@cleocode/core 2026.6.9 → 2026.6.11

package/dist/store/migration-manager.js

@@ -11,6 +11,7 @@
  * @see https://github.com/anthropics/cleo/issues/65
  */
 import { copyFileSync, existsSync } from 'node:fs';
+import { dirname, join } from 'node:path';
 import { readMigrationFiles } from 'drizzle-orm/migrator';
 import { getLogger } from '../logger.js';
 import { isSqliteBusy } from './with-retry.js';
@@ -27,6 +28,178 @@ export { isSqliteBusy };
 const MAX_MIGRATION_RETRIES = 5;
 const MIGRATION_RETRY_BASE_DELAY_MS = 100;
 const MIGRATION_RETRY_MAX_DELAY_MS = 2000;
+/**
+ * Strip SQL line (`-- …`) and block (`/* … *​/`) comments from a migration's SQL
+ * before scanning it for DDL targets.
+ *
+ * Migration files routinely carry prose comments describing the change — phrases
+ * like "the project-side CREATE TABLE half of that move" or "CREATE TABLE IF NOT
+ * EXISTS ensures it exists". A DDL-extraction regex run over the RAW SQL captures
+ * bogus "table" names from those comments (`half`, `IF`, `ensures`), making a
+ * fully-satisfied migration look un-applied. The journal then omits it, Drizzle
+ * re-runs its bare `CREATE TABLE …` against a DB where the table already exists,
+ * and the open fails (root cause of the "Task database not initialized" poison).
+ *
+ * Always strip comments via this helper BEFORE any `createTableRegex` /
+ * `createIndexRegex` / `alterColumnRegex` scan. The pair of replaces matches the
+ * idiom already used by {@link isExecutableStatement} and Scenario 3's
+ * comment-only baseline detection.
+ *
+ * @param sql - Raw migration SQL (one statement or many joined with `\n`)
+ * @returns The SQL with all `--` line comments and `/* … *​/` block comments removed
+ */
+export function stripSqlComments(sql) {
+    return sql.replace(/--[^\n]*/g, '').replace(/\/\*[\s\S]*?\*\//g, '');
+}
+/**
+ * Compute the set of tables that a migration lineage CREATEs and a LATER
+ * migration permanently ELIMINATES (DROP TABLE with no subsequent recreate).
+ *
+ * ## Why (bug #2)
+ *
+ * The DDL probe ({@link probeAndMarkApplied}) marks a `CREATE TABLE foo`
+ * migration applied only if `foo` exists in the live schema. That breaks when a
+ * later migration DROPs `foo` for good: e.g. `t033`/`initial` create
+ * `release_manifests`, which `t9686b2` later DROPs (superseded by `releases`).
+ * On a DB that has run the WHOLE lineage, `release_manifests` is correctly
+ * absent — but the probe then refuses to mark `t033`/`initial` applied, so
+ * drizzle's `migrate()` re-runs their bare `CREATE TABLE release_manifests`
+ * against the live DB and throws ("table already exists" / cascade) — surfacing
+ * as the opaque E_NOT_INITIALIZED / E_INTERNAL on a consolidated `cleo.db`.
+ *
+ * Pre-computing the eliminated set lets the probe treat a CREATE-of-an-
+ * eliminated-table as already satisfied: the table is *supposed* to be gone, so
+ * its absence is evidence the lineage ran, not that it didn't.
+ *
+ * ## Disposition tracking
+ *
+ * Walks migrations in `folderMillis` order and, WITHIN each migration, processes
+ * statements IN ORDER so the SQLite rebuild/recreate idioms resolve correctly:
+ *
+ *  - `CREATE TABLE x` (or `… RENAME TO x`) → `x` is present.
+ *  - `DROP TABLE x`                        → `x` is dropped.
+ *
+ * The rebuild idiom (`CREATE __new_x; DROP x; ALTER __new_x RENAME TO x`) and the
+ * drop-then-recreate idiom (`DROP x; CREATE x`) both end with `x` PRESENT because
+ * the final in-order statement for `x` is a create/rename. A table is
+ * "eliminated" only if the LAST statement touching it across the whole lineage is
+ * a DROP. Transient intermediates (`__new_*`) are naturally classified by the
+ * same rule and are irrelevant to the probe (which already redirects renames to
+ * the final name).
+ *
+ * @param migrations - All local migrations of one lineage (from readMigrationFiles)
+ * @returns The set of permanently-eliminated final table names
+ * @task T11553
+ */
+export function computeEliminatedTables(migrations) {
+    const createTableRegex = /CREATE\s+TABLE\s+(?:IF\s+NOT\s+EXISTS\s+)?[`"]?(\w+)[`"]?/i;
+    const dropTableRegex = /DROP\s+TABLE\s+(?:IF\s+EXISTS\s+)?[`"]?(\w+)[`"]?/i;
+    const renameRegex = /ALTER\s+TABLE\s+[`"]?(\w+)[`"]?\s+RENAME\s+TO\s+[`"]?(\w+)[`"]?/i;
+    // Final disposition per table: true = present, false = dropped.
+    const disposition = new Map();
+    const ordered = [...migrations].sort((a, b) => a.folderMillis - b.folderMillis);
+    for (const migration of ordered) {
+        const statements = Array.isArray(migration.sql) ? migration.sql : [migration.sql ?? ''];
+        for (const rawStatement of statements) {
+            // Split on `;` so multiple DDL statements joined in one `.sql` array entry
+            // are still evaluated IN ORDER (drizzle usually splits on
+            // statement-breakpoint, but a migration may carry several `;`-separated
+            // statements in a single chunk).
+            const stripped = stripSqlComments(rawStatement);
+            for (const clause of stripped.split(';')) {
+                const create = createTableRegex.exec(clause);
+                if (create) {
+                    disposition.set(create[1], true);
+                    continue;
+                }
+                const rename = renameRegex.exec(clause);
+                if (rename) {
+                    disposition.set(rename[2], true);
+                    continue;
+                }
+                const drop = dropTableRegex.exec(clause);
+                if (drop) {
+                    disposition.set(drop[1], false);
+                }
+            }
+        }
+    }
+    const eliminated = new Set();
+    for (const [table, present] of disposition) {
+        if (!present)
+            eliminated.add(table);
+    }
+    return eliminated;
+}
+/**
+ * The timestamp-prefix of the consolidation cutover migration
+ * (`20260531000001_t11363-consolidation-cleo-{project,global}`), used as the
+ * fallback when the consolidation migration cannot be located on disk.
+ *
+ * Migration folder names start with a 14-char numeric timestamp prefix
+ * (`YYYYMMDDHHMMSS`). Comparing those prefixes lexicographically is equivalent
+ * to comparing the encoded timestamps, so this string is the cutover boundary.
+ *
+ * @task T11553
+ */
+export const CONSOLIDATION_CUTOVER_PREFIX = '20260531000001';
+/**
+ * Length of a drizzle migration folder's leading `YYYYMMDDHHMMSS` timestamp.
+ */
+const MIGRATION_TIMESTAMP_PREFIX_LEN = 14;
+/**
+ * Resolve the consolidation cutover timestamp-prefix for a lineage being
+ * reconciled, by locating the `*-consolidation-cleo-*` migration in the SIBLING
+ * consolidated folders (`drizzle-cleo-project` / `drizzle-cleo-global`) next to
+ * the supplied `migrationsFolder`.
+ *
+ * The legacy lineages (`drizzle-tasks` / `drizzle-brain`) do NOT themselves
+ * contain the consolidation migration — it lives in the consolidated folders —
+ * so we scan the siblings. Best-effort: if neither sibling is present/readable
+ * (partial install) the function returns {@link CONSOLIDATION_CUTOVER_PREFIX}.
+ *
+ * @param migrationsFolder - Absolute path to the lineage folder being reconciled
+ * @returns The 14-char timestamp prefix of the consolidation cutover migration
+ * @task T11553
+ */
+export function resolveConsolidationCutoverPrefix(migrationsFolder) {
+    const parent = dirname(migrationsFolder);
+    for (const setName of ['drizzle-cleo-project', 'drizzle-cleo-global']) {
+        const folder = join(parent, setName);
+        if (!existsSync(folder))
+            continue;
+        try {
+            const consolidation = readMigrationFiles({ migrationsFolder: folder }).find((m) => /-consolidation-cleo-/.test(m.name ?? ''));
+            if (consolidation?.name) {
+                return consolidation.name.slice(0, MIGRATION_TIMESTAMP_PREFIX_LEN);
+            }
+        }
+        catch {
+            // Best-effort — fall through to the next sibling / the constant fallback.
+        }
+    }
+    return CONSOLIDATION_CUTOVER_PREFIX;
+}
+/**
+ * Whether a migration's `YYYYMMDDHHMMSS` timestamp prefix is at or before the
+ * consolidation cutover — i.e. it is a PRE-consolidation legacy migration
+ * subsumed by the consolidation snapshot (vs a NEW post-consolidation migration
+ * that must run normally).
+ *
+ * @param migrationName - The migration folder name (e.g. `20260321000000_t033-…`)
+ * @param cutoverPrefix - The cutover prefix from {@link resolveConsolidationCutoverPrefix}
+ * @returns true if at/before the cutover (pre-consolidation), false if after
+ * @task T11553
+ */
+function isAtOrBeforeCutover(migrationName, cutoverPrefix) {
+    const prefix = (migrationName ?? '').slice(0, MIGRATION_TIMESTAMP_PREFIX_LEN);
+    // A name without a parseable prefix is treated as pre-cutover (legacy/unknown):
+    // safer to stamp-and-skip than to re-run an unknown legacy migration. Real
+    // post-consolidation migrations always carry a valid prefix.
+    if (prefix.length < MIGRATION_TIMESTAMP_PREFIX_LEN)
+        return true;
+    return prefix <= cutoverPrefix;
+}
 /**
  * Check whether a table exists in a SQLite database.
  */
@@ -92,14 +265,56 @@ function insertJournalEntry(nativeDb, hash, createdAt, name) {
  * Replaces the broken "wholesale mark applied" pattern that was the root cause
  * of the ensureColumns band-aid sprawl (T632).
  *
+ * ## Eliminated-table tolerance (bug #2 · T11553)
+ *
+ * A `CREATE TABLE foo` whose `foo` is in `eliminatedTables` — i.e. a LATER
+ * migration in the same lineage permanently DROPs it (e.g. `release_manifests`,
+ * dropped by `t9686b2`) — is treated as ALREADY SATISFIED. On a DB that ran the
+ * whole lineage the table is *supposed* to be absent; without this tolerance the
+ * probe refuses to mark the creating migration applied, drizzle re-runs its bare
+ * `CREATE TABLE` and throws. See {@link computeEliminatedTables}.
+ *
+ * ## Zero-DDL discriminator (bug #2 follow-up · T11553)
+ *
+ * A migration with NO probe-able DDL targets (pure `INSERT`/`UPDATE`/`DELETE`
+ * backfill, `DROP TABLE`-only, `CREATE VIEW`, …) cannot be verified by schema
+ * inspection. The cutover decides:
+ *
+ *  - **at/before** the consolidation cutover → a PRE-consolidation legacy
+ *    migration, already subsumed and possibly NON-idempotent (`UPDATE`/plain
+ *    `INSERT`) → STAMP applied (do NOT re-run).
+ *  - **after** the cutover → a NEW post-consolidation migration whose effect has
+ *    NOT run yet → do NOT stamp (return false) so drizzle `migrate()` executes
+ *    it. New migrations are required to be idempotent (`INSERT OR IGNORE` /
+ *    `DROP … IF EXISTS` / `CREATE … IF NOT EXISTS`), so running them is correct
+ *    and harmless on re-run; they journal normally afterwards.
+ *
+ * Migrations WITH DDL targets keep the probe-tolerance behaviour unchanged
+ * (including post-cutover ones like t11538/t11649 that must be probe-stampable
+ * once already applied).
+ *
  * @param nativeDb - Native SQLite database handle
  * @param migration - One entry from drizzle's readMigrationFiles
  * @param logSubsystem - Logger subsystem name
+ * @param eliminatedTables - Final table names a later migration permanently DROPs
+ *   (from {@link computeEliminatedTables}); their CREATE targets count as
+ *   satisfied. Defaults to empty (no tolerance) for callers that do not supply it.
+ * @param consolidationCutoverPrefix - The cutover timestamp-prefix from
+ *   {@link resolveConsolidationCutoverPrefix}; gates the zero-DDL stamp/run
+ *   decision. Defaults to {@link CONSOLIDATION_CUTOVER_PREFIX}.
  * @returns true if the journal entry was inserted; false if migration must run
  */
-function probeAndMarkApplied(nativeDb, migration, logSubsystem) {
+function probeAndMarkApplied(nativeDb, migration, logSubsystem, eliminatedTables = new Set(), consolidationCutoverPrefix = CONSOLIDATION_CUTOVER_PREFIX) {
     const sqlStatements = Array.isArray(migration.sql) ? migration.sql : [migration.sql ?? ''];
-    const fullSql = sqlStatements.join('\n');
+    // Strip SQL line (`--`) and block (`/* */`) comments BEFORE any DDL-target
+    // extraction. Prose comments routinely contain phrases like "the project-side
+    // CREATE TABLE half of that move", which would otherwise make createTableRegex
+    // capture a phantom target (`half`) → tableExists(phantom) false → the
+    // migration is wrongly left un-journaled → Drizzle re-runs its bare CREATE
+    // TABLE against an existing table and crashes (root-cause of the
+    // "Task database not initialized" poison). Mirrors the same idiom already used
+    // by reconcileBrainMigrationsForConsolidatedDb and Scenario 3 below.
+    const fullSql = stripSqlComments(sqlStatements.join('\n'));
     // Extract DDL targets we can probe.
     const alterColumnRegex = /ALTER\s+TABLE\s+[`"]?(\w+)[`"]?\s+ADD\s+COLUMN\s+[`"]?(\w+)[`"]?/gi;
     const createTableRegex = /CREATE\s+TABLE\s+(?:IF\s+NOT\s+EXISTS\s+)?[`"]?(\w+)[`"]?/gi;
@@ -154,10 +369,24 @@ function probeAndMarkApplied(nativeDb, migration, logSubsystem) {
     // `allCreatedTablesAreRenamed` gate was too narrow). Pure CREATE INDEX
     // migrations (no rename, no rebuild) still probe their indexes normally.
     const performsTableRebuild = renameMap.size > 0;
+    // Capture `CREATE INDEX <name> ON <table>` so the probe can skip indexes that
+    // live on an ELIMINATED table (bug #2): when `release_manifests` is dropped by
+    // a later migration, SQLite drops `idx_release_manifests_*` with it — probing
+    // for them would wrongly report the creating migration un-applied.
+    const createIndexWithTableRegex = /CREATE\s+(?:UNIQUE\s+)?INDEX\s+(?:IF\s+NOT\s+EXISTS\s+)?[`"]?(\w+)[`"]?\s+ON\s+[`"]?(\w+)[`"]?/gi;
+    const indexOnTable = new Map();
+    for (const m of fullSql.matchAll(createIndexWithTableRegex)) {
+        indexOnTable.set(m[1], m[2]);
+    }
     const indexTargets = [];
     if (!isRebuildOnlyMigration && !performsTableRebuild) {
         for (const m of fullSql.matchAll(createIndexRegex)) {
-            indexTargets.push(m[1]);
+            const idx = m[1];
+            // Skip indexes on a permanently-eliminated table — they are expected to be
+            // gone once that table was dropped.
+            if (eliminatedTables.has(indexOnTable.get(idx) ?? ''))
+                continue;
+            indexTargets.push(idx);
         }
     }
     const triggerTargets = [];
@@ -166,7 +395,20 @@ function probeAndMarkApplied(nativeDb, migration, logSubsystem) {
     }
     const totalTargets = alterTargets.length + tableTargets.length + indexTargets.length + triggerTargets.length;
     if (totalTargets === 0) {
-        // No probable DDL — could be UPDATE/INSERT/DELETE/etc. Leave for migrate().
+        // No probe-able DDL — pure DML (INSERT/UPDATE/DELETE), DROP-only, CREATE VIEW,
+        // etc. Schema inspection can't verify it, so the consolidation cutover decides
+        // (bug #2 follow-up · T11553):
+        if (isAtOrBeforeCutover(migration.name, consolidationCutoverPrefix)) {
+            // PRE-consolidation legacy migration — already subsumed by the consolidation
+            // snapshot and possibly NON-idempotent (UPDATE / plain INSERT). Re-running it
+            // would double-apply or fail, so STAMP applied without running.
+            insertJournalEntry(nativeDb, migration.hash, migration.folderMillis, migration.name ?? '');
+            getLogger(logSubsystem).debug({ migration: migration.name }, `Zero-DDL pre-consolidation migration ${migration.name} stamped applied (subsumed; not re-run).`);
+            return true;
+        }
+        // POST-consolidation migration (e.g. a new INSERT-OR-IGNORE backfill or
+        // DROP-IF-EXISTS) whose effect has NOT run yet — DO NOT stamp; let drizzle
+        // migrate() execute it. New migrations are required to be idempotent.
         return false;
     }
     // Probe each target.
@@ -176,7 +418,10 @@ function probeAndMarkApplied(nativeDb, migration, logSubsystem) {
         const cols = nativeDb.prepare(`PRAGMA table_info(${table})`).all();
         return cols.some((c) => c.name === column);
     });
-    const allTablesPresent = tableTargets.every((t) => tableExists(nativeDb, t));
+    // A CREATE-TABLE target is satisfied if it exists OR if a later migration in
+    // the lineage permanently eliminated it (bug #2 — e.g. `release_manifests`,
+    // dropped by t9686b2). Its absence on a fully-migrated DB is expected.
+    const allTablesPresent = tableTargets.every((t) => tableExists(nativeDb, t) || eliminatedTables.has(t));
     const allIndexesPresent = indexTargets.every((idx) => {
         const rows = nativeDb
             .prepare(`SELECT name FROM sqlite_master WHERE type='index' AND name=?`)
@@ -204,6 +449,60 @@ function probeAndMarkApplied(nativeDb, migration, logSubsystem) {
     // At least one target missing — leave for drizzle migrate() to run.
     return false;
 }
+/**
+ * Read the set of migration hashes for a SIBLING lineage folder (T11829).
+ *
+ * Used to build the cross-lineage orphan-deletion union in {@link reconcileJournal}.
+ * Defensive: a missing/unreadable/empty sibling folder yields an empty set rather
+ * than throwing — a sibling that does not exist in this install simply contributes
+ * no hashes to the union (the reconcile is conservative: fewer known hashes can
+ * only mean MORE deletions, so we never over-delete by failing safe to empty, but
+ * we also never crash the caller's open on a missing sibling).
+ *
+ * @param siblingFolder - Absolute path to a sibling drizzle migrations folder.
+ * @returns The set of migration hashes declared by that folder (empty on failure).
+ */
+function readSiblingMigrationHashes(siblingFolder) {
+    try {
+        return new Set(readMigrationFiles({ migrationsFolder: siblingFolder }).map((m) => m.hash));
+    }
+    catch {
+        return new Set();
+    }
+}
+/**
+ * Ensure a UNIQUE index on `__drizzle_migrations(hash)` exists so the shared
+ * consolidated journal converges idempotently (T11829).
+ *
+ * With the UNIQUE index in place, the `INSERT OR IGNORE` emitted by
+ * {@link insertJournalEntry} becomes a true no-op on a re-probe (rather than
+ * appending a duplicate row), so any residual cross-lineage re-probe cannot grow
+ * the journal. Creation is guarded behind a one-time dedup: the live consolidated
+ * journal currently has no duplicate hashes, but a historically-thrashed journal
+ * could, and `CREATE UNIQUE INDEX` would fail on duplicates. We therefore collapse
+ * any duplicate-hash rows (keeping the lowest `id`) BEFORE creating the index.
+ *
+ * Idempotent and cheap: once the index exists, `CREATE UNIQUE INDEX IF NOT EXISTS`
+ * is a no-op and the dedup pass finds nothing.
+ *
+ * @param nativeDb - Native SQLite database handle.
+ */
+function ensureJournalHashUnique(nativeDb) {
+    if (!tableExists(nativeDb, '__drizzle_migrations'))
+        return;
+    try {
+        // One-time dedup: keep the lowest id per hash, delete the rest. A no-op once
+        // the journal is already unique (the live journal has no dups today).
+        nativeDb.exec('DELETE FROM "__drizzle_migrations" WHERE id NOT IN ' +
+            '(SELECT MIN(id) FROM "__drizzle_migrations" GROUP BY hash)');
+        nativeDb.exec('CREATE UNIQUE INDEX IF NOT EXISTS "idx_drizzle_migrations_hash" ON "__drizzle_migrations" ("hash")');
+    }
+    catch {
+        // Best-effort convergence aid — never block an open on the index/dedup.
+        // INSERT OR IGNORE already guards duplicate inserts at the row level even
+        // without the index (it just cannot enforce uniqueness without it).
+    }
+}
 /**
  * Bootstrap and reconcile the Drizzle migration journal.
  *
@@ -220,12 +519,50 @@ function probeAndMarkApplied(nativeDb, migration, logSubsystem) {
  *    applied migrations to be re-run and fail with "duplicate column name". Backfills
  *    the name from the local migration file matched by hash.
  *
+ * ## Cross-lineage orphan-deletion guard (T11829 — OOM root fix)
+ *
+ * The consolidated `cleo.db` carries ONE shared `__drizzle_migrations` journal but
+ * is reconciled by MULTIPLE physically-coexisting migration lineages
+ * (`drizzle-tasks`, `drizzle-cleo-project`, `drizzle-nexus`, `drizzle-brain`,
+ * `drizzle-agent-registry`, `drizzle-conduit`). Each lineage only knows its OWN
+ * folder, so a naive Sub-case B classified EVERY sibling lineage's journal rows as
+ * "true orphans" and DELETEd them — the next sibling open then deleted THIS
+ * lineage's rows, so the journal NEVER converged (it oscillated and re-ran
+ * BEGIN/COMMIT migrate transactions on every open, holding the WAL writer lock and
+ * stacking 300-550 MB-per-connection opens until the host OOM-killed).
+ *
+ * The fix: an entry is a TRUE orphan only when its hash belongs to NO lineage that
+ * physically shares this DB. Callers that share the journal pass
+ * `siblingMigrationsFolders` (the OTHER lineages' folders); the orphan-DELETE
+ * decision then uses the UNION of every sibling lineage's hashes plus this
+ * lineage's own. A hash present in any sibling is preserved (it is that sibling's
+ * legitimately-applied migration, not an orphan). Standalone DBs (a single
+ * lineage) pass no siblings and behave exactly as before.
+ *
  * @param nativeDb - Native SQLite database handle
  * @param migrationsFolder - Path to the drizzle migrations folder
  * @param existenceTable - A table name used to detect if the DB has data (e.g., 'tasks' or 'brain_decisions')
  * @param logSubsystem - Logger subsystem name for reconciliation warnings
+ * @param siblingMigrationsFolders - OTHER migration-lineage folders that share this
+ *   `__drizzle_migrations` journal inside the same consolidated `cleo.db` (T11829).
+ *   Their hashes are added to the orphan-deletion union so a sibling lineage's rows
+ *   are never deleted as cross-lineage orphans. Omit (or pass `[]`) for a DB with a
+ *   single lineage. Unreadable/empty sibling folders are skipped defensively.
  */
-export function reconcileJournal(nativeDb, migrationsFolder, existenceTable, logSubsystem) {
+export function reconcileJournal(nativeDb, migrationsFolder, existenceTable, logSubsystem, siblingMigrationsFolders = []) {
+    // bug #2 (T11553): pre-compute the tables this lineage CREATEs and a LATER
+    // migration permanently ELIMINATES (DROP TABLE, no recreate — e.g.
+    // `release_manifests`, dropped by t9686b2). The DDL probe treats a CREATE of an
+    // eliminated table (and its indexes) as already satisfied, so a fully-migrated
+    // DB — where that table is correctly absent — doesn't make drizzle re-run the
+    // creating migration's bare `CREATE TABLE` and crash.
+    const eliminatedTables = computeEliminatedTables(readMigrationFiles({ migrationsFolder }));
+    // bug #2 follow-up (T11553): the consolidation cutover timestamp-prefix gates
+    // the zero-DDL stamp/run decision in probeAndMarkApplied — pre-cutover legacy
+    // DML/DROP migrations are stamped (subsumed, possibly non-idempotent), new
+    // post-cutover ones are left for migrate() to RUN. Resolved from the sibling
+    // consolidation migration on disk.
+    const cutoverPrefix = resolveConsolidationCutoverPrefix(migrationsFolder);
     // Scenario 1: Tables exist but no migration journal — bootstrap baseline
     if (tableExists(nativeDb, existenceTable) && !tableExists(nativeDb, '__drizzle_migrations')) {
         const migrations = readMigrationFiles({ migrationsFolder });
@@ -243,6 +580,10 @@ export function reconcileJournal(nativeDb, migrationsFolder, existenceTable, log
             insertJournalEntry(nativeDb, baseline.hash, baseline.folderMillis, baseline.name ?? '');
         }
     }
+    // T11829: enforce UNIQUE(hash) so the shared consolidated journal converges
+    // idempotently — any residual re-probe's INSERT OR IGNORE becomes a true no-op.
+    // Runs once the journal table exists (Scenario 1 / a prior open created it).
+    ensureJournalHashUnique(nativeDb);
     // Scenario 2: Journal has orphaned entries from a previous CLEO version
     //
     // Two distinct sub-cases require different handling:
@@ -271,10 +612,26 @@ export function reconcileJournal(nativeDb, migrationsFolder, existenceTable, log
     if (tableExists(nativeDb, '__drizzle_migrations') && tableExists(nativeDb, existenceTable)) {
         const localMigrations = readMigrationFiles({ migrationsFolder });
         const localHashes = new Set(localMigrations.map((m) => m.hash));
+        // T11829 (OOM root fix): the orphan-DELETE decision must use the UNION of
+        // every migration lineage that physically shares this DB's `__drizzle_migrations`
+        // journal — NOT just this lineage's folder. A hash belonging to a sibling
+        // lineage (e.g. drizzle-cleo-project's rows seen from the drizzle-tasks open)
+        // is that sibling's legitimately-applied migration, not an orphan. Deleting it
+        // is what made the shared journal oscillate and never converge → host OOM.
+        const knownHashes = new Set(localHashes);
+        for (const siblingFolder of siblingMigrationsFolders) {
+            if (siblingFolder === migrationsFolder)
+                continue;
+            for (const m of readSiblingMigrationHashes(siblingFolder)) {
+                knownHashes.add(m);
+            }
+        }
         const dbEntries = nativeDb
             .prepare('SELECT id, hash FROM "__drizzle_migrations"')
             .all();
-        const orphanedEntries = dbEntries.filter((e) => !localHashes.has(e.hash));
+        // A row is an orphan ONLY when its hash is unknown to THIS lineage AND every
+        // sibling lineage sharing this journal (T11829 cross-lineage guard).
+        const orphanedEntries = dbEntries.filter((e) => !knownHashes.has(e.hash));
         const hasOrphanedEntries = orphanedEntries.length > 0;
         if (hasOrphanedEntries) {
             const dbHashes = new Set(dbEntries.map((e) => e.hash));
@@ -286,8 +643,9 @@ export function reconcileJournal(nativeDb, migrationsFolder, existenceTable, log
                 log.debug({ extra: orphanedEntries.length }, `Migration journal has ${orphanedEntries.length} entries for migrations not known to this install (DB is ahead). Skipping reconciliation.`);
             }
             else {
-                // Sub-case B: TRUE ORPHANS — entries whose hash has no local match.
-                // Delete them and re-probe local migrations via DDL.
+                // Sub-case B: TRUE ORPHANS — entries whose hash matches NO known lineage
+                // (this one or any sibling sharing the journal). Delete them and re-probe
+                // local migrations via DDL.
                 log.warn({ orphaned: orphanedEntries.length }, `Detected ${orphanedEntries.length} true-orphan journal entries from a previous CLEO lineage. Reconciling via DDL probe.`);
                 const deleteStmt = nativeDb.prepare('DELETE FROM "__drizzle_migrations" WHERE id = ?');
                 for (const e of orphanedEntries)
@@ -299,7 +657,7 @@ export function reconcileJournal(nativeDb, migrationsFolder, existenceTable, log
                 for (const m of localMigrations) {
                     if (journaledHashesAfter.has(m.hash))
                         continue;
-                    probeAndMarkApplied(nativeDb, m, logSubsystem);
+                    probeAndMarkApplied(nativeDb, m, logSubsystem, eliminatedTables, cutoverPrefix);
                 }
             }
         }
@@ -362,12 +720,10 @@ export function reconcileJournal(nativeDb, migrationsFolder, existenceTable, log
             // than running the comment SQL. The "all DDL targets present" check reduces to:
             // strip comments → empty string → no targets at all → baseline already satisfied.
             if (alterMatches.length === 0) {
-                // Check for comment-only baseline marker: strip SQL line comments and block comments,
-                // then check if any non-whitespace DDL remains.
-                const stripped = fullSql
-                    .replace(/--[^\n]*/g, '') // strip line comments
-                    .replace(/\/\*[\s\S]*?\*\//g, '') // strip block comments
-                    .trim();
+                // Check for comment-only baseline marker: strip SQL line + block comments
+                // (shared {@link stripSqlComments} helper), then check if any
+                // non-whitespace DDL remains.
+                const stripped = stripSqlComments(fullSql).trim();
                 if (stripped === '') {
                     // Comment-only baseline marker — mark applied immediately on existing DBs.
                     const log = getLogger(logSubsystem);
@@ -379,7 +735,7 @@ export function reconcileJournal(nativeDb, migrationsFolder, existenceTable, log
                 const createTableRe = /CREATE\s+TABLE/i;
                 const createTriggerRe = /CREATE\s+TRIGGER/i;
                 if (renameRe.test(fullSql) && createTableRe.test(fullSql)) {
-                    probeAndMarkApplied(nativeDb, migration, logSubsystem);
+                    probeAndMarkApplied(nativeDb, migration, logSubsystem, eliminatedTables, cutoverPrefix);
                 }
                 else if (createTableRe.test(fullSql) || createTriggerRe.test(fullSql)) {
                     // Pure CREATE TABLE migration (no ALTER, no RENAME). Delegate to
@@ -388,7 +744,16 @@ export function reconcileJournal(nativeDb, migrationsFolder, existenceTable, log
                     // This handles signaldock's initial migration (pure schema bootstrap) when
                     // the DB has tables but the journal entry is missing (e.g., after a journal
                     // reset or bare-SQL-to-drizzle migration path upgrade).
-                    probeAndMarkApplied(nativeDb, migration, logSubsystem);
+                    probeAndMarkApplied(nativeDb, migration, logSubsystem, eliminatedTables, cutoverPrefix);
+                }
+                else {
+                    // Zero-DDL migration (pure DML backfill, DROP-only, CREATE VIEW, …) with
+                    // no journal entry. Delegate to probeAndMarkApplied, whose zero-target
+                    // path applies the consolidation cutover (T11553): a PRE-cutover legacy
+                    // migration is stamped (subsumed, possibly non-idempotent), while a NEW
+                    // POST-cutover one is left un-stamped so drizzle migrate() RUNS its
+                    // effect (e.g. the cutover agent's INSERT-OR-IGNORE backfill / DROP).
+                    probeAndMarkApplied(nativeDb, migration, logSubsystem, eliminatedTables, cutoverPrefix);
                 }
                 continue;
             }
@@ -543,6 +908,11 @@ export function reconcileBrainMigrationsForConsolidatedDb(nativeDb, migrationsFo
   `);
     const localMigrations = sanitizeMigrationStatements(readMigrationFiles({ migrationsFolder }));
     const existingHashes = new Set(nativeDb.prepare('SELECT hash FROM "__drizzle_migrations"').all().map((r) => r.hash));
+    // bug #2 (T11553): tables this brain lineage CREATEs and a LATER migration
+    // permanently ELIMINATES — their absence is expected on a fully-migrated DB and
+    // must count as "satisfied" so the creating migration is journaled rather than
+    // re-run. (Mirrors the reconcileJournal eliminated-table tolerance.)
+    const eliminatedTables = computeEliminatedTables(localMigrations);
     const createTableRegex = /CREATE\s+TABLE\s+(?:IF\s+NOT\s+EXISTS\s+)?[`"]?(\w+)[`"]?/gi;
     const renameRegex = /ALTER\s+TABLE\s+[`"]?(\w+)[`"]?\s+RENAME\s+TO\s+[`"]?(\w+)[`"]?/gi;
     const addColumnRegex = /ALTER\s+TABLE\s+[`"]?(\w+)[`"]?\s+ADD\s+COLUMN\s+[`"]?(\w+)[`"]?/gi;
@@ -552,12 +922,11 @@ export function reconcileBrainMigrationsForConsolidatedDb(nativeDb, migrationsFo
         const cols = nativeDb.prepare(`PRAGMA table_info("${table}")`).all();
         return cols.some((c) => c.name === column);
     };
-    // Strip SQL line (`-- …`) and block (`/* … */`) comments before scanning for
-    // DDL targets. A migration's prose comments routinely contain phrases like
-    // "CREATE TABLE IF NOT EXISTS ensures it exists", which would otherwise make
-    // the CREATE-TABLE regex capture bogus "table" names (`IF`, `ensures`) and
-    // wrongly classify a satisfied migration as missing.
-    const stripSqlComments = (sql) => sql.replace(/--[^\n]*/g, '').replace(/\/\*[\s\S]*?\*\//g, '');
+    // Strip SQL comments before scanning for DDL targets (shared module helper —
+    // see {@link stripSqlComments}). A migration's prose comments routinely contain
+    // phrases like "CREATE TABLE IF NOT EXISTS ensures it exists", which would
+    // otherwise make the CREATE-TABLE regex capture bogus "table" names and wrongly
+    // classify a satisfied migration as missing.
     let marked = 0;
     let applied = 0;
     for (const m of localMigrations) {
@@ -582,7 +951,8 @@ export function reconcileBrainMigrationsForConsolidatedDb(nativeDb, migrationsFo
         for (const match of fullSql.matchAll(addColumnRegex)) {
             addColumns.push({ table: match[1], column: match[2] });
         }
-        const tablesSatisfied = resultTables.size > 0 && [...resultTables].every((t) => tableExists(nativeDb, t));
+        const tablesSatisfied = resultTables.size > 0 &&
+            [...resultTables].every((t) => tableExists(nativeDb, t) || eliminatedTables.has(t));
         const altersSatisfied = resultTables.size === 0 &&
             addColumns.length > 0 &&
             addColumns.every(({ table, column }) => columnExists(table, column));
@@ -624,25 +994,55 @@ export function reconcileBrainMigrationsForConsolidatedDb(nativeDb, migrationsFo
     }
     return { marked, applied };
 }
+/**
+ * Collect the `.message` of an Error and every nested `.cause` (recursively).
+ *
+ * Drizzle wraps the underlying node:sqlite error in a `DrizzleError` whose own
+ * `.message` is generic ("Failed to run the query …") while the real SQLite
+ * message ("table nexus_nodes already exists") lives in `.cause.message`. Error
+ * predicates that only test the top-level `.message` miss the wrapped case and
+ * rethrow — defeating the migrateWithRetry reconcile path. Walking the cause
+ * chain (with a depth guard against pathological cycles) lets the predicates see
+ * the real message regardless of how many layers wrap it.
+ *
+ * @param err - The thrown value (Error, wrapped Error, or anything else)
+ * @returns All messages found along the cause chain, joined with `\n`
+ */
+function collectErrorMessages(err) {
+    const messages = [];
+    let current = err;
+    // Depth guard: cap the walk so a self-referential cause cannot loop forever.
+    for (let depth = 0; current instanceof Error && depth < 16; depth++) {
+        messages.push(current.message);
+        current = current.cause;
+    }
+    return messages.join('\n');
+}
 /**
  * Check whether an error is a SQLite "duplicate column name" error.
  *
  * These are thrown when an ALTER TABLE ADD COLUMN statement is re-executed
  * after the column was already added (Scenario 3 in reconcileJournal).
+ *
+ * Inspects the full `.cause` chain so a Drizzle-wrapped error (whose real SQLite
+ * message lives in `.cause.message`) is still recognised.
  */
 export function isDuplicateColumnError(err) {
     if (!(err instanceof Error))
         return false;
-    return /duplicate column name/i.test(err.message);
+    return /duplicate column name/i.test(collectErrorMessages(err));
 }
 /**
  * T9174: Check for "table X already exists" SQLite error.
  * Occurs when migration SQL lacks IF NOT EXISTS but startup DDL already ran.
+ *
+ * Inspects the full `.cause` chain so a Drizzle-wrapped error (whose real SQLite
+ * message lives in `.cause.message`) is still recognised.
  */
 export function isTableAlreadyExistsError(err) {
     if (!(err instanceof Error))
         return false;
-    return /table .+ already exists/i.test(err.message);
+    return /table .+ already exists/i.test(collectErrorMessages(err));
 }
 /**
  * Check whether a SQL statement is "executable" — i.e., contains something