@cleocode/core 2026.4.45 → 2026.4.47

package/dist/internal.js

@@ -11471,14 +11471,14 @@ function reconcileJournal(nativeDb, migrationsFolder, existenceTable, logSubsyst
       const dbHashes = new Set(dbEntries.map((e) => e.hash));
       const allLocalHashesPresentInDb = localMigrations.every((m2) => dbHashes.has(m2.hash));
       if (allLocalHashesPresentInDb) {
-        const log11 = getLogger(logSubsystem);
-        log11.debug(
+        const log12 = getLogger(logSubsystem);
+        log12.debug(
           { extra: orphanedEntries.length },
           `Migration journal has ${orphanedEntries.length} entries for migrations not known to this install (DB is ahead). Skipping reconciliation.`
         );
       } else {
-        const log11 = getLogger(logSubsystem);
-        log11.warn(
+        const log12 = getLogger(logSubsystem);
+        log12.warn(
           { orphaned: orphanedEntries.length },
           `Detected stale migration journal entries from a previous CLEO version. Reconciling.`
         );
@@ -11509,8 +11509,8 @@ function reconcileJournal(nativeDb, migrationsFolder, existenceTable, logSubsyst
         return cols.some((c) => c.name === column);
       });
       if (allColumnsExist) {
-        const log11 = getLogger(logSubsystem);
-        log11.warn(
+        const log12 = getLogger(logSubsystem);
+        log12.warn(
           { migration: migration.name, columns: alterMatches },
           `Detected partially-applied migration ${migration.name} \u2014 columns exist but journal entry missing. Auto-reconciling.`
         );
@@ -11528,8 +11528,8 @@ function reconcileJournal(nativeDb, migrationsFolder, existenceTable, logSubsyst
     for (const entry of unnamedEntries) {
       const migrationName = hashToName.get(entry.hash);
       if (!migrationName) continue;
-      const log11 = getLogger(logSubsystem);
-      log11.warn(
+      const log12 = getLogger(logSubsystem);
+      log12.warn(
         { id: entry.id, hash: entry.hash, name: migrationName },
         `Backfilling missing name on journal entry id=${entry.id} \u2014 Drizzle v1 beta requires name for applied-migration detection.`
       );
@@ -11573,8 +11573,8 @@ function ensureColumns(nativeDb, tableName, requiredColumns, logSubsystem) {
   const existingCols = new Set(columns.map((c) => c.name));
   for (const req of requiredColumns) {
     if (!existingCols.has(req.name)) {
-      const log11 = getLogger(logSubsystem);
-      log11.warn(
+      const log12 = getLogger(logSubsystem);
+      log12.warn(
         { column: req.name },
         `Adding missing column ${tableName}.${req.name} via ALTER TABLE`
       );
@@ -13972,7 +13972,7 @@ function getDbPath(cwd) {
   return join10(getCleoDirAbsolute(cwd), DB_FILENAME2);
 }
 async function autoRecoverFromBackup(nativeDb, dbPath, cwd) {
-  const log11 = getLogger("sqlite");
+  const log12 = getLogger("sqlite");
   try {
     const countResult = nativeDb.prepare("SELECT COUNT(*) as cnt FROM tasks").get();
     const taskCount = countResult?.cnt ?? 0;
@@ -13993,7 +13993,7 @@ async function autoRecoverFromBackup(nativeDb, dbPath, cwd) {
     if (backupTaskCount < MIN_BACKUP_TASK_COUNT) {
       return;
     }
-    log11.warn(
+    log12.warn(
       { dbPath, backupPath: newestBackup.path, backupTasks: backupTaskCount },
       `Empty database detected with ${backupTaskCount}-task backup available. Auto-recovering from backup. This likely happened because git-tracked WAL/SHM files were overwritten during a branch switch (T5188).`
     );
@@ -14011,7 +14011,7 @@ async function autoRecoverFromBackup(nativeDb, dbPath, cwd) {
     const tempPath = dbPath + ".recovery-tmp";
     copyFileSync4(newestBackup.path, tempPath);
     renameSync(tempPath, dbPath);
-    log11.info(
+    log12.info(
       { dbPath, backupPath: newestBackup.path, restoredTasks: backupTaskCount },
       "Database auto-recovered from backup successfully."
     );
@@ -14021,7 +14021,7 @@ async function autoRecoverFromBackup(nativeDb, dbPath, cwd) {
     runMigrations(restoredNativeDb, restoredDb);
     _db = restoredDb;
   } catch (err) {
-    log11.error({ err, dbPath }, "Auto-recovery from backup failed. Continuing with empty database.");
+    log12.error({ err, dbPath }, "Auto-recovery from backup failed. Continuing with empty database.");
   }
 }
 async function getDb(cwd) {
@@ -14055,7 +14055,7 @@ async function getDb(cwd) {
         const { execFileSync: execFileSync14 } = await import("node:child_process");
         const gitCwd = resolve3(dbPath, "..", "..");
         const filesToCheck = [dbPath, dbPath + "-wal", dbPath + "-shm"];
-        const log11 = getLogger("sqlite");
+        const log12 = getLogger("sqlite");
         for (const fileToCheck of filesToCheck) {
           try {
             execFileSync14("git", ["ls-files", "--error-unmatch", fileToCheck], {
@@ -14064,7 +14064,7 @@ async function getDb(cwd) {
             });
             const basename18 = fileToCheck.split(/[\\/]/).pop();
             const relPath = fileToCheck.replace(gitCwd + sep, "");
-            log11.warn(
+            log12.warn(
               { path: fileToCheck },
               `${basename18} is tracked by project git \u2014 this risks data loss on branch switch. Resolution (ADR-013 \xA79): \`git rm --cached ${relPath}\` and rely on \`.cleo/backups/sqlite/\` snapshots + \`cleo backup add\` for recovery.`
             );
@@ -15258,11 +15258,18 @@ var init_cross_db_cleanup = __esm({
 
 // packages/core/src/store/db-helpers.ts
 import { eq as eq4, inArray as inArray2 } from "drizzle-orm";
-async function upsertTask(db, row, archiveFields) {
+async function upsertTask(db, row, archiveFields, allowOrphanParent = false) {
   if (row.parentId) {
     const parent = await db.select({ id: tasks.id }).from(tasks).where(eq4(tasks.id, row.parentId)).limit(1).all();
     if (parent.length === 0) {
-      row = { ...row, parentId: null };
+      if (allowOrphanParent) {
+        row = { ...row, parentId: null };
+      } else {
+        log2.warn(
+          { taskId: row.id, parentId: row.parentId },
+          "upsertTask: parentId references a non-existent task \u2014 parent relationship may be lost"
+        );
+      }
     }
   }
   const values = archiveFields ? { ...row, ...archiveFields, status: "archived" } : row;
@@ -15406,10 +15413,13 @@ async function loadRelationsForTasks(db, tasks2) {
     }
   }
 }
+var log2;
 var init_db_helpers = __esm({
   "packages/core/src/store/db-helpers.ts"() {
     "use strict";
+    init_logger();
     init_tasks_schema();
+    log2 = getLogger("db-helpers");
   }
 });
 
@@ -15743,7 +15753,7 @@ async function createSqliteDataAccessor(cwd) {
             archiveReason: taskAny.archiveReason ?? "completed",
             cycleTimeDays: taskAny.cycleTimeDays ?? null
           };
-          await upsertTask(db, row, archiveFields);
+          await upsertTask(db, row, archiveFields, true);
           depBatch.push({ taskId: task.id, deps: task.depends ?? [] });
         }
         await batchUpdateDependencies(db, depBatch, validDepIds);
@@ -16756,7 +16766,7 @@ async function ensureSequenceValid(cwd, options) {
   if (!options?.validateSequence) return;
   const check2 = await checkSequence(cwd);
   if (!check2.valid) {
-    log2.warn({ counter: check2.counter, maxId: check2.maxIdInData }, "Sequence behind, repairing");
+    log3.warn({ counter: check2.counter, maxId: check2.maxIdInData }, "Sequence behind, repairing");
     const repair = await repairSequence(cwd);
     if (!repair.repaired && options.strict) {
       throw new DataSafetyError(`Sequence repair failed: ${repair.message}`, "SEQUENCE_INVALID", {
@@ -16773,7 +16783,7 @@ async function checkpoint(context, cwd, options) {
     stats.checkpoints++;
     stats.lastCheckpoint = /* @__PURE__ */ new Date();
   } catch (err) {
-    log2.warn({ err }, "Checkpoint failed (non-fatal)");
+    log3.warn({ err }, "Checkpoint failed (non-fatal)");
   }
   vacuumIntoBackup({ cwd }).catch(() => {
   });
@@ -16835,7 +16845,7 @@ async function safeAppendLog(accessor, entry, cwd, options) {
   stats.writes++;
   await checkpoint("log entry", cwd, opts);
 }
-var log2, DataSafetyError, DEFAULT_SAFETY, stats;
+var log3, DataSafetyError, DEFAULT_SAFETY, stats;
 var init_data_safety_central = __esm({
   "packages/core/src/store/data-safety-central.ts"() {
     "use strict";
@@ -16843,7 +16853,7 @@ var init_data_safety_central = __esm({
     init_sequence();
     init_git_checkpoint();
     init_sqlite_backup();
-    log2 = getLogger("data-safety");
+    log3 = getLogger("data-safety");
     DataSafetyError = class extends Error {
       constructor(message, code, context) {
         super(message);
@@ -16883,7 +16893,7 @@ function isSafetyDisabled() {
 }
 function wrapWithSafety(accessor, cwd) {
   if (isSafetyDisabled()) {
-    log3.warn(
+    log4.warn(
       "Safety disabled - emergency mode (CLEO_DISABLE_SAFETY=true). Data integrity checks bypassed."
     );
     return accessor;
@@ -16904,13 +16914,13 @@ function getSafetyStatus() {
     enabled: true
   };
 }
-var log3, SafetyDataAccessor;
+var log4, SafetyDataAccessor;
 var init_safety_data_accessor = __esm({
   "packages/core/src/store/safety-data-accessor.ts"() {
     "use strict";
     init_logger();
     init_data_safety_central();
-    log3 = getLogger("data-safety");
+    log4 = getLogger("data-safety");
     SafetyDataAccessor = class {
       /** The underlying accessor being wrapped. */
       inner;
@@ -16934,7 +16944,7 @@ var init_safety_data_accessor = __esm({
           ...config2
         };
         if (this.config.verbose) {
-          log3.debug({ engine: inner.engine }, "SafetyDataAccessor initialized");
+          log4.debug({ engine: inner.engine }, "SafetyDataAccessor initialized");
         }
       }
       /** The storage engine backing this accessor. */
@@ -16946,7 +16956,7 @@ var init_safety_data_accessor = __esm({
        */
       logVerbose(message) {
         if (this.config.verbose) {
-          log3.debug(message);
+          log4.debug(message);
         }
       }
       /**
@@ -21347,16 +21357,16 @@ async function queryAudit(options) {
       error: row.errorMessage ?? void 0
     }));
   } catch (err) {
-    log4.warn({ err }, "Failed to query audit entries from SQLite");
+    log5.warn({ err }, "Failed to query audit entries from SQLite");
     return [];
   }
 }
-var log4;
+var log5;
 var init_audit = __esm({
   "packages/core/src/audit.ts"() {
     "use strict";
     init_logger();
-    log4 = getLogger("audit");
+    log5 = getLogger("audit");
   }
 });
 
@@ -43701,13 +43711,16 @@ async function runTierPromotion(projectRoot) {
     try {
       shortToMedium = typedAll(
         nativeDb.prepare(`
-          SELECT id, citation_count, quality_score
+          SELECT id, citation_count, quality_score, verified
           FROM ${table}
           WHERE memory_tier = 'short'
             AND invalid_at IS NULL
             AND ${dateCol} < ?
-            AND verified = 1
-            AND (citation_count >= 3 OR quality_score >= 0.7)
+            AND (
+              citation_count >= 3
+              OR quality_score >= 0.7
+              OR verified = 1
+            )
         `),
         age24h
       );
@@ -43717,13 +43730,15 @@ async function runTierPromotion(projectRoot) {
     for (const row of shortToMedium) {
       try {
         nativeDb.prepare(`UPDATE ${table} SET memory_tier = 'medium', updated_at = ? WHERE id = ?`).run(now2, row.id);
-        promoted.push({
-          id: row.id,
-          table,
-          fromTier: "short",
-          toTier: "medium",
-          reason: row.citation_count >= 3 ? `citationCount=${row.citation_count} >= 3, verified, age > 24h` : `qualityScore=${row.quality_score?.toFixed(2)} >= 0.70, verified, age > 24h`
-        });
+        let reason;
+        if (row.citation_count >= 3) {
+          reason = `citationCount=${row.citation_count} >= 3, age > 24h`;
+        } else if ((row.quality_score ?? 0) >= 0.7) {
+          reason = `qualityScore=${row.quality_score?.toFixed(2)} >= 0.70, age > 24h`;
+        } else {
+          reason = `verified=true, age > 24h`;
+        }
+        promoted.push({ id: row.id, table, fromTier: "short", toTier: "medium", reason });
       } catch {
       }
     }
@@ -43731,13 +43746,12 @@ async function runTierPromotion(projectRoot) {
     try {
       mediumToLong = typedAll(
         nativeDb.prepare(`
-          SELECT id, citation_count, quality_score
+          SELECT id, citation_count, quality_score, verified
           FROM ${table}
           WHERE memory_tier = 'medium'
             AND invalid_at IS NULL
             AND ${dateCol} < ?
-            AND verified = 1
-            AND citation_count >= 5
+            AND (citation_count >= 5 OR verified = 1)
         `),
         age7d
       );
@@ -43747,13 +43761,8 @@ async function runTierPromotion(projectRoot) {
     for (const row of mediumToLong) {
       try {
         nativeDb.prepare(`UPDATE ${table} SET memory_tier = 'long', updated_at = ? WHERE id = ?`).run(now2, row.id);
-        promoted.push({
-          id: row.id,
-          table,
-          fromTier: "medium",
-          toTier: "long",
-          reason: `citationCount=${row.citation_count} >= 5, verified, age > 7d`
-        });
+        const reason = row.citation_count >= 5 ? `citationCount=${row.citation_count} >= 5, age > 7d` : `verified=true, age > 7d`;
+        promoted.push({ id: row.id, table, fromTier: "medium", toTier: "long", reason });
       } catch {
       }
     }
@@ -54112,9 +54121,7 @@ async function completeTask(options, cwd, accessor) {
     const parent = await acc.loadSingleTask(task.parentId);
     if (parent && parent.type === "epic" && !parent.noAutoComplete) {
       const siblings = await acc.getChildren(parent.id);
-      const allDone = siblings.every(
-        (c) => c.id === task.id || c.status === "done" || c.status === "cancelled"
-      );
+      const allDone = siblings.length > 0 && siblings.every((c) => c.id === task.id || c.status === "done" || c.status === "cancelled");
       if (allDone) {
         parent.status = "done";
         parent.completedAt = now2;
@@ -58253,7 +58260,7 @@ async function validateAndRepairSequence(cwd, config2 = {}) {
     }
     const repair = await repairSequence(cwd);
     if (repair.repaired) {
-      log10.warn(
+      log11.warn(
         { oldCounter: repair.oldCounter, newCounter: repair.newCounter },
         "Sequence repaired"
       );
@@ -58282,7 +58289,7 @@ async function triggerCheckpoint(context, cwd, config2 = {}) {
   try {
     await gitCheckpoint("auto", context, cwd);
   } catch (err) {
-    log10.warn({ err }, "Checkpoint failed (non-fatal)");
+    log11.warn({ err }, "Checkpoint failed (non-fatal)");
   }
   vacuumIntoBackup({ cwd }).catch(() => {
   });
@@ -58320,16 +58327,16 @@ async function safeDeleteTask(deleteFn, taskId, cwd, config2 = {}) {
   return result;
 }
 async function forceCheckpointBeforeOperation(operation, cwd) {
-  log10.info({ operation }, "Forcing checkpoint before operation");
+  log11.info({ operation }, "Forcing checkpoint before operation");
   try {
     await gitCheckpoint("manual", `pre-${operation}`, cwd);
   } catch (err) {
-    log10.error({ err }, "Failed to create pre-operation checkpoint");
+    log11.error({ err }, "Failed to create pre-operation checkpoint");
   }
   vacuumIntoBackup({ cwd, force: true }).catch(() => {
   });
 }
-var log10, DEFAULT_CONFIG2, SafetyError;
+var log11, DEFAULT_CONFIG2, SafetyError;
 var init_data_safety = __esm({
   "packages/core/src/store/data-safety.ts"() {
     "use strict";
@@ -58339,7 +58346,7 @@ var init_data_safety = __esm({
     init_sqlite2();
     init_sqlite_backup();
     init_tasks_schema();
-    log10 = getLogger("data-safety");
+    log11 = getLogger("data-safety");
     DEFAULT_CONFIG2 = {
       verifyWrites: true,
       detectCollisions: true,
@@ -63649,11 +63656,11 @@ var require_core = __commonJS({
     Ajv4.ValidationError = validation_error_1.default;
     Ajv4.MissingRefError = ref_error_1.default;
     exports.default = Ajv4;
-    function checkOptions(checkOpts, options, msg, log11 = "error") {
+    function checkOptions(checkOpts, options, msg, log12 = "error") {
       for (const key in checkOpts) {
         const opt = key;
         if (opt in options)
-          this.logger[log11](`${msg}: option ${key}. ${checkOpts[opt]}`);
+          this.logger[log12](`${msg}: option ${key}. ${checkOpts[opt]}`);
       }
     }
     function getSchEnv(keyRef) {
@@ -71017,7 +71024,7 @@ init_logger();
 init_paths();
 init_tasks_schema();
 import { basename as basename6, relative as relative2 } from "node:path";
-var log5 = getLogger("lifecycle:evidence");
+var log6 = getLogger("lifecycle:evidence");
 async function recordEvidence(epicId, stage, uri, type, options) {
   const now2 = (/* @__PURE__ */ new Date()).toISOString();
   const stageId = `stage-${epicId}-${stage}`;
@@ -71044,7 +71051,7 @@ async function recordEvidence(epicId, stage, uri, type, options) {
       description: options?.description ?? null
     }).run();
   } catch (err) {
-    log5.warn({ err }, "Failed to write evidence to SQLite");
+    log6.warn({ err }, "Failed to write evidence to SQLite");
   }
   return record2;
 }
@@ -76782,7 +76789,7 @@ init_sqlite2();
 init_tasks_schema();
 import { randomUUID as randomUUID5 } from "node:crypto";
 import { and as and8, eq as eq11, sql as sql11 } from "drizzle-orm";
-var log6 = getLogger("link-store");
+var log7 = getLogger("link-store");
 async function getLinksByProvider(providerId, cwd) {
   const db = await getDb(cwd);
   const rows = await db.select().from(externalTaskLinks).where(eq11(externalTaskLinks.providerId, providerId));
@@ -76837,7 +76844,7 @@ async function ensureExternalTaskLinksTable(cwd) {
       )
     );
   } catch (err) {
-    log6.warn({ err }, "Failed to ensure external_task_links table exists");
+    log7.warn({ err }, "Failed to ensure external_task_links table exists");
     throw err;
   }
 }
@@ -76911,7 +76918,7 @@ init_brain_accessor();
 init_brain_sqlite();
 init_data_accessor();
 init_registry3();
-var log7 = getLogger("nexus:transfer");
+var log8 = getLogger("nexus:transfer");
 async function previewTransfer(params) {
   return executeTransferInternal({ ...params, dryRun: true });
 }
@@ -77052,7 +77059,7 @@ async function executeTransferInternal(params) {
       }
     }
   } catch (err) {
-    log7.warn(
+    log8.warn(
       { err, linksCreated },
       "Failed to create external_task_links during transfer \u2014 tasks were transferred successfully but provenance links could not be written"
     );
@@ -77080,7 +77087,7 @@ async function executeTransferInternal(params) {
       })
     });
   } catch (err) {
-    log7.warn({ err }, "nexus transfer audit write failed");
+    log8.warn({ err }, "nexus transfer audit write failed");
   }
   if (mode === "move") {
     let archived = 0;
@@ -77093,7 +77100,7 @@ async function executeTransferInternal(params) {
           });
           archived++;
         } catch (err) {
-          log7.warn({ err, taskId: entry.sourceId }, "failed to archive source task after transfer");
+          log8.warn({ err, taskId: entry.sourceId }, "failed to archive source task after transfer");
         }
       }
     }
@@ -77131,7 +77138,7 @@ async function executeTransferInternal(params) {
         }
       }
     } catch (err) {
-      log7.warn({ err }, "brain observation transfer failed");
+      log8.warn({ err }, "brain observation transfer failed");
     }
     result.brainObservationsTransferred = brainTransferred;
     result.manifest.brainObservationsTransferred = brainTransferred;
@@ -77179,8 +77186,8 @@ async function loadProjectACL(projectPath) {
 async function logAclFailure(projectPath) {
   try {
     const { getLogger: getLogger2 } = await Promise.resolve().then(() => (init_logger(), logger_exports));
-    const log11 = getLogger2("nexus.acl");
-    log11.warn({ projectPath }, "Failed to load ACL configuration, defaulting to deny-all");
+    const log12 = getLogger2("nexus.acl");
+    log12.warn({ projectPath }, "Failed to load ACL configuration, defaulting to deny-all");
   } catch {
   }
 }
@@ -77335,9 +77342,9 @@ async function executeOperation(operation, taskId, projectPath, accessor, direct
 async function logRouteAudit(directive, projectName, taskId, operation, success2, error48) {
   try {
     const { getLogger: getLogger2 } = await Promise.resolve().then(() => (init_logger(), logger_exports));
-    const log11 = getLogger2("nexus.route");
+    const log12 = getLogger2("nexus.route");
     const level = success2 ? "info" : "warn";
-    log11[level](
+    log12[level](
       {
         directive: directive.verb,
         agentId: directive.agentId,
@@ -85909,7 +85916,7 @@ init_data_accessor();
 
 // packages/core/src/stats/workflow-telemetry.ts
 init_logger();
-var log8 = getLogger("workflow-telemetry");
+var log9 = getLogger("workflow-telemetry");
 async function queryTasks(cwd, since) {
   try {
     const { getDb: getDb4 } = await Promise.resolve().then(() => (init_sqlite2(), sqlite_exports));
@@ -85931,7 +85938,7 @@ async function queryTasks(cwd, since) {
     }).from(tasks2).where(conditions.length > 0 ? and13(...conditions) : void 0).all();
     return rows;
   } catch (err) {
-    log8.warn({ err }, "Failed to query tasks for workflow telemetry");
+    log9.warn({ err }, "Failed to query tasks for workflow telemetry");
     return [];
   }
 }
@@ -85965,7 +85972,7 @@ async function queryCompletionAuditRows(cwd, since) {
       return isComplete;
     });
   } catch (err) {
-    log8.warn({ err }, "Failed to query audit log for workflow telemetry");
+    log9.warn({ err }, "Failed to query audit log for workflow telemetry");
     return [];
   }
 }
@@ -87451,11 +87458,11 @@ import { join as join88 } from "node:path";
 import { Readable } from "node:stream";
 import { pipeline } from "node:stream/promises";
 import { createGzip } from "node:zlib";
-var log9 = getLogger("prune");
+var log10 = getLogger("prune");
 async function pruneAuditLog(cleoDir, config2) {
   try {
     if (!config2.auditRetentionDays || config2.auditRetentionDays <= 0) {
-      log9.debug("auditRetentionDays is 0 or unset; skipping audit prune");
+      log10.debug("auditRetentionDays is 0 or unset; skipping audit prune");
       return { rowsArchived: 0, rowsDeleted: 0 };
     }
     const cutoff = new Date(Date.now() - config2.auditRetentionDays * 864e5).toISOString();
@@ -87466,7 +87473,7 @@ async function pruneAuditLog(cleoDir, config2) {
     const db = await getDb4(projectRoot);
     const oldRows = await db.select().from(auditLog2).where(lt4(auditLog2.timestamp, cutoff));
     if (oldRows.length === 0) {
-      log9.debug("No audit_log rows older than cutoff; nothing to prune");
+      log10.debug("No audit_log rows older than cutoff; nothing to prune");
       return { rowsArchived: 0, rowsDeleted: 0 };
     }
     let archivePath;
@@ -87484,17 +87491,17 @@ async function pruneAuditLog(cleoDir, config2) {
         const inStream = Readable.from([jsonlContent]);
         await pipeline(inStream, gzip, outStream);
         rowsArchived = oldRows.length;
-        log9.info(
+        log10.info(
           { archivePath, rowsArchived },
           `Archived ${rowsArchived} audit rows to ${archivePath}`
         );
       } catch (archiveErr) {
-        log9.warn({ err: archiveErr }, "Failed to archive audit rows; continuing with deletion");
+        log10.warn({ err: archiveErr }, "Failed to archive audit rows; continuing with deletion");
         archivePath = void 0;
       }
     }
     await db.delete(auditLog2).where(lt4(auditLog2.timestamp, cutoff)).run();
-    log9.info(
+    log10.info(
       { rowsDeleted: oldRows.length, cutoff },
       `Pruned ${oldRows.length} audit_log rows older than ${cutoff}`
     );
@@ -87504,7 +87511,7 @@ async function pruneAuditLog(cleoDir, config2) {
       archivePath
     };
   } catch (err) {
-    log9.warn({ err }, "audit log pruning failed");
+    log10.warn({ err }, "audit log pruning failed");
     return { rowsArchived: 0, rowsDeleted: 0 };
   }
 }
@@ -96585,6 +96592,7 @@ async function runBrainMaintenance(projectRoot, options) {
     skipDecay = false,
     skipConsolidation = false,
     skipReconciliation = false,
+    skipTierPromotion = false,
     skipEmbeddings = false,
     onProgress
   } = options ?? {};
@@ -96596,6 +96604,7 @@ async function runBrainMaintenance(projectRoot, options) {
     observationsFixed: 0,
     linksRemoved: 0
   };
+  const tierPromotionResult = { promoted: 0, evicted: 0 };
   const embeddingsResult = {
     processed: 0,
     skipped: 0,
@@ -96622,6 +96631,13 @@ async function runBrainMaintenance(projectRoot, options) {
     reconciliationResult.linksRemoved = raw.linksRemoved;
     onProgress?.("reconciliation", 1, 1);
   }
+  if (!skipTierPromotion) {
+    onProgress?.("tier-promotion", 0, 1);
+    const raw = await runTierPromotion(projectRoot);
+    tierPromotionResult.promoted = raw.promoted.length;
+    tierPromotionResult.evicted = raw.evicted.length;
+    onProgress?.("tier-promotion", 1, 1);
+  }
   if (!skipEmbeddings) {
     const raw = await populateEmbeddings(projectRoot, {
       onProgress: (current, total) => {
@@ -96636,6 +96652,7 @@ async function runBrainMaintenance(projectRoot, options) {
     decay: decayResult,
     consolidation: consolidationResult,
     reconciliation: reconciliationResult,
+    tierPromotion: tierPromotionResult,
     embeddings: embeddingsResult,
     duration: Date.now() - startTime
   };
@@ -102838,7 +102855,7 @@ var LEGACY_FILES = [
   "nexus-pre-cleo.db.bak"
 ];
 function detectAndRemoveLegacyGlobalFiles(cleoHomeOverride) {
-  const log11 = getLogger("cleanup-legacy");
+  const log12 = getLogger("cleanup-legacy");
   const cleoHome = cleoHomeOverride ?? getCleoHome();
   const removed = [];
   const errors = [];
@@ -102848,30 +102865,30 @@ function detectAndRemoveLegacyGlobalFiles(cleoHomeOverride) {
       if (fs5.existsSync(fullPath)) {
         fs5.unlinkSync(fullPath);
         removed.push(fileName);
-        log11.info({ file: fullPath }, "Removed legacy global file");
+        log12.info({ file: fullPath }, "Removed legacy global file");
       }
     } catch (err) {
       const message = err instanceof Error ? err.message : String(err);
       errors.push({ file: fileName, error: message });
-      log11.warn({ file: fullPath, error: message }, "Failed to remove legacy global file");
+      log12.warn({ file: fullPath, error: message }, "Failed to remove legacy global file");
     }
   }
   return { removed, errors };
 }
 function detectAndRemoveStrayProjectNexus(projectRoot) {
-  const log11 = getLogger("cleanup-legacy");
+  const log12 = getLogger("cleanup-legacy");
   const strayPath = path5.join(projectRoot, ".cleo", "nexus.db");
   if (fs5.existsSync(strayPath)) {
     try {
       fs5.unlinkSync(strayPath);
-      log11.warn(
+      log12.warn(
         { path: strayPath },
         "Removed stray project-tier nexus.db (violates ADR-036 global-only contract)"
       );
       return { removed: true, path: strayPath };
     } catch (err) {
       const message = err instanceof Error ? err.message : String(err);
-      log11.warn(
+      log12.warn(
         { path: strayPath, error: message },
         "Failed to remove stray project-tier nexus.db \u2014 manual deletion may be required"
       );
@@ -102964,7 +102981,7 @@ function brokenTimestamp() {
   return `${now2.getFullYear()}${pad2(now2.getMonth() + 1)}${pad2(now2.getDate())}-${pad2(now2.getHours())}${pad2(now2.getMinutes())}${pad2(now2.getSeconds())}-${pad3(now2.getMilliseconds())}`;
 }
 function migrateSignaldockToConduit(projectRoot) {
-  const log11 = getLogger("migrate-signaldock-to-conduit");
+  const log12 = getLogger("migrate-signaldock-to-conduit");
   const legacyPath = join112(projectRoot, ".cleo", "signaldock.db");
   const conduitPath = join112(projectRoot, ".cleo", "conduit.db");
   const globalSignaldockPath = join112(getCleoHome(), "signaldock.db");
@@ -102981,13 +102998,13 @@ function migrateSignaldockToConduit(projectRoot) {
   if (!needsSignaldockToConduitMigration(projectRoot)) {
     return result;
   }
-  log11.info({ projectRoot, legacyPath }, "T310 migration: starting signaldock.db \u2192 conduit.db");
+  log12.info({ projectRoot, legacyPath }, "T310 migration: starting signaldock.db \u2192 conduit.db");
   let legacy = null;
   try {
     legacy = new DatabaseSync7(legacyPath, { readOnly: true });
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
-    log11.error({ legacyPath, error: message }, "T310 migration: cannot open legacy signaldock.db");
+    log12.error({ legacyPath, error: message }, "T310 migration: cannot open legacy signaldock.db");
     result.errors.push({ step: "step-2-open-legacy", error: message });
     result.status = "failed";
     return result;
@@ -102995,7 +103012,7 @@ function migrateSignaldockToConduit(projectRoot) {
   try {
     if (!integrityCheckPasses(legacy)) {
       const msg = "Legacy signaldock.db failed PRAGMA integrity_check. Migration aborted \u2014 no changes written. Recovery: inspect the database with sqlite3 and attempt manual repair before re-running.";
-      log11.error({ legacyPath }, msg);
+      log12.error({ legacyPath }, msg);
       result.errors.push({ step: "step-3-legacy-integrity", error: msg });
       result.status = "failed";
       legacy.close();
@@ -103003,7 +103020,7 @@ function migrateSignaldockToConduit(projectRoot) {
     }
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
-    log11.error({ legacyPath, error: message }, "T310 migration: integrity_check threw on legacy DB");
+    log12.error({ legacyPath, error: message }, "T310 migration: integrity_check threw on legacy DB");
     result.errors.push({ step: "step-3-legacy-integrity", error: message });
     result.status = "failed";
     legacy.close();
@@ -103021,7 +103038,7 @@ function migrateSignaldockToConduit(projectRoot) {
     getGlobalSalt();
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
-    log11.error({ error: message }, "T310 migration: getGlobalSalt failed \u2014 migration aborted");
+    log12.error({ error: message }, "T310 migration: getGlobalSalt failed \u2014 migration aborted");
     result.errors.push({ step: "step-6-global-salt", error: message });
     result.status = "failed";
     legacy.close();
@@ -103035,7 +103052,7 @@ function migrateSignaldockToConduit(projectRoot) {
     conduit.exec("PRAGMA foreign_keys = OFF");
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
-    log11.error({ conduitPath, error: message }, "T310 migration: failed to create conduit.db");
+    log12.error({ conduitPath, error: message }, "T310 migration: failed to create conduit.db");
     result.errors.push({ step: "step-7-create-conduit", error: message });
     result.status = "failed";
     legacy.close();
@@ -103081,7 +103098,7 @@ function migrateSignaldockToConduit(projectRoot) {
     result.agentsCopied = agentsCountForConduit;
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
-    log11.error({ error: message }, "T310 migration: conduit.db write failed \u2014 rolling back");
+    log12.error({ error: message }, "T310 migration: conduit.db write failed \u2014 rolling back");
     result.errors.push({ step: "step-8-conduit-write", error: message });
     result.status = "failed";
     try {
@@ -103102,7 +103119,7 @@ function migrateSignaldockToConduit(projectRoot) {
   try {
     if (!integrityCheckPasses(conduit)) {
       const msg = "conduit.db failed PRAGMA integrity_check after write";
-      log11.error({ conduitPath }, msg);
+      log12.error({ conduitPath }, msg);
       result.errors.push({ step: "step-10-conduit-integrity", error: msg });
       result.status = "failed";
       conduit.close();
@@ -103117,7 +103134,7 @@ function migrateSignaldockToConduit(projectRoot) {
     }
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
-    log11.error({ error: message }, "T310 migration: conduit.db integrity_check threw");
+    log12.error({ error: message }, "T310 migration: conduit.db integrity_check threw");
     result.errors.push({ step: "step-10-conduit-integrity", error: message });
     result.status = "failed";
     if (conduit) {
@@ -103139,7 +103156,7 @@ function migrateSignaldockToConduit(projectRoot) {
     globalDb.exec("PRAGMA foreign_keys = OFF");
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
-    log11.error(
+    log12.error(
       { globalSignaldockPath, error: message },
       "T310 migration: cannot open global signaldock.db"
     );
@@ -103178,7 +103195,7 @@ function migrateSignaldockToConduit(projectRoot) {
     result.agentsCopied = agentsCopiedToGlobal;
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
-    log11.error(
+    log12.error(
       { error: message },
       "T310 migration: global signaldock.db write failed \u2014 rolling back"
     );
@@ -103196,7 +103213,7 @@ function migrateSignaldockToConduit(projectRoot) {
   try {
     if (!integrityCheckPasses(globalDb)) {
       const msg = "Global signaldock.db failed PRAGMA integrity_check after write";
-      log11.error({ globalSignaldockPath }, msg);
+      log12.error({ globalSignaldockPath }, msg);
       result.errors.push({ step: "step-14-global-integrity", error: msg });
       result.status = "failed";
       globalDb.close();
@@ -103211,7 +103228,7 @@ function migrateSignaldockToConduit(projectRoot) {
     }
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
-    log11.error({ error: message }, "T310 migration: global signaldock.db integrity_check threw");
+    log12.error({ error: message }, "T310 migration: global signaldock.db integrity_check threw");
     result.errors.push({ step: "step-14-global-integrity", error: message });
     result.status = "failed";
     if (globalDb) {
@@ -103230,21 +103247,21 @@ function migrateSignaldockToConduit(projectRoot) {
     result.bakPath = bakPath;
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
-    log11.error(
+    log12.error(
       { legacyPath, bakPath, error: message },
       "T310 migration: rename to .pre-t310.bak failed \u2014 legacy file left in place (harmless)"
     );
     result.errors.push({ step: "step-16-rename-bak", error: message });
   }
-  log11.info(
+  log12.info(
     { projectRoot, agentsCopied: result.agentsCopied, conduitPath, bakPath: result.bakPath },
     `T310 migration complete: ${result.agentsCopied} agents migrated to global, conduit.db created`
   );
-  log11.warn(
+  log12.warn(
     {},
     "T310 migration: API keys have been re-keyed. External systems holding old API keys (CI env vars, remote agent configs) must be updated."
   );
-  log11.info(
+  log12.info(
     { legacyPath, bakPath: result.bakPath, conduitPath },
     "T310 migration recovery: if problems occur, rename .pre-t310.bak to signaldock.db and delete conduit.db to re-run migration."
   );
@@ -110531,9 +110548,11 @@ export {
   routing_exports as routing,
   runAllMigrations,
   runBrainMaintenance,
+  runConsolidation,
   runDoctorFixes,
   runMigration,
   runReleaseGates,
+  runTierPromotion,
   runUpgrade,
   safestop,
   sanitizeContent,