@cleocode/core 2026.10.19 → 2026.10.20

package/dist/audit-prune.d.ts

@@ -93,4 +93,22 @@ export declare function auditPruneCondition(table: PrunableAuditTable, cutoff: s
  * @param config   - LoggingConfig with auditRetentionDays and archiveBeforePrune
  */
 export declare function pruneAuditLog(cleoDir: string, config: LoggingConfig): Promise<PruneResult>;
+/** File under `.cleo/logs/` holding the time of the last automatic prune (T13828). */
+export declare const AUTO_AUDIT_PRUNE_STAMP = "audit-prune.last";
+/** The least time between two automatic prunes of one project: a day (T13828). */
+export declare const AUTO_AUDIT_PRUNE_INTERVAL_MS = 86400000;
+/**
+ * The automatic audit prune (T13828): {@link pruneAuditLog} with the project's
+ * `logging` config, at most once per {@link AUTO_AUDIT_PRUNE_INTERVAL_MS} per
+ * project. Session end runs it after its snapshot; `cleo admin cleanup
+ * --target logs` still prunes on demand.
+ *
+ * The stamp is written before the prune, so concurrent session ends skip
+ * rather than all prune. Never throws.
+ *
+ * @param projectRoot - The project root.
+ * @param now - The current time (tests).
+ * @returns The prune result, or `null` when a prune ran within the interval or it failed.
+ */
+export declare function autoPruneAuditLog(projectRoot: string, now?: Date): Promise<PruneResult | null>;
 //# sourceMappingURL=audit-prune.d.ts.map

package/dist/audit-prune.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit-prune.d.ts","sourceRoot":"","sources":["../src/audit-prune.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAOH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAuB,KAAK,GAAG,EAAO,MAAM,aAAa,CAAC;AAGjE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AACxD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sCAAsC,CAAC;AAI1E,MAAM,WAAW,WAAW;IAC1B,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,0BAA0B,EAAE,SAAS,MAAM,EAIvD,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,sBAAsB,CAAC;AAE7D;;;;;;;GAOG;AACH,eAAO,MAAM,0BAA0B,KAAK,CAAC;AAE7C,4FAA4F;AAC5F,MAAM,MAAM,kBAAkB,GAAG,OAAO,QAAQ,GAAG,OAAO,aAAa,CAAC;AAExE;;;;;;;;;;;;GAYG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,kBAAkB,EAAE,MAAM,EAAE,MAAM,GAAG,GAAG,CASlF;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,WAAW,CAAC,CA8EhG"}
+{"version":3,"file":"audit-prune.d.ts","sourceRoot":"","sources":["../src/audit-prune.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAOH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAuB,KAAK,GAAG,EAAO,MAAM,aAAa,CAAC;AAIjE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AACxD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sCAAsC,CAAC;AAI1E,MAAM,WAAW,WAAW;IAC1B,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,0BAA0B,EAAE,SAAS,MAAM,EAIvD,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,sBAAsB,CAAC;AAE7D;;;;;;;GAOG;AACH,eAAO,MAAM,0BAA0B,KAAK,CAAC;AAE7C,4FAA4F;AAC5F,MAAM,MAAM,kBAAkB,GAAG,OAAO,QAAQ,GAAG,OAAO,aAAa,CAAC;AAExE;;;;;;;;;;;;GAYG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,kBAAkB,EAAE,MAAM,EAAE,MAAM,GAAG,GAAG,CASlF;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,WAAW,CAAC,CA8EhG;AAED,sFAAsF;AACtF,eAAO,MAAM,sBAAsB,qBAAqB,CAAC;AAEzD,kFAAkF;AAClF,eAAO,MAAM,4BAA4B,WAAa,CAAC;AAEvD;;;;;;;;;;;;GAYG;AACH,wBAAsB,iBAAiB,CACrC,WAAW,EAAE,MAAM,EACnB,GAAG,GAAE,IAAiB,GACrB,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAmB7B"}

package/dist/audit-prune.js

@@ -10,13 +10,14 @@
  *
  * @task T5339
  */
-import { createWriteStream, mkdirSync } from 'node:fs';
+import { createWriteStream, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { Readable } from 'node:stream';
 import { pipeline } from 'node:stream/promises';
 import { createGzip } from 'node:zlib';
 import { and, lt, notInArray, sql } from 'drizzle-orm';
 import { getLogger } from './logger.js';
+import { getCleoDir } from './paths.js';
 import { AC_BINDINGS_PRUNED_ACTION } from './store/ac-binding-prune.js';
 const log = getLogger('prune');
 /**
@@ -159,4 +160,44 @@ export async function pruneAuditLog(cleoDir, config) {
         return { rowsArchived: 0, rowsDeleted: 0 };
     }
 }
+/** File under `.cleo/logs/` holding the time of the last automatic prune (T13828). */
+export const AUTO_AUDIT_PRUNE_STAMP = 'audit-prune.last';
+/** The least time between two automatic prunes of one project: a day (T13828). */
+export const AUTO_AUDIT_PRUNE_INTERVAL_MS = 86_400_000;
+/**
+ * The automatic audit prune (T13828): {@link pruneAuditLog} with the project's
+ * `logging` config, at most once per {@link AUTO_AUDIT_PRUNE_INTERVAL_MS} per
+ * project. Session end runs it after its snapshot; `cleo admin cleanup
+ * --target logs` still prunes on demand.
+ *
+ * The stamp is written before the prune, so concurrent session ends skip
+ * rather than all prune. Never throws.
+ *
+ * @param projectRoot - The project root.
+ * @param now - The current time (tests).
+ * @returns The prune result, or `null` when a prune ran within the interval or it failed.
+ */
+export async function autoPruneAuditLog(projectRoot, now = new Date()) {
+    try {
+        const cleoDir = getCleoDir(projectRoot);
+        const stamp = join(cleoDir, 'logs', AUTO_AUDIT_PRUNE_STAMP);
+        let last = Number.NaN;
+        try {
+            last = Date.parse(readFileSync(stamp, 'utf8').trim());
+        }
+        catch {
+            // never pruned automatically
+        }
+        if (now.getTime() - last < AUTO_AUDIT_PRUNE_INTERVAL_MS)
+            return null;
+        mkdirSync(join(cleoDir, 'logs'), { recursive: true });
+        writeFileSync(stamp, `${now.toISOString()}\n`);
+        const { loadConfig } = await import('./config.js');
+        return await pruneAuditLog(cleoDir, (await loadConfig(projectRoot)).logging);
+    }
+    catch (err) {
+        log.warn({ err, projectRoot }, 'automatic audit prune failed');
+        return null;
+    }
+}
 //# sourceMappingURL=audit-prune.js.map

package/dist/audit-prune.js.map

@@ -1 +1 @@
-{"version":3,"file":"audit-prune.js","sourceRoot":"","sources":["../src/audit-prune.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACvD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAEvC,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,UAAU,EAAY,GAAG,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,yBAAyB,EAAE,MAAM,6BAA6B,CAAC;AAIxE,MAAM,GAAG,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;AAQ/B;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAsB;IAC3D,yBAAyB;IACzB,iBAAiB;IACjB,iBAAiB;CAClB,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,mBAAmB,CAAC;AAE7D;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,EAAE,CAAC;AAK7C;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAyB,EAAE,MAAc;IAC3E,MAAM,SAAS,GAAG,GAAG,CACnB,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,MAAM,CAAC,EAC3B,UAAU,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,GAAG,0BAA0B,CAAC,CAAC,EACzD,GAAG,CAAA,QAAQ,KAAK,CAAC,MAAM,MAAM,yBAAyB,QAAQ,KAAK,CAAC,MAAM,6EAA6E,CACxJ,CAAC;IACF,uDAAuD;IACvD,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IACxE,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAAe,EAAE,MAAqB;IACxE,IAAI,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,kBAAkB,IAAI,MAAM,CAAC,kBAAkB,IAAI,CAAC,EAAE,CAAC;YACjE,GAAG,CAAC,KAAK,CAAC,wDAAwD,CAAC,CAAC;YACpE,OAAO,EAAE,YAAY,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC;QAC7C,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,kBAAkB,EAAE,0BAA0B,CAAC,CAAC;QAC7E,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC;QAEtE,qEAAqE;QACrE,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAExC,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;QACpD,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,yBAAyB,CAAC,CAAC;QAE7D,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,CAAC;QAEpC,uBAAuB;QACvB,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,mBAAmB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;QAE9F,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,GAAG,CAAC,KAAK,CAAC,uDAAuD,CAAC,CAAC;YACnE,OAAO,EAAE,YAAY,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC;QAC7C,CAAC;QAED,IAAI,WAA+B,CAAC;QACpC,IAAI,YAAY,GAAG,CAAC,CAAC;QAErB,sCAAsC;QACtC,IAAI,MAAM,CAAC,kBAAkB,EAAE,CAAC;YAC9B,IAAI,CAAC;gBACH,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;gBACpD,SAAS,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBAE3C,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACxD,WAAW,GAAG,IAAI,CAAC,UAAU,EAAE,SAAS,SAAS,WAAW,CAAC,CAAC;gBAE9D,gDAAgD;gBAChD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;gBACxD,MAAM,YAAY,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;gBAE7C,iDAAiD;gBACjD,MAAM,IAAI,GAAG,UAAU,EAAE,CAAC;gBAC1B,MAAM,SAAS,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAAC;gBACjD,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC;gBAE/C,MAAM,QAAQ,CAAC,QAAQ,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;gBAE1C,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC;gBAC9B,GAAG,CAAC,IAAI,CACN,EAAE,WAAW,EAAE,YAAY,EAAE,EAC7B,YAAY,YAAY,kBAAkB,WAAW,EAAE,CACxD,CAAC;YACJ,CAAC;YAAC,OAAO,UAAU,EAAE,CAAC;gBACpB,8DAA8D;gBAC9D,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,EAAE,wDAAwD,CAAC,CAAC;gBACxF,WAAW,GAAG,SAAS,CAAC;YAC1B,CAAC;QACH,CAAC;QAED,uBAAuB;QACvB,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,mBAAmB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;QAE7E,GAAG,CAAC,IAAI,CACN,EAAE,WAAW,EAAE,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,EACvC,UAAU,OAAO,CAAC,MAAM,8BAA8B,MAAM,EAAE,CAC/D,CAAC;QAEF,OAAO;YACL,YAAY;YACZ,WAAW,EAAE,OAAO,CAAC,MAAM;YAC3B,WAAW;SACZ,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,0BAA0B,CAAC,CAAC;QAC9C,OAAO,EAAE,YAAY,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC;IAC7C,CAAC;AACH,CAAC"}
+{"version":3,"file":"audit-prune.js","sourceRoot":"","sources":["../src/audit-prune.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACpF,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAEvC,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,UAAU,EAAY,GAAG,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EAAE,yBAAyB,EAAE,MAAM,6BAA6B,CAAC;AAIxE,MAAM,GAAG,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;AAQ/B;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAsB;IAC3D,yBAAyB;IACzB,iBAAiB;IACjB,iBAAiB;CAClB,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,mBAAmB,CAAC;AAE7D;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,EAAE,CAAC;AAK7C;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAyB,EAAE,MAAc;IAC3E,MAAM,SAAS,GAAG,GAAG,CACnB,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,MAAM,CAAC,EAC3B,UAAU,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,GAAG,0BAA0B,CAAC,CAAC,EACzD,GAAG,CAAA,QAAQ,KAAK,CAAC,MAAM,MAAM,yBAAyB,QAAQ,KAAK,CAAC,MAAM,6EAA6E,CACxJ,CAAC;IACF,uDAAuD;IACvD,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IACxE,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAAe,EAAE,MAAqB;IACxE,IAAI,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,kBAAkB,IAAI,MAAM,CAAC,kBAAkB,IAAI,CAAC,EAAE,CAAC;YACjE,GAAG,CAAC,KAAK,CAAC,wDAAwD,CAAC,CAAC;YACpE,OAAO,EAAE,YAAY,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC;QAC7C,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,kBAAkB,EAAE,0BAA0B,CAAC,CAAC;QAC7E,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC;QAEtE,qEAAqE;QACrE,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAExC,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;QACpD,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,yBAAyB,CAAC,CAAC;QAE7D,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,CAAC;QAEpC,uBAAuB;QACvB,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,mBAAmB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;QAE9F,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,GAAG,CAAC,KAAK,CAAC,uDAAuD,CAAC,CAAC;YACnE,OAAO,EAAE,YAAY,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC;QAC7C,CAAC;QAED,IAAI,WAA+B,CAAC;QACpC,IAAI,YAAY,GAAG,CAAC,CAAC;QAErB,sCAAsC;QACtC,IAAI,MAAM,CAAC,kBAAkB,EAAE,CAAC;YAC9B,IAAI,CAAC;gBACH,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;gBACpD,SAAS,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBAE3C,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACxD,WAAW,GAAG,IAAI,CAAC,UAAU,EAAE,SAAS,SAAS,WAAW,CAAC,CAAC;gBAE9D,gDAAgD;gBAChD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;gBACxD,MAAM,YAAY,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;gBAE7C,iDAAiD;gBACjD,MAAM,IAAI,GAAG,UAAU,EAAE,CAAC;gBAC1B,MAAM,SAAS,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAAC;gBACjD,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC;gBAE/C,MAAM,QAAQ,CAAC,QAAQ,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;gBAE1C,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC;gBAC9B,GAAG,CAAC,IAAI,CACN,EAAE,WAAW,EAAE,YAAY,EAAE,EAC7B,YAAY,YAAY,kBAAkB,WAAW,EAAE,CACxD,CAAC;YACJ,CAAC;YAAC,OAAO,UAAU,EAAE,CAAC;gBACpB,8DAA8D;gBAC9D,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,EAAE,wDAAwD,CAAC,CAAC;gBACxF,WAAW,GAAG,SAAS,CAAC;YAC1B,CAAC;QACH,CAAC;QAED,uBAAuB;QACvB,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,mBAAmB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;QAE7E,GAAG,CAAC,IAAI,CACN,EAAE,WAAW,EAAE,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,EACvC,UAAU,OAAO,CAAC,MAAM,8BAA8B,MAAM,EAAE,CAC/D,CAAC;QAEF,OAAO;YACL,YAAY;YACZ,WAAW,EAAE,OAAO,CAAC,MAAM;YAC3B,WAAW;SACZ,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,0BAA0B,CAAC,CAAC;QAC9C,OAAO,EAAE,YAAY,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC;IAC7C,CAAC;AACH,CAAC;AAED,sFAAsF;AACtF,MAAM,CAAC,MAAM,sBAAsB,GAAG,kBAAkB,CAAC;AAEzD,kFAAkF;AAClF,MAAM,CAAC,MAAM,4BAA4B,GAAG,UAAU,CAAC;AAEvD;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,WAAmB,EACnB,MAAY,IAAI,IAAI,EAAE;IAEtB,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC;QACxC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,sBAAsB,CAAC,CAAC;QAC5D,IAAI,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC;QACtB,IAAI,CAAC;YACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACxD,CAAC;QAAC,MAAM,CAAC;YACP,6BAA6B;QAC/B,CAAC;QACD,IAAI,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,GAAG,4BAA4B;YAAE,OAAO,IAAI,CAAC;QACrE,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACtD,aAAa,CAAC,KAAK,EAAE,GAAG,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;QAC/C,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;QACnD,OAAO,MAAM,aAAa,CAAC,OAAO,EAAE,CAAC,MAAM,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAC/E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,EAAE,8BAA8B,CAAC,CAAC;QAC/D,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/build-provenance.json

@@ -1,6 +1,6 @@
 {
   "schema": 1,
-  "gitHead": "22e6300406adcc932577098dd8bcf66000dd52b5",
-  "builtAt": "2026-10-17T10:52:58.025Z",
+  "gitHead": "61df8623708aa137827194be3bfb5decfbf27913",
+  "builtAt": "2026-10-18T03:59:18.365Z",
   "linkedWorktree": null
 }

package/dist/cloud/nexus-vault.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"nexus-vault.d.ts","sourceRoot":"","sources":["../../src/cloud/nexus-vault.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AAQH,OAAO,KAAK,EACV,uBAAuB,EACvB,eAAe,EACf,kBAAkB,EAClB,yBAAyB,EACzB,eAAe,EAGf,eAAe,EAEf,sBAAsB,EAGtB,iBAAiB,EAGlB,MAAM,qBAAqB,CAAC;AAqD7B,OAAO,EACL,KAAK,gBAAgB,EAMtB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAoB,KAAK,gBAAgB,EAAc,MAAM,uBAAuB,CAAC;AAgB5F,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAmChE,OAAO,EACL,KAAK,cAAc,EAKpB,MAAM,sBAAsB,CAAC;AAa9B,OAAO,EAGL,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,EAIvB,MAAM,uBAAuB,CAAC;AAK/B,gGAAgG;AAChG,eAAO,MAAM,6BAA6B,MAAM,CAAC;AAMjD;;;;;;;;GAQG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;CA6B1B,CAAC;AAkCX,4CAA4C;AAC5C,MAAM,WAAW,wBAAyB,SAAQ,iBAAiB;IACjE,0FAA0F;IAC1F,KAAK,CAAC,EAAE,eAAe,CAAC;CACzB;AA8iCD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,sBAAsB,CACpC,YAAY,EAAE,MAAM,GAAG,SAAS,EAChC,OAAO,EAAE,cAAc,EACvB,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EACvC,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAC1C;IAAE,OAAO,EAAE,cAAc,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,CAa7D;AAg/CD;;;;;;;;;;;GAWG;AACH,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,IAAI,CAAC,oBAAoB,EAAE,MAAM,CAAC,EACxC,KAAK,EAAE,eAAe,EACtB,SAAS,GAAE,MAAM,GAAG,IAAW,GAC9B,OAAO,CAAC,gBAAgB,EAAE,GAAG,SAAS,CAAC,CAmCzC;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,IAAI,CAAC,oBAAoB,EAAE,MAAM,GAAG,UAAU,CAAC,EACrD,KAAK,EAAE,eAAe,EACtB,SAAS,GAAE,MAAM,GAAG,IAAW,GAC9B,OAAO,CAAC,gBAAgB,EAAE,GAAG,SAAS,CAAC,CAUzC;AAkKD,sFAAsF;AACtF,MAAM,WAAW,cAAc;IAC7B,gGAAgG;IAChG,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;IAC3B,2BAA2B;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;IAC3B,8CAA8C;IAC9C,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,8DAA8D;IAC9D,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;CAC/B;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,IAAI,CAAC,gBAAgB,EAAE,SAAS,GAAG,aAAa,CAAC,EACvD,IAAI,EAAE,IAAI,CAAC,gBAAgB,EAAE,SAAS,GAAG,aAAa,CAAC,GACtD,cAAc,CAkBhB;AAgID,4CAA4C;AAC5C,MAAM,WAAW,wBAAyB,SAAQ,wBAAwB;IACxE,uHAAuH;IACvH,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,0CAA0C;IAC1C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gEAAgE;IAChE,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,mEAAmE;IACnE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4FAA4F;IAC5F,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,8FAA8F;IAC9F,MAAM,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;CACrD;AAyDD,4FAA4F;AAC5F,eAAO,MAAM,+BAA+B,KAAK,CAAC;AA0lClD;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAC5B,IAAI,GAAE,wBAAwB,GAAG;IAC/B,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,+GAA+G;IAC/G,eAAe,CAAC,EAAE,OAAO,CAAC;CACtB,GACL,OAAO,CAAC,eAAe,CAAC,CAE1B;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,cAAc,CAC5B,IAAI,GAAE,wBAAwB,GAAG;IAAE,eAAe,CAAC,EAAE,OAAO,CAAA;CAAO,GAClE,OAAO,CAAC,yBAAyB,CAAC,CAEpC;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAC5B,IAAI,GAAE,wBAAwB,GAAG;IAAE,eAAe,CAAC,EAAE,OAAO,CAAA;CAAO,GAClE,OAAO,CAAC,gBAAgB,CAAC,CAE3B;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAAC,IAAI,GAAE,wBAA6B,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAE7F;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,SAAS,CACvB,IAAI,GAAE,wBAAwB,GAAG;IAAE,eAAe,CAAC,EAAE,OAAO,CAAA;CAAO,GAClE,OAAO,CAAC,eAAe,CAAC,CAE1B;AAED;;;;;;;;;GASG;AACH,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,wBAAwB,GAAG;IAAE,eAAe,CAAC,EAAE,OAAO,CAAA;CAAE,GAC7D,OAAO,CAAC,kBAAkB,CAAC,CAQ7B;AA0CD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,GAAE,wBAA6B,GAClC,OAAO,CAAC,sBAAsB,CAAC,CAEjC;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,GAAE,wBAAwB,GAAG;IAAE,IAAI,CAAC,EAAE,OAAO,CAAA;CAAO,GACvD,OAAO,CAAC,iBAAiB,CAAC,CAE5B;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,IAAI,GAAE,wBAA6B,GAClC,OAAO,CAAC,uBAAuB,CAAC,CAElC"}
+{"version":3,"file":"nexus-vault.d.ts","sourceRoot":"","sources":["../../src/cloud/nexus-vault.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AAQH,OAAO,KAAK,EACV,uBAAuB,EACvB,eAAe,EACf,kBAAkB,EAClB,yBAAyB,EACzB,eAAe,EAGf,eAAe,EAEf,sBAAsB,EAGtB,iBAAiB,EAGlB,MAAM,qBAAqB,CAAC;AAsD7B,OAAO,EACL,KAAK,gBAAgB,EAMtB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAoB,KAAK,gBAAgB,EAAc,MAAM,uBAAuB,CAAC;AAgB5F,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAoChE,OAAO,EACL,KAAK,cAAc,EAKpB,MAAM,sBAAsB,CAAC;AAa9B,OAAO,EAGL,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,EAIvB,MAAM,uBAAuB,CAAC;AAK/B,gGAAgG;AAChG,eAAO,MAAM,6BAA6B,MAAM,CAAC;AAMjD;;;;;;;;GAQG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;CA6B1B,CAAC;AAkCX,4CAA4C;AAC5C,MAAM,WAAW,wBAAyB,SAAQ,iBAAiB;IACjE,0FAA0F;IAC1F,KAAK,CAAC,EAAE,eAAe,CAAC;CACzB;AAolCD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,sBAAsB,CACpC,YAAY,EAAE,MAAM,GAAG,SAAS,EAChC,OAAO,EAAE,cAAc,EACvB,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EACvC,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAC1C;IAAE,OAAO,EAAE,cAAc,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,CAa7D;AAg/CD;;;;;;;;;;;GAWG;AACH,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,IAAI,CAAC,oBAAoB,EAAE,MAAM,CAAC,EACxC,KAAK,EAAE,eAAe,EACtB,SAAS,GAAE,MAAM,GAAG,IAAW,GAC9B,OAAO,CAAC,gBAAgB,EAAE,GAAG,SAAS,CAAC,CAmCzC;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,IAAI,CAAC,oBAAoB,EAAE,MAAM,GAAG,UAAU,CAAC,EACrD,KAAK,EAAE,eAAe,EACtB,SAAS,GAAE,MAAM,GAAG,IAAW,GAC9B,OAAO,CAAC,gBAAgB,EAAE,GAAG,SAAS,CAAC,CAUzC;AAkKD,sFAAsF;AACtF,MAAM,WAAW,cAAc;IAC7B,gGAAgG;IAChG,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;IAC3B,2BAA2B;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;IAC3B,8CAA8C;IAC9C,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,8DAA8D;IAC9D,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;CAC/B;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,IAAI,CAAC,gBAAgB,EAAE,SAAS,GAAG,aAAa,CAAC,EACvD,IAAI,EAAE,IAAI,CAAC,gBAAgB,EAAE,SAAS,GAAG,aAAa,CAAC,GACtD,cAAc,CAkBhB;AAgID,4CAA4C;AAC5C,MAAM,WAAW,wBAAyB,SAAQ,wBAAwB;IACxE,uHAAuH;IACvH,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,0CAA0C;IAC1C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gEAAgE;IAChE,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,mEAAmE;IACnE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4FAA4F;IAC5F,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,8FAA8F;IAC9F,MAAM,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;CACrD;AAyDD,4FAA4F;AAC5F,eAAO,MAAM,+BAA+B,KAAK,CAAC;AA2lClD;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAC5B,IAAI,GAAE,wBAAwB,GAAG;IAC/B,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,+GAA+G;IAC/G,eAAe,CAAC,EAAE,OAAO,CAAC;CACtB,GACL,OAAO,CAAC,eAAe,CAAC,CAE1B;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,cAAc,CAC5B,IAAI,GAAE,wBAAwB,GAAG;IAAE,eAAe,CAAC,EAAE,OAAO,CAAA;CAAO,GAClE,OAAO,CAAC,yBAAyB,CAAC,CAEpC;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAC5B,IAAI,GAAE,wBAAwB,GAAG;IAAE,eAAe,CAAC,EAAE,OAAO,CAAA;CAAO,GAClE,OAAO,CAAC,gBAAgB,CAAC,CAE3B;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAAC,IAAI,GAAE,wBAA6B,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAE7F;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,SAAS,CACvB,IAAI,GAAE,wBAAwB,GAAG;IAAE,eAAe,CAAC,EAAE,OAAO,CAAA;CAAO,GAClE,OAAO,CAAC,eAAe,CAAC,CAE1B;AAED;;;;;;;;;GASG;AACH,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,wBAAwB,GAAG;IAAE,eAAe,CAAC,EAAE,OAAO,CAAA;CAAE,GAC7D,OAAO,CAAC,kBAAkB,CAAC,CAQ7B;AA0CD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,GAAE,wBAA6B,GAClC,OAAO,CAAC,sBAAsB,CAAC,CAEjC;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,GAAE,wBAAwB,GAAG;IAAE,IAAI,CAAC,EAAE,OAAO,CAAA;CAAO,GACvD,OAAO,CAAC,iBAAiB,CAAC,CAE5B;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,IAAI,GAAE,wBAA6B,GAClC,OAAO,CAAC,uBAAuB,CAAC,CAElC"}

package/dist/cloud/nexus-vault.js

@@ -63,6 +63,7 @@ import { SYNC_SCHEMA_VERSION } from '@cleocode/contracts/sync-schema.js';
 import { readDeclaredProjectIdentity } from '@cleocode/paths';
 import { extract as tarExtract } from 'tar';
 import { z } from 'zod';
+import { currentDeviceId } from '../nexus/path-map.js';
 import { getCleoHome, resolveOrCwd } from '../paths.js';
 import { withLock } from '../store/lock.js';
 import { exportPortableBundle, globalHomeRules } from '../store/portable-bundle.js';
@@ -85,7 +86,7 @@ import { sealBacklog } from '../store/sync/seal-backlog.js';
 import { sealPending } from '../store/sync/sealer.js';
 import { unpushedSegments } from '../store/sync/segments.js';
 import { firstBadTxnSignature, signTxn } from '../store/sync/txn-signing.js';
-import { buildVaultManifest, carryMachineState, compareVaultManifests, emptyVaultTableHash, isVaultAnnotationKey, isVaultForkManifest, sameVaultManifest, VAULT_FILES_KEY, VAULT_FORK_KEY, VAULT_FORMAT_KEY, VAULT_GLOBAL_CONFIG_LOCAL_KEYS, VAULT_MANIFEST_FORMAT_VERSION, vaultDatabaseEntry, vaultDatabaseKey, vaultFileDigest, vaultFilesEntry, vaultForkEntry, vaultFormatEntry, vaultManifestFormat, vaultStripColumns, } from '../store/vault-manifest.js';
+import { buildVaultManifest, carryMachineState, compareVaultManifests, emptyVaultTableHash, isVaultAnnotationKey, isVaultForkManifest, sameVaultAuthoredState, sameVaultManifest, VAULT_FILES_KEY, VAULT_FORK_KEY, VAULT_FORMAT_KEY, VAULT_GLOBAL_CONFIG_LOCAL_KEYS, VAULT_MANIFEST_FORMAT_VERSION, vaultDatabaseEntry, vaultDatabaseKey, vaultFileDigest, vaultFilesEntry, vaultForkEntry, vaultFormatEntry, vaultManifestFormat, vaultStripColumns, } from '../store/vault-manifest.js';
 import { foreignWriterLeases, storeOpenElsewhere } from '../store/writer-lease.js';
 import { autoSyncSuppressedBy } from './auto-sync.js';
 import { deriveKey, uuidv7 } from './crypto.js';
@@ -568,6 +569,18 @@ function compareWithSynced(local, snapshot, git, changes) {
         return rows;
     return rows.map((r) => (r.table === VAULT_FILES_KEY ? { ...r, match: changes.length === 0 } : r));
 }
+/**
+ * The changes a pull must not overwrite (T13850): {@link compareWithSynced},
+ * except that `cleo.db` tables count as unchanged when the authored digests
+ * agree, since then they differ only in what memory reads wrote (retrieval
+ * log, citation counters), and the snapshot may replace that.
+ */
+function changesToKeep(local, snapshot, git, changes) {
+    const rows = compareWithSynced(local, snapshot, git, changes);
+    if (!sameVaultAuthoredState(local, snapshot))
+        return rows;
+    return rows.map((r) => (isSnapshotAuthoritativeKey(r.table) ? r : { ...r, match: true }));
+}
 /**
  * This device's local-only change journal, emptied in every vault snapshot
  * (T13042): capture, undo and quarantined images, and apply intents (T12757),
@@ -835,6 +848,29 @@ async function localManifest(t, git, untracked, like) {
     vault.tables[VAULT_FILES_KEY] = vaultFilesEntry(files, hashKey);
     return { manifest: vault, files: digests };
 }
+/**
+ * Rows a store writes about this machine on its own: the device's heartbeat
+ * row in `nexus_devices`, which login and every CLI start write and the next
+ * start rewrites. A restore that replaces it loses nothing, so it never makes
+ * a never-synced store hold data of its own (T13853).
+ */
+async function ownMachineRows(t) {
+    if (t.scope !== 'global')
+        return {};
+    const { openNativeDatabase } = await import('../store/sqlite-native.js');
+    const db = openNativeDatabase(t.dbPath, { readonly: true, enableWal: false });
+    try {
+        if (!hasTable(db, 'nexus_devices'))
+            return {};
+        const { n } = db
+            .prepare('SELECT count(*) AS n FROM nexus_devices WHERE device_id = ?')
+            .get(currentDeviceId());
+        return Number(n) > 0 ? { nexus_devices: Number(n) } : {};
+    }
+    finally {
+        db.close();
+    }
+}
 /**
  * This store's section as a vault snapshot walks it: the section root, the
  * export's walk rules (so secrets, excluded directories and machine-local
@@ -1255,7 +1291,7 @@ async function pushJournalCheckpoint(conn, key, opts, scope, warnings) {
                 throw vaultError('E_NEXUS_VAULT_REFUSED', `this store's rows do not reconcile with ${t.streamId}'s change journal (${unexplained.slice(0, 8).join(', ')}): ${exemptOnly ? 'these tables are not in the change journal yet, and this Cleo Nexus server does not take a snapshot-authoritative list (manifest.snapshot-authoritative)' : transition ? `the head snapshot is vault format ${parentFormat}, and the local rows it counted do not explain the shortfall: synced rows are missing from this store` : 'a write landed outside the journal'}`, exemptOnly
                     ? 'nothing was written; upgrade the Cleo Nexus server, then push again'
                     : transition
-                        ? 'nothing was written; run `cleo cloud pull` to take the cloud copy, or `cleo cloud push --force` to keep this store as a labelled fork'
+                        ? 'nothing was written; run `cleo cloud pull --force` to take the cloud copy, or `cleo cloud push --force` to keep this store as a labelled fork'
                         : 'nothing was written; run `cleo cloud sync`, then push again');
             }
             const vaultOnlyChanged = keys.some((k) => isSnapshotAuthoritativeKey(k) && local[k] !== (parent.manifest.tables[k]?.rows ?? 0));
@@ -2981,9 +3017,10 @@ async function restoreNexusVaultImpl(opts) {
         ? await localManifest(t, git, untrackedComparison(t, git, synced), last?.manifest)
         : null;
     if (local !== null) {
-        const hasRows = Object.entries(local.manifest.tables).some(([name, x]) => x.rows > 0 && name !== VAULT_FILES_KEY);
+        const own = last ? {} : await ownMachineRows(t);
+        const hasRows = Object.entries(local.manifest.tables).some(([name, x]) => x.rows - (own[name] ?? 0) > 0 && name !== VAULT_FILES_KEY);
         const fileChanges = fileChangesSinceSync(local.files, t, git, synced);
-        const rows = last ? compareWithSynced(local.manifest, last.manifest, git, fileChanges) : [];
+        const rows = last ? changesToKeep(local.manifest, last.manifest, git, fileChanges) : [];
         if ((!last && hasRows) || rows.some((d) => !d.match)) {
             const changed = rows
                 .filter((d) => !d.match)