyncCtor, STALE_JSON_FILES;
 var init_health = __esm({
   "packages/core/src/system/health.ts"() {
     "use strict";
@@ -96152,10 +96181,10 @@ var init_health = __esm({
     init_checks3();
     init_dependencies();
     init_storage_preflight();
-    _require15 = createRequire17(import.meta.url);
+    _require14 = createRequire16(import.meta.url);
     databaseSyncCtor = (() => {
       try {
-        return _require15("node:sqlite").DatabaseSync;
+        return _require14("node:sqlite").DatabaseSync;
       } catch {
         return null;
       }
@@ -96190,8 +96219,8 @@ async function generateInjection(projectRoot, accessor) {
     activeSessionName = activeSessionMeta;
   }
   try {
-    const sessions2 = await acc.loadSessions();
-    const active = sessions2.find((s3) => s3.status === "active");
+    const sessions3 = await acc.loadSessions();
+    const active = sessions3.find((s3) => s3.status === "active");
     if (active) {
       activeSessionName = active.name || active.id;
       focusTask = active.taskWork?.taskId ?? focusTask;
@@ -96336,18 +96365,18 @@ async function getSystemMetrics(projectRoot, opts, accessor) {
   let sessionsCompleted = 0;
   try {
     if (accessor) {
-      const sessions2 = await accessor.loadSessions();
-      sessionsTotal = sessions2.length;
-      sessionsActive = sessions2.filter((s3) => s3.status === "active").length;
-      sessionsCompleted = sessions2.filter((s3) => s3.status === "ended").length;
+      const sessions3 = await accessor.loadSessions();
+      sessionsTotal = sessions3.length;
+      sessionsActive = sessions3.filter((s3) => s3.status === "active").length;
+      sessionsCompleted = sessions3.filter((s3) => s3.status === "ended").length;
     } else {
       const sessionsPath = join106(cleoDir, "sessions.json");
       if (existsSync101(sessionsPath)) {
         const sessionsData = JSON.parse(readFileSync75(sessionsPath, "utf-8"));
-        const sessions2 = sessionsData.sessions ?? [];
-        sessionsTotal = sessions2.length;
-        sessionsActive = sessions2.filter((s3) => s3.status === "active").length;
-        sessionsCompleted = sessions2.filter(
+        const sessions3 = sessionsData.sessions ?? [];
+        sessionsTotal = sessions3.length;
+        sessionsActive = sessions3.filter((s3) => s3.status === "active").length;
+        sessionsCompleted = sessions3.filter(
           (s3) => s3.status === "ended" || s3.status === "ended"
         ).length;
       }
@@ -97686,7 +97715,7 @@ var init_find3 = __esm({
 
 // packages/core/src/tasks/gate-audit.ts
 import { appendFile as appendFile5, mkdir as mkdir18, readFile as readFile21 } from "node:fs/promises";
-import { dirname as dirname27, resolve as resolvePath3 } from "node:path";
+import { dirname as dirname28, resolve as resolvePath3 } from "node:path";
 function getGateAuditPath(projectRoot) {
   return resolvePath3(projectRoot, ".cleo", "audit", "gates.jsonl");
 }
@@ -97695,14 +97724,14 @@ function getForceBypassPath(projectRoot) {
 }
 async function appendGateAuditLine(projectRoot, record2) {
   const path15 = getGateAuditPath(projectRoot);
-  await mkdir18(dirname27(path15), { recursive: true });
+  await mkdir18(dirname28(path15), { recursive: true });
   const line2 = `${JSON.stringify(record2)}
 `;
   await appendFile5(path15, line2, { encoding: "utf-8" });
 }
 async function appendForceBypassLine(projectRoot, record2) {
   const path15 = getForceBypassPath(projectRoot);
-  await mkdir18(dirname27(path15), { recursive: true });
+  await mkdir18(dirname28(path15), { recursive: true });
   const line2 = `${JSON.stringify(record2)}
 `;
   await appendFile5(path15, line2, { encoding: "utf-8" });
@@ -97873,7 +97902,7 @@ __export(schema_exports, {
   telemetryEvents: () => telemetryEvents,
   telemetrySchemaMeta: () => telemetrySchemaMeta
 });
-import { sql as sql12 } from "drizzle-orm";
+import { sql as sql13 } from "drizzle-orm";
 var telemetryEvents, telemetrySchemaMeta;
 var init_schema = __esm({
   "packages/core/src/telemetry/schema.ts"() {
@@ -97901,7 +97930,7 @@ var init_schema = __esm({
         /** Machine-readable error code when exit_code != 0. NULL on success. */
         errorCode: text2("error_code"),
         /** ISO-8601 timestamp of the invocation. */
-        timestamp: text2("timestamp").notNull().default(sql12`(datetime('now'))`)
+        timestamp: text2("timestamp").notNull().default(sql13`(datetime('now'))`)
       },
       (table) => [
         index("idx_telemetry_command").on(table.command),
@@ -97922,14 +97951,14 @@ var init_schema = __esm({
 
 // packages/core/src/telemetry/sqlite.ts
 import { mkdirSync as mkdirSync28 } from "node:fs";
-import { dirname as dirname28, join as join110 } from "node:path";
-import { fileURLToPath as fileURLToPath10 } from "node:url";
+import { dirname as dirname29, join as join110 } from "node:path";
+import { fileURLToPath as fileURLToPath11 } from "node:url";
 function getTelemetryDbPath() {
   return join110(getCleoHome(), DB_FILENAME4);
 }
 function resolveTelemetryMigrationsFolder() {
-  const __filename = fileURLToPath10(import.meta.url);
-  const __dir = dirname28(__filename);
+  const __filename = fileURLToPath11(import.meta.url);
+  const __dir = dirname29(__filename);
   const isBundled = __dir.endsWith("/dist") || __dir.endsWith("\\dist");
   const pkgRoot = isBundled ? join110(__dir, "..") : join110(__dir, "..", "..");
   return join110(pkgRoot, "migrations", "drizzle-telemetry");
@@ -97974,7 +98003,7 @@ async function getTelemetryDb() {
   _initPromise3 = (async () => {
     const dbPath = requestedPath;
     _dbPath3 = dbPath;
-    mkdirSync28(dirname28(dbPath), { recursive: true });
+    mkdirSync28(dirname29(dbPath), { recursive: true });
     const nativeDb = openNativeDatabase(dbPath);
     _nativeDb3 = nativeDb;
     const db = drizzle({ client: nativeDb, schema: schema_exports });
@@ -98025,7 +98054,7 @@ __export(telemetry_exports, {
 import { randomUUID as randomUUID8 } from "node:crypto";
 import { existsSync as existsSync106, mkdirSync as mkdirSync29, readFileSync as readFileSync76, writeFileSync as writeFileSync19 } from "node:fs";
 import { join as join111 } from "node:path";
-import { and as and11, count as count2, desc as desc5, gt as gt2, sql as sql13 } from "drizzle-orm";
+import { and as and11, count as count2, desc as desc5, gt as gt2, sql as sql14 } from "drizzle-orm";
 function getTelemetryConfigPath() {
   return join111(getCleoHome(), TELEMETRY_CONFIG_FILENAME);
 }
@@ -98109,15 +98138,15 @@ async function buildDiagnosticsReport(days = 30) {
   const rows = await db.select({
     command: telemetryEvents.command,
     total: count2(telemetryEvents.id),
-    failures: sql13`SUM(CASE WHEN ${telemetryEvents.exitCode} != 0 THEN 1 ELSE 0 END)`,
-    avgMs: sql13`AVG(${telemetryEvents.durationMs})`,
-    maxMs: sql13`MAX(${telemetryEvents.durationMs})`
+    failures: sql14`SUM(CASE WHEN ${telemetryEvents.exitCode} != 0 THEN 1 ELSE 0 END)`,
+    avgMs: sql14`AVG(${telemetryEvents.durationMs})`,
+    maxMs: sql14`MAX(${telemetryEvents.durationMs})`
   }).from(telemetryEvents).where(gt2(telemetryEvents.timestamp, from)).groupBy(telemetryEvents.command).all();
   const errorCodeRows = await db.select({
     command: telemetryEvents.command,
     errorCode: telemetryEvents.errorCode,
     n: count2(telemetryEvents.id)
-  }).from(telemetryEvents).where(and11(gt2(telemetryEvents.timestamp, from), sql13`${telemetryEvents.errorCode} IS NOT NULL`)).groupBy(telemetryEvents.command, telemetryEvents.errorCode).orderBy(desc5(count2(telemetryEvents.id))).all();
+  }).from(telemetryEvents).where(and11(gt2(telemetryEvents.timestamp, from), sql14`${telemetryEvents.errorCode} IS NOT NULL`)).groupBy(telemetryEvents.command, telemetryEvents.errorCode).orderBy(desc5(count2(telemetryEvents.id))).all();
   const topErrorMap = /* @__PURE__ */ new Map();
   for (const r of errorCodeRows) {
     if (!topErrorMap.has(r.command)) {
@@ -99427,8 +99456,8 @@ var init_validation_schemas = __esm({
     sessionRefinements = {
       name: (s3) => s3.min(1).max(200)
     };
-    insertSessionSchema = createInsertSchema2(sessions, sessionRefinements);
-    selectSessionSchema = createSelectSchema2(sessions, sessionRefinements);
+    insertSessionSchema = createInsertSchema2(sessions2, sessionRefinements);
+    selectSessionSchema = createSelectSchema2(sessions2, sessionRefinements);
     insertWorkHistorySchema = createInsertSchema2(taskWorkHistory);
     selectWorkHistorySchema = createSelectSchema2(taskWorkHistory);
     lifecyclePipelineRefinements = {
@@ -99828,7 +99857,7 @@ var init_docs_sync = __esm({
 // packages/core/src/validation/doctor/project-cache.ts
 import { createHash as createHash20 } from "node:crypto";
 import { existsSync as existsSync112, mkdirSync as mkdirSync30, readFileSync as readFileSync82, unlinkSync as unlinkSync9, writeFileSync as writeFileSync22 } from "node:fs";
-import { dirname as dirname29, join as join116 } from "node:path";
+import { dirname as dirname30, join as join116 } from "node:path";
 function getCacheFilePath(cleoHome) {
   const home = cleoHome ?? getCleoHome();
   return join116(home, CACHE_FILE2);
@@ -99839,7 +99868,7 @@ function initCacheFile(cacheFile) {
     lastUpdated: (/* @__PURE__ */ new Date()).toISOString(),
     projects: {}
   };
-  const dir = dirname29(cacheFile);
+  const dir = dirname30(cacheFile);
   if (!existsSync112(dir)) {
     mkdirSync30(dir, { recursive: true });
   }
@@ -100939,7 +100968,7 @@ var init_gap_check = __esm({
 // packages/core/src/validation/manifest.ts
 import { existsSync as existsSync113 } from "node:fs";
 import { appendFile as appendFile6, mkdir as mkdir19, readFile as readFile22 } from "node:fs/promises";
-import { dirname as dirname30 } from "node:path";
+import { dirname as dirname31 } from "node:path";
 async function findManifestEntry(taskId, manifestPath) {
   if (!manifestPath) {
     try {
@@ -101060,7 +101089,7 @@ async function validateManifestEntry(taskId, manifestEntry, manifestPath = DEFAU
   };
 }
 async function logRealCompliance(taskId, validationResult, agentType = "unknown", compliancePath = DEFAULT_COMPLIANCE_PATH) {
-  const metricsDir = dirname30(compliancePath);
+  const metricsDir = dirname31(compliancePath);
   await mkdir19(metricsDir, { recursive: true });
   const { score, pass, violations } = validationResult;
   const violationCount = violations.length;
@@ -102224,13 +102253,13 @@ __export(init_exports, {
 import { existsSync as existsSync116, readdirSync as readdirSync37, readFileSync as readFileSync84 } from "node:fs";
 import { copyFile as copyFile4, lstat, mkdir as mkdir20, readFile as readFile23, symlink, unlink as unlink4, writeFile as writeFile12 } from "node:fs/promises";
 import { platform as platform5 } from "node:os";
-import { basename as basename17, dirname as dirname31, join as join118 } from "node:path";
+import { basename as basename17, dirname as dirname32, join as join118 } from "node:path";
 async function resolveSeedAgentsDir() {
   try {
-    const { createRequire: createRequire24 } = await import("node:module");
-    const req = createRequire24(import.meta.url);
+    const { createRequire: createRequire23 } = await import("node:module");
+    const req = createRequire23(import.meta.url);
     const agentsPkgMain = req.resolve("@cleocode/agents/package.json");
-    const agentsPkgRoot = dirname31(agentsPkgMain);
+    const agentsPkgRoot = dirname32(agentsPkgMain);
     const candidate = join118(agentsPkgRoot, "seed-agents");
     if (existsSync116(candidate)) {
       return candidate;
@@ -102255,10 +102284,10 @@ async function resolveSeedAgentsDir() {
 async function initAgentDefinition(created, warnings) {
   let agentSourceDir = null;
   try {
-    const { createRequire: createRequire24 } = await import("node:module");
-    const req = createRequire24(import.meta.url);
+    const { createRequire: createRequire23 } = await import("node:module");
+    const req = createRequire23(import.meta.url);
     const agentsPkgMain = req.resolve("@cleocode/agents/package.json");
-    const agentsPkgRoot = dirname31(agentsPkgMain);
+    const agentsPkgRoot = dirname32(agentsPkgMain);
     const candidate = join118(agentsPkgRoot, "cleo-subagent");
     if (existsSync116(candidate)) {
       agentSourceDir = candidate;
@@ -102277,7 +102306,7 @@ async function initAgentDefinition(created, warnings) {
     return;
   }
   const globalAgentsDir = join118(getAgentsHome(), "agents", "cleo-subagent");
-  await mkdir20(dirname31(globalAgentsDir), { recursive: true });
+  await mkdir20(dirname32(globalAgentsDir), { recursive: true });
   try {
     try {
       const stat8 = await lstat(globalAgentsDir);
@@ -102322,10 +102351,10 @@ async function initCoreSkills(created, warnings) {
     const packageRoot = getPackageRoot();
     let ctSkillsRoot = null;
     try {
-      const { createRequire: createRequire24 } = await import("node:module");
-      const req = createRequire24(import.meta.url);
+      const { createRequire: createRequire23 } = await import("node:module");
+      const req = createRequire23(import.meta.url);
       const skillsPkgMain = req.resolve("@cleocode/skills/package.json");
-      const skillsPkgRoot = dirname31(skillsPkgMain);
+      const skillsPkgRoot = dirname32(skillsPkgMain);
       if (existsSync116(join118(skillsPkgRoot, "skills.json"))) {
         ctSkillsRoot = skillsPkgRoot;
       }
@@ -102356,11 +102385,11 @@ async function initCoreSkills(created, warnings) {
     }
     const catalogPath = join118(ctSkillsRoot, "skills.json");
     const catalog5 = JSON.parse(readFileSync84(catalogPath, "utf-8"));
-    const skills = catalog5.skills ?? [];
-    const coreSkills = skills.filter((s3) => s3.tier <= 2);
+    const skills2 = catalog5.skills ?? [];
+    const coreSkills = skills2.filter((s3) => s3.tier <= 2);
     const installed = [];
     for (const skill of coreSkills) {
-      const skillSourceDir = dirname31(join118(ctSkillsRoot, skill.path));
+      const skillSourceDir = dirname32(join118(ctSkillsRoot, skill.path));
       if (!existsSync116(skillSourceDir)) {
         continue;
       }
@@ -102465,7 +102494,7 @@ async function updateDocs() {
 }
 async function initProject(opts = {}) {
   const cleoDir = getCleoDirAbsolute();
-  const projRoot = dirname31(cleoDir);
+  const projRoot = dirname32(cleoDir);
   const alreadyInitialized = existsSync116(cleoDir) && (existsSync116(join118(cleoDir, "tasks.db")) || existsSync116(join118(cleoDir, "config.json")));
   if (alreadyInitialized && !opts.force) {
     throw new CleoError(
@@ -102831,10 +102860,10 @@ async function deployStarterBundle(cleoDir, created, warnings) {
   if (hasCantFiles) return;
   let starterBundleSrc = null;
   try {
-    const { createRequire: createRequire24 } = await import("node:module");
-    const req = createRequire24(import.meta.url);
+    const { createRequire: createRequire23 } = await import("node:module");
+    const req = createRequire23(import.meta.url);
     const cleoOsPkgMain = req.resolve("@cleocode/cleo-os/package.json");
-    const cleoOsPkgRoot = dirname31(cleoOsPkgMain);
+    const cleoOsPkgRoot = dirname32(cleoOsPkgMain);
     const candidate = join118(cleoOsPkgRoot, "starter-bundle");
     if (existsSync116(candidate)) {
       starterBundleSrc = candidate;
@@ -103074,8 +103103,8 @@ async function ensureCleoSymlink(ctx) {
 }
 async function writeTemplateTo(content, destPath, isDryRun) {
   if (isDryRun) return false;
-  const { dirname: dirname44 } = await import("node:path");
-  await mkdir21(dirname44(destPath), { recursive: true });
+  const { dirname: dirname46 } = await import("node:path");
+  await mkdir21(dirname46(destPath), { recursive: true });
   await writeFile13(destPath, content);
   return true;
 }
@@ -103540,12 +103569,12 @@ async function serializeSession(projectRoot, options = {}, accessor) {
   const acc = accessor ?? await getAccessor(projectRoot);
   const maxObs = options.maxObservations ?? 10;
   const maxDescLen = options.maxDescriptionLength ?? 500;
-  const sessions2 = await acc.loadSessions();
+  const sessions3 = await acc.loadSessions();
   let session;
   if (options.sessionId) {
-    session = sessions2.find((s3) => s3.id === options.sessionId);
+    session = sessions3.find((s3) => s3.id === options.sessionId);
   } else {
-    session = sessions2.filter((s3) => s3.status === "active").sort((a, b2) => new Date(b2.startedAt).getTime() - new Date(a.startedAt).getTime())[0];
+    session = sessions3.filter((s3) => s3.status === "active").sort((a, b2) => new Date(b2.startedAt).getTime() - new Date(a.startedAt).getTime())[0];
   }
   if (!session) {
     throw new CleoError(
@@ -103626,9 +103655,9 @@ async function restoreSession(projectRoot, snapshot, options = {}, accessor) {
   const acc = accessor ?? await getAccessor(projectRoot);
   const activate = options.activate ?? true;
   if (activate) {
-    const sessions2 = await acc.loadSessions();
+    const sessions3 = await acc.loadSessions();
     const scope = snapshot.session.scope;
-    const activeConflict = sessions2.find(
+    const activeConflict = sessions3.find(
       (s3) => s3.status === "active" && s3.scope.type === scope.type && s3.scope.epicId === scope.epicId && s3.id !== snapshot.session.id
     );
     if (activeConflict) {
@@ -105288,7 +105317,7 @@ __export(attachment_store_exports, {
 import { createHash as createHash21, randomUUID as randomUUID10 } from "node:crypto";
 import { mkdir as mkdir22, readFile as readFile25, rm as rm3, writeFile as writeFile14 } from "node:fs/promises";
 import { join as join121 } from "node:path";
-import { and as and12, eq as eq15, sql as sql14 } from "drizzle-orm";
+import { and as and12, eq as eq15, sql as sql15 } from "drizzle-orm";
 function extFromMime(mime) {
   const base = mime.split(";")[0]?.trim() ?? mime;
   return MIME_TO_EXT[base] ?? ".bin";
@@ -105396,7 +105425,7 @@ function createAttachmentStore() {
             attachedAt: (/* @__PURE__ */ new Date()).toISOString(),
             attachedBy: attachedBy ?? null
           }).run();
-          await db.update(attachments).set({ refCount: sql14`ref_count + 1` }).where(eq15(attachments.id, attachmentId)).run();
+          await db.update(attachments).set({ refCount: sql15`ref_count + 1` }).where(eq15(attachments.id, attachmentId)).run();
           nativeDb.prepare("COMMIT").run();
           if (wasNew) {
             await mkdir22(join121(filePath, ".."), { recursive: true });
@@ -105471,7 +105500,7 @@ function createAttachmentStore() {
             attachedAt: (/* @__PURE__ */ new Date()).toISOString(),
             attachedBy: attachedBy ?? null
           }).run();
-          await db.update(attachments).set({ refCount: sql14`ref_count + 1` }).where(eq15(attachments.id, attachmentId)).run();
+          await db.update(attachments).set({ refCount: sql15`ref_count + 1` }).where(eq15(attachments.id, attachmentId)).run();
           nativeDb.prepare("COMMIT").run();
         } catch (err) {
           try {
@@ -105511,7 +105540,7 @@ function createAttachmentStore() {
             }
             return { status: "removed" };
           }
-          await db.update(attachments).set({ refCount: sql14`ref_count - 1` }).where(eq15(attachments.id, attachmentId)).run();
+          await db.update(attachments).set({ refCount: sql15`ref_count - 1` }).where(eq15(attachments.id, attachmentId)).run();
           nativeDb.prepare("COMMIT").run();
           return { status: "derefd", refCountAfter: newCount };
         } catch (err) {
@@ -105799,8 +105828,8 @@ var init_llmtxt_blob_adapter = __esm({
           db = this.opts.db;
         } else {
           const { drizzle: drizzle2, NodeSqliteDatabase } = await loadDrizzle();
-          const { mkdir: mkdir28 } = await import("node:fs/promises");
-          await mkdir28(path6.dirname(manifestDbPath), { recursive: true });
+          const { mkdir: mkdir29 } = await import("node:fs/promises");
+          await mkdir29(path6.dirname(manifestDbPath), { recursive: true });
           const nativeDb = new NodeSqliteDatabase(manifestDbPath);
           this.ownedNativeDb = nativeDb;
           db = drizzle2({ client: nativeDb });
@@ -105947,7 +105976,7 @@ var init_blob_ops = __esm({
 // packages/core/src/docs/docs-ops.ts
 import { createHash as createHash22 } from "node:crypto";
 import { mkdir as mkdir23 } from "node:fs/promises";
-import { dirname as dirname32, isAbsolute as isAbsolute4, join as join122 } from "node:path";
+import { dirname as dirname33, isAbsolute as isAbsolute4, join as join122 } from "node:path";
 function throwUnavailable(primitive, cause) {
   const msg = `LLMTXT_PRIMITIVE_UNAVAILABLE: cannot import "${primitive}". Requires llmtxt >= ${REQUIRED_LLMTXT_VERSION}. Install with: pnpm add llmtxt@${REQUIRED_LLMTXT_VERSION}`;
   const err = new Error(msg);
@@ -106156,7 +106185,7 @@ async function publishDocs(opts) {
   }
   const publishedPath = isAbsolute4(opts.toPath) ? opts.toPath : join122(root, opts.toPath);
   const tmpPath = `${publishedPath}.cleo-publish-tmp`;
-  await mkdir23(dirname32(publishedPath), { recursive: true });
+  await mkdir23(dirname33(publishedPath), { recursive: true });
   const { writeFile: writeFile18, rename: rename3 } = await import("node:fs/promises");
   await writeFile18(tmpPath, bytes);
   await rename3(tmpPath, publishedPath);
@@ -109004,7 +109033,7 @@ var init_brain_export = __esm({
 });
 
 // packages/core/src/memory/brain-purge.ts
-import { inArray as inArray6, ne as ne3, sql as sql15 } from "drizzle-orm";
+import { inArray as inArray6, ne as ne3, sql as sql16 } from "drizzle-orm";
 function countRowsNative(tableName) {
   const nativeDb = getBrainNativeDb();
   if (!nativeDb) return 0;
@@ -109026,7 +109055,7 @@ async function purgeBrainNoise(projectRoot) {
   console.log(`  Learnings:    ${beforeLearnings}`);
   console.log(`  Decisions:    ${beforeDecisions}`);
   console.log(`  Observations: ${beforeObservations}`);
-  const realDecision = await db.select().from(brainDecisions).where(sql15`id = 'D-mntpeeer'`);
+  const realDecision = await db.select().from(brainDecisions).where(sql16`id = 'D-mntpeeer'`);
   if (realDecision.length === 0) {
     throw new Error(
       "SAFETY ABORT: D-mntpeeer not found in brain_decisions. Backup and restore required."
@@ -109173,9 +109202,9 @@ var init_brain_purge = __esm({
 
 // packages/core/src/memory/claude-mem-migration.ts
 import { existsSync as existsSync119 } from "node:fs";
-import { createRequire as createRequire18 } from "node:module";
-function typedAll3(db, sql18) {
-  return db.prepare(sql18).all();
+import { createRequire as createRequire17 } from "node:module";
+function typedAll3(db, sql19) {
+  return db.prepare(sql19).all();
 }
 function mapObservationType(type2) {
   if (VALID_OBSERVATION_TYPES.has(type2)) {
@@ -109396,15 +109425,15 @@ Use --source <path> to specify a custom location.`
   }
   return result;
 }
-var _require16, DatabaseSync7, VALID_OBSERVATION_TYPES;
+var _require15, DatabaseSync7, VALID_OBSERVATION_TYPES;
 var init_claude_mem_migration = __esm({
   "packages/core/src/memory/claude-mem-migration.ts"() {
     "use strict";
     init_paths();
     init_memory_sqlite();
     init_brain_search();
-    _require16 = createRequire18(import.meta.url);
-    ({ DatabaseSync: DatabaseSync7 } = _require16("node:sqlite"));
+    _require15 = createRequire17(import.meta.url);
+    ({ DatabaseSync: DatabaseSync7 } = _require15("node:sqlite"));
     VALID_OBSERVATION_TYPES = /* @__PURE__ */ new Set([
       "discovery",
       "change",
@@ -112247,7 +112276,7 @@ var init_hooks_augment = __esm({
 });
 
 // packages/core/src/nexus/plasticity-queries.ts
-import { sql as sql16 } from "drizzle-orm";
+import { sql as sql17 } from "drizzle-orm";
 function emptyResult(key, note) {
   return { [key]: [], count: 0, note };
 }
@@ -112256,7 +112285,7 @@ async function getHotPaths(_projectRoot, limit = 20) {
   if (!db) {
     return emptyResult("paths", "nexus database not initialised");
   }
-  const stmt = sql16`
+  const stmt = sql17`
     SELECT source_id AS sourceId,
            target_id AS targetId,
            type AS type,
@@ -112287,7 +112316,7 @@ async function getHotNodes(_projectRoot, limit = 20) {
   if (!db) {
     return emptyResult("nodes", "nexus database not initialised");
   }
-  const stmt = sql16`
+  const stmt = sql17`
     SELECT r.source_id AS sourceId,
            COALESCE(n.label, r.source_id) AS label,
            n.file_path AS filePath,
@@ -112322,7 +112351,7 @@ async function getColdSymbols(_projectRoot, thresholdDays = 30) {
     return { symbols: [], count: 0, thresholdDays, note: "nexus database not initialised" };
   }
   const cutoff = new Date(Date.now() - thresholdDays * 864e5).toISOString();
-  const stmt = sql16`
+  const stmt = sql17`
     SELECT r.source_id AS sourceId,
            COALESCE(n.label, r.source_id) AS label,
            n.file_path AS filePath,
@@ -115943,7 +115972,7 @@ var init_t310_readiness = __esm({
 // packages/core/src/store/backup-pack.ts
 import crypto5 from "node:crypto";
 import fs9 from "node:fs";
-import { createRequire as createRequire19 } from "node:module";
+import { createRequire as createRequire18 } from "node:module";
 import os3 from "node:os";
 import path7 from "node:path";
 function resolveContractsSchemasDir() {
@@ -116371,7 +116400,7 @@ async function packBundle(input) {
     }
   }
 }
-var _require17, DatabaseSync8;
+var _require16, DatabaseSync8;
 var init_backup_pack = __esm({
   "packages/core/src/store/backup-pack.ts"() {
     "use strict";
@@ -116383,8 +116412,8 @@ var init_backup_pack = __esm({
     init_nexus_sqlite();
     init_signaldock_sqlite();
     init_t310_readiness();
-    _require17 = createRequire19(import.meta.url);
-    ({ DatabaseSync: DatabaseSync8 } = _require17("node:sqlite"));
+    _require16 = createRequire18(import.meta.url);
+    ({ DatabaseSync: DatabaseSync8 } = _require16("node:sqlite"));
   }
 });
 
@@ -116452,7 +116481,7 @@ var init_cleanup_legacy = __esm({
 
 // packages/core/src/store/migrate-signaldock-to-conduit.ts
 import { existsSync as existsSync126, mkdirSync as mkdirSync32, renameSync as renameSync10, unlinkSync as unlinkSync10 } from "node:fs";
-import { createRequire as createRequire20 } from "node:module";
+import { createRequire as createRequire19 } from "node:module";
 import { join as join129 } from "node:path";
 function needsSignaldockToConduitMigration(projectRoot) {
   const legacyPath = join129(projectRoot, ".cleo", "signaldock.db");
@@ -116783,7 +116812,7 @@ function migrateSignaldockToConduit(projectRoot) {
   result.status = "migrated";
   return result;
 }
-var _require18, DatabaseSync9, PROJECT_TIER_TABLES, GLOBAL_IDENTITY_TABLES;
+var _require17, DatabaseSync9, PROJECT_TIER_TABLES, GLOBAL_IDENTITY_TABLES;
 var init_migrate_signaldock_to_conduit = __esm({
   "packages/core/src/store/migrate-signaldock-to-conduit.ts"() {
     "use strict";
@@ -116792,8 +116821,8 @@ var init_migrate_signaldock_to_conduit = __esm({
     init_conduit_sqlite();
     init_global_salt();
     init_signaldock_sqlite();
-    _require18 = createRequire20(import.meta.url);
-    ({ DatabaseSync: DatabaseSync9 } = _require18("node:sqlite"));
+    _require17 = createRequire19(import.meta.url);
+    ({ DatabaseSync: DatabaseSync9 } = _require17("node:sqlite"));
     PROJECT_TIER_TABLES = [
       "messages",
       "conversations",
@@ -116842,7 +116871,7 @@ import { and as and14, desc as desc7, eq as eq18, isNull as isNull4 } from "driz
 async function createSession(session, cwd) {
   const db = await getDb(cwd);
   const tw = session.taskWork;
-  db.insert(sessions).values({
+  db.insert(sessions2).values({
     id: session.id,
     name: session.name,
     status: session.status,
@@ -116860,7 +116889,7 @@ async function createSession(session, cwd) {
 }
 async function getSession(sessionId, cwd) {
   const db = await getDb(cwd);
-  const rows = await db.select().from(sessions).where(eq18(sessions.id, sessionId)).all();
+  const rows = await db.select().from(sessions2).where(eq18(sessions2.id, sessionId)).all();
   if (rows.length === 0) return null;
   return rowToSession(rows[0]);
 }
@@ -116889,16 +116918,16 @@ async function updateSession(sessionId, updates, cwd) {
     updateRow.handoffConsumedBy = updates.handoffConsumedBy;
   if (updates.debriefJson !== void 0) updateRow.debriefJson = updates.debriefJson;
   if (updates.handoffJson !== void 0) updateRow.handoffJson = updates.handoffJson;
-  db.update(sessions).set(updateRow).where(eq18(sessions.id, sessionId)).run();
+  db.update(sessions2).set(updateRow).where(eq18(sessions2.id, sessionId)).run();
   return getSession(sessionId, cwd);
 }
 async function listSessions2(filters, cwd) {
   const db = await getDb(cwd);
   const conditions = [];
   if (filters?.active) {
-    conditions.push(eq18(sessions.status, "active"));
+    conditions.push(eq18(sessions2.status, "active"));
   }
-  const query = db.select().from(sessions).where(conditions.length > 0 ? and14(...conditions) : void 0).orderBy(desc7(sessions.startedAt));
+  const query = db.select().from(sessions2).where(conditions.length > 0 ? and14(...conditions) : void 0).orderBy(desc7(sessions2.startedAt));
   const rows = filters?.limit ? await query.limit(filters.limit).all() : await query.all();
   return rows.map(rowToSession);
 }
@@ -116926,14 +116955,14 @@ async function startTask2(sessionId, taskId, cwd) {
     )
   ).run();
   db.insert(taskWorkHistory).values({ sessionId, taskId, setAt: now2 }).run();
-  db.update(sessions).set({ currentTask: taskId, taskStartedAt: now2 }).where(eq18(sessions.id, sessionId)).run();
+  db.update(sessions2).set({ currentTask: taskId, taskStartedAt: now2 }).where(eq18(sessions2.id, sessionId)).run();
 }
 async function getCurrentTask(sessionId, cwd) {
   const db = await getDb(cwd);
   const rows = await db.select({
-    currentTask: sessions.currentTask,
-    taskStartedAt: sessions.taskStartedAt
-  }).from(sessions).where(eq18(sessions.id, sessionId)).all();
+    currentTask: sessions2.currentTask,
+    taskStartedAt: sessions2.taskStartedAt
+  }).from(sessions2).where(eq18(sessions2.id, sessionId)).all();
   if (rows.length === 0) return { taskId: null, since: null };
   return { taskId: rows[0].currentTask, since: rows[0].taskStartedAt };
 }
@@ -116946,7 +116975,7 @@ async function stopTask2(sessionId, cwd) {
       isNull4(taskWorkHistory.clearedAt)
     )
   ).run();
-  db.update(sessions).set({ currentTask: null, taskStartedAt: null }).where(eq18(sessions.id, sessionId)).run();
+  db.update(sessions2).set({ currentTask: null, taskStartedAt: null }).where(eq18(sessions2.id, sessionId)).run();
 }
 async function workHistory(sessionId, limit = 50, cwd) {
   const db = await getDb(cwd);
@@ -116961,16 +116990,16 @@ async function gcSessions2(maxAgeDays = 30, cwd) {
   const db = await getDb(cwd);
   const threshold = /* @__PURE__ */ new Date();
   threshold.setDate(threshold.getDate() - maxAgeDays);
-  const before = await db.select({ id: sessions.id }).from(sessions).where(and14(eq18(sessions.status, "ended"))).all();
+  const before = await db.select({ id: sessions2.id }).from(sessions2).where(and14(eq18(sessions2.status, "ended"))).all();
   const toUpdate = before;
   if (toUpdate.length > 0) {
-    db.update(sessions).set({ status: "orphaned" }).where(eq18(sessions.status, "ended")).run();
+    db.update(sessions2).set({ status: "orphaned" }).where(eq18(sessions2.status, "ended")).run();
   }
   return toUpdate.length;
 }
 async function getActiveSession(cwd) {
   const db = await getDb(cwd);
-  const rows = await db.select().from(sessions).where(eq18(sessions.status, "active")).orderBy(desc7(sessions.startedAt)).limit(1).all();
+  const rows = await db.select().from(sessions2).where(eq18(sessions2.status, "active")).orderBy(desc7(sessions2.startedAt)).limit(1).all();
   if (rows.length === 0) return null;
   return rowToSession(rows[0]);
 }
@@ -117139,7 +117168,7 @@ __export(task_store_exports, {
   updateTask: () => updateTask2,
   updateTaskSafe: () => updateTaskSafe
 });
-import { and as and15, asc as asc4, count as count4, eq as eq20, inArray as inArray7, isNull as isNull5, ne as ne5, sql as sql17 } from "drizzle-orm";
+import { and as and15, asc as asc4, count as count4, eq as eq20, inArray as inArray7, isNull as isNull5, ne as ne5, sql as sql18 } from "drizzle-orm";
 async function insertTaskRow(task, cwd) {
   const db = await getDb(cwd);
   const row = taskToRow(task);
@@ -117242,7 +117271,7 @@ async function findTasks2(query, limit = 20, cwd) {
   const rows = await db.select().from(tasks).where(
     and15(
       ne5(tasks.status, "archived"),
-      sql17`(${tasks.id} LIKE ${pattern} OR ${tasks.title} LIKE ${pattern} OR ${tasks.description} LIKE ${pattern})`
+      sql18`(${tasks.id} LIKE ${pattern} OR ${tasks.title} LIKE ${pattern} OR ${tasks.description} LIKE ${pattern})`
     )
   ).limit(limit).all();
   return rows.map(rowToTask);
@@ -118264,11 +118293,11 @@ async function coreTaskHistory(projectRoot, taskId, limit) {
   try {
     const { getDb: getDb5 } = await Promise.resolve().then(() => (init_sqlite2(), sqlite_exports));
     const { auditLog: auditLog2 } = await Promise.resolve().then(() => (init_tasks_schema(), tasks_schema_exports));
-    const { sql: sql18 } = await import("drizzle-orm");
+    const { sql: sql19 } = await import("drizzle-orm");
     const db = await getDb5(projectRoot);
     const maxRows = limit && limit > 0 ? limit : 100;
     const rows = await db.all(
-      sql18`SELECT * FROM ${auditLog2}
+      sql19`SELECT * FROM ${auditLog2}
           WHERE ${auditLog2.taskId} = ${taskId}
           ORDER BY ${auditLog2.timestamp} DESC
           LIMIT ${maxRows}`
@@ -118594,7 +118623,7 @@ __export(migration_sqlite_exports, {
   migrateJsonToSqliteAtomic: () => migrateJsonToSqliteAtomic
 });
 import { existsSync as existsSync127, mkdirSync as mkdirSync33, readFileSync as readFileSync91 } from "node:fs";
-import { dirname as dirname33, join as join130 } from "node:path";
+import { dirname as dirname34, join as join130 } from "node:path";
 function topoSortTasks(tasks2) {
   const taskMap = new Map(tasks2.map((t) => [t.id, t]));
   const sorted = [];
@@ -118628,7 +118657,7 @@ function topoSortTasks(tasks2) {
 function countJsonRecords(cleoDir) {
   let tasks2 = 0;
   let archived = 0;
-  let sessions2 = 0;
+  let sessions3 = 0;
   const todoPath = join130(cleoDir, "todo.json");
   if (existsSync127(todoPath)) {
     try {
@@ -118649,11 +118678,11 @@ function countJsonRecords(cleoDir) {
   if (existsSync127(sessionsPath)) {
     try {
       const data = JSON.parse(readFileSync91(sessionsPath, "utf-8"));
-      sessions2 = (data.sessions ?? []).length;
+      sessions3 = (data.sessions ?? []).length;
     } catch {
     }
   }
-  return { tasks: tasks2, archived, sessions: sessions2 };
+  return { tasks: tasks2, archived, sessions: sessions3 };
 }
 async function migrateJsonToSqliteAtomic(cwd, tempDbPath, logger) {
   const cleoDir = getCleoDirAbsolute(cwd);
@@ -118672,12 +118701,12 @@ async function migrateJsonToSqliteAtomic(cwd, tempDbPath, logger) {
   closeDb2();
   try {
     logger?.info("import", "init", "Initializing node:sqlite for migration");
-    mkdirSync33(dirname33(tempDbPath), { recursive: true });
+    mkdirSync33(dirname34(tempDbPath), { recursive: true });
     const nativeDb = openNativeDatabase(tempDbPath, { enableWal: true });
     const db = drizzle({ client: nativeDb, schema: tasks_schema_exports });
     logger?.info("import", "create-tables", "Running drizzle migrations to create tables");
     const migrationsFolder = resolveMigrationsFolder();
-    migrate(db, { migrationsFolder });
+    migrateSanitized(db, { migrationsFolder });
     if (process.env.VITEST) {
       nativeDb.exec("PRAGMA foreign_keys=OFF");
     }
@@ -118873,18 +118902,18 @@ async function runMigrationDataImport(db, cleoDir, result, logger) {
         path: sessionsPath.replace(cleoDir, ".")
       });
       const sessionsData = JSON.parse(readFileSync91(sessionsPath, "utf-8"));
-      const sessions2 = sessionsData.sessions ?? [];
-      const totalSessions = sessions2.length;
+      const sessions3 = sessionsData.sessions ?? [];
+      const totalSessions = sessions3.length;
       logger?.info("import", "sessions-start", `Starting import of ${totalSessions} sessions`, {
         totalSessions
       });
-      for (let i = 0; i < sessions2.length; i++) {
-        const session = sessions2[i];
+      for (let i = 0; i < sessions3.length; i++) {
+        const session = sessions3[i];
         try {
           const validStatuses = ["active", "ended", "orphaned", "suspended"];
           const normalizedStatus = validStatuses.includes(session.status) ? session.status : "ended";
           const normalizedName = session.name || `session-${session.id}`;
-          await db.insert(sessions).values({
+          await db.insert(sessions2).values({
             id: session.id,
             name: normalizedName,
             status: normalizedStatus,
@@ -118899,7 +118928,7 @@ async function runMigrationDataImport(db, cleoDir, result, logger) {
             endedAt: session.endedAt
           }).onConflictDoNothing().run();
           result.sessionsImported++;
-          if ((i + 1) % 10 === 0 || i === sessions2.length - 1) {
+          if ((i + 1) % 10 === 0 || i === sessions3.length - 1) {
             logger?.logImportProgress("import", "sessions", result.sessionsImported, totalSessions);
           }
         } catch (err) {
@@ -118945,7 +118974,7 @@ async function migrateJsonToSqlite2(cwd, options) {
     const db2 = await getDb(cwd);
     const tasksResult = await db2.select({ count: count5() }).from(tasks).where(ne6(tasks.status, "archived")).get();
     const archivedResult = await db2.select({ count: count5() }).from(tasks).where(eq22(tasks.status, "archived")).get();
-    const sessionsResult = await db2.select({ count: count5() }).from(sessions).get();
+    const sessionsResult = await db2.select({ count: count5() }).from(sessions2).get();
     const existingCounts = {
       tasks: tasksResult?.count ?? 0,
       archived: archivedResult?.count ?? 0,
@@ -119095,13 +119124,13 @@ async function migrateJsonToSqlite2(cwd, options) {
   if (existsSync127(sessionsPath)) {
     try {
       const sessionsData = JSON.parse(readFileSync91(sessionsPath, "utf-8"));
-      const sessions2 = sessionsData.sessions ?? [];
-      for (const session of sessions2) {
+      const sessions3 = sessionsData.sessions ?? [];
+      for (const session of sessions3) {
         try {
           const validStatuses = ["active", "ended", "orphaned", "suspended"];
           const normalizedStatus = validStatuses.includes(session.status) ? session.status : "ended";
           const normalizedName = session.name || `session-${session.id}`;
-          db.insert(sessions).values({
+          db.insert(sessions2).values({
             id: session.id,
             name: normalizedName,
             status: normalizedStatus,
@@ -119144,15 +119173,15 @@ async function exportToJson(cwd) {
     updatedAt: row.updatedAt,
     completedAt: row.completedAt ?? void 0
   }));
-  const sessions2 = await listSessions3(void 0, cwd);
-  return { tasks: tasks2, archived, sessions: sessions2 };
+  const sessions3 = await listSessions3(void 0, cwd);
+  return { tasks: tasks2, archived, sessions: sessions3 };
 }
 var init_migration_sqlite = __esm({
   "packages/core/src/store/migration-sqlite.ts"() {
     "use strict";
     init_node_sqlite();
-    init_migrator2();
     init_paths();
+    init_migration_manager();
     init_sqlite2();
     init_tasks_schema();
   }
@@ -119196,10 +119225,10 @@ async function repairMissingSizes(cwd, dryRun) {
 async function repairMissingCompletedAt(cwd, dryRun) {
   const { getDb: getDb5 } = await Promise.resolve().then(() => (init_sqlite2(), sqlite_exports));
   const { tasks: tasks2 } = await Promise.resolve().then(() => (init_tasks_schema(), tasks_schema_exports));
-  const { sql: sql18 } = await import("drizzle-orm");
+  const { sql: sql19 } = await import("drizzle-orm");
   const db = await getDb5(cwd);
   const affected = await db.select({ id: tasks2.id }).from(tasks2).where(
-    sql18`(${tasks2.status} = 'done' OR ${tasks2.status} = 'cancelled') AND ${tasks2.completedAt} IS NULL`
+    sql19`(${tasks2.status} = 'done' OR ${tasks2.status} = 'cancelled') AND ${tasks2.completedAt} IS NULL`
   );
   if (affected.length === 0) {
     return {
@@ -119217,7 +119246,7 @@ async function repairMissingCompletedAt(cwd, dryRun) {
   }
   const now2 = (/* @__PURE__ */ new Date()).toISOString();
   await db.update(tasks2).set({ completedAt: now2 }).where(
-    sql18`(${tasks2.status} = 'done' OR ${tasks2.status} = 'cancelled') AND ${tasks2.completedAt} IS NULL`
+    sql19`(${tasks2.status} = 'done' OR ${tasks2.status} = 'cancelled') AND ${tasks2.completedAt} IS NULL`
   );
   return {
     action: "fix_completed_at",
@@ -119228,8 +119257,8 @@ async function repairMissingCompletedAt(cwd, dryRun) {
 async function repairMissingColumns(cwd, dryRun) {
   const { getDb: getDb5 } = await Promise.resolve().then(() => (init_sqlite2(), sqlite_exports));
   const db = await getDb5(cwd);
-  const { sql: sql18 } = await import("drizzle-orm");
-  const columns = db.all(sql18`PRAGMA table_info(tasks)`);
+  const { sql: sql19 } = await import("drizzle-orm");
+  const columns = db.all(sql19`PRAGMA table_info(tasks)`);
   const existingCols = new Set(columns.map((c) => c.name));
   const missingCols = ["pipeline_stage"].filter((c) => !existingCols.has(c));
   if (missingCols.length === 0) {
@@ -119247,7 +119276,7 @@ async function repairMissingColumns(cwd, dryRun) {
     };
   }
   for (const col of missingCols) {
-    db.run(sql18.raw(`ALTER TABLE tasks ADD COLUMN ${col} text`));
+    db.run(sql19.raw(`ALTER TABLE tasks ADD COLUMN ${col} text`));
   }
   return {
     action: "fix_missing_columns",
@@ -122003,7 +122032,7 @@ var init_schema_validator = __esm({
 // packages/core/src/validation/validate-ops.ts
 import { execFileSync as execFileSync14 } from "node:child_process";
 import { appendFileSync as appendFileSync11, existsSync as existsSync132, mkdirSync as mkdirSync35, readFileSync as readFileSync97 } from "node:fs";
-import { dirname as dirname34, join as join132, resolve as resolve15 } from "node:path";
+import { dirname as dirname35, join as join132, resolve as resolve15 } from "node:path";
 function readJsonFile2(filePath) {
   try {
     const raw = readFileSync97(filePath, "utf-8");
@@ -122311,7 +122340,7 @@ function coreComplianceRecord(taskId, result, protocol, violations, projectRoot)
     throw new Error(`Invalid result: ${result}. Valid: ${validResults.join(", ")}`);
   }
   const compliancePath = join132(projectRoot, ".cleo", "metrics", "COMPLIANCE.jsonl");
-  const dir = dirname34(compliancePath);
+  const dir = dirname35(compliancePath);
   if (!existsSync132(dir)) {
     mkdirSync35(dir, { recursive: true });
   }
@@ -122611,8 +122640,8 @@ async function buildBrainState(projectRoot, opts, accessor) {
   };
   const acc = accessor ?? await getAccessor(projectRoot);
   try {
-    const sessions2 = await acc.loadSessions();
-    const activeSession = sessions2.find((s3) => s3.status === "active");
+    const sessions3 = await acc.loadSessions();
+    const activeSession = sessions3.find((s3) => s3.status === "active");
     if (activeSession) {
       brain.session = {
         id: activeSession.id,
@@ -129738,7 +129767,7 @@ var require__ = __commonJS({
 // packages/core/src/store/backup-unpack.ts
 import crypto6 from "node:crypto";
 import fs11 from "node:fs";
-import { createRequire as createRequire21 } from "node:module";
+import { createRequire as createRequire20 } from "node:module";
 import os4 from "node:os";
 import path9 from "node:path";
 import { default as addFormatsImport2 } from "ajv-formats";
@@ -130000,15 +130029,15 @@ function cleanupStaging(stagingDir) {
   } catch {
   }
 }
-var import__, _require19, DatabaseSync10, ajv2020Mod, Ajv2020, fmtMod2, addFormats3, BundleError, _ajv2020, MANIFEST_SCHEMA_ID;
+var import__, _require18, DatabaseSync10, ajv2020Mod, Ajv2020, fmtMod2, addFormats3, BundleError, _ajv2020, MANIFEST_SCHEMA_ID;
 var init_backup_unpack = __esm({
   "packages/core/src/store/backup-unpack.ts"() {
     "use strict";
     import__ = __toESM(require__(), 1);
     init_index_min();
     init_backup_crypto();
-    _require19 = createRequire21(import.meta.url);
-    ({ DatabaseSync: DatabaseSync10 } = _require19("node:sqlite"));
+    _require18 = createRequire20(import.meta.url);
+    ({ DatabaseSync: DatabaseSync10 } = _require18("node:sqlite"));
     ajv2020Mod = import__.default;
     Ajv2020 = typeof ajv2020Mod.default === "function" ? ajv2020Mod.default : import__.default;
     fmtMod2 = addFormatsImport2;
@@ -130485,11 +130514,11 @@ var init_restore_json_merge = __esm({
 // packages/core/src/nexus/nexus-bridge.ts
 import { existsSync as existsSync135, mkdirSync as mkdirSync36, readFileSync as readFileSync100, writeFileSync as writeFileSync26 } from "node:fs";
 import { join as join135 } from "node:path";
-function typedAll4(db, sql18, ...params) {
-  return db.prepare(sql18).all(...params);
+function typedAll4(db, sql19, ...params) {
+  return db.prepare(sql19).all(...params);
 }
-function typedGet2(db, sql18, ...params) {
-  return db.prepare(sql18).get(...params);
+function typedGet2(db, sql19, ...params) {
+  return db.prepare(sql19).get(...params);
 }
 function queryIndexMeta(db, projectId) {
   try {
@@ -131181,7 +131210,7 @@ var init_plan = __esm({
 import { execFileSync as execFileSync15 } from "node:child_process";
 import { createCipheriv, createDecipheriv, createHmac as createHmac3, randomBytes as randomBytes19 } from "node:crypto";
 import { chmod as chmod3, mkdir as mkdir24, readFile as readFile27, stat as stat6, writeFile as writeFile15 } from "node:fs/promises";
-import { dirname as dirname35, join as join136 } from "node:path";
+import { dirname as dirname36, join as join136 } from "node:path";
 function getMachineKeyPath() {
   if (process.platform === "win32") {
     const appData = process.env["LOCALAPPDATA"] ?? process.env["APPDATA"];
@@ -131232,7 +131261,7 @@ async function getMachineKey() {
   } catch (err) {
     if (err instanceof Error && "code" in err && err.code === "ENOENT") {
       const key = randomBytes19(KEY_LENGTH);
-      await mkdir24(dirname35(keyPath), { recursive: true });
+      await mkdir24(dirname36(keyPath), { recursive: true });
       await writeFile15(keyPath, key, { mode: 384 });
       if (process.platform === "win32") {
         try {
@@ -131593,7 +131622,7 @@ function parseCantAgent(source) {
   const lines = body.slice(headerIndex + headerMatch[0].length).split("\n");
   let role = null;
   let parent = null;
-  let skills = [];
+  let skills2 = [];
   for (const rawLine of lines) {
     if (/^[a-zA-Z]/.test(rawLine)) break;
     const trimmed = rawLine.trim();
@@ -131607,10 +131636,10 @@ function parseCantAgent(source) {
     } else if (key === "parent") {
       parent = unquote(value) || null;
     } else if (key === "skills") {
-      skills = parseSkillsValue(value);
+      skills2 = parseSkillsValue(value);
     }
   }
-  return { name: name2, role, parent, skills };
+  return { name: name2, role, parent, skills: skills2 };
 }
 function unquote(raw) {
   if (raw.length >= 2) {
@@ -131844,6 +131873,7 @@ __export(internal_exports, {
   HttpTransport: () => HttpTransport,
   LIFECYCLE_PIPELINE_STATUSES: () => LIFECYCLE_PIPELINE_STATUSES,
   LIFECYCLE_STAGE_STATUSES: () => LIFECYCLE_STAGE_STATUSES,
+  LifecycleScopeDeniedError: () => LifecycleScopeDeniedError,
   MANIFEST_STATUSES: () => MANIFEST_STATUSES,
   MAX_LOOP_BACKS_PER_PHASE: () => MAX_LOOP_BACKS_PER_PHASE,
   MINIMUM_NODE_MAJOR: () => MINIMUM_NODE_MAJOR,
@@ -132630,6 +132660,7 @@ __export(internal_exports, {
   resolvePhasePrompt: () => resolvePhasePrompt,
   resolveProjectPath: () => resolveProjectPath,
   resolveProjectRoot: () => resolveProjectRoot,
+  resolveSignaldockMigrationsFolder: () => resolveSignaldockMigrationsFolder,
   resolveSkillPathsForProvider: () => resolveSkillPathsForProvider,
   resolveStageAlias: () => resolveStageAlias,
   resolveTask: () => resolveTask,
@@ -132679,7 +132710,7 @@ __export(internal_exports, {
   sessionStartNext: () => sessionStartNext,
   sessionStatus: () => sessionStatus,
   sessionStatusSchema: () => sessionStatusSchema,
-  sessions: () => sessions,
+  sessions: () => sessions2,
   setConfigValue: () => setConfigValue,
   setPermission: () => setPermission,
   setPhase: () => setPhase,
@@ -133565,12 +133596,12 @@ function renderCurrent(data, quiet) {
 function renderSession(data, quiet) {
   const sessionId = data["sessionId"];
   const status = data["status"];
-  const sessions2 = data["sessions"];
-  if (sessions2) {
-    if (quiet) return sessions2.map((s3) => String(s3["id"])).join("\n");
+  const sessions3 = data["sessions"];
+  if (sessions3) {
+    if (quiet) return sessions3.map((s3) => String(s3["id"])).join("\n");
     const lines2 = [];
-    lines2.push(`${BOLD}Sessions (${sessions2.length})${NC}`);
-    for (const s3 of sessions2) {
+    lines2.push(`${BOLD}Sessions (${sessions3.length})${NC}`);
+    for (const s3 of sessions3) {
       const active = s3["active"];
       const icon = active ? `${GREEN}\u25CF${NC}` : `${DIM}\u25CB${NC}`;
       lines2.push(`  ${icon} ${BOLD}${s3["id"]}${NC}${active ? " (active)" : ""}`);
@@ -140054,6 +140085,10 @@ var init_error3 = __esm({
       E_LIFECYCLE_TRANSITION_INVALID: 83,
       E_IVTR_INCOMPLETE: 83,
       E_PROVENANCE_REQUIRED: 84,
+      // T1162: lifecycle scope guard — maps to ExitCode.TASK_NOT_IN_SCOPE (34)
+      // because a subagent attempting to mutate a parent epic's lifecycle is
+      // operating outside the scope granted by its session.
+      E_LIFECYCLE_SCOPE_DENIED: 34,
       // Artifact Publish (85-89)
       E_ARTIFACT_TYPE_UNKNOWN: 85,
       E_ARTIFACT_VALIDATION_FAILED: 86,
@@ -140344,6 +140379,80 @@ var init_init_engine = __esm({
 });
 
 // packages/cleo/src/dispatch/engines/lifecycle-engine.ts
+import { appendFile as appendFile7, mkdir as mkdir25 } from "node:fs/promises";
+import { dirname as dirname37, resolve as resolvePath4 } from "node:path";
+function getForceBypassPath2(projectRoot) {
+  return resolvePath4(projectRoot, ".cleo", "audit", "force-bypass.jsonl");
+}
+async function appendLifecycleScopeBypassLine(projectRoot, epicId, sessionScope, reason) {
+  const path15 = getForceBypassPath2(projectRoot);
+  await mkdir25(dirname37(path15), { recursive: true });
+  const record2 = {
+    timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+    type: "lifecycle_scope_bypass",
+    epicId,
+    sessionScope,
+    overrideReason: reason,
+    pid: process.pid,
+    command: (process.argv.slice(1).join(" ") || "cleo").slice(0, 512)
+  };
+  await appendFile7(path15, `${JSON.stringify(record2)}
+`, { encoding: "utf-8" });
+}
+async function enforceScopeForLifecycleMutation(epicId, projectRoot) {
+  let session;
+  try {
+    session = await getActiveSession(projectRoot);
+  } catch {
+    return null;
+  }
+  if (!session) {
+    return null;
+  }
+  const scope = session.scope;
+  if (scope.type === "global") {
+    return null;
+  }
+  if (scope.type === "epic") {
+    const rootId = scope.rootTaskId ?? scope.epicId;
+    if (rootId === epicId) {
+      return null;
+    }
+  }
+  const overrideRaw = process.env["CLEO_OWNER_OVERRIDE"];
+  const overrideActive = overrideRaw === "1" || overrideRaw === "true";
+  const agentRole = process.env["CLEO_AGENT_ROLE"];
+  const forbiddenRoles = /* @__PURE__ */ new Set(["worker", "lead", "subagent"]);
+  const overrideAllowed = overrideActive && !(agentRole && forbiddenRoles.has(agentRole));
+  if (overrideAllowed) {
+    const reason = (process.env["CLEO_OWNER_OVERRIDE_REASON"] ?? "").trim() || "unspecified";
+    const scopeStr = scope.epicId ? `epic:${scope.epicId}` : scope.type;
+    try {
+      const root = projectRoot ?? process.cwd();
+      await appendLifecycleScopeBypassLine(root, epicId, scopeStr, reason);
+    } catch {
+    }
+    return null;
+  }
+  const scopeDesc = scope.type === "epic" && scope.epicId ? `epic:${scope.epicId}${scope.rootTaskId && scope.rootTaskId !== scope.epicId ? ` (rootTaskId: ${scope.rootTaskId})` : ""}` : scope.type;
+  return engineError(
+    "E_LIFECYCLE_SCOPE_DENIED",
+    `Lifecycle stage advancement for epic ${epicId} requires a session scoped to that epic or an owner override. Current session scope: ${scopeDesc}. Use CLEO_OWNER_OVERRIDE=1 (with CLEO_OWNER_OVERRIDE_REASON) if this is an authorized operation.`,
+    {
+      fix: `Start a session scoped to the target epic: cleo session start --scope epic:${epicId}`,
+      alternatives: [
+        {
+          action: "Start an epic-scoped session",
+          command: `cleo session start --scope epic:${epicId} --name "Lifecycle work"`
+        },
+        {
+          action: "Emergency override (audited)",
+          command: `CLEO_OWNER_OVERRIDE=1 CLEO_OWNER_OVERRIDE_REASON="..." cleo lifecycle complete ${epicId} <stage>`
+        }
+      ]
+    }
+  );
+}
 async function lifecycleStatus(epicId, projectRoot) {
   if (!epicId) {
     return engineError("E_INVALID_INPUT", "epicId is required");
@@ -140412,6 +140521,8 @@ async function lifecycleProgress(taskId, stage, status, notes, projectRoot) {
   if (!taskId || !stage || !status) {
     return engineError("E_INVALID_INPUT", "taskId, stage, and status are required");
   }
+  const scopeDenied = await enforceScopeForLifecycleMutation(taskId, projectRoot);
+  if (scopeDenied) return scopeDenied;
   stage = resolveStageAlias(stage);
   try {
     if (status === "in_progress" || status === "completed") {
@@ -140446,6 +140557,8 @@ async function lifecycleSkip(taskId, stage, reason, projectRoot) {
   if (!taskId || !stage || !reason) {
     return engineError("E_INVALID_INPUT", "taskId, stage, and reason are required");
   }
+  const scopeDenied = await enforceScopeForLifecycleMutation(taskId, projectRoot);
+  if (scopeDenied) return scopeDenied;
   try {
     const data = await skipStageWithReason(taskId, stage, reason, projectRoot);
     return engineSuccess({ ...data, skipped: true });
@@ -140460,6 +140573,8 @@ async function lifecycleReset(taskId, stage, reason, projectRoot) {
   if (!taskId || !stage || !reason) {
     return engineError("E_INVALID_INPUT", "taskId, stage, and reason are required");
   }
+  const scopeDenied = await enforceScopeForLifecycleMutation(taskId, projectRoot);
+  if (scopeDenied) return scopeDenied;
   try {
     const data = await resetStage(taskId, stage, reason, projectRoot);
     return engineSuccess({ ...data, reset: "pending" });
@@ -140519,8 +140634,8 @@ async function sessionStatus2(projectRoot) {
   try {
     const accessor = await getAccessor(projectRoot);
     const focusState = await accessor.getMetaValue("focus_state");
-    const sessions2 = await accessor.loadSessions();
-    const active = sessions2.find((s3) => s3.status === "active");
+    const sessions3 = await accessor.loadSessions();
+    const active = sessions3.find((s3) => s3.status === "active");
     return {
       success: true,
       data: {
@@ -140536,8 +140651,8 @@ async function sessionStatus2(projectRoot) {
 async function sessionList(projectRoot, params) {
   try {
     const accessor = await getAccessor(projectRoot);
-    const sessions2 = await accessor.loadSessions();
-    let result = sessions2;
+    const sessions3 = await accessor.loadSessions();
+    let result = sessions3;
     if (params?.status) {
       result = result.filter((s3) => s3.status === params.status);
     } else if (params?.active === true) {
@@ -140545,7 +140660,7 @@ async function sessionList(projectRoot, params) {
     } else if (params?.active === false) {
       result = result.filter((s3) => s3.status !== "active");
     }
-    const total = sessions2.length;
+    const total = sessions3.length;
     const filtered = result.length;
     const limit = params?.limit && params.limit > 0 ? params.limit : SESSION_LIST_DEFAULT_LIMIT;
     const offset = typeof params?.offset === "number" && params.offset > 0 ? params.offset : 0;
@@ -140663,8 +140778,8 @@ async function sessionStart(projectRoot, params) {
     const sessionId = generateSessionId2();
     let previousSessionId = null;
     {
-      const sessions2 = await accessor.loadSessions();
-      const sameScope = sessions2.filter(
+      const sessions3 = await accessor.loadSessions();
+      const sameScope = sessions3.filter(
         (s3) => s3.status === "ended" && s3.endedAt && s3.scope?.type === scope.type && (scope.type === "global" || s3.scope?.rootTaskId === scope.rootTaskId)
       ).sort(
         (a, b2) => new Date(b2.endedAt).getTime() - new Date(a.endedAt).getTime()
@@ -140725,8 +140840,8 @@ async function sessionStart(projectRoot, params) {
     }
     await accessor.upsertSingleSession(newSession);
     if (previousSessionId) {
-      const sessions2 = await accessor.loadSessions();
-      const pred = sessions2.find((s3) => s3.id === previousSessionId);
+      const sessions3 = await accessor.loadSessions();
+      const pred = sessions3.find((s3) => s3.id === previousSessionId);
       if (pred) {
         pred.nextSessionId = sessionId;
         await accessor.upsertSingleSession(pred);
@@ -140746,8 +140861,8 @@ async function sessionStart(projectRoot, params) {
     let previousHandoff = null;
     if (previousSessionId) {
       try {
-        const sessions2 = await accessor.loadSessions();
-        const pred = sessions2.find((s3) => s3.id === previousSessionId);
+        const sessions22 = await accessor.loadSessions();
+        const pred = sessions22.find((s3) => s3.id === previousSessionId);
         if (pred) {
           if (pred.debriefJson) {
             previousDebrief = JSON.parse(pred.debriefJson);
@@ -140807,8 +140922,8 @@ async function sessionEnd(projectRoot, notes, params) {
       const { loadConfig: loadConfig4 } = await Promise.resolve().then(() => (init_internal(), internal_exports));
       const config2 = await loadConfig4(projectRoot);
       if (config2.brain?.summarization?.enabled) {
-        const sessions2 = await accessor.loadSessions();
-        const endedSession = sessions2.find(
+        const sessions3 = await accessor.loadSessions();
+        const endedSession = sessions3.find(
           (s3) => s3.id === sessionId
         );
         if (endedSession?.debriefJson) {
@@ -140838,8 +140953,8 @@ async function sessionEnd(projectRoot, notes, params) {
 async function sessionResume(projectRoot, sessionId) {
   try {
     const accessor = await getAccessor(projectRoot);
-    const sessions2 = await accessor.loadSessions();
-    const session = sessions2.find((s3) => s3.id === sessionId);
+    const sessions3 = await accessor.loadSessions();
+    const session = sessions3.find((s3) => s3.id === sessionId);
     if (!session) {
       return engineError("E_NOT_FOUND", `Session '${sessionId}' not found`);
     }
@@ -140890,13 +141005,13 @@ async function sessionResume(projectRoot, sessionId) {
 async function sessionGc(projectRoot, maxAgeDays = 1) {
   try {
     const accessor = await getAccessor(projectRoot);
-    const sessions2 = await accessor.loadSessions();
+    const sessions3 = await accessor.loadSessions();
     const now2 = Date.now();
     const maxAgeMs = maxAgeDays * 24 * 60 * 60 * 1e3;
     const thirtyDaysMs = 30 * 24 * 60 * 60 * 1e3;
     const orphaned = [];
     const removed = [];
-    for (const session of sessions2) {
+    for (const session of sessions3) {
       if (session.status === "active") {
         const lastActive = new Date(session.endedAt || session.startedAt).getTime();
         if (now2 - lastActive > maxAgeMs) {
@@ -140907,7 +141022,7 @@ async function sessionGc(projectRoot, maxAgeDays = 1) {
         }
       }
     }
-    for (const s3 of sessions2) {
+    for (const s3 of sessions3) {
       if (s3.status === "active") continue;
       const endedAt = s3.endedAt ? new Date(s3.endedAt).getTime() : new Date(s3.startedAt).getTime();
       if (now2 - endedAt > thirtyDaysMs) {
@@ -141041,8 +141156,8 @@ async function sessionBriefing(projectRoot, options) {
 async function sessionComputeDebrief(projectRoot, sessionId, options) {
   try {
     const accessor = await getAccessor(projectRoot);
-    const sessions2 = await accessor.loadSessions();
-    const session = sessions2.find((s3) => s3.id === sessionId);
+    const sessions3 = await accessor.loadSessions();
+    const session = sessions3.find((s3) => s3.id === sessionId);
     const debrief = await computeDebrief(projectRoot, {
       sessionId,
       note: options?.note,
@@ -141065,8 +141180,8 @@ async function sessionComputeDebrief(projectRoot, sessionId, options) {
 async function sessionDebriefShow(projectRoot, sessionId) {
   try {
     const accessor = await getAccessor(projectRoot);
-    const sessions2 = await accessor.loadSessions();
-    const session = sessions2.find((s3) => s3.id === sessionId);
+    const sessions3 = await accessor.loadSessions();
+    const session = sessions3.find((s3) => s3.id === sessionId);
     if (!session) {
       return engineError("E_NOT_FOUND", `Session '${sessionId}' not found`);
     }
@@ -141092,8 +141207,8 @@ async function sessionDebriefShow(projectRoot, sessionId) {
 async function sessionChainShow(projectRoot, sessionId) {
   try {
     const accessor = await getAccessor(projectRoot);
-    const sessions2 = await accessor.loadSessions();
-    const sessionMap = new Map(sessions2.map((s3) => [s3.id, s3]));
+    const sessions3 = await accessor.loadSessions();
+    const sessionMap = new Map(sessions3.map((s3) => [s3.id, s3]));
     const target = sessionMap.get(sessionId);
     if (!target) {
       return engineError("E_NOT_FOUND", `Session '${sessionId}' not found`);
@@ -141150,7 +141265,7 @@ var init_session_engine = __esm({
 
 // packages/cleo/src/dispatch/engines/orchestrate-engine.ts
 import { createHash as createHash30 } from "node:crypto";
-import { createRequire as createRequire22 } from "node:module";
+import { createRequire as createRequire21 } from "node:module";
 async function sendConduitEvent(cwd, to2, event) {
   try {
     const { AgentRegistryAccessor: AgentRegistryAccessor2, createConduit: createConduit2 } = await Promise.resolve().then(() => (init_internal(), internal_exports));
@@ -142075,7 +142190,7 @@ var init_orchestrate_engine = __esm({
     init_internal();
     init_error3();
     init_session_engine();
-    _engineRequire = createRequire22(import.meta.url);
+    _engineRequire = createRequire21(import.meta.url);
     ({ DatabaseSync: _DatabaseSyncCtor } = _engineRequire("node:sqlite"));
     CLASSIFIER_RULES2 = [
       { test: /^(docs?|doc)[:\s-]/i, agentId: "docs-worker" },
@@ -143293,27 +143408,27 @@ async function queryAuditLogSqlite(projectRoot, filters) {
     }
     const { getDb: getDb5 } = await Promise.resolve().then(() => (init_internal(), internal_exports));
     const { auditLog: auditLog2 } = await Promise.resolve().then(() => (init_internal(), internal_exports));
-    const { sql: sql18 } = await import("drizzle-orm");
+    const { sql: sql19 } = await import("drizzle-orm");
     const db = await getDb5(projectRoot);
     try {
       const conditions = [];
       if (filters?.operation) {
         conditions.push(
-          sql18`(${auditLog2.action} = ${filters.operation} OR ${auditLog2.operation} = ${filters.operation})`
+          sql19`(${auditLog2.action} = ${filters.operation} OR ${auditLog2.operation} = ${filters.operation})`
         );
       }
       if (filters?.taskId) {
-        conditions.push(sql18`${auditLog2.taskId} = ${filters.taskId}`);
+        conditions.push(sql19`${auditLog2.taskId} = ${filters.taskId}`);
       }
       if (filters?.since) {
-        conditions.push(sql18`${auditLog2.timestamp} >= ${filters.since}`);
+        conditions.push(sql19`${auditLog2.timestamp} >= ${filters.since}`);
       }
       if (filters?.until) {
-        conditions.push(sql18`${auditLog2.timestamp} <= ${filters.until}`);
+        conditions.push(sql19`${auditLog2.timestamp} <= ${filters.until}`);
       }
-      const whereClause = conditions.length > 0 ? sql18.join(conditions, sql18` AND `) : sql18`1=1`;
+      const whereClause = conditions.length > 0 ? sql19.join(conditions, sql19` AND `) : sql19`1=1`;
       const countResult = await db.all(
-        sql18`SELECT count(*) as cnt FROM ${auditLog2} WHERE ${whereClause}`
+        sql19`SELECT count(*) as cnt FROM ${auditLog2} WHERE ${whereClause}`
       );
       const total = countResult[0]?.cnt ?? 0;
       if (total === 0) {
@@ -143330,7 +143445,7 @@ async function queryAuditLogSqlite(projectRoot, filters) {
       const offset = filters?.offset ?? 0;
       const limit = filters?.limit ?? 20;
       const rows = await db.all(
-        sql18`SELECT * FROM ${auditLog2}
+        sql19`SELECT * FROM ${auditLog2}
             WHERE ${whereClause}
             ORDER BY ${auditLog2.timestamp} DESC
             LIMIT ${limit} OFFSET ${offset}`
@@ -143401,14 +143516,14 @@ function systemContext(projectRoot, params) {
         stateFile = join139(cleoDir, ".context-state.json");
       }
     }
-    const sessions2 = [];
+    const sessions3 = [];
     const statesDir = join139(cleoDir, "context-states");
     if (existsSync137(statesDir)) {
       for (const file2 of readdirSync42(statesDir)) {
         if (file2.startsWith("context-state-") && file2.endsWith(".json")) {
           try {
             const state = JSON.parse(readFileSync103(join139(statesDir, file2), "utf-8"));
-            sessions2.push({
+            sessions3.push({
               file: basename20(file2),
               sessionId: state.sessionId ?? null,
               percentage: state.contextWindow?.percentage ?? 0,
@@ -143424,7 +143539,7 @@ function systemContext(projectRoot, params) {
     if (existsSync137(singletonFile)) {
       try {
         const state = JSON.parse(readFileSync103(singletonFile, "utf-8"));
-        sessions2.push({
+        sessions3.push({
           file: ".context-state.json",
           sessionId: state.sessionId ?? "global",
           percentage: state.contextWindow?.percentage ?? 0,
@@ -143445,7 +143560,7 @@ function systemContext(projectRoot, params) {
           maxTokens: 0,
           timestamp: null,
           stale: true,
-          sessions: sessions2
+          sessions: sessions3
         }
       };
     }
@@ -143471,7 +143586,7 @@ function systemContext(projectRoot, params) {
           maxTokens: max,
           timestamp: timestamp3,
           stale: status === "stale",
-          sessions: sessions2
+          sessions: sessions3
         }
       };
     } catch {
@@ -143485,7 +143600,7 @@ function systemContext(projectRoot, params) {
           maxTokens: 0,
           timestamp: null,
           stale: true,
-          sessions: sessions2
+          sessions: sessions3
         }
       };
     }
@@ -151290,7 +151405,7 @@ function handleTopEntriesFromBrain(operation, params, startTime, db, limit) {
   const nodeType = typeof rawNodeType === "string" && rawNodeType.length > 0 ? rawNodeType : null;
   let rows = [];
   try {
-    const sql18 = nodeType === null ? `SELECT id, node_type, label, quality_score, last_activity_at, metadata_json
+    const sql19 = nodeType === null ? `SELECT id, node_type, label, quality_score, last_activity_at, metadata_json
              FROM brain_page_nodes
             ORDER BY quality_score DESC
             LIMIT ?` : `SELECT id, node_type, label, quality_score, last_activity_at, metadata_json
@@ -151299,7 +151414,7 @@ function handleTopEntriesFromBrain(operation, params, startTime, db, limit) {
             ORDER BY quality_score DESC
             LIMIT ?`;
     const bindArgs = nodeType === null ? [limit] : [nodeType, limit];
-    const rawRows = db.prepare(sql18).all(...bindArgs);
+    const rawRows = db.prepare(sql19).all(...bindArgs);
     rows = rawRows.map((raw) => {
       const r = raw;
       return {
@@ -151335,7 +151450,7 @@ function handleTopEntriesFromNexus(operation, params, startTime, db, limit) {
   const kind = typeof rawKind === "string" && rawKind.length > 0 ? rawKind : null;
   let rows = [];
   try {
-    const sql18 = kind === null ? `SELECT r.source_id,
+    const sql19 = kind === null ? `SELECT r.source_id,
                   SUM(COALESCE(r.weight, 0)) AS totalWeight,
                   COUNT(*)                   AS edgeCount,
                   n.label,
@@ -151358,7 +151473,7 @@ function handleTopEntriesFromNexus(operation, params, startTime, db, limit) {
             ORDER BY totalWeight DESC, edgeCount DESC
             LIMIT ?`;
     const bindArgs = kind === null ? [limit] : [kind, limit];
-    const rawRows = db.prepare(sql18).all(...bindArgs);
+    const rawRows = db.prepare(sql19).all(...bindArgs);
     rows = rawRows.map((raw) => {
       const r = raw;
       return {
@@ -156078,8 +156193,8 @@ function listPlaybookRuns(db, opts = {}) {
   const where = clauses.length > 0 ? `WHERE ${clauses.join(" AND ")}` : "";
   const limitClause = typeof opts.limit === "number" ? "LIMIT ?" : "";
   if (limitClause) values.push(opts.limit ?? 0);
-  const sql18 = `SELECT * FROM playbook_runs ${where} ORDER BY started_at DESC ${limitClause}`;
-  const rows = db.prepare(sql18).all(...values);
+  const sql19 = `SELECT * FROM playbook_runs ${where} ORDER BY started_at DESC ${limitClause}`;
+  const rows = db.prepare(sql19).all(...values);
   return rows.map(rowToPlaybookRun);
 }
 function deletePlaybookRun(db, runId) {
@@ -156688,8 +156803,8 @@ var init_src4 = __esm({
 // packages/cleo/src/dispatch/domains/playbook.ts
 import { existsSync as existsSync139, readFileSync as readFileSync106 } from "node:fs";
 import { homedir as homedir11 } from "node:os";
-import { dirname as dirname36, join as join142, resolve as resolvePath4 } from "node:path";
-import { fileURLToPath as fileURLToPath11 } from "node:url";
+import { dirname as dirname38, join as join142, resolve as resolvePath5 } from "node:path";
+import { fileURLToPath as fileURLToPath12 } from "node:url";
 function normalizeListStatus(raw) {
   if (typeof raw !== "string" || raw.length === 0) return void 0;
   const value = raw.trim().toLowerCase();
@@ -156717,9 +156832,9 @@ function resolvePlaybookDirs() {
     return __playbookRuntimeOverrides.playbookBaseDirs;
   }
   const globalDir = join142(homedir11(), ".local", "share", "cleo", "playbooks");
-  const here = dirname36(fileURLToPath11(import.meta.url));
-  const sourceStarter = resolvePath4(here, "..", "..", "..", "..", "playbooks", "starter");
-  const bundledStarter = resolvePath4(here, "..", "..", "..", "playbooks", "starter");
+  const here = dirname38(fileURLToPath12(import.meta.url));
+  const sourceStarter = resolvePath5(here, "..", "..", "..", "..", "playbooks", "starter");
+  const bundledStarter = resolvePath5(here, "..", "..", "..", "playbooks", "starter");
   return [globalDir, sourceStarter, bundledStarter];
 }
 function loadPlaybookByName(name2) {
@@ -159606,7 +159721,7 @@ function envelopeToEngineResult(envelope) {
 }
 async function storeSessionOwnerAuthToken(projectRoot, sessionId, token) {
   const db = await getDb(projectRoot);
-  db.update(sessions).set({ ownerAuthToken: token }).where(eq21(sessions.id, sessionId)).run();
+  db.update(sessions2).set({ ownerAuthToken: token }).where(eq21(sessions2.id, sessionId)).run();
 }
 var _sessionTypedHandler, QUERY_OPS, MUTATE_OPS, SessionHandler;
 var init_session5 = __esm({
@@ -160971,15 +161086,15 @@ function toolsIssueDiagnostics() {
 }
 async function toolsSkillList(limit, offset) {
   try {
-    const skills = await discoverSkills(getCanonicalSkillsDir4());
-    const page = paginate(skills, limit, offset);
+    const skills2 = await discoverSkills(getCanonicalSkillsDir4());
+    const page = paginate(skills2, limit, offset);
     return {
       success: true,
       data: {
         skills: page.items,
-        count: skills.length,
-        total: skills.length,
-        filtered: skills.length,
+        count: skills2.length,
+        total: skills2.length,
+        filtered: skills2.length,
         page: page.page
       },
       page: page.page
@@ -161002,10 +161117,10 @@ async function toolsSkillShow(name2) {
 async function toolsSkillFind(query) {
   try {
     const q2 = (query ?? "").toLowerCase();
-    const skills = await discoverSkills(getCanonicalSkillsDir4());
-    const filtered = q2 ? skills.filter(
+    const skills2 = await discoverSkills(getCanonicalSkillsDir4());
+    const filtered = q2 ? skills2.filter(
       (s3) => s3.name.toLowerCase().includes(q2) || s3.metadata.description.toLowerCase().includes(q2)
-    ) : skills;
+    ) : skills2;
     return engineSuccess({ skills: filtered, count: filtered.length, query: q2 });
   } catch (error48) {
     return engineError("E_INTERNAL", error48 instanceof Error ? error48.message : String(error48));
@@ -162583,26 +162698,26 @@ __export(cli_exports, {
 });
 import { randomUUID as randomUUID19 } from "node:crypto";
 import { existsSync as existsSync141 } from "node:fs";
-import { createRequire as createRequire23 } from "node:module";
-import { dirname as dirname37, join as join146 } from "node:path";
-import { fileURLToPath as fileURLToPath12 } from "node:url";
+import { createRequire as createRequire22 } from "node:module";
+import { dirname as dirname39, join as join146 } from "node:path";
+import { fileURLToPath as fileURLToPath13 } from "node:url";
 import { catalog as catalog4, registerSkillLibraryFromPath } from "@cleocode/caamp";
 function ensureCaampLibrary() {
   if (catalog4.isCatalogAvailable()) return;
   try {
     let skillsRoot = null;
     try {
-      const req = createRequire23(import.meta.url);
+      const req = createRequire22(import.meta.url);
       const skillsPkgJson = req.resolve("@cleocode/skills/package.json");
-      const candidate = dirname37(skillsPkgJson);
+      const candidate = dirname39(skillsPkgJson);
       if (existsSync141(join146(candidate, "skills.json"))) {
         skillsRoot = candidate;
       }
     } catch {
     }
     if (!skillsRoot) {
-      const thisFile = fileURLToPath12(import.meta.url);
-      const packageRoot = join146(dirname37(thisFile), "..", "..", "..", "..", "..");
+      const thisFile = fileURLToPath13(import.meta.url);
+      const packageRoot = join146(dirname39(thisFile), "..", "..", "..", "..", "..");
       const candidate = join146(packageRoot, "packages", "skills");
       if (existsSync141(join146(candidate, "skills.json"))) {
         skillsRoot = candidate;
@@ -162826,8 +162941,8 @@ var init_cli = __esm({
 // packages/cleo/src/cli/index.ts
 init_internal();
 import { readFileSync as readFileSync115 } from "node:fs";
-import { dirname as dirname43, join as join159 } from "node:path";
-import { fileURLToPath as fileURLToPath13 } from "node:url";
+import { dirname as dirname45, join as join159 } from "node:path";
+import { fileURLToPath as fileURLToPath14 } from "node:url";
 
 // node_modules/.pnpm/citty@0.2.1/node_modules/citty/dist/_chunks/libs/scule.mjs
 var NUMBER_CHAR_RE = /\d/;
@@ -164812,18 +164927,18 @@ var statusCommand = defineCommand({
           { command: "agent status" }
         );
       } else {
-        const agents = await registry2.list();
+        const agents2 = await registry2.list();
         cliOutput(
           {
             success: true,
             data: {
-              agents: agents.map((a) => ({
+              agents: agents2.map((a) => ({
                 agentId: a.agentId,
                 displayName: a.displayName,
                 active: a.isActive,
                 lastUsedAt: a.lastUsedAt
               })),
-              total: agents.length
+              total: agents2.length
             }
           },
           { command: "agent status" }
@@ -165088,9 +165203,9 @@ var stopAllCommand = defineCommand({
       const { AgentRegistryAccessor: AgentRegistryAccessor2, getDb: getDb5 } = await Promise.resolve().then(() => (init_internal(), internal_exports));
       await getDb5();
       const registry2 = new AgentRegistryAccessor2(process.cwd());
-      const agents = await registry2.list({ active: true });
+      const agents2 = await registry2.list({ active: true });
       let stopped = 0;
-      for (const a of agents) {
+      for (const a of agents2) {
         await registry2.update(a.agentId, { isActive: false });
         try {
           await fetch(`${a.apiBaseUrl}/agents/${a.agentId}/status`, {
@@ -165108,7 +165223,7 @@ var stopAllCommand = defineCommand({
         stopped++;
       }
       cliOutput(
-        { success: true, data: { stopped, total: agents.length } },
+        { success: true, data: { stopped, total: agents2.length } },
         { command: "agent stop-all" }
       );
     } catch (err) {
@@ -165317,11 +165432,11 @@ var listCommand3 = defineCommand({
       await getDb5();
       const includeGlobal = args.global === true;
       const includeDisabled = args["include-disabled"] === true;
-      const agents = listAgentsForProject2(process.cwd(), {
+      const agents2 = listAgentsForProject2(process.cwd(), {
         includeGlobal,
         includeDisabled
       });
-      const filtered = !includeGlobal && args.active ? agents.filter((a) => a.isActive) : agents;
+      const filtered = !includeGlobal && args.active ? agents2.filter((a) => a.isActive) : agents2;
       cliOutput(
         {
           success: true,
@@ -166253,7 +166368,7 @@ var packCommand = defineCommand({
   async run({ args }) {
     try {
       const { existsSync: existsSync148, statSync: statSync23 } = await import("node:fs");
-      const { resolve: resolve21, basename: basename21, dirname: dirname44 } = await import("node:path");
+      const { resolve: resolve21, basename: basename21, dirname: dirname46 } = await import("node:path");
       const { execFileSync: execFileSync21 } = await import("node:child_process");
       const resolvedDir = resolve21(args.dir);
       if (!existsSync148(resolvedDir) || !statSync23(resolvedDir).isDirectory()) {
@@ -166289,7 +166404,7 @@ var packCommand = defineCommand({
       const agentName = basename21(resolvedDir);
       const archiveName = `${agentName}.cantz`;
       const archivePath = resolve21(archiveName);
-      const parentDir = dirname44(resolvedDir);
+      const parentDir = dirname46(resolvedDir);
       try {
         execFileSync21("zip", ["-r", archivePath, agentName], {
           cwd: parentDir,
@@ -166602,8 +166717,8 @@ var doctorCommand = defineCommand({
         ensureGlobalSignaldockDb: ensureGlobalSignaldockDb2,
         getGlobalSignaldockDbPath: getGlobalSignaldockDbPath2
       } = await Promise.resolve().then(() => (init_internal(), internal_exports));
-      const { createRequire: createRequire24 } = await import("node:module");
-      const nodeSqlite = createRequire24(import.meta.url)(
+      const { createRequire: createRequire23 } = await import("node:module");
+      const nodeSqlite = createRequire23(import.meta.url)(
         "node:sqlite"
       );
       const { DatabaseSync: DatabaseSync11 } = nodeSqlite;
@@ -168496,8 +168611,8 @@ var briefingCommand = defineCommand({
 // packages/cleo/src/cli/commands/bug.ts
 init_src3();
 import { existsSync as existsSync143 } from "node:fs";
-import { appendFile as appendFile7, mkdir as mkdir25, readFile as readFile30 } from "node:fs/promises";
-import { dirname as dirname38, join as join147 } from "node:path";
+import { appendFile as appendFile8, mkdir as mkdir26, readFile as readFile30 } from "node:fs/promises";
+import { dirname as dirname40, join as join147 } from "node:path";
 init_cli();
 var SEVERITY_MAP = {
   P0: { priority: "critical", labels: ["bug", "p0"] },
@@ -168550,8 +168665,8 @@ async function appendSignedBugSeverity(record2) {
   const line2 = `${JSON.stringify({ ...full, _sig: sig })}
 `;
   const auditPath = join147(getCleoDirAbsolute(), "audit", "bug-severity.jsonl");
-  await mkdir25(dirname38(auditPath), { recursive: true });
-  await appendFile7(auditPath, line2, { encoding: "utf-8" });
+  await mkdir26(dirname40(auditPath), { recursive: true });
+  await appendFile8(auditPath, line2, { encoding: "utf-8" });
 }
 var bugCommand = defineCommand({
   meta: {
@@ -168663,7 +168778,7 @@ var cancelCommand = defineCommand({
 
 // packages/cleo/src/cli/commands/cant.ts
 import { existsSync as existsSync144, mkdirSync as mkdirSync38, readFileSync as readFileSync109, writeFileSync as writeFileSync27 } from "node:fs";
-import { dirname as dirname39, isAbsolute as isAbsolute6, join as join148, resolve as resolve19 } from "node:path";
+import { dirname as dirname41, isAbsolute as isAbsolute6, join as join148, resolve as resolve19 } from "node:path";
 init_renderers();
 function resolveFilePath(file2) {
   return isAbsolute6(file2) ? file2 : resolve19(process.cwd(), file2);
@@ -168824,7 +168939,7 @@ var cantMigrateCommand = defineCommand({
         let written = 0;
         for (const outputFile of result.outputFiles) {
           const outputPath = isAbsolute6(outputFile.path) ? outputFile.path : join148(projectRoot, outputFile.path);
-          mkdirSync38(dirname39(outputPath), { recursive: true });
+          mkdirSync38(dirname41(outputPath), { recursive: true });
           writeFileSync27(outputPath, outputFile.content, "utf-8");
           written++;
         }
@@ -170948,7 +171063,7 @@ var detectCommand2 = defineCommand({
 // packages/cleo/src/cli/commands/detect-drift.ts
 init_src();
 import { existsSync as existsSync145, readdirSync as readdirSync43, readFileSync as readFileSync111 } from "node:fs";
-import { dirname as dirname40, join as join150 } from "node:path";
+import { dirname as dirname42, join as join150 } from "node:path";
 init_paths2();
 init_renderers();
 function findProjectRoot() {
@@ -170957,7 +171072,7 @@ function findProjectRoot() {
     if (existsSync145(join150(currentDir, "package.json"))) {
       return currentDir;
     }
-    const parent = dirname40(currentDir);
+    const parent = dirname42(currentDir);
     if (parent === currentDir) break;
     currentDir = parent;
   }
@@ -171425,8 +171540,8 @@ var diagnosticsCommand = defineCommand({
 // packages/cleo/src/cli/commands/docs.ts
 init_src();
 init_internal();
-import { mkdir as mkdir26, readdir as readdir5, readFile as readFile31, writeFile as writeFile16 } from "node:fs/promises";
-import { dirname as dirname41, isAbsolute as isAbsolute7, join as join151, resolve as resolve20 } from "node:path";
+import { mkdir as mkdir27, readdir as readdir5, readFile as readFile31, writeFile as writeFile16 } from "node:fs/promises";
+import { dirname as dirname43, isAbsolute as isAbsolute7, join as join151, resolve as resolve20 } from "node:path";
 init_cli();
 init_renderers();
 async function getScriptNames(projectRoot) {
@@ -171719,7 +171834,7 @@ var exportCommand4 = defineCommand({
       let writtenPath;
       if (typeof args.out === "string" && args.out.length > 0) {
         const outPath = isAbsolute7(args.out) ? args.out : resolve20(projectRoot, args.out);
-        await mkdir26(dirname41(outPath), { recursive: true });
+        await mkdir27(dirname43(outPath), { recursive: true });
         await writeFile16(outPath, result.markdown, "utf8");
         writtenPath = outPath;
       }
@@ -171834,7 +171949,7 @@ var mergeCommand = defineCommand({
       });
       if (typeof args.out === "string" && args.out.length > 0) {
         const outPath = isAbsolute7(args.out) ? args.out : resolve20(projectRoot, args.out);
-        await mkdir26(dirname41(outPath), { recursive: true });
+        await mkdir27(dirname43(outPath), { recursive: true });
         await writeFile16(outPath, result.merged, "utf8");
         process.stderr.write(`Wrote merged content to ${outPath}
 `);
@@ -171906,7 +172021,7 @@ var graphCommand = defineCommand({
       }
       if (typeof args.out === "string" && args.out.length > 0) {
         const outPath = isAbsolute7(args.out) ? args.out : resolve20(projectRoot, args.out);
-        await mkdir26(dirname41(outPath), { recursive: true });
+        await mkdir27(dirname43(outPath), { recursive: true });
         await writeFile16(outPath, output, "utf8");
         process.stderr.write(`Wrote graph to ${outPath}
 `);
@@ -172977,7 +173092,7 @@ init_src();
 init_src3();
 import { execFileSync as execFileSync18 } from "node:child_process";
 import { existsSync as existsSync146, mkdirSync as mkdirSync39, readFileSync as readFileSync112, writeFileSync as writeFileSync28 } from "node:fs";
-import { dirname as dirname42, join as join153 } from "node:path";
+import { dirname as dirname44, join as join153 } from "node:path";
 init_renderers();
 function getChangelogSource(cwd) {
   const configPath = getConfigPath(cwd);
@@ -173149,7 +173264,7 @@ var generateChangelogCommand = defineCommand({
         const content = generateForPlatform(targetPlatform, sourceContent, repoSlug, limit);
         if (!dryRun) {
           const fullPath = join153(getProjectRoot(), outputPath);
-          mkdirSync39(dirname42(fullPath), { recursive: true });
+          mkdirSync39(dirname44(fullPath), { recursive: true });
           writeFileSync28(fullPath, content, "utf-8");
         }
         results.push({ platform: targetPlatform, path: outputPath, written: !dryRun });
@@ -173170,7 +173285,7 @@ var generateChangelogCommand = defineCommand({
           );
           if (!dryRun) {
             const fullPath = join153(getProjectRoot(), platformConfig.path);
-            mkdirSync39(dirname42(fullPath), { recursive: true });
+            mkdirSync39(dirname44(fullPath), { recursive: true });
             writeFileSync28(fullPath, content, "utf-8");
           }
           results.push({
@@ -185075,7 +185190,7 @@ async function writeRuntimeVersionMetadata(mode, source, version2) {
     `installed=${(/* @__PURE__ */ new Date()).toISOString()}`
   ];
   await import("node:fs/promises").then(
-    ({ writeFile: writeFile18, mkdir: mkdir28 }) => mkdir28(cleoHome, { recursive: true }).then(
+    ({ writeFile: writeFile18, mkdir: mkdir29 }) => mkdir29(cleoHome, { recursive: true }).then(
       () => writeFile18(join155(cleoHome, "VERSION"), `${lines.join("\n")}
 `, "utf-8")
     )
@@ -188154,11 +188269,11 @@ var extractCommand = defineCommand({
     try {
       const { extractTranscript } = await import("@cleocode/core/memory/transcript-extractor.js");
       const { findSessionTranscriptPath: findSessionTranscriptPath2, listAllTranscripts: listAllTranscripts2 } = await import("@cleocode/core/memory/transcript-scanner.js");
-      const sessions2 = [];
+      const sessions3 = [];
       if (args["all-warm"]) {
         const allTranscripts = await listAllTranscripts2({ olderThanHours: 1 });
         for (const t of allTranscripts) {
-          sessions2.push({ sessionId: t.sessionId, path: t.path });
+          sessions3.push({ sessionId: t.sessionId, path: t.path });
         }
       } else if (args["session-id"]) {
         const path15 = await findSessionTranscriptPath2(args["session-id"]);
@@ -188179,7 +188294,7 @@ var extractCommand = defineCommand({
           process.exit(4);
           return;
         }
-        sessions2.push({ sessionId: args["session-id"], path: path15 });
+        sessions3.push({ sessionId: args["session-id"], path: path15 });
       } else {
         process.stderr.write(
           "Provide a session-id or use --all-warm to extract all warm sessions\n"
@@ -188191,7 +188306,7 @@ var extractCommand = defineCommand({
       let totalStored = 0;
       let totalBytesFreed = 0;
       const results = [];
-      for (const session of sessions2) {
+      for (const session of sessions3) {
         const result = await extractTranscript({
           transcriptPath: session.path,
           projectRoot,
@@ -188207,7 +188322,7 @@ var extractCommand = defineCommand({
       const envelope = {
         success: true,
         data: {
-          sessionsProcessed: sessions2.length,
+          sessionsProcessed: sessions3.length,
           memoriesExtracted: totalExtracted,
           memoriesStored: totalStored,
           bytesFreed: totalBytesFreed,
@@ -188221,7 +188336,7 @@ var extractCommand = defineCommand({
         const dryLabel = dryRun ? " (dry run)" : "";
         process.stdout.write(`Transcript extraction complete${dryLabel}
 `);
-        process.stdout.write(`Sessions:  ${sessions2.length}
+        process.stdout.write(`Sessions:  ${sessions3.length}
 `);
         process.stdout.write(`Extracted: ${totalExtracted} memories
 `);
@@ -188857,7 +188972,7 @@ var verifyCommand2 = defineCommand({
 init_src();
 init_src3();
 import { execFileSync as execFileSync20, spawn as spawn3 } from "node:child_process";
-import { mkdir as mkdir27, open, readFile as readFile33, rm as rm4, stat as stat7, writeFile as writeFile17 } from "node:fs/promises";
+import { mkdir as mkdir28, open, readFile as readFile33, rm as rm4, stat as stat7, writeFile as writeFile17 } from "node:fs/promises";
 import { join as join158 } from "node:path";
 init_renderers();
 var DEFAULT_PORT = 3456;
@@ -188908,7 +189023,7 @@ async function startWebServer(port, host) {
   }
   const projectRoot = process.env["CLEO_ROOT"] ?? process.cwd();
   const studioDir = process.env["CLEO_STUDIO_DIR"] ?? join158(projectRoot, "packages", "studio", "build");
-  await mkdir27(logDir, { recursive: true });
+  await mkdir28(logDir, { recursive: true });
   await writeFile17(
     configFile,
     JSON.stringify({
@@ -189196,7 +189311,7 @@ Or via NodeSource: https://github.com/nodesource/distributions
   }
 }
 function getPackageVersion() {
-  const pkgPath = join159(dirname43(fileURLToPath13(import.meta.url)), "../../package.json");
+  const pkgPath = join159(dirname45(fileURLToPath14(import.meta.url)), "../../package.json");
   const pkg = JSON.parse(readFileSync115(pkgPath, "utf-8"));
   return pkg.version;
 }