@cleocode/core 2026.6.19 → 2026.7.1

package/dist/docs/export-document.js

@@ -12419,7 +12419,7 @@ var init_lafs = __esm({
 
 // packages/contracts/src/lease-ipc/messages.ts
 import { z as z11 } from "zod";
-var LeaseScopeSchema, LeaseLaneSchema, LeaseAcquireRequestSchema, LeaseReleaseRequestSchema, LeaseRenewRequestSchema, RateCheckRequestSchema, ToolGrantRequestSchema, QueuePriorityClassSchema, QueueAdmitRequestSchema, WorkerHeartbeatRequestSchema, LeaseIpcRequestSchema, LeaseGrantedResponseSchema, LeaseQueuedResponseSchema, LeaseDeniedResponseSchema, RateResultResponseSchema, ToolGrantedResponseSchema, LeaseRevokedResponseSchema, ChildKilledUnresponsiveResponseSchema, QueueAdmitDispositionSchema, QueueAdmitResultResponseSchema, HeartbeatAckResponseSchema, LeaseErrorResponseSchema, LeaseIpcResponseSchema, LeaseIpcRequestEnvelopeSchema, LeaseIpcResponseEnvelopeSchema, LeaseIpcEnvelopeSchema, LEASE_IPC_REQUEST_KINDS, LEASE_IPC_RESPONSE_KINDS, LEASE_IPC_MESSAGE_KINDS;
+var LeaseScopeSchema, LeaseLaneSchema, LeaseAcquireRequestSchema, LeaseReleaseRequestSchema, LeaseRenewRequestSchema, RateCheckRequestSchema, ToolGrantRequestSchema, QueuePriorityClassSchema, QueueAdmitRequestSchema, WorkerHeartbeatRequestSchema, ResourceAdmitRequestSchema, ResourceReleaseRequestSchema, LeaseIpcRequestSchema, LeaseGrantedResponseSchema, LeaseQueuedResponseSchema, LeaseDeniedResponseSchema, RateResultResponseSchema, ToolGrantedResponseSchema, LeaseRevokedResponseSchema, ChildKilledUnresponsiveResponseSchema, QueueAdmitDispositionSchema, QueueAdmitResultResponseSchema, HeartbeatAckResponseSchema, ResourceAdmitDispositionSchema, ResourceAdmitResultResponseSchema, ResourceReleaseResultResponseSchema, LeaseErrorResponseSchema, LeaseIpcResponseSchema, LeaseIpcRequestEnvelopeSchema, LeaseIpcResponseEnvelopeSchema, LeaseIpcEnvelopeSchema, LEASE_IPC_REQUEST_KINDS, LEASE_IPC_RESPONSE_KINDS, LEASE_IPC_MESSAGE_KINDS;
 var init_messages2 = __esm({
   "packages/contracts/src/lease-ipc/messages.ts"() {
     "use strict";
@@ -12504,6 +12504,24 @@ var init_messages2 = __esm({
       /** The worker's own view of whether it is currently inside an LLM call. */
       in_flight_llm: z11.boolean()
     }).strict();
+    ResourceAdmitRequestSchema = z11.object({
+      /** Tag discriminating this request variant. */
+      kind: z11.literal("resource_admit"),
+      /** The resource class (e.g. `"db-heavy"`, `"full-build"`, `"test-run"`). */
+      class: z11.string().min(1),
+      /** The caller holding the slot — process/worktree-unique; the release key. */
+      holder_id: z11.string().min(1),
+      /** The client-computed budget: the max concurrent holders for this class. */
+      budget: z11.number().int().nonnegative()
+    }).strict();
+    ResourceReleaseRequestSchema = z11.object({
+      /** Tag discriminating this request variant. */
+      kind: z11.literal("resource_release"),
+      /** The resource class the slot belongs to. */
+      class: z11.string().min(1),
+      /** The holder that was admitted (matches the admit `holder_id`). */
+      holder_id: z11.string().min(1)
+    }).strict();
     LeaseIpcRequestSchema = z11.discriminatedUnion("kind", [
       LeaseAcquireRequestSchema,
       LeaseReleaseRequestSchema,
@@ -12511,7 +12529,9 @@ var init_messages2 = __esm({
       RateCheckRequestSchema,
       ToolGrantRequestSchema,
       QueueAdmitRequestSchema,
-      WorkerHeartbeatRequestSchema
+      WorkerHeartbeatRequestSchema,
+      ResourceAdmitRequestSchema,
+      ResourceReleaseRequestSchema
     ]);
     LeaseGrantedResponseSchema = z11.object({
       /** Tag discriminating this response variant. */
@@ -12612,6 +12632,25 @@ var init_messages2 = __esm({
       /** Tag discriminating this response variant. */
       kind: z11.literal("heartbeat_ack")
     }).strict();
+    ResourceAdmitDispositionSchema = z11.enum(["admitted", "deferred"]);
+    ResourceAdmitResultResponseSchema = z11.object({
+      /** Tag discriminating this response variant. */
+      kind: z11.literal("resource_admit_result"),
+      /** Whether the heavy op was admitted or deferred. */
+      disposition: ResourceAdmitDispositionSchema,
+      /** Back-off in ms before re-requesting (0 when admitted). */
+      retry_after_ms: z11.number().int().nonnegative(),
+      /** Remaining slots for the class after this decision. */
+      slots_remaining: z11.number().int().nonnegative()
+    }).strict();
+    ResourceReleaseResultResponseSchema = z11.object({
+      /** Tag discriminating this response variant. */
+      kind: z11.literal("resource_release_result"),
+      /** Whether a held slot was actually released (false = no such holder). */
+      released: z11.boolean(),
+      /** Remaining in-flight holders for the class after the release. */
+      slots_remaining: z11.number().int().nonnegative()
+    }).strict();
     LeaseErrorResponseSchema = z11.object({
       /** Tag discriminating this response variant. */
       kind: z11.literal("error"),
@@ -12630,6 +12669,8 @@ var init_messages2 = __esm({
       ChildKilledUnresponsiveResponseSchema,
       QueueAdmitResultResponseSchema,
       HeartbeatAckResponseSchema,
+      ResourceAdmitResultResponseSchema,
+      ResourceReleaseResultResponseSchema,
       LeaseErrorResponseSchema
     ]);
     LeaseIpcRequestEnvelopeSchema = z11.object({
@@ -12663,7 +12704,9 @@ var init_messages2 = __esm({
       "rate_check",
       "tool_grant",
       "queue_admit",
-      "worker_heartbeat"
+      "worker_heartbeat",
+      "resource_admit",
+      "resource_release"
     ];
     LEASE_IPC_RESPONSE_KINDS = [
       "lease_granted",
@@ -12675,6 +12718,8 @@ var init_messages2 = __esm({
       "child_killed_unresponsive",
       "queue_admit_result",
       "heartbeat_ack",
+      "resource_admit_result",
+      "resource_release_result",
       "error"
     ];
     LEASE_IPC_MESSAGE_KINDS = [
@@ -12685,9 +12730,11 @@ var init_messages2 = __esm({
 });
 
 // packages/contracts/src/lease-ipc/version.ts
+var LEASE_IPC_PROTOCOL_VERSION;
 var init_version2 = __esm({
   "packages/contracts/src/lease-ipc/version.ts"() {
     "use strict";
+    LEASE_IPC_PROTOCOL_VERSION = "1.2.0";
   }
 });
 
@@ -13891,6 +13938,25 @@ var init_render = __esm({
   }
 });
 
+// packages/contracts/src/resource-governor.ts
+var RESOURCE_CLASSES, DEFAULT_RESOURCE_RETRY_AFTER_MS;
+var init_resource_governor = __esm({
+  "packages/contracts/src/resource-governor.ts"() {
+    "use strict";
+    RESOURCE_CLASSES = Object.freeze([
+      "interactive-cli",
+      "agent-session",
+      "llm-call",
+      "test-run",
+      "scoped-build",
+      "full-build",
+      "db-heavy",
+      "background-autonomous"
+    ]);
+    DEFAULT_RESOURCE_RETRY_AFTER_MS = 2e3;
+  }
+});
+
 // packages/contracts/src/session.ts
 var init_session2 = __esm({
   "packages/contracts/src/session.ts"() {
@@ -15642,6 +15708,7 @@ var init_src = __esm({
     init_evidence_atoms();
     init_plan();
     init_render();
+    init_resource_governor();
     init_session2();
     init_session_journal();
     init_status_registry();
@@ -17555,7 +17622,7 @@ var init_sql = __esm({
         return new SQL([new StringChunk(str)]);
       }
       _sql.raw = raw;
-      function join23(chunks, separator) {
+      function join25(chunks, separator) {
         const result = [];
         for (const [i, chunk] of chunks.entries()) {
           if (i > 0 && separator !== void 0) result.push(separator);
@@ -17563,7 +17630,7 @@ var init_sql = __esm({
         }
         return new SQL(result);
       }
-      _sql.join = join23;
+      _sql.join = join25;
       function identifier(value) {
         return new Name(value);
       }
@@ -19950,7 +20017,7 @@ var init_select2 = __esm({
           const baseTableName = this.tableName;
           const tableName = getTableLikeName(table);
           for (const item of extractUsedTable(table)) this.usedTables.add(item);
-          if (typeof tableName === "string" && this.config.joins?.some((join23) => join23.alias === tableName)) throw new Error(`Alias "${tableName}" is already used in this query`);
+          if (typeof tableName === "string" && this.config.joins?.some((join25) => join25.alias === tableName)) throw new Error(`Alias "${tableName}" is already used in this query`);
           if (!this.isPartialSelect) {
             if (Object.keys(this.joinsNotNullableMap).length === 1 && typeof baseTableName === "string") this.config.fields = { [baseTableName]: this.config.fields };
             if (typeof tableName === "string" && !is(table, SQL)) {
@@ -23760,7 +23827,7 @@ var init_dialect = __esm({
           if (!joins2) return;
           const withEntries = Object.entries(joins2).filter(([_, v]) => v);
           if (!withEntries.length) return;
-          return sql.join(withEntries.map(([k, join23]) => {
+          return sql.join(withEntries.map(([k, join25]) => {
             const relation = tableConfig.relations[k];
             const isSingle2 = is(relation, One);
             const targetTable = aliasedTable(relation.targetTable, `d${currentDepth + 1}`);
@@ -23771,7 +23838,7 @@ var init_dialect = __esm({
               table: targetTable,
               mode: isSingle2 ? "first" : "many",
               schema,
-              queryConfig: join23,
+              queryConfig: join25,
               tableConfig: schema[relation.targetTableName],
               relationWhere: filter,
               isNested: true,
@@ -23785,7 +23852,7 @@ var init_dialect = __esm({
               key: k,
               selection: innerQuery.selection,
               isArray: !isSingle2,
-              isOptional: (relation.optional ?? false) || join23 !== true && !!join23.where
+              isOptional: (relation.optional ?? false) || join25 !== true && !!join25.where
             });
             const jsonColumns = sql.join(innerQuery.selection.map((s) => {
               return sql`${sql.raw(this.escapeString(s.key))}, ${s.selection ? sql`${jsonb3}(${sql.identifier(s.key)})` : sql.identifier(s.key)}`;
@@ -24606,7 +24673,7 @@ var init_update = __esm({
       createJoin(joinType) {
         return ((table, on) => {
           const tableName = getTableLikeName(table);
-          if (typeof tableName === "string" && this.config.joins.some((join23) => join23.alias === tableName)) throw new Error(`Alias "${tableName}" is already used in this query`);
+          if (typeof tableName === "string" && this.config.joins.some((join25) => join25.alias === tableName)) throw new Error(`Alias "${tableName}" is already used in this query`);
           if (typeof on === "function") {
             const from = this.config.from ? is(table, SQLiteTable) ? table[Table.Symbol.Columns] : is(table, Subquery) ? table._.selectedFields : is(table, SQLiteViewBase) ? table[ViewBaseConfig].selectedFields : void 0 : void 0;
             on = on(new Proxy(this.config.table[Table.Symbol.Columns], new SelectionProxyHandler({
@@ -25758,8 +25825,8 @@ function probeAndMarkApplied(nativeDb, migration, logSubsystem, eliminatedTables
   });
   if (allAltersPresent && allTablesPresent && allIndexesPresent && allTriggersPresent) {
     insertJournalEntry(nativeDb, migration.hash, migration.folderMillis, migration.name ?? "");
-    const log11 = getLogger(logSubsystem);
-    log11.debug(
+    const log12 = getLogger(logSubsystem);
+    log12.debug(
       {
         migration: migration.name,
         alters: alterTargets.length,
@@ -25828,14 +25895,14 @@ function reconcileJournal(nativeDb, migrationsFolder, existenceTable2, logSubsys
     if (hasOrphanedEntries) {
       const dbHashes = new Set(dbEntries.map((e) => e.hash));
       const allLocalHashesPresentInDb = localMigrations.every((m) => dbHashes.has(m.hash));
-      const log11 = getLogger(logSubsystem);
+      const log12 = getLogger(logSubsystem);
       if (allLocalHashesPresentInDb) {
-        log11.debug(
+        log12.debug(
           { extra: orphanedEntries.length },
           `Migration journal has ${orphanedEntries.length} entries for migrations not known to this install (DB is ahead). Skipping reconciliation.`
         );
       } else {
-        log11.warn(
+        log12.warn(
           { orphaned: orphanedEntries.length },
           `Detected ${orphanedEntries.length} true-orphan journal entries from a previous CLEO lineage. Reconciling via DDL probe.`
         );
@@ -25871,8 +25938,8 @@ function reconcileJournal(nativeDb, migrationsFolder, existenceTable2, logSubsys
       if (alterMatches.length === 0) {
         const stripped = stripSqlComments(fullSql).trim();
         if (stripped === "") {
-          const log11 = getLogger(logSubsystem);
-          log11.debug(
+          const log12 = getLogger(logSubsystem);
+          log12.debug(
             { migration: migration.name },
             `Migration ${migration.name} is a comment-only baseline marker \u2014 marking applied on existing DB.`
           );
@@ -25911,8 +25978,8 @@ function reconcileJournal(nativeDb, migrationsFolder, existenceTable2, logSubsys
         }
       }
       if (missingColumns.length === 0) {
-        const log11 = getLogger(logSubsystem);
-        log11.warn(
+        const log12 = getLogger(logSubsystem);
+        log12.warn(
           { migration: migration.name, columns: alterMatches },
           `Detected partially-applied migration ${migration.name} \u2014 columns exist but journal entry missing. Auto-reconciling.`
         );
@@ -25920,8 +25987,8 @@ function reconcileJournal(nativeDb, migrationsFolder, existenceTable2, logSubsys
         continue;
       }
       if (existingColumns.length > 0 && missingColumns.length > 0) {
-        const log11 = getLogger(logSubsystem);
-        log11.warn(
+        const log12 = getLogger(logSubsystem);
+        log12.warn(
           {
             migration: migration.name,
             existingColumns: existingColumns.map((c) => `${c.table}.${c.column}`),
@@ -25933,12 +26000,12 @@ function reconcileJournal(nativeDb, migrationsFolder, existenceTable2, logSubsys
           if (!tableExists(nativeDb, table)) continue;
           try {
             nativeDb.exec(`ALTER TABLE ${table} ADD COLUMN ${column}${ddl ? ` ${ddl}` : ""}`);
-            log11.warn(
+            log12.warn(
               { migration: migration.name, table, column },
               `T920: Added missing column ${table}.${column} to complete partial migration.`
             );
           } catch {
-            log11.warn(
+            log12.warn(
               { migration: migration.name, table, column },
               `T920: Could not add missing column ${table}.${column} \u2014 will let Drizzle migrate() handle it.`
             );
@@ -25958,8 +26025,8 @@ function reconcileJournal(nativeDb, migrationsFolder, existenceTable2, logSubsys
     for (const entry of unnamedEntries) {
       const migrationName = hashToName.get(entry.hash);
       if (!migrationName) continue;
-      const log11 = getLogger(logSubsystem);
-      log11.debug(
+      const log12 = getLogger(logSubsystem);
+      log12.debug(
         { id: entry.id, hash: entry.hash, name: migrationName },
         `Backfilling missing name on journal entry id=${entry.id} (Drizzle v1 beta legacy compat).`
       );
@@ -26109,13 +26176,13 @@ function ensureColumns(nativeDb, tableName, requiredColumns, logSubsystem, conte
   const existingCols = new Set(columns.map((c) => c.name));
   for (const req of requiredColumns) {
     if (!existingCols.has(req.name)) {
-      const log11 = getLogger(logSubsystem);
+      const log12 = getLogger(logSubsystem);
       const message = `Adding missing column ${tableName}.${req.name} via ALTER TABLE`;
       const fields = { column: req.name, context };
       if (context === "fresh") {
-        log11.error(fields, `${message} \u2014 MIGRATION DEFECT (fresh DB should not need repair)`);
+        log12.error(fields, `${message} \u2014 MIGRATION DEFECT (fresh DB should not need repair)`);
       } else {
-        log11.warn(fields, message);
+        log12.warn(fields, message);
       }
       nativeDb.exec(`ALTER TABLE ${tableName} ADD COLUMN ${req.name} ${req.ddl}`);
     }
@@ -35308,11 +35375,750 @@ var init_cleo_global = __esm({
   }
 });
 
-// packages/core/src/store/lock.ts
+// packages/core/src/resources/linux-backend.ts
+import { readFile as readFile2, stat } from "node:fs/promises";
+function parsePressureLine(line2) {
+  const avg10Match = /avg10=([\d.]+)/.exec(line2);
+  const avg60Match = /avg60=([\d.]+)/.exec(line2);
+  const avg300Match = /avg300=([\d.]+)/.exec(line2);
+  const totalMatch = /total=(\d+)/.exec(line2);
+  if (!avg10Match?.[1] || !avg60Match?.[1] || !avg300Match?.[1] || !totalMatch?.[1]) {
+    return null;
+  }
+  return {
+    avg10: parseFloat(avg10Match[1]),
+    avg60: parseFloat(avg60Match[1]),
+    avg300: parseFloat(avg300Match[1]),
+    totalUs: parseInt(totalMatch[1], 10)
+  };
+}
+function parsePsiFile(content) {
+  const lines = content.split("\n").map((l) => l.trim()).filter(Boolean);
+  let some = null;
+  let full = null;
+  for (const line2 of lines) {
+    if (line2.startsWith("some ")) {
+      some = parsePressureLine(line2);
+    } else if (line2.startsWith("full ")) {
+      full = parsePressureLine(line2);
+    }
+  }
+  if (!some) {
+    return null;
+  }
+  return { some, full };
+}
+function parseMemAvailable(content) {
+  for (const line2 of content.split("\n")) {
+    if (line2.startsWith("MemAvailable:")) {
+      const match = /MemAvailable:\s+(\d+)\s+kB/.exec(line2);
+      if (match?.[1]) {
+        return parseInt(match[1], 10) * 1024;
+      }
+    }
+  }
+  return null;
+}
+function parseSmapsRollup(content) {
+  let rssKb = null;
+  let pssKb = null;
+  for (const line2 of content.split("\n")) {
+    if (line2.startsWith("Rss:")) {
+      const m = /Rss:\s+(\d+)\s+kB/.exec(line2);
+      if (m?.[1]) rssKb = parseInt(m[1], 10);
+    } else if (line2.startsWith("Pss:")) {
+      const m = /Pss:\s+(\d+)\s+kB/.exec(line2);
+      if (m?.[1]) pssKb = parseInt(m[1], 10);
+    }
+  }
+  if (rssKb === null || pssKb === null) return null;
+  return { rssBytes: rssKb * 1024, pssBytes: pssKb * 1024 };
+}
+var defaultReadFile, defaultStat, LinuxResourceBackend;
+var init_linux_backend = __esm({
+  "packages/core/src/resources/linux-backend.ts"() {
+    "use strict";
+    defaultReadFile = (path2, encoding) => readFile2(path2, encoding);
+    defaultStat = async (path2) => {
+      try {
+        const s = await stat(path2);
+        return { size: s.size };
+      } catch {
+        return null;
+      }
+    };
+    LinuxResourceBackend = class {
+      globalPressurePath;
+      cgroupSlicePressurePath;
+      walPaths;
+      readFileFn;
+      statFileFn;
+      constructor(opts = {}) {
+        this.globalPressurePath = opts.globalPressurePath ?? "/proc/pressure/memory";
+        this.cgroupSlicePressurePath = opts.cgroupSlicePressurePath ?? null;
+        this.walPaths = opts.walPaths ?? [];
+        this.readFileFn = opts.readFileFn ?? defaultReadFile;
+        this.statFileFn = opts.statFileFn ?? defaultStat;
+      }
+      /**
+       * Take a bounded point-in-time resource sample.
+       *
+       * Read-count (bounded by Amendment 1):
+       *   - 1 read: `/proc/pressure/memory`
+       *   - 0–1 reads: slice `memory.pressure` (if configured)
+       *   - 1 read: `/proc/meminfo`
+       *   - N stat calls: one per WAL path in `walPaths`
+       *
+       * Never spawns a child process.
+       */
+      async sample() {
+        const sampledAtMs = Date.now();
+        const globalPressure = await this._readPsi(this.globalPressurePath);
+        const pressureAvailable = globalPressure !== null;
+        let slicePressure = null;
+        if (this.cgroupSlicePressurePath) {
+          slicePressure = await this._readPsi(this.cgroupSlicePressurePath);
+        }
+        const memAvailableBytes = await this._readMemAvailable();
+        const walObservations = await this._readWalObservations();
+        return {
+          sampledAtMs,
+          pressureAvailable,
+          memAvailableBytes,
+          globalPressure,
+          slicePressure,
+          walObservations
+        };
+      }
+      /**
+       * Sweep per-child RSS via `/proc/<pid>/smaps_rollup`.
+       *
+       * **STRUCTURALLY SEPARATED from sample()** — smaps_rollup reads are
+       * ms-scale per multi-GB process and must never appear in the hot path.
+       * Call on a separate low-frequency cadence (e.g. every 60s or on
+       * backoff→hold state transition).
+       *
+       * @param pids - PIDs to sweep. Dead/unknown PIDs are silently skipped.
+       */
+      async sweepChildRss(pids) {
+        const sampledAtMs = Date.now();
+        const entries = [];
+        for (const pid of pids) {
+          try {
+            const content = await this.readFileFn(`/proc/${pid}/smaps_rollup`, "utf-8");
+            const parsed = parseSmapsRollup(content);
+            if (parsed) {
+              entries.push({ pid, ...parsed });
+            }
+          } catch {
+          }
+        }
+        return { sampledAtMs, entries };
+      }
+      // -------------------------------------------------------------------------
+      // Private helpers
+      // -------------------------------------------------------------------------
+      async _readPsi(path2) {
+        try {
+          const content = await this.readFileFn(path2, "utf-8");
+          return parsePsiFile(content);
+        } catch {
+          return null;
+        }
+      }
+      async _readMemAvailable() {
+        try {
+          const content = await this.readFileFn("/proc/meminfo", "utf-8");
+          return parseMemAvailable(content);
+        } catch {
+          return null;
+        }
+      }
+      async _readWalObservations() {
+        const results = [];
+        for (const walPath of this.walPaths) {
+          const info = await this.statFileFn(walPath);
+          results.push({ walPath, sizeBytes: info?.size ?? null });
+        }
+        return results;
+      }
+    };
+  }
+});
+
+// packages/core/src/resources/monitor.ts
+import { EventEmitter as EventEmitter2 } from "node:events";
+function resolveThresholds(cfg) {
+  return {
+    holdSomeAvg10: cfg.psi?.holdSomeAvg10 ?? DEFAULTS.holdSomeAvg10,
+    backoffSomeAvg10: cfg.psi?.backoffSomeAvg10 ?? DEFAULTS.backoffSomeAvg10,
+    holdFullAvg10: cfg.psi?.holdFullAvg10 ?? DEFAULTS.holdFullAvg10,
+    backoffFullAvg10: cfg.psi?.backoffFullAvg10 ?? DEFAULTS.backoffFullAvg10,
+    hysteresisPoints: cfg.hysteresisPoints ?? DEFAULTS.hysteresisPoints,
+    headroomBytes: cfg.headroomBytes ?? DEFAULTS.headroomBytes,
+    walWarnThresholdBytes: cfg.walWarnThresholdBytes ?? DEFAULTS.walWarnThresholdBytes,
+    pollIntervalMs: cfg.pollIntervalMs ?? DEFAULTS.pollIntervalMs
+  };
+}
+function evaluateState(sample, thresholds, currentState) {
+  if (!sample.pressureAvailable) {
+    if (sample.memAvailableBytes !== null && sample.memAvailableBytes < thresholds.headroomBytes) {
+      return { state: "hold", reason: "degraded: memAvailable below headroom" };
+    }
+    return { state: "ok", reason: "degraded: PSI unavailable, memAvailable sufficient" };
+  }
+  const somePressure = sample.globalPressure?.some ?? sample.slicePressure?.some;
+  const fullPressure = sample.globalPressure?.full ?? sample.slicePressure?.full;
+  const someAvg102 = somePressure?.avg10 ?? 0;
+  const fullAvg10 = fullPressure?.avg10 ?? 0;
+  if (someAvg102 > thresholds.backoffSomeAvg10 || fullAvg10 > thresholds.backoffFullAvg10) {
+    return {
+      state: "backoff",
+      reason: `some avg10=${someAvg102.toFixed(2)} full avg10=${fullAvg10.toFixed(2)} \u2014 above backoff threshold`
+    };
+  }
+  if (someAvg102 > thresholds.holdSomeAvg10 || fullAvg10 > thresholds.holdFullAvg10) {
+    return {
+      state: "hold",
+      reason: `some avg10=${someAvg102.toFixed(2)} full avg10=${fullAvg10.toFixed(2)} \u2014 above hold threshold`
+    };
+  }
+  if (currentState !== "ok") {
+    const hysteresisFloor = thresholds.holdSomeAvg10 - thresholds.hysteresisPoints;
+    const fullHysteresisFloor = thresholds.holdFullAvg10 - thresholds.hysteresisPoints;
+    if (someAvg102 > hysteresisFloor || fullAvg10 > fullHysteresisFloor) {
+      const clamped = currentState === "backoff" ? "hold" : currentState;
+      return {
+        state: clamped,
+        reason: `some avg10=${someAvg102.toFixed(2)} full avg10=${fullAvg10.toFixed(2)} \u2014 hysteresis hold (floor: some ${hysteresisFloor}, full ${fullHysteresisFloor})`
+      };
+    }
+  }
+  return {
+    state: "ok",
+    reason: `some avg10=${someAvg102.toFixed(2)} full avg10=${fullAvg10.toFixed(2)} \u2014 below thresholds`
+  };
+}
+var DEFAULTS, ResourceMonitor;
+var init_monitor = __esm({
+  "packages/core/src/resources/monitor.ts"() {
+    "use strict";
+    init_linux_backend();
+    DEFAULTS = {
+      holdSomeAvg10: 10,
+      backoffSomeAvg10: 20,
+      holdFullAvg10: 5,
+      backoffFullAvg10: 10,
+      hysteresisPoints: 3,
+      headroomBytes: 256 * 1024 * 1024,
+      walWarnThresholdBytes: 256 * 1024 * 1024,
+      pollIntervalMs: 1500
+    };
+    ResourceMonitor = class extends EventEmitter2 {
+      thresholds;
+      backend;
+      _state = "ok";
+      _timer = null;
+      _running = false;
+      constructor(cfg = {}) {
+        super();
+        this.thresholds = resolveThresholds(cfg);
+        this.backend = cfg.backend ?? new LinuxResourceBackend();
+      }
+      // -------------------------------------------------------------------------
+      // Public API
+      // -------------------------------------------------------------------------
+      /**
+       * Current pressure state (only meaningful after at least one sample).
+       */
+      get state() {
+        return this._state;
+      }
+      /**
+       * `true` while the continuous loop is running.
+       */
+      get running() {
+        return this._running;
+      }
+      /**
+       * Take a single point-in-time resource sample.
+       *
+       * Safe to call with the daemon off (no child processes, bounded reads).
+       * Does NOT update `this.state` — use {@link startContinuous} for that.
+       */
+      async sample() {
+        return this.backend.sample();
+      }
+      /**
+       * Start the continuous polling loop.
+       *
+       * Returns a `stop()` function. Calling `stop()` is idempotent.
+       *
+       * Emits:
+       *   - `'sample'` on every poll (even if state did not change)
+       *   - `'transition'` when `PressureState` changes
+       *   - `'error'` if the backend throws (loop continues regardless)
+       */
+      startContinuous() {
+        if (this._running) {
+          return () => this._stopLoop();
+        }
+        this._running = true;
+        this._scheduleNext();
+        return () => this._stopLoop();
+      }
+      /**
+       * Stop the continuous polling loop. Idempotent.
+       */
+      stop() {
+        this._stopLoop();
+      }
+      // -------------------------------------------------------------------------
+      // Private loop machinery
+      // -------------------------------------------------------------------------
+      _scheduleNext() {
+        this._timer = setTimeout(() => {
+          void this._tick();
+        }, this.thresholds.pollIntervalMs);
+        if (typeof this._timer.unref === "function") {
+          this._timer.unref();
+        }
+      }
+      async _tick() {
+        if (!this._running) return;
+        try {
+          const sample = await this.backend.sample();
+          this.emit("sample", sample);
+          const { state: newState, reason } = evaluateState(sample, this.thresholds, this._state);
+          if (newState !== this._state) {
+            const transition = {
+              from: this._state,
+              to: newState,
+              sample,
+              reason
+            };
+            this._state = newState;
+            this.emit("transition", transition);
+          }
+        } catch (err) {
+          this.emit("error", err instanceof Error ? err : new Error(String(err)));
+        }
+        if (this._running) {
+          this._scheduleNext();
+        }
+      }
+      _stopLoop() {
+        this._running = false;
+        if (this._timer !== null) {
+          clearTimeout(this._timer);
+          this._timer = null;
+        }
+      }
+    };
+  }
+});
+
+// packages/core/src/resources/supervisor-admit.ts
+import { connect } from "node:net";
+import { join as join5 } from "node:path";
+import { getCleoHome as getCleoHome2 } from "@cleocode/paths";
+function resolveSupervisorSocketPath() {
+  return process.env.CLEO_SUPERVISOR_SOCKET ?? join5(getCleoHome2(), SUPERVISOR_SOCKET_NAME);
+}
+async function sendResourceAdmit(socketPath, cls, holderId, budget) {
+  const result = await sendLeaseRequest(
+    socketPath,
+    { kind: "resource_admit", class: cls, holder_id: holderId, budget },
+    "resource_admit_result"
+  );
+  if ("unavailable" in result) return result;
+  if (result.kind === "resource_admit_result") return result;
+  return { unavailable: true, reason: `unexpected response kind: ${result.kind}` };
+}
+async function sendResourceRelease(socketPath, cls, holderId) {
+  const result = await sendLeaseRequest(
+    socketPath,
+    { kind: "resource_release", class: cls, holder_id: holderId },
+    "resource_release_result"
+  );
+  if ("unavailable" in result) return result;
+  if (result.kind === "resource_release_result") return result;
+  return { unavailable: true, reason: `unexpected response kind: ${result.kind}` };
+}
+function sendLeaseRequest(socketPath, request, expectedKind) {
+  return new Promise((resolve6) => {
+    const id = `ra-${process.pid}-${request.kind}`;
+    const envelope = LeaseIpcRequestEnvelopeSchema.parse({
+      protocol_version: LEASE_IPC_PROTOCOL_VERSION,
+      id,
+      direction: "request",
+      request
+    });
+    const line2 = `${JSON.stringify(envelope)}
+`;
+    let settled = false;
+    let buffer = "";
+    const socket = connect(socketPath);
+    const done = (value) => {
+      if (settled) return;
+      settled = true;
+      socket.removeAllListeners();
+      socket.destroy();
+      resolve6(value);
+    };
+    const degrade = (reason) => done({ unavailable: true, reason });
+    socket.setTimeout(REQUEST_TIMEOUT_MS);
+    const connectTimer = setTimeout(
+      () => degrade("supervisor connect timeout"),
+      CONNECT_TIMEOUT_MS
+    );
+    socket.on("connect", () => {
+      clearTimeout(connectTimer);
+      socket.write(line2);
+    });
+    socket.on("timeout", () => degrade("supervisor request timeout"));
+    socket.on("error", (err) => {
+      clearTimeout(connectTimer);
+      degrade(err.message);
+    });
+    socket.on("close", () => {
+      if (!settled) degrade("supervisor closed the connection before responding");
+    });
+    socket.on("data", (chunk) => {
+      buffer += chunk.toString("utf8");
+      const nl = buffer.indexOf("\n");
+      if (nl < 0) return;
+      let json2;
+      try {
+        json2 = JSON.parse(buffer.slice(0, nl));
+      } catch (cause) {
+        degrade(`malformed lease-ipc frame: ${cause instanceof Error ? cause.message : cause}`);
+        return;
+      }
+      const parsed = LeaseIpcResponseEnvelopeSchema.safeParse(json2);
+      if (!parsed.success) {
+        degrade(`off-contract lease-ipc response: ${parsed.error.message}`);
+        return;
+      }
+      const { response } = parsed.data;
+      if (response.kind === expectedKind) {
+        done(response);
+        return;
+      }
+      if (response.kind === "error") {
+        degrade(`${response.code}: ${response.message}`);
+        return;
+      }
+      degrade(`unexpected lease-ipc response kind for ${request.kind}: ${response.kind}`);
+    });
+  });
+}
+var SUPERVISOR_SOCKET_NAME, CONNECT_TIMEOUT_MS, REQUEST_TIMEOUT_MS;
+var init_supervisor_admit = __esm({
+  "packages/core/src/resources/supervisor-admit.ts"() {
+    "use strict";
+    init_src();
+    SUPERVISOR_SOCKET_NAME = "cleo-supervisor.sock";
+    CONNECT_TIMEOUT_MS = 250;
+    REQUEST_TIMEOUT_MS = 2e3;
+  }
+});
+
+// packages/core/src/resources/governor.ts
+var governor_exports = {};
+__export(governor_exports, {
+  ResourceGovernor: () => ResourceGovernor,
+  _resetGovernorStateForTest: () => _resetGovernorStateForTest,
+  computeClassBudget: () => computeClassBudget,
+  governor: () => governor,
+  governorSlotDir: () => governorSlotDir,
+  resolveGovernorMode: () => resolveGovernorMode,
+  slotFileCount: () => slotFileCount
+});
+import { existsSync as existsSync3, mkdirSync, readdirSync as readdirSync2, writeFileSync } from "node:fs";
+import { availableParallelism, totalmem } from "node:os";
+import { join as join6 } from "node:path";
 import lockfile from "proper-lockfile";
+function log2() {
+  if (_log2 === null) _log2 = getLogger("resource-governor");
+  return _log2;
+}
+function resolveGovernorMode() {
+  if (_cachedMode2 !== null) return _cachedMode2;
+  const raw = process.env.CLEO_RESOURCES_MODE;
+  _cachedMode2 = raw === "supervisor" || raw === "local" || raw === "off" ? raw : "local";
+  return _cachedMode2;
+}
+function logSupervisorDegradeOnce(reason) {
+  if (_supervisorDegradeLogged) return;
+  _supervisorDegradeLogged = true;
+  log2().info(
+    `CLEO_RESOURCES_MODE=supervisor but the arbiter is unreachable (${reason}); degrading to local-mode admission for the process lifetime.`
+  );
+}
+function _resetGovernorStateForTest() {
+  _cachedMode2 = null;
+  _supervisorDegradeLogged = false;
+}
+function someAvg10(sample) {
+  const some = sample.globalPressure?.some ?? sample.slicePressure?.some;
+  return some?.avg10 ?? 0;
+}
+function computeClassBudget(cls, sample, opts = {}) {
+  if (cls === "interactive-cli") return Number.POSITIVE_INFINITY;
+  const cpus = Math.max(1, opts.cpuCount ?? availableParallelism());
+  const totalBytes = opts.totalMemBytes ?? totalmem();
+  const headroomBytes = (opts.headroomMb ?? 2048) * MB;
+  const hold = opts.holdSomeAvg10 ?? 10;
+  const floor = opts.floorSomeAvg10 ?? 25;
+  const some = someAvg10(sample);
+  const availBytes = sample.memAvailableBytes ?? totalBytes;
+  const fullStall = sample.globalPressure?.full?.avg10 ?? sample.slicePressure?.full?.avg10 ?? 0;
+  const backoff = some > floor || fullStall > 10;
+  switch (cls) {
+    case "full-build":
+      return 1;
+    case "agent-session": {
+      const estRamBytes = (opts.agentEstRamMb ?? 4096) * MB;
+      const byMem = Math.floor((availBytes - headroomBytes) / estRamBytes);
+      return clamp(1, byMem, Math.max(1, cpus - 2));
+    }
+    case "llm-call":
+      return Math.max(1, cpus - 2);
+    case "test-run":
+    case "scoped-build": {
+      const base = Math.max(1, Math.floor(cpus / 4));
+      if (some > floor) return 1;
+      if (some > hold) return Math.max(1, Math.floor(base / 2));
+      return base;
+    }
+    case "db-heavy":
+      return backoff ? 0 : 1;
+    case "background-autonomous":
+      return some > hold || fullStall > 5 ? 0 : 1;
+    default:
+      return 1;
+  }
+}
+function clamp(lo, v, hi) {
+  return Math.max(lo, Math.min(v, hi));
+}
+function governorSlotDir(cls) {
+  return join6(getCleoHome(), "locks", `resource-${cls}`);
+}
+function ensureSlotFiles(dir, count) {
+  if (!existsSync3(dir)) mkdirSync(dir, { recursive: true });
+  const paths = [];
+  for (let i = 0; i < count; i++) {
+    const p = join6(dir, `slot-${i}.lock`);
+    if (!existsSync3(p)) writeFileSync(p, "", { flag: "a" });
+    paths.push(p);
+  }
+  return paths;
+}
+function sleep2(ms) {
+  return new Promise((r) => setTimeout(r, ms));
+}
+function passThroughGrant(cls) {
+  return {
+    deferred: false,
+    class: cls,
+    slot: -1,
+    acquiredAtMs: Date.now(),
+    release: async () => {
+    }
+  };
+}
+function deferral(cls, reason, retryAfterMs) {
+  return { deferred: true, class: cls, retryAfterMs, reason };
+}
+function supervisorHolderId(cls) {
+  _supervisorHolderSeq += 1;
+  return `${process.pid}:${cls}:${_supervisorHolderSeq}`;
+}
+function shuffledIndices(n) {
+  const order = Array.from({ length: n }, (_, i) => i);
+  for (let i = order.length - 1; i > 0; i--) {
+    const j = Math.floor(Math.random() * (i + 1));
+    const a = order[i];
+    const b = order[j];
+    if (a !== void 0 && b !== void 0) {
+      order[i] = b;
+      order[j] = a;
+    }
+  }
+  return order;
+}
+async function countHeldSlots(cls, budget) {
+  const dir = governorSlotDir(cls);
+  if (!existsSync3(dir)) return 0;
+  const slots = ensureSlotFiles(dir, budget);
+  let held = 0;
+  for (const path2 of slots) {
+    try {
+      const release = await lockfile.lock(path2, { retries: 0, stale: STALE_MS, realpath: false });
+      await release();
+    } catch {
+      held++;
+    }
+  }
+  return held;
+}
+function slotFileCount(cls) {
+  const dir = governorSlotDir(cls);
+  if (!existsSync3(dir)) return 0;
+  return readdirSync2(dir).filter((f) => f.startsWith("slot-") && f.endsWith(".lock")).length;
+}
+var _log2, _cachedMode2, _supervisorDegradeLogged, MB, STALE_MS, _supervisorHolderSeq, ResourceGovernor, governor;
+var init_governor = __esm({
+  "packages/core/src/resources/governor.ts"() {
+    "use strict";
+    init_src();
+    init_logger2();
+    init_paths();
+    init_monitor();
+    init_supervisor_admit();
+    _log2 = null;
+    _cachedMode2 = null;
+    _supervisorDegradeLogged = false;
+    MB = 1024 * 1024;
+    STALE_MS = 6e5;
+    _supervisorHolderSeq = 0;
+    ResourceGovernor = class {
+      /**
+       * Acquire one slot of `cls`. Returns a {@link ResourceGrant} on success or a
+       * {@link ResourceDeferral} on denial. Never throws for admission control;
+       * only genuinely unexpected I/O errors propagate.
+       */
+      async acquire(cls, opts = {}) {
+        const mode = resolveGovernorMode();
+        if (mode === "off" || cls === "interactive-cli") {
+          return passThroughGrant(cls);
+        }
+        const sample = opts.sample ?? await (opts.monitor ?? new ResourceMonitor()).sample();
+        const budget = computeClassBudget(cls, sample, opts);
+        if (!Number.isFinite(budget)) return passThroughGrant(cls);
+        if (budget <= 0) {
+          return deferral(
+            cls,
+            `class '${cls}' budget is 0 under current pressure (some avg10=${someAvg10(sample).toFixed(1)})`,
+            DEFAULT_RESOURCE_RETRY_AFTER_MS
+          );
+        }
+        if (mode === "supervisor") {
+          const viaSupervisor = await this.acquireViaSupervisor(cls, Math.floor(budget));
+          if (viaSupervisor !== null) return viaSupervisor;
+        }
+        const dir = governorSlotDir(cls);
+        const slots = ensureSlotFiles(dir, budget);
+        const blocking = opts.blocking ?? true;
+        const timeoutMs = opts.timeoutMs ?? 36e5;
+        const pollMs = opts.pollMs ?? 200;
+        const startedAt = Date.now();
+        do {
+          const order = shuffledIndices(slots.length);
+          for (const idx of order) {
+            const path2 = slots[idx];
+            if (!path2) continue;
+            try {
+              const release = await lockfile.lock(path2, {
+                retries: 0,
+                stale: STALE_MS,
+                realpath: false
+              });
+              let released = false;
+              return {
+                deferred: false,
+                class: cls,
+                slot: idx,
+                acquiredAtMs: Date.now(),
+                release: async () => {
+                  if (released) return;
+                  released = true;
+                  try {
+                    await release();
+                  } catch {
+                  }
+                }
+              };
+            } catch {
+            }
+          }
+          if (!blocking) break;
+          await sleep2(pollMs);
+        } while (Date.now() - startedAt < timeoutMs);
+        return deferral(
+          cls,
+          `class '${cls}' is at capacity (${budget} slot(s)); ` + (blocking ? `timed out after ${timeoutMs}ms` : "no slot free"),
+          Math.min(pollMs * 4, DEFAULT_RESOURCE_RETRY_AFTER_MS)
+        );
+      }
+      /**
+       * Route an admission through the supervisor's central `resource_admit` verb.
+       * Returns a grant (whose `release` calls `resource_release`) or a deferral, or
+       * `null` when the supervisor is unreachable so the caller degrades to the
+       * local slot engine. Never throws — a dead arbiter never deadlocks work.
+       *
+       * @task T12001
+       */
+      async acquireViaSupervisor(cls, budget) {
+        const socketPath = resolveSupervisorSocketPath();
+        const holderId = supervisorHolderId(cls);
+        const reply = await sendResourceAdmit(socketPath, cls, holderId, budget);
+        if ("unavailable" in reply) {
+          logSupervisorDegradeOnce(reply.reason);
+          return null;
+        }
+        if (reply.disposition === "deferred") {
+          return deferral(
+            cls,
+            `class '${cls}' deferred by supervisor (budget ${budget})`,
+            reply.retry_after_ms || DEFAULT_RESOURCE_RETRY_AFTER_MS
+          );
+        }
+        let released = false;
+        return {
+          deferred: false,
+          class: cls,
+          slot: 0,
+          acquiredAtMs: Date.now(),
+          release: async () => {
+            if (released) return;
+            released = true;
+            await sendResourceRelease(socketPath, cls, holderId).catch(() => {
+            });
+          }
+        };
+      }
+      /** Non-blocking single-pass acquire (admission semantics). */
+      async tryAcquire(cls, opts = {}) {
+        return this.acquire(cls, { ...opts, blocking: false });
+      }
+      /**
+       * Currently-grantable slot count for `cls` = budget − held. Held is the count
+       * of slot files currently locked. `Infinity` for ungated classes.
+       */
+      async available(cls, opts = {}) {
+        if (resolveGovernorMode() === "off" || cls === "interactive-cli") {
+          return Number.POSITIVE_INFINITY;
+        }
+        const sample = opts.sample ?? await (opts.monitor ?? new ResourceMonitor()).sample();
+        const budget = computeClassBudget(cls, sample, opts);
+        if (!Number.isFinite(budget)) return Number.POSITIVE_INFINITY;
+        if (budget <= 0) return 0;
+        const held = await countHeldSlots(cls, budget);
+        return Math.max(0, budget - held);
+      }
+    };
+    governor = new ResourceGovernor();
+  }
+});
+
+// packages/core/src/store/lock.ts
+import lockfile2 from "proper-lockfile";
 async function acquireLock(filePath, options) {
   try {
-    const release = await lockfile.lock(filePath, {
+    const release = await lockfile2.lock(filePath, {
       ...DEFAULT_LOCK_OPTIONS,
       ...options?.stale !== void 0 && { stale: options.stale },
       ...options?.retries !== void 0 && {
@@ -35358,7 +36164,7 @@ var init_lock = __esm({
 });
 
 // packages/core/src/store/atomic.ts
-import { mkdir, readFile as readFile2, rename, unlink } from "node:fs/promises";
+import { mkdir, readFile as readFile3, rename, unlink } from "node:fs/promises";
 import { dirname as dirname3 } from "node:path";
 import writeFileAtomic from "write-file-atomic";
 async function atomicWrite(filePath, data, options) {
@@ -35374,7 +36180,7 @@ async function atomicWrite(filePath, data, options) {
 }
 async function safeReadFile(filePath) {
   try {
-    return await readFile2(filePath, "utf8");
+    return await readFile3(filePath, "utf8");
   } catch (err) {
     if (err instanceof Error && "code" in err && err.code === "ENOENT") {
       return null;
@@ -35395,34 +36201,34 @@ var init_atomic = __esm({
 });
 
 // packages/core/src/store/backup.ts
-import { copyFile, rename as fsRename, mkdir as mkdir2, readdir, stat, unlink as unlink2 } from "node:fs/promises";
-import { basename, join as join5 } from "node:path";
+import { copyFile, rename as fsRename, mkdir as mkdir2, readdir, stat as stat2, unlink as unlink2 } from "node:fs/promises";
+import { basename, join as join7 } from "node:path";
 async function createBackup(filePath, backupDir, maxBackups = DEFAULT_MAX_BACKUPS) {
   try {
     await mkdir2(backupDir, { recursive: true });
     const fileName = basename(filePath);
     try {
-      await stat(filePath);
+      await stat2(filePath);
     } catch {
       throw new CleoError(3 /* FILE_ERROR */, `Cannot backup: source file not found: ${filePath}`);
     }
     for (let i = maxBackups; i >= 1; i--) {
-      const current = join5(backupDir, `${fileName}.${i}`);
+      const current = join7(backupDir, `${fileName}.${i}`);
       if (i === maxBackups) {
         try {
           await unlink2(current);
         } catch {
         }
       } else {
-        const next = join5(backupDir, `${fileName}.${i + 1}`);
+        const next = join7(backupDir, `${fileName}.${i + 1}`);
         try {
-          await stat(current);
+          await stat2(current);
           await fsRename(current, next);
         } catch {
         }
       }
     }
-    const backupPath = join5(backupDir, `${fileName}.1`);
+    const backupPath = join7(backupDir, `${fileName}.1`);
     await copyFile(filePath, backupPath);
     return backupPath;
   } catch (err) {
@@ -35701,8 +36507,8 @@ var init_json2 = __esm({
 });
 
 // packages/core/src/scaffold/ensure-config.ts
-import { existsSync as existsSync3, readFileSync } from "node:fs";
-import { basename as basename2, dirname as dirname4, join as join6, resolve as resolve2 } from "node:path";
+import { existsSync as existsSync4, readFileSync } from "node:fs";
+import { basename as basename2, dirname as dirname4, join as join8, resolve as resolve2 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 function getPackageRoot() {
   const thisFile = fileURLToPath2(import.meta.url);
@@ -35710,7 +36516,7 @@ function getPackageRoot() {
 }
 function getCleoVersion() {
   try {
-    const pkgPath = join6(getPackageRoot(), "package.json");
+    const pkgPath = join8(getPackageRoot(), "package.json");
     const pkg = JSON.parse(readFileSync(pkgPath, "utf-8"));
     return pkg.version ?? "0.0.0";
   } catch {
@@ -35729,25 +36535,25 @@ var init_ensure_config = __esm({
 // packages/core/src/store/exodus/archive.ts
 import {
   copyFileSync as copyFileSync2,
-  existsSync as existsSync4,
-  mkdirSync,
+  existsSync as existsSync5,
+  mkdirSync as mkdirSync2,
   renameSync,
   unlinkSync,
-  writeFileSync
+  writeFileSync as writeFileSync2
 } from "node:fs";
-import { basename as basename3, join as join7 } from "node:path";
+import { basename as basename3, join as join9 } from "node:path";
 function scopeBaseDir(scope, cwd) {
   return scope === "project" ? resolveCleoDir(cwd) : getCleoHome();
 }
 function exodusArchiveDir(scope, cwd) {
-  return join7(scopeBaseDir(scope, cwd), ARCHIVE_DIR_NAME);
+  return join9(scopeBaseDir(scope, cwd), ARCHIVE_DIR_NAME);
 }
 function exodusMarkerPath(scope, cwd) {
-  return join7(scopeBaseDir(scope, cwd), MARKER_FILENAME_BY_SCOPE[scope]);
+  return join9(scopeBaseDir(scope, cwd), MARKER_FILENAME_BY_SCOPE[scope]);
 }
 function hasExodusCompleteMarker(scope, cwd) {
   try {
-    return existsSync4(exodusMarkerPath(scope, cwd));
+    return existsSync5(exodusMarkerPath(scope, cwd));
   } catch {
     return false;
   }
@@ -35755,7 +36561,7 @@ function hasExodusCompleteMarker(scope, cwd) {
 function writeExodusCompleteMarker(scope, archivedSources, cwd) {
   const markerPath = exodusMarkerPath(scope, cwd);
   const baseDir = scopeBaseDir(scope, cwd);
-  mkdirSync(baseDir, { recursive: true });
+  mkdirSync2(baseDir, { recursive: true });
   const marker = {
     version: 1,
     scope,
@@ -35764,17 +36570,17 @@ function writeExodusCompleteMarker(scope, archivedSources, cwd) {
     archivedSources: [...archivedSources]
   };
   const tmpPath = `${markerPath}.tmp`;
-  writeFileSync(tmpPath, JSON.stringify(marker, null, 2) + "\n", "utf8");
+  writeFileSync2(tmpPath, JSON.stringify(marker, null, 2) + "\n", "utf8");
   renameSync(tmpPath, markerPath);
-  log2.info({ scope, markerPath, archivedSources }, "exodus: wrote completion marker");
+  log3.info({ scope, markerPath, archivedSources }, "exodus: wrote completion marker");
   return markerPath;
 }
 function moveFileInto(srcPath, destDir) {
-  mkdirSync(destDir, { recursive: true });
-  let dest = join7(destDir, basename3(srcPath));
-  if (existsSync4(dest)) {
+  mkdirSync2(destDir, { recursive: true });
+  let dest = join9(destDir, basename3(srcPath));
+  if (existsSync5(dest)) {
     const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "").replace(/Z$/, "Z");
-    dest = join7(destDir, `${basename3(srcPath)}.${stamp}`);
+    dest = join9(destDir, `${basename3(srcPath)}.${stamp}`);
   }
   try {
     renameSync(srcPath, dest);
@@ -35785,25 +36591,25 @@ function moveFileInto(srcPath, destDir) {
   return dest;
 }
 function archiveSourceDb(source, cwd) {
-  if (!existsSync4(source.path)) {
+  if (!existsSync5(source.path)) {
     return { name: source.name, sourcePath: source.path, archivedTo: null, action: "absent" };
   }
   const destDir = exodusArchiveDir(source.targetScope, cwd);
   const archivedTo = moveFileInto(source.path, destDir);
   for (const suffix of SIDECAR_SUFFIXES) {
     const sidecar = `${source.path}${suffix}`;
-    if (existsSync4(sidecar)) {
+    if (existsSync5(sidecar)) {
       try {
         moveFileInto(sidecar, destDir);
       } catch (err) {
-        log2.warn(
+        log3.warn(
           { err, sidecar, sourceName: source.name },
           "exodus-archive: failed to archive sidecar (non-fatal)"
         );
       }
     }
   }
-  log2.info(
+  log3.info(
     { sourceName: source.name, sourcePath: source.path, archivedTo, scope: source.targetScope },
     "exodus-archive: archived legacy source DB"
   );
@@ -35838,7 +36644,7 @@ function detectStrandedResidue(sources, cwd) {
   const stranded = [];
   for (const source of sources) {
     if (!markedScopes.has(source.targetScope)) continue;
-    if (existsSync4(source.path)) {
+    if (existsSync5(source.path)) {
       stranded.push({ name: source.name, path: source.path, scope: source.targetScope });
     }
   }
@@ -35854,14 +36660,14 @@ function archiveStrandedResidue(stranded, sources, cwd) {
   }
   return results;
 }
-var log2, ARCHIVE_DIR_NAME, MARKER_FILENAME_BY_SCOPE, SIDECAR_SUFFIXES;
+var log3, ARCHIVE_DIR_NAME, MARKER_FILENAME_BY_SCOPE, SIDECAR_SUFFIXES;
 var init_archive2 = __esm({
   "packages/core/src/store/exodus/archive.ts"() {
     "use strict";
     init_logger2();
     init_paths();
     init_ensure_config();
-    log2 = getLogger("exodus-archive");
+    log3 = getLogger("exodus-archive");
     ARCHIVE_DIR_NAME = "_archive";
     MARKER_FILENAME_BY_SCOPE = {
       project: "exodus-complete",
@@ -35872,13 +36678,13 @@ var init_archive2 = __esm({
 });
 
 // packages/core/src/project-info.ts
-import { existsSync as existsSync5, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "node:fs";
-import { join as join8 } from "node:path";
+import { existsSync as existsSync6, readFileSync as readFileSync2, writeFileSync as writeFileSync3 } from "node:fs";
+import { join as join10 } from "node:path";
 function getProjectInfoSync(cwd) {
   const projectRoot = resolveOrCwd(cwd);
   const cleoDir = getCleoDirAbsolute(projectRoot);
-  const infoPath = join8(cleoDir, "project-info.json");
-  if (!existsSync5(infoPath)) return null;
+  const infoPath = join10(cleoDir, "project-info.json");
+  if (!existsSync6(infoPath)) return null;
   try {
     const raw = readFileSync2(infoPath, "utf-8");
     const data = JSON.parse(raw);
@@ -35905,8 +36711,8 @@ var init_project_info = __esm({
 });
 
 // packages/core/src/store/worktree-isolation-guard.ts
-import { existsSync as existsSync6, statSync } from "node:fs";
-import { dirname as dirname5, join as join9 } from "node:path";
+import { existsSync as existsSync7, statSync } from "node:fs";
+import { dirname as dirname5, join as join11 } from "node:path";
 function assertDbPathIsNotWorktreeResident(role, cwd) {
   let cleoDir;
   try {
@@ -35915,10 +36721,10 @@ function assertDbPathIsNotWorktreeResident(role, cwd) {
     return;
   }
   const projectRoot = dirname5(cleoDir);
-  const projectGit = join9(projectRoot, ".git");
+  const projectGit = join11(projectRoot, ".git");
   let isWorktreeGitlink = false;
   try {
-    isWorktreeGitlink = existsSync6(projectGit) && statSync(projectGit).isFile();
+    isWorktreeGitlink = existsSync7(projectGit) && statSync(projectGit).isFile();
   } catch {
   }
   if (!isWorktreeGitlink) {
@@ -36383,7 +37189,7 @@ var init_table_name_map = __esm({
 });
 
 // packages/core/src/store/exodus/count-parity.ts
-import { existsSync as existsSync7 } from "node:fs";
+import { existsSync as existsSync8 } from "node:fs";
 function listTables(db) {
   return db.prepare(
     "SELECT name FROM sqlite_master WHERE type='table' AND name NOT LIKE 'sqlite_%' AND name NOT LIKE '__drizzle_%' ORDER BY name"
@@ -36404,14 +37210,14 @@ function rowCount(db, tableName) {
 function computeCountParity(sources, projectDbPath, globalDbPath) {
   const entries = [];
   let skipped = 0;
-  if (!existsSync7(projectDbPath) || !existsSync7(globalDbPath)) {
+  if (!existsSync8(projectDbPath) || !existsSync8(globalDbPath)) {
     return { ok: false, entries: [], deficits: [], checked: 0, skipped: 0 };
   }
   const projectSnap = openCleoDbSnapshot(projectDbPath, { readOnly: true });
   const globalSnap = openCleoDbSnapshot(globalDbPath, { readOnly: true });
   try {
     for (const src of sources) {
-      if (!existsSync7(src.path)) continue;
+      if (!existsSync8(src.path)) continue;
       const srcSnap = openCleoDbSnapshot(src.path, { readOnly: true });
       try {
         for (const legacyTable of listTables(srcSnap.db)) {
@@ -36450,27 +37256,27 @@ function computeCountParity(sources, projectDbPath, globalDbPath) {
   }
   const deficits = entries.filter((e) => e.deficit > 0);
   if (deficits.length > 0) {
-    log3.warn(
+    log4.warn(
       { deficitCount: deficits.length, sample: deficits.slice(0, 5) },
       `exodus count-parity: ${deficits.length} table(s) have FEWER rows in the consolidated target than the legacy source`
     );
   }
   return { ok: deficits.length === 0, entries, deficits, checked: entries.length, skipped };
 }
-var log3;
+var log4;
 var init_count_parity = __esm({
   "packages/core/src/store/exodus/count-parity.ts"() {
     "use strict";
     init_logger2();
     init_open_cleo_db();
     init_table_name_map();
-    log3 = getLogger("exodus-count-parity");
+    log4 = getLogger("exodus-count-parity");
   }
 });
 
 // packages/core/src/store/exodus/plan.ts
-import { existsSync as existsSync8, readdirSync as readdirSync2, statfsSync, statSync as statSync2 } from "node:fs";
-import { join as join10 } from "node:path";
+import { existsSync as existsSync9, readdirSync as readdirSync3, statfsSync, statSync as statSync2 } from "node:fs";
+import { join as join12 } from "node:path";
 function computeRequiredBytes(totalSourceBytes, largestSourceBytes) {
   return Math.ceil(STAGING_HEADROOM_FACTOR * largestSourceBytes) + totalSourceBytes;
 }
@@ -36481,33 +37287,33 @@ function buildSourceDescriptors(cwd) {
     // Project-tier — go into consolidated project-scope cleo.db
     {
       name: "tasks",
-      path: join10(cleoDir, "tasks.db"),
+      path: join12(cleoDir, "tasks.db"),
       targetScope: "project"
     },
     {
       name: "brain (project)",
-      path: join10(cleoDir, "brain.db"),
+      path: join12(cleoDir, "brain.db"),
       targetScope: "project"
     },
     {
       name: "conduit",
-      path: join10(cleoDir, "conduit.db"),
+      path: join12(cleoDir, "conduit.db"),
       targetScope: "project"
     },
     // Global-tier — go into consolidated global-scope cleo.db
     {
       name: "nexus",
-      path: join10(cleoHome, "nexus.db"),
+      path: join12(cleoHome, "nexus.db"),
       targetScope: "global"
     },
     {
       name: "signaldock",
-      path: join10(cleoHome, "signaldock.db"),
+      path: join12(cleoHome, "signaldock.db"),
       targetScope: "global"
     },
     {
       name: "skills",
-      path: join10(cleoHome, "skills.db"),
+      path: join12(cleoHome, "skills.db"),
       targetScope: "global"
     }
   ];
@@ -36533,10 +37339,10 @@ function deriveStagingDirName() {
 }
 function findExistingStaging(cleoDir) {
   try {
-    const entries = readdirSync2(cleoDir, { withFileTypes: true });
+    const entries = readdirSync3(cleoDir, { withFileTypes: true });
     const stagingDirs = entries.filter((e) => e.isDirectory() && e.name.startsWith("exodus-staging-")).map((e) => e.name).sort().reverse();
     if (stagingDirs.length > 0) {
-      return join10(cleoDir, stagingDirs[0]);
+      return join12(cleoDir, stagingDirs[0]);
     }
   } catch {
   }
@@ -36552,7 +37358,7 @@ function buildExodusPlan(cwd) {
   const availableBytes = getAvailableBytes(cleoDir);
   const diskPreflight = totalSourceBytes === 0 || availableBytes >= requiredBytes;
   const existingStaging = findExistingStaging(cleoDir);
-  const stagingDir = existingStaging ?? join10(cleoDir, deriveStagingDirName());
+  const stagingDir = existingStaging ?? join12(cleoDir, deriveStagingDirName());
   const resumeFromStaging = existingStaging !== null;
   const projectDbPath = resolveDualScopeDbPath("project", cwd);
   const globalDbPath = resolveDualScopeDbPath("global");
@@ -36571,7 +37377,7 @@ function buildExodusPlan(cwd) {
   };
 }
 function sourcesPresent(sources) {
-  return sources.some((s) => existsSync8(s.path));
+  return sources.some((s) => existsSync9(s.path));
 }
 var STAGING_HEADROOM_FACTOR, STAGING_COPY_SKIP_THRESHOLD_BYTES;
 var init_plan2 = __esm({
@@ -36585,18 +37391,18 @@ var init_plan2 = __esm({
 });
 
 // packages/core/src/store/exodus/health.ts
-import { existsSync as existsSync9, statSync as statSync3 } from "node:fs";
+import { existsSync as existsSync10, statSync as statSync3 } from "node:fs";
 function buildExodusHealth(cwd) {
   const plan = buildExodusPlan(cwd);
-  const anyLegacyPresent = plan.sources.some((s) => existsSync9(s.path));
+  const anyLegacyPresent = plan.sources.some((s) => existsSync10(s.path));
   const parity = anyLegacyPresent ? computeCountParity(plan.sources, plan.projectDbPath, plan.globalDbPath) : { ok: true, entries: [], deficits: [], checked: 0, skipped: 0 };
   const consolidatedExistsByScope = {
-    project: existsSync9(plan.projectDbPath),
-    global: existsSync9(plan.globalDbPath)
+    project: existsSync10(plan.projectDbPath),
+    global: existsSync10(plan.globalDbPath)
   };
   const buildScope = (scope) => {
     const sources = plan.sources.filter((s) => s.targetScope === scope).map((s) => {
-      const present = existsSync9(s.path);
+      const present = existsSync10(s.path);
       let bytes = 0;
       if (present) {
         try {
@@ -36863,15 +37669,15 @@ var init_types = __esm({
 // packages/core/src/store/exodus/migrate.ts
 import {
   copyFileSync as copyFileSync3,
-  existsSync as existsSync10,
-  mkdirSync as mkdirSync2,
+  existsSync as existsSync11,
+  mkdirSync as mkdirSync3,
   readFileSync as readFileSync3,
   renameSync as renameSync2,
   statSync as statSync4,
   unlinkSync as unlinkSync2,
-  writeFileSync as writeFileSync3
+  writeFileSync as writeFileSync4
 } from "node:fs";
-import { join as join11 } from "node:path";
+import { join as join13 } from "node:path";
 function getSqliteVersion(db) {
   try {
     const row = db.prepare("SELECT sqlite_version() AS v").get();
@@ -36887,14 +37693,14 @@ function listTables2(db) {
   return rows.map((r) => r.name);
 }
 function writeJournal(stagingDir, journal) {
-  const journalPath = join11(stagingDir, JOURNAL_FILENAME);
+  const journalPath = join13(stagingDir, JOURNAL_FILENAME);
   const tmpPath = `${journalPath}.tmp`;
-  writeFileSync3(tmpPath, JSON.stringify(journal, null, 2) + "\n", "utf8");
+  writeFileSync4(tmpPath, JSON.stringify(journal, null, 2) + "\n", "utf8");
   renameSync2(tmpPath, journalPath);
 }
 function readJournal(stagingDir) {
-  const journalPath = join11(stagingDir, JOURNAL_FILENAME);
-  if (!existsSync10(journalPath)) return null;
+  const journalPath = join13(stagingDir, JOURNAL_FILENAME);
+  if (!existsSync11(journalPath)) return null;
   try {
     return JSON.parse(readFileSync3(journalPath, "utf8"));
   } catch {
@@ -36902,17 +37708,17 @@ function readJournal(stagingDir) {
   }
 }
 function clearExodusJournal(stagingDir) {
-  const journalPath = join11(stagingDir, JOURNAL_FILENAME);
+  const journalPath = join13(stagingDir, JOURNAL_FILENAME);
   try {
-    if (!existsSync10(journalPath)) return false;
+    if (!existsSync11(journalPath)) return false;
     unlinkSync2(journalPath);
-    log4.info(
+    log5.info(
       { stagingDir },
       "exodus: cleared migrate journal after abort/rollback \u2014 a retry will RE-COPY all tables"
     );
     return true;
   } catch (err) {
-    log4.warn(
+    log5.warn(
       { err, stagingDir },
       'exodus: failed to clear migrate journal after rollback (a retry may skip already-"done" tables)'
     );
@@ -36937,7 +37743,7 @@ function lockPath(dbPath) {
 }
 function acquireAdvisoryLock(dbPath) {
   const lp = lockPath(dbPath);
-  writeFileSync3(lp, JSON.stringify({ pid: process.pid, ts: (/* @__PURE__ */ new Date()).toISOString() }), "utf8");
+  writeFileSync4(lp, JSON.stringify({ pid: process.pid, ts: (/* @__PURE__ */ new Date()).toISOString() }), "utf8");
 }
 function releaseAdvisoryLock(dbPath) {
   try {
@@ -37000,7 +37806,7 @@ function buildSelectExpr(attachAlias, legacyTable, targetTableName, col, srcType
 function copyTableFromAttached(targetNativeDb, srcNativeDb, attachAlias, legacyTableName, sourceName, targetSchema = "main") {
   const resolution = resolveConsolidatedTableName(sourceName, legacyTableName);
   if (resolution.kind === "skip") {
-    log4.warn(
+    log5.warn(
       { legacyTableName, sourceName, reason: resolution.reason },
       `Exodus: explicitly skipping table \u2014 ${resolution.reason}`
     );
@@ -37019,7 +37825,7 @@ function copyTableFromAttached(targetNativeDb, srcNativeDb, attachAlias, legacyT
   ).get();
   if (!existsRow) {
     const reason = `consolidated target '${targetTableName}' not found (mapped from legacy '${legacyTableName}')`;
-    log4.warn(
+    log5.warn(
       { legacyTableName, targetTableName, sourceName, attachAlias, targetSchema },
       `Exodus: ${reason}`
     );
@@ -37030,13 +37836,13 @@ function copyTableFromAttached(targetNativeDb, srcNativeDb, attachAlias, legacyT
   const sharedColumns = srcPragma.map((r) => r.name).filter((col) => tgtColMap.has(col));
   if (sharedColumns.length === 0) {
     const reason = `no overlapping columns between source '${legacyTableName}' and target '${targetTableName}'`;
-    log4.warn({ legacyTableName, targetTableName, sourceName }, `Exodus: ${reason}`);
+    log5.warn({ legacyTableName, targetTableName, sourceName }, `Exodus: ${reason}`);
     return { rowsCopied: 0, skipped: true, reason };
   }
   const srcOnlyColumns = srcPragma.map((r) => r.name).filter((c) => !tgtColMap.has(c));
   const tgtOnlyColumns = tgtPragma.map((r) => r.name).filter((c) => !srcColumns.has(c));
   if (srcOnlyColumns.length > 0 || tgtOnlyColumns.length > 0) {
-    log4.info(
+    log5.info(
       { legacyTableName, targetTableName, sourceName, srcOnlyColumns, tgtOnlyColumns },
       "Exodus: column drift detected \u2014 copying intersection, dropping src-only cols, using defaults for tgt-only cols"
     );
@@ -37051,7 +37857,7 @@ function copyTableFromAttached(targetNativeDb, srcNativeDb, attachAlias, legacyT
       return isoGlobCols.has(col) && (upper.includes("INT") || upper === "" || upper === "NUMERIC");
     });
     if (coercedCols.length > 0) {
-      log4.info(
+      log5.info(
         {
           legacyTableName,
           targetTableName,
@@ -37067,7 +37873,7 @@ function copyTableFromAttached(targetNativeDb, srcNativeDb, attachAlias, legacyT
     (col) => ENUM_NORMALIZATIONS.has(`${targetTableName}.${col}`)
   );
   if (normalizedCols.length > 0) {
-    log4.info(
+    log5.info(
       { legacyTableName, targetTableName, sourceName, normalizedCols },
       `Exodus: applying enum-value normalization for ${normalizedCols.length} column(s) (T11547)`
     );
@@ -37076,7 +37882,7 @@ function copyTableFromAttached(targetNativeDb, srcNativeDb, attachAlias, legacyT
     (col) => NUMERIC_CLAMPS.has(`${targetTableName}.${col}`)
   );
   if (clampedCols.length > 0) {
-    log4.info(
+    log5.info(
       { legacyTableName, targetTableName, sourceName, clampedCols },
       `Exodus: applying non-finite numeric clamp for ${clampedCols.length} column(s) (T11782)`
     );
@@ -37118,7 +37924,7 @@ function copyTableFromAttached(targetNativeDb, srcNativeDb, attachAlias, legacyT
   if (rowsCopied < sourceCount) {
     const presentAccountedFor = existingBefore + rowsCopied;
     if (presentAccountedFor >= sourceCount) {
-      log4.info(
+      log5.info(
         { legacyTableName, targetTableName, sourceName, sourceCount, rowsCopied, existingBefore },
         `Exodus: '${legacyTableName}'\u2192'${targetTableName}' \u2014 ${sourceCount - rowsCopied} of ${sourceCount} row(s) already present in target (idempotent PK dedup), ${rowsCopied} newly copied; no loss`
       );
@@ -37126,7 +37932,7 @@ function copyTableFromAttached(targetNativeDb, srcNativeDb, attachAlias, legacyT
     }
     const missing = sourceCount - presentAccountedFor;
     const reason = `INSERT OR IGNORE lost ${missing} of ${sourceCount} rows from '${legacyTableName}'\u2192'${targetTableName}' (rowsCopied=${rowsCopied}, existingBefore=${existingBefore}) \u2014 a CHECK/NOT NULL/type/enum constraint rejected them (NOT PK dedup); inspect epoch coercion + enum normalization. verify will confirm.`;
-    log4.error(
+    log5.error(
       {
         legacyTableName,
         targetTableName,
@@ -37146,10 +37952,10 @@ function checkSchemaVersion(journal, forceCrossVersion) {
   if (journal.targetSchemaVersion !== EXODUS_TARGET_SCHEMA_VERSION) {
     const msg = `Schema version mismatch: journal=${journal.targetSchemaVersion}, expected=${EXODUS_TARGET_SCHEMA_VERSION}`;
     if (forceCrossVersion) {
-      log4.warn(msg + " (--force-cross-version: continuing anyway)");
+      log5.warn(msg + " (--force-cross-version: continuing anyway)");
       return true;
     }
-    log4.error(msg + " \u2014 pass --force-cross-version to override");
+    log5.error(msg + " \u2014 pass --force-cross-version to override");
     return false;
   }
   return true;
@@ -37166,10 +37972,10 @@ async function runExodusMigrate(plan, forceCrossVersion = false, onProgress) {
       error: `Insufficient disk space for exodus: need \u2265${plan.requiredBytes} bytes (\u2248${STAGING_HEADROOM_FACTOR}\xD7 largest source ${plan.largestSourceBytes} + consolidated estimate ${plan.totalSourceBytes}), but only ${plan.availableBytes} bytes are free on the target filesystem \u2014 ${shortfall} bytes short. Free up at least ${shortfall} bytes (e.g. \`cleo backup prune\`, clear caches), or move the .cleo/ directory to a larger volume, then retry.`
     };
   }
-  mkdirSync2(stagingDir, { recursive: true });
+  mkdirSync3(stagingDir, { recursive: true });
   let sqliteVersion = "unknown";
   for (const src of sources) {
-    if (existsSync10(src.path)) {
+    if (existsSync11(src.path)) {
       const snap = openCleoDbSnapshot(src.path, { readOnly: true });
       sqliteVersion = getSqliteVersion(snap.db);
       snap.close();
@@ -37210,15 +38016,15 @@ async function runExodusMigrate(plan, forceCrossVersion = false, onProgress) {
     };
     var extractNativeDb = extractNativeDb2;
     for (const src of sources) {
-      if (!existsSync10(src.path)) continue;
-      const backupDest = join11(stagingDir, `${src.name.replace(/[^a-z0-9-]/g, "_")}-backup.db`);
+      if (!existsSync11(src.path)) continue;
+      const backupDest = join13(stagingDir, `${src.name.replace(/[^a-z0-9-]/g, "_")}-backup.db`);
       const srcBytes = safeStatBytes(src.path);
       const skipStagingCopy = srcBytes > plan.stagingCopyThresholdBytes;
       if (skipStagingCopy) {
         onProgress?.(
           `Skipping full staging copy of ${src.name} (${srcBytes} bytes > ${plan.stagingCopyThresholdBytes} threshold) \u2014 source is archived, not deleted, on success.`
         );
-      } else if (!existsSync10(backupDest)) {
+      } else if (!existsSync11(backupDest)) {
         onProgress?.(`Backing up ${src.name} \u2192 staging dir\u2026`);
         copyFileSync3(src.path, backupDest);
         backupPaths.push(backupDest);
@@ -37236,8 +38042,8 @@ async function runExodusMigrate(plan, forceCrossVersion = false, onProgress) {
     });
     const projectNative = extractNativeDb2(projectHandle);
     const globalNative = extractNativeDb2(globalHandle);
-    const projectSources = sources.filter((s) => s.targetScope === "project" && existsSync10(s.path));
-    const globalSources = sources.filter((s) => s.targetScope === "global" && existsSync10(s.path));
+    const projectSources = sources.filter((s) => s.targetScope === "project" && existsSync11(s.path));
+    const globalSources = sources.filter((s) => s.targetScope === "global" && existsSync11(s.path));
     await migrateScope(
       "project",
       projectSources,
@@ -37262,7 +38068,7 @@ async function runExodusMigrate(plan, forceCrossVersion = false, onProgress) {
     return { ok: true, tables: allTableResults, stagingDir, backupPaths };
   } catch (err) {
     const error = err instanceof Error ? err.message : String(err);
-    log4.error({ err }, "Exodus migration failed");
+    log5.error({ err }, "Exodus migration failed");
     return { ok: false, tables: allTableResults, stagingDir, backupPaths, error };
   } finally {
     try {
@@ -37282,7 +38088,7 @@ async function migrateScope(scope, sources, targetNativeDb, journal, stagingDir,
   if (sources.length === 0) return;
   onProgress?.(`Migrating ${scope}-scope sources\u2026`);
   targetNativeDb.exec("PRAGMA foreign_keys = OFF");
-  log4.info({ scope }, "Exodus: foreign_keys=OFF for bulk copy (T11533 FK-defer)");
+  log5.info({ scope }, "Exodus: foreign_keys=OFF for bulk copy (T11533 FK-defer)");
   try {
     for (let i = 0; i < sources.length; i++) {
       const src = sources[i];
@@ -37349,7 +38155,7 @@ async function migrateScope(scope, sources, targetNativeDb, journal, stagingDir,
               }
             } catch (err) {
               const msg = err instanceof Error ? err.message : String(err);
-              log4.warn({ tableName, sourceDb: src.name, err }, "Table copy failed \u2014 skipping");
+              log5.warn({ tableName, sourceDb: src.name, err }, "Table copy failed \u2014 skipping");
               status = "skipped";
               errorMsg = msg;
               skipped = true;
@@ -37397,7 +38203,7 @@ async function migrateScope(scope, sources, targetNativeDb, journal, stagingDir,
           targetNativeDb.exec(`DETACH DATABASE "${attachAlias}"`);
           onProgress?.(`  [${src.name}] Detached "${attachAlias}"`);
         } catch (detachErr) {
-          log4.warn(
+          log5.warn(
             { attachAlias, sourceDb: src.name, err: detachErr },
             "DETACH failed \u2014 alias will be released on DB close"
           );
@@ -37407,7 +38213,7 @@ async function migrateScope(scope, sources, targetNativeDb, journal, stagingDir,
             targetNativeDb.exec(`DETACH DATABASE "${crossAlias}"`);
             onProgress?.(`  [${src.name}] Cross-scope target detached "${crossAlias}"`);
           } catch (detachErr) {
-            log4.warn(
+            log5.warn(
               { crossAlias, sourceDb: src.name, err: detachErr },
               "Cross-scope DETACH failed \u2014 alias will be released on DB close"
             );
@@ -37419,28 +38225,28 @@ async function migrateScope(scope, sources, targetNativeDb, journal, stagingDir,
     try {
       const orphans = targetNativeDb.prepare("PRAGMA foreign_key_check").all();
       if (orphans.length > 0) {
-        log4.warn(
+        log5.warn(
           { scope, orphanCount: orphans.length, sample: orphans.slice(0, 5) },
           `Exodus: PRAGMA foreign_key_check found ${orphans.length} orphan row(s) after bulk copy \u2014 these are genuine data orphans (not ordering artifacts)`
         );
       } else {
-        log4.info({ scope }, "Exodus: PRAGMA foreign_key_check PASSED \u2014 no orphan rows");
+        log5.info({ scope }, "Exodus: PRAGMA foreign_key_check PASSED \u2014 no orphan rows");
       }
     } catch (checkErr) {
-      log4.warn(
+      log5.warn(
         { scope, err: checkErr },
         "Exodus: PRAGMA foreign_key_check failed (non-fatal) \u2014 target schema may not have FK constraints enabled"
       );
     }
     try {
       targetNativeDb.exec("PRAGMA foreign_keys = ON");
-      log4.info({ scope }, "Exodus: foreign_keys=ON restored after bulk copy");
+      log5.info({ scope }, "Exodus: foreign_keys=ON restored after bulk copy");
     } catch (fkErr) {
-      log4.warn({ scope, err: fkErr }, "Exodus: could not restore foreign_keys=ON (non-fatal)");
+      log5.warn({ scope, err: fkErr }, "Exodus: could not restore foreign_keys=ON (non-fatal)");
     }
   }
 }
-var log4, LOCK_SENTINEL_SUFFIX, JOURNAL_FILENAME, SOURCE_EPOCH_UNITS;
+var log5, LOCK_SENTINEL_SUFFIX, JOURNAL_FILENAME, SOURCE_EPOCH_UNITS;
 var init_migrate = __esm({
   "packages/core/src/store/exodus/migrate.ts"() {
     "use strict";
@@ -37452,7 +38258,7 @@ var init_migrate = __esm({
     init_plan2();
     init_table_name_map();
     init_types();
-    log4 = getLogger("exodus-migrate");
+    log5 = getLogger("exodus-migrate");
     LOCK_SENTINEL_SUFFIX = ".exodus-lock";
     JOURNAL_FILENAME = "exodus-journal.json";
     SOURCE_EPOCH_UNITS = /* @__PURE__ */ new Map([
@@ -37476,7 +38282,7 @@ function sealExodus(plan, scopeArg, cwd) {
   const parity = computeCountParity(plan.sources, plan.projectDbPath, plan.globalDbPath);
   if (!parity.ok) {
     const refusedReason = `Refusing to seal: ${parity.deficits.length} table(s) have FEWER rows in the consolidated cleo.db than the legacy source \u2014 the data is NOT fully migrated. Run \`cleo exodus migrate\` first. Deficits: ${parity.deficits.map((d) => `${d.targetTable}(${d.sourceCount}\u2192${d.targetCount})`).join(", ")}`;
-    log5.error({ deficits: parity.deficits.length }, `exodus seal refused \u2014 ${refusedReason}`);
+    log6.error({ deficits: parity.deficits.length }, `exodus seal refused \u2014 ${refusedReason}`);
     return { ok: false, refusedReason, parity, scopes: [] };
   }
   const outcomes = [];
@@ -37492,7 +38298,7 @@ function sealExodus(plan, scopeArg, cwd) {
       scopeSources.map((s) => s.name),
       cwd
     );
-    log5.info(
+    log6.info(
       { scope, alreadySealed, archived: archived.filter((a) => a.action === "archived").length },
       `exodus seal: scope '${scope}' certified (count-parity verified, ${parity.checked} tables)`
     );
@@ -37500,23 +38306,23 @@ function sealExodus(plan, scopeArg, cwd) {
   }
   return { ok: true, parity, scopes: outcomes };
 }
-var log5;
+var log6;
 var init_seal = __esm({
   "packages/core/src/store/exodus/seal.ts"() {
     "use strict";
     init_logger2();
     init_archive2();
     init_count_parity();
-    log5 = getLogger("exodus-seal");
+    log6 = getLogger("exodus-seal");
   }
 });
 
 // packages/core/src/store/exodus/status.ts
-import { existsSync as existsSync11, readdirSync as readdirSync3, readFileSync as readFileSync4, statSync as statSync5 } from "node:fs";
-import { join as join12 } from "node:path";
+import { existsSync as existsSync12, readdirSync as readdirSync4, readFileSync as readFileSync4, statSync as statSync5 } from "node:fs";
+import { join as join14 } from "node:path";
 function readJournal2(stagingDir) {
-  const p = join12(stagingDir, JOURNAL_FILENAME2);
-  if (!existsSync11(p)) return null;
+  const p = join14(stagingDir, JOURNAL_FILENAME2);
+  if (!existsSync12(p)) return null;
   try {
     return JSON.parse(readFileSync4(p, "utf8"));
   } catch {
@@ -37525,7 +38331,7 @@ function readJournal2(stagingDir) {
 }
 function findStagingDirs(cleoDir) {
   try {
-    return readdirSync3(cleoDir, { withFileTypes: true }).filter((e) => e.isDirectory() && e.name.startsWith("exodus-staging-")).map((e) => join12(cleoDir, e.name)).sort().reverse();
+    return readdirSync4(cleoDir, { withFileTypes: true }).filter((e) => e.isDirectory() && e.name.startsWith("exodus-staging-")).map((e) => join14(cleoDir, e.name)).sort().reverse();
   } catch {
     return [];
   }
@@ -37548,15 +38354,15 @@ function runExodusStatus(cwd) {
   const sourcesInfo = plan.sources.map((s) => ({
     name: s.name,
     path: s.path,
-    exists: existsSync11(s.path),
+    exists: existsSync12(s.path),
     bytes: safeBytes(s.path)
   }));
   return {
     hasStaging: latestStaging !== null,
     stagingDir: latestStaging,
     journal,
-    projectDbExists: existsSync11(projectDbPath),
-    globalDbExists: existsSync11(globalDbPath),
+    projectDbExists: existsSync12(projectDbPath),
+    globalDbExists: existsSync12(globalDbPath),
     sourcesPresent: sourcesInfo.some((s) => s.exists),
     sources: sourcesInfo
   };
@@ -37573,7 +38379,7 @@ var init_status = __esm({
 });
 
 // packages/core/src/store/exodus/verify-migration.ts
-import { existsSync as existsSync12 } from "node:fs";
+import { existsSync as existsSync13 } from "node:fs";
 import { createRequire as createRequire3 } from "node:module";
 function orderByClause(db, tableName) {
   try {
@@ -37593,7 +38399,7 @@ function computeTableDigest(db, tableName, columns, transform) {
     count = Number(row?.c ?? 0);
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
-    log6.warn(
+    log7.warn(
       { tableName, err: msg },
       "computeTableDigest: COUNT(*) failed (possibly a virtual/FTS table) \u2014 treating as 0 rows"
     );
@@ -37628,7 +38434,7 @@ function computeTableDigest(db, tableName, columns, transform) {
     }
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
-    log6.warn(
+    log7.warn(
       { tableName, err: msg },
       "computeTableDigest: streamed SELECT failed (possibly a virtual/FTS table) \u2014 digest skipped (COUNT(*) parity still enforced)"
     );
@@ -37754,7 +38560,7 @@ function foreignKeyCheck(db, scope) {
   try {
     const rows = db.prepare("PRAGMA foreign_key_check").all();
     if (rows.length > 0) {
-      log6.warn(
+      log7.warn(
         { scope, count: rows.length, sample: rows.slice(0, 5) },
         `verifyMigration: PRAGMA foreign_key_check found ${rows.length} orphan row(s)`
       );
@@ -37766,7 +38572,7 @@ function foreignKeyCheck(db, scope) {
       fkid: r.fkid
     }));
   } catch (err) {
-    log6.warn({ scope, err }, "verifyMigration: PRAGMA foreign_key_check failed (non-fatal)");
+    log7.warn({ scope, err }, "verifyMigration: PRAGMA foreign_key_check failed (non-fatal)");
     return [];
   }
 }
@@ -37803,13 +38609,13 @@ function sourceOrphanSignatures(db, sourceName, scope) {
     const rows = db.prepare("PRAGMA foreign_key_check").all();
     for (const r of rows) sigs.add(orphanSignature(db, r, sourceName));
     if (rows.length > 0) {
-      log6.warn(
+      log7.warn(
         { scope, count: rows.length, sample: rows.slice(0, 5) },
         `verifyMigration: source already has ${rows.length} pre-existing FK orphan(s) \u2014 these are tolerated (carried forward losslessly, flagged for data-hygiene)`
       );
     }
   } catch (err) {
-    log6.warn({ scope, err }, "verifyMigration: source PRAGMA foreign_key_check failed (non-fatal)");
+    log7.warn({ scope, err }, "verifyMigration: source PRAGMA foreign_key_check failed (non-fatal)");
   }
   return sigs;
 }
@@ -37821,7 +38627,7 @@ function verifyMigration(sources, projectDbPath, globalDbPath, onProgress) {
   const preExistingForeignKeyViolations = [];
   const failureLines = [];
   const sourceOrphanSigs = /* @__PURE__ */ new Set();
-  if (!existsSync12(projectDbPath)) {
+  if (!existsSync13(projectDbPath)) {
     return {
       ok: false,
       tables: [],
@@ -37832,7 +38638,7 @@ function verifyMigration(sources, projectDbPath, globalDbPath, onProgress) {
       error: `Consolidated project cleo.db not found at ${projectDbPath}. Run 'cleo exodus migrate' first.`
     };
   }
-  if (!existsSync12(globalDbPath)) {
+  if (!existsSync13(globalDbPath)) {
     return {
       ok: false,
       tables: [],
@@ -37847,7 +38653,7 @@ function verifyMigration(sources, projectDbPath, globalDbPath, onProgress) {
   const globalSnap = openCleoDbSnapshot(globalDbPath, { readOnly: true });
   try {
     for (const src of sources) {
-      if (!existsSync12(src.path)) {
+      if (!existsSync13(src.path)) {
         onProgress?.(`Skipping ${src.name} (not present)`);
         continue;
       }
@@ -37932,7 +38738,7 @@ function verifyMigration(sources, projectDbPath, globalDbPath, onProgress) {
               `[${scope}] ${src.name}.${legacyTableName} \u2192 ${targetTableName}: DEFICIT \u2014 source=${srcDigest.count} rows, target=${tgtDigest.count} rows (${srcDigest.count - tgtDigest.count} missing), hashMatch=${hashMatch}`
             );
           } else if (tgtDigest.count > srcDigest.count) {
-            log6.warn(
+            log7.warn(
               {
                 scope,
                 source: src.name,
@@ -37982,7 +38788,7 @@ function verifyMigration(sources, projectDbPath, globalDbPath, onProgress) {
       }
     }
     if (preExistingForeignKeyViolations.length > 0) {
-      log6.warn(
+      log7.warn(
         {
           count: preExistingForeignKeyViolations.length,
           sample: preExistingForeignKeyViolations.slice(0, 5)
@@ -37992,7 +38798,7 @@ function verifyMigration(sources, projectDbPath, globalDbPath, onProgress) {
     }
   } catch (err) {
     const error = err instanceof Error ? err.message : String(err);
-    log6.error({ err }, "verifyMigration failed");
+    log7.error({ err }, "verifyMigration failed");
     return {
       ok: false,
       tables,
@@ -38009,7 +38815,7 @@ function verifyMigration(sources, projectDbPath, globalDbPath, onProgress) {
   if (failureLines.length > 0) {
     const error = `verifyMigration FAILED: ${failureLines.length} issue(s):
 ${failureLines.map((l) => `  \u2022 ${l}`).join("\n")}`;
-    log6.error({ failureCount: failureLines.length }, error);
+    log7.error({ failureCount: failureLines.length }, error);
     return {
       ok: false,
       tables,
@@ -38029,7 +38835,7 @@ ${failureLines.map((l) => `  \u2022 ${l}`).join("\n")}`;
     enumDrift
   };
 }
-var log6, _require, CHECK_ENUM_REGEX;
+var log7, _require, CHECK_ENUM_REGEX;
 var init_verify_migration = __esm({
   "packages/core/src/store/exodus/verify-migration.ts"() {
     "use strict";
@@ -38038,7 +38844,7 @@ var init_verify_migration = __esm({
     init_open_cleo_db();
     init_column_transforms();
     init_table_name_map();
-    log6 = getLogger("verify-migration");
+    log7 = getLogger("verify-migration");
     _require = createRequire3(import.meta.url);
     CHECK_ENUM_REGEX = /CHECK\s*\(\s*"([^"]+)"\s+(?:IS\s+NULL\s+OR\s+"[^"]+"\s+)?IN\s*\(([^)]*)\)\s*\)/gi;
   }
@@ -38130,7 +38936,7 @@ __export(on_open_exports, {
   isDataContinuityOk: () => isDataContinuityOk,
   maybeRunExodusOnOpen: () => maybeRunExodusOnOpen
 });
-import { existsSync as existsSync13 } from "node:fs";
+import { existsSync as existsSync14 } from "node:fs";
 function isDisabledByEnv() {
   const v = process.env.CLEO_DISABLE_EXODUS_ON_OPEN;
   return v === "1" || v === "true";
@@ -38156,7 +38962,7 @@ function rollbackConsolidatedToEmpty(nativeDb, scope) {
       "SELECT name FROM sqlite_master WHERE type='table' AND name NOT LIKE 'sqlite_%' AND name NOT LIKE '__drizzle_%'"
     ).all().map((r) => r.name);
   } catch (err) {
-    log7.error({ err, scope }, "exodus-on-open: failed to enumerate tables for rollback");
+    log8.error({ err, scope }, "exodus-on-open: failed to enumerate tables for rollback");
     return;
   }
   try {
@@ -38166,7 +38972,7 @@ function rollbackConsolidatedToEmpty(nativeDb, scope) {
       try {
         nativeDb.exec(`DELETE FROM "${table}"`);
       } catch (err) {
-        log7.warn({ err, table, scope }, "exodus-on-open: failed to clear table during rollback");
+        log8.warn({ err, table, scope }, "exodus-on-open: failed to clear table during rollback");
       }
     }
     nativeDb.exec("COMMIT");
@@ -38175,7 +38981,7 @@ function rollbackConsolidatedToEmpty(nativeDb, scope) {
       nativeDb.exec("ROLLBACK");
     } catch {
     }
-    log7.error({ err, scope }, "exodus-on-open: rollback transaction failed");
+    log8.error({ err, scope }, "exodus-on-open: rollback transaction failed");
   } finally {
     try {
       nativeDb.exec("PRAGMA foreign_keys = ON");
@@ -38195,7 +39001,7 @@ async function rollbackBothScopes(scope, projectDbPath, globalDbPath) {
         rollbackConsolidatedToEmpty(native, s);
       }
     } catch (err) {
-      log7.warn(
+      log8.warn(
         { err, scope: s, openingScope: scope },
         "exodus-on-open: could not roll back scope (best-effort)"
       );
@@ -38211,7 +39017,7 @@ function isDataContinuityOk(result) {
   const deficits = result.tables.filter((t) => t.targetCount < t.sourceCount);
   const surpluses = result.tables.filter((t) => t.targetCount > t.sourceCount);
   if (surpluses.length > 0) {
-    log7.warn(
+    log8.warn(
       {
         surpluses: surpluses.map((t) => ({
           table: t.targetTable,
@@ -38245,7 +39051,7 @@ async function maybeRunExodusOnOpen(scope, dbPath, nativeDb, cwd) {
   const { buildExodusPlan: buildExodusPlan2, runExodusMigrate: runExodusMigrate2, verifyMigration: verifyMigration2, clearExodusJournal: clearExodusJournal2 } = await Promise.resolve().then(() => (init_exodus(), exodus_exports));
   const plan = buildExodusPlan2(cwd);
   const scopeSources = plan.sources.filter((s) => s.targetScope === scope);
-  if (!scopeSources.some((s) => existsSync13(s.path))) {
+  if (!scopeSources.some((s) => existsSync14(s.path))) {
     return {
       outcome: "skipped",
       reason: `no legacy ${scope}-scope source DBs present (fresh install or cross-scope-only)`
@@ -38258,11 +39064,11 @@ async function maybeRunExodusOnOpen(scope, dbPath, nativeDb, cwd) {
       if (!consolidatedIsEmpty(nativeDb, scope)) {
         return { outcome: "skipped", reason: "migrated by a concurrent process (lock winner)" };
       }
-      log7.info(
+      log8.info(
         {
           scope,
           dbPath,
-          sources: plan.sources.filter((s) => existsSync13(s.path)).map((s) => s.name)
+          sources: plan.sources.filter((s) => existsSync14(s.path)).map((s) => s.name)
         },
         "exodus-on-open: consolidated cleo.db is empty and legacy data present \u2014 auto-migrating"
       );
@@ -38271,23 +39077,23 @@ async function maybeRunExodusOnOpen(scope, dbPath, nativeDb, cwd) {
         const migrateResult = await runExodusMigrate2(
           plan,
           false,
-          (msg) => log7.debug({ scope }, `exodus-on-open: ${msg}`)
+          (msg) => log8.debug({ scope }, `exodus-on-open: ${msg}`)
         );
         if (!migrateResult.ok) {
           await rollbackBothScopes(scope, plan.projectDbPath, plan.globalDbPath);
           clearExodusJournal2(migrateResult.stagingDir);
           const reason = `migration failed: ${migrateResult.error ?? "unknown error"} \u2014 legacy DBs kept as source`;
-          log7.error({ scope, error: migrateResult.error }, `exodus-on-open: ${reason}`);
+          log8.error({ scope, error: migrateResult.error }, `exodus-on-open: ${reason}`);
           return { outcome: "aborted", reason };
         }
         const verifyResult = verifyMigration2(
           plan.sources,
           plan.projectDbPath,
           plan.globalDbPath,
-          (msg) => log7.debug({ scope }, `exodus-on-open verify: ${msg}`)
+          (msg) => log8.debug({ scope }, `exodus-on-open verify: ${msg}`)
         );
         if (!verifyResult.ok) {
-          log7.warn(
+          log8.warn(
             {
               scope,
               enumDrift: verifyResult.enumDrift.length,
@@ -38301,7 +39107,7 @@ async function maybeRunExodusOnOpen(scope, dbPath, nativeDb, cwd) {
           clearExodusJournal2(plan.stagingDir);
           const deficits = verifyResult.tables.filter((t) => t.targetCount < t.sourceCount).map((t) => `${t.targetTable}(${t.sourceCount}\u2192${t.targetCount})`);
           const reason = `parity verification failed \u2014 cutover aborted, legacy DBs kept as source. count deficits: [${deficits.join(", ")}]; INTRODUCED fk orphans: ${verifyResult.introducedForeignKeyViolations.length} (pre-existing source orphans tolerated: ${verifyResult.preExistingForeignKeyViolations.length}). ` + `${verifyResult.error ?? ""}`.trim();
-          log7.error(
+          log8.error(
             {
               scope,
               countDeficits: deficits,
@@ -38313,14 +39119,14 @@ async function maybeRunExodusOnOpen(scope, dbPath, nativeDb, cwd) {
           return { outcome: "aborted", reason };
         }
         const rowsCopied = migrateResult.tables.filter((t) => !t.skipped).reduce((n, t) => n + t.rowsCopied, 0);
-        log7.info(
+        log8.info(
           { scope, rowsCopied, tables: migrateResult.tables.length },
           "exodus-on-open: parity verified \u2014 legacy data migrated into consolidated cleo.db"
         );
         try {
-          const consumed = plan.sources.filter((s) => existsSync13(s.path));
+          const consumed = plan.sources.filter((s) => existsSync14(s.path));
           const archiveResult = archiveMigratedSources(consumed, cwd);
-          log7.info(
+          log8.info(
             {
               scope,
               archived: archiveResult.sources.filter((s) => s.action === "archived").length,
@@ -38329,7 +39135,7 @@ async function maybeRunExodusOnOpen(scope, dbPath, nativeDb, cwd) {
             "exodus-on-open: archived legacy sources + sealed completion marker(s)"
           );
         } catch (err) {
-          log7.error(
+          log8.error(
             { err, scope },
             "exodus-on-open: post-migration archive/marker step failed (migration itself succeeded \u2014 legacy DBs left in place, will be re-checked by `cleo doctor exodus-residue`)"
           );
@@ -38351,14 +39157,14 @@ async function maybeRunExodusOnOpen(scope, dbPath, nativeDb, cwd) {
 function _isExodusInProgress() {
   return _exodusInProgress;
 }
-var log7, _exodusInProgress;
+var log8, _exodusInProgress;
 var init_on_open = __esm({
   "packages/core/src/store/exodus/on-open.ts"() {
     "use strict";
     init_logger2();
     init_lock();
     init_archive2();
-    log7 = getLogger("exodus-on-open");
+    log8 = getLogger("exodus-on-open");
     _exodusInProgress = false;
   }
 });
@@ -38375,9 +39181,9 @@ __export(dual_scope_db_exports, {
   resolveDualScopeDbPath: () => resolveDualScopeDbPath,
   upsertIdempotent: () => upsertIdempotent
 });
-import { existsSync as existsSync14, mkdirSync as mkdirSync3 } from "node:fs";
+import { existsSync as existsSync15, mkdirSync as mkdirSync4 } from "node:fs";
 import { createRequire as createRequire4 } from "node:module";
-import { dirname as dirname6, join as join13 } from "node:path";
+import { dirname as dirname6, join as join15 } from "node:path";
 function assertWriteDurable(handle) {
   if (handle.exodusAbort) {
     throw new ExodusAbortWriteUnsafeError(handle.exodusAbort);
@@ -38394,9 +39200,9 @@ function cacheKey(scope, dbPath) {
 }
 function resolveDualScopeDbPath(scope, cwd) {
   if (scope === "project") {
-    return join13(resolveCleoDir(cwd), "cleo.db");
+    return join15(resolveCleoDir(cwd), "cleo.db");
   }
-  return join13(getCleoHome(), "cleo.db");
+  return join15(getCleoHome(), "cleo.db");
 }
 function migrationsSetName(scope) {
   return scope === "project" ? "drizzle-cleo-project" : "drizzle-cleo-global";
@@ -38439,11 +39245,11 @@ async function openDualScopeDb(scope, cwd) {
   const dbPath = resolveDualScopeDbPath(scope, cwd);
   return scope === "project" ? openDualScopeDbAtPath("project", dbPath, cwd) : openDualScopeDbAtPath("global", dbPath, cwd);
 }
-async function openDedicatedDualScopeDb(scope, dbPath, log11) {
-  log11.debug({ scope, dbPath }, "opening DEDICATED (non-cached) dual-scope cleo.db (T11782 FIX D)");
+async function openDedicatedDualScopeDb(scope, dbPath, log12) {
+  log12.debug({ scope, dbPath }, "opening DEDICATED (non-cached) dual-scope cleo.db (T11782 FIX D)");
   const dir = dirname6(dbPath);
-  if (!existsSync14(dir)) {
-    mkdirSync3(dir, { recursive: true });
+  if (!existsSync15(dir)) {
+    mkdirSync4(dir, { recursive: true });
   }
   const DatabaseSyncCtor = getDatabaseSyncCtor();
   const nativeDb = new DatabaseSyncCtor(dbPath, { allowExtension: true });
@@ -38466,7 +39272,7 @@ async function openDedicatedDualScopeDb(scope, dbPath, log11) {
     existenceTable(scope),
     `dual-scope-db[${scope}]`
   );
-  log11.debug({ scope, dbPath }, "DEDICATED dual-scope cleo.db ready (T11782 FIX D)");
+  log12.debug({ scope, dbPath }, "DEDICATED dual-scope cleo.db ready (T11782 FIX D)");
   return {
     db,
     scope,
@@ -38491,15 +39297,15 @@ async function openDualScopeDbAtPath(scope, dbPath, exodusCwd, options) {
       return existing.handle;
     }
   }
-  const log11 = getLogger("dual-scope-db");
+  const log12 = getLogger("dual-scope-db");
   if (dedicated) {
-    return openDedicatedDualScopeDb(scope, dbPath, log11);
+    return openDedicatedDualScopeDb(scope, dbPath, log12);
   }
   const initPromise = (async () => {
-    log11.debug({ scope, dbPath }, "opening dual-scope cleo.db");
+    log12.debug({ scope, dbPath }, "opening dual-scope cleo.db");
     const dir = dirname6(dbPath);
-    if (!existsSync14(dir)) {
-      mkdirSync3(dir, { recursive: true });
+    if (!existsSync15(dir)) {
+      mkdirSync4(dir, { recursive: true });
     }
     const DatabaseSyncCtor = getDatabaseSyncCtor();
     const nativeDb = new DatabaseSyncCtor(dbPath, { allowExtension: true });
@@ -38526,7 +39332,7 @@ async function openDualScopeDbAtPath(scope, dbPath, exodusCwd, options) {
           existenceTable(scope),
           `dual-scope-db[${scope}]`
         );
-        log11.debug({ scope, dbPath }, "dual-scope cleo.db ready");
+        log12.debug({ scope, dbPath }, "dual-scope cleo.db ready");
         const built = {
           db,
           scope,
@@ -38552,6 +39358,25 @@ async function openDualScopeDbAtPath(scope, dbPath, exodusCwd, options) {
       { dbPath }
     );
     if (exodusCwd !== void 0 && dbPath === resolveDualScopeDbPath(scope, exodusCwd)) {
+      let releaseDbHeavy = null;
+      let dbHeavyDeferred = false;
+      try {
+        const { governor: governor2 } = await Promise.resolve().then(() => (init_governor(), governor_exports));
+        const admit = await governor2.tryAcquire("db-heavy");
+        if (admit.deferred) {
+          dbHeavyDeferred = true;
+        } else {
+          releaseDbHeavy = admit.release;
+        }
+      } catch {
+      }
+      if (dbHeavyDeferred) {
+        log12.debug(
+          { scope, dbPath },
+          "exodus-on-open skipped this open \u2014 db-heavy deferred under memory pressure (re-runs idempotently on a calmer open)"
+        );
+        return handle;
+      }
       try {
         const { maybeRunExodusOnOpen: maybeRunExodusOnOpen2 } = await Promise.resolve().then(() => (init_on_open(), on_open_exports));
         const result = await maybeRunExodusOnOpen2(scope, dbPath, nativeDb, exodusCwd);
@@ -38564,7 +39389,7 @@ async function openDualScopeDbAtPath(scope, dbPath, exodusCwd, options) {
               reason: result.reason,
               at: Date.now()
             };
-            log11.warn(
+            log12.warn(
               { scope, reason: result.reason },
               "exodus-on-open aborted; consolidated cleo.db left empty, legacy kept as source \u2014 mutating callers must check handle.exodusAbort / call assertWriteDurable (T11828)"
             );
@@ -38577,11 +39402,14 @@ async function openDualScopeDbAtPath(scope, dbPath, exodusCwd, options) {
           return reopened;
         }
       } catch (err) {
-        log11.warn(
+        log12.warn(
           { err, scope },
           "exodus-on-open hook failed (non-fatal); re-opening consolidated handle"
         );
         return scope === "project" ? openDualScopeDbAtPath("project", dbPath) : openDualScopeDbAtPath("global", dbPath);
+      } finally {
+        if (releaseDbHeavy) await releaseDbHeavy().catch(() => {
+        });
       }
     }
     return handle;
@@ -39204,8 +40032,8 @@ __export(nexus_sqlite_exports, {
   resetNexusDbState: () => resetNexusDbState,
   resolveNexusMigrationsFolder: () => resolveNexusMigrationsFolder
 });
-import { copyFileSync as copyFileSync4, existsSync as existsSync15 } from "node:fs";
-import { join as join14 } from "node:path";
+import { copyFileSync as copyFileSync4, existsSync as existsSync16 } from "node:fs";
+import { join as join16 } from "node:path";
 function getNexusDbPath(cwd) {
   return resolveDualScopeDbPath("project", cwd);
 }
@@ -39237,7 +40065,7 @@ function resolveNexusMigrationsFolder() {
   return resolveCorePackageMigrationsFolder("drizzle-nexus");
 }
 function getNestedNexusSentinelPath() {
-  return join14(getCleoHome(), "nexus", NESTED_NEXUS_SENTINEL);
+  return join16(getCleoHome(), "nexus", NESTED_NEXUS_SENTINEL);
 }
 function detectAndWarnOnNestedNexus() {
   let nestedPath;
@@ -39246,12 +40074,12 @@ function detectAndWarnOnNestedNexus() {
   } catch {
     return false;
   }
-  if (!existsSync15(nestedPath)) return false;
+  if (!existsSync16(nestedPath)) return false;
   if (_warnedNestedPaths.has(nestedPath)) return false;
   _warnedNestedPaths.add(nestedPath);
   const canonicalPath = getNexusDbPath();
-  const log11 = getLogger("nexus-sqlite");
-  log11.warn(
+  const log12 = getLogger("nexus-sqlite");
+  log12.warn(
     {
       nestedPath,
       canonicalPath,
@@ -39405,7 +40233,7 @@ function runNexusMigrations(nativeDb, db) {
   const migrationsFolder = resolveNexusMigrationsFolder();
   if (tableExists4(nativeDb, "nexus_nodes") && _nexusDbPath) {
     const backupPath = _nexusDbPath.replace(/\.db$/, "-pre-cleo.db.bak");
-    if (!existsSync15(backupPath)) {
+    if (!existsSync16(backupPath)) {
       try {
         copyFileSync4(_nexusDbPath, backupPath);
       } catch {
@@ -39543,10 +40371,10 @@ var init_nexus_sqlite = __esm({
 
 // packages/core/src/paths.ts
 import { AsyncLocalStorage } from "node:async_hooks";
-import { existsSync as existsSync16, readFileSync as readFileSync5, statSync as statSync6 } from "node:fs";
+import { existsSync as existsSync17, readFileSync as readFileSync5, statSync as statSync6 } from "node:fs";
 import { createRequire as createRequire5 } from "node:module";
 import { homedir } from "node:os";
-import { basename as basename4, dirname as dirname7, join as join15, resolve as resolve3 } from "node:path";
+import { basename as basename4, dirname as dirname7, join as join17, resolve as resolve3 } from "node:path";
 import {
   computeCanonicalProjectId as _computeCanonicalProjectId,
   getCanonicalTemplatesTildePath as _getCanonicalTemplatesTildePath,
@@ -39636,8 +40464,8 @@ function getCleoDirAbsolute(cwd, opts) {
 function _resolveProjectByCwdFromNexus(cwd) {
   try {
     const cleoHome = getCleoHome();
-    const globalDbPath = join15(cleoHome, "cleo.db");
-    if (!existsSync16(globalDbPath)) return null;
+    const globalDbPath = join17(cleoHome, "cleo.db");
+    if (!existsSync17(globalDbPath)) return null;
     const start = resolve3(cwd ?? process.cwd());
     let current = start;
     const DatabaseSync3 = _getDatabaseSyncCtor();
@@ -39676,7 +40504,7 @@ function _findCleoDirRoot(cwd) {
     const isDangerousRoot = current === homeRoot || current === "/" || current === "";
     if (!isDangerousRoot) {
       try {
-        if (statSync6(join15(current, ".cleo")).isDirectory()) {
+        if (statSync6(join17(current, ".cleo")).isDirectory()) {
           return current;
         }
       } catch {
@@ -39691,7 +40519,7 @@ function _findCleoDirRoot(cwd) {
 function resolveCleoDir(cwd) {
   const scope = worktreeScope.getStore();
   if (scope !== void 0) {
-    return join15(scope.worktreeRoot, ".cleo");
+    return join17(scope.worktreeRoot, ".cleo");
   }
   const override = _cleoDirEnvOverride();
   if (override !== null) {
@@ -39699,14 +40527,14 @@ function resolveCleoDir(cwd) {
   }
   const root = _findCleoDirRoot(cwd);
   if (root !== null) {
-    return join15(root, ".cleo");
+    return join17(root, ".cleo");
   }
   const start = resolve3(cwd ?? process.cwd());
   let current = start;
   while (true) {
     const mainRepo = _resolveMainRepoFromGitlink(current);
     if (mainRepo !== null) {
-      return join15(mainRepo, ".cleo");
+      return join17(mainRepo, ".cleo");
     }
     const parent = dirname7(current);
     if (parent === current) {
@@ -39748,9 +40576,9 @@ function _cwdHasGitAncestor(cwd) {
   const start = resolve3(cwd ?? process.cwd());
   let current = start;
   while (true) {
-    const gitMarker = join15(current, ".git");
+    const gitMarker = join17(current, ".git");
     try {
-      if (existsSync16(gitMarker)) {
+      if (existsSync17(gitMarker)) {
         return true;
       }
     } catch {
@@ -39762,16 +40590,16 @@ function _cwdHasGitAncestor(cwd) {
 }
 function _resolveMainRepoFromGitlink(gitlinkDir) {
   try {
-    const gitLinkPath = join15(gitlinkDir, ".git");
-    if (!existsSync16(gitLinkPath)) return null;
-    const stat2 = statSync6(gitLinkPath);
-    if (!stat2.isFile()) return null;
+    const gitLinkPath = join17(gitlinkDir, ".git");
+    if (!existsSync17(gitLinkPath)) return null;
+    const stat3 = statSync6(gitLinkPath);
+    if (!stat3.isFile()) return null;
     const gitLinkContent = readFileSync5(gitLinkPath, "utf-8").trim();
     const match = gitLinkContent.match(/^gitdir:\s*(.+)$/m);
     if (!match) return null;
     const gitdir = match[1].trim();
     const mainRepo = dirname7(dirname7(dirname7(gitdir)));
-    if (existsSync16(join15(mainRepo, ".cleo")) && validateProjectRoot(mainRepo)) {
+    if (existsSync17(join17(mainRepo, ".cleo")) && validateProjectRoot(mainRepo)) {
       return mainRepo;
     }
   } catch {
@@ -39779,18 +40607,18 @@ function _resolveMainRepoFromGitlink(gitlinkDir) {
   return null;
 }
 function validateProjectRoot(candidate) {
-  const cleoDir = join15(candidate, ".cleo");
-  if (!existsSync16(cleoDir)) {
+  const cleoDir = join17(candidate, ".cleo");
+  if (!existsSync17(cleoDir)) {
     return false;
   }
-  const projectInfoPath = join15(cleoDir, "project-info.json");
-  if (existsSync16(projectInfoPath)) {
+  const projectInfoPath = join17(cleoDir, "project-info.json");
+  if (existsSync17(projectInfoPath)) {
     try {
       const raw = readFileSync5(projectInfoPath, "utf-8");
       const parsed = JSON.parse(raw);
       if (typeof parsed === "object" && parsed !== null && "projectId" in parsed && typeof parsed["projectId"] === "string" && parsed["projectId"] !== "") {
-        const gitMarker = join15(candidate, ".git");
-        if (existsSync16(gitMarker)) {
+        const gitMarker = join17(candidate, ".git");
+        if (existsSync17(gitMarker)) {
           try {
             if (!statSync6(gitMarker).isDirectory()) {
               return false;
@@ -39804,12 +40632,12 @@ function validateProjectRoot(candidate) {
     } catch {
     }
   }
-  const gitDir = join15(candidate, ".git");
-  if (existsSync16(gitDir)) {
+  const gitDir = join17(candidate, ".git");
+  if (existsSync17(gitDir)) {
     let isRealGitDir = false;
     try {
-      const stat2 = statSync6(gitDir);
-      isRealGitDir = stat2.isDirectory();
+      const stat3 = statSync6(gitDir);
+      isRealGitDir = stat3.isDirectory();
     } catch {
       isRealGitDir = false;
     }
@@ -39852,16 +40680,16 @@ function getProjectRoot(cwd) {
   const homeRoot = homedir();
   const skippedCleoDirs = [];
   while (true) {
-    const cleoDir = join15(current, ".cleo");
-    const gitDir = join15(current, ".git");
+    const cleoDir = join17(current, ".cleo");
+    const gitDir = join17(current, ".git");
     const isDangerousRoot = current === homeRoot || current === "/" || current === "";
-    if (existsSync16(cleoDir) && !isDangerousRoot) {
+    if (existsSync17(cleoDir) && !isDangerousRoot) {
       if (validateProjectRoot(current)) {
         return current;
       }
       skippedCleoDirs.push(current);
     }
-    if (existsSync16(gitDir) && !isDangerousRoot) {
+    if (existsSync17(gitDir) && !isDangerousRoot) {
       let isRealGitDir = false;
       try {
         isRealGitDir = statSync6(gitDir).isDirectory();
@@ -39906,18 +40734,18 @@ function resolveOrCwd(maybeRoot) {
   return getProjectRoot();
 }
 function getConfigPath(cwd) {
-  return join15(_resolveCleoDir(cwd), "config.json");
+  return join17(_resolveCleoDir(cwd), "config.json");
 }
 function getGlobalConfigPath() {
-  return join15(getCleoHome(), "config.json");
+  return join17(getCleoHome(), "config.json");
 }
 function isAbsolutePath(path2) {
   return _isAbsolutePath(path2);
 }
 function _readProjectNameFromInfo(projectRoot) {
   try {
-    const infoPath = join15(projectRoot, ".cleo", "project-info.json");
-    if (!existsSync16(infoPath)) return void 0;
+    const infoPath = join17(projectRoot, ".cleo", "project-info.json");
+    if (!existsSync17(infoPath)) return void 0;
     const raw = readFileSync5(infoPath, "utf-8");
     const data = JSON.parse(raw);
     return typeof data.name === "string" && data.name.length > 0 ? data.name : void 0;
@@ -39943,8 +40771,8 @@ async function registerProjectOnEncounter(projectRoot, infoProjectId) {
     if (existingRows.length > 0) {
       const existingPath = existingRows[0].projectPath;
       if (existingPath !== resolvedPath) {
-        const newBrainDbPath = join15(resolvedPath, ".cleo", "brain.db");
-        const newTasksDbPath = join15(resolvedPath, ".cleo", "tasks.db");
+        const newBrainDbPath = join17(resolvedPath, ".cleo", "brain.db");
+        const newTasksDbPath = join17(resolvedPath, ".cleo", "tasks.db");
         await db.update(projectRegistry2).set({
           projectPath: resolvedPath,
           projectHash: generateProjectHash2(resolvedPath),
@@ -39975,8 +40803,8 @@ async function registerProjectOnEncounter(projectRoot, infoProjectId) {
       lastSync: now,
       taskCount: 0,
       labelsJson: "[]",
-      brainDbPath: join15(resolvedPath, ".cleo", "brain.db"),
-      tasksDbPath: join15(resolvedPath, ".cleo", "tasks.db"),
+      brainDbPath: join17(resolvedPath, ".cleo", "brain.db"),
+      tasksDbPath: join17(resolvedPath, ".cleo", "tasks.db"),
       statsJson: "{}"
     }).onConflictDoNothing();
     const aliases = canonicalResult.legacyAliases ?? [];
@@ -40193,7 +41021,7 @@ __export(config_exports, {
   parseConfigValue: () => parseConfigValue,
   setConfigValue: () => setConfigValue
 });
-import { existsSync as existsSync17 } from "node:fs";
+import { existsSync as existsSync18 } from "node:fs";
 function getNestedValue(obj, path2) {
   const parts = path2.split(".");
   let current = obj;
@@ -40241,7 +41069,7 @@ function parseEnvValue(value) {
   return value;
 }
 async function loadConfig(cwd) {
-  let merged = JSON.parse(JSON.stringify(DEFAULTS));
+  let merged = JSON.parse(JSON.stringify(DEFAULTS2));
   const globalConfig = await readJson(getGlobalConfigPath());
   if (globalConfig) {
     merged = deepMerge(merged, globalConfig);
@@ -40287,7 +41115,7 @@ async function getConfigValue(path2, cwd) {
       return { value: val, source: "global" };
     }
   }
-  const defaultVal = getNestedValue({ ...DEFAULTS }, path2);
+  const defaultVal = getNestedValue({ ...DEFAULTS2 }, path2);
   return { value: defaultVal, source: "default" };
 }
 async function getRawConfigValue(key, cwd) {
@@ -40315,7 +41143,7 @@ function parseConfigValue(value) {
 }
 async function setConfigValue(key, value, cwd, opts) {
   const configPath = opts?.global ? getGlobalConfigPath() : getConfigPath(cwd);
-  if (!existsSync17(configPath)) {
+  if (!existsSync18(configPath)) {
     await atomicWriteJson(configPath, {});
   }
   const config = await readJson(configPath) ?? {};
@@ -40327,7 +41155,7 @@ async function setConfigValue(key, value, cwd, opts) {
 async function applyStrictnessPreset(preset, cwd, opts) {
   const definition = STRICTNESS_PRESETS[preset];
   const configPath = opts?.global ? getGlobalConfigPath() : getConfigPath(cwd);
-  if (!existsSync17(configPath)) {
+  if (!existsSync18(configPath)) {
     await atomicWriteJson(configPath, {});
   }
   const config = await readJson(configPath) ?? {};
@@ -40351,7 +41179,7 @@ function listStrictnessPresets() {
     })
   );
 }
-var DEFAULTS, ENV_MAP, STRICTNESS_PRESETS;
+var DEFAULTS2, ENV_MAP, STRICTNESS_PRESETS;
 var init_config = __esm({
   "packages/core/src/config.ts"() {
     "use strict";
@@ -40359,7 +41187,7 @@ var init_config = __esm({
     init_paths();
     init_atomic();
     init_json2();
-    DEFAULTS = {
+    DEFAULTS2 = {
       version: "2.10.0",
       output: {
         defaultFormat: "json",
@@ -40678,7 +41506,7 @@ function brainTablesAreConsolidatedShape(nativeDb) {
   return createdAt !== void 0 && createdAt.type.toUpperCase() !== "INTEGER";
 }
 function establishLegacyBrainSchema(nativeDb, db) {
-  const log11 = getLogger("brain-schema");
+  const log12 = getLogger("brain-schema");
   if (brainTablesAreConsolidatedShape(nativeDb)) {
     const fkRow = nativeDb.prepare("PRAGMA foreign_keys").get();
     const fkWasOn = fkRow?.foreign_keys === 1;
@@ -40688,7 +41516,7 @@ function establishLegacyBrainSchema(nativeDb, db) {
         try {
           nativeDb.exec(`DROP TABLE IF EXISTS \`${table}\``);
         } catch (err) {
-          log11.warn(
+          log12.warn(
             { table, err },
             "Failed to drop consolidated brain table during legacy rebuild."
           );
@@ -40697,7 +41525,7 @@ function establishLegacyBrainSchema(nativeDb, db) {
     } finally {
       nativeDb.exec(`PRAGMA foreign_keys=${fkWasOn ? "ON" : "OFF"}`);
     }
-    log11.debug(
+    log12.debug(
       { count: CONSOLIDATED_BRAIN_TABLES.length },
       "Dropped consolidated (exodus-target) brain tables \u2014 rebuilding in legacy runtime shape."
     );
@@ -40708,7 +41536,7 @@ function establishLegacyBrainSchema(nativeDb, db) {
       nativeDb,
       migrationsFolder
     );
-    log11.debug(
+    log12.debug(
       { marked, applied },
       "brain consolidated cleo.db reconcile (T11647) \u2014 marked already-present migrations applied + executed the missing unprefixed-table migrations directly."
     );
@@ -41264,7 +42092,7 @@ async function upsertTask(db, row, archiveFields, allowOrphanParent = false) {
       if (allowOrphanParent) {
         row = { ...row, parentId: null };
       } else {
-        log8.warn(
+        log9.warn(
           { taskId: row.id, parentId: row.parentId },
           "upsertTask: parentId references a non-existent task \u2014 parent relationship may be lost"
         );
@@ -41449,13 +42277,13 @@ async function loadRelationsForTasks(db, tasks2) {
     task.relates = relations && relations.length > 0 ? relations : [];
   }
 }
-var log8;
+var log9;
 var init_db_helpers = __esm({
   "packages/core/src/store/db-helpers.ts"() {
     "use strict";
     init_logger2();
     init_tasks_schema();
-    log8 = getLogger("db-helpers");
+    log9 = getLogger("db-helpers");
   }
 });
 
@@ -41556,10 +42384,10 @@ var init_telemetry_schema = __esm({
 });
 
 // packages/core/src/telemetry/sqlite.ts
-import { mkdirSync as mkdirSync4 } from "node:fs";
-import { dirname as dirname8, join as join16 } from "node:path";
+import { mkdirSync as mkdirSync5 } from "node:fs";
+import { dirname as dirname8, join as join18 } from "node:path";
 function getTelemetryDbPath() {
-  return join16(getCleoHome(), DB_FILENAME);
+  return join18(getCleoHome(), DB_FILENAME);
 }
 function resolveTelemetryMigrationsFolder() {
   return resolveCorePackageMigrationsFolder("drizzle-telemetry");
@@ -41607,7 +42435,7 @@ async function getTelemetryDb() {
   _initPromise2 = (async () => {
     const dbPath = requestedPath;
     _dbPath2 = dbPath;
-    mkdirSync4(dirname8(dbPath), { recursive: true });
+    mkdirSync5(dirname8(dbPath), { recursive: true });
     const nativeDb = openNativeDatabase(dbPath);
     _nativeDb2 = nativeDb;
     const db = drizzle({ client: nativeDb, schema: telemetry_schema_exports });
@@ -41640,11 +42468,11 @@ var init_sqlite2 = __esm({
 });
 
 // packages/core/src/store/agent-registry-store.ts
-import { existsSync as existsSync18 } from "node:fs";
-import { join as join17 } from "node:path";
+import { existsSync as existsSync19 } from "node:fs";
+import { join as join19 } from "node:path";
 function getGlobalAgentRegistryDbPath() {
   const cleoHome = getCleoHome();
-  const dbPath = join17(cleoHome, "cleo.db");
+  const dbPath = join19(cleoHome, "cleo.db");
   if (!dbPath.startsWith(cleoHome)) {
     throw new Error(
       `BUG: getGlobalAgentRegistryDbPath() resolved to "${dbPath}" which is NOT under getCleoHome() ("${cleoHome}"). The Agent Registry is global-only per ADR-037. This indicates a code path that bypasses path resolution \u2014 fix the caller, do not suppress this error.`
@@ -41691,8 +42519,8 @@ function writeAgentRegistrySchemaVersionSentinel(db) {
 }
 async function ensureGlobalAgentRegistryDb() {
   const dbPath = getGlobalAgentRegistryDbPath();
-  const alreadyExists = existsSync18(dbPath);
-  const dualHandle = await openDualScopeDb("global");
+  const alreadyExists = existsSync19(dbPath);
+  const dualHandle = await openDualScopeDbAtPath("global", dbPath);
   const nativeDb = dualHandle.db.$client ?? null;
   if (!nativeDb) {
     throw new Error(
@@ -41740,7 +42568,7 @@ var init_agent_registry_store = __esm({
 });
 
 // packages/core/src/store/conduit-sqlite.ts
-import { existsSync as existsSync19 } from "node:fs";
+import { existsSync as existsSync20 } from "node:fs";
 import { createRequire as createRequire7 } from "node:module";
 function _getDrizzle2() {
   if (_drizzle3 === null) {
@@ -41777,7 +42605,7 @@ async function ensureConduitDb(projectRoot) {
   }
   if (_initPromise3) return _initPromise3;
   _initPromise3 = (async () => {
-    const alreadyExists = existsSync19(dbPath);
+    const alreadyExists = existsSync20(dbPath);
     const dualHandle = await openDualScopeDb("project", projectRoot);
     const nativeDb = dualHandle.db.$client ?? null;
     if (!nativeDb) {
@@ -41997,11 +42825,11 @@ var init_skills_schema = __esm({
 });
 
 // packages/core/src/store/skills-db.ts
-import { join as join18 } from "node:path";
+import { join as join20 } from "node:path";
 import { and as and3, eq as eq4 } from "drizzle-orm";
 function getDefaultSkillsDbPath() {
   const cleoHome = getCleoHome();
-  const dbPath = join18(cleoHome, "cleo.db");
+  const dbPath = join20(cleoHome, "cleo.db");
   if (!dbPath.startsWith(cleoHome)) {
     throw new Error(
       `BUG: getDefaultSkillsDbPath() resolved to "${dbPath}" which is NOT under getCleoHome() ("${cleoHome}"). The skills registry is global-only per SG-CLEO-SKILLS-architecture-v3.md \xA74. Fix the caller, do not suppress.`
@@ -42071,13 +42899,13 @@ var init_skills_db = __esm({
 import {
   chmodSync,
   copyFileSync as copyFileSync5,
-  existsSync as existsSync20,
-  mkdirSync as mkdirSync5,
-  readdirSync as readdirSync4,
+  existsSync as existsSync21,
+  mkdirSync as mkdirSync6,
+  readdirSync as readdirSync5,
   statSync as statSync7,
   unlinkSync as unlinkSync3
 } from "node:fs";
-import { join as join19 } from "node:path";
+import { join as join21 } from "node:path";
 function resolveInventoryPath(entry, cwd) {
   try {
     if (entry.tier === "global") {
@@ -42112,8 +42940,8 @@ async function openAgentRegistryDbForSnapshot() {
 }
 async function openTelemetryDbForSnapshot() {
   try {
-    const path2 = join19(getCleoHome(), "telemetry.db");
-    if (!existsSync20(path2)) return null;
+    const path2 = join21(getCleoHome(), "telemetry.db");
+    if (!existsSync21(path2)) return null;
   } catch {
     return null;
   }
@@ -42128,7 +42956,7 @@ function buildRawFileVacuumOpener(entry) {
   return async (cwd) => {
     const path2 = resolveInventoryPath(entry, cwd);
     if (!path2) return null;
-    if (!existsSync20(path2)) return null;
+    if (!existsSync21(path2)) return null;
     try {
       const { DatabaseSync: DatabaseSync3 } = await import("node:sqlite");
       return new DatabaseSync3(path2, { readOnly: true });
@@ -42216,10 +43044,10 @@ function snapshotPattern(prefix) {
 function rotateSnapshots(backupDir, prefix) {
   try {
     const pattern = snapshotPattern(prefix);
-    const files = readdirSync4(backupDir).filter((f) => pattern.test(f)).map((f) => ({
+    const files = readdirSync5(backupDir).filter((f) => pattern.test(f)).map((f) => ({
       name: f,
-      path: join19(backupDir, f),
-      mtimeMs: statSync7(join19(backupDir, f)).mtimeMs
+      path: join21(backupDir, f),
+      mtimeMs: statSync7(join21(backupDir, f)).mtimeMs
     })).sort((a, b) => a.mtimeMs - b.mtimeMs);
     while (files.length >= MAX_SNAPSHOTS) {
       const oldest = files.shift();
@@ -42244,7 +43072,7 @@ async function snapshotOne(target, backupDir, now, cwd) {
     if (!db) return;
     opened = db;
   }
-  const dest = join19(backupDir, `${target.prefix}-${formatTimestamp(now)}.db`);
+  const dest = join21(backupDir, `${target.prefix}-${formatTimestamp(now)}.db`);
   try {
     db.exec("PRAGMA wal_checkpoint(TRUNCATE)");
     rotateSnapshots(backupDir, target.prefix);
@@ -42265,8 +43093,8 @@ async function vacuumIntoBackup(opts = {}) {
   }
   try {
     const cleoDir = getCleoDir(opts.cwd);
-    const backupDir = join19(cleoDir, "backups", "sqlite");
-    mkdirSync5(backupDir, { recursive: true });
+    const backupDir = join21(cleoDir, "backups", "sqlite");
+    mkdirSync6(backupDir, { recursive: true });
     const target = SNAPSHOT_TARGETS.find((t) => t.prefix === prefix);
     if (!target) return;
     await snapshotOne(target, backupDir, /* @__PURE__ */ new Date(), opts.cwd);
@@ -42277,13 +43105,13 @@ async function vacuumIntoBackup(opts = {}) {
 function listSqliteBackupsForPrefix(prefix, cwd) {
   try {
     const cleoDir = getCleoDir(cwd);
-    const backupDir = join19(cleoDir, "backups", "sqlite");
-    if (!existsSync20(backupDir)) return [];
+    const backupDir = join21(cleoDir, "backups", "sqlite");
+    if (!existsSync21(backupDir)) return [];
     const pattern = snapshotPattern(prefix);
-    return readdirSync4(backupDir).filter((f) => pattern.test(f)).map((f) => ({
+    return readdirSync5(backupDir).filter((f) => pattern.test(f)).map((f) => ({
       name: f,
-      path: join19(backupDir, f),
-      mtimeMs: statSync7(join19(backupDir, f)).mtimeMs
+      path: join21(backupDir, f),
+      mtimeMs: statSync7(join21(backupDir, f)).mtimeMs
     })).sort((a, b) => b.mtimeMs - a.mtimeMs);
   } catch {
     return [];
@@ -42339,7 +43167,7 @@ __export(sqlite_native_exports, {
 import { realpathSync } from "node:fs";
 import { createRequire as createRequire8 } from "node:module";
 import { tmpdir } from "node:os";
-import { delimiter, dirname as dirname9, isAbsolute, join as join20, resolve as resolve4, sep } from "node:path";
+import { delimiter, dirname as dirname9, isAbsolute, join as join22, resolve as resolve4, sep } from "node:path";
 function getDbSyncConstructor() {
   if (_ctor === null) {
     const mod = _require5("node:sqlite");
@@ -42360,7 +43188,7 @@ function resolveAbsoluteSafe(p) {
       missingParts.unshift(cursor.slice(parent.length + (parent.endsWith(sep) ? 0 : 1)));
       cursor = parent;
       try {
-        return join20(realpathSync(cursor), ...missingParts);
+        return join22(realpathSync(cursor), ...missingParts);
       } catch {
       }
     }
@@ -42466,7 +43294,7 @@ __export(sqlite_exports, {
   resolveMigrationsFolder: () => resolveMigrationsFolder,
   schema: () => tasks_schema_exports
 });
-import { copyFileSync as copyFileSync6, existsSync as existsSync21, renameSync as renameSync3, unlinkSync as unlinkSync4 } from "node:fs";
+import { copyFileSync as copyFileSync6, existsSync as existsSync22, renameSync as renameSync3, unlinkSync as unlinkSync4 } from "node:fs";
 import { createRequire as createRequire9 } from "node:module";
 import { eq as eq5 } from "drizzle-orm";
 function _getDrizzle3() {
@@ -42508,7 +43336,7 @@ function countBackupTasks(backupDb) {
 }
 async function autoRecoverFromBackup(nativeDb, dbPath, cwd) {
   const { openNativeDatabase: openNativeDatabase2 } = await Promise.resolve().then(() => (init_sqlite_native(), sqlite_native_exports));
-  const log11 = getLogger("sqlite");
+  const log12 = getLogger("sqlite");
   try {
     const countResult = nativeDb.prepare("SELECT COUNT(*) as cnt FROM tasks_tasks").get();
     const taskCount = countResult?.cnt ?? 0;
@@ -42534,13 +43362,13 @@ async function autoRecoverFromBackup(nativeDb, dbPath, cwd) {
       async () => {
         const currentTaskCount = await recountTasksFromDisk(dbPath);
         if (currentTaskCount > 0) {
-          log11.info(
+          log12.info(
             { dbPath, currentTaskCount },
             "Auto-recovery skipped: database was populated by a concurrent process while acquiring the first-open lock (T11662 double-checked re-query)."
           );
           return;
         }
-        log11.warn(
+        log12.warn(
           { dbPath, backupPath: newestBackup.path, backupTasks: backupTaskCount },
           `Empty database detected with ${backupTaskCount}-task backup available. Auto-recovering from backup. This likely happened because git-tracked WAL/SHM files were overwritten during a branch switch (T5188).`
         );
@@ -42560,7 +43388,7 @@ async function autoRecoverFromBackup(nativeDb, dbPath, cwd) {
         const tempPath = dbPath + ".recovery-tmp";
         copyFileSync6(newestBackup.path, tempPath);
         renameSync3(tempPath, dbPath);
-        log11.info(
+        log12.info(
           { dbPath, backupPath: newestBackup.path, restoredTasks: backupTaskCount },
           "Database auto-recovered from backup successfully."
         );
@@ -42577,7 +43405,7 @@ async function autoRecoverFromBackup(nativeDb, dbPath, cwd) {
       { stale: 6e5, retries: 30 }
     );
   } catch (err) {
-    log11.error({ err, dbPath }, "Auto-recovery from backup failed. Continuing with empty database.");
+    log12.error({ err, dbPath }, "Auto-recovery from backup failed. Continuing with empty database.");
   }
 }
 async function getDb(cwd) {
@@ -42586,6 +43414,9 @@ async function getDb(cwd) {
   if (_db3 && _dbPath3 !== requestedPath) {
     resetDbState();
   }
+  if (_db3 && (_nativeDb3 === null || !_nativeDb3.isOpen)) {
+    resetDbState();
+  }
   if (_db3) return _db3;
   if (_initPromise4) return _initPromise4;
   _initPromise4 = (async () => {
@@ -42683,7 +43514,7 @@ async function getSchemaVersion(cwd) {
   return result[0]?.value ?? null;
 }
 function dbExists(cwd) {
-  return existsSync21(resolveDualScopeDbPath("project", cwd));
+  return existsSync22(resolveDualScopeDbPath("project", cwd));
 }
 function getNativeDb() {
   return _nativeDb3;
@@ -43913,13 +44744,13 @@ var init_sqlite_data_accessor = __esm({
 });
 
 // packages/core/src/sequence/index.ts
-import { existsSync as existsSync22, readFileSync as readFileSync6, renameSync as renameSync4 } from "node:fs";
-import { join as join21 } from "node:path";
+import { existsSync as existsSync23, readFileSync as readFileSync6, renameSync as renameSync4 } from "node:fs";
+import { join as join23 } from "node:path";
 function getLegacySequenceJsonPath(cwd) {
-  return join21(resolveOrCwd(cwd), ".cleo", ".sequence.json");
+  return join23(resolveOrCwd(cwd), ".cleo", ".sequence.json");
 }
 function getLegacySequencePath(cwd) {
-  return join21(resolveOrCwd(cwd), ".cleo", ".sequence");
+  return join23(resolveOrCwd(cwd), ".cleo", ".sequence");
 }
 function isValidSequenceState(value) {
   if (!value || typeof value !== "object") return false;
@@ -43930,7 +44761,7 @@ function isSeedSequence(value) {
   return value.counter === 0 && value.lastId === "T000" && value.checksum === "seed";
 }
 function readLegacySequenceFile(path2) {
-  if (!existsSync22(path2)) return null;
+  if (!existsSync23(path2)) return null;
   try {
     const parsed = JSON.parse(readFileSync6(path2, "utf-8"));
     return isValidSequenceState(parsed) ? parsed : null;
@@ -43939,10 +44770,10 @@ function readLegacySequenceFile(path2) {
   }
 }
 function renameLegacyFile(path2) {
-  if (!existsSync22(path2)) return;
+  if (!existsSync23(path2)) return;
   const migratedPath = `${path2}.migrated`;
   try {
-    if (!existsSync22(migratedPath)) {
+    if (!existsSync23(migratedPath)) {
       renameSync4(path2, migratedPath);
       return;
     }
@@ -44105,15 +44936,15 @@ var init_sequence = __esm({
 
 // packages/core/src/store/git-checkpoint.ts
 import { execFile as execFile2 } from "node:child_process";
-import { existsSync as existsSync23 } from "node:fs";
-import { readFile as readFile3, writeFile } from "node:fs/promises";
-import { join as join22, resolve as resolve5 } from "node:path";
+import { existsSync as existsSync24 } from "node:fs";
+import { readFile as readFile4, writeFile } from "node:fs/promises";
+import { join as join24, resolve as resolve5 } from "node:path";
 import { promisify as promisify2 } from "node:util";
 function makeCleoGitEnv(cleoDir) {
   const abs = resolve5(cleoDir);
   return {
     ...process.env,
-    GIT_DIR: join22(abs, ".git"),
+    GIT_DIR: join24(abs, ".git"),
     GIT_WORK_TREE: abs
   };
 }
@@ -44131,7 +44962,7 @@ async function cleoGitCommand(args, cleoDir) {
   }
 }
 function isCleoGitInitialized(cleoDir) {
-  return existsSync23(join22(cleoDir, ".git", "HEAD"));
+  return existsSync24(join24(cleoDir, ".git", "HEAD"));
 }
 async function loadStateFileAllowlist(cwd) {
   try {
@@ -44175,26 +45006,26 @@ async function isCleoGitRepo(cleoDir) {
   return result.success && (result.stdout === "true" || isCleoGitInitialized(cleoDir));
 }
 function isMergeInProgress(cleoDir) {
-  return existsSync23(join22(cleoDir, ".git", "MERGE_HEAD"));
+  return existsSync24(join24(cleoDir, ".git", "MERGE_HEAD"));
 }
 async function isDetachedHead(cleoDir) {
   const result = await cleoGitCommand(["symbolic-ref", "HEAD"], cleoDir);
   return !result.success;
 }
 function isRebaseInProgress(cleoDir) {
-  return existsSync23(join22(cleoDir, ".git", "rebase-merge")) || existsSync23(join22(cleoDir, ".git", "rebase-apply"));
+  return existsSync24(join24(cleoDir, ".git", "rebase-merge")) || existsSync24(join24(cleoDir, ".git", "rebase-apply"));
 }
 async function recordCheckpointTime(cleoDir) {
   try {
-    const stateFile = join22(cleoDir, CHECKPOINT_STATE_FILE);
+    const stateFile = join24(cleoDir, CHECKPOINT_STATE_FILE);
     await writeFile(stateFile, String(Math.floor(Date.now() / 1e3)));
   } catch {
   }
 }
 async function getLastCheckpointTime(cleoDir) {
   try {
-    const stateFile = join22(cleoDir, CHECKPOINT_STATE_FILE);
-    const content = await readFile3(stateFile, "utf-8");
+    const stateFile = join24(cleoDir, CHECKPOINT_STATE_FILE);
+    const content = await readFile4(stateFile, "utf-8");
     const epoch = parseInt(content.trim(), 10);
     return Number.isNaN(epoch) ? 0 : epoch;
   } catch {
@@ -44205,8 +45036,8 @@ async function getChangedStateFiles(cleoDir, cwd) {
   const changed = [];
   const allStateFiles = await getAllStateFiles(cwd);
   for (const stateFile of allStateFiles) {
-    const fullPath = join22(cleoDir, stateFile);
-    if (!existsSync23(fullPath)) continue;
+    const fullPath = join24(cleoDir, stateFile);
+    if (!existsSync24(fullPath)) continue;
     const diffResult = await cleoGitCommand(["diff", "--quiet", "--", stateFile], cleoDir);
     const cachedResult = await cleoGitCommand(
       ["diff", "--cached", "--quiet", "--", stateFile],
@@ -44233,7 +45064,7 @@ async function shouldCheckpoint(options) {
   const config = await loadCheckpointConfig(cwd);
   if (!config.enabled) return false;
   const cleoDir = getCleoDir(cwd);
-  if (!existsSync23(cleoDir)) return false;
+  if (!existsSync24(cleoDir)) return false;
   if (!isCleoGitInitialized(cleoDir)) return false;
   if (!await isCleoGitRepo(cleoDir)) return false;
   if (isMergeInProgress(cleoDir)) return false;
@@ -44311,7 +45142,7 @@ async function ensureSequenceValid(cwd, options) {
   if (!options?.validateSequence) return;
   const check = await checkSequence(cwd);
   if (!check.valid) {
-    log9.warn({ counter: check.counter, maxId: check.maxIdInData }, "Sequence behind, repairing");
+    log10.warn({ counter: check.counter, maxId: check.maxIdInData }, "Sequence behind, repairing");
     const repair = await repairSequence(cwd);
     if (!repair.repaired && options.strict) {
       throw new DataSafetyError(`Sequence repair failed: ${repair.message}`, "SEQUENCE_INVALID", {
@@ -44328,7 +45159,7 @@ async function checkpoint(context, cwd, options) {
     stats.checkpoints++;
     stats.lastCheckpoint = /* @__PURE__ */ new Date();
   } catch (err) {
-    log9.warn({ err }, "Checkpoint failed (non-fatal)");
+    log10.warn({ err }, "Checkpoint failed (non-fatal)");
   }
   vacuumIntoBackup({ cwd }).catch(() => {
   });
@@ -44390,7 +45221,7 @@ async function safeAppendLog(accessor, entry, cwd, options) {
   stats.writes++;
   await checkpoint("log entry", cwd, opts);
 }
-var log9, DataSafetyError, DEFAULT_SAFETY, stats;
+var log10, DataSafetyError, DEFAULT_SAFETY, stats;
 var init_data_safety_central = __esm({
   "packages/core/src/store/data-safety-central.ts"() {
     "use strict";
@@ -44400,7 +45231,7 @@ var init_data_safety_central = __esm({
     init_sqlite3();
     init_sqlite_backup();
     init_tasks_schema();
-    log9 = getLogger("data-safety");
+    log10 = getLogger("data-safety");
     DataSafetyError = class extends Error {
       constructor(message, code, context) {
         super(message);
@@ -44440,7 +45271,7 @@ function isSafetyDisabled() {
 }
 function wrapWithSafety(accessor, cwd) {
   if (isSafetyDisabled()) {
-    log10.warn(
+    log11.warn(
       "Safety disabled - emergency mode (CLEO_DISABLE_SAFETY=true). Data integrity checks bypassed."
     );
     return accessor;
@@ -44461,13 +45292,13 @@ function getSafetyStatus() {
     enabled: true
   };
 }
-var log10, SafetyDataAccessor;
+var log11, SafetyDataAccessor;
 var init_safety_data_accessor = __esm({
   "packages/core/src/store/safety-data-accessor.ts"() {
     "use strict";
     init_logger2();
     init_data_safety_central();
-    log10 = getLogger("data-safety");
+    log11 = getLogger("data-safety");
     SafetyDataAccessor = class {
       /** The underlying accessor being wrapped. */
       inner;
@@ -44491,7 +45322,7 @@ var init_safety_data_accessor = __esm({
           ...config
         };
         if (this.config.verbose) {
-          log10.debug({ engine: inner.engine }, "SafetyDataAccessor initialized");
+          log11.debug({ engine: inner.engine }, "SafetyDataAccessor initialized");
         }
       }
       /** The storage engine backing this accessor. */
@@ -44503,7 +45334,7 @@ var init_safety_data_accessor = __esm({
        */
       logVerbose(message) {
         if (this.config.verbose) {
-          log10.debug(message);
+          log11.debug(message);
         }
       }
       /**