@cleocode/core 2026.6.3 → 2026.6.5

package/dist/llm/plugin-facade.js

@@ -10652,6 +10652,13 @@ var init_plugin_llm = __esm({
   }
 });
 
+// packages/contracts/src/llm/system-resolver.ts
+var init_system_resolver = __esm({
+  "packages/contracts/src/llm/system-resolver.ts"() {
+    "use strict";
+  }
+});
+
 // packages/contracts/src/memory/observe.ts
 var BRAIN_OBSERVATION_SOURCE_TYPES;
 var init_observe = __esm({
@@ -12576,6 +12583,7 @@ var init_src = __esm({
     init_invariants();
     init_lafs();
     init_plugin_llm();
+    init_system_resolver();
     init_observe();
     init_migration_parity();
     init_mvi();
@@ -14523,7 +14531,7 @@ var init_sql = __esm({
         return new SQL([new StringChunk(str)]);
       }
       _sql.raw = raw;
-      function join26(chunks, separator) {
+      function join27(chunks, separator) {
         const result = [];
         for (const [i, chunk] of chunks.entries()) {
           if (i > 0 && separator !== void 0) result.push(separator);
@@ -14531,7 +14539,7 @@ var init_sql = __esm({
         }
         return new SQL(result);
       }
-      _sql.join = join26;
+      _sql.join = join27;
       function identifier(value) {
         return new Name(value);
       }
@@ -16918,7 +16926,7 @@ var init_select2 = __esm({
           const baseTableName = this.tableName;
           const tableName = getTableLikeName(table);
           for (const item of extractUsedTable(table)) this.usedTables.add(item);
-          if (typeof tableName === "string" && this.config.joins?.some((join26) => join26.alias === tableName)) throw new Error(`Alias "${tableName}" is already used in this query`);
+          if (typeof tableName === "string" && this.config.joins?.some((join27) => join27.alias === tableName)) throw new Error(`Alias "${tableName}" is already used in this query`);
           if (!this.isPartialSelect) {
             if (Object.keys(this.joinsNotNullableMap).length === 1 && typeof baseTableName === "string") this.config.fields = { [baseTableName]: this.config.fields };
             if (typeof tableName === "string" && !is(table, SQL)) {
@@ -20728,7 +20736,7 @@ var init_dialect = __esm({
           if (!joins2) return;
           const withEntries = Object.entries(joins2).filter(([_, v]) => v);
           if (!withEntries.length) return;
-          return sql.join(withEntries.map(([k, join26]) => {
+          return sql.join(withEntries.map(([k, join27]) => {
             const relation = tableConfig.relations[k];
             const isSingle2 = is(relation, One);
             const targetTable = aliasedTable(relation.targetTable, `d${currentDepth + 1}`);
@@ -20739,7 +20747,7 @@ var init_dialect = __esm({
               table: targetTable,
               mode: isSingle2 ? "first" : "many",
               schema,
-              queryConfig: join26,
+              queryConfig: join27,
               tableConfig: schema[relation.targetTableName],
               relationWhere: filter,
               isNested: true,
@@ -20753,7 +20761,7 @@ var init_dialect = __esm({
               key: k,
               selection: innerQuery.selection,
               isArray: !isSingle2,
-              isOptional: (relation.optional ?? false) || join26 !== true && !!join26.where
+              isOptional: (relation.optional ?? false) || join27 !== true && !!join27.where
             });
             const jsonColumns = sql.join(innerQuery.selection.map((s) => {
               return sql`${sql.raw(this.escapeString(s.key))}, ${s.selection ? sql`${jsonb3}(${sql.identifier(s.key)})` : sql.identifier(s.key)}`;
@@ -21574,7 +21582,7 @@ var init_update = __esm({
       createJoin(joinType) {
         return ((table, on) => {
           const tableName = getTableLikeName(table);
-          if (typeof tableName === "string" && this.config.joins.some((join26) => join26.alias === tableName)) throw new Error(`Alias "${tableName}" is already used in this query`);
+          if (typeof tableName === "string" && this.config.joins.some((join27) => join27.alias === tableName)) throw new Error(`Alias "${tableName}" is already used in this query`);
           if (typeof on === "function") {
             const from = this.config.from ? is(table, SQLiteTable) ? table[Table.Symbol.Columns] : is(table, Subquery) ? table._.selectedFields : is(table, SQLiteViewBase) ? table[ViewBaseConfig].selectedFields : void 0 : void 0;
             on = on(new Proxy(this.config.table[Table.Symbol.Columns], new SelectionProxyHandler({
@@ -22552,8 +22560,8 @@ function probeAndMarkApplied(nativeDb, migration, logSubsystem) {
   });
   if (allAltersPresent && allTablesPresent && allIndexesPresent && allTriggersPresent) {
     insertJournalEntry(nativeDb, migration.hash, migration.folderMillis, migration.name ?? "");
-    const log4 = getLogger(logSubsystem);
-    log4.debug(
+    const log5 = getLogger(logSubsystem);
+    log5.debug(
       {
         migration: migration.name,
         alters: alterTargets.length,
@@ -22593,14 +22601,14 @@ function reconcileJournal(nativeDb, migrationsFolder, existenceTable2, logSubsys
     if (hasOrphanedEntries) {
       const dbHashes = new Set(dbEntries.map((e) => e.hash));
       const allLocalHashesPresentInDb = localMigrations.every((m) => dbHashes.has(m.hash));
-      const log4 = getLogger(logSubsystem);
+      const log5 = getLogger(logSubsystem);
       if (allLocalHashesPresentInDb) {
-        log4.debug(
+        log5.debug(
           { extra: orphanedEntries.length },
           `Migration journal has ${orphanedEntries.length} entries for migrations not known to this install (DB is ahead). Skipping reconciliation.`
         );
       } else {
-        log4.warn(
+        log5.warn(
           { orphaned: orphanedEntries.length },
           `Detected ${orphanedEntries.length} true-orphan journal entries from a previous CLEO lineage. Reconciling via DDL probe.`
         );
@@ -22636,8 +22644,8 @@ function reconcileJournal(nativeDb, migrationsFolder, existenceTable2, logSubsys
       if (alterMatches.length === 0) {
         const stripped = fullSql.replace(/--[^\n]*/g, "").replace(/\/\*[\s\S]*?\*\//g, "").trim();
         if (stripped === "") {
-          const log4 = getLogger(logSubsystem);
-          log4.debug(
+          const log5 = getLogger(logSubsystem);
+          log5.debug(
             { migration: migration.name },
             `Migration ${migration.name} is a comment-only baseline marker \u2014 marking applied on existing DB.`
           );
@@ -22674,8 +22682,8 @@ function reconcileJournal(nativeDb, migrationsFolder, existenceTable2, logSubsys
         }
       }
       if (missingColumns.length === 0) {
-        const log4 = getLogger(logSubsystem);
-        log4.warn(
+        const log5 = getLogger(logSubsystem);
+        log5.warn(
           { migration: migration.name, columns: alterMatches },
           `Detected partially-applied migration ${migration.name} \u2014 columns exist but journal entry missing. Auto-reconciling.`
         );
@@ -22683,8 +22691,8 @@ function reconcileJournal(nativeDb, migrationsFolder, existenceTable2, logSubsys
         continue;
       }
       if (existingColumns.length > 0 && missingColumns.length > 0) {
-        const log4 = getLogger(logSubsystem);
-        log4.warn(
+        const log5 = getLogger(logSubsystem);
+        log5.warn(
           {
             migration: migration.name,
             existingColumns: existingColumns.map((c) => `${c.table}.${c.column}`),
@@ -22696,12 +22704,12 @@ function reconcileJournal(nativeDb, migrationsFolder, existenceTable2, logSubsys
           if (!tableExists(nativeDb, table)) continue;
           try {
             nativeDb.exec(`ALTER TABLE ${table} ADD COLUMN ${column}${ddl ? ` ${ddl}` : ""}`);
-            log4.warn(
+            log5.warn(
               { migration: migration.name, table, column },
               `T920: Added missing column ${table}.${column} to complete partial migration.`
             );
           } catch {
-            log4.warn(
+            log5.warn(
               { migration: migration.name, table, column },
               `T920: Could not add missing column ${table}.${column} \u2014 will let Drizzle migrate() handle it.`
             );
@@ -22721,8 +22729,8 @@ function reconcileJournal(nativeDb, migrationsFolder, existenceTable2, logSubsys
     for (const entry of unnamedEntries) {
       const migrationName = hashToName.get(entry.hash);
       if (!migrationName) continue;
-      const log4 = getLogger(logSubsystem);
-      log4.debug(
+      const log5 = getLogger(logSubsystem);
+      log5.debug(
         { id: entry.id, hash: entry.hash, name: migrationName },
         `Backfilling missing name on journal entry id=${entry.id} (Drizzle v1 beta legacy compat).`
       );
@@ -22797,13 +22805,13 @@ function ensureColumns(nativeDb, tableName, requiredColumns, logSubsystem, conte
   const existingCols = new Set(columns.map((c) => c.name));
   for (const req of requiredColumns) {
     if (!existingCols.has(req.name)) {
-      const log4 = getLogger(logSubsystem);
+      const log5 = getLogger(logSubsystem);
       const message = `Adding missing column ${tableName}.${req.name} via ALTER TABLE`;
       const fields = { column: req.name, context };
       if (context === "fresh") {
-        log4.error(fields, `${message} \u2014 MIGRATION DEFECT (fresh DB should not need repair)`);
+        log5.error(fields, `${message} \u2014 MIGRATION DEFECT (fresh DB should not need repair)`);
       } else {
-        log4.warn(fields, message);
+        log5.warn(fields, message);
       }
       nativeDb.exec(`ALTER TABLE ${tableName} ADD COLUMN ${req.name} ${req.ddl}`);
     }
@@ -31228,6 +31236,151 @@ var init_ensure_config = __esm({
   }
 });
 
+// packages/core/src/store/exodus/archive.ts
+import {
+  copyFileSync,
+  existsSync as existsSync3,
+  mkdirSync,
+  renameSync,
+  unlinkSync,
+  writeFileSync
+} from "node:fs";
+import { basename as basename3, join as join6 } from "node:path";
+function scopeBaseDir(scope, cwd) {
+  return scope === "project" ? resolveCleoDir(cwd) : getCleoHome();
+}
+function exodusArchiveDir(scope, cwd) {
+  return join6(scopeBaseDir(scope, cwd), ARCHIVE_DIR_NAME);
+}
+function exodusMarkerPath(scope, cwd) {
+  return join6(scopeBaseDir(scope, cwd), MARKER_FILENAME_BY_SCOPE[scope]);
+}
+function hasExodusCompleteMarker(scope, cwd) {
+  try {
+    return existsSync3(exodusMarkerPath(scope, cwd));
+  } catch {
+    return false;
+  }
+}
+function writeExodusCompleteMarker(scope, archivedSources, cwd) {
+  const markerPath = exodusMarkerPath(scope, cwd);
+  const baseDir = scopeBaseDir(scope, cwd);
+  mkdirSync(baseDir, { recursive: true });
+  const marker = {
+    version: 1,
+    scope,
+    cleoVersion: getCleoVersion(),
+    completedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    archivedSources: [...archivedSources]
+  };
+  const tmpPath = `${markerPath}.tmp`;
+  writeFileSync(tmpPath, JSON.stringify(marker, null, 2) + "\n", "utf8");
+  renameSync(tmpPath, markerPath);
+  log.info({ scope, markerPath, archivedSources }, "exodus: wrote completion marker");
+  return markerPath;
+}
+function moveFileInto(srcPath, destDir) {
+  mkdirSync(destDir, { recursive: true });
+  let dest = join6(destDir, basename3(srcPath));
+  if (existsSync3(dest)) {
+    const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "").replace(/Z$/, "Z");
+    dest = join6(destDir, `${basename3(srcPath)}.${stamp}`);
+  }
+  try {
+    renameSync(srcPath, dest);
+  } catch {
+    copyFileSync(srcPath, dest);
+    unlinkSync(srcPath);
+  }
+  return dest;
+}
+function archiveSourceDb(source, cwd) {
+  if (!existsSync3(source.path)) {
+    return { name: source.name, sourcePath: source.path, archivedTo: null, action: "absent" };
+  }
+  const destDir = exodusArchiveDir(source.targetScope, cwd);
+  const archivedTo = moveFileInto(source.path, destDir);
+  for (const suffix of SIDECAR_SUFFIXES) {
+    const sidecar = `${source.path}${suffix}`;
+    if (existsSync3(sidecar)) {
+      try {
+        moveFileInto(sidecar, destDir);
+      } catch (err) {
+        log.warn(
+          { err, sidecar, sourceName: source.name },
+          "exodus-archive: failed to archive sidecar (non-fatal)"
+        );
+      }
+    }
+  }
+  log.info(
+    { sourceName: source.name, sourcePath: source.path, archivedTo, scope: source.targetScope },
+    "exodus-archive: archived legacy source DB"
+  );
+  return {
+    name: source.name,
+    sourcePath: source.path,
+    archivedTo,
+    action: "archived"
+  };
+}
+function archiveMigratedSources(consumed, cwd) {
+  const results = [];
+  const scopes = /* @__PURE__ */ new Set();
+  for (const source of consumed) {
+    scopes.add(source.targetScope);
+    results.push(archiveSourceDb(source, cwd));
+  }
+  const markersWritten = [];
+  for (const scope of scopes) {
+    const archivedForScope = consumed.filter((s) => s.targetScope === scope).map((s) => s.name);
+    writeExodusCompleteMarker(scope, archivedForScope, cwd);
+    markersWritten.push(scope);
+  }
+  return { sources: results, markersWritten };
+}
+function detectStrandedResidue(sources, cwd) {
+  const markedScopes = /* @__PURE__ */ new Set();
+  for (const scope of ["project", "global"]) {
+    if (hasExodusCompleteMarker(scope, cwd)) markedScopes.add(scope);
+  }
+  if (markedScopes.size === 0) return [];
+  const stranded = [];
+  for (const source of sources) {
+    if (!markedScopes.has(source.targetScope)) continue;
+    if (existsSync3(source.path)) {
+      stranded.push({ name: source.name, path: source.path, scope: source.targetScope });
+    }
+  }
+  return stranded;
+}
+function archiveStrandedResidue(stranded, sources, cwd) {
+  const byName = new Map(sources.map((s) => [s.name, s]));
+  const results = [];
+  for (const entry of stranded) {
+    const descriptor = byName.get(entry.name);
+    if (descriptor === void 0) continue;
+    results.push(archiveSourceDb(descriptor, cwd));
+  }
+  return results;
+}
+var log, ARCHIVE_DIR_NAME, MARKER_FILENAME_BY_SCOPE, SIDECAR_SUFFIXES;
+var init_archive2 = __esm({
+  "packages/core/src/store/exodus/archive.ts"() {
+    "use strict";
+    init_logger2();
+    init_paths();
+    init_ensure_config();
+    log = getLogger("exodus-archive");
+    ARCHIVE_DIR_NAME = "_archive";
+    MARKER_FILENAME_BY_SCOPE = {
+      project: "exodus-complete",
+      global: "exodus-complete"
+    };
+    SIDECAR_SUFFIXES = ["-wal", "-shm"];
+  }
+});
+
 // packages/core/src/project-info.ts
 var init_project_info = __esm({
   "packages/core/src/project-info.ts"() {
@@ -31622,15 +31775,15 @@ var init_types = __esm({
 
 // packages/core/src/store/exodus/migrate.ts
 import {
-  copyFileSync,
-  existsSync as existsSync3,
-  mkdirSync,
+  copyFileSync as copyFileSync2,
+  existsSync as existsSync4,
+  mkdirSync as mkdirSync2,
   readFileSync as readFileSync2,
-  renameSync,
-  unlinkSync,
-  writeFileSync
+  renameSync as renameSync2,
+  unlinkSync as unlinkSync2,
+  writeFileSync as writeFileSync2
 } from "node:fs";
-import { join as join6 } from "node:path";
+import { join as join7 } from "node:path";
 function getSqliteVersion(db) {
   try {
     const row = db.prepare("SELECT sqlite_version() AS v").get();
@@ -31646,14 +31799,14 @@ function listTables(db) {
   return rows.map((r) => r.name);
 }
 function writeJournal(stagingDir, journal) {
-  const journalPath = join6(stagingDir, JOURNAL_FILENAME);
+  const journalPath = join7(stagingDir, JOURNAL_FILENAME);
   const tmpPath = `${journalPath}.tmp`;
-  writeFileSync(tmpPath, JSON.stringify(journal, null, 2) + "\n", "utf8");
-  renameSync(tmpPath, journalPath);
+  writeFileSync2(tmpPath, JSON.stringify(journal, null, 2) + "\n", "utf8");
+  renameSync2(tmpPath, journalPath);
 }
 function readJournal(stagingDir) {
-  const journalPath = join6(stagingDir, JOURNAL_FILENAME);
-  if (!existsSync3(journalPath)) return null;
+  const journalPath = join7(stagingDir, JOURNAL_FILENAME);
+  if (!existsSync4(journalPath)) return null;
   try {
     return JSON.parse(readFileSync2(journalPath, "utf8"));
   } catch {
@@ -31661,17 +31814,17 @@ function readJournal(stagingDir) {
   }
 }
 function clearExodusJournal(stagingDir) {
-  const journalPath = join6(stagingDir, JOURNAL_FILENAME);
+  const journalPath = join7(stagingDir, JOURNAL_FILENAME);
   try {
-    if (!existsSync3(journalPath)) return false;
-    unlinkSync(journalPath);
-    log.info(
+    if (!existsSync4(journalPath)) return false;
+    unlinkSync2(journalPath);
+    log2.info(
       { stagingDir },
       "exodus: cleared migrate journal after abort/rollback \u2014 a retry will RE-COPY all tables"
     );
     return true;
   } catch (err) {
-    log.warn(
+    log2.warn(
       { err, stagingDir },
       'exodus: failed to clear migrate journal after rollback (a retry may skip already-"done" tables)'
     );
@@ -31696,11 +31849,11 @@ function lockPath(dbPath) {
 }
 function acquireAdvisoryLock(dbPath) {
   const lp = lockPath(dbPath);
-  writeFileSync(lp, JSON.stringify({ pid: process.pid, ts: (/* @__PURE__ */ new Date()).toISOString() }), "utf8");
+  writeFileSync2(lp, JSON.stringify({ pid: process.pid, ts: (/* @__PURE__ */ new Date()).toISOString() }), "utf8");
 }
 function releaseAdvisoryLock(dbPath) {
   try {
-    unlinkSync(lockPath(dbPath));
+    unlinkSync2(lockPath(dbPath));
   } catch {
   }
 }
@@ -31720,6 +31873,11 @@ function enumNormExpr(targetTableName, col, srcRef) {
   const fn = ENUM_NORMALIZATIONS.get(key);
   return fn ? fn(srcRef) : null;
 }
+function numericClampExpr(targetTableName, col, srcRef) {
+  const key = `${targetTableName}.${col}`;
+  const fn = NUMERIC_CLAMPS.get(key);
+  return fn ? fn(srcRef) : null;
+}
 function epochUnitForSource(sourceName) {
   const key = sourceName.toLowerCase();
   for (const [pattern, unit] of SOURCE_EPOCH_UNITS) {
@@ -31755,6 +31913,14 @@ function buildSelectExpr(attachAlias, legacyTable, targetTableName, col, srcType
     }
     return `${isoExpr} AS "${col}"`;
   }
+  const clampExpr = numericClampExpr(targetTableName, col, srcRef);
+  if (clampExpr !== null) {
+    if (isNotNullWithoutDefault) {
+      const defLiteral = typeDefaultLiteral(tgtInfo.type);
+      return `COALESCE(${clampExpr}, ${defLiteral}) AS "${col}"`;
+    }
+    return `${clampExpr} AS "${col}"`;
+  }
   const normExpr = enumNormExpr(targetTableName, col, srcRef);
   if (normExpr !== null) {
     if (isNotNullWithoutDefault) {
@@ -31772,7 +31938,7 @@ function buildSelectExpr(attachAlias, legacyTable, targetTableName, col, srcType
 function copyTableFromAttached(targetNativeDb, srcNativeDb, attachAlias, legacyTableName, sourceName, targetSchema = "main") {
   const resolution = resolveConsolidatedTableName(sourceName, legacyTableName);
   if (resolution.kind === "skip") {
-    log.warn(
+    log2.warn(
       { legacyTableName, sourceName, reason: resolution.reason },
       `Exodus: explicitly skipping table \u2014 ${resolution.reason}`
     );
@@ -31791,7 +31957,7 @@ function copyTableFromAttached(targetNativeDb, srcNativeDb, attachAlias, legacyT
   ).get();
   if (!existsRow) {
     const reason = `consolidated target '${targetTableName}' not found (mapped from legacy '${legacyTableName}')`;
-    log.warn(
+    log2.warn(
       { legacyTableName, targetTableName, sourceName, attachAlias, targetSchema },
       `Exodus: ${reason}`
     );
@@ -31802,13 +31968,13 @@ function copyTableFromAttached(targetNativeDb, srcNativeDb, attachAlias, legacyT
   const sharedColumns = srcPragma.map((r) => r.name).filter((col) => tgtColMap.has(col));
   if (sharedColumns.length === 0) {
     const reason = `no overlapping columns between source '${legacyTableName}' and target '${targetTableName}'`;
-    log.warn({ legacyTableName, targetTableName, sourceName }, `Exodus: ${reason}`);
+    log2.warn({ legacyTableName, targetTableName, sourceName }, `Exodus: ${reason}`);
     return { rowsCopied: 0, skipped: true, reason };
   }
   const srcOnlyColumns = srcPragma.map((r) => r.name).filter((c) => !tgtColMap.has(c));
   const tgtOnlyColumns = tgtPragma.map((r) => r.name).filter((c) => !srcColumns.has(c));
   if (srcOnlyColumns.length > 0 || tgtOnlyColumns.length > 0) {
-    log.info(
+    log2.info(
       { legacyTableName, targetTableName, sourceName, srcOnlyColumns, tgtOnlyColumns },
       "Exodus: column drift detected \u2014 copying intersection, dropping src-only cols, using defaults for tgt-only cols"
     );
@@ -31823,7 +31989,7 @@ function copyTableFromAttached(targetNativeDb, srcNativeDb, attachAlias, legacyT
       return isoGlobCols.has(col) && (upper.includes("INT") || upper === "" || upper === "NUMERIC");
     });
     if (coercedCols.length > 0) {
-      log.info(
+      log2.info(
         {
           legacyTableName,
           targetTableName,
@@ -31839,11 +32005,20 @@ function copyTableFromAttached(targetNativeDb, srcNativeDb, attachAlias, legacyT
     (col) => ENUM_NORMALIZATIONS.has(`${targetTableName}.${col}`)
   );
   if (normalizedCols.length > 0) {
-    log.info(
+    log2.info(
       { legacyTableName, targetTableName, sourceName, normalizedCols },
       `Exodus: applying enum-value normalization for ${normalizedCols.length} column(s) (T11547)`
     );
   }
+  const clampedCols = sharedColumns.filter(
+    (col) => NUMERIC_CLAMPS.has(`${targetTableName}.${col}`)
+  );
+  if (clampedCols.length > 0) {
+    log2.info(
+      { legacyTableName, targetTableName, sourceName, clampedCols },
+      `Exodus: applying non-finite numeric clamp for ${clampedCols.length} column(s) (T11782)`
+    );
+  }
   const selectExprs = sharedColumns.map((col) => {
     const srcType = srcTypeMap.get(col) ?? "";
     const tgtInfo = tgtColMap.get(col);
@@ -31880,13 +32055,13 @@ function copyTableFromAttached(targetNativeDb, srcNativeDb, attachAlias, legacyT
     const dropped = sourceCount - rowsCopied;
     if (rowsCopied === 0) {
       const reason = `INSERT OR IGNORE dropped ALL ${sourceCount} rows from '${legacyTableName}'\u2192'${targetTableName}' (rowsCopied=0, sourceCount=${sourceCount}). Likely a CHECK/type constraint violation \u2014 check epoch coercion or enum values.`;
-      log.error(
+      log2.error(
         { legacyTableName, targetTableName, sourceName, sourceCount, rowsCopied },
         `Exodus: ${reason}`
       );
       return { rowsCopied: 0, skipped: false, reason };
     }
-    log.warn(
+    log2.warn(
       { legacyTableName, targetTableName, sourceName, sourceCount, rowsCopied, dropped },
       `Exodus: INSERT OR IGNORE dropped ${dropped}/${sourceCount} rows from '${legacyTableName}'\u2192'${targetTableName}' \u2014 may be idempotent-resume dedup or a constraint violation; verify will confirm`
     );
@@ -31897,16 +32072,16 @@ function checkSchemaVersion(journal, forceCrossVersion) {
   if (journal.targetSchemaVersion !== EXODUS_TARGET_SCHEMA_VERSION) {
     const msg = `Schema version mismatch: journal=${journal.targetSchemaVersion}, expected=${EXODUS_TARGET_SCHEMA_VERSION}`;
     if (forceCrossVersion) {
-      log.warn(msg + " (--force-cross-version: continuing anyway)");
+      log2.warn(msg + " (--force-cross-version: continuing anyway)");
       return true;
     }
-    log.error(msg + " \u2014 pass --force-cross-version to override");
+    log2.error(msg + " \u2014 pass --force-cross-version to override");
     return false;
   }
   return true;
 }
 async function runExodusMigrate(plan, forceCrossVersion = false, onProgress) {
-  const { sources, stagingDir, diskPreflight, projectDbPath } = plan;
+  const { sources, stagingDir, diskPreflight, projectDbPath, globalDbPath } = plan;
   if (!diskPreflight) {
     return {
       ok: false,
@@ -31916,10 +32091,10 @@ async function runExodusMigrate(plan, forceCrossVersion = false, onProgress) {
       error: `Insufficient disk space: need \u22653\xD7 source size (${plan.totalSourceBytes} bytes source, ${plan.availableBytes} bytes available). Free up space or use a different storage location.`
     };
   }
-  mkdirSync(stagingDir, { recursive: true });
+  mkdirSync2(stagingDir, { recursive: true });
   let sqliteVersion = "unknown";
   for (const src of sources) {
-    if (existsSync3(src.path)) {
+    if (existsSync4(src.path)) {
       const snap = openCleoDbSnapshot(src.path, { readOnly: true });
       sqliteVersion = getSqliteVersion(snap.db);
       snap.close();
@@ -31944,6 +32119,8 @@ async function runExodusMigrate(plan, forceCrossVersion = false, onProgress) {
   const backupPaths = [];
   const allTableResults = [];
   const lockedPaths = [];
+  let projectHandle = null;
+  let globalHandle = null;
   try {
     let extractNativeDb2 = function(handle) {
       const drizzleHandle = handle.db;
@@ -31958,24 +32135,28 @@ async function runExodusMigrate(plan, forceCrossVersion = false, onProgress) {
     };
     var extractNativeDb = extractNativeDb2;
     for (const src of sources) {
-      if (!existsSync3(src.path)) continue;
-      const backupDest = join6(stagingDir, `${src.name.replace(/[^a-z0-9-]/g, "_")}-backup.db`);
-      if (!existsSync3(backupDest)) {
+      if (!existsSync4(src.path)) continue;
+      const backupDest = join7(stagingDir, `${src.name.replace(/[^a-z0-9-]/g, "_")}-backup.db`);
+      if (!existsSync4(backupDest)) {
         onProgress?.(`Backing up ${src.name} \u2192 staging dir\u2026`);
-        copyFileSync(src.path, backupDest);
+        copyFileSync2(src.path, backupDest);
         backupPaths.push(backupDest);
       }
       acquireAdvisoryLock(src.path);
       lockedPaths.push(src.path);
     }
-    onProgress?.("Opening consolidated project-scope cleo.db (running migrations)\u2026");
-    const projectHandle = await openDualScopeDb("project");
-    onProgress?.("Opening consolidated global-scope cleo.db (running migrations)\u2026");
-    const globalHandle = await openDualScopeDb("global");
+    onProgress?.("Opening DEDICATED project-scope cleo.db connection (running migrations)\u2026");
+    projectHandle = await openDualScopeDbAtPath("project", projectDbPath, void 0, {
+      dedicated: true
+    });
+    onProgress?.("Opening DEDICATED global-scope cleo.db connection (running migrations)\u2026");
+    globalHandle = await openDualScopeDbAtPath("global", globalDbPath, void 0, {
+      dedicated: true
+    });
     const projectNative = extractNativeDb2(projectHandle);
     const globalNative = extractNativeDb2(globalHandle);
-    const projectSources = sources.filter((s) => s.targetScope === "project" && existsSync3(s.path));
-    const globalSources = sources.filter((s) => s.targetScope === "global" && existsSync3(s.path));
+    const projectSources = sources.filter((s) => s.targetScope === "project" && existsSync4(s.path));
+    const globalSources = sources.filter((s) => s.targetScope === "global" && existsSync4(s.path));
     await migrateScope(
       "project",
       projectSources,
@@ -31997,14 +32178,20 @@ async function runExodusMigrate(plan, forceCrossVersion = false, onProgress) {
     );
     journal.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
     writeJournal(stagingDir, journal);
-    projectHandle.close();
-    globalHandle.close();
     return { ok: true, tables: allTableResults, stagingDir, backupPaths };
   } catch (err) {
     const error = err instanceof Error ? err.message : String(err);
-    log.error({ err }, "Exodus migration failed");
+    log2.error({ err }, "Exodus migration failed");
     return { ok: false, tables: allTableResults, stagingDir, backupPaths, error };
   } finally {
+    try {
+      projectHandle?.close();
+    } catch {
+    }
+    try {
+      globalHandle?.close();
+    } catch {
+    }
     for (const p of lockedPaths) {
       releaseAdvisoryLock(p);
     }
@@ -32014,7 +32201,7 @@ async function migrateScope(scope, sources, targetNativeDb, journal, stagingDir,
   if (sources.length === 0) return;
   onProgress?.(`Migrating ${scope}-scope sources\u2026`);
   targetNativeDb.exec("PRAGMA foreign_keys = OFF");
-  log.info({ scope }, "Exodus: foreign_keys=OFF for bulk copy (T11533 FK-defer)");
+  log2.info({ scope }, "Exodus: foreign_keys=OFF for bulk copy (T11533 FK-defer)");
   try {
     for (let i = 0; i < sources.length; i++) {
       const src = sources[i];
@@ -32076,12 +32263,12 @@ async function migrateScope(scope, sources, targetNativeDb, journal, stagingDir,
                 errorMsg = copyResult.reason;
                 skipped = true;
               } else if (copyResult.reason) {
-                status = "skipped";
+                status = "partial";
                 errorMsg = copyResult.reason;
               }
             } catch (err) {
               const msg = err instanceof Error ? err.message : String(err);
-              log.warn({ tableName, sourceDb: src.name, err }, "Table copy failed \u2014 skipping");
+              log2.warn({ tableName, sourceDb: src.name, err }, "Table copy failed \u2014 skipping");
               status = "skipped";
               errorMsg = msg;
               skipped = true;
@@ -32129,7 +32316,7 @@ async function migrateScope(scope, sources, targetNativeDb, journal, stagingDir,
           targetNativeDb.exec(`DETACH DATABASE "${attachAlias}"`);
           onProgress?.(`  [${src.name}] Detached "${attachAlias}"`);
         } catch (detachErr) {
-          log.warn(
+          log2.warn(
             { attachAlias, sourceDb: src.name, err: detachErr },
             "DETACH failed \u2014 alias will be released on DB close"
           );
@@ -32139,7 +32326,7 @@ async function migrateScope(scope, sources, targetNativeDb, journal, stagingDir,
             targetNativeDb.exec(`DETACH DATABASE "${crossAlias}"`);
             onProgress?.(`  [${src.name}] Cross-scope target detached "${crossAlias}"`);
           } catch (detachErr) {
-            log.warn(
+            log2.warn(
               { crossAlias, sourceDb: src.name, err: detachErr },
               "Cross-scope DETACH failed \u2014 alias will be released on DB close"
             );
@@ -32151,28 +32338,28 @@ async function migrateScope(scope, sources, targetNativeDb, journal, stagingDir,
     try {
       const orphans = targetNativeDb.prepare("PRAGMA foreign_key_check").all();
       if (orphans.length > 0) {
-        log.warn(
+        log2.warn(
           { scope, orphanCount: orphans.length, sample: orphans.slice(0, 5) },
           `Exodus: PRAGMA foreign_key_check found ${orphans.length} orphan row(s) after bulk copy \u2014 these are genuine data orphans (not ordering artifacts)`
         );
       } else {
-        log.info({ scope }, "Exodus: PRAGMA foreign_key_check PASSED \u2014 no orphan rows");
+        log2.info({ scope }, "Exodus: PRAGMA foreign_key_check PASSED \u2014 no orphan rows");
       }
     } catch (checkErr) {
-      log.warn(
+      log2.warn(
         { scope, err: checkErr },
         "Exodus: PRAGMA foreign_key_check failed (non-fatal) \u2014 target schema may not have FK constraints enabled"
       );
     }
     try {
       targetNativeDb.exec("PRAGMA foreign_keys = ON");
-      log.info({ scope }, "Exodus: foreign_keys=ON restored after bulk copy");
+      log2.info({ scope }, "Exodus: foreign_keys=ON restored after bulk copy");
     } catch (fkErr) {
-      log.warn({ scope, err: fkErr }, "Exodus: could not restore foreign_keys=ON (non-fatal)");
+      log2.warn({ scope, err: fkErr }, "Exodus: could not restore foreign_keys=ON (non-fatal)");
     }
   }
 }
-var log, LOCK_SENTINEL_SUFFIX, JOURNAL_FILENAME, ENUM_NORMALIZATIONS, ISO_CHECK_REGEX, SOURCE_EPOCH_UNITS, EPOCH_SECONDS_THRESHOLD;
+var log2, LOCK_SENTINEL_SUFFIX, JOURNAL_FILENAME, ENUM_NORMALIZATIONS, NUMERIC_CLAMPS, ISO_CHECK_REGEX, SOURCE_EPOCH_UNITS, EPOCH_SECONDS_THRESHOLD;
 var init_migrate = __esm({
   "packages/core/src/store/exodus/migrate.ts"() {
     "use strict";
@@ -32182,7 +32369,7 @@ var init_migrate = __esm({
     init_open_cleo_db();
     init_table_name_map();
     init_types();
-    log = getLogger("exodus-migrate");
+    log2 = getLogger("exodus-migrate");
     LOCK_SENTINEL_SUFFIX = ".exodus-lock";
     JOURNAL_FILENAME = "exodus-journal.json";
     ENUM_NORMALIZATIONS = /* @__PURE__ */ new Map([
@@ -32274,6 +32461,15 @@ var init_migrate = __esm({
       //  brain target = runtime shape with no CHECK; legacy values like 'accepted',
       //  'rejected', 'prime' now survive VERBATIM instead of being coerced.)
     ]);
+    NUMERIC_CLAMPS = /* @__PURE__ */ new Map([
+      // --- brain_weight_history.delta_weight (T11782) -------------------------
+      // +Inf → 1.0 (max canonical reinforcement), -Inf → -1.0 (max canonical
+      // depression), NaN → 0.0 (no-op delta). Finite values pass through.
+      [
+        "brain_weight_history.delta_weight",
+        (src) => `CASE WHEN ${src} = 9e999 THEN 1.0 WHEN ${src} = -9e999 THEN -1.0 WHEN ${src} != ${src} THEN 0.0 ELSE ${src} END`
+      ]
+    ]);
     ISO_CHECK_REGEX = /CHECK\s*\(\s*"([^"]+)"\s+IS\s+NULL\s+OR\s+"[^"]+"\s+GLOB\s+'\[0-9/gi;
     SOURCE_EPOCH_UNITS = /* @__PURE__ */ new Map([
       ["conduit", "seconds"],
@@ -32290,8 +32486,8 @@ var init_migrate = __esm({
 });
 
 // packages/core/src/store/exodus/plan.ts
-import { existsSync as existsSync4, readdirSync as readdirSync2, statfsSync, statSync } from "node:fs";
-import { join as join7 } from "node:path";
+import { existsSync as existsSync5, readdirSync as readdirSync2, statfsSync, statSync } from "node:fs";
+import { join as join8 } from "node:path";
 function buildSourceDescriptors(cwd) {
   const cleoDir = resolveCleoDir(cwd);
   const cleoHome = getCleoHome();
@@ -32299,33 +32495,33 @@ function buildSourceDescriptors(cwd) {
     // Project-tier — go into consolidated project-scope cleo.db
     {
       name: "tasks",
-      path: join7(cleoDir, "tasks.db"),
+      path: join8(cleoDir, "tasks.db"),
       targetScope: "project"
     },
     {
       name: "brain (project)",
-      path: join7(cleoDir, "brain.db"),
+      path: join8(cleoDir, "brain.db"),
       targetScope: "project"
     },
     {
       name: "conduit",
-      path: join7(cleoDir, "conduit.db"),
+      path: join8(cleoDir, "conduit.db"),
       targetScope: "project"
     },
     // Global-tier — go into consolidated global-scope cleo.db
     {
       name: "nexus",
-      path: join7(cleoHome, "nexus.db"),
+      path: join8(cleoHome, "nexus.db"),
       targetScope: "global"
     },
     {
       name: "signaldock",
-      path: join7(cleoHome, "signaldock.db"),
+      path: join8(cleoHome, "signaldock.db"),
       targetScope: "global"
     },
     {
       name: "skills",
-      path: join7(cleoHome, "skills.db"),
+      path: join8(cleoHome, "skills.db"),
       targetScope: "global"
     }
   ];
@@ -32354,7 +32550,7 @@ function findExistingStaging(cleoDir) {
     const entries = readdirSync2(cleoDir, { withFileTypes: true });
     const stagingDirs = entries.filter((e) => e.isDirectory() && e.name.startsWith("exodus-staging-")).map((e) => e.name).sort().reverse();
     if (stagingDirs.length > 0) {
-      return join7(cleoDir, stagingDirs[0]);
+      return join8(cleoDir, stagingDirs[0]);
     }
   } catch {
   }
@@ -32367,7 +32563,7 @@ function buildExodusPlan(cwd) {
   const availableBytes = getAvailableBytes(cleoDir);
   const diskPreflight = totalSourceBytes === 0 || availableBytes >= 3 * totalSourceBytes;
   const existingStaging = findExistingStaging(cleoDir);
-  const stagingDir = existingStaging ?? join7(cleoDir, deriveStagingDirName());
+  const stagingDir = existingStaging ?? join8(cleoDir, deriveStagingDirName());
   const resumeFromStaging = existingStaging !== null;
   const projectDbPath = resolveDualScopeDbPath("project", cwd);
   const globalDbPath = resolveDualScopeDbPath("global");
@@ -32383,7 +32579,7 @@ function buildExodusPlan(cwd) {
   };
 }
 function sourcesPresent(sources) {
-  return sources.some((s) => existsSync4(s.path));
+  return sources.some((s) => existsSync5(s.path));
 }
 var init_plan2 = __esm({
   "packages/core/src/store/exodus/plan.ts"() {
@@ -32394,11 +32590,11 @@ var init_plan2 = __esm({
 });
 
 // packages/core/src/store/exodus/status.ts
-import { existsSync as existsSync5, readdirSync as readdirSync3, readFileSync as readFileSync3, statSync as statSync2 } from "node:fs";
-import { join as join8 } from "node:path";
+import { existsSync as existsSync6, readdirSync as readdirSync3, readFileSync as readFileSync3, statSync as statSync2 } from "node:fs";
+import { join as join9 } from "node:path";
 function readJournal2(stagingDir) {
-  const p = join8(stagingDir, JOURNAL_FILENAME2);
-  if (!existsSync5(p)) return null;
+  const p = join9(stagingDir, JOURNAL_FILENAME2);
+  if (!existsSync6(p)) return null;
   try {
     return JSON.parse(readFileSync3(p, "utf8"));
   } catch {
@@ -32407,7 +32603,7 @@ function readJournal2(stagingDir) {
 }
 function findStagingDirs(cleoDir) {
   try {
-    return readdirSync3(cleoDir, { withFileTypes: true }).filter((e) => e.isDirectory() && e.name.startsWith("exodus-staging-")).map((e) => join8(cleoDir, e.name)).sort().reverse();
+    return readdirSync3(cleoDir, { withFileTypes: true }).filter((e) => e.isDirectory() && e.name.startsWith("exodus-staging-")).map((e) => join9(cleoDir, e.name)).sort().reverse();
   } catch {
     return [];
   }
@@ -32430,15 +32626,15 @@ function runExodusStatus(cwd) {
   const sourcesInfo = plan.sources.map((s) => ({
     name: s.name,
     path: s.path,
-    exists: existsSync5(s.path),
+    exists: existsSync6(s.path),
     bytes: safeBytes(s.path)
   }));
   return {
     hasStaging: latestStaging !== null,
     stagingDir: latestStaging,
     journal,
-    projectDbExists: existsSync5(projectDbPath),
-    globalDbExists: existsSync5(globalDbPath),
+    projectDbExists: existsSync6(projectDbPath),
+    globalDbExists: existsSync6(globalDbPath),
     sourcesPresent: sourcesInfo.some((s) => s.exists),
     sources: sourcesInfo
   };
@@ -32455,7 +32651,7 @@ var init_status = __esm({
 });
 
 // packages/core/src/store/exodus/verify-migration.ts
-import { existsSync as existsSync6 } from "node:fs";
+import { existsSync as existsSync7 } from "node:fs";
 import { createRequire as createRequire3 } from "node:module";
 function orderByClause(db, tableName) {
   try {
@@ -32478,14 +32674,15 @@ function computeTableDigest(db, tableName, columns) {
     rows = db.prepare(`SELECT ${selectClause} FROM "${tableName}" ORDER BY ${orderBy}`).all();
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
-    log2.warn(
+    log3.warn(
       { tableName, err: msg },
       "computeTableDigest: SELECT failed (possibly a virtual/FTS table) \u2014 treating as 0 rows"
     );
     return { count: 0, hash: "" };
   }
   for (const row of rows) {
-    hasher.update(JSON.stringify(row));
+    const rowObj = row;
+    hasher.update(JSON.stringify(rowObj, Object.keys(rowObj).sort()));
   }
   return {
     count: rows.length,
@@ -32590,7 +32787,7 @@ function foreignKeyCheck(db, scope) {
   try {
     const rows = db.prepare("PRAGMA foreign_key_check").all();
     if (rows.length > 0) {
-      log2.warn(
+      log3.warn(
         { scope, count: rows.length, sample: rows.slice(0, 5) },
         `verifyMigration: PRAGMA foreign_key_check found ${rows.length} orphan row(s)`
       );
@@ -32602,7 +32799,7 @@ function foreignKeyCheck(db, scope) {
       fkid: r.fkid
     }));
   } catch (err) {
-    log2.warn({ scope, err }, "verifyMigration: PRAGMA foreign_key_check failed (non-fatal)");
+    log3.warn({ scope, err }, "verifyMigration: PRAGMA foreign_key_check failed (non-fatal)");
     return [];
   }
 }
@@ -32639,13 +32836,13 @@ function sourceOrphanSignatures(db, sourceName, scope) {
     const rows = db.prepare("PRAGMA foreign_key_check").all();
     for (const r of rows) sigs.add(orphanSignature(db, r, sourceName));
     if (rows.length > 0) {
-      log2.warn(
+      log3.warn(
         { scope, count: rows.length, sample: rows.slice(0, 5) },
         `verifyMigration: source already has ${rows.length} pre-existing FK orphan(s) \u2014 these are tolerated (carried forward losslessly, flagged for data-hygiene)`
       );
     }
   } catch (err) {
-    log2.warn({ scope, err }, "verifyMigration: source PRAGMA foreign_key_check failed (non-fatal)");
+    log3.warn({ scope, err }, "verifyMigration: source PRAGMA foreign_key_check failed (non-fatal)");
   }
   return sigs;
 }
@@ -32657,7 +32854,7 @@ function verifyMigration(sources, projectDbPath, globalDbPath, onProgress) {
   const preExistingForeignKeyViolations = [];
   const failureLines = [];
   const sourceOrphanSigs = /* @__PURE__ */ new Set();
-  if (!existsSync6(projectDbPath)) {
+  if (!existsSync7(projectDbPath)) {
     return {
       ok: false,
       tables: [],
@@ -32668,7 +32865,7 @@ function verifyMigration(sources, projectDbPath, globalDbPath, onProgress) {
       error: `Consolidated project cleo.db not found at ${projectDbPath}. Run 'cleo exodus migrate' first.`
     };
   }
-  if (!existsSync6(globalDbPath)) {
+  if (!existsSync7(globalDbPath)) {
     return {
       ok: false,
       tables: [],
@@ -32683,7 +32880,7 @@ function verifyMigration(sources, projectDbPath, globalDbPath, onProgress) {
   const globalSnap = openCleoDbSnapshot(globalDbPath, { readOnly: true });
   try {
     for (const src of sources) {
-      if (!existsSync6(src.path)) {
+      if (!existsSync7(src.path)) {
         onProgress?.(`Skipping ${src.name} (not present)`);
         continue;
       }
@@ -32762,7 +32959,7 @@ function verifyMigration(sources, projectDbPath, globalDbPath, onProgress) {
               `[${scope}] ${src.name}.${legacyTableName} \u2192 ${targetTableName}: DEFICIT \u2014 source=${srcDigest.count} rows, target=${tgtDigest.count} rows (${srcDigest.count - tgtDigest.count} missing), hashMatch=${hashMatch}`
             );
           } else if (tgtDigest.count > srcDigest.count) {
-            log2.warn(
+            log3.warn(
               {
                 scope,
                 source: src.name,
@@ -32812,7 +33009,7 @@ function verifyMigration(sources, projectDbPath, globalDbPath, onProgress) {
       }
     }
     if (preExistingForeignKeyViolations.length > 0) {
-      log2.warn(
+      log3.warn(
         {
           count: preExistingForeignKeyViolations.length,
           sample: preExistingForeignKeyViolations.slice(0, 5)
@@ -32822,7 +33019,7 @@ function verifyMigration(sources, projectDbPath, globalDbPath, onProgress) {
     }
   } catch (err) {
     const error = err instanceof Error ? err.message : String(err);
-    log2.error({ err }, "verifyMigration failed");
+    log3.error({ err }, "verifyMigration failed");
     return {
       ok: false,
       tables,
@@ -32839,7 +33036,7 @@ function verifyMigration(sources, projectDbPath, globalDbPath, onProgress) {
   if (failureLines.length > 0) {
     const error = `verifyMigration FAILED: ${failureLines.length} issue(s):
 ${failureLines.map((l) => `  \u2022 ${l}`).join("\n")}`;
-    log2.error({ failureCount: failureLines.length }, error);
+    log3.error({ failureCount: failureLines.length }, error);
     return {
       ok: false,
       tables,
@@ -32859,7 +33056,7 @@ ${failureLines.map((l) => `  \u2022 ${l}`).join("\n")}`;
     enumDrift
   };
 }
-var log2, _require, CHECK_ENUM_REGEX;
+var log3, _require, CHECK_ENUM_REGEX;
 var init_verify_migration = __esm({
   "packages/core/src/store/exodus/verify-migration.ts"() {
     "use strict";
@@ -32867,7 +33064,7 @@ var init_verify_migration = __esm({
     init_logger2();
     init_open_cleo_db();
     init_table_name_map();
-    log2 = getLogger("verify-migration");
+    log3 = getLogger("verify-migration");
     _require = createRequire3(import.meta.url);
     CHECK_ENUM_REGEX = /CHECK\s*\(\s*"([^"]+)"\s+(?:IS\s+NULL\s+OR\s+"[^"]+"\s+)?IN\s*\(([^)]*)\)\s*\)/gi;
   }
@@ -32907,9 +33104,16 @@ var init_verify = __esm({
 var exodus_exports = {};
 __export(exodus_exports, {
   EXODUS_TARGET_SCHEMA_VERSION: () => EXODUS_TARGET_SCHEMA_VERSION,
+  archiveMigratedSources: () => archiveMigratedSources,
+  archiveSourceDb: () => archiveSourceDb,
+  archiveStrandedResidue: () => archiveStrandedResidue,
   buildExodusPlan: () => buildExodusPlan,
   clearExodusJournal: () => clearExodusJournal,
   deriveStagingDirName: () => deriveStagingDirName,
+  detectStrandedResidue: () => detectStrandedResidue,
+  exodusArchiveDir: () => exodusArchiveDir,
+  exodusMarkerPath: () => exodusMarkerPath,
+  hasExodusCompleteMarker: () => hasExodusCompleteMarker,
   isDerivedOrInternalTable: () => isDerivedOrInternalTable,
   resolveConsolidatedTableName: () => resolveConsolidatedTableName,
   reverseLookup: () => reverseLookup,
@@ -32917,11 +33121,13 @@ __export(exodus_exports, {
   runExodusStatus: () => runExodusStatus,
   runExodusVerify: () => runExodusVerify,
   sourcesPresent: () => sourcesPresent,
-  verifyMigration: () => verifyMigration
+  verifyMigration: () => verifyMigration,
+  writeExodusCompleteMarker: () => writeExodusCompleteMarker
 });
 var init_exodus = __esm({
   "packages/core/src/store/exodus/index.ts"() {
     "use strict";
+    init_archive2();
     init_migrate();
     init_plan2();
     init_status();
@@ -32939,7 +33145,7 @@ __export(on_open_exports, {
   isDataContinuityOk: () => isDataContinuityOk,
   maybeRunExodusOnOpen: () => maybeRunExodusOnOpen
 });
-import { existsSync as existsSync7 } from "node:fs";
+import { existsSync as existsSync8 } from "node:fs";
 function isDisabledByEnv() {
   const v = process.env.CLEO_DISABLE_EXODUS_ON_OPEN;
   return v === "1" || v === "true";
@@ -32965,7 +33171,7 @@ function rollbackConsolidatedToEmpty(nativeDb, scope) {
       "SELECT name FROM sqlite_master WHERE type='table' AND name NOT LIKE 'sqlite_%' AND name NOT LIKE '__drizzle_%'"
     ).all().map((r) => r.name);
   } catch (err) {
-    log3.error({ err, scope }, "exodus-on-open: failed to enumerate tables for rollback");
+    log4.error({ err, scope }, "exodus-on-open: failed to enumerate tables for rollback");
     return;
   }
   try {
@@ -32975,7 +33181,7 @@ function rollbackConsolidatedToEmpty(nativeDb, scope) {
       try {
         nativeDb.exec(`DELETE FROM "${table}"`);
       } catch (err) {
-        log3.warn({ err, table, scope }, "exodus-on-open: failed to clear table during rollback");
+        log4.warn({ err, table, scope }, "exodus-on-open: failed to clear table during rollback");
       }
     }
     nativeDb.exec("COMMIT");
@@ -32984,7 +33190,7 @@ function rollbackConsolidatedToEmpty(nativeDb, scope) {
       nativeDb.exec("ROLLBACK");
     } catch {
     }
-    log3.error({ err, scope }, "exodus-on-open: rollback transaction failed");
+    log4.error({ err, scope }, "exodus-on-open: rollback transaction failed");
   } finally {
     try {
       nativeDb.exec("PRAGMA foreign_keys = ON");
@@ -32992,20 +33198,27 @@ function rollbackConsolidatedToEmpty(nativeDb, scope) {
     }
   }
 }
-async function rollbackBothScopes(scope) {
-  const { openDualScopeDb: openDualScopeDb2 } = await Promise.resolve().then(() => (init_dual_scope_db(), dual_scope_db_exports));
+async function rollbackBothScopes(scope, projectDbPath, globalDbPath) {
+  const { openDualScopeDbAtPath: openDualScopeDbAtPath2 } = await Promise.resolve().then(() => (init_dual_scope_db(), dual_scope_db_exports));
   for (const s of ["project", "global"]) {
+    const path = s === "project" ? projectDbPath : globalDbPath;
+    let handle = null;
     try {
-      const handle = s === "project" ? await openDualScopeDb2("project") : await openDualScopeDb2("global");
+      handle = s === "project" ? await openDualScopeDbAtPath2("project", path, void 0, { dedicated: true }) : await openDualScopeDbAtPath2("global", path, void 0, { dedicated: true });
       const native = handle.db.$client;
       if (native) {
         rollbackConsolidatedToEmpty(native, s);
       }
     } catch (err) {
-      log3.warn(
+      log4.warn(
         { err, scope: s, openingScope: scope },
         "exodus-on-open: could not roll back scope (best-effort)"
       );
+    } finally {
+      try {
+        handle?.close();
+      } catch {
+      }
     }
   }
 }
@@ -33013,7 +33226,7 @@ function isDataContinuityOk(result) {
   const deficits = result.tables.filter((t) => t.targetCount < t.sourceCount);
   const surpluses = result.tables.filter((t) => t.targetCount > t.sourceCount);
   if (surpluses.length > 0) {
-    log3.warn(
+    log4.warn(
       {
         surpluses: surpluses.map((t) => ({
           table: t.targetTable,
@@ -33035,13 +33248,19 @@ async function maybeRunExodusOnOpen(scope, dbPath, nativeDb, cwd) {
   if (isDisabledByEnv()) {
     return { outcome: "skipped", reason: "CLEO_DISABLE_EXODUS_ON_OPEN set" };
   }
+  if (hasExodusCompleteMarker(scope, cwd)) {
+    return {
+      outcome: "skipped",
+      reason: "exodus completion marker present \u2014 scope already migrated (cutover sealed)"
+    };
+  }
   if (!consolidatedIsEmpty(nativeDb, scope)) {
     return { outcome: "skipped", reason: "consolidated cleo.db already populated" };
   }
   const { buildExodusPlan: buildExodusPlan2, runExodusMigrate: runExodusMigrate2, verifyMigration: verifyMigration2, clearExodusJournal: clearExodusJournal2 } = await Promise.resolve().then(() => (init_exodus(), exodus_exports));
   const plan = buildExodusPlan2(cwd);
   const scopeSources = plan.sources.filter((s) => s.targetScope === scope);
-  if (!scopeSources.some((s) => existsSync7(s.path))) {
+  if (!scopeSources.some((s) => existsSync8(s.path))) {
     return {
       outcome: "skipped",
       reason: `no legacy ${scope}-scope source DBs present (fresh install or cross-scope-only)`
@@ -33054,11 +33273,11 @@ async function maybeRunExodusOnOpen(scope, dbPath, nativeDb, cwd) {
       if (!consolidatedIsEmpty(nativeDb, scope)) {
         return { outcome: "skipped", reason: "migrated by a concurrent process (lock winner)" };
       }
-      log3.info(
+      log4.info(
         {
           scope,
           dbPath,
-          sources: plan.sources.filter((s) => existsSync7(s.path)).map((s) => s.name)
+          sources: plan.sources.filter((s) => existsSync8(s.path)).map((s) => s.name)
         },
         "exodus-on-open: consolidated cleo.db is empty and legacy data present \u2014 auto-migrating"
       );
@@ -33067,23 +33286,23 @@ async function maybeRunExodusOnOpen(scope, dbPath, nativeDb, cwd) {
         const migrateResult = await runExodusMigrate2(
           plan,
           false,
-          (msg) => log3.debug({ scope }, `exodus-on-open: ${msg}`)
+          (msg) => log4.debug({ scope }, `exodus-on-open: ${msg}`)
         );
         if (!migrateResult.ok) {
-          await rollbackBothScopes(scope);
+          await rollbackBothScopes(scope, plan.projectDbPath, plan.globalDbPath);
           clearExodusJournal2(migrateResult.stagingDir);
           const reason = `migration failed: ${migrateResult.error ?? "unknown error"} \u2014 legacy DBs kept as source`;
-          log3.error({ scope, error: migrateResult.error }, `exodus-on-open: ${reason}`);
+          log4.error({ scope, error: migrateResult.error }, `exodus-on-open: ${reason}`);
           return { outcome: "aborted", reason };
         }
         const verifyResult = verifyMigration2(
           plan.sources,
           plan.projectDbPath,
           plan.globalDbPath,
-          (msg) => log3.debug({ scope }, `exodus-on-open verify: ${msg}`)
+          (msg) => log4.debug({ scope }, `exodus-on-open verify: ${msg}`)
         );
         if (!verifyResult.ok) {
-          log3.warn(
+          log4.warn(
             {
               scope,
               enumDrift: verifyResult.enumDrift.length,
@@ -33093,11 +33312,11 @@ async function maybeRunExodusOnOpen(scope, dbPath, nativeDb, cwd) {
           );
         }
         if (!isDataContinuityOk(verifyResult)) {
-          await rollbackBothScopes(scope);
+          await rollbackBothScopes(scope, plan.projectDbPath, plan.globalDbPath);
           clearExodusJournal2(plan.stagingDir);
           const deficits = verifyResult.tables.filter((t) => t.targetCount < t.sourceCount).map((t) => `${t.targetTable}(${t.sourceCount}\u2192${t.targetCount})`);
           const reason = `parity verification failed \u2014 cutover aborted, legacy DBs kept as source. count deficits: [${deficits.join(", ")}]; INTRODUCED fk orphans: ${verifyResult.introducedForeignKeyViolations.length} (pre-existing source orphans tolerated: ${verifyResult.preExistingForeignKeyViolations.length}). ` + `${verifyResult.error ?? ""}`.trim();
-          log3.error(
+          log4.error(
             {
               scope,
               countDeficits: deficits,
@@ -33109,10 +33328,27 @@ async function maybeRunExodusOnOpen(scope, dbPath, nativeDb, cwd) {
           return { outcome: "aborted", reason };
         }
         const rowsCopied = migrateResult.tables.filter((t) => !t.skipped).reduce((n, t) => n + t.rowsCopied, 0);
-        log3.info(
+        log4.info(
           { scope, rowsCopied, tables: migrateResult.tables.length },
           "exodus-on-open: parity verified \u2014 legacy data migrated into consolidated cleo.db"
         );
+        try {
+          const consumed = plan.sources.filter((s) => existsSync8(s.path));
+          const archiveResult = archiveMigratedSources(consumed, cwd);
+          log4.info(
+            {
+              scope,
+              archived: archiveResult.sources.filter((s) => s.action === "archived").length,
+              markersWritten: archiveResult.markersWritten
+            },
+            "exodus-on-open: archived legacy sources + sealed completion marker(s)"
+          );
+        } catch (err) {
+          log4.error(
+            { err, scope },
+            "exodus-on-open: post-migration archive/marker step failed (migration itself succeeded \u2014 legacy DBs left in place, will be re-checked by `cleo doctor exodus-residue`)"
+          );
+        }
         return {
           outcome: "migrated",
           reason: `migrated ${rowsCopied} rows across ${migrateResult.tables.length} tables; parity verified`,
@@ -33130,13 +33366,14 @@ async function maybeRunExodusOnOpen(scope, dbPath, nativeDb, cwd) {
 function _isExodusInProgress() {
   return _exodusInProgress;
 }
-var log3, _exodusInProgress;
+var log4, _exodusInProgress;
 var init_on_open = __esm({
   "packages/core/src/store/exodus/on-open.ts"() {
     "use strict";
     init_logger2();
     init_lock();
-    log3 = getLogger("exodus-on-open");
+    init_archive2();
+    log4 = getLogger("exodus-on-open");
     _exodusInProgress = false;
   }
 });
@@ -33151,17 +33388,17 @@ __export(dual_scope_db_exports, {
   resolveDualScopeDbPath: () => resolveDualScopeDbPath,
   upsertIdempotent: () => upsertIdempotent
 });
-import { existsSync as existsSync8, mkdirSync as mkdirSync2 } from "node:fs";
+import { existsSync as existsSync9, mkdirSync as mkdirSync3 } from "node:fs";
 import { createRequire as createRequire4 } from "node:module";
-import { dirname as dirname4, join as join9 } from "node:path";
+import { dirname as dirname4, join as join10 } from "node:path";
 function cacheKey(scope, dbPath) {
   return `${scope}::${dbPath}`;
 }
 function resolveDualScopeDbPath(scope, cwd) {
   if (scope === "project") {
-    return join9(resolveCleoDir(cwd), "cleo.db");
+    return join10(resolveCleoDir(cwd), "cleo.db");
   }
-  return join9(getCleoHome(), "cleo.db");
+  return join10(getCleoHome(), "cleo.db");
 }
 function migrationsSetName(scope) {
   return scope === "project" ? "drizzle-cleo-project" : "drizzle-cleo-global";
@@ -33199,21 +33436,61 @@ async function openDualScopeDb(scope, cwd) {
   const dbPath = resolveDualScopeDbPath(scope, cwd);
   return scope === "project" ? openDualScopeDbAtPath("project", dbPath, cwd) : openDualScopeDbAtPath("global", dbPath, cwd);
 }
-async function openDualScopeDbAtPath(scope, dbPath, exodusCwd) {
+async function openDedicatedDualScopeDb(scope, dbPath, log5) {
+  log5.debug({ scope, dbPath }, "opening DEDICATED (non-cached) dual-scope cleo.db (T11782 FIX D)");
+  const dir = dirname4(dbPath);
+  if (!existsSync9(dir)) {
+    mkdirSync3(dir, { recursive: true });
+  }
+  const DatabaseSyncCtor = getDatabaseSyncCtor();
+  const nativeDb = new DatabaseSyncCtor(dbPath, { allowExtension: true });
+  applyPerfPragmas(nativeDb);
+  const schema = scope === "project" ? await loadProjectSchema() : await loadGlobalSchema();
+  const drizzle2 = getDrizzle();
+  const db = drizzle2({ client: nativeDb, schema });
+  const migrationsFolder = resolveCorePackageMigrationsFolder(migrationsSetName(scope));
+  reconcileJournal(nativeDb, migrationsFolder, existenceTable(scope), `dual-scope-db[${scope}]`);
+  migrateWithRetry(
+    db,
+    migrationsFolder,
+    nativeDb,
+    existenceTable(scope),
+    `dual-scope-db[${scope}]`
+  );
+  log5.debug({ scope, dbPath }, "DEDICATED dual-scope cleo.db ready (T11782 FIX D)");
+  return {
+    db,
+    scope,
+    dbPath,
+    close() {
+      try {
+        nativeDb.close();
+      } catch {
+      }
+    }
+  };
+}
+async function openDualScopeDbAtPath(scope, dbPath, exodusCwd, options) {
+  const dedicated = options?.dedicated === true;
   const key = cacheKey(scope, dbPath);
-  const existing = _cache.get(key);
-  if (existing) {
-    if (existing.initPromise) {
-      return existing.initPromise;
+  if (!dedicated) {
+    const existing = _cache.get(key);
+    if (existing) {
+      if (existing.initPromise) {
+        return existing.initPromise;
+      }
+      return existing.handle;
     }
-    return existing.handle;
   }
-  const log4 = getLogger("dual-scope-db");
+  const log5 = getLogger("dual-scope-db");
+  if (dedicated) {
+    return openDedicatedDualScopeDb(scope, dbPath, log5);
+  }
   const initPromise = (async () => {
-    log4.debug({ scope, dbPath }, "opening dual-scope cleo.db");
+    log5.debug({ scope, dbPath }, "opening dual-scope cleo.db");
     const dir = dirname4(dbPath);
-    if (!existsSync8(dir)) {
-      mkdirSync2(dir, { recursive: true });
+    if (!existsSync9(dir)) {
+      mkdirSync3(dir, { recursive: true });
     }
     const DatabaseSyncCtor = getDatabaseSyncCtor();
     const nativeDb = new DatabaseSyncCtor(dbPath, { allowExtension: true });
@@ -33230,7 +33507,7 @@ async function openDualScopeDbAtPath(scope, dbPath, exodusCwd) {
       existenceTable(scope),
       `dual-scope-db[${scope}]`
     );
-    log4.debug({ scope, dbPath }, "dual-scope cleo.db ready");
+    log5.debug({ scope, dbPath }, "dual-scope cleo.db ready");
     const handle = {
       db,
       scope,
@@ -33254,7 +33531,7 @@ async function openDualScopeDbAtPath(scope, dbPath, exodusCwd) {
         const result = await maybeRunExodusOnOpen2(scope, dbPath, nativeDb, exodusCwd);
         if (result.outcome === "migrated" || result.outcome === "aborted") {
           if (result.outcome === "aborted") {
-            log4.warn(
+            log5.warn(
               { scope, reason: result.reason },
               "exodus-on-open aborted; consolidated cleo.db left empty, legacy kept as source"
             );
@@ -33262,7 +33539,7 @@ async function openDualScopeDbAtPath(scope, dbPath, exodusCwd) {
           return scope === "project" ? openDualScopeDbAtPath("project", dbPath) : openDualScopeDbAtPath("global", dbPath);
         }
       } catch (err) {
-        log4.warn(
+        log5.warn(
           { err, scope },
           "exodus-on-open hook failed (non-fatal); re-opening consolidated handle"
         );
@@ -33846,8 +34123,8 @@ __export(nexus_sqlite_exports, {
   resetNexusDbState: () => resetNexusDbState,
   resolveNexusMigrationsFolder: () => resolveNexusMigrationsFolder
 });
-import { copyFileSync as copyFileSync2, existsSync as existsSync9 } from "node:fs";
-import { join as join10 } from "node:path";
+import { copyFileSync as copyFileSync3, existsSync as existsSync10 } from "node:fs";
+import { join as join11 } from "node:path";
 function getNexusDbPath(cwd) {
   return resolveDualScopeDbPath("project", cwd);
 }
@@ -33879,7 +34156,7 @@ function resolveNexusMigrationsFolder() {
   return resolveCorePackageMigrationsFolder("drizzle-nexus");
 }
 function getNestedNexusSentinelPath() {
-  return join10(getCleoHome(), "nexus", NESTED_NEXUS_SENTINEL);
+  return join11(getCleoHome(), "nexus", NESTED_NEXUS_SENTINEL);
 }
 function detectAndWarnOnNestedNexus() {
   let nestedPath;
@@ -33888,12 +34165,12 @@ function detectAndWarnOnNestedNexus() {
   } catch {
     return false;
   }
-  if (!existsSync9(nestedPath)) return false;
+  if (!existsSync10(nestedPath)) return false;
   if (_warnedNestedPaths.has(nestedPath)) return false;
   _warnedNestedPaths.add(nestedPath);
   const canonicalPath = getNexusDbPath();
-  const log4 = getLogger("nexus-sqlite");
-  log4.warn(
+  const log5 = getLogger("nexus-sqlite");
+  log5.warn(
     {
       nestedPath,
       canonicalPath,
@@ -34047,9 +34324,9 @@ function runNexusMigrations(nativeDb, db) {
   const migrationsFolder = resolveNexusMigrationsFolder();
   if (tableExists3(nativeDb, "nexus_nodes") && _nexusDbPath) {
     const backupPath = _nexusDbPath.replace(/\.db$/, "-pre-cleo.db.bak");
-    if (!existsSync9(backupPath)) {
+    if (!existsSync10(backupPath)) {
       try {
-        copyFileSync2(_nexusDbPath, backupPath);
+        copyFileSync3(_nexusDbPath, backupPath);
       } catch {
       }
     }
@@ -34179,10 +34456,10 @@ var init_nexus_sqlite = __esm({
 
 // packages/core/src/paths.ts
 import { AsyncLocalStorage } from "node:async_hooks";
-import { existsSync as existsSync10, readFileSync as readFileSync4, statSync as statSync3 } from "node:fs";
+import { existsSync as existsSync11, readFileSync as readFileSync4, statSync as statSync3 } from "node:fs";
 import { createRequire as createRequire5 } from "node:module";
 import { homedir } from "node:os";
-import { basename as basename3, dirname as dirname5, join as join11, resolve as resolve3 } from "node:path";
+import { basename as basename4, dirname as dirname5, join as join12, resolve as resolve3 } from "node:path";
 import {
   computeCanonicalProjectId as _computeCanonicalProjectId,
   getCanonicalTemplatesTildePath as _getCanonicalTemplatesTildePath,
@@ -34272,8 +34549,8 @@ function getCleoDirAbsolute(cwd, opts) {
 function _resolveProjectByCwdFromNexus(cwd) {
   try {
     const cleoHome = getCleoHome();
-    const globalDbPath = join11(cleoHome, "cleo.db");
-    if (!existsSync10(globalDbPath)) return null;
+    const globalDbPath = join12(cleoHome, "cleo.db");
+    if (!existsSync11(globalDbPath)) return null;
     const start = resolve3(cwd ?? process.cwd());
     let current = start;
     const DatabaseSync2 = _getDatabaseSyncCtor();
@@ -34312,7 +34589,7 @@ function _findCleoDirRoot(cwd) {
     const isDangerousRoot = current === homeRoot || current === "/" || current === "";
     if (!isDangerousRoot) {
       try {
-        if (statSync3(join11(current, ".cleo")).isDirectory()) {
+        if (statSync3(join12(current, ".cleo")).isDirectory()) {
           return current;
         }
       } catch {
@@ -34327,7 +34604,7 @@ function _findCleoDirRoot(cwd) {
 function resolveCleoDir(cwd) {
   const scope = worktreeScope.getStore();
   if (scope !== void 0) {
-    return join11(scope.worktreeRoot, ".cleo");
+    return join12(scope.worktreeRoot, ".cleo");
   }
   const override = _cleoDirEnvOverride();
   if (override !== null) {
@@ -34335,14 +34612,14 @@ function resolveCleoDir(cwd) {
   }
   const root = _findCleoDirRoot(cwd);
   if (root !== null) {
-    return join11(root, ".cleo");
+    return join12(root, ".cleo");
   }
   const start = resolve3(cwd ?? process.cwd());
   let current = start;
   while (true) {
     const mainRepo = _resolveMainRepoFromGitlink(current);
     if (mainRepo !== null) {
-      return join11(mainRepo, ".cleo");
+      return join12(mainRepo, ".cleo");
     }
     const parent = dirname5(current);
     if (parent === current) {
@@ -34384,9 +34661,9 @@ function _cwdHasGitAncestor(cwd) {
   const start = resolve3(cwd ?? process.cwd());
   let current = start;
   while (true) {
-    const gitMarker = join11(current, ".git");
+    const gitMarker = join12(current, ".git");
     try {
-      if (existsSync10(gitMarker)) {
+      if (existsSync11(gitMarker)) {
         return true;
       }
     } catch {
@@ -34398,8 +34675,8 @@ function _cwdHasGitAncestor(cwd) {
 }
 function _resolveMainRepoFromGitlink(gitlinkDir) {
   try {
-    const gitLinkPath = join11(gitlinkDir, ".git");
-    if (!existsSync10(gitLinkPath)) return null;
+    const gitLinkPath = join12(gitlinkDir, ".git");
+    if (!existsSync11(gitLinkPath)) return null;
     const stat2 = statSync3(gitLinkPath);
     if (!stat2.isFile()) return null;
     const gitLinkContent = readFileSync4(gitLinkPath, "utf-8").trim();
@@ -34407,7 +34684,7 @@ function _resolveMainRepoFromGitlink(gitlinkDir) {
     if (!match) return null;
     const gitdir = match[1].trim();
     const mainRepo = dirname5(dirname5(dirname5(gitdir)));
-    if (existsSync10(join11(mainRepo, ".cleo")) && validateProjectRoot(mainRepo)) {
+    if (existsSync11(join12(mainRepo, ".cleo")) && validateProjectRoot(mainRepo)) {
       return mainRepo;
     }
   } catch {
@@ -34415,18 +34692,18 @@ function _resolveMainRepoFromGitlink(gitlinkDir) {
   return null;
 }
 function validateProjectRoot(candidate) {
-  const cleoDir = join11(candidate, ".cleo");
-  if (!existsSync10(cleoDir)) {
+  const cleoDir = join12(candidate, ".cleo");
+  if (!existsSync11(cleoDir)) {
     return false;
   }
-  const projectInfoPath = join11(cleoDir, "project-info.json");
-  if (existsSync10(projectInfoPath)) {
+  const projectInfoPath = join12(cleoDir, "project-info.json");
+  if (existsSync11(projectInfoPath)) {
     try {
       const raw = readFileSync4(projectInfoPath, "utf-8");
       const parsed = JSON.parse(raw);
       if (typeof parsed === "object" && parsed !== null && "projectId" in parsed && typeof parsed["projectId"] === "string" && parsed["projectId"] !== "") {
-        const gitMarker = join11(candidate, ".git");
-        if (existsSync10(gitMarker)) {
+        const gitMarker = join12(candidate, ".git");
+        if (existsSync11(gitMarker)) {
           try {
             if (!statSync3(gitMarker).isDirectory()) {
               return false;
@@ -34440,8 +34717,8 @@ function validateProjectRoot(candidate) {
     } catch {
     }
   }
-  const gitDir = join11(candidate, ".git");
-  if (existsSync10(gitDir)) {
+  const gitDir = join12(candidate, ".git");
+  if (existsSync11(gitDir)) {
     let isRealGitDir = false;
     try {
       const stat2 = statSync3(gitDir);
@@ -34488,16 +34765,16 @@ function getProjectRoot(cwd) {
   const homeRoot = homedir();
   const skippedCleoDirs = [];
   while (true) {
-    const cleoDir = join11(current, ".cleo");
-    const gitDir = join11(current, ".git");
+    const cleoDir = join12(current, ".cleo");
+    const gitDir = join12(current, ".git");
     const isDangerousRoot = current === homeRoot || current === "/" || current === "";
-    if (existsSync10(cleoDir) && !isDangerousRoot) {
+    if (existsSync11(cleoDir) && !isDangerousRoot) {
       if (validateProjectRoot(current)) {
         return current;
       }
       skippedCleoDirs.push(current);
     }
-    if (existsSync10(gitDir) && !isDangerousRoot) {
+    if (existsSync11(gitDir) && !isDangerousRoot) {
       let isRealGitDir = false;
       try {
         isRealGitDir = statSync3(gitDir).isDirectory();
@@ -34542,18 +34819,18 @@ function resolveOrCwd(maybeRoot) {
   return getProjectRoot();
 }
 function getConfigPath(cwd) {
-  return join11(_resolveCleoDir(cwd), "config.json");
+  return join12(_resolveCleoDir(cwd), "config.json");
 }
 function getGlobalConfigPath() {
-  return join11(getCleoHome(), "config.json");
+  return join12(getCleoHome(), "config.json");
 }
 function isAbsolutePath(path) {
   return _isAbsolutePath(path);
 }
 function _readProjectNameFromInfo(projectRoot) {
   try {
-    const infoPath = join11(projectRoot, ".cleo", "project-info.json");
-    if (!existsSync10(infoPath)) return void 0;
+    const infoPath = join12(projectRoot, ".cleo", "project-info.json");
+    if (!existsSync11(infoPath)) return void 0;
     const raw = readFileSync4(infoPath, "utf-8");
     const data = JSON.parse(raw);
     return typeof data.name === "string" && data.name.length > 0 ? data.name : void 0;
@@ -34575,12 +34852,12 @@ async function registerProjectOnEncounter(projectRoot, infoProjectId) {
     const existingRows = await db.select().from(projectRegistry2).where(eq2(projectRegistry2.projectId, immutableId)).limit(1);
     const now = (/* @__PURE__ */ new Date()).toISOString();
     const resolvedPath = resolve3(projectRoot);
-    const projectName = _readProjectNameFromInfo(resolvedPath) || basename3(projectRoot) || "unnamed";
+    const projectName = _readProjectNameFromInfo(resolvedPath) || basename4(projectRoot) || "unnamed";
     if (existingRows.length > 0) {
       const existingPath = existingRows[0].projectPath;
       if (existingPath !== resolvedPath) {
-        const newBrainDbPath = join11(resolvedPath, ".cleo", "brain.db");
-        const newTasksDbPath = join11(resolvedPath, ".cleo", "tasks.db");
+        const newBrainDbPath = join12(resolvedPath, ".cleo", "brain.db");
+        const newTasksDbPath = join12(resolvedPath, ".cleo", "tasks.db");
         await db.update(projectRegistry2).set({
           projectPath: resolvedPath,
           projectHash: generateProjectHash2(resolvedPath),
@@ -34611,8 +34888,8 @@ async function registerProjectOnEncounter(projectRoot, infoProjectId) {
       lastSync: now,
       taskCount: 0,
       labelsJson: "[]",
-      brainDbPath: join11(resolvedPath, ".cleo", "brain.db"),
-      tasksDbPath: join11(resolvedPath, ".cleo", "tasks.db"),
+      brainDbPath: join12(resolvedPath, ".cleo", "brain.db"),
+      tasksDbPath: join12(resolvedPath, ".cleo", "tasks.db"),
       statsJson: "{}"
     }).onConflictDoNothing();
     const aliases = canonicalResult.legacyAliases ?? [];
@@ -34645,46 +34922,46 @@ var init_paths = __esm({
 // packages/core/src/store/file-utils.ts
 import { randomBytes } from "node:crypto";
 import {
-  existsSync as existsSync11,
-  mkdirSync as mkdirSync3,
+  existsSync as existsSync12,
+  mkdirSync as mkdirSync4,
   readdirSync as readdirSync4,
   readFileSync as readFileSync5,
-  renameSync as renameSync2,
-  unlinkSync as unlinkSync2,
-  writeFileSync as writeFileSync2
+  renameSync as renameSync3,
+  unlinkSync as unlinkSync3,
+  writeFileSync as writeFileSync3
 } from "node:fs";
-import { basename as basename4, dirname as dirname6, join as join12 } from "node:path";
+import { basename as basename5, dirname as dirname6, join as join13 } from "node:path";
 import * as lockfile2 from "proper-lockfile";
 function rotateBackup(filePath, mode) {
   const dir = dirname6(filePath);
-  const name2 = basename4(filePath);
-  const backupDir = join12(dir, ".backups");
+  const name2 = basename5(filePath);
+  const backupDir = join13(dir, ".backups");
   const dirMode = typeof mode === "number" ? modeToDirMode(mode) : void 0;
-  if (!existsSync11(backupDir)) {
-    mkdirSync3(backupDir, { recursive: true, mode: dirMode });
+  if (!existsSync12(backupDir)) {
+    mkdirSync4(backupDir, { recursive: true, mode: dirMode });
   }
   for (let i = MAX_BACKUPS; i >= 1; i--) {
-    const current = join12(backupDir, `${name2}.${i}`);
+    const current = join13(backupDir, `${name2}.${i}`);
     if (i === MAX_BACKUPS) {
       try {
-        unlinkSync2(current);
+        unlinkSync3(current);
       } catch {
       }
     } else {
-      const next = join12(backupDir, `${name2}.${i + 1}`);
+      const next = join13(backupDir, `${name2}.${i + 1}`);
       try {
-        if (existsSync11(current)) renameSync2(current, next);
+        if (existsSync12(current)) renameSync3(current, next);
       } catch {
       }
     }
   }
   try {
     const content = readFileSync5(filePath, "utf-8");
-    const backupPath = join12(backupDir, `${name2}.1`);
+    const backupPath = join13(backupDir, `${name2}.1`);
     if (typeof mode === "number") {
-      writeFileSync2(backupPath, content, { encoding: "utf-8", mode });
+      writeFileSync3(backupPath, content, { encoding: "utf-8", mode });
     } else {
-      writeFileSync2(backupPath, content, "utf-8");
+      writeFileSync3(backupPath, content, "utf-8");
     }
   } catch {
   }
@@ -34701,21 +34978,21 @@ function writeJsonFileAtomic(filePath, data, optsOrIndent = 2) {
   const indent = opts.indent ?? 2;
   const mode = opts.mode;
   const dir = dirname6(filePath);
-  const tempPath = join12(dir, `.${basename4(filePath)}.${randomBytes(6).toString("hex")}.tmp`);
+  const tempPath = join13(dir, `.${basename5(filePath)}.${randomBytes(6).toString("hex")}.tmp`);
   const content = JSON.stringify(data, null, indent) + "\n";
   if (typeof mode === "number") {
-    writeFileSync2(tempPath, content, { encoding: "utf-8", mode });
+    writeFileSync3(tempPath, content, { encoding: "utf-8", mode });
   } else {
-    writeFileSync2(tempPath, content, "utf-8");
+    writeFileSync3(tempPath, content, "utf-8");
   }
   try {
-    if (existsSync11(filePath)) {
+    if (existsSync12(filePath)) {
       rotateBackup(filePath, mode);
     }
-    renameSync2(tempPath, filePath);
+    renameSync3(tempPath, filePath);
   } catch (error) {
     try {
-      unlinkSync2(tempPath);
+      unlinkSync3(tempPath);
     } catch {
     }
     throw error;
@@ -34735,14 +35012,14 @@ function readJsonFile(filePath) {
 async function withLock2(filePath, transform, opts = {}) {
   const dir = dirname6(filePath);
   const dirMode = typeof opts.mode === "number" ? modeToDirMode(opts.mode) : void 0;
-  if (!existsSync11(dir)) {
-    mkdirSync3(dir, { recursive: true, mode: dirMode });
+  if (!existsSync12(dir)) {
+    mkdirSync4(dir, { recursive: true, mode: dirMode });
   }
-  if (!existsSync11(filePath)) {
+  if (!existsSync12(filePath)) {
     if (typeof opts.mode === "number") {
-      writeFileSync2(filePath, "", { encoding: "utf-8", mode: opts.mode });
+      writeFileSync3(filePath, "", { encoding: "utf-8", mode: opts.mode });
     } else {
-      writeFileSync2(filePath, "", "utf-8");
+      writeFileSync3(filePath, "", "utf-8");
     }
   }
   let release;
@@ -34760,11 +35037,11 @@ async function withLock2(filePath, transform, opts = {}) {
 }
 async function withFileLock(filePath, operation) {
   const dir = dirname6(filePath);
-  if (!existsSync11(dir)) {
-    mkdirSync3(dir, { recursive: true });
+  if (!existsSync12(dir)) {
+    mkdirSync4(dir, { recursive: true });
   }
-  if (!existsSync11(filePath)) {
-    writeFileSync2(filePath, "", "utf-8");
+  if (!existsSync12(filePath)) {
+    writeFileSync3(filePath, "", "utf-8");
   }
   let release;
   try {
@@ -34796,11 +35073,11 @@ var init_file_utils = __esm({
 });
 
 // packages/core/src/llm/credential-removal.ts
-import { unlinkSync as unlinkSync3 } from "node:fs";
-import { join as join13 } from "node:path";
+import { unlinkSync as unlinkSync4 } from "node:fs";
+import { join as join14 } from "node:path";
 import { getCleoHome as getCleoHome2 } from "@cleocode/paths";
 function suppressionStatePath() {
-  return join13(getCleoHome2(), SUPPRESSION_FILENAME);
+  return join14(getCleoHome2(), SUPPRESSION_FILENAME);
 }
 function readSuppressionFile() {
   const data = readJsonFile(suppressionStatePath());
@@ -34904,10 +35181,10 @@ var init_credential_removal = __esm({
       sourceId: "cleo-pkce",
       description: "Delete CLEO-issued PKCE token at <CLEO_HOME>/anthropic-oauth.json",
       async remove() {
-        const path = join13(getCleoHome2(), "anthropic-oauth.json");
+        const path = join14(getCleoHome2(), "anthropic-oauth.json");
         const cleaned = [];
         try {
-          unlinkSync3(path);
+          unlinkSync4(path);
           cleaned.push(path);
         } catch (err) {
           const code = err.code;
@@ -34983,7 +35260,7 @@ __export(config_exports, {
   parseConfigValue: () => parseConfigValue,
   setConfigValue: () => setConfigValue
 });
-import { existsSync as existsSync12 } from "node:fs";
+import { existsSync as existsSync13 } from "node:fs";
 import { mkdir as mkdir3, writeFile } from "node:fs/promises";
 import { dirname as dirname7 } from "node:path";
 function getNestedValue(obj, path) {
@@ -35107,7 +35384,7 @@ function parseConfigValue(value) {
 }
 async function setConfigValue(key, value, cwd, opts) {
   const configPath = opts?.global ? getGlobalConfigPath() : getConfigPath(cwd);
-  if (!existsSync12(configPath)) {
+  if (!existsSync13(configPath)) {
     const dir = dirname7(configPath);
     await mkdir3(dir, { recursive: true });
     await writeFile(configPath, "{}", "utf-8");
@@ -35121,7 +35398,7 @@ async function setConfigValue(key, value, cwd, opts) {
 async function applyStrictnessPreset(preset, cwd, opts) {
   const definition = STRICTNESS_PRESETS[preset];
   const configPath = opts?.global ? getGlobalConfigPath() : getConfigPath(cwd);
-  if (!existsSync12(configPath)) {
+  if (!existsSync13(configPath)) {
     const dir = dirname7(configPath);
     await mkdir3(dir, { recursive: true });
     await writeFile(configPath, "{}", "utf-8");
@@ -35323,10 +35600,10 @@ var init_config = __esm({
 // packages/core/src/llm/credential-seeders/claude-code-seeder.ts
 import { readFileSync as readFileSync6 } from "node:fs";
 import { homedir as homedir2 } from "node:os";
-import { join as join14 } from "node:path";
+import { join as join15 } from "node:path";
 function defaultReadCredentialFile() {
   try {
-    return readFileSync6(join14(homedir2(), ".claude", ".credentials.json"), "utf-8");
+    return readFileSync6(join15(homedir2(), ".claude", ".credentials.json"), "utf-8");
   } catch {
     return null;
   }
@@ -35421,9 +35698,9 @@ var init_claude_code_seeder = __esm({
 
 // packages/core/src/llm/credential-seeders/cleo-pkce-seeder.ts
 import { readFileSync as readFileSync7 } from "node:fs";
-import { join as join15 } from "node:path";
+import { join as join16 } from "node:path";
 function defaultCleoPkcePath() {
-  return join15(getCleoHome(), "anthropic-oauth.json");
+  return join16(getCleoHome(), "anthropic-oauth.json");
 }
 function defaultReadCredentialFile2() {
   try {
@@ -35494,13 +35771,13 @@ var init_cleo_pkce_seeder = __esm({
 });
 
 // packages/core/src/llm/credential-seeders/codex-cli-seeder.ts
-import { existsSync as existsSync13, readFileSync as readFileSync8 } from "node:fs";
+import { existsSync as existsSync14, readFileSync as readFileSync8 } from "node:fs";
 import { homedir as homedir3 } from "node:os";
-import { join as join16 } from "node:path";
+import { join as join17 } from "node:path";
 function getCodexAuthPath() {
   const codexHome = (process.env["CODEX_HOME"] ?? "").trim();
-  const root = codexHome || join16(homedir3(), ".codex");
-  return join16(root, "auth.json");
+  const root = codexHome || join17(homedir3(), ".codex");
+  return join17(root, "auth.json");
 }
 var CodexCliSeeder, codexCliSeeder;
 var init_codex_cli_seeder = __esm({
@@ -35519,7 +35796,7 @@ var init_codex_cli_seeder = __esm({
        */
       async seed() {
         const authPath = getCodexAuthPath();
-        if (!existsSync13(authPath)) {
+        if (!existsSync14(authPath)) {
           return { entries: [] };
         }
         let raw;
@@ -35649,11 +35926,11 @@ var init_google_pkce = __esm({
 });
 
 // packages/core/src/llm/credential-seeders/gemini-cli-seeder.ts
-import { existsSync as existsSync14, readFileSync as readFileSync9 } from "node:fs";
-import { join as join17 } from "node:path";
+import { existsSync as existsSync15, readFileSync as readFileSync9 } from "node:fs";
+import { join as join18 } from "node:path";
 import { getCleoHome as getCleoHome3 } from "@cleocode/paths";
 function getGoogleOauthPath() {
-  return join17(getCleoHome3(), "google_oauth.json");
+  return join18(getCleoHome3(), "google_oauth.json");
 }
 function parseGoogleOauthFile(raw) {
   let json2;
@@ -35698,7 +35975,7 @@ var init_gemini_cli_seeder = __esm({
        */
       async seed() {
         const path = getGoogleOauthPath();
-        if (!existsSync14(path)) {
+        if (!existsSync15(path)) {
           return { entries: [] };
         }
         let raw;
@@ -35923,23 +36200,23 @@ var init_credential_seeders = __esm({
 
 // packages/core/src/llm/global-config-migration.ts
 import {
-  existsSync as existsSync15,
-  mkdirSync as mkdirSync4,
+  existsSync as existsSync16,
+  mkdirSync as mkdirSync5,
   readFileSync as readFileSync10,
-  renameSync as renameSync3,
-  unlinkSync as unlinkSync4,
-  writeFileSync as writeFileSync3
+  renameSync as renameSync4,
+  unlinkSync as unlinkSync5,
+  writeFileSync as writeFileSync4
 } from "node:fs";
-import { join as join18 } from "node:path";
+import { join as join19 } from "node:path";
 import { getCleoHome as getCleoHome4, getCleoPlatformPaths as getCleoPlatformPaths2 } from "@cleocode/paths";
 function configDirGlobalConfigPath() {
-  return join18(getCleoPlatformPaths2().config, GLOBAL_CONFIG_FILENAME);
+  return join19(getCleoPlatformPaths2().config, GLOBAL_CONFIG_FILENAME);
 }
 function legacyGlobalConfigPath() {
-  return join18(getCleoHome4(), GLOBAL_CONFIG_FILENAME);
+  return join19(getCleoHome4(), GLOBAL_CONFIG_FILENAME);
 }
 function migrationMarkerPath() {
-  return join18(getCleoHome4(), MIGRATIONS_SUBDIR, MIGRATION_MARKER);
+  return join19(getCleoHome4(), MIGRATIONS_SUBDIR, MIGRATION_MARKER);
 }
 function tempTargetPath() {
   return `${configDirGlobalConfigPath()}.tmp`;
@@ -35949,12 +36226,12 @@ function migrateGlobalConfigToConfigDir() {
     const source = legacyGlobalConfigPath();
     const target = configDirGlobalConfigPath();
     const marker = migrationMarkerPath();
-    if (existsSync15(marker)) return false;
-    if (!existsSync15(source)) {
+    if (existsSync16(marker)) return false;
+    if (!existsSync16(source)) {
       stampMarker(marker);
       return false;
     }
-    if (existsSync15(target)) {
+    if (existsSync16(target)) {
       backupSourceQuiet(source);
       stampMarker(marker);
       return false;
@@ -35968,13 +36245,13 @@ function migrateGlobalConfigToConfigDir() {
       );
       return false;
     }
-    mkdirSync4(getCleoPlatformPaths2().config, { recursive: true });
+    mkdirSync5(getCleoPlatformPaths2().config, { recursive: true });
     const temp = tempTargetPath();
-    writeFileSync3(temp, raw, { mode: 420 });
-    renameSync3(temp, target);
+    writeFileSync4(temp, raw, { mode: 420 });
+    renameSync4(temp, target);
     stampMarker(marker);
     try {
-      renameSync3(source, `${source}${BACKUP_SUFFIX}`);
+      renameSync4(source, `${source}${BACKUP_SUFFIX}`);
     } catch (err) {
       console.error(
         `[cleo] global config migrated, but backup rename failed: ${err.message}. The legacy file at ${source} can be removed manually.`
@@ -35987,7 +36264,7 @@ function migrateGlobalConfigToConfigDir() {
   } catch (err) {
     try {
       const temp = tempTargetPath();
-      if (existsSync15(temp)) unlinkSync4(temp);
+      if (existsSync16(temp)) unlinkSync5(temp);
     } catch {
     }
     console.error(
@@ -35998,8 +36275,8 @@ function migrateGlobalConfigToConfigDir() {
 }
 function stampMarker(markerPath) {
   try {
-    mkdirSync4(join18(getCleoHome4(), MIGRATIONS_SUBDIR), { recursive: true });
-    writeFileSync3(markerPath, `${(/* @__PURE__ */ new Date()).toISOString()}
+    mkdirSync5(join19(getCleoHome4(), MIGRATIONS_SUBDIR), { recursive: true });
+    writeFileSync4(markerPath, `${(/* @__PURE__ */ new Date()).toISOString()}
 `, { mode: 420 });
   } catch {
   }
@@ -36007,8 +36284,8 @@ function stampMarker(markerPath) {
 function backupSourceQuiet(source) {
   try {
     const backup = `${source}${BACKUP_SUFFIX}`;
-    if (existsSync15(backup)) return;
-    renameSync3(source, backup);
+    if (existsSync16(backup)) return;
+    renameSync4(source, backup);
   } catch {
   }
 }
@@ -36030,20 +36307,20 @@ var init_global_config_migration = __esm({
 });
 
 // packages/core/src/llm/legacy-flat-key-import.ts
-import { existsSync as existsSync16, readFileSync as readFileSync11, renameSync as renameSync4, writeFileSync as writeFileSync4 } from "node:fs";
-import { join as join19 } from "node:path";
+import { existsSync as existsSync17, readFileSync as readFileSync11, renameSync as renameSync5, writeFileSync as writeFileSync5 } from "node:fs";
+import { join as join20 } from "node:path";
 import { getCleoHome as getCleoHome5 } from "@cleocode/paths";
 function migrationPaths() {
   const home = getCleoHome5();
   return {
-    flatPath: join19(home, "anthropic-key"),
-    bakPath: join19(home, `anthropic-key${LEGACY_FLAT_KEY_BAK_SUFFIX}`),
-    markerPath: join19(home, LEGACY_FLAT_KEY_MARKER)
+    flatPath: join20(home, "anthropic-key"),
+    bakPath: join20(home, `anthropic-key${LEGACY_FLAT_KEY_BAK_SUFFIX}`),
+    markerPath: join20(home, LEGACY_FLAT_KEY_MARKER)
   };
 }
 function writeMarker(markerPath) {
   try {
-    writeFileSync4(markerPath, `${(/* @__PURE__ */ new Date()).toISOString()}
+    writeFileSync5(markerPath, `${(/* @__PURE__ */ new Date()).toISOString()}
 `, {
       encoding: "utf-8",
       flag: "wx",
@@ -36059,7 +36336,7 @@ function writeMarker(markerPath) {
 }
 function readFlatKey(flatPath) {
   try {
-    if (!existsSync16(flatPath)) return null;
+    if (!existsSync17(flatPath)) return null;
     const raw = readFileSync11(flatPath, "utf-8").trim();
     return raw || null;
   } catch (err) {
@@ -36072,7 +36349,7 @@ function readFlatKey(flatPath) {
 }
 async function importLegacyFlatAnthropicKey() {
   const { flatPath, bakPath, markerPath } = migrationPaths();
-  if (existsSync16(markerPath)) {
+  if (existsSync17(markerPath)) {
     return { status: "marker-present", flatPath, bakPath: null, markerPath };
   }
   let existing = null;
@@ -36089,7 +36366,7 @@ async function importLegacyFlatAnthropicKey() {
     writeMarker(markerPath);
     return { status: "already-imported", flatPath, bakPath: null, markerPath };
   }
-  if (!existsSync16(flatPath)) {
+  if (!existsSync17(flatPath)) {
     writeMarker(markerPath);
     return { status: "no-flat-file", flatPath, bakPath: null, markerPath };
   }
@@ -36115,7 +36392,7 @@ async function importLegacyFlatAnthropicKey() {
     return { status: "no-flat-file", flatPath, bakPath: null, markerPath };
   }
   try {
-    renameSync4(flatPath, bakPath);
+    renameSync5(flatPath, bakPath);
   } catch (err) {
     logger.warn(
       { err: err instanceof Error ? err.message : String(err), flatPath, bakPath },
@@ -36165,15 +36442,15 @@ __export(credentials_exports, {
   resolveProviderStatus: () => resolveProviderStatus,
   storeAnthropicApiKey: () => storeAnthropicApiKey
 });
-import { existsSync as existsSync17, mkdirSync as mkdirSync5, readFileSync as readFileSync12, writeFileSync as writeFileSync5 } from "node:fs";
-import { join as join20 } from "node:path";
+import { existsSync as existsSync18, mkdirSync as mkdirSync6, readFileSync as readFileSync12, writeFileSync as writeFileSync6 } from "node:fs";
+import { join as join21 } from "node:path";
 import { getCleoHome as getCleoHome6 } from "@cleocode/paths";
 function globalConfigPath() {
   return configDirGlobalConfigPath();
 }
 function projectConfigPath(projectRoot) {
   const cleoDir = process.env["CLEO_DIR"] ?? ".cleo";
-  return join20(projectRoot, cleoDir, "config.json");
+  return join21(projectRoot, cleoDir, "config.json");
 }
 function readGlobalProviderKey(provider) {
   ensureGlobalConfigMigrated();
@@ -36183,8 +36460,8 @@ function readGlobalProviderKey(provider) {
 }
 function readFlatAnthropicKey() {
   try {
-    const keyFile = join20(getCleoHome6(), "anthropic-key");
-    if (!existsSync17(keyFile)) return null;
+    const keyFile = join21(getCleoHome6(), "anthropic-key");
+    if (!existsSync18(keyFile)) return null;
     const stored = readFileSync12(keyFile, "utf-8").trim();
     return stored || null;
   } catch {
@@ -36193,7 +36470,7 @@ function readFlatAnthropicKey() {
 }
 function readProviderKeyFromConfig(configFile, provider) {
   try {
-    if (!existsSync17(configFile)) return null;
+    if (!existsSync18(configFile)) return null;
     const raw = readFileSync12(configFile, "utf-8");
     const config = JSON.parse(raw);
     const llm = config["llm"];
@@ -36356,11 +36633,11 @@ function resolveProviderStatus(provider) {
 }
 function storeAnthropicApiKey(apiKey) {
   const dir = getCleoHome6();
-  if (!existsSync17(dir)) {
-    mkdirSync5(dir, { recursive: true });
+  if (!existsSync18(dir)) {
+    mkdirSync6(dir, { recursive: true });
   }
-  const keyFile = join20(dir, "anthropic-key");
-  writeFileSync5(keyFile, apiKey.trim(), { mode: 384 });
+  const keyFile = join21(dir, "anthropic-key");
+  writeFileSync6(keyFile, apiKey.trim(), { mode: 384 });
 }
 function clearAnthropicKeyCache() {
 }
@@ -36411,17 +36688,17 @@ var init_credentials2 = __esm({
 });
 
 // packages/core/src/llm/credentials-store.ts
-import { chmodSync, existsSync as existsSync18, mkdirSync as mkdirSync6, readFileSync as readFileSync13, statSync as statSync4, writeFileSync as writeFileSync6 } from "node:fs";
-import { dirname as dirname8, join as join21 } from "node:path";
+import { chmodSync, existsSync as existsSync19, mkdirSync as mkdirSync7, readFileSync as readFileSync13, statSync as statSync4, writeFileSync as writeFileSync7 } from "node:fs";
+import { dirname as dirname8, join as join22 } from "node:path";
 import { getCleoHome as getCleoHome7 } from "@cleocode/paths";
 function credentialsStorePath() {
-  return join21(getCleoHome7(), "llm-credentials.json");
+  return join22(getCleoHome7(), "llm-credentials.json");
 }
 function ensureFileInitialized(path) {
-  if (existsSync18(path)) return;
+  if (existsSync19(path)) return;
   const dir = dirname8(path);
-  if (!existsSync18(dir)) {
-    mkdirSync6(dir, { recursive: true, mode: 448 });
+  if (!existsSync19(dir)) {
+    mkdirSync7(dir, { recursive: true, mode: 448 });
   } else {
     try {
       chmodSync(dir, 448);
@@ -36429,7 +36706,7 @@ function ensureFileInitialized(path) {
     }
   }
   try {
-    writeFileSync6(path, `${JSON.stringify(emptyStore(), null, 2)}
+    writeFileSync7(path, `${JSON.stringify(emptyStore(), null, 2)}
 `, {
       encoding: "utf-8",
       flag: "wx",
@@ -36678,12 +36955,20 @@ function parseTokenResponse(provider, data) {
   };
 }
 async function extractErrorDetail2(resp) {
+  const clone = resp.clone();
   try {
-    const body = await resp.json();
+    const body = await clone.json();
     const desc2 = body["error_description"] ?? body["error"];
-    return desc2 ? ` \u2014 ${String(desc2)}` : "";
+    if (desc2) return ` \u2014 ${String(desc2)}`;
+    const text3 = JSON.stringify(body);
+    return ` \u2014 ${text3.slice(0, 512)}`;
   } catch {
-    return "";
+    try {
+      const text3 = (await resp.text()).trim();
+      return text3 ? ` \u2014 ${text3.slice(0, 512)}` : "";
+    } catch {
+      return "";
+    }
   }
 }
 var init_pkce = __esm({
@@ -36781,13 +37066,13 @@ var init_gemini = __esm({
 
 // packages/core/src/llm/stable-device-id.ts
 import { randomUUID } from "node:crypto";
-import { existsSync as existsSync19, mkdirSync as mkdirSync7, readFileSync as readFileSync14, renameSync as renameSync5, writeFileSync as writeFileSync7 } from "node:fs";
-import { dirname as dirname9, join as join22 } from "node:path";
+import { existsSync as existsSync20, mkdirSync as mkdirSync8, readFileSync as readFileSync14, renameSync as renameSync6, writeFileSync as writeFileSync8 } from "node:fs";
+import { dirname as dirname9, join as join23 } from "node:path";
 import { getCleoHome as getCleoHome8 } from "@cleocode/paths";
 function getStableDeviceId() {
   if (_cachedDeviceId !== null) return _cachedDeviceId;
-  const path = join22(getCleoHome8(), DEVICE_ID_FILE);
-  if (existsSync19(path)) {
+  const path = join23(getCleoHome8(), DEVICE_ID_FILE);
+  if (existsSync20(path)) {
     try {
       const raw = readFileSync14(path, "utf-8").trim();
       if (raw.length > 0) {
@@ -36800,12 +37085,12 @@ function getStableDeviceId() {
   const fresh = randomUUID();
   try {
     const dir = dirname9(path);
-    if (!existsSync19(dir)) {
-      mkdirSync7(dir, { recursive: true });
+    if (!existsSync20(dir)) {
+      mkdirSync8(dir, { recursive: true });
     }
     const tmpPath = `${path}.tmp.${process.pid}`;
-    writeFileSync7(tmpPath, fresh, { mode: 384 });
-    renameSync5(tmpPath, path);
+    writeFileSync8(tmpPath, fresh, { mode: 384 });
+    renameSync6(tmpPath, path);
   } catch {
   }
   _cachedDeviceId = fresh;
@@ -36980,7 +37265,10 @@ var init_openai = __esm({
       displayName: "OpenAI Codex (ChatGPT)",
       authTypes: ["api_key", "oauth"],
       baseUrl: "https://api.openai.com/v1",
-      defaultModel: "gpt-5-codex",
+      // Static fallback — catalog-driven resolver replaces this at runtime when a
+      // disk snapshot is available (T11773 · E8). Updated from stale 'gpt-5-codex'
+      // to the confirmed latest OpenAI model (catalog release_date 2026-04-23).
+      defaultModel: "gpt-5.5",
       aliases: ["codex", "chatgpt", "openai-codex"],
       oauth: OPENAI_CODEX_OAUTH
     };
@@ -37090,13 +37378,13 @@ var init_xai = __esm({
 
 // packages/core/src/llm/provider-registry/loader.ts
 import { readdirSync as readdirSync5, statSync as statSync5 } from "node:fs";
-import { join as join23 } from "node:path";
+import { join as join24 } from "node:path";
 import { pathToFileURL } from "node:url";
 function isPluginFile(filename) {
   return PLUGIN_EXTENSIONS.some((ext) => filename.endsWith(ext));
 }
 function getPluginDir() {
-  return join23(getCleoHome(), "plugins", "model-providers");
+  return join24(getCleoHome(), "plugins", "model-providers");
 }
 async function loadOnePlugin(absPath, api) {
   let mod;
@@ -37144,13 +37432,13 @@ async function scanAndLoadPlugins(pluginDir, api) {
   }
   const pluginFiles = entries.filter((name2) => !name2.startsWith(".") && isPluginFile(name2)).filter((name2) => {
     try {
-      return statSync5(join23(pluginDir, name2)).isFile();
+      return statSync5(join24(pluginDir, name2)).isFile();
     } catch {
       return false;
     }
   }).sort();
   for (const filename of pluginFiles) {
-    await loadOnePlugin(join23(pluginDir, filename), api);
+    await loadOnePlugin(join24(pluginDir, filename), api);
   }
 }
 async function runDiscovery(registerProvider2, builtins) {
@@ -37231,15 +37519,15 @@ var init_provider_registry = __esm({
 });
 
 // packages/core/src/llm/rate-limit-guard.ts
-import { existsSync as existsSync20, mkdirSync as mkdirSync8, unlinkSync as unlinkSync5 } from "node:fs";
-import { join as join24 } from "node:path";
+import { existsSync as existsSync21, mkdirSync as mkdirSync9, unlinkSync as unlinkSync6 } from "node:fs";
+import { join as join25 } from "node:path";
 import { getCleoHome as getCleoHome9 } from "@cleocode/paths";
 function sanitize(value) {
   return value.replace(/[^a-zA-Z0-9_-]/g, "_");
 }
 function rateLimitStatePath(provider, label) {
-  const dir = join24(getCleoHome9(), "rate-limit-state");
-  return join24(dir, `${sanitize(provider)}-${sanitize(label)}.json`);
+  const dir = join25(getCleoHome9(), "rate-limit-state");
+  return join25(dir, `${sanitize(provider)}-${sanitize(label)}.json`);
 }
 function parseResetFromHeaders(headers) {
   const get = (k) => {
@@ -37286,9 +37574,9 @@ async function recordRateLimit(provider, label, opts) {
     source = "default";
   }
   const filePath = rateLimitStatePath(provider, label);
-  const dir = join24(getCleoHome9(), "rate-limit-state");
-  if (!existsSync20(dir)) {
-    mkdirSync8(dir, { recursive: true });
+  const dir = join25(getCleoHome9(), "rate-limit-state");
+  if (!existsSync21(dir)) {
+    mkdirSync9(dir, { recursive: true });
   }
   const state = { resetAt, recordedAt: now, source };
   await withFileLock(filePath, () => {
@@ -38130,14 +38418,14 @@ var init_catalog_cache = __esm({
 
 // packages/core/src/llm/model-metadata.ts
 import { readFileSync as readFileSync15 } from "node:fs";
-import { dirname as dirname10, join as join25 } from "node:path";
+import { dirname as dirname10, join as join26 } from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 function getCuratedTable() {
   if (_curated !== void 0) {
     return _curated;
   }
   const thisDir = dirname10(fileURLToPath3(import.meta.url));
-  const jsonPath = join25(thisDir, "curated-models.json");
+  const jsonPath = join26(thisDir, "curated-models.json");
   const raw = JSON.parse(readFileSync15(jsonPath, "utf-8"));
   _curated = raw.models;
   return _curated;