@cleocode/core 2026.9.2 → 2026.9.4

package/dist/setup/sections/brain.d.ts

@@ -4,7 +4,7 @@
  * Controls how BRAIN context is surfaced inside AGENTS.md by toggling
  * `brain.memoryBridge.mode` across three operator-visible values:
  *
- *   - `'digest'`   — AGENTS.md gets a `cleo memory digest --brief` directive
+ *   - `'digest'`   — AGENTS.md gets a `cleo memory digest` directive
  *                    (no `.cleo/memory-bridge.md` written). Wire value stays
  *                    `'cli'` so existing project configs continue to resolve
  *                    correctly; the wizard label was renamed to "digest" to

package/dist/setup/sections/brain.js

@@ -4,7 +4,7 @@
  * Controls how BRAIN context is surfaced inside AGENTS.md by toggling
  * `brain.memoryBridge.mode` across three operator-visible values:
  *
- *   - `'digest'`   — AGENTS.md gets a `cleo memory digest --brief` directive
+ *   - `'digest'`   — AGENTS.md gets a `cleo memory digest` directive
  *                    (no `.cleo/memory-bridge.md` written). Wire value stays
  *                    `'cli'` so existing project configs continue to resolve
  *                    correctly; the wizard label was renamed to "digest" to

package/dist/system/bridge-mode.d.ts

@@ -7,7 +7,7 @@
  * where one sibling silently ignored the gate.
  *
  * Behaviour:
- *   - `'cli'`  — AGENTS.md gets a `cleo memory digest --brief` directive; no `.md` files written.
+ *   - `'cli'`  — AGENTS.md gets a `cleo memory digest` directive; no `.md` files written.
  *   - `'file'` — legacy `@.cleo/memory-bridge.md` + `@.cleo/nexus-bridge.md` injection.
  *
  * The resolver never throws. On any read/parse failure it returns the safe

package/dist/system/bridge-mode.js

@@ -7,7 +7,7 @@
  * where one sibling silently ignored the gate.
  *
  * Behaviour:
- *   - `'cli'`  — AGENTS.md gets a `cleo memory digest --brief` directive; no `.md` files written.
+ *   - `'cli'`  — AGENTS.md gets a `cleo memory digest` directive; no `.md` files written.
  *   - `'file'` — legacy `@.cleo/memory-bridge.md` + `@.cleo/nexus-bridge.md` injection.
  *
  * The resolver never throws. On any read/parse failure it returns the safe

package/dist/tasks/index.d.ts

@@ -32,7 +32,7 @@ export { type AppendSeverityAttestationOptions, appendSignedSeverityAttestation,
 export { showTask, type TaskDetail, taskExists, taskShow, taskShowIvtrHistory, taskShowOperation, taskShowWithHistory, } from './show.js';
 export { taskSyncLinks, taskSyncLinksRemove, taskSyncReconcile } from './sync-ops.js';
 export { taskAnalyze, taskBatchValidate, taskBlockers, taskCancel, taskClaim, taskComplexityEstimate, taskDepends, taskDeps, taskDepsCycles, taskDepsOverview, taskDepsTree, taskDepsValidate, taskExport, taskHistory, taskImpact, taskImport, taskLint, taskNext, taskPromote, taskRelates, taskRelatesAdd, taskRelatesFind, taskRelatesRemove, taskReopen, taskReorder, taskReparent, taskRestore, taskSlice, taskStats, taskTree, taskUnarchive, taskUnclaim, } from './task-ops.js';
-export { cacheEntryPath, captureDirtyFingerprint, captureHead, clearToolCache, computeCacheKey, type RunToolOptions, readCacheEntry, runToolCached, type ToolCacheEntry, type ToolRunResult, writeCacheEntry, } from './tool-cache.js';
+export { cacheEntryPath, captureDirtyFingerprint, captureHead, clearToolCache, computeCacheKey, isEntryUsable, type RunToolOptions, readCacheEntry, runToolCached, TOOL_RUN_IDENTITY_FIELDS, type ToolCacheEntry, type ToolRunIdentity, type ToolRunResult, writeCacheEntry, } from './tool-cache.js';
 export { type CanonicalTool, listValidToolNames, type ResolutionSource, type ResolvedToolCommand, type ResolveToolResult, resolveToolCommand, } from './tool-resolver.js';
 export { type AcquireSlotOptions, acquireGlobalSlot, defaultMaxConcurrent, isHolderAlive, listSlotHolders, type ReleaseSlotFn, readHolder, reapOrphanedSlots, reapSlotIfOrphaned, resolveMaxConcurrent, type SlotHolder, semaphoreDir, } from './tool-semaphore.js';
 export { taskUpdate, type UpdateTaskOptions, type UpdateTaskResult, updateTask } from './update.js';

package/dist/tasks/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/tasks/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,YAAY,EACV,uBAAuB,EACvB,qBAAqB,EACrB,4BAA4B,EAC5B,4BAA4B,EAC5B,6BAA6B,EAC7B,uBAAuB,EACvB,8BAA8B,EAC9B,yBAAyB,EACzB,yBAAyB,EACzB,oBAAoB,EACpB,qBAAqB,EACrB,sBAAsB,EACtB,4BAA4B,EAC5B,8BAA8B,EAC9B,qBAAqB,EACrB,QAAQ,EACR,mBAAmB,EACnB,mBAAmB,EACnB,yBAAyB,EACzB,kBAAkB,EAClB,qBAAqB,GACtB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,OAAO,EACP,wBAAwB,EACxB,mBAAmB,EACnB,eAAe,EACf,YAAY,EACZ,aAAa,EACb,YAAY,EACZ,iBAAiB,EACjB,gBAAgB,EAChB,eAAe,EACf,cAAc,EACd,cAAc,EACd,mBAAmB,EACnB,gBAAgB,EAChB,YAAY,EACZ,cAAc,EACd,gBAAgB,EAChB,aAAa,GACd,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,aAAa,EACb,eAAe,GAChB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,0BAA0B,EAC1B,2BAA2B,EAC3B,qBAAqB,EACrB,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,EACtB,yBAAyB,GAC1B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,YAAY,EACZ,WAAW,GACZ,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,YAAY,EACZ,kBAAkB,EAClB,YAAY,GACb,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,0BAA0B,EAC1B,0BAA0B,GAC3B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAEnF,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC3E,OAAO,EACL,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,0BAA0B,CAAC;AAElC,OAAO,EAAE,KAAK,iBAAiB,EAAE,KAAK,gBAAgB,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEpG,OAAO,EACL,KAAK,aAAa,IAAI,iBAAiB,EACvC,KAAK,iBAAiB,EACtB,KAAK,sBAAsB,EAC3B,KAAK,gBAAgB,EACrB,mBAAmB,EACnB,aAAa,EACb,eAAe,EACf,WAAW,EACX,aAAa,EACb,gBAAgB,GACjB,MAAM,0BAA0B,CAAC;AAElC,OAAO,EACL,KAAK,qBAAqB,EAC1B,KAAK,eAAe,EACpB,KAAK,iBAAiB,EACtB,kBAAkB,EAClB,eAAe,EACf,eAAe,EACf,aAAa,EACb,eAAe,EACf,aAAa,EACb,qBAAqB,EACrB,iBAAiB,EACjB,eAAe,EACf,oBAAoB,EACpB,sBAAsB,EACtB,gBAAgB,GACjB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,KAAK,gBAAgB,EACrB,KAAK,mBAAmB,EACxB,cAAc,EACd,YAAY,EACZ,cAAc,GACf,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EACL,KAAK,cAAc,EACnB,eAAe,EACf,wBAAwB,EACxB,mBAAmB,EACnB,KAAK,YAAY,EACjB,sBAAsB,EACtB,eAAe,EACf,KAAK,UAAU,EACf,KAAK,cAAc,EACnB,aAAa,EACb,KAAK,kBAAkB,EACvB,kBAAkB,EAClB,aAAa,EACb,WAAW,EACX,YAAY,GACb,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,KAAK,UAAU,EACf,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,SAAS,EACT,UAAU,EACV,QAAQ,GACT,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,KAAK,kBAAkB,EACvB,qBAAqB,EACrB,mBAAmB,EACnB,yBAAyB,EACzB,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,kBAAkB,EAClB,gBAAgB,EAChB,KAAK,qBAAqB,EAC1B,kBAAkB,GACnB,MAAM,iBAAiB,CAAC;AAEzB,YAAY,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EACL,cAAc,EACd,kBAAkB,EAClB,YAAY,EACZ,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,EACjB,gBAAgB,EAChB,qBAAqB,GACtB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,qBAAqB,EACrB,kBAAkB,EAClB,uBAAuB,GACxB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,KAAK,gBAAgB,EAAE,KAAK,eAAe,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAE7F,YAAY,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAEvF,OAAO,EACL,KAAK,gCAAgC,EACrC,+BAA+B,EAC/B,wBAAwB,EACxB,8BAA8B,EAC9B,gBAAgB,EAChB,+BAA+B,EAC/B,KAAK,mBAAmB,GACzB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,QAAQ,EACR,KAAK,UAAU,EACf,UAAU,EACV,QAAQ,EACR,mBAAmB,EACnB,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,WAAW,CAAC;AAEnB,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AACtF,OAAO,EACL,WAAW,EACX,iBAAiB,EACjB,YAAY,EACZ,UAAU,EACV,SAAS,EACT,sBAAsB,EACtB,WAAW,EACX,QAAQ,EACR,cAAc,EACd,gBAAgB,EAChB,YAAY,EACZ,gBAAgB,EAChB,UAAU,EACV,WAAW,EACX,UAAU,EACV,UAAU,EACV,QAAQ,EACR,QAAQ,EACR,WAAW,EACX,WAAW,EACX,cAAc,EACd,eAAe,EACf,iBAAiB,EACjB,UAAU,EACV,WAAW,EACX,YAAY,EACZ,WAAW,EACX,SAAS,EACT,SAAS,EACT,QAAQ,EACR,aAAa,EACb,WAAW,GACZ,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,cAAc,EACd,uBAAuB,EACvB,WAAW,EACX,cAAc,EACd,eAAe,EACf,KAAK,cAAc,EACnB,cAAc,EACd,aAAa,EACb,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,eAAe,GAChB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACL,KAAK,aAAa,EAClB,kBAAkB,EAClB,KAAK,gBAAgB,EACrB,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,EACtB,kBAAkB,GACnB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,KAAK,kBAAkB,EACvB,iBAAiB,EACjB,oBAAoB,EACpB,aAAa,EACb,eAAe,EACf,KAAK,aAAa,EAClB,UAAU,EACV,iBAAiB,EACjB,kBAAkB,EAClB,oBAAoB,EACpB,KAAK,UAAU,EACf,YAAY,GACb,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,KAAK,iBAAiB,EAAE,KAAK,gBAAgB,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/tasks/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,YAAY,EACV,uBAAuB,EACvB,qBAAqB,EACrB,4BAA4B,EAC5B,4BAA4B,EAC5B,6BAA6B,EAC7B,uBAAuB,EACvB,8BAA8B,EAC9B,yBAAyB,EACzB,yBAAyB,EACzB,oBAAoB,EACpB,qBAAqB,EACrB,sBAAsB,EACtB,4BAA4B,EAC5B,8BAA8B,EAC9B,qBAAqB,EACrB,QAAQ,EACR,mBAAmB,EACnB,mBAAmB,EACnB,yBAAyB,EACzB,kBAAkB,EAClB,qBAAqB,GACtB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,OAAO,EACP,wBAAwB,EACxB,mBAAmB,EACnB,eAAe,EACf,YAAY,EACZ,aAAa,EACb,YAAY,EACZ,iBAAiB,EACjB,gBAAgB,EAChB,eAAe,EACf,cAAc,EACd,cAAc,EACd,mBAAmB,EACnB,gBAAgB,EAChB,YAAY,EACZ,cAAc,EACd,gBAAgB,EAChB,aAAa,GACd,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,aAAa,EACb,eAAe,GAChB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,0BAA0B,EAC1B,2BAA2B,EAC3B,qBAAqB,EACrB,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,EACtB,yBAAyB,GAC1B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,YAAY,EACZ,WAAW,GACZ,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,YAAY,EACZ,kBAAkB,EAClB,YAAY,GACb,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,0BAA0B,EAC1B,0BAA0B,GAC3B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAEnF,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC3E,OAAO,EACL,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,0BAA0B,CAAC;AAElC,OAAO,EAAE,KAAK,iBAAiB,EAAE,KAAK,gBAAgB,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEpG,OAAO,EACL,KAAK,aAAa,IAAI,iBAAiB,EACvC,KAAK,iBAAiB,EACtB,KAAK,sBAAsB,EAC3B,KAAK,gBAAgB,EACrB,mBAAmB,EACnB,aAAa,EACb,eAAe,EACf,WAAW,EACX,aAAa,EACb,gBAAgB,GACjB,MAAM,0BAA0B,CAAC;AAElC,OAAO,EACL,KAAK,qBAAqB,EAC1B,KAAK,eAAe,EACpB,KAAK,iBAAiB,EACtB,kBAAkB,EAClB,eAAe,EACf,eAAe,EACf,aAAa,EACb,eAAe,EACf,aAAa,EACb,qBAAqB,EACrB,iBAAiB,EACjB,eAAe,EACf,oBAAoB,EACpB,sBAAsB,EACtB,gBAAgB,GACjB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,KAAK,gBAAgB,EACrB,KAAK,mBAAmB,EACxB,cAAc,EACd,YAAY,EACZ,cAAc,GACf,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EACL,KAAK,cAAc,EACnB,eAAe,EACf,wBAAwB,EACxB,mBAAmB,EACnB,KAAK,YAAY,EACjB,sBAAsB,EACtB,eAAe,EACf,KAAK,UAAU,EACf,KAAK,cAAc,EACnB,aAAa,EACb,KAAK,kBAAkB,EACvB,kBAAkB,EAClB,aAAa,EACb,WAAW,EACX,YAAY,GACb,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,KAAK,UAAU,EACf,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,SAAS,EACT,UAAU,EACV,QAAQ,GACT,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,KAAK,kBAAkB,EACvB,qBAAqB,EACrB,mBAAmB,EACnB,yBAAyB,EACzB,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,kBAAkB,EAClB,gBAAgB,EAChB,KAAK,qBAAqB,EAC1B,kBAAkB,GACnB,MAAM,iBAAiB,CAAC;AAEzB,YAAY,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EACL,cAAc,EACd,kBAAkB,EAClB,YAAY,EACZ,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,EACjB,gBAAgB,EAChB,qBAAqB,GACtB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,qBAAqB,EACrB,kBAAkB,EAClB,uBAAuB,GACxB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,KAAK,gBAAgB,EAAE,KAAK,eAAe,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAE7F,YAAY,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAEvF,OAAO,EACL,KAAK,gCAAgC,EACrC,+BAA+B,EAC/B,wBAAwB,EACxB,8BAA8B,EAC9B,gBAAgB,EAChB,+BAA+B,EAC/B,KAAK,mBAAmB,GACzB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,QAAQ,EACR,KAAK,UAAU,EACf,UAAU,EACV,QAAQ,EACR,mBAAmB,EACnB,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,WAAW,CAAC;AAEnB,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AACtF,OAAO,EACL,WAAW,EACX,iBAAiB,EACjB,YAAY,EACZ,UAAU,EACV,SAAS,EACT,sBAAsB,EACtB,WAAW,EACX,QAAQ,EACR,cAAc,EACd,gBAAgB,EAChB,YAAY,EACZ,gBAAgB,EAChB,UAAU,EACV,WAAW,EACX,UAAU,EACV,UAAU,EACV,QAAQ,EACR,QAAQ,EACR,WAAW,EACX,WAAW,EACX,cAAc,EACd,eAAe,EACf,iBAAiB,EACjB,UAAU,EACV,WAAW,EACX,YAAY,EACZ,WAAW,EACX,SAAS,EACT,SAAS,EACT,QAAQ,EACR,aAAa,EACb,WAAW,GACZ,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,cAAc,EACd,uBAAuB,EACvB,WAAW,EACX,cAAc,EACd,eAAe,EACf,aAAa,EACb,KAAK,cAAc,EACnB,cAAc,EACd,aAAa,EACb,wBAAwB,EACxB,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,eAAe,GAChB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACL,KAAK,aAAa,EAClB,kBAAkB,EAClB,KAAK,gBAAgB,EACrB,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,EACtB,kBAAkB,GACnB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,KAAK,kBAAkB,EACvB,iBAAiB,EACjB,oBAAoB,EACpB,aAAa,EACb,eAAe,EACf,KAAK,aAAa,EAClB,UAAU,EACV,iBAAiB,EACjB,kBAAkB,EAClB,oBAAoB,EACpB,KAAK,UAAU,EACf,YAAY,GACb,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,KAAK,iBAAiB,EAAE,KAAK,gBAAgB,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC"}

package/dist/tasks/index.js

@@ -42,7 +42,7 @@ export { showTask, taskExists, taskShow, taskShowIvtrHistory, taskShowOperation,
 export { taskSyncLinks, taskSyncLinksRemove, taskSyncReconcile } from './sync-ops.js';
 export { taskAnalyze, taskBatchValidate, taskBlockers, taskCancel, taskClaim, taskComplexityEstimate, taskDepends, taskDeps, taskDepsCycles, taskDepsOverview, taskDepsTree, taskDepsValidate, taskExport, taskHistory, taskImpact, taskImport, taskLint, taskNext, taskPromote, taskRelates, taskRelatesAdd, taskRelatesFind, taskRelatesRemove, taskReopen, taskReorder, taskReparent, taskRestore, taskSlice, taskStats, taskTree, taskUnarchive, taskUnclaim, } from './task-ops.js';
 // Tool result cache + cross-process semaphore (T1534 / ADR-061)
-export { cacheEntryPath, captureDirtyFingerprint, captureHead, clearToolCache, computeCacheKey, readCacheEntry, runToolCached, writeCacheEntry, } from './tool-cache.js';
+export { cacheEntryPath, captureDirtyFingerprint, captureHead, clearToolCache, computeCacheKey, isEntryUsable, readCacheEntry, runToolCached, TOOL_RUN_IDENTITY_FIELDS, writeCacheEntry, } from './tool-cache.js';
 // Project-agnostic tool resolution (T1534 / ADR-061)
 export { listValidToolNames, resolveToolCommand, } from './tool-resolver.js';
 // Cross-process global per-tool concurrency semaphore (T1534 / ADR-061)

package/dist/tasks/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/tasks/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAyBH,OAAO,EAGL,OAAO,EACP,wBAAwB,EACxB,mBAAmB,EACnB,eAAe,EACf,YAAY,EACZ,aAAa,EACb,YAAY,EACZ,iBAAiB,EACjB,gBAAgB,EAChB,eAAe,EACf,cAAc,EACd,cAAc,EACd,mBAAmB,EACnB,gBAAgB,EAChB,YAAY,EACZ,cAAc,EACd,gBAAgB,EAChB,aAAa,GACd,MAAM,UAAU,CAAC;AAClB,OAAO,EAIL,aAAa,EACb,eAAe,GAChB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,0BAA0B,EAC1B,2BAA2B,EAC3B,qBAAqB,EAIrB,yBAAyB,GAC1B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAGL,YAAY,EACZ,WAAW,GACZ,MAAM,cAAc,CAAC;AACtB,OAAO,EAGL,YAAY,EACZ,kBAAkB,EAClB,YAAY,GACb,MAAM,eAAe,CAAC;AACvB,sEAAsE;AACtE,OAAO,EACL,0BAA0B,EAC1B,0BAA0B,GAC3B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AACnF,kDAAkD;AAClD,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC3E,OAAO,EACL,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,0BAA0B,CAAC;AAClC,4EAA4E;AAC5E,OAAO,EAAiD,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACpG,8EAA8E;AAC9E,OAAO,EAKL,mBAAmB,EACnB,aAAa,EACb,eAAe,EACf,WAAW,EACX,aAAa,EACb,gBAAgB,GACjB,MAAM,0BAA0B,CAAC;AAClC,sDAAsD;AACtD,OAAO,EAIL,kBAAkB,EAClB,eAAe,EACf,eAAe,EACf,aAAa,EACb,eAAe,EACf,aAAa,EACb,qBAAqB,EACrB,iBAAiB,EACjB,eAAe,EACf,oBAAoB,EACpB,sBAAsB,EACtB,gBAAgB,GACjB,MAAM,uBAAuB,CAAC;AAC/B,yEAAyE;AACzE,OAAO,EAGL,cAAc,EACd,YAAY,EACZ,cAAc,GACf,MAAM,wBAAwB,CAAC;AAChC,gEAAgE;AAChE,OAAO,EAEL,eAAe,EACf,wBAAwB,EACxB,mBAAmB,EAEnB,sBAAsB,EACtB,eAAe,EAGf,aAAa,EAEb,kBAAkB,EAClB,aAAa,EACb,WAAW,EACX,YAAY,GACb,MAAM,eAAe,CAAC;AACvB,OAAO,EAIL,SAAS,EACT,UAAU,EACV,QAAQ,GACT,MAAM,WAAW,CAAC;AACnB,0DAA0D;AAC1D,OAAO,EAEL,qBAAqB,EACrB,mBAAmB,EACnB,yBAAyB,EAGzB,kBAAkB,EAClB,gBAAgB,EAEhB,kBAAkB,GACnB,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EACL,cAAc,EACd,kBAAkB,EAClB,YAAY,EACZ,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,EACjB,gBAAgB,EAChB,qBAAqB,GACtB,MAAM,qBAAqB,CAAC;AAC7B,8CAA8C;AAC9C,OAAO,EAGL,qBAAqB,EACrB,kBAAkB,EAClB,uBAAuB,GACxB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EAA+C,SAAS,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAG7F,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AACvF,qEAAqE;AACrE,OAAO,EAEL,+BAA+B,EAC/B,wBAAwB,EACxB,8BAA8B,EAC9B,gBAAgB,EAChB,+BAA+B,GAEhC,MAAM,2BAA2B,CAAC;AACnC,oFAAoF;AACpF,OAAO,EACL,QAAQ,EAER,UAAU,EACV,QAAQ,EACR,mBAAmB,EACnB,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,WAAW,CAAC;AACnB,uDAAuD;AACvD,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AACtF,OAAO,EACL,WAAW,EACX,iBAAiB,EACjB,YAAY,EACZ,UAAU,EACV,SAAS,EACT,sBAAsB,EACtB,WAAW,EACX,QAAQ,EACR,cAAc,EACd,gBAAgB,EAChB,YAAY,EACZ,gBAAgB,EAChB,UAAU,EACV,WAAW,EACX,UAAU,EACV,UAAU,EACV,QAAQ,EACR,QAAQ,EACR,WAAW,EACX,WAAW,EACX,cAAc,EACd,eAAe,EACf,iBAAiB,EACjB,UAAU,EACV,WAAW,EACX,YAAY,EACZ,WAAW,EACX,SAAS,EACT,SAAS,EACT,QAAQ,EACR,aAAa,EACb,WAAW,GACZ,MAAM,eAAe,CAAC;AACvB,gEAAgE;AAChE,OAAO,EACL,cAAc,EACd,uBAAuB,EACvB,WAAW,EACX,cAAc,EACd,eAAe,EAEf,cAAc,EACd,aAAa,EAGb,eAAe,GAChB,MAAM,iBAAiB,CAAC;AACzB,qDAAqD;AACrD,OAAO,EAEL,kBAAkB,EAIlB,kBAAkB,GACnB,MAAM,oBAAoB,CAAC;AAC5B,wEAAwE;AACxE,OAAO,EAEL,iBAAiB,EACjB,oBAAoB,EACpB,aAAa,EACb,eAAe,EAEf,UAAU,EACV,iBAAiB,EACjB,kBAAkB,EAClB,oBAAoB,EAEpB,YAAY,GACb,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAiD,UAAU,EAAE,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/tasks/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAyBH,OAAO,EAGL,OAAO,EACP,wBAAwB,EACxB,mBAAmB,EACnB,eAAe,EACf,YAAY,EACZ,aAAa,EACb,YAAY,EACZ,iBAAiB,EACjB,gBAAgB,EAChB,eAAe,EACf,cAAc,EACd,cAAc,EACd,mBAAmB,EACnB,gBAAgB,EAChB,YAAY,EACZ,cAAc,EACd,gBAAgB,EAChB,aAAa,GACd,MAAM,UAAU,CAAC;AAClB,OAAO,EAIL,aAAa,EACb,eAAe,GAChB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,0BAA0B,EAC1B,2BAA2B,EAC3B,qBAAqB,EAIrB,yBAAyB,GAC1B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAGL,YAAY,EACZ,WAAW,GACZ,MAAM,cAAc,CAAC;AACtB,OAAO,EAGL,YAAY,EACZ,kBAAkB,EAClB,YAAY,GACb,MAAM,eAAe,CAAC;AACvB,sEAAsE;AACtE,OAAO,EACL,0BAA0B,EAC1B,0BAA0B,GAC3B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AACnF,kDAAkD;AAClD,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC3E,OAAO,EACL,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,0BAA0B,CAAC;AAClC,4EAA4E;AAC5E,OAAO,EAAiD,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACpG,8EAA8E;AAC9E,OAAO,EAKL,mBAAmB,EACnB,aAAa,EACb,eAAe,EACf,WAAW,EACX,aAAa,EACb,gBAAgB,GACjB,MAAM,0BAA0B,CAAC;AAClC,sDAAsD;AACtD,OAAO,EAIL,kBAAkB,EAClB,eAAe,EACf,eAAe,EACf,aAAa,EACb,eAAe,EACf,aAAa,EACb,qBAAqB,EACrB,iBAAiB,EACjB,eAAe,EACf,oBAAoB,EACpB,sBAAsB,EACtB,gBAAgB,GACjB,MAAM,uBAAuB,CAAC;AAC/B,yEAAyE;AACzE,OAAO,EAGL,cAAc,EACd,YAAY,EACZ,cAAc,GACf,MAAM,wBAAwB,CAAC;AAChC,gEAAgE;AAChE,OAAO,EAEL,eAAe,EACf,wBAAwB,EACxB,mBAAmB,EAEnB,sBAAsB,EACtB,eAAe,EAGf,aAAa,EAEb,kBAAkB,EAClB,aAAa,EACb,WAAW,EACX,YAAY,GACb,MAAM,eAAe,CAAC;AACvB,OAAO,EAIL,SAAS,EACT,UAAU,EACV,QAAQ,GACT,MAAM,WAAW,CAAC;AACnB,0DAA0D;AAC1D,OAAO,EAEL,qBAAqB,EACrB,mBAAmB,EACnB,yBAAyB,EAGzB,kBAAkB,EAClB,gBAAgB,EAEhB,kBAAkB,GACnB,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EACL,cAAc,EACd,kBAAkB,EAClB,YAAY,EACZ,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,EACjB,gBAAgB,EAChB,qBAAqB,GACtB,MAAM,qBAAqB,CAAC;AAC7B,8CAA8C;AAC9C,OAAO,EAGL,qBAAqB,EACrB,kBAAkB,EAClB,uBAAuB,GACxB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EAA+C,SAAS,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAG7F,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AACvF,qEAAqE;AACrE,OAAO,EAEL,+BAA+B,EAC/B,wBAAwB,EACxB,8BAA8B,EAC9B,gBAAgB,EAChB,+BAA+B,GAEhC,MAAM,2BAA2B,CAAC;AACnC,oFAAoF;AACpF,OAAO,EACL,QAAQ,EAER,UAAU,EACV,QAAQ,EACR,mBAAmB,EACnB,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,WAAW,CAAC;AACnB,uDAAuD;AACvD,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AACtF,OAAO,EACL,WAAW,EACX,iBAAiB,EACjB,YAAY,EACZ,UAAU,EACV,SAAS,EACT,sBAAsB,EACtB,WAAW,EACX,QAAQ,EACR,cAAc,EACd,gBAAgB,EAChB,YAAY,EACZ,gBAAgB,EAChB,UAAU,EACV,WAAW,EACX,UAAU,EACV,UAAU,EACV,QAAQ,EACR,QAAQ,EACR,WAAW,EACX,WAAW,EACX,cAAc,EACd,eAAe,EACf,iBAAiB,EACjB,UAAU,EACV,WAAW,EACX,YAAY,EACZ,WAAW,EACX,SAAS,EACT,SAAS,EACT,QAAQ,EACR,aAAa,EACb,WAAW,GACZ,MAAM,eAAe,CAAC;AACvB,gEAAgE;AAChE,OAAO,EACL,cAAc,EACd,uBAAuB,EACvB,WAAW,EACX,cAAc,EACd,eAAe,EACf,aAAa,EAEb,cAAc,EACd,aAAa,EACb,wBAAwB,EAIxB,eAAe,GAChB,MAAM,iBAAiB,CAAC;AACzB,qDAAqD;AACrD,OAAO,EAEL,kBAAkB,EAIlB,kBAAkB,GACnB,MAAM,oBAAoB,CAAC;AAC5B,wEAAwE;AACxE,OAAO,EAEL,iBAAiB,EACjB,oBAAoB,EACpB,aAAa,EACb,eAAe,EAEf,UAAU,EACV,iBAAiB,EACjB,kBAAkB,EAClB,oBAAoB,EAEpB,YAAY,GACb,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAiD,UAAU,EAAE,MAAM,aAAa,CAAC"}

package/dist/tasks/tool-cache.d.ts

@@ -37,8 +37,24 @@ import { type AcquireSlotOptions } from './tool-semaphore.js';
  * @task T1534
  */
 export interface ToolCacheEntry {
-    /** Schema version for forwards compatibility. */
-    schemaVersion: 1;
+    /**
+     * Schema version for forwards compatibility.
+     *
+     * Bumped 1 -> 2 by gh#1419, which added {@link ToolCacheEntry.executionRoot}
+     * to the run's identity. Every entry written before that field existed is
+     * refused wholesale by {@link readCacheEntry} on this one comparison.
+     *
+     * That is the mechanism gh#1380 and gh#1404 each rebuilt by hand. Both
+     * needed to retire entries already on disk in consumers' caches, and both
+     * did it with a bespoke null-check on the field they had just added —
+     * `exitCode === null`, then `head === null` — while this field, whose entire
+     * purpose is to retire incompatible entries, stayed at 1 through both.
+     * Two defects, two hand-written retirement clauses, one unused version
+     * counter sitting between them.
+     *
+     * @task T12190 (gh#1419)
+     */
+    schemaVersion: 2;
     /** Cache key (also encoded in the filename). */
     key: string;
     /** Canonical tool name from the resolver. */
@@ -55,6 +71,26 @@ export interface ToolCacheEntry {
     head: string | null;
     /** sha256 of `git status --porcelain` (uncommitted tree fingerprint). */
     dirtyFingerprint: string | null;
+    /**
+     * Absolute, symlink-resolved path of the tree the tool actually ran in.
+     *
+     * Part of the run's IDENTITY (see {@link TOOL_RUN_IDENTITY_FIELDS}), so it
+     * is in the cache key: two clean worktrees at the same HEAD no longer
+     * collide. They used to by construction — a clean tree's
+     * `dirtyFingerprint` is the empty-input hash in every worktree, so the old
+     * key `{canonical, cmd, args, head, dirtyFingerprint}` was byte-identical
+     * across them.
+     *
+     * Stored as well as keyed, so a hit can be AUDITED. Before this field,
+     * `ToolCacheEntry` carried no directory at all: a field survey of 259 tool
+     * entries found 0 that could say which tree produced them, and 8 that had
+     * been produced in worktrees since deleted — every one `exitCode: 0` and
+     * still servable, which makes the evidence unfalsifiable rather than merely
+     * stale. Nobody can go and look.
+     *
+     * @task T12190 (gh#1419)
+     */
+    executionRoot: string;
     /** Process exit code. */
     exitCode: number | null;
     /**
@@ -290,21 +326,110 @@ export declare function defaultSpawnTimeoutMs(canonical: string): number;
  * @task T12105 (gh#1193)
  */
 export declare function resolveSpawnTimeoutMs(canonical: string, env?: NodeJS.ProcessEnv): number;
+/**
+ * The fields that establish WHICH RUN a cache entry describes.
+ *
+ * This list is the single source of truth for three things that must agree
+ * and previously did not, because each was maintained by hand:
+ *
+ *   1. what {@link computeCacheKey} hashes,
+ *   2. what {@link readCacheEntry} requires before serving an entry,
+ *   3. what `runToolCached` requires before persisting one.
+ *
+ * ## Why this exists rather than a fourth guard clause
+ *
+ * Three defects in three releases, each invisible to the detector written for
+ * the one before it:
+ *
+ * | | gh#1380 (2026.9.2) | gh#1404 (2026.9.3) | gh#1419 (this) |
+ * |---|---|---|---|
+ * | signature | `exitCode: null` | real code, `head: null` | well-formed, genuinely succeeded |
+ * | wrong how | never ran | key cannot rotate | ran, on the wrong tree |
+ * | detector | all-null | real code + null head | neither matches |
+ *
+ * Each fix added one `if` naming one field, to two separate guards — the read
+ * path and the write path — that encode the same rule in different code with
+ * nothing asserting they agree. A fourth defect means a fourth pair of `if`s,
+ * and the pair for defect five is the one somebody edits only half of.
+ *
+ * The recurring mistake is not any of the three fields. It is that a field
+ * could be added to {@link ToolCacheEntry} without being added to the key:
+ * `executionRoot` was threaded all the way through execution by T12112 and
+ * never reached `computeCacheKey`, so the tool correctly ran in worktree A
+ * and its result was then served to worktree B under an identical key. The
+ * execution half of that fix landed; the caching half did not.
+ *
+ * Deriving all three consumers from this one array makes that specific
+ * mistake unavailable: a field added here is keyed, required on read, and
+ * required on write, together or not at all.
+ *
+ * ## What is deliberately NOT here
+ *
+ * `exitCode` is a RESULT, not an identity — it is what the run produced, not
+ * which run it was. It has its own non-null requirement in
+ * {@link isEntryUsable} (gh#1380: an unknown outcome must never be cached).
+ * Putting it here would key the cache on its own answer.
+ *
+ * @task T12190 (gh#1419)
+ */
+export declare const TOOL_RUN_IDENTITY_FIELDS: readonly ["canonical", "cmd", "args", "head", "dirtyFingerprint", "executionRoot"];
+/**
+ * The identity half of a {@link ToolCacheEntry} — the inputs that determine
+ * which run it is, independent of what that run produced.
+ *
+ * @task T12190 (gh#1419)
+ */
+export type ToolRunIdentity = Pick<ToolCacheEntry, (typeof TOOL_RUN_IDENTITY_FIELDS)[number]>;
 /**
  * Compute the cache key for a resolved tool command + repo state.
  *
- * Key includes:
- *   - Canonical tool name
- *   - Resolved command + args (sensitive to project-context updates)
- *   - Git HEAD sha (so a new commit invalidates everything)
- *   - Dirty-tree fingerprint (so an uncommitted edit invalidates everything)
+ * The key covers exactly {@link TOOL_RUN_IDENTITY_FIELDS} — canonical tool
+ * name, resolved command and args, git HEAD, dirty-tree fingerprint, and the
+ * normalised execution root. Fields are projected in the order that array
+ * declares, so the hashed payload is a function of the array and adding a
+ * field there changes every key by construction.
+ *
+ * `executionRoot` is a REQUIRED parameter, deliberately. A defaulted one
+ * would let every callsite that was not updated keep computing the old,
+ * colliding key while the type-checker reported success — which is the exact
+ * shape of the defect this fixes, since `executionRoot` already existed and
+ * already reached this function's caller.
  *
  * Using `createHash('sha256')` makes the key collision-resistant and bounded
- * to 64 hex chars regardless of input size.
+ * to 32 hex chars regardless of input size.
  *
  * @task T1534
+ * @task T12190 (gh#1419)
+ */
+export declare function computeCacheKey(command: ResolvedToolCommand, head: string | null, dirtyFingerprint: string | null, executionRoot: string): string;
+/**
+ * Whether a cache entry may be SERVED or PERSISTED as a real result.
+ *
+ * One predicate, used by both {@link readCacheEntry} and the persist guard in
+ * `runToolCached`, so the two cannot drift apart. Two rules:
+ *
+ *   1. every field in {@link TOOL_RUN_IDENTITY_FIELDS} is present and
+ *      non-null — an entry that cannot say which run it describes is not
+ *      evidence of anything;
+ *   2. `exitCode` is non-null — a run that produced no exit code records that
+ *      we do not know what happened, and an unknown must never be cached
+ *      (gh#1380).
+ *
+ * Rule 1 subsumes gh#1404's `head === null` clause without naming `head`:
+ * when the tool runs off a non-git root both git fields are null on EVERY
+ * run, so the key is a function of the command alone and nothing a developer
+ * does to the source can rotate it. That is not a cache, it is a hardcoded
+ * answer with a filename — and unlike gh#1380 it holds a real exit code,
+ * which can be a PASS. A poisoned red is investigated within minutes; nobody
+ * debugs a passing gate.
+ *
+ * The cost is stated rather than hidden: a project whose CLEO root is not a
+ * git checkout gets no tool-result caching at all. Such projects are not
+ * getting valid caching today — they are getting one answer forever.
+ *
+ * @task T12190 (gh#1419)
  */
-export declare function computeCacheKey(command: ResolvedToolCommand, head: string | null, dirtyFingerprint: string | null): string;
+export declare function isEntryUsable(entry: Partial<ToolCacheEntry>): boolean;
 /**
  * Capture the repo's git HEAD sha. Returns `null` when the directory is not
  * a git checkout or the command fails.

package/dist/tasks/tool-cache.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tool-cache.d.ts","sourceRoot":"","sources":["../../src/tasks/tool-cache.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAoBH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,KAAK,kBAAkB,EAAqB,MAAM,qBAAqB,CAAC;AAMjF;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,iDAAiD;IACjD,aAAa,EAAE,CAAC,CAAC;IACjB,gDAAgD;IAChD,GAAG,EAAE,MAAM,CAAC;IACZ,6CAA6C;IAC7C,SAAS,EAAE,MAAM,CAAC;IAClB,kDAAkD;IAClD,WAAW,EAAE,MAAM,CAAC;IACpB,oBAAoB;IACpB,GAAG,EAAE,MAAM,CAAC;IACZ,qBAAqB;IACrB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,2CAA2C;IAC3C,MAAM,EAAE,MAAM,CAAC;IACf,sCAAsC;IACtC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,yEAAyE;IACzE,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,yBAAyB;IACzB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;IAC/B,gCAAgC;IAChC,UAAU,EAAE,MAAM,CAAC;IACnB,gCAAgC;IAChC,UAAU,EAAE,MAAM,CAAC;IACnB,sCAAsC;IACtC,UAAU,EAAE,MAAM,CAAC;IACnB,gDAAgD;IAChD,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB;;;;;OAKG;IACH,MAAM,EAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,kEAAkE;IAClE,QAAQ,EAAE,OAAO,CAAC;IAClB;;;;;;OAMG;IACH,QAAQ,EAAE,OAAO,CAAC;IAClB;;;;;;;OAOG;IACH,QAAQ,EAAE,OAAO,CAAC;IAClB;;;;;;;;;;;;OAYG;IACH,aAAa,EAAE,MAAM,CAAC;IACtB,uDAAuD;IACvD,KAAK,EAAE,cAAc,CAAC;CACvB;AAED;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B;;;;;;;;;;;;OAYG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;;OAOG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,kBAAkB,CAAC;IACtC;;;;;;;;;;;;OAYG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;;;;;;;;;;;;;OAiBG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAMD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,wBAAwB,SAAU,CAAC;AAEhD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,eAAO,MAAM,2BAA2B,UAAY,CAAC;AAYrD;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAI/D;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,MAAM,EACjB,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,CA0BR;AAMD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,mBAAmB,EAC5B,IAAI,EAAE,MAAM,GAAG,IAAI,EACnB,gBAAgB,EAAE,MAAM,GAAG,IAAI,GAC9B,MAAM,CASR;AAqND;;;;;GAKG;AACH,wBAAsB,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAI7E;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,wBAAsB,uBAAuB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CA4BzF;AAMD;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAEvE;AAUD;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI,CA0BtF;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,GAAG,IAAI,CAMhF;AAMD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,aAAa,CACjC,OAAO,EAAE,mBAAmB,EAC5B,WAAW,EAAE,MAAM,EACnB,IAAI,GAAE,cAAmB,GACxB,OAAO,CAAC,aAAa,CAAC,CAwOxB;AAWD;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,CAgBvE"}
+{"version":3,"file":"tool-cache.d.ts","sourceRoot":"","sources":["../../src/tasks/tool-cache.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAqBH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,KAAK,kBAAkB,EAAqB,MAAM,qBAAqB,CAAC;AAMjF;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B;;;;;;;;;;;;;;;;OAgBG;IACH,aAAa,EAAE,CAAC,CAAC;IACjB,gDAAgD;IAChD,GAAG,EAAE,MAAM,CAAC;IACZ,6CAA6C;IAC7C,SAAS,EAAE,MAAM,CAAC;IAClB,kDAAkD;IAClD,WAAW,EAAE,MAAM,CAAC;IACpB,oBAAoB;IACpB,GAAG,EAAE,MAAM,CAAC;IACZ,qBAAqB;IACrB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,2CAA2C;IAC3C,MAAM,EAAE,MAAM,CAAC;IACf,sCAAsC;IACtC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,yEAAyE;IACzE,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC;;;;;;;;;;;;;;;;;;OAkBG;IACH,aAAa,EAAE,MAAM,CAAC;IACtB,yBAAyB;IACzB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;IAC/B,gCAAgC;IAChC,UAAU,EAAE,MAAM,CAAC;IACnB,gCAAgC;IAChC,UAAU,EAAE,MAAM,CAAC;IACnB,sCAAsC;IACtC,UAAU,EAAE,MAAM,CAAC;IACnB,gDAAgD;IAChD,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB;;;;;OAKG;IACH,MAAM,EAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,kEAAkE;IAClE,QAAQ,EAAE,OAAO,CAAC;IAClB;;;;;;OAMG;IACH,QAAQ,EAAE,OAAO,CAAC;IAClB;;;;;;;OAOG;IACH,QAAQ,EAAE,OAAO,CAAC;IAClB;;;;;;;;;;;;OAYG;IACH,aAAa,EAAE,MAAM,CAAC;IACtB,uDAAuD;IACvD,KAAK,EAAE,cAAc,CAAC;CACvB;AAED;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B;;;;;;;;;;;;OAYG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;;OAOG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,kBAAkB,CAAC;IACtC;;;;;;;;;;;;OAYG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;;;;;;;;;;;;;OAiBG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAMD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,wBAAwB,SAAU,CAAC;AAEhD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,eAAO,MAAM,2BAA2B,UAAY,CAAC;AAYrD;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAI/D;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,MAAM,EACjB,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,CA0BR;AAMD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,eAAO,MAAM,wBAAwB,oFAO3B,CAAC;AAEX;;;;;GAKG;AACH,MAAM,MAAM,eAAe,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC,OAAO,wBAAwB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AAwB9F;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,mBAAmB,EAC5B,IAAI,EAAE,MAAM,GAAG,IAAI,EACnB,gBAAgB,EAAE,MAAM,GAAG,IAAI,EAC/B,aAAa,EAAE,MAAM,GACpB,MAAM,CAaR;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,cAAc,CAAC,GAAG,OAAO,CAMrE;AAqND;;;;;GAKG;AACH,wBAAsB,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAI7E;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,wBAAsB,uBAAuB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CA4BzF;AAMD;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAEvE;AAUD;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI,CA4CtF;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,GAAG,IAAI,CAMhF;AAMD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,aAAa,CACjC,OAAO,EAAE,mBAAmB,EAC5B,WAAW,EAAE,MAAM,EACnB,IAAI,GAAE,cAAmB,GACxB,OAAO,CAAC,aAAa,CAAC,CA6PxB;AAWD;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,CAgBvE"}

package/dist/tasks/tool-cache.js

@@ -31,8 +31,8 @@
  */
 import { execFileSync, spawn } from 'node:child_process';
 import { createHash } from 'node:crypto';
-import { existsSync, mkdirSync, readdirSync, readFileSync, renameSync, rmSync, writeFileSync, } from 'node:fs';
-import { join } from 'node:path';
+import { existsSync, mkdirSync, readdirSync, readFileSync, realpathSync, renameSync, rmSync, writeFileSync, } from 'node:fs';
+import { join, resolve } from 'node:path';
 import { ExitCode } from '@cleocode/contracts';
 import { CleoError } from '../errors.js';
 import { withLock } from '../store/lock.js';
@@ -156,30 +156,152 @@ export function resolveSpawnTimeoutMs(canonical, env = process.env) {
 // ---------------------------------------------------------------------------
 // Cache key derivation
 // ---------------------------------------------------------------------------
+/**
+ * The fields that establish WHICH RUN a cache entry describes.
+ *
+ * This list is the single source of truth for three things that must agree
+ * and previously did not, because each was maintained by hand:
+ *
+ *   1. what {@link computeCacheKey} hashes,
+ *   2. what {@link readCacheEntry} requires before serving an entry,
+ *   3. what `runToolCached` requires before persisting one.
+ *
+ * ## Why this exists rather than a fourth guard clause
+ *
+ * Three defects in three releases, each invisible to the detector written for
+ * the one before it:
+ *
+ * | | gh#1380 (2026.9.2) | gh#1404 (2026.9.3) | gh#1419 (this) |
+ * |---|---|---|---|
+ * | signature | `exitCode: null` | real code, `head: null` | well-formed, genuinely succeeded |
+ * | wrong how | never ran | key cannot rotate | ran, on the wrong tree |
+ * | detector | all-null | real code + null head | neither matches |
+ *
+ * Each fix added one `if` naming one field, to two separate guards — the read
+ * path and the write path — that encode the same rule in different code with
+ * nothing asserting they agree. A fourth defect means a fourth pair of `if`s,
+ * and the pair for defect five is the one somebody edits only half of.
+ *
+ * The recurring mistake is not any of the three fields. It is that a field
+ * could be added to {@link ToolCacheEntry} without being added to the key:
+ * `executionRoot` was threaded all the way through execution by T12112 and
+ * never reached `computeCacheKey`, so the tool correctly ran in worktree A
+ * and its result was then served to worktree B under an identical key. The
+ * execution half of that fix landed; the caching half did not.
+ *
+ * Deriving all three consumers from this one array makes that specific
+ * mistake unavailable: a field added here is keyed, required on read, and
+ * required on write, together or not at all.
+ *
+ * ## What is deliberately NOT here
+ *
+ * `exitCode` is a RESULT, not an identity — it is what the run produced, not
+ * which run it was. It has its own non-null requirement in
+ * {@link isEntryUsable} (gh#1380: an unknown outcome must never be cached).
+ * Putting it here would key the cache on its own answer.
+ *
+ * @task T12190 (gh#1419)
+ */
+export const TOOL_RUN_IDENTITY_FIELDS = [
+    'canonical',
+    'cmd',
+    'args',
+    'head',
+    'dirtyFingerprint',
+    'executionRoot',
+];
+/**
+ * Normalise an execution root to a stable, comparable absolute path.
+ *
+ * Symlinks are resolved so that two spellings of one directory produce one
+ * key — the safe direction, since collapsing an alias can only merge entries
+ * that genuinely describe the same tree, while failing to collapse it would
+ * split one tree's cache across spellings. A path that cannot be resolved
+ * (it has been deleted) falls back to lexical resolution rather than
+ * throwing: callers of {@link computeCacheKey} must be able to compute the
+ * key of a run whose directory is already gone, precisely so
+ * {@link readCacheEntry} can then refuse it.
+ *
+ * @task T12190 (gh#1419)
+ */
+function normalizeExecutionRoot(executionRoot) {
+    try {
+        return realpathSync(executionRoot);
+    }
+    catch {
+        return resolve(executionRoot);
+    }
+}
 /**
  * Compute the cache key for a resolved tool command + repo state.
  *
- * Key includes:
- *   - Canonical tool name
- *   - Resolved command + args (sensitive to project-context updates)
- *   - Git HEAD sha (so a new commit invalidates everything)
- *   - Dirty-tree fingerprint (so an uncommitted edit invalidates everything)
+ * The key covers exactly {@link TOOL_RUN_IDENTITY_FIELDS} — canonical tool
+ * name, resolved command and args, git HEAD, dirty-tree fingerprint, and the
+ * normalised execution root. Fields are projected in the order that array
+ * declares, so the hashed payload is a function of the array and adding a
+ * field there changes every key by construction.
+ *
+ * `executionRoot` is a REQUIRED parameter, deliberately. A defaulted one
+ * would let every callsite that was not updated keep computing the old,
+ * colliding key while the type-checker reported success — which is the exact
+ * shape of the defect this fixes, since `executionRoot` already existed and
+ * already reached this function's caller.
  *
  * Using `createHash('sha256')` makes the key collision-resistant and bounded
- * to 64 hex chars regardless of input size.
+ * to 32 hex chars regardless of input size.
  *
  * @task T1534
+ * @task T12190 (gh#1419)
  */
-export function computeCacheKey(command, head, dirtyFingerprint) {
-    const payload = JSON.stringify({
+export function computeCacheKey(command, head, dirtyFingerprint, executionRoot) {
+    const identity = {
         canonical: command.canonical,
         cmd: command.cmd,
         args: command.args,
         head,
         dirtyFingerprint,
-    });
+        executionRoot: normalizeExecutionRoot(executionRoot),
+    };
+    // Projected through TOOL_RUN_IDENTITY_FIELDS rather than written as an
+    // object literal: the literal is what drifted from the entry shape before.
+    const payload = JSON.stringify(TOOL_RUN_IDENTITY_FIELDS.map((f) => identity[f]));
     return createHash('sha256').update(payload).digest('hex').slice(0, 32);
 }
+/**
+ * Whether a cache entry may be SERVED or PERSISTED as a real result.
+ *
+ * One predicate, used by both {@link readCacheEntry} and the persist guard in
+ * `runToolCached`, so the two cannot drift apart. Two rules:
+ *
+ *   1. every field in {@link TOOL_RUN_IDENTITY_FIELDS} is present and
+ *      non-null — an entry that cannot say which run it describes is not
+ *      evidence of anything;
+ *   2. `exitCode` is non-null — a run that produced no exit code records that
+ *      we do not know what happened, and an unknown must never be cached
+ *      (gh#1380).
+ *
+ * Rule 1 subsumes gh#1404's `head === null` clause without naming `head`:
+ * when the tool runs off a non-git root both git fields are null on EVERY
+ * run, so the key is a function of the command alone and nothing a developer
+ * does to the source can rotate it. That is not a cache, it is a hardcoded
+ * answer with a filename — and unlike gh#1380 it holds a real exit code,
+ * which can be a PASS. A poisoned red is investigated within minutes; nobody
+ * debugs a passing gate.
+ *
+ * The cost is stated rather than hidden: a project whose CLEO root is not a
+ * git checkout gets no tool-result caching at all. Such projects are not
+ * getting valid caching today — they are getting one answer forever.
+ *
+ * @task T12190 (gh#1419)
+ */
+export function isEntryUsable(entry) {
+    for (const field of TOOL_RUN_IDENTITY_FIELDS) {
+        const value = entry[field];
+        if (value === null || value === undefined)
+            return false;
+    }
+    return entry.exitCode !== null && entry.exitCode !== undefined;
+}
 /**
  * Maximum bytes retained from a child's stdout / stderr stream during
  * spawn. The tool-evidence atom only needs the trailing 512 bytes for
@@ -467,23 +589,37 @@ export function readCacheEntry(projectRoot, key) {
         return null;
     try {
         const parsed = JSON.parse(readFileSync(path, 'utf-8'));
-        if (parsed.schemaVersion !== 1 || parsed.key !== key)
+        // Schema gate. Bumped to 2 by gh#1419; every entry written before
+        // `executionRoot` was part of a run's identity is refused here, on this
+        // one line. gh#1380 and gh#1404 each needed exactly this and each
+        // reimplemented it as a bespoke null-check on their own field, while this
+        // counter sat unused at 1 through both.
+        if (parsed.schemaVersion !== 2 || parsed.key !== key)
             return null;
         // A placeholder written by `runToolCached` to satisfy proper-lockfile's
         // "file must exist" requirement. It carries no real result — treat as
-        // a miss until the lock holder writes the entry.
+        // a miss until the lock holder writes the entry. Checked before the
+        // identity gate below because a placeholder legitimately has none.
         if (parsed.pending === true)
             return null;
-        // gh#1380: an entry whose run produced no exit code is not a result — it
-        // records that we do not know what happened. Refusing it on READ as well
-        // as declining to write it retires the entries already persisted by
-        // <= 2026.9.1, which cannot clean themselves up: when the tool ran off a
-        // non-git root, `head` and `dirtyFingerprint` are both null, they are part
-        // of the cache key, and a key that cannot change can never be invalidated
-        // by a commit or an edit. One signal-killed run would otherwise serve a
-        // cached "binary missing" forever, without ever spawning again — a
-        // permanent red that no amount of correct work clears.
-        if (parsed.exitCode === null || parsed.exitCode === undefined)
+        // The identity + result gate (gh#1380, gh#1404, gh#1419), derived from
+        // TOOL_RUN_IDENTITY_FIELDS rather than written out field by field, and
+        // shared verbatim with the persist guard in `runToolCached`.
+        if (!isEntryUsable(parsed))
+            return null;
+        // gh#1419: refuse a hit whose originating tree is GONE.
+        //
+        // Keying on `executionRoot` stops one live worktree from being served
+        // another live worktree's result. It does not address the worse case the
+        // field survey actually found: 8 entries produced in worktrees that had
+        // since been deleted, all `exitCode: 0`, all still servable. A stale
+        // result is merely wrong; a result whose tree no longer exists is
+        // UNFALSIFIABLE — there is nowhere left to go and check what ran.
+        //
+        // This is the one rule that is genuinely read-only. At write time the
+        // directory exists by construction, so it cannot live in `isEntryUsable`
+        // alongside the rules both paths share.
+        if (!existsSync(parsed.executionRoot))
             return null;
         return parsed;
     }
@@ -550,7 +686,7 @@ export async function runToolCached(command, projectRoot, opts = {}) {
     const bypassCache = opts.bypassCache ?? process.env['CLEO_EVIDENCE_FRESH'] === '1';
     const head = await captureHead(executionRoot);
     const dirtyFingerprint = await captureDirtyFingerprint(executionRoot);
-    const key = computeCacheKey(command, head, dirtyFingerprint);
+    const key = computeCacheKey(command, head, dirtyFingerprint, executionRoot);
     // Fast path — fresh cache hit
     if (!bypassCache) {
         const existing = readCacheEntry(projectRoot, key);
@@ -585,7 +721,7 @@ export async function runToolCached(command, projectRoot, opts = {}) {
     ensureCacheDir(projectRoot);
     const cachePath = cacheEntryPath(projectRoot, key);
     if (!existsSync(cachePath)) {
-        writeFileSync(cachePath, JSON.stringify({ schemaVersion: 1, key, pending: true }), 'utf-8');
+        writeFileSync(cachePath, JSON.stringify({ schemaVersion: 2, key, pending: true }), 'utf-8');
     }
     const releaseSemaphore = opts.skipGlobalSemaphore
         ? undefined
@@ -640,7 +776,7 @@ export async function runToolCached(command, projectRoot, opts = {}) {
                     lockBusy: false,
                     executionRoot,
                     entry: {
-                        schemaVersion: 1,
+                        schemaVersion: 2,
                         key,
                         canonical: command.canonical,
                         displayName: command.displayName,
@@ -649,6 +785,7 @@ export async function runToolCached(command, projectRoot, opts = {}) {
                         source: command.source,
                         head,
                         dirtyFingerprint,
+                        executionRoot,
                         exitCode: null,
                         signal: result.signal,
                         stdoutTail: '',
@@ -659,7 +796,7 @@ export async function runToolCached(command, projectRoot, opts = {}) {
                 };
             }
             const entry = {
-                schemaVersion: 1,
+                schemaVersion: 2,
                 key,
                 canonical: command.canonical,
                 displayName: command.displayName,
@@ -668,6 +805,7 @@ export async function runToolCached(command, projectRoot, opts = {}) {
                 source: command.source,
                 head,
                 dirtyFingerprint,
+                executionRoot,
                 exitCode: result.exitCode,
                 signal: result.signal,
                 stdoutTail: tailString(result.stdout, tailBytes),
@@ -675,14 +813,32 @@ export async function runToolCached(command, projectRoot, opts = {}) {
                 durationMs,
                 capturedAt: new Date().toISOString(),
             };
-            // gh#1380: `exitCode === null` means the process produced no exit code —
-            // it was killed by a signal, or never started. Either way we do not know
-            // whether the tool would have passed, and an unknown must never be
-            // cached. The `timedOut` branch above already returns without writing
-            // for exactly this reason; a signal kill that is NOT a CLEO timeout —
-            // the memory-scope OOM in gh#1381 — had no equivalent guard and fell
-            // through to here.
-            if (entry.exitCode !== null) {
+            // Persist only a usable entry. `isEntryUsable` is the SAME predicate
+            // `readCacheEntry` applies, which is the point: these two guards used
+            // to be independent transcriptions of one rule — `exitCode !== null
+            // && head !== null`, written out twice — so a field added to one had
+            // to be remembered into the other. gh#1380 and gh#1404 each edited
+            // both, and nothing checked that they still agreed.
+            //
+            // What the shared predicate refuses, and why none of it is an
+            // overcorrection:
+            //   - unknown outcome (`exitCode: null`) — a signal kill, or a
+            //     failure to start. The `timedOut` branch above already returns
+            //     without writing for this reason; an OOM kill that is not a CLEO
+            //     timeout (gh#1381) had no equivalent guard and fell through here.
+            //   - unrotatable key (`head: null`) — costs a non-git CLEO root all
+            //     caching. Stated rather than hidden: those projects are not
+            //     getting valid caching today, they are getting ONE answer
+            //     forever, and a slow correct answer beats a fast fabricated one.
+            //   - unattributable run (`executionRoot` absent) — cannot occur on
+            //     this path, and is required here anyway so that read and write
+            //     stay ONE rule rather than two that happen to match today.
+            //
+            // Deliberately narrow in the other direction too: refusing, say, all
+            // non-zero exits would trade a fabricated pass for a permanent cache
+            // miss on healthy projects — the same overcorrection pointed the
+            // other way.
+            if (isEntryUsable(entry)) {
                 writeCacheEntry(projectRoot, entry);
             }
             return {
@@ -720,7 +876,7 @@ export async function runToolCached(command, projectRoot, opts = {}) {
                     lockBusy: true,
                     executionRoot,
                     entry: {
-                        schemaVersion: 1,
+                        schemaVersion: 2,
                         key,
                         canonical: command.canonical,
                         displayName: command.displayName,
@@ -729,6 +885,7 @@ export async function runToolCached(command, projectRoot, opts = {}) {
                         source: command.source,
                         head,
                         dirtyFingerprint,
+                        executionRoot,
                         exitCode: null,
                         stdoutTail: '',
                         stderrTail: '',