@cleocode/core 2026.6.6 → 2026.6.7

package/dist/llm/plugin-facade.js

@@ -11331,6 +11331,87 @@ var init_nexus_scope_map = __esm({
   }
 });
 
+// packages/contracts/src/operations/output-contracts-data.ts
+var TASK_MUTATION_DATA_SCHEMA, tasksAddOutputContract, tasksAddBatchOutputContract, tasksUpdateOutputContract, tasksCompleteOutputContract;
+var init_output_contracts_data = __esm({
+  "packages/contracts/src/operations/output-contracts-data.ts"() {
+    "use strict";
+    TASK_MUTATION_DATA_SCHEMA = {
+      type: "object",
+      required: ["count", "created", "updated", "deleted"],
+      additionalProperties: true,
+      properties: {
+        count: { type: "number", description: "Number of records the mutation affected." },
+        created: {
+          type: "array",
+          description: 'Task IDs created by the mutation (bare strings, e.g. "T11692"). Empty for update/delete-only mutations.',
+          items: { type: "string" }
+        },
+        updated: {
+          type: "array",
+          description: "Task IDs updated by the mutation (bare strings). Empty for create/delete-only mutations.",
+          items: { type: "string" }
+        },
+        deleted: {
+          type: "array",
+          description: "Task IDs deleted by the mutation (bare strings). Empty for create/update-only mutations.",
+          items: { type: "string" }
+        },
+        ids: {
+          type: "array",
+          description: "Deprecated alias for the non-empty bucket. Prefer created/updated/deleted.",
+          items: { type: "string" }
+        },
+        dryRun: { type: "boolean", description: "True when this was a preview-only mutation." },
+        status: { type: "string", description: "Post-mutation task status (add/update/complete)." }
+      }
+    };
+    tasksAddOutputContract = {
+      operation: "tasks.add",
+      shapeNote: 'The created task ID (bare string) is at /data/created/0 \u2014 NOT /data/created/0/id. Example: /data/created/0 \u2192 "T11692".',
+      dataSchema: { ...TASK_MUTATION_DATA_SCHEMA },
+      fieldPointers: ["/data/created/0", "/data/count"]
+    };
+    tasksAddBatchOutputContract = {
+      operation: "tasks.add-batch",
+      shapeNote: "Atomic batch insert. Each created task ID (bare string) is in /data/created (array). Dry-run projections are at root: /data/wouldCreate and /data/insertedCount (=0). NOT under /data/dryRunSummary.",
+      dataSchema: {
+        type: "object",
+        required: ["count", "created", "updated", "deleted"],
+        additionalProperties: true,
+        properties: {
+          ...TASK_MUTATION_DATA_SCHEMA.properties,
+          wouldCreate: {
+            type: "number",
+            description: "Dry-run: predicted write count. Present only when dryRun=true."
+          },
+          insertedCount: {
+            type: "number",
+            description: "Dry-run: always 0 (no DB write). Present only when dryRun=true."
+          },
+          wouldAffect: {
+            type: "number",
+            description: "Dry-run: generic affected count. Present only when dryRun=true."
+          }
+        }
+      },
+      fieldPointers: ["/data/created/0", "/data/count", "/data/wouldCreate", "/data/insertedCount"]
+    };
+    tasksUpdateOutputContract = {
+      operation: "tasks.update",
+      shapeNote: "The updated task ID (bare string) is at /data/updated/0 \u2014 NOT /data/updated/0/id. Use /data/status for the post-mutation status.",
+      dataSchema: { ...TASK_MUTATION_DATA_SCHEMA },
+      fieldPointers: ["/data/updated/0", "/data/status", "/data/count"]
+    };
+    tasksCompleteOutputContract = {
+      operation: "tasks.complete",
+      shapeNote: "Completion is a status mutation \u2014 the task ID (bare string) is at /data/updated/0 (status=done). Use /data/status for the post-mutation status.",
+      dataSchema: { ...TASK_MUTATION_DATA_SCHEMA },
+      fieldPointers: ["/data/updated/0", "/data/status", "/data/count"]
+    };
+  }
+});
+
 // packages/contracts/src/peer.ts
 var init_peer = __esm({
   "packages/contracts/src/peer.ts"() {
@@ -12591,6 +12672,7 @@ var init_src = __esm({
     init_docs();
     init_operations();
     init_nexus_scope_map();
+    init_output_contracts_data();
     init_params();
     init_tasks();
     init_peer();
@@ -22560,8 +22642,8 @@ function probeAndMarkApplied(nativeDb, migration, logSubsystem) {
   });
   if (allAltersPresent && allTablesPresent && allIndexesPresent && allTriggersPresent) {
     insertJournalEntry(nativeDb, migration.hash, migration.folderMillis, migration.name ?? "");
-    const log5 = getLogger(logSubsystem);
-    log5.debug(
+    const log7 = getLogger(logSubsystem);
+    log7.debug(
       {
         migration: migration.name,
         alters: alterTargets.length,
@@ -22601,14 +22683,14 @@ function reconcileJournal(nativeDb, migrationsFolder, existenceTable2, logSubsys
     if (hasOrphanedEntries) {
       const dbHashes = new Set(dbEntries.map((e) => e.hash));
       const allLocalHashesPresentInDb = localMigrations.every((m) => dbHashes.has(m.hash));
-      const log5 = getLogger(logSubsystem);
+      const log7 = getLogger(logSubsystem);
       if (allLocalHashesPresentInDb) {
-        log5.debug(
+        log7.debug(
           { extra: orphanedEntries.length },
           `Migration journal has ${orphanedEntries.length} entries for migrations not known to this install (DB is ahead). Skipping reconciliation.`
         );
       } else {
-        log5.warn(
+        log7.warn(
           { orphaned: orphanedEntries.length },
           `Detected ${orphanedEntries.length} true-orphan journal entries from a previous CLEO lineage. Reconciling via DDL probe.`
         );
@@ -22644,8 +22726,8 @@ function reconcileJournal(nativeDb, migrationsFolder, existenceTable2, logSubsys
       if (alterMatches.length === 0) {
         const stripped = fullSql.replace(/--[^\n]*/g, "").replace(/\/\*[\s\S]*?\*\//g, "").trim();
         if (stripped === "") {
-          const log5 = getLogger(logSubsystem);
-          log5.debug(
+          const log7 = getLogger(logSubsystem);
+          log7.debug(
             { migration: migration.name },
             `Migration ${migration.name} is a comment-only baseline marker \u2014 marking applied on existing DB.`
           );
@@ -22682,8 +22764,8 @@ function reconcileJournal(nativeDb, migrationsFolder, existenceTable2, logSubsys
         }
       }
       if (missingColumns.length === 0) {
-        const log5 = getLogger(logSubsystem);
-        log5.warn(
+        const log7 = getLogger(logSubsystem);
+        log7.warn(
           { migration: migration.name, columns: alterMatches },
           `Detected partially-applied migration ${migration.name} \u2014 columns exist but journal entry missing. Auto-reconciling.`
         );
@@ -22691,8 +22773,8 @@ function reconcileJournal(nativeDb, migrationsFolder, existenceTable2, logSubsys
         continue;
       }
       if (existingColumns.length > 0 && missingColumns.length > 0) {
-        const log5 = getLogger(logSubsystem);
-        log5.warn(
+        const log7 = getLogger(logSubsystem);
+        log7.warn(
           {
             migration: migration.name,
             existingColumns: existingColumns.map((c) => `${c.table}.${c.column}`),
@@ -22704,12 +22786,12 @@ function reconcileJournal(nativeDb, migrationsFolder, existenceTable2, logSubsys
           if (!tableExists(nativeDb, table)) continue;
           try {
             nativeDb.exec(`ALTER TABLE ${table} ADD COLUMN ${column}${ddl ? ` ${ddl}` : ""}`);
-            log5.warn(
+            log7.warn(
               { migration: migration.name, table, column },
               `T920: Added missing column ${table}.${column} to complete partial migration.`
             );
           } catch {
-            log5.warn(
+            log7.warn(
               { migration: migration.name, table, column },
               `T920: Could not add missing column ${table}.${column} \u2014 will let Drizzle migrate() handle it.`
             );
@@ -22729,8 +22811,8 @@ function reconcileJournal(nativeDb, migrationsFolder, existenceTable2, logSubsys
     for (const entry of unnamedEntries) {
       const migrationName = hashToName.get(entry.hash);
       if (!migrationName) continue;
-      const log5 = getLogger(logSubsystem);
-      log5.debug(
+      const log7 = getLogger(logSubsystem);
+      log7.debug(
         { id: entry.id, hash: entry.hash, name: migrationName },
         `Backfilling missing name on journal entry id=${entry.id} (Drizzle v1 beta legacy compat).`
       );
@@ -22805,13 +22887,13 @@ function ensureColumns(nativeDb, tableName, requiredColumns, logSubsystem, conte
   const existingCols = new Set(columns.map((c) => c.name));
   for (const req of requiredColumns) {
     if (!existingCols.has(req.name)) {
-      const log5 = getLogger(logSubsystem);
+      const log7 = getLogger(logSubsystem);
       const message = `Adding missing column ${tableName}.${req.name} via ALTER TABLE`;
       const fields = { column: req.name, context };
       if (context === "fresh") {
-        log5.error(fields, `${message} \u2014 MIGRATION DEFECT (fresh DB should not need repair)`);
+        log7.error(fields, `${message} \u2014 MIGRATION DEFECT (fresh DB should not need repair)`);
       } else {
-        log5.warn(fields, message);
+        log7.warn(fields, message);
       }
       nativeDb.exec(`ALTER TABLE ${tableName} ADD COLUMN ${req.name} ${req.ddl}`);
     }
@@ -31436,162 +31518,6 @@ var init_open_cleo_db = __esm({
   }
 });
 
-// packages/core/src/store/exodus/column-transforms.ts
-function typeDefaultLiteral(colType) {
-  const upper = colType.toUpperCase();
-  if (upper.includes("INT")) return "0";
-  if (upper.includes("REAL") || upper.includes("FLOAT") || upper.includes("DOUBLE")) return "0.0";
-  if (upper.includes("BLOB")) return "x''";
-  return "''";
-}
-function enumNormExpr(targetTableName, col, srcRef) {
-  const key = `${targetTableName}.${col}`;
-  const fn = ENUM_NORMALIZATIONS.get(key);
-  return fn ? fn(srcRef) : null;
-}
-function numericClampExpr(targetTableName, col, srcRef) {
-  const key = `${targetTableName}.${col}`;
-  const fn = NUMERIC_CLAMPS.get(key);
-  return fn ? fn(srcRef) : null;
-}
-function buildEpochToIsoExpr(srcRef) {
-  return `CASE WHEN ${srcRef} IS NULL THEN NULL WHEN ${srcRef} < ${EPOCH_SECONDS_THRESHOLD} THEN strftime('%Y-%m-%dT%H:%M:%fZ', ${srcRef}, 'unixepoch') ELSE strftime('%Y-%m-%dT%H:%M:%fZ', ${srcRef}/1000.0, 'unixepoch') END`;
-}
-function detectIsoGlobColumns(db, tableName, targetSchema = "main") {
-  const escapedTable = tableName.replace(/'/g, "''");
-  const row = db.prepare(
-    `SELECT sql FROM "${targetSchema}".sqlite_master WHERE type='table' AND name='${escapedTable}'`
-  ).get();
-  if (!row?.sql) return /* @__PURE__ */ new Set();
-  const isoColumns = /* @__PURE__ */ new Set();
-  ISO_CHECK_REGEX.lastIndex = 0;
-  for (const match of row.sql.matchAll(ISO_CHECK_REGEX)) {
-    isoColumns.add(match[1]);
-  }
-  return isoColumns;
-}
-function isIntegerSourceType(srcType) {
-  const upper = srcType.toUpperCase();
-  return upper.includes("INT") || upper === "" || upper === "NUMERIC";
-}
-function buildDigestExpr(targetTableName, col, srcType, isoGlobCols) {
-  const srcRef = `"${col}"`;
-  if (isoGlobCols.has(col) && isIntegerSourceType(srcType)) {
-    return buildEpochToIsoExpr(srcRef);
-  }
-  const clampExpr = numericClampExpr(targetTableName, col, srcRef);
-  if (clampExpr !== null) return clampExpr;
-  const normExpr = enumNormExpr(targetTableName, col, srcRef);
-  if (normExpr !== null) return normExpr;
-  return srcRef;
-}
-var ENUM_NORMALIZATIONS, NUMERIC_CLAMPS, ISO_CHECK_REGEX, EPOCH_SECONDS_THRESHOLD;
-var init_column_transforms = __esm({
-  "packages/core/src/store/exodus/column-transforms.ts"() {
-    "use strict";
-    ENUM_NORMALIZATIONS = /* @__PURE__ */ new Map([
-      // --- task_commits.link_source -------------------------------------------
-      // 'commit-message' → 'commit-subject' (pre-T9506 legacy value)
-      [
-        "tasks_task_commits.link_source",
-        (src) => `CASE ${src} WHEN 'commit-message' THEN 'commit-subject' ELSE ${src} END`
-      ],
-      // --- architecture_decisions.status (case + date-suffix normalization) ----
-      // 'Accepted', 'ACCEPTED', 'approved', 'Accepted (2026-04-18)', … → 'accepted'
-      // 'Proposed', 'PROPOSED' → 'proposed'
-      // 'Superseded', 'SUPERSEDED' → 'superseded'
-      [
-        "tasks_architecture_decisions.status",
-        (src) => `CASE WHEN lower(${src}) = 'accepted' OR lower(${src}) LIKE 'accepted %' OR lower(${src}) = 'approved' THEN 'accepted' WHEN lower(${src}) = 'proposed' THEN 'proposed' WHEN lower(${src}) = 'superseded' THEN 'superseded' WHEN lower(${src}) = 'deprecated' THEN 'deprecated' ELSE ${src} END`
-      ],
-      // --- brain_* enum normalizations REMOVED (T11647) -----------------------
-      // The brain memory family now lands in the consolidated cleo.db in its LEGACY
-      // RUNTIME shape — INTEGER epoch timestamps and, critically, NO SQL CHECK
-      // constraints (the `text({ enum })` unions are enforced only at the
-      // application layer, exactly as the runtime `drizzle-brain` tables are). With
-      // no brain CHECK constraint to satisfy, exodus MUST copy every brain enum
-      // value VERBATIM — coercing them (e.g. source_type 'observer-compressed'/
-      // 'sleep-consolidation' → 'agent', type 'observation'/'proposal'/'pattern' →
-      // nearest) would now be unnecessary data CORRUPTION, not a constraint fix.
-      // The previous brain entries (brain_observations.{source_type,type},
-      // brain_decisions.{confirmation_state,decision_category,confidence,outcome,
-      // decided_by}) are therefore deleted. The non-brain entries below still apply
-      // because those consolidated tables retain their CHECK constraints.
-      // --- tasks_token_usage.transport (T11548 → REMOVED T11649) ---------------
-      // NO normalization. 'mcp' is a first-class transport origin (MCP-gateway
-      // requests) and is preserved verbatim. The consolidated CHECK enum was WIDENED
-      // to include 'mcp' (canonical TOKEN_USAGE_TRANSPORTS SSoT + forward migration
-      // 20260602000002_t11649-token-usage-transport-mcp), so the value lands without
-      // coercion. The earlier 'mcp' → 'agent' mapping was a silent semantic alteration
-      // of ~194 rows (count-preserving, NOT integrity-preserving) — see T11649.
-      // (brain_decisions.{decision_category,confidence} normalizations removed —
-      //  T11647: brain target = runtime shape with no CHECK; copy values verbatim.)
-      // --- tasks_commits.conventional_type (T11548 + T11578) -------------------
-      // The consolidated CHECK enum is feat/fix/chore/docs/refactor/test/build/ci/
-      // perf/revert/breaking. Real git history carries non-conventional subjects:
-      //   - 'style'           → 'chore' (pre-T11548 mapping; no 'style' in enum).
-      //   - 'merge'/'release' → 'chore' (T11578): merge + release commits are
-      //     maintenance-class; the precise semantic is preserved by the dedicated
-      //     `is_merge_commit` / `is_release_commit` boolean columns, so collapsing
-      //     `conventional_type` to the maintenance catch-all 'chore' is lossless at
-      //     the row grain. Without this the 'merge'/'release' rows violate the CHECK,
-      //     `INSERT OR IGNORE` drops the WHOLE commits table, and the exodus-on-open
-      //     data-continuity gate aborts the cutover (T11578 CI regression).
-      //   - any OTHER out-of-enum value → 'chore' (defensive: future non-conventional
-      //     subjects must never re-break the zero-deficit gate; the boolean flags and
-      //     raw subject text remain the precise provenance).
-      [
-        "tasks_commits.conventional_type",
-        (src) => `CASE WHEN ${src} IS NULL THEN NULL WHEN ${src} IN ('feat', 'fix', 'chore', 'docs', 'refactor', 'test', 'build', 'ci', 'perf', 'revert', 'breaking') THEN ${src} ELSE 'chore' END`
-      ],
-      // --- tasks_task_relations.relation_type (T11548) -------------------------
-      // 'grouped-by' → 'groups' (enum: related/blocks/duplicates/absorbs/fixes/extends/
-      // supersedes/groups). 4 rows.
-      [
-        "tasks_task_relations.relation_type",
-        (src) => `CASE ${src} WHEN 'grouped-by' THEN 'groups' ELSE ${src} END`
-      ],
-      // --- tasks_lifecycle_stages.stage_name (T11548) --------------------------
-      // Legacy camelCase / past-tense values → canonical snake_case stage names.
-      // 'implemented' → 'implementation', 'qaPassed' → 'validation',
-      // 'testsPassed' → 'testing'. 3 rows.
-      [
-        "tasks_lifecycle_stages.stage_name",
-        (src) => `CASE ${src} WHEN 'implemented' THEN 'implementation' WHEN 'qaPassed' THEN 'validation' WHEN 'testsPassed' THEN 'testing' ELSE ${src} END`
-      ],
-      // --- tasks_architecture_decisions.gate_status (T11548) ------------------
-      // 'passed (T5313 consensus)' → 'passed', 'approved' → 'passed'
-      // (enum: pending/passed/failed/waived). 2 rows.
-      [
-        "tasks_architecture_decisions.gate_status",
-        (src) => `CASE WHEN ${src} LIKE 'passed%' THEN 'passed' WHEN ${src} = 'approved' THEN 'passed' ELSE ${src} END`
-      ],
-      // --- tasks_evidence_ac_bindings.binding_type (T11548) -------------------
-      // Values with a 'validator:...' prefix → 'direct'
-      // (enum: direct/satisfies/coverage). 3 rows.
-      // Strip the namespace prefix introduced before the enum was tightened.
-      [
-        "tasks_evidence_ac_bindings.binding_type",
-        (src) => `CASE WHEN ${src} LIKE 'validator:%' THEN 'direct' ELSE ${src} END`
-      ]
-      // (brain_decisions.{outcome,decided_by} normalizations removed — T11647:
-      //  brain target = runtime shape with no CHECK; legacy values like 'accepted',
-      //  'rejected', 'prime' now survive VERBATIM instead of being coerced.)
-    ]);
-    NUMERIC_CLAMPS = /* @__PURE__ */ new Map([
-      // --- brain_weight_history.delta_weight (T11782) -------------------------
-      // +Inf → 1.0 (max canonical reinforcement), -Inf → -1.0 (max canonical
-      // depression), NaN → 0.0 (no-op delta). Finite values pass through.
-      [
-        "brain_weight_history.delta_weight",
-        (src) => `CASE WHEN ${src} = 9e999 THEN 1.0 WHEN ${src} = -9e999 THEN -1.0 WHEN ${src} != ${src} THEN 0.0 ELSE ${src} END`
-      ]
-    ]);
-    ISO_CHECK_REGEX = /CHECK\s*\(\s*"([^"]+)"\s+IS\s+NULL\s+OR\s+"[^"]+"\s+GLOB\s+'\[0-9/gi;
-    EPOCH_SECONDS_THRESHOLD = 1e11;
-  }
-});
-
 // packages/core/src/store/exodus/table-name-map.ts
 function resolveTableTargetScope(sourceName, legacyTable, sourceScope) {
   if (inferSourceKind(sourceName) === "nexus" && NEXUS_GRAPH_PROJECT_TABLES.has(legacyTable)) {
@@ -31920,6 +31846,475 @@ var init_table_name_map = __esm({
   }
 });
 
+// packages/core/src/store/exodus/count-parity.ts
+import { existsSync as existsSync4 } from "node:fs";
+function listTables(db) {
+  return db.prepare(
+    "SELECT name FROM sqlite_master WHERE type='table' AND name NOT LIKE 'sqlite_%' AND name NOT LIKE '__drizzle_%' ORDER BY name"
+  ).all().map((r) => r.name);
+}
+function tableExists2(db, tableName) {
+  const escaped = tableName.replace(/'/g, "''");
+  return db.prepare(`SELECT 1 FROM sqlite_master WHERE type='table' AND name='${escaped}'`).get() !== void 0;
+}
+function rowCount(db, tableName) {
+  try {
+    const row = db.prepare(`SELECT COUNT(*) AS c FROM "${tableName}"`).get();
+    return Number(row?.c ?? 0);
+  } catch {
+    return null;
+  }
+}
+function computeCountParity(sources, projectDbPath, globalDbPath) {
+  const entries = [];
+  let skipped = 0;
+  if (!existsSync4(projectDbPath) || !existsSync4(globalDbPath)) {
+    return { ok: false, entries: [], deficits: [], checked: 0, skipped: 0 };
+  }
+  const projectSnap = openCleoDbSnapshot(projectDbPath, { readOnly: true });
+  const globalSnap = openCleoDbSnapshot(globalDbPath, { readOnly: true });
+  try {
+    for (const src of sources) {
+      if (!existsSync4(src.path)) continue;
+      const srcSnap = openCleoDbSnapshot(src.path, { readOnly: true });
+      try {
+        for (const legacyTable of listTables(srcSnap.db)) {
+          const resolution = resolveConsolidatedTableName(src.name, legacyTable);
+          if (resolution.kind === "skip") {
+            skipped++;
+            continue;
+          }
+          const targetTable = resolution.targetName;
+          const scope = resolveTableTargetScope(src.name, legacyTable, src.targetScope);
+          const targetSnap = scope === "project" ? projectSnap : globalSnap;
+          const sourceCount = rowCount(srcSnap.db, legacyTable);
+          if (sourceCount === null) {
+            skipped++;
+            continue;
+          }
+          const targetCount = tableExists2(targetSnap.db, targetTable) ? rowCount(targetSnap.db, targetTable) ?? 0 : 0;
+          const deficit = targetCount < sourceCount ? sourceCount - targetCount : 0;
+          entries.push({
+            sourceDb: src.name,
+            sourceTable: legacyTable,
+            targetTable,
+            scope,
+            sourceCount,
+            targetCount,
+            deficit
+          });
+        }
+      } finally {
+        srcSnap.close();
+      }
+    }
+  } finally {
+    projectSnap.close();
+    globalSnap.close();
+  }
+  const deficits = entries.filter((e) => e.deficit > 0);
+  if (deficits.length > 0) {
+    log2.warn(
+      { deficitCount: deficits.length, sample: deficits.slice(0, 5) },
+      `exodus count-parity: ${deficits.length} table(s) have FEWER rows in the consolidated target than the legacy source`
+    );
+  }
+  return { ok: deficits.length === 0, entries, deficits, checked: entries.length, skipped };
+}
+var log2;
+var init_count_parity = __esm({
+  "packages/core/src/store/exodus/count-parity.ts"() {
+    "use strict";
+    init_logger2();
+    init_open_cleo_db();
+    init_table_name_map();
+    log2 = getLogger("exodus-count-parity");
+  }
+});
+
+// packages/core/src/store/exodus/plan.ts
+import { existsSync as existsSync5, readdirSync as readdirSync2, statfsSync, statSync } from "node:fs";
+import { join as join7 } from "node:path";
+function computeRequiredBytes(totalSourceBytes, largestSourceBytes) {
+  return Math.ceil(STAGING_HEADROOM_FACTOR * largestSourceBytes) + totalSourceBytes;
+}
+function buildSourceDescriptors(cwd) {
+  const cleoDir = resolveCleoDir(cwd);
+  const cleoHome = getCleoHome();
+  return [
+    // Project-tier — go into consolidated project-scope cleo.db
+    {
+      name: "tasks",
+      path: join7(cleoDir, "tasks.db"),
+      targetScope: "project"
+    },
+    {
+      name: "brain (project)",
+      path: join7(cleoDir, "brain.db"),
+      targetScope: "project"
+    },
+    {
+      name: "conduit",
+      path: join7(cleoDir, "conduit.db"),
+      targetScope: "project"
+    },
+    // Global-tier — go into consolidated global-scope cleo.db
+    {
+      name: "nexus",
+      path: join7(cleoHome, "nexus.db"),
+      targetScope: "global"
+    },
+    {
+      name: "signaldock",
+      path: join7(cleoHome, "signaldock.db"),
+      targetScope: "global"
+    },
+    {
+      name: "skills",
+      path: join7(cleoHome, "skills.db"),
+      targetScope: "global"
+    }
+  ];
+}
+function safeFileBytes(filePath) {
+  try {
+    return statSync(filePath).size;
+  } catch {
+    return 0;
+  }
+}
+function getAvailableBytes(dir) {
+  try {
+    const result = statfsSync(dir);
+    return (result.bavail ?? result.bfree ?? 0) * (result.bsize ?? 4096);
+  } catch {
+    return 0;
+  }
+}
+function deriveStagingDirName() {
+  const iso = (/* @__PURE__ */ new Date()).toISOString().replace(/[:]/g, "").replace(/\..+Z$/, "Z");
+  return `exodus-staging-${iso}`;
+}
+function findExistingStaging(cleoDir) {
+  try {
+    const entries = readdirSync2(cleoDir, { withFileTypes: true });
+    const stagingDirs = entries.filter((e) => e.isDirectory() && e.name.startsWith("exodus-staging-")).map((e) => e.name).sort().reverse();
+    if (stagingDirs.length > 0) {
+      return join7(cleoDir, stagingDirs[0]);
+    }
+  } catch {
+  }
+  return null;
+}
+function buildExodusPlan(cwd) {
+  const cleoDir = resolveCleoDir(cwd);
+  const sources = buildSourceDescriptors(cwd);
+  const sourceBytes = sources.map((s) => safeFileBytes(s.path));
+  const totalSourceBytes = sourceBytes.reduce((sum, b) => sum + b, 0);
+  const largestSourceBytes = sourceBytes.reduce((max, b) => Math.max(max, b), 0);
+  const requiredBytes = computeRequiredBytes(totalSourceBytes, largestSourceBytes);
+  const availableBytes = getAvailableBytes(cleoDir);
+  const diskPreflight = totalSourceBytes === 0 || availableBytes >= requiredBytes;
+  const existingStaging = findExistingStaging(cleoDir);
+  const stagingDir = existingStaging ?? join7(cleoDir, deriveStagingDirName());
+  const resumeFromStaging = existingStaging !== null;
+  const projectDbPath = resolveDualScopeDbPath("project", cwd);
+  const globalDbPath = resolveDualScopeDbPath("global");
+  return {
+    sources,
+    totalSourceBytes,
+    largestSourceBytes,
+    requiredBytes,
+    availableBytes,
+    diskPreflight,
+    stagingCopyThresholdBytes: STAGING_COPY_SKIP_THRESHOLD_BYTES,
+    stagingDir,
+    resumeFromStaging,
+    projectDbPath,
+    globalDbPath
+  };
+}
+function sourcesPresent(sources) {
+  return sources.some((s) => existsSync5(s.path));
+}
+var STAGING_HEADROOM_FACTOR, STAGING_COPY_SKIP_THRESHOLD_BYTES;
+var init_plan2 = __esm({
+  "packages/core/src/store/exodus/plan.ts"() {
+    "use strict";
+    init_paths();
+    init_dual_scope_db();
+    STAGING_HEADROOM_FACTOR = 1.2;
+    STAGING_COPY_SKIP_THRESHOLD_BYTES = 256 * 1024 * 1024;
+  }
+});
+
+// packages/core/src/store/exodus/health.ts
+import { existsSync as existsSync6, statSync as statSync2 } from "node:fs";
+function buildExodusHealth(cwd) {
+  const plan = buildExodusPlan(cwd);
+  const anyLegacyPresent = plan.sources.some((s) => existsSync6(s.path));
+  const parity = anyLegacyPresent ? computeCountParity(plan.sources, plan.projectDbPath, plan.globalDbPath) : { ok: true, entries: [], deficits: [], checked: 0, skipped: 0 };
+  const consolidatedExistsByScope = {
+    project: existsSync6(plan.projectDbPath),
+    global: existsSync6(plan.globalDbPath)
+  };
+  const buildScope = (scope) => {
+    const sources = plan.sources.filter((s) => s.targetScope === scope).map((s) => {
+      const present = existsSync6(s.path);
+      let bytes = 0;
+      if (present) {
+        try {
+          bytes = statSync2(s.path).size;
+        } catch {
+          bytes = 0;
+        }
+      }
+      return { name: s.name, path: s.path, present, bytes, large: bytes >= LARGE_DB_BYTES };
+    });
+    const markerPresent = hasExodusCompleteMarker(scope, cwd);
+    const legacyPresent = sources.some((s) => s.present);
+    const consolidatedExists = consolidatedExistsByScope[scope];
+    const scopeEntries = parity.entries.filter((e) => e.scope === scope);
+    const scopeHasDeficit = scopeEntries.some((e) => e.deficit > 0);
+    const scopeHasData = scopeEntries.some((e) => e.targetCount > 0);
+    let state;
+    if (markerPresent) {
+      state = "sealed";
+    } else if (legacyPresent && consolidatedExists && scopeHasData && !scopeHasDeficit) {
+      state = "migrated-unsealed";
+    } else if (legacyPresent) {
+      state = "needs-migration";
+    } else {
+      state = "no-cleo-data";
+    }
+    const stranded = sources.filter((s) => s.present && markerPresent).map((s) => s.name);
+    return {
+      scope,
+      state,
+      consolidatedExists,
+      markerPresent,
+      legacySources: sources,
+      strandedResidue: stranded
+    };
+  };
+  const project = buildScope("project");
+  const global = buildScope("global");
+  const largeLegacyDbs = [
+    ...project.legacySources.filter((s) => s.large).map((s) => ({ name: s.name, scope: "project", bytes: s.bytes })),
+    ...global.legacySources.filter((s) => s.large).map((s) => ({ name: s.name, scope: "global", bytes: s.bytes }))
+  ];
+  const recommendations = [];
+  for (const sc of [project, global]) {
+    if (sc.state === "migrated-unsealed") {
+      recommendations.push(
+        `${sc.scope}: data is consolidated but unsealed \u2014 run \`cleo exodus seal --scope ${sc.scope}\` to archive legacy DBs + stop on-open re-firing.`
+      );
+    } else if (sc.state === "needs-migration") {
+      recommendations.push(
+        `${sc.scope}: legacy data not yet consolidated \u2014 run \`cleo exodus migrate --scope ${sc.scope}\`.`
+      );
+    } else if (sc.strandedResidue.length > 0) {
+      recommendations.push(
+        `${sc.scope}: ${sc.strandedResidue.length} stranded legacy DB(s) after a sealed cutover \u2014 run \`cleo doctor exodus-residue --fix\`.`
+      );
+    }
+  }
+  if (largeLegacyDbs.length > 0) {
+    recommendations.push(
+      `${largeLegacyDbs.length} large legacy DB(s) (\u2265500 MB) \u2014 migrate these only with the streamed-verify build (T11834) to avoid the verify OOM.`
+    );
+  }
+  if (!parity.ok) {
+    recommendations.push(
+      `${parity.deficits.length} table(s) show a row deficit in cleo.db \u2014 DO NOT seal; run \`cleo exodus migrate\` first.`
+    );
+  }
+  return {
+    project,
+    global,
+    diskHeadroomOk: plan.diskPreflight,
+    availableBytes: plan.availableBytes,
+    requiredBytes: 3 * plan.totalSourceBytes,
+    killSwitchSet: process.env.CLEO_DISABLE_EXODUS_ON_OPEN === "1",
+    dataParityOk: parity.ok,
+    dataDeficits: parity.deficits.length,
+    largeLegacyDbs,
+    recommendations
+  };
+}
+var LARGE_DB_BYTES;
+var init_health2 = __esm({
+  "packages/core/src/store/exodus/health.ts"() {
+    "use strict";
+    init_archive2();
+    init_count_parity();
+    init_plan2();
+    LARGE_DB_BYTES = 500 * 1024 * 1024;
+  }
+});
+
+// packages/core/src/store/exodus/column-transforms.ts
+function typeDefaultLiteral(colType) {
+  const upper = colType.toUpperCase();
+  if (upper.includes("INT")) return "0";
+  if (upper.includes("REAL") || upper.includes("FLOAT") || upper.includes("DOUBLE")) return "0.0";
+  if (upper.includes("BLOB")) return "x''";
+  return "''";
+}
+function enumNormExpr(targetTableName, col, srcRef) {
+  const key = `${targetTableName}.${col}`;
+  const fn = ENUM_NORMALIZATIONS.get(key);
+  return fn ? fn(srcRef) : null;
+}
+function numericClampExpr(targetTableName, col, srcRef) {
+  const key = `${targetTableName}.${col}`;
+  const fn = NUMERIC_CLAMPS.get(key);
+  return fn ? fn(srcRef) : null;
+}
+function buildEpochToIsoExpr(srcRef) {
+  return `CASE WHEN ${srcRef} IS NULL THEN NULL WHEN ${srcRef} < ${EPOCH_SECONDS_THRESHOLD} THEN strftime('%Y-%m-%dT%H:%M:%fZ', ${srcRef}, 'unixepoch') ELSE strftime('%Y-%m-%dT%H:%M:%fZ', ${srcRef}/1000.0, 'unixepoch') END`;
+}
+function detectIsoGlobColumns(db, tableName, targetSchema = "main") {
+  const escapedTable = tableName.replace(/'/g, "''");
+  const row = db.prepare(
+    `SELECT sql FROM "${targetSchema}".sqlite_master WHERE type='table' AND name='${escapedTable}'`
+  ).get();
+  if (!row?.sql) return /* @__PURE__ */ new Set();
+  const isoColumns = /* @__PURE__ */ new Set();
+  ISO_CHECK_REGEX.lastIndex = 0;
+  for (const match of row.sql.matchAll(ISO_CHECK_REGEX)) {
+    isoColumns.add(match[1]);
+  }
+  return isoColumns;
+}
+function isIntegerSourceType(srcType) {
+  const upper = srcType.toUpperCase();
+  return upper.includes("INT") || upper === "" || upper === "NUMERIC";
+}
+function maybeCoalesceNotNull(expr, tgtCol) {
+  if (tgtCol === void 0) return expr;
+  const isNotNullWithoutDefault = tgtCol.notnull === 1 && tgtCol.dflt_value === null;
+  if (!isNotNullWithoutDefault) return expr;
+  return `COALESCE(${expr}, ${typeDefaultLiteral(tgtCol.type)})`;
+}
+function buildDigestExpr(targetTableName, col, srcType, isoGlobCols, tgtCol) {
+  const srcRef = `"${col}"`;
+  if (isoGlobCols.has(col) && isIntegerSourceType(srcType)) {
+    return maybeCoalesceNotNull(buildEpochToIsoExpr(srcRef), tgtCol);
+  }
+  const clampExpr = numericClampExpr(targetTableName, col, srcRef);
+  if (clampExpr !== null) return maybeCoalesceNotNull(clampExpr, tgtCol);
+  const normExpr = enumNormExpr(targetTableName, col, srcRef);
+  if (normExpr !== null) return maybeCoalesceNotNull(normExpr, tgtCol);
+  return maybeCoalesceNotNull(srcRef, tgtCol);
+}
+var ENUM_NORMALIZATIONS, NUMERIC_CLAMPS, ISO_CHECK_REGEX, EPOCH_SECONDS_THRESHOLD;
+var init_column_transforms = __esm({
+  "packages/core/src/store/exodus/column-transforms.ts"() {
+    "use strict";
+    ENUM_NORMALIZATIONS = /* @__PURE__ */ new Map([
+      // --- task_commits.link_source -------------------------------------------
+      // 'commit-message' → 'commit-subject' (pre-T9506 legacy value)
+      [
+        "tasks_task_commits.link_source",
+        (src) => `CASE ${src} WHEN 'commit-message' THEN 'commit-subject' ELSE ${src} END`
+      ],
+      // --- architecture_decisions.status (case + date-suffix normalization) ----
+      // 'Accepted', 'ACCEPTED', 'approved', 'Accepted (2026-04-18)', … → 'accepted'
+      // 'Proposed', 'PROPOSED' → 'proposed'
+      // 'Superseded', 'SUPERSEDED' → 'superseded'
+      [
+        "tasks_architecture_decisions.status",
+        (src) => `CASE WHEN lower(${src}) = 'accepted' OR lower(${src}) LIKE 'accepted %' OR lower(${src}) = 'approved' THEN 'accepted' WHEN lower(${src}) = 'proposed' THEN 'proposed' WHEN lower(${src}) = 'superseded' THEN 'superseded' WHEN lower(${src}) = 'deprecated' THEN 'deprecated' ELSE ${src} END`
+      ],
+      // --- brain_* enum normalizations REMOVED (T11647) -----------------------
+      // The brain memory family now lands in the consolidated cleo.db in its LEGACY
+      // RUNTIME shape — INTEGER epoch timestamps and, critically, NO SQL CHECK
+      // constraints (the `text({ enum })` unions are enforced only at the
+      // application layer, exactly as the runtime `drizzle-brain` tables are). With
+      // no brain CHECK constraint to satisfy, exodus MUST copy every brain enum
+      // value VERBATIM — coercing them (e.g. source_type 'observer-compressed'/
+      // 'sleep-consolidation' → 'agent', type 'observation'/'proposal'/'pattern' →
+      // nearest) would now be unnecessary data CORRUPTION, not a constraint fix.
+      // The previous brain entries (brain_observations.{source_type,type},
+      // brain_decisions.{confirmation_state,decision_category,confidence,outcome,
+      // decided_by}) are therefore deleted. The non-brain entries below still apply
+      // because those consolidated tables retain their CHECK constraints.
+      // --- tasks_token_usage.transport (T11548 → REMOVED T11649) ---------------
+      // NO normalization. 'mcp' is a first-class transport origin (MCP-gateway
+      // requests) and is preserved verbatim. The consolidated CHECK enum was WIDENED
+      // to include 'mcp' (canonical TOKEN_USAGE_TRANSPORTS SSoT + forward migration
+      // 20260602000002_t11649-token-usage-transport-mcp), so the value lands without
+      // coercion. The earlier 'mcp' → 'agent' mapping was a silent semantic alteration
+      // of ~194 rows (count-preserving, NOT integrity-preserving) — see T11649.
+      // (brain_decisions.{decision_category,confidence} normalizations removed —
+      //  T11647: brain target = runtime shape with no CHECK; copy values verbatim.)
+      // --- tasks_commits.conventional_type (T11548 + T11578) -------------------
+      // The consolidated CHECK enum is feat/fix/chore/docs/refactor/test/build/ci/
+      // perf/revert/breaking. Real git history carries non-conventional subjects:
+      //   - 'style'           → 'chore' (pre-T11548 mapping; no 'style' in enum).
+      //   - 'merge'/'release' → 'chore' (T11578): merge + release commits are
+      //     maintenance-class; the precise semantic is preserved by the dedicated
+      //     `is_merge_commit` / `is_release_commit` boolean columns, so collapsing
+      //     `conventional_type` to the maintenance catch-all 'chore' is lossless at
+      //     the row grain. Without this the 'merge'/'release' rows violate the CHECK,
+      //     `INSERT OR IGNORE` drops the WHOLE commits table, and the exodus-on-open
+      //     data-continuity gate aborts the cutover (T11578 CI regression).
+      //   - any OTHER out-of-enum value → 'chore' (defensive: future non-conventional
+      //     subjects must never re-break the zero-deficit gate; the boolean flags and
+      //     raw subject text remain the precise provenance).
+      [
+        "tasks_commits.conventional_type",
+        (src) => `CASE WHEN ${src} IS NULL THEN NULL WHEN ${src} IN ('feat', 'fix', 'chore', 'docs', 'refactor', 'test', 'build', 'ci', 'perf', 'revert', 'breaking') THEN ${src} ELSE 'chore' END`
+      ],
+      // --- tasks_task_relations.relation_type (T11548) -------------------------
+      // 'grouped-by' → 'groups' (enum: related/blocks/duplicates/absorbs/fixes/extends/
+      // supersedes/groups). 4 rows.
+      [
+        "tasks_task_relations.relation_type",
+        (src) => `CASE ${src} WHEN 'grouped-by' THEN 'groups' ELSE ${src} END`
+      ],
+      // --- tasks_lifecycle_stages.stage_name (T11548) --------------------------
+      // Legacy camelCase / past-tense values → canonical snake_case stage names.
+      // 'implemented' → 'implementation', 'qaPassed' → 'validation',
+      // 'testsPassed' → 'testing'. 3 rows.
+      [
+        "tasks_lifecycle_stages.stage_name",
+        (src) => `CASE ${src} WHEN 'implemented' THEN 'implementation' WHEN 'qaPassed' THEN 'validation' WHEN 'testsPassed' THEN 'testing' ELSE ${src} END`
+      ],
+      // --- tasks_architecture_decisions.gate_status (T11548) ------------------
+      // 'passed (T5313 consensus)' → 'passed', 'approved' → 'passed'
+      // (enum: pending/passed/failed/waived). 2 rows.
+      [
+        "tasks_architecture_decisions.gate_status",
+        (src) => `CASE WHEN ${src} LIKE 'passed%' THEN 'passed' WHEN ${src} = 'approved' THEN 'passed' ELSE ${src} END`
+      ],
+      // --- tasks_evidence_ac_bindings.binding_type (T11548) -------------------
+      // Values with a 'validator:...' prefix → 'direct'
+      // (enum: direct/satisfies/coverage). 3 rows.
+      // Strip the namespace prefix introduced before the enum was tightened.
+      [
+        "tasks_evidence_ac_bindings.binding_type",
+        (src) => `CASE WHEN ${src} LIKE 'validator:%' THEN 'direct' ELSE ${src} END`
+      ]
+      // (brain_decisions.{outcome,decided_by} normalizations removed — T11647:
+      //  brain target = runtime shape with no CHECK; legacy values like 'accepted',
+      //  'rejected', 'prime' now survive VERBATIM instead of being coerced.)
+    ]);
+    NUMERIC_CLAMPS = /* @__PURE__ */ new Map([
+      // --- brain_weight_history.delta_weight (T11782) -------------------------
+      // +Inf → 1.0 (max canonical reinforcement), -Inf → -1.0 (max canonical
+      // depression), NaN → 0.0 (no-op delta). Finite values pass through.
+      [
+        "brain_weight_history.delta_weight",
+        (src) => `CASE WHEN ${src} = 9e999 THEN 1.0 WHEN ${src} = -9e999 THEN -1.0 WHEN ${src} != ${src} THEN 0.0 ELSE ${src} END`
+      ]
+    ]);
+    ISO_CHECK_REGEX = /CHECK\s*\(\s*"([^"]+)"\s+IS\s+NULL\s+OR\s+"[^"]+"\s+GLOB\s+'\[0-9/gi;
+    EPOCH_SECONDS_THRESHOLD = 1e11;
+  }
+});
+
 // packages/core/src/store/exodus/types.ts
 var EXODUS_TARGET_SCHEMA_VERSION;
 var init_types = __esm({
@@ -31932,14 +32327,15 @@ var init_types = __esm({
 // packages/core/src/store/exodus/migrate.ts
 import {
   copyFileSync as copyFileSync2,
-  existsSync as existsSync4,
+  existsSync as existsSync7,
   mkdirSync as mkdirSync2,
   readFileSync as readFileSync2,
   renameSync as renameSync2,
+  statSync as statSync3,
   unlinkSync as unlinkSync2,
   writeFileSync as writeFileSync2
 } from "node:fs";
-import { join as join7 } from "node:path";
+import { join as join8 } from "node:path";
 function getSqliteVersion(db) {
   try {
     const row = db.prepare("SELECT sqlite_version() AS v").get();
@@ -31948,21 +32344,21 @@ function getSqliteVersion(db) {
     return "unknown";
   }
 }
-function listTables(db) {
+function listTables2(db) {
   const rows = db.prepare(
     "SELECT name FROM sqlite_master WHERE type='table' AND name NOT LIKE 'sqlite_%' AND name NOT LIKE '__drizzle_%' ORDER BY name"
   ).all();
   return rows.map((r) => r.name);
 }
 function writeJournal(stagingDir, journal) {
-  const journalPath = join7(stagingDir, JOURNAL_FILENAME);
+  const journalPath = join8(stagingDir, JOURNAL_FILENAME);
   const tmpPath = `${journalPath}.tmp`;
   writeFileSync2(tmpPath, JSON.stringify(journal, null, 2) + "\n", "utf8");
   renameSync2(tmpPath, journalPath);
 }
 function readJournal(stagingDir) {
-  const journalPath = join7(stagingDir, JOURNAL_FILENAME);
-  if (!existsSync4(journalPath)) return null;
+  const journalPath = join8(stagingDir, JOURNAL_FILENAME);
+  if (!existsSync7(journalPath)) return null;
   try {
     return JSON.parse(readFileSync2(journalPath, "utf8"));
   } catch {
@@ -31970,17 +32366,17 @@ function readJournal(stagingDir) {
   }
 }
 function clearExodusJournal(stagingDir) {
-  const journalPath = join7(stagingDir, JOURNAL_FILENAME);
+  const journalPath = join8(stagingDir, JOURNAL_FILENAME);
   try {
-    if (!existsSync4(journalPath)) return false;
+    if (!existsSync7(journalPath)) return false;
     unlinkSync2(journalPath);
-    log2.info(
+    log3.info(
       { stagingDir },
       "exodus: cleared migrate journal after abort/rollback \u2014 a retry will RE-COPY all tables"
     );
     return true;
   } catch (err) {
-    log2.warn(
+    log3.warn(
       { err, stagingDir },
       'exodus: failed to clear migrate journal after rollback (a retry may skip already-"done" tables)'
     );
@@ -32013,6 +32409,13 @@ function releaseAdvisoryLock(dbPath) {
   } catch {
   }
 }
+function safeStatBytes(filePath) {
+  try {
+    return statSync3(filePath).size;
+  } catch {
+    return 0;
+  }
+}
 function makeAttachAlias(name15, index2) {
   const safe = name15.replace(/[^a-z0-9]/gi, "_").replace(/_+/g, "_").slice(0, 20);
   return `_src_${safe}_${index2}`;
@@ -32061,7 +32464,7 @@ function buildSelectExpr(attachAlias, legacyTable, targetTableName, col, srcType
 function copyTableFromAttached(targetNativeDb, srcNativeDb, attachAlias, legacyTableName, sourceName, targetSchema = "main") {
   const resolution = resolveConsolidatedTableName(sourceName, legacyTableName);
   if (resolution.kind === "skip") {
-    log2.warn(
+    log3.warn(
       { legacyTableName, sourceName, reason: resolution.reason },
       `Exodus: explicitly skipping table \u2014 ${resolution.reason}`
     );
@@ -32080,7 +32483,7 @@ function copyTableFromAttached(targetNativeDb, srcNativeDb, attachAlias, legacyT
   ).get();
   if (!existsRow) {
     const reason = `consolidated target '${targetTableName}' not found (mapped from legacy '${legacyTableName}')`;
-    log2.warn(
+    log3.warn(
       { legacyTableName, targetTableName, sourceName, attachAlias, targetSchema },
       `Exodus: ${reason}`
     );
@@ -32091,13 +32494,13 @@ function copyTableFromAttached(targetNativeDb, srcNativeDb, attachAlias, legacyT
   const sharedColumns = srcPragma.map((r) => r.name).filter((col) => tgtColMap.has(col));
   if (sharedColumns.length === 0) {
     const reason = `no overlapping columns between source '${legacyTableName}' and target '${targetTableName}'`;
-    log2.warn({ legacyTableName, targetTableName, sourceName }, `Exodus: ${reason}`);
+    log3.warn({ legacyTableName, targetTableName, sourceName }, `Exodus: ${reason}`);
     return { rowsCopied: 0, skipped: true, reason };
   }
   const srcOnlyColumns = srcPragma.map((r) => r.name).filter((c) => !tgtColMap.has(c));
   const tgtOnlyColumns = tgtPragma.map((r) => r.name).filter((c) => !srcColumns.has(c));
   if (srcOnlyColumns.length > 0 || tgtOnlyColumns.length > 0) {
-    log2.info(
+    log3.info(
       { legacyTableName, targetTableName, sourceName, srcOnlyColumns, tgtOnlyColumns },
       "Exodus: column drift detected \u2014 copying intersection, dropping src-only cols, using defaults for tgt-only cols"
     );
@@ -32112,7 +32515,7 @@ function copyTableFromAttached(targetNativeDb, srcNativeDb, attachAlias, legacyT
       return isoGlobCols.has(col) && (upper.includes("INT") || upper === "" || upper === "NUMERIC");
     });
     if (coercedCols.length > 0) {
-      log2.info(
+      log3.info(
         {
           legacyTableName,
           targetTableName,
@@ -32128,7 +32531,7 @@ function copyTableFromAttached(targetNativeDb, srcNativeDb, attachAlias, legacyT
     (col) => ENUM_NORMALIZATIONS.has(`${targetTableName}.${col}`)
   );
   if (normalizedCols.length > 0) {
-    log2.info(
+    log3.info(
       { legacyTableName, targetTableName, sourceName, normalizedCols },
       `Exodus: applying enum-value normalization for ${normalizedCols.length} column(s) (T11547)`
     );
@@ -32137,7 +32540,7 @@ function copyTableFromAttached(targetNativeDb, srcNativeDb, attachAlias, legacyT
     (col) => NUMERIC_CLAMPS.has(`${targetTableName}.${col}`)
   );
   if (clampedCols.length > 0) {
-    log2.info(
+    log3.info(
       { legacyTableName, targetTableName, sourceName, clampedCols },
       `Exodus: applying non-finite numeric clamp for ${clampedCols.length} column(s) (T11782)`
     );
@@ -32169,25 +32572,37 @@ function copyTableFromAttached(targetNativeDb, srcNativeDb, attachAlias, legacyT
   ];
   const colList = allInsertCols.map((c) => `"${c}"`).join(", ");
   const selectList = allSelectExprs.join(", ");
+  const existingBeforeRow = targetNativeDb.prepare(`SELECT COUNT(*) AS c FROM "${targetSchema}"."${targetTableName}"`).get();
+  const existingBefore = Number(existingBeforeRow?.c ?? 0);
   const stmt = targetNativeDb.prepare(
     `INSERT OR IGNORE INTO "${targetSchema}"."${targetTableName}" (${colList}) SELECT ${selectList} FROM "${attachAlias}"."${legacyTableName}"`
   );
   const result = stmt.run();
   const rowsCopied = result.changes ?? 0;
   if (rowsCopied < sourceCount) {
-    const dropped = sourceCount - rowsCopied;
-    if (rowsCopied === 0) {
-      const reason = `INSERT OR IGNORE dropped ALL ${sourceCount} rows from '${legacyTableName}'\u2192'${targetTableName}' (rowsCopied=0, sourceCount=${sourceCount}). Likely a CHECK/type constraint violation \u2014 check epoch coercion or enum values.`;
-      log2.error(
-        { legacyTableName, targetTableName, sourceName, sourceCount, rowsCopied },
-        `Exodus: ${reason}`
+    const presentAccountedFor = existingBefore + rowsCopied;
+    if (presentAccountedFor >= sourceCount) {
+      log3.info(
+        { legacyTableName, targetTableName, sourceName, sourceCount, rowsCopied, existingBefore },
+        `Exodus: '${legacyTableName}'\u2192'${targetTableName}' \u2014 ${sourceCount - rowsCopied} of ${sourceCount} row(s) already present in target (idempotent PK dedup), ${rowsCopied} newly copied; no loss`
       );
-      return { rowsCopied: 0, skipped: false, reason };
+      return { rowsCopied, skipped: false };
     }
-    log2.warn(
-      { legacyTableName, targetTableName, sourceName, sourceCount, rowsCopied, dropped },
-      `Exodus: INSERT OR IGNORE dropped ${dropped}/${sourceCount} rows from '${legacyTableName}'\u2192'${targetTableName}' \u2014 may be idempotent-resume dedup or a constraint violation; verify will confirm`
+    const missing = sourceCount - presentAccountedFor;
+    const reason = `INSERT OR IGNORE lost ${missing} of ${sourceCount} rows from '${legacyTableName}'\u2192'${targetTableName}' (rowsCopied=${rowsCopied}, existingBefore=${existingBefore}) \u2014 a CHECK/NOT NULL/type/enum constraint rejected them (NOT PK dedup); inspect epoch coercion + enum normalization. verify will confirm.`;
+    log3.error(
+      {
+        legacyTableName,
+        targetTableName,
+        sourceName,
+        sourceCount,
+        rowsCopied,
+        existingBefore,
+        missing
+      },
+      `Exodus: ${reason}`
     );
+    return { rowsCopied, skipped: false, reason };
   }
   return { rowsCopied, skipped: false };
 }
@@ -32195,10 +32610,10 @@ function checkSchemaVersion(journal, forceCrossVersion) {
   if (journal.targetSchemaVersion !== EXODUS_TARGET_SCHEMA_VERSION) {
     const msg = `Schema version mismatch: journal=${journal.targetSchemaVersion}, expected=${EXODUS_TARGET_SCHEMA_VERSION}`;
     if (forceCrossVersion) {
-      log2.warn(msg + " (--force-cross-version: continuing anyway)");
+      log3.warn(msg + " (--force-cross-version: continuing anyway)");
       return true;
     }
-    log2.error(msg + " \u2014 pass --force-cross-version to override");
+    log3.error(msg + " \u2014 pass --force-cross-version to override");
     return false;
   }
   return true;
@@ -32206,18 +32621,19 @@ function checkSchemaVersion(journal, forceCrossVersion) {
 async function runExodusMigrate(plan, forceCrossVersion = false, onProgress) {
   const { sources, stagingDir, diskPreflight, projectDbPath, globalDbPath } = plan;
   if (!diskPreflight) {
+    const shortfall = Math.max(0, plan.requiredBytes - plan.availableBytes);
     return {
       ok: false,
       tables: [],
       stagingDir,
       backupPaths: [],
-      error: `Insufficient disk space: need \u22653\xD7 source size (${plan.totalSourceBytes} bytes source, ${plan.availableBytes} bytes available). Free up space or use a different storage location.`
+      error: `Insufficient disk space for exodus: need \u2265${plan.requiredBytes} bytes (\u2248${STAGING_HEADROOM_FACTOR}\xD7 largest source ${plan.largestSourceBytes} + consolidated estimate ${plan.totalSourceBytes}), but only ${plan.availableBytes} bytes are free on the target filesystem \u2014 ${shortfall} bytes short. Free up at least ${shortfall} bytes (e.g. \`cleo backup prune\`, clear caches), or move the .cleo/ directory to a larger volume, then retry.`
     };
   }
   mkdirSync2(stagingDir, { recursive: true });
   let sqliteVersion = "unknown";
   for (const src of sources) {
-    if (existsSync4(src.path)) {
+    if (existsSync7(src.path)) {
       const snap = openCleoDbSnapshot(src.path, { readOnly: true });
       sqliteVersion = getSqliteVersion(snap.db);
       snap.close();
@@ -32258,9 +32674,15 @@ async function runExodusMigrate(plan, forceCrossVersion = false, onProgress) {
     };
     var extractNativeDb = extractNativeDb2;
     for (const src of sources) {
-      if (!existsSync4(src.path)) continue;
-      const backupDest = join7(stagingDir, `${src.name.replace(/[^a-z0-9-]/g, "_")}-backup.db`);
-      if (!existsSync4(backupDest)) {
+      if (!existsSync7(src.path)) continue;
+      const backupDest = join8(stagingDir, `${src.name.replace(/[^a-z0-9-]/g, "_")}-backup.db`);
+      const srcBytes = safeStatBytes(src.path);
+      const skipStagingCopy = srcBytes > plan.stagingCopyThresholdBytes;
+      if (skipStagingCopy) {
+        onProgress?.(
+          `Skipping full staging copy of ${src.name} (${srcBytes} bytes > ${plan.stagingCopyThresholdBytes} threshold) \u2014 source is archived, not deleted, on success.`
+        );
+      } else if (!existsSync7(backupDest)) {
         onProgress?.(`Backing up ${src.name} \u2192 staging dir\u2026`);
         copyFileSync2(src.path, backupDest);
         backupPaths.push(backupDest);
@@ -32278,8 +32700,8 @@ async function runExodusMigrate(plan, forceCrossVersion = false, onProgress) {
     });
     const projectNative = extractNativeDb2(projectHandle);
     const globalNative = extractNativeDb2(globalHandle);
-    const projectSources = sources.filter((s) => s.targetScope === "project" && existsSync4(s.path));
-    const globalSources = sources.filter((s) => s.targetScope === "global" && existsSync4(s.path));
+    const projectSources = sources.filter((s) => s.targetScope === "project" && existsSync7(s.path));
+    const globalSources = sources.filter((s) => s.targetScope === "global" && existsSync7(s.path));
     await migrateScope(
       "project",
       projectSources,
@@ -32304,7 +32726,7 @@ async function runExodusMigrate(plan, forceCrossVersion = false, onProgress) {
     return { ok: true, tables: allTableResults, stagingDir, backupPaths };
   } catch (err) {
     const error48 = err instanceof Error ? err.message : String(err);
-    log2.error({ err }, "Exodus migration failed");
+    log3.error({ err }, "Exodus migration failed");
     return { ok: false, tables: allTableResults, stagingDir, backupPaths, error: error48 };
   } finally {
     try {
@@ -32324,7 +32746,7 @@ async function migrateScope(scope, sources, targetNativeDb, journal, stagingDir,
   if (sources.length === 0) return;
   onProgress?.(`Migrating ${scope}-scope sources\u2026`);
   targetNativeDb.exec("PRAGMA foreign_keys = OFF");
-  log2.info({ scope }, "Exodus: foreign_keys=OFF for bulk copy (T11533 FK-defer)");
+  log3.info({ scope }, "Exodus: foreign_keys=OFF for bulk copy (T11533 FK-defer)");
   try {
     for (let i = 0; i < sources.length; i++) {
       const src = sources[i];
@@ -32341,7 +32763,7 @@ async function migrateScope(scope, sources, targetNativeDb, journal, stagingDir,
       }
       const snap = openCleoDbSnapshot(src.path, { readOnly: true });
       try {
-        const tables = listTables(snap.db);
+        const tables = listTables2(snap.db);
         targetNativeDb.exec("BEGIN");
         let txOpen = true;
         try {
@@ -32391,7 +32813,7 @@ async function migrateScope(scope, sources, targetNativeDb, journal, stagingDir,
               }
             } catch (err) {
               const msg = err instanceof Error ? err.message : String(err);
-              log2.warn({ tableName, sourceDb: src.name, err }, "Table copy failed \u2014 skipping");
+              log3.warn({ tableName, sourceDb: src.name, err }, "Table copy failed \u2014 skipping");
               status = "skipped";
               errorMsg = msg;
               skipped = true;
@@ -32439,7 +32861,7 @@ async function migrateScope(scope, sources, targetNativeDb, journal, stagingDir,
           targetNativeDb.exec(`DETACH DATABASE "${attachAlias}"`);
           onProgress?.(`  [${src.name}] Detached "${attachAlias}"`);
         } catch (detachErr) {
-          log2.warn(
+          log3.warn(
             { attachAlias, sourceDb: src.name, err: detachErr },
             "DETACH failed \u2014 alias will be released on DB close"
           );
@@ -32449,7 +32871,7 @@ async function migrateScope(scope, sources, targetNativeDb, journal, stagingDir,
             targetNativeDb.exec(`DETACH DATABASE "${crossAlias}"`);
             onProgress?.(`  [${src.name}] Cross-scope target detached "${crossAlias}"`);
           } catch (detachErr) {
-            log2.warn(
+            log3.warn(
               { crossAlias, sourceDb: src.name, err: detachErr },
               "Cross-scope DETACH failed \u2014 alias will be released on DB close"
             );
@@ -32461,28 +32883,28 @@ async function migrateScope(scope, sources, targetNativeDb, journal, stagingDir,
     try {
       const orphans = targetNativeDb.prepare("PRAGMA foreign_key_check").all();
       if (orphans.length > 0) {
-        log2.warn(
+        log3.warn(
           { scope, orphanCount: orphans.length, sample: orphans.slice(0, 5) },
           `Exodus: PRAGMA foreign_key_check found ${orphans.length} orphan row(s) after bulk copy \u2014 these are genuine data orphans (not ordering artifacts)`
         );
       } else {
-        log2.info({ scope }, "Exodus: PRAGMA foreign_key_check PASSED \u2014 no orphan rows");
+        log3.info({ scope }, "Exodus: PRAGMA foreign_key_check PASSED \u2014 no orphan rows");
       }
     } catch (checkErr) {
-      log2.warn(
+      log3.warn(
         { scope, err: checkErr },
         "Exodus: PRAGMA foreign_key_check failed (non-fatal) \u2014 target schema may not have FK constraints enabled"
       );
     }
     try {
       targetNativeDb.exec("PRAGMA foreign_keys = ON");
-      log2.info({ scope }, "Exodus: foreign_keys=ON restored after bulk copy");
+      log3.info({ scope }, "Exodus: foreign_keys=ON restored after bulk copy");
     } catch (fkErr) {
-      log2.warn({ scope, err: fkErr }, "Exodus: could not restore foreign_keys=ON (non-fatal)");
+      log3.warn({ scope, err: fkErr }, "Exodus: could not restore foreign_keys=ON (non-fatal)");
     }
   }
 }
-var log2, LOCK_SENTINEL_SUFFIX, JOURNAL_FILENAME, SOURCE_EPOCH_UNITS;
+var log3, LOCK_SENTINEL_SUFFIX, JOURNAL_FILENAME, SOURCE_EPOCH_UNITS;
 var init_migrate = __esm({
   "packages/core/src/store/exodus/migrate.ts"() {
     "use strict";
@@ -32491,9 +32913,10 @@ var init_migrate = __esm({
     init_dual_scope_db();
     init_open_cleo_db();
     init_column_transforms();
+    init_plan2();
     init_table_name_map();
     init_types();
-    log2 = getLogger("exodus-migrate");
+    log3 = getLogger("exodus-migrate");
     LOCK_SENTINEL_SUFFIX = ".exodus-lock";
     JOURNAL_FILENAME = "exodus-journal.json";
     SOURCE_EPOCH_UNITS = /* @__PURE__ */ new Map([
@@ -32509,116 +32932,55 @@ var init_migrate = __esm({
   }
 });
 
-// packages/core/src/store/exodus/plan.ts
-import { existsSync as existsSync5, readdirSync as readdirSync2, statfsSync, statSync } from "node:fs";
-import { join as join8 } from "node:path";
-function buildSourceDescriptors(cwd) {
-  const cleoDir = resolveCleoDir(cwd);
-  const cleoHome = getCleoHome();
-  return [
-    // Project-tier — go into consolidated project-scope cleo.db
-    {
-      name: "tasks",
-      path: join8(cleoDir, "tasks.db"),
-      targetScope: "project"
-    },
-    {
-      name: "brain (project)",
-      path: join8(cleoDir, "brain.db"),
-      targetScope: "project"
-    },
-    {
-      name: "conduit",
-      path: join8(cleoDir, "conduit.db"),
-      targetScope: "project"
-    },
-    // Global-tier — go into consolidated global-scope cleo.db
-    {
-      name: "nexus",
-      path: join8(cleoHome, "nexus.db"),
-      targetScope: "global"
-    },
-    {
-      name: "signaldock",
-      path: join8(cleoHome, "signaldock.db"),
-      targetScope: "global"
-    },
-    {
-      name: "skills",
-      path: join8(cleoHome, "skills.db"),
-      targetScope: "global"
-    }
-  ];
-}
-function safeFileBytes(filePath) {
-  try {
-    return statSync(filePath).size;
-  } catch {
-    return 0;
-  }
-}
-function getAvailableBytes(dir) {
-  try {
-    const result = statfsSync(dir);
-    return (result.bavail ?? result.bfree ?? 0) * (result.bsize ?? 4096);
-  } catch {
-    return 0;
-  }
-}
-function deriveStagingDirName() {
-  const iso = (/* @__PURE__ */ new Date()).toISOString().replace(/[:]/g, "").replace(/\..+Z$/, "Z");
-  return `exodus-staging-${iso}`;
-}
-function findExistingStaging(cleoDir) {
-  try {
-    const entries = readdirSync2(cleoDir, { withFileTypes: true });
-    const stagingDirs = entries.filter((e) => e.isDirectory() && e.name.startsWith("exodus-staging-")).map((e) => e.name).sort().reverse();
-    if (stagingDirs.length > 0) {
-      return join8(cleoDir, stagingDirs[0]);
-    }
-  } catch {
+// packages/core/src/store/exodus/seal.ts
+function resolveScopes(arg) {
+  return arg === "both" ? ["project", "global"] : [arg];
+}
+function sealExodus(plan, scopeArg, cwd) {
+  const parity = computeCountParity(plan.sources, plan.projectDbPath, plan.globalDbPath);
+  if (!parity.ok) {
+    const refusedReason = `Refusing to seal: ${parity.deficits.length} table(s) have FEWER rows in the consolidated cleo.db than the legacy source \u2014 the data is NOT fully migrated. Run \`cleo exodus migrate\` first. Deficits: ${parity.deficits.map((d) => `${d.targetTable}(${d.sourceCount}\u2192${d.targetCount})`).join(", ")}`;
+    log4.error({ deficits: parity.deficits.length }, `exodus seal refused \u2014 ${refusedReason}`);
+    return { ok: false, refusedReason, parity, scopes: [] };
+  }
+  const outcomes = [];
+  for (const scope of resolveScopes(scopeArg)) {
+    const alreadySealed = hasExodusCompleteMarker(scope, cwd);
+    const scopeSources = plan.sources.filter((s) => s.targetScope === scope);
+    const archived = scopeSources.map((s) => {
+      const r = archiveSourceDb(s, cwd);
+      return { name: r.name, action: r.action, archivedTo: r.archivedTo };
+    });
+    const markerPath = writeExodusCompleteMarker(
+      scope,
+      scopeSources.map((s) => s.name),
+      cwd
+    );
+    log4.info(
+      { scope, alreadySealed, archived: archived.filter((a) => a.action === "archived").length },
+      `exodus seal: scope '${scope}' certified (count-parity verified, ${parity.checked} tables)`
+    );
+    outcomes.push({ scope, alreadySealed, archived, markerPath });
   }
-  return null;
+  return { ok: true, parity, scopes: outcomes };
 }
-function buildExodusPlan(cwd) {
-  const cleoDir = resolveCleoDir(cwd);
-  const sources = buildSourceDescriptors(cwd);
-  const totalSourceBytes = sources.reduce((sum, s) => sum + safeFileBytes(s.path), 0);
-  const availableBytes = getAvailableBytes(cleoDir);
-  const diskPreflight = totalSourceBytes === 0 || availableBytes >= 3 * totalSourceBytes;
-  const existingStaging = findExistingStaging(cleoDir);
-  const stagingDir = existingStaging ?? join8(cleoDir, deriveStagingDirName());
-  const resumeFromStaging = existingStaging !== null;
-  const projectDbPath = resolveDualScopeDbPath("project", cwd);
-  const globalDbPath = resolveDualScopeDbPath("global");
-  return {
-    sources,
-    totalSourceBytes,
-    availableBytes,
-    diskPreflight,
-    stagingDir,
-    resumeFromStaging,
-    projectDbPath,
-    globalDbPath
-  };
-}
-function sourcesPresent(sources) {
-  return sources.some((s) => existsSync5(s.path));
-}
-var init_plan2 = __esm({
-  "packages/core/src/store/exodus/plan.ts"() {
+var log4;
+var init_seal = __esm({
+  "packages/core/src/store/exodus/seal.ts"() {
     "use strict";
-    init_paths();
-    init_dual_scope_db();
+    init_logger2();
+    init_archive2();
+    init_count_parity();
+    log4 = getLogger("exodus-seal");
   }
 });
 
 // packages/core/src/store/exodus/status.ts
-import { existsSync as existsSync6, readdirSync as readdirSync3, readFileSync as readFileSync3, statSync as statSync2 } from "node:fs";
+import { existsSync as existsSync8, readdirSync as readdirSync3, readFileSync as readFileSync3, statSync as statSync4 } from "node:fs";
 import { join as join9 } from "node:path";
 function readJournal2(stagingDir) {
   const p = join9(stagingDir, JOURNAL_FILENAME2);
-  if (!existsSync6(p)) return null;
+  if (!existsSync8(p)) return null;
   try {
     return JSON.parse(readFileSync3(p, "utf8"));
   } catch {
@@ -32634,7 +32996,7 @@ function findStagingDirs(cleoDir) {
 }
 function safeBytes(p) {
   try {
-    return statSync2(p).size;
+    return statSync4(p).size;
   } catch {
     return 0;
   }
@@ -32650,15 +33012,15 @@ function runExodusStatus(cwd) {
   const sourcesInfo = plan.sources.map((s) => ({
     name: s.name,
     path: s.path,
-    exists: existsSync6(s.path),
+    exists: existsSync8(s.path),
     bytes: safeBytes(s.path)
   }));
   return {
     hasStaging: latestStaging !== null,
     stagingDir: latestStaging,
     journal,
-    projectDbExists: existsSync6(projectDbPath),
-    globalDbExists: existsSync6(globalDbPath),
+    projectDbExists: existsSync8(projectDbPath),
+    globalDbExists: existsSync8(globalDbPath),
     sourcesPresent: sourcesInfo.some((s) => s.exists),
     sources: sourcesInfo
   };
@@ -32675,7 +33037,7 @@ var init_status = __esm({
 });
 
 // packages/core/src/store/exodus/verify-migration.ts
-import { existsSync as existsSync7 } from "node:fs";
+import { existsSync as existsSync9 } from "node:fs";
 import { createRequire as createRequire3 } from "node:module";
 function orderByClause(db, tableName) {
   try {
@@ -32689,6 +33051,18 @@ function orderByClause(db, tableName) {
   return "rowid";
 }
 function computeTableDigest(db, tableName, columns, transform2) {
+  let count = 0;
+  try {
+    const row = db.prepare(`SELECT COUNT(*) AS c FROM "${tableName}"`).get();
+    count = Number(row?.c ?? 0);
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    log5.warn(
+      { tableName, err: msg },
+      "computeTableDigest: COUNT(*) failed (possibly a virtual/FTS table) \u2014 treating as 0 rows"
+    );
+    return { count: 0, hash: "" };
+  }
   const { createHash: createHash4 } = _require("node:crypto");
   const hasher = createHash4("sha256");
   const orderBy = orderByClause(db, tableName);
@@ -32697,29 +33071,35 @@ function computeTableDigest(db, tableName, columns, transform2) {
     selectClause = columns.map((c) => {
       if (transform2 === void 0) return `"${c}"`;
       const srcType = transform2.srcTypeByCol.get(c) ?? "";
-      const expr = buildDigestExpr(transform2.targetTableName, c, srcType, transform2.isoGlobCols);
+      const tgtCol = transform2.tgtColByCol.get(c);
+      const expr = buildDigestExpr(
+        transform2.targetTableName,
+        c,
+        srcType,
+        transform2.isoGlobCols,
+        tgtCol
+      );
       return `${expr} AS "${c}"`;
     }).join(", ");
   } else {
     selectClause = "*";
   }
-  let rows;
   try {
-    rows = db.prepare(`SELECT ${selectClause} FROM "${tableName}" ORDER BY ${orderBy}`).all();
+    const stmt = db.prepare(`SELECT ${selectClause} FROM "${tableName}" ORDER BY ${orderBy}`);
+    for (const row of stmt.iterate()) {
+      const rowObj = row;
+      hasher.update(JSON.stringify(rowObj, Object.keys(rowObj).sort()));
+    }
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
-    log3.warn(
+    log5.warn(
       { tableName, err: msg },
-      "computeTableDigest: SELECT failed (possibly a virtual/FTS table) \u2014 treating as 0 rows"
+      "computeTableDigest: streamed SELECT failed (possibly a virtual/FTS table) \u2014 digest skipped (COUNT(*) parity still enforced)"
     );
-    return { count: 0, hash: "" };
-  }
-  for (const row of rows) {
-    const rowObj = row;
-    hasher.update(JSON.stringify(rowObj, Object.keys(rowObj).sort()));
+    return { count, hash: "" };
   }
   return {
-    count: rows.length,
+    count,
     hash: hasher.digest("hex").slice(0, 32)
   };
 }
@@ -32743,18 +33123,24 @@ function buildSourceDigestTransform(srcDb, srcTable, tgtDb, targetTableName) {
       srcDb.prepare(`PRAGMA table_info("${srcTable}")`).all().map((r) => [r.name, r.type])
     );
     const isoGlobCols = detectIsoGlobColumns(tgtDb, targetTableName);
-    return { targetTableName, srcTypeByCol, isoGlobCols };
+    const tgtColByCol = new Map(
+      tgtDb.prepare(`PRAGMA table_info("${targetTableName}")`).all().map((r) => [
+        r.name,
+        { notnull: r.notnull, dflt_value: r.dflt_value, type: r.type }
+      ])
+    );
+    return { targetTableName, srcTypeByCol, isoGlobCols, tgtColByCol };
   } catch {
     return void 0;
   }
 }
-function listTables2(db) {
+function listTables3(db) {
   const rows = db.prepare(
     "SELECT name FROM sqlite_master WHERE type='table' AND name NOT LIKE 'sqlite_%' AND name NOT LIKE '__drizzle_%' ORDER BY name"
   ).all();
   return rows.map((r) => r.name);
 }
-function tableExists2(db, tableName) {
+function tableExists3(db, tableName) {
   try {
     const escaped = tableName.replace(/'/g, "''");
     return db.prepare(`SELECT 1 FROM sqlite_master WHERE type='table' AND name='${escaped}'`).get() !== void 0;
@@ -32832,7 +33218,7 @@ function foreignKeyCheck(db, scope) {
   try {
     const rows = db.prepare("PRAGMA foreign_key_check").all();
     if (rows.length > 0) {
-      log3.warn(
+      log5.warn(
         { scope, count: rows.length, sample: rows.slice(0, 5) },
         `verifyMigration: PRAGMA foreign_key_check found ${rows.length} orphan row(s)`
       );
@@ -32844,7 +33230,7 @@ function foreignKeyCheck(db, scope) {
       fkid: r.fkid
     }));
   } catch (err) {
-    log3.warn({ scope, err }, "verifyMigration: PRAGMA foreign_key_check failed (non-fatal)");
+    log5.warn({ scope, err }, "verifyMigration: PRAGMA foreign_key_check failed (non-fatal)");
     return [];
   }
 }
@@ -32881,13 +33267,13 @@ function sourceOrphanSignatures(db, sourceName, scope) {
     const rows = db.prepare("PRAGMA foreign_key_check").all();
     for (const r of rows) sigs.add(orphanSignature(db, r, sourceName));
     if (rows.length > 0) {
-      log3.warn(
+      log5.warn(
         { scope, count: rows.length, sample: rows.slice(0, 5) },
         `verifyMigration: source already has ${rows.length} pre-existing FK orphan(s) \u2014 these are tolerated (carried forward losslessly, flagged for data-hygiene)`
       );
     }
   } catch (err) {
-    log3.warn({ scope, err }, "verifyMigration: source PRAGMA foreign_key_check failed (non-fatal)");
+    log5.warn({ scope, err }, "verifyMigration: source PRAGMA foreign_key_check failed (non-fatal)");
   }
   return sigs;
 }
@@ -32899,7 +33285,7 @@ function verifyMigration(sources, projectDbPath, globalDbPath, onProgress) {
   const preExistingForeignKeyViolations = [];
   const failureLines = [];
   const sourceOrphanSigs = /* @__PURE__ */ new Set();
-  if (!existsSync7(projectDbPath)) {
+  if (!existsSync9(projectDbPath)) {
     return {
       ok: false,
       tables: [],
@@ -32910,7 +33296,7 @@ function verifyMigration(sources, projectDbPath, globalDbPath, onProgress) {
       error: `Consolidated project cleo.db not found at ${projectDbPath}. Run 'cleo exodus migrate' first.`
     };
   }
-  if (!existsSync7(globalDbPath)) {
+  if (!existsSync9(globalDbPath)) {
     return {
       ok: false,
       tables: [],
@@ -32925,7 +33311,7 @@ function verifyMigration(sources, projectDbPath, globalDbPath, onProgress) {
   const globalSnap = openCleoDbSnapshot(globalDbPath, { readOnly: true });
   try {
     for (const src of sources) {
-      if (!existsSync7(src.path)) {
+      if (!existsSync9(src.path)) {
         onProgress?.(`Skipping ${src.name} (not present)`);
         continue;
       }
@@ -32934,9 +33320,9 @@ function verifyMigration(sources, projectDbPath, globalDbPath, onProgress) {
         for (const sig of sourceOrphanSignatures(srcSnap.db, src.name, `source:${src.name}`)) {
           sourceOrphanSigs.add(sig);
         }
-        const sourceTables = listTables2(srcSnap.db);
-        const projectTables = new Set(listTables2(projectSnap.db));
-        const globalTables = new Set(listTables2(globalSnap.db));
+        const sourceTables = listTables3(srcSnap.db);
+        const projectTables = new Set(listTables3(projectSnap.db));
+        const globalTables = new Set(listTables3(globalSnap.db));
         for (const legacyTableName of sourceTables) {
           onProgress?.(`Verifying ${src.name}.${legacyTableName}\u2026`);
           const resolution = resolveConsolidatedTableName(src.name, legacyTableName);
@@ -33010,7 +33396,7 @@ function verifyMigration(sources, projectDbPath, globalDbPath, onProgress) {
               `[${scope}] ${src.name}.${legacyTableName} \u2192 ${targetTableName}: DEFICIT \u2014 source=${srcDigest.count} rows, target=${tgtDigest.count} rows (${srcDigest.count - tgtDigest.count} missing), hashMatch=${hashMatch}`
             );
           } else if (tgtDigest.count > srcDigest.count) {
-            log3.warn(
+            log5.warn(
               {
                 scope,
                 source: src.name,
@@ -33047,7 +33433,7 @@ function verifyMigration(sources, projectDbPath, globalDbPath, onProgress) {
     targetOrphans.push(...foreignKeyCheck(globalSnap.db, "global"));
     foreignKeyViolations.push(...targetOrphans);
     for (const fk of targetOrphans) {
-      const orphanDb = tableExists2(projectSnap.db, fk.table) ? projectSnap.db : globalSnap.db;
+      const orphanDb = tableExists3(projectSnap.db, fk.table) ? projectSnap.db : globalSnap.db;
       const sig = orphanSignature(orphanDb, fk);
       const preExisting = sourceOrphanSigs.has(sig);
       if (preExisting) {
@@ -33060,7 +33446,7 @@ function verifyMigration(sources, projectDbPath, globalDbPath, onProgress) {
       }
     }
     if (preExistingForeignKeyViolations.length > 0) {
-      log3.warn(
+      log5.warn(
         {
           count: preExistingForeignKeyViolations.length,
           sample: preExistingForeignKeyViolations.slice(0, 5)
@@ -33070,7 +33456,7 @@ function verifyMigration(sources, projectDbPath, globalDbPath, onProgress) {
     }
   } catch (err) {
     const error48 = err instanceof Error ? err.message : String(err);
-    log3.error({ err }, "verifyMigration failed");
+    log5.error({ err }, "verifyMigration failed");
     return {
       ok: false,
       tables,
@@ -33087,7 +33473,7 @@ function verifyMigration(sources, projectDbPath, globalDbPath, onProgress) {
   if (failureLines.length > 0) {
     const error48 = `verifyMigration FAILED: ${failureLines.length} issue(s):
 ${failureLines.map((l) => `  \u2022 ${l}`).join("\n")}`;
-    log3.error({ failureCount: failureLines.length }, error48);
+    log5.error({ failureCount: failureLines.length }, error48);
     return {
       ok: false,
       tables,
@@ -33107,7 +33493,7 @@ ${failureLines.map((l) => `  \u2022 ${l}`).join("\n")}`;
     enumDrift
   };
 }
-var log3, _require, CHECK_ENUM_REGEX;
+var log5, _require, CHECK_ENUM_REGEX;
 var init_verify_migration = __esm({
   "packages/core/src/store/exodus/verify-migration.ts"() {
     "use strict";
@@ -33116,7 +33502,7 @@ var init_verify_migration = __esm({
     init_open_cleo_db();
     init_column_transforms();
     init_table_name_map();
-    log3 = getLogger("verify-migration");
+    log5 = getLogger("verify-migration");
     _require = createRequire3(import.meta.url);
     CHECK_ENUM_REGEX = /CHECK\s*\(\s*"([^"]+)"\s+(?:IS\s+NULL\s+OR\s+"[^"]+"\s+)?IN\s*\(([^)]*)\)\s*\)/gi;
   }
@@ -33159,8 +33545,10 @@ __export(exodus_exports, {
   archiveMigratedSources: () => archiveMigratedSources,
   archiveSourceDb: () => archiveSourceDb,
   archiveStrandedResidue: () => archiveStrandedResidue,
+  buildExodusHealth: () => buildExodusHealth,
   buildExodusPlan: () => buildExodusPlan,
   clearExodusJournal: () => clearExodusJournal,
+  computeCountParity: () => computeCountParity,
   deriveStagingDirName: () => deriveStagingDirName,
   detectStrandedResidue: () => detectStrandedResidue,
   exodusArchiveDir: () => exodusArchiveDir,
@@ -33172,6 +33560,7 @@ __export(exodus_exports, {
   runExodusMigrate: () => runExodusMigrate,
   runExodusStatus: () => runExodusStatus,
   runExodusVerify: () => runExodusVerify,
+  sealExodus: () => sealExodus,
   sourcesPresent: () => sourcesPresent,
   verifyMigration: () => verifyMigration,
   writeExodusCompleteMarker: () => writeExodusCompleteMarker
@@ -33180,8 +33569,11 @@ var init_exodus = __esm({
   "packages/core/src/store/exodus/index.ts"() {
     "use strict";
     init_archive2();
+    init_count_parity();
+    init_health2();
     init_migrate();
     init_plan2();
+    init_seal();
     init_status();
     init_table_name_map();
     init_types();
@@ -33197,7 +33589,7 @@ __export(on_open_exports, {
   isDataContinuityOk: () => isDataContinuityOk,
   maybeRunExodusOnOpen: () => maybeRunExodusOnOpen
 });
-import { existsSync as existsSync8 } from "node:fs";
+import { existsSync as existsSync10 } from "node:fs";
 function isDisabledByEnv() {
   const v = process.env.CLEO_DISABLE_EXODUS_ON_OPEN;
   return v === "1" || v === "true";
@@ -33223,7 +33615,7 @@ function rollbackConsolidatedToEmpty(nativeDb, scope) {
       "SELECT name FROM sqlite_master WHERE type='table' AND name NOT LIKE 'sqlite_%' AND name NOT LIKE '__drizzle_%'"
     ).all().map((r) => r.name);
   } catch (err) {
-    log4.error({ err, scope }, "exodus-on-open: failed to enumerate tables for rollback");
+    log6.error({ err, scope }, "exodus-on-open: failed to enumerate tables for rollback");
     return;
   }
   try {
@@ -33233,7 +33625,7 @@ function rollbackConsolidatedToEmpty(nativeDb, scope) {
       try {
         nativeDb.exec(`DELETE FROM "${table}"`);
       } catch (err) {
-        log4.warn({ err, table, scope }, "exodus-on-open: failed to clear table during rollback");
+        log6.warn({ err, table, scope }, "exodus-on-open: failed to clear table during rollback");
       }
     }
     nativeDb.exec("COMMIT");
@@ -33242,7 +33634,7 @@ function rollbackConsolidatedToEmpty(nativeDb, scope) {
       nativeDb.exec("ROLLBACK");
     } catch {
     }
-    log4.error({ err, scope }, "exodus-on-open: rollback transaction failed");
+    log6.error({ err, scope }, "exodus-on-open: rollback transaction failed");
   } finally {
     try {
       nativeDb.exec("PRAGMA foreign_keys = ON");
@@ -33262,7 +33654,7 @@ async function rollbackBothScopes(scope, projectDbPath, globalDbPath) {
         rollbackConsolidatedToEmpty(native, s);
       }
     } catch (err) {
-      log4.warn(
+      log6.warn(
         { err, scope: s, openingScope: scope },
         "exodus-on-open: could not roll back scope (best-effort)"
       );
@@ -33278,7 +33670,7 @@ function isDataContinuityOk(result) {
   const deficits = result.tables.filter((t) => t.targetCount < t.sourceCount);
   const surpluses = result.tables.filter((t) => t.targetCount > t.sourceCount);
   if (surpluses.length > 0) {
-    log4.warn(
+    log6.warn(
       {
         surpluses: surpluses.map((t) => ({
           table: t.targetTable,
@@ -33312,7 +33704,7 @@ async function maybeRunExodusOnOpen(scope, dbPath, nativeDb, cwd) {
   const { buildExodusPlan: buildExodusPlan2, runExodusMigrate: runExodusMigrate2, verifyMigration: verifyMigration2, clearExodusJournal: clearExodusJournal2 } = await Promise.resolve().then(() => (init_exodus(), exodus_exports));
   const plan = buildExodusPlan2(cwd);
   const scopeSources = plan.sources.filter((s) => s.targetScope === scope);
-  if (!scopeSources.some((s) => existsSync8(s.path))) {
+  if (!scopeSources.some((s) => existsSync10(s.path))) {
     return {
       outcome: "skipped",
       reason: `no legacy ${scope}-scope source DBs present (fresh install or cross-scope-only)`
@@ -33325,11 +33717,11 @@ async function maybeRunExodusOnOpen(scope, dbPath, nativeDb, cwd) {
       if (!consolidatedIsEmpty(nativeDb, scope)) {
         return { outcome: "skipped", reason: "migrated by a concurrent process (lock winner)" };
       }
-      log4.info(
+      log6.info(
         {
           scope,
           dbPath,
-          sources: plan.sources.filter((s) => existsSync8(s.path)).map((s) => s.name)
+          sources: plan.sources.filter((s) => existsSync10(s.path)).map((s) => s.name)
         },
         "exodus-on-open: consolidated cleo.db is empty and legacy data present \u2014 auto-migrating"
       );
@@ -33338,23 +33730,23 @@ async function maybeRunExodusOnOpen(scope, dbPath, nativeDb, cwd) {
         const migrateResult = await runExodusMigrate2(
           plan,
           false,
-          (msg) => log4.debug({ scope }, `exodus-on-open: ${msg}`)
+          (msg) => log6.debug({ scope }, `exodus-on-open: ${msg}`)
         );
         if (!migrateResult.ok) {
           await rollbackBothScopes(scope, plan.projectDbPath, plan.globalDbPath);
           clearExodusJournal2(migrateResult.stagingDir);
           const reason = `migration failed: ${migrateResult.error ?? "unknown error"} \u2014 legacy DBs kept as source`;
-          log4.error({ scope, error: migrateResult.error }, `exodus-on-open: ${reason}`);
+          log6.error({ scope, error: migrateResult.error }, `exodus-on-open: ${reason}`);
           return { outcome: "aborted", reason };
         }
         const verifyResult = verifyMigration2(
           plan.sources,
           plan.projectDbPath,
           plan.globalDbPath,
-          (msg) => log4.debug({ scope }, `exodus-on-open verify: ${msg}`)
+          (msg) => log6.debug({ scope }, `exodus-on-open verify: ${msg}`)
         );
         if (!verifyResult.ok) {
-          log4.warn(
+          log6.warn(
             {
               scope,
               enumDrift: verifyResult.enumDrift.length,
@@ -33368,7 +33760,7 @@ async function maybeRunExodusOnOpen(scope, dbPath, nativeDb, cwd) {
           clearExodusJournal2(plan.stagingDir);
           const deficits = verifyResult.tables.filter((t) => t.targetCount < t.sourceCount).map((t) => `${t.targetTable}(${t.sourceCount}\u2192${t.targetCount})`);
           const reason = `parity verification failed \u2014 cutover aborted, legacy DBs kept as source. count deficits: [${deficits.join(", ")}]; INTRODUCED fk orphans: ${verifyResult.introducedForeignKeyViolations.length} (pre-existing source orphans tolerated: ${verifyResult.preExistingForeignKeyViolations.length}). ` + `${verifyResult.error ?? ""}`.trim();
-          log4.error(
+          log6.error(
             {
               scope,
               countDeficits: deficits,
@@ -33380,14 +33772,14 @@ async function maybeRunExodusOnOpen(scope, dbPath, nativeDb, cwd) {
           return { outcome: "aborted", reason };
         }
         const rowsCopied = migrateResult.tables.filter((t) => !t.skipped).reduce((n, t) => n + t.rowsCopied, 0);
-        log4.info(
+        log6.info(
           { scope, rowsCopied, tables: migrateResult.tables.length },
           "exodus-on-open: parity verified \u2014 legacy data migrated into consolidated cleo.db"
         );
         try {
-          const consumed = plan.sources.filter((s) => existsSync8(s.path));
+          const consumed = plan.sources.filter((s) => existsSync10(s.path));
           const archiveResult = archiveMigratedSources(consumed, cwd);
-          log4.info(
+          log6.info(
             {
               scope,
               archived: archiveResult.sources.filter((s) => s.action === "archived").length,
@@ -33396,7 +33788,7 @@ async function maybeRunExodusOnOpen(scope, dbPath, nativeDb, cwd) {
             "exodus-on-open: archived legacy sources + sealed completion marker(s)"
           );
         } catch (err) {
-          log4.error(
+          log6.error(
             { err, scope },
             "exodus-on-open: post-migration archive/marker step failed (migration itself succeeded \u2014 legacy DBs left in place, will be re-checked by `cleo doctor exodus-residue`)"
           );
@@ -33418,14 +33810,14 @@ async function maybeRunExodusOnOpen(scope, dbPath, nativeDb, cwd) {
 function _isExodusInProgress() {
   return _exodusInProgress;
 }
-var log4, _exodusInProgress;
+var log6, _exodusInProgress;
 var init_on_open = __esm({
   "packages/core/src/store/exodus/on-open.ts"() {
     "use strict";
     init_logger2();
     init_lock();
     init_archive2();
-    log4 = getLogger("exodus-on-open");
+    log6 = getLogger("exodus-on-open");
     _exodusInProgress = false;
   }
 });
@@ -33440,7 +33832,7 @@ __export(dual_scope_db_exports, {
   resolveDualScopeDbPath: () => resolveDualScopeDbPath,
   upsertIdempotent: () => upsertIdempotent
 });
-import { existsSync as existsSync9, mkdirSync as mkdirSync3 } from "node:fs";
+import { existsSync as existsSync11, mkdirSync as mkdirSync3 } from "node:fs";
 import { createRequire as createRequire4 } from "node:module";
 import { dirname as dirname4, join as join10 } from "node:path";
 function cacheKey(scope, dbPath) {
@@ -33488,10 +33880,10 @@ async function openDualScopeDb(scope, cwd) {
   const dbPath = resolveDualScopeDbPath(scope, cwd);
   return scope === "project" ? openDualScopeDbAtPath("project", dbPath, cwd) : openDualScopeDbAtPath("global", dbPath, cwd);
 }
-async function openDedicatedDualScopeDb(scope, dbPath, log5) {
-  log5.debug({ scope, dbPath }, "opening DEDICATED (non-cached) dual-scope cleo.db (T11782 FIX D)");
+async function openDedicatedDualScopeDb(scope, dbPath, log7) {
+  log7.debug({ scope, dbPath }, "opening DEDICATED (non-cached) dual-scope cleo.db (T11782 FIX D)");
   const dir = dirname4(dbPath);
-  if (!existsSync9(dir)) {
+  if (!existsSync11(dir)) {
     mkdirSync3(dir, { recursive: true });
   }
   const DatabaseSyncCtor = getDatabaseSyncCtor();
@@ -33509,7 +33901,7 @@ async function openDedicatedDualScopeDb(scope, dbPath, log5) {
     existenceTable(scope),
     `dual-scope-db[${scope}]`
   );
-  log5.debug({ scope, dbPath }, "DEDICATED dual-scope cleo.db ready (T11782 FIX D)");
+  log7.debug({ scope, dbPath }, "DEDICATED dual-scope cleo.db ready (T11782 FIX D)");
   return {
     db,
     scope,
@@ -33534,14 +33926,14 @@ async function openDualScopeDbAtPath(scope, dbPath, exodusCwd, options) {
       return existing.handle;
     }
   }
-  const log5 = getLogger("dual-scope-db");
+  const log7 = getLogger("dual-scope-db");
   if (dedicated) {
-    return openDedicatedDualScopeDb(scope, dbPath, log5);
+    return openDedicatedDualScopeDb(scope, dbPath, log7);
   }
   const initPromise = (async () => {
-    log5.debug({ scope, dbPath }, "opening dual-scope cleo.db");
+    log7.debug({ scope, dbPath }, "opening dual-scope cleo.db");
     const dir = dirname4(dbPath);
-    if (!existsSync9(dir)) {
+    if (!existsSync11(dir)) {
       mkdirSync3(dir, { recursive: true });
     }
     const DatabaseSyncCtor = getDatabaseSyncCtor();
@@ -33559,7 +33951,7 @@ async function openDualScopeDbAtPath(scope, dbPath, exodusCwd, options) {
       existenceTable(scope),
       `dual-scope-db[${scope}]`
     );
-    log5.debug({ scope, dbPath }, "dual-scope cleo.db ready");
+    log7.debug({ scope, dbPath }, "dual-scope cleo.db ready");
     const handle = {
       db,
       scope,
@@ -33583,7 +33975,7 @@ async function openDualScopeDbAtPath(scope, dbPath, exodusCwd, options) {
         const result = await maybeRunExodusOnOpen2(scope, dbPath, nativeDb, exodusCwd);
         if (result.outcome === "migrated" || result.outcome === "aborted") {
           if (result.outcome === "aborted") {
-            log5.warn(
+            log7.warn(
               { scope, reason: result.reason },
               "exodus-on-open aborted; consolidated cleo.db left empty, legacy kept as source"
             );
@@ -33591,7 +33983,7 @@ async function openDualScopeDbAtPath(scope, dbPath, exodusCwd, options) {
           return scope === "project" ? openDualScopeDbAtPath("project", dbPath) : openDualScopeDbAtPath("global", dbPath);
         }
       } catch (err) {
-        log5.warn(
+        log7.warn(
           { err, scope },
           "exodus-on-open hook failed (non-fatal); re-opening consolidated handle"
         );
@@ -34175,7 +34567,7 @@ __export(nexus_sqlite_exports, {
   resetNexusDbState: () => resetNexusDbState,
   resolveNexusMigrationsFolder: () => resolveNexusMigrationsFolder
 });
-import { copyFileSync as copyFileSync3, existsSync as existsSync10 } from "node:fs";
+import { copyFileSync as copyFileSync3, existsSync as existsSync12 } from "node:fs";
 import { join as join11 } from "node:path";
 function getNexusDbPath(cwd) {
   return resolveDualScopeDbPath("project", cwd);
@@ -34217,12 +34609,12 @@ function detectAndWarnOnNestedNexus() {
   } catch {
     return false;
   }
-  if (!existsSync10(nestedPath)) return false;
+  if (!existsSync12(nestedPath)) return false;
   if (_warnedNestedPaths.has(nestedPath)) return false;
   _warnedNestedPaths.add(nestedPath);
   const canonicalPath = getNexusDbPath();
-  const log5 = getLogger("nexus-sqlite");
-  log5.warn(
+  const log7 = getLogger("nexus-sqlite");
+  log7.warn(
     {
       nestedPath,
       canonicalPath,
@@ -34237,7 +34629,7 @@ function detectAndWarnOnNestedNexus() {
 function _resetNestedNexusWarningGate() {
   _warnedNestedPaths.clear();
 }
-function tableExists3(nativeDb, tableName) {
+function tableExists4(nativeDb, tableName) {
   const result = nativeDb.prepare("SELECT name FROM sqlite_master WHERE type='table' AND name=?").get(tableName);
   return !!result;
 }
@@ -34246,7 +34638,7 @@ function objectExists(nativeDb, type, name15) {
   return !!result;
 }
 function ensureNexusFts5(nativeDb) {
-  if (!tableExists3(nativeDb, "nexus_nodes")) return;
+  if (!tableExists4(nativeDb, "nexus_nodes")) return;
   if (!objectExists(nativeDb, "table", "nexus_symbols_fts")) {
     nativeDb.exec(`
       CREATE VIRTUAL TABLE nexus_symbols_fts USING fts5(
@@ -34292,7 +34684,7 @@ function ensureNexusFts5(nativeDb) {
   `);
 }
 function ensureNexusRelationWeights(nativeDb) {
-  if (!tableExists3(nativeDb, "nexus_relations")) return;
+  if (!tableExists4(nativeDb, "nexus_relations")) return;
   nativeDb.exec(`
     CREATE TABLE IF NOT EXISTS nexus_relation_weights (
       relation_id       TEXT PRIMARY KEY NOT NULL,
@@ -34374,9 +34766,9 @@ function ensureNexusRelationWeights(nativeDb) {
 }
 function runNexusMigrations(nativeDb, db) {
   const migrationsFolder = resolveNexusMigrationsFolder();
-  if (tableExists3(nativeDb, "nexus_nodes") && _nexusDbPath) {
+  if (tableExists4(nativeDb, "nexus_nodes") && _nexusDbPath) {
     const backupPath = _nexusDbPath.replace(/\.db$/, "-pre-cleo.db.bak");
-    if (!existsSync10(backupPath)) {
+    if (!existsSync12(backupPath)) {
       try {
         copyFileSync3(_nexusDbPath, backupPath);
       } catch {
@@ -34508,7 +34900,7 @@ var init_nexus_sqlite = __esm({
 
 // packages/core/src/paths.ts
 import { AsyncLocalStorage } from "node:async_hooks";
-import { existsSync as existsSync11, readFileSync as readFileSync4, statSync as statSync3 } from "node:fs";
+import { existsSync as existsSync13, readFileSync as readFileSync4, statSync as statSync5 } from "node:fs";
 import { createRequire as createRequire5 } from "node:module";
 import { homedir } from "node:os";
 import { basename as basename4, dirname as dirname5, join as join12, resolve as resolve3 } from "node:path";
@@ -34602,7 +34994,7 @@ function _resolveProjectByCwdFromNexus(cwd) {
   try {
     const cleoHome = getCleoHome();
     const globalDbPath = join12(cleoHome, "cleo.db");
-    if (!existsSync11(globalDbPath)) return null;
+    if (!existsSync13(globalDbPath)) return null;
     const start = resolve3(cwd ?? process.cwd());
     let current = start;
     const DatabaseSync2 = _getDatabaseSyncCtor();
@@ -34641,7 +35033,7 @@ function _findCleoDirRoot(cwd) {
     const isDangerousRoot = current === homeRoot || current === "/" || current === "";
     if (!isDangerousRoot) {
       try {
-        if (statSync3(join12(current, ".cleo")).isDirectory()) {
+        if (statSync5(join12(current, ".cleo")).isDirectory()) {
           return current;
         }
       } catch {
@@ -34715,7 +35107,7 @@ function _cwdHasGitAncestor(cwd) {
   while (true) {
     const gitMarker = join12(current, ".git");
     try {
-      if (existsSync11(gitMarker)) {
+      if (existsSync13(gitMarker)) {
         return true;
       }
     } catch {
@@ -34728,15 +35120,15 @@ function _cwdHasGitAncestor(cwd) {
 function _resolveMainRepoFromGitlink(gitlinkDir) {
   try {
     const gitLinkPath = join12(gitlinkDir, ".git");
-    if (!existsSync11(gitLinkPath)) return null;
-    const stat2 = statSync3(gitLinkPath);
+    if (!existsSync13(gitLinkPath)) return null;
+    const stat2 = statSync5(gitLinkPath);
     if (!stat2.isFile()) return null;
     const gitLinkContent = readFileSync4(gitLinkPath, "utf-8").trim();
     const match = gitLinkContent.match(/^gitdir:\s*(.+)$/m);
     if (!match) return null;
     const gitdir = match[1].trim();
     const mainRepo = dirname5(dirname5(dirname5(gitdir)));
-    if (existsSync11(join12(mainRepo, ".cleo")) && validateProjectRoot(mainRepo)) {
+    if (existsSync13(join12(mainRepo, ".cleo")) && validateProjectRoot(mainRepo)) {
       return mainRepo;
     }
   } catch {
@@ -34745,19 +35137,19 @@ function _resolveMainRepoFromGitlink(gitlinkDir) {
 }
 function validateProjectRoot(candidate) {
   const cleoDir = join12(candidate, ".cleo");
-  if (!existsSync11(cleoDir)) {
+  if (!existsSync13(cleoDir)) {
     return false;
   }
   const projectInfoPath = join12(cleoDir, "project-info.json");
-  if (existsSync11(projectInfoPath)) {
+  if (existsSync13(projectInfoPath)) {
     try {
       const raw = readFileSync4(projectInfoPath, "utf-8");
       const parsed = JSON.parse(raw);
       if (typeof parsed === "object" && parsed !== null && "projectId" in parsed && typeof parsed["projectId"] === "string" && parsed["projectId"] !== "") {
         const gitMarker = join12(candidate, ".git");
-        if (existsSync11(gitMarker)) {
+        if (existsSync13(gitMarker)) {
           try {
-            if (!statSync3(gitMarker).isDirectory()) {
+            if (!statSync5(gitMarker).isDirectory()) {
               return false;
             }
           } catch {
@@ -34770,10 +35162,10 @@ function validateProjectRoot(candidate) {
     }
   }
   const gitDir = join12(candidate, ".git");
-  if (existsSync11(gitDir)) {
+  if (existsSync13(gitDir)) {
     let isRealGitDir = false;
     try {
-      const stat2 = statSync3(gitDir);
+      const stat2 = statSync5(gitDir);
       isRealGitDir = stat2.isDirectory();
     } catch {
       isRealGitDir = false;
@@ -34820,16 +35212,16 @@ function getProjectRoot(cwd) {
     const cleoDir = join12(current, ".cleo");
     const gitDir = join12(current, ".git");
     const isDangerousRoot = current === homeRoot || current === "/" || current === "";
-    if (existsSync11(cleoDir) && !isDangerousRoot) {
+    if (existsSync13(cleoDir) && !isDangerousRoot) {
       if (validateProjectRoot(current)) {
         return current;
       }
       skippedCleoDirs.push(current);
     }
-    if (existsSync11(gitDir) && !isDangerousRoot) {
+    if (existsSync13(gitDir) && !isDangerousRoot) {
       let isRealGitDir = false;
       try {
-        isRealGitDir = statSync3(gitDir).isDirectory();
+        isRealGitDir = statSync5(gitDir).isDirectory();
       } catch {
         isRealGitDir = false;
       }
@@ -34882,7 +35274,7 @@ function isAbsolutePath(path) {
 function _readProjectNameFromInfo(projectRoot) {
   try {
     const infoPath = join12(projectRoot, ".cleo", "project-info.json");
-    if (!existsSync11(infoPath)) return void 0;
+    if (!existsSync13(infoPath)) return void 0;
     const raw = readFileSync4(infoPath, "utf-8");
     const data = JSON.parse(raw);
     return typeof data.name === "string" && data.name.length > 0 ? data.name : void 0;
@@ -34974,7 +35366,7 @@ var init_paths = __esm({
 // packages/core/src/store/file-utils.ts
 import { randomBytes } from "node:crypto";
 import {
-  existsSync as existsSync12,
+  existsSync as existsSync14,
   mkdirSync as mkdirSync4,
   readdirSync as readdirSync4,
   readFileSync as readFileSync5,
@@ -34989,7 +35381,7 @@ function rotateBackup(filePath, mode) {
   const name15 = basename5(filePath);
   const backupDir = join13(dir, ".backups");
   const dirMode = typeof mode === "number" ? modeToDirMode(mode) : void 0;
-  if (!existsSync12(backupDir)) {
+  if (!existsSync14(backupDir)) {
     mkdirSync4(backupDir, { recursive: true, mode: dirMode });
   }
   for (let i = MAX_BACKUPS; i >= 1; i--) {
@@ -35002,7 +35394,7 @@ function rotateBackup(filePath, mode) {
     } else {
       const next = join13(backupDir, `${name15}.${i + 1}`);
       try {
-        if (existsSync12(current)) renameSync3(current, next);
+        if (existsSync14(current)) renameSync3(current, next);
       } catch {
       }
     }
@@ -35038,7 +35430,7 @@ function writeJsonFileAtomic(filePath, data, optsOrIndent = 2) {
     writeFileSync3(tempPath, content, "utf-8");
   }
   try {
-    if (existsSync12(filePath)) {
+    if (existsSync14(filePath)) {
       rotateBackup(filePath, mode);
     }
     renameSync3(tempPath, filePath);
@@ -35064,10 +35456,10 @@ function readJsonFile(filePath) {
 async function withLock2(filePath, transform2, opts = {}) {
   const dir = dirname6(filePath);
   const dirMode = typeof opts.mode === "number" ? modeToDirMode(opts.mode) : void 0;
-  if (!existsSync12(dir)) {
+  if (!existsSync14(dir)) {
     mkdirSync4(dir, { recursive: true, mode: dirMode });
   }
-  if (!existsSync12(filePath)) {
+  if (!existsSync14(filePath)) {
     if (typeof opts.mode === "number") {
       writeFileSync3(filePath, "", { encoding: "utf-8", mode: opts.mode });
     } else {
@@ -35089,10 +35481,10 @@ async function withLock2(filePath, transform2, opts = {}) {
 }
 async function withFileLock(filePath, operation) {
   const dir = dirname6(filePath);
-  if (!existsSync12(dir)) {
+  if (!existsSync14(dir)) {
     mkdirSync4(dir, { recursive: true });
   }
-  if (!existsSync12(filePath)) {
+  if (!existsSync14(filePath)) {
     writeFileSync3(filePath, "", "utf-8");
   }
   let release;
@@ -35312,7 +35704,7 @@ __export(config_exports, {
   parseConfigValue: () => parseConfigValue,
   setConfigValue: () => setConfigValue
 });
-import { existsSync as existsSync13 } from "node:fs";
+import { existsSync as existsSync15 } from "node:fs";
 import { mkdir as mkdir3, writeFile } from "node:fs/promises";
 import { dirname as dirname7 } from "node:path";
 function getNestedValue(obj, path) {
@@ -35436,7 +35828,7 @@ function parseConfigValue(value) {
 }
 async function setConfigValue(key, value, cwd, opts) {
   const configPath = opts?.global ? getGlobalConfigPath() : getConfigPath(cwd);
-  if (!existsSync13(configPath)) {
+  if (!existsSync15(configPath)) {
     const dir = dirname7(configPath);
     await mkdir3(dir, { recursive: true });
     await writeFile(configPath, "{}", "utf-8");
@@ -35450,7 +35842,7 @@ async function setConfigValue(key, value, cwd, opts) {
 async function applyStrictnessPreset(preset, cwd, opts) {
   const definition = STRICTNESS_PRESETS[preset];
   const configPath = opts?.global ? getGlobalConfigPath() : getConfigPath(cwd);
-  if (!existsSync13(configPath)) {
+  if (!existsSync15(configPath)) {
     const dir = dirname7(configPath);
     await mkdir3(dir, { recursive: true });
     await writeFile(configPath, "{}", "utf-8");
@@ -35823,7 +36215,7 @@ var init_cleo_pkce_seeder = __esm({
 });
 
 // packages/core/src/llm/credential-seeders/codex-cli-seeder.ts
-import { existsSync as existsSync14, readFileSync as readFileSync8 } from "node:fs";
+import { existsSync as existsSync16, readFileSync as readFileSync8 } from "node:fs";
 import { homedir as homedir3 } from "node:os";
 import { join as join17 } from "node:path";
 function getCodexAuthPath() {
@@ -35848,7 +36240,7 @@ var init_codex_cli_seeder = __esm({
        */
       async seed() {
         const authPath = getCodexAuthPath();
-        if (!existsSync14(authPath)) {
+        if (!existsSync16(authPath)) {
           return { entries: [] };
         }
         let raw;
@@ -35978,7 +36370,7 @@ var init_google_pkce = __esm({
 });
 
 // packages/core/src/llm/credential-seeders/gemini-cli-seeder.ts
-import { existsSync as existsSync15, readFileSync as readFileSync9 } from "node:fs";
+import { existsSync as existsSync17, readFileSync as readFileSync9 } from "node:fs";
 import { join as join18 } from "node:path";
 import { getCleoHome as getCleoHome3 } from "@cleocode/paths";
 function getGoogleOauthPath() {
@@ -36027,7 +36419,7 @@ var init_gemini_cli_seeder = __esm({
        */
       async seed() {
         const path = getGoogleOauthPath();
-        if (!existsSync15(path)) {
+        if (!existsSync17(path)) {
           return { entries: [] };
         }
         let raw;
@@ -36252,7 +36644,7 @@ var init_credential_seeders = __esm({
 
 // packages/core/src/llm/global-config-migration.ts
 import {
-  existsSync as existsSync16,
+  existsSync as existsSync18,
   mkdirSync as mkdirSync5,
   readFileSync as readFileSync10,
   renameSync as renameSync4,
@@ -36278,12 +36670,12 @@ function migrateGlobalConfigToConfigDir() {
     const source = legacyGlobalConfigPath();
     const target = configDirGlobalConfigPath();
     const marker16 = migrationMarkerPath();
-    if (existsSync16(marker16)) return false;
-    if (!existsSync16(source)) {
+    if (existsSync18(marker16)) return false;
+    if (!existsSync18(source)) {
       stampMarker(marker16);
       return false;
     }
-    if (existsSync16(target)) {
+    if (existsSync18(target)) {
       backupSourceQuiet(source);
       stampMarker(marker16);
       return false;
@@ -36316,7 +36708,7 @@ function migrateGlobalConfigToConfigDir() {
   } catch (err) {
     try {
       const temp = tempTargetPath();
-      if (existsSync16(temp)) unlinkSync5(temp);
+      if (existsSync18(temp)) unlinkSync5(temp);
     } catch {
     }
     console.error(
@@ -36336,7 +36728,7 @@ function stampMarker(markerPath) {
 function backupSourceQuiet(source) {
   try {
     const backup = `${source}${BACKUP_SUFFIX}`;
-    if (existsSync16(backup)) return;
+    if (existsSync18(backup)) return;
     renameSync4(source, backup);
   } catch {
   }
@@ -36359,7 +36751,7 @@ var init_global_config_migration = __esm({
 });
 
 // packages/core/src/llm/legacy-flat-key-import.ts
-import { existsSync as existsSync17, readFileSync as readFileSync11, renameSync as renameSync5, writeFileSync as writeFileSync5 } from "node:fs";
+import { existsSync as existsSync19, readFileSync as readFileSync11, renameSync as renameSync5, writeFileSync as writeFileSync5 } from "node:fs";
 import { join as join20 } from "node:path";
 import { getCleoHome as getCleoHome5 } from "@cleocode/paths";
 function migrationPaths() {
@@ -36388,7 +36780,7 @@ function writeMarker(markerPath) {
 }
 function readFlatKey(flatPath) {
   try {
-    if (!existsSync17(flatPath)) return null;
+    if (!existsSync19(flatPath)) return null;
     const raw = readFileSync11(flatPath, "utf-8").trim();
     return raw || null;
   } catch (err) {
@@ -36401,7 +36793,7 @@ function readFlatKey(flatPath) {
 }
 async function importLegacyFlatAnthropicKey() {
   const { flatPath, bakPath, markerPath } = migrationPaths();
-  if (existsSync17(markerPath)) {
+  if (existsSync19(markerPath)) {
     return { status: "marker-present", flatPath, bakPath: null, markerPath };
   }
   let existing = null;
@@ -36418,7 +36810,7 @@ async function importLegacyFlatAnthropicKey() {
     writeMarker(markerPath);
     return { status: "already-imported", flatPath, bakPath: null, markerPath };
   }
-  if (!existsSync17(flatPath)) {
+  if (!existsSync19(flatPath)) {
     writeMarker(markerPath);
     return { status: "no-flat-file", flatPath, bakPath: null, markerPath };
   }
@@ -36494,7 +36886,7 @@ __export(credentials_exports, {
   resolveProviderStatus: () => resolveProviderStatus,
   storeAnthropicApiKey: () => storeAnthropicApiKey
 });
-import { existsSync as existsSync18, mkdirSync as mkdirSync6, readFileSync as readFileSync12, writeFileSync as writeFileSync6 } from "node:fs";
+import { existsSync as existsSync20, mkdirSync as mkdirSync6, readFileSync as readFileSync12, writeFileSync as writeFileSync6 } from "node:fs";
 import { join as join21 } from "node:path";
 import { getCleoHome as getCleoHome6 } from "@cleocode/paths";
 function globalConfigPath() {
@@ -36513,7 +36905,7 @@ function readGlobalProviderKey(provider) {
 function readFlatAnthropicKey() {
   try {
     const keyFile = join21(getCleoHome6(), "anthropic-key");
-    if (!existsSync18(keyFile)) return null;
+    if (!existsSync20(keyFile)) return null;
     const stored = readFileSync12(keyFile, "utf-8").trim();
     return stored || null;
   } catch {
@@ -36522,7 +36914,7 @@ function readFlatAnthropicKey() {
 }
 function readProviderKeyFromConfig(configFile, provider) {
   try {
-    if (!existsSync18(configFile)) return null;
+    if (!existsSync20(configFile)) return null;
     const raw = readFileSync12(configFile, "utf-8");
     const config2 = JSON.parse(raw);
     const llm = config2["llm"];
@@ -36685,7 +37077,7 @@ function resolveProviderStatus(provider) {
 }
 function storeAnthropicApiKey(apiKey) {
   const dir = getCleoHome6();
-  if (!existsSync18(dir)) {
+  if (!existsSync20(dir)) {
     mkdirSync6(dir, { recursive: true });
   }
   const keyFile = join21(dir, "anthropic-key");
@@ -36740,16 +37132,16 @@ var init_credentials2 = __esm({
 });
 
 // packages/core/src/llm/credentials-store.ts
-import { chmodSync, existsSync as existsSync19, mkdirSync as mkdirSync7, readFileSync as readFileSync13, statSync as statSync4, writeFileSync as writeFileSync7 } from "node:fs";
+import { chmodSync, existsSync as existsSync21, mkdirSync as mkdirSync7, readFileSync as readFileSync13, statSync as statSync6, writeFileSync as writeFileSync7 } from "node:fs";
 import { dirname as dirname8, join as join22 } from "node:path";
 import { getCleoHome as getCleoHome7 } from "@cleocode/paths";
 function credentialsStorePath() {
   return join22(getCleoHome7(), "llm-credentials.json");
 }
 function ensureFileInitialized(path) {
-  if (existsSync19(path)) return;
+  if (existsSync21(path)) return;
   const dir = dirname8(path);
-  if (!existsSync19(dir)) {
+  if (!existsSync21(dir)) {
     mkdirSync7(dir, { recursive: true, mode: 448 });
   } else {
     try {
@@ -36771,7 +37163,7 @@ function ensureFileInitialized(path) {
 function checkPermsOnRead(path) {
   if (_warnedLoosePerms) return;
   try {
-    const stats = statSync4(path);
+    const stats = statSync6(path);
     const mode = stats.mode & 511;
     if (mode !== 384 && mode !== 0) {
       logger2.warn(
@@ -37053,6 +37445,10 @@ var init_anthropic = __esm({
       baseUrl: "https://api.anthropic.com",
       defaultModel: "claude-haiku-4-5-20251001",
       aliases: ["claude", "anthropic-api"],
+      // Hermes-parity routing/catalog fields (T11756); catalog-sourced under E8.
+      tier: "frontier",
+      defaultAuxModel: "claude-haiku-4-5-20251001",
+      defaultMaxTokens: 4096,
       defaultHeaders: { "anthropic-version": "2023-06-01" },
       oauth: ANTHROPIC_OAUTH
     };
@@ -37093,6 +37489,10 @@ var init_gemini = __esm({
       baseUrl: "https://generativelanguage.googleapis.com/v1beta/openai",
       defaultModel: "gemini-2.0-flash",
       aliases: ["google", "google-gemini"],
+      // Hermes-parity routing/catalog fields (T11756); catalog-sourced under E8.
+      tier: "standard",
+      defaultAuxModel: "gemini-2.0-flash",
+      defaultMaxTokens: 4096,
       envVars: ["GEMINI_API_KEY", "GOOGLE_API_KEY"],
       /**
        * Inject `thinking_config` for Gemini's extended reasoning support.
@@ -37118,13 +37518,13 @@ var init_gemini = __esm({
 
 // packages/core/src/llm/stable-device-id.ts
 import { randomUUID } from "node:crypto";
-import { existsSync as existsSync20, mkdirSync as mkdirSync8, readFileSync as readFileSync14, renameSync as renameSync6, writeFileSync as writeFileSync8 } from "node:fs";
+import { existsSync as existsSync22, mkdirSync as mkdirSync8, readFileSync as readFileSync14, renameSync as renameSync6, writeFileSync as writeFileSync8 } from "node:fs";
 import { dirname as dirname9, join as join23 } from "node:path";
 import { getCleoHome as getCleoHome8 } from "@cleocode/paths";
 function getStableDeviceId() {
   if (_cachedDeviceId !== null) return _cachedDeviceId;
   const path = join23(getCleoHome8(), DEVICE_ID_FILE);
-  if (existsSync20(path)) {
+  if (existsSync22(path)) {
     try {
       const raw = readFileSync14(path, "utf-8").trim();
       if (raw.length > 0) {
@@ -37137,7 +37537,7 @@ function getStableDeviceId() {
   const fresh = randomUUID();
   try {
     const dir = dirname9(path);
-    if (!existsSync20(dir)) {
+    if (!existsSync22(dir)) {
       mkdirSync8(dir, { recursive: true });
     }
     const tmpPath = `${path}.tmp.${process.pid}`;
@@ -37284,6 +37684,10 @@ var init_ollama = __esm({
       baseUrl: "http://localhost:11434",
       defaultModel: "llama3",
       aliases: ["ollama-local"],
+      // Hermes-parity routing/catalog fields (T11756). Local on-device tier.
+      tier: "local",
+      defaultAuxModel: "llama3",
+      defaultMaxTokens: 2048,
       envVars: ["OLLAMA_API_KEY", "OLLAMA_BASE_URL"],
       supportsThinkingBudget: false
     };
@@ -37322,6 +37726,12 @@ var init_openai = __esm({
       // to the confirmed latest OpenAI model (catalog release_date 2026-04-23).
       defaultModel: "gpt-5.5",
       aliases: ["codex", "chatgpt", "openai-codex"],
+      // Hermes-parity routing/catalog fields (T11756). tier + defaultAuxModel are
+      // catalog-sourced (E8 join, T11773) when a snapshot is present; these are the
+      // static fallbacks used until the catalog populates them.
+      tier: "frontier",
+      defaultAuxModel: "gpt-5-mini",
+      defaultMaxTokens: 4096,
       oauth: OPENAI_CODEX_OAUTH
     };
   }
@@ -37429,7 +37839,7 @@ var init_xai = __esm({
 });
 
 // packages/core/src/llm/provider-registry/loader.ts
-import { readdirSync as readdirSync5, statSync as statSync5 } from "node:fs";
+import { readdirSync as readdirSync5, statSync as statSync7 } from "node:fs";
 import { join as join24 } from "node:path";
 import { pathToFileURL } from "node:url";
 function isPluginFile(filename) {
@@ -37484,7 +37894,7 @@ async function scanAndLoadPlugins(pluginDir, api) {
   }
   const pluginFiles = entries.filter((name15) => !name15.startsWith(".") && isPluginFile(name15)).filter((name15) => {
     try {
-      return statSync5(join24(pluginDir, name15)).isFile();
+      return statSync7(join24(pluginDir, name15)).isFile();
     } catch {
       return false;
     }
@@ -37571,7 +37981,7 @@ var init_provider_registry = __esm({
 });
 
 // packages/core/src/llm/rate-limit-guard.ts
-import { existsSync as existsSync21, mkdirSync as mkdirSync9, unlinkSync as unlinkSync6 } from "node:fs";
+import { existsSync as existsSync23, mkdirSync as mkdirSync9, unlinkSync as unlinkSync6 } from "node:fs";
 import { join as join25 } from "node:path";
 import { getCleoHome as getCleoHome9 } from "@cleocode/paths";
 function sanitize(value) {
@@ -37627,7 +38037,7 @@ async function recordRateLimit(provider, label, opts) {
   }
   const filePath = rateLimitStatePath(provider, label);
   const dir = join25(getCleoHome9(), "rate-limit-state");
-  if (!existsSync21(dir)) {
+  if (!existsSync23(dir)) {
     mkdirSync9(dir, { recursive: true });
   }
   const state = { resetAt, recordedAt: now, source };
@@ -38832,6 +39242,78 @@ var init_concrete_session = __esm({
   }
 });
 
+// packages/core/src/llm/transports/codex-oauth-headers.ts
+function extractChatGptAccountId(accessToken) {
+  if (typeof accessToken !== "string" || !accessToken.trim()) return null;
+  const parts = accessToken.split(".");
+  if (parts.length < 2) return null;
+  const payloadSegment = parts[1];
+  if (!payloadSegment) return null;
+  try {
+    const b64 = payloadSegment.replace(/-/g, "+").replace(/_/g, "/");
+    const padded = b64 + "=".repeat((4 - b64.length % 4) % 4);
+    const json3 = Buffer.from(padded, "base64").toString("utf8");
+    const claims = JSON.parse(json3);
+    const authClaim = claims["https://api.openai.com/auth"];
+    if (authClaim && typeof authClaim === "object" && !Array.isArray(authClaim)) {
+      const acctId = authClaim["chatgpt_account_id"];
+      if (typeof acctId === "string" && acctId) return acctId;
+    }
+  } catch {
+  }
+  return null;
+}
+function buildCodexOAuthHeaders(accessToken) {
+  const headers = {
+    "User-Agent": CODEX_USER_AGENT,
+    originator: "codex_cli_rs"
+  };
+  const acctId = extractChatGptAccountId(accessToken);
+  if (acctId) headers["ChatGPT-Account-ID"] = acctId;
+  return headers;
+}
+var CODEX_OAUTH_BASE_URL, CODEX_USER_AGENT;
+var init_codex_oauth_headers = __esm({
+  "packages/core/src/llm/transports/codex-oauth-headers.ts"() {
+    "use strict";
+    CODEX_OAUTH_BASE_URL = "https://chatgpt.com/backend-api/codex";
+    CODEX_USER_AGENT = "codex_cli_rs/0.0.0 (CLEO)";
+  }
+});
+
+// packages/core/src/llm/api-mode.ts
+var api_mode_exports = {};
+__export(api_mode_exports, {
+  deriveApiWire: () => deriveApiWire
+});
+function deriveApiWire(provider, authType) {
+  if (provider === "anthropic") {
+    return { apiMode: "anthropic_messages", baseUrl: null };
+  }
+  if (provider === "kimi-code") {
+    return { apiMode: "anthropic_messages", baseUrl: null };
+  }
+  if (provider === "bedrock") {
+    return { apiMode: "bedrock_converse", baseUrl: null };
+  }
+  if (provider === "gemini") {
+    return { apiMode: "chat_completions", baseUrl: null };
+  }
+  if (provider === "ollama") {
+    return { apiMode: "ollama_native", baseUrl: null };
+  }
+  if (provider === "openai" && authType === "oauth") {
+    return { apiMode: "codex_responses", baseUrl: CODEX_OAUTH_BASE_URL };
+  }
+  return { apiMode: "chat_completions", baseUrl: null };
+}
+var init_api_mode = __esm({
+  "packages/core/src/llm/api-mode.ts"() {
+    "use strict";
+    init_codex_oauth_headers();
+  }
+});
+
 // packages/core/src/llm/image-routing.ts
 function imageSizeLimitFor(provider) {
   return PROVIDER_IMAGE_SIZE_LIMITS[provider.toLowerCase()] ?? Number.POSITIVE_INFINITY;
@@ -41241,45 +41723,6 @@ var init_chat_completions = __esm({
   }
 });
 
-// packages/core/src/llm/transports/codex-oauth-headers.ts
-function extractChatGptAccountId(accessToken) {
-  if (typeof accessToken !== "string" || !accessToken.trim()) return null;
-  const parts = accessToken.split(".");
-  if (parts.length < 2) return null;
-  const payloadSegment = parts[1];
-  if (!payloadSegment) return null;
-  try {
-    const b64 = payloadSegment.replace(/-/g, "+").replace(/_/g, "/");
-    const padded = b64 + "=".repeat((4 - b64.length % 4) % 4);
-    const json3 = Buffer.from(padded, "base64").toString("utf8");
-    const claims = JSON.parse(json3);
-    const authClaim = claims["https://api.openai.com/auth"];
-    if (authClaim && typeof authClaim === "object" && !Array.isArray(authClaim)) {
-      const acctId = authClaim["chatgpt_account_id"];
-      if (typeof acctId === "string" && acctId) return acctId;
-    }
-  } catch {
-  }
-  return null;
-}
-function buildCodexOAuthHeaders(accessToken) {
-  const headers = {
-    "User-Agent": CODEX_USER_AGENT,
-    originator: "codex_cli_rs"
-  };
-  const acctId = extractChatGptAccountId(accessToken);
-  if (acctId) headers["ChatGPT-Account-ID"] = acctId;
-  return headers;
-}
-var CODEX_OAUTH_BASE_URL, CODEX_USER_AGENT;
-var init_codex_oauth_headers = __esm({
-  "packages/core/src/llm/transports/codex-oauth-headers.ts"() {
-    "use strict";
-    CODEX_OAUTH_BASE_URL = "https://chatgpt.com/backend-api/codex";
-    CODEX_USER_AGENT = "codex_cli_rs/0.0.0 (CLEO)";
-  }
-});
-
 // packages/core/src/llm/transports/codex-responses.ts
 import { OpenAI as OpenAIClient } from "openai";
 function extractTextContent3(message) {
@@ -70227,6 +70670,62 @@ var model_runner_exports = {};
 __export(model_runner_exports, {
   ModelRunner: () => ModelRunner
 });
+function buildCodexResponsesTransport(provider, credential) {
+  const defaultHeaders = credential.authType === "oauth" ? { ...credential.extraHeaders, ...buildCodexOAuthHeaders(credential.token) } : { ...credential.extraHeaders };
+  return new CodexResponsesTransport({
+    apiKey: credential.token,
+    baseUrl: credential.baseUrl ?? void 0,
+    defaultHeaders: Object.keys(defaultHeaders).length ? defaultHeaders : void 0,
+    provider
+  });
+}
+function buildAnthropicMessagesTransport(provider, credential) {
+  if (provider === "kimi-code") {
+    return new AnthropicTransport({
+      authToken: credential.token,
+      baseUrl: credential.baseUrl ?? KIMI_CODE_BASE_URL2,
+      defaultHeaders: getKimiCodeMshHeaders()
+    });
+  }
+  const opts = credential.authType === "oauth" ? {
+    authToken: credential.token,
+    baseUrl: credential.baseUrl ?? void 0,
+    defaultHeaders: { ...ANTHROPIC_OAUTH_HEADERS, ...credential.extraHeaders }
+  } : {
+    apiKey: credential.token,
+    baseUrl: credential.baseUrl ?? void 0,
+    defaultHeaders: Object.keys(credential.extraHeaders).length ? credential.extraHeaders : void 0
+  };
+  return new AnthropicTransport(opts);
+}
+function buildBedrockConverseTransport(_provider, credential) {
+  return new BedrockTransport({ awsProfile: credential.awsProfile ?? void 0 });
+}
+function buildOllamaNativeTransport(_provider, credential) {
+  return new OllamaTransport({
+    baseUrl: credential.baseUrl ?? void 0,
+    apiKey: credential.token || void 0,
+    defaultHeaders: Object.keys(credential.extraHeaders).length ? credential.extraHeaders : void 0
+  });
+}
+function buildChatCompletionsTransport(provider, credential) {
+  if (provider === "gemini") {
+    return new GeminiTransport({
+      apiKey: credential.token,
+      baseUrl: credential.baseUrl ?? void 0
+    });
+  }
+  const defaultHeaders = { ...credential.extraHeaders };
+  if (credential.authType === "oauth") {
+    defaultHeaders["Authorization"] = `Bearer ${credential.token}`;
+  }
+  return new ChatCompletionsTransport({
+    apiKey: credential.token,
+    baseUrl: credential.baseUrl ?? void 0,
+    defaultHeaders: Object.keys(defaultHeaders).length ? defaultHeaders : void 0,
+    provider
+  });
+}
 function descriptorToCredential(d) {
   const authType = d.authType === "oauth" ? "oauth" : d.authType === "aws_sdk" ? "aws_sdk" : "api_key";
   return {
@@ -70241,11 +70740,12 @@ function descriptorToCredential(d) {
     awsProfile: null
   };
 }
-var logger3, KIMI_CODE_BASE_URL2, ANTHROPIC_OAUTH_HEADERS, OLLAMA_OPENAI_COMPAT_BASE_URL, ModelRunner;
+var logger3, KIMI_CODE_BASE_URL2, ANTHROPIC_OAUTH_HEADERS, TRANSPORT_ADAPTERS, OLLAMA_OPENAI_COMPAT_BASE_URL, ModelRunner;
 var init_model_runner = __esm({
   "packages/core/src/llm/model-runner.ts"() {
     "use strict";
     init_logger2();
+    init_api_mode();
     init_concrete_session();
     init_kimi_code();
     init_anthropic2();
@@ -70260,6 +70760,13 @@ var init_model_runner = __esm({
     ANTHROPIC_OAUTH_HEADERS = {
       "anthropic-beta": "oauth-2025-04-20"
     };
+    TRANSPORT_ADAPTERS = {
+      codex_responses: buildCodexResponsesTransport,
+      anthropic_messages: buildAnthropicMessagesTransport,
+      bedrock_converse: buildBedrockConverseTransport,
+      ollama_native: buildOllamaNativeTransport,
+      chat_completions: buildChatCompletionsTransport
+    };
     OLLAMA_OPENAI_COMPAT_BASE_URL = "http://localhost:11434/v1";
     ModelRunner = {
       /**
@@ -70295,64 +70802,8 @@ var init_model_runner = __esm({
        * @returns A wire-level transport.
        */
       buildTransportFromCredential(provider, credential, apiMode) {
-        if (apiMode === "codex_responses") {
-          const defaultHeaders2 = credential.authType === "oauth" ? { ...credential.extraHeaders, ...buildCodexOAuthHeaders(credential.token) } : { ...credential.extraHeaders };
-          return new CodexResponsesTransport({
-            apiKey: credential.token,
-            baseUrl: credential.baseUrl ?? void 0,
-            defaultHeaders: Object.keys(defaultHeaders2).length ? defaultHeaders2 : void 0,
-            provider
-          });
-        }
-        if (provider === "anthropic") {
-          const opts = credential.authType === "oauth" ? {
-            authToken: credential.token,
-            baseUrl: credential.baseUrl ?? void 0,
-            // OAuth REQUIRES the beta opt-in header. The canonical header is
-            // the default; a caller's own extraHeaders override it if set.
-            defaultHeaders: { ...ANTHROPIC_OAUTH_HEADERS, ...credential.extraHeaders }
-          } : {
-            apiKey: credential.token,
-            baseUrl: credential.baseUrl ?? void 0,
-            defaultHeaders: Object.keys(credential.extraHeaders).length ? credential.extraHeaders : void 0
-          };
-          return new AnthropicTransport(opts);
-        }
-        if (provider === "kimi-code") {
-          return new AnthropicTransport({
-            authToken: credential.token,
-            baseUrl: credential.baseUrl ?? KIMI_CODE_BASE_URL2,
-            defaultHeaders: getKimiCodeMshHeaders()
-          });
-        }
-        if (provider === "bedrock") {
-          return new BedrockTransport({
-            awsProfile: credential.awsProfile ?? void 0
-          });
-        }
-        if (provider === "gemini") {
-          return new GeminiTransport({
-            apiKey: credential.token,
-            baseUrl: credential.baseUrl ?? void 0
-          });
-        }
-        if (provider === "ollama") {
-          return new OllamaTransport({
-            baseUrl: credential.baseUrl ?? void 0,
-            apiKey: credential.token || void 0,
-            defaultHeaders: Object.keys(credential.extraHeaders).length ? credential.extraHeaders : void 0
-          });
-        }
-        const defaultHeaders = { ...credential.extraHeaders };
-        if (credential.authType === "oauth") {
-          defaultHeaders["Authorization"] = `Bearer ${credential.token}`;
-        }
-        return new ChatCompletionsTransport({
-          apiKey: credential.token,
-          baseUrl: credential.baseUrl ?? void 0,
-          defaultHeaders: Object.keys(defaultHeaders).length ? defaultHeaders : void 0,
-          provider
-        });
+        const mode = apiMode ?? deriveApiWire(provider, null).apiMode;
+        return TRANSPORT_ADAPTERS[mode](provider, credential);
       },
       /**
        * Construct a Vercel AI SDK {@link LanguageModel} for the sentient/adapters
@@ -70422,39 +70873,6 @@ var init_model_runner = __esm({
   }
 });
 
-// packages/core/src/llm/api-mode.ts
-var api_mode_exports = {};
-__export(api_mode_exports, {
-  deriveApiWire: () => deriveApiWire
-});
-function deriveApiWire(provider, authType) {
-  if (provider === "anthropic") {
-    return { apiMode: "anthropic_messages", baseUrl: null };
-  }
-  if (provider === "kimi-code") {
-    return { apiMode: "anthropic_messages", baseUrl: null };
-  }
-  if (provider === "bedrock") {
-    return { apiMode: "bedrock_converse", baseUrl: null };
-  }
-  if (provider === "gemini") {
-    return { apiMode: "chat_completions", baseUrl: null };
-  }
-  if (provider === "ollama") {
-    return { apiMode: "ollama_native", baseUrl: null };
-  }
-  if (provider === "openai" && authType === "oauth") {
-    return { apiMode: "codex_responses", baseUrl: CODEX_OAUTH_BASE_URL };
-  }
-  return { apiMode: "chat_completions", baseUrl: null };
-}
-var init_api_mode = __esm({
-  "packages/core/src/llm/api-mode.ts"() {
-    "use strict";
-    init_codex_oauth_headers();
-  }
-});
-
 // packages/core/src/llm/transports/anthropic-client-factory.ts
 import { Anthropic as Anthropic2 } from "@anthropic-ai/sdk";
 function buildAnthropicClient(credential) {