@cleocode/contracts 2026.10.4 → 2026.10.5

package/src/nexus-vault.ts

@@ -46,6 +46,38 @@ export const nexusProjectKeysSchema = z.looseObject({
   ),
 });
 
+// ---------- wire: replica retirement refusals (cleo-nexus T123) ----------
+
+/**
+ * The `details.reason` values E31 (`POST …/replicas/:replicaId/retirements`) and the calls it guards answer with
+ * (cleo-nexus #41, contract v2.28):
+ * - `not-pinned-or-owner` (403): the caller is neither the replica's pinned device nor, on a project stream, an
+ *   owner's device (on a home stream, any device of the account may retire).
+ * - `retire-below-head` (409): `lastReplicaSeq` is under the replica's highest appended replicaSeq, or null while
+ *   the replica has a segment.
+ * - `retired` (409): the replica is already retired with another successor or `lastReplicaSeq` (the same pair
+ *   again answers 200 with the stored record).
+ * - `successor-other-user` (403): on a project stream, the successor is pinned to another user's device.
+ * - `successor-taken` (409): another user's retirement already names that successor.
+ * - `successor-retired` (409): the successor is itself retired (this also refuses a cycle).
+ * - `replica-retired` (409, `E_CONFLICT`, with `lastReplicaSeq` and `successor`): a segment append past the
+ *   retirement, or a lease request, for a retired replica.
+ * The server's strings, not a cloud wire schema: kept here, beside the vault's other wire constants, so the
+ * `@cleocode/contracts/cloud` mirror stays byte-for-byte the server's.
+ */
+export const NEXUS_REPLICA_RETIREMENT_REASONS = [
+  'not-pinned-or-owner',
+  'retire-below-head',
+  'retired',
+  'successor-other-user',
+  'successor-taken',
+  'successor-retired',
+  'replica-retired',
+] as const;
+
+/** One E31 refusal reason ({@link NEXUS_REPLICA_RETIREMENT_REASONS}). */
+export type NexusReplicaRetirementReason = (typeof NEXUS_REPLICA_RETIREMENT_REASONS)[number];
+
 // ---------- wire: leases (cleo-nexus T083) ----------
 
 /** The lease role of the vault's single writer. */
@@ -195,15 +227,59 @@ export interface CloudRestoreResult {
   tables: number;
   /** Local safety backup taken before activation, if any. */
   safetyBackup: string | null;
+  /**
+   * The placed file is a new store instance, so the replica this store had is
+   * retired and a new one bound (journal spec §1.5; T13109). The server keeps
+   * the retired one as history until S4 announces its retirement. `null` when
+   * nothing was placed or the store had no replica yet (a first restore here).
+   *
+   * `reason` is `vault-restore` when the retired replica was this device's
+   * replica of the replaced file (recorded as a retire candidate unless the
+   * registry write failed), `file-identity` or `foreign-device` when the store
+   * was a copy or another device's (the carried replica stays live where it
+   * belongs; nothing to retire), and `null` when the rebind's registry write
+   * failed.
+   */
+  replica: {
+    retired: string;
+    current: string;
+    reason: 'vault-restore' | 'file-identity' | 'foreign-device' | null;
+  } | null;
   warnings: CloudWarning[];
 }
 
+/**
+ * `cleo cloud verify --deep` (T13291): the cloud copy downloaded again and
+ * checked byte for byte. Local backups are checked by `cleo backup verify`.
+ */
+export interface CloudVerifyDeepCheck {
+  /**
+   * The head snapshot and each device's newest snapshot: its bundle downloaded,
+   * checked against the size and sha256 its signed checkpoint records, and
+   * decrypted. `problem` says why a check failed; `null` when it passed.
+   */
+  snapshots: Array<{
+    checkpointId: string;
+    deviceId: string;
+    sizeBytes: number;
+    ok: boolean;
+    problem: string | null;
+  }>;
+  /**
+   * The journal segments after the head snapshot (from the start of the stream
+   * when there is none), each re-hashed, signature-checked and decrypted.
+   * `from` is the stream seq they start after; `checked` counts the segments
+   * that passed; `problem` is the first failure, `null` when none.
+   */
+  segments: { from: number; checked: number; ok: boolean; problem: string | null };
+}
+
 /** `cleo cloud verify`. */
 export interface CloudVerifyResult {
   apiUrl: string;
   scope: CloudVaultScope;
   streamId: string;
-  /** `match`: local equals the head snapshot; `ahead`: local changed since this machine's last snapshot; `behind`: the cloud has a newer snapshot; `diverged`: both; `empty`: no snapshot yet; `untrusted`: the head snapshot's signature does not verify against a trusted device key (nothing is compared with it). */
+  /** `match`: local equals the head snapshot; `ahead`: local changed since this machine's last snapshot; `behind`: the cloud has a newer snapshot; `diverged`: both; `empty`: no snapshot yet; `untrusted`: the head snapshot's signature does not verify against a trusted device key (nothing is compared with it), or with `--deep`, its bundle or a segment after it failed the byte check. */
   verdict: 'match' | 'ahead' | 'behind' | 'diverged' | 'empty' | 'untrusted';
   /** What to do about a verdict other than `match` (or a failed integrity check); `null` when nothing. */
   remedy: string | null;
@@ -222,6 +298,8 @@ export interface CloudVerifyResult {
     createdAt: string | null;
     matchesHead: boolean;
   }>;
+  /** The byte-level check of `--deep`; absent without it. */
+  deep?: CloudVerifyDeepCheck;
   warnings: CloudWarning[];
 }
 
@@ -278,3 +356,48 @@ export interface CloudActivityResult {
   nextBefore: string | null;
   warnings: CloudWarning[];
 }
+
+/** One conflict an apply recorded (`cleo cloud conflicts`, T12344 PR-6). */
+export interface CloudConflict {
+  id: number;
+  stream: string;
+  seq: number;
+  txnIdx: number;
+  /** Op index in the transaction; -1 for a whole-transaction (post-apply) conflict. */
+  opIdx: number;
+  /** `field`, `typed-rule`, `edit-vs-delete`, `delete-vs-edit`, `dangling-ref`, `guard`, `delete-with-live-children`, `uid-collision`, `post-apply` … */
+  kind: string;
+  table: string;
+  uid: string;
+  columns: string[];
+  /** The typed rule, guard message or invariant, when there is one. */
+  rule: string | null;
+  /** What happened to the incoming op: `incoming-applied`, `incoming-dropped`, `row-deleted`, `op-voided`. */
+  resolution: string;
+  opHlc: string;
+  localHlc: string | null;
+  /** The replica that wrote the op. */
+  origin: string;
+  createdAt: string;
+  resolvedAt: string | null;
+}
+
+/** `cleo cloud conflicts`: the store's recorded sync conflicts. */
+export interface CloudConflictsResult {
+  scope: CloudVaultScope;
+  /** Unresolved conflicts in the store. */
+  open: number;
+  /** All conflicts in the store. */
+  total: number;
+  conflicts: CloudConflict[];
+  warnings: CloudWarning[];
+}
+
+/** `cleo cloud conflicts resolve <id>`. */
+export interface CloudConflictResolveResult {
+  scope: CloudVaultScope;
+  id: number;
+  /** False when no open conflict has that id. */
+  resolved: boolean;
+  warnings: CloudWarning[];
+}

package/src/operations/admin.ts

@@ -108,6 +108,10 @@ export interface AdminBackupEntry {
   note?: string;
   /** File names captured in this backup. */
   files: string[];
+  /** Which store it is of: `project` (`.cleo/cleo.db`) or `global` (`<CLEO_HOME>/cleo.db`, T13245). */
+  scope?: 'project' | 'global';
+  /** What its store file holds: `tasks`, `brain`, `conduit` (project) or `global` (T13245). */
+  contains?: string[];
 }
 
 /**
@@ -1194,7 +1198,10 @@ export type AdminAdrShowResult = AdminAdrRecord;
 // ---------------------------------------------------------------------------
 
 /** Parameters for `admin.backup` query — none required. */
-export type AdminBackupListParams = Record<string, never>;
+export interface AdminBackupListParams {
+  /** `project`, `global` or `all` (default `all`; T13245). */
+  scope?: 'project' | 'global' | 'all';
+}
 
 /** Result of `admin.backup` query. */
 export interface AdminBackupListResult {
@@ -1653,6 +1660,10 @@ export interface AdminBackupMutateParams {
    * project's live store (T12680). Without it such a restore is refused.
    */
   confirmOwnerStore?: boolean;
+  /** Create: also back up the global store (`<CLEO_HOME>/cleo.db`, T13245). */
+  includeGlobal?: boolean;
+  /** Restore by id: `global` restores a backup of the global store (T13245). */
+  scope?: 'project' | 'global';
 }
 
 /** Result of `admin.backup` mutate (create action). */
@@ -1667,6 +1678,8 @@ export interface AdminBackupCreateResult {
   type: string;
   /** Files captured in the backup. */
   files: string[];
+  /** The global store's backup, when `includeGlobal` was set (T13245). */
+  global?: AdminBackupCreateResult | null;
 }
 
 /** Result of `admin.backup` mutate (restore action — by ID). */

package/src/operations/conduit.ts

@@ -97,7 +97,7 @@ export interface ConduitStatusResult {
 }
 
 // --------------------------------------------------------------------------
-// conduit.peek → one-shot poll for new messages (ACKs as it reads)
+// conduit.peek → one-shot poll for new messages (never acks or consumes, T13169)
 // --------------------------------------------------------------------------
 
 /** Parameters for `conduit.peek`. */

package/src/operations/docs-lifecycle.ts

@@ -0,0 +1,31 @@
+/**
+ * Lifecycle statuses of a canonical doc.
+ *
+ * A leaf module with no schema imports: the operation registry
+ * (`dispatch/operations-registry.ts`) and the dispatch input sanitizer read
+ * these on every command, and `./docs.js` imports zod for its payload schemas.
+ * `./docs.js` re-exports both names.
+ *
+ * @task T10161
+ * @task T13126 - split out of operations/docs.ts
+ */
+
+/**
+ * Allowed `lifecycle_status` values mirrored from the attachments-table enum
+ * (`ATTACHMENT_LIFECYCLE_STATUSES` in
+ * `packages/core/src/store/schema/attachments.ts`). Kept inline here so the
+ * contract surface stays self-contained — the dispatch handler narrows raw
+ * `--status` input against this set before touching the store.
+ *
+ * @task T10161 (Epic T10157 / Saga T9855)
+ */
+export const DOCS_LIFECYCLE_STATUSES = [
+  'draft',
+  'proposed',
+  'accepted',
+  'superseded',
+  'archived',
+  'deprecated',
+] as const;
+
+export type DocsLifecycleStatus = (typeof DOCS_LIFECYCLE_STATUSES)[number];

package/src/operations/docs.ts

@@ -39,6 +39,7 @@ import type {
   OperationExecutionIdentity,
 } from '../jobs.js';
 import type { DocAttachmentObservationPayload } from '../memory/observe.js';
+import type { DocsLifecycleStatus } from './docs-lifecycle.js';
 
 // ============================================================================
 // Shared Attachment Types (API wire format)
@@ -686,25 +687,9 @@ export interface DocsRemoveResult {
 // docs.update — UPDATE-in-place via slug (T10161)
 // --------------------------------------------------------------------------
 
-/**
- * Allowed `lifecycle_status` values mirrored from the attachments-table enum
- * (`ATTACHMENT_LIFECYCLE_STATUSES` in
- * `packages/core/src/store/schema/attachments.ts`). Kept inline here so the
- * contract surface stays self-contained — the dispatch handler narrows raw
- * `--status` input against this set before touching the store.
- *
- * @task T10161 (Epic T10157 / Saga T9855)
- */
-export const DOCS_LIFECYCLE_STATUSES = [
-  'draft',
-  'proposed',
-  'accepted',
-  'superseded',
-  'archived',
-  'deprecated',
-] as const;
-
-export type DocsLifecycleStatus = (typeof DOCS_LIFECYCLE_STATUSES)[number];
+// The lifecycle statuses live in `./docs-lifecycle.js`, a leaf without zod: the
+// operation registry reads them on every dispatch (T13126).
+export { DOCS_LIFECYCLE_STATUSES, type DocsLifecycleStatus } from './docs-lifecycle.js';
 
 /**
  * Parameters for `docs.update`.

package/src/project-context.ts

@@ -90,6 +90,13 @@ export interface ProjectEvidenceContext {
     /** Job-name globs that must have run and succeeded for a code task's gate. */
     jobs?: { tests?: string[]; qa?: string[] };
   };
+  /**
+   * Repo-relative paths or globs (`path.matchesGlob`, `**` crosses directories)
+   * that never count as part of a change when evidence decides its scope —
+   * runtime state a tool writes into the checkout, e.g. `.opencode/goals/**`.
+   * CLEO's own installed hook files are always excluded (T13135, gh#1805).
+   */
+  scopeExcludes?: string[];
 }
 
 /**

package/src/release/evidence-atoms.ts

@@ -136,26 +136,30 @@ export const ghPrViewSchema = z
 export type GhPrViewPayload = z.infer<typeof ghPrViewSchema>;
 
 /**
- * Default required-workflow names enforced by `pr:<number>` validation.
- *
- * Mirrors the canonical branch-protection list documented in
- * `docs/release/branch-protection-setup.md`. Override via
- * {@link PR_REQUIRED_WORKFLOWS_ENV_VAR} when projects deviate (e.g. an
- * out-of-tree consumer with different gating workflows).
+ * cleocode's OWN required-check names: the `CI` aggregate of its ci.yml and the
+ * `Contracts Dep Lint` job, both real check names there (T13285; a test pins
+ * every name to a job or workflow in cleocode's `.github/workflows/`).
+ *
+ * This is cleocode's configuration, not a library default for other
+ * repositories. Since gh#1323 the evidence path (`resolveRequiredWorkflowsDetailed`)
+ * never applies it to another repository: with no env override, no
+ * `release.prRequiredWorkflows` in `.cleo/project-context.json` and no readable
+ * branch protection it returns tier `unknown` and refuses loudly. Only the
+ * synchronous `resolveRequiredWorkflows` still returns it as its last tier.
+ * cleocode itself resolves through its project-context entry. (`Lockfile Check`
+ * was dropped: no check ever reported under that name — its job is
+ * "Verify pnpm-lock.yaml consistency" — and CI now covers it, T13279.)
  *
  * @task T9764
+ * @task T13285
  */
-export const PR_REQUIRED_WORKFLOWS: readonly string[] = Object.freeze([
-  'CI',
-  'Lockfile Check',
-  'Contracts Dep Lint',
-]);
+export const PR_REQUIRED_WORKFLOWS: readonly string[] = Object.freeze(['CI', 'Contracts Dep Lint']);
 
 /**
  * Name of the env var that overrides {@link PR_REQUIRED_WORKFLOWS}.
  *
  * Format: comma-separated workflow names (e.g.
- * `"CI,Lockfile Check,MyExtraGate"`). Whitespace around commas is
+ * `"CI,Contracts Dep Lint,MyExtraGate"`). Whitespace around commas is
  * trimmed.
  *
  * @task T9764

package/src/resource-governor.ts

@@ -88,6 +88,41 @@ export const RUN_DEFERRED_EXIT_CODE = 75;
  */
 export const RESOURCE_BACKPRESSURE_CODE = 'E_RESOURCE_BACKPRESSURE' as const;
 
+/**
+ * The numbers behind a memory-pressure refusal of a heavy class (T13127).
+ *
+ * The memory gate refuses `test-run`, `scoped-build` and `full-build` while
+ * memory pressure is above {@link MemoryPressureReading.refuseAbove}; once it
+ * has refused, it admits again only when pressure falls to
+ * {@link MemoryPressureReading.resumeAtOrBelow} (hysteresis), so admission
+ * does not flap at the threshold.
+ *
+ * @example
+ * ```ts
+ * const r: MemoryPressureReading = {
+ *   score: 31, fullStall: 0, refuseAbove: 25, resumeAtOrBelow: 15, latched: false,
+ *   memAvailableBytes: 21_000_000_000,
+ *   summary: 'kernel level warn; 59% of RAM wired or compressed; swap 11.4 GiB used (24% of RAM)',
+ * };
+ * ```
+ */
+export interface MemoryPressureReading {
+  /** Memory pressure on the PSI `some avg10` scale (0–100). */
+  readonly score: number;
+  /** Memory `full avg10` stall (0–100); 0 when the platform reports none. */
+  readonly fullStall: number;
+  /** Heavy classes are refused while {@link score} is above this. */
+  readonly refuseAbove: number;
+  /** A refusing gate admits again once {@link score} is at or below this. */
+  readonly resumeAtOrBelow: number;
+  /** `true` when the gate was already refusing, so the resume threshold applied. */
+  readonly latched: boolean;
+  /** Available memory in bytes, when the platform reports it. */
+  readonly memAvailableBytes: number | null;
+  /** The platform signals in one line (kernel level, swap, compressor, PSI). */
+  readonly summary: string;
+}
+
 /**
  * Structured, retryable deferral returned when admission is denied. Never a
  * silent drop; callers back off `retryAfterMs` and re-request, or annotate the
@@ -102,6 +137,11 @@ export interface ResourceDeferral {
   readonly retryAfterMs: number;
   /** Human-readable reason (pressure state, budget, held count). */
   readonly reason: string;
+  /**
+   * Set when the deferral is a memory-pressure refusal of a heavy class rather
+   * than a full budget: the readings behind it (T13127).
+   */
+  readonly memoryPressure?: MemoryPressureReading;
 }
 
 /**

package/src/row-identity.ts

@@ -130,3 +130,101 @@ export interface RowIdentitySpec {
   /** Task that declared the table. */
   readonly task: string;
 }
+
+/**
+ * One signal behind a store's row-identity share state (T13231).
+ *
+ * - `synced-marker`: `row_identity_synced` is set (a receive or a send happened);
+ * - `sync-flag`: `sync.seal`, `sync.push` or `sync.pull` is on;
+ * - `journal-rows`: a change-journal table holds rows (every `_sync_*` table
+ *   except `_sync_meta`, `_sync_replica` and `_sync_clock`; they key rows by uid);
+ * - `journal-meta`: `_sync_meta` holds `suspect:` or `baseline:` keys;
+ * - `identity-aliases`: an alias table holds rows (uids were re-keyed);
+ * - `rebound`: the store was copied, moved or restored (`_sync_replica`);
+ * - `vault-pushed`: a vault push or restore of this root is recorded locally;
+ * - `nexus-linked-no-vault`: linked to Cleo Nexus with no local vault record;
+ * - `nexus-checkpoint`: Cleo Nexus holds a checkpoint or journal segment of the project;
+ * - `nexus-unreachable`: Cleo Nexus could not be asked;
+ * - `unreadable`: a record needed for the verdict could not be read.
+ */
+export type RowIdentityShareSignalCode =
+  | 'synced-marker'
+  | 'sync-flag'
+  | 'journal-rows'
+  | 'journal-meta'
+  | 'identity-aliases'
+  | 'rebound'
+  | 'vault-pushed'
+  | 'nexus-linked-no-vault'
+  | 'nexus-checkpoint'
+  | 'nexus-unreachable'
+  | 'unreadable';
+
+/** One signal behind a share verdict (T13231). */
+export interface RowIdentityShareSignal {
+  readonly code: RowIdentityShareSignalCode;
+  /** `shared`: the uids may have left the store; `unknown`: that cannot be ruled out. */
+  readonly kind: 'shared' | 'unknown';
+  readonly detail: string;
+}
+
+/**
+ * Whether a store's row identity may have left it (T13231).
+ *
+ * - `shared`: its uids have, or may have, reached another store;
+ * - `unknown`: that cannot be ruled out;
+ * - `unshared`: provably local, so a from-scratch refill changes nothing any
+ *   other store holds.
+ */
+export interface RowIdentityShareState {
+  readonly state: 'shared' | 'unknown' | 'unshared';
+  /** Every signal that decided it (empty when unshared). */
+  readonly signals: readonly RowIdentityShareSignal[];
+  /** The signals' details, one line each (empty when unshared). */
+  readonly reasons: readonly string[];
+}
+
+/** What Cleo Nexus answered for one linked origin (`cleo doctor row-identity`, T13231). */
+export interface RowIdentityNexusAnswer {
+  readonly apiUrl: string;
+  readonly remoteProjectId: string;
+  readonly streamId: string;
+  /** `none`: no checkpoint and no journal segment; `present`: some; `error`: not answered. */
+  readonly answer: 'none' | 'present' | 'error';
+  readonly checkpoints: number;
+  readonly headSeq: number;
+  /** Why it was not answered (`error` only). */
+  readonly error?: string;
+}
+
+/** Rows whose identity a full refill re-derives, per table. */
+export type RowIdentityRefillCounts = Readonly<Record<string, number>>;
+
+/**
+ * `cleo doctor row-identity --refill`: the verdict, its evidence and the plan
+ * (T13231). `applied` is false on a dry run and on a refusal.
+ */
+export interface RowIdentityRefillReport {
+  readonly projectRoot: string;
+  /** Whether the store's recipe marker is current (no refill is due). */
+  readonly recipeCurrent: boolean;
+  /** Whether `CLEO_ROW_UID_FILL` is on in this process (`--apply` needs it). */
+  readonly fillEnabled: boolean;
+  /** The local verdict (link, vault state, journal state). */
+  readonly local: RowIdentityShareState;
+  /** Cleo Nexus, one answer per linked origin (empty when unlinked). */
+  readonly nexus: readonly RowIdentityNexusAnswer[];
+  /** The verdict with the Nexus answers folded in. */
+  readonly verdict: RowIdentityShareState;
+  /** Rows per declared table that carry an identity value the refill clears. */
+  readonly planned: RowIdentityRefillCounts;
+  /** `refill`: due and allowed; `none`: nothing to do; `refuse`: shared or unknown. */
+  readonly action: 'refill' | 'none' | 'refuse';
+  /** What to do next, one line each. */
+  readonly remedy: readonly string[];
+  readonly applied: boolean;
+  /** `--apply`: the pre-refill snapshot. */
+  readonly snapshot: string | null;
+  /** `--apply`: how to undo the refill. */
+  readonly undo: string | null;
+}

package/src/store-restore.ts

@@ -0,0 +1,70 @@
+/**
+ * `cleo restore backup --snapshot <file> | --id <backupId>`: restore the live
+ * project `cleo.db` (which holds the tasks AND brain tables) from a named
+ * snapshot or a backup id, safely (T13240).
+ *
+ * @task T13240
+ */
+
+/** Where the snapshot came from. */
+export interface StoreRestoreSource {
+  /** `snapshot`: a file named on the command line; `backup`: a backup id from `cleo backup list`. */
+  readonly kind: 'snapshot' | 'backup';
+  /** The file restored from (resolved, absolute). */
+  readonly path: string;
+  /** The backup id (`backup` only). */
+  readonly backupId: string | null;
+}
+
+/** What the snapshot verification found. */
+export interface StoreRestoreVerification {
+  /** `PRAGMA integrity_check` on a private copy of the snapshot: `ok`, or the first problems. */
+  readonly integrity: string;
+  /** Tasks in the snapshot (`tasks_tasks`). */
+  readonly tasks: number;
+  readonly sizeBytes: number;
+}
+
+/** The live store file that was replaced, kept so the restore can be undone. */
+export interface StoreRestoreKept {
+  /** Backup id the kept file is listed under (`cleo backup list`), restorable with `--id`. */
+  readonly backupId: string;
+  /** The kept store file. */
+  readonly path: string;
+  /** Whether the live WAL was folded into the kept file (otherwise its raw sidecars are kept beside it). */
+  readonly checkpointed: boolean;
+  /** Raw sidecar copies kept beside it (`-wal`, `-shm`, `-journal`), when not checkpointed. */
+  readonly sidecars: readonly string[];
+}
+
+/** Result of a store restore (or its dry run). */
+export interface StoreRestoreResult {
+  readonly dryRun: boolean;
+  /** `project` (`.cleo/cleo.db`) or `global` (`<CLEO_HOME>/cleo.db`, T13245). */
+  readonly scope: 'project' | 'global';
+  readonly restored: boolean;
+  /** The live store file. */
+  readonly target: string;
+  readonly source: StoreRestoreSource;
+  readonly verification: StoreRestoreVerification;
+  /** The replaced store, kept (`null` on a dry run, or when there was no live store). */
+  readonly kept: StoreRestoreKept | null;
+  /** Live-file sidecars removed so the restored file is not read with the old journal. */
+  readonly removedSidecars: readonly string[];
+  /** How to undo the restore (`null` on a dry run, or when nothing was replaced). */
+  readonly undo: string | null;
+}
+
+/**
+ * `cleo backup recover tasks|brain|conduit`: the freshest valid snapshot of the
+ * project store, restored through the same safe path as `cleo restore backup`
+ * (T13245). All three roles name the one live file, `.cleo/cleo.db`.
+ */
+export interface StoreRecoverResult extends StoreRestoreResult {
+  /** The role asked for (`tasks`, `brain` or `conduit`); the store restored is `cleo.db` either way. */
+  readonly role: string;
+  /** Snapshots that failed `PRAGMA quick_check` before one passed (newest first). */
+  readonly rejected: readonly string[];
+  /** Hours between the chosen snapshot and now, or `null` when its time is unknown. */
+  readonly dataLossWindowHours: number | null;
+}

package/src/task.ts

@@ -540,6 +540,12 @@ export type EvidenceAtom =
        * vouches for a PR that was not itself green.
        */
       descendantPrHeadSha?: string;
+      /**
+       * The PR edited a pinned workflow, so only default-branch `push` runs
+       * attested it; its own `pull_request` runs (which ran the edited
+       * workflow) were never consulted, and none is re-checked (T13174).
+       */
+      mainOnly?: boolean;
       /** Task the PR was verified to be linked to (T12634). */
       taskId?: string;
       /** Component PR the task is linked through; its CI ran as this integration PR's (T12671). */