@cleocode/cleo 2026.4.45 → 2026.4.46

package/dist/cli/index.js

@@ -11473,14 +11473,14 @@ function reconcileJournal(nativeDb, migrationsFolder, existenceTable, logSubsyst
       const dbHashes = new Set(dbEntries.map((e) => e.hash));
       const allLocalHashesPresentInDb = localMigrations.every((m2) => dbHashes.has(m2.hash));
       if (allLocalHashesPresentInDb) {
-        const log12 = getLogger(logSubsystem);
-        log12.debug(
+        const log13 = getLogger(logSubsystem);
+        log13.debug(
           { extra: orphanedEntries.length },
           `Migration journal has ${orphanedEntries.length} entries for migrations not known to this install (DB is ahead). Skipping reconciliation.`
         );
       } else {
-        const log12 = getLogger(logSubsystem);
-        log12.warn(
+        const log13 = getLogger(logSubsystem);
+        log13.warn(
           { orphaned: orphanedEntries.length },
           `Detected stale migration journal entries from a previous CLEO version. Reconciling.`
         );
@@ -11511,8 +11511,8 @@ function reconcileJournal(nativeDb, migrationsFolder, existenceTable, logSubsyst
         return cols.some((c) => c.name === column);
       });
       if (allColumnsExist) {
-        const log12 = getLogger(logSubsystem);
-        log12.warn(
+        const log13 = getLogger(logSubsystem);
+        log13.warn(
           { migration: migration.name, columns: alterMatches },
           `Detected partially-applied migration ${migration.name} \u2014 columns exist but journal entry missing. Auto-reconciling.`
         );
@@ -11530,8 +11530,8 @@ function reconcileJournal(nativeDb, migrationsFolder, existenceTable, logSubsyst
     for (const entry of unnamedEntries) {
       const migrationName = hashToName.get(entry.hash);
       if (!migrationName) continue;
-      const log12 = getLogger(logSubsystem);
-      log12.warn(
+      const log13 = getLogger(logSubsystem);
+      log13.warn(
         { id: entry.id, hash: entry.hash, name: migrationName },
         `Backfilling missing name on journal entry id=${entry.id} \u2014 Drizzle v1 beta requires name for applied-migration detection.`
       );
@@ -11575,8 +11575,8 @@ function ensureColumns(nativeDb, tableName, requiredColumns, logSubsystem) {
   const existingCols = new Set(columns.map((c) => c.name));
   for (const req of requiredColumns) {
     if (!existingCols.has(req.name)) {
-      const log12 = getLogger(logSubsystem);
-      log12.warn(
+      const log13 = getLogger(logSubsystem);
+      log13.warn(
         { column: req.name },
         `Adding missing column ${tableName}.${req.name} via ALTER TABLE`
       );
@@ -13974,7 +13974,7 @@ function getDbPath(cwd) {
   return join10(getCleoDirAbsolute(cwd), DB_FILENAME2);
 }
 async function autoRecoverFromBackup(nativeDb, dbPath, cwd) {
-  const log12 = getLogger("sqlite");
+  const log13 = getLogger("sqlite");
   try {
     const countResult = nativeDb.prepare("SELECT COUNT(*) as cnt FROM tasks").get();
     const taskCount = countResult?.cnt ?? 0;
@@ -13995,7 +13995,7 @@ async function autoRecoverFromBackup(nativeDb, dbPath, cwd) {
     if (backupTaskCount < MIN_BACKUP_TASK_COUNT) {
       return;
     }
-    log12.warn(
+    log13.warn(
       { dbPath, backupPath: newestBackup.path, backupTasks: backupTaskCount },
       `Empty database detected with ${backupTaskCount}-task backup available. Auto-recovering from backup. This likely happened because git-tracked WAL/SHM files were overwritten during a branch switch (T5188).`
     );
@@ -14013,7 +14013,7 @@ async function autoRecoverFromBackup(nativeDb, dbPath, cwd) {
     const tempPath = dbPath + ".recovery-tmp";
     copyFileSync4(newestBackup.path, tempPath);
     renameSync(tempPath, dbPath);
-    log12.info(
+    log13.info(
       { dbPath, backupPath: newestBackup.path, restoredTasks: backupTaskCount },
       "Database auto-recovered from backup successfully."
     );
@@ -14023,7 +14023,7 @@ async function autoRecoverFromBackup(nativeDb, dbPath, cwd) {
     runMigrations(restoredNativeDb, restoredDb);
     _db = restoredDb;
   } catch (err) {
-    log12.error({ err, dbPath }, "Auto-recovery from backup failed. Continuing with empty database.");
+    log13.error({ err, dbPath }, "Auto-recovery from backup failed. Continuing with empty database.");
   }
 }
 async function getDb(cwd) {
@@ -14057,7 +14057,7 @@ async function getDb(cwd) {
         const { execFileSync: execFileSync19 } = await import("node:child_process");
         const gitCwd = resolve3(dbPath, "..", "..");
         const filesToCheck = [dbPath, dbPath + "-wal", dbPath + "-shm"];
-        const log12 = getLogger("sqlite");
+        const log13 = getLogger("sqlite");
         for (const fileToCheck of filesToCheck) {
           try {
             execFileSync19("git", ["ls-files", "--error-unmatch", fileToCheck], {
@@ -14066,7 +14066,7 @@ async function getDb(cwd) {
             });
             const basename19 = fileToCheck.split(/[\\/]/).pop();
             const relPath = fileToCheck.replace(gitCwd + sep, "");
-            log12.warn(
+            log13.warn(
               { path: fileToCheck },
               `${basename19} is tracked by project git \u2014 this risks data loss on branch switch. Resolution (ADR-013 \xA79): \`git rm --cached ${relPath}\` and rely on \`.cleo/backups/sqlite/\` snapshots + \`cleo backup add\` for recovery.`
             );
@@ -15260,11 +15260,18 @@ var init_cross_db_cleanup = __esm({
 
 // packages/core/src/store/db-helpers.ts
 import { eq as eq4, inArray as inArray2 } from "drizzle-orm";
-async function upsertTask(db, row, archiveFields) {
+async function upsertTask(db, row, archiveFields, allowOrphanParent = false) {
   if (row.parentId) {
     const parent = await db.select({ id: tasks.id }).from(tasks).where(eq4(tasks.id, row.parentId)).limit(1).all();
     if (parent.length === 0) {
-      row = { ...row, parentId: null };
+      if (allowOrphanParent) {
+        row = { ...row, parentId: null };
+      } else {
+        log2.warn(
+          { taskId: row.id, parentId: row.parentId },
+          "upsertTask: parentId references a non-existent task \u2014 parent relationship may be lost"
+        );
+      }
     }
   }
   const values = archiveFields ? { ...row, ...archiveFields, status: "archived" } : row;
@@ -15408,10 +15415,13 @@ async function loadRelationsForTasks(db, tasks2) {
     }
   }
 }
+var log2;
 var init_db_helpers = __esm({
   "packages/core/src/store/db-helpers.ts"() {
     "use strict";
+    init_logger();
     init_tasks_schema();
+    log2 = getLogger("db-helpers");
   }
 });
 
@@ -15745,7 +15755,7 @@ async function createSqliteDataAccessor(cwd) {
             archiveReason: taskAny.archiveReason ?? "completed",
             cycleTimeDays: taskAny.cycleTimeDays ?? null
           };
-          await upsertTask(db, row, archiveFields);
+          await upsertTask(db, row, archiveFields, true);
           depBatch.push({ taskId: task.id, deps: task.depends ?? [] });
         }
         await batchUpdateDependencies(db, depBatch, validDepIds);
@@ -16758,7 +16768,7 @@ async function ensureSequenceValid(cwd, options) {
   if (!options?.validateSequence) return;
   const check2 = await checkSequence(cwd);
   if (!check2.valid) {
-    log2.warn({ counter: check2.counter, maxId: check2.maxIdInData }, "Sequence behind, repairing");
+    log3.warn({ counter: check2.counter, maxId: check2.maxIdInData }, "Sequence behind, repairing");
     const repair = await repairSequence(cwd);
     if (!repair.repaired && options.strict) {
       throw new DataSafetyError(`Sequence repair failed: ${repair.message}`, "SEQUENCE_INVALID", {
@@ -16775,7 +16785,7 @@ async function checkpoint(context, cwd, options) {
     stats.checkpoints++;
     stats.lastCheckpoint = /* @__PURE__ */ new Date();
   } catch (err) {
-    log2.warn({ err }, "Checkpoint failed (non-fatal)");
+    log3.warn({ err }, "Checkpoint failed (non-fatal)");
   }
   vacuumIntoBackup({ cwd }).catch(() => {
   });
@@ -16837,7 +16847,7 @@ async function safeAppendLog(accessor, entry, cwd, options) {
   stats.writes++;
   await checkpoint("log entry", cwd, opts);
 }
-var log2, DataSafetyError, DEFAULT_SAFETY, stats;
+var log3, DataSafetyError, DEFAULT_SAFETY, stats;
 var init_data_safety_central = __esm({
   "packages/core/src/store/data-safety-central.ts"() {
     "use strict";
@@ -16845,7 +16855,7 @@ var init_data_safety_central = __esm({
     init_sequence();
     init_git_checkpoint();
     init_sqlite_backup();
-    log2 = getLogger("data-safety");
+    log3 = getLogger("data-safety");
     DataSafetyError = class extends Error {
       constructor(message, code, context) {
         super(message);
@@ -16885,7 +16895,7 @@ function isSafetyDisabled() {
 }
 function wrapWithSafety(accessor, cwd) {
   if (isSafetyDisabled()) {
-    log3.warn(
+    log4.warn(
       "Safety disabled - emergency mode (CLEO_DISABLE_SAFETY=true). Data integrity checks bypassed."
     );
     return accessor;
@@ -16906,13 +16916,13 @@ function getSafetyStatus() {
     enabled: true
   };
 }
-var log3, SafetyDataAccessor;
+var log4, SafetyDataAccessor;
 var init_safety_data_accessor = __esm({
   "packages/core/src/store/safety-data-accessor.ts"() {
     "use strict";
     init_logger();
     init_data_safety_central();
-    log3 = getLogger("data-safety");
+    log4 = getLogger("data-safety");
     SafetyDataAccessor = class {
       /** The underlying accessor being wrapped. */
       inner;
@@ -16936,7 +16946,7 @@ var init_safety_data_accessor = __esm({
           ...config2
         };
         if (this.config.verbose) {
-          log3.debug({ engine: inner.engine }, "SafetyDataAccessor initialized");
+          log4.debug({ engine: inner.engine }, "SafetyDataAccessor initialized");
         }
       }
       /** The storage engine backing this accessor. */
@@ -16948,7 +16958,7 @@ var init_safety_data_accessor = __esm({
        */
       logVerbose(message) {
         if (this.config.verbose) {
-          log3.debug(message);
+          log4.debug(message);
         }
       }
       /**
@@ -24069,16 +24079,16 @@ async function queryAudit(options) {
       error: row.errorMessage ?? void 0
     }));
   } catch (err) {
-    log4.warn({ err }, "Failed to query audit entries from SQLite");
+    log5.warn({ err }, "Failed to query audit entries from SQLite");
     return [];
   }
 }
-var log4;
+var log5;
 var init_audit = __esm({
   "packages/core/src/audit.ts"() {
     "use strict";
     init_logger();
-    log4 = getLogger("audit");
+    log5 = getLogger("audit");
   }
 });
 
@@ -57107,7 +57117,7 @@ async function recordEvidence(epicId, stage, uri, type, options) {
       description: options?.description ?? null
     }).run();
   } catch (err) {
-    log5.warn({ err }, "Failed to write evidence to SQLite");
+    log6.warn({ err }, "Failed to write evidence to SQLite");
   }
   return record2;
 }
@@ -57120,14 +57130,14 @@ async function linkProvenance(epicId, stage, filePath, cwd) {
     cwd
   });
 }
-var log5;
+var log6;
 var init_evidence = __esm({
   "packages/core/src/lifecycle/evidence.ts"() {
     "use strict";
     init_logger();
     init_paths();
     init_tasks_schema();
-    log5 = getLogger("lifecycle:evidence");
+    log6 = getLogger("lifecycle:evidence");
   }
 });
 
@@ -65581,7 +65591,7 @@ async function ensureExternalTaskLinksTable(cwd) {
       )
     );
   } catch (err) {
-    log6.warn({ err }, "Failed to ensure external_task_links table exists");
+    log7.warn({ err }, "Failed to ensure external_task_links table exists");
     throw err;
   }
 }
@@ -65649,14 +65659,14 @@ function rowToLink(row) {
     lastSyncAt: row.lastSyncAt
   };
 }
-var log6;
+var log7;
 var init_link_store = __esm({
   "packages/core/src/reconciliation/link-store.ts"() {
     "use strict";
     init_logger();
     init_sqlite2();
     init_tasks_schema();
-    log6 = getLogger("link-store");
+    log7 = getLogger("link-store");
   }
 });
 
@@ -65802,7 +65812,7 @@ async function executeTransferInternal(params) {
       }
     }
   } catch (err) {
-    log7.warn(
+    log8.warn(
       { err, linksCreated },
       "Failed to create external_task_links during transfer \u2014 tasks were transferred successfully but provenance links could not be written"
     );
@@ -65830,7 +65840,7 @@ async function executeTransferInternal(params) {
       })
     });
   } catch (err) {
-    log7.warn({ err }, "nexus transfer audit write failed");
+    log8.warn({ err }, "nexus transfer audit write failed");
   }
   if (mode === "move") {
     let archived = 0;
@@ -65843,7 +65853,7 @@ async function executeTransferInternal(params) {
           });
           archived++;
         } catch (err) {
-          log7.warn({ err, taskId: entry.sourceId }, "failed to archive source task after transfer");
+          log8.warn({ err, taskId: entry.sourceId }, "failed to archive source task after transfer");
         }
       }
     }
@@ -65881,14 +65891,14 @@ async function executeTransferInternal(params) {
         }
       }
     } catch (err) {
-      log7.warn({ err }, "brain observation transfer failed");
+      log8.warn({ err }, "brain observation transfer failed");
     }
     result.brainObservationsTransferred = brainTransferred;
     result.manifest.brainObservationsTransferred = brainTransferred;
   }
   return result;
 }
-var log7;
+var log8;
 var init_transfer = __esm({
   "packages/core/src/nexus/transfer.ts"() {
     "use strict";
@@ -65901,7 +65911,7 @@ var init_transfer = __esm({
     init_export2();
     init_permissions();
     init_registry3();
-    log7 = getLogger("nexus:transfer");
+    log8 = getLogger("nexus:transfer");
   }
 });
 
@@ -66182,9 +66192,7 @@ async function completeTask(options, cwd, accessor) {
     const parent = await acc.loadSingleTask(task.parentId);
     if (parent && parent.type === "epic" && !parent.noAutoComplete) {
       const siblings = await acc.getChildren(parent.id);
-      const allDone = siblings.every(
-        (c) => c.id === task.id || c.status === "done" || c.status === "cancelled"
-      );
+      const allDone = siblings.length > 0 && siblings.every((c) => c.id === task.id || c.status === "done" || c.status === "cancelled");
       if (allDone) {
         parent.status = "done";
         parent.completedAt = now2;
@@ -66843,8 +66851,8 @@ async function loadProjectACL(projectPath) {
 async function logAclFailure(projectPath) {
   try {
     const { getLogger: getLogger2 } = await Promise.resolve().then(() => (init_logger(), logger_exports));
-    const log12 = getLogger2("nexus.acl");
-    log12.warn({ projectPath }, "Failed to load ACL configuration, defaulting to deny-all");
+    const log13 = getLogger2("nexus.acl");
+    log13.warn({ projectPath }, "Failed to load ACL configuration, defaulting to deny-all");
   } catch {
   }
 }
@@ -66989,9 +66997,9 @@ async function executeOperation(operation, taskId, projectPath, accessor, direct
 async function logRouteAudit(directive, projectName, taskId, operation, success2, error48) {
   try {
     const { getLogger: getLogger2 } = await Promise.resolve().then(() => (init_logger(), logger_exports));
-    const log12 = getLogger2("nexus.route");
+    const log13 = getLogger2("nexus.route");
     const level = success2 ? "info" : "warn";
-    log12[level](
+    log13[level](
       {
         directive: directive.verb,
         agentId: directive.agentId,
@@ -76084,7 +76092,7 @@ async function queryTasks(cwd, since) {
     }).from(tasks2).where(conditions.length > 0 ? and14(...conditions) : void 0).all();
     return rows;
   } catch (err) {
-    log8.warn({ err }, "Failed to query tasks for workflow telemetry");
+    log9.warn({ err }, "Failed to query tasks for workflow telemetry");
     return [];
   }
 }
@@ -76118,7 +76126,7 @@ async function queryCompletionAuditRows(cwd, since) {
       return isComplete;
     });
   } catch (err) {
-    log8.warn({ err }, "Failed to query audit log for workflow telemetry");
+    log9.warn({ err }, "Failed to query audit log for workflow telemetry");
     return [];
   }
 }
@@ -76343,12 +76351,12 @@ async function getWorkflowComplianceReport(opts) {
     }
   };
 }
-var log8;
+var log9;
 var init_workflow_telemetry = __esm({
   "packages/core/src/stats/workflow-telemetry.ts"() {
     "use strict";
     init_logger();
-    log8 = getLogger("workflow-telemetry");
+    log9 = getLogger("workflow-telemetry");
   }
 });
 
@@ -77665,7 +77673,7 @@ import { createGzip } from "node:zlib";
 async function pruneAuditLog(cleoDir, config2) {
   try {
     if (!config2.auditRetentionDays || config2.auditRetentionDays <= 0) {
-      log9.debug("auditRetentionDays is 0 or unset; skipping audit prune");
+      log10.debug("auditRetentionDays is 0 or unset; skipping audit prune");
       return { rowsArchived: 0, rowsDeleted: 0 };
     }
     const cutoff = new Date(Date.now() - config2.auditRetentionDays * 864e5).toISOString();
@@ -77676,7 +77684,7 @@ async function pruneAuditLog(cleoDir, config2) {
     const db = await getDb4(projectRoot);
     const oldRows = await db.select().from(auditLog2).where(lt4(auditLog2.timestamp, cutoff));
     if (oldRows.length === 0) {
-      log9.debug("No audit_log rows older than cutoff; nothing to prune");
+      log10.debug("No audit_log rows older than cutoff; nothing to prune");
       return { rowsArchived: 0, rowsDeleted: 0 };
     }
     let archivePath;
@@ -77694,17 +77702,17 @@ async function pruneAuditLog(cleoDir, config2) {
         const inStream = Readable.from([jsonlContent]);
         await pipeline(inStream, gzip, outStream);
         rowsArchived = oldRows.length;
-        log9.info(
+        log10.info(
           { archivePath, rowsArchived },
           `Archived ${rowsArchived} audit rows to ${archivePath}`
         );
       } catch (archiveErr) {
-        log9.warn({ err: archiveErr }, "Failed to archive audit rows; continuing with deletion");
+        log10.warn({ err: archiveErr }, "Failed to archive audit rows; continuing with deletion");
         archivePath = void 0;
       }
     }
     await db.delete(auditLog2).where(lt4(auditLog2.timestamp, cutoff)).run();
-    log9.info(
+    log10.info(
       { rowsDeleted: oldRows.length, cutoff },
       `Pruned ${oldRows.length} audit_log rows older than ${cutoff}`
     );
@@ -77714,16 +77722,16 @@ async function pruneAuditLog(cleoDir, config2) {
       archivePath
     };
   } catch (err) {
-    log9.warn({ err }, "audit log pruning failed");
+    log10.warn({ err }, "audit log pruning failed");
     return { rowsArchived: 0, rowsDeleted: 0 };
   }
 }
-var log9;
+var log10;
 var init_audit_prune = __esm({
   "packages/core/src/audit-prune.ts"() {
     "use strict";
     init_logger();
-    log9 = getLogger("prune");
+    log10 = getLogger("prune");
   }
 });
 
@@ -96752,7 +96760,7 @@ var init_backup_pack = __esm({
 import fs5 from "node:fs";
 import path5 from "node:path";
 function detectAndRemoveLegacyGlobalFiles(cleoHomeOverride) {
-  const log12 = getLogger("cleanup-legacy");
+  const log13 = getLogger("cleanup-legacy");
   const cleoHome = cleoHomeOverride ?? getCleoHome();
   const removed = [];
   const errors = [];
@@ -96762,30 +96770,30 @@ function detectAndRemoveLegacyGlobalFiles(cleoHomeOverride) {
       if (fs5.existsSync(fullPath)) {
         fs5.unlinkSync(fullPath);
         removed.push(fileName);
-        log12.info({ file: fullPath }, "Removed legacy global file");
+        log13.info({ file: fullPath }, "Removed legacy global file");
       }
     } catch (err) {
       const message = err instanceof Error ? err.message : String(err);
       errors.push({ file: fileName, error: message });
-      log12.warn({ file: fullPath, error: message }, "Failed to remove legacy global file");
+      log13.warn({ file: fullPath, error: message }, "Failed to remove legacy global file");
     }
   }
   return { removed, errors };
 }
 function detectAndRemoveStrayProjectNexus(projectRoot) {
-  const log12 = getLogger("cleanup-legacy");
+  const log13 = getLogger("cleanup-legacy");
   const strayPath = path5.join(projectRoot, ".cleo", "nexus.db");
   if (fs5.existsSync(strayPath)) {
     try {
       fs5.unlinkSync(strayPath);
-      log12.warn(
+      log13.warn(
         { path: strayPath },
         "Removed stray project-tier nexus.db (violates ADR-036 global-only contract)"
       );
       return { removed: true, path: strayPath };
     } catch (err) {
       const message = err instanceof Error ? err.message : String(err);
-      log12.warn(
+      log13.warn(
         { path: strayPath, error: message },
         "Failed to remove stray project-tier nexus.db \u2014 manual deletion may be required"
       );
@@ -96856,7 +96864,7 @@ function brokenTimestamp() {
   return `${now2.getFullYear()}${pad2(now2.getMonth() + 1)}${pad2(now2.getDate())}-${pad2(now2.getHours())}${pad2(now2.getMinutes())}${pad2(now2.getSeconds())}-${pad3(now2.getMilliseconds())}`;
 }
 function migrateSignaldockToConduit(projectRoot) {
-  const log12 = getLogger("migrate-signaldock-to-conduit");
+  const log13 = getLogger("migrate-signaldock-to-conduit");
   const legacyPath = join113(projectRoot, ".cleo", "signaldock.db");
   const conduitPath = join113(projectRoot, ".cleo", "conduit.db");
   const globalSignaldockPath = join113(getCleoHome(), "signaldock.db");
@@ -96873,13 +96881,13 @@ function migrateSignaldockToConduit(projectRoot) {
   if (!needsSignaldockToConduitMigration(projectRoot)) {
     return result;
   }
-  log12.info({ projectRoot, legacyPath }, "T310 migration: starting signaldock.db \u2192 conduit.db");
+  log13.info({ projectRoot, legacyPath }, "T310 migration: starting signaldock.db \u2192 conduit.db");
   let legacy = null;
   try {
     legacy = new DatabaseSync7(legacyPath, { readOnly: true });
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
-    log12.error({ legacyPath, error: message }, "T310 migration: cannot open legacy signaldock.db");
+    log13.error({ legacyPath, error: message }, "T310 migration: cannot open legacy signaldock.db");
     result.errors.push({ step: "step-2-open-legacy", error: message });
     result.status = "failed";
     return result;
@@ -96887,7 +96895,7 @@ function migrateSignaldockToConduit(projectRoot) {
   try {
     if (!integrityCheckPasses(legacy)) {
       const msg = "Legacy signaldock.db failed PRAGMA integrity_check. Migration aborted \u2014 no changes written. Recovery: inspect the database with sqlite3 and attempt manual repair before re-running.";
-      log12.error({ legacyPath }, msg);
+      log13.error({ legacyPath }, msg);
       result.errors.push({ step: "step-3-legacy-integrity", error: msg });
       result.status = "failed";
       legacy.close();
@@ -96895,7 +96903,7 @@ function migrateSignaldockToConduit(projectRoot) {
     }
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
-    log12.error({ legacyPath, error: message }, "T310 migration: integrity_check threw on legacy DB");
+    log13.error({ legacyPath, error: message }, "T310 migration: integrity_check threw on legacy DB");
     result.errors.push({ step: "step-3-legacy-integrity", error: message });
     result.status = "failed";
     legacy.close();
@@ -96913,7 +96921,7 @@ function migrateSignaldockToConduit(projectRoot) {
     getGlobalSalt();
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
-    log12.error({ error: message }, "T310 migration: getGlobalSalt failed \u2014 migration aborted");
+    log13.error({ error: message }, "T310 migration: getGlobalSalt failed \u2014 migration aborted");
     result.errors.push({ step: "step-6-global-salt", error: message });
     result.status = "failed";
     legacy.close();
@@ -96927,7 +96935,7 @@ function migrateSignaldockToConduit(projectRoot) {
     conduit.exec("PRAGMA foreign_keys = OFF");
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
-    log12.error({ conduitPath, error: message }, "T310 migration: failed to create conduit.db");
+    log13.error({ conduitPath, error: message }, "T310 migration: failed to create conduit.db");
     result.errors.push({ step: "step-7-create-conduit", error: message });
     result.status = "failed";
     legacy.close();
@@ -96973,7 +96981,7 @@ function migrateSignaldockToConduit(projectRoot) {
     result.agentsCopied = agentsCountForConduit;
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
-    log12.error({ error: message }, "T310 migration: conduit.db write failed \u2014 rolling back");
+    log13.error({ error: message }, "T310 migration: conduit.db write failed \u2014 rolling back");
     result.errors.push({ step: "step-8-conduit-write", error: message });
     result.status = "failed";
     try {
@@ -96994,7 +97002,7 @@ function migrateSignaldockToConduit(projectRoot) {
   try {
     if (!integrityCheckPasses(conduit)) {
       const msg = "conduit.db failed PRAGMA integrity_check after write";
-      log12.error({ conduitPath }, msg);
+      log13.error({ conduitPath }, msg);
       result.errors.push({ step: "step-10-conduit-integrity", error: msg });
       result.status = "failed";
       conduit.close();
@@ -97009,7 +97017,7 @@ function migrateSignaldockToConduit(projectRoot) {
     }
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
-    log12.error({ error: message }, "T310 migration: conduit.db integrity_check threw");
+    log13.error({ error: message }, "T310 migration: conduit.db integrity_check threw");
     result.errors.push({ step: "step-10-conduit-integrity", error: message });
     result.status = "failed";
     if (conduit) {
@@ -97031,7 +97039,7 @@ function migrateSignaldockToConduit(projectRoot) {
     globalDb.exec("PRAGMA foreign_keys = OFF");
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
-    log12.error(
+    log13.error(
       { globalSignaldockPath, error: message },
       "T310 migration: cannot open global signaldock.db"
     );
@@ -97070,7 +97078,7 @@ function migrateSignaldockToConduit(projectRoot) {
     result.agentsCopied = agentsCopiedToGlobal;
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
-    log12.error(
+    log13.error(
       { error: message },
       "T310 migration: global signaldock.db write failed \u2014 rolling back"
     );
@@ -97088,7 +97096,7 @@ function migrateSignaldockToConduit(projectRoot) {
   try {
     if (!integrityCheckPasses(globalDb)) {
       const msg = "Global signaldock.db failed PRAGMA integrity_check after write";
-      log12.error({ globalSignaldockPath }, msg);
+      log13.error({ globalSignaldockPath }, msg);
       result.errors.push({ step: "step-14-global-integrity", error: msg });
       result.status = "failed";
       globalDb.close();
@@ -97103,7 +97111,7 @@ function migrateSignaldockToConduit(projectRoot) {
     }
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
-    log12.error({ error: message }, "T310 migration: global signaldock.db integrity_check threw");
+    log13.error({ error: message }, "T310 migration: global signaldock.db integrity_check threw");
     result.errors.push({ step: "step-14-global-integrity", error: message });
     result.status = "failed";
     if (globalDb) {
@@ -97122,21 +97130,21 @@ function migrateSignaldockToConduit(projectRoot) {
     result.bakPath = bakPath;
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
-    log12.error(
+    log13.error(
       { legacyPath, bakPath, error: message },
       "T310 migration: rename to .pre-t310.bak failed \u2014 legacy file left in place (harmless)"
     );
     result.errors.push({ step: "step-16-rename-bak", error: message });
   }
-  log12.info(
+  log13.info(
     { projectRoot, agentsCopied: result.agentsCopied, conduitPath, bakPath: result.bakPath },
     `T310 migration complete: ${result.agentsCopied} agents migrated to global, conduit.db created`
   );
-  log12.warn(
+  log13.warn(
     {},
     "T310 migration: API keys have been re-keyed. External systems holding old API keys (CI env vars, remote agent configs) must be updated."
   );
-  log12.info(
+  log13.info(
     { legacyPath, bakPath: result.bakPath, conduitPath },
     "T310 migration recovery: if problems occur, rename .pre-t310.bak to signaldock.db and delete conduit.db to re-run migration."
   );
@@ -97370,7 +97378,7 @@ async function validateAndRepairSequence(cwd, config2 = {}) {
     }
     const repair = await repairSequence(cwd);
     if (repair.repaired) {
-      log10.warn(
+      log11.warn(
         { oldCounter: repair.oldCounter, newCounter: repair.newCounter },
         "Sequence repaired"
       );
@@ -97399,7 +97407,7 @@ async function triggerCheckpoint(context, cwd, config2 = {}) {
   try {
     await gitCheckpoint("auto", context, cwd);
   } catch (err) {
-    log10.warn({ err }, "Checkpoint failed (non-fatal)");
+    log11.warn({ err }, "Checkpoint failed (non-fatal)");
   }
   vacuumIntoBackup({ cwd }).catch(() => {
   });
@@ -97437,16 +97445,16 @@ async function safeDeleteTask(deleteFn, taskId, cwd, config2 = {}) {
   return result;
 }
 async function forceCheckpointBeforeOperation(operation, cwd) {
-  log10.info({ operation }, "Forcing checkpoint before operation");
+  log11.info({ operation }, "Forcing checkpoint before operation");
   try {
     await gitCheckpoint("manual", `pre-${operation}`, cwd);
   } catch (err) {
-    log10.error({ err }, "Failed to create pre-operation checkpoint");
+    log11.error({ err }, "Failed to create pre-operation checkpoint");
   }
   vacuumIntoBackup({ cwd, force: true }).catch(() => {
   });
 }
-var log10, DEFAULT_CONFIG2, SafetyError;
+var log11, DEFAULT_CONFIG2, SafetyError;
 var init_data_safety = __esm({
   "packages/core/src/store/data-safety.ts"() {
     "use strict";
@@ -97456,7 +97464,7 @@ var init_data_safety = __esm({
     init_sqlite2();
     init_sqlite_backup();
     init_tasks_schema();
-    log10 = getLogger("data-safety");
+    log11 = getLogger("data-safety");
     DEFAULT_CONFIG2 = {
       verifyWrites: true,
       detectCollisions: true,
@@ -107330,11 +107338,11 @@ var require_core = __commonJS({
     Ajv4.ValidationError = validation_error_1.default;
     Ajv4.MissingRefError = ref_error_1.default;
     exports.default = Ajv4;
-    function checkOptions(checkOpts, options, msg, log12 = "error") {
+    function checkOptions(checkOpts, options, msg, log13 = "error") {
       for (const key in checkOpts) {
         const opt = key;
         if (opt in options)
-          this.logger[log12](`${msg}: option ${key}. ${checkOpts[opt]}`);
+          this.logger[log13](`${msg}: option ${key}. ${checkOpts[opt]}`);
       }
     }
     function getSchEnv(keyRef) {
@@ -130134,7 +130142,7 @@ async function writeToSqlite(entry, requestId) {
     };
     const parsed = AuditLogInsertSchema2.safeParse(payload);
     if (!parsed.success) {
-      log11.warn(
+      log12.warn(
         { issues: parsed.error.issues },
         "Audit payload failed Zod validation; skipping insert"
       );
@@ -130143,7 +130151,7 @@ async function writeToSqlite(entry, requestId) {
     const db = await getDb4(process.cwd());
     await db.insert(auditLog2).values(parsed.data).run();
   } catch (err) {
-    log11.warn({ err }, "Failed to write audit entry to SQLite");
+    log12.warn({ err }, "Failed to write audit entry to SQLite");
   }
 }
 function createAudit() {
@@ -130174,7 +130182,7 @@ function createAudit() {
       },
       error: response.error?.message
     };
-    log11.info(
+    log12.info(
       {
         domain: entry.domain,
         operation: entry.operation,
@@ -130191,20 +130199,20 @@ function createAudit() {
       await writeToSqlite(entry, req.requestId);
     } else {
       writeToSqlite(entry, req.requestId).catch((err) => {
-        log11.error({ err }, "Failed to persist audit entry to SQLite");
+        log12.error({ err }, "Failed to persist audit entry to SQLite");
       });
     }
     return response;
   };
 }
-var log11, cachedProjectHash;
+var log12, cachedProjectHash;
 var init_audit3 = __esm({
   "packages/cleo/src/dispatch/middleware/audit.ts"() {
     "use strict";
     init_internal();
     init_config3();
     init_internal();
-    log11 = getLogger("audit");
+    log12 = getLogger("audit");
   }
 });