@cleocode/core 2026.10.1 → 2026.10.3

package/migrations/drizzle-cleo-project/20260930170000_t12819-trigger-suspend-clause/migration.sql

@@ -0,0 +1,367 @@
+-- T12819 (C2) — the trigger-suspension flag table, and the owned guard and
+-- side-effect triggers rewritten with its WHEN clause. Journal spec
+-- t12342-t12343-journal-design §3.5 Rule 4 and §2.3a rules 4, 9 and 10.
+--
+-- cleo_trigger_suspend(scope) is a flag table in MAIN. A frame that must run
+-- with a class of triggers off inserts a scope row inside its own transaction
+-- and deletes it before COMMIT. Under WAL no other connection sees the
+-- uncommitted row, so everyone else keeps every trigger. A crash rolls the row
+-- back, and the open pass asserts the table is empty.
+--
+-- The table is schema-owned and never dropped (not a _sync_ table): the
+-- triggers below read it, so writes to tasks, sessions and acceptance
+-- criteria, and any ALTER ... RENAME (which re-validates every trigger), need
+-- it. The open pass also creates it, IF NOT EXISTS, before migrations.
+--
+-- Each owned trigger keeps its original text and gains
+--   NOT EXISTS (SELECT 1 FROM cleo_trigger_suspend WHERE scope IN (<class>, all))
+-- ANDed with its own WHEN. The table name is deliberately unqualified: a
+-- persistent trigger resolves it in its own schema, so the trigger keeps
+-- working when the store is ATTACHed under another name (exodus, backup).
+-- A `main.` qualifier makes such a schema unreadable.
+-- Released files that first created these triggers
+-- (t11884, t12502, t12736, t12886) are never edited; this file replaces the
+-- triggers. It is dated after t12886 (the dependency cycle guard, 9.26) so
+-- that file stays a released, pre-clause migration.
+-- The T12341 AC graveyard trigger is owned too, but its DDL lives in code
+-- (store/sync/trigger-classes.ts): a store whose t12341 migration was
+-- probe-stamped has no graveyard TABLE, and creating the trigger here would
+-- make every acceptance-criterion delete fail. The open pass installs it
+-- only where its table exists.
+-- The ownership map lives in packages/core/src/store/sync/trigger-classes.ts.
+--
+-- Idempotent (CREATE TABLE IF NOT EXISTS; DROP TRIGGER IF EXISTS before each
+-- CREATE), and must always RUN: reconcileJournal never probe-stamps it.
+-- cleo:probe-never-stamp
+--
+-- @task T12819
+-- @epic T12323
+
+CREATE TABLE IF NOT EXISTS `cleo_trigger_suspend` (
+  `scope` TEXT PRIMARY KEY NOT NULL CHECK (`scope` IN ('capture', 'guard', 'side-effect', 'all'))
+);
+--> statement-breakpoint
+DROP TRIGGER IF EXISTS `tasks_tasks_parent_cycle_guard_insert`;
+--> statement-breakpoint
+CREATE TRIGGER `tasks_tasks_parent_cycle_guard_insert`
+BEFORE INSERT ON `tasks_tasks`
+WHEN (NEW.`parent_id` IS NOT NULL)
+  AND NOT EXISTS (SELECT 1 FROM cleo_trigger_suspend WHERE scope IN ('guard', 'all'))
+BEGIN
+  SELECT RAISE(ABORT, 'E_TASK_PARENT_CYCLE: tasks.parent_id cannot create a containment cycle')
+  WHERE EXISTS (
+    WITH RECURSIVE ancestors(`id`, `parent_id`) AS (
+      SELECT parent.`id`, parent.`parent_id`
+      FROM `tasks_tasks` parent
+      WHERE parent.`id` = NEW.`parent_id`
+      UNION ALL
+      SELECT next_parent.`id`, next_parent.`parent_id`
+      FROM `tasks_tasks` next_parent
+      JOIN ancestors ON next_parent.`id` = ancestors.`parent_id`
+      WHERE ancestors.`parent_id` IS NOT NULL
+    )
+    SELECT 1 FROM ancestors WHERE ancestors.`id` = NEW.`id`
+  );
+END;
+--> statement-breakpoint
+DROP TRIGGER IF EXISTS `tasks_tasks_parent_cycle_guard_update`;
+--> statement-breakpoint
+CREATE TRIGGER `tasks_tasks_parent_cycle_guard_update`
+BEFORE UPDATE OF `parent_id` ON `tasks_tasks`
+WHEN (NEW.`parent_id` IS NOT NULL)
+  AND NOT EXISTS (SELECT 1 FROM cleo_trigger_suspend WHERE scope IN ('guard', 'all'))
+BEGIN
+  SELECT RAISE(ABORT, 'E_TASK_PARENT_CYCLE: tasks.parent_id cannot create a containment cycle')
+  WHERE EXISTS (
+    WITH RECURSIVE ancestors(`id`, `parent_id`) AS (
+      SELECT parent.`id`, parent.`parent_id`
+      FROM `tasks_tasks` parent
+      WHERE parent.`id` = NEW.`parent_id`
+      UNION ALL
+      SELECT next_parent.`id`, next_parent.`parent_id`
+      FROM `tasks_tasks` next_parent
+      JOIN ancestors ON next_parent.`id` = ancestors.`parent_id`
+      WHERE ancestors.`parent_id` IS NOT NULL
+    )
+    SELECT 1 FROM ancestors WHERE ancestors.`id` = NEW.`id`
+  );
+END;
+--> statement-breakpoint
+DROP TRIGGER IF EXISTS `tasks_tasks_parent_type_matrix_insert`;
+--> statement-breakpoint
+CREATE TRIGGER `tasks_tasks_parent_type_matrix_insert`
+BEFORE INSERT ON `tasks_tasks`
+WHEN (NEW.`parent_id` IS NOT NULL
+  AND NEW.`type` IS NOT NULL
+  AND EXISTS (SELECT 1 FROM `tasks_tasks` parent WHERE parent.`id` = NEW.`parent_id` AND parent.`type` IS NOT NULL)
+  AND NOT EXISTS (
+    SELECT 1
+    FROM `tasks_tasks` parent
+    WHERE parent.`id` = NEW.`parent_id`
+      AND (
+        (NEW.`type` = 'epic'  AND parent.`type` = 'saga')
+        OR (NEW.`type` = 'task'   AND parent.`type` = 'epic')
+        OR (NEW.`type` = 'subtask' AND parent.`type` IN ('epic', 'task'))
+      )
+  ))
+  AND NOT EXISTS (SELECT 1 FROM cleo_trigger_suspend WHERE scope IN ('guard', 'all'))
+BEGIN
+  SELECT RAISE(ABORT, 'E_TASK_PARENT_TYPE_MATRIX: tasks.parent_id must follow saga->epic, epic->task|subtask, and task->subtask; sagas/tasks must be roots');
+END;
+--> statement-breakpoint
+DROP TRIGGER IF EXISTS `tasks_tasks_parent_type_matrix_update`;
+--> statement-breakpoint
+CREATE TRIGGER `tasks_tasks_parent_type_matrix_update`
+BEFORE UPDATE OF `parent_id`, `type` ON `tasks_tasks`
+WHEN (NEW.`parent_id` IS NOT NULL
+  AND NEW.`type` IS NOT NULL
+  AND EXISTS (SELECT 1 FROM `tasks_tasks` parent WHERE parent.`id` = NEW.`parent_id` AND parent.`type` IS NOT NULL)
+  AND NOT EXISTS (
+    SELECT 1
+    FROM `tasks_tasks` parent
+    WHERE parent.`id` = NEW.`parent_id`
+      AND (
+        (NEW.`type` = 'epic'  AND parent.`type` = 'saga')
+        OR (NEW.`type` = 'task'   AND parent.`type` = 'epic')
+        OR (NEW.`type` = 'subtask' AND parent.`type` IN ('epic', 'task'))
+      )
+  ))
+  AND NOT EXISTS (SELECT 1 FROM cleo_trigger_suspend WHERE scope IN ('guard', 'all'))
+BEGIN
+  SELECT RAISE(ABORT, 'E_TASK_PARENT_TYPE_MATRIX: tasks.parent_id must follow saga->epic, epic->task|subtask, and task->subtask; sagas/tasks must be roots');
+END;
+--> statement-breakpoint
+DROP TRIGGER IF EXISTS `trg_tasks_tasks_status_pipeline_insert`;
+--> statement-breakpoint
+CREATE TRIGGER `trg_tasks_tasks_status_pipeline_insert`
+BEFORE INSERT ON `tasks_tasks`
+FOR EACH ROW
+WHEN ((NEW.`status` = 'done'      AND (NEW.`pipeline_stage` IS NULL OR NEW.`pipeline_stage` NOT IN ('contribution','cancelled')))
+  OR (NEW.`status` = 'cancelled' AND (NEW.`pipeline_stage` IS NULL OR NEW.`pipeline_stage` != 'cancelled')))
+  AND NOT EXISTS (SELECT 1 FROM cleo_trigger_suspend WHERE scope IN ('guard', 'all'))
+BEGIN
+  SELECT RAISE(ABORT, 'T877_INVARIANT_VIOLATION: status/pipeline_stage mismatch. status=done requires pipeline_stage IN (contribution,cancelled); status=cancelled requires pipeline_stage=cancelled.');
+END;
+--> statement-breakpoint
+DROP TRIGGER IF EXISTS `trg_tasks_tasks_status_pipeline_update`;
+--> statement-breakpoint
+CREATE TRIGGER `trg_tasks_tasks_status_pipeline_update`
+BEFORE UPDATE OF `status`, `pipeline_stage` ON `tasks_tasks`
+FOR EACH ROW
+WHEN ((NEW.`status` = 'done'      AND (NEW.`pipeline_stage` IS NULL OR NEW.`pipeline_stage` NOT IN ('contribution','cancelled')))
+  OR (NEW.`status` = 'cancelled' AND (NEW.`pipeline_stage` IS NULL OR NEW.`pipeline_stage` != 'cancelled')))
+  AND NOT EXISTS (SELECT 1 FROM cleo_trigger_suspend WHERE scope IN ('guard', 'all'))
+BEGIN
+  SELECT RAISE(ABORT, 'T877_INVARIANT_VIOLATION: status/pipeline_stage mismatch. status=done requires pipeline_stage IN (contribution,cancelled); status=cancelled requires pipeline_stage=cancelled.');
+END;
+--> statement-breakpoint
+DROP TRIGGER IF EXISTS `tasks_task_relations_non_containment_insert`;
+--> statement-breakpoint
+CREATE TRIGGER `tasks_task_relations_non_containment_insert`
+BEFORE INSERT ON `tasks_task_relations`
+WHEN (EXISTS (
+  SELECT 1
+  FROM `tasks_tasks` child
+  WHERE child.`id` = NEW.`task_id`
+    AND child.`parent_id` = NEW.`related_to`
+) OR EXISTS (
+  SELECT 1
+  FROM `tasks_tasks` child
+  WHERE child.`id` = NEW.`related_to`
+    AND child.`parent_id` = NEW.`task_id`
+))
+  AND NOT EXISTS (SELECT 1 FROM cleo_trigger_suspend WHERE scope IN ('guard', 'all'))
+BEGIN
+  SELECT RAISE(ABORT, 'E_TASK_RELATION_CONTAINMENT: task_relations is non-containment-only; use tasks.parent_id for parent/child edges');
+END;
+--> statement-breakpoint
+DROP TRIGGER IF EXISTS `tasks_task_relations_non_containment_update`;
+--> statement-breakpoint
+CREATE TRIGGER `tasks_task_relations_non_containment_update`
+BEFORE UPDATE OF `task_id`, `related_to` ON `tasks_task_relations`
+WHEN (EXISTS (
+  SELECT 1
+  FROM `tasks_tasks` child
+  WHERE child.`id` = NEW.`task_id`
+    AND child.`parent_id` = NEW.`related_to`
+) OR EXISTS (
+  SELECT 1
+  FROM `tasks_tasks` child
+  WHERE child.`id` = NEW.`related_to`
+    AND child.`parent_id` = NEW.`task_id`
+))
+  AND NOT EXISTS (SELECT 1 FROM cleo_trigger_suspend WHERE scope IN ('guard', 'all'))
+BEGIN
+  SELECT RAISE(ABORT, 'E_TASK_RELATION_CONTAINMENT: task_relations is non-containment-only; use tasks.parent_id for parent/child edges');
+END;
+--> statement-breakpoint
+DROP TRIGGER IF EXISTS `tasks_task_acceptance_child_target_insert`;
+--> statement-breakpoint
+CREATE TRIGGER `tasks_task_acceptance_child_target_insert`
+BEFORE INSERT ON `tasks_task_acceptance_criteria`
+WHEN (NEW.`target_task_id` IS NOT NULL
+  AND (
+    NEW.`kind` <> 'child_task'
+    OR NOT EXISTS (
+      SELECT 1
+      FROM `tasks_tasks` child
+      WHERE child.`id` = NEW.`target_task_id`
+        AND child.`parent_id` = NEW.`task_id`
+    )
+  ))
+  AND NOT EXISTS (SELECT 1 FROM cleo_trigger_suspend WHERE scope IN ('guard', 'all'))
+BEGIN
+  SELECT RAISE(ABORT, 'E_CHILD_TASK_TARGET_CONTAINMENT: child_task acceptance target_task_id must be a direct child of task_id; non-child_task criteria must not set target_task_id');
+END;
+--> statement-breakpoint
+DROP TRIGGER IF EXISTS `tasks_task_acceptance_child_target_update`;
+--> statement-breakpoint
+CREATE TRIGGER `tasks_task_acceptance_child_target_update`
+BEFORE UPDATE OF `task_id`, `kind`, `target_task_id` ON `tasks_task_acceptance_criteria`
+WHEN (NEW.`target_task_id` IS NOT NULL
+  AND (
+    NEW.`kind` <> 'child_task'
+    OR NOT EXISTS (
+      SELECT 1
+      FROM `tasks_tasks` child
+      WHERE child.`id` = NEW.`target_task_id`
+        AND child.`parent_id` = NEW.`task_id`
+    )
+  ))
+  AND NOT EXISTS (SELECT 1 FROM cleo_trigger_suspend WHERE scope IN ('guard', 'all'))
+BEGIN
+  SELECT RAISE(ABORT, 'E_CHILD_TASK_TARGET_CONTAINMENT: child_task acceptance target_task_id must be a direct child of task_id; non-child_task criteria must not set target_task_id');
+END;
+--> statement-breakpoint
+DROP TRIGGER IF EXISTS `trg_tasks_session_handoff_no_update`;
+--> statement-breakpoint
+CREATE TRIGGER `trg_tasks_session_handoff_no_update`
+BEFORE UPDATE ON `tasks_session_handoff_entries`
+FOR EACH ROW
+WHEN NOT EXISTS (SELECT 1 FROM cleo_trigger_suspend WHERE scope IN ('guard', 'all'))
+BEGIN
+  SELECT RAISE(
+    ABORT,
+    'T1609_HANDOFF_IMMUTABLE: session_handoff_entries rows are write-once. Use persistHandoff() exactly once per session.'
+  );
+END;
+--> statement-breakpoint
+DROP TRIGGER IF EXISTS `tasks_tasks_lease_iso_insert`;
+--> statement-breakpoint
+CREATE TRIGGER `tasks_tasks_lease_iso_insert`
+BEFORE INSERT ON `tasks_tasks`
+WHEN ((NEW.`claimed_at` IS NOT NULL AND NEW.`claimed_at` NOT GLOB '[0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9]*')
+  OR (NEW.`lease_expires_at` IS NOT NULL AND NEW.`lease_expires_at` NOT GLOB '[0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9]*'))
+  AND NOT EXISTS (SELECT 1 FROM cleo_trigger_suspend WHERE scope IN ('guard', 'all'))
+BEGIN
+  SELECT RAISE(ABORT, 'tasks_tasks.claimed_at and lease_expires_at must be ISO-8601 timestamps (T12736)');
+END;
+--> statement-breakpoint
+DROP TRIGGER IF EXISTS `tasks_tasks_lease_iso_update`;
+--> statement-breakpoint
+CREATE TRIGGER `tasks_tasks_lease_iso_update`
+BEFORE UPDATE OF `claimed_at`, `lease_expires_at` ON `tasks_tasks`
+WHEN ((NEW.`claimed_at` IS NOT NULL AND NEW.`claimed_at` NOT GLOB '[0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9]*')
+  OR (NEW.`lease_expires_at` IS NOT NULL AND NEW.`lease_expires_at` NOT GLOB '[0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9]*'))
+  AND NOT EXISTS (SELECT 1 FROM cleo_trigger_suspend WHERE scope IN ('guard', 'all'))
+BEGIN
+  SELECT RAISE(ABORT, 'tasks_tasks.claimed_at and lease_expires_at must be ISO-8601 timestamps (T12736)');
+END;
+--> statement-breakpoint
+DROP TRIGGER IF EXISTS `trg_tasks_session_handoff_mirror`;
+--> statement-breakpoint
+CREATE TRIGGER `trg_tasks_session_handoff_mirror`
+AFTER INSERT ON `tasks_session_handoff_entries`
+FOR EACH ROW
+WHEN NOT EXISTS (SELECT 1 FROM cleo_trigger_suspend WHERE scope IN ('side-effect', 'all'))
+BEGIN
+  UPDATE `tasks_sessions`
+     SET `handoff_json` = NEW.handoff_json
+   WHERE `id` = NEW.session_id;
+END;
+--> statement-breakpoint
+DROP TRIGGER IF EXISTS `tasks_sessions_release_claims_on_end`;
+--> statement-breakpoint
+CREATE TRIGGER `tasks_sessions_release_claims_on_end`
+AFTER UPDATE OF `status` ON `tasks_sessions`
+WHEN (NEW.`status` IN ('ended', 'orphaned'))
+  AND NOT EXISTS (SELECT 1 FROM cleo_trigger_suspend WHERE scope IN ('side-effect', 'all'))
+BEGIN
+  UPDATE `tasks_tasks`
+     SET `claimed_by_session` = NULL, `claimed_by_agent` = NULL,
+         `claimed_at` = NULL, `lease_expires_at` = NULL
+   WHERE `claimed_by_session` = NEW.`id`;
+END;
+--> statement-breakpoint
+DROP TRIGGER IF EXISTS `tasks_sessions_release_claims_on_delete`;
+--> statement-breakpoint
+CREATE TRIGGER `tasks_sessions_release_claims_on_delete`
+AFTER DELETE ON `tasks_sessions`
+WHEN NOT EXISTS (SELECT 1 FROM cleo_trigger_suspend WHERE scope IN ('side-effect', 'all'))
+BEGIN
+  UPDATE `tasks_tasks`
+     SET `claimed_by_session` = NULL, `claimed_by_agent` = NULL,
+         `claimed_at` = NULL, `lease_expires_at` = NULL
+   WHERE `claimed_by_session` = OLD.`id`;
+END;
+--> statement-breakpoint
+DROP TRIGGER IF EXISTS `tasks_tasks_release_claim_on_terminal`;
+--> statement-breakpoint
+CREATE TRIGGER `tasks_tasks_release_claim_on_terminal`
+AFTER UPDATE OF `status` ON `tasks_tasks`
+WHEN (NEW.`status` IN ('done', 'cancelled', 'archived') AND NEW.`claimed_by_session` IS NOT NULL)
+  AND NOT EXISTS (SELECT 1 FROM cleo_trigger_suspend WHERE scope IN ('side-effect', 'all'))
+BEGIN
+  UPDATE `tasks_tasks`
+     SET `claimed_by_session` = NULL, `claimed_by_agent` = NULL,
+         `claimed_at` = NULL, `lease_expires_at` = NULL
+   WHERE `id` = NEW.`id`;
+END;
+--> statement-breakpoint
+DROP TRIGGER IF EXISTS `tasks_task_dependencies_cycle_guard_insert`;
+--> statement-breakpoint
+CREATE TRIGGER `tasks_task_dependencies_cycle_guard_insert`
+BEFORE INSERT ON `tasks_task_dependencies`
+WHEN (NOT EXISTS (
+  SELECT 1
+  FROM `tasks_task_dependencies` existing
+  WHERE existing.`task_id` = NEW.`task_id`
+    AND existing.`depends_on` = NEW.`depends_on`
+))
+  AND NOT EXISTS (SELECT 1 FROM cleo_trigger_suspend WHERE scope IN ('guard', 'all'))
+BEGIN
+  SELECT RAISE(ABORT, 'E_TASK_DEPENDENCY_CYCLE: tasks_task_dependencies edge would close a dependency cycle (a task cannot depend on itself or on a task that already depends on it)')
+  WHERE NEW.`task_id` = NEW.`depends_on`
+    OR EXISTS (
+      WITH RECURSIVE reachable(`id`) AS (
+        SELECT NEW.`depends_on`
+        UNION
+        SELECT dep.`depends_on`
+        FROM `tasks_task_dependencies` dep
+        JOIN reachable ON dep.`task_id` = reachable.`id`
+      )
+      SELECT 1 FROM reachable WHERE reachable.`id` = NEW.`task_id`
+    );
+END;
+--> statement-breakpoint
+DROP TRIGGER IF EXISTS `tasks_task_dependencies_cycle_guard_update`;
+--> statement-breakpoint
+CREATE TRIGGER `tasks_task_dependencies_cycle_guard_update`
+BEFORE UPDATE OF `task_id`, `depends_on` ON `tasks_task_dependencies`
+WHEN (NEW.`task_id` IS NOT OLD.`task_id` OR NEW.`depends_on` IS NOT OLD.`depends_on`)
+  AND NOT EXISTS (SELECT 1 FROM cleo_trigger_suspend WHERE scope IN ('guard', 'all'))
+BEGIN
+  SELECT RAISE(ABORT, 'E_TASK_DEPENDENCY_CYCLE: tasks_task_dependencies edge would close a dependency cycle (a task cannot depend on itself or on a task that already depends on it)')
+  WHERE NEW.`task_id` = NEW.`depends_on`
+    OR EXISTS (
+      WITH RECURSIVE reachable(`id`) AS (
+        SELECT NEW.`depends_on`
+        UNION
+        SELECT dep.`depends_on`
+        FROM `tasks_task_dependencies` dep
+        JOIN reachable ON dep.`task_id` = reachable.`id`
+        WHERE NOT (dep.`task_id` = OLD.`task_id` AND dep.`depends_on` = OLD.`depends_on`)
+      )
+      SELECT 1 FROM reachable WHERE reachable.`id` = NEW.`task_id`
+    );
+END;

package/migrations/sync-journal/20260930120000_t12343-capture/migration.sql

@@ -0,0 +1,47 @@
+-- T12343 — change journal (S2): the capture outbox, transaction frames and the
+-- undo log. Journal spec t12342-t12343-journal-design §2.3 and §3.5 Rule 2.
+--
+-- Applied lazily by packages/core/src/store/sync/schema.ts when a sync.* flag
+-- is first enabled (never at open with every flag off); journaled in
+-- _sync_meta by sha256, never in __drizzle_migrations. All tables are
+-- local-only. Capture triggers (_sync_cap_*) are generated per table by the
+-- open pass (store/sync/capture.ts) and are never part of any migration.
+--
+-- @task T12343
+
+CREATE TABLE IF NOT EXISTS _sync_capture (
+  seq    INTEGER PRIMARY KEY AUTOINCREMENT,
+  tbl    TEXT NOT NULL,
+  op     TEXT NOT NULL CHECK (op IN ('I', 'U', 'D', 'K')),
+  rk     TEXT NOT NULL,
+  uid    TEXT,
+  img    TEXT NOT NULL,
+  at_ms  INTEGER NOT NULL,
+  conn   TEXT,
+  frame  TEXT,
+  kind   TEXT,
+  state  TEXT NOT NULL DEFAULT 'live' CHECK (state IN ('live', 'inherited', 'folded'))
+);
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS _sync_capture_frame ON _sync_capture (frame) WHERE frame IS NOT NULL;
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS _sync_capture_key ON _sync_capture (tbl, rk, op);
+--> statement-breakpoint
+CREATE TABLE IF NOT EXISTS _sync_frame (
+  frame     TEXT PRIMARY KEY,
+  kind      TEXT NOT NULL,
+  actor     TEXT,
+  first_seq INTEGER
+) WITHOUT ROWID;
+--> statement-breakpoint
+CREATE TABLE IF NOT EXISTS _sync_undo (
+  seq         INTEGER PRIMARY KEY,
+  txn_local   TEXT,
+  kind        TEXT,
+  tbl         TEXT NOT NULL,
+  rk          TEXT NOT NULL,
+  uid         TEXT,
+  op          TEXT NOT NULL,
+  before_full TEXT,
+  after_full  TEXT
+);

package/migrations/sync-journal/20261001170000_t12984-sealer/migration.sql

@@ -0,0 +1,101 @@
+-- T12984 (S3a) — the sealer's outbox and row metadata. Journal spec
+-- t12342-t12343-journal-design §1.6, §2.5, §2.6, §4.3.
+--
+-- _sync_txn / _sync_op: sealed transactions and their ops, in local commit
+-- order. `local_seq` is this replica's transaction counter; `txn` is
+-- `<replica>:<local_seq>` (§2.6). The counter is persisted in
+-- _sync_meta ('sealer.local_seq') and only ever rises, so a txn id is never
+-- reused after old rows are collected. `state`: sealed -> segmented when a
+-- persisted segment carries the transaction (S4); `inherited` for rows a
+-- copied store carries from its original replica (§1.5); `folded` for
+-- transactions at or below a stream's genesis cut (§2.11 §10). `unframed`
+-- marks a singleton sealed from a capture with no validated frame (ruling (c));
+-- `partial` a frame sealed without a capture the sealer had to quarantine
+-- (T13041).
+--
+-- _sync_row_meta: per-row replication metadata (§1.6). Local-only; travels
+-- inside checkpoint bundles (shash stripped). `bfp` is a minted row's
+-- birth_fp, kept across a delete or re-key so every op carries it (T13030). `_sync_row_meta_tomb` indexes
+-- FULL tombstones only (version > 0), the ones GC scans by HLC; a compacted
+-- minimal tombstone (version 0, §1.7) is found by its key and needs no index
+-- entry, which keeps it near the spec's ~190 B (T12986 measured ~155 B).
+--
+-- _sync_ledger: per sync-set table, the sealed row count (`live`) and the
+-- rows a rebase holds unreplayed (`held`, §3.5 Rule 5). The ledger check
+-- (§4.3) compares count(*) + held with it.
+--
+-- _sync_quarantine: captures the sealer could not read (a table that left
+-- the sync set, a malformed image), moved out of the outbox so they never
+-- stall it (T13036). A table with rows here is suspect: S3d's repair diff
+-- re-derives it, and `cleo doctor` reports it.
+--
+-- Do not edit this file once applied: its hash is recorded per store.
+-- (Unreleased until #1779 merges. It was edited during review; a dev or
+-- Gate B scratch store that applied an earlier text fails with
+-- E_SYNC_SCHEMA_HASH_DRIFT: reset it with dropSyncMachinery, or recreate it.)
+CREATE TABLE IF NOT EXISTS _sync_txn (
+  txn          TEXT PRIMARY KEY,
+  local_seq    INTEGER NOT NULL UNIQUE,
+  replica      TEXT NOT NULL,
+  hlc          TEXT NOT NULL,
+  scope        TEXT NOT NULL CHECK (scope IN ('project', 'global')),
+  via          TEXT NOT NULL,
+  kind         TEXT NOT NULL,
+  actor        TEXT,
+  frame        TEXT,
+  unframed     INTEGER NOT NULL DEFAULT 0,
+  partial      INTEGER NOT NULL DEFAULT 0,
+  op_count     INTEGER NOT NULL,
+  state        TEXT NOT NULL DEFAULT 'sealed'
+               CHECK (state IN ('sealed', 'segmented', 'inherited', 'folded')),
+  sealed_at_ms INTEGER NOT NULL
+) WITHOUT ROWID;
+CREATE INDEX IF NOT EXISTS _sync_txn_state ON _sync_txn (state, local_seq);
+CREATE TABLE IF NOT EXISTS _sync_op (
+  txn  TEXT NOT NULL,
+  idx  INTEGER NOT NULL,
+  tbl  TEXT NOT NULL,
+  uid  TEXT NOT NULL,
+  o    TEXT NOT NULL CHECK (o IN ('I', 'U', 'D', 'K')),
+  hlc  TEXT NOT NULL,
+  body TEXT NOT NULL,
+  PRIMARY KEY (txn, idx)
+) WITHOUT ROWID;
+CREATE INDEX IF NOT EXISTS _sync_op_row ON _sync_op (tbl, uid);
+CREATE TABLE IF NOT EXISTS _sync_row_meta (
+  tbl         TEXT NOT NULL,
+  uid         TEXT NOT NULL,
+  hlc         TEXT NOT NULL,
+  fhlc        TEXT,
+  origin      TEXT NOT NULL,
+  actor       TEXT,
+  version     INTEGER NOT NULL,
+  deleted     INTEGER NOT NULL DEFAULT 0,
+  key_json    TEXT,
+  sent        INTEGER NOT NULL DEFAULT 0,
+  fk_excluded INTEGER NOT NULL DEFAULT 0,
+  held        INTEGER NOT NULL DEFAULT 0,
+  chash       TEXT,
+  shash       TEXT,
+  bfp         TEXT,
+  PRIMARY KEY (tbl, uid)
+) WITHOUT ROWID;
+CREATE INDEX IF NOT EXISTS _sync_row_meta_tomb ON _sync_row_meta (hlc) WHERE deleted = 1 AND version > 0;
+CREATE TABLE IF NOT EXISTS _sync_ledger (
+  tbl  TEXT PRIMARY KEY,
+  live INTEGER NOT NULL,
+  held INTEGER NOT NULL DEFAULT 0
+) WITHOUT ROWID;
+CREATE TABLE IF NOT EXISTS _sync_quarantine (
+  seq               INTEGER PRIMARY KEY,
+  tbl               TEXT NOT NULL,
+  op                TEXT NOT NULL,
+  rk                TEXT NOT NULL,
+  uid               TEXT,
+  img               TEXT NOT NULL,
+  at_ms             INTEGER NOT NULL,
+  frame             TEXT,
+  reason            TEXT NOT NULL,
+  quarantined_at_ms INTEGER NOT NULL
+);
+CREATE INDEX IF NOT EXISTS _sync_quarantine_tbl ON _sync_quarantine (tbl);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cleocode/core",
-  "version": "2026.10.1",
+  "version": "2026.10.3",
   "description": "CLEO core business logic kernel — tasks, sessions, memory, orchestration, lifecycle, with bundled SQLite store",
   "type": "module",
   "main": "./dist/index.js",
@@ -491,16 +491,16 @@
     "write-file-atomic": "^7.0.1",
     "yaml": "^2.8.3",
     "zod": "^4.3.6",
-    "@cleocode/adapters": "2026.10.1",
-    "@cleocode/agents": "2026.10.1",
-    "@cleocode/caamp": "2026.10.1",
-    "@cleocode/contracts": "2026.10.1",
-    "@cleocode/git-shim": "2026.10.1",
-    "@cleocode/lafs": "2026.10.1",
-    "@cleocode/nexus": "2026.10.1",
-    "@cleocode/paths": "2026.10.1",
-    "@cleocode/skills": "2026.10.1",
-    "@cleocode/worktree": "2026.10.1"
+    "@cleocode/agents": "2026.10.3",
+    "@cleocode/adapters": "2026.10.3",
+    "@cleocode/caamp": "2026.10.3",
+    "@cleocode/contracts": "2026.10.3",
+    "@cleocode/git-shim": "2026.10.3",
+    "@cleocode/lafs": "2026.10.3",
+    "@cleocode/nexus": "2026.10.3",
+    "@cleocode/paths": "2026.10.3",
+    "@cleocode/skills": "2026.10.3",
+    "@cleocode/worktree": "2026.10.3"
   },
   "engines": {
     "node": ">=24.16.0"
@@ -526,7 +526,7 @@
     "@types/proper-lockfile": "^4.1.4",
     "@types/tar": "^6.1.13",
     "@types/write-file-atomic": "^4.0.3",
-    "@cleocode/utils": "2026.10.1"
+    "@cleocode/utils": "2026.10.3"
   },
   "repository": {
     "type": "git",
@@ -535,7 +535,7 @@
   },
   "optionalDependencies": {
     "llmtxt": "^2026.5.15",
-    "@cleocode/studio": "^2026.10.1"
+    "@cleocode/studio": "^2026.10.3"
   },
   "scripts": {
     "build": "tsc && node scripts/copy-selfimprove-fixtures.mjs && node scripts/write-build-provenance.mjs",

package/templates/CLEO-INJECTION.md

@@ -1,6 +1,6 @@
 # CLEO Protocol
 
-Version: 2.24.3 | CLI-only dispatch | `cleo <command> [args]`
+Version: 2.24.4 | CLI-only dispatch | `cleo <command> [args]`
 
 <!-- CLEO-INJECTION:section=session-start -->
 ## Universal protocol
@@ -55,7 +55,7 @@ Discovery: `cleo focus <id>` to orient, `cleo find "query"` to search (default p
 | Task acceptance criterion contains "test" | Propose an `AcceptanceGate` with `kind:"test"` via `cleo req add` |
 | Session token budget ≈ 80% consumed | Run `cleo session end --note "..."` and hand off |
 | Multiple related tasks ready in parallel | Run `cleo orchestrate ready <epicId>` for the wave set |
-| About to call `cleo complete` | First: check gates via `cleo show <id> --full` → run tests → then complete |
+| About to call `cleo complete` | `cleo done <id> --plan`, record what it names, then complete |
 | Writing a canonical doc (spec/adr/research/handoff/note/llm-readme) | Use `cleo docs add --type <kind> --slug <kebab-handle>` — NEVER raw fs write to `.cleo/adrs/`, `.cleo/research/`, `.cleo/agent-outputs/`, or `docs/` |
 | Reading an ADR/spec/research note/handoff | `cleo docs fetch <slug>` — never grep the filesystem for canonical docs |
 | New device, restore or migration; known repo "Not inside a CLEO project"; unreachable registry path; nexus `ENOENT` | `cleo doctor global-delivery` (hub + skills resolve; `--repair`), `cleo doctor projects` (dry run; `--apply`/`--rollback <id>`), `cleo doctor project-identity`, `cleo doctor --all-projects`, `cleo nexus projects clean --orphans --dry-run` (`--dry-run` mandatory: it deletes moved projects), `cleo doctor credentials`; report. Never delete rows of projects that may have moved |
@@ -126,15 +126,15 @@ Before `cleo complete <id>`, every gate requires programmatic evidence validated
 | gate | evidence that satisfies it |
 |------|----------------------------|
 | `implemented` | `commit:<sha>;files:path/a.ts,path/b.ts` — or `pr:<number>` with `files:<changed-paths>`, or `decision:<id>` for decision-only tasks |
-| `testsPassed` | `tool:test` (canonical) or `test-run:<json>` |
-| `qaPassed` | `tool:lint;tool:typecheck` |
+| `testsPassed` | `ci:<pr>` if merged and `evidence.ciSatisfies`; else `tool:test-affected` (needs `testing.affectedCommand`), changed-file `test-run:<json>`, or `tool:test` |
+| `qaPassed` | `ci:<pr>` likewise, else `tool:lint;tool:typecheck` |
 | `documented` | `files:docs/spec.md` |
 | `securityPassed` | `tool:security-scan` |
 | `cleanupDone` | `note:removed dead branches` |
 
 Name the acceptance criteria each result proves: `cleo verify T1234 --gate implemented --evidence "commit:abc123;files:src/fix.ts;satisfies:T1234#AC1"`. Record `testsPassed` and `qaPassed` separately with actual verification results and explicit criterion links. Documentation-only PRs cannot implement a code-fix task; changed criteria require fresh evidence, and a child waiver does not waive parent criteria. Then `cleo complete T###` re-validates every hard atom (commit reachable, file sha256, test-run hash); tampering → `E_EVIDENCE_STALE`. Typed gates, `pr:` rules, tool timeouts and the audited owner override: `cleo briefing inject --section evidence`.
 
-Anti-patterns: completing without running tests · `cleo verify --all` without `--evidence` · self-attesting without programmatic proof · modifying files between `cleo verify` and `cleo complete`.
+Anti-patterns: completing without running tests · `cleo verify --all` without `--evidence` · self-attesting without programmatic proof · running tests by hand, then again via `tool:test` · modifying files between `cleo verify` and `cleo complete`.
 <!-- /CLEO-INJECTION:section=pre-complete-gate -->
 
 <!-- CLEO-INJECTION:section=rules -->

package/templates/CLEO-REFERENCE.md

@@ -1,6 +1,6 @@
 # CLEO Protocol — on-demand reference
 
-Version: 2.24.3 | Companion to the always-loaded `CLEO-INJECTION.md` core
+Version: 2.24.4 | Companion to the always-loaded `CLEO-INJECTION.md` core
 
 Not injected into agent context. Print one section with `cleo briefing inject --section <name>`; tier-2 spawn prompts embed this whole file. Section names are the `CLEO-INJECTION:section` markers below.
 
@@ -270,7 +270,7 @@ A merged PR and green CI provide provenance. For `implemented`, pair `pr:<number
 
 | Exit | Code | Fix |
 |:----:|------|-----|
-| — | `E_EVIDENCE_TESTS_FAILED` | Fix failing tests before re-verifying with `tool:pnpm-test` or `test-run:<json>` |
+| — | `E_EVIDENCE_TESTS_FAILED` | Fix failing tests before re-verifying with `tool:test-affected` (needs `testing.affectedCommand`), a targeted `test-run:<json>` or `tool:test`, or `ci:<pr>` once merged (needs `evidence.ciSatisfies`) |
 | — | `E_EVIDENCE_INVALID_DECISION` | `decision:<id>` atom — decision ID not found or not accepted/proposed in BRAIN |
 | — | `E_EVIDENCE_GIT_ROOT` | The CLEO root is not a git checkout — a LAYOUT fact, not a failing atom. One child repo, or a `commit:` SHA that exists in exactly one child, resolves automatically. Otherwise declare it: `"evidence": { "gitRoot": "<subdir>" }` in `.cleo/project-context.json`, or `CLEO_EVIDENCE_GIT_ROOT=<repo>` for one invocation |
 | — | `E_FLAG_REMOVED` | `cleo complete --force` removed per ADR-051. Use `--evidence` or `CLEO_OWNER_OVERRIDE=1` |
@@ -295,7 +295,11 @@ All overrides append a line to `.cleo/audit/force-bypass.jsonl`. Use sparingly.
 
 ### Tool resolution + result cache (ADR-061)
 
-`tool:<name>` resolves through `.cleo/project-context.json`, then the project's `package.json` script of that name (`<pm> run <name>`), then `primaryType` fallbacks (references-only tsconfig → `tsc -b`, which emits). A script that writes files (an auto-fixing `lint`) edits the checkout and later fails `E_EVIDENCE_STALE`; keep verification scripts read-only. Cache `.cleo/cache/evidence/<key>.json`: `(canonical, cmd, args, HEAD, dirty-tree fingerprint)`. Parallel verifies coalesce; cross-worktree semaphores: `~/.local/share/cleo/locks/tool-<canonical>/`, limit `CLEO_TOOL_CONCURRENCY_<TOOL>=<n>`. Deadlines: **1800000 ms (30 min) for `test` and `build`**, otherwise 300000 ms (5 min). Positive-integer override: `CLEO_TOOL_TIMEOUT_<TOOL>=<ms>`; invalid values explicitly fail with the tool default. Timeouts cache nothing; increase the deadline before an unchanged retry (gh#1221).
+`tool:<name>` resolves through `.cleo/project-context.json`, then the project's `package.json` script of that name (`<pm> run <name>`), then `primaryType` fallbacks (references-only tsconfig → `tsc -b`, which emits). A script that writes files (an auto-fixing `lint`) edits the checkout and later fails `E_EVIDENCE_STALE`; keep verification scripts read-only. Cache `.cleo/cache/evidence/<key>.json`, keyed on the command `(canonical, cmd, args)` and the tree content under test: identical tree content shares one result across worktrees and commits, and a repeat verify on an unchanged tree never re-runs. After a failure the previously failing test files re-run first, and a failure that passes on its single rerun is recorded as `flaky`. Parallel verifies coalesce; cross-worktree semaphores: `~/.local/share/cleo/locks/tool-<canonical>/`, limit `CLEO_TOOL_CONCURRENCY_<TOOL>=<n>`. Deadlines: **1800000 ms (30 min) for `test` and `build`**, otherwise 300000 ms (5 min). Positive-integer override: `CLEO_TOOL_TIMEOUT_<TOOL>=<ms>`; invalid values explicitly fail with the tool default. Timeouts cache nothing; increase the deadline before an unchanged retry (gh#1221). `cleo verify --fresh` (or `CLEO_EVIDENCE_FRESH=1`) bypasses the cache for one call.
+
+### Test evidence without churn (T12957)
+
+The evidence run is the one run. Start with `cleo done <id> --plan`, which picks affected → ci → full and shows each tool's cache state. When the PR has merged and the project sets `evidence.ciSatisfies`, record `testsPassed`/`qaPassed` with `ci:<pr>` and run nothing locally. Otherwise, when `testing.affectedCommand` is configured, use `tool:test-affected` (packages the diff touches plus dependents); a full `tool:test` is then only for changes to root config, which affected planning refuses. Without it, use a targeted `test-run:<json>` of the test files you changed, or `tool:test`. While iterating, run only the failing or changed test files; never run the suite by hand and then again through `tool:test`. On macOS heavy `test`/`build` runs take one machine-wide slot by default (`CLEO_TOOL_CONCURRENCY_TEST=<n>` raises it).
 
 ### `pr:<number>` retroactive atom (T9764)
 
@@ -307,5 +311,5 @@ A task PR merged into an integration branch is a component: `pr:<component>@<int
 
 With `evidence.ciSatisfies: true`, `ci:<number>` attests `testsPassed`/`qaPassed` from the required checks (`evidence.ciChecks`) green on the merged PR's merge commit, or on a final PR head whose tree equals it. When a concurrency group CANCELLED (or skipped) the merge commit's own push run, a later default-branch commit's green `push` run may stand in (T12742). That run proves the DESCENDANT's tree, not the merge tree, so it counts only when all of these hold: no merge-commit run or job failed; the PR's final head has a green latest `pull_request` run for every stood-in check; the commit descends from the merge commit and is one of the first 10 first-parent commits within 7 days; NO commit between them, merge commits included, touched the PR's changed files, a pinned workflow file or `.github/actions`; and it is the first candidate with a decisive verdict. A red first decisive candidate refuses, and a pending one refuses with "wait for <sha>"; only cancelled, skipped or never-started runs move on. The atom records `descendantSha`, `descendantRange` and `descendantPrHeadSha`, and `cleo complete` re-fetches both runs' latest attempts, because a re-run can turn a completed check red.
 
-Required checks: explicit configuration or target repository protection. `release.prRequiredWorkflows: []` requires no checks; it proves neither testing nor review. `.cleo/cache/evidence/pr-<num>.json` retains provenance and changed files; obsolete versions reject. Use `tool:test` or `test-run:<json>` plus appropriate QA tools, linking each result to verified criteria.
+Required checks: explicit configuration or target repository protection. `release.prRequiredWorkflows: []` requires no checks; it proves neither testing nor review. `.cleo/cache/evidence/pr-<num>.json` retains provenance and changed files; obsolete versions reject. Use `tool:test-affected` when `testing.affectedCommand` is configured (a full `tool:test` then only for root-config changes, which affected planning refuses), otherwise a targeted `test-run:<json>` or `tool:test`, plus appropriate QA tools, linking each result to verified criteria.
 <!-- /CLEO-INJECTION:section=evidence -->