@cleocode/core 2026.9.21 → 2026.9.23

package/dist/docs/export-document.js

@@ -344,7 +344,7 @@ var init_acceptance_gate_schema = __esm({
             message: "Result cannot precede input capture"
           });
         const executable = ["test", "command", "lint"].includes(result.kind);
-        if (executable && !binding.invocation)
+        if (executable && !binding.invocation && result.result !== "error")
           context.addIssue({
             code: "custom",
             path: ["binding", "invocation"],
@@ -3086,12 +3086,21 @@ var init_operations_registry = __esm({
         gateway: "query",
         domain: "tasks",
         operation: "history",
-        description: "Show task work history (time tracked per task)",
+        description: "Show task work history; with taskId, the task audit trail; with ranking, who changed its priority/severity/kind/depends and why (T12693)",
         tier: 1,
         idempotent: true,
         sessionRequired: false,
         requiredParams: [],
-        params: []
+        params: [
+          { name: "taskId", type: "string", required: false, description: "Task to show history for" },
+          { name: "limit", type: "number", required: false, description: "Maximum entries" },
+          {
+            name: "ranking",
+            type: "boolean",
+            required: false,
+            description: "Only ranking-input changes (actor, session, reason, before/after)"
+          }
+        ]
       },
       {
         gateway: "query",
@@ -5586,6 +5595,32 @@ var init_operations_registry = __esm({
         ],
         outputSchema: OUTPUT_CONTRACTS["tasks.assignee"]
       },
+      {
+        gateway: "mutate",
+        domain: "tasks",
+        operation: "ranking.revert",
+        description: "tasks.ranking.revert (mutate) \u2014 undo one recorded ranking change (priority/severity/kind/depends) as a new audited change (T12693, D11161)",
+        tier: 1,
+        idempotent: false,
+        sessionRequired: false,
+        requiredParams: ["entryId"],
+        params: [
+          {
+            name: "entryId",
+            type: "string",
+            required: true,
+            description: "ranking_changed audit row id (cleo history ranking <taskId>)",
+            cli: { positional: true }
+          },
+          { name: "reason", type: "string", required: false, description: "Why it is reverted" },
+          {
+            name: "force",
+            type: "boolean",
+            required: false,
+            description: "Revert even though a field changed again since"
+          }
+        ]
+      },
       {
         gateway: "mutate",
         domain: "tasks",
@@ -10509,7 +10544,7 @@ var init_operations_registry = __esm({
             type: "string",
             required: false,
             enum: DOCS_LIFECYCLE_STATUSES,
-            description: `Override the new lifecycle status. Defaults to "draft" on every update. Valid: ${DOCS_LIFECYCLE_STATUSES.join("|")}.`
+            description: `Override the new lifecycle status. Defaults to "draft" on every update. Alone (no file or content) it changes only the lifecycle status. Valid: ${DOCS_LIFECYCLE_STATUSES.join("|")}.`
           },
           {
             name: "dryRun",
@@ -12996,11 +13031,13 @@ var init_evidence_atom_schema = __esm({
     });
     prAtomSchema = z10.object({
       kind: z10.literal("pr"),
-      prNumber: z10.number().int().positive("pr atom requires a positive integer PR number")
+      prNumber: z10.number().int().positive("pr atom requires a positive integer PR number"),
+      componentPrNumber: z10.number().int().positive().optional()
     });
     ciAtomSchema = z10.object({
       kind: z10.literal("ci"),
-      prNumber: z10.number().int().positive("ci atom requires a positive integer PR number")
+      prNumber: z10.number().int().positive("ci atom requires a positive integer PR number"),
+      componentPrNumber: z10.number().int().positive().optional()
     });
     locDropAtomSchema = z10.object({
       kind: z10.literal("loc-drop"),
@@ -13051,7 +13088,10 @@ var init_evidence_atom_schema = __esm({
           ["commit", "note"],
           ["decision", "files"],
           ["decision", "note"],
-          ["pr", "files"]
+          ["pr", "files"],
+          // T12689: a deletion-only PR (no bytes to hash). Contextual validation
+          // accepts this only when every change the PR made is a deletion.
+          ["pr", "note"]
         ]
       },
       testsPassed: { oneOf: [["test-run"], ["tool"], ["ci"]] },
@@ -16953,7 +16993,7 @@ var init_collection_keys = __esm({
 
 // packages/contracts/src/decide.ts
 import { z as z24 } from "zod";
-var DECISION_QUESTION_TYPES, DECISION_OUTCOME_SOURCES, DECISION_REQUEST_LIMITS, decisionQuestionTypeSchema, decisionOutcomeSourceSchema, decisionInstructionsSchema, unitIntervalSchema, decisionStateSchema, noulDecisionQuestionSchema, choiceDecisionQuestionSchema, scoreDecisionQuestionSchema, decisionQuestionSchema, decisionRequestSchema, noulDecisionAnswerSchema, choiceDecisionAnswerSchema, scoreDecisionAnswerSchema, decisionAnswerSchema, decisionOutcomeSchema, decisionProviderConfigSchema;
+var DECISION_QUESTION_TYPES, DECISION_OUTCOME_SOURCES, DECISION_REQUEST_LIMITS, DECISION_PROVIDER_KINDS, decisionQuestionTypeSchema, decisionOutcomeSourceSchema, decisionInstructionsSchema, unitIntervalSchema, decisionStateSchema, noulDecisionQuestionSchema, choiceDecisionQuestionSchema, scoreDecisionQuestionSchema, decisionQuestionSchema, decisionRequestSchema, noulDecisionAnswerSchema, choiceDecisionAnswerSchema, scoreDecisionAnswerSchema, decisionAnswerSchema, decisionOutcomeSchema, decisionProviderKindSchema, decisionProviderConfigSchema;
 var init_decide = __esm({
   "packages/contracts/src/decide.ts"() {
     "use strict";
@@ -16977,6 +17017,7 @@ var init_decide = __esm({
       /** Maximum number of levels on a `score` question's scale. */
       maxScoreLevels: 10
     };
+    DECISION_PROVIDER_KINDS = ["layahost", "jev"];
     decisionQuestionTypeSchema = z24.enum(DECISION_QUESTION_TYPES);
     decisionOutcomeSourceSchema = z24.enum(DECISION_OUTCOME_SOURCES);
     decisionInstructionsSchema = z24.union([z24.string(), z24.record(z24.string(), z24.json())]);
@@ -17014,6 +17055,8 @@ var init_decide = __esm({
     ]);
     decisionRequestSchema = z24.object({
       model: z24.string().min(1).optional(),
+      lang: z24.string().regex(/^[a-z]{2,3}(-[A-Za-z0-9]{2,8})?$/).optional(),
+      cache: z24.boolean().optional(),
       state: decisionStateSchema,
       questions: z24.record(z24.string().min(1), decisionQuestionSchema).refine(
         (questions) => {
@@ -17054,14 +17097,26 @@ var init_decide = __esm({
       requestId: z24.string().min(1).optional(),
       latencyMs: z24.number().nonnegative(),
       costUsd: z24.number().nonnegative().optional(),
+      costMicros: z24.number().int().nonnegative().optional(),
+      balanceMicros: z24.number().int().optional(),
+      checkpoint: z24.string().min(1).optional(),
       inputTokens: z24.number().int().nonnegative().optional()
     });
+    decisionProviderKindSchema = z24.enum(DECISION_PROVIDER_KINDS);
     decisionProviderConfigSchema = z24.object({
-      baseUrl: z24.url()
+      baseUrl: z24.url(),
+      provider: decisionProviderKindSchema.optional()
     });
   }
 });
 
+// packages/contracts/src/decide-sites.ts
+var init_decide_sites = __esm({
+  "packages/contracts/src/decide-sites.ts"() {
+    "use strict";
+  }
+});
+
 // packages/contracts/src/task-id.ts
 var init_task_id = __esm({
   "packages/contracts/src/task-id.ts"() {
@@ -17143,6 +17198,7 @@ var init_src = __esm({
     init_caamp_markers();
     init_collection_keys();
     init_decide();
+    init_decide_sites();
     init_task_id();
   }
 });
@@ -18640,6 +18696,37 @@ function linkedWorktreeMainRoot(dir) {
   if (basename2(commonDir) === ".git") return dirname2(commonDir);
   return readCoreWorktree(commonDir);
 }
+function describeWorktreeOwner(dir) {
+  const mainRoot = linkedWorktreeMainRoot(dir);
+  if (mainRoot === null) {
+    const bare = bareRepositoryOfWorktree(dir);
+    return bare === null ? "owning repository unknown (unreadable gitlink)" : `owning repository ${bare} is a bare git repository with no main checkout to hold a CLEO store; clone it to a regular checkout, run \`cleo init\` there, and create worktrees from that checkout`;
+  }
+  let projectId = null;
+  try {
+    const parsed = JSON.parse(
+      readFileSync2(join3(mainRoot, ".cleo", "project-info.json"), "utf-8")
+    );
+    if (typeof parsed === "object" && parsed !== null && "projectId" in parsed) {
+      const value = parsed.projectId;
+      if (typeof value === "string" && value !== "") projectId = value;
+    }
+  } catch {
+  }
+  return projectId === null ? `owning repository ${mainRoot} (not an initialised CLEO project)` : `owning project ${mainRoot} (projectId ${projectId})`;
+}
+function bareRepositoryOfWorktree(dir) {
+  const gitdir = readGitlinkTarget(dir);
+  if (!gitdir || basename2(dirname2(gitdir)) !== "worktrees") return null;
+  const commonDir = dirname2(dirname2(gitdir));
+  try {
+    const config = readFileSync2(join3(commonDir, "config"), "utf-8");
+    const core = /^\[core\][^[]*/m.exec(config)?.[0] ?? "";
+    return /^\s*bare\s*=\s*true\s*$/im.test(core) ? commonDir : null;
+  } catch {
+    return null;
+  }
+}
 function readCoreWorktree(gitDir) {
   try {
     const config = readFileSync2(join3(gitDir, "config"), "utf-8");
@@ -19089,13 +19176,13 @@ function captureWriteFence(input) {
   return writeFence;
 }
 function observeOperation(context, work) {
-  return new Promise((resolve14) => {
+  return new Promise((resolve16) => {
     let observed = false;
     const finish = (result) => {
       if (observed) return;
       observed = true;
       context.signal.removeEventListener("abort", abort);
-      resolve14(result);
+      resolve16(result);
     };
     const abort = () => {
       const reason = context.signal.reason;
@@ -19729,7 +19816,7 @@ var init_sql = __esm({
         return new SQL([new StringChunk(str)]);
       }
       _sql.raw = raw;
-      function join35(chunks, separator) {
+      function join36(chunks, separator) {
         const result = [];
         for (const [i, chunk] of chunks.entries()) {
           if (i > 0 && separator !== void 0) result.push(separator);
@@ -19737,7 +19824,7 @@ var init_sql = __esm({
         }
         return new SQL(result);
       }
-      _sql.join = join35;
+      _sql.join = join36;
       function identifier2(value) {
         return new Name(value);
       }
@@ -21752,7 +21839,7 @@ var init_select = __esm({
           const baseTableName = this.tableName;
           const tableName = getTableLikeName(table);
           for (const item of extractUsedTable(table)) this.usedTables.add(item);
-          if (typeof tableName === "string" && this.config.joins?.some((join35) => join35.alias === tableName)) throw new Error(`Alias "${tableName}" is already used in this query`);
+          if (typeof tableName === "string" && this.config.joins?.some((join36) => join36.alias === tableName)) throw new Error(`Alias "${tableName}" is already used in this query`);
           if (!this.isPartialSelect) {
             if (Object.keys(this.joinsNotNullableMap).length === 1 && typeof baseTableName === "string") this.config.fields = { [baseTableName]: this.config.fields };
             if (typeof tableName === "string" && !is(table, SQL)) {
@@ -23349,7 +23436,7 @@ var init_dialect = __esm({
           if (!joins2) return;
           const withEntries = Object.entries(joins2).filter(([_, v]) => v);
           if (!withEntries.length) return;
-          return sql.join(withEntries.map(([k, join35]) => {
+          return sql.join(withEntries.map(([k, join36]) => {
             const relation = tableConfig.relations[k];
             const isSingle2 = is(relation, One);
             const targetTable = aliasedTable(relation.targetTable, `d${currentDepth + 1}`);
@@ -23360,7 +23447,7 @@ var init_dialect = __esm({
               table: targetTable,
               mode: isSingle2 ? "first" : "many",
               schema,
-              queryConfig: join35,
+              queryConfig: join36,
               tableConfig: schema[relation.targetTableName],
               relationWhere: filter,
               isNested: true,
@@ -23374,7 +23461,7 @@ var init_dialect = __esm({
               key: k,
               selection: innerQuery.selection,
               isArray: !isSingle2,
-              isOptional: (relation.optional ?? false) || join35 !== true && !!join35.where
+              isOptional: (relation.optional ?? false) || join36 !== true && !!join36.where
             });
             const jsonColumns = sql.join(innerQuery.selection.map((s) => {
               return sql`${sql.raw(this.escapeString(s.key))}, ${s.selection ? sql`${jsonb2}(${sql.identifier(s.key)})` : sql.identifier(s.key)}`;
@@ -23796,7 +23883,7 @@ var init_update = __esm({
       createJoin(joinType) {
         return ((table, on) => {
           const tableName = getTableLikeName(table);
-          if (typeof tableName === "string" && this.config.joins.some((join35) => join35.alias === tableName)) throw new Error(`Alias "${tableName}" is already used in this query`);
+          if (typeof tableName === "string" && this.config.joins.some((join36) => join36.alias === tableName)) throw new Error(`Alias "${tableName}" is already used in this query`);
           if (typeof on === "function") {
             const from = this.config.from ? is(table, SQLiteTable) ? table[Table.Symbol.Columns] : is(table, Subquery) ? table._.selectedFields : is(table, SQLiteViewBase) ? table[ViewBaseConfig].selectedFields : void 0 : void 0;
             on = on(new Proxy(this.config.table[Table.Symbol.Columns], new SelectionProxyHandler({
@@ -24952,7 +25039,7 @@ async function withWriteRetry(fn, opts = {}) {
   throw contentionErr;
 }
 function sleep(ms) {
-  return new Promise((resolve14) => setTimeout(resolve14, ms));
+  return new Promise((resolve16) => setTimeout(resolve16, ms));
 }
 var DEFAULT_MAX_ATTEMPTS, DEFAULT_BASE_DELAY_MS, DEFAULT_JITTER_MS;
 var init_with_retry = __esm({
@@ -24964,9 +25051,250 @@ var init_with_retry = __esm({
   }
 });
 
+// packages/core/src/store/worktree-build-guard.ts
+import { existsSync as existsSync4, readFileSync as readFileSync3, realpathSync as realpathSync3 } from "node:fs";
+import { createRequire } from "node:module";
+import { dirname as dirname3, isAbsolute as isAbsolute3, join as join5, relative as relative2, resolve as resolve2, sep as sep2 } from "node:path";
+import { fileURLToPath } from "node:url";
+function realOrResolved(path2) {
+  try {
+    return realpathSync3(path2);
+  } catch {
+    return resolve2(path2);
+  }
+}
+function isWithin(root, path2) {
+  const local = relative2(root, path2);
+  return local === "" || !isAbsolute3(local) && local !== ".." && !local.startsWith(`..${sep2}`);
+}
+function insideGitCheckout(dir) {
+  let current = dir;
+  for (; ; ) {
+    if (existsSync4(join5(current, ".git"))) return true;
+    const parent = dirname3(current);
+    if (parent === current) return false;
+    current = parent;
+  }
+}
+function insideTestSandbox(path2) {
+  let dir = dirname3(path2);
+  for (; ; ) {
+    if (existsSync4(join5(dir, TEST_SANDBOX_MARKER))) return !insideGitCheckout(dir);
+    const parent = dirname3(dir);
+    if (parent === dir) return false;
+    dir = parent;
+  }
+}
+function linkedWorktreeRootOf(path2) {
+  let dir = realOrResolved(path2);
+  for (; ; ) {
+    if (isGitLinkedCheckout(dir)) return dir;
+    if (existsSync4(join5(dir, ".git"))) return null;
+    const parent = dirname3(dir);
+    if (parent === dir) return null;
+    dir = parent;
+  }
+}
+function readBuildProvenance(codePath) {
+  let dir = dirname3(codePath);
+  for (; ; ) {
+    const stamp = join5(dir, "build-provenance.json");
+    if (existsSync4(stamp)) {
+      try {
+        const parsed = JSON.parse(readFileSync3(stamp, "utf8"));
+        if (typeof parsed === "object" && parsed !== null && "linkedWorktree" in parsed) {
+          const value = parsed.linkedWorktree;
+          if (value === null || typeof value === "string") return { linkedWorktree: value };
+        }
+      } catch {
+      }
+      return null;
+    }
+    if (existsSync4(join5(dir, "package.json"))) return null;
+    const parent = dirname3(dir);
+    if (parent === dir) return null;
+    dir = parent;
+  }
+}
+function devBuildWorktree(options = {}) {
+  const codePath = options.codePath ?? overrides?.codePath ?? fileURLToPath(import.meta.url);
+  const provenance = options.provenance !== void 0 ? options.provenance : overrides?.provenance !== void 0 ? overrides.provenance : readBuildProvenance(codePath);
+  if (provenance) return provenance.linkedWorktree;
+  if (codePath.split(/[\\/]/).includes("node_modules")) return null;
+  return linkedWorktreeRootOf(codePath);
+}
+function schemaWriteRefusal(dbPath, options = {}) {
+  const env = options.env ?? overrides?.env ?? process.env;
+  const buildWorktree = devBuildWorktree(options);
+  if (buildWorktree === null) return null;
+  const store = realOrResolved(dbPath);
+  if (isWithin(realOrResolved(buildWorktree), store)) return null;
+  if (env["VITEST"]) return null;
+  const honourTestSandbox = options.honourTestSandbox ?? overrides?.honourTestSandbox ?? true;
+  if (honourTestSandbox && insideTestSandbox(store)) return null;
+  if (env[ALLOW_WORKTREE_BUILD_MIGRATIONS_ENV] === "1") return null;
+  return `Refusing to change the schema of ${store}: this CLI was built inside the git worktree ${buildWorktree}, and its schema may be unreleased. Run the released \`cleo\` against this store, or opt in with ${ALLOW_WORKTREE_BUILD_MIGRATIONS_ENV}=1 (T12687).`;
+}
+function decisionFor(dbPath) {
+  const key = realOrResolved(dbPath);
+  if (!decisions.has(key)) decisions.set(key, schemaWriteRefusal(key));
+  return decisions.get(key) ?? null;
+}
+function isWorktreeBuildSchemaError(error) {
+  return error instanceof Error && error.message.includes(E_WORKTREE_BUILD_SCHEMA);
+}
+function codes() {
+  if (authorizerCodes) return authorizerCodes;
+  const sqlite = createRequire(import.meta.url)("node:sqlite").constants;
+  authorizerCodes = {
+    sqlite,
+    creates: /* @__PURE__ */ new Map([
+      [sqlite.SQLITE_CREATE_TABLE, "table"],
+      [sqlite.SQLITE_CREATE_VTABLE, "table"],
+      [sqlite.SQLITE_CREATE_INDEX, "index"],
+      [sqlite.SQLITE_CREATE_TRIGGER, "trigger"],
+      [sqlite.SQLITE_CREATE_VIEW, "view"]
+    ]),
+    changes: /* @__PURE__ */ new Set([
+      sqlite.SQLITE_ALTER_TABLE,
+      sqlite.SQLITE_DROP_TABLE,
+      sqlite.SQLITE_DROP_INDEX,
+      sqlite.SQLITE_DROP_TRIGGER,
+      sqlite.SQLITE_DROP_VIEW,
+      sqlite.SQLITE_DROP_VTABLE
+    ])
+  };
+  return authorizerCodes;
+}
+function attachRefusal(name2) {
+  if (name2 === "" || name2 === ":memory:") return null;
+  if (typeof name2 !== "string" || /^file:/i.test(name2) || name2.includes("?")) {
+    return UNKNOWN_ATTACH_REFUSAL;
+  }
+  return decisionFor(name2);
+}
+function readSchemas(nativeDb) {
+  const schemas = /* @__PURE__ */ new Map();
+  const list = nativeDb.prepare("PRAGMA database_list").all();
+  for (const { name: name2, file } of list) {
+    if (name2 === "temp") continue;
+    const rows = nativeDb.prepare(`SELECT type, name FROM "${name2.replaceAll('"', '""')}".sqlite_master`).all();
+    schemas.set(name2.toLowerCase(), {
+      refusal: file ? decisionFor(file) : null,
+      // '' = in-memory
+      objects: new Set(rows.map((r) => `${r.type}:${r.name}`))
+    });
+  }
+  return schemas;
+}
+function guardActive() {
+  const env = overrides?.env ?? process.env;
+  if (env["VITEST"]) return false;
+  if (overrides) return devBuildWorktree() !== null;
+  if (processBuildWorktree === void 0) processBuildWorktree = devBuildWorktree();
+  return processBuildWorktree !== null;
+}
+function installSchemaWriteGuard(nativeDb) {
+  if (!guardActive()) return false;
+  const location = nativeDb.location();
+  const mainRefusal = location ? decisionFor(location) : null;
+  if (typeof nativeDb.setAuthorizer !== "function") {
+    if (mainRefusal) throw new WorktreeBuildSchemaError(mainRefusal);
+    return false;
+  }
+  const state = {
+    schemas: readSchemas(nativeDb),
+    unmappedAttachRefusal: null,
+    stale: false,
+    lastDenied: null
+  };
+  guards.set(nativeDb, state);
+  const { sqlite, creates, changes } = codes();
+  nativeDb.setAuthorizer((action, arg1, arg2, dbName) => {
+    if (action === sqlite.SQLITE_ATTACH) {
+      const refusal2 = attachRefusal(arg1);
+      if (refusal2 && !state.unmappedAttachRefusal) state.unmappedAttachRefusal = refusal2;
+      return sqlite.SQLITE_OK;
+    }
+    if (action === sqlite.SQLITE_DETACH) {
+      state.stale = true;
+      return sqlite.SQLITE_OK;
+    }
+    const createType = creates.get(action);
+    if (createType === void 0 && !changes.has(action)) return sqlite.SQLITE_OK;
+    const schema = ((action === sqlite.SQLITE_ALTER_TABLE ? arg1 : dbName) ?? "main").toLowerCase();
+    if (schema === "temp") return sqlite.SQLITE_OK;
+    const mapped = state.schemas.get(schema);
+    const policy = state.stale ? void 0 : mapped;
+    const refusal = policy ? policy.refusal : (mapped?.refusal ?? null) || state.unmappedAttachRefusal;
+    if (refusal === null) return sqlite.SQLITE_OK;
+    if (createType !== void 0 && policy?.objects.has(`${createType}:${arg1}`)) {
+      return sqlite.SQLITE_OK;
+    }
+    state.lastDenied = {
+      what: createType !== void 0 ? `CREATE ${createType} ${schema}.${arg1}` : `schema change on ${schema}.${(action === sqlite.SQLITE_ALTER_TABLE ? arg2 : arg1) ?? ""}`,
+      refusal
+    };
+    return sqlite.SQLITE_DENY;
+  });
+  return mainRefusal !== null;
+}
+function refreshSchemaWriteGuard(nativeDb) {
+  const state = guards.get(nativeDb);
+  if (!state) return;
+  state.schemas = readSchemas(nativeDb);
+  state.unmappedAttachRefusal = null;
+  state.stale = false;
+}
+function explainSchemaWriteDenial(nativeDb, error) {
+  if (!(error instanceof Error) || !/not authorized/i.test(error.message)) return error;
+  const denied = guards.get(nativeDb)?.lastDenied;
+  if (!denied) return error;
+  return new WorktreeBuildSchemaError(`${denied.refusal} Denied: ${denied.what}.`);
+}
+function pendingMigrations(nativeDb, migrations) {
+  const hasJournal = nativeDb.prepare("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = '__drizzle_migrations'").get();
+  const applied = hasJournal ? new Set(
+    nativeDb.prepare('SELECT hash FROM main."__drizzle_migrations"').all().map((row) => row.hash)
+  ) : /* @__PURE__ */ new Set();
+  return migrations.filter((m) => !applied.has(m.hash)).map((m) => m.name ?? m.hash);
+}
+function assertNoPendingMigrationsForWorktreeBuild(nativeDb, migrations) {
+  const dbPath = nativeDb.location();
+  if (!dbPath) return;
+  const refusal = decisionFor(dbPath);
+  if (refusal === null) return;
+  const pending = pendingMigrations(nativeDb, migrations);
+  if (pending.length === 0) return;
+  throw new WorktreeBuildSchemaError(`${refusal} Pending migrations: ${pending.join(", ")}.`);
+}
+var ALLOW_WORKTREE_BUILD_MIGRATIONS_ENV, TEST_SANDBOX_MARKER, E_WORKTREE_BUILD_SCHEMA, overrides, decisions, WorktreeBuildSchemaError, authorizerCodes, guards, UNKNOWN_ATTACH_REFUSAL, processBuildWorktree;
+var init_worktree_build_guard = __esm({
+  "packages/core/src/store/worktree-build-guard.ts"() {
+    "use strict";
+    init_src();
+    init_errors2();
+    init_project_scope();
+    ALLOW_WORKTREE_BUILD_MIGRATIONS_ENV = "CLEO_ALLOW_WORKTREE_BUILD_MIGRATIONS";
+    TEST_SANDBOX_MARKER = ".cleo-test-sandbox";
+    E_WORKTREE_BUILD_SCHEMA = "E_WORKTREE_BUILD_SCHEMA";
+    overrides = null;
+    decisions = /* @__PURE__ */ new Map();
+    WorktreeBuildSchemaError = class extends CleoError {
+      constructor(message) {
+        super(8 /* CONFIG_ERROR */, `${E_WORKTREE_BUILD_SCHEMA}: ${message}`, {
+          fix: `Use the released \`cleo\` for this store, run the build against a store inside its own worktree, or set ${ALLOW_WORKTREE_BUILD_MIGRATIONS_ENV}=1 to accept the schema change.`
+        });
+      }
+    };
+    guards = /* @__PURE__ */ new WeakMap();
+    UNKNOWN_ATTACH_REFUSAL = "a store was ATTACHed by a bound, computed or URI filename, so this build cannot tell whose store it is; schema changes on unmapped schemas are refused until the guard is refreshed";
+  }
+});
+
 // packages/core/src/store/migration-manager.ts
-import { copyFileSync, existsSync as existsSync4 } from "node:fs";
-import { dirname as dirname3, join as join5 } from "node:path";
+import { copyFileSync, existsSync as existsSync5 } from "node:fs";
+import { dirname as dirname4, join as join6 } from "node:path";
 function stripSqlComments(sql32) {
   return sql32.replace(/--[^\n]*/g, "").replace(/\/\*[\s\S]*?\*\//g, "");
 }
@@ -25005,10 +25333,10 @@ function computeEliminatedTables(migrations) {
   return eliminated;
 }
 function resolveConsolidationCutoverPrefix(migrationsFolder) {
-  const parent = dirname3(migrationsFolder);
+  const parent = dirname4(migrationsFolder);
   for (const setName of ["drizzle-cleo-project", "drizzle-cleo-global"]) {
-    const folder = join5(parent, setName);
-    if (!existsSync4(folder)) continue;
+    const folder = join6(parent, setName);
+    if (!existsSync5(folder)) continue;
     try {
       const consolidation = readMigrationFiles({ migrationsFolder: folder }).find(
         (m) => /-consolidation-cleo-/.test(m.name ?? "")
@@ -25032,7 +25360,7 @@ function tableExists(nativeDb, tableName) {
 }
 function createSafetyBackup(dbPath) {
   const backupPath = dbPath.replace(/\.db$/, "-pre-cleo.db.bak");
-  if (!existsSync4(backupPath)) {
+  if (!existsSync5(backupPath)) {
     try {
       copyFileSync(dbPath, backupPath);
     } catch {
@@ -25150,6 +25478,16 @@ function readSiblingMigrationHashes(siblingFolder) {
     return /* @__PURE__ */ new Set();
   }
 }
+function readSiblingNewestMillis(siblingFolder) {
+  try {
+    return Math.max(
+      0,
+      ...readMigrationFiles({ migrationsFolder: siblingFolder }).map((m) => m.folderMillis)
+    );
+  } catch {
+    return 0;
+  }
+}
 function ensureJournalHashUnique(nativeDb) {
   if (!tableExists(nativeDb, "__drizzle_migrations")) return;
   try {
@@ -25198,6 +25536,7 @@ function upgradeSharedJournalFormat(nativeDb, lineageFolders) {
   return { named, unnamed: rows.length - named };
 }
 function reconcileJournal(nativeDb, migrationsFolder, existenceTable2, logSubsystem, siblingMigrationsFolders = []) {
+  assertNoPendingMigrationsForWorktreeBuild(nativeDb, readMigrationFiles({ migrationsFolder }));
   const eliminatedTables = computeEliminatedTables(readMigrationFiles({ migrationsFolder }));
   const cutoverPrefix = resolveConsolidationCutoverPrefix(migrationsFolder);
   if (siblingMigrationsFolders.length > 0)
@@ -25229,8 +25568,15 @@ function reconcileJournal(nativeDb, migrationsFolder, existenceTable2, logSubsys
         knownHashes.add(m);
       }
     }
-    const dbEntries = nativeDb.prepare('SELECT id, hash FROM "__drizzle_migrations"').all();
-    const orphanedEntries = dbEntries.filter((e) => !knownHashes.has(e.hash));
+    const newestKnownMillis = Math.max(
+      0,
+      ...localMigrations.map((m) => m.folderMillis),
+      ...siblingMigrationsFolders.filter((folder) => folder !== migrationsFolder).map(readSiblingNewestMillis)
+    );
+    const dbEntries = nativeDb.prepare('SELECT id, hash, created_at FROM "__drizzle_migrations"').all();
+    const orphanedEntries = dbEntries.filter(
+      (e) => !knownHashes.has(e.hash) && !(Number(e.created_at) > newestKnownMillis)
+    );
     const hasOrphanedEntries = orphanedEntries.length > 0;
     if (hasOrphanedEntries) {
       const dbHashes = new Set(dbEntries.map((e) => e.hash));
@@ -25472,6 +25818,8 @@ function sanitizeMigrationStatements(migrations) {
 }
 function migrateSanitized(db, config) {
   const raw = readMigrationFiles(config);
+  const client = db.$client;
+  if (client) assertNoPendingMigrationsForWorktreeBuild(client, raw);
   const sanitized = sanitizeMigrationStatements(raw);
   migrateSync(sanitized, db._.session, config);
 }
@@ -25535,6 +25883,7 @@ var init_migration_manager = __esm({
     init_sqlite_core();
     init_logger2();
     init_with_retry();
+    init_worktree_build_guard();
     MAX_MIGRATION_RETRIES = 5;
     MIGRATION_RETRY_BASE_DELAY_MS = 100;
     MIGRATION_RETRY_MAX_DELAY_MS = 2e3;
@@ -25544,13 +25893,13 @@ var init_migration_manager = __esm({
 });
 
 // packages/core/src/store/relocated-store-guard.ts
-import { existsSync as existsSync5, realpathSync as realpathSync3 } from "node:fs";
-import { createRequire } from "node:module";
-import { basename as basename3, dirname as dirname4 } from "node:path";
+import { existsSync as existsSync6, realpathSync as realpathSync4 } from "node:fs";
+import { createRequire as createRequire2 } from "node:module";
+import { basename as basename3, dirname as dirname5 } from "node:path";
 import { readDeclaredProjectIdentity as readDeclaredProjectIdentity2, readPortableProjectId } from "@cleocode/paths";
 function real2(p) {
   try {
-    return realpathSync3(p);
+    return realpathSync4(p);
   } catch {
     return p;
   }
@@ -25567,7 +25916,7 @@ function liveElsewhere(globalDbPath, projectId, root) {
       "SELECT project_path AS projectPath FROM nexus_project_registry WHERE project_id = ?"
     ).get(projectId);
     const live = row?.projectPath;
-    if (!live || paths.has(live) || !existsSync5(live)) return null;
+    if (!live || paths.has(live) || !existsSync6(live)) return null;
     if (!isStrictlyInsideDir(root, live)) return null;
     return readDeclaredProjectIdentity2(live)?.projectId === projectId ? live : null;
   } catch {
@@ -25581,14 +25930,14 @@ function detectRelocatedRoot(root, globalDbPath) {
   if (tombstone)
     return { projectId: tombstone.projectId, movedTo: tombstone.movedTo, via: "tombstone" };
   const declared = readPortableProjectId(root);
-  if (declared.status !== "valid" || !existsSync5(globalDbPath)) return null;
+  if (declared.status !== "valid" || !existsSync6(globalDbPath)) return null;
   const movedTo = liveElsewhere(globalDbPath, declared.projectId, root);
   return movedTo ? { projectId: declared.projectId, movedTo, via: "registry" } : null;
 }
 function assertStoreNotRelocated(dbPath, globalDbPath) {
-  if (basename3(dbPath) !== "cleo.db" || basename3(dirname4(dbPath)) !== ".cleo") return;
-  if (existsSync5(dbPath) || globalDbPath === dbPath) return;
-  const root = dirname4(dirname4(dbPath));
+  if (basename3(dbPath) !== "cleo.db" || basename3(dirname5(dbPath)) !== ".cleo") return;
+  if (existsSync6(dbPath) || globalDbPath === dbPath) return;
+  const root = dirname5(dirname5(dbPath));
   if (_adopted.has(root)) return;
   const moved = detectRelocatedRoot(root, globalDbPath);
   if (moved) throw projectMovedError(root, moved, void 0, moved.via);
@@ -25598,17 +25947,17 @@ var init_relocated_store_guard = __esm({
   "packages/core/src/store/relocated-store-guard.ts"() {
     "use strict";
     init_project_tombstone();
-    _require = createRequire(import.meta.url);
+    _require = createRequire2(import.meta.url);
     _adopted = /* @__PURE__ */ new Set();
   }
 });
 
 // packages/core/src/store/resolve-migrations-folder.ts
-import { createRequire as createRequire2 } from "node:module";
-import { dirname as dirname5, join as join6 } from "node:path";
-import { fileURLToPath } from "node:url";
+import { createRequire as createRequire3 } from "node:module";
+import { dirname as dirname6, join as join7 } from "node:path";
+import { fileURLToPath as fileURLToPath2 } from "node:url";
 function coreRootFromEntry(entryPath) {
-  return dirname5(dirname5(entryPath));
+  return dirname6(dirname6(entryPath));
 }
 function resolveConsolidatedJournalSiblings(ownSetName) {
   return CONSOLIDATED_JOURNAL_LINEAGES.filter((name2) => name2 !== ownSetName).map(
@@ -25618,14 +25967,14 @@ function resolveConsolidatedJournalSiblings(ownSetName) {
 function resolveCorePackageMigrationsFolder(setName) {
   try {
     const resolved = import.meta.resolve("@cleocode/core", import.meta.url);
-    const entryPath = fileURLToPath(resolved);
-    return join6(coreRootFromEntry(entryPath), "migrations", setName);
+    const entryPath = fileURLToPath2(resolved);
+    return join7(coreRootFromEntry(entryPath), "migrations", setName);
   } catch {
   }
-  const _require7 = createRequire2(import.meta.url);
+  const _require7 = createRequire3(import.meta.url);
   try {
     const entryPath = _require7.resolve("@cleocode/core");
-    return join6(coreRootFromEntry(entryPath), "migrations", setName);
+    return join7(coreRootFromEntry(entryPath), "migrations", setName);
   } catch (err) {
     throw new Error(
       `resolveCorePackageMigrationsFolder("${setName}"): cannot locate @cleocode/core from "${import.meta.url}". Ensure @cleocode/core is installed (workspace or npm). Original error: ${err.message}`
@@ -25735,11 +26084,11 @@ var init_sqlite_pragmas = __esm({
 });
 
 // packages/core/src/store/worktree-isolation-guard.ts
-import { basename as basename4, dirname as dirname6, join as join7 } from "node:path";
+import { basename as basename4, dirname as dirname7, join as join8, resolve as resolve3 } from "node:path";
 function assertStorePathIsNotWorktreeResident(role, dbPath) {
-  const cleoDir = dirname6(dbPath);
+  const cleoDir = dirname7(dbPath);
   if (basename4(cleoDir) !== ".cleo") return;
-  const projectRoot = dirname6(cleoDir);
+  const projectRoot = dirname7(cleoDir);
   if (!isGitLinkedCheckout(projectRoot)) return;
   if (process.env["CLEO_ALLOW_WORKTREE_DB_CREATE"] === "1") {
     process.stderr.write(
@@ -25748,9 +26097,10 @@ function assertStorePathIsNotWorktreeResident(role, dbPath) {
     );
     return;
   }
+  const owner = describeWorktreeOwner(projectRoot);
   throw new CleoError(
     8 /* CONFIG_ERROR */,
-    `E_WT_DB_ISOLATION_VIOLATION: refusing to open '${role}' DB at ${dbPath} \u2014 parent ${projectRoot} is a git worktree (gitlink). DBs must open against the canonical project root.`,
+    `E_WT_DB_ISOLATION_VIOLATION: refusing to open '${role}' DB at ${dbPath} \u2014 parent ${projectRoot} is a git worktree (gitlink); ${owner}. DBs must open against the canonical project root.`,
     {
       fix: `Run from the canonical project root, or make sure the worktree's main repository is an initialised CLEO project so it resolves there. Inspect stranded worktree stores with \`cleo doctor worktree-stores\`. Emergency override (audited): CLEO_ALLOW_WORKTREE_DB_CREATE=1.`
     }
@@ -25763,7 +26113,7 @@ function assertDbPathIsNotWorktreeResident(role, cwd) {
   } catch {
     return;
   }
-  assertStorePathIsNotWorktreeResident(role, join7(cleoDir, PROJECT_STORE_FILENAME2));
+  assertStorePathIsNotWorktreeResident(role, join8(cleoDir, PROJECT_STORE_FILENAME2));
 }
 var PROJECT_STORE_FILENAME2;
 var init_worktree_isolation_guard = __esm({
@@ -25783,10 +26133,10 @@ __export(sqlite_native_exports, {
   getDbSyncConstructor: () => getDbSyncConstructor,
   openNativeDatabase: () => openNativeDatabase
 });
-import { realpathSync as realpathSync4 } from "node:fs";
-import { createRequire as createRequire3 } from "node:module";
+import { realpathSync as realpathSync5 } from "node:fs";
+import { createRequire as createRequire4 } from "node:module";
 import { tmpdir as tmpdir2 } from "node:os";
-import { delimiter, dirname as dirname7, isAbsolute as isAbsolute3, join as join8, resolve as resolve2, sep as sep2 } from "node:path";
+import { delimiter, dirname as dirname8, isAbsolute as isAbsolute4, join as join9, resolve as resolve4, sep as sep3 } from "node:path";
 function getDbSyncConstructor() {
   if (_ctor === null) {
     const mod = _require2("node:sqlite");
@@ -25795,19 +26145,19 @@ function getDbSyncConstructor() {
   return _ctor;
 }
 function resolveAbsoluteSafe(p) {
-  const abs = isAbsolute3(p) ? p : resolve2(p);
+  const abs = isAbsolute4(p) ? p : resolve4(p);
   try {
-    return realpathSync4(abs);
+    return realpathSync5(abs);
   } catch {
     const missingParts = [];
     let cursor = abs;
     while (true) {
-      const parent = dirname7(cursor);
+      const parent = dirname8(cursor);
       if (parent === cursor) return abs;
-      missingParts.unshift(cursor.slice(parent.length + (parent.endsWith(sep2) ? 0 : 1)));
+      missingParts.unshift(cursor.slice(parent.length + (parent.endsWith(sep3) ? 0 : 1)));
       cursor = parent;
       try {
-        return join8(realpathSync4(cursor), ...missingParts);
+        return join9(realpathSync5(cursor), ...missingParts);
       } catch {
       }
     }
@@ -25815,7 +26165,7 @@ function resolveAbsoluteSafe(p) {
 }
 function isPathUnder(child, parent) {
   if (child === parent) return true;
-  const withSep = parent.endsWith(sep2) ? parent : parent + sep2;
+  const withSep = parent.endsWith(sep3) ? parent : parent + sep3;
   return child.startsWith(withSep);
 }
 function assertVitestSafePath(path2) {
@@ -25838,6 +26188,7 @@ function openNativeDatabase(path2, options) {
   assertVitestSafePath(path2);
   const DatabaseSyncCtor = getDbSyncConstructor();
   const db = new DatabaseSyncCtor(path2, {
+    // schema-guard-exempt: the native chokepoint; every writable caller installs the guard
     enableForeignKeyConstraints: true,
     readOnly: options?.readonly ?? false,
     // Default handle-open lock timeout mirrors the SSoT busy_timeout
@@ -25889,7 +26240,7 @@ var init_sqlite_native = __esm({
   "packages/core/src/store/sqlite-native.ts"() {
     "use strict";
     init_sqlite_pragmas();
-    _require2 = createRequire3(import.meta.url);
+    _require2 = createRequire4(import.meta.url);
     _ctor = null;
   }
 });
@@ -25963,7 +26314,7 @@ var init_writer_lease_schema = __esm({
 // packages/core/src/store/writer-lease.ts
 import { AsyncLocalStorage as AsyncLocalStorage3 } from "node:async_hooks";
 import { randomUUID } from "node:crypto";
-import { realpathSync as realpathSync5, statSync as statSync2 } from "node:fs";
+import { realpathSync as realpathSync6, statSync as statSync2 } from "node:fs";
 import { resolve as resolvePath } from "node:path";
 function log() {
   if (_log === null) _log = getLogger("writer-lease");
@@ -26053,7 +26404,7 @@ function resolveDbIdentity(db) {
   return identity;
 }
 function sleepAsync(ms) {
-  return new Promise((resolve14) => setTimeout(resolve14, Math.max(0, Math.round(ms))));
+  return new Promise((resolve16) => setTimeout(resolve16, Math.max(0, Math.round(ms))));
 }
 function isPidAlive(pid) {
   try {
@@ -26392,7 +26743,7 @@ function assertColdOpenFile(frame) {
 async function withRequiredColdOpenLease(scope, nativeDb, fn, opts) {
   opts.execution?.assertActive();
   const captured = opts.requiredIdentity;
-  const path2 = realpathSync5(captured.dbPath);
+  const path2 = realpathSync6(captured.dbPath);
   const identity = statSync2(path2, { bigint: true });
   if (captured.scope !== scope || captured.fileDevice !== String(identity.dev) || captured.fileInode !== String(identity.ino)) {
     throw new LeaseUnavailableError(
@@ -26425,6 +26776,7 @@ async function withRequiredColdOpenLease(scope, nativeDb, fn, opts) {
   }
   const remaining = opts.execution ? Math.max(1, opts.execution.deadlineAt - Date.now()) : ACQUIRE_DEADLINE_MS;
   const owned = openNativeDatabase(path2, { timeout: Math.min(ACQUIRE_DEADLINE_MS, remaining) });
+  installSchemaWriteGuard(owned);
   try {
     opts.execution?.assertActive();
     const afterOpen = statSync2(path2, { bigint: true });
@@ -26618,6 +26970,7 @@ var init_writer_lease = __esm({
     init_background_ops();
     init_dual_scope_db();
     init_sqlite_native();
+    init_worktree_build_guard();
     init_writer_lease_schema();
     DEFAULT_TTL_MS = 3e4;
     DEFAULT_PRIORITY = 100;
@@ -27160,10 +27513,10 @@ var init_monitor = __esm({
 
 // packages/core/src/resources/supervisor-admit.ts
 import { connect } from "node:net";
-import { join as join9 } from "node:path";
+import { join as join10 } from "node:path";
 import { getCleoHome as getCleoHome2 } from "@cleocode/paths";
 function resolveSupervisorSocketPath() {
-  return process.env.CLEO_SUPERVISOR_SOCKET ?? join9(getCleoHome2(), SUPERVISOR_SOCKET_NAME);
+  return process.env.CLEO_SUPERVISOR_SOCKET ?? join10(getCleoHome2(), SUPERVISOR_SOCKET_NAME);
 }
 async function sendResourceAdmit(socketPath, cls, holderId, budget) {
   const result = await sendLeaseRequest(
@@ -27186,7 +27539,7 @@ async function sendResourceRelease(socketPath, cls, holderId) {
   return { unavailable: true, reason: `unexpected response kind: ${result.kind}` };
 }
 function sendLeaseRequest(socketPath, request, expectedKind) {
-  return new Promise((resolve14) => {
+  return new Promise((resolve16) => {
     const id = `ra-${process.pid}-${request.kind}`;
     const envelope = LeaseIpcRequestEnvelopeSchema.parse({
       protocol_version: LEASE_IPC_PROTOCOL_VERSION,
@@ -27204,7 +27557,7 @@ function sendLeaseRequest(socketPath, request, expectedKind) {
       settled = true;
       socket.removeAllListeners();
       socket.destroy();
-      resolve14(value);
+      resolve16(value);
     };
     const degrade = (reason) => done({ unavailable: true, reason });
     socket.setTimeout(REQUEST_TIMEOUT_MS);
@@ -27275,9 +27628,9 @@ __export(governor_exports, {
   resolveGovernorMode: () => resolveGovernorMode,
   slotFileCount: () => slotFileCount
 });
-import { existsSync as existsSync6, mkdirSync, readdirSync as readdirSync2, writeFileSync as writeFileSync3 } from "node:fs";
+import { existsSync as existsSync7, mkdirSync, readdirSync as readdirSync2, writeFileSync as writeFileSync3 } from "node:fs";
 import { availableParallelism, totalmem } from "node:os";
-import { join as join10 } from "node:path";
+import { join as join11 } from "node:path";
 import lockfile from "proper-lockfile";
 function log2() {
   if (_log2 === null) _log2 = getLogger("resource-governor");
@@ -27346,14 +27699,14 @@ function clamp(lo, v, hi) {
   return Math.max(lo, Math.min(v, hi));
 }
 function governorSlotDir(cls) {
-  return join10(getCleoHome(), "locks", `resource-${cls}`);
+  return join11(getCleoHome(), "locks", `resource-${cls}`);
 }
 function ensureSlotFiles(dir, count) {
-  if (!existsSync6(dir)) mkdirSync(dir, { recursive: true });
+  if (!existsSync7(dir)) mkdirSync(dir, { recursive: true });
   const paths = [];
   for (let i = 0; i < count; i++) {
-    const p = join10(dir, `slot-${i}.lock`);
-    if (!existsSync6(p)) writeFileSync3(p, "", { flag: "a" });
+    const p = join11(dir, `slot-${i}.lock`);
+    if (!existsSync7(p)) writeFileSync3(p, "", { flag: "a" });
     paths.push(p);
   }
   return paths;
@@ -27393,7 +27746,7 @@ function shuffledIndices(n) {
 }
 async function countHeldSlots(cls, budget) {
   const dir = governorSlotDir(cls);
-  if (!existsSync6(dir)) return 0;
+  if (!existsSync7(dir)) return 0;
   const slots = ensureSlotFiles(dir, budget);
   let held = 0;
   for (const path2 of slots) {
@@ -27408,7 +27761,7 @@ async function countHeldSlots(cls, budget) {
 }
 function slotFileCount(cls) {
   const dir = governorSlotDir(cls);
-  if (!existsSync6(dir)) return 0;
+  if (!existsSync7(dir)) return 0;
   return readdirSync2(dir).filter((f) => f.startsWith("slot-") && f.endsWith(".lock")).length;
 }
 var _log2, _cachedMode2, _supervisorDegradeLogged, MB, STALE_MS, _supervisorHolderSeq, ResourceGovernor, governor;
@@ -27608,11 +27961,11 @@ var init_lock = __esm({
 
 // packages/core/src/store/atomic.ts
 import { mkdir, readFile as readFile2, rename, unlink } from "node:fs/promises";
-import { dirname as dirname8 } from "node:path";
+import { dirname as dirname9 } from "node:path";
 import writeFileAtomic from "write-file-atomic";
 async function atomicWrite(filePath, data, options) {
   try {
-    await mkdir(dirname8(filePath), { recursive: true });
+    await mkdir(dirname9(filePath), { recursive: true });
     await writeFileAtomic(filePath, data, {
       encoding: options?.encoding ?? "utf8",
       mode: options?.mode
@@ -27645,7 +27998,7 @@ var init_atomic = __esm({
 
 // packages/core/src/store/backup.ts
 import { copyFile, rename as fsRename, mkdir as mkdir2, readdir, stat as stat2, unlink as unlink2 } from "node:fs/promises";
-import { basename as basename5, join as join11 } from "node:path";
+import { basename as basename5, dirname as dirname10, join as join12 } from "node:path";
 async function createBackup(filePath, backupDir, maxBackups = DEFAULT_MAX_BACKUPS) {
   try {
     await mkdir2(backupDir, { recursive: true });
@@ -27656,14 +28009,14 @@ async function createBackup(filePath, backupDir, maxBackups = DEFAULT_MAX_BACKUP
       throw new CleoError(3 /* FILE_ERROR */, `Cannot backup: source file not found: ${filePath}`);
     }
     for (let i = maxBackups; i >= 1; i--) {
-      const current = join11(backupDir, `${fileName}.${i}`);
+      const current = join12(backupDir, `${fileName}.${i}`);
       if (i === maxBackups) {
         try {
           await unlink2(current);
         } catch {
         }
       } else {
-        const next = join11(backupDir, `${fileName}.${i + 1}`);
+        const next = join12(backupDir, `${fileName}.${i + 1}`);
         try {
           await stat2(current);
           await fsRename(current, next);
@@ -27671,7 +28024,7 @@ async function createBackup(filePath, backupDir, maxBackups = DEFAULT_MAX_BACKUP
         }
       }
     }
-    const backupPath = join11(backupDir, `${fileName}.1`);
+    const backupPath = join12(backupDir, `${fileName}.1`);
     await copyFile(filePath, backupPath);
     return backupPath;
   } catch (err) {
@@ -27685,6 +28038,7 @@ var init_backup = __esm({
     "use strict";
     init_src();
     init_errors2();
+    init_worktree_isolation_guard();
     DEFAULT_MAX_BACKUPS = 5;
   }
 });
@@ -27969,7 +28323,7 @@ __export(identity_exports, {
 import { execFile } from "node:child_process";
 import { createHash as createHash2 } from "node:crypto";
 import { readFile as readFile3 } from "node:fs/promises";
-import { join as join12, resolve as resolve3 } from "node:path";
+import { join as join13, resolve as resolve5 } from "node:path";
 import { promisify } from "node:util";
 import { legacyProjectId } from "@cleocode/paths";
 import { legacyProjectId as legacyProjectId2 } from "@cleocode/paths";
@@ -27977,14 +28331,14 @@ async function findGitRoot(fromPath, execution) {
   execution?.assertActive();
   try {
     const { stdout } = await execFileAsync("git", ["rev-parse", "--show-toplevel"], {
-      cwd: resolve3(fromPath),
+      cwd: resolve5(fromPath),
       signal: execution?.signal,
       timeout: execution ? Math.max(1, execution.remainingMs()) : void 0,
       killSignal: "SIGKILL",
       maxBuffer: 64 * 1024
     });
     execution?.assertActive();
-    return resolve3(stdout.trim());
+    return resolve5(stdout.trim());
   } catch {
     execution?.assertActive();
     return null;
@@ -27994,7 +28348,7 @@ async function findGitRemoteUrl(fromPath, execution) {
   execution?.assertActive();
   try {
     const { stdout } = await execFileAsync("git", ["remote", "get-url", "origin"], {
-      cwd: resolve3(fromPath),
+      cwd: resolve5(fromPath),
       signal: execution?.signal,
       timeout: execution ? Math.max(1, execution.remainingMs()) : void 0,
       killSignal: "SIGKILL",
@@ -28024,7 +28378,7 @@ async function collectCheckoutEvidence(fromPath, execution) {
     try {
       const args = ["--no-replace-objects", "rev-list", "--max-parents=0", "HEAD"];
       const { stdout } = await execFileAsync("git", args, {
-        cwd: resolve3(fromPath),
+        cwd: resolve5(fromPath),
         signal: execution?.signal,
         timeout: execution ? Math.max(1, execution.remainingMs()) : void 0,
         killSignal: "SIGKILL",
@@ -28047,7 +28401,7 @@ async function collectCheckoutEvidence(fromPath, execution) {
 async function readProjectInfoName(repoRoot, execution) {
   execution?.assertActive();
   try {
-    const raw = await readFile3(join12(repoRoot, ".cleo", "project-info.json"), {
+    const raw = await readFile3(join13(repoRoot, ".cleo", "project-info.json"), {
       encoding: "utf8",
       signal: execution?.signal
     });
@@ -28062,7 +28416,7 @@ async function readProjectInfoName(repoRoot, execution) {
 }
 async function projectPathFingerprint(repoPath, execution) {
   execution?.assertActive();
-  const realRepoPath = resolve3(repoPath);
+  const realRepoPath = resolve5(repoPath);
   const results = await Promise.allSettled([
     findGitRoot(realRepoPath, execution),
     findGitRemoteUrl(realRepoPath, execution)
@@ -28086,9 +28440,9 @@ async function projectPathFingerprint(repoPath, execution) {
 }
 function computeLegacyAliases(repoPath, additionalPaths) {
   const aliases = /* @__PURE__ */ new Set();
-  aliases.add(legacyProjectId(resolve3(repoPath)));
+  aliases.add(legacyProjectId(resolve5(repoPath)));
   for (const p of additionalPaths ?? []) {
-    aliases.add(legacyProjectId(resolve3(p)));
+    aliases.add(legacyProjectId(resolve5(p)));
   }
   return [...aliases];
 }
@@ -28122,17 +28476,17 @@ var init_project_identity = __esm({
 });
 
 // packages/core/src/scaffold/ensure-config.ts
-import { existsSync as existsSync7, readFileSync as readFileSync3 } from "node:fs";
-import { basename as basename6, dirname as dirname9, join as join13, resolve as resolve4 } from "node:path";
-import { fileURLToPath as fileURLToPath2 } from "node:url";
+import { existsSync as existsSync8, readFileSync as readFileSync4 } from "node:fs";
+import { basename as basename6, dirname as dirname11, join as join14, resolve as resolve6 } from "node:path";
+import { fileURLToPath as fileURLToPath3 } from "node:url";
 function getPackageRoot() {
-  const thisFile = fileURLToPath2(import.meta.url);
-  return resolve4(dirname9(thisFile), "..", "..");
+  const thisFile = fileURLToPath3(import.meta.url);
+  return resolve6(dirname11(thisFile), "..", "..");
 }
 function getCleoVersion() {
   try {
-    const pkgPath = join13(getPackageRoot(), "package.json");
-    const pkg = JSON.parse(readFileSync3(pkgPath, "utf-8"));
+    const pkgPath = join14(getPackageRoot(), "package.json");
+    const pkg = JSON.parse(readFileSync4(pkgPath, "utf-8"));
     return pkg.version ?? "0.0.0";
   } catch {
     return "0.0.0";
@@ -28491,25 +28845,25 @@ var init_recovery = __esm({
 // packages/core/src/store/exodus/archive.ts
 import {
   copyFileSync as copyFileSync2,
-  existsSync as existsSync8,
+  existsSync as existsSync9,
   mkdirSync as mkdirSync2,
-  readFileSync as readFileSync4,
+  readFileSync as readFileSync5,
   renameSync as renameSync3,
   unlinkSync,
   writeFileSync as writeFileSync4
 } from "node:fs";
-import { basename as basename7, dirname as dirname10, join as join14, resolve as resolve5 } from "node:path";
+import { basename as basename7, dirname as dirname12, join as join15, resolve as resolve7 } from "node:path";
 import { z as z26 } from "zod";
 function scopeBaseDir(scope, cwd, targetDbPath) {
-  if (targetDbPath !== void 0) return dirname10(targetDbPath);
+  if (targetDbPath !== void 0) return dirname12(targetDbPath);
   return scope === "project" ? resolveCleoDir(cwd) : getCleoHome();
 }
 function exodusArchiveDir(scope, cwd, targetDbPath) {
-  return join14(scopeBaseDir(scope, cwd, targetDbPath), ARCHIVE_DIR_NAME);
+  return join15(scopeBaseDir(scope, cwd, targetDbPath), ARCHIVE_DIR_NAME);
 }
 function exodusMarkerPath(scope, cwd, targetDbPath) {
   const marker = targetDbPath !== void 0 && basename7(targetDbPath) !== "cleo.db" ? `${basename7(targetDbPath)}.${MARKER_FILENAME_BY_SCOPE[scope]}` : MARKER_FILENAME_BY_SCOPE[scope];
-  return join14(scopeBaseDir(scope, cwd, targetDbPath), marker);
+  return join15(scopeBaseDir(scope, cwd, targetDbPath), marker);
 }
 function hasExodusCompleteMarker(scope, cwd, targetDbPath, nativeDb) {
   let markerPath;
@@ -28519,13 +28873,13 @@ function hasExodusCompleteMarker(scope, cwd, targetDbPath, nativeDb) {
     if (targetDbPath) throw error;
     return false;
   }
-  if (!existsSync8(markerPath)) return false;
-  const marker = markerIdentity.parse(JSON.parse(readFileSync4(markerPath, "utf8")));
+  if (!existsSync9(markerPath)) return false;
+  const marker = markerIdentity.parse(JSON.parse(readFileSync5(markerPath, "utf8")));
   if (nativeDb && (!marker.databaseIdentity || !hasExodusDatabaseIdentity(nativeDb, marker.databaseIdentity)))
     throw new Error(
       "Exodus completion marker does not certify this database generation; assessment required"
     );
-  return marker.scope === scope && (!targetDbPath || !marker.targetDbPath || resolve5(marker.targetDbPath) === resolve5(targetDbPath));
+  return marker.scope === scope && (!targetDbPath || !marker.targetDbPath || resolve7(marker.targetDbPath) === resolve7(targetDbPath));
 }
 function writeExodusCompleteMarker(scope, archivedSources, cwd, targetDbPath, databaseIdentity) {
   const markerPath = exodusMarkerPath(scope, cwd, targetDbPath);
@@ -28537,7 +28891,7 @@ function writeExodusCompleteMarker(scope, archivedSources, cwd, targetDbPath, da
     cleoVersion: getCleoVersion(),
     completedAt: (/* @__PURE__ */ new Date()).toISOString(),
     archivedSources: [...archivedSources],
-    targetDbPath: resolve5(targetDbPath ?? join14(baseDir, "cleo.db")),
+    targetDbPath: resolve7(targetDbPath ?? join15(baseDir, "cleo.db")),
     ...databaseIdentity ? { databaseIdentity } : {}
   };
   const tmpPath = `${markerPath}.tmp`;
@@ -28548,10 +28902,10 @@ function writeExodusCompleteMarker(scope, archivedSources, cwd, targetDbPath, da
 }
 function moveFileInto(srcPath, destDir) {
   mkdirSync2(destDir, { recursive: true });
-  let dest = join14(destDir, basename7(srcPath));
-  if (existsSync8(dest)) {
+  let dest = join15(destDir, basename7(srcPath));
+  if (existsSync9(dest)) {
     const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "").replace(/Z$/, "Z");
-    dest = join14(destDir, `${basename7(srcPath)}.${stamp}`);
+    dest = join15(destDir, `${basename7(srcPath)}.${stamp}`);
   }
   try {
     renameSync3(srcPath, dest);
@@ -28562,14 +28916,14 @@ function moveFileInto(srcPath, destDir) {
   return dest;
 }
 function archiveSourceDb(source, cwd, targetDbPath) {
-  if (!existsSync8(source.path)) {
+  if (!existsSync9(source.path)) {
     return { name: source.name, sourcePath: source.path, archivedTo: null, action: "absent" };
   }
   const destDir = exodusArchiveDir(source.targetScope, cwd, targetDbPath);
   const archivedTo = moveFileInto(source.path, destDir);
   for (const suffix of SIDECAR_SUFFIXES) {
     const sidecar = `${source.path}${suffix}`;
-    if (existsSync8(sidecar)) {
+    if (existsSync9(sidecar)) {
       try {
         moveFileInto(sidecar, destDir);
       } catch (err) {
@@ -28617,7 +28971,7 @@ function detectStrandedResidue(sources, cwd) {
   const stranded = [];
   for (const source of sources) {
     if (!markedScopes.has(source.targetScope)) continue;
-    if (existsSync8(source.path)) {
+    if (existsSync9(source.path)) {
       stranded.push({ name: source.name, path: source.path, scope: source.targetScope });
     }
   }
@@ -28682,7 +29036,7 @@ __export(open_cleo_db_exports, {
   openCleoDbSnapshot: () => openCleoDbSnapshot,
   validateProjectIdConsistency: () => validateProjectIdConsistency
 });
-import { createRequire as createRequire4 } from "node:module";
+import { createRequire as createRequire5 } from "node:module";
 function unwrapNativeSqliteDb(db) {
   if (db && typeof db === "object" && "$client" in db) {
     return db.$client ?? db;
@@ -28746,9 +29100,10 @@ async function openCleoDb(role, cwd) {
 }
 function openCleoDbSnapshot(path2, options = {}) {
   const { readOnly = true, applyPragmas = true } = options;
-  const _require7 = createRequire4(import.meta.url);
+  const _require7 = createRequire5(import.meta.url);
   const { DatabaseSync: DatabaseSyncCtor } = _require7("node:sqlite");
   const db = new DatabaseSyncCtor(path2, { readOnly });
+  if (!readOnly) installSchemaWriteGuard(db);
   if (applyPragmas) {
     applyPerfPragmas(db, { enableWal: !readOnly });
   }
@@ -28776,6 +29131,7 @@ var init_open_cleo_db = __esm({
     init_project_info();
     init_dual_scope_db();
     init_sqlite_pragmas();
+    init_worktree_build_guard();
     init_worktree_isolation_guard();
     PROJECT_ID_TRACKING_ROLES = /* @__PURE__ */ new Set(["global"]);
   }
@@ -29115,7 +29471,7 @@ var init_table_name_map = __esm({
 });
 
 // packages/core/src/store/exodus/count-parity.ts
-import { existsSync as existsSync9 } from "node:fs";
+import { existsSync as existsSync10 } from "node:fs";
 function listTables(db) {
   return db.prepare(
     "SELECT name FROM sqlite_master WHERE type='table' AND name NOT LIKE 'sqlite_%' AND name NOT LIKE '__drizzle_%' ORDER BY name"
@@ -29136,14 +29492,14 @@ function rowCount(db, tableName) {
 function computeCountParity(sources, projectDbPath, globalDbPath) {
   const entries = [];
   let skipped = 0;
-  if (!existsSync9(projectDbPath) || !existsSync9(globalDbPath)) {
+  if (!existsSync10(projectDbPath) || !existsSync10(globalDbPath)) {
     return { ok: false, entries: [], deficits: [], checked: 0, skipped: 0 };
   }
   const projectSnap = openCleoDbSnapshot(projectDbPath, { readOnly: true });
   const globalSnap = openCleoDbSnapshot(globalDbPath, { readOnly: true });
   try {
     for (const src of sources) {
-      if (!existsSync9(src.path)) continue;
+      if (!existsSync10(src.path)) continue;
       const srcSnap = openCleoDbSnapshot(src.path, { readOnly: true });
       try {
         for (const legacyTable of listTables(srcSnap.db)) {
@@ -29201,8 +29557,8 @@ var init_count_parity = __esm({
 });
 
 // packages/core/src/store/exodus/plan.ts
-import { existsSync as existsSync10, readdirSync as readdirSync3, statfsSync, statSync as statSync3 } from "node:fs";
-import { join as join15 } from "node:path";
+import { existsSync as existsSync11, readdirSync as readdirSync3, statfsSync, statSync as statSync3 } from "node:fs";
+import { join as join16 } from "node:path";
 function computeRequiredBytes(totalSourceBytes, largestSourceBytes) {
   return Math.ceil(STAGING_HEADROOM_FACTOR * largestSourceBytes) + totalSourceBytes;
 }
@@ -29213,33 +29569,33 @@ function buildSourceDescriptors(cwd) {
     // Project-tier — go into consolidated project-scope cleo.db
     {
       name: "tasks",
-      path: join15(cleoDir, "tasks.db"),
+      path: join16(cleoDir, "tasks.db"),
       targetScope: "project"
     },
     {
       name: "brain (project)",
-      path: join15(cleoDir, "brain.db"),
+      path: join16(cleoDir, "brain.db"),
       targetScope: "project"
     },
     {
       name: "conduit",
-      path: join15(cleoDir, "conduit.db"),
+      path: join16(cleoDir, "conduit.db"),
       targetScope: "project"
     },
     // Global-tier — go into consolidated global-scope cleo.db
     {
       name: "nexus",
-      path: join15(cleoHome, "nexus.db"),
+      path: join16(cleoHome, "nexus.db"),
       targetScope: "global"
     },
     {
       name: "signaldock",
-      path: join15(cleoHome, "signaldock.db"),
+      path: join16(cleoHome, "signaldock.db"),
       targetScope: "global"
     },
     {
       name: "skills",
-      path: join15(cleoHome, "skills.db"),
+      path: join16(cleoHome, "skills.db"),
       targetScope: "global"
     }
   ];
@@ -29268,7 +29624,7 @@ function findExistingStaging(cleoDir) {
     const entries = readdirSync3(cleoDir, { withFileTypes: true });
     const stagingDirs = entries.filter((e) => e.isDirectory() && e.name.startsWith("exodus-staging-")).map((e) => e.name).sort().reverse();
     if (stagingDirs.length > 0) {
-      return join15(cleoDir, stagingDirs[0]);
+      return join16(cleoDir, stagingDirs[0]);
     }
   } catch {
   }
@@ -29284,7 +29640,7 @@ function buildExodusPlan(cwd) {
   const availableBytes = getAvailableBytes(cleoDir);
   const diskPreflight = totalSourceBytes === 0 || availableBytes >= requiredBytes;
   const existingStaging = findExistingStaging(cleoDir);
-  const stagingDir = existingStaging ?? join15(cleoDir, deriveStagingDirName());
+  const stagingDir = existingStaging ?? join16(cleoDir, deriveStagingDirName());
   const resumeFromStaging = existingStaging !== null;
   const projectDbPath = resolveDualScopeDbPath("project", cwd);
   const globalDbPath = resolveDualScopeDbPath("global");
@@ -29303,7 +29659,7 @@ function buildExodusPlan(cwd) {
   };
 }
 function sourcesPresent(sources) {
-  return sources.some((s) => existsSync10(s.path));
+  return sources.some((s) => existsSync11(s.path));
 }
 var STAGING_HEADROOM_FACTOR, STAGING_COPY_SKIP_THRESHOLD_BYTES;
 var init_plan2 = __esm({
@@ -29317,18 +29673,18 @@ var init_plan2 = __esm({
 });
 
 // packages/core/src/store/exodus/health.ts
-import { existsSync as existsSync11, statSync as statSync4 } from "node:fs";
+import { existsSync as existsSync12, statSync as statSync4 } from "node:fs";
 function buildExodusHealth(cwd) {
   const plan = buildExodusPlan(cwd);
-  const anyLegacyPresent = plan.sources.some((s) => existsSync11(s.path));
+  const anyLegacyPresent = plan.sources.some((s) => existsSync12(s.path));
   const parity = anyLegacyPresent ? computeCountParity(plan.sources, plan.projectDbPath, plan.globalDbPath) : { ok: true, entries: [], deficits: [], checked: 0, skipped: 0 };
   const consolidatedExistsByScope = {
-    project: existsSync11(plan.projectDbPath),
-    global: existsSync11(plan.globalDbPath)
+    project: existsSync12(plan.projectDbPath),
+    global: existsSync12(plan.globalDbPath)
   };
   const buildScope = (scope) => {
     const sources = plan.sources.filter((s) => s.targetScope === scope).map((s) => {
-      const present = existsSync11(s.path);
+      const present = existsSync12(s.path);
       let bytes = 0;
       if (present) {
         try {
@@ -29680,8 +30036,8 @@ var init_types = __esm({
 });
 
 // packages/core/src/store/backup-sidecar.ts
-import { existsSync as existsSync12, readdirSync as readdirSync4, renameSync as renameSync4, statSync as statSync5, unlinkSync as unlinkSync2, writeFileSync as writeFileSync5 } from "node:fs";
-import { join as join16 } from "node:path";
+import { existsSync as existsSync13, readdirSync as readdirSync4, renameSync as renameSync4, statSync as statSync5, unlinkSync as unlinkSync2, writeFileSync as writeFileSync5 } from "node:fs";
+import { join as join17 } from "node:path";
 function formatBackupTimestamp(d) {
   const pad = (n, len = 2) => String(n).padStart(len, "0");
   return `${d.getFullYear()}${pad(d.getMonth() + 1)}${pad(d.getDate())}-${pad(d.getHours())}${pad(d.getMinutes())}${pad(d.getSeconds())}`;
@@ -29692,8 +30048,8 @@ function rotateBackupDir(backupDir, maxSnapshots, backupType) {
     const ownedPattern = new RegExp(`\\.${escapedType}-`);
     const files = readdirSync4(backupDir).filter((f) => !f.endsWith(".meta.json") && !f.endsWith(".tmp") && ownedPattern.test(f)).map((f) => ({
       name: f,
-      path: join16(backupDir, f),
-      mtimeMs: statSync5(join16(backupDir, f)).mtimeMs
+      path: join17(backupDir, f),
+      mtimeMs: statSync5(join17(backupDir, f)).mtimeMs
     })).sort((a, b) => a.mtimeMs - b.mtimeMs);
     while (files.length > maxSnapshots) {
       const oldest = files.shift();
@@ -29701,7 +30057,7 @@ function rotateBackupDir(backupDir, maxSnapshots, backupType) {
       try {
         unlinkSync2(oldest.path);
         const metaPath = `${oldest.path}.meta.json`;
-        if (existsSync12(metaPath)) unlinkSync2(metaPath);
+        if (existsSync13(metaPath)) unlinkSync2(metaPath);
       } catch {
       }
     }
@@ -29709,7 +30065,7 @@ function rotateBackupDir(backupDir, maxSnapshots, backupType) {
   }
 }
 function writeBackupSidecar(backupDir, sidecar) {
-  const dest = join16(backupDir, `${sidecar.backupId}.meta.json`);
+  const dest = join17(backupDir, `${sidecar.backupId}.meta.json`);
   const tmp = `${dest}.${process.pid}.${Date.now()}.tmp`;
   writeFileSync5(tmp, JSON.stringify(sidecar, null, 2));
   renameSync4(tmp, dest);
@@ -29721,23 +30077,23 @@ var init_backup_sidecar = __esm({
 });
 
 // packages/core/src/store/pre-repair-snapshot.ts
-import { existsSync as existsSync13, mkdirSync as mkdirSync3, statfsSync as statfsSync2 } from "node:fs";
-import { dirname as dirname11, join as join17 } from "node:path";
+import { existsSync as existsSync14, mkdirSync as mkdirSync3, statfsSync as statfsSync2 } from "node:fs";
+import { dirname as dirname13, join as join18 } from "node:path";
 function writePreRepairSnapshot(nativeDb, dbPath, label) {
   const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
-  const backupDir = join17(dirname11(dbPath), "backups");
+  const backupDir = join18(dirname13(dbPath), "backups");
   mkdirSync3(backupDir, { recursive: true });
-  const snapshotPath = join17(backupDir, `cleo-pre-${label}-${stamp}.db`);
+  const snapshotPath = join18(backupDir, `cleo-pre-${label}-${stamp}.db`);
   nativeDb.exec(`VACUUM INTO '${snapshotPath.replace(/'/g, "''")}'`);
   return snapshotPath;
 }
 function existingAncestor(path2) {
   let p = path2;
-  while (!existsSync13(p) && dirname11(p) !== p) p = dirname11(p);
+  while (!existsSync14(p) && dirname13(p) !== p) p = dirname13(p);
   return p;
 }
 function planMigrationSnapshot(nativeDb, dbPath) {
-  const backupDir = join17(dirname11(dbPath), "backups", "sqlite");
+  const backupDir = join18(dirname13(dbPath), "backups", "sqlite");
   const pragma = (name2) => Number(nativeDb.prepare(`PRAGMA main.${name2}`).get()[name2] ?? 0);
   const liveBytes = (pragma("page_count") - pragma("freelist_count")) * pragma("page_size");
   let availableBytes = null;
@@ -29749,13 +30105,13 @@ function planMigrationSnapshot(nativeDb, dbPath) {
   }
   const base = `migration-${formatBackupTimestamp(/* @__PURE__ */ new Date())}`;
   let backupId = base;
-  for (let n = 2; existsSync13(join17(backupDir, `${backupId}.meta.json`)); n++) {
+  for (let n = 2; existsSync14(join18(backupDir, `${backupId}.meta.json`)); n++) {
     backupId = `${base}-${n}`;
   }
   return {
     backupDir,
     backupId,
-    snapshotPath: join17(backupDir, `cleo.db.${backupId}`),
+    snapshotPath: join18(backupDir, `cleo.db.${backupId}`),
     requiredBytes: liveBytes + SNAPSHOT_HEADROOM_BYTES,
     availableBytes
   };
@@ -29995,7 +30351,7 @@ var init_legacy_tasks_lineage = __esm({
 
 // packages/core/src/store/ports/domain-binding.ts
 import { AsyncLocalStorage as AsyncLocalStorage4 } from "node:async_hooks";
-import { resolve as resolve6 } from "node:path";
+import { resolve as resolve8 } from "node:path";
 function getCleoRuntime() {
   if (!_runtime) {
     _runtime = createCleoRuntime();
@@ -30063,6 +30419,8 @@ async function bindAgainst(key, store, establish) {
           () => establish(native, store)
         );
         return { store, native, db };
+      } catch (error) {
+        throw explainSchemaWriteDenial(native, error);
       } finally {
         membership.active = false;
       }
@@ -30112,7 +30470,7 @@ async function bindLive(scope, key, dbPath, openStore, establish) {
   );
 }
 async function bindProjectDomain(domain, cwd, establish) {
-  const dbPath = resolve6(resolveDualScopeDbPath("project", cwd));
+  const dbPath = resolve8(resolveDualScopeDbPath("project", cwd));
   const row = await bindLive(
     "project",
     bindingKey("project", dbPath, domain),
@@ -30123,7 +30481,7 @@ async function bindProjectDomain(domain, cwd, establish) {
   return row;
 }
 async function bindGlobalDomain(domain, establish, cwd) {
-  const dbPath = resolve6(resolveDualScopeDbPath("global"));
+  const dbPath = resolve8(resolveDualScopeDbPath("global"));
   const row = await bindLive(
     "global",
     bindingKey("global", dbPath, domain),
@@ -30134,7 +30492,7 @@ async function bindGlobalDomain(domain, establish, cwd) {
   return row;
 }
 async function bindGlobalDomainAtPath(domain, dbPath, establish) {
-  const normalized = resolve6(dbPath);
+  const normalized = resolve8(dbPath);
   const row = await bindLive(
     "global",
     bindingKey("global", normalized, domain),
@@ -30145,7 +30503,7 @@ async function bindGlobalDomainAtPath(domain, dbPath, establish) {
   return row;
 }
 function peekDomainAtPath(scope, dbPath, domain) {
-  const row = _bindings.get(bindingKey(scope, resolve6(dbPath), domain));
+  const row = _bindings.get(bindingKey(scope, resolve8(dbPath), domain));
   if (!row?.native.isOpen) return null;
   return row;
 }
@@ -30154,12 +30512,12 @@ function releaseDomainBindings(filter) {
     _bindings.clear();
     return;
   }
-  const wantPath = filter.dbPath === void 0 ? void 0 : resolve6(filter.dbPath);
+  const wantPath = filter.dbPath === void 0 ? void 0 : resolve8(filter.dbPath);
   for (const key of [..._bindings.keys()]) {
-    const sep5 = key.indexOf("::");
+    const sep6 = key.indexOf("::");
     const lastSep = key.lastIndexOf("::");
-    const scope = key.slice(0, sep5);
-    const dbPath = key.slice(sep5 + 2, lastSep);
+    const scope = key.slice(0, sep6);
+    const dbPath = key.slice(sep6 + 2, lastSep);
     const domain = key.slice(lastSep + 2);
     if (filter.scope !== void 0 && scope !== filter.scope) continue;
     if (wantPath !== void 0 && dbPath !== wantPath) continue;
@@ -30174,7 +30532,7 @@ function boundProjectNative(domain, cwd) {
   return peekProjectDomain(domain, cwd)?.native ?? null;
 }
 function peekProjectDomain(domain, cwd) {
-  const dbPath = resolve6(resolveDualScopeDbPath("project", cwd));
+  const dbPath = resolve8(resolveDualScopeDbPath("project", cwd));
   const row = _bindings.get(bindingKey("project", dbPath, domain));
   if (row?.native.isOpen) return row;
   if (cwd !== void 0) return null;
@@ -30189,7 +30547,7 @@ function peekProjectDomain(domain, cwd) {
   return sole ?? null;
 }
 function peekGlobalDomain(domain) {
-  const dbPath = resolve6(resolveDualScopeDbPath("global"));
+  const dbPath = resolve8(resolveDualScopeDbPath("global"));
   const row = _bindings.get(bindingKey("global", dbPath, domain));
   if (!row || !row.native.isOpen) return null;
   return row;
@@ -30200,6 +30558,7 @@ var init_domain_binding = __esm({
     "use strict";
     init_project_scope();
     init_dual_scope_db();
+    init_worktree_build_guard();
     _runtime = null;
     _bindings = /* @__PURE__ */ new Map();
     _inflight = /* @__PURE__ */ new Map();
@@ -30210,9 +30569,9 @@ var init_domain_binding = __esm({
 
 // packages/core/src/telemetry/sqlite.ts
 import { mkdirSync as mkdirSync4 } from "node:fs";
-import { dirname as dirname12, join as join18 } from "node:path";
+import { dirname as dirname14, join as join19 } from "node:path";
 function getTelemetryDbPath() {
-  return join18(getCleoHome(), DB_FILENAME);
+  return join19(getCleoHome(), DB_FILENAME);
 }
 function resolveTelemetryMigrationsFolder() {
   return resolveCorePackageMigrationsFolder("drizzle-telemetry");
@@ -30260,8 +30619,9 @@ async function getTelemetryDb() {
   _initPromise = (async () => {
     const dbPath = requestedPath;
     _dbPath = dbPath;
-    mkdirSync4(dirname12(dbPath), { recursive: true });
+    mkdirSync4(dirname14(dbPath), { recursive: true });
     const nativeDb = openNativeDatabase(dbPath);
+    installSchemaWriteGuard(nativeDb);
     _nativeDb = nativeDb;
     const db = drizzle({ client: nativeDb });
     runTelemetryMigrations(nativeDb, db);
@@ -30282,6 +30642,7 @@ var init_sqlite2 = __esm({
     init_migration_manager();
     init_resolve_migrations_folder();
     init_sqlite3();
+    init_worktree_build_guard();
     DB_FILENAME = "telemetry.db";
     TELEMETRY_SCHEMA_VERSION = "1.0.0";
     _db = null;
@@ -30292,11 +30653,11 @@ var init_sqlite2 = __esm({
 });
 
 // packages/core/src/store/agent-registry-store.ts
-import { existsSync as existsSync14 } from "node:fs";
-import { join as join19 } from "node:path";
+import { existsSync as existsSync15 } from "node:fs";
+import { join as join20 } from "node:path";
 function getGlobalAgentRegistryDbPath() {
   const cleoHome = getCleoHome();
-  const dbPath = join19(cleoHome, "cleo.db");
+  const dbPath = join20(cleoHome, "cleo.db");
   if (!dbPath.startsWith(cleoHome)) {
     throw new Error(
       `BUG: getGlobalAgentRegistryDbPath() resolved to "${dbPath}" which is NOT under getCleoHome() ("${cleoHome}"). The Agent Registry is global-only per ADR-037. This indicates a code path that bypasses path resolution \u2014 fix the caller, do not suppress this error.`
@@ -30363,7 +30724,7 @@ function establishAgentRegistrySchema(native) {
 }
 async function ensureGlobalAgentRegistryDb() {
   const dbPath = getGlobalAgentRegistryDbPath();
-  const alreadyExists = existsSync14(dbPath);
+  const alreadyExists = existsSync15(dbPath);
   let created = false;
   const { native: nativeDb } = await bindGlobalDomainAtPath(
     AGENT_REGISTRY_DOMAIN,
@@ -30408,8 +30769,8 @@ var init_agent_registry_store = __esm({
 });
 
 // packages/core/src/store/conduit-sqlite.ts
-import { existsSync as existsSync15 } from "node:fs";
-import { createRequire as createRequire5 } from "node:module";
+import { existsSync as existsSync16 } from "node:fs";
+import { createRequire as createRequire6 } from "node:module";
 function _getDrizzle() {
   if (_drizzle === null) {
     const mod = _require3("drizzle-orm/node-sqlite");
@@ -30437,7 +30798,7 @@ function runConduitMigrations(nativeDb) {
 }
 async function ensureConduitDb(projectRoot) {
   const dbPath = getConduitDbPath(projectRoot);
-  const alreadyExists = peekProjectDomain("conduit", projectRoot) !== null || existsSync15(dbPath);
+  const alreadyExists = peekProjectDomain("conduit", projectRoot) !== null || existsSync16(dbPath);
   await bindConduitDomain(projectRoot);
   return { action: alreadyExists ? "exists" : "created", path: dbPath };
 }
@@ -30463,7 +30824,8 @@ var init_conduit_sqlite = __esm({
     init_domain_binding();
     init_resolve_migrations_folder();
     init_sqlite_pragmas();
-    _require3 = createRequire5(import.meta.url);
+    init_worktree_build_guard();
+    _require3 = createRequire6(import.meta.url);
     ({ DatabaseSync: DatabaseSync2 } = _require3("node:sqlite"));
     _drizzle = null;
     CONDUIT_SCHEMA_VERSION = "2026.4.23";
@@ -32337,216 +32699,6 @@ var init_memory_schema = __esm({
   }
 });
 
-// packages/core/src/store/snapshot-gate.ts
-import { join as join20 } from "node:path";
-function readGateState(db) {
-  const row = db.prepare("SELECT value FROM tasks_schema_meta WHERE key = ?").get(SNAPSHOT_GATE_META_KEY);
-  const state = { generation: 0, prefixes: {} };
-  if (!row) return state;
-  try {
-    const parsed = JSON.parse(row.value);
-    if (parsed === null || typeof parsed !== "object") return state;
-    if (typeof parsed.generation === "number" && Number.isSafeInteger(parsed.generation)) {
-      state.generation = parsed.generation;
-    }
-    for (const [prefix, e] of Object.entries(parsed.prefixes ?? {})) {
-      if (e && typeof e.generation === "number" && typeof e.startedAt === "number" && typeof e.completedAt === "number") {
-        state.prefixes[prefix] = {
-          generation: e.generation,
-          startedAt: e.startedAt,
-          completedAt: e.completedAt
-        };
-      }
-    }
-  } catch {
-  }
-  return state;
-}
-function writeGateState(db, state) {
-  db.prepare(
-    "INSERT INTO tasks_schema_meta (key, value) VALUES (?, ?) ON CONFLICT(key) DO UPDATE SET value = excluded.value"
-  ).run(SNAPSHOT_GATE_META_KEY, JSON.stringify(state));
-}
-function tryReadGateState(db) {
-  if (!db) return null;
-  try {
-    return readGateState(db);
-  } catch {
-    return null;
-  }
-}
-function needsSnapshot(entry, mode, nowMs, seenGeneration) {
-  if (!entry) return true;
-  if (mode === "required") return seenGeneration === null || entry.generation <= seenGeneration;
-  const elapsed = nowMs - entry.startedAt;
-  return elapsed < 0 || elapsed >= SNAPSHOT_DEBOUNCE_MS;
-}
-async function runGatedSnapshot(opts, snapshot) {
-  const now = opts.now ?? Date.now;
-  const mode = opts.mode ?? "routine";
-  const db = opts.stateDb;
-  const none = (skipped, error) => ({
-    snapshotted: [],
-    linked: [],
-    absent: [],
-    failed: [],
-    skipped,
-    ...error !== void 0 && { error }
-  });
-  const entryState = tryReadGateState(db);
-  const seenGeneration = mode === "required" ? opts.seenGeneration ?? entryState?.generation ?? null : null;
-  if (mode === "routine") {
-    if (!entryState) return none("state-unavailable");
-    const nowMs = now();
-    if (!opts.prefixes.some((p) => needsSnapshot(entryState.prefixes[p], mode, nowMs, null))) {
-      return none("debounced");
-    }
-  }
-  const lockPath2 = join20(opts.backupDir, GATE_LOCK_BASENAME);
-  let release;
-  try {
-    release = await acquireLock(lockPath2, {
-      retries: mode === "required" ? opts.lockWaitRetries ?? SNAPSHOT_LOCK_WAIT_RETRIES : 0,
-      stale: SNAPSHOT_LOCK_STALE_MS,
-      // A compromised lock (e.g. the backup dir was removed) must not throw
-      // from a timer and crash the host process.
-      onCompromised: () => {
-      }
-    });
-  } catch {
-    if (mode === "routine") return none("in-flight");
-    return none(
-      "lock-timeout",
-      `Snapshot lock ${lockPath2}.lock is still held after waiting. Another snapshot is running, or a crashed process left the lock (it expires after ${SNAPSHOT_LOCK_STALE_MS / 6e4} minutes). Remove it if no snapshot is running.`
-    );
-  }
-  try {
-    try {
-      opts.onLockAcquired?.();
-    } catch {
-    }
-    const state = tryReadGateState(db);
-    if (!state && mode === "routine") return none("state-unavailable");
-    const startMs = now();
-    const admitted = mode === "required" && opts.alwaysSnapshot === true ? [...opts.prefixes] : opts.prefixes.filter(
-      (p) => needsSnapshot(state?.prefixes[p], mode, startMs, seenGeneration)
-    );
-    if (admitted.length === 0) return none(mode === "routine" ? "debounced" : "covered");
-    const generation = (state?.generation ?? 0) + 1;
-    let claimed = false;
-    if (db && state) {
-      try {
-        writeGateState(db, { ...state, generation });
-        claimed = true;
-      } catch {
-      }
-    }
-    const snapshotted = [];
-    const linked = [];
-    const absent = [];
-    const failed = [];
-    for (const prefix of admitted) {
-      try {
-        const outcome = await snapshot(prefix);
-        if (outcome === "absent") absent.push(prefix);
-        else {
-          snapshotted.push(prefix);
-          if (outcome === "linked") linked.push(prefix);
-        }
-      } catch {
-        failed.push(prefix);
-      }
-    }
-    const satisfied = [...snapshotted, ...absent];
-    if (db && claimed && satisfied.length > 0) {
-      try {
-        const latest = readGateState(db);
-        const completedAt = now();
-        latest.generation = Math.max(latest.generation, generation);
-        for (const p of satisfied) {
-          latest.prefixes[p] = { generation, startedAt: startMs, completedAt };
-        }
-        writeGateState(db, latest);
-      } catch {
-      }
-    }
-    return { snapshotted, linked, absent, failed, skipped: null };
-  } finally {
-    await release().catch(() => {
-    });
-  }
-}
-function isValidStamp(ymd, hms) {
-  const y = Number(ymd.slice(0, 4));
-  const mo = Number(ymd.slice(4, 6));
-  const d = Number(ymd.slice(6, 8));
-  const h = Number(hms.slice(0, 2));
-  const mi = Number(hms.slice(2, 4));
-  const se = Number(hms.slice(4, 6));
-  if (mo < 1 || mo > 12 || d < 1 || h > 23 || mi > 59 || se > 59) return false;
-  const probe = new Date(Date.UTC(y, mo - 1, d));
-  return probe.getUTCFullYear() === y && probe.getUTCMonth() === mo - 1 && probe.getUTCDate() === d;
-}
-function selectSnapshotsToKeep(names, ctx = {}) {
-  const policy = ctx.policy ?? DEFAULT_SNAPSHOT_RETENTION;
-  const keep = /* @__PURE__ */ new Set();
-  const stamped = [];
-  for (const name2 of names) {
-    const m = STAMP_PATTERN.exec(name2);
-    const ymd = m?.[1];
-    const hms = m?.[2];
-    if (!ymd || !hms || !isValidStamp(ymd, hms)) {
-      keep.add(name2);
-      continue;
-    }
-    const stamp = `${ymd}-${hms}`;
-    if (ctx.nowStamp !== void 0 && stamp > ctx.nowStamp) {
-      keep.add(name2);
-      continue;
-    }
-    stamped.push({ name: name2, stamp });
-  }
-  if (ctx.pinned !== void 0 && names.includes(ctx.pinned)) keep.add(ctx.pinned);
-  stamped.sort((a, b) => a.stamp < b.stamp ? 1 : a.stamp > b.stamp ? -1 : 0);
-  for (const s of stamped.slice(0, policy.latest)) keep.add(s.name);
-  const keepNewestPerBucket = (bucketOf, slots) => {
-    const seen = /* @__PURE__ */ new Set();
-    for (const s of stamped) {
-      const bucket = bucketOf(s.stamp);
-      if (seen.has(bucket)) continue;
-      if (seen.size >= slots) break;
-      seen.add(bucket);
-      keep.add(s.name);
-    }
-  };
-  keepNewestPerBucket(
-    (stamp) => `${stamp.slice(0, 11)}q${Math.floor(Number(stamp.slice(11, 13)) / 15)}`,
-    policy.quarterHourly
-  );
-  keepNewestPerBucket((stamp) => stamp.slice(0, 11), policy.hourly);
-  keepNewestPerBucket((stamp) => stamp.slice(0, 8), policy.daily);
-  return keep;
-}
-var SNAPSHOT_DEBOUNCE_MS, SNAPSHOT_LOCK_STALE_MS, SNAPSHOT_LOCK_WAIT_RETRIES, SNAPSHOT_GATE_META_KEY, GATE_LOCK_BASENAME, DEFAULT_SNAPSHOT_RETENTION, STAMP_PATTERN;
-var init_snapshot_gate = __esm({
-  "packages/core/src/store/snapshot-gate.ts"() {
-    "use strict";
-    init_lock();
-    SNAPSHOT_DEBOUNCE_MS = 5 * 6e4;
-    SNAPSHOT_LOCK_STALE_MS = 10 * 6e4;
-    SNAPSHOT_LOCK_WAIT_RETRIES = 90;
-    SNAPSHOT_GATE_META_KEY = "sqlite_snapshot_gate";
-    GATE_LOCK_BASENAME = ".snapshot-gate";
-    DEFAULT_SNAPSHOT_RETENTION = {
-      latest: 1,
-      quarterHourly: 3,
-      hourly: 3,
-      daily: 3
-    };
-    STAMP_PATTERN = /-(\d{8})-(\d{6})\.db$/;
-  }
-});
-
 // packages/core/src/store/twin-collapse.ts
 import { createHash as createHash3 } from "node:crypto";
 function hasMainTable(db, name2) {
@@ -32623,6 +32775,22 @@ function mergeSchemaMetaValue(key, bare, twin) {
   const field = SCHEMA_META_COUNTER_FIELDS[key];
   return field === void 0 ? bare : withMaxCounter(bare, twin, field);
 }
+function mirrorCounterToBare(db, key) {
+  if (SCHEMA_META_COUNTER_FIELDS[key] === void 0) return;
+  if (!hasMainTable(db, "schema_meta")) return;
+  const twin = readKv(db, "tasks_schema_meta", key);
+  if (twin === void 0) return;
+  const bare = readKv(db, "schema_meta", key);
+  const next = bare === void 0 ? twin : mergeSchemaMetaValue(key, bare, twin);
+  if (next === null || next === bare) return;
+  writeKv(db, "schema_meta", key, next);
+}
+function bareCounterOf(db, key) {
+  const name2 = SCHEMA_META_COUNTER_FIELDS[key];
+  if (name2 === void 0 || !hasMainTable(db, "schema_meta")) return 0;
+  const bare = readKv(db, "schema_meta", key);
+  return (bare === void 0 ? void 0 : counterOf(bare, name2)) ?? 0;
+}
 function kvRows(db, table, schema = "main") {
   const rows = db.prepare(`SELECT key, value FROM ${schema}.${table}`).all();
   return new Map(rows.map((r) => [r.key, r.value]));
@@ -32755,6 +32923,39 @@ function applyStickyRows(db, schema, plan) {
   }
   return { inserted, replaced: 0, deleted };
 }
+function tagsOf(tagsJson) {
+  if (!tagsJson) return [];
+  try {
+    const parsed = JSON.parse(tagsJson);
+    if (!Array.isArray(parsed)) return [];
+    return [...new Set(parsed.filter((t) => typeof t === "string" && t.length > 0))];
+  } catch {
+    return [];
+  }
+}
+function syncStickyJunction(db, schema) {
+  const notes = db.prepare("SELECT id, tags_json FROM main.brain_sticky_notes").all();
+  const have = /* @__PURE__ */ new Map();
+  for (const r of db.prepare(`SELECT sticky_id, tag FROM ${schema}.brain_sticky_tags`).all()) {
+    const set = have.get(r.sticky_id) ?? /* @__PURE__ */ new Set();
+    set.add(r.tag);
+    have.set(r.sticky_id, set);
+  }
+  const insert = db.prepare(
+    `INSERT OR IGNORE INTO ${schema}.brain_sticky_tags (sticky_id, tag) VALUES (?, ?)`
+  );
+  const del = db.prepare(`DELETE FROM ${schema}.brain_sticky_tags WHERE sticky_id = ? AND tag = ?`);
+  let inserted = 0;
+  let deleted = 0;
+  for (const note of notes) {
+    const want = new Set(tagsOf(note.tags_json));
+    const current = have.get(note.id) ?? /* @__PURE__ */ new Set();
+    for (const tag of want)
+      if (!current.has(tag)) inserted += Number(insert.run(note.id, tag).changes);
+    for (const tag of current) if (!want.has(tag)) deleted += Number(del.run(note.id, tag).changes);
+  }
+  return { inserted, deleted };
+}
 function twinCollapseFailureOf(db) {
   return degraded.get(db);
 }
@@ -32964,7 +33165,7 @@ function collapseTwinTables(nativeDb, dbPath, options = {}) {
   }
   return inOrder();
 }
-var log6, TWIN_COLLAPSE_MARKER_PREFIX, TWIN_COLLAPSE_FAILURE_PREFIX, SCHEMA_META_COUNTER_FIELDS, SCHEMA_META_NEVER_DELETED, MAX_CONFLICTS, sha, ABSENT, hashMap, emptyPlan, SCHEMA_META, hashSets, EMPTY_SET, STICKY_TAGS, PAIRS, degraded, SHADOW_WRITE_REFUSED, SHADOW_WRITE_OPS;
+var log6, TWIN_COLLAPSE_MARKER_PREFIX, TWIN_COLLAPSE_FAILURE_PREFIX, SNAPSHOT_GATE_KEY, SCHEMA_META_COUNTER_FIELDS, SCHEMA_META_NEVER_DELETED, MAX_CONFLICTS, sha, ABSENT, hashMap, emptyPlan, SCHEMA_META, hashSets, EMPTY_SET, STICKY_TAGS, PAIRS, degraded, SHADOW_WRITE_REFUSED, SHADOW_WRITE_OPS;
 var init_twin_collapse = __esm({
   "packages/core/src/store/twin-collapse.ts"() {
     "use strict";
@@ -32972,18 +33173,18 @@ var init_twin_collapse = __esm({
     init_errors2();
     init_logger2();
     init_pre_repair_snapshot();
-    init_snapshot_gate();
     log6 = getLogger("twin-collapse");
     TWIN_COLLAPSE_MARKER_PREFIX = "twin_collapse:";
     TWIN_COLLAPSE_FAILURE_PREFIX = "twin_collapse_failed:";
+    SNAPSHOT_GATE_KEY = "sqlite_snapshot_gate";
     SCHEMA_META_COUNTER_FIELDS = {
       task_id_sequence: "counter",
-      [SNAPSHOT_GATE_META_KEY]: "generation",
+      [SNAPSHOT_GATE_KEY]: "generation",
       file_meta: "generation"
     };
     SCHEMA_META_NEVER_DELETED = /* @__PURE__ */ new Set([
       "task_id_sequence",
-      SNAPSHOT_GATE_META_KEY
+      SNAPSHOT_GATE_KEY
     ]);
     MAX_CONFLICTS = 50;
     sha = (value) => createHash3("sha256").update(value).digest("hex");
@@ -33048,7 +33249,12 @@ var init_twin_collapse = __esm({
           throw new Error(
             `sticky_tags collapse did not verify: ${missing} missing, ${lingering} not removed`
           );
-        return counts;
+        const synced = syncStickyJunction(db, "main");
+        return {
+          inserted: counts.inserted + synced.inserted,
+          replaced: 0,
+          deleted: counts.deleted + synced.deleted
+        };
       },
       shadow(db, plan) {
         db.exec(
@@ -33059,6 +33265,7 @@ var init_twin_collapse = __esm({
           "INSERT INTO temp.brain_sticky_tags (sticky_id, tag) SELECT sticky_id, tag FROM main.brain_sticky_tags"
         );
         applyStickyRows(db, "temp", plan);
+        syncStickyJunction(db, "temp");
       }
     };
     PAIRS = [SCHEMA_META, STICKY_TAGS];
@@ -33090,7 +33297,7 @@ __export(config_exports, {
   parseConfigValue: () => parseConfigValue,
   setConfigValue: () => setConfigValue
 });
-import { existsSync as existsSync16 } from "node:fs";
+import { existsSync as existsSync17 } from "node:fs";
 function getNestedValue(obj, path2) {
   const parts = path2.split(".");
   let current = obj;
@@ -33212,7 +33419,7 @@ function parseConfigValue(value) {
 }
 async function setConfigValue(key, value, cwd, opts) {
   const configPath = opts?.global ? getGlobalConfigPath() : getConfigPath(cwd);
-  if (!existsSync16(configPath)) {
+  if (!existsSync17(configPath)) {
     await atomicWriteJson(configPath, {});
   }
   const config = await readJson(configPath) ?? {};
@@ -33224,7 +33431,7 @@ async function setConfigValue(key, value, cwd, opts) {
 async function applyStrictnessPreset(preset, cwd, opts) {
   const definition = STRICTNESS_PRESETS[preset];
   const configPath = opts?.global ? getGlobalConfigPath() : getConfigPath(cwd);
-  if (!existsSync16(configPath)) {
+  if (!existsSync17(configPath)) {
     await atomicWriteJson(configPath, {});
   }
   const config = await readJson(configPath) ?? {};
@@ -33801,6 +34008,7 @@ var init_cross_db_cleanup = __esm({
     "use strict";
     init_memory_sqlite();
     init_memory_schema();
+    init_worktree_build_guard();
   }
 });
 
@@ -38493,7 +38701,7 @@ __export(sqlite_data_accessor_exports, {
   setMetaValue: () => setMetaValue
 });
 import { AsyncLocalStorage as AsyncLocalStorage6 } from "node:async_hooks";
-import { resolve as resolve7 } from "node:path";
+import { resolve as resolve9 } from "node:path";
 import {
   and as and5,
   eq as eq6,
@@ -38533,9 +38741,12 @@ async function writeMetaValue(cwd, key, value) {
     target: tasksSchemaMeta.key,
     set: { value: json }
   }).run();
+  const native = getNativeTasksDb(cwd);
+  if (native) mirrorCounterToBare(native, key);
 }
 function advanceTaskIdSequence(nativeDb, floor) {
   assertTwinCollapseWritable(nativeDb);
+  const lowest = Math.max(floor, bareCounterOf(nativeDb, "task_id_sequence"));
   nativeDb.prepare(`
       UPDATE tasks_schema_meta
       SET value = json_set(value,
@@ -38544,7 +38755,8 @@ function advanceTaskIdSequence(nativeDb, floor) {
         '$.checksum', 'alloc-' || strftime('%s','now')
       )
       WHERE key = 'task_id_sequence'
-    `).run(floor, floor);
+    `).run(lowest, lowest);
+  mirrorCounterToBare(nativeDb, "task_id_sequence");
   const row = nativeDb.prepare(`
       SELECT json_extract(value, '$.counter') AS counter
       FROM tasks_schema_meta WHERE key = 'task_id_sequence'
@@ -38598,7 +38810,7 @@ function bindTaskAccessorScope(accessor, scope) {
 }
 async function createSqliteDataAccessor(cwd) {
   const scope = captureProjectScope(
-    resolve7(cwd ?? getProjectRoot()),
+    resolve9(cwd ?? getProjectRoot()),
     worktreeScope.getStore()
   );
   return worktreeScope.run(
@@ -38713,7 +38925,9 @@ async function createOwnedSqliteDataAccessor(cwd, accessorScope) {
             actor: entry.actor ?? "system",
             detailsJson: entry.details ? JSON.stringify(entry.details) : "{}",
             beforeJson: entry.before ? JSON.stringify(entry.before) : null,
-            afterJson: entry.after ? JSON.stringify(entry.after) : null
+            afterJson: entry.after ? JSON.stringify(entry.after) : null,
+            // T12693: the session a ranking change ran in.
+            sessionId: typeof entry.sessionId === "string" ? entry.sessionId : null
           }).run()
         );
       });
@@ -38721,6 +38935,9 @@ async function createOwnedSqliteDataAccessor(cwd, accessorScope) {
     async queryAuditLog(query) {
       const db = await getDb(cwd);
       const conditions = [];
+      if (query.ids && query.ids.length > 0) {
+        conditions.push(inArray4(tasksAuditLog.id, [...query.ids]));
+      }
       if (query.taskIds && query.taskIds.length > 0) {
         conditions.push(inArray4(tasksAuditLog.taskId, [...query.taskIds]));
       }
@@ -38739,7 +38956,8 @@ async function createOwnedSqliteDataAccessor(cwd, accessorScope) {
         actor: tasksAuditLog.actor,
         detailsJson: tasksAuditLog.detailsJson,
         beforeJson: tasksAuditLog.beforeJson,
-        afterJson: tasksAuditLog.afterJson
+        afterJson: tasksAuditLog.afterJson,
+        sessionId: tasksAuditLog.sessionId
       }).from(tasksAuditLog).where(conditions.length > 0 ? and5(...conditions) : void 0).orderBy(sql26`${tasksAuditLog.timestamp} DESC`).limit(limit).all();
       return rows.map((row) => ({
         id: row.id,
@@ -38749,7 +38967,8 @@ async function createOwnedSqliteDataAccessor(cwd, accessorScope) {
         actor: row.actor,
         detailsJson: row.detailsJson ?? null,
         beforeJson: row.beforeJson ?? null,
-        afterJson: row.afterJson ?? null
+        afterJson: row.afterJson ?? null,
+        sessionId: row.sessionId ?? null
       }));
     },
     // ---- Fine-grained task operations (T5034) ----
@@ -39587,7 +39806,7 @@ var init_sqlite_data_accessor = __esm({
 });
 
 // packages/core/src/sequence/index.ts
-import { existsSync as existsSync17, readFileSync as readFileSync5, renameSync as renameSync5 } from "node:fs";
+import { existsSync as existsSync18, readFileSync as readFileSync6, renameSync as renameSync5 } from "node:fs";
 import { join as join21 } from "node:path";
 function getLegacySequenceJsonPath(cwd) {
   return join21(resolveOrCwd(cwd), ".cleo", ".sequence.json");
@@ -39604,19 +39823,19 @@ function isSeedSequence(value) {
   return value.counter === 0 && value.lastId === "T000" && value.checksum === "seed";
 }
 function readLegacySequenceFile(path2) {
-  if (!existsSync17(path2)) return null;
+  if (!existsSync18(path2)) return null;
   try {
-    const parsed = JSON.parse(readFileSync5(path2, "utf-8"));
+    const parsed = JSON.parse(readFileSync6(path2, "utf-8"));
     return isValidSequenceState(parsed) ? parsed : null;
   } catch {
     return null;
   }
 }
 function renameLegacyFile(path2) {
-  if (!existsSync17(path2)) return;
+  if (!existsSync18(path2)) return;
   const migratedPath = `${path2}.migrated`;
   try {
-    if (!existsSync17(migratedPath)) {
+    if (!existsSync18(migratedPath)) {
       renameSync5(path2, migratedPath);
       return;
     }
@@ -39782,12 +40001,12 @@ var init_checkpoint_git_dir = __esm({
 
 // packages/core/src/store/git-checkpoint.ts
 import { execFile as execFile2 } from "node:child_process";
-import { existsSync as existsSync18 } from "node:fs";
+import { existsSync as existsSync19 } from "node:fs";
 import { readFile as readFile4, writeFile } from "node:fs/promises";
-import { join as join23, resolve as resolve8 } from "node:path";
+import { join as join23, resolve as resolve10 } from "node:path";
 import { promisify as promisify2 } from "node:util";
 function makeCleoGitEnv(cleoDir) {
-  const abs = resolve8(cleoDir);
+  const abs = resolve10(cleoDir);
   return {
     ...process.env,
     GIT_DIR: checkpointGitDir(abs),
@@ -39797,7 +40016,7 @@ function makeCleoGitEnv(cleoDir) {
 async function cleoGitCommand(args, cleoDir) {
   try {
     const result = await execFileAsync2("git", args, {
-      cwd: resolve8(cleoDir),
+      cwd: resolve10(cleoDir),
       // absolute cwd so relative paths in args resolve correctly
       env: makeCleoGitEnv(cleoDir),
       timeout: 1e4
@@ -39808,7 +40027,7 @@ async function cleoGitCommand(args, cleoDir) {
   }
 }
 function isCleoGitInitialized(cleoDir) {
-  return existsSync18(join23(checkpointGitDir(cleoDir), "HEAD"));
+  return existsSync19(join23(checkpointGitDir(cleoDir), "HEAD"));
 }
 async function loadStateFileAllowlist(cwd) {
   try {
@@ -39852,14 +40071,14 @@ async function isCleoGitRepo(cleoDir) {
   return result.success && (result.stdout === "true" || isCleoGitInitialized(cleoDir));
 }
 function isMergeInProgress(cleoDir) {
-  return existsSync18(join23(checkpointGitDir(cleoDir), "MERGE_HEAD"));
+  return existsSync19(join23(checkpointGitDir(cleoDir), "MERGE_HEAD"));
 }
 async function isDetachedHead(cleoDir) {
   const result = await cleoGitCommand(["symbolic-ref", "HEAD"], cleoDir);
   return !result.success;
 }
 function isRebaseInProgress(cleoDir) {
-  return existsSync18(join23(checkpointGitDir(cleoDir), "rebase-merge")) || existsSync18(join23(checkpointGitDir(cleoDir), "rebase-apply"));
+  return existsSync19(join23(checkpointGitDir(cleoDir), "rebase-merge")) || existsSync19(join23(checkpointGitDir(cleoDir), "rebase-apply"));
 }
 async function recordCheckpointTime(cleoDir) {
   try {
@@ -39883,7 +40102,7 @@ async function getChangedStateFiles(cleoDir, cwd) {
   const allStateFiles = await getAllStateFiles(cwd);
   for (const stateFile of allStateFiles) {
     const fullPath = join23(cleoDir, stateFile);
-    if (!existsSync18(fullPath)) continue;
+    if (!existsSync19(fullPath)) continue;
     const diffResult = await cleoGitCommand(["diff", "--quiet", "--", stateFile], cleoDir);
     const cachedResult = await cleoGitCommand(
       ["diff", "--cached", "--quiet", "--", stateFile],
@@ -39910,7 +40129,7 @@ async function shouldCheckpoint(options) {
   const config = await loadCheckpointConfig(cwd);
   if (!config.enabled) return false;
   const cleoDir = getCleoDir(cwd);
-  if (!existsSync18(cleoDir)) return false;
+  if (!existsSync19(cleoDir)) return false;
   if (!isCleoGitInitialized(cleoDir)) return false;
   if (!await isCleoGitRepo(cleoDir)) return false;
   if (isMergeInProgress(cleoDir)) return false;
@@ -39983,6 +40202,218 @@ var init_git_checkpoint = __esm({
   }
 });
 
+// packages/core/src/store/snapshot-gate.ts
+import { join as join24 } from "node:path";
+function readGateState(db) {
+  const row = db.prepare("SELECT value FROM tasks_schema_meta WHERE key = ?").get(SNAPSHOT_GATE_META_KEY);
+  const state = { generation: 0, prefixes: {} };
+  if (!row) return state;
+  try {
+    const parsed = JSON.parse(row.value);
+    if (parsed === null || typeof parsed !== "object") return state;
+    if (typeof parsed.generation === "number" && Number.isSafeInteger(parsed.generation)) {
+      state.generation = parsed.generation;
+    }
+    for (const [prefix, e] of Object.entries(parsed.prefixes ?? {})) {
+      if (e && typeof e.generation === "number" && typeof e.startedAt === "number" && typeof e.completedAt === "number") {
+        state.prefixes[prefix] = {
+          generation: e.generation,
+          startedAt: e.startedAt,
+          completedAt: e.completedAt
+        };
+      }
+    }
+  } catch {
+  }
+  return state;
+}
+function writeGateState(db, state) {
+  db.prepare(
+    "INSERT INTO tasks_schema_meta (key, value) VALUES (?, ?) ON CONFLICT(key) DO UPDATE SET value = excluded.value"
+  ).run(SNAPSHOT_GATE_META_KEY, JSON.stringify(state));
+  mirrorCounterToBare(db, SNAPSHOT_GATE_META_KEY);
+}
+function tryReadGateState(db) {
+  if (!db) return null;
+  try {
+    return readGateState(db);
+  } catch {
+    return null;
+  }
+}
+function needsSnapshot(entry, mode, nowMs, seenGeneration) {
+  if (!entry) return true;
+  if (mode === "required") return seenGeneration === null || entry.generation <= seenGeneration;
+  const elapsed = nowMs - entry.startedAt;
+  return elapsed < 0 || elapsed >= SNAPSHOT_DEBOUNCE_MS;
+}
+async function runGatedSnapshot(opts, snapshot) {
+  const now = opts.now ?? Date.now;
+  const mode = opts.mode ?? "routine";
+  const db = opts.stateDb;
+  const none = (skipped, error) => ({
+    snapshotted: [],
+    linked: [],
+    absent: [],
+    failed: [],
+    skipped,
+    ...error !== void 0 && { error }
+  });
+  const entryState = tryReadGateState(db);
+  const seenGeneration = mode === "required" ? opts.seenGeneration ?? entryState?.generation ?? null : null;
+  if (mode === "routine") {
+    if (!entryState) return none("state-unavailable");
+    const nowMs = now();
+    if (!opts.prefixes.some((p) => needsSnapshot(entryState.prefixes[p], mode, nowMs, null))) {
+      return none("debounced");
+    }
+  }
+  const lockPath2 = join24(opts.backupDir, GATE_LOCK_BASENAME);
+  let release;
+  try {
+    release = await acquireLock(lockPath2, {
+      retries: mode === "required" ? opts.lockWaitRetries ?? SNAPSHOT_LOCK_WAIT_RETRIES : 0,
+      stale: SNAPSHOT_LOCK_STALE_MS,
+      // A compromised lock (e.g. the backup dir was removed) must not throw
+      // from a timer and crash the host process.
+      onCompromised: () => {
+      }
+    });
+  } catch {
+    if (mode === "routine") return none("in-flight");
+    return none(
+      "lock-timeout",
+      `Snapshot lock ${lockPath2}.lock is still held after waiting. Another snapshot is running, or a crashed process left the lock (it expires after ${SNAPSHOT_LOCK_STALE_MS / 6e4} minutes). Remove it if no snapshot is running.`
+    );
+  }
+  try {
+    try {
+      opts.onLockAcquired?.();
+    } catch {
+    }
+    const state = tryReadGateState(db);
+    if (!state && mode === "routine") return none("state-unavailable");
+    const startMs = now();
+    const admitted = mode === "required" && opts.alwaysSnapshot === true ? [...opts.prefixes] : opts.prefixes.filter(
+      (p) => needsSnapshot(state?.prefixes[p], mode, startMs, seenGeneration)
+    );
+    if (admitted.length === 0) return none(mode === "routine" ? "debounced" : "covered");
+    const generation = (state?.generation ?? 0) + 1;
+    let claimed = false;
+    if (db && state) {
+      try {
+        writeGateState(db, { ...state, generation });
+        claimed = true;
+      } catch {
+      }
+    }
+    const snapshotted = [];
+    const linked = [];
+    const absent = [];
+    const failed = [];
+    for (const prefix of admitted) {
+      try {
+        const outcome = await snapshot(prefix);
+        if (outcome === "absent") absent.push(prefix);
+        else {
+          snapshotted.push(prefix);
+          if (outcome === "linked") linked.push(prefix);
+        }
+      } catch {
+        failed.push(prefix);
+      }
+    }
+    const satisfied = [...snapshotted, ...absent];
+    if (db && claimed && satisfied.length > 0) {
+      try {
+        const latest = readGateState(db);
+        const completedAt = now();
+        latest.generation = Math.max(latest.generation, generation);
+        for (const p of satisfied) {
+          latest.prefixes[p] = { generation, startedAt: startMs, completedAt };
+        }
+        writeGateState(db, latest);
+      } catch {
+      }
+    }
+    return { snapshotted, linked, absent, failed, skipped: null };
+  } finally {
+    await release().catch(() => {
+    });
+  }
+}
+function isValidStamp(ymd, hms) {
+  const y = Number(ymd.slice(0, 4));
+  const mo = Number(ymd.slice(4, 6));
+  const d = Number(ymd.slice(6, 8));
+  const h = Number(hms.slice(0, 2));
+  const mi = Number(hms.slice(2, 4));
+  const se = Number(hms.slice(4, 6));
+  if (mo < 1 || mo > 12 || d < 1 || h > 23 || mi > 59 || se > 59) return false;
+  const probe = new Date(Date.UTC(y, mo - 1, d));
+  return probe.getUTCFullYear() === y && probe.getUTCMonth() === mo - 1 && probe.getUTCDate() === d;
+}
+function selectSnapshotsToKeep(names, ctx = {}) {
+  const policy = ctx.policy ?? DEFAULT_SNAPSHOT_RETENTION;
+  const keep = /* @__PURE__ */ new Set();
+  const stamped = [];
+  for (const name2 of names) {
+    const m = STAMP_PATTERN.exec(name2);
+    const ymd = m?.[1];
+    const hms = m?.[2];
+    if (!ymd || !hms || !isValidStamp(ymd, hms)) {
+      keep.add(name2);
+      continue;
+    }
+    const stamp = `${ymd}-${hms}`;
+    if (ctx.nowStamp !== void 0 && stamp > ctx.nowStamp) {
+      keep.add(name2);
+      continue;
+    }
+    stamped.push({ name: name2, stamp });
+  }
+  if (ctx.pinned !== void 0 && names.includes(ctx.pinned)) keep.add(ctx.pinned);
+  stamped.sort((a, b) => a.stamp < b.stamp ? 1 : a.stamp > b.stamp ? -1 : 0);
+  for (const s of stamped.slice(0, policy.latest)) keep.add(s.name);
+  const keepNewestPerBucket = (bucketOf, slots) => {
+    const seen = /* @__PURE__ */ new Set();
+    for (const s of stamped) {
+      const bucket = bucketOf(s.stamp);
+      if (seen.has(bucket)) continue;
+      if (seen.size >= slots) break;
+      seen.add(bucket);
+      keep.add(s.name);
+    }
+  };
+  keepNewestPerBucket(
+    (stamp) => `${stamp.slice(0, 11)}q${Math.floor(Number(stamp.slice(11, 13)) / 15)}`,
+    policy.quarterHourly
+  );
+  keepNewestPerBucket((stamp) => stamp.slice(0, 11), policy.hourly);
+  keepNewestPerBucket((stamp) => stamp.slice(0, 8), policy.daily);
+  return keep;
+}
+var SNAPSHOT_DEBOUNCE_MS, SNAPSHOT_LOCK_STALE_MS, SNAPSHOT_LOCK_WAIT_RETRIES, SNAPSHOT_GATE_META_KEY, GATE_LOCK_BASENAME, DEFAULT_SNAPSHOT_RETENTION, STAMP_PATTERN;
+var init_snapshot_gate = __esm({
+  "packages/core/src/store/snapshot-gate.ts"() {
+    "use strict";
+    init_lock();
+    init_twin_collapse();
+    SNAPSHOT_DEBOUNCE_MS = 5 * 6e4;
+    SNAPSHOT_LOCK_STALE_MS = 10 * 6e4;
+    SNAPSHOT_LOCK_WAIT_RETRIES = 90;
+    SNAPSHOT_GATE_META_KEY = "sqlite_snapshot_gate";
+    GATE_LOCK_BASENAME = ".snapshot-gate";
+    DEFAULT_SNAPSHOT_RETENTION = {
+      latest: 1,
+      quarterHourly: 3,
+      hourly: 3,
+      daily: 3
+    };
+    STAMP_PATTERN = /-(\d{8})-(\d{6})\.db$/;
+  }
+});
+
 // packages/core/src/store/data-safety-central.ts
 import { eq as eq7 } from "drizzle-orm";
 function inSafetyScope(cwd, operation) {
@@ -40393,7 +40824,7 @@ __export(data_accessor_exports, {
   getAccessorDb: () => getAccessorDb,
   getTaskAccessor: () => getTaskAccessor
 });
-import { resolve as resolve9 } from "node:path";
+import { resolve as resolve11 } from "node:path";
 function assertTestEnv(dbPath) {
   const testMode = process.env["CLEO_TEST_MODE"];
   if (testMode !== "1") return;
@@ -40414,7 +40845,7 @@ function assertTestEnv(dbPath) {
   }
 }
 async function createDataAccessor(cwd) {
-  const root = resolve9(cwd ?? getProjectRoot());
+  const root = resolve11(cwd ?? getProjectRoot());
   const inherited = worktreeScope.getStore();
   const captured = inherited ? { ...inherited } : void 0;
   captured?.execution?.assertActive();
@@ -40458,7 +40889,7 @@ __export(memory_sqlite_exports, {
   resetBrainDbState: () => resetBrainDbState,
   resolveBrainMigrationsFolder: () => resolveBrainMigrationsFolder
 });
-import { createRequire as createRequire6 } from "node:module";
+import { createRequire as createRequire7 } from "node:module";
 function _getDrizzle2() {
   if (_drizzle2 === null) {
     const mod = _require4("drizzle-orm/node-sqlite");
@@ -40595,7 +41026,7 @@ var init_memory_sqlite = __esm({
     init_resolve_migrations_folder();
     init_memory_schema();
     init_twin_collapse();
-    _require4 = createRequire6(import.meta.url);
+    _require4 = createRequire7(import.meta.url);
     _drizzle2 = null;
     BRAIN_SCHEMA_VERSION = "1.0.0";
     CONSOLIDATED_BRAIN_TABLES = [
@@ -40783,11 +41214,11 @@ var init_skills_schema = __esm({
 });
 
 // packages/core/src/store/skills-db.ts
-import { join as join24 } from "node:path";
+import { join as join25 } from "node:path";
 import { and as and6, eq as eq8 } from "drizzle-orm";
 function getDefaultSkillsDbPath() {
   const cleoHome = getCleoHome();
-  const dbPath = join24(cleoHome, "cleo.db");
+  const dbPath = join25(cleoHome, "cleo.db");
   if (!dbPath.startsWith(cleoHome)) {
     throw new Error(
       `BUG: getDefaultSkillsDbPath() resolved to "${dbPath}" which is NOT under getCleoHome() ("${cleoHome}"). The skills registry is global-only per SG-CLEO-SKILLS-architecture-v3.md \xA74. Fix the caller, do not suppress.`
@@ -40835,19 +41266,19 @@ import {
   chmodSync,
   closeSync,
   copyFileSync as copyFileSync3,
-  existsSync as existsSync19,
+  existsSync as existsSync20,
   fsyncSync,
   linkSync,
   mkdirSync as mkdirSync5,
   openSync,
   readdirSync as readdirSync5,
-  realpathSync as realpathSync6,
+  realpathSync as realpathSync7,
   renameSync as renameSync6,
   rmSync,
   statSync as statSync6,
   unlinkSync as unlinkSync3
 } from "node:fs";
-import { dirname as dirname13, join as join25, sep as sep3 } from "node:path";
+import { dirname as dirname15, join as join26, sep as sep4 } from "node:path";
 function resolveInventoryPath(entry, cwd) {
   try {
     if (entry.tier === "global") {
@@ -40883,8 +41314,8 @@ async function openAgentRegistryDbForSnapshot() {
 }
 async function openTelemetryDbForSnapshot() {
   try {
-    const path2 = join25(getCleoHome(), "telemetry.db");
-    if (!existsSync19(path2)) return null;
+    const path2 = join26(getCleoHome(), "telemetry.db");
+    if (!existsSync20(path2)) return null;
   } catch {
     return null;
   }
@@ -40996,7 +41427,7 @@ function rotateSnapshots(backupDir, prefix, justWritten) {
     for (const name2 of names) {
       if (keep.has(name2)) continue;
       try {
-        unlinkSync3(join25(backupDir, name2));
+        unlinkSync3(join26(backupDir, name2));
       } catch {
       }
     }
@@ -41018,7 +41449,7 @@ async function snapshotProjectTargetsGated(targets, opts) {
   let backupDir;
   try {
     const cleoDir = getCleoDir(cwd);
-    backupDir = join25(cleoDir, "backups", "sqlite");
+    backupDir = join26(cleoDir, "backups", "sqlite");
     mkdirSync5(backupDir, { recursive: true });
   } catch {
     return null;
@@ -41050,7 +41481,7 @@ function sourceFileOf(db) {
   const location = db.location();
   if (!location) return null;
   try {
-    return realpathSync6(location);
+    return realpathSync7(location);
   } catch {
     return location;
   }
@@ -41061,10 +41492,10 @@ function hasLocation(db) {
 function assertOwnedByProject(source, prefix, cwd) {
   let cleoDir = getCleoDir(cwd);
   try {
-    cleoDir = realpathSync6(cleoDir);
+    cleoDir = realpathSync7(cleoDir);
   } catch {
   }
-  if (!source.startsWith(cleoDir + sep3)) {
+  if (!source.startsWith(cleoDir + sep4)) {
     throw new Error(
       `refusing to snapshot ${prefix}: its database ${source} is not inside ${cleoDir}`
     );
@@ -41093,7 +41524,7 @@ function commitSnapshotFile(tmp, dest) {
   }
   renameSync6(tmp, dest);
   try {
-    const dirFd = openSync(dirname13(dest), "r");
+    const dirFd = openSync(dirname15(dest), "r");
     try {
       fsyncSync(dirFd);
     } finally {
@@ -41116,7 +41547,7 @@ function removeDeadTempSnapshots(backupDir) {
       const m = TEMP_SNAPSHOT_RE.exec(name2);
       if (!m) continue;
       const pid = Number(m[1]);
-      const path2 = join25(backupDir, name2);
+      const path2 = join26(backupDir, name2);
       const stale = pid !== process.pid && (!isPidAlive2(pid) || Date.now() - statSync6(path2).mtimeMs > TEMP_SNAPSHOT_MAX_AGE_MS);
       if (stale) rmSync(path2, { force: true });
     }
@@ -41126,7 +41557,7 @@ function removeDeadTempSnapshots(backupDir) {
 async function freeSnapshotName(backupDir, prefix) {
   for (let attempt = 0; attempt < SNAPSHOT_NAME_ATTEMPTS; attempt++) {
     const name2 = `${prefix}-${formatTimestamp(/* @__PURE__ */ new Date())}.db`;
-    if (!existsSync19(join25(backupDir, name2))) return name2;
+    if (!existsSync20(join26(backupDir, name2))) return name2;
     await new Promise((r) => setTimeout(r, 1e3 - Date.now() % 1e3 + 5));
   }
   throw new Error(`no free snapshot filename for ${prefix} in ${backupDir}`);
@@ -41154,7 +41585,7 @@ async function snapshotOne(target, backupDir, writtenBySource, cwd) {
     if (opened && target.closeDb) target.closeDb(opened);
     throw err;
   }
-  const dest = join25(backupDir, destName);
+  const dest = join26(backupDir, destName);
   removeDeadTempSnapshots(backupDir);
   const existing = source !== null ? writtenBySource.get(source) : void 0;
   if (existing !== void 0) {
@@ -41208,13 +41639,13 @@ async function vacuumIntoBackup(opts = {}) {
 function listSqliteBackupsForPrefix(prefix, cwd) {
   try {
     const cleoDir = getCleoDir(cwd);
-    const backupDir = join25(cleoDir, "backups", "sqlite");
-    if (!existsSync19(backupDir)) return [];
+    const backupDir = join26(cleoDir, "backups", "sqlite");
+    if (!existsSync20(backupDir)) return [];
     const pattern = snapshotPattern(prefix);
     return readdirSync5(backupDir).filter((f) => pattern.test(f)).map((f) => ({
       name: f,
-      path: join25(backupDir, f),
-      mtimeMs: statSync6(join25(backupDir, f)).mtimeMs
+      path: join26(backupDir, f),
+      mtimeMs: statSync6(join26(backupDir, f)).mtimeMs
     })).sort((a, b) => b.mtimeMs - a.mtimeMs);
   } catch {
     return [];
@@ -41284,15 +41715,16 @@ __export(sqlite_exports, {
   resetDbState: () => resetDbState,
   resolveMigrationsFolder: () => resolveMigrationsFolder,
   schema: () => tasks_schema_exports,
-  seedTasksMeta: () => seedTasksMeta
+  seedTasksMeta: () => seedTasksMeta,
+  worktreeRecoveryRefusal: () => worktreeRecoveryRefusal
 });
-import { copyFileSync as copyFileSync4, existsSync as existsSync20, realpathSync as realpathSync7, renameSync as renameSync7, unlinkSync as unlinkSync4 } from "node:fs";
-import { createRequire as createRequire7 } from "node:module";
-import { basename as basename8, dirname as dirname14, resolve as resolve10 } from "node:path";
+import { copyFileSync as copyFileSync4, existsSync as existsSync21, realpathSync as realpathSync8, renameSync as renameSync7, unlinkSync as unlinkSync4 } from "node:fs";
+import { createRequire as createRequire8 } from "node:module";
+import { basename as basename8, dirname as dirname16, resolve as resolve12 } from "node:path";
 import { eq as eq9 } from "drizzle-orm";
 function _getDrizzle3() {
   if (_drizzle3 === null) {
-    const _require7 = createRequire7(import.meta.url);
+    const _require7 = createRequire8(import.meta.url);
     const mod = _require7("drizzle-orm/node-sqlite");
     _drizzle3 = mod.drizzle;
   }
@@ -41328,13 +41760,19 @@ function countBackupTasks(backupDb) {
   return 0;
 }
 function isSameDirectory(a, b) {
-  if (resolve10(a) === resolve10(b)) return true;
+  if (resolve12(a) === resolve12(b)) return true;
   try {
-    return realpathSync7(a) === realpathSync7(b);
+    return realpathSync8(a) === realpathSync8(b);
   } catch {
     return false;
   }
 }
+function worktreeRecoveryRefusal(dbPath) {
+  const storeCleoDir = dirname16(dbPath);
+  const root = dirname16(storeCleoDir);
+  if (basename8(storeCleoDir) !== ".cleo" || !isGitLinkedCheckout(root)) return null;
+  return `Auto-recovery refused: ${dbPath} lives inside the git worktree ${root}; ${describeWorktreeOwner(root)}. A worktree uses its owning project's store and never receives a restored copy (T12460, T12677).`;
+}
 async function autoRecoverFromBackup(nativeDb, dbPath, cwd) {
   const { openNativeDatabase: openNativeDatabase2 } = await Promise.resolve().then(() => (init_sqlite_native(), sqlite_native_exports));
   const log15 = getLogger("sqlite");
@@ -41343,12 +41781,10 @@ async function autoRecoverFromBackup(nativeDb, dbPath, cwd) {
     const countResult = nativeDb.prepare("SELECT COUNT(*) as cnt FROM tasks_tasks").get();
     const taskCount = countResult?.cnt ?? 0;
     if (taskCount > 0) return false;
-    const storeCleoDir = dirname14(dbPath);
-    if (basename8(storeCleoDir) === ".cleo" && isGitLinkedCheckout(dirname14(storeCleoDir))) {
-      log15.warn(
-        { dbPath },
-        "Auto-recovery refused: the empty store lives inside a git worktree (T12460). Worktrees must resolve the parent project store."
-      );
+    const storeCleoDir = dirname16(dbPath);
+    const worktreeRefusal = worktreeRecoveryRefusal(dbPath);
+    if (worktreeRefusal !== null) {
+      log15.warn({ dbPath }, worktreeRefusal);
       return false;
     }
     const backups = listSqliteBackups(cwd);
@@ -41356,7 +41792,7 @@ async function autoRecoverFromBackup(nativeDb, dbPath, cwd) {
       return false;
     }
     const newestBackup = backups[0];
-    const backupCleoDir = dirname14(dirname14(dirname14(newestBackup.path)));
+    const backupCleoDir = dirname16(dirname16(dirname16(newestBackup.path)));
     if (!isSameDirectory(backupCleoDir, storeCleoDir)) {
       log15.warn(
         { dbPath, backupPath: newestBackup.path },
@@ -41478,6 +41914,7 @@ function runMigrations(nativeDb, db, dbPath) {
   try {
     migrateWithRetry(db, migrationsFolder, nativeDb, "tasks", "sqlite");
   } catch (error) {
+    if (isWorktreeBuildSchemaError(error)) throw error;
     if (isSqliteBusy(error) || !tableExists(nativeDb, "tasks_tasks")) throw error;
     try {
       rebuildLegacyTasksLineage(
@@ -41519,7 +41956,7 @@ async function getSchemaVersion(cwd) {
   return result[0]?.value ?? null;
 }
 function dbExists(cwd) {
-  return existsSync20(resolveDualScopeDbPath("project", cwd));
+  return existsSync21(resolveDualScopeDbPath("project", cwd));
 }
 function getNativeDb(cwd) {
   return boundProjectNative("tasks", cwd);
@@ -41555,6 +41992,7 @@ var init_sqlite3 = __esm({
     init_resolve_migrations_folder();
     init_sqlite_backup();
     init_twin_collapse();
+    init_worktree_build_guard();
     init_worktree_isolation_guard();
     init_sqlite_native();
     init_tasks_schema();
@@ -41583,15 +42021,15 @@ var init_sqlite3 = __esm({
 // packages/core/src/store/exodus/migrate.ts
 import {
   copyFileSync as copyFileSync5,
-  existsSync as existsSync21,
+  existsSync as existsSync22,
   mkdirSync as mkdirSync6,
-  readFileSync as readFileSync6,
+  readFileSync as readFileSync7,
   renameSync as renameSync8,
   statSync as statSync7,
   unlinkSync as unlinkSync5,
   writeFileSync as writeFileSync6
 } from "node:fs";
-import { join as join26 } from "node:path";
+import { join as join27 } from "node:path";
 function getSqliteVersion(db) {
   try {
     const row = db.prepare("SELECT sqlite_version() AS v").get();
@@ -41622,24 +42060,24 @@ function restoreGrandfatheredGuards(db, suspended) {
   }
 }
 function writeJournal(stagingDir, journal) {
-  const journalPath = join26(stagingDir, JOURNAL_FILENAME);
+  const journalPath = join27(stagingDir, JOURNAL_FILENAME);
   const tmpPath = `${journalPath}.tmp`;
   writeFileSync6(tmpPath, JSON.stringify(journal, null, 2) + "\n", "utf8");
   renameSync8(tmpPath, journalPath);
 }
 function readJournal(stagingDir) {
-  const journalPath = join26(stagingDir, JOURNAL_FILENAME);
-  if (!existsSync21(journalPath)) return null;
+  const journalPath = join27(stagingDir, JOURNAL_FILENAME);
+  if (!existsSync22(journalPath)) return null;
   try {
-    return JSON.parse(readFileSync6(journalPath, "utf8"));
+    return JSON.parse(readFileSync7(journalPath, "utf8"));
   } catch {
     return null;
   }
 }
 function clearExodusJournal(stagingDir) {
-  const journalPath = join26(stagingDir, JOURNAL_FILENAME);
+  const journalPath = join27(stagingDir, JOURNAL_FILENAME);
   try {
-    if (!existsSync21(journalPath)) return false;
+    if (!existsSync22(journalPath)) return false;
     unlinkSync5(journalPath);
     log10.info(
       { stagingDir },
@@ -41935,7 +42373,7 @@ async function runExodusMigrate(plan, forceCrossVersion = false, onProgress, opt
   mkdirSync6(stagingDir, { recursive: true });
   let sqliteVersion = "unknown";
   for (const src of sources) {
-    if (existsSync21(src.path)) {
+    if (existsSync22(src.path)) {
       const snap = openCleoDbSnapshot(src.path, { readOnly: true });
       sqliteVersion = getSqliteVersion(snap.db);
       snap.close();
@@ -41965,15 +42403,15 @@ async function runExodusMigrate(plan, forceCrossVersion = false, onProgress, opt
   let reseedProject = null;
   try {
     for (const src of sources) {
-      if (!existsSync21(src.path)) continue;
-      const backupDest = join26(stagingDir, `${src.name.replace(/[^a-z0-9-]/g, "_")}-backup.db`);
+      if (!existsSync22(src.path)) continue;
+      const backupDest = join27(stagingDir, `${src.name.replace(/[^a-z0-9-]/g, "_")}-backup.db`);
       const srcBytes = safeStatBytes(src.path);
       const skipStagingCopy = srcBytes > plan.stagingCopyThresholdBytes;
       if (skipStagingCopy) {
         onProgress?.(
           `Skipping full staging copy of ${src.name} (${srcBytes} bytes > ${plan.stagingCopyThresholdBytes} threshold) \u2014 source is archived, not deleted, on success.`
         );
-      } else if (!existsSync21(backupDest)) {
+      } else if (!existsSync22(backupDest)) {
         onProgress?.(`Backing up ${src.name} \u2192 staging dir\u2026`);
         copyFileSync5(src.path, backupDest);
         backupPaths.push(backupDest);
@@ -42006,8 +42444,8 @@ async function runExodusMigrate(plan, forceCrossVersion = false, onProgress, opt
     }
     prepareExodusRecovery(projectNative, stagingDir);
     if (globalNative !== null) prepareExodusRecovery(globalNative, stagingDir);
-    const projectSources = sources.filter((s) => s.targetScope === "project" && existsSync21(s.path));
-    const globalSources = sources.filter((s) => s.targetScope === "global" && existsSync21(s.path));
+    const projectSources = sources.filter((s) => s.targetScope === "project" && existsSync22(s.path));
+    const globalSources = sources.filter((s) => s.targetScope === "global" && existsSync22(s.path));
     if (globalNative === null && globalSources.length > 0)
       throw new Error("A projectOnly exodus run was given global-scope sources");
     await migrateScope(
@@ -42315,9 +42753,9 @@ __export(reconcile_exports, {
   reconcileSupersededStores: () => reconcileSupersededStores,
   unmigratedBareSources: () => unmigratedBareSources
 });
-import { copyFileSync as copyFileSync6, existsSync as existsSync22, mkdirSync as mkdirSync7, mkdtempSync, rmSync as rmSync2, writeFileSync as writeFileSync7 } from "node:fs";
+import { copyFileSync as copyFileSync6, existsSync as existsSync23, mkdirSync as mkdirSync7, mkdtempSync, rmSync as rmSync2, writeFileSync as writeFileSync7 } from "node:fs";
 import { tmpdir as tmpdir3 } from "node:os";
-import { basename as basename9, join as join27 } from "node:path";
+import { basename as basename9, join as join28 } from "node:path";
 function ident2(name2) {
   return `"${name2.replace(/"/g, '""')}"`;
 }
@@ -42386,7 +42824,7 @@ function assessSupersededProjectStores(liveStorePath, sources, resolveTarget = r
 }
 function legacySourcesHoldRows(sources) {
   for (const src of sources) {
-    if (!existsSync22(src.path)) continue;
+    if (!existsSync23(src.path)) continue;
     const snap = openCleoDbSnapshot(src.path, { readOnly: true });
     try {
       for (const table of orderTablesForCopy(snap.db)) {
@@ -42417,8 +42855,8 @@ async function bareTaskCoreSource(liveStorePath, resolveTarget, outDir) {
     live.close();
   }
   if (tables.length === 0) return null;
-  const seedPath = await buildFreshProjectStore(join27(outDir, "fresh-project-seed.db"));
-  const path2 = join27(outDir, "cleo-bare-task-core.db");
+  const seedPath = await buildFreshProjectStore(join28(outDir, "fresh-project-seed.db"));
+  const path2 = join28(outDir, "cleo-bare-task-core.db");
   const snap = openCleoDbSnapshot(path2, { readOnly: false });
   let kept = 0;
   try {
@@ -42466,7 +42904,7 @@ async function buildFreshProjectStore(path2) {
 }
 function snapshotFresherBareRows(barePath, legacyTasksPath, stagingDir) {
   if (legacyTasksPath === void 0) return null;
-  const path2 = join27(stagingDir, "cleo-bare-task-core-fresher.db");
+  const path2 = join28(stagingDir, "cleo-bare-task-core-fresher.db");
   const snap = openCleoDbSnapshot(barePath, { readOnly: true });
   try {
     snap.db.exec(`VACUUM INTO '${path2.replace(/'/g, "''")}'`);
@@ -42617,7 +43055,7 @@ async function reconcileSuppressed(projectRoot, options, liveStorePath) {
   const additive = options.additive === true;
   const plan = buildExodusPlan(projectRoot);
   const resolveTarget = await buildRuntimeTargetResolver();
-  const scratch = mkdtempSync(join27(tmpdir3(), "cleo-reconcile-"));
+  const scratch = mkdtempSync(join28(tmpdir3(), "cleo-reconcile-"));
   try {
     return await reconcileWithScratch(
       projectRoot,
@@ -42633,8 +43071,8 @@ async function reconcileSuppressed(projectRoot, options, liveStorePath) {
   }
 }
 async function reconcileWithScratch(projectRoot, dryRun, additive, liveStorePath, plan, resolveTarget, scratch) {
-  const fileSources = plan.sources.filter((s) => s.targetScope === "project" && existsSync22(s.path));
-  const bare = !additive && existsSync22(liveStorePath) ? await bareTaskCoreSource(liveStorePath, resolveTarget, scratch) : null;
+  const fileSources = plan.sources.filter((s) => s.targetScope === "project" && existsSync23(s.path));
+  const bare = !additive && existsSync23(liveStorePath) ? await bareTaskCoreSource(liveStorePath, resolveTarget, scratch) : null;
   const copyResolver = additive ? (sourceName, legacyTable) => {
     const r = resolveTarget(sourceName, legacyTable);
     return r.kind !== "skip" && isLiveAuthoritative(sourceName, legacyTable, r.targetName) ? { kind: "skip", reason: "additive: live-authoritative task graph" } : r;
@@ -42653,7 +43091,7 @@ async function reconcileWithScratch(projectRoot, dryRun, additive, liveStorePath
     stagingDir: null,
     receiptPath: null
   };
-  if (sources.length === 0 || !existsSync22(liveStorePath)) {
+  if (sources.length === 0 || !existsSync23(liveStorePath)) {
     return {
       ...base,
       outcome: "nothing-to-reconcile",
@@ -42693,11 +43131,11 @@ async function reconcileWithScratch(projectRoot, dryRun, additive, liveStorePath
     };
   }
   const iso = (/* @__PURE__ */ new Date()).toISOString().replace(/[:]/g, "").replace(/\..+Z$/, "Z");
-  const stagingDir = join27(resolveCleoDir(projectRoot), `${RECONCILE_DIR_PREFIX}${iso}`);
+  const stagingDir = join28(resolveCleoDir(projectRoot), `${RECONCILE_DIR_PREFIX}${iso}`);
   mkdirSync7(stagingDir, { recursive: true });
   const copySources = sources.map((s) => {
     if (s !== bare) return s;
-    const kept = join27(stagingDir, basename9(s.path));
+    const kept = join28(stagingDir, basename9(s.path));
     copyFileSync6(s.path, kept);
     return { ...s, path: kept };
   });
@@ -42717,7 +43155,7 @@ async function reconcileWithScratch(projectRoot, dryRun, additive, liveStorePath
   const result = await withLock(
     `${liveStorePath}.exodus-on-open.lock`,
     async () => {
-      const liveBefore = join27(scratch, "live-before.db");
+      const liveBefore = join28(scratch, "live-before.db");
       snapshotLive(liveStorePath, liveBefore);
       const migrated = await runExodusMigrate(reconcilePlan, false, (msg) => log11.debug(msg), {
         projectOnly: true,
@@ -42767,7 +43205,7 @@ async function reconcileWithScratch(projectRoot, dryRun, additive, liveStorePath
     },
     { stale: 6e5, retries: 30 }
   );
-  const receiptPath = join27(stagingDir, RECEIPT_FILENAME);
+  const receiptPath = join28(stagingDir, RECEIPT_FILENAME);
   const receipt2 = { ...result, receiptPath };
   writeFileSync7(receiptPath, `${JSON.stringify(receipt2, null, 2)}
 `, "utf8");
@@ -42844,20 +43282,20 @@ var init_seal = __esm({
 });
 
 // packages/core/src/store/exodus/status.ts
-import { existsSync as existsSync23, readdirSync as readdirSync6, readFileSync as readFileSync7, statSync as statSync8 } from "node:fs";
-import { join as join28 } from "node:path";
+import { existsSync as existsSync24, readdirSync as readdirSync6, readFileSync as readFileSync8, statSync as statSync8 } from "node:fs";
+import { join as join29 } from "node:path";
 function readJournal2(stagingDir) {
-  const p = join28(stagingDir, JOURNAL_FILENAME2);
-  if (!existsSync23(p)) return null;
+  const p = join29(stagingDir, JOURNAL_FILENAME2);
+  if (!existsSync24(p)) return null;
   try {
-    return JSON.parse(readFileSync7(p, "utf8"));
+    return JSON.parse(readFileSync8(p, "utf8"));
   } catch {
     return null;
   }
 }
 function findStagingDirs(cleoDir) {
   try {
-    return readdirSync6(cleoDir, { withFileTypes: true }).filter((e) => e.isDirectory() && e.name.startsWith("exodus-staging-")).map((e) => join28(cleoDir, e.name)).sort().reverse();
+    return readdirSync6(cleoDir, { withFileTypes: true }).filter((e) => e.isDirectory() && e.name.startsWith("exodus-staging-")).map((e) => join29(cleoDir, e.name)).sort().reverse();
   } catch {
     return [];
   }
@@ -42880,15 +43318,15 @@ function runExodusStatus(cwd) {
   const sourcesInfo = plan.sources.map((s) => ({
     name: s.name,
     path: s.path,
-    exists: existsSync23(s.path),
+    exists: existsSync24(s.path),
     bytes: safeBytes(s.path)
   }));
   return {
     hasStaging: latestStaging !== null,
     stagingDir: latestStaging,
     journal,
-    projectDbExists: existsSync23(projectDbPath),
-    globalDbExists: existsSync23(globalDbPath),
+    projectDbExists: existsSync24(projectDbPath),
+    globalDbExists: existsSync24(globalDbPath),
     sourcesPresent: sourcesInfo.some((s) => s.exists),
     sources: sourcesInfo
   };
@@ -42905,8 +43343,8 @@ var init_status = __esm({
 });
 
 // packages/core/src/store/exodus/verify-migration.ts
-import { existsSync as existsSync24 } from "node:fs";
-import { createRequire as createRequire8 } from "node:module";
+import { existsSync as existsSync25 } from "node:fs";
+import { createRequire as createRequire9 } from "node:module";
 function orderByClause(db, tableName) {
   try {
     const pragma = db.prepare(`PRAGMA table_info("${tableName}")`).all();
@@ -43170,7 +43608,7 @@ function orphanAlreadyInSource(targetDb, fk, sources, resolveTarget = resolveCon
     const anyFeeder = (targetTable, probe) => {
       for (const feeder of feedersOf(targetTable)) {
         const src = sources.find((s) => s.name === feeder.sourceName);
-        if (src === void 0 || !existsSync24(src.path)) continue;
+        if (src === void 0 || !existsSync25(src.path)) continue;
         const snap = openCleoDbSnapshot(src.path, { readOnly: true });
         try {
           if (!tableExists3(snap.db, feeder.legacyTable)) continue;
@@ -43225,7 +43663,7 @@ function verifyMigration(sources, projectDbPath, globalDbPath, onProgress, resol
   const preExistingForeignKeyViolations = [];
   const failureLines = [];
   const sourceOrphanSigs = /* @__PURE__ */ new Set();
-  if (!existsSync24(projectDbPath)) {
+  if (!existsSync25(projectDbPath)) {
     return {
       ok: false,
       tables: [],
@@ -43236,7 +43674,7 @@ function verifyMigration(sources, projectDbPath, globalDbPath, onProgress, resol
       error: `Consolidated project cleo.db not found at ${projectDbPath}. Run 'cleo exodus migrate' first.`
     };
   }
-  if (!existsSync24(globalDbPath)) {
+  if (!existsSync25(globalDbPath)) {
     return {
       ok: false,
       tables: [],
@@ -43251,7 +43689,7 @@ function verifyMigration(sources, projectDbPath, globalDbPath, onProgress, resol
   const globalSnap = openCleoDbSnapshot(globalDbPath, { readOnly: true });
   try {
     for (const src of sources) {
-      if (!existsSync24(src.path)) {
+      if (!existsSync25(src.path)) {
         onProgress?.(`Skipping ${src.name} (not present)`);
         continue;
       }
@@ -43446,7 +43884,7 @@ var init_verify_migration = __esm({
     init_column_transforms();
     init_table_name_map();
     log13 = getLogger("verify-migration");
-    _require5 = createRequire8(import.meta.url);
+    _require5 = createRequire9(import.meta.url);
     CHECK_ENUM_REGEX = /CHECK\s*\(\s*"([^"]+)"\s+(?:IS\s+NULL\s+OR\s+"[^"]+"\s+)?IN\s*\(([^)]*)\)\s*\)/gi;
   }
 });
@@ -43542,11 +43980,11 @@ __export(on_open_exports, {
   maybeRunExodusOnOpen: () => maybeRunExodusOnOpen,
   withExodusOnOpenSuppressed: () => withExodusOnOpenSuppressed
 });
-import { existsSync as existsSync25, mkdtempSync as mkdtempSync2, rmSync as rmSync3 } from "node:fs";
+import { existsSync as existsSync26, mkdtempSync as mkdtempSync2, rmSync as rmSync3 } from "node:fs";
 import { tmpdir as tmpdir4 } from "node:os";
-import { join as join29, resolve as resolve11 } from "node:path";
+import { join as join30, resolve as resolve13 } from "node:path";
 async function withExodusOnOpenSuppressed(dbPath, fn) {
-  const key = resolve11(dbPath);
+  const key = resolve13(dbPath);
   _reconcileInProgress.set(key, (_reconcileInProgress.get(key) ?? 0) + 1);
   try {
     return await fn();
@@ -43584,7 +44022,7 @@ function remedyFor(scope) {
 }
 async function strandedLegacySources(scope, cwd) {
   const { buildExodusPlan: buildExodusPlan2, legacySourcesHoldRows: legacySourcesHoldRows2 } = await Promise.resolve().then(() => (init_exodus(), exodus_exports));
-  return buildExodusPlan2(cwd).sources.filter((s) => s.targetScope === scope && existsSync25(s.path)).filter((s) => legacySourcesHoldRows2([s])).map((s) => s.name);
+  return buildExodusPlan2(cwd).sources.filter((s) => s.targetScope === scope && existsSync26(s.path)).filter((s) => legacySourcesHoldRows2([s])).map((s) => s.name);
 }
 async function rollbackBothScopes(plan) {
   const { getDualScopeNativeDb: getDualScopeNativeDb2, openDualScopeDbAtPath: openDualScopeDbAtPath2 } = await Promise.resolve().then(() => (init_dual_scope_db(), dual_scope_db_exports));
@@ -43662,7 +44100,7 @@ async function runExodusOnOpen(scope, dbPath, nativeDb, cwd) {
   if (_exodusInProgress) {
     return { outcome: "skipped", reason: "re-entrant open during active migration" };
   }
-  if (_reconcileInProgress.has(resolve11(dbPath))) {
+  if (_reconcileInProgress.has(resolve13(dbPath))) {
     return {
       outcome: "skipped",
       reason: "an explicit superseded-store reconcile of this store is in progress"
@@ -43695,14 +44133,14 @@ async function runExodusOnOpen(scope, dbPath, nativeDb, cwd) {
   const { buildExodusPlan: buildExodusPlan2, runExodusMigrate: runExodusMigrate2, verifyMigration: verifyMigration2, clearExodusJournal: clearExodusJournal2 } = await Promise.resolve().then(() => (init_exodus(), exodus_exports));
   const plan = buildExodusPlan2(cwd);
   const plannedTarget = scope === "project" ? plan.projectDbPath : plan.globalDbPath;
-  if (resolve11(plannedTarget) !== resolve11(dbPath)) {
+  if (resolve13(plannedTarget) !== resolve13(dbPath)) {
     return {
       outcome: "aborted",
       reason: `migration plan target ${plannedTarget} does not match opened database ${dbPath}; no migration applied`
     };
   }
   const scopeSources = plan.sources.filter((s) => s.targetScope === scope);
-  if (!scopeSources.some((s) => existsSync25(s.path))) {
+  if (!scopeSources.some((s) => existsSync26(s.path))) {
     return {
       outcome: "skipped",
       reason: `no legacy ${scope}-scope source DBs present (fresh install or cross-scope-only)`
@@ -43719,12 +44157,12 @@ async function runExodusOnOpen(scope, dbPath, nativeDb, cwd) {
         {
           scope,
           dbPath,
-          sources: plan.sources.filter((s) => existsSync25(s.path)).map((s) => s.name)
+          sources: plan.sources.filter((s) => existsSync26(s.path)).map((s) => s.name)
         },
         "exodus-on-open: consolidated cleo.db is empty and legacy data present \u2014 auto-migrating"
       );
       _exodusInProgress = true;
-      const bareScratch = mkdtempSync2(join29(tmpdir4(), "cleo-exodus-bare-"));
+      const bareScratch = mkdtempSync2(join30(tmpdir4(), "cleo-exodus-bare-"));
       try {
         const { buildRuntimeTargetResolver: buildRuntimeTargetResolver2 } = await Promise.resolve().then(() => (init_runtime_targets(), runtime_targets_exports));
         const resolveTarget = await buildRuntimeTargetResolver2();
@@ -43732,7 +44170,7 @@ async function runExodusOnOpen(scope, dbPath, nativeDb, cwd) {
         const bare = scope === "project" ? await unmigratedBareSources2(
           dbPath,
           resolveTarget,
-          plan.sources.find((s) => s.name === "tasks" && existsSync25(s.path))?.path,
+          plan.sources.find((s) => s.name === "tasks" && existsSync26(s.path))?.path,
           bareScratch
         ) : { first: [], last: [] };
         const migratePlan = { ...plan, sources: [...bare.first, ...plan.sources, ...bare.last] };
@@ -43796,7 +44234,7 @@ async function runExodusOnOpen(scope, dbPath, nativeDb, cwd) {
           "exodus-on-open: parity verified \u2014 legacy data migrated into consolidated cleo.db"
         );
         try {
-          const consumed = plan.sources.filter((s) => existsSync25(s.path));
+          const consumed = plan.sources.filter((s) => existsSync26(s.path));
           const identities = await sealTargets(plan, consumed);
           const archiveResult = archiveMigratedSources(consumed, cwd, plan, identities);
           log14.info(
@@ -43871,9 +44309,9 @@ __export(dual_scope_db_exports, {
   upsertIdempotent: () => upsertIdempotent,
   withStoreSchemaOwnership: () => withStoreSchemaOwnership
 });
-import { existsSync as existsSync26, mkdirSync as mkdirSync8 } from "node:fs";
-import { createRequire as createRequire9 } from "node:module";
-import { dirname as dirname15, join as join30, resolve as resolve12 } from "node:path";
+import { existsSync as existsSync27, mkdirSync as mkdirSync8 } from "node:fs";
+import { createRequire as createRequire10 } from "node:module";
+import { dirname as dirname17, join as join31, resolve as resolve14 } from "node:path";
 function getDualScopeNativeDb(handle) {
   const db = handle.db;
   if ("$client" in db && db.$client instanceof getDatabaseSyncCtor()) return db.$client;
@@ -43895,9 +44333,9 @@ function cacheKey(scope, dbPath) {
 }
 function resolveDualScopeDbPath(scope, cwd, capturedGlobalHome) {
   if (scope === "project") {
-    return join30(resolveCleoDir(cwd), "cleo.db");
+    return join31(resolveCleoDir(cwd), "cleo.db");
   }
-  return join30(capturedGlobalHome ?? getCleoHome(), "cleo.db");
+  return join31(capturedGlobalHome ?? getCleoHome(), "cleo.db");
 }
 function migrationsSetName(scope) {
   return scope === "project" ? "drizzle-cleo-project" : "drizzle-cleo-global";
@@ -43947,8 +44385,8 @@ async function openDualScopeDb(scope, cwd, options) {
 async function openDedicatedDualScopeDb(scope, dbPath, log15, execution) {
   execution?.assertActive();
   log15.debug({ scope, dbPath }, "opening DEDICATED (non-cached) dual-scope cleo.db (T11782 FIX D)");
-  const dir = dirname15(dbPath);
-  if (!existsSync26(dir)) {
+  const dir = dirname17(dbPath);
+  if (!existsSync27(dir)) {
     mkdirSync8(dir, { recursive: true });
   }
   execution?.assertActive();
@@ -43956,6 +44394,7 @@ async function openDedicatedDualScopeDb(scope, dbPath, log15, execution) {
   const nativeDb = new DatabaseSyncCtor(dbPath, { allowExtension: true });
   try {
     applyPerfPragmas(nativeDb, memoryBoundedPragmaOverrides());
+    installSchemaWriteGuard(nativeDb);
     const drizzle2 = getDrizzle();
     const db = drizzle2({ client: nativeDb });
     const migrationsFolder = resolveCorePackageMigrationsFolder(migrationsSetName(scope));
@@ -44004,11 +44443,12 @@ async function openDedicatedDualScopeDb(scope, dbPath, log15, execution) {
     execution?.assertActive();
     return handle;
   } catch (err) {
+    const explained = explainSchemaWriteDenial(nativeDb, err);
     try {
       nativeDb.close();
     } catch {
     }
-    throw err;
+    throw explained;
   }
 }
 async function openDualScopeDbAtPath(scope, dbPath, exodusCwd, options) {
@@ -44029,7 +44469,7 @@ async function openDualScopeDbAtPath(scope, dbPath, exodusCwd, options) {
     );
   }
   const dedicated = options?.dedicated === true;
-  const normalizedPath = resolve12(dbPath);
+  const normalizedPath = resolve14(dbPath);
   const key = cacheKey(scope, normalizedPath);
   if (!dedicated) {
     const existing = _cache.get(key);
@@ -44066,8 +44506,8 @@ async function openDualScopeDbAtPath(scope, dbPath, exodusCwd, options) {
   }
   let initResolve = null;
   let initReject = null;
-  const initPromise = new Promise((resolve14, reject) => {
-    initResolve = resolve14;
+  const initPromise = new Promise((resolve16, reject) => {
+    initResolve = resolve16;
     initReject = reject;
   });
   _cache.set(key, {
@@ -44088,8 +44528,8 @@ async function openDualScopeDbAtPath(scope, dbPath, exodusCwd, options) {
     try {
       execution?.assertActive();
       log15.debug({ scope, dbPath: normalizedPath }, "opening dual-scope cleo.db");
-      const dir = dirname15(normalizedPath);
-      if (!existsSync26(dir)) {
+      const dir = dirname17(normalizedPath);
+      if (!existsSync27(dir)) {
         mkdirSync8(dir, { recursive: true });
       }
       execution?.assertActive();
@@ -44097,6 +44537,7 @@ async function openDualScopeDbAtPath(scope, dbPath, exodusCwd, options) {
       const nativeDb = new DatabaseSyncCtor(normalizedPath, { allowExtension: true });
       openingNative = nativeDb;
       applyPerfPragmas(nativeDb, memoryBoundedPragmaOverrides());
+      installSchemaWriteGuard(nativeDb);
       const drizzle2 = getDrizzle();
       const db = drizzle2({ client: nativeDb });
       const migrationsFolder = resolveCorePackageMigrationsFolder(migrationsSetName(scope));
@@ -44227,12 +44668,13 @@ async function openDualScopeDbAtPath(scope, dbPath, exodusCwd, options) {
       execution?.assertActive();
       initResolve(finalHandle);
     } catch (err) {
+      const explained = openingNative ? explainSchemaWriteDenial(openingNative, err) : err;
       try {
         if (!published && openingNative?.isOpen) openingNative.close();
       } catch (closeError) {
         log15.warn({ closeError }, "failed to close unpublished database initializer");
       }
-      initReject(err);
+      initReject(explained);
     }
   })();
   return initPromise;
@@ -44305,6 +44747,7 @@ var init_dual_scope_db = __esm({
     init_relocated_store_guard();
     init_resolve_migrations_folder();
     init_sqlite_pragmas();
+    init_worktree_build_guard();
     init_worktree_isolation_guard();
     init_writer_lease();
     ExodusAbortWriteUnsafeError = class extends Error {
@@ -44327,7 +44770,7 @@ var init_dual_scope_db = __esm({
       }
     };
     _cache = /* @__PURE__ */ new Map();
-    _require6 = createRequire9(import.meta.url);
+    _require6 = createRequire10(import.meta.url);
     _drizzle4 = null;
     _DatabaseSyncCtor = null;
     EntryCancelledError = class extends Error {
@@ -44358,7 +44801,7 @@ var init_dual_scope_db = __esm({
       }
       /** @inheritdoc */
       async openProject(dbPath, options) {
-        const normalized = resolve12(dbPath);
+        const normalized = resolve14(dbPath);
         if (options?.dedicated) {
           const handle = await openDualScopeDbAtPath("project", normalized, options?.exodusCwd, {
             dedicated: true
@@ -44370,7 +44813,7 @@ var init_dual_scope_db = __esm({
       /** @inheritdoc */
       async openGlobal(options) {
         const dbPath = resolveDualScopeDbPath("global");
-        const normalized = resolve12(dbPath);
+        const normalized = resolve14(dbPath);
         if (options?.dedicated) {
           const handle = await openDualScopeDbAtPath("global", normalized, options?.exodusCwd, {
             dedicated: true
@@ -44381,7 +44824,7 @@ var init_dual_scope_db = __esm({
       }
       /** @inheritdoc */
       async openGlobalAt(dbPath, options) {
-        const normalized = resolve12(dbPath);
+        const normalized = resolve14(dbPath);
         if (options?.dedicated) {
           const handle = await openDualScopeDbAtPath("global", normalized, options?.exodusCwd, {
             dedicated: true
@@ -44392,7 +44835,7 @@ var init_dual_scope_db = __esm({
       }
       /** @inheritdoc */
       closeProject(dbPath) {
-        const normalized = resolve12(dbPath);
+        const normalized = resolve14(dbPath);
         this.closeEntry("project", normalized);
       }
       /** @inheritdoc */
@@ -44429,8 +44872,8 @@ var init_dual_scope_db = __esm({
         const entryId = ++this._nextId;
         let initResolve;
         let initReject;
-        const initPromise = new Promise((resolve14, reject) => {
-          initResolve = resolve14;
+        const initPromise = new Promise((resolve16, reject) => {
+          initResolve = resolve16;
           initReject = reject;
         });
         this._registry.set(key, { id: entryId, store: null, initPromise });
@@ -45223,8 +45666,8 @@ __export(nexus_sqlite_exports, {
   resetNexusDbState: () => resetNexusDbState,
   resolveNexusMigrationsFolder: () => resolveNexusMigrationsFolder
 });
-import { copyFileSync as copyFileSync7, existsSync as existsSync27 } from "node:fs";
-import { join as join31 } from "node:path";
+import { copyFileSync as copyFileSync7, existsSync as existsSync28 } from "node:fs";
+import { join as join32 } from "node:path";
 function getNexusDbPath(cwd) {
   return resolveDualScopeDbPath("project", cwd);
 }
@@ -45260,12 +45703,13 @@ function ensureGlobalRegistryAttached(nativeDb) {
     }
   }
   nativeDb.exec(`ATTACH DATABASE '${escaped}' AS ${NEXUS_GLOBAL_ATTACH_ALIAS}`);
+  refreshSchemaWriteGuard(nativeDb);
 }
 function resolveNexusMigrationsFolder() {
   return resolveCorePackageMigrationsFolder("drizzle-nexus");
 }
 function getNestedNexusSentinelPath() {
-  return join31(getCleoHome(), "nexus", NESTED_NEXUS_SENTINEL);
+  return join32(getCleoHome(), "nexus", NESTED_NEXUS_SENTINEL);
 }
 function detectAndWarnOnNestedNexus() {
   let nestedPath;
@@ -45274,7 +45718,7 @@ function detectAndWarnOnNestedNexus() {
   } catch {
     return false;
   }
-  if (!existsSync27(nestedPath)) return false;
+  if (!existsSync28(nestedPath)) return false;
   if (_warnedNestedPaths.has(nestedPath)) return false;
   _warnedNestedPaths.add(nestedPath);
   const canonicalPath = getNexusDbPath();
@@ -45433,7 +45877,7 @@ function runNexusMigrations(nativeDb, db, dbPath) {
   const migrationsFolder = resolveNexusMigrationsFolder();
   if (tableExists4(nativeDb, "nexus_nodes")) {
     const backupPath = dbPath.replace(/\.db$/, "-pre-cleo.db.bak");
-    if (!existsSync27(backupPath)) {
+    if (!existsSync28(backupPath)) {
       try {
         copyFileSync7(dbPath, backupPath);
       } catch {
@@ -45528,6 +45972,7 @@ var init_nexus_sqlite = __esm({
     init_resolve_migrations_folder();
     init_nexus_schema();
     init_with_retry();
+    init_worktree_build_guard();
     NEXUS_SCHEMA_VERSION = "1.0.0";
     NEXUS_GLOBAL_ATTACH_ALIAS = "nexus_global";
     NESTED_NEXUS_SENTINEL = "nexus.db";
@@ -45562,15 +46007,15 @@ var init_legacy_alias = __esm({
 
 // packages/core/src/llm/stable-device-id.ts
 import { randomUUID as randomUUID3 } from "node:crypto";
-import { existsSync as existsSync28, mkdirSync as mkdirSync9, readFileSync as readFileSync8, renameSync as renameSync9, writeFileSync as writeFileSync8 } from "node:fs";
-import { dirname as dirname16 } from "node:path";
+import { existsSync as existsSync29, mkdirSync as mkdirSync9, readFileSync as readFileSync9, renameSync as renameSync9, writeFileSync as writeFileSync8 } from "node:fs";
+import { dirname as dirname18 } from "node:path";
 import { resolveStableDeviceIdPath } from "@cleocode/paths";
 function getStableDeviceId() {
   if (_cachedDeviceId !== null) return _cachedDeviceId;
   const path2 = resolveStableDeviceIdPath();
-  if (existsSync28(path2)) {
+  if (existsSync29(path2)) {
     try {
-      const raw = readFileSync8(path2, "utf-8").trim();
+      const raw = readFileSync9(path2, "utf-8").trim();
       if (raw.length > 0) {
         _cachedDeviceId = raw;
         return raw;
@@ -45580,8 +46025,8 @@ function getStableDeviceId() {
   }
   const fresh = randomUUID3();
   try {
-    const dir = dirname16(path2);
-    if (!existsSync28(dir)) {
+    const dir = dirname18(path2);
+    if (!existsSync29(dir)) {
       mkdirSync9(dir, { recursive: true });
     }
     const tmpPath = `${path2}.tmp.${process.pid}`;
@@ -45618,8 +46063,8 @@ var init_registry_roots = __esm({
 // packages/core/src/nexus/projects-scan.ts
 async function withinBudget(promise, ms) {
   let timer;
-  const expiry = new Promise((resolve14) => {
-    timer = setTimeout(() => resolve14("timeout"), ms);
+  const expiry = new Promise((resolve16) => {
+    timer = setTimeout(() => resolve16("timeout"), ms);
     timer.unref();
   });
   try {
@@ -45657,9 +46102,9 @@ __export(path_map_exports, {
   supersededRegistryPath: () => supersededRegistryPath,
   touchProjectLocation: () => touchProjectLocation
 });
-import { existsSync as existsSync29, lstatSync, readdirSync as readdirSync7 } from "node:fs";
+import { existsSync as existsSync30, lstatSync, readdirSync as readdirSync7 } from "node:fs";
 import { lstat, readdir as readdir2 } from "node:fs/promises";
-import { isAbsolute as isAbsolute4, join as join32, relative as relative2, sep as sep4 } from "node:path";
+import { isAbsolute as isAbsolute5, join as join33, relative as relative3, sep as sep5 } from "node:path";
 import { canonicalizePath as canonicalizePath3, readDeclaredProjectIdentity as readDeclaredProjectIdentity3 } from "@cleocode/paths";
 import { and as and7, desc as desc3, eq as eq11, inArray as inArray5, ne as ne3 } from "drizzle-orm";
 function holdingKey(projectId, path2) {
@@ -45675,7 +46120,7 @@ function isSupersededRegistryPath(projectPath) {
   return projectPath.startsWith(SUPERSEDED_PATH_PREFIX);
 }
 function projectHolding(path2, projectId) {
-  const cleoDir = join32(path2, ".cleo");
+  const cleoDir = join33(path2, ".cleo");
   try {
     lstatSync(cleoDir);
     readdirSync7(cleoDir);
@@ -45687,7 +46132,7 @@ function projectHolding(path2, projectId) {
   return declared === null || declared.projectId === projectId ? "yes" : "no";
 }
 async function probeProjectHolding(path2, projectId, timeoutMs) {
-  const cleoDir = join32(path2, ".cleo");
+  const cleoDir = join33(path2, ".cleo");
   const probe = async () => {
     try {
       await lstat(cleoDir);
@@ -45705,8 +46150,8 @@ async function probeProjectHolding(path2, projectId, timeoutMs) {
   return declared === null || declared.projectId === projectId ? "yes" : "no";
 }
 function isStrictlyInside(outer, inner) {
-  const rel = relative2(canonicalizePath3(outer), canonicalizePath3(inner));
-  return rel.length > 0 && rel !== ".." && !rel.startsWith(`..${sep4}`) && !isAbsolute4(rel);
+  const rel = relative3(canonicalizePath3(outer), canonicalizePath3(inner));
+  return rel.length > 0 && rel !== ".." && !rel.startsWith(`..${sep5}`) && !isAbsolute5(rel);
 }
 function locationKey(projectId, deviceId, path2) {
   return and7(
@@ -45868,7 +46313,7 @@ function hasOtherLiveLocation(db, record, deviceId) {
       ne3(projectLocations.path, record.projectPath)
     )
   ).all().some(
-    (location) => isStrictlyInside(record.projectPath, location.path) && existsSync29(location.path) && readDeclaredProjectIdentity3(location.path)?.projectId === record.projectId
+    (location) => isStrictlyInside(record.projectPath, location.path) && existsSync30(location.path) && readDeclaredProjectIdentity3(location.path)?.projectId === record.projectId
   );
 }
 function demoteProjectLocation(db, record, state) {
@@ -45919,7 +46364,7 @@ function rehomeDisplacedRows(db, projectId, projectPath, deviceId, probed) {
     ).orderBy(desc3(projectLocations.lastSeen)).all();
     const present = (path2) => {
       const holding = probed?.get(holdingKey(row.projectId, path2));
-      return holding === void 0 ? existsSync29(path2) : holding === "yes";
+      return holding === void 0 ? existsSync30(path2) : holding === "yes";
     };
     const home = candidates.find(
       (c) => present(c.path) && db.select({ projectId: projectRegistry.projectId }).from(projectRegistry).where(eq11(projectRegistry.projectPath, c.path)).all().length === 0
@@ -45948,7 +46393,7 @@ async function listProjectCheckouts(projectId, opts = {}) {
       projectHash: generateProjectHash(row.path),
       firstSeen: row.firstSeen,
       lastSeen: row.lastSeen,
-      exists: local && existsSync29(row.path),
+      exists: local && existsSync30(row.path),
       deviceId: local ? deviceId : row.deviceId,
       state: row.state
     });
@@ -45977,13 +46422,13 @@ __export(checkout_nonce_exports, {
   readCheckoutNonce: () => readCheckoutNonce
 });
 import { randomBytes as randomBytes2 } from "node:crypto";
-import { existsSync as existsSync30, readFileSync as readFileSync9, renameSync as renameSync10, writeFileSync as writeFileSync9 } from "node:fs";
-import { join as join33 } from "node:path";
+import { existsSync as existsSync31, readFileSync as readFileSync10, renameSync as renameSync10, writeFileSync as writeFileSync9 } from "node:fs";
+import { join as join34 } from "node:path";
 function readInfo(projectRoot) {
-  const path2 = join33(projectRoot, ".cleo", "project-info.json");
-  if (!existsSync30(path2)) return null;
+  const path2 = join34(projectRoot, ".cleo", "project-info.json");
+  if (!existsSync31(path2)) return null;
   try {
-    const parsed = JSON.parse(readFileSync9(path2, "utf-8"));
+    const parsed = JSON.parse(readFileSync10(path2, "utf-8"));
     return parsed !== null && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
   } catch {
     return null;
@@ -45999,7 +46444,7 @@ function ensureCheckoutNonce(projectRoot) {
   const info = readInfo(projectRoot);
   if (!info) return null;
   const nonce = randomBytes2(16).toString("hex");
-  const path2 = join33(projectRoot, ".cleo", "project-info.json");
+  const path2 = join34(projectRoot, ".cleo", "project-info.json");
   const temp = `${path2}.${randomBytes2(6).toString("hex")}.tmp`;
   writeFileSync9(temp, `${JSON.stringify({ ...info, [CHECKOUT_NONCE_FIELD]: nonce }, null, 2)}
 `);
@@ -46074,10 +46519,10 @@ __export(paths_exports, {
   validateProjectRoot: () => validateProjectRoot,
   worktreeScope: () => worktreeScope
 });
-import { existsSync as existsSync31, readFileSync as readFileSync10, statSync as statSync9 } from "node:fs";
-import { createRequire as createRequire10 } from "node:module";
+import { existsSync as existsSync32, readFileSync as readFileSync11, statSync as statSync9 } from "node:fs";
+import { createRequire as createRequire11 } from "node:module";
 import { homedir as homedir2 } from "node:os";
-import { basename as basename10, dirname as dirname17, join as join34, resolve as resolve13 } from "node:path";
+import { basename as basename10, dirname as dirname19, join as join35, resolve as resolve15 } from "node:path";
 import {
   getCanonicalTemplatesTildePath as _getCanonicalTemplatesTildePath,
   getCleoTemplatesTildePath as _getCleoTemplatesTildePath,
@@ -46087,7 +46532,7 @@ import {
   resolveCanonicalCleoDir as _resolveCanonicalCleoDir
 } from "@cleocode/paths";
 function _getDatabaseSyncCtor() {
-  const _require7 = createRequire10(import.meta.url);
+  const _require7 = createRequire11(import.meta.url);
   const mod = _require7("node:sqlite");
   return mod.DatabaseSync;
 }
@@ -46099,20 +46544,20 @@ function runWithWorktreeScopeFromEnv(fn) {
 }
 function isProjectInitialized(projectRoot) {
   const root = projectRoot ?? getProjectRoot();
-  const cleoDir = join34(root, ".cleo");
-  return existsSync31(cleoDir) && existsSync31(join34(cleoDir, "tasks.db"));
+  const cleoDir = join35(root, ".cleo");
+  return existsSync32(cleoDir) && existsSync32(join35(cleoDir, "tasks.db"));
 }
 function getCleoHome() {
   return getPlatformPaths().data;
 }
 function getCleoTemplatesDir() {
-  return join34(getCleoHome(), "templates");
+  return join35(getCleoHome(), "templates");
 }
 function getCleoSchemasDir() {
-  return join34(getCleoHome(), "schemas");
+  return join35(getCleoHome(), "schemas");
 }
 function getCleoDocsDir() {
-  return join34(getCleoHome(), "docs");
+  return join35(getCleoHome(), "docs");
 }
 function getCleoDir(cwd) {
   if (cwd) {
@@ -46161,24 +46606,24 @@ function getCleoDirAbsolute(cwd, opts) {
     try {
       const projectRoot = getProjectRoot(cwd);
       const canonical = _resolveCanonicalCleoDir(project.projectId);
-      if (canonical !== null && canonical === resolve13(projectRoot, cleoDir)) {
+      if (canonical !== null && canonical === resolve15(projectRoot, cleoDir)) {
         return canonical;
       }
-      return resolve13(projectRoot, cleoDir);
+      return resolve15(projectRoot, cleoDir);
     } catch {
-      return resolve13(project.projectRoot, cleoDir);
+      return resolve15(project.projectRoot, cleoDir);
     }
   }
   try {
-    return resolve13(getProjectRoot(cwd), cleoDir);
+    return resolve15(getProjectRoot(cwd), cleoDir);
   } catch (err) {
     if (opts?.bootstrap) {
-      return resolve13(cwd ?? process.cwd(), cleoDir);
+      return resolve15(cwd ?? process.cwd(), cleoDir);
     }
     if (_cwdHasGitAncestor(cwd)) {
       throw err;
     }
-    return resolve13(cwd ?? process.cwd(), cleoDir);
+    return resolve15(cwd ?? process.cwd(), cleoDir);
   }
 }
 function resolveCanonicalCleoDir(projectId) {
@@ -46205,9 +46650,9 @@ function resolveCanonicalCleoDir(projectId) {
 function _resolveProjectByCwdFromNexus(cwd) {
   try {
     const cleoHome = getCleoHome();
-    const globalDbPath = join34(cleoHome, "cleo.db");
-    if (!existsSync31(globalDbPath)) return null;
-    const start = resolve13(cwd ?? process.cwd());
+    const globalDbPath = join35(cleoHome, "cleo.db");
+    if (!existsSync32(globalDbPath)) return null;
+    const start = resolve15(cwd ?? process.cwd());
     let current = start;
     const DatabaseSync3 = _getDatabaseSyncCtor();
     const db = new DatabaseSync3(globalDbPath, { readOnly: true });
@@ -46220,7 +46665,7 @@ function _resolveProjectByCwdFromNexus(cwd) {
         if (row && typeof row.project_id === "string" && row.project_id.length > 0) {
           return row.project_id;
         }
-        const parent = dirname17(current);
+        const parent = dirname19(current);
         if (parent === current) break;
         current = parent;
       }
@@ -46240,18 +46685,18 @@ function _cleoDirEnvOverride() {
 }
 function _findCleoDirRoot(cwd) {
   const homeRoot = homedir2();
-  let current = resolve13(cwd ?? process.cwd());
+  let current = resolve15(cwd ?? process.cwd());
   while (true) {
     const isDangerousRoot = current === homeRoot || current === "/" || current === "";
     if (!isDangerousRoot) {
       try {
-        if (statSync9(join34(current, ".cleo")).isDirectory()) {
+        if (statSync9(join35(current, ".cleo")).isDirectory()) {
           return current;
         }
       } catch {
       }
     }
-    const parent = dirname17(current);
+    const parent = dirname19(current);
     if (parent === current) break;
     current = parent;
   }
@@ -46270,7 +46715,7 @@ function resolveProjectByCwd(cwd) {
   if (pathsResult !== null) {
     return pathsResult.projectId;
   }
-  const start = resolve13(from ?? process.cwd());
+  const start = resolve15(from ?? process.cwd());
   let current = start;
   while (true) {
     const mainRepo = _resolveMainRepoFromGitlink(current);
@@ -46281,7 +46726,7 @@ function resolveProjectByCwd(cwd) {
       }
       break;
     }
-    const parent = dirname17(current);
+    const parent = dirname19(current);
     if (parent === current) break;
     current = parent;
   }
@@ -46300,7 +46745,7 @@ function resolveProjectByCwd(cwd) {
 function resolveCleoDir(cwd) {
   const scope = worktreeScope.getStore();
   if (scope !== void 0) {
-    return join34(resolveStoreOwnerRoot(scope.worktreeRoot), ".cleo");
+    return join35(resolveStoreOwnerRoot(scope.worktreeRoot), ".cleo");
   }
   const override = _cleoDirEnvOverride();
   if (override !== null) {
@@ -46308,16 +46753,16 @@ function resolveCleoDir(cwd) {
   }
   const root = _findCleoDirRoot(cwd);
   if (root !== null) {
-    return join34(resolveStoreOwnerRoot(root), ".cleo");
+    return join35(resolveStoreOwnerRoot(root), ".cleo");
   }
-  const start = resolve13(cwd ?? process.cwd());
+  const start = resolve15(cwd ?? process.cwd());
   let current = start;
   while (true) {
     const mainRepo = _resolveMainRepoFromGitlink(current);
     if (mainRepo !== null) {
-      return join34(mainRepo, ".cleo");
+      return join35(mainRepo, ".cleo");
     }
-    const parent = dirname17(current);
+    const parent = dirname19(current);
     if (parent === current) {
       break;
     }
@@ -46356,25 +46801,25 @@ function _resolveCleoDir(cwd) {
   const project = _pathsResolveProjectByCwd(cwd);
   if (project !== null) {
     try {
-      return resolve13(getProjectRoot(cwd), cleoDir);
+      return resolve15(getProjectRoot(cwd), cleoDir);
     } catch {
-      return resolve13(project.projectRoot, cleoDir);
+      return resolve15(project.projectRoot, cleoDir);
     }
   }
   return getCleoDirAbsolute(cwd);
 }
 function _cwdHasGitAncestor(cwd) {
-  const start = resolve13(cwd ?? process.cwd());
+  const start = resolve15(cwd ?? process.cwd());
   let current = start;
   while (true) {
-    const gitMarker = join34(current, ".git");
+    const gitMarker = join35(current, ".git");
     try {
-      if (existsSync31(gitMarker)) {
+      if (existsSync32(gitMarker)) {
         return true;
       }
     } catch {
     }
-    const parent = dirname17(current);
+    const parent = dirname19(current);
     if (parent === current) return false;
     current = parent;
   }
@@ -46401,55 +46846,55 @@ function resolveProjectPath(relativePath, cwd) {
     return relativePath;
   }
   if (relativePath.startsWith("~/") || relativePath.startsWith("~\\") || relativePath === "~") {
-    return resolve13(homedir2(), relativePath.slice(2));
+    return resolve15(homedir2(), relativePath.slice(2));
   }
-  return resolve13(getProjectRoot(cwd), relativePath);
+  return resolve15(getProjectRoot(cwd), relativePath);
 }
 function getTaskPath(cwd) {
-  return join34(_resolveCleoDir(cwd), "tasks.db");
+  return join35(_resolveCleoDir(cwd), "tasks.db");
 }
 function getConfigPath(cwd) {
-  return join34(_resolveCleoDir(cwd), "config.json");
+  return join35(_resolveCleoDir(cwd), "config.json");
 }
 function getSessionsPath(cwd) {
-  return join34(_resolveCleoDir(cwd), "sessions.json");
+  return join35(_resolveCleoDir(cwd), "sessions.json");
 }
 function getArchivePath(cwd) {
-  return join34(_resolveCleoDir(cwd), "tasks-archive.json");
+  return join35(_resolveCleoDir(cwd), "tasks-archive.json");
 }
 function getLogPath(cwd) {
-  return join34(_resolveCleoDir(cwd), "logs", "cleo.log");
+  return join35(_resolveCleoDir(cwd), "logs", "cleo.log");
 }
 function getBackupDir(cwd) {
-  return join34(_resolveCleoDir(cwd), "backups", "operational");
+  return join35(_resolveCleoDir(cwd), "backups", "operational");
 }
 function getGlobalConfigPath() {
-  return join34(getCleoHome(), "config.json");
+  return join35(getCleoHome(), "config.json");
 }
 function getCleoGlobalRecipesDir() {
-  return join34(getCleoHome(), "global-recipes");
+  return join35(getCleoHome(), "global-recipes");
 }
 function getCleoGlobalJustfilePath() {
-  return join34(getCleoGlobalRecipesDir(), "justfile");
+  return join35(getCleoGlobalRecipesDir(), "justfile");
 }
 function getCleoPiExtensionsDir() {
-  return join34(getCleoHome(), "pi-extensions");
+  return join35(getCleoHome(), "pi-extensions");
 }
 function getCleoCantWorkflowsDir() {
-  return join34(getCleoHome(), "cant-workflows");
+  return join35(getCleoHome(), "cant-workflows");
 }
 function getCleoGlobalAgentsDir() {
-  return join34(getCleoHome(), "agents");
+  return join35(getCleoHome(), "agents");
 }
 function getCleoGlobalCantAgentsDir() {
-  return join34(getCleoHome(), "cant", "agents");
+  return join35(getCleoHome(), "cant", "agents");
 }
 function getAgentOutputsDir(cwd) {
   const projectRoot = getProjectRoot(cwd);
-  const configPath = join34(projectRoot, ".cleo", "config.json");
-  if (existsSync31(configPath)) {
+  const configPath = join35(projectRoot, ".cleo", "config.json");
+  if (existsSync32(configPath)) {
     try {
-      const config = JSON.parse(readFileSync10(configPath, "utf-8"));
+      const config = JSON.parse(readFileSync11(configPath, "utf-8"));
       if (typeof config.agentOutputs === "object" && config.agentOutputs?.directory) {
         return config.agentOutputs.directory;
       }
@@ -46472,17 +46917,17 @@ function getAgentOutputsAbsolute(cwd) {
   if (isAbsolutePath2(dir)) {
     return dir;
   }
-  return resolve13(getProjectRoot(cwd), dir);
+  return resolve15(getProjectRoot(cwd), dir);
 }
 function getManifestPath(cwd) {
   const outputDir = getAgentOutputsDir(cwd);
   const projectRoot = getProjectRoot(cwd);
-  const configPath = join34(projectRoot, ".cleo", "config.json");
+  const configPath = join35(projectRoot, ".cleo", "config.json");
   const legacyFileName = ["MANIFEST", "jsonl"].join(".");
   let manifestFile = legacyFileName;
-  if (existsSync31(configPath)) {
+  if (existsSync32(configPath)) {
     try {
-      const config = JSON.parse(readFileSync10(configPath, "utf-8"));
+      const config = JSON.parse(readFileSync11(configPath, "utf-8"));
       const customFile = config.agentOutputs?.manifestFile ?? config.research?.manifestFile;
       if (customFile) {
         manifestFile = customFile;
@@ -46490,12 +46935,12 @@ function getManifestPath(cwd) {
     } catch {
     }
   }
-  return resolve13(projectRoot, outputDir, manifestFile);
+  return resolve15(projectRoot, outputDir, manifestFile);
 }
 function getManifestArchivePath(cwd) {
   const outputDir = getAgentOutputsDir(cwd);
   const projectRoot = getProjectRoot(cwd);
-  return resolve13(projectRoot, outputDir, "MANIFEST.archive.jsonl");
+  return resolve15(projectRoot, outputDir, "MANIFEST.archive.jsonl");
 }
 function isAbsolutePath2(path2) {
   return _isAbsolutePath(path2);
@@ -46519,24 +46964,24 @@ function getCanonicalTemplatesTildePath() {
   return _getCanonicalTemplatesTildePath();
 }
 function getAgentsHome() {
-  return process.env["AGENTS_HOME"] ?? join34(homedir2(), ".agents");
+  return process.env["AGENTS_HOME"] ?? join35(homedir2(), ".agents");
 }
 function getClaudeAgentsDir() {
-  const claudeDir = process.env["CLAUDE_HOME"] ?? join34(homedir2(), ".claude");
-  return join34(claudeDir, "agents");
+  const claudeDir = process.env["CLAUDE_HOME"] ?? join35(homedir2(), ".claude");
+  return join35(claudeDir, "agents");
 }
 function getClaudeMemDbPath() {
-  return process.env["CLAUDE_MEM_DB"] ?? join34(homedir2(), ".claude-mem", "claude-mem.db");
+  return process.env["CLAUDE_MEM_DB"] ?? join35(homedir2(), ".claude-mem", "claude-mem.db");
 }
 function resolveWorktreeRouting(cwdOverride) {
-  const cwd = resolve13(cwdOverride ?? process.cwd());
+  const cwd = resolve15(cwdOverride ?? process.cwd());
   const home = homedir2();
   let worktreePath;
   let current = cwd;
   while (current !== home && current !== "/" && current !== "") {
-    const gitPath = join34(current, ".git");
+    const gitPath = join35(current, ".git");
     try {
-      if (existsSync31(gitPath)) {
+      if (existsSync32(gitPath)) {
         const stat3 = statSync9(gitPath);
         if (stat3.isFile()) {
           worktreePath = current;
@@ -46548,7 +46993,7 @@ function resolveWorktreeRouting(cwdOverride) {
       }
     } catch {
     }
-    const parent = dirname17(current);
+    const parent = dirname19(current);
     if (parent === current) break;
     current = parent;
   }
@@ -46565,17 +47010,17 @@ function resolveWorktreeRouting(cwdOverride) {
 }
 function resolveWorktreeFilePath(filePath, routing) {
   if (!routing.isWorktree || routing.worktreePath === void 0) {
-    return resolve13(filePath);
+    return resolve15(filePath);
   }
-  return resolve13(routing.cwd, filePath);
+  return resolve15(routing.cwd, filePath);
 }
 function detectStrayCleoDb(routing) {
   if (!routing.isWorktree || routing.worktreePath === void 0) {
     return void 0;
   }
-  const tasksDbPath = join34(routing.worktreePath, ".cleo", "tasks.db");
+  const tasksDbPath = join35(routing.worktreePath, ".cleo", "tasks.db");
   try {
-    if (existsSync31(tasksDbPath) && statSync9(tasksDbPath).isFile()) {
+    if (existsSync32(tasksDbPath) && statSync9(tasksDbPath).isFile()) {
       return tasksDbPath;
     }
   } catch {
@@ -46585,7 +47030,7 @@ function detectStrayCleoDb(routing) {
 async function resolveProjectById(projectId) {
   try {
     const { getNexusDb: getNexusDb2, getNexusRegistryDbPath: getNexusRegistryDbPath2 } = await Promise.resolve().then(() => (init_nexus_sqlite(), nexus_sqlite_exports));
-    if (!existsSync31(getNexusRegistryDbPath2())) return null;
+    if (!existsSync32(getNexusRegistryDbPath2())) return null;
     const { eq: eq14 } = await import("drizzle-orm");
     const { projectRegistry: projectRegistry2 } = await Promise.resolve().then(() => (init_nexus_schema(), nexus_schema_exports));
     const db = await getNexusDb2();
@@ -46620,9 +47065,9 @@ function _rowToRegistryEntry(row) {
   };
 }
 function _readProjectNameFromInfo(projectRoot) {
-  const infoPath = join34(projectRoot, ".cleo", "project-info.json");
-  if (!existsSync31(infoPath)) return void 0;
-  const raw = readFileSync10(infoPath, "utf-8");
+  const infoPath = join35(projectRoot, ".cleo", "project-info.json");
+  if (!existsSync32(infoPath)) return void 0;
+  const raw = readFileSync11(infoPath, "utf-8");
   const data = JSON.parse(raw);
   return typeof data.name === "string" && data.name.length > 0 ? data.name : void 0;
 }
@@ -46673,7 +47118,7 @@ async function recordProjectEncounter(cwd) {
   if (!shouldAutoRegisterProject(project.projectRoot, cleoHome)) return "ephemeral";
   const checkout = captureProjectScope(project.projectRoot, worktreeScope.getStore()).worktreeRoot;
   const { getNexusRegistryDb: getNexusRegistryDb2, getNexusRegistryDbPath: getNexusRegistryDbPath2 } = await Promise.resolve().then(() => (init_nexus_sqlite(), nexus_sqlite_exports));
-  if (existsSync31(getNexusRegistryDbPath2(cleoHome))) {
+  if (existsSync32(getNexusRegistryDbPath2(cleoHome))) {
     const { and: and10, eq: eq14 } = await import("drizzle-orm");
     const { projectLocations: projectLocations2, projectRegistry: projectRegistry2 } = await Promise.resolve().then(() => (init_nexus_schema(), nexus_schema_exports));
     const { currentDeviceId: currentDeviceId2 } = await Promise.resolve().then(() => (init_path_map(), path_map_exports));