@cleocode/cleo 2026.9.16 → 2026.9.17

package/dist/cli/index.js

@@ -12274,7 +12274,12 @@ var init_operations_registry = __esm({
             required: false,
             description: "JS regex matched against project_path"
           },
-          { name: "includeTemp", type: "boolean", required: false, description: "Match .temp/ paths" },
+          {
+            name: "includeTemp",
+            type: "boolean",
+            required: false,
+            description: "Match .temp/ or OS temp-directory paths"
+          },
           {
             name: "includeTests",
             type: "boolean",
@@ -12309,7 +12314,7 @@ var init_operations_registry = __esm({
             name: "vacuum",
             type: "boolean",
             required: false,
-            description: "After delete, run sqlite VACUUM on nexus.db to reclaim space (T9117)"
+            description: "After delete, VACUUM the global registry store (<cleoHome>/cleo.db) to reclaim space (T9117 \xB7 T12324)"
           }
         ]
       },
@@ -16375,7 +16380,8 @@ var init_errors = __esm({
       constructor(details) {
         const linePart = details.line !== null ? `:${details.line}` : "";
         super(
-          `E_CHANGESET_YAML_INVALID: ${details.file}${linePart} invalid YAML frontmatter: ${details.parserMessage}`
+          `E_CHANGESET_YAML_INVALID: ${details.file}${linePart} invalid YAML frontmatter: ${details.parserMessage}` + (details.hint !== void 0 ? `
+  hint: ${details.hint}` : "")
         );
         this.name = "ChangesetYamlInvalidError";
         this.details = details;
@@ -19348,7 +19354,8 @@ var init_nexus_scope_map = __esm({
         scope: "project",
         effect: "write",
         stores: ["nexus-graph"],
-        requiresProject: true
+        requiresProject: true,
+        indexSensitive: true
       },
       "share.status": {
         op: "share.status",
@@ -19372,7 +19379,8 @@ var init_nexus_scope_map = __esm({
         scope: "project",
         effect: "read",
         stores: ["nexus-graph"],
-        requiresProject: true
+        requiresProject: true,
+        indexSensitive: true
       },
       impact: {
         op: "impact",
@@ -19389,7 +19397,8 @@ var init_nexus_scope_map = __esm({
         scope: "project",
         effect: "read",
         stores: ["nexus-graph"],
-        requiresProject: true
+        requiresProject: true,
+        indexSensitive: true
       },
       "task-footprint": {
         op: "task-footprint",
@@ -19397,7 +19406,8 @@ var init_nexus_scope_map = __esm({
         scope: "hybrid",
         effect: "read",
         stores: ["nexus-graph", "tasks"],
-        requiresProject: true
+        requiresProject: true,
+        indexSensitive: true
       },
       "brain-anchors": {
         op: "brain-anchors",
@@ -19405,7 +19415,8 @@ var init_nexus_scope_map = __esm({
         scope: "hybrid",
         effect: "read",
         stores: ["nexus-graph", "brain"],
-        requiresProject: true
+        requiresProject: true,
+        indexSensitive: true
       },
       why: {
         op: "why",
@@ -19413,7 +19424,8 @@ var init_nexus_scope_map = __esm({
         scope: "hybrid",
         effect: "read",
         stores: ["nexus-graph", "brain"],
-        requiresProject: true
+        requiresProject: true,
+        indexSensitive: true
       },
       "impact-full": {
         op: "impact-full",
@@ -19430,7 +19442,8 @@ var init_nexus_scope_map = __esm({
         scope: "project",
         effect: "read",
         stores: ["nexus-graph"],
-        requiresProject: true
+        requiresProject: true,
+        indexSensitive: true
       },
       "shape-check": {
         op: "shape-check",
@@ -19438,7 +19451,8 @@ var init_nexus_scope_map = __esm({
         scope: "project",
         effect: "read",
         stores: ["nexus-graph"],
-        requiresProject: true
+        requiresProject: true,
+        indexSensitive: true
       },
       "search-code": {
         op: "search-code",
@@ -19446,7 +19460,8 @@ var init_nexus_scope_map = __esm({
         scope: "project",
         effect: "read",
         stores: ["nexus-graph", "fs"],
-        requiresProject: true
+        requiresProject: true,
+        indexSensitive: true
       },
       wiki: {
         op: "wiki",
@@ -19470,7 +19485,8 @@ var init_nexus_scope_map = __esm({
         scope: "hybrid",
         effect: "read",
         stores: ["nexus-graph", "tasks"],
-        requiresProject: true
+        requiresProject: true,
+        indexSensitive: true
       },
       // ── Profile ops ───────────────────────────────────────────────────────────
       "profile.view": {
@@ -19650,7 +19666,8 @@ var init_nexus_scope_map = __esm({
         scope: "project",
         effect: "read",
         stores: ["nexus-graph"],
-        requiresProject: true
+        requiresProject: true,
+        indexSensitive: true
       },
       flows: {
         op: "flows",
@@ -19658,7 +19675,8 @@ var init_nexus_scope_map = __esm({
         scope: "project",
         effect: "read",
         stores: ["nexus-graph"],
-        requiresProject: true
+        requiresProject: true,
+        indexSensitive: true
       },
       context: {
         op: "context",
@@ -19732,7 +19750,8 @@ var init_nexus_scope_map = __esm({
         scope: "project",
         effect: "read",
         stores: ["nexus-graph"],
-        requiresProject: true
+        requiresProject: true,
+        indexSensitive: true
       },
       "hot-paths": {
         op: "hot-paths",
@@ -19740,7 +19759,8 @@ var init_nexus_scope_map = __esm({
         scope: "project",
         effect: "read",
         stores: ["nexus-graph"],
-        requiresProject: true
+        requiresProject: true,
+        indexSensitive: true
       },
       "hot-nodes": {
         op: "hot-nodes",
@@ -19748,7 +19768,8 @@ var init_nexus_scope_map = __esm({
         scope: "project",
         effect: "read",
         stores: ["nexus-graph"],
-        requiresProject: true
+        requiresProject: true,
+        indexSensitive: true
       },
       "cold-symbols": {
         op: "cold-symbols",
@@ -19756,7 +19777,8 @@ var init_nexus_scope_map = __esm({
         scope: "project",
         effect: "read",
         stores: ["nexus-graph"],
-        requiresProject: true
+        requiresProject: true,
+        indexSensitive: true
       }
     };
   }
@@ -31466,10 +31488,13 @@ var init_memory2 = __esm({
 
 // packages/cleo/src/dispatch/domains/nexus.ts
 import {
+  assessNexusFreshnessForQuery,
+  discloseNexusFreshness,
   getBrainNativeDb as getBrainNativeDb2,
   getLogger as getLogger6,
   getNexusNativeDb,
   getProjectRoot as getProjectRoot9,
+  judgeSymbolFiles,
   nexusAugment,
   nexusBlockers,
   nexusBrainAnchors,
@@ -31531,7 +31556,9 @@ import {
   nexusTransferPreview,
   nexusUnregisterProject,
   nexusWhy,
-  nexusWiki
+  nexusWiki,
+  querySymbolFiles,
+  withNexusFreshnessMeta
 } from "@cleocode/core/internal";
 import { stampNexusMeta } from "@cleocode/runtime/gateway";
 function nexusQueryEnvelopeToResponse(envelope, operation, startTime) {
@@ -31573,6 +31600,21 @@ function nexusMutateEnvelopeToResponse(envelope, operation, startTime) {
     startTime
   );
 }
+function isScopeMapOp(operation) {
+  return operation in NEXUS_SCOPE_MAP;
+}
+function answersFromGraph(operation) {
+  if (FRESHNESS_EXEMPT_OPS.has(operation) || !isScopeMapOp(operation)) return false;
+  return getNexusDescriptor(operation).indexSensitive === true;
+}
+function withFreshness(response, operation, assessment) {
+  const freshness = judgeSymbolFiles(assessment, querySymbolFiles(response.data));
+  discloseNexusFreshness(`nexus ${operation}`, freshness);
+  return {
+    ...response,
+    meta: { ...response.meta, ...withNexusFreshnessMeta(response.meta, freshness) }
+  };
+}
 async function handleTopEntries(operation, params, startTime) {
   const rawLimit = params?.limit;
   const limit = typeof rawLimit === "number" && Number.isFinite(rawLimit) && rawLimit > 0 ? Math.floor(rawLimit) : 20;
@@ -31739,10 +31781,11 @@ async function handleImpact(operation, params, startTime) {
   });
   return wrapResult(result, "query", "nexus", operation, startTime);
 }
-var _nexusTypedHandler, QUERY_OPS7, MUTATE_OPS6, NexusHandler;
+var _nexusTypedHandler, QUERY_OPS7, MUTATE_OPS6, FRESHNESS_EXEMPT_OPS, NexusHandler;
 var init_nexus2 = __esm({
   "packages/cleo/src/dispatch/domains/nexus.ts"() {
     "use strict";
+    init_src2();
     init_typed();
     init_base();
     _nexusTypedHandler = defineTypedHandler("nexus", {
@@ -32229,6 +32272,7 @@ var init_nexus2 = __esm({
       "projects.clean",
       "refresh-bridge"
     ]);
+    FRESHNESS_EXEMPT_OPS = /* @__PURE__ */ new Set(["diff"]);
     NexusHandler = class {
       /**
        * Execute a read-only nexus query operation.
@@ -32241,6 +32285,14 @@ var init_nexus2 = __esm({
         if (!QUERY_OPS7.has(operation)) {
           return unsupportedOp("query", "nexus", operation, startTime);
         }
+        if (answersFromGraph(operation)) {
+          const assessment = await assessNexusFreshnessForQuery(getProjectRoot9());
+          return withFreshness(await this.answer(operation, params, startTime), operation, assessment);
+        }
+        return this.answer(operation, params, startTime);
+      }
+      /** Run one validated query op and stamp its `_nexus` scope metadata. */
+      async answer(operation, params, startTime) {
         if (operation === "top-entries") {
           const r = await handleTopEntries(operation, params, startTime);
           return stampNexusMeta(r, operation, params ?? {});
@@ -37120,8 +37172,8 @@ async function loadPlaybookByName(name) {
     return null;
   }
   try {
-    const { getProjectRoot: getProjectRoot67 } = await import("@cleocode/core/internal");
-    const projectRoot = __playbookRuntimeOverrides.projectRoot ?? getProjectRoot67();
+    const { getProjectRoot: getProjectRoot69 } = await import("@cleocode/core/internal");
+    const projectRoot = __playbookRuntimeOverrides.projectRoot ?? getProjectRoot69();
     const resolved = resolvePlaybook(name, {
       projectRoot,
       globalPlaybooksDir: __playbookRuntimeOverrides.globalPlaybooksDir,
@@ -37166,7 +37218,7 @@ async function buildDefaultDispatcher() {
   if (__playbookRuntimeOverrides.dispatcher) return __playbookRuntimeOverrides.dispatcher;
   const { orchestrateSpawnExecute: orchestrateSpawnExecute2 } = await import("@cleocode/runtime/gateway");
   const {
-    getProjectRoot: getProjectRoot67,
+    getProjectRoot: getProjectRoot69,
     createToolGuard,
     runSkillNodeOrSpawn,
     maybeCreatePiRunner,
@@ -37174,7 +37226,7 @@ async function buildDefaultDispatcher() {
     hasCantbookProfilePin,
     DEFAULT_DETERMINISTIC_DENIED_COMMANDS
   } = await import("@cleocode/core/internal");
-  const projectRoot = getProjectRoot67();
+  const projectRoot = getProjectRoot69();
   const tools = createToolGuard({
     allowedRoots: [projectRoot],
     deniedCommands: DEFAULT_DETERMINISTIC_DENIED_COMMANDS,
@@ -37267,12 +37319,12 @@ async function buildDefaultDeterministicRunner() {
     return void 0;
   }
   const {
-    getProjectRoot: getProjectRoot67,
+    getProjectRoot: getProjectRoot69,
     createToolGuard,
     createGuardedDeterministicRunner,
     DEFAULT_DETERMINISTIC_DENIED_COMMANDS
   } = await import("@cleocode/core/internal");
-  const projectRoot = getProjectRoot67();
+  const projectRoot = getProjectRoot69();
   const tools = createToolGuard({
     allowedRoots: [projectRoot],
     deniedCommands: DEFAULT_DETERMINISTIC_DENIED_COMMANDS,
@@ -37430,8 +37482,8 @@ var init_playbook2 = __esm({
             projectRoot = __playbookRuntimeOverrides.projectRoot;
           } else {
             try {
-              const { getProjectRoot: getProjectRoot67 } = await import("@cleocode/core/internal");
-              projectRoot = getProjectRoot67();
+              const { getProjectRoot: getProjectRoot69 } = await import("@cleocode/core/internal");
+              projectRoot = getProjectRoot69();
             } catch {
               projectRoot = void 0;
             }
@@ -37496,14 +37548,14 @@ var init_playbook2 = __esm({
         const deterministicRunner = await buildDefaultDeterministicRunner();
         let result;
         try {
-          const { getProjectRoot: getProjectRoot67 } = await import("@cleocode/core/internal");
+          const { getProjectRoot: getProjectRoot69 } = await import("@cleocode/core/internal");
           const opts = {
             db,
             playbook: parsed.definition,
             playbookHash: parsed.sourceHash,
             initialContext,
             dispatcher,
-            projectRoot: getProjectRoot67()
+            projectRoot: getProjectRoot69()
           };
           if (deterministicRunner !== void 0) opts.deterministicRunner = deterministicRunner;
           if (__playbookRuntimeOverrides.approvalSecret !== void 0) {
@@ -37948,7 +38000,7 @@ async function orchestrateClassify(request, context, projectRoot, taskId) {
   try {
     const { getCleoCantWorkflowsDir } = await import("@cleocode/core/internal");
     const { readFileSync: readFileSync23, readdirSync: readdirSync3, existsSync: existsSync24 } = await import("node:fs");
-    const { join: join40 } = await import("node:path");
+    const { join: join41 } = await import("node:path");
     const workflowsDir = getCleoCantWorkflowsDir();
     const combined = `${request} ${context ?? ""}`.toLowerCase();
     const matches = [];
@@ -37956,7 +38008,7 @@ async function orchestrateClassify(request, context, projectRoot, taskId) {
       const files = readdirSync3(workflowsDir).filter((f) => f.endsWith(".cant"));
       for (const file of files) {
         try {
-          const src = readFileSync23(join40(workflowsDir, file), "utf-8");
+          const src = readFileSync23(join41(workflowsDir, file), "utf-8");
           const teamMatch = /^team\s+(\S+):/m.exec(src);
           if (!teamMatch) continue;
           const teamName = teamMatch[1];
@@ -37971,12 +38023,12 @@ async function orchestrateClassify(request, context, projectRoot, taskId) {
         }
       }
     }
-    const localCantDir = join40(projectRoot, CLEO_DIR_NAME2, WORKFLOWS_SUBDIR);
+    const localCantDir = join41(projectRoot, CLEO_DIR_NAME2, WORKFLOWS_SUBDIR);
     if (existsSync24(localCantDir)) {
       const files = readdirSync3(localCantDir).filter((f) => f.endsWith(".cant"));
       for (const file of files) {
         try {
-          const src = readFileSync23(join40(localCantDir, file), "utf-8");
+          const src = readFileSync23(join41(localCantDir, file), "utf-8");
           const teamMatch = /^team\s+(\S+):/m.exec(src);
           if (!teamMatch) continue;
           const teamName = teamMatch[1];
@@ -44750,11 +44802,11 @@ var init_security = __esm({
 });
 
 // packages/cleo/src/dispatch/middleware/sanitizer.ts
-function createSanitizer(getProjectRoot67) {
+function createSanitizer(getProjectRoot69) {
   return async (req, next) => {
     if (req.params) {
       try {
-        const root = getProjectRoot67 ? getProjectRoot67() : void 0;
+        const root = getProjectRoot69 ? getProjectRoot69() : void 0;
         req.params = sanitizeParams(req.params, root, {
           domain: req.domain,
           operation: req.operation
@@ -46630,10 +46682,10 @@ var init_agent = __esm({
             transportConfig: {},
             isActive: true
           });
-          const { existsSync: existsSync24, mkdirSync: mkdirSync7, writeFileSync: writeFileSync7 } = await import("node:fs");
-          const { join: join40 } = await import("node:path");
-          const cantDir = join40(CLEO_DIR_NAME3, AGENTS_SUBDIR);
-          const cantPath = join40(cantDir, `${agentId}.cant`);
+          const { existsSync: existsSync24, mkdirSync: mkdirSync7, writeFileSync: writeFileSync8 } = await import("node:fs");
+          const { join: join41 } = await import("node:path");
+          const cantDir = join41(CLEO_DIR_NAME3, AGENTS_SUBDIR);
+          const cantPath = join41(cantDir, `${agentId}.cant`);
           let cantScaffolded = false;
           if (!existsSync24(cantPath)) {
             mkdirSync7(cantDir, { recursive: true });
@@ -46686,7 +46738,7 @@ agent ${agentId}:
   enforcement:
     1: TODO \u2014 what does this agent push back on?
 `;
-            writeFileSync7(cantPath, cantContent, "utf-8");
+            writeFileSync8(cantPath, cantContent, "utf-8");
             cantScaffolded = true;
           }
           cliOutput(
@@ -46815,7 +46867,7 @@ agent ${agentId}:
           const { AgentRegistryAccessor } = await import("@cleocode/core/agents");
           const { createRuntime } = await import("@cleocode/runtime");
           const { existsSync: existsSync24, readFileSync: readFileSync23 } = await import("node:fs");
-          const { join: join40 } = await import("node:path");
+          const { join: join41 } = await import("node:path");
           await openCleoDb("project");
           const registry = new AgentRegistryAccessor(getProjectRoot25());
           const credential = await registry.get(args.agentId);
@@ -46835,7 +46887,7 @@ agent ${agentId}:
           }
           let profile = null;
           let cantValidation = null;
-          const cantPath = args.cant ?? join40(CLEO_DIR_NAME3, AGENTS_SUBDIR, `${args.agentId}.cant`);
+          const cantPath = args.cant ?? join41(CLEO_DIR_NAME3, AGENTS_SUBDIR, `${args.agentId}.cant`);
           if (existsSync24(cantPath)) {
             profile = readFileSync23(cantPath, "utf-8");
             try {
@@ -47361,7 +47413,7 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
           const { AgentRegistryAccessor } = await import("@cleocode/core/agents");
           const { createRuntime } = await import("@cleocode/runtime");
           const { existsSync: existsSync24 } = await import("node:fs");
-          const { join: join40 } = await import("node:path");
+          const { join: join41 } = await import("node:path");
           await openCleoDb("project");
           const registry = new AgentRegistryAccessor(getProjectRoot25());
           const credential = await registry.get(args.agentId);
@@ -47378,7 +47430,7 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
           }
           await registry.update(args.agentId, { isActive: true });
           await registry.markUsed(args.agentId);
-          const cantPath = join40(CLEO_DIR_NAME3, AGENTS_SUBDIR, `${args.agentId}.cant`);
+          const cantPath = join41(CLEO_DIR_NAME3, AGENTS_SUBDIR, `${args.agentId}.cant`);
           const hasProfile = existsSync24(cantPath);
           const runtime = await createRuntime(registry, {
             agentId: args.agentId,
@@ -48329,8 +48381,8 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
             process.exitCode = 4;
             return;
           }
-          const { join: join40 } = await import("node:path");
-          const personaPath = join40(resolvedDir, "persona.cant");
+          const { join: join41 } = await import("node:path");
+          const personaPath = join41(resolvedDir, "persona.cant");
           if (!existsSync24(personaPath)) {
             cliOutput(
               {
@@ -48378,7 +48430,7 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
               if (entry.isFile()) {
                 fileCount++;
               } else if (entry.isDirectory()) {
-                countFiles(join40(dirPath, entry.name));
+                countFiles(join41(dirPath, entry.name));
               }
             }
           };
@@ -48627,7 +48679,7 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
       async run({ args }) {
         try {
           const { existsSync: existsSync24, readFileSync: readFileSync23, mkdirSync: mkdirSync7 } = await import("node:fs");
-          const { resolve: resolve13, join: join40 } = await import("node:path");
+          const { resolve: resolve13, join: join41 } = await import("node:path");
           const specPath = resolve13(args.spec);
           if (!existsSync24(specPath)) {
             cliError(`spec file not found: ${specPath}`, 4, { name: "E_NOT_FOUND" });
@@ -48636,7 +48688,7 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
           }
           const specContent = readFileSync23(specPath, "utf-8");
           const projectRoot = getProjectRoot25();
-          const outputDir = args["output-dir"] ? resolve13(args["output-dir"]) : join40(projectRoot, ".cleo", "cant", "agents");
+          const outputDir = args["output-dir"] ? resolve13(args["output-dir"]) : join41(projectRoot, ".cleo", "cant", "agents");
           mkdirSync7(outputDir, { recursive: true });
           if (args["dry-run"]) {
             cliOutput(
@@ -51357,6 +51409,63 @@ async function promptPassphrase() {
     });
   });
 }
+async function resolvePassphrase() {
+  let passphrase = process.env["CLEO_BACKUP_PASSPHRASE"];
+  if (!passphrase) {
+    try {
+      passphrase = await promptPassphrase();
+    } catch (promptErr) {
+      passphrase = void 0;
+      cliError(promptErr instanceof Error ? promptErr.message : String(promptErr), 6, {
+        name: "E_PASSPHRASE_REQUIRED"
+      });
+    }
+  }
+  if (!passphrase) {
+    if (process.exitCode === void 0) cliError("a passphrase is required", 6);
+    process.exitCode = 6;
+    return void 0;
+  }
+  return passphrase;
+}
+function collectFlagValues(rawArgs, flag) {
+  const values = [];
+  for (let i = 0; i < rawArgs.length; i++) {
+    const arg = rawArgs[i] ?? "";
+    if (arg === `--${flag}` && i + 1 < rawArgs.length) values.push(rawArgs[++i] ?? "");
+    else if (arg.startsWith(`--${flag}=`)) values.push(arg.slice(flag.length + 3));
+  }
+  return values;
+}
+async function portableImport(bundlePath, target, mapValues, force) {
+  const core2 = await import("@cleocode/core/store/portable-bundle-import.js");
+  const { PortableBundleError } = await import("@cleocode/core/store/portable-bundle.js");
+  try {
+    const needsPass = isBundleEncrypted(bundlePath);
+    const passphrase = needsPass ? await resolvePassphrase() : void 0;
+    if (needsPass && passphrase === void 0) return;
+    const result = await core2.importPortableBundle({
+      bundlePath,
+      passphrase,
+      target,
+      maps: core2.parsePathMappings(mapValues),
+      force: force === true,
+      requireLossless: true,
+      registerProject: core2.registerRelocatedProject
+    });
+    cliOutput(result, { command: "backup", operation: "backup.import" });
+  } catch (err) {
+    reportBundleError(err, err instanceof PortableBundleError ? err : null, "E_IMPORT_FAILED");
+  }
+}
+function reportBundleError(err, bundleErr, fallbackName) {
+  const exitCode = bundleErr?.exitCode ?? 1;
+  cliError(err instanceof Error ? err.message : String(err), exitCode, {
+    name: bundleErr?.code ?? fallbackName,
+    ...bundleErr?.details !== void 0 ? { details: bundleErr.details } : {}
+  });
+  process.exitCode = exitCode;
+}
 function checkForExistingData(projectRoot, cleoHome) {
   const projectFiles = CLI_PROJECT_BACKUP_FILES;
   const globalFiles = CLI_GLOBAL_BACKUP_FILES;
@@ -51464,7 +51573,7 @@ var init_backup = __esm({
     exportCommand = defineCommand({
       meta: {
         name: "export",
-        description: "Export project + global state to a portable .cleobundle.tar.gz"
+        description: "Export CLEO state to a portable .cleobundle.tar.gz (scopes: project | global | all | machine)"
       },
       args: {
         name: {
@@ -51474,12 +51583,12 @@ var init_backup = __esm({
         },
         scope: {
           type: "string",
-          description: "project | global | all",
+          description: "project | global | all | machine",
           default: "project"
         },
         encrypt: {
           type: "boolean",
-          description: "Encrypt bundle with passphrase (AES-256-GCM via scrypt)"
+          description: "Encrypt bundle with passphrase (AES-256-GCM via scrypt); required to carry secrets"
         },
         out: {
           type: "string",
@@ -51488,64 +51597,32 @@ var init_backup = __esm({
       },
       async run({ args }) {
         const scope = args.scope;
-        const { packBundle } = await import("@cleocode/core/store/backup-pack.js");
-        const { getProjectRoot: getProjectRoot67 } = await import("@cleocode/core");
-        const includesProject = scope === "project" || scope === "all";
-        const projectRoot = includesProject ? getProjectRoot67() : void 0;
-        let passphrase;
-        if (args.encrypt === true) {
-          passphrase = process.env["CLEO_BACKUP_PASSPHRASE"];
-          if (!passphrase) {
-            try {
-              passphrase = await promptPassphrase();
-            } catch (promptErr) {
-              const msg = promptErr instanceof Error ? promptErr.message : String(promptErr);
-              process.stderr.write(
-                JSON.stringify({ success: false, error: { code: 6, message: msg } }) + "\n"
-              );
-              process.exitCode = 6;
-              return;
-            }
-          }
-          if (!passphrase) {
-            process.stderr.write(
-              JSON.stringify({
-                success: false,
-                error: { code: 6, message: "--encrypt requires a passphrase" }
-              }) + "\n"
-            );
-            process.exitCode = 6;
-            return;
-          }
+        if (scope !== "project" && scope !== "global" && scope !== "all" && scope !== "machine") {
+          cliError(`--scope must be project, global, all or machine (got "${scope}")`, 6, {
+            name: "E_VALIDATION"
+          });
+          process.exitCode = 6;
+          return;
         }
+        const { exportPortableBundle, PortableBundleError } = await import("@cleocode/core/store/portable-bundle.js");
+        const { getProjectRoot: getProjectRoot69 } = await import("@cleocode/core");
+        const passphrase = args.encrypt === true ? await resolvePassphrase() : void 0;
+        if (args.encrypt === true && passphrase === void 0) return;
         const encSuffix = args.encrypt === true ? "enc." : "";
-        const outputPath = args.out ?? `./${args.name}.${encSuffix}cleobundle.tar.gz`;
         try {
-          const result = await packBundle({
+          const result = await exportPortableBundle({
             scope,
-            projectRoot,
-            outputPath,
+            projectRoot: scope === "project" || scope === "all" ? getProjectRoot69() : void 0,
+            outputPath: args.out ?? `./${args.name}.${encSuffix}cleobundle.tar.gz`,
             encrypt: args.encrypt === true,
             passphrase,
-            projectName: args.name
+            label: args.name
           });
-          cliOutput(
-            {
-              bundlePath: result.bundlePath,
-              size: result.size,
-              fileCount: result.fileCount,
-              scope,
-              encrypted: args.encrypt === true
-            },
-            { command: "backup", operation: "backup.add" }
-          );
-          humanInfo(
-            `Bundle written to ${result.bundlePath} (${result.size} bytes, ${result.fileCount} files)`
-          );
+          cliOutput(result, { command: "backup", operation: "backup.export" });
+          humanInfo(`Bundle written to ${result.bundlePath} (${result.size} bytes)`);
+          humanInfo(result.memory.notice);
         } catch (err) {
-          const message = err instanceof Error ? err.message : String(err);
-          process.stderr.write(JSON.stringify({ success: false, error: { code: 1, message } }) + "\n");
-          process.exitCode = 1;
+          reportBundleError(err, err instanceof PortableBundleError ? err : null, "E_EXPORT_FAILED");
         }
       }
     });
@@ -51563,18 +51640,31 @@ var init_backup = __esm({
         force: {
           type: "boolean",
           description: "Overwrite existing live data at target without aborting"
+        },
+        target: {
+          type: "string",
+          description: "Portable bundles: place a single-project bundle at this project root (paths are relocated)"
+        },
+        map: {
+          type: "string",
+          description: "Portable bundles: rewrite project paths <oldPrefix>=<newPrefix> (repeatable; longest prefix wins)"
         }
       },
-      async run({ args }) {
+      async run({ args, rawArgs }) {
         const bundlePath = args.bundle;
-        const { getProjectRoot: getProjectRoot67, getCleoHome: getCleoHome7, getCleoVersion } = await import("@cleocode/core");
+        const { detectBundleFormat } = await import("@cleocode/core/store/portable-bundle-import.js");
+        if (await detectBundleFormat(bundlePath) === "v2") {
+          await portableImport(bundlePath, args.target, collectFlagValues(rawArgs, "map"), args.force);
+          return;
+        }
+        const { getProjectRoot: getProjectRoot69, getCleoHome: getCleoHome8, getCleoVersion } = await import("@cleocode/core");
         const { BundleError, cleanupStaging, unpackBundle } = await import("@cleocode/core/store/backup-unpack.js");
         const { regenerateConfigJson, regenerateProjectContextJson, regenerateProjectInfoJson } = await import("@cleocode/core/store/regenerators.js");
         const { regenerateAndCompare } = await import("@cleocode/core/store/restore-json-merge.js");
         const { buildConflictReport, writeConflictReport } = await import("@cleocode/core/store/restore-conflict-report.js");
-        const projectRoot = getProjectRoot67();
+        const projectRoot = getProjectRoot69();
         if (args.force !== true) {
-          const existing = checkForExistingData(projectRoot, getCleoHome7());
+          const existing = checkForExistingData(projectRoot, getCleoHome8());
           if (existing.length > 0) {
             process.stderr.write(
               JSON.stringify({
@@ -51630,7 +51720,7 @@ var init_backup = __esm({
           for (const dbEntry of manifest.databases) {
             const src = path2.join(stagingDir, dbEntry.filename);
             if (!fs2.existsSync(src)) continue;
-            const dst = resolveDbTarget(projectRoot, dbEntry.name, getCleoHome7());
+            const dst = resolveDbTarget(projectRoot, dbEntry.name, getCleoHome8());
             fs2.mkdirSync(path2.dirname(dst), { recursive: true });
             const tmpDst = `${dst}.import-tmp-${Date.now()}`;
             fs2.copyFileSync(src, tmpDst);
@@ -51673,7 +51763,7 @@ var init_backup = __esm({
             reports: jsonReports,
             bundlePath,
             sourceMachineFingerprint: manifest.backup.machineFingerprint,
-            targetMachineFingerprint: sha256OfMachineKey(getCleoHome7()),
+            targetMachineFingerprint: sha256OfMachineKey(getCleoHome8()),
             cleoVersion,
             schemaWarnings: warnings.map((w) => ({
               db: w.db,
@@ -53509,7 +53599,7 @@ var init_check3 = __esm({
       async run({ args }) {
         const { spawnSync: spawnSync2 } = await import("node:child_process");
         const { existsSync: existsSync24 } = await import("node:fs");
-        const { join: join40, resolve: resolve13 } = await import("node:path");
+        const { join: join41, resolve: resolve13 } = await import("node:path");
         const strict = Boolean(args.strict);
         const jsonOnly = Boolean(args.json);
         const repoRoot = resolve13(process.cwd());
@@ -53701,7 +53791,7 @@ var init_check3 = __esm({
         const results = [];
         let anyFailed = false;
         for (const gate of gates) {
-          const scriptPath = join40(repoRoot, gate.script);
+          const scriptPath = join41(repoRoot, gate.script);
           if (!existsSync24(scriptPath)) {
             results.push({
               id: gate.id,
@@ -54153,9 +54243,9 @@ var init_code = __esm({
           async run({ args }) {
             await requireTreeSitter();
             const { smartOutline } = await import("@cleocode/core/internal");
-            const { join: join40 } = await import("node:path");
+            const { join: join41 } = await import("node:path");
             const root = process.cwd();
-            const absPath = args.file.startsWith("/") ? args.file : join40(root, args.file);
+            const absPath = args.file.startsWith("/") ? args.file : join41(root, args.file);
             const result = smartOutline(absPath, root);
             if (result.errors.length > 0 && result.symbols.length === 0) {
               cliError(result.errors.join(", "), 1, { name: "E_OUTLINE_FAILED" });
@@ -54246,9 +54336,9 @@ var init_code = __esm({
           async run({ args }) {
             await requireTreeSitter();
             const { smartUnfold } = await import("@cleocode/core/internal");
-            const { join: join40 } = await import("node:path");
+            const { join: join41 } = await import("node:path");
             const root = process.cwd();
-            const absPath = args.file.startsWith("/") ? args.file : join40(root, args.file);
+            const absPath = args.file.startsWith("/") ? args.file : join41(root, args.file);
             const result = smartUnfold(absPath, args.symbol, root);
             if (!result.found) {
               const errs = result.errors.length > 0 ? `: ${result.errors.join(", ")}` : "";
@@ -61277,12 +61367,74 @@ var init_doctor_acceptance_drift = __esm({
   }
 });
 
+// packages/cleo/src/cli/commands/doctor-credentials.ts
+var doctor_credentials_exports = {};
+__export(doctor_credentials_exports, {
+  doctorCredentialsCommand: () => doctorCredentialsCommand
+});
+import { join as join23 } from "node:path";
+import { getCleoHome as getCleoHome5, getProjectRoot as getProjectRoot42 } from "@cleocode/core/paths.js";
+import {
+  auditAgentRegistryKeys,
+  migrateProjectCredentialsAtRoot
+} from "@cleocode/core/store/credential-transfer.js";
+var doctorCredentialsCommand;
+var init_doctor_credentials = __esm({
+  "packages/cleo/src/cli/commands/doctor-credentials.ts"() {
+    "use strict";
+    init_define_cli_command();
+    init_renderers();
+    doctorCredentialsCommand = defineCommand({
+      meta: {
+        name: "credentials",
+        description: "Report project credentials still encrypted under the legacy path-bound key (moving the project would strand them) and agent registry keys that are not recoverable. --fix re-keys project credentials to the project's identity in place and flags unrecoverable agent keys requires_reauth. Idempotent; never deletes. Unrecoverable credentials are listed with their re-entry command."
+      },
+      args: {
+        fix: {
+          type: "boolean",
+          description: "Re-key path-bound credentials in place (default: report only)."
+        },
+        json: { type: "boolean", description: "Output as JSON" },
+        human: { type: "boolean", description: "Force human-readable output" },
+        quiet: { type: "boolean", description: "Suppress non-essential output" }
+      },
+      async run({ args }) {
+        const dryRun = args.fix !== true;
+        const result = await migrateProjectCredentialsAtRoot(getProjectRoot42(), { dryRun });
+        const agents = await auditAgentRegistryKeys(join23(getCleoHome5(), "cleo.db"), { dryRun });
+        cliOutput(
+          {
+            projectDbPath: result.projectDbPath,
+            projectId: result.projectId,
+            applied: !result.dryRun,
+            [result.dryRun ? "wouldMigrate" : "migrated"]: result.migrated,
+            current: result.current,
+            requiresReentry: result.reentry,
+            agentRegistry: {
+              globalDbPath: agents.globalDbPath,
+              current: agents.current,
+              requiresReentry: agents.reentry,
+              flaggedRequiresReauth: agents.flagged
+            }
+          },
+          { command: "doctor", operation: "doctor.credentials.run" }
+        );
+        const pending = result.dryRun && result.migrated.length > 0;
+        const unrecoverable = result.reentry.length + agents.reentry.length;
+        if ((pending || unrecoverable > 0) && (process.exitCode ?? 0) === 0) {
+          process.exitCode = 1;
+        }
+      }
+    });
+  }
+});
+
 // packages/cleo/src/cli/commands/doctor-db-substrate.ts
 var doctor_db_substrate_exports = {};
 __export(doctor_db_substrate_exports, {
   doctorDbSubstrateCommand: () => doctorDbSubstrateCommand
 });
-import { getProjectRoot as getProjectRoot42, pushWarning as pushWarning4 } from "@cleocode/core";
+import { getProjectRoot as getProjectRoot43, pushWarning as pushWarning4 } from "@cleocode/core";
 import { surveyDbSubstrate, surveyFleetDbSubstrate } from "@cleocode/core/doctor/db-substrate.js";
 function pushSubstrateWarnings(result) {
   for (const warning of result.warnings) {
@@ -61415,7 +61567,7 @@ var init_doctor_db_substrate = __esm({
         const result = isFleet ? surveyFleetDbSubstrate(
           typeof args["fleet-root"] === "string" && args["fleet-root"].length > 0 ? args["fleet-root"] : DEFAULT_FLEET_ROOT,
           options
-        ) : surveyDbSubstrate(getProjectRoot42(), options);
+        ) : surveyDbSubstrate(getProjectRoot43(), options);
         pushSubstrateWarnings(result);
         pushPerDbWarnings(result);
         cliOutput(result, {
@@ -61679,7 +61831,7 @@ var doctor_legacy_backups_exports = {};
 __export(doctor_legacy_backups_exports, {
   doctorLegacyBackupsCommand: () => doctorLegacyBackupsCommand
 });
-import { getProjectRoot as getProjectRoot43 } from "@cleocode/core";
+import { getProjectRoot as getProjectRoot44 } from "@cleocode/core";
 import { pruneLegacyBackups, scanLegacyBackups } from "@cleocode/core/doctor/legacy-backups.js";
 function parsePositiveInt(raw, fallback) {
   if (raw === void 0 || raw === null) return fallback;
@@ -61723,7 +61875,7 @@ var init_doctor_legacy_backups = __esm({
       async run({ args }) {
         const softRetentionDays = parsePositiveInt(args["soft-retention-days"], 30);
         const hardRetentionDays = parsePositiveInt(args["hard-retention-days"], 90);
-        const projectRoot = getProjectRoot43();
+        const projectRoot = getProjectRoot44();
         let result;
         if (args.prune === true) {
           const dryRun = args["dry-run"] !== false;
@@ -61789,7 +61941,7 @@ var doctor_malformed_ids_exports = {};
 __export(doctor_malformed_ids_exports, {
   doctorMalformedIdsCommand: () => doctorMalformedIdsCommand
 });
-import { getProjectRoot as getProjectRoot44 } from "@cleocode/core";
+import { getProjectRoot as getProjectRoot45 } from "@cleocode/core";
 import { scanMalformedTaskIds } from "@cleocode/core/doctor/malformed-task-ids.js";
 var doctorMalformedIdsCommand;
 var init_doctor_malformed_ids = __esm({
@@ -61812,7 +61964,7 @@ var init_doctor_malformed_ids = __esm({
         quiet: { type: "boolean", description: "Suppress non-essential output" }
       },
       async run({ args }) {
-        const report = await scanMalformedTaskIds(getProjectRoot44(), { fix: args.fix === true });
+        const report = await scanMalformedTaskIds(getProjectRoot45(), { fix: args.fix === true });
         cliOutput(report, {
           command: "doctor",
           operation: "doctor.malformed-ids.run"
@@ -61895,7 +62047,7 @@ var doctor_nexus_residency_exports = {};
 __export(doctor_nexus_residency_exports, {
   doctorNexusResidencyCommand: () => doctorNexusResidencyCommand
 });
-import { getCleoHome as getCleoHome5, getProjectRoot as getProjectRoot45 } from "@cleocode/core";
+import { getCleoHome as getCleoHome6, getProjectRoot as getProjectRoot46 } from "@cleocode/core";
 import { scanNexusSchemaResidency } from "@cleocode/core/doctor/nexus-schema-residency.js";
 var doctorNexusResidencyCommand;
 var init_doctor_nexus_residency = __esm({
@@ -61914,7 +62066,7 @@ var init_doctor_nexus_residency = __esm({
         quiet: { type: "boolean", description: "Suppress non-essential output" }
       },
       async run() {
-        const result = scanNexusSchemaResidency(getProjectRoot45(), getCleoHome5());
+        const result = scanNexusSchemaResidency(getProjectRoot46(), getCleoHome6());
         cliOutput(result, {
           command: "doctor",
           operation: "doctor.nexus-residency.run"
@@ -61927,6 +62079,52 @@ var init_doctor_nexus_residency = __esm({
   }
 });
 
+// packages/cleo/src/cli/commands/doctor-project-identity.ts
+var doctor_project_identity_exports = {};
+__export(doctor_project_identity_exports, {
+  doctorProjectIdentityCommand: () => doctorProjectIdentityCommand
+});
+import { getProjectRoot as getProjectRoot47 } from "@cleocode/core";
+import {
+  inspectProjectIdentity,
+  resolveProjectIdentity
+} from "@cleocode/core/doctor/project-identity.js";
+var doctorProjectIdentityCommand;
+var init_doctor_project_identity = __esm({
+  "packages/cleo/src/cli/commands/doctor-project-identity.ts"() {
+    "use strict";
+    init_define_cli_command();
+    init_renderers();
+    doctorProjectIdentityCommand = defineCommand({
+      meta: {
+        name: "project-identity",
+        description: "Check .cleo/project-id against project-info.json (missing / conflict / invalid / untracked) and print the exact remedy. --resolve applies it (a conflict is re-keyed to the tracked id through the alias table, losing no registry rows); add --dry-run to see the plan first."
+      },
+      args: {
+        resolve: { type: "boolean", description: "Apply the remedy for the reported state" },
+        "dry-run": { type: "boolean", description: "With --resolve: print the plan, write nothing" },
+        json: { type: "boolean", description: "Output as JSON" },
+        human: { type: "boolean", description: "Force human-readable output" },
+        quiet: { type: "boolean", description: "Suppress non-essential output" }
+      },
+      async run({ args }) {
+        const projectRoot = getProjectRoot47();
+        if (!args.resolve) {
+          const report = inspectProjectIdentity(projectRoot);
+          cliOutput(report, { command: "doctor", operation: "doctor.project-identity.inspect" });
+          if (report.state !== "ok" && (process.exitCode === void 0 || process.exitCode === 0))
+            process.exitCode = 1;
+          return;
+        }
+        const result = await resolveProjectIdentity(projectRoot, { dryRun: !!args["dry-run"] });
+        cliOutput(result, { command: "doctor", operation: "doctor.project-identity.resolve" });
+        if (result.refused && result.before.state !== "ok" && (process.exitCode ?? 0) === 0)
+          process.exitCode = 1;
+      }
+    });
+  }
+});
+
 // packages/cleo/src/cli/commands/doctor-projects.ts
 var doctor_projects_exports = {};
 __export(doctor_projects_exports, {
@@ -62076,7 +62274,7 @@ __export(doctor_release_readiness_exports, {
   doctorReleaseReadinessCommand: () => doctorReleaseReadinessCommand
 });
 import { existsSync as existsSync14 } from "node:fs";
-import { join as join23, resolve as resolve7 } from "node:path";
+import { join as join24, resolve as resolve7 } from "node:path";
 async function runCheck(name, cmd, args, cwd) {
   const { spawnSync: spawnSync2 } = await import("node:child_process");
   const start = Date.now();
@@ -62117,7 +62315,7 @@ var init_doctor_release_readiness = __esm({
         const repoRoot = resolve7(process.cwd());
         const startTotal = Date.now();
         const checks = [];
-        const biomePath = join23(repoRoot, "node_modules", ".bin", "biome");
+        const biomePath = join24(repoRoot, "node_modules", ".bin", "biome");
         const biomeAvailable = existsSync14(biomePath);
         if (biomeAvailable) {
           checks.push(await runCheck("biome-lint", biomePath, ["ci", "."], repoRoot));
@@ -62131,7 +62329,7 @@ var init_doctor_release_readiness = __esm({
             stderr: "biome not found in node_modules/.bin \u2014 skipping"
           });
         }
-        const changesetLintScript = join23(repoRoot, "scripts", "lint-changesets.mjs");
+        const changesetLintScript = join24(repoRoot, "scripts", "lint-changesets.mjs");
         if (existsSync14(changesetLintScript)) {
           checks.push(await runCheck("changeset-lint", "node", [changesetLintScript], repoRoot));
         } else {
@@ -62144,7 +62342,7 @@ var init_doctor_release_readiness = __esm({
             stderr: "scripts/lint-changesets.mjs not found \u2014 skipping"
           });
         }
-        const changelogPath = join23(repoRoot, "CHANGELOG.md");
+        const changelogPath = join24(repoRoot, "CHANGELOG.md");
         const changelogExists = existsSync14(changelogPath);
         const changelogCheck = {
           name: "changelog-exists",
@@ -62155,7 +62353,7 @@ var init_doctor_release_readiness = __esm({
           stderr: changelogExists ? "" : `CHANGELOG.md not found at ${changelogPath}`
         };
         checks.push(changelogCheck);
-        const packageJsonPath = join23(repoRoot, "package.json");
+        const packageJsonPath = join24(repoRoot, "package.json");
         let oidcCheck;
         if (existsSync14(packageJsonPath)) {
           try {
@@ -62204,7 +62402,7 @@ var init_doctor_release_readiness = __esm({
           };
         }
         checks.push(oidcCheck);
-        const tagWorkflowPath = join23(repoRoot, ".github", "workflows", "auto-tag-on-release-merge.yml");
+        const tagWorkflowPath = join24(repoRoot, ".github", "workflows", "auto-tag-on-release-merge.yml");
         const tagWorkflowExists = existsSync14(tagWorkflowPath);
         let tagTriggerCheck;
         if (tagWorkflowExists) {
@@ -62244,9 +62442,9 @@ var init_doctor_release_readiness = __esm({
           };
         }
         checks.push(tagTriggerCheck);
-        const tsconfigPath = join23(repoRoot, "tsconfig.json");
+        const tsconfigPath = join24(repoRoot, "tsconfig.json");
         if (existsSync14(tsconfigPath)) {
-          const tscPath = join23(repoRoot, "node_modules", ".bin", "tsc");
+          const tscPath = join24(repoRoot, "node_modules", ".bin", "tsc");
           if (existsSync14(tscPath)) {
             checks.push(await runCheck("typecheck", tscPath, ["--noEmit"], repoRoot));
           } else {
@@ -62275,7 +62473,7 @@ var init_doctor_release_readiness = __esm({
           { name: "json-stream-lint", script: "scripts/lint-json-stream-hygiene.mjs" }
         ];
         for (const lint of fastLintScripts) {
-          const scriptPath = join23(repoRoot, lint.script);
+          const scriptPath = join24(repoRoot, lint.script);
           if (existsSync14(scriptPath)) {
             checks.push(await runCheck(lint.name, "node", [scriptPath], repoRoot));
           } else {
@@ -62338,7 +62536,7 @@ var doctor_repair_exports = {};
 __export(doctor_repair_exports, {
   doctorRepairCommand: () => doctorRepairCommand
 });
-import { getLogger as getLogger21, getProjectRoot as getProjectRoot46 } from "@cleocode/core";
+import { getLogger as getLogger21, getProjectRoot as getProjectRoot48 } from "@cleocode/core";
 import { repairMalformedDbs } from "@cleocode/core/store/repair-malformed-dbs.js";
 var doctorRepairCommand;
 var init_doctor_repair = __esm({
@@ -62382,7 +62580,7 @@ var init_doctor_repair = __esm({
           return;
         }
         const result = repairMalformedDbs({
-          projectRoot: getProjectRoot46(),
+          projectRoot: getProjectRoot48(),
           roles: roleArg.length > 0 ? [roleArg] : void 0,
           dryRun,
           logger: getLogger21("doctor-repair")
@@ -62405,13 +62603,92 @@ var init_doctor_repair = __esm({
   }
 });
 
+// packages/cleo/src/cli/commands/doctor-split-brain.ts
+var doctor_split_brain_exports = {};
+__export(doctor_split_brain_exports, {
+  doctorSplitBrainCommand: () => doctorSplitBrainCommand
+});
+import { writeFileSync as writeFileSync4 } from "node:fs";
+import {
+  importSplitBrain,
+  verifyPreexistingRows
+} from "@cleocode/core/store/split-brain-import.js";
+var doctorSplitBrainCommand;
+var init_doctor_split_brain = __esm({
+  "packages/cleo/src/cli/commands/doctor-split-brain.ts"() {
+    "use strict";
+    init_define_cli_command();
+    init_renderers();
+    doctorSplitBrainCommand = defineCommand({
+      meta: {
+        name: "split-brain",
+        description: "Import rows that exist only in a diverged copy of a store (--source) into another (--target) under new task ids, with provenance. Dry-run unless --apply; --verify-before <snapshot> proves no pre-existing target row changed."
+      },
+      args: {
+        source: {
+          type: "string",
+          description: "Store with the extra rows (opened read-only)",
+          required: true
+        },
+        target: { type: "string", description: "Store that receives them", required: true },
+        apply: { type: "boolean", description: "Write the target (default: dry run)" },
+        label: { type: "string", description: "Provenance label for the source (default: its path)" },
+        "diverged-after": {
+          type: "string",
+          description: "Override the detected divergence point (ISO 8601)"
+        },
+        receipt: { type: "string", description: "Also write the receipt JSON to this file" },
+        task: {
+          type: "string",
+          description: "Task that records provenance of imported non-task rows (required with --apply when there are any)"
+        },
+        "verify-before": {
+          type: "string",
+          description: "Pre-import snapshot of the target; verify every one of its rows is unchanged"
+        },
+        json: { type: "boolean", description: "Output as JSON" },
+        human: { type: "boolean", description: "Force human-readable output" },
+        quiet: { type: "boolean", description: "Suppress non-essential output" }
+      },
+      async run({ args }) {
+        const report = importSplitBrain({
+          sourcePath: String(args.source),
+          targetPath: String(args.target),
+          dryRun: !args.apply,
+          sourceLabel: args.label ? String(args.label) : void 0,
+          divergedAfter: args["diverged-after"] ? String(args["diverged-after"]) : void 0,
+          provenanceTaskId: args.task ? String(args.task) : void 0
+        });
+        const verification = args["verify-before"] ? verifyPreexistingRows(String(args["verify-before"]), String(args.target)) : void 0;
+        const changed = verification?.filter((check) => check.missingOrChanged > 0) ?? [];
+        const result = {
+          ...report,
+          ...verification && {
+            verification: {
+              tablesChecked: verification.length,
+              rowsBefore: verification.reduce((sum, check) => sum + check.before, 0),
+              rowsAfter: verification.reduce((sum, check) => sum + check.after, 0),
+              missingOrChanged: changed
+            }
+          }
+        };
+        if (args.receipt) writeFileSync4(String(args.receipt), `${JSON.stringify(result, null, 2)}
+`);
+        cliOutput(result, { command: "doctor", operation: "doctor.split-brain.run" });
+        if (changed.length > 0 && (process.exitCode ?? 0) === 0) process.exitCode = 1;
+      }
+    });
+  }
+});
+
 // packages/cleo/src/cli/commands/doctor-superseded-store.ts
 var doctor_superseded_store_exports = {};
 __export(doctor_superseded_store_exports, {
   doctorSupersededStoreCommand: () => doctorSupersededStoreCommand
 });
-import { getProjectRoot as getProjectRoot47 } from "@cleocode/core";
+import { getProjectRoot as getProjectRoot49 } from "@cleocode/core";
 import { scanSupersededStores } from "@cleocode/core/doctor/superseded-store.js";
+import { reconcileSupersededStores } from "@cleocode/core/store/exodus/index.js";
 var doctorSupersededStoreCommand;
 var init_doctor_superseded_store = __esm({
   "packages/cleo/src/cli/commands/doctor-superseded-store.ts"() {
@@ -62424,12 +62701,47 @@ var init_doctor_superseded_store = __esm({
         description: "Report pre-dual-scope store files (.cleo/tasks.db, .cleo/brain.db) still on disk under their old LIVE names after the cleo.db migration, proving which store holds the data. Read-only \u2014 deletes nothing."
       },
       args: {
+        reconcile: {
+          type: "boolean",
+          description: "Copy rows the superseded files hold that are missing from cleo.db (additive, verified, reverted on mismatch; legacy files are never touched). Writes a receipt."
+        },
+        additive: {
+          type: "boolean",
+          description: "With --reconcile, for a project already running on cleo.db: copy only history rows whose keys are absent from live, never write the live task graph, and list every row left uncopied as a conflict in the receipt"
+        },
+        "dry-run": {
+          type: "boolean",
+          description: "With --reconcile: report per-table counts and what would be copied; write nothing"
+        },
         json: { type: "boolean", description: "Output as JSON" },
         human: { type: "boolean", description: "Force human-readable output" },
         quiet: { type: "boolean", description: "Suppress non-essential output" }
       },
-      async run() {
-        const result = scanSupersededStores(getProjectRoot47());
+      async run({ args }) {
+        if (args.reconcile === true) {
+          const receipt = await reconcileSupersededStores(getProjectRoot49(), {
+            dryRun: args["dry-run"] === true,
+            additive: args.additive === true
+          });
+          if (receipt.outcome === "refused") {
+            cliError(receipt.reason, "E_RECONCILE_REFUSED", {
+              details: receipt,
+              fix: `Inspect ${receipt.receiptPath ?? "the receipt"}; the legacy files are unchanged, so it is safe to retry after fixing the cause.`
+            });
+            process.exitCode = 1;
+            return;
+          }
+          cliOutput(
+            { kind: "generic", ...receipt },
+            {
+              command: "doctor",
+              operation: "doctor.superseded-store.reconcile",
+              message: receipt.reason
+            }
+          );
+          return;
+        }
+        const result = scanSupersededStores(getProjectRoot49());
         cliOutput(result, {
           command: "doctor",
           operation: "doctor.superseded-store.run"
@@ -62654,7 +62966,7 @@ import {
   resumePreparedKnowledgeRepair,
   runKnowledgeDoctor as runKnowledgeDoctor2
 } from "@cleocode/core/doctor/knowledge.js";
-import { getProjectRoot as getProjectRoot48 } from "@cleocode/core/paths.js";
+import { getProjectRoot as getProjectRoot50 } from "@cleocode/core/paths.js";
 var doctorKnowledgeSubcommand;
 var init_doctor_knowledge = __esm({
   "packages/cleo/src/cli/commands/doctor-knowledge.ts"() {
@@ -62729,7 +63041,7 @@ var init_doctor_knowledge = __esm({
       },
       async run({ args }) {
         const startedAt = Date.now();
-        const root = getProjectRoot48();
+        const root = getProjectRoot50();
         let context;
         let pending;
         try {
@@ -62893,11 +63205,11 @@ __export(migrate_agents_v2_exports, {
 });
 import { createHash as createHash2 } from "node:crypto";
 import { appendFileSync as appendFileSync2, existsSync as existsSync15, mkdirSync as mkdirSync3, readdirSync as readdirSync2, readFileSync as readFileSync12 } from "node:fs";
-import { join as join24 } from "node:path";
+import { join as join25 } from "node:path";
 import {
   ensureGlobalAgentRegistryDb,
   getGlobalAgentRegistryNativeDb,
-  getProjectRoot as getProjectRoot49,
+  getProjectRoot as getProjectRoot51,
   installAgentFromCant
 } from "@cleocode/core/internal";
 function sha256Hex(bytes) {
@@ -62917,8 +63229,8 @@ function extractAgentName(source) {
   return headerMatch[1] ?? null;
 }
 function appendAuditLog(projectRoot, entry) {
-  const auditPath = join24(projectRoot, AUDIT_LOG_RELATIVE);
-  const auditDir = join24(auditPath, "..");
+  const auditPath = join25(projectRoot, AUDIT_LOG_RELATIVE);
+  const auditDir = join25(auditPath, "..");
   if (!existsSync15(auditDir)) {
     mkdirSync3(auditDir, { recursive: true });
   }
@@ -62936,7 +63248,7 @@ function walkAgentsDir(db, scanDir, projectRoot, summary, verbose) {
     return;
   }
   for (const filename of files) {
-    const cantPath = join24(scanDir, filename);
+    const cantPath = join25(scanDir, filename);
     const relPath = cantPath.replace(`${projectRoot}/`, "");
     let sourceBytes;
     let sourceText;
@@ -63033,9 +63345,9 @@ async function runMigrateAgentsV2(projectRoot, verbose = true) {
   await ensureGlobalAgentRegistryDb();
   const db = getGlobalAgentRegistryNativeDb();
   try {
-    const canonicalDir = join24(projectRoot, ".cleo", "cant", "agents");
+    const canonicalDir = join25(projectRoot, ".cleo", "cant", "agents");
     walkAgentsDir(db, canonicalDir, projectRoot, summary, verbose);
-    const legacyDir = join24(projectRoot, ".cleo", "agents");
+    const legacyDir = join25(projectRoot, ".cleo", "agents");
     walkAgentsDir(db, legacyDir, projectRoot, summary, verbose);
   } finally {
     db.close();
@@ -63043,7 +63355,7 @@ async function runMigrateAgentsV2(projectRoot, verbose = true) {
   return summary;
 }
 function readMigrationConflicts(projectRoot) {
-  const auditPath = join24(projectRoot, AUDIT_LOG_RELATIVE);
+  const auditPath = join25(projectRoot, AUDIT_LOG_RELATIVE);
   if (!existsSync15(auditPath)) return [];
   let raw;
   try {
@@ -63085,7 +63397,7 @@ var init_migrate_agents_v2 = __esm({
         }
       },
       async run({ args }) {
-        const projectRoot = getProjectRoot49();
+        const projectRoot = getProjectRoot51();
         const verbose = args.quiet !== true;
         if (verbose) {
           humanInfo("Scanning .cleo/cant/agents/ and .cleo/agents/ for unregistered agents...");
@@ -63127,9 +63439,9 @@ var doctor_exports = {};
 __export(doctor_exports, {
   doctorCommand: () => doctorCommand2
 });
-import { mkdirSync as mkdirSync4, writeFileSync as writeFileSync4 } from "node:fs";
-import { join as join25 } from "node:path";
-import { getProjectRoot as getProjectRoot50, pushWarning as pushWarning5 } from "@cleocode/core";
+import { mkdirSync as mkdirSync4, writeFileSync as writeFileSync5 } from "node:fs";
+import { join as join26 } from "node:path";
+import { getProjectRoot as getProjectRoot52, pushWarning as pushWarning5 } from "@cleocode/core";
 import { renderInvariantAuditLines } from "@cleocode/core/doctor/invariant-audit-render.js";
 import {
   quarantineRogueCleoDir,
@@ -63168,16 +63480,16 @@ async function scanTestFixturesInProd(projectRoot) {
 }
 async function quarantineTestFixtures(projectRoot, matches) {
   if (matches.length === 0) return 0;
-  const cleoDir = join25(projectRoot, ".cleo");
-  const quarantineDir = join25(
+  const cleoDir = join26(projectRoot, ".cleo");
+  const quarantineDir = join26(
     cleoDir,
     "quarantine",
     `fixture-scan-${(/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-")}`
   );
   mkdirSync4(quarantineDir, { recursive: true });
   const manifest = matches.map((m) => ({ ...m, quarantinedAt: (/* @__PURE__ */ new Date()).toISOString() }));
-  writeFileSync4(
-    join25(quarantineDir, "manifest.jsonl"),
+  writeFileSync5(
+    join26(quarantineDir, "manifest.jsonl"),
     manifest.map((m) => JSON.stringify(m)).join("\n") + "\n"
   );
   const { getNativeDb } = await import("@cleocode/core/store/sqlite.js");
@@ -63246,6 +63558,7 @@ var init_doctor = __esm({
     init_progress();
     init_renderers();
     init_doctor_acceptance_drift();
+    init_doctor_credentials();
     init_doctor_db_substrate();
     init_doctor_exodus();
     init_doctor_exodus_residue();
@@ -63256,9 +63569,11 @@ var init_doctor = __esm({
     init_doctor_malformed_ids();
     init_doctor_memory_guard();
     init_doctor_nexus_residency();
+    init_doctor_project_identity();
     init_doctor_projects();
     init_doctor_release_readiness();
     init_doctor_repair();
+    init_doctor_split_brain();
     init_doctor_superseded_store();
     init_doctor_tool_locks();
     init_migrate_agents_v2();
@@ -63285,12 +63600,18 @@ var init_doctor = __esm({
         "superseded-store": doctorSupersededStoreCommand,
         // T12097 — machine-wide guard for test runs started OUTSIDE cleo verify
         "memory-guard": doctorMemoryGuardCommand,
+        // T12353 — tracked .cleo/project-id vs project-info.json (+ --resolve re-key)
+        "project-identity": doctorProjectIdentityCommand,
+        // T12329 — import rows only a diverged store copy has, under new ids (dry-run first)
+        "split-brain": doctorSplitBrainCommand,
         // T12157 — the two acceptance stores (json column vs text+child rows) must agree
         "acceptance-drift": doctorAcceptanceDriftCommand,
         // T12158 — tables nexus resolves by bare name must actually live where it assumes
         "nexus-residency": doctorNexusResidencyCommand,
         // T12113 (gh#1222) — evidence-tool semaphore holders + orphan reaping
         "tool-locks": doctorToolLocksCommand,
+        // T12326 — project credentials still keyed by project PATH (+ --fix re-keys)
+        credentials: doctorCredentialsCommand,
         // T11777 / Saga T11242 / Epic T11249 — exodus stranded-residue check (+ --fix)
         "exodus-residue": doctorExodusResidueCommand,
         // T11837 / Saga T11242 / Epic T11833 — read-only exodus health report
@@ -63503,7 +63824,7 @@ var init_doctor = __esm({
             const { join: pathJoin } = await import("node:path");
             const { existsSync: existsSync24 } = await import("node:fs");
             const { detectAndHealCoreWorktreeLeak } = await import("@cleocode/worktree");
-            const projectRoot = getProjectRoot50();
+            const projectRoot = getProjectRoot52();
             let gitRoot = projectRoot;
             try {
               gitRoot = execFile2("git", ["rev-parse", "--show-toplevel"], {
@@ -63555,7 +63876,7 @@ var init_doctor = __esm({
           }
           if (args.brain) {
             const { computeBrainHealthDashboard } = await import("@cleocode/core/memory/brain-health-dashboard.js");
-            const projectRoot = getProjectRoot50();
+            const projectRoot = getProjectRoot52();
             const dashboard = await computeBrainHealthDashboard(projectRoot);
             cliOutput(dashboard, { command: "doctor", operation: "doctor.brain" });
             if (dashboard.hasP0Failure) {
@@ -63564,7 +63885,7 @@ var init_doctor = __esm({
             return;
           }
           if (args["scan-test-fixtures-in-prod"]) {
-            const projectRoot = getProjectRoot50();
+            const projectRoot = getProjectRoot52();
             const matches = await scanTestFixturesInProd(projectRoot);
             const dryRun = args["dry-run"] !== false && args.quarantine !== true;
             const quarantined = !dryRun && matches.length > 0 ? await quarantineTestFixtures(projectRoot, matches) : void 0;
@@ -63652,7 +63973,7 @@ var init_doctor = __esm({
             progress.complete("Comprehensive diagnostics complete");
           } else if (args["scan-rogue-cleo-dirs"]) {
             progress.step(0, "Scanning for rogue .cleo/ directories");
-            const projectRoot = getProjectRoot50();
+            const projectRoot = getProjectRoot52();
             const reports = scanRogueCleoDirs(projectRoot);
             progress.complete(
               `Found ${reports.length} rogue .cleo/ director${reports.length === 1 ? "y" : "ies"}`
@@ -63661,7 +63982,7 @@ var init_doctor = __esm({
           } else if (args["quarantine-rogue-cleo-dirs"]) {
             const isDryRun = args["dry-run"] === true;
             progress.step(0, `${isDryRun ? "[DRY RUN] " : ""}Scanning for rogue .cleo/ directories`);
-            const projectRoot = getProjectRoot50();
+            const projectRoot = getProjectRoot52();
             const reports = scanRogueCleoDirs(projectRoot);
             if (reports.length === 0) {
               progress.complete("No rogue .cleo/ directories found \u2014 nothing to quarantine");
@@ -63713,9 +64034,9 @@ var init_doctor = __esm({
           } else if (args["scan-stray-nexus-dbs"]) {
             progress.step(0, "Scanning for stray nexus.db files");
             const { detectAndRemoveLegacyGlobalFiles, detectAndRemoveStrayProjectNexus } = await import("@cleocode/core/store/cleanup-legacy.js");
-            const { getCleoHome: getCleoHome7 } = await import("@cleocode/core");
-            const cleoHome = getCleoHome7();
-            const projectRoot = getProjectRoot50();
+            const { getCleoHome: getCleoHome8 } = await import("@cleocode/core");
+            const cleoHome = getCleoHome8();
+            const projectRoot = getProjectRoot52();
             const legacyResult = detectAndRemoveLegacyGlobalFiles(cleoHome);
             const strayResult = detectAndRemoveStrayProjectNexus(projectRoot);
             const isDryRun = args["dry-run"] === true;
@@ -63748,7 +64069,7 @@ var init_doctor = __esm({
           } else if (args["audit-worktree-orphans"]) {
             progress.step(0, "Comprehensive worktree anomaly audit (T9808 / council D009)");
             const { auditWorktreeOrphansComprehensive, scanWorktreeOrphansBudgeted } = await import("@cleocode/core/doctor/worktree-orphans.js");
-            const projectRoot = getProjectRoot50();
+            const projectRoot = getProjectRoot52();
             const timeoutSecs = args["timeout"] !== void 0 ? Number.parseInt(String(args["timeout"]), 10) : 30;
             const timeoutMs = Number.isFinite(timeoutSecs) && timeoutSecs > 0 ? timeoutSecs * 1e3 : 3e4;
             const maxEntriesPerLevel = args["max-entries-per-level"] !== void 0 ? Number.parseInt(String(args["max-entries-per-level"]), 10) : 500;
@@ -63805,7 +64126,7 @@ var init_doctor = __esm({
               `${isDryRun ? "[DRY RUN] " : ""}Scanning + pruning worktree-orphan .cleo/ directories`
             );
             const { pruneWorktreeOrphans, scanWorktreeOrphansBudgeted } = await import("@cleocode/core/doctor/worktree-orphans.js");
-            const projectRoot = getProjectRoot50();
+            const projectRoot = getProjectRoot52();
             const timeoutSecs = args["timeout"] !== void 0 ? Number.parseInt(String(args["timeout"]), 10) : 30;
             const timeoutMs = Number.isFinite(timeoutSecs) && timeoutSecs > 0 ? timeoutSecs * 1e3 : 3e4;
             const maxEntriesPerLevel = args["max-entries-per-level"] !== void 0 ? Number.parseInt(String(args["max-entries-per-level"]), 10) : 500;
@@ -63853,8 +64174,8 @@ var init_doctor = __esm({
               );
               return;
             }
-            const archiveDir = join25(projectRoot, ".cleo", "backups");
-            const auditLogPath = join25(projectRoot, ".cleo", "audit", "worktree-prune.jsonl");
+            const archiveDir = join26(projectRoot, ".cleo", "backups");
+            const auditLogPath = join26(projectRoot, ".cleo", "audit", "worktree-prune.jsonl");
             const result = await pruneWorktreeOrphans(orphans, {
               archiveDir,
               auditLogPath,
@@ -63884,7 +64205,7 @@ var init_doctor = __esm({
               `${isDryRun ? "[DRY RUN] " : ""}Migrating .cleo/worktree-include \u2192 .worktreeinclude`
             );
             const { migrateWorktreeIncludeFile } = await import("@cleocode/core");
-            const projectRoot = getProjectRoot50();
+            const projectRoot = getProjectRoot52();
             const result = await migrateWorktreeIncludeFile(projectRoot, { dryRun: isDryRun });
             progress.complete(`Migration ${result.action}`);
             cliOutput(result, { command: "doctor", operation: "doctor.migrate-worktree-include" });
@@ -63903,7 +64224,7 @@ var init_doctor = __esm({
             const stepLabel = isFocusedAlias ? "Auditing Saga hierarchy for ADR-073 invariants" : "Walking central INVARIANTS_REGISTRY";
             progress.step(0, stepLabel);
             const { auditInvariantRegistry } = await import("@cleocode/core/doctor/invariant-audit.js");
-            const projectRoot = getProjectRoot50();
+            const projectRoot = getProjectRoot52();
             const result = await auditInvariantRegistry(projectRoot, { adrFilter });
             const operation = isFocusedAlias ? "doctor.audit-sagas" : "doctor.audit-invariants";
             const summary = `Invariant audit complete \u2014 ${result.totalCount} entries walked, ${result.errorCount} error / ${result.warningCount} warning / ${result.infoCount} info violation(s), ${result.notApplicableCount} not-applicable, ${result.documentedCount} documented`;
@@ -63925,7 +64246,7 @@ var init_doctor = __esm({
               { command: "doctor", operation: "admin.health" }
             );
             try {
-              const projectRoot = getProjectRoot50();
+              const projectRoot = getProjectRoot52();
               const conflicts = readMigrationConflicts(projectRoot);
               if (conflicts.length > 0) {
                 progress.complete(
@@ -63956,7 +64277,7 @@ var init_doctor = __esm({
               progress.complete("Health check complete");
             }
             try {
-              const projectRoot = getProjectRoot50();
+              const projectRoot = getProjectRoot52();
               const { auditSagaHierarchy } = await import("@cleocode/core/doctor/saga-audit.js");
               const sagaAudit = await auditSagaHierarchy(projectRoot);
               if (sagaAudit.sagas.length === 0) {
@@ -64018,7 +64339,7 @@ __export(event_exports, {
   orchestratorCommand: () => orchestratorCommand
 });
 import { readdir as readdir2 } from "node:fs/promises";
-import { join as join26 } from "node:path";
+import { join as join27 } from "node:path";
 import { cwd as processCwd } from "node:process";
 import { appendEvent } from "@cleocode/core/events/event-bus.js";
 function resolveProjectRoot2(arg) {
@@ -64141,7 +64462,7 @@ var init_event = __esm({
         const agentIdFilter = args.agent;
         const showAll = args.all === true;
         const lines = parseInt(args.lines ?? "20", 10);
-        const eventsDir = join26(projectRoot, ".cleo", "agent-events");
+        const eventsDir = join27(projectRoot, ".cleo", "agent-events");
         try {
           let files = [];
           try {
@@ -64179,7 +64500,7 @@ var init_event = __esm({
           for (const file of filesToTail) {
             const agentId = file.replace(".jsonl", "");
             const { readFileSync: readFileSync23 } = await import("node:fs");
-            const content = readFileSync23(join26(eventsDir, file), "utf-8");
+            const content = readFileSync23(join27(eventsDir, file), "utf-8");
             const eventLines = content.trim().split("\n").filter(Boolean);
             const tail = eventLines.slice(-lines);
             if (jsonMode) {
@@ -64249,7 +64570,7 @@ var init_event = __esm({
         const epicFilter = args.epic;
         const follow = args.follow === true;
         const lines = parseInt(args.lines ?? "50", 10);
-        const eventsDir = join26(projectRoot, ".cleo", "agent-events");
+        const eventsDir = join27(projectRoot, ".cleo", "agent-events");
         let files = [];
         try {
           const entries = await readdir2(eventsDir);
@@ -64275,7 +64596,7 @@ var init_event = __esm({
           const agentId = file.replace(".jsonl", "");
           try {
             const { readFileSync: readFileSync23 } = await import("node:fs");
-            const content = readFileSync23(join26(eventsDir, file), "utf-8");
+            const content = readFileSync23(join27(eventsDir, file), "utf-8");
             const eventLines = content.trim().split("\n").filter(Boolean);
             const tail = eventLines.slice(-lines);
             if (jsonMode) {
@@ -65270,7 +65591,7 @@ __export(gateway_exports, {
   gatewayOpenapiSubCommand: () => gatewayOpenapiSubCommand
 });
 import { resolve as resolve8 } from "node:path";
-import { generateOpenApi, getProjectRoot as getProjectRoot51 } from "@cleocode/core";
+import { generateOpenApi, getProjectRoot as getProjectRoot53 } from "@cleocode/core";
 var gatewayOpenapiSubCommand, gatewayCommand;
 var init_gateway = __esm({
   "packages/cleo/src/cli/commands/gateway.ts"() {
@@ -65301,9 +65622,9 @@ var init_gateway = __esm({
 `;
         const pathCount = Object.keys(doc.paths).length;
         if (typeof args.out === "string" && args.out.length > 0) {
-          const { writeFileSync: writeFileSync7 } = await import("node:fs");
-          const target = resolve8(getProjectRoot51(), args.out);
-          writeFileSync7(target, json2, "utf8");
+          const { writeFileSync: writeFileSync8 } = await import("node:fs");
+          const target = resolve8(getProjectRoot53(), args.out);
+          writeFileSync8(target, json2, "utf8");
           cliOutput(
             { out: target, pathCount, version: doc.info.version, openapi: doc.openapi },
             { command: "gateway", operation: "gateway.openapi" }
@@ -65383,7 +65704,7 @@ __export(gc_exports, {
   gcCommand: () => gcCommand
 });
 import { homedir as homedir4, tmpdir } from "node:os";
-import { join as join27 } from "node:path";
+import { join as join28 } from "node:path";
 import { pruneOrphanTempDirs, pruneOrphanWorktrees } from "@cleocode/core/gc/cleanup.js";
 import { runGC } from "@cleocode/core/gc/runner.js";
 import { readGCState } from "@cleocode/core/gc/state.js";
@@ -65460,7 +65781,7 @@ var init_gc = __esm({
       },
       async run({ args }) {
         const cleoDir = resolveLegacyCleoDir3(args["cleo-dir"]);
-        const statePath = join27(cleoDir, "gc-state.json");
+        const statePath = join28(cleoDir, "gc-state.json");
         try {
           const state = await readGCState(statePath);
           const diskStr = state.lastDiskUsedPct !== null ? `${state.lastDiskUsedPct.toFixed(1)}%` : "unknown";
@@ -65513,8 +65834,8 @@ var init_gc = __esm({
         }
       },
       async run({ args }) {
-        const xdgData = process.env["XDG_DATA_HOME"] ?? join27(homedir4(), ".local", "share");
-        const worktreesRoot = args["worktrees-root"] ?? join27(xdgData, "cleo", "worktrees");
+        const xdgData = process.env["XDG_DATA_HOME"] ?? join28(homedir4(), ".local", "share");
+        const worktreesRoot = args["worktrees-root"] ?? join28(xdgData, "cleo", "worktrees");
         const projectHash = args["project-hash"];
         const dryRun = args["dry-run"];
         const preserveRaw = args["preserve-tasks"];
@@ -65762,7 +66083,7 @@ var go_exports = {};
 __export(go_exports, {
   goCommand: () => goCommand
 });
-import { getProjectRoot as getProjectRoot52, go } from "@cleocode/core";
+import { getProjectRoot as getProjectRoot54, go } from "@cleocode/core";
 var goCommand;
 var init_go = __esm({
   "packages/cleo/src/cli/commands/go.ts"() {
@@ -65788,7 +66109,7 @@ var init_go = __esm({
         }
       },
       async run({ args }) {
-        const projectRoot = getProjectRoot52();
+        const projectRoot = getProjectRoot54();
         const { getCurrentSessionId, getActiveSession } = await import("@cleocode/core/internal");
         let sessionId = getCurrentSessionId(projectRoot) ?? void 0;
         if (sessionId === void 0) {
@@ -65817,7 +66138,7 @@ var goal_exports = {};
 __export(goal_exports, {
   goalCommand: () => goalCommand
 });
-import { getProjectRoot as getProjectRoot53, goal } from "@cleocode/core";
+import { getProjectRoot as getProjectRoot55, goal } from "@cleocode/core";
 function resolveGoalKind(task) {
   if (typeof task === "string" && task.length > 0) {
     if (!isValidGoalTargetTaskId(task)) {
@@ -65864,7 +66185,7 @@ var init_goal2 = __esm({
         }
         const record = await goal.createGoal(
           { goalKind: kindResult.kind, intent, turnBudget: resolveTurnBudget(args.turns) },
-          getProjectRoot53()
+          getProjectRoot55()
         );
         cliOutput(record, { command: "goal set", operation: "goal.set" });
       }
@@ -65875,7 +66196,7 @@ var init_goal2 = __esm({
         description: "Show the current agent's active goal (per-agent scoped)."
       },
       async run() {
-        const record = await goal.getActiveGoal(getProjectRoot53());
+        const record = await goal.getActiveGoal(getProjectRoot55());
         cliOutput(record ?? { active: null }, { command: "goal status", operation: "goal.status" });
       }
     });
@@ -65897,7 +66218,7 @@ var init_goal2 = __esm({
           });
           return;
         }
-        const cwd = getProjectRoot53();
+        const cwd = getProjectRoot55();
         const parent = await goal.getActiveGoal(cwd);
         if (!parent) {
           cliError(
@@ -65945,7 +66266,7 @@ var init_goal2 = __esm({
           });
           return;
         }
-        const cwd = getProjectRoot53();
+        const cwd = getProjectRoot55();
         const result = await goal.advanceGoalWithPersist(goalId, { cwd });
         if (!result) {
           cliError(`Goal '${goalId}' not found.`, 4 /* NOT_FOUND */, { name: "E_NOT_FOUND" });
@@ -65970,7 +66291,7 @@ var init_goal2 = __esm({
           });
           return;
         }
-        const cwd = getProjectRoot53();
+        const cwd = getProjectRoot55();
         const active = await goal.getActiveGoal(cwd);
         if (!active) {
           cliError(
@@ -66968,7 +67289,7 @@ var hygiene_exports = {};
 __export(hygiene_exports, {
   hygieneCommand: () => hygieneCommand
 });
-import { getProjectRoot as getProjectRoot54 } from "@cleocode/core";
+import { getProjectRoot as getProjectRoot56 } from "@cleocode/core";
 import { runSpawnReadinessHygieneCli } from "@cleocode/core/hygiene/validate-spawn-readiness.js";
 var hygieneCommand;
 var init_hygiene = __esm({
@@ -66997,7 +67318,7 @@ var init_hygiene = __esm({
             }
           },
           async run({ args }) {
-            const projectRoot = args["project-root"] || getProjectRoot54() || process.cwd();
+            const projectRoot = args["project-root"] || getProjectRoot56() || process.cwd();
             const worktreePath = args["worktree-path"];
             await runSpawnReadinessHygieneCli(projectRoot, worktreePath);
           }
@@ -67172,7 +67493,7 @@ __export(init_exports, {
   maybeNudgeFirstRunLogin: () => maybeNudgeFirstRunLogin
 });
 import { existsSync as existsSync17, readFileSync as readFileSync13 } from "node:fs";
-import { join as join28 } from "node:path";
+import { join as join29 } from "node:path";
 import { fileURLToPath as fileURLToPath6 } from "node:url";
 import {
   CleoError as CleoError7,
@@ -67186,9 +67507,9 @@ import { getTemplatesByKind } from "@cleocode/core/templates/registry";
 function getGitignoreTemplate() {
   try {
     const thisFile = fileURLToPath6(import.meta.url);
-    const packageRoot = join28(thisFile, "..", "..", "..", "..");
-    const localTemplatePath = join28(packageRoot, "templates", "cleo-gitignore");
-    const monorepoTemplatePath = join28(packageRoot, "..", "..", "templates", "cleo-gitignore");
+    const packageRoot = join29(thisFile, "..", "..", "..", "..");
+    const localTemplatePath = join29(packageRoot, "templates", "cleo-gitignore");
+    const monorepoTemplatePath = join29(packageRoot, "..", "..", "templates", "cleo-gitignore");
     const templatePath = existsSync17(localTemplatePath) ? localTemplatePath : monorepoTemplatePath;
     if (existsSync17(templatePath)) {
       return readFileSync13(templatePath, "utf-8");
@@ -67296,6 +67617,11 @@ var init_init = __esm({
           type: "boolean",
           description: "With --workflows: print the rendered YAML without writing.",
           default: false
+        },
+        "new-identity": {
+          type: "boolean",
+          description: "Mint a new project identity instead of re-linking a registered one (T12325). Never rewrites an existing .cleo/project-id.",
+          default: false
         }
       },
       async run({ args }) {
@@ -67340,7 +67666,8 @@ var init_init = __esm({
             force: !!args.force,
             detect: !!args.detect,
             mapCodebase: !!args["map-codebase"],
-            installSeedAgents: !!args["install-seed-agents"]
+            installSeedAgents: !!args["install-seed-agents"],
+            newIdentity: !!args["new-identity"]
           };
           const result = await initProject2(initOpts);
           const nextSteps = [...result.nextSteps ?? []];
@@ -68315,7 +68642,7 @@ var llm_cost_exports = {};
 __export(llm_cost_exports, {
   costCommand: () => costCommand
 });
-import { getProjectRoot as getProjectRoot55 } from "@cleocode/core/internal";
+import { getProjectRoot as getProjectRoot57 } from "@cleocode/core/internal";
 import { computeCost } from "@cleocode/core/llm/usage-pricing";
 function resolveSessionId(raw) {
   if (raw === "current") {
@@ -68388,7 +68715,7 @@ var init_llm_cost = __esm({
           process.exit(6);
         }
         const sessionId = resolveSessionId(rawSessionId);
-        const projectRoot = getProjectRoot55(process.cwd());
+        const projectRoot = getProjectRoot57(process.cwd());
         let breakdown;
         try {
           breakdown = await loadSessionCostBreakdown(projectRoot, sessionId);
@@ -69723,7 +70050,7 @@ var memory_exports = {};
 __export(memory_exports, {
   memoryCommand: () => memoryCommand
 });
-import { getProjectRoot as getProjectRoot56 } from "@cleocode/core";
+import { getProjectRoot as getProjectRoot58 } from "@cleocode/core";
 import {
   getBrainDb as getBrainDb2,
   getDreamStatus,
@@ -70681,7 +71008,7 @@ var init_memory3 = __esm({
       },
       args: {},
       async run() {
-        const root = getProjectRoot56();
+        const root = getProjectRoot58();
         try {
           const result = await runConsolidation(root);
           cliOutput(result, { command: "memory-consolidate", operation: "memory.consolidate" });
@@ -70705,7 +71032,7 @@ var init_memory3 = __esm({
         }
       },
       async run({ args }) {
-        const root = getProjectRoot56();
+        const root = getProjectRoot58();
         if (args.status) {
           try {
             const status = await getDreamStatus(root);
@@ -70742,7 +71069,7 @@ var init_memory3 = __esm({
         }
       },
       async run({ args }) {
-        const root = getProjectRoot56();
+        const root = getProjectRoot58();
         try {
           const { runObserver, runReflector } = await import("@cleocode/core/memory");
           const observerResult = await runObserver(root, args.session, {
@@ -70782,7 +71109,7 @@ var init_memory3 = __esm({
         }
       },
       async run({ args }) {
-        const root = getProjectRoot56();
+        const root = getProjectRoot58();
         await getBrainDb2(root);
         const { getBrainNativeDb: getBrainNativeDb3 } = await import("@cleocode/core/internal");
         const nativeDb = getBrainNativeDb3();
@@ -70807,7 +71134,7 @@ var init_memory3 = __esm({
         }
       },
       async run({ args }) {
-        const root = getProjectRoot56();
+        const root = getProjectRoot58();
         try {
           await getBrainDb2(root);
           const { totalDuplicateRows, groups } = await scanDuplicateEntries();
@@ -70853,7 +71180,7 @@ var init_memory3 = __esm({
       async run({ args }) {
         const sourceDir = args.from;
         const isDryRun = !!args["dry-run"];
-        const projectRoot = getProjectRoot56();
+        const projectRoot = getProjectRoot58();
         try {
           const result = await importMemoryFiles({
             sourceDir,
@@ -71004,7 +71331,7 @@ var init_memory3 = __esm({
       },
       args: {},
       async run() {
-        const root = getProjectRoot56();
+        const root = getProjectRoot58();
         try {
           await getBrainDb2(root);
           const result = await getTierStats(root);
@@ -71047,7 +71374,7 @@ var init_memory3 = __esm({
         }
       },
       async run({ args }) {
-        const root = getProjectRoot56();
+        const root = getProjectRoot58();
         const targetTier = args.to;
         const reason = args.reason;
         const validTiers = ["medium", "long"];
@@ -71113,7 +71440,7 @@ var init_memory3 = __esm({
         }
       },
       async run({ args }) {
-        const root = getProjectRoot56();
+        const root = getProjectRoot58();
         const targetTier = args.to;
         const reason = args.reason;
         const validTiers = ["short", "medium"];
@@ -71584,7 +71911,7 @@ var migrate_claude_mem_exports = {};
 __export(migrate_claude_mem_exports, {
   migrateClaudeMemCommand: () => migrateClaudeMemCommand
 });
-import { getProjectRoot as getProjectRoot57, migrateClaudeMem } from "@cleocode/core/internal";
+import { getProjectRoot as getProjectRoot59, migrateClaudeMem } from "@cleocode/core/internal";
 import { ingestLooseAgentOutputs, ingestRcasdDirectories } from "@cleocode/core/memory";
 import { getDb as getDb2 } from "@cleocode/core/store/sqlite";
 var storageCommand, claudeMemCommand, manifestIngestCommand, migrateClaudeMemCommand;
@@ -71647,7 +71974,7 @@ var init_migrate_claude_mem = __esm({
         }
       },
       async run({ args }) {
-        const root = getProjectRoot57();
+        const root = getProjectRoot59();
         try {
           const result = await migrateClaudeMem(root, {
             sourcePath: args.source,
@@ -71696,7 +72023,7 @@ var init_migrate_claude_mem = __esm({
         }
       },
       async run({ args }) {
-        const projectRoot = getProjectRoot57();
+        const projectRoot = getProjectRoot59();
         try {
           const db = await getDb2(projectRoot);
           const rcasdFlag = Boolean(args.rcasd);
@@ -71815,10 +72142,18 @@ import { statSync as statSync2 } from "node:fs";
 import { appendFile as appendFile2, mkdir as mkdir5 } from "node:fs/promises";
 import { homedir as homedir5 } from "node:os";
 import path4 from "node:path";
-import { getProjectRoot as getProjectRoot58 } from "@cleocode/core";
+import { getProjectRoot as getProjectRoot60 } from "@cleocode/core";
 import { getSymbolImpact } from "@cleocode/core/nexus";
 import { runNexusAnalysis } from "@cleocode/core/nexus/analyze-orchestrator.js";
 import { exportNexusGraph } from "@cleocode/core/nexus/export.js";
+import {
+  assessNexusFreshnessForQuery as assessNexusFreshnessForQuery2,
+  assessNexusIndexFreshness,
+  discloseNexusFreshness as discloseNexusFreshness2,
+  judgeSymbolFiles as judgeSymbolFiles2,
+  querySymbolFiles as querySymbolFiles2,
+  withNexusFreshnessMeta as withNexusFreshnessMeta2
+} from "@cleocode/core/nexus/freshness.js";
 import { KnowledgeSymbolAmbiguityError } from "@cleocode/core/nexus/knowledge.js";
 import { runNexusWiki } from "@cleocode/core/nexus/wiki-orchestrator.js";
 async function appendDeprecationTelemetry(op, replacement) {
@@ -71924,6 +72259,10 @@ var init_nexus3 = __esm({
           type: "string",
           description: "Override the project ID (default: auto-detected from path)"
         },
+        references: {
+          type: "boolean",
+          description: "Include every retained unresolved/unmodeled reference (large; the default reports referenceCount)"
+        },
         json: {
           type: "boolean",
           description: "Output as JSON (LAFS envelope format)"
@@ -71946,7 +72285,7 @@ var init_nexus3 = __esm({
       async run({ args }) {
         applyJsonFlag2(args.json);
         const projectIdOverride = args["project-id"];
-        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot58();
+        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot60();
         const startTime = Date.now();
         if (args.path) {
           let isDir = false;
@@ -71985,7 +72324,7 @@ The code-intelligence graph is project-scoped (ADR-090 \xB7 T11648), so the coun
           process.exitCode = 2 /* INVALID_INPUT */;
           return;
         }
-        const currentRoot = getProjectRoot58();
+        const currentRoot = getProjectRoot60();
         if (args.path && path4.resolve(repoPath) !== path4.resolve(currentRoot)) {
           cliError(
             `nexus status cannot report on '${repoPath}' from this project.
@@ -72001,7 +72340,11 @@ The code-intelligence graph is project-scoped (ADR-090 \xB7 T11648): one store p
           return;
         }
         try {
-          const [{ getNexusDb, nexusSchema }, { getIndexStats }, { readKnowledgeIndexAssessment }] = await Promise.all([
+          const [
+            { getNexusDb, nexusSchema },
+            { getIndexStats },
+            { readKnowledgeIndexAssessment, readKnowledgeIndexReferences }
+          ] = await Promise.all([
             import("@cleocode/core/store/nexus-sqlite"),
             import("@cleocode/nexus/pipeline"),
             import("@cleocode/core/nexus/knowledge")
@@ -72012,11 +72355,22 @@ The code-intelligence graph is project-scoped (ADR-090 \xB7 T11648): one store p
             nexusNodes: nexusSchema.nexusNodes,
             nexusRelations: nexusSchema.nexusRelations
           };
-          const stats = await getIndexStats(projectId, repoPath, db, tables);
-          const assessment = await readKnowledgeIndexAssessment(currentRoot);
+          const freshness = await assessNexusIndexFreshness(currentRoot);
+          const stats = await getIndexStats(projectId, repoPath, db, tables, {
+            staleScan: freshness.status === "unknown"
+          });
+          const summary = await readKnowledgeIndexAssessment(currentRoot);
+          const assessment = summary && args.references ? { ...summary, references: await readKnowledgeIndexReferences(currentRoot) } : summary;
           const durationMs = Date.now() - startTime;
           cliOutput(
-            { projectId, repoPath, ...stats, assessment },
+            {
+              projectId,
+              repoPath,
+              ...stats,
+              ...freshness.status === "unknown" ? {} : { staleFileCount: freshness.staleFileCount },
+              freshness,
+              assessment
+            },
             {
               command: "nexus-status",
               operation: "nexus.status",
@@ -72515,7 +72869,7 @@ The code-intelligence graph is project-scoped (ADR-090 \xB7 T11648): one store p
         applyJsonFlag2(args.json);
         const startTime = Date.now();
         const projectIdOverride = args["project-id"];
-        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot58();
+        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot60();
         const projectId = projectIdOverride ?? Buffer.from(repoPath).toString("base64url").slice(0, 32);
         const response = await dispatchRaw("query", "nexus", "clusters", { projectId, repoPath });
         const durationMs = Date.now() - startTime;
@@ -72559,7 +72913,7 @@ The code-intelligence graph is project-scoped (ADR-090 \xB7 T11648): one store p
         applyJsonFlag2(args.json);
         const startTime = Date.now();
         const projectIdOverride = args["project-id"];
-        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot58();
+        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot60();
         const projectId = projectIdOverride ?? Buffer.from(repoPath).toString("base64url").slice(0, 32);
         const response = await dispatchRaw("query", "nexus", "flows", { projectId, repoPath });
         const durationMs = Date.now() - startTime;
@@ -72602,7 +72956,7 @@ The code-intelligence graph is project-scoped (ADR-090 \xB7 T11648): one store p
         void appendDeprecationTelemetry("nexus.context", "cleo graph context");
         const startTime = Date.now();
         const projectIdOverride = args["project-id"];
-        const repoPath = getProjectRoot58();
+        const repoPath = getProjectRoot60();
         const projectId = projectIdOverride ?? Buffer.from(repoPath).toString("base64url").slice(0, 32);
         const limit = parseInt(args.limit, 10);
         const symbolName = args.symbol;
@@ -72665,23 +73019,29 @@ The code-intelligence graph is project-scoped (ADR-090 \xB7 T11648): one store p
         const startTime = Date.now();
         const whyFlag = !!args.why;
         const projectIdOverride = args["project-id"];
-        const repoPath = getProjectRoot58();
+        const repoPath = getProjectRoot60();
         const projectId = projectIdOverride ?? Buffer.from(repoPath).toString("base64url").slice(0, 32);
         const maxDepth = Math.min(parseInt(args.depth, 10), 5);
         const symbolName = args.symbol;
         try {
+          const assessment = await assessNexusFreshnessForQuery2(repoPath);
           const result = await getSymbolImpact(symbolName, projectId, repoPath, {
             maxDepth,
             why: whyFlag
           });
+          const freshness = judgeSymbolFiles2(assessment, querySymbolFiles2(result));
+          discloseNexusFreshness2("nexus impact", freshness);
           const durationMs = Date.now() - startTime;
           cliOutput({ ...result, _symbolName: symbolName, _why: whyFlag }, {
             command: "nexus-impact",
             operation: "nexus.impact",
-            extensions: {
-              duration_ms: durationMs,
-              ...buildNexusMetaExtensions("impact", { symbol: symbolName, projectId })
-            }
+            extensions: withNexusFreshnessMeta2(
+              {
+                duration_ms: durationMs,
+                ...buildNexusMetaExtensions("impact", { symbol: symbolName, projectId })
+              },
+              freshness
+            )
           });
         } catch (err) {
           const code = err instanceof Error && "code" in err ? err.code : void 0;
@@ -72744,26 +73104,33 @@ The code-intelligence graph is project-scoped (ADR-090 \xB7 T11648): one store p
           type: "string",
           description: "Comma-separated relative nested repository/worktree paths explicitly included in this project index"
         },
+        full: {
+          type: "boolean",
+          description: "Parse every file instead of reusing unchanged files (default: incremental, falling back to full with a stated reason)"
+        },
         incremental: {
           type: "boolean",
-          description: "Skip unchanged indexes; atomically rebuild the full graph when sources change"
+          description: "Deprecated no-op: incremental analysis is now the default (use --full to rebuild)"
         }
       },
       async run({ args }) {
         applyJsonFlag2(args.json);
         const startTime = Date.now();
         const projectIdOverride = args["project-id"];
-        const isIncremental = !!args.incremental;
+        const full = !!args.full;
         const ctx = getFormatContext();
-        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot58();
-        humanInfo(`[nexus] Analyzing: ${repoPath}${isIncremental ? " (incremental)" : ""}`);
-        if (!isIncremental)
-          humanInfo("[nexus] Staging replacement graph; current index remains available...");
+        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot60();
+        if (args.incremental)
+          humanWarn(
+            "[nexus] --incremental is deprecated and has no effect: incremental is the default."
+          );
+        humanInfo(`[nexus] Analyzing: ${repoPath}${full ? " (full rebuild)" : ""}`);
+        humanInfo("[nexus] Staging replacement graph; current index remains available...");
         try {
           const result = await runNexusAnalysis({
             repoPath,
             projectIdOverride,
-            incremental: isIncremental,
+            full,
             includedRepositories: args["include-repositories"]?.split(",").map((entry) => entry.trim()).filter(Boolean),
             onProgress: ctx.format === "json" ? void 0 : (current, total, filePath) => {
               if (current % 50 === 0 || current === total) {
@@ -72774,11 +73141,17 @@ The code-intelligence graph is project-scoped (ADR-090 \xB7 T11648): one store p
           });
           humanInfo(`[nexus] nexus-bridge.md refreshed at ${repoPath}/.cleo/nexus-bridge.md`);
           humanInfo("[nexus] Project registered/updated in multi-project registry.");
+          humanInfo(
+            `[nexus] Mode: ${result.summary.mode} \u2014 ${result.summary.reason} (parsed ${result.summary.parsedFiles}, reused ${result.summary.reusedFiles})`
+          );
           cliOutput(
             {
               projectId: result.projectId,
               repoPath,
-              incremental: isIncremental,
+              incremental: result.incremental,
+              mode: result.summary.mode,
+              reason: result.summary.reason,
+              summary: result.summary,
               nodeCount: result.nodeCount,
               relationCount: result.relationCount,
               fileCount: result.fileCount,
@@ -72864,7 +73237,7 @@ The code-intelligence graph is project-scoped (ADR-090 \xB7 T11648): one store p
       async run({ args }) {
         applyJsonFlag2(args.json);
         const startTime = Date.now();
-        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot58();
+        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot60();
         const name = args.name;
         const response = await dispatchRaw("mutate", "nexus", "projects.register", {
           path: repoPath,
@@ -73020,11 +73393,11 @@ The code-intelligence graph is project-scoped (ADR-090 \xB7 T11648): one store p
         },
         "include-temp": {
           type: "boolean",
-          description: "Preset: match paths containing a .temp/ segment"
+          description: "Preset: match paths containing a .temp/ segment or under the OS temp directory"
         },
         "include-tests": {
           type: "boolean",
-          description: "Preset: match paths containing tmp/test/fixture/scratch/sandbox segments"
+          description: "Preset: match paths containing tmp/test(s)/__tests__/fixture(s)/scratch/sandbox segments"
         },
         unhealthy: {
           type: "boolean",
@@ -73044,7 +73417,7 @@ The code-intelligence graph is project-scoped (ADR-090 \xB7 T11648): one store p
         },
         vacuum: {
           type: "boolean",
-          description: "After delete, run sqlite VACUUM on nexus.db to reclaim space (T9117)"
+          description: "After delete, VACUUM the global registry store (<cleoHome>/cleo.db) to reclaim space"
         },
         yes: {
           type: "boolean",
@@ -73090,10 +73463,16 @@ The code-intelligence graph is project-scoped (ADR-090 \xB7 T11648): one store p
             return;
           }
           const preview = previewResp.data;
-          const { matched: matchCount, totalCount, sample: samplePaths } = preview;
+          const {
+            matched: matchCount,
+            totalCount,
+            sample: samplePaths,
+            classification,
+            matchedByReason
+          } = preview;
           if (ctx.format !== "json") {
             cliOutput(
-              { matched: matchCount, totalCount, sample: samplePaths },
+              { matched: matchCount, totalCount, sample: samplePaths, classification },
               {
                 command: "nexus-projects-clean-preview",
                 operation: "nexus.projects.clean",
@@ -73109,7 +73488,9 @@ The code-intelligence graph is project-scoped (ADR-090 \xB7 T11648): one store p
                 matched: matchCount,
                 purged: 0,
                 remaining: totalCount,
-                sample: samplePaths
+                sample: samplePaths,
+                classification,
+                matchedByReason
               },
               {
                 command: "nexus-projects-clean",
@@ -73169,7 +73550,10 @@ The code-intelligence graph is project-scoped (ADR-090 \xB7 T11648): one store p
               sample: result.sample,
               fsRemoved: result.fsRemoved,
               fsFailed: result.fsFailed,
-              vacuumBytesFreed: result.vacuumBytesFreed
+              vacuumBytesFreed: result.vacuumBytesFreed,
+              classification: result.classification,
+              matchedByReason: result.matchedByReason,
+              receipt: result.receipt
             },
             {
               command: "nexus-projects-clean",
@@ -73225,7 +73609,7 @@ The code-intelligence graph is project-scoped (ADR-090 \xB7 T11648): one store p
         applyJsonFlag2(args.json);
         const startTime = Date.now();
         const projectIdOverride = args["project-id"];
-        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot58();
+        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot60();
         const projectId = projectIdOverride ?? Buffer.from(repoPath).toString("base64url").slice(0, 32);
         const response = await dispatchRaw("mutate", "nexus", "refresh-bridge", {
           repoPath,
@@ -73279,8 +73663,8 @@ The code-intelligence graph is project-scoped (ADR-090 \xB7 T11648): one store p
             projectFilter
           });
           if (outputFile) {
-            const { writeFileSync: writeFileSync7 } = await import("node:fs");
-            writeFileSync7(outputFile, result.content, "utf-8");
+            const { writeFileSync: writeFileSync8 } = await import("node:fs");
+            writeFileSync8(outputFile, result.content, "utf-8");
             const durationMs = Date.now() - startTime;
             cliOutput(
               { outputFile, nodeCount: result.nodeCount, edgeCount: result.edgeCount },
@@ -73331,7 +73715,7 @@ The code-intelligence graph is project-scoped (ADR-090 \xB7 T11648): one store p
       async run({ args }) {
         applyJsonFlag2(args.json);
         const startTime = Date.now();
-        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot58();
+        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot60();
         const projectIdOverride = args["project-id"];
         const beforeRef = args.before ?? "HEAD~1";
         const afterRef = args.after ?? "HEAD";
@@ -73449,7 +73833,7 @@ The code-intelligence graph is project-scoped (ADR-090 \xB7 T11648): one store p
         applyJsonFlag2(args.json);
         const startTime = Date.now();
         const projectIdOverride = args["project-id"];
-        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot58();
+        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot60();
         const projectId = projectIdOverride ?? Buffer.from(repoPath).toString("base64url").slice(0, 32);
         const response = await dispatchRaw("query", "nexus", "route-map", { projectId });
         const durationMs = Date.now() - startTime;
@@ -73505,7 +73889,7 @@ The code-intelligence graph is project-scoped (ADR-090 \xB7 T11648): one store p
         const startTime = Date.now();
         const routeSymbol = args.routeSymbol;
         const projectIdOverride = args["project-id"];
-        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot58();
+        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot60();
         const projectId = projectIdOverride ?? Buffer.from(repoPath).toString("base64url").slice(0, 32);
         const response = await dispatchRaw("query", "nexus", "shape-check", { routeSymbol, projectId });
         const durationMs = Date.now() - startTime;
@@ -73901,7 +74285,7 @@ The code-intelligence graph is project-scoped (ADR-090 \xB7 T11648): one store p
       async run({ args }) {
         applyJsonFlag2(args.json);
         const startTime = Date.now();
-        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot58();
+        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot60();
         const projectIdOverride = args["project-id"];
         const projectId = projectIdOverride ?? Buffer.from(repoPath).toString("base64url").slice(0, 32);
         const response = await dispatchRaw("mutate", "nexus", "contracts-sync", {
@@ -74011,7 +74395,7 @@ The code-intelligence graph is project-scoped (ADR-090 \xB7 T11648): one store p
       async run({ args }) {
         applyJsonFlag2(args.json);
         const startTime = Date.now();
-        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot58();
+        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot60();
         const projectId = Buffer.from(repoPath).toString("base64url").slice(0, 32);
         const response = await dispatchRaw("mutate", "nexus", "contracts-link-tasks", {
           projectId,
@@ -74095,7 +74479,7 @@ The code-intelligence graph is project-scoped (ADR-090 \xB7 T11648): one store p
         const isIncremental = !!args.incremental;
         try {
           const result = await runNexusWiki({
-            projectRoot: getProjectRoot58(),
+            projectRoot: getProjectRoot60(),
             outputDir,
             communityFilter,
             incremental: isIncremental
@@ -74445,7 +74829,7 @@ __export(orchestrate_exports, {
 });
 import { execFileSync as execFileSync5 } from "node:child_process";
 import { orchestration } from "@cleocode/core";
-import { BUILD_CONFIG as BUILD_CONFIG2, getProjectRoot as getProjectRoot59 } from "@cleocode/core/internal";
+import { BUILD_CONFIG as BUILD_CONFIG2, getProjectRoot as getProjectRoot61 } from "@cleocode/core/internal";
 function formatRollupTable(rollup) {
   const waves = "waves" in rollup ? rollup.waves : [rollup];
   const lines = [];
@@ -74588,7 +74972,7 @@ var init_orchestrate3 = __esm({
       },
       async run({ args }) {
         const rateWindowHours = args.window !== void 0 ? Number.parseFloat(String(args.window)) : void 0;
-        const metrics = await orchestration.collectOrchestrateDashboard(getProjectRoot59(), {
+        const metrics = await orchestration.collectOrchestrateDashboard(getProjectRoot61(), {
           ...rateWindowHours !== void 0 && Number.isFinite(rateWindowHours) && rateWindowHours > 0 ? { rateWindowHours } : {}
         });
         cliOutput(metrics, {
@@ -76753,7 +77137,7 @@ var refresh_memory_exports = {};
 __export(refresh_memory_exports, {
   refreshMemoryCommand: () => refreshMemoryCommand
 });
-import { getProjectRoot as getProjectRoot60 } from "@cleocode/core";
+import { getProjectRoot as getProjectRoot62 } from "@cleocode/core";
 var refreshMemoryCommand;
 var init_refresh_memory = __esm({
   "packages/cleo/src/cli/commands/refresh-memory.ts"() {
@@ -76766,7 +77150,7 @@ var init_refresh_memory = __esm({
         description: "Regenerate .cleo/memory-bridge.md from brain.db"
       },
       async run() {
-        const projectDir = getProjectRoot60();
+        const projectDir = getProjectRoot62();
         const { writeMemoryBridge } = await import("@cleocode/core/internal");
         const result = await writeMemoryBridge(projectDir);
         if (result.written) {
@@ -78350,7 +78734,7 @@ import fs3 from "node:fs";
 import path5 from "node:path";
 import {
   CleoError as CleoError10,
-  getProjectRoot as getProjectRoot61,
+  getProjectRoot as getProjectRoot63,
   getTaskAccessor as getTaskAccessor3,
   parseConflictReport,
   setAtPath
@@ -78371,7 +78755,7 @@ var init_restore = __esm({
         description: "Apply manually-resolved conflicts from .cleo/restore-conflicts.md"
       },
       async run() {
-        const projectRoot = getProjectRoot61();
+        const projectRoot = getProjectRoot63();
         const reportPath = path5.join(projectRoot, CLEO_DIR_NAME3, RESTORE_CONFLICTS_MD);
         if (!fs3.existsSync(reportPath)) {
           humanLine("No pending restore conflicts. Nothing to finalize.");
@@ -78737,7 +79121,7 @@ __export(revert_exports, {
   revertCommand: () => revertCommand
 });
 import { readFile as readFile8 } from "node:fs/promises";
-import { join as join29 } from "node:path";
+import { join as join30 } from "node:path";
 import { cwd as processCwd2 } from "node:process";
 import { E_RECEIPT_NOT_FOUND } from "@cleocode/core/sentient/chain-walker.js";
 import { SENTIENT_STATE_FILE } from "@cleocode/core/sentient/daemon.js";
@@ -78790,7 +79174,7 @@ async function loadOwnerAttestation(attestationFilePath) {
   return obj;
 }
 async function loadOwnerPubkeys(projectRoot) {
-  const path6 = join29(projectRoot, OWNER_PUBKEYS_FILE);
+  const path6 = join30(projectRoot, OWNER_PUBKEYS_FILE);
   try {
     const raw = await readFile8(path6, "utf-8");
     const parsed = JSON.parse(raw);
@@ -78874,7 +79258,7 @@ var init_revert = __esm({
         if (attestation && allowedPubkeys.size > 0 && !allowedPubkeys.has(attestation.ownerPubkey)) {
           emitFailure2(
             E_OWNER_ATTESTATION_REQUIRED,
-            `Attestation pubkey "${attestation.ownerPubkey}" is not in the owner allowlist at ${join29(projectRoot, OWNER_PUBKEYS_FILE)}`,
+            `Attestation pubkey "${attestation.ownerPubkey}" is not in the owner allowlist at ${join30(projectRoot, OWNER_PUBKEYS_FILE)}`,
             jsonMode
           );
         }
@@ -78927,7 +79311,7 @@ ${lines}`
             identity,
             includeHuman
           });
-          const statePath = join29(projectRoot, SENTIENT_STATE_FILE);
+          const statePath = join30(projectRoot, SENTIENT_STATE_FILE);
           const state = await readSentientState(statePath);
           emitSuccess(
             {
@@ -79293,8 +79677,8 @@ var init_saga = __esm({
         }
       },
       async run({ args }) {
-        const { sagas: sagas2, getProjectRoot: getProjectRoot67 } = await import("@cleocode/core");
-        const projectRoot = getProjectRoot67();
+        const { sagas: sagas2, getProjectRoot: getProjectRoot69 } = await import("@cleocode/core");
+        const projectRoot = getProjectRoot69();
         const sagaId = typeof args.sagaId === "string" && args.sagaId.length > 0 ? args.sagaId : void 0;
         const result = await sagas2.sagaNext(projectRoot, { sagaId });
         cliOutput(result.success ? result.data : result, { command: "saga", operation: "saga.next" });
@@ -79508,7 +79892,7 @@ __export(self_update_exports, {
 });
 import { execFile } from "node:child_process";
 import { readFile as readFile9 } from "node:fs/promises";
-import { join as join30 } from "node:path";
+import { join as join31 } from "node:path";
 import * as readline3 from "node:readline";
 import { promisify } from "node:util";
 import {
@@ -79516,14 +79900,14 @@ import {
   CleoError as CleoError11,
   checkAllRegisteredProjects as checkAllRegisteredProjects2,
   checkStorageMigration,
-  getCleoHome as getCleoHome6,
+  getCleoHome as getCleoHome7,
   getRuntimeDiagnostics as getRuntimeDiagnostics2,
   runUpgrade
 } from "@cleocode/core/internal";
 async function getCurrentVersion() {
-  const cleoHome = getCleoHome6();
+  const cleoHome = getCleoHome7();
   try {
-    const content = await readFile9(join30(cleoHome, "VERSION"), "utf-8");
+    const content = await readFile9(join31(cleoHome, "VERSION"), "utf-8");
     return (content.split("\n")[0] ?? "unknown").trim();
   } catch {
     return "unknown";
@@ -79568,7 +79952,7 @@ async function getDistTagVersion(tag) {
   }
 }
 async function writeRuntimeVersionMetadata(mode, source, version) {
-  const cleoHome = getCleoHome6();
+  const cleoHome = getCleoHome7();
   const lines = [
     version,
     `mode=${mode}`,
@@ -79577,7 +79961,7 @@ async function writeRuntimeVersionMetadata(mode, source, version) {
   ];
   await import("node:fs/promises").then(
     ({ writeFile: writeFile4, mkdir: mkdir7 }) => mkdir7(cleoHome, { recursive: true }).then(
-      () => writeFile4(join30(cleoHome, "VERSION"), `${lines.join("\n")}
+      () => writeFile4(join31(cleoHome, "VERSION"), `${lines.join("\n")}
 `, "utf-8")
     )
   );
@@ -80057,7 +80441,7 @@ __export(sentient_exports, {
   promptAcceptExecution: () => promptAcceptExecution,
   sentientCommand: () => sentientCommand
 });
-import { join as join31 } from "node:path";
+import { join as join32 } from "node:path";
 import { cwd as processCwd3, stdin, stdout } from "node:process";
 import { createInterface as createInterface4 } from "node:readline/promises";
 import {
@@ -80146,7 +80530,7 @@ var init_sentient3 = __esm({
             return;
           }
           if (dryRun) {
-            const statePath2 = join31(projectRoot, SENTIENT_STATE_FILE2);
+            const statePath2 = join32(projectRoot, SENTIENT_STATE_FILE2);
             const outcome = await safeRunTick({ projectRoot, statePath: statePath2, dryRun: true });
             emitSuccess2(
               { dryRun: true, outcome },
@@ -80262,7 +80646,7 @@ Logs:  ${logPath}`
         const jsonMode = args.json === true;
         const dryRun = args["dry-run"] === true;
         try {
-          const statePath = join31(projectRoot, SENTIENT_STATE_FILE2);
+          const statePath = join32(projectRoot, SENTIENT_STATE_FILE2);
           const outcome = await safeRunTick({ projectRoot, statePath, dryRun });
           emitSuccess2(
             { outcome, dryRun },
@@ -80354,7 +80738,7 @@ Logs:  ${logPath}`
             return;
           }
           await db.update(tasks).set({ status: "pending", updatedAt: now }).where(eq2(tasks.id, id)).run();
-          const statePath = join31(projectRoot, SENTIENT_STATE_FILE2);
+          const statePath = join32(projectRoot, SENTIENT_STATE_FILE2);
           const state = await readSentientState2(statePath);
           await patchSentientState(statePath, {
             tier2Stats: {
@@ -80450,7 +80834,7 @@ Logs:  ${logPath}`
             return;
           }
           await db.update(tasks).set({ status: "cancelled", cancellationReason: reason, cancelledAt: now, updatedAt: now }).where(eq2(tasks.id, id)).run();
-          const statePath = join31(projectRoot, SENTIENT_STATE_FILE2);
+          const statePath = join32(projectRoot, SENTIENT_STATE_FILE2);
           const state = await readSentientState2(statePath);
           await patchSentientState(statePath, {
             tier2Stats: {
@@ -80495,7 +80879,7 @@ Logs:  ${logPath}`
         const projectRoot = resolveProjectRoot5(args.project);
         const jsonMode = args.json === true;
         try {
-          const statePath = join31(projectRoot, SENTIENT_STATE_FILE2);
+          const statePath = join32(projectRoot, SENTIENT_STATE_FILE2);
           const outcome = await safeRunProposeTick({ projectRoot, statePath });
           emitSuccess2(
             { outcome },
@@ -80515,7 +80899,7 @@ Logs:  ${logPath}`
         const projectRoot = resolveProjectRoot5(args.project);
         const jsonMode = args.json === true;
         try {
-          const statePath = join31(projectRoot, SENTIENT_STATE_FILE2);
+          const statePath = join32(projectRoot, SENTIENT_STATE_FILE2);
           const updated = await patchSentientState(statePath, { tier2Enabled: true });
           emitSuccess2({ tier2Enabled: updated.tier2Enabled }, jsonMode, "Tier-2 proposals enabled");
         } catch (err) {
@@ -80534,7 +80918,7 @@ Logs:  ${logPath}`
         const projectRoot = resolveProjectRoot5(args.project);
         const jsonMode = args.json === true;
         try {
-          const statePath = join31(projectRoot, SENTIENT_STATE_FILE2);
+          const statePath = join32(projectRoot, SENTIENT_STATE_FILE2);
           const updated = await patchSentientState(statePath, { tier2Enabled: false });
           emitSuccess2({ tier2Enabled: updated.tier2Enabled }, jsonMode, "Tier-2 proposals disabled");
         } catch (err) {
@@ -80565,7 +80949,7 @@ Logs:  ${logPath}`
         const projectRoot = resolveProjectRoot5(args.project);
         const jsonMode = args.json === true;
         try {
-          const statePath = join31(projectRoot, SENTIENT_STATE_FILE2);
+          const statePath = join32(projectRoot, SENTIENT_STATE_FILE2);
           const state = await readSentientState2(statePath);
           emitSuccess2(
             {
@@ -81123,7 +81507,7 @@ var sequence_exports = {};
 __export(sequence_exports, {
   sequenceCommand: () => sequenceCommand
 });
-import { getProjectRoot as getProjectRoot62 } from "@cleocode/core/internal";
+import { getProjectRoot as getProjectRoot64 } from "@cleocode/core/internal";
 var showCommand12, checkCommand7, repairCommand3, sequenceCommand;
 var init_sequence = __esm({
   "packages/cleo/src/cli/commands/sequence.ts"() {
@@ -81159,7 +81543,7 @@ var init_sequence = __esm({
       meta: { name: "repair", description: "Reset counter to max + 1 if behind" },
       async run() {
         const { repairSequence } = await import("@cleocode/core/internal");
-        const projectRoot = getProjectRoot62();
+        const projectRoot = getProjectRoot64();
         const repair = await repairSequence(projectRoot);
         const result = {
           repaired: repair.repaired,
@@ -81752,8 +82136,8 @@ var init_session4 = __esm({
         "audit-scope": { type: "string", description: "Audit log scope (global|local)" }
       },
       async run({ args }) {
-        const { detectSessionDrift, getProjectRoot: getProjectRoot67 } = await import("@cleocode/core");
-        const projectRoot = await getProjectRoot67();
+        const { detectSessionDrift, getProjectRoot: getProjectRoot69 } = await import("@cleocode/core");
+        const projectRoot = await getProjectRoot69();
         const scope = args["audit-scope"] === "local" ? "local" : "global";
         const report = await detectSessionDrift({ projectRoot, auditScope: scope });
         cliOutput(report, { command: "session drift", operation: "session.drift" });
@@ -84342,13 +84726,13 @@ var init_telemetry2 = __esm({
 // packages/cleo/src/cli/commands/templates/lib.ts
 import { readFileSync as readFileSync14 } from "node:fs";
 import { isAbsolute as isAbsolute3, resolve as resolve10 } from "node:path";
-import { getProjectRoot as getProjectRoot63 } from "@cleocode/core";
+import { getProjectRoot as getProjectRoot65 } from "@cleocode/core";
 import { resolveSourcePathAbsolute } from "@cleocode/core/templates/registry";
 function resolveProjectRoot6(raw) {
   if (typeof raw === "string" && raw.length > 0) {
     return isAbsolute3(raw) ? raw : resolve10(process.cwd(), raw);
   }
-  return getProjectRoot63();
+  return getProjectRoot65();
 }
 function readTemplateSource(entry) {
   const sourceAbsolute = resolveSourcePathAbsolute(entry);
@@ -84368,7 +84752,7 @@ var init_lib = __esm({
 
 // packages/cleo/src/cli/commands/templates/diff.ts
 import { existsSync as existsSync19, readFileSync as readFileSync15 } from "node:fs";
-import { join as join32 } from "node:path";
+import { join as join33 } from "node:path";
 import { getTemplateById } from "@cleocode/core/templates/registry";
 function unifiedDiff(a, b) {
   const aLines = a.length === 0 ? [] : a.split("\n");
@@ -84438,7 +84822,7 @@ var init_diff = __esm({
         let rendered;
         try {
           projectRoot = resolveProjectRoot6(args["project"]);
-          installPath = join32(projectRoot, entry.installPath);
+          installPath = join33(projectRoot, entry.installPath);
           const source = readTemplateSource(entry);
           rendered = applySubstitution(entry, source).rendered;
         } catch (err) {
@@ -84488,8 +84872,8 @@ ${unifiedDiff("", rendered)}`
 });
 
 // packages/cleo/src/cli/commands/templates/install.ts
-import { existsSync as existsSync20, mkdirSync as mkdirSync5, readFileSync as readFileSync16, writeFileSync as writeFileSync5 } from "node:fs";
-import { dirname as dirname10, join as join33 } from "node:path";
+import { existsSync as existsSync20, mkdirSync as mkdirSync5, readFileSync as readFileSync16, writeFileSync as writeFileSync6 } from "node:fs";
+import { dirname as dirname10, join as join34 } from "node:path";
 import { getTemplateById as getTemplateById2 } from "@cleocode/core/templates/registry";
 var templatesInstallCommand;
 var init_install = __esm({
@@ -84543,7 +84927,7 @@ var init_install = __esm({
         let substituted;
         try {
           projectRoot = resolveProjectRoot6(args["project"]);
-          installPath = join33(projectRoot, entry.installPath);
+          installPath = join34(projectRoot, entry.installPath);
           const source = readTemplateSource(entry);
           const sub = applySubstitution(entry, source);
           rendered = sub.rendered;
@@ -84575,7 +84959,7 @@ var init_install = __esm({
         }
         try {
           mkdirSync5(dirname10(installPath), { recursive: true });
-          writeFileSync5(installPath, rendered, "utf8");
+          writeFileSync6(installPath, rendered, "utf8");
         } catch (err) {
           const message = err instanceof Error ? err.message : String(err);
           cliError(`templates install failed: ${message}`, 1 /* GENERAL_ERROR */, {
@@ -84705,8 +85089,8 @@ var init_show3 = __esm({
 });
 
 // packages/cleo/src/cli/commands/templates/upgrade.ts
-import { existsSync as existsSync21, mkdirSync as mkdirSync6, readFileSync as readFileSync17, writeFileSync as writeFileSync6 } from "node:fs";
-import { dirname as dirname11, join as join34 } from "node:path";
+import { existsSync as existsSync21, mkdirSync as mkdirSync6, readFileSync as readFileSync17, writeFileSync as writeFileSync7 } from "node:fs";
+import { dirname as dirname11, join as join35 } from "node:path";
 import { getTemplateById as getTemplateById4 } from "@cleocode/core/templates/registry";
 var templatesUpgradeCommand;
 var init_upgrade2 = __esm({
@@ -84768,7 +85152,7 @@ var init_upgrade2 = __esm({
         let rendered;
         try {
           projectRoot = resolveProjectRoot6(args["project"]);
-          installPath = join34(projectRoot, entry.installPath);
+          installPath = join35(projectRoot, entry.installPath);
           const source = readTemplateSource(entry);
           rendered = applySubstitution(entry, source).rendered;
         } catch (err) {
@@ -84817,7 +85201,7 @@ var init_upgrade2 = __esm({
         if (shouldWrite) {
           try {
             mkdirSync6(dirname11(installPath), { recursive: true });
-            writeFileSync6(installPath, rendered, "utf8");
+            writeFileSync7(installPath, rendered, "utf8");
           } catch (err) {
             const message = err instanceof Error ? err.message : String(err);
             cliError(`templates upgrade failed: ${message}`, 1 /* GENERAL_ERROR */, {
@@ -85132,7 +85516,7 @@ __export(token_exports, {
   tokenCommand: () => tokenCommand
 });
 import { readFileSync as readFileSync18 } from "node:fs";
-import { getProjectRoot as getProjectRoot64, measureTokenExchange, recordTokenExchange as recordTokenExchange2 } from "@cleocode/core/internal";
+import { getProjectRoot as getProjectRoot66, measureTokenExchange, recordTokenExchange as recordTokenExchange2 } from "@cleocode/core/internal";
 function readPayload(args, textKey, fileKey) {
   const text = args[textKey];
   const file = args[fileKey];
@@ -85296,7 +85680,7 @@ var init_token = __esm({
           domain: args.domain,
           operation: args.operation
         };
-        const result = args.record ? await recordTokenExchange2(getProjectRoot64(), input2) : await measureTokenExchange(input2);
+        const result = args.record ? await recordTokenExchange2(getProjectRoot66(), input2) : await measureTokenExchange(input2);
         cliOutput(result, {
           command: "token",
           operation: args.record ? "admin.token.record" : "token.estimate"
@@ -85331,8 +85715,8 @@ __export(transcript_exports, {
   transcriptCommand: () => transcriptCommand
 });
 import { homedir as homedir6 } from "node:os";
-import { join as join35 } from "node:path";
-import { getProjectRoot as getProjectRoot65 } from "@cleocode/core";
+import { join as join36 } from "node:path";
+import { getProjectRoot as getProjectRoot67 } from "@cleocode/core";
 import {
   parseDurationMs,
   pruneTranscripts,
@@ -85362,7 +85746,7 @@ var init_transcript = __esm({
       async run({ args }) {
         if (args.pending) {
           try {
-            const projectRoot = getProjectRoot65();
+            const projectRoot = getProjectRoot67();
             const { scanPendingTranscripts } = await import("@cleocode/core/memory/transcript-scanner.js");
             const pending = await scanPendingTranscripts(projectRoot);
             cliOutput(
@@ -85385,7 +85769,7 @@ var init_transcript = __esm({
           }
           return;
         }
-        const projectsDir = args["projects-dir"] ?? join35(homedir6(), ".claude", "projects");
+        const projectsDir = args["projects-dir"] ?? join36(homedir6(), ".claude", "projects");
         try {
           const result = await scanTranscripts(projectsDir);
           cliOutput(
@@ -85459,7 +85843,7 @@ var init_transcript = __esm({
       async run({ args }) {
         const tier = args.tier ?? "warm";
         const dryRun = args["dry-run"] ?? false;
-        const projectRoot = getProjectRoot65();
+        const projectRoot = getProjectRoot67();
         try {
           const { extractTranscript } = await import("@cleocode/core/memory/transcript-extractor.js");
           const { findSessionTranscriptPath, listAllTranscripts } = await import("@cleocode/core/memory/transcript-scanner.js");
@@ -85575,7 +85959,7 @@ var init_transcript = __esm({
         const dryRun = args["dry-run"] ?? false;
         const olderThanHours = args["older-than-hours"] ? Number.parseInt(args["older-than-hours"], 10) : 24;
         const limit = args.limit ? Number.parseInt(args.limit, 10) : void 0;
-        const projectRoot = getProjectRoot65();
+        const projectRoot = getProjectRoot67();
         try {
           const { extractTranscript } = await import("@cleocode/core/memory/transcript-extractor.js");
           const { listAllTranscripts } = await import("@cleocode/core/memory/transcript-scanner.js");
@@ -85695,7 +86079,7 @@ var init_transcript = __esm({
           process.exit(2);
           return;
         }
-        const projectsDir = args["projects-dir"] ?? join35(homedir6(), ".claude", "projects");
+        const projectsDir = args["projects-dir"] ?? join36(homedir6(), ".claude", "projects");
         try {
           const pruneResult = await pruneTranscripts({
             olderThanMs,
@@ -85765,7 +86149,7 @@ import { once } from "node:events";
 import { createWriteStream, existsSync as existsSync22, readFileSync as readFileSync19, realpathSync } from "node:fs";
 import { mkdir as mkdir6 } from "node:fs/promises";
 import * as net from "node:net";
-import { dirname as dirname12, join as join36 } from "node:path";
+import { dirname as dirname12, join as join37 } from "node:path";
 import { fileURLToPath as fileURLToPath7 } from "node:url";
 import { spawnWrapped } from "@cleocode/core/resources/spawn-wrapper.js";
 function shouldAutoStartGateway(config) {
@@ -85809,7 +86193,7 @@ function resolveCliEntryPath(startUrl = import.meta.url) {
   const startFile = realpathSync(fileURLToPath7(startUrl));
   let current = dirname12(startFile);
   for (let i = 0; i < 20; i++) {
-    const pkgJsonPath = join36(current, "package.json");
+    const pkgJsonPath = join37(current, "package.json");
     if (existsSync22(pkgJsonPath)) {
       let pkgName;
       try {
@@ -85819,7 +86203,7 @@ function resolveCliEntryPath(startUrl = import.meta.url) {
       } catch {
       }
       if (pkgName === CLEO_PACKAGE_NAME) {
-        const entry = join36(current, "dist", "cli", "index.js");
+        const entry = join37(current, "dist", "cli", "index.js");
         if (!existsSync22(entry)) {
           throw new Error(
             `@cleocode/cleo package root found at ${current} but dist/cli/index.js is missing \u2014 run \`pnpm --filter @cleocode/cleo run build\` to generate it`
@@ -85856,8 +86240,8 @@ async function spawnGatewayIfDown(opts = {}) {
     const { getCleoLogDir } = await import("@cleocode/core");
     const logDir = getCleoLogDir();
     await mkdir6(logDir, { recursive: true });
-    const outStream = createWriteStream(join36(logDir, "gateway.log"), { flags: "a" });
-    const errStream = createWriteStream(join36(logDir, "gateway.err"), { flags: "a" });
+    const outStream = createWriteStream(join37(logDir, "gateway.log"), { flags: "a" });
+    const errStream = createWriteStream(join37(logDir, "gateway.err"), { flags: "a" });
     await Promise.all([once(outStream, "open"), once(errStream, "open")]);
     outFd = outStream;
     errFd = errStream;
@@ -86317,7 +86701,7 @@ __export(cockpit_exports, {
   runCockpit: () => runCockpit
 });
 import { readFileSync as readFileSync20 } from "node:fs";
-import { join as join37 } from "node:path";
+import { join as join38 } from "node:path";
 import { createCleoClient as createCleoClient2 } from "@cleocode/core/gateway-client";
 async function fetchTaskRows(baseUrl) {
   const client = createCleoClient2({ baseUrl });
@@ -86434,7 +86818,7 @@ async function runCockpit(options = {}, sink = (line) => process.stdout.write(`$
     }
     try {
       const { getCleoLogDir } = await import("@cleocode/core");
-      const errPath = join37(getCleoLogDir(), "gateway.err");
+      const errPath = join38(getCleoLogDir(), "gateway.err");
       const errContent = readFileSync20(errPath, "utf8").trimEnd();
       if (errContent.length > 0) {
         const lastLine = errContent.split("\n").at(-1) ?? "";
@@ -87867,9 +88251,9 @@ var init_workgraph2 = __esm({
       },
       async run({ args }) {
         const { generatePlanningDoc } = await import("@cleocode/core/workgraph");
-        const { getProjectRoot: getProjectRoot67 } = await import("@cleocode/core");
+        const { getProjectRoot: getProjectRoot69 } = await import("@cleocode/core");
         const { cliOutput: cliOutput2 } = await Promise.resolve().then(() => (init_renderers(), renderers_exports));
-        const projectRoot = getProjectRoot67();
+        const projectRoot = getProjectRoot69();
         const audience = String(args.audience) === "agent" ? "agent" : "maintainer";
         const result = await generatePlanningDoc(projectRoot, {
           sagaId: String(args.sagaId),
@@ -87886,9 +88270,9 @@ var init_workgraph2 = __esm({
       async run() {
         const { validateWorkGraphStructure } = await import("@cleocode/core/workgraph");
         const { taskList: taskList2 } = await import("@cleocode/core/internal");
-        const { getProjectRoot: getProjectRoot67 } = await import("@cleocode/core");
+        const { getProjectRoot: getProjectRoot69 } = await import("@cleocode/core");
         const { cliOutput: cliOutput2 } = await Promise.resolve().then(() => (init_renderers(), renderers_exports));
-        const projectRoot = getProjectRoot67();
+        const projectRoot = getProjectRoot69();
         const listResult = await taskList2(projectRoot, { limit: 5e3 });
         const tasks = listResult.success ? listResult.data?.tasks ?? [] : [];
         const nodes = tasks.map((t) => ({
@@ -87907,9 +88291,9 @@ var init_workgraph2 = __esm({
         description: "One-shot saga-to-saga workgraph dashboard (tracking checklist)"
       },
       async run() {
-        const { sagas: sagas2, getProjectRoot: getProjectRoot67 } = await import("@cleocode/core");
+        const { sagas: sagas2, getProjectRoot: getProjectRoot69 } = await import("@cleocode/core");
         const { cliOutput: cliOutput2 } = await Promise.resolve().then(() => (init_renderers(), renderers_exports));
-        const projectRoot = getProjectRoot67();
+        const projectRoot = getProjectRoot69();
         const listResult = await sagas2.sagaList(projectRoot);
         if (!listResult.success) {
           cliOutput2(listResult, { command: "workgraph", operation: "workgraph.status" });
@@ -87975,7 +88359,7 @@ __export(worktree_exports, {
   worktreeCommand: () => worktreeCommand
 });
 import readline4 from "node:readline";
-import { getProjectRoot as getProjectRoot66, listWorktrees as listWorktrees2 } from "@cleocode/core/internal";
+import { getProjectRoot as getProjectRoot68, listWorktrees as listWorktrees2 } from "@cleocode/core/internal";
 async function promptYesNo2(question) {
   return new Promise((resolve13) => {
     const rl = readline4.createInterface({ input: process.stdin, output: process.stdout });
@@ -88080,7 +88464,7 @@ var init_worktree3 = __esm({
         const staleDays = staleDaysRaw !== void 0 ? Number.parseInt(staleDaysRaw, 10) : void 0;
         const idleDaysRaw = typeof args["idle-days"] === "string" ? args["idle-days"] : void 0;
         const idleDays = idleDaysRaw !== void 0 ? Number.parseInt(idleDaysRaw, 10) : void 0;
-        const projectRoot = getProjectRoot66();
+        const projectRoot = getProjectRoot68();
         const listResult = await listWorktrees2({
           projectRoot,
           ...staleDays !== void 0 && !Number.isNaN(staleDays) ? { staleDays } : {}
@@ -88320,7 +88704,7 @@ var init_worktree3 = __esm({
 // packages/cleo/src/cli/index.ts
 init_dist();
 import { readFileSync as readFileSync22 } from "node:fs";
-import { dirname as dirname13, join as join39 } from "node:path";
+import { dirname as dirname13, join as join40 } from "node:path";
 import { fileURLToPath as fileURLToPath8 } from "node:url";
 import { enforceNodeVersion } from "@cleocode/paths";
 
@@ -88664,6 +89048,12 @@ var COMMAND_MANIFEST = [
     description: "Report tasks whose acceptance criteria disagree between the JSON column and the typed rows ",
     load: async () => (await Promise.resolve().then(() => (init_doctor_acceptance_drift(), doctor_acceptance_drift_exports))).doctorAcceptanceDriftCommand
   },
+  {
+    exportName: "doctorCredentialsCommand",
+    name: "credentials",
+    description: "Report project credentials still encrypted under the legacy path-bound key (moving the project would strand them) and agent registry keys that are not recoverable. --fix re-keys project credentials to the project's identity in place and flags unrecoverable agent keys requires_reauth. Idempotent; never deletes. Unrecoverable credentials are listed with their re-entry command.",
+    load: async () => (await Promise.resolve().then(() => (init_doctor_credentials(), doctor_credentials_exports))).doctorCredentialsCommand
+  },
   {
     exportName: "doctorDbSubstrateCommand",
     name: "db-substrate",
@@ -88718,6 +89108,12 @@ var COMMAND_MANIFEST = [
     description: "Report nexus tables resident in the wrong store \u2014 graph tables orphaned in the global ",
     load: async () => (await Promise.resolve().then(() => (init_doctor_nexus_residency(), doctor_nexus_residency_exports))).doctorNexusResidencyCommand
   },
+  {
+    exportName: "doctorProjectIdentityCommand",
+    name: "project-identity",
+    description: "Check .cleo/project-id against project-info.json (missing / conflict / invalid / untracked) ",
+    load: async () => (await Promise.resolve().then(() => (init_doctor_project_identity(), doctor_project_identity_exports))).doctorProjectIdentityCommand
+  },
   {
     exportName: "doctorProjectsCommand",
     name: "doctor-projects",
@@ -88736,6 +89132,12 @@ var COMMAND_MANIFEST = [
     description: "Detect malformed CLEO databases (PRAGMA quick_check) and restore each from its ",
     load: async () => (await Promise.resolve().then(() => (init_doctor_repair(), doctor_repair_exports))).doctorRepairCommand
   },
+  {
+    exportName: "doctorSplitBrainCommand",
+    name: "split-brain",
+    description: "Import rows that exist only in a diverged copy of a store (--source) into another (--target) ",
+    load: async () => (await Promise.resolve().then(() => (init_doctor_split_brain(), doctor_split_brain_exports))).doctorSplitBrainCommand
+  },
   {
     exportName: "doctorSupersededStoreCommand",
     name: "superseded-store",
@@ -89569,12 +89971,12 @@ init_did_you_mean();
 
 // packages/cleo/src/cli/lib/first-run-detection.ts
 import { existsSync as existsSync23 } from "node:fs";
-import { join as join38 } from "node:path";
+import { join as join39 } from "node:path";
 async function detectFirstRun() {
   const envKey = process.env["ANTHROPIC_API_KEY"];
   if (typeof envKey === "string" && envKey.length > 0) return false;
   const { getCleoPlatformPaths } = await import("@cleocode/paths");
-  const configPath = join38(getCleoPlatformPaths().config, "config.json");
+  const configPath = join39(getCleoPlatformPaths().config, "config.json");
   if (existsSync23(configPath)) return false;
   try {
     const { getCredentialPool: getCredentialPool2 } = await import("@cleocode/core/llm/credential-pool.js");
@@ -89699,7 +90101,7 @@ async function resolveSubCommandForHelp(cmd, rawArgs) {
 init_summary_context();
 enforceNodeVersion();
 function getPackageVersion() {
-  const pkgPath = join39(dirname13(fileURLToPath8(import.meta.url)), "../../package.json");
+  const pkgPath = join40(dirname13(fileURLToPath8(import.meta.url)), "../../package.json");
   const pkg = JSON.parse(readFileSync22(pkgPath, "utf-8"));
   return pkg.version;
 }
@@ -89883,6 +90285,19 @@ async function runMainWithLafsEnvelope(cmd, rawArgs, showUsage2) {
   const { WarningCollector, withWarningCollector } = await import("@cleocode/lafs");
   const collector = new WarningCollector();
   await withWarningCollector(collector, async () => {
+    const { recordProjectEncounter } = await import("@cleocode/core/internal");
+    try {
+      const outcome = await recordProjectEncounter();
+      if (process.env["CLEO_DEBUG"])
+        process.stderr.write(`[cleo][debug] Project encounter: ${outcome}
+`);
+    } catch (error) {
+      if (process.env["CLEO_DEBUG"])
+        process.stderr.write(
+          `[cleo][debug] Project encounter not recorded: ${error instanceof Error ? error.message : String(error)}
+`
+        );
+    }
     try {
       await runCommand(cmd, { rawArgs });
     } catch (err) {
@@ -89914,7 +90329,7 @@ async function runStartupMaintenance() {
     detectAndRemoveStrayProjectNexus,
     getGlobalSalt,
     getLogger: getLogger22,
-    getProjectRoot: getProjectRoot67,
+    getProjectRoot: getProjectRoot69,
     isCleanupMarkerSet,
     migrateSignaldockToConduit,
     needsSignaldockToConduitMigration,
@@ -89923,7 +90338,7 @@ async function runStartupMaintenance() {
   } = await import("@cleocode/core/internal");
   let projectRootForCleanup = "";
   try {
-    projectRootForCleanup = getProjectRoot67();
+    projectRootForCleanup = getProjectRoot69();
   } catch {
   }
   if (!isCleanupMarkerSet(CLI_VERSION, projectRootForCleanup)) {
@@ -89943,7 +90358,7 @@ async function runStartupMaintenance() {
   const isInitInvocation = process.argv.slice(2).some((a) => a === "init");
   if (!isInitInvocation) {
     try {
-      const _projectRootForMigration = getProjectRoot67();
+      const _projectRootForMigration = getProjectRoot69();
       if (needsSignaldockToConduitMigration(_projectRootForMigration)) {
         const migrationResult = await migrateSignaldockToConduit(_projectRootForMigration);
         if (migrationResult.status === "failed") {