@cleocode/core 2026.6.19 → 2026.7.2

package/dist/llm/plugin-facade.js

@@ -12443,7 +12443,7 @@ var init_lafs = __esm({
 
 // packages/contracts/src/lease-ipc/messages.ts
 import { z as z11 } from "zod";
-var LeaseScopeSchema, LeaseLaneSchema, LeaseAcquireRequestSchema, LeaseReleaseRequestSchema, LeaseRenewRequestSchema, RateCheckRequestSchema, ToolGrantRequestSchema, QueuePriorityClassSchema, QueueAdmitRequestSchema, WorkerHeartbeatRequestSchema, LeaseIpcRequestSchema, LeaseGrantedResponseSchema, LeaseQueuedResponseSchema, LeaseDeniedResponseSchema, RateResultResponseSchema, ToolGrantedResponseSchema, LeaseRevokedResponseSchema, ChildKilledUnresponsiveResponseSchema, QueueAdmitDispositionSchema, QueueAdmitResultResponseSchema, HeartbeatAckResponseSchema, LeaseErrorResponseSchema, LeaseIpcResponseSchema, LeaseIpcRequestEnvelopeSchema, LeaseIpcResponseEnvelopeSchema, LeaseIpcEnvelopeSchema, LEASE_IPC_REQUEST_KINDS, LEASE_IPC_RESPONSE_KINDS, LEASE_IPC_MESSAGE_KINDS;
+var LeaseScopeSchema, LeaseLaneSchema, LeaseAcquireRequestSchema, LeaseReleaseRequestSchema, LeaseRenewRequestSchema, RateCheckRequestSchema, ToolGrantRequestSchema, QueuePriorityClassSchema, QueueAdmitRequestSchema, WorkerHeartbeatRequestSchema, ResourceAdmitRequestSchema, ResourceReleaseRequestSchema, LeaseIpcRequestSchema, LeaseGrantedResponseSchema, LeaseQueuedResponseSchema, LeaseDeniedResponseSchema, RateResultResponseSchema, ToolGrantedResponseSchema, LeaseRevokedResponseSchema, ChildKilledUnresponsiveResponseSchema, QueueAdmitDispositionSchema, QueueAdmitResultResponseSchema, HeartbeatAckResponseSchema, ResourceAdmitDispositionSchema, ResourceAdmitResultResponseSchema, ResourceReleaseResultResponseSchema, LeaseErrorResponseSchema, LeaseIpcResponseSchema, LeaseIpcRequestEnvelopeSchema, LeaseIpcResponseEnvelopeSchema, LeaseIpcEnvelopeSchema, LEASE_IPC_REQUEST_KINDS, LEASE_IPC_RESPONSE_KINDS, LEASE_IPC_MESSAGE_KINDS;
 var init_messages2 = __esm({
   "packages/contracts/src/lease-ipc/messages.ts"() {
     "use strict";
@@ -12528,6 +12528,24 @@ var init_messages2 = __esm({
       /** The worker's own view of whether it is currently inside an LLM call. */
       in_flight_llm: z11.boolean()
     }).strict();
+    ResourceAdmitRequestSchema = z11.object({
+      /** Tag discriminating this request variant. */
+      kind: z11.literal("resource_admit"),
+      /** The resource class (e.g. `"db-heavy"`, `"full-build"`, `"test-run"`). */
+      class: z11.string().min(1),
+      /** The caller holding the slot — process/worktree-unique; the release key. */
+      holder_id: z11.string().min(1),
+      /** The client-computed budget: the max concurrent holders for this class. */
+      budget: z11.number().int().nonnegative()
+    }).strict();
+    ResourceReleaseRequestSchema = z11.object({
+      /** Tag discriminating this request variant. */
+      kind: z11.literal("resource_release"),
+      /** The resource class the slot belongs to. */
+      class: z11.string().min(1),
+      /** The holder that was admitted (matches the admit `holder_id`). */
+      holder_id: z11.string().min(1)
+    }).strict();
     LeaseIpcRequestSchema = z11.discriminatedUnion("kind", [
       LeaseAcquireRequestSchema,
       LeaseReleaseRequestSchema,
@@ -12535,7 +12553,9 @@ var init_messages2 = __esm({
       RateCheckRequestSchema,
       ToolGrantRequestSchema,
       QueueAdmitRequestSchema,
-      WorkerHeartbeatRequestSchema
+      WorkerHeartbeatRequestSchema,
+      ResourceAdmitRequestSchema,
+      ResourceReleaseRequestSchema
     ]);
     LeaseGrantedResponseSchema = z11.object({
       /** Tag discriminating this response variant. */
@@ -12636,6 +12656,25 @@ var init_messages2 = __esm({
       /** Tag discriminating this response variant. */
       kind: z11.literal("heartbeat_ack")
     }).strict();
+    ResourceAdmitDispositionSchema = z11.enum(["admitted", "deferred"]);
+    ResourceAdmitResultResponseSchema = z11.object({
+      /** Tag discriminating this response variant. */
+      kind: z11.literal("resource_admit_result"),
+      /** Whether the heavy op was admitted or deferred. */
+      disposition: ResourceAdmitDispositionSchema,
+      /** Back-off in ms before re-requesting (0 when admitted). */
+      retry_after_ms: z11.number().int().nonnegative(),
+      /** Remaining slots for the class after this decision. */
+      slots_remaining: z11.number().int().nonnegative()
+    }).strict();
+    ResourceReleaseResultResponseSchema = z11.object({
+      /** Tag discriminating this response variant. */
+      kind: z11.literal("resource_release_result"),
+      /** Whether a held slot was actually released (false = no such holder). */
+      released: z11.boolean(),
+      /** Remaining in-flight holders for the class after the release. */
+      slots_remaining: z11.number().int().nonnegative()
+    }).strict();
     LeaseErrorResponseSchema = z11.object({
       /** Tag discriminating this response variant. */
       kind: z11.literal("error"),
@@ -12654,6 +12693,8 @@ var init_messages2 = __esm({
       ChildKilledUnresponsiveResponseSchema,
       QueueAdmitResultResponseSchema,
       HeartbeatAckResponseSchema,
+      ResourceAdmitResultResponseSchema,
+      ResourceReleaseResultResponseSchema,
       LeaseErrorResponseSchema
     ]);
     LeaseIpcRequestEnvelopeSchema = z11.object({
@@ -12687,7 +12728,9 @@ var init_messages2 = __esm({
       "rate_check",
       "tool_grant",
       "queue_admit",
-      "worker_heartbeat"
+      "worker_heartbeat",
+      "resource_admit",
+      "resource_release"
     ];
     LEASE_IPC_RESPONSE_KINDS = [
       "lease_granted",
@@ -12699,6 +12742,8 @@ var init_messages2 = __esm({
       "child_killed_unresponsive",
       "queue_admit_result",
       "heartbeat_ack",
+      "resource_admit_result",
+      "resource_release_result",
       "error"
     ];
     LEASE_IPC_MESSAGE_KINDS = [
@@ -12709,9 +12754,11 @@ var init_messages2 = __esm({
 });
 
 // packages/contracts/src/lease-ipc/version.ts
+var LEASE_IPC_PROTOCOL_VERSION;
 var init_version2 = __esm({
   "packages/contracts/src/lease-ipc/version.ts"() {
     "use strict";
+    LEASE_IPC_PROTOCOL_VERSION = "1.2.0";
   }
 });
 
@@ -13971,6 +14018,25 @@ var init_render = __esm({
   }
 });
 
+// packages/contracts/src/resource-governor.ts
+var RESOURCE_CLASSES, DEFAULT_RESOURCE_RETRY_AFTER_MS;
+var init_resource_governor = __esm({
+  "packages/contracts/src/resource-governor.ts"() {
+    "use strict";
+    RESOURCE_CLASSES = Object.freeze([
+      "interactive-cli",
+      "agent-session",
+      "llm-call",
+      "test-run",
+      "scoped-build",
+      "full-build",
+      "db-heavy",
+      "background-autonomous"
+    ]);
+    DEFAULT_RESOURCE_RETRY_AFTER_MS = 2e3;
+  }
+});
+
 // packages/contracts/src/session.ts
 var init_session2 = __esm({
   "packages/contracts/src/session.ts"() {
@@ -15721,6 +15787,7 @@ var init_src = __esm({
     init_evidence_atoms();
     init_plan();
     init_render();
+    init_resource_governor();
     init_session2();
     init_session_journal();
     init_status_registry();
@@ -17656,7 +17723,7 @@ var init_sql = __esm({
         return new SQL([new StringChunk(str)]);
       }
       _sql.raw = raw;
-      function join29(chunks, separator) {
+      function join31(chunks, separator) {
         const result = [];
         for (const [i, chunk] of chunks.entries()) {
           if (i > 0 && separator !== void 0) result.push(separator);
@@ -17664,7 +17731,7 @@ var init_sql = __esm({
         }
         return new SQL(result);
       }
-      _sql.join = join29;
+      _sql.join = join31;
       function identifier(value) {
         return new Name(value);
       }
@@ -20051,7 +20118,7 @@ var init_select2 = __esm({
           const baseTableName = this.tableName;
           const tableName = getTableLikeName(table);
           for (const item of extractUsedTable(table)) this.usedTables.add(item);
-          if (typeof tableName === "string" && this.config.joins?.some((join29) => join29.alias === tableName)) throw new Error(`Alias "${tableName}" is already used in this query`);
+          if (typeof tableName === "string" && this.config.joins?.some((join31) => join31.alias === tableName)) throw new Error(`Alias "${tableName}" is already used in this query`);
           if (!this.isPartialSelect) {
             if (Object.keys(this.joinsNotNullableMap).length === 1 && typeof baseTableName === "string") this.config.fields = { [baseTableName]: this.config.fields };
             if (typeof tableName === "string" && !is(table, SQL)) {
@@ -23861,7 +23928,7 @@ var init_dialect = __esm({
           if (!joins2) return;
           const withEntries = Object.entries(joins2).filter(([_, v]) => v);
           if (!withEntries.length) return;
-          return sql.join(withEntries.map(([k, join29]) => {
+          return sql.join(withEntries.map(([k, join31]) => {
             const relation = tableConfig.relations[k];
             const isSingle2 = is(relation, One);
             const targetTable = aliasedTable(relation.targetTable, `d${currentDepth + 1}`);
@@ -23872,7 +23939,7 @@ var init_dialect = __esm({
               table: targetTable,
               mode: isSingle2 ? "first" : "many",
               schema,
-              queryConfig: join29,
+              queryConfig: join31,
               tableConfig: schema[relation.targetTableName],
               relationWhere: filter2,
               isNested: true,
@@ -23886,7 +23953,7 @@ var init_dialect = __esm({
               key: k,
               selection: innerQuery.selection,
               isArray: !isSingle2,
-              isOptional: (relation.optional ?? false) || join29 !== true && !!join29.where
+              isOptional: (relation.optional ?? false) || join31 !== true && !!join31.where
             });
             const jsonColumns = sql.join(innerQuery.selection.map((s) => {
               return sql`${sql.raw(this.escapeString(s.key))}, ${s.selection ? sql`${jsonb3}(${sql.identifier(s.key)})` : sql.identifier(s.key)}`;
@@ -24707,7 +24774,7 @@ var init_update = __esm({
       createJoin(joinType) {
         return ((table, on) => {
           const tableName = getTableLikeName(table);
-          if (typeof tableName === "string" && this.config.joins.some((join29) => join29.alias === tableName)) throw new Error(`Alias "${tableName}" is already used in this query`);
+          if (typeof tableName === "string" && this.config.joins.some((join31) => join31.alias === tableName)) throw new Error(`Alias "${tableName}" is already used in this query`);
           if (typeof on === "function") {
             const from = this.config.from ? is(table, SQLiteTable) ? table[Table.Symbol.Columns] : is(table, Subquery) ? table._.selectedFields : is(table, SQLiteViewBase) ? table[ViewBaseConfig].selectedFields : void 0 : void 0;
             on = on(new Proxy(this.config.table[Table.Symbol.Columns], new SelectionProxyHandler({
@@ -25805,8 +25872,8 @@ function probeAndMarkApplied(nativeDb, migration, logSubsystem, eliminatedTables
   });
   if (allAltersPresent && allTablesPresent && allIndexesPresent && allTriggersPresent) {
     insertJournalEntry(nativeDb, migration.hash, migration.folderMillis, migration.name ?? "");
-    const log8 = getLogger(logSubsystem);
-    log8.debug(
+    const log9 = getLogger(logSubsystem);
+    log9.debug(
       {
         migration: migration.name,
         alters: alterTargets.length,
@@ -25875,14 +25942,14 @@ function reconcileJournal(nativeDb, migrationsFolder, existenceTable2, logSubsys
     if (hasOrphanedEntries) {
       const dbHashes = new Set(dbEntries.map((e) => e.hash));
       const allLocalHashesPresentInDb = localMigrations.every((m) => dbHashes.has(m.hash));
-      const log8 = getLogger(logSubsystem);
+      const log9 = getLogger(logSubsystem);
       if (allLocalHashesPresentInDb) {
-        log8.debug(
+        log9.debug(
           { extra: orphanedEntries.length },
           `Migration journal has ${orphanedEntries.length} entries for migrations not known to this install (DB is ahead). Skipping reconciliation.`
         );
       } else {
-        log8.warn(
+        log9.warn(
           { orphaned: orphanedEntries.length },
           `Detected ${orphanedEntries.length} true-orphan journal entries from a previous CLEO lineage. Reconciling via DDL probe.`
         );
@@ -25918,8 +25985,8 @@ function reconcileJournal(nativeDb, migrationsFolder, existenceTable2, logSubsys
       if (alterMatches.length === 0) {
         const stripped = stripSqlComments(fullSql).trim();
         if (stripped === "") {
-          const log8 = getLogger(logSubsystem);
-          log8.debug(
+          const log9 = getLogger(logSubsystem);
+          log9.debug(
             { migration: migration.name },
             `Migration ${migration.name} is a comment-only baseline marker \u2014 marking applied on existing DB.`
           );
@@ -25958,8 +26025,8 @@ function reconcileJournal(nativeDb, migrationsFolder, existenceTable2, logSubsys
         }
       }
       if (missingColumns.length === 0) {
-        const log8 = getLogger(logSubsystem);
-        log8.warn(
+        const log9 = getLogger(logSubsystem);
+        log9.warn(
           { migration: migration.name, columns: alterMatches },
           `Detected partially-applied migration ${migration.name} \u2014 columns exist but journal entry missing. Auto-reconciling.`
         );
@@ -25967,8 +26034,8 @@ function reconcileJournal(nativeDb, migrationsFolder, existenceTable2, logSubsys
         continue;
       }
       if (existingColumns.length > 0 && missingColumns.length > 0) {
-        const log8 = getLogger(logSubsystem);
-        log8.warn(
+        const log9 = getLogger(logSubsystem);
+        log9.warn(
           {
             migration: migration.name,
             existingColumns: existingColumns.map((c) => `${c.table}.${c.column}`),
@@ -25980,12 +26047,12 @@ function reconcileJournal(nativeDb, migrationsFolder, existenceTable2, logSubsys
           if (!tableExists(nativeDb, table)) continue;
           try {
             nativeDb.exec(`ALTER TABLE ${table} ADD COLUMN ${column}${ddl ? ` ${ddl}` : ""}`);
-            log8.warn(
+            log9.warn(
               { migration: migration.name, table, column },
               `T920: Added missing column ${table}.${column} to complete partial migration.`
             );
           } catch {
-            log8.warn(
+            log9.warn(
               { migration: migration.name, table, column },
               `T920: Could not add missing column ${table}.${column} \u2014 will let Drizzle migrate() handle it.`
             );
@@ -26005,8 +26072,8 @@ function reconcileJournal(nativeDb, migrationsFolder, existenceTable2, logSubsys
     for (const entry of unnamedEntries) {
       const migrationName = hashToName.get(entry.hash);
       if (!migrationName) continue;
-      const log8 = getLogger(logSubsystem);
-      log8.debug(
+      const log9 = getLogger(logSubsystem);
+      log9.debug(
         { id: entry.id, hash: entry.hash, name: migrationName },
         `Backfilling missing name on journal entry id=${entry.id} (Drizzle v1 beta legacy compat).`
       );
@@ -26090,13 +26157,13 @@ function ensureColumns(nativeDb, tableName, requiredColumns, logSubsystem, conte
   const existingCols = new Set(columns.map((c) => c.name));
   for (const req of requiredColumns) {
     if (!existingCols.has(req.name)) {
-      const log8 = getLogger(logSubsystem);
+      const log9 = getLogger(logSubsystem);
       const message = `Adding missing column ${tableName}.${req.name} via ALTER TABLE`;
       const fields = { column: req.name, context };
       if (context === "fresh") {
-        log8.error(fields, `${message} \u2014 MIGRATION DEFECT (fresh DB should not need repair)`);
+        log9.error(fields, `${message} \u2014 MIGRATION DEFECT (fresh DB should not need repair)`);
       } else {
-        log8.warn(fields, message);
+        log9.warn(fields, message);
       }
       nativeDb.exec(`ALTER TABLE ${tableName} ADD COLUMN ${req.name} ${req.ddl}`);
     }
@@ -35177,11 +35244,750 @@ var init_cleo_global = __esm({
   }
 });
 
-// packages/core/src/store/lock.ts
+// packages/core/src/resources/linux-backend.ts
+import { readFile as readFile2, stat } from "node:fs/promises";
+function parsePressureLine(line2) {
+  const avg10Match = /avg10=([\d.]+)/.exec(line2);
+  const avg60Match = /avg60=([\d.]+)/.exec(line2);
+  const avg300Match = /avg300=([\d.]+)/.exec(line2);
+  const totalMatch = /total=(\d+)/.exec(line2);
+  if (!avg10Match?.[1] || !avg60Match?.[1] || !avg300Match?.[1] || !totalMatch?.[1]) {
+    return null;
+  }
+  return {
+    avg10: parseFloat(avg10Match[1]),
+    avg60: parseFloat(avg60Match[1]),
+    avg300: parseFloat(avg300Match[1]),
+    totalUs: parseInt(totalMatch[1], 10)
+  };
+}
+function parsePsiFile(content) {
+  const lines = content.split("\n").map((l) => l.trim()).filter(Boolean);
+  let some = null;
+  let full = null;
+  for (const line2 of lines) {
+    if (line2.startsWith("some ")) {
+      some = parsePressureLine(line2);
+    } else if (line2.startsWith("full ")) {
+      full = parsePressureLine(line2);
+    }
+  }
+  if (!some) {
+    return null;
+  }
+  return { some, full };
+}
+function parseMemAvailable(content) {
+  for (const line2 of content.split("\n")) {
+    if (line2.startsWith("MemAvailable:")) {
+      const match = /MemAvailable:\s+(\d+)\s+kB/.exec(line2);
+      if (match?.[1]) {
+        return parseInt(match[1], 10) * 1024;
+      }
+    }
+  }
+  return null;
+}
+function parseSmapsRollup(content) {
+  let rssKb = null;
+  let pssKb = null;
+  for (const line2 of content.split("\n")) {
+    if (line2.startsWith("Rss:")) {
+      const m = /Rss:\s+(\d+)\s+kB/.exec(line2);
+      if (m?.[1]) rssKb = parseInt(m[1], 10);
+    } else if (line2.startsWith("Pss:")) {
+      const m = /Pss:\s+(\d+)\s+kB/.exec(line2);
+      if (m?.[1]) pssKb = parseInt(m[1], 10);
+    }
+  }
+  if (rssKb === null || pssKb === null) return null;
+  return { rssBytes: rssKb * 1024, pssBytes: pssKb * 1024 };
+}
+var defaultReadFile, defaultStat, LinuxResourceBackend;
+var init_linux_backend = __esm({
+  "packages/core/src/resources/linux-backend.ts"() {
+    "use strict";
+    defaultReadFile = (path, encoding) => readFile2(path, encoding);
+    defaultStat = async (path) => {
+      try {
+        const s = await stat(path);
+        return { size: s.size };
+      } catch {
+        return null;
+      }
+    };
+    LinuxResourceBackend = class {
+      globalPressurePath;
+      cgroupSlicePressurePath;
+      walPaths;
+      readFileFn;
+      statFileFn;
+      constructor(opts = {}) {
+        this.globalPressurePath = opts.globalPressurePath ?? "/proc/pressure/memory";
+        this.cgroupSlicePressurePath = opts.cgroupSlicePressurePath ?? null;
+        this.walPaths = opts.walPaths ?? [];
+        this.readFileFn = opts.readFileFn ?? defaultReadFile;
+        this.statFileFn = opts.statFileFn ?? defaultStat;
+      }
+      /**
+       * Take a bounded point-in-time resource sample.
+       *
+       * Read-count (bounded by Amendment 1):
+       *   - 1 read: `/proc/pressure/memory`
+       *   - 0–1 reads: slice `memory.pressure` (if configured)
+       *   - 1 read: `/proc/meminfo`
+       *   - N stat calls: one per WAL path in `walPaths`
+       *
+       * Never spawns a child process.
+       */
+      async sample() {
+        const sampledAtMs = Date.now();
+        const globalPressure = await this._readPsi(this.globalPressurePath);
+        const pressureAvailable = globalPressure !== null;
+        let slicePressure = null;
+        if (this.cgroupSlicePressurePath) {
+          slicePressure = await this._readPsi(this.cgroupSlicePressurePath);
+        }
+        const memAvailableBytes = await this._readMemAvailable();
+        const walObservations = await this._readWalObservations();
+        return {
+          sampledAtMs,
+          pressureAvailable,
+          memAvailableBytes,
+          globalPressure,
+          slicePressure,
+          walObservations
+        };
+      }
+      /**
+       * Sweep per-child RSS via `/proc/<pid>/smaps_rollup`.
+       *
+       * **STRUCTURALLY SEPARATED from sample()** — smaps_rollup reads are
+       * ms-scale per multi-GB process and must never appear in the hot path.
+       * Call on a separate low-frequency cadence (e.g. every 60s or on
+       * backoff→hold state transition).
+       *
+       * @param pids - PIDs to sweep. Dead/unknown PIDs are silently skipped.
+       */
+      async sweepChildRss(pids) {
+        const sampledAtMs = Date.now();
+        const entries = [];
+        for (const pid of pids) {
+          try {
+            const content = await this.readFileFn(`/proc/${pid}/smaps_rollup`, "utf-8");
+            const parsed = parseSmapsRollup(content);
+            if (parsed) {
+              entries.push({ pid, ...parsed });
+            }
+          } catch {
+          }
+        }
+        return { sampledAtMs, entries };
+      }
+      // -------------------------------------------------------------------------
+      // Private helpers
+      // -------------------------------------------------------------------------
+      async _readPsi(path) {
+        try {
+          const content = await this.readFileFn(path, "utf-8");
+          return parsePsiFile(content);
+        } catch {
+          return null;
+        }
+      }
+      async _readMemAvailable() {
+        try {
+          const content = await this.readFileFn("/proc/meminfo", "utf-8");
+          return parseMemAvailable(content);
+        } catch {
+          return null;
+        }
+      }
+      async _readWalObservations() {
+        const results = [];
+        for (const walPath of this.walPaths) {
+          const info = await this.statFileFn(walPath);
+          results.push({ walPath, sizeBytes: info?.size ?? null });
+        }
+        return results;
+      }
+    };
+  }
+});
+
+// packages/core/src/resources/monitor.ts
+import { EventEmitter as EventEmitter2 } from "node:events";
+function resolveThresholds(cfg) {
+  return {
+    holdSomeAvg10: cfg.psi?.holdSomeAvg10 ?? DEFAULTS.holdSomeAvg10,
+    backoffSomeAvg10: cfg.psi?.backoffSomeAvg10 ?? DEFAULTS.backoffSomeAvg10,
+    holdFullAvg10: cfg.psi?.holdFullAvg10 ?? DEFAULTS.holdFullAvg10,
+    backoffFullAvg10: cfg.psi?.backoffFullAvg10 ?? DEFAULTS.backoffFullAvg10,
+    hysteresisPoints: cfg.hysteresisPoints ?? DEFAULTS.hysteresisPoints,
+    headroomBytes: cfg.headroomBytes ?? DEFAULTS.headroomBytes,
+    walWarnThresholdBytes: cfg.walWarnThresholdBytes ?? DEFAULTS.walWarnThresholdBytes,
+    pollIntervalMs: cfg.pollIntervalMs ?? DEFAULTS.pollIntervalMs
+  };
+}
+function evaluateState(sample, thresholds, currentState) {
+  if (!sample.pressureAvailable) {
+    if (sample.memAvailableBytes !== null && sample.memAvailableBytes < thresholds.headroomBytes) {
+      return { state: "hold", reason: "degraded: memAvailable below headroom" };
+    }
+    return { state: "ok", reason: "degraded: PSI unavailable, memAvailable sufficient" };
+  }
+  const somePressure = sample.globalPressure?.some ?? sample.slicePressure?.some;
+  const fullPressure = sample.globalPressure?.full ?? sample.slicePressure?.full;
+  const someAvg102 = somePressure?.avg10 ?? 0;
+  const fullAvg10 = fullPressure?.avg10 ?? 0;
+  if (someAvg102 > thresholds.backoffSomeAvg10 || fullAvg10 > thresholds.backoffFullAvg10) {
+    return {
+      state: "backoff",
+      reason: `some avg10=${someAvg102.toFixed(2)} full avg10=${fullAvg10.toFixed(2)} \u2014 above backoff threshold`
+    };
+  }
+  if (someAvg102 > thresholds.holdSomeAvg10 || fullAvg10 > thresholds.holdFullAvg10) {
+    return {
+      state: "hold",
+      reason: `some avg10=${someAvg102.toFixed(2)} full avg10=${fullAvg10.toFixed(2)} \u2014 above hold threshold`
+    };
+  }
+  if (currentState !== "ok") {
+    const hysteresisFloor = thresholds.holdSomeAvg10 - thresholds.hysteresisPoints;
+    const fullHysteresisFloor = thresholds.holdFullAvg10 - thresholds.hysteresisPoints;
+    if (someAvg102 > hysteresisFloor || fullAvg10 > fullHysteresisFloor) {
+      const clamped = currentState === "backoff" ? "hold" : currentState;
+      return {
+        state: clamped,
+        reason: `some avg10=${someAvg102.toFixed(2)} full avg10=${fullAvg10.toFixed(2)} \u2014 hysteresis hold (floor: some ${hysteresisFloor}, full ${fullHysteresisFloor})`
+      };
+    }
+  }
+  return {
+    state: "ok",
+    reason: `some avg10=${someAvg102.toFixed(2)} full avg10=${fullAvg10.toFixed(2)} \u2014 below thresholds`
+  };
+}
+var DEFAULTS, ResourceMonitor;
+var init_monitor = __esm({
+  "packages/core/src/resources/monitor.ts"() {
+    "use strict";
+    init_linux_backend();
+    DEFAULTS = {
+      holdSomeAvg10: 10,
+      backoffSomeAvg10: 20,
+      holdFullAvg10: 5,
+      backoffFullAvg10: 10,
+      hysteresisPoints: 3,
+      headroomBytes: 256 * 1024 * 1024,
+      walWarnThresholdBytes: 256 * 1024 * 1024,
+      pollIntervalMs: 1500
+    };
+    ResourceMonitor = class extends EventEmitter2 {
+      thresholds;
+      backend;
+      _state = "ok";
+      _timer = null;
+      _running = false;
+      constructor(cfg = {}) {
+        super();
+        this.thresholds = resolveThresholds(cfg);
+        this.backend = cfg.backend ?? new LinuxResourceBackend();
+      }
+      // -------------------------------------------------------------------------
+      // Public API
+      // -------------------------------------------------------------------------
+      /**
+       * Current pressure state (only meaningful after at least one sample).
+       */
+      get state() {
+        return this._state;
+      }
+      /**
+       * `true` while the continuous loop is running.
+       */
+      get running() {
+        return this._running;
+      }
+      /**
+       * Take a single point-in-time resource sample.
+       *
+       * Safe to call with the daemon off (no child processes, bounded reads).
+       * Does NOT update `this.state` — use {@link startContinuous} for that.
+       */
+      async sample() {
+        return this.backend.sample();
+      }
+      /**
+       * Start the continuous polling loop.
+       *
+       * Returns a `stop()` function. Calling `stop()` is idempotent.
+       *
+       * Emits:
+       *   - `'sample'` on every poll (even if state did not change)
+       *   - `'transition'` when `PressureState` changes
+       *   - `'error'` if the backend throws (loop continues regardless)
+       */
+      startContinuous() {
+        if (this._running) {
+          return () => this._stopLoop();
+        }
+        this._running = true;
+        this._scheduleNext();
+        return () => this._stopLoop();
+      }
+      /**
+       * Stop the continuous polling loop. Idempotent.
+       */
+      stop() {
+        this._stopLoop();
+      }
+      // -------------------------------------------------------------------------
+      // Private loop machinery
+      // -------------------------------------------------------------------------
+      _scheduleNext() {
+        this._timer = setTimeout(() => {
+          void this._tick();
+        }, this.thresholds.pollIntervalMs);
+        if (typeof this._timer.unref === "function") {
+          this._timer.unref();
+        }
+      }
+      async _tick() {
+        if (!this._running) return;
+        try {
+          const sample = await this.backend.sample();
+          this.emit("sample", sample);
+          const { state: newState, reason } = evaluateState(sample, this.thresholds, this._state);
+          if (newState !== this._state) {
+            const transition = {
+              from: this._state,
+              to: newState,
+              sample,
+              reason
+            };
+            this._state = newState;
+            this.emit("transition", transition);
+          }
+        } catch (err) {
+          this.emit("error", err instanceof Error ? err : new Error(String(err)));
+        }
+        if (this._running) {
+          this._scheduleNext();
+        }
+      }
+      _stopLoop() {
+        this._running = false;
+        if (this._timer !== null) {
+          clearTimeout(this._timer);
+          this._timer = null;
+        }
+      }
+    };
+  }
+});
+
+// packages/core/src/resources/supervisor-admit.ts
+import { connect } from "node:net";
+import { join as join5 } from "node:path";
+import { getCleoHome as getCleoHome2 } from "@cleocode/paths";
+function resolveSupervisorSocketPath() {
+  return process.env.CLEO_SUPERVISOR_SOCKET ?? join5(getCleoHome2(), SUPERVISOR_SOCKET_NAME);
+}
+async function sendResourceAdmit(socketPath, cls, holderId, budget) {
+  const result = await sendLeaseRequest(
+    socketPath,
+    { kind: "resource_admit", class: cls, holder_id: holderId, budget },
+    "resource_admit_result"
+  );
+  if ("unavailable" in result) return result;
+  if (result.kind === "resource_admit_result") return result;
+  return { unavailable: true, reason: `unexpected response kind: ${result.kind}` };
+}
+async function sendResourceRelease(socketPath, cls, holderId) {
+  const result = await sendLeaseRequest(
+    socketPath,
+    { kind: "resource_release", class: cls, holder_id: holderId },
+    "resource_release_result"
+  );
+  if ("unavailable" in result) return result;
+  if (result.kind === "resource_release_result") return result;
+  return { unavailable: true, reason: `unexpected response kind: ${result.kind}` };
+}
+function sendLeaseRequest(socketPath, request, expectedKind) {
+  return new Promise((resolve5) => {
+    const id = `ra-${process.pid}-${request.kind}`;
+    const envelope = LeaseIpcRequestEnvelopeSchema.parse({
+      protocol_version: LEASE_IPC_PROTOCOL_VERSION,
+      id,
+      direction: "request",
+      request
+    });
+    const line2 = `${JSON.stringify(envelope)}
+`;
+    let settled = false;
+    let buffer = "";
+    const socket = connect(socketPath);
+    const done = (value) => {
+      if (settled) return;
+      settled = true;
+      socket.removeAllListeners();
+      socket.destroy();
+      resolve5(value);
+    };
+    const degrade = (reason) => done({ unavailable: true, reason });
+    socket.setTimeout(REQUEST_TIMEOUT_MS);
+    const connectTimer = setTimeout(
+      () => degrade("supervisor connect timeout"),
+      CONNECT_TIMEOUT_MS
+    );
+    socket.on("connect", () => {
+      clearTimeout(connectTimer);
+      socket.write(line2);
+    });
+    socket.on("timeout", () => degrade("supervisor request timeout"));
+    socket.on("error", (err) => {
+      clearTimeout(connectTimer);
+      degrade(err.message);
+    });
+    socket.on("close", () => {
+      if (!settled) degrade("supervisor closed the connection before responding");
+    });
+    socket.on("data", (chunk) => {
+      buffer += chunk.toString("utf8");
+      const nl = buffer.indexOf("\n");
+      if (nl < 0) return;
+      let json3;
+      try {
+        json3 = JSON.parse(buffer.slice(0, nl));
+      } catch (cause) {
+        degrade(`malformed lease-ipc frame: ${cause instanceof Error ? cause.message : cause}`);
+        return;
+      }
+      const parsed = LeaseIpcResponseEnvelopeSchema.safeParse(json3);
+      if (!parsed.success) {
+        degrade(`off-contract lease-ipc response: ${parsed.error.message}`);
+        return;
+      }
+      const { response } = parsed.data;
+      if (response.kind === expectedKind) {
+        done(response);
+        return;
+      }
+      if (response.kind === "error") {
+        degrade(`${response.code}: ${response.message}`);
+        return;
+      }
+      degrade(`unexpected lease-ipc response kind for ${request.kind}: ${response.kind}`);
+    });
+  });
+}
+var SUPERVISOR_SOCKET_NAME, CONNECT_TIMEOUT_MS, REQUEST_TIMEOUT_MS;
+var init_supervisor_admit = __esm({
+  "packages/core/src/resources/supervisor-admit.ts"() {
+    "use strict";
+    init_src();
+    SUPERVISOR_SOCKET_NAME = "cleo-supervisor.sock";
+    CONNECT_TIMEOUT_MS = 250;
+    REQUEST_TIMEOUT_MS = 2e3;
+  }
+});
+
+// packages/core/src/resources/governor.ts
+var governor_exports = {};
+__export(governor_exports, {
+  ResourceGovernor: () => ResourceGovernor,
+  _resetGovernorStateForTest: () => _resetGovernorStateForTest,
+  computeClassBudget: () => computeClassBudget,
+  governor: () => governor,
+  governorSlotDir: () => governorSlotDir,
+  resolveGovernorMode: () => resolveGovernorMode,
+  slotFileCount: () => slotFileCount
+});
+import { existsSync as existsSync3, mkdirSync, readdirSync as readdirSync2, writeFileSync } from "node:fs";
+import { availableParallelism, totalmem } from "node:os";
+import { join as join6 } from "node:path";
 import lockfile from "proper-lockfile";
+function log2() {
+  if (_log2 === null) _log2 = getLogger("resource-governor");
+  return _log2;
+}
+function resolveGovernorMode() {
+  if (_cachedMode2 !== null) return _cachedMode2;
+  const raw = process.env.CLEO_RESOURCES_MODE;
+  _cachedMode2 = raw === "supervisor" || raw === "local" || raw === "off" ? raw : "local";
+  return _cachedMode2;
+}
+function logSupervisorDegradeOnce(reason) {
+  if (_supervisorDegradeLogged) return;
+  _supervisorDegradeLogged = true;
+  log2().info(
+    `CLEO_RESOURCES_MODE=supervisor but the arbiter is unreachable (${reason}); degrading to local-mode admission for the process lifetime.`
+  );
+}
+function _resetGovernorStateForTest() {
+  _cachedMode2 = null;
+  _supervisorDegradeLogged = false;
+}
+function someAvg10(sample) {
+  const some = sample.globalPressure?.some ?? sample.slicePressure?.some;
+  return some?.avg10 ?? 0;
+}
+function computeClassBudget(cls, sample, opts = {}) {
+  if (cls === "interactive-cli") return Number.POSITIVE_INFINITY;
+  const cpus = Math.max(1, opts.cpuCount ?? availableParallelism());
+  const totalBytes = opts.totalMemBytes ?? totalmem();
+  const headroomBytes = (opts.headroomMb ?? 2048) * MB;
+  const hold = opts.holdSomeAvg10 ?? 10;
+  const floor = opts.floorSomeAvg10 ?? 25;
+  const some = someAvg10(sample);
+  const availBytes = sample.memAvailableBytes ?? totalBytes;
+  const fullStall = sample.globalPressure?.full?.avg10 ?? sample.slicePressure?.full?.avg10 ?? 0;
+  const backoff = some > floor || fullStall > 10;
+  switch (cls) {
+    case "full-build":
+      return 1;
+    case "agent-session": {
+      const estRamBytes = (opts.agentEstRamMb ?? 4096) * MB;
+      const byMem = Math.floor((availBytes - headroomBytes) / estRamBytes);
+      return clamp(1, byMem, Math.max(1, cpus - 2));
+    }
+    case "llm-call":
+      return Math.max(1, cpus - 2);
+    case "test-run":
+    case "scoped-build": {
+      const base = Math.max(1, Math.floor(cpus / 4));
+      if (some > floor) return 1;
+      if (some > hold) return Math.max(1, Math.floor(base / 2));
+      return base;
+    }
+    case "db-heavy":
+      return backoff ? 0 : 1;
+    case "background-autonomous":
+      return some > hold || fullStall > 5 ? 0 : 1;
+    default:
+      return 1;
+  }
+}
+function clamp(lo, v, hi) {
+  return Math.max(lo, Math.min(v, hi));
+}
+function governorSlotDir(cls) {
+  return join6(getCleoHome(), "locks", `resource-${cls}`);
+}
+function ensureSlotFiles(dir, count) {
+  if (!existsSync3(dir)) mkdirSync(dir, { recursive: true });
+  const paths = [];
+  for (let i = 0; i < count; i++) {
+    const p = join6(dir, `slot-${i}.lock`);
+    if (!existsSync3(p)) writeFileSync(p, "", { flag: "a" });
+    paths.push(p);
+  }
+  return paths;
+}
+function sleep(ms) {
+  return new Promise((r) => setTimeout(r, ms));
+}
+function passThroughGrant(cls) {
+  return {
+    deferred: false,
+    class: cls,
+    slot: -1,
+    acquiredAtMs: Date.now(),
+    release: async () => {
+    }
+  };
+}
+function deferral(cls, reason, retryAfterMs) {
+  return { deferred: true, class: cls, retryAfterMs, reason };
+}
+function supervisorHolderId(cls) {
+  _supervisorHolderSeq += 1;
+  return `${process.pid}:${cls}:${_supervisorHolderSeq}`;
+}
+function shuffledIndices(n) {
+  const order = Array.from({ length: n }, (_, i) => i);
+  for (let i = order.length - 1; i > 0; i--) {
+    const j = Math.floor(Math.random() * (i + 1));
+    const a = order[i];
+    const b = order[j];
+    if (a !== void 0 && b !== void 0) {
+      order[i] = b;
+      order[j] = a;
+    }
+  }
+  return order;
+}
+async function countHeldSlots(cls, budget) {
+  const dir = governorSlotDir(cls);
+  if (!existsSync3(dir)) return 0;
+  const slots = ensureSlotFiles(dir, budget);
+  let held = 0;
+  for (const path of slots) {
+    try {
+      const release = await lockfile.lock(path, { retries: 0, stale: STALE_MS, realpath: false });
+      await release();
+    } catch {
+      held++;
+    }
+  }
+  return held;
+}
+function slotFileCount(cls) {
+  const dir = governorSlotDir(cls);
+  if (!existsSync3(dir)) return 0;
+  return readdirSync2(dir).filter((f) => f.startsWith("slot-") && f.endsWith(".lock")).length;
+}
+var _log2, _cachedMode2, _supervisorDegradeLogged, MB, STALE_MS, _supervisorHolderSeq, ResourceGovernor, governor;
+var init_governor = __esm({
+  "packages/core/src/resources/governor.ts"() {
+    "use strict";
+    init_src();
+    init_logger2();
+    init_paths();
+    init_monitor();
+    init_supervisor_admit();
+    _log2 = null;
+    _cachedMode2 = null;
+    _supervisorDegradeLogged = false;
+    MB = 1024 * 1024;
+    STALE_MS = 6e5;
+    _supervisorHolderSeq = 0;
+    ResourceGovernor = class {
+      /**
+       * Acquire one slot of `cls`. Returns a {@link ResourceGrant} on success or a
+       * {@link ResourceDeferral} on denial. Never throws for admission control;
+       * only genuinely unexpected I/O errors propagate.
+       */
+      async acquire(cls, opts = {}) {
+        const mode = resolveGovernorMode();
+        if (mode === "off" || cls === "interactive-cli") {
+          return passThroughGrant(cls);
+        }
+        const sample = opts.sample ?? await (opts.monitor ?? new ResourceMonitor()).sample();
+        const budget = computeClassBudget(cls, sample, opts);
+        if (!Number.isFinite(budget)) return passThroughGrant(cls);
+        if (budget <= 0) {
+          return deferral(
+            cls,
+            `class '${cls}' budget is 0 under current pressure (some avg10=${someAvg10(sample).toFixed(1)})`,
+            DEFAULT_RESOURCE_RETRY_AFTER_MS
+          );
+        }
+        if (mode === "supervisor") {
+          const viaSupervisor = await this.acquireViaSupervisor(cls, Math.floor(budget));
+          if (viaSupervisor !== null) return viaSupervisor;
+        }
+        const dir = governorSlotDir(cls);
+        const slots = ensureSlotFiles(dir, budget);
+        const blocking = opts.blocking ?? true;
+        const timeoutMs = opts.timeoutMs ?? 36e5;
+        const pollMs = opts.pollMs ?? 200;
+        const startedAt = Date.now();
+        do {
+          const order = shuffledIndices(slots.length);
+          for (const idx of order) {
+            const path = slots[idx];
+            if (!path) continue;
+            try {
+              const release = await lockfile.lock(path, {
+                retries: 0,
+                stale: STALE_MS,
+                realpath: false
+              });
+              let released = false;
+              return {
+                deferred: false,
+                class: cls,
+                slot: idx,
+                acquiredAtMs: Date.now(),
+                release: async () => {
+                  if (released) return;
+                  released = true;
+                  try {
+                    await release();
+                  } catch {
+                  }
+                }
+              };
+            } catch {
+            }
+          }
+          if (!blocking) break;
+          await sleep(pollMs);
+        } while (Date.now() - startedAt < timeoutMs);
+        return deferral(
+          cls,
+          `class '${cls}' is at capacity (${budget} slot(s)); ` + (blocking ? `timed out after ${timeoutMs}ms` : "no slot free"),
+          Math.min(pollMs * 4, DEFAULT_RESOURCE_RETRY_AFTER_MS)
+        );
+      }
+      /**
+       * Route an admission through the supervisor's central `resource_admit` verb.
+       * Returns a grant (whose `release` calls `resource_release`) or a deferral, or
+       * `null` when the supervisor is unreachable so the caller degrades to the
+       * local slot engine. Never throws — a dead arbiter never deadlocks work.
+       *
+       * @task T12001
+       */
+      async acquireViaSupervisor(cls, budget) {
+        const socketPath = resolveSupervisorSocketPath();
+        const holderId = supervisorHolderId(cls);
+        const reply = await sendResourceAdmit(socketPath, cls, holderId, budget);
+        if ("unavailable" in reply) {
+          logSupervisorDegradeOnce(reply.reason);
+          return null;
+        }
+        if (reply.disposition === "deferred") {
+          return deferral(
+            cls,
+            `class '${cls}' deferred by supervisor (budget ${budget})`,
+            reply.retry_after_ms || DEFAULT_RESOURCE_RETRY_AFTER_MS
+          );
+        }
+        let released = false;
+        return {
+          deferred: false,
+          class: cls,
+          slot: 0,
+          acquiredAtMs: Date.now(),
+          release: async () => {
+            if (released) return;
+            released = true;
+            await sendResourceRelease(socketPath, cls, holderId).catch(() => {
+            });
+          }
+        };
+      }
+      /** Non-blocking single-pass acquire (admission semantics). */
+      async tryAcquire(cls, opts = {}) {
+        return this.acquire(cls, { ...opts, blocking: false });
+      }
+      /**
+       * Currently-grantable slot count for `cls` = budget − held. Held is the count
+       * of slot files currently locked. `Infinity` for ungated classes.
+       */
+      async available(cls, opts = {}) {
+        if (resolveGovernorMode() === "off" || cls === "interactive-cli") {
+          return Number.POSITIVE_INFINITY;
+        }
+        const sample = opts.sample ?? await (opts.monitor ?? new ResourceMonitor()).sample();
+        const budget = computeClassBudget(cls, sample, opts);
+        if (!Number.isFinite(budget)) return Number.POSITIVE_INFINITY;
+        if (budget <= 0) return 0;
+        const held = await countHeldSlots(cls, budget);
+        return Math.max(0, budget - held);
+      }
+    };
+    governor = new ResourceGovernor();
+  }
+});
+
+// packages/core/src/store/lock.ts
+import lockfile2 from "proper-lockfile";
 async function acquireLock(filePath, options) {
   try {
-    const release = await lockfile.lock(filePath, {
+    const release = await lockfile2.lock(filePath, {
       ...DEFAULT_LOCK_OPTIONS,
       ...options?.stale !== void 0 && { stale: options.stale },
       ...options?.retries !== void 0 && {
@@ -35227,7 +36033,7 @@ var init_lock = __esm({
 });
 
 // packages/core/src/store/atomic.ts
-import { mkdir, readFile as readFile2, rename, unlink } from "node:fs/promises";
+import { mkdir, readFile as readFile3, rename, unlink } from "node:fs/promises";
 import { dirname as dirname3 } from "node:path";
 import writeFileAtomic from "write-file-atomic";
 async function atomicWrite(filePath, data, options) {
@@ -35243,7 +36049,7 @@ async function atomicWrite(filePath, data, options) {
 }
 async function safeReadFile(filePath) {
   try {
-    return await readFile2(filePath, "utf8");
+    return await readFile3(filePath, "utf8");
   } catch (err) {
     if (err instanceof Error && "code" in err && err.code === "ENOENT") {
       return null;
@@ -35264,34 +36070,34 @@ var init_atomic = __esm({
 });
 
 // packages/core/src/store/backup.ts
-import { copyFile, rename as fsRename, mkdir as mkdir2, readdir, stat, unlink as unlink2 } from "node:fs/promises";
-import { basename, join as join5 } from "node:path";
+import { copyFile, rename as fsRename, mkdir as mkdir2, readdir, stat as stat2, unlink as unlink2 } from "node:fs/promises";
+import { basename, join as join7 } from "node:path";
 async function createBackup(filePath, backupDir, maxBackups = DEFAULT_MAX_BACKUPS) {
   try {
     await mkdir2(backupDir, { recursive: true });
     const fileName = basename(filePath);
     try {
-      await stat(filePath);
+      await stat2(filePath);
     } catch {
       throw new CleoError(3 /* FILE_ERROR */, `Cannot backup: source file not found: ${filePath}`);
     }
     for (let i = maxBackups; i >= 1; i--) {
-      const current = join5(backupDir, `${fileName}.${i}`);
+      const current = join7(backupDir, `${fileName}.${i}`);
       if (i === maxBackups) {
         try {
           await unlink2(current);
         } catch {
         }
       } else {
-        const next = join5(backupDir, `${fileName}.${i + 1}`);
+        const next = join7(backupDir, `${fileName}.${i + 1}`);
         try {
-          await stat(current);
+          await stat2(current);
           await fsRename(current, next);
         } catch {
         }
       }
     }
-    const backupPath = join5(backupDir, `${fileName}.1`);
+    const backupPath = join7(backupDir, `${fileName}.1`);
     await copyFile(filePath, backupPath);
     return backupPath;
   } catch (err) {
@@ -35570,8 +36376,8 @@ var init_json2 = __esm({
 });
 
 // packages/core/src/scaffold/ensure-config.ts
-import { existsSync as existsSync3, readFileSync } from "node:fs";
-import { basename as basename2, dirname as dirname4, join as join6, resolve as resolve2 } from "node:path";
+import { existsSync as existsSync4, readFileSync } from "node:fs";
+import { basename as basename2, dirname as dirname4, join as join8, resolve as resolve2 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 function getPackageRoot() {
   const thisFile = fileURLToPath2(import.meta.url);
@@ -35579,7 +36385,7 @@ function getPackageRoot() {
 }
 function getCleoVersion() {
   try {
-    const pkgPath = join6(getPackageRoot(), "package.json");
+    const pkgPath = join8(getPackageRoot(), "package.json");
     const pkg = JSON.parse(readFileSync(pkgPath, "utf-8"));
     return pkg.version ?? "0.0.0";
   } catch {
@@ -35598,25 +36404,25 @@ var init_ensure_config = __esm({
 // packages/core/src/store/exodus/archive.ts
 import {
   copyFileSync as copyFileSync2,
-  existsSync as existsSync4,
-  mkdirSync,
+  existsSync as existsSync5,
+  mkdirSync as mkdirSync2,
   renameSync,
   unlinkSync,
-  writeFileSync
+  writeFileSync as writeFileSync2
 } from "node:fs";
-import { basename as basename3, join as join7 } from "node:path";
+import { basename as basename3, join as join9 } from "node:path";
 function scopeBaseDir(scope, cwd) {
   return scope === "project" ? resolveCleoDir(cwd) : getCleoHome();
 }
 function exodusArchiveDir(scope, cwd) {
-  return join7(scopeBaseDir(scope, cwd), ARCHIVE_DIR_NAME);
+  return join9(scopeBaseDir(scope, cwd), ARCHIVE_DIR_NAME);
 }
 function exodusMarkerPath(scope, cwd) {
-  return join7(scopeBaseDir(scope, cwd), MARKER_FILENAME_BY_SCOPE[scope]);
+  return join9(scopeBaseDir(scope, cwd), MARKER_FILENAME_BY_SCOPE[scope]);
 }
 function hasExodusCompleteMarker(scope, cwd) {
   try {
-    return existsSync4(exodusMarkerPath(scope, cwd));
+    return existsSync5(exodusMarkerPath(scope, cwd));
   } catch {
     return false;
   }
@@ -35624,7 +36430,7 @@ function hasExodusCompleteMarker(scope, cwd) {
 function writeExodusCompleteMarker(scope, archivedSources, cwd) {
   const markerPath = exodusMarkerPath(scope, cwd);
   const baseDir = scopeBaseDir(scope, cwd);
-  mkdirSync(baseDir, { recursive: true });
+  mkdirSync2(baseDir, { recursive: true });
   const marker16 = {
     version: 1,
     scope,
@@ -35633,17 +36439,17 @@ function writeExodusCompleteMarker(scope, archivedSources, cwd) {
     archivedSources: [...archivedSources]
   };
   const tmpPath = `${markerPath}.tmp`;
-  writeFileSync(tmpPath, JSON.stringify(marker16, null, 2) + "\n", "utf8");
+  writeFileSync2(tmpPath, JSON.stringify(marker16, null, 2) + "\n", "utf8");
   renameSync(tmpPath, markerPath);
-  log2.info({ scope, markerPath, archivedSources }, "exodus: wrote completion marker");
+  log3.info({ scope, markerPath, archivedSources }, "exodus: wrote completion marker");
   return markerPath;
 }
 function moveFileInto(srcPath, destDir) {
-  mkdirSync(destDir, { recursive: true });
-  let dest = join7(destDir, basename3(srcPath));
-  if (existsSync4(dest)) {
+  mkdirSync2(destDir, { recursive: true });
+  let dest = join9(destDir, basename3(srcPath));
+  if (existsSync5(dest)) {
     const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "").replace(/Z$/, "Z");
-    dest = join7(destDir, `${basename3(srcPath)}.${stamp}`);
+    dest = join9(destDir, `${basename3(srcPath)}.${stamp}`);
   }
   try {
     renameSync(srcPath, dest);
@@ -35654,25 +36460,25 @@ function moveFileInto(srcPath, destDir) {
   return dest;
 }
 function archiveSourceDb(source, cwd) {
-  if (!existsSync4(source.path)) {
+  if (!existsSync5(source.path)) {
     return { name: source.name, sourcePath: source.path, archivedTo: null, action: "absent" };
   }
   const destDir = exodusArchiveDir(source.targetScope, cwd);
   const archivedTo = moveFileInto(source.path, destDir);
   for (const suffix of SIDECAR_SUFFIXES) {
     const sidecar = `${source.path}${suffix}`;
-    if (existsSync4(sidecar)) {
+    if (existsSync5(sidecar)) {
       try {
         moveFileInto(sidecar, destDir);
       } catch (err) {
-        log2.warn(
+        log3.warn(
           { err, sidecar, sourceName: source.name },
           "exodus-archive: failed to archive sidecar (non-fatal)"
         );
       }
     }
   }
-  log2.info(
+  log3.info(
     { sourceName: source.name, sourcePath: source.path, archivedTo, scope: source.targetScope },
     "exodus-archive: archived legacy source DB"
   );
@@ -35707,7 +36513,7 @@ function detectStrandedResidue(sources, cwd) {
   const stranded = [];
   for (const source of sources) {
     if (!markedScopes.has(source.targetScope)) continue;
-    if (existsSync4(source.path)) {
+    if (existsSync5(source.path)) {
       stranded.push({ name: source.name, path: source.path, scope: source.targetScope });
     }
   }
@@ -35723,14 +36529,14 @@ function archiveStrandedResidue(stranded, sources, cwd) {
   }
   return results;
 }
-var log2, ARCHIVE_DIR_NAME, MARKER_FILENAME_BY_SCOPE, SIDECAR_SUFFIXES;
+var log3, ARCHIVE_DIR_NAME, MARKER_FILENAME_BY_SCOPE, SIDECAR_SUFFIXES;
 var init_archive2 = __esm({
   "packages/core/src/store/exodus/archive.ts"() {
     "use strict";
     init_logger2();
     init_paths();
     init_ensure_config();
-    log2 = getLogger("exodus-archive");
+    log3 = getLogger("exodus-archive");
     ARCHIVE_DIR_NAME = "_archive";
     MARKER_FILENAME_BY_SCOPE = {
       project: "exodus-complete",
@@ -36124,7 +36930,7 @@ var init_table_name_map = __esm({
 });
 
 // packages/core/src/store/exodus/count-parity.ts
-import { existsSync as existsSync5 } from "node:fs";
+import { existsSync as existsSync6 } from "node:fs";
 function listTables(db) {
   return db.prepare(
     "SELECT name FROM sqlite_master WHERE type='table' AND name NOT LIKE 'sqlite_%' AND name NOT LIKE '__drizzle_%' ORDER BY name"
@@ -36145,14 +36951,14 @@ function rowCount(db, tableName) {
 function computeCountParity(sources, projectDbPath, globalDbPath) {
   const entries = [];
   let skipped = 0;
-  if (!existsSync5(projectDbPath) || !existsSync5(globalDbPath)) {
+  if (!existsSync6(projectDbPath) || !existsSync6(globalDbPath)) {
     return { ok: false, entries: [], deficits: [], checked: 0, skipped: 0 };
   }
   const projectSnap = openCleoDbSnapshot(projectDbPath, { readOnly: true });
   const globalSnap = openCleoDbSnapshot(globalDbPath, { readOnly: true });
   try {
     for (const src of sources) {
-      if (!existsSync5(src.path)) continue;
+      if (!existsSync6(src.path)) continue;
       const srcSnap = openCleoDbSnapshot(src.path, { readOnly: true });
       try {
         for (const legacyTable of listTables(srcSnap.db)) {
@@ -36191,27 +36997,27 @@ function computeCountParity(sources, projectDbPath, globalDbPath) {
   }
   const deficits = entries.filter((e) => e.deficit > 0);
   if (deficits.length > 0) {
-    log3.warn(
+    log4.warn(
       { deficitCount: deficits.length, sample: deficits.slice(0, 5) },
       `exodus count-parity: ${deficits.length} table(s) have FEWER rows in the consolidated target than the legacy source`
     );
   }
   return { ok: deficits.length === 0, entries, deficits, checked: entries.length, skipped };
 }
-var log3;
+var log4;
 var init_count_parity = __esm({
   "packages/core/src/store/exodus/count-parity.ts"() {
     "use strict";
     init_logger2();
     init_open_cleo_db();
     init_table_name_map();
-    log3 = getLogger("exodus-count-parity");
+    log4 = getLogger("exodus-count-parity");
   }
 });
 
 // packages/core/src/store/exodus/plan.ts
-import { existsSync as existsSync6, readdirSync as readdirSync2, statfsSync, statSync } from "node:fs";
-import { join as join8 } from "node:path";
+import { existsSync as existsSync7, readdirSync as readdirSync3, statfsSync, statSync } from "node:fs";
+import { join as join10 } from "node:path";
 function computeRequiredBytes(totalSourceBytes, largestSourceBytes) {
   return Math.ceil(STAGING_HEADROOM_FACTOR * largestSourceBytes) + totalSourceBytes;
 }
@@ -36222,33 +37028,33 @@ function buildSourceDescriptors(cwd) {
     // Project-tier — go into consolidated project-scope cleo.db
     {
       name: "tasks",
-      path: join8(cleoDir, "tasks.db"),
+      path: join10(cleoDir, "tasks.db"),
       targetScope: "project"
     },
     {
       name: "brain (project)",
-      path: join8(cleoDir, "brain.db"),
+      path: join10(cleoDir, "brain.db"),
       targetScope: "project"
     },
     {
       name: "conduit",
-      path: join8(cleoDir, "conduit.db"),
+      path: join10(cleoDir, "conduit.db"),
       targetScope: "project"
     },
     // Global-tier — go into consolidated global-scope cleo.db
     {
       name: "nexus",
-      path: join8(cleoHome, "nexus.db"),
+      path: join10(cleoHome, "nexus.db"),
       targetScope: "global"
     },
     {
       name: "signaldock",
-      path: join8(cleoHome, "signaldock.db"),
+      path: join10(cleoHome, "signaldock.db"),
       targetScope: "global"
     },
     {
       name: "skills",
-      path: join8(cleoHome, "skills.db"),
+      path: join10(cleoHome, "skills.db"),
       targetScope: "global"
     }
   ];
@@ -36274,10 +37080,10 @@ function deriveStagingDirName() {
 }
 function findExistingStaging(cleoDir) {
   try {
-    const entries = readdirSync2(cleoDir, { withFileTypes: true });
+    const entries = readdirSync3(cleoDir, { withFileTypes: true });
     const stagingDirs = entries.filter((e) => e.isDirectory() && e.name.startsWith("exodus-staging-")).map((e) => e.name).sort().reverse();
     if (stagingDirs.length > 0) {
-      return join8(cleoDir, stagingDirs[0]);
+      return join10(cleoDir, stagingDirs[0]);
     }
   } catch {
   }
@@ -36293,7 +37099,7 @@ function buildExodusPlan(cwd) {
   const availableBytes = getAvailableBytes(cleoDir);
   const diskPreflight = totalSourceBytes === 0 || availableBytes >= requiredBytes;
   const existingStaging = findExistingStaging(cleoDir);
-  const stagingDir = existingStaging ?? join8(cleoDir, deriveStagingDirName());
+  const stagingDir = existingStaging ?? join10(cleoDir, deriveStagingDirName());
   const resumeFromStaging = existingStaging !== null;
   const projectDbPath = resolveDualScopeDbPath("project", cwd);
   const globalDbPath = resolveDualScopeDbPath("global");
@@ -36312,7 +37118,7 @@ function buildExodusPlan(cwd) {
   };
 }
 function sourcesPresent(sources) {
-  return sources.some((s) => existsSync6(s.path));
+  return sources.some((s) => existsSync7(s.path));
 }
 var STAGING_HEADROOM_FACTOR, STAGING_COPY_SKIP_THRESHOLD_BYTES;
 var init_plan2 = __esm({
@@ -36326,18 +37132,18 @@ var init_plan2 = __esm({
 });
 
 // packages/core/src/store/exodus/health.ts
-import { existsSync as existsSync7, statSync as statSync2 } from "node:fs";
+import { existsSync as existsSync8, statSync as statSync2 } from "node:fs";
 function buildExodusHealth(cwd) {
   const plan = buildExodusPlan(cwd);
-  const anyLegacyPresent = plan.sources.some((s) => existsSync7(s.path));
+  const anyLegacyPresent = plan.sources.some((s) => existsSync8(s.path));
   const parity = anyLegacyPresent ? computeCountParity(plan.sources, plan.projectDbPath, plan.globalDbPath) : { ok: true, entries: [], deficits: [], checked: 0, skipped: 0 };
   const consolidatedExistsByScope = {
-    project: existsSync7(plan.projectDbPath),
-    global: existsSync7(plan.globalDbPath)
+    project: existsSync8(plan.projectDbPath),
+    global: existsSync8(plan.globalDbPath)
   };
   const buildScope = (scope) => {
     const sources = plan.sources.filter((s) => s.targetScope === scope).map((s) => {
-      const present = existsSync7(s.path);
+      const present = existsSync8(s.path);
       let bytes = 0;
       if (present) {
         try {
@@ -36604,15 +37410,15 @@ var init_types = __esm({
 // packages/core/src/store/exodus/migrate.ts
 import {
   copyFileSync as copyFileSync3,
-  existsSync as existsSync8,
-  mkdirSync as mkdirSync2,
+  existsSync as existsSync9,
+  mkdirSync as mkdirSync3,
   readFileSync as readFileSync2,
   renameSync as renameSync2,
   statSync as statSync3,
   unlinkSync as unlinkSync2,
-  writeFileSync as writeFileSync2
+  writeFileSync as writeFileSync3
 } from "node:fs";
-import { join as join9 } from "node:path";
+import { join as join11 } from "node:path";
 function getSqliteVersion(db) {
   try {
     const row = db.prepare("SELECT sqlite_version() AS v").get();
@@ -36628,14 +37434,14 @@ function listTables2(db) {
   return rows.map((r) => r.name);
 }
 function writeJournal(stagingDir, journal) {
-  const journalPath = join9(stagingDir, JOURNAL_FILENAME);
+  const journalPath = join11(stagingDir, JOURNAL_FILENAME);
   const tmpPath = `${journalPath}.tmp`;
-  writeFileSync2(tmpPath, JSON.stringify(journal, null, 2) + "\n", "utf8");
+  writeFileSync3(tmpPath, JSON.stringify(journal, null, 2) + "\n", "utf8");
   renameSync2(tmpPath, journalPath);
 }
 function readJournal(stagingDir) {
-  const journalPath = join9(stagingDir, JOURNAL_FILENAME);
-  if (!existsSync8(journalPath)) return null;
+  const journalPath = join11(stagingDir, JOURNAL_FILENAME);
+  if (!existsSync9(journalPath)) return null;
   try {
     return JSON.parse(readFileSync2(journalPath, "utf8"));
   } catch {
@@ -36643,17 +37449,17 @@ function readJournal(stagingDir) {
   }
 }
 function clearExodusJournal(stagingDir) {
-  const journalPath = join9(stagingDir, JOURNAL_FILENAME);
+  const journalPath = join11(stagingDir, JOURNAL_FILENAME);
   try {
-    if (!existsSync8(journalPath)) return false;
+    if (!existsSync9(journalPath)) return false;
     unlinkSync2(journalPath);
-    log4.info(
+    log5.info(
       { stagingDir },
       "exodus: cleared migrate journal after abort/rollback \u2014 a retry will RE-COPY all tables"
     );
     return true;
   } catch (err) {
-    log4.warn(
+    log5.warn(
       { err, stagingDir },
       'exodus: failed to clear migrate journal after rollback (a retry may skip already-"done" tables)'
     );
@@ -36678,7 +37484,7 @@ function lockPath(dbPath) {
 }
 function acquireAdvisoryLock(dbPath) {
   const lp = lockPath(dbPath);
-  writeFileSync2(lp, JSON.stringify({ pid: process.pid, ts: (/* @__PURE__ */ new Date()).toISOString() }), "utf8");
+  writeFileSync3(lp, JSON.stringify({ pid: process.pid, ts: (/* @__PURE__ */ new Date()).toISOString() }), "utf8");
 }
 function releaseAdvisoryLock(dbPath) {
   try {
@@ -36741,7 +37547,7 @@ function buildSelectExpr(attachAlias, legacyTable, targetTableName, col, srcType
 function copyTableFromAttached(targetNativeDb, srcNativeDb, attachAlias, legacyTableName, sourceName, targetSchema = "main") {
   const resolution = resolveConsolidatedTableName(sourceName, legacyTableName);
   if (resolution.kind === "skip") {
-    log4.warn(
+    log5.warn(
       { legacyTableName, sourceName, reason: resolution.reason },
       `Exodus: explicitly skipping table \u2014 ${resolution.reason}`
     );
@@ -36760,7 +37566,7 @@ function copyTableFromAttached(targetNativeDb, srcNativeDb, attachAlias, legacyT
   ).get();
   if (!existsRow) {
     const reason = `consolidated target '${targetTableName}' not found (mapped from legacy '${legacyTableName}')`;
-    log4.warn(
+    log5.warn(
       { legacyTableName, targetTableName, sourceName, attachAlias, targetSchema },
       `Exodus: ${reason}`
     );
@@ -36771,13 +37577,13 @@ function copyTableFromAttached(targetNativeDb, srcNativeDb, attachAlias, legacyT
   const sharedColumns = srcPragma.map((r) => r.name).filter((col) => tgtColMap.has(col));
   if (sharedColumns.length === 0) {
     const reason = `no overlapping columns between source '${legacyTableName}' and target '${targetTableName}'`;
-    log4.warn({ legacyTableName, targetTableName, sourceName }, `Exodus: ${reason}`);
+    log5.warn({ legacyTableName, targetTableName, sourceName }, `Exodus: ${reason}`);
     return { rowsCopied: 0, skipped: true, reason };
   }
   const srcOnlyColumns = srcPragma.map((r) => r.name).filter((c) => !tgtColMap.has(c));
   const tgtOnlyColumns = tgtPragma.map((r) => r.name).filter((c) => !srcColumns.has(c));
   if (srcOnlyColumns.length > 0 || tgtOnlyColumns.length > 0) {
-    log4.info(
+    log5.info(
       { legacyTableName, targetTableName, sourceName, srcOnlyColumns, tgtOnlyColumns },
       "Exodus: column drift detected \u2014 copying intersection, dropping src-only cols, using defaults for tgt-only cols"
     );
@@ -36792,7 +37598,7 @@ function copyTableFromAttached(targetNativeDb, srcNativeDb, attachAlias, legacyT
       return isoGlobCols.has(col) && (upper.includes("INT") || upper === "" || upper === "NUMERIC");
     });
     if (coercedCols.length > 0) {
-      log4.info(
+      log5.info(
         {
           legacyTableName,
           targetTableName,
@@ -36808,7 +37614,7 @@ function copyTableFromAttached(targetNativeDb, srcNativeDb, attachAlias, legacyT
     (col) => ENUM_NORMALIZATIONS.has(`${targetTableName}.${col}`)
   );
   if (normalizedCols.length > 0) {
-    log4.info(
+    log5.info(
       { legacyTableName, targetTableName, sourceName, normalizedCols },
       `Exodus: applying enum-value normalization for ${normalizedCols.length} column(s) (T11547)`
     );
@@ -36817,7 +37623,7 @@ function copyTableFromAttached(targetNativeDb, srcNativeDb, attachAlias, legacyT
     (col) => NUMERIC_CLAMPS.has(`${targetTableName}.${col}`)
   );
   if (clampedCols.length > 0) {
-    log4.info(
+    log5.info(
       { legacyTableName, targetTableName, sourceName, clampedCols },
       `Exodus: applying non-finite numeric clamp for ${clampedCols.length} column(s) (T11782)`
     );
@@ -36859,7 +37665,7 @@ function copyTableFromAttached(targetNativeDb, srcNativeDb, attachAlias, legacyT
   if (rowsCopied < sourceCount) {
     const presentAccountedFor = existingBefore + rowsCopied;
     if (presentAccountedFor >= sourceCount) {
-      log4.info(
+      log5.info(
         { legacyTableName, targetTableName, sourceName, sourceCount, rowsCopied, existingBefore },
         `Exodus: '${legacyTableName}'\u2192'${targetTableName}' \u2014 ${sourceCount - rowsCopied} of ${sourceCount} row(s) already present in target (idempotent PK dedup), ${rowsCopied} newly copied; no loss`
       );
@@ -36867,7 +37673,7 @@ function copyTableFromAttached(targetNativeDb, srcNativeDb, attachAlias, legacyT
     }
     const missing = sourceCount - presentAccountedFor;
     const reason = `INSERT OR IGNORE lost ${missing} of ${sourceCount} rows from '${legacyTableName}'\u2192'${targetTableName}' (rowsCopied=${rowsCopied}, existingBefore=${existingBefore}) \u2014 a CHECK/NOT NULL/type/enum constraint rejected them (NOT PK dedup); inspect epoch coercion + enum normalization. verify will confirm.`;
-    log4.error(
+    log5.error(
       {
         legacyTableName,
         targetTableName,
@@ -36887,10 +37693,10 @@ function checkSchemaVersion(journal, forceCrossVersion) {
   if (journal.targetSchemaVersion !== EXODUS_TARGET_SCHEMA_VERSION) {
     const msg = `Schema version mismatch: journal=${journal.targetSchemaVersion}, expected=${EXODUS_TARGET_SCHEMA_VERSION}`;
     if (forceCrossVersion) {
-      log4.warn(msg + " (--force-cross-version: continuing anyway)");
+      log5.warn(msg + " (--force-cross-version: continuing anyway)");
       return true;
     }
-    log4.error(msg + " \u2014 pass --force-cross-version to override");
+    log5.error(msg + " \u2014 pass --force-cross-version to override");
     return false;
   }
   return true;
@@ -36907,10 +37713,10 @@ async function runExodusMigrate(plan, forceCrossVersion = false, onProgress) {
       error: `Insufficient disk space for exodus: need \u2265${plan.requiredBytes} bytes (\u2248${STAGING_HEADROOM_FACTOR}\xD7 largest source ${plan.largestSourceBytes} + consolidated estimate ${plan.totalSourceBytes}), but only ${plan.availableBytes} bytes are free on the target filesystem \u2014 ${shortfall} bytes short. Free up at least ${shortfall} bytes (e.g. \`cleo backup prune\`, clear caches), or move the .cleo/ directory to a larger volume, then retry.`
     };
   }
-  mkdirSync2(stagingDir, { recursive: true });
+  mkdirSync3(stagingDir, { recursive: true });
   let sqliteVersion = "unknown";
   for (const src of sources) {
-    if (existsSync8(src.path)) {
+    if (existsSync9(src.path)) {
       const snap = openCleoDbSnapshot(src.path, { readOnly: true });
       sqliteVersion = getSqliteVersion(snap.db);
       snap.close();
@@ -36951,15 +37757,15 @@ async function runExodusMigrate(plan, forceCrossVersion = false, onProgress) {
     };
     var extractNativeDb = extractNativeDb2;
     for (const src of sources) {
-      if (!existsSync8(src.path)) continue;
-      const backupDest = join9(stagingDir, `${src.name.replace(/[^a-z0-9-]/g, "_")}-backup.db`);
+      if (!existsSync9(src.path)) continue;
+      const backupDest = join11(stagingDir, `${src.name.replace(/[^a-z0-9-]/g, "_")}-backup.db`);
       const srcBytes = safeStatBytes(src.path);
       const skipStagingCopy = srcBytes > plan.stagingCopyThresholdBytes;
       if (skipStagingCopy) {
         onProgress?.(
           `Skipping full staging copy of ${src.name} (${srcBytes} bytes > ${plan.stagingCopyThresholdBytes} threshold) \u2014 source is archived, not deleted, on success.`
         );
-      } else if (!existsSync8(backupDest)) {
+      } else if (!existsSync9(backupDest)) {
         onProgress?.(`Backing up ${src.name} \u2192 staging dir\u2026`);
         copyFileSync3(src.path, backupDest);
         backupPaths.push(backupDest);
@@ -36977,8 +37783,8 @@ async function runExodusMigrate(plan, forceCrossVersion = false, onProgress) {
     });
     const projectNative = extractNativeDb2(projectHandle);
     const globalNative = extractNativeDb2(globalHandle);
-    const projectSources = sources.filter((s) => s.targetScope === "project" && existsSync8(s.path));
-    const globalSources = sources.filter((s) => s.targetScope === "global" && existsSync8(s.path));
+    const projectSources = sources.filter((s) => s.targetScope === "project" && existsSync9(s.path));
+    const globalSources = sources.filter((s) => s.targetScope === "global" && existsSync9(s.path));
     await migrateScope(
       "project",
       projectSources,
@@ -37003,7 +37809,7 @@ async function runExodusMigrate(plan, forceCrossVersion = false, onProgress) {
     return { ok: true, tables: allTableResults, stagingDir, backupPaths };
   } catch (err) {
     const error48 = err instanceof Error ? err.message : String(err);
-    log4.error({ err }, "Exodus migration failed");
+    log5.error({ err }, "Exodus migration failed");
     return { ok: false, tables: allTableResults, stagingDir, backupPaths, error: error48 };
   } finally {
     try {
@@ -37023,7 +37829,7 @@ async function migrateScope(scope, sources, targetNativeDb, journal, stagingDir,
   if (sources.length === 0) return;
   onProgress?.(`Migrating ${scope}-scope sources\u2026`);
   targetNativeDb.exec("PRAGMA foreign_keys = OFF");
-  log4.info({ scope }, "Exodus: foreign_keys=OFF for bulk copy (T11533 FK-defer)");
+  log5.info({ scope }, "Exodus: foreign_keys=OFF for bulk copy (T11533 FK-defer)");
   try {
     for (let i = 0; i < sources.length; i++) {
       const src = sources[i];
@@ -37090,7 +37896,7 @@ async function migrateScope(scope, sources, targetNativeDb, journal, stagingDir,
               }
             } catch (err) {
               const msg = err instanceof Error ? err.message : String(err);
-              log4.warn({ tableName, sourceDb: src.name, err }, "Table copy failed \u2014 skipping");
+              log5.warn({ tableName, sourceDb: src.name, err }, "Table copy failed \u2014 skipping");
               status = "skipped";
               errorMsg = msg;
               skipped = true;
@@ -37138,7 +37944,7 @@ async function migrateScope(scope, sources, targetNativeDb, journal, stagingDir,
           targetNativeDb.exec(`DETACH DATABASE "${attachAlias}"`);
           onProgress?.(`  [${src.name}] Detached "${attachAlias}"`);
         } catch (detachErr) {
-          log4.warn(
+          log5.warn(
             { attachAlias, sourceDb: src.name, err: detachErr },
             "DETACH failed \u2014 alias will be released on DB close"
           );
@@ -37148,7 +37954,7 @@ async function migrateScope(scope, sources, targetNativeDb, journal, stagingDir,
             targetNativeDb.exec(`DETACH DATABASE "${crossAlias}"`);
             onProgress?.(`  [${src.name}] Cross-scope target detached "${crossAlias}"`);
           } catch (detachErr) {
-            log4.warn(
+            log5.warn(
               { crossAlias, sourceDb: src.name, err: detachErr },
               "Cross-scope DETACH failed \u2014 alias will be released on DB close"
             );
@@ -37160,28 +37966,28 @@ async function migrateScope(scope, sources, targetNativeDb, journal, stagingDir,
     try {
       const orphans = targetNativeDb.prepare("PRAGMA foreign_key_check").all();
       if (orphans.length > 0) {
-        log4.warn(
+        log5.warn(
           { scope, orphanCount: orphans.length, sample: orphans.slice(0, 5) },
           `Exodus: PRAGMA foreign_key_check found ${orphans.length} orphan row(s) after bulk copy \u2014 these are genuine data orphans (not ordering artifacts)`
         );
       } else {
-        log4.info({ scope }, "Exodus: PRAGMA foreign_key_check PASSED \u2014 no orphan rows");
+        log5.info({ scope }, "Exodus: PRAGMA foreign_key_check PASSED \u2014 no orphan rows");
       }
     } catch (checkErr) {
-      log4.warn(
+      log5.warn(
         { scope, err: checkErr },
         "Exodus: PRAGMA foreign_key_check failed (non-fatal) \u2014 target schema may not have FK constraints enabled"
       );
     }
     try {
       targetNativeDb.exec("PRAGMA foreign_keys = ON");
-      log4.info({ scope }, "Exodus: foreign_keys=ON restored after bulk copy");
+      log5.info({ scope }, "Exodus: foreign_keys=ON restored after bulk copy");
     } catch (fkErr) {
-      log4.warn({ scope, err: fkErr }, "Exodus: could not restore foreign_keys=ON (non-fatal)");
+      log5.warn({ scope, err: fkErr }, "Exodus: could not restore foreign_keys=ON (non-fatal)");
     }
   }
 }
-var log4, LOCK_SENTINEL_SUFFIX, JOURNAL_FILENAME, SOURCE_EPOCH_UNITS;
+var log5, LOCK_SENTINEL_SUFFIX, JOURNAL_FILENAME, SOURCE_EPOCH_UNITS;
 var init_migrate = __esm({
   "packages/core/src/store/exodus/migrate.ts"() {
     "use strict";
@@ -37193,7 +37999,7 @@ var init_migrate = __esm({
     init_plan2();
     init_table_name_map();
     init_types();
-    log4 = getLogger("exodus-migrate");
+    log5 = getLogger("exodus-migrate");
     LOCK_SENTINEL_SUFFIX = ".exodus-lock";
     JOURNAL_FILENAME = "exodus-journal.json";
     SOURCE_EPOCH_UNITS = /* @__PURE__ */ new Map([
@@ -37217,7 +38023,7 @@ function sealExodus(plan, scopeArg, cwd) {
   const parity = computeCountParity(plan.sources, plan.projectDbPath, plan.globalDbPath);
   if (!parity.ok) {
     const refusedReason = `Refusing to seal: ${parity.deficits.length} table(s) have FEWER rows in the consolidated cleo.db than the legacy source \u2014 the data is NOT fully migrated. Run \`cleo exodus migrate\` first. Deficits: ${parity.deficits.map((d) => `${d.targetTable}(${d.sourceCount}\u2192${d.targetCount})`).join(", ")}`;
-    log5.error({ deficits: parity.deficits.length }, `exodus seal refused \u2014 ${refusedReason}`);
+    log6.error({ deficits: parity.deficits.length }, `exodus seal refused \u2014 ${refusedReason}`);
     return { ok: false, refusedReason, parity, scopes: [] };
   }
   const outcomes = [];
@@ -37233,7 +38039,7 @@ function sealExodus(plan, scopeArg, cwd) {
       scopeSources.map((s) => s.name),
       cwd
     );
-    log5.info(
+    log6.info(
       { scope, alreadySealed, archived: archived.filter((a) => a.action === "archived").length },
       `exodus seal: scope '${scope}' certified (count-parity verified, ${parity.checked} tables)`
     );
@@ -37241,23 +38047,23 @@ function sealExodus(plan, scopeArg, cwd) {
   }
   return { ok: true, parity, scopes: outcomes };
 }
-var log5;
+var log6;
 var init_seal = __esm({
   "packages/core/src/store/exodus/seal.ts"() {
     "use strict";
     init_logger2();
     init_archive2();
     init_count_parity();
-    log5 = getLogger("exodus-seal");
+    log6 = getLogger("exodus-seal");
   }
 });
 
 // packages/core/src/store/exodus/status.ts
-import { existsSync as existsSync9, readdirSync as readdirSync3, readFileSync as readFileSync3, statSync as statSync4 } from "node:fs";
-import { join as join10 } from "node:path";
+import { existsSync as existsSync10, readdirSync as readdirSync4, readFileSync as readFileSync3, statSync as statSync4 } from "node:fs";
+import { join as join12 } from "node:path";
 function readJournal2(stagingDir) {
-  const p = join10(stagingDir, JOURNAL_FILENAME2);
-  if (!existsSync9(p)) return null;
+  const p = join12(stagingDir, JOURNAL_FILENAME2);
+  if (!existsSync10(p)) return null;
   try {
     return JSON.parse(readFileSync3(p, "utf8"));
   } catch {
@@ -37266,7 +38072,7 @@ function readJournal2(stagingDir) {
 }
 function findStagingDirs(cleoDir) {
   try {
-    return readdirSync3(cleoDir, { withFileTypes: true }).filter((e) => e.isDirectory() && e.name.startsWith("exodus-staging-")).map((e) => join10(cleoDir, e.name)).sort().reverse();
+    return readdirSync4(cleoDir, { withFileTypes: true }).filter((e) => e.isDirectory() && e.name.startsWith("exodus-staging-")).map((e) => join12(cleoDir, e.name)).sort().reverse();
   } catch {
     return [];
   }
@@ -37289,15 +38095,15 @@ function runExodusStatus(cwd) {
   const sourcesInfo = plan.sources.map((s) => ({
     name: s.name,
     path: s.path,
-    exists: existsSync9(s.path),
+    exists: existsSync10(s.path),
     bytes: safeBytes(s.path)
   }));
   return {
     hasStaging: latestStaging !== null,
     stagingDir: latestStaging,
     journal,
-    projectDbExists: existsSync9(projectDbPath),
-    globalDbExists: existsSync9(globalDbPath),
+    projectDbExists: existsSync10(projectDbPath),
+    globalDbExists: existsSync10(globalDbPath),
     sourcesPresent: sourcesInfo.some((s) => s.exists),
     sources: sourcesInfo
   };
@@ -37314,7 +38120,7 @@ var init_status = __esm({
 });
 
 // packages/core/src/store/exodus/verify-migration.ts
-import { existsSync as existsSync10 } from "node:fs";
+import { existsSync as existsSync11 } from "node:fs";
 import { createRequire as createRequire3 } from "node:module";
 function orderByClause(db, tableName) {
   try {
@@ -37334,7 +38140,7 @@ function computeTableDigest(db, tableName, columns, transform2) {
     count = Number(row?.c ?? 0);
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
-    log6.warn(
+    log7.warn(
       { tableName, err: msg },
       "computeTableDigest: COUNT(*) failed (possibly a virtual/FTS table) \u2014 treating as 0 rows"
     );
@@ -37369,7 +38175,7 @@ function computeTableDigest(db, tableName, columns, transform2) {
     }
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
-    log6.warn(
+    log7.warn(
       { tableName, err: msg },
       "computeTableDigest: streamed SELECT failed (possibly a virtual/FTS table) \u2014 digest skipped (COUNT(*) parity still enforced)"
     );
@@ -37495,7 +38301,7 @@ function foreignKeyCheck(db, scope) {
   try {
     const rows = db.prepare("PRAGMA foreign_key_check").all();
     if (rows.length > 0) {
-      log6.warn(
+      log7.warn(
         { scope, count: rows.length, sample: rows.slice(0, 5) },
         `verifyMigration: PRAGMA foreign_key_check found ${rows.length} orphan row(s)`
       );
@@ -37507,7 +38313,7 @@ function foreignKeyCheck(db, scope) {
       fkid: r.fkid
     }));
   } catch (err) {
-    log6.warn({ scope, err }, "verifyMigration: PRAGMA foreign_key_check failed (non-fatal)");
+    log7.warn({ scope, err }, "verifyMigration: PRAGMA foreign_key_check failed (non-fatal)");
     return [];
   }
 }
@@ -37544,13 +38350,13 @@ function sourceOrphanSignatures(db, sourceName, scope) {
     const rows = db.prepare("PRAGMA foreign_key_check").all();
     for (const r of rows) sigs.add(orphanSignature(db, r, sourceName));
     if (rows.length > 0) {
-      log6.warn(
+      log7.warn(
         { scope, count: rows.length, sample: rows.slice(0, 5) },
         `verifyMigration: source already has ${rows.length} pre-existing FK orphan(s) \u2014 these are tolerated (carried forward losslessly, flagged for data-hygiene)`
       );
     }
   } catch (err) {
-    log6.warn({ scope, err }, "verifyMigration: source PRAGMA foreign_key_check failed (non-fatal)");
+    log7.warn({ scope, err }, "verifyMigration: source PRAGMA foreign_key_check failed (non-fatal)");
   }
   return sigs;
 }
@@ -37562,7 +38368,7 @@ function verifyMigration(sources, projectDbPath, globalDbPath, onProgress) {
   const preExistingForeignKeyViolations = [];
   const failureLines = [];
   const sourceOrphanSigs = /* @__PURE__ */ new Set();
-  if (!existsSync10(projectDbPath)) {
+  if (!existsSync11(projectDbPath)) {
     return {
       ok: false,
       tables: [],
@@ -37573,7 +38379,7 @@ function verifyMigration(sources, projectDbPath, globalDbPath, onProgress) {
       error: `Consolidated project cleo.db not found at ${projectDbPath}. Run 'cleo exodus migrate' first.`
     };
   }
-  if (!existsSync10(globalDbPath)) {
+  if (!existsSync11(globalDbPath)) {
     return {
       ok: false,
       tables: [],
@@ -37588,7 +38394,7 @@ function verifyMigration(sources, projectDbPath, globalDbPath, onProgress) {
   const globalSnap = openCleoDbSnapshot(globalDbPath, { readOnly: true });
   try {
     for (const src of sources) {
-      if (!existsSync10(src.path)) {
+      if (!existsSync11(src.path)) {
         onProgress?.(`Skipping ${src.name} (not present)`);
         continue;
       }
@@ -37673,7 +38479,7 @@ function verifyMigration(sources, projectDbPath, globalDbPath, onProgress) {
               `[${scope}] ${src.name}.${legacyTableName} \u2192 ${targetTableName}: DEFICIT \u2014 source=${srcDigest.count} rows, target=${tgtDigest.count} rows (${srcDigest.count - tgtDigest.count} missing), hashMatch=${hashMatch}`
             );
           } else if (tgtDigest.count > srcDigest.count) {
-            log6.warn(
+            log7.warn(
               {
                 scope,
                 source: src.name,
@@ -37723,7 +38529,7 @@ function verifyMigration(sources, projectDbPath, globalDbPath, onProgress) {
       }
     }
     if (preExistingForeignKeyViolations.length > 0) {
-      log6.warn(
+      log7.warn(
         {
           count: preExistingForeignKeyViolations.length,
           sample: preExistingForeignKeyViolations.slice(0, 5)
@@ -37733,7 +38539,7 @@ function verifyMigration(sources, projectDbPath, globalDbPath, onProgress) {
     }
   } catch (err) {
     const error48 = err instanceof Error ? err.message : String(err);
-    log6.error({ err }, "verifyMigration failed");
+    log7.error({ err }, "verifyMigration failed");
     return {
       ok: false,
       tables,
@@ -37750,7 +38556,7 @@ function verifyMigration(sources, projectDbPath, globalDbPath, onProgress) {
   if (failureLines.length > 0) {
     const error48 = `verifyMigration FAILED: ${failureLines.length} issue(s):
 ${failureLines.map((l) => `  \u2022 ${l}`).join("\n")}`;
-    log6.error({ failureCount: failureLines.length }, error48);
+    log7.error({ failureCount: failureLines.length }, error48);
     return {
       ok: false,
       tables,
@@ -37770,7 +38576,7 @@ ${failureLines.map((l) => `  \u2022 ${l}`).join("\n")}`;
     enumDrift
   };
 }
-var log6, _require, CHECK_ENUM_REGEX;
+var log7, _require, CHECK_ENUM_REGEX;
 var init_verify_migration = __esm({
   "packages/core/src/store/exodus/verify-migration.ts"() {
     "use strict";
@@ -37779,7 +38585,7 @@ var init_verify_migration = __esm({
     init_open_cleo_db();
     init_column_transforms();
     init_table_name_map();
-    log6 = getLogger("verify-migration");
+    log7 = getLogger("verify-migration");
     _require = createRequire3(import.meta.url);
     CHECK_ENUM_REGEX = /CHECK\s*\(\s*"([^"]+)"\s+(?:IS\s+NULL\s+OR\s+"[^"]+"\s+)?IN\s*\(([^)]*)\)\s*\)/gi;
   }
@@ -37871,7 +38677,7 @@ __export(on_open_exports, {
   isDataContinuityOk: () => isDataContinuityOk,
   maybeRunExodusOnOpen: () => maybeRunExodusOnOpen
 });
-import { existsSync as existsSync11 } from "node:fs";
+import { existsSync as existsSync12 } from "node:fs";
 function isDisabledByEnv() {
   const v = process.env.CLEO_DISABLE_EXODUS_ON_OPEN;
   return v === "1" || v === "true";
@@ -37897,7 +38703,7 @@ function rollbackConsolidatedToEmpty(nativeDb, scope) {
       "SELECT name FROM sqlite_master WHERE type='table' AND name NOT LIKE 'sqlite_%' AND name NOT LIKE '__drizzle_%'"
     ).all().map((r) => r.name);
   } catch (err) {
-    log7.error({ err, scope }, "exodus-on-open: failed to enumerate tables for rollback");
+    log8.error({ err, scope }, "exodus-on-open: failed to enumerate tables for rollback");
     return;
   }
   try {
@@ -37907,7 +38713,7 @@ function rollbackConsolidatedToEmpty(nativeDb, scope) {
       try {
         nativeDb.exec(`DELETE FROM "${table}"`);
       } catch (err) {
-        log7.warn({ err, table, scope }, "exodus-on-open: failed to clear table during rollback");
+        log8.warn({ err, table, scope }, "exodus-on-open: failed to clear table during rollback");
       }
     }
     nativeDb.exec("COMMIT");
@@ -37916,7 +38722,7 @@ function rollbackConsolidatedToEmpty(nativeDb, scope) {
       nativeDb.exec("ROLLBACK");
     } catch {
     }
-    log7.error({ err, scope }, "exodus-on-open: rollback transaction failed");
+    log8.error({ err, scope }, "exodus-on-open: rollback transaction failed");
   } finally {
     try {
       nativeDb.exec("PRAGMA foreign_keys = ON");
@@ -37936,7 +38742,7 @@ async function rollbackBothScopes(scope, projectDbPath, globalDbPath) {
         rollbackConsolidatedToEmpty(native, s);
       }
     } catch (err) {
-      log7.warn(
+      log8.warn(
         { err, scope: s, openingScope: scope },
         "exodus-on-open: could not roll back scope (best-effort)"
       );
@@ -37952,7 +38758,7 @@ function isDataContinuityOk(result) {
   const deficits = result.tables.filter((t) => t.targetCount < t.sourceCount);
   const surpluses = result.tables.filter((t) => t.targetCount > t.sourceCount);
   if (surpluses.length > 0) {
-    log7.warn(
+    log8.warn(
       {
         surpluses: surpluses.map((t) => ({
           table: t.targetTable,
@@ -37986,7 +38792,7 @@ async function maybeRunExodusOnOpen(scope, dbPath, nativeDb, cwd) {
   const { buildExodusPlan: buildExodusPlan2, runExodusMigrate: runExodusMigrate2, verifyMigration: verifyMigration2, clearExodusJournal: clearExodusJournal2 } = await Promise.resolve().then(() => (init_exodus(), exodus_exports));
   const plan = buildExodusPlan2(cwd);
   const scopeSources = plan.sources.filter((s) => s.targetScope === scope);
-  if (!scopeSources.some((s) => existsSync11(s.path))) {
+  if (!scopeSources.some((s) => existsSync12(s.path))) {
     return {
       outcome: "skipped",
       reason: `no legacy ${scope}-scope source DBs present (fresh install or cross-scope-only)`
@@ -37999,11 +38805,11 @@ async function maybeRunExodusOnOpen(scope, dbPath, nativeDb, cwd) {
       if (!consolidatedIsEmpty(nativeDb, scope)) {
         return { outcome: "skipped", reason: "migrated by a concurrent process (lock winner)" };
       }
-      log7.info(
+      log8.info(
         {
           scope,
           dbPath,
-          sources: plan.sources.filter((s) => existsSync11(s.path)).map((s) => s.name)
+          sources: plan.sources.filter((s) => existsSync12(s.path)).map((s) => s.name)
         },
         "exodus-on-open: consolidated cleo.db is empty and legacy data present \u2014 auto-migrating"
       );
@@ -38012,23 +38818,23 @@ async function maybeRunExodusOnOpen(scope, dbPath, nativeDb, cwd) {
         const migrateResult = await runExodusMigrate2(
           plan,
           false,
-          (msg) => log7.debug({ scope }, `exodus-on-open: ${msg}`)
+          (msg) => log8.debug({ scope }, `exodus-on-open: ${msg}`)
         );
         if (!migrateResult.ok) {
           await rollbackBothScopes(scope, plan.projectDbPath, plan.globalDbPath);
           clearExodusJournal2(migrateResult.stagingDir);
           const reason = `migration failed: ${migrateResult.error ?? "unknown error"} \u2014 legacy DBs kept as source`;
-          log7.error({ scope, error: migrateResult.error }, `exodus-on-open: ${reason}`);
+          log8.error({ scope, error: migrateResult.error }, `exodus-on-open: ${reason}`);
           return { outcome: "aborted", reason };
         }
         const verifyResult = verifyMigration2(
           plan.sources,
           plan.projectDbPath,
           plan.globalDbPath,
-          (msg) => log7.debug({ scope }, `exodus-on-open verify: ${msg}`)
+          (msg) => log8.debug({ scope }, `exodus-on-open verify: ${msg}`)
         );
         if (!verifyResult.ok) {
-          log7.warn(
+          log8.warn(
             {
               scope,
               enumDrift: verifyResult.enumDrift.length,
@@ -38042,7 +38848,7 @@ async function maybeRunExodusOnOpen(scope, dbPath, nativeDb, cwd) {
           clearExodusJournal2(plan.stagingDir);
           const deficits = verifyResult.tables.filter((t) => t.targetCount < t.sourceCount).map((t) => `${t.targetTable}(${t.sourceCount}\u2192${t.targetCount})`);
           const reason = `parity verification failed \u2014 cutover aborted, legacy DBs kept as source. count deficits: [${deficits.join(", ")}]; INTRODUCED fk orphans: ${verifyResult.introducedForeignKeyViolations.length} (pre-existing source orphans tolerated: ${verifyResult.preExistingForeignKeyViolations.length}). ` + `${verifyResult.error ?? ""}`.trim();
-          log7.error(
+          log8.error(
             {
               scope,
               countDeficits: deficits,
@@ -38054,14 +38860,14 @@ async function maybeRunExodusOnOpen(scope, dbPath, nativeDb, cwd) {
           return { outcome: "aborted", reason };
         }
         const rowsCopied = migrateResult.tables.filter((t) => !t.skipped).reduce((n, t) => n + t.rowsCopied, 0);
-        log7.info(
+        log8.info(
           { scope, rowsCopied, tables: migrateResult.tables.length },
           "exodus-on-open: parity verified \u2014 legacy data migrated into consolidated cleo.db"
         );
         try {
-          const consumed = plan.sources.filter((s) => existsSync11(s.path));
+          const consumed = plan.sources.filter((s) => existsSync12(s.path));
           const archiveResult = archiveMigratedSources(consumed, cwd);
-          log7.info(
+          log8.info(
             {
               scope,
               archived: archiveResult.sources.filter((s) => s.action === "archived").length,
@@ -38070,7 +38876,7 @@ async function maybeRunExodusOnOpen(scope, dbPath, nativeDb, cwd) {
             "exodus-on-open: archived legacy sources + sealed completion marker(s)"
           );
         } catch (err) {
-          log7.error(
+          log8.error(
             { err, scope },
             "exodus-on-open: post-migration archive/marker step failed (migration itself succeeded \u2014 legacy DBs left in place, will be re-checked by `cleo doctor exodus-residue`)"
           );
@@ -38092,14 +38898,14 @@ async function maybeRunExodusOnOpen(scope, dbPath, nativeDb, cwd) {
 function _isExodusInProgress() {
   return _exodusInProgress;
 }
-var log7, _exodusInProgress;
+var log8, _exodusInProgress;
 var init_on_open = __esm({
   "packages/core/src/store/exodus/on-open.ts"() {
     "use strict";
     init_logger2();
     init_lock();
     init_archive2();
-    log7 = getLogger("exodus-on-open");
+    log8 = getLogger("exodus-on-open");
     _exodusInProgress = false;
   }
 });
@@ -38116,9 +38922,9 @@ __export(dual_scope_db_exports, {
   resolveDualScopeDbPath: () => resolveDualScopeDbPath,
   upsertIdempotent: () => upsertIdempotent
 });
-import { existsSync as existsSync12, mkdirSync as mkdirSync3 } from "node:fs";
+import { existsSync as existsSync13, mkdirSync as mkdirSync4 } from "node:fs";
 import { createRequire as createRequire4 } from "node:module";
-import { dirname as dirname5, join as join11 } from "node:path";
+import { dirname as dirname5, join as join13 } from "node:path";
 function assertWriteDurable(handle) {
   if (handle.exodusAbort) {
     throw new ExodusAbortWriteUnsafeError(handle.exodusAbort);
@@ -38135,9 +38941,9 @@ function cacheKey(scope, dbPath) {
 }
 function resolveDualScopeDbPath(scope, cwd) {
   if (scope === "project") {
-    return join11(resolveCleoDir(cwd), "cleo.db");
+    return join13(resolveCleoDir(cwd), "cleo.db");
   }
-  return join11(getCleoHome(), "cleo.db");
+  return join13(getCleoHome(), "cleo.db");
 }
 function migrationsSetName(scope) {
   return scope === "project" ? "drizzle-cleo-project" : "drizzle-cleo-global";
@@ -38180,11 +38986,11 @@ async function openDualScopeDb(scope, cwd) {
   const dbPath = resolveDualScopeDbPath(scope, cwd);
   return scope === "project" ? openDualScopeDbAtPath("project", dbPath, cwd) : openDualScopeDbAtPath("global", dbPath, cwd);
 }
-async function openDedicatedDualScopeDb(scope, dbPath, log8) {
-  log8.debug({ scope, dbPath }, "opening DEDICATED (non-cached) dual-scope cleo.db (T11782 FIX D)");
+async function openDedicatedDualScopeDb(scope, dbPath, log9) {
+  log9.debug({ scope, dbPath }, "opening DEDICATED (non-cached) dual-scope cleo.db (T11782 FIX D)");
   const dir = dirname5(dbPath);
-  if (!existsSync12(dir)) {
-    mkdirSync3(dir, { recursive: true });
+  if (!existsSync13(dir)) {
+    mkdirSync4(dir, { recursive: true });
   }
   const DatabaseSyncCtor = getDatabaseSyncCtor();
   const nativeDb = new DatabaseSyncCtor(dbPath, { allowExtension: true });
@@ -38207,7 +39013,7 @@ async function openDedicatedDualScopeDb(scope, dbPath, log8) {
     existenceTable(scope),
     `dual-scope-db[${scope}]`
   );
-  log8.debug({ scope, dbPath }, "DEDICATED dual-scope cleo.db ready (T11782 FIX D)");
+  log9.debug({ scope, dbPath }, "DEDICATED dual-scope cleo.db ready (T11782 FIX D)");
   return {
     db,
     scope,
@@ -38232,15 +39038,15 @@ async function openDualScopeDbAtPath(scope, dbPath, exodusCwd, options) {
       return existing.handle;
     }
   }
-  const log8 = getLogger("dual-scope-db");
+  const log9 = getLogger("dual-scope-db");
   if (dedicated) {
-    return openDedicatedDualScopeDb(scope, dbPath, log8);
+    return openDedicatedDualScopeDb(scope, dbPath, log9);
   }
   const initPromise = (async () => {
-    log8.debug({ scope, dbPath }, "opening dual-scope cleo.db");
+    log9.debug({ scope, dbPath }, "opening dual-scope cleo.db");
     const dir = dirname5(dbPath);
-    if (!existsSync12(dir)) {
-      mkdirSync3(dir, { recursive: true });
+    if (!existsSync13(dir)) {
+      mkdirSync4(dir, { recursive: true });
     }
     const DatabaseSyncCtor = getDatabaseSyncCtor();
     const nativeDb = new DatabaseSyncCtor(dbPath, { allowExtension: true });
@@ -38267,7 +39073,7 @@ async function openDualScopeDbAtPath(scope, dbPath, exodusCwd, options) {
           existenceTable(scope),
           `dual-scope-db[${scope}]`
         );
-        log8.debug({ scope, dbPath }, "dual-scope cleo.db ready");
+        log9.debug({ scope, dbPath }, "dual-scope cleo.db ready");
         const built = {
           db,
           scope,
@@ -38293,6 +39099,25 @@ async function openDualScopeDbAtPath(scope, dbPath, exodusCwd, options) {
       { dbPath }
     );
     if (exodusCwd !== void 0 && dbPath === resolveDualScopeDbPath(scope, exodusCwd)) {
+      let releaseDbHeavy = null;
+      let dbHeavyDeferred = false;
+      try {
+        const { governor: governor2 } = await Promise.resolve().then(() => (init_governor(), governor_exports));
+        const admit = await governor2.tryAcquire("db-heavy");
+        if (admit.deferred) {
+          dbHeavyDeferred = true;
+        } else {
+          releaseDbHeavy = admit.release;
+        }
+      } catch {
+      }
+      if (dbHeavyDeferred) {
+        log9.debug(
+          { scope, dbPath },
+          "exodus-on-open skipped this open \u2014 db-heavy deferred under memory pressure (re-runs idempotently on a calmer open)"
+        );
+        return handle;
+      }
       try {
         const { maybeRunExodusOnOpen: maybeRunExodusOnOpen2 } = await Promise.resolve().then(() => (init_on_open(), on_open_exports));
         const result = await maybeRunExodusOnOpen2(scope, dbPath, nativeDb, exodusCwd);
@@ -38305,7 +39130,7 @@ async function openDualScopeDbAtPath(scope, dbPath, exodusCwd, options) {
               reason: result.reason,
               at: Date.now()
             };
-            log8.warn(
+            log9.warn(
               { scope, reason: result.reason },
               "exodus-on-open aborted; consolidated cleo.db left empty, legacy kept as source \u2014 mutating callers must check handle.exodusAbort / call assertWriteDurable (T11828)"
             );
@@ -38318,11 +39143,14 @@ async function openDualScopeDbAtPath(scope, dbPath, exodusCwd, options) {
           return reopened;
         }
       } catch (err) {
-        log8.warn(
+        log9.warn(
           { err, scope },
           "exodus-on-open hook failed (non-fatal); re-opening consolidated handle"
         );
         return scope === "project" ? openDualScopeDbAtPath("project", dbPath) : openDualScopeDbAtPath("global", dbPath);
+      } finally {
+        if (releaseDbHeavy) await releaseDbHeavy().catch(() => {
+        });
       }
     }
     return handle;
@@ -38945,8 +39773,8 @@ __export(nexus_sqlite_exports, {
   resetNexusDbState: () => resetNexusDbState,
   resolveNexusMigrationsFolder: () => resolveNexusMigrationsFolder
 });
-import { copyFileSync as copyFileSync4, existsSync as existsSync13 } from "node:fs";
-import { join as join12 } from "node:path";
+import { copyFileSync as copyFileSync4, existsSync as existsSync14 } from "node:fs";
+import { join as join14 } from "node:path";
 function getNexusDbPath(cwd) {
   return resolveDualScopeDbPath("project", cwd);
 }
@@ -38978,7 +39806,7 @@ function resolveNexusMigrationsFolder() {
   return resolveCorePackageMigrationsFolder("drizzle-nexus");
 }
 function getNestedNexusSentinelPath() {
-  return join12(getCleoHome(), "nexus", NESTED_NEXUS_SENTINEL);
+  return join14(getCleoHome(), "nexus", NESTED_NEXUS_SENTINEL);
 }
 function detectAndWarnOnNestedNexus() {
   let nestedPath;
@@ -38987,12 +39815,12 @@ function detectAndWarnOnNestedNexus() {
   } catch {
     return false;
   }
-  if (!existsSync13(nestedPath)) return false;
+  if (!existsSync14(nestedPath)) return false;
   if (_warnedNestedPaths.has(nestedPath)) return false;
   _warnedNestedPaths.add(nestedPath);
   const canonicalPath = getNexusDbPath();
-  const log8 = getLogger("nexus-sqlite");
-  log8.warn(
+  const log9 = getLogger("nexus-sqlite");
+  log9.warn(
     {
       nestedPath,
       canonicalPath,
@@ -39146,7 +39974,7 @@ function runNexusMigrations(nativeDb, db) {
   const migrationsFolder = resolveNexusMigrationsFolder();
   if (tableExists4(nativeDb, "nexus_nodes") && _nexusDbPath) {
     const backupPath = _nexusDbPath.replace(/\.db$/, "-pre-cleo.db.bak");
-    if (!existsSync13(backupPath)) {
+    if (!existsSync14(backupPath)) {
       try {
         copyFileSync4(_nexusDbPath, backupPath);
       } catch {
@@ -39284,10 +40112,10 @@ var init_nexus_sqlite = __esm({
 
 // packages/core/src/paths.ts
 import { AsyncLocalStorage } from "node:async_hooks";
-import { existsSync as existsSync14, readFileSync as readFileSync4, statSync as statSync5 } from "node:fs";
+import { existsSync as existsSync15, readFileSync as readFileSync4, statSync as statSync5 } from "node:fs";
 import { createRequire as createRequire5 } from "node:module";
 import { homedir } from "node:os";
-import { basename as basename4, dirname as dirname6, join as join13, resolve as resolve3 } from "node:path";
+import { basename as basename4, dirname as dirname6, join as join15, resolve as resolve3 } from "node:path";
 import {
   computeCanonicalProjectId as _computeCanonicalProjectId,
   getCanonicalTemplatesTildePath as _getCanonicalTemplatesTildePath,
@@ -39377,8 +40205,8 @@ function getCleoDirAbsolute(cwd, opts) {
 function _resolveProjectByCwdFromNexus(cwd) {
   try {
     const cleoHome = getCleoHome();
-    const globalDbPath = join13(cleoHome, "cleo.db");
-    if (!existsSync14(globalDbPath)) return null;
+    const globalDbPath = join15(cleoHome, "cleo.db");
+    if (!existsSync15(globalDbPath)) return null;
     const start = resolve3(cwd ?? process.cwd());
     let current = start;
     const DatabaseSync2 = _getDatabaseSyncCtor();
@@ -39417,7 +40245,7 @@ function _findCleoDirRoot(cwd) {
     const isDangerousRoot = current === homeRoot || current === "/" || current === "";
     if (!isDangerousRoot) {
       try {
-        if (statSync5(join13(current, ".cleo")).isDirectory()) {
+        if (statSync5(join15(current, ".cleo")).isDirectory()) {
           return current;
         }
       } catch {
@@ -39432,7 +40260,7 @@ function _findCleoDirRoot(cwd) {
 function resolveCleoDir(cwd) {
   const scope = worktreeScope.getStore();
   if (scope !== void 0) {
-    return join13(scope.worktreeRoot, ".cleo");
+    return join15(scope.worktreeRoot, ".cleo");
   }
   const override = _cleoDirEnvOverride();
   if (override !== null) {
@@ -39440,14 +40268,14 @@ function resolveCleoDir(cwd) {
   }
   const root = _findCleoDirRoot(cwd);
   if (root !== null) {
-    return join13(root, ".cleo");
+    return join15(root, ".cleo");
   }
   const start = resolve3(cwd ?? process.cwd());
   let current = start;
   while (true) {
     const mainRepo = _resolveMainRepoFromGitlink(current);
     if (mainRepo !== null) {
-      return join13(mainRepo, ".cleo");
+      return join15(mainRepo, ".cleo");
     }
     const parent = dirname6(current);
     if (parent === current) {
@@ -39489,9 +40317,9 @@ function _cwdHasGitAncestor(cwd) {
   const start = resolve3(cwd ?? process.cwd());
   let current = start;
   while (true) {
-    const gitMarker = join13(current, ".git");
+    const gitMarker = join15(current, ".git");
     try {
-      if (existsSync14(gitMarker)) {
+      if (existsSync15(gitMarker)) {
         return true;
       }
     } catch {
@@ -39503,16 +40331,16 @@ function _cwdHasGitAncestor(cwd) {
 }
 function _resolveMainRepoFromGitlink(gitlinkDir) {
   try {
-    const gitLinkPath = join13(gitlinkDir, ".git");
-    if (!existsSync14(gitLinkPath)) return null;
-    const stat2 = statSync5(gitLinkPath);
-    if (!stat2.isFile()) return null;
+    const gitLinkPath = join15(gitlinkDir, ".git");
+    if (!existsSync15(gitLinkPath)) return null;
+    const stat3 = statSync5(gitLinkPath);
+    if (!stat3.isFile()) return null;
     const gitLinkContent = readFileSync4(gitLinkPath, "utf-8").trim();
     const match = gitLinkContent.match(/^gitdir:\s*(.+)$/m);
     if (!match) return null;
     const gitdir = match[1].trim();
     const mainRepo = dirname6(dirname6(dirname6(gitdir)));
-    if (existsSync14(join13(mainRepo, ".cleo")) && validateProjectRoot(mainRepo)) {
+    if (existsSync15(join15(mainRepo, ".cleo")) && validateProjectRoot(mainRepo)) {
       return mainRepo;
     }
   } catch {
@@ -39520,18 +40348,18 @@ function _resolveMainRepoFromGitlink(gitlinkDir) {
   return null;
 }
 function validateProjectRoot(candidate) {
-  const cleoDir = join13(candidate, ".cleo");
-  if (!existsSync14(cleoDir)) {
+  const cleoDir = join15(candidate, ".cleo");
+  if (!existsSync15(cleoDir)) {
     return false;
   }
-  const projectInfoPath = join13(cleoDir, "project-info.json");
-  if (existsSync14(projectInfoPath)) {
+  const projectInfoPath = join15(cleoDir, "project-info.json");
+  if (existsSync15(projectInfoPath)) {
     try {
       const raw = readFileSync4(projectInfoPath, "utf-8");
       const parsed = JSON.parse(raw);
       if (typeof parsed === "object" && parsed !== null && "projectId" in parsed && typeof parsed["projectId"] === "string" && parsed["projectId"] !== "") {
-        const gitMarker = join13(candidate, ".git");
-        if (existsSync14(gitMarker)) {
+        const gitMarker = join15(candidate, ".git");
+        if (existsSync15(gitMarker)) {
           try {
             if (!statSync5(gitMarker).isDirectory()) {
               return false;
@@ -39545,12 +40373,12 @@ function validateProjectRoot(candidate) {
     } catch {
     }
   }
-  const gitDir = join13(candidate, ".git");
-  if (existsSync14(gitDir)) {
+  const gitDir = join15(candidate, ".git");
+  if (existsSync15(gitDir)) {
     let isRealGitDir = false;
     try {
-      const stat2 = statSync5(gitDir);
-      isRealGitDir = stat2.isDirectory();
+      const stat3 = statSync5(gitDir);
+      isRealGitDir = stat3.isDirectory();
     } catch {
       isRealGitDir = false;
     }
@@ -39593,16 +40421,16 @@ function getProjectRoot(cwd) {
   const homeRoot = homedir();
   const skippedCleoDirs = [];
   while (true) {
-    const cleoDir = join13(current, ".cleo");
-    const gitDir = join13(current, ".git");
+    const cleoDir = join15(current, ".cleo");
+    const gitDir = join15(current, ".git");
     const isDangerousRoot = current === homeRoot || current === "/" || current === "";
-    if (existsSync14(cleoDir) && !isDangerousRoot) {
+    if (existsSync15(cleoDir) && !isDangerousRoot) {
       if (validateProjectRoot(current)) {
         return current;
       }
       skippedCleoDirs.push(current);
     }
-    if (existsSync14(gitDir) && !isDangerousRoot) {
+    if (existsSync15(gitDir) && !isDangerousRoot) {
       let isRealGitDir = false;
       try {
         isRealGitDir = statSync5(gitDir).isDirectory();
@@ -39647,18 +40475,18 @@ function resolveOrCwd(maybeRoot) {
   return getProjectRoot();
 }
 function getConfigPath(cwd) {
-  return join13(_resolveCleoDir(cwd), "config.json");
+  return join15(_resolveCleoDir(cwd), "config.json");
 }
 function getGlobalConfigPath() {
-  return join13(getCleoHome(), "config.json");
+  return join15(getCleoHome(), "config.json");
 }
 function isAbsolutePath(path) {
   return _isAbsolutePath(path);
 }
 function _readProjectNameFromInfo(projectRoot) {
   try {
-    const infoPath = join13(projectRoot, ".cleo", "project-info.json");
-    if (!existsSync14(infoPath)) return void 0;
+    const infoPath = join15(projectRoot, ".cleo", "project-info.json");
+    if (!existsSync15(infoPath)) return void 0;
     const raw = readFileSync4(infoPath, "utf-8");
     const data = JSON.parse(raw);
     return typeof data.name === "string" && data.name.length > 0 ? data.name : void 0;
@@ -39684,8 +40512,8 @@ async function registerProjectOnEncounter(projectRoot, infoProjectId) {
     if (existingRows.length > 0) {
       const existingPath = existingRows[0].projectPath;
       if (existingPath !== resolvedPath) {
-        const newBrainDbPath = join13(resolvedPath, ".cleo", "brain.db");
-        const newTasksDbPath = join13(resolvedPath, ".cleo", "tasks.db");
+        const newBrainDbPath = join15(resolvedPath, ".cleo", "brain.db");
+        const newTasksDbPath = join15(resolvedPath, ".cleo", "tasks.db");
         await db.update(projectRegistry2).set({
           projectPath: resolvedPath,
           projectHash: generateProjectHash2(resolvedPath),
@@ -39716,8 +40544,8 @@ async function registerProjectOnEncounter(projectRoot, infoProjectId) {
       lastSync: now,
       taskCount: 0,
       labelsJson: "[]",
-      brainDbPath: join13(resolvedPath, ".cleo", "brain.db"),
-      tasksDbPath: join13(resolvedPath, ".cleo", "tasks.db"),
+      brainDbPath: join15(resolvedPath, ".cleo", "brain.db"),
+      tasksDbPath: join15(resolvedPath, ".cleo", "tasks.db"),
       statsJson: "{}"
     }).onConflictDoNothing();
     const aliases = canonicalResult.legacyAliases ?? [];
@@ -39750,46 +40578,46 @@ var init_paths = __esm({
 // packages/core/src/store/file-utils.ts
 import { randomBytes } from "node:crypto";
 import {
-  existsSync as existsSync15,
-  mkdirSync as mkdirSync4,
-  readdirSync as readdirSync4,
+  existsSync as existsSync16,
+  mkdirSync as mkdirSync5,
+  readdirSync as readdirSync5,
   readFileSync as readFileSync5,
   renameSync as renameSync3,
   unlinkSync as unlinkSync3,
-  writeFileSync as writeFileSync3
+  writeFileSync as writeFileSync4
 } from "node:fs";
-import { basename as basename5, dirname as dirname7, join as join14 } from "node:path";
-import * as lockfile2 from "proper-lockfile";
+import { basename as basename5, dirname as dirname7, join as join16 } from "node:path";
+import * as lockfile3 from "proper-lockfile";
 function rotateBackup(filePath, mode) {
   const dir = dirname7(filePath);
   const name15 = basename5(filePath);
-  const backupDir = join14(dir, ".backups");
+  const backupDir = join16(dir, ".backups");
   const dirMode = typeof mode === "number" ? modeToDirMode(mode) : void 0;
-  if (!existsSync15(backupDir)) {
-    mkdirSync4(backupDir, { recursive: true, mode: dirMode });
+  if (!existsSync16(backupDir)) {
+    mkdirSync5(backupDir, { recursive: true, mode: dirMode });
   }
   for (let i = MAX_BACKUPS; i >= 1; i--) {
-    const current = join14(backupDir, `${name15}.${i}`);
+    const current = join16(backupDir, `${name15}.${i}`);
     if (i === MAX_BACKUPS) {
       try {
         unlinkSync3(current);
       } catch {
       }
     } else {
-      const next = join14(backupDir, `${name15}.${i + 1}`);
+      const next = join16(backupDir, `${name15}.${i + 1}`);
       try {
-        if (existsSync15(current)) renameSync3(current, next);
+        if (existsSync16(current)) renameSync3(current, next);
       } catch {
       }
     }
   }
   try {
     const content = readFileSync5(filePath, "utf-8");
-    const backupPath = join14(backupDir, `${name15}.1`);
+    const backupPath = join16(backupDir, `${name15}.1`);
     if (typeof mode === "number") {
-      writeFileSync3(backupPath, content, { encoding: "utf-8", mode });
+      writeFileSync4(backupPath, content, { encoding: "utf-8", mode });
     } else {
-      writeFileSync3(backupPath, content, "utf-8");
+      writeFileSync4(backupPath, content, "utf-8");
     }
   } catch {
   }
@@ -39806,15 +40634,15 @@ function writeJsonFileAtomic(filePath, data, optsOrIndent = 2) {
   const indent = opts.indent ?? 2;
   const mode = opts.mode;
   const dir = dirname7(filePath);
-  const tempPath = join14(dir, `.${basename5(filePath)}.${randomBytes(6).toString("hex")}.tmp`);
+  const tempPath = join16(dir, `.${basename5(filePath)}.${randomBytes(6).toString("hex")}.tmp`);
   const content = JSON.stringify(data, null, indent) + "\n";
   if (typeof mode === "number") {
-    writeFileSync3(tempPath, content, { encoding: "utf-8", mode });
+    writeFileSync4(tempPath, content, { encoding: "utf-8", mode });
   } else {
-    writeFileSync3(tempPath, content, "utf-8");
+    writeFileSync4(tempPath, content, "utf-8");
   }
   try {
-    if (existsSync15(filePath)) {
+    if (existsSync16(filePath)) {
       rotateBackup(filePath, mode);
     }
     renameSync3(tempPath, filePath);
@@ -39840,19 +40668,19 @@ function readJsonFile(filePath) {
 async function withLock2(filePath, transform2, opts = {}) {
   const dir = dirname7(filePath);
   const dirMode = typeof opts.mode === "number" ? modeToDirMode(opts.mode) : void 0;
-  if (!existsSync15(dir)) {
-    mkdirSync4(dir, { recursive: true, mode: dirMode });
+  if (!existsSync16(dir)) {
+    mkdirSync5(dir, { recursive: true, mode: dirMode });
   }
-  if (!existsSync15(filePath)) {
+  if (!existsSync16(filePath)) {
     if (typeof opts.mode === "number") {
-      writeFileSync3(filePath, "", { encoding: "utf-8", mode: opts.mode });
+      writeFileSync4(filePath, "", { encoding: "utf-8", mode: opts.mode });
     } else {
-      writeFileSync3(filePath, "", "utf-8");
+      writeFileSync4(filePath, "", "utf-8");
     }
   }
   let release;
   try {
-    release = await lockfile2.lock(filePath, LOCK_OPTIONS);
+    release = await lockfile3.lock(filePath, LOCK_OPTIONS);
     const current = readJsonFile(filePath);
     const updated = transform2(current);
     writeJsonFileAtomic(filePath, updated, { mode: opts.mode });
@@ -39865,15 +40693,15 @@ async function withLock2(filePath, transform2, opts = {}) {
 }
 async function withFileLock(filePath, operation) {
   const dir = dirname7(filePath);
-  if (!existsSync15(dir)) {
-    mkdirSync4(dir, { recursive: true });
+  if (!existsSync16(dir)) {
+    mkdirSync5(dir, { recursive: true });
   }
-  if (!existsSync15(filePath)) {
-    writeFileSync3(filePath, "", "utf-8");
+  if (!existsSync16(filePath)) {
+    writeFileSync4(filePath, "", "utf-8");
   }
   let release;
   try {
-    release = await lockfile2.lock(filePath, LOCK_OPTIONS);
+    release = await lockfile3.lock(filePath, LOCK_OPTIONS);
     return await operation();
   } finally {
     if (release) {
@@ -39902,10 +40730,10 @@ var init_file_utils = __esm({
 
 // packages/core/src/llm/credential-removal.ts
 import { unlinkSync as unlinkSync4 } from "node:fs";
-import { join as join15 } from "node:path";
-import { getCleoHome as getCleoHome2 } from "@cleocode/paths";
+import { join as join17 } from "node:path";
+import { getCleoHome as getCleoHome3 } from "@cleocode/paths";
 function suppressionStatePath() {
-  return join15(getCleoHome2(), SUPPRESSION_FILENAME);
+  return join17(getCleoHome3(), SUPPRESSION_FILENAME);
 }
 function readSuppressionFile() {
   const data = readJsonFile(suppressionStatePath());
@@ -40009,7 +40837,7 @@ var init_credential_removal = __esm({
       sourceId: "cleo-pkce",
       description: "Delete CLEO-issued PKCE token at <CLEO_HOME>/anthropic-oauth.json",
       async remove() {
-        const path = join15(getCleoHome2(), "anthropic-oauth.json");
+        const path = join17(getCleoHome3(), "anthropic-oauth.json");
         const cleaned = [];
         try {
           unlinkSync4(path);
@@ -40088,7 +40916,7 @@ __export(config_exports, {
   parseConfigValue: () => parseConfigValue,
   setConfigValue: () => setConfigValue
 });
-import { existsSync as existsSync16 } from "node:fs";
+import { existsSync as existsSync17 } from "node:fs";
 function getNestedValue(obj, path) {
   const parts = path.split(".");
   let current = obj;
@@ -40136,7 +40964,7 @@ function parseEnvValue(value) {
   return value;
 }
 async function loadConfig(cwd) {
-  let merged = JSON.parse(JSON.stringify(DEFAULTS));
+  let merged = JSON.parse(JSON.stringify(DEFAULTS2));
   const globalConfig2 = await readJson(getGlobalConfigPath());
   if (globalConfig2) {
     merged = deepMerge(merged, globalConfig2);
@@ -40182,7 +41010,7 @@ async function getConfigValue(path, cwd) {
       return { value: val, source: "global" };
     }
   }
-  const defaultVal = getNestedValue({ ...DEFAULTS }, path);
+  const defaultVal = getNestedValue({ ...DEFAULTS2 }, path);
   return { value: defaultVal, source: "default" };
 }
 async function getRawConfigValue(key, cwd) {
@@ -40210,7 +41038,7 @@ function parseConfigValue(value) {
 }
 async function setConfigValue(key, value, cwd, opts) {
   const configPath = opts?.global ? getGlobalConfigPath() : getConfigPath(cwd);
-  if (!existsSync16(configPath)) {
+  if (!existsSync17(configPath)) {
     await atomicWriteJson(configPath, {});
   }
   const config2 = await readJson(configPath) ?? {};
@@ -40222,7 +41050,7 @@ async function setConfigValue(key, value, cwd, opts) {
 async function applyStrictnessPreset(preset, cwd, opts) {
   const definition = STRICTNESS_PRESETS[preset];
   const configPath = opts?.global ? getGlobalConfigPath() : getConfigPath(cwd);
-  if (!existsSync16(configPath)) {
+  if (!existsSync17(configPath)) {
     await atomicWriteJson(configPath, {});
   }
   const config2 = await readJson(configPath) ?? {};
@@ -40246,7 +41074,7 @@ function listStrictnessPresets() {
     })
   );
 }
-var DEFAULTS, ENV_MAP, STRICTNESS_PRESETS;
+var DEFAULTS2, ENV_MAP, STRICTNESS_PRESETS;
 var init_config = __esm({
   "packages/core/src/config.ts"() {
     "use strict";
@@ -40254,7 +41082,7 @@ var init_config = __esm({
     init_paths();
     init_atomic();
     init_json2();
-    DEFAULTS = {
+    DEFAULTS2 = {
       version: "2.10.0",
       output: {
         defaultFormat: "json",
@@ -40429,10 +41257,10 @@ var init_config = __esm({
 // packages/core/src/llm/credential-seeders/claude-code-seeder.ts
 import { readFileSync as readFileSync6 } from "node:fs";
 import { homedir as homedir2 } from "node:os";
-import { join as join16 } from "node:path";
+import { join as join18 } from "node:path";
 function defaultReadCredentialFile() {
   try {
-    return readFileSync6(join16(homedir2(), ".claude", ".credentials.json"), "utf-8");
+    return readFileSync6(join18(homedir2(), ".claude", ".credentials.json"), "utf-8");
   } catch {
     return null;
   }
@@ -40527,9 +41355,9 @@ var init_claude_code_seeder = __esm({
 
 // packages/core/src/llm/credential-seeders/cleo-pkce-seeder.ts
 import { readFileSync as readFileSync7 } from "node:fs";
-import { join as join17 } from "node:path";
+import { join as join19 } from "node:path";
 function defaultCleoPkcePath() {
-  return join17(getCleoHome(), "anthropic-oauth.json");
+  return join19(getCleoHome(), "anthropic-oauth.json");
 }
 function defaultReadCredentialFile2() {
   try {
@@ -40600,13 +41428,13 @@ var init_cleo_pkce_seeder = __esm({
 });
 
 // packages/core/src/llm/credential-seeders/codex-cli-seeder.ts
-import { existsSync as existsSync17, readFileSync as readFileSync8 } from "node:fs";
+import { existsSync as existsSync18, readFileSync as readFileSync8 } from "node:fs";
 import { homedir as homedir3 } from "node:os";
-import { join as join18 } from "node:path";
+import { join as join20 } from "node:path";
 function getCodexAuthPath() {
   const codexHome = (process.env["CODEX_HOME"] ?? "").trim();
-  const root = codexHome || join18(homedir3(), ".codex");
-  return join18(root, "auth.json");
+  const root = codexHome || join20(homedir3(), ".codex");
+  return join20(root, "auth.json");
 }
 var CodexCliSeeder, codexCliSeeder;
 var init_codex_cli_seeder = __esm({
@@ -40625,7 +41453,7 @@ var init_codex_cli_seeder = __esm({
        */
       async seed() {
         const authPath = getCodexAuthPath();
-        if (!existsSync17(authPath)) {
+        if (!existsSync18(authPath)) {
           return { entries: [] };
         }
         let raw;
@@ -40820,11 +41648,11 @@ var init_google_pkce = __esm({
 });
 
 // packages/core/src/llm/credential-seeders/gemini-cli-seeder.ts
-import { existsSync as existsSync18, readFileSync as readFileSync9 } from "node:fs";
-import { join as join19 } from "node:path";
-import { getCleoHome as getCleoHome3 } from "@cleocode/paths";
+import { existsSync as existsSync19, readFileSync as readFileSync9 } from "node:fs";
+import { join as join21 } from "node:path";
+import { getCleoHome as getCleoHome4 } from "@cleocode/paths";
 function getGoogleOauthPath() {
-  return join19(getCleoHome3(), "google_oauth.json");
+  return join21(getCleoHome4(), "google_oauth.json");
 }
 function parseGoogleOauthFile(raw) {
   let json3;
@@ -40869,7 +41697,7 @@ var init_gemini_cli_seeder = __esm({
        */
       async seed() {
         const path = getGoogleOauthPath();
-        if (!existsSync18(path)) {
+        if (!existsSync19(path)) {
           return { entries: [] };
         }
         let raw;
@@ -41094,23 +41922,23 @@ var init_credential_seeders = __esm({
 
 // packages/core/src/llm/global-config-migration.ts
 import {
-  existsSync as existsSync19,
-  mkdirSync as mkdirSync5,
+  existsSync as existsSync20,
+  mkdirSync as mkdirSync6,
   readFileSync as readFileSync10,
   renameSync as renameSync4,
   unlinkSync as unlinkSync5,
-  writeFileSync as writeFileSync4
+  writeFileSync as writeFileSync5
 } from "node:fs";
-import { join as join20 } from "node:path";
-import { getCleoHome as getCleoHome4, getCleoPlatformPaths as getCleoPlatformPaths2 } from "@cleocode/paths";
+import { join as join22 } from "node:path";
+import { getCleoHome as getCleoHome5, getCleoPlatformPaths as getCleoPlatformPaths2 } from "@cleocode/paths";
 function configDirGlobalConfigPath() {
-  return join20(getCleoPlatformPaths2().config, GLOBAL_CONFIG_FILENAME);
+  return join22(getCleoPlatformPaths2().config, GLOBAL_CONFIG_FILENAME);
 }
 function legacyGlobalConfigPath() {
-  return join20(getCleoHome4(), GLOBAL_CONFIG_FILENAME);
+  return join22(getCleoHome5(), GLOBAL_CONFIG_FILENAME);
 }
 function migrationMarkerPath() {
-  return join20(getCleoHome4(), MIGRATIONS_SUBDIR, MIGRATION_MARKER);
+  return join22(getCleoHome5(), MIGRATIONS_SUBDIR, MIGRATION_MARKER);
 }
 function tempTargetPath() {
   return `${configDirGlobalConfigPath()}.tmp`;
@@ -41120,12 +41948,12 @@ function migrateGlobalConfigToConfigDir() {
     const source = legacyGlobalConfigPath();
     const target = configDirGlobalConfigPath();
     const marker16 = migrationMarkerPath();
-    if (existsSync19(marker16)) return false;
-    if (!existsSync19(source)) {
+    if (existsSync20(marker16)) return false;
+    if (!existsSync20(source)) {
       stampMarker(marker16);
       return false;
     }
-    if (existsSync19(target)) {
+    if (existsSync20(target)) {
       backupSourceQuiet(source);
       stampMarker(marker16);
       return false;
@@ -41139,9 +41967,9 @@ function migrateGlobalConfigToConfigDir() {
       );
       return false;
     }
-    mkdirSync5(getCleoPlatformPaths2().config, { recursive: true });
+    mkdirSync6(getCleoPlatformPaths2().config, { recursive: true });
     const temp = tempTargetPath();
-    writeFileSync4(temp, raw, { mode: 420 });
+    writeFileSync5(temp, raw, { mode: 420 });
     renameSync4(temp, target);
     stampMarker(marker16);
     try {
@@ -41158,7 +41986,7 @@ function migrateGlobalConfigToConfigDir() {
   } catch (err) {
     try {
       const temp = tempTargetPath();
-      if (existsSync19(temp)) unlinkSync5(temp);
+      if (existsSync20(temp)) unlinkSync5(temp);
     } catch {
     }
     console.error(
@@ -41169,8 +41997,8 @@ function migrateGlobalConfigToConfigDir() {
 }
 function stampMarker(markerPath) {
   try {
-    mkdirSync5(join20(getCleoHome4(), MIGRATIONS_SUBDIR), { recursive: true });
-    writeFileSync4(markerPath, `${(/* @__PURE__ */ new Date()).toISOString()}
+    mkdirSync6(join22(getCleoHome5(), MIGRATIONS_SUBDIR), { recursive: true });
+    writeFileSync5(markerPath, `${(/* @__PURE__ */ new Date()).toISOString()}
 `, { mode: 420 });
   } catch {
   }
@@ -41178,7 +42006,7 @@ function stampMarker(markerPath) {
 function backupSourceQuiet(source) {
   try {
     const backup = `${source}${BACKUP_SUFFIX}`;
-    if (existsSync19(backup)) return;
+    if (existsSync20(backup)) return;
     renameSync4(source, backup);
   } catch {
   }
@@ -41201,20 +42029,20 @@ var init_global_config_migration = __esm({
 });
 
 // packages/core/src/llm/legacy-flat-key-import.ts
-import { existsSync as existsSync20, readFileSync as readFileSync11, renameSync as renameSync5, writeFileSync as writeFileSync5 } from "node:fs";
-import { join as join21 } from "node:path";
-import { getCleoHome as getCleoHome5 } from "@cleocode/paths";
+import { existsSync as existsSync21, readFileSync as readFileSync11, renameSync as renameSync5, writeFileSync as writeFileSync6 } from "node:fs";
+import { join as join23 } from "node:path";
+import { getCleoHome as getCleoHome6 } from "@cleocode/paths";
 function migrationPaths() {
-  const home = getCleoHome5();
+  const home = getCleoHome6();
   return {
-    flatPath: join21(home, "anthropic-key"),
-    bakPath: join21(home, `anthropic-key${LEGACY_FLAT_KEY_BAK_SUFFIX}`),
-    markerPath: join21(home, LEGACY_FLAT_KEY_MARKER)
+    flatPath: join23(home, "anthropic-key"),
+    bakPath: join23(home, `anthropic-key${LEGACY_FLAT_KEY_BAK_SUFFIX}`),
+    markerPath: join23(home, LEGACY_FLAT_KEY_MARKER)
   };
 }
 function writeMarker(markerPath) {
   try {
-    writeFileSync5(markerPath, `${(/* @__PURE__ */ new Date()).toISOString()}
+    writeFileSync6(markerPath, `${(/* @__PURE__ */ new Date()).toISOString()}
 `, {
       encoding: "utf-8",
       flag: "wx",
@@ -41230,7 +42058,7 @@ function writeMarker(markerPath) {
 }
 function readFlatKey(flatPath) {
   try {
-    if (!existsSync20(flatPath)) return null;
+    if (!existsSync21(flatPath)) return null;
     const raw = readFileSync11(flatPath, "utf-8").trim();
     return raw || null;
   } catch (err) {
@@ -41243,7 +42071,7 @@ function readFlatKey(flatPath) {
 }
 async function importLegacyFlatAnthropicKey() {
   const { flatPath, bakPath, markerPath } = migrationPaths();
-  if (existsSync20(markerPath)) {
+  if (existsSync21(markerPath)) {
     return { status: "marker-present", flatPath, bakPath: null, markerPath };
   }
   let existing = null;
@@ -41260,7 +42088,7 @@ async function importLegacyFlatAnthropicKey() {
     writeMarker(markerPath);
     return { status: "already-imported", flatPath, bakPath: null, markerPath };
   }
-  if (!existsSync20(flatPath)) {
+  if (!existsSync21(flatPath)) {
     writeMarker(markerPath);
     return { status: "no-flat-file", flatPath, bakPath: null, markerPath };
   }
@@ -41337,15 +42165,15 @@ __export(credentials_exports, {
   resolveProviderStatus: () => resolveProviderStatus,
   storeAnthropicApiKey: () => storeAnthropicApiKey
 });
-import { existsSync as existsSync21, mkdirSync as mkdirSync6, readFileSync as readFileSync12, writeFileSync as writeFileSync6 } from "node:fs";
-import { join as join22 } from "node:path";
-import { getCleoHome as getCleoHome6 } from "@cleocode/paths";
+import { existsSync as existsSync22, mkdirSync as mkdirSync7, readFileSync as readFileSync12, writeFileSync as writeFileSync7 } from "node:fs";
+import { join as join24 } from "node:path";
+import { getCleoHome as getCleoHome7 } from "@cleocode/paths";
 function globalConfigPath() {
   return configDirGlobalConfigPath();
 }
 function projectConfigPath(projectRoot) {
   const cleoDir = process.env["CLEO_DIR"] ?? ".cleo";
-  return join22(projectRoot, cleoDir, "config.json");
+  return join24(projectRoot, cleoDir, "config.json");
 }
 function readGlobalProviderKey(provider) {
   ensureGlobalConfigMigrated();
@@ -41355,8 +42183,8 @@ function readGlobalProviderKey(provider) {
 }
 function readFlatAnthropicKey() {
   try {
-    const keyFile = join22(getCleoHome6(), "anthropic-key");
-    if (!existsSync21(keyFile)) return null;
+    const keyFile = join24(getCleoHome7(), "anthropic-key");
+    if (!existsSync22(keyFile)) return null;
     const stored = readFileSync12(keyFile, "utf-8").trim();
     return stored || null;
   } catch {
@@ -41365,7 +42193,7 @@ function readFlatAnthropicKey() {
 }
 function readProviderKeyFromConfig(configFile, provider) {
   try {
-    if (!existsSync21(configFile)) return null;
+    if (!existsSync22(configFile)) return null;
     const raw = readFileSync12(configFile, "utf-8");
     const config2 = JSON.parse(raw);
     const llm = config2["llm"];
@@ -41537,12 +42365,12 @@ function resolveProviderStatus(provider) {
   return { provider, resolvedSource, hasCredential: true };
 }
 function storeAnthropicApiKey(apiKey) {
-  const dir = getCleoHome6();
-  if (!existsSync21(dir)) {
-    mkdirSync6(dir, { recursive: true });
+  const dir = getCleoHome7();
+  if (!existsSync22(dir)) {
+    mkdirSync7(dir, { recursive: true });
   }
-  const keyFile = join22(dir, "anthropic-key");
-  writeFileSync6(keyFile, apiKey.trim(), { mode: 384 });
+  const keyFile = join24(dir, "anthropic-key");
+  writeFileSync7(keyFile, apiKey.trim(), { mode: 384 });
 }
 function clearAnthropicKeyCache() {
 }
@@ -41605,17 +42433,17 @@ __export(credentials_store_exports, {
   pickCredentialForProviderSync: () => pickCredentialForProviderSync,
   removeCredential: () => removeCredential
 });
-import { chmodSync, existsSync as existsSync22, mkdirSync as mkdirSync7, readFileSync as readFileSync13, statSync as statSync6, writeFileSync as writeFileSync7 } from "node:fs";
-import { dirname as dirname8, join as join23 } from "node:path";
-import { getCleoHome as getCleoHome7 } from "@cleocode/paths";
+import { chmodSync, existsSync as existsSync23, mkdirSync as mkdirSync8, readFileSync as readFileSync13, statSync as statSync6, writeFileSync as writeFileSync8 } from "node:fs";
+import { dirname as dirname8, join as join25 } from "node:path";
+import { getCleoHome as getCleoHome8 } from "@cleocode/paths";
 function credentialsStorePath() {
-  return join23(getCleoHome7(), "llm-credentials.json");
+  return join25(getCleoHome8(), "llm-credentials.json");
 }
 function ensureFileInitialized(path) {
-  if (existsSync22(path)) return;
+  if (existsSync23(path)) return;
   const dir = dirname8(path);
-  if (!existsSync22(dir)) {
-    mkdirSync7(dir, { recursive: true, mode: 448 });
+  if (!existsSync23(dir)) {
+    mkdirSync8(dir, { recursive: true, mode: 448 });
   } else {
     try {
       chmodSync(dir, 448);
@@ -41623,7 +42451,7 @@ function ensureFileInitialized(path) {
     }
   }
   try {
-    writeFileSync7(path, `${JSON.stringify(emptyStore(), null, 2)}
+    writeFileSync8(path, `${JSON.stringify(emptyStore(), null, 2)}
 `, {
       encoding: "utf-8",
       flag: "wx",
@@ -41966,13 +42794,13 @@ var init_gemini = __esm({
 
 // packages/core/src/llm/stable-device-id.ts
 import { randomUUID as randomUUID2 } from "node:crypto";
-import { existsSync as existsSync23, mkdirSync as mkdirSync8, readFileSync as readFileSync14, renameSync as renameSync6, writeFileSync as writeFileSync8 } from "node:fs";
-import { dirname as dirname9, join as join24 } from "node:path";
-import { getCleoHome as getCleoHome8 } from "@cleocode/paths";
+import { existsSync as existsSync24, mkdirSync as mkdirSync9, readFileSync as readFileSync14, renameSync as renameSync6, writeFileSync as writeFileSync9 } from "node:fs";
+import { dirname as dirname9, join as join26 } from "node:path";
+import { getCleoHome as getCleoHome9 } from "@cleocode/paths";
 function getStableDeviceId() {
   if (_cachedDeviceId !== null) return _cachedDeviceId;
-  const path = join24(getCleoHome8(), DEVICE_ID_FILE);
-  if (existsSync23(path)) {
+  const path = join26(getCleoHome9(), DEVICE_ID_FILE);
+  if (existsSync24(path)) {
     try {
       const raw = readFileSync14(path, "utf-8").trim();
       if (raw.length > 0) {
@@ -41985,11 +42813,11 @@ function getStableDeviceId() {
   const fresh = randomUUID2();
   try {
     const dir = dirname9(path);
-    if (!existsSync23(dir)) {
-      mkdirSync8(dir, { recursive: true });
+    if (!existsSync24(dir)) {
+      mkdirSync9(dir, { recursive: true });
     }
     const tmpPath = `${path}.tmp.${process.pid}`;
-    writeFileSync8(tmpPath, fresh, { mode: 384 });
+    writeFileSync9(tmpPath, fresh, { mode: 384 });
     renameSync6(tmpPath, path);
   } catch {
   }
@@ -42287,14 +43115,14 @@ var init_xai = __esm({
 });
 
 // packages/core/src/llm/provider-registry/loader.ts
-import { readdirSync as readdirSync5, statSync as statSync7 } from "node:fs";
-import { join as join25 } from "node:path";
+import { readdirSync as readdirSync6, statSync as statSync7 } from "node:fs";
+import { join as join27 } from "node:path";
 import { pathToFileURL } from "node:url";
 function isPluginFile(filename) {
   return PLUGIN_EXTENSIONS.some((ext) => filename.endsWith(ext));
 }
 function getPluginDir() {
-  return join25(getCleoHome(), "plugins", "model-providers");
+  return join27(getCleoHome(), "plugins", "model-providers");
 }
 async function loadOnePlugin(absPath, api) {
   let mod;
@@ -42336,19 +43164,19 @@ async function loadOnePlugin(absPath, api) {
 async function scanAndLoadPlugins(pluginDir, api) {
   let entries;
   try {
-    entries = readdirSync5(pluginDir);
+    entries = readdirSync6(pluginDir);
   } catch {
     return;
   }
   const pluginFiles = entries.filter((name15) => !name15.startsWith(".") && isPluginFile(name15)).filter((name15) => {
     try {
-      return statSync7(join25(pluginDir, name15)).isFile();
+      return statSync7(join27(pluginDir, name15)).isFile();
     } catch {
       return false;
     }
   }).sort();
   for (const filename of pluginFiles) {
-    await loadOnePlugin(join25(pluginDir, filename), api);
+    await loadOnePlugin(join27(pluginDir, filename), api);
   }
 }
 async function runDiscovery(registerProvider2, builtins) {
@@ -42451,15 +43279,15 @@ var init_provider_registry = __esm({
 });
 
 // packages/core/src/llm/rate-limit-guard.ts
-import { existsSync as existsSync24, mkdirSync as mkdirSync9, unlinkSync as unlinkSync6 } from "node:fs";
-import { join as join26 } from "node:path";
-import { getCleoHome as getCleoHome9 } from "@cleocode/paths";
+import { existsSync as existsSync25, mkdirSync as mkdirSync10, unlinkSync as unlinkSync6 } from "node:fs";
+import { join as join28 } from "node:path";
+import { getCleoHome as getCleoHome10 } from "@cleocode/paths";
 function sanitize(value) {
   return value.replace(/[^a-zA-Z0-9_-]/g, "_");
 }
 function rateLimitStatePath(provider, label) {
-  const dir = join26(getCleoHome9(), "rate-limit-state");
-  return join26(dir, `${sanitize(provider)}-${sanitize(label)}.json`);
+  const dir = join28(getCleoHome10(), "rate-limit-state");
+  return join28(dir, `${sanitize(provider)}-${sanitize(label)}.json`);
 }
 function parseResetFromHeaders(headers) {
   const get = (k) => {
@@ -42506,9 +43334,9 @@ async function recordRateLimit(provider, label, opts) {
     source = "default";
   }
   const filePath = rateLimitStatePath(provider, label);
-  const dir = join26(getCleoHome9(), "rate-limit-state");
-  if (!existsSync24(dir)) {
-    mkdirSync9(dir, { recursive: true });
+  const dir = join28(getCleoHome10(), "rate-limit-state");
+  if (!existsSync25(dir)) {
+    mkdirSync10(dir, { recursive: true });
   }
   const state = { resetAt, recordedAt: now, source };
   await withFileLock(filePath, () => {
@@ -43408,28 +44236,28 @@ var init_error_classifier = __esm({
 
 // packages/core/src/llm/catalog-cache.ts
 import {
-  existsSync as existsSync25,
-  mkdirSync as mkdirSync10,
-  readdirSync as readdirSync6,
+  existsSync as existsSync26,
+  mkdirSync as mkdirSync11,
+  readdirSync as readdirSync7,
   readFileSync as readFileSync15,
   statSync as statSync8,
   symlinkSync,
   unlinkSync as unlinkSync7,
-  writeFileSync as writeFileSync9
+  writeFileSync as writeFileSync10
 } from "node:fs";
 import { homedir as homedir4 } from "node:os";
-import { join as join27 } from "node:path";
+import { join as join29 } from "node:path";
 function getCatalogDir() {
   if (process.env["CLEO_DATA_DIR"]) {
-    return join27(process.env["CLEO_DATA_DIR"], "llm-catalog");
+    return join29(process.env["CLEO_DATA_DIR"], "llm-catalog");
   }
-  const xdg = process.env["XDG_DATA_HOME"] ?? join27(homedir4(), ".local", "share");
-  return join27(xdg, "cleo", "llm-catalog");
+  const xdg = process.env["XDG_DATA_HOME"] ?? join29(homedir4(), ".local", "share");
+  return join29(xdg, "cleo", "llm-catalog");
 }
 function findLatestCacheFile(dir) {
-  if (!existsSync25(dir)) return null;
-  const files = readdirSync6(dir).filter((f) => f.endsWith("-models.json")).map((f) => ({ name: f, mtime: statSync8(join27(dir, f)).mtimeMs })).sort((a, b) => b.mtime - a.mtime);
-  return files.length > 0 ? join27(dir, files[0].name) : null;
+  if (!existsSync26(dir)) return null;
+  const files = readdirSync7(dir).filter((f) => f.endsWith("-models.json")).map((f) => ({ name: f, mtime: statSync8(join29(dir, f)).mtimeMs })).sort((a, b) => b.mtime - a.mtime);
+  return files.length > 0 ? join29(dir, files[0].name) : null;
 }
 function readCacheFile(filePath) {
   try {
@@ -43447,14 +44275,14 @@ var init_catalog_cache = __esm({
 
 // packages/core/src/llm/model-metadata.ts
 import { readFileSync as readFileSync16 } from "node:fs";
-import { dirname as dirname10, join as join28 } from "node:path";
+import { dirname as dirname10, join as join30 } from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 function getCuratedTable() {
   if (_curated !== void 0) {
     return _curated;
   }
   const thisDir = dirname10(fileURLToPath3(import.meta.url));
-  const jsonPath = join28(thisDir, "curated-models.json");
+  const jsonPath = join30(thisDir, "curated-models.json");
   const raw = JSON.parse(readFileSync16(jsonPath, "utf-8"));
   _curated = raw.models;
   return _curated;
@@ -43539,7 +44367,7 @@ function storedToResolved(stored) {
     awsProfile: stored.metadata?.["awsProfile"] ?? null
   };
 }
-function sleep(ms) {
+function sleep2(ms) {
   return new Promise((resolve5) => setTimeout(resolve5, ms));
 }
 function backoffMs(policy, attempt) {
@@ -43677,7 +44505,7 @@ var init_concrete_session = __esm({
               throw err;
             }
             lastErr = err;
-            await sleep(backoffMs(policy, attempt));
+            await sleep2(backoffMs(policy, attempt));
           }
         }
         throw lastErr;
@@ -47433,7 +48261,7 @@ function normalizeOllamaToolCall(tc) {
     arguments: JSON.stringify(tc.function.arguments ?? {})
   };
 }
-function sleep2(ms) {
+function sleep3(ms) {
   return new Promise((resolve5) => setTimeout(resolve5, ms));
 }
 var OLLAMA_DEFAULT_BASE_URL, MAX_RETRIES, INITIAL_BACKOFF_MS, RETRYABLE_STATUS_CODES, OllamaTransport;
@@ -47642,7 +48470,7 @@ var init_ollama2 = __esm({
         for (let attempt = 0; attempt < MAX_RETRIES; attempt++) {
           if (attempt > 0) {
             const delay = INITIAL_BACKOFF_MS * 2 ** (attempt - 1);
-            await sleep2(delay);
+            await sleep3(delay);
           }
           let response;
           try {
@@ -75655,7 +76483,7 @@ var init_catalog_model_resolver = __esm({
 });
 
 // packages/core/src/llm/cross-provider-selector.ts
-import { totalmem } from "node:os";
+import { totalmem as totalmem2 } from "node:os";
 async function probeOllamaAlive(baseUrl) {
   const cached2 = _ollamaProbeCache.get(baseUrl);
   if (cached2 && Date.now() - cached2.checkedAt < OLLAMA_PROBE_TTL_MS) {
@@ -75678,7 +76506,7 @@ async function probeOllamaAlive(baseUrl) {
   return alive;
 }
 function ollamaDefaultModelForTier(tier, ramBytesOverride) {
-  const ramBytes = ramBytesOverride ?? totalmem();
+  const ramBytes = ramBytesOverride ?? totalmem2();
   const gb = ramBytes / 1024 ** 3;
   if (gb >= 8) {
     return tier === "fast" || tier === "local" ? "gemma4:e2b" : "gemma4:e4b";
@@ -75802,7 +76630,7 @@ async function selectBestProvisioned(role, opts) {
   let model;
   if (winner.id === "ollama") {
     const ollamaProfile2 = await getProviderProfile2("ollama");
-    const ramBytes = totalmem();
+    const ramBytes = totalmem2();
     const gb = ramBytes / 1024 ** 3;
     if (gb >= 8) {
       model = (winner.tier === "fast" || taskTier === "fast" ? ollamaProfile2?.defaultAuxModel : ollamaProfile2?.defaultModel) ?? ollamaDefaultModelForTier(winner.tier);