@cleocode/core 2026.6.11 → 2026.6.13

package/migrations/drizzle-cleo-global/20260608010000_t11709-accounts-credential-pool/migration.sql

@@ -0,0 +1,72 @@
+-- T11709 (EP-PROVIDER-VAULT · epic T10410 · saga SG-VAULT-CORE T10409) — the
+-- pooled-LLM-credential `accounts` table in the consolidated GLOBAL cleo.db
+-- (drizzle-cleo-global scope ONLY — this is a cross-project, machine-wide
+-- credential pool with no project-tier analog, so it is NOT mirrored into
+-- drizzle-cleo-project).
+--
+-- One row per LLM credential ("account") for one provider: the encrypted
+-- secret/refresh material plus rotation / cooldown / health metadata the pool
+-- runner consults to select the next live account and retire dead ones. Replaces
+-- the legacy plaintext JSON blob with a queryable, `cleo health`-visible table.
+--
+-- `secret_enc` / `refresh_enc` are encryptGlobal() ciphertext (T11710), NEVER
+-- plaintext. This is DISTINCT from `agent_registry_accounts` (the better-auth
+-- OAuth-account table) — different physical name, different purpose.
+--
+-- ## Active-account pointer (raw partial unique index)
+--
+-- `is_active` is the per-provider "currently-selected" pointer: AT MOST ONE row
+-- per `provider` may carry `is_active = 1`. drizzle-orm cannot model a partial
+-- `WHERE` unique index, so it is emitted here as raw SQL (the established repo
+-- pattern — cf. `_writer_leases.active`, T11627 · `project_agent_refs.enabled`).
+-- The drizzle schema (accounts.ts) declares only the full-column table plus the
+-- non-partial `(provider, label)` unique index that drizzle CAN emit.
+--
+-- ## Page-2 invariant
+--
+-- This migration runs AFTER the consolidation baseline (…_t11363-consolidation-
+-- cleo-global) which already creates dozens of tables, so `accounts` is NEVER the
+-- first CREATE on a fresh DB — rootpage 2 is already owned by
+-- `__drizzle_migrations` / the baseline tables. No journal pre-create is required.
+--
+-- `IF NOT EXISTS` so a re-open over an already-migrated DB is a no-op. Each
+-- statement is separated by a drizzle breakpoint marker line so node:sqlite
+-- prepare() does not silently truncate the multi-statement file to statement one
+-- (the marker token is intentionally not spelled out in this comment — drizzle's
+-- readMigrationFiles splits the file on that literal substring).
+--
+-- @task T11709
+-- @epic T10410
+-- @saga T10409
+
+CREATE TABLE IF NOT EXISTS `accounts` (
+  `id` integer PRIMARY KEY NOT NULL,
+  `provider` text NOT NULL,
+  `label` text NOT NULL,
+  `auth_type` text NOT NULL,
+  `secret_enc` text,
+  `refresh_enc` text,
+  `expires_at` text,
+  `priority` integer NOT NULL DEFAULT 0,
+  `source` text,
+  `status` text NOT NULL DEFAULT 'ok',
+  `last_error_code` text,
+  `cooldown_reset_at` text,
+  `request_count` integer NOT NULL DEFAULT 0,
+  `metadata` text NOT NULL DEFAULT '{}',
+  `is_active` integer NOT NULL DEFAULT 0,
+  `created_at` text NOT NULL DEFAULT (datetime('now')),
+  `updated_at` text NOT NULL DEFAULT (datetime('now')),
+  CHECK ("status" IN ('ok', 'exhausted', 'dead')),
+  CHECK ("is_active" IN (0, 1)),
+  CHECK ("expires_at" IS NULL OR "expires_at" GLOB '[0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9]*'),
+  CHECK ("cooldown_reset_at" IS NULL OR "cooldown_reset_at" GLOB '[0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9]*'),
+  CHECK ("created_at" IS NULL OR "created_at" GLOB '[0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9]*'),
+  CHECK ("updated_at" IS NULL OR "updated_at" GLOB '[0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9]*')
+);
+--> statement-breakpoint
+CREATE UNIQUE INDEX IF NOT EXISTS `ux_accounts_provider_label` ON `accounts` (`provider`, `label`);
+--> statement-breakpoint
+CREATE UNIQUE INDEX IF NOT EXISTS `ux_accounts_active_provider` ON `accounts` (`provider`) WHERE `is_active` = 1;
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS `idx_accounts_provider_status_priority` ON `accounts` (`provider`, `status`, `priority`);

package/migrations/drizzle-cleo-global/20260608020000_t11889-selfimprove-dhq/migration.sql

@@ -0,0 +1,64 @@
+-- T11889 (T11889-A · T11911) — the self-improvement-loop DHQ sink (`selfimprove_dhq`).
+--
+-- One row per Dogfood-Harness-Question raised by `cleo selfimprove run`: the loop
+-- replays a canned scenario, diffs the LAFS envelopes against a golden, and on
+-- regression UPSERTs exactly ONE row here via the leased Gate-3 accessor
+-- (selfimprove-dhq-store.ts). On green it writes nothing.
+--
+-- Co-located inside EACH scope's consolidated cleo.db (this file is byte-identical
+-- in drizzle-cleo-project and drizzle-cleo-global so the two lineages produce the
+-- SAME migration hash — the consolidated single-file journal converges across both
+-- under the CONSOLIDATED_JOURNAL_LINEAGES cross-lineage guard, T11829). Pure runtime
+-- infrastructure (like `_writer_leases` from T11627 and `pi_session_*` from T11899)
+-- — NOT part of the exodus target shape under `schema/cleo-project/`.
+--
+-- ## Idempotency invariant (partial UNIQUE index)
+--
+-- At most ONE row per `question_hash` may carry `status = 'open'`, so a repeated
+-- regression UPSERTs the same open row instead of spamming duplicates. drizzle-orm
+-- cannot model a partial WHERE unique index, so it is emitted here as raw SQL (the
+-- established repo pattern — cf. `_writer_leases.active`, T11627 ·
+-- `project_agent_refs.enabled`). The drizzle schema (selfimprove-dhq-schema.ts)
+-- declares ONLY the full-column table plus the two non-partial indexes drizzle CAN
+-- emit; the runtime bootstrap asserts this partial index exists
+-- (assertSelfimproveDhqOpenIndexPresent).
+--
+-- ## Page-2 invariant
+--
+-- This migration runs AFTER the consolidation baseline (…_t11363-consolidation-
+-- cleo-project) which already creates dozens of tables, so `selfimprove_dhq` is
+-- NEVER the first CREATE on a fresh DB — rootpage 2 is already owned by
+-- `__drizzle_migrations` / the baseline tables. No journal pre-create is required
+-- (the lease cold-open path pre-creates `__drizzle_migrations` before any first
+-- table, so the precondition holds even on a freshly cold-opened DB).
+--
+-- `IF NOT EXISTS` so a re-open over an already-migrated DB is a no-op. Each
+-- statement is separated by a drizzle breakpoint marker line so node:sqlite
+-- prepare() does not silently truncate the multi-statement file to statement one
+-- (the marker token is intentionally not spelled out in this comment — drizzle's
+-- readMigrationFiles splits the file on that literal substring).
+--
+-- @task T11889
+-- @task T11911
+-- @epic T11889
+
+CREATE TABLE IF NOT EXISTS `selfimprove_dhq` (
+  `id` INTEGER PRIMARY KEY,
+  `dhq_id` TEXT NOT NULL,
+  `scenario` TEXT NOT NULL,
+  `question_hash` TEXT NOT NULL,
+  `title` TEXT NOT NULL,
+  `regression_json` TEXT NOT NULL,
+  `status` TEXT NOT NULL DEFAULT 'open',
+  `severity` TEXT,
+  `pr_url` TEXT,
+  `run_id` TEXT NOT NULL,
+  `created_at` INTEGER NOT NULL,
+  `updated_at` INTEGER NOT NULL
+);
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS `ix_selfimprove_dhq_status` ON `selfimprove_dhq` (`status`);
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS `ix_selfimprove_dhq_scenario` ON `selfimprove_dhq` (`scenario`);
+--> statement-breakpoint
+CREATE UNIQUE INDEX IF NOT EXISTS `ux_selfimprove_dhq_open` ON `selfimprove_dhq` (`question_hash`) WHERE `status` = 'open';

package/migrations/drizzle-cleo-project/20260606000000_t11884-restore-prefixed-task-triggers/migration.sql

@@ -0,0 +1,272 @@
+-- T11884 — Restore task-domain invariant + handoff triggers on the PREFIXED tables.
+--
+-- ==========================================================================
+-- Problem (latent bug exposed by the SG-DB-SUBSTRATE-V2 cutover)
+-- ==========================================================================
+-- The T11578 dual-scope cutover repointed the runtime drizzle symbols
+-- (`tasks`, `task_relations`, `task_acceptance_criteria`, session handoff, …)
+-- from the BARE un-prefixed tables onto the domain-prefixed tables
+-- (`tasks_tasks`, `tasks_task_relations`, …). But the 12 SQLite invariant /
+-- handoff triggers were authored ONLY on the bare tables (T877, T10572,
+-- T10638, T1609) and were never recreated on the prefixed tables — exodus
+-- copies rows with triggers absent on the target. Result: every task invariant
+-- has been SILENTLY UNENFORCED on the live write path (`tasks_tasks` has zero
+-- triggers), and the session-handoff `handoff_json` mirror is dead.
+--
+-- This migration recreates all 12 guards on the prefixed tables, with bodies
+-- rewritten to reference `tasks_tasks` / `tasks_sessions`. New trigger NAMES
+-- are used (prefixed) so they do NOT collide with the still-present legacy
+-- triggers; when the legacy bare tables are dropped (E5 of the cutover) their
+-- triggers drop with them and these remain the SSoT.
+--
+-- Invariants restored:
+--   - tasks_tasks.parent_id cannot introduce a containment cycle
+--   - tasks_tasks.parent_id obeys the saga->epic, epic->task|subtask,
+--     task->subtask type matrix (sagas/tasks are roots)
+--   - tasks_tasks status/pipeline_stage T877 invariant
+--   - tasks_task_relations is non-containment-only
+--   - tasks_task_acceptance_criteria child_task targets must be direct children
+--   - tasks_session_handoff_entries is write-once + mirrors handoff_json into
+--     tasks_sessions
+--
+-- Trigger messages keep the same stable error codes so CLI callers surface
+-- identical remediation regardless of which physical table fired.
+--
+-- @task T11884
+-- @epic T11883
+-- @saga T11242
+
+DROP TRIGGER IF EXISTS `tasks_tasks_parent_cycle_guard_insert`;
+--> statement-breakpoint
+DROP TRIGGER IF EXISTS `tasks_tasks_parent_cycle_guard_update`;
+--> statement-breakpoint
+DROP TRIGGER IF EXISTS `tasks_tasks_parent_type_matrix_insert`;
+--> statement-breakpoint
+DROP TRIGGER IF EXISTS `tasks_tasks_parent_type_matrix_update`;
+--> statement-breakpoint
+DROP TRIGGER IF EXISTS `trg_tasks_tasks_status_pipeline_insert`;
+--> statement-breakpoint
+DROP TRIGGER IF EXISTS `trg_tasks_tasks_status_pipeline_update`;
+--> statement-breakpoint
+DROP TRIGGER IF EXISTS `tasks_task_relations_non_containment_insert`;
+--> statement-breakpoint
+DROP TRIGGER IF EXISTS `tasks_task_relations_non_containment_update`;
+--> statement-breakpoint
+DROP TRIGGER IF EXISTS `tasks_task_acceptance_child_target_insert`;
+--> statement-breakpoint
+DROP TRIGGER IF EXISTS `tasks_task_acceptance_child_target_update`;
+--> statement-breakpoint
+DROP TRIGGER IF EXISTS `trg_tasks_session_handoff_mirror`;
+--> statement-breakpoint
+DROP TRIGGER IF EXISTS `trg_tasks_session_handoff_no_update`;
+--> statement-breakpoint
+
+-- ---------------------------------------------------------------------------
+-- Parent-cycle guard (T10572) — tasks_tasks
+-- ---------------------------------------------------------------------------
+CREATE TRIGGER `tasks_tasks_parent_cycle_guard_insert`
+BEFORE INSERT ON `tasks_tasks`
+WHEN NEW.`parent_id` IS NOT NULL
+BEGIN
+  SELECT RAISE(ABORT, 'E_TASK_PARENT_CYCLE: tasks.parent_id cannot create a containment cycle')
+  WHERE EXISTS (
+    WITH RECURSIVE ancestors(`id`, `parent_id`) AS (
+      SELECT parent.`id`, parent.`parent_id`
+      FROM `tasks_tasks` parent
+      WHERE parent.`id` = NEW.`parent_id`
+      UNION ALL
+      SELECT next_parent.`id`, next_parent.`parent_id`
+      FROM `tasks_tasks` next_parent
+      JOIN ancestors ON next_parent.`id` = ancestors.`parent_id`
+      WHERE ancestors.`parent_id` IS NOT NULL
+    )
+    SELECT 1 FROM ancestors WHERE ancestors.`id` = NEW.`id`
+  );
+END;
+--> statement-breakpoint
+
+CREATE TRIGGER `tasks_tasks_parent_cycle_guard_update`
+BEFORE UPDATE OF `parent_id` ON `tasks_tasks`
+WHEN NEW.`parent_id` IS NOT NULL
+BEGIN
+  SELECT RAISE(ABORT, 'E_TASK_PARENT_CYCLE: tasks.parent_id cannot create a containment cycle')
+  WHERE EXISTS (
+    WITH RECURSIVE ancestors(`id`, `parent_id`) AS (
+      SELECT parent.`id`, parent.`parent_id`
+      FROM `tasks_tasks` parent
+      WHERE parent.`id` = NEW.`parent_id`
+      UNION ALL
+      SELECT next_parent.`id`, next_parent.`parent_id`
+      FROM `tasks_tasks` next_parent
+      JOIN ancestors ON next_parent.`id` = ancestors.`parent_id`
+      WHERE ancestors.`parent_id` IS NOT NULL
+    )
+    SELECT 1 FROM ancestors WHERE ancestors.`id` = NEW.`id`
+  );
+END;
+--> statement-breakpoint
+
+-- ---------------------------------------------------------------------------
+-- Parent type-matrix guard (T10638) — tasks_tasks
+-- ---------------------------------------------------------------------------
+CREATE TRIGGER `tasks_tasks_parent_type_matrix_insert`
+BEFORE INSERT ON `tasks_tasks`
+WHEN NEW.`parent_id` IS NOT NULL
+  AND NEW.`type` IS NOT NULL
+  AND EXISTS (SELECT 1 FROM `tasks_tasks` parent WHERE parent.`id` = NEW.`parent_id` AND parent.`type` IS NOT NULL)
+  AND NOT EXISTS (
+    SELECT 1
+    FROM `tasks_tasks` parent
+    WHERE parent.`id` = NEW.`parent_id`
+      AND (
+        (NEW.`type` = 'epic'  AND parent.`type` = 'saga')
+        OR (NEW.`type` = 'task'   AND parent.`type` = 'epic')
+        OR (NEW.`type` = 'subtask' AND parent.`type` IN ('epic', 'task'))
+      )
+  )
+BEGIN
+  SELECT RAISE(ABORT, 'E_TASK_PARENT_TYPE_MATRIX: tasks.parent_id must follow saga->epic, epic->task|subtask, and task->subtask; sagas/tasks must be roots');
+END;
+--> statement-breakpoint
+
+CREATE TRIGGER `tasks_tasks_parent_type_matrix_update`
+BEFORE UPDATE OF `parent_id`, `type` ON `tasks_tasks`
+WHEN NEW.`parent_id` IS NOT NULL
+  AND NEW.`type` IS NOT NULL
+  AND EXISTS (SELECT 1 FROM `tasks_tasks` parent WHERE parent.`id` = NEW.`parent_id` AND parent.`type` IS NOT NULL)
+  AND NOT EXISTS (
+    SELECT 1
+    FROM `tasks_tasks` parent
+    WHERE parent.`id` = NEW.`parent_id`
+      AND (
+        (NEW.`type` = 'epic'  AND parent.`type` = 'saga')
+        OR (NEW.`type` = 'task'   AND parent.`type` = 'epic')
+        OR (NEW.`type` = 'subtask' AND parent.`type` IN ('epic', 'task'))
+      )
+  )
+BEGIN
+  SELECT RAISE(ABORT, 'E_TASK_PARENT_TYPE_MATRIX: tasks.parent_id must follow saga->epic, epic->task|subtask, and task->subtask; sagas/tasks must be roots');
+END;
+--> statement-breakpoint
+
+-- ---------------------------------------------------------------------------
+-- Status / pipeline_stage invariant (T877) — tasks_tasks
+-- ---------------------------------------------------------------------------
+CREATE TRIGGER `trg_tasks_tasks_status_pipeline_insert`
+BEFORE INSERT ON `tasks_tasks`
+FOR EACH ROW
+WHEN (NEW.`status` = 'done'      AND (NEW.`pipeline_stage` IS NULL OR NEW.`pipeline_stage` NOT IN ('contribution','cancelled')))
+  OR (NEW.`status` = 'cancelled' AND (NEW.`pipeline_stage` IS NULL OR NEW.`pipeline_stage` != 'cancelled'))
+BEGIN
+  SELECT RAISE(ABORT, 'T877_INVARIANT_VIOLATION: status/pipeline_stage mismatch. status=done requires pipeline_stage IN (contribution,cancelled); status=cancelled requires pipeline_stage=cancelled.');
+END;
+--> statement-breakpoint
+
+CREATE TRIGGER `trg_tasks_tasks_status_pipeline_update`
+BEFORE UPDATE OF `status`, `pipeline_stage` ON `tasks_tasks`
+FOR EACH ROW
+WHEN (NEW.`status` = 'done'      AND (NEW.`pipeline_stage` IS NULL OR NEW.`pipeline_stage` NOT IN ('contribution','cancelled')))
+  OR (NEW.`status` = 'cancelled' AND (NEW.`pipeline_stage` IS NULL OR NEW.`pipeline_stage` != 'cancelled'))
+BEGIN
+  SELECT RAISE(ABORT, 'T877_INVARIANT_VIOLATION: status/pipeline_stage mismatch. status=done requires pipeline_stage IN (contribution,cancelled); status=cancelled requires pipeline_stage=cancelled.');
+END;
+--> statement-breakpoint
+
+-- ---------------------------------------------------------------------------
+-- Non-containment guard (T10572) — tasks_task_relations
+-- ---------------------------------------------------------------------------
+CREATE TRIGGER `tasks_task_relations_non_containment_insert`
+BEFORE INSERT ON `tasks_task_relations`
+WHEN EXISTS (
+  SELECT 1
+  FROM `tasks_tasks` child
+  WHERE child.`id` = NEW.`task_id`
+    AND child.`parent_id` = NEW.`related_to`
+) OR EXISTS (
+  SELECT 1
+  FROM `tasks_tasks` child
+  WHERE child.`id` = NEW.`related_to`
+    AND child.`parent_id` = NEW.`task_id`
+)
+BEGIN
+  SELECT RAISE(ABORT, 'E_TASK_RELATION_CONTAINMENT: task_relations is non-containment-only; use tasks.parent_id for parent/child edges');
+END;
+--> statement-breakpoint
+
+CREATE TRIGGER `tasks_task_relations_non_containment_update`
+BEFORE UPDATE OF `task_id`, `related_to` ON `tasks_task_relations`
+WHEN EXISTS (
+  SELECT 1
+  FROM `tasks_tasks` child
+  WHERE child.`id` = NEW.`task_id`
+    AND child.`parent_id` = NEW.`related_to`
+) OR EXISTS (
+  SELECT 1
+  FROM `tasks_tasks` child
+  WHERE child.`id` = NEW.`related_to`
+    AND child.`parent_id` = NEW.`task_id`
+)
+BEGIN
+  SELECT RAISE(ABORT, 'E_TASK_RELATION_CONTAINMENT: task_relations is non-containment-only; use tasks.parent_id for parent/child edges');
+END;
+--> statement-breakpoint
+
+-- ---------------------------------------------------------------------------
+-- Acceptance child_target containment guard (T10572) — tasks_task_acceptance_criteria
+-- ---------------------------------------------------------------------------
+CREATE TRIGGER `tasks_task_acceptance_child_target_insert`
+BEFORE INSERT ON `tasks_task_acceptance_criteria`
+WHEN NEW.`target_task_id` IS NOT NULL
+  AND (
+    NEW.`kind` <> 'child_task'
+    OR NOT EXISTS (
+      SELECT 1
+      FROM `tasks_tasks` child
+      WHERE child.`id` = NEW.`target_task_id`
+        AND child.`parent_id` = NEW.`task_id`
+    )
+  )
+BEGIN
+  SELECT RAISE(ABORT, 'E_CHILD_TASK_TARGET_CONTAINMENT: child_task acceptance target_task_id must be a direct child of task_id; non-child_task criteria must not set target_task_id');
+END;
+--> statement-breakpoint
+
+CREATE TRIGGER `tasks_task_acceptance_child_target_update`
+BEFORE UPDATE OF `task_id`, `kind`, `target_task_id` ON `tasks_task_acceptance_criteria`
+WHEN NEW.`target_task_id` IS NOT NULL
+  AND (
+    NEW.`kind` <> 'child_task'
+    OR NOT EXISTS (
+      SELECT 1
+      FROM `tasks_tasks` child
+      WHERE child.`id` = NEW.`target_task_id`
+        AND child.`parent_id` = NEW.`task_id`
+    )
+  )
+BEGIN
+  SELECT RAISE(ABORT, 'E_CHILD_TASK_TARGET_CONTAINMENT: child_task acceptance target_task_id must be a direct child of task_id; non-child_task criteria must not set target_task_id');
+END;
+--> statement-breakpoint
+
+-- ---------------------------------------------------------------------------
+-- Session-handoff write-once + mirror (T1609) — tasks_session_handoff_entries
+-- ---------------------------------------------------------------------------
+CREATE TRIGGER `trg_tasks_session_handoff_mirror`
+AFTER INSERT ON `tasks_session_handoff_entries`
+FOR EACH ROW
+BEGIN
+  UPDATE `tasks_sessions`
+     SET `handoff_json` = NEW.handoff_json
+   WHERE `id` = NEW.session_id;
+END;
+--> statement-breakpoint
+
+CREATE TRIGGER `trg_tasks_session_handoff_no_update`
+BEFORE UPDATE ON `tasks_session_handoff_entries`
+FOR EACH ROW
+BEGIN
+  SELECT RAISE(
+    ABORT,
+    'T1609_HANDOFF_IMMUTABLE: session_handoff_entries rows are write-once. Use persistHandoff() exactly once per session.'
+  );
+END;

package/migrations/drizzle-cleo-project/20260606000000_t11884-restore-prefixed-task-triggers/revert.sql

@@ -0,0 +1,29 @@
+-- Revert T11884 — drop the prefixed-table invariant + handoff triggers.
+-- The legacy bare-table triggers are untouched (they remain the active guards
+-- until the E5 cutover drops the bare tables).
+--
+-- @task T11884
+
+DROP TRIGGER IF EXISTS `tasks_tasks_parent_cycle_guard_insert`;
+--> statement-breakpoint
+DROP TRIGGER IF EXISTS `tasks_tasks_parent_cycle_guard_update`;
+--> statement-breakpoint
+DROP TRIGGER IF EXISTS `tasks_tasks_parent_type_matrix_insert`;
+--> statement-breakpoint
+DROP TRIGGER IF EXISTS `tasks_tasks_parent_type_matrix_update`;
+--> statement-breakpoint
+DROP TRIGGER IF EXISTS `trg_tasks_tasks_status_pipeline_insert`;
+--> statement-breakpoint
+DROP TRIGGER IF EXISTS `trg_tasks_tasks_status_pipeline_update`;
+--> statement-breakpoint
+DROP TRIGGER IF EXISTS `tasks_task_relations_non_containment_insert`;
+--> statement-breakpoint
+DROP TRIGGER IF EXISTS `tasks_task_relations_non_containment_update`;
+--> statement-breakpoint
+DROP TRIGGER IF EXISTS `tasks_task_acceptance_child_target_insert`;
+--> statement-breakpoint
+DROP TRIGGER IF EXISTS `tasks_task_acceptance_child_target_update`;
+--> statement-breakpoint
+DROP TRIGGER IF EXISTS `trg_tasks_session_handoff_mirror`;
+--> statement-breakpoint
+DROP TRIGGER IF EXISTS `trg_tasks_session_handoff_no_update`;

package/migrations/drizzle-cleo-project/20260606000100_t11883-tasks-releases-version-unique/migration.sql

@@ -0,0 +1,21 @@
+-- T11883 (E2) — Repair the missing UNIQUE index on tasks_releases.version.
+--
+-- The drizzle schema declares `version: text('version').notNull().unique()`
+-- (packages/core/src/store/schema/cleo-project/provenance-rest.ts:201), but the
+-- T11363 consolidation migration that built `tasks_releases` emitted only a
+-- NON-unique `idx_tasks_releases_version` — the UNIQUE was dropped during the
+-- exodus build. `cleo release plan` upserts with
+-- `onConflictDoUpdate({ target: releases.version })`, which REQUIRES a physical
+-- unique index on `version`; once the provenance `releases` symbol is rebound to
+-- `tasks_releases` (E3) the upsert would otherwise throw "ON CONFLICT clause
+-- does not match any PRIMARY KEY or UNIQUE constraint". This is a pure
+-- drift-repair (schema↔physical), so it ships as a custom migration rather than
+-- a generated one (generate has no committed snapshot to diff an index against).
+--
+-- Safe: the live corpus has 0 duplicate versions (74 rows), and fresh/test DBs
+-- are empty. IF NOT EXISTS keeps it idempotent under the reconciler's re-probe.
+--
+-- @task T11883
+-- @saga T11242
+
+CREATE UNIQUE INDEX IF NOT EXISTS `uq_tasks_releases_version` ON `tasks_releases` (`version`);

package/migrations/drizzle-cleo-project/20260606000100_t11883-tasks-releases-version-unique/revert.sql

@@ -0,0 +1,4 @@
+-- Revert T11883 (E2) — drop the repaired UNIQUE index on tasks_releases.version.
+-- @task T11883
+
+DROP INDEX IF EXISTS `uq_tasks_releases_version`;

package/migrations/drizzle-cleo-project/20260607000000_t11891-writer-leases/migration.sql

@@ -0,0 +1,55 @@
+-- T11627 (ST-2) — DbWriterLease arbitration tables (local-mode, daemon-disabled).
+--
+-- Co-located inside EACH scope's consolidated cleo.db (this file is byte-identical
+-- in drizzle-cleo-project and drizzle-cleo-global so the two lineages produce the
+-- SAME migration hash — the consolidated single-file journal converges across both
+-- under the CONSOLIDATED_JOURNAL_LINEAGES cross-lineage guard, T11829).
+--
+-- The lease engine (packages/core/src/store/writer-lease.ts) arbitrates a single
+-- in-process writer per (scope, lane) via BEGIN IMMEDIATE + epoch-CAS over the
+-- `_writer_leases` row, healing the T5158 multi-writer corruption WITHOUT a running
+-- supervisor daemon.
+--
+-- AC1 (at most one active writer per scope/lane) is enforced by the PARTIAL UNIQUE
+-- index `ux_writer_leases_active … WHERE active = 1`. drizzle-orm cannot model a
+-- partial WHERE index, so it is emitted here as raw SQL (the established repo
+-- pattern — cf. project_agent_refs.enabled in conduit-schema). The drizzle schema
+-- (writer-lease-schema.ts) declares ONLY the full-column tables; the runtime
+-- bootstrap asserts this index exists (assertWriterLeaseActiveIndexPresent).
+--
+-- Each statement is separated by a drizzle breakpoint marker line so node:sqlite
+-- prepare() does not silently truncate the multi-statement file to statement one.
+-- (The marker token is intentionally NOT spelled out in this comment: drizzle's
+-- readMigrationFiles splits the file on that literal substring, so writing it here
+-- would split the comment mid-line and corrupt statement one.)
+--
+-- @task T11627
+-- @epic T11625
+
+CREATE TABLE IF NOT EXISTS `_writer_leases` (
+  `id` INTEGER PRIMARY KEY,
+  `scope` TEXT NOT NULL,
+  `lane` TEXT NOT NULL,
+  `holder_id` TEXT NOT NULL,
+  `holder_pid` INTEGER NOT NULL,
+  `epoch` INTEGER NOT NULL,
+  `acquired_at` INTEGER NOT NULL,
+  `heartbeat_at` INTEGER NOT NULL,
+  `ttl_ms` INTEGER NOT NULL,
+  `reentrancy_depth` INTEGER NOT NULL DEFAULT 1,
+  `active` INTEGER NOT NULL DEFAULT 1
+);
+--> statement-breakpoint
+CREATE UNIQUE INDEX IF NOT EXISTS `ux_writer_leases_active` ON `_writer_leases` (`scope`, `lane`) WHERE `active` = 1;
+--> statement-breakpoint
+CREATE TABLE IF NOT EXISTS `_writer_queue` (
+  `ticket` INTEGER PRIMARY KEY AUTOINCREMENT,
+  `scope` TEXT NOT NULL,
+  `lane` TEXT NOT NULL,
+  `holder_id` TEXT NOT NULL,
+  `priority` INTEGER NOT NULL DEFAULT 100,
+  `enqueued_at` INTEGER NOT NULL,
+  `deadline_at` INTEGER NOT NULL
+);
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS `ix_writer_queue_order` ON `_writer_queue` (`scope`, `lane`, `priority` ASC, `ticket` ASC);

package/migrations/drizzle-cleo-project/20260607010000_t11639-session-parent/migration.sql

@@ -0,0 +1,22 @@
+-- T11639 (EP-SESSION-MANIFEST · epic T11638) — add nullable `parent_session_id`
+-- to `tasks_sessions` (consolidated PROJECT cleo.db, drizzle-cleo-project scope).
+--
+-- The fork-tree PARENT session edge: the orchestrator→worker spawn relationship,
+-- sourced from CLEO_PARENT_SESSION_ID (stamped by the supervisor — T11629 / PR #996)
+-- at session start. Distinct from `previous_session_id` (the linear resume chain).
+-- Soft self-reference to `tasks_sessions.id`; nullable so a root session (no spawning
+-- parent) and every existing row stay valid.
+--
+-- No CHECK constraint: `parent_session_id` is a plain free-text soft self-FK (not a
+-- timestamp `_at`, boolean, or enum), so the T11363 consolidation-check injector
+-- contributes nothing for it.
+--
+-- Each statement is separated by a drizzle breakpoint marker so node:sqlite prepare()
+-- does not truncate the multi-statement file to statement one.
+--
+-- @task T11639
+-- @epic T11638
+
+ALTER TABLE `tasks_sessions` ADD COLUMN `parent_session_id` text;
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS `idx_tasks_sessions_parent` ON `tasks_sessions` (`parent_session_id`);

package/migrations/drizzle-cleo-project/20260608000000_t11899-pi-session-tree/migration.sql

@@ -0,0 +1,52 @@
+-- T11761 (S3 · T11899) — Pi `SessionStorage` tree-persistence tables.
+--
+-- Backs `CleoSessionStorage` (packages/core/src/llm/pi/pi-session-storage.ts):
+-- the durable cleo.db implementation of Pi's tree-structured `SessionStorage`
+-- interface (@earendil-works/pi-agent-core). Every Pi session is a tree of
+-- `SessionTreeEntry` nodes (id / parentId / timestamp / type / payload) plus one
+-- leaf pointer per session; this file is the physical home for both.
+--
+-- Pure runtime infrastructure (like `_writer_leases` from T11627) — NOT part of
+-- the exodus target shape under `schema/cleo-project/`. Co-located inside EACH
+-- scope's consolidated cleo.db via the existing drizzle-cleo-project /
+-- drizzle-cleo-global migration sets; this file is byte-identical across both
+-- lineages so the two produce the SAME migration hash (the consolidated
+-- single-file journal converges across both under CONSOLIDATED_JOURNAL_LINEAGES,
+-- T11829). The Pi adapter resolves PROJECT scope; the global copy keeps the two
+-- lineages' DDL convergent (the lease-table precedent).
+--
+-- ALL writes go through the writer lease (withWriterLease('project', 'bulk', …),
+-- writer-lease.ts:1067) — the adapter NEVER opens a raw writer (Gate 3). These
+-- tables are written by the store accessor (pi-session-store.ts) over the native
+-- handle openDualScopeDb already holds, inside the leased section.
+--
+-- Each statement is separated by a drizzle breakpoint marker line so node:sqlite
+-- prepare() does not silently truncate the multi-statement file to statement one
+-- (the marker token is intentionally not spelled out in this comment — drizzle's
+-- readMigrationFiles splits the file on that literal substring).
+--
+-- @task T11899
+-- @task T11761
+-- @epic T10403
+
+CREATE TABLE IF NOT EXISTS `pi_session_entries` (
+  `session_id` TEXT NOT NULL,
+  `entry_id` TEXT NOT NULL,
+  `parent_id` TEXT,
+  `type` TEXT NOT NULL,
+  `payload_json` TEXT NOT NULL,
+  `seq` INTEGER NOT NULL,
+  `ts` TEXT NOT NULL,
+  PRIMARY KEY (`session_id`, `entry_id`)
+);
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS `ix_pi_session_entries_seq` ON `pi_session_entries` (`session_id`, `seq` ASC);
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS `ix_pi_session_entries_parent` ON `pi_session_entries` (`session_id`, `parent_id`);
+--> statement-breakpoint
+CREATE TABLE IF NOT EXISTS `pi_session_leaf` (
+  `session_id` TEXT PRIMARY KEY,
+  `leaf_id` TEXT,
+  `created_at` TEXT NOT NULL,
+  `updated_at` TEXT NOT NULL
+);

package/migrations/drizzle-cleo-project/20260608020000_t11889-selfimprove-dhq/migration.sql

@@ -0,0 +1,64 @@
+-- T11889 (T11889-A · T11911) — the self-improvement-loop DHQ sink (`selfimprove_dhq`).
+--
+-- One row per Dogfood-Harness-Question raised by `cleo selfimprove run`: the loop
+-- replays a canned scenario, diffs the LAFS envelopes against a golden, and on
+-- regression UPSERTs exactly ONE row here via the leased Gate-3 accessor
+-- (selfimprove-dhq-store.ts). On green it writes nothing.
+--
+-- Co-located inside EACH scope's consolidated cleo.db (this file is byte-identical
+-- in drizzle-cleo-project and drizzle-cleo-global so the two lineages produce the
+-- SAME migration hash — the consolidated single-file journal converges across both
+-- under the CONSOLIDATED_JOURNAL_LINEAGES cross-lineage guard, T11829). Pure runtime
+-- infrastructure (like `_writer_leases` from T11627 and `pi_session_*` from T11899)
+-- — NOT part of the exodus target shape under `schema/cleo-project/`.
+--
+-- ## Idempotency invariant (partial UNIQUE index)
+--
+-- At most ONE row per `question_hash` may carry `status = 'open'`, so a repeated
+-- regression UPSERTs the same open row instead of spamming duplicates. drizzle-orm
+-- cannot model a partial WHERE unique index, so it is emitted here as raw SQL (the
+-- established repo pattern — cf. `_writer_leases.active`, T11627 ·
+-- `project_agent_refs.enabled`). The drizzle schema (selfimprove-dhq-schema.ts)
+-- declares ONLY the full-column table plus the two non-partial indexes drizzle CAN
+-- emit; the runtime bootstrap asserts this partial index exists
+-- (assertSelfimproveDhqOpenIndexPresent).
+--
+-- ## Page-2 invariant
+--
+-- This migration runs AFTER the consolidation baseline (…_t11363-consolidation-
+-- cleo-project) which already creates dozens of tables, so `selfimprove_dhq` is
+-- NEVER the first CREATE on a fresh DB — rootpage 2 is already owned by
+-- `__drizzle_migrations` / the baseline tables. No journal pre-create is required
+-- (the lease cold-open path pre-creates `__drizzle_migrations` before any first
+-- table, so the precondition holds even on a freshly cold-opened DB).
+--
+-- `IF NOT EXISTS` so a re-open over an already-migrated DB is a no-op. Each
+-- statement is separated by a drizzle breakpoint marker line so node:sqlite
+-- prepare() does not silently truncate the multi-statement file to statement one
+-- (the marker token is intentionally not spelled out in this comment — drizzle's
+-- readMigrationFiles splits the file on that literal substring).
+--
+-- @task T11889
+-- @task T11911
+-- @epic T11889
+
+CREATE TABLE IF NOT EXISTS `selfimprove_dhq` (
+  `id` INTEGER PRIMARY KEY,
+  `dhq_id` TEXT NOT NULL,
+  `scenario` TEXT NOT NULL,
+  `question_hash` TEXT NOT NULL,
+  `title` TEXT NOT NULL,
+  `regression_json` TEXT NOT NULL,
+  `status` TEXT NOT NULL DEFAULT 'open',
+  `severity` TEXT,
+  `pr_url` TEXT,
+  `run_id` TEXT NOT NULL,
+  `created_at` INTEGER NOT NULL,
+  `updated_at` INTEGER NOT NULL
+);
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS `ix_selfimprove_dhq_status` ON `selfimprove_dhq` (`status`);
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS `ix_selfimprove_dhq_scenario` ON `selfimprove_dhq` (`scenario`);
+--> statement-breakpoint
+CREATE UNIQUE INDEX IF NOT EXISTS `ux_selfimprove_dhq_open` ON `selfimprove_dhq` (`question_hash`) WHERE `status` = 'open';