@cleocode/core 2026.9.21 → 2026.9.23

package/dist/llm/plugin-facade.js

@@ -344,7 +344,7 @@ var init_acceptance_gate_schema = __esm({
             message: "Result cannot precede input capture"
           });
         const executable = ["test", "command", "lint"].includes(result.kind);
-        if (executable && !binding.invocation)
+        if (executable && !binding.invocation && result.result !== "error")
           context.addIssue({
             code: "custom",
             path: ["binding", "invocation"],
@@ -3110,12 +3110,21 @@ var init_operations_registry = __esm({
         gateway: "query",
         domain: "tasks",
         operation: "history",
-        description: "Show task work history (time tracked per task)",
+        description: "Show task work history; with taskId, the task audit trail; with ranking, who changed its priority/severity/kind/depends and why (T12693)",
         tier: 1,
         idempotent: true,
         sessionRequired: false,
         requiredParams: [],
-        params: []
+        params: [
+          { name: "taskId", type: "string", required: false, description: "Task to show history for" },
+          { name: "limit", type: "number", required: false, description: "Maximum entries" },
+          {
+            name: "ranking",
+            type: "boolean",
+            required: false,
+            description: "Only ranking-input changes (actor, session, reason, before/after)"
+          }
+        ]
       },
       {
         gateway: "query",
@@ -5610,6 +5619,32 @@ var init_operations_registry = __esm({
         ],
         outputSchema: OUTPUT_CONTRACTS["tasks.assignee"]
       },
+      {
+        gateway: "mutate",
+        domain: "tasks",
+        operation: "ranking.revert",
+        description: "tasks.ranking.revert (mutate) \u2014 undo one recorded ranking change (priority/severity/kind/depends) as a new audited change (T12693, D11161)",
+        tier: 1,
+        idempotent: false,
+        sessionRequired: false,
+        requiredParams: ["entryId"],
+        params: [
+          {
+            name: "entryId",
+            type: "string",
+            required: true,
+            description: "ranking_changed audit row id (cleo history ranking <taskId>)",
+            cli: { positional: true }
+          },
+          { name: "reason", type: "string", required: false, description: "Why it is reverted" },
+          {
+            name: "force",
+            type: "boolean",
+            required: false,
+            description: "Revert even though a field changed again since"
+          }
+        ]
+      },
       {
         gateway: "mutate",
         domain: "tasks",
@@ -10533,7 +10568,7 @@ var init_operations_registry = __esm({
             type: "string",
             required: false,
             enum: DOCS_LIFECYCLE_STATUSES,
-            description: `Override the new lifecycle status. Defaults to "draft" on every update. Valid: ${DOCS_LIFECYCLE_STATUSES.join("|")}.`
+            description: `Override the new lifecycle status. Defaults to "draft" on every update. Alone (no file or content) it changes only the lifecycle status. Valid: ${DOCS_LIFECYCLE_STATUSES.join("|")}.`
           },
           {
             name: "dryRun",
@@ -13020,11 +13055,13 @@ var init_evidence_atom_schema = __esm({
     });
     prAtomSchema = z10.object({
       kind: z10.literal("pr"),
-      prNumber: z10.number().int().positive("pr atom requires a positive integer PR number")
+      prNumber: z10.number().int().positive("pr atom requires a positive integer PR number"),
+      componentPrNumber: z10.number().int().positive().optional()
     });
     ciAtomSchema = z10.object({
       kind: z10.literal("ci"),
-      prNumber: z10.number().int().positive("ci atom requires a positive integer PR number")
+      prNumber: z10.number().int().positive("ci atom requires a positive integer PR number"),
+      componentPrNumber: z10.number().int().positive().optional()
     });
     locDropAtomSchema = z10.object({
       kind: z10.literal("loc-drop"),
@@ -13075,7 +13112,10 @@ var init_evidence_atom_schema = __esm({
           ["commit", "note"],
           ["decision", "files"],
           ["decision", "note"],
-          ["pr", "files"]
+          ["pr", "files"],
+          // T12689: a deletion-only PR (no bytes to hash). Contextual validation
+          // accepts this only when every change the PR made is a deletion.
+          ["pr", "note"]
         ]
       },
       testsPassed: { oneOf: [["test-run"], ["tool"], ["ci"]] },
@@ -17050,7 +17090,7 @@ var init_collection_keys = __esm({
 
 // packages/contracts/src/decide.ts
 import { z as z24 } from "zod";
-var DECISION_QUESTION_TYPES, DECISION_OUTCOME_SOURCES, DECISION_REQUEST_LIMITS, decisionQuestionTypeSchema, decisionOutcomeSourceSchema, decisionInstructionsSchema, unitIntervalSchema, decisionStateSchema, noulDecisionQuestionSchema, choiceDecisionQuestionSchema, scoreDecisionQuestionSchema, decisionQuestionSchema, decisionRequestSchema, noulDecisionAnswerSchema, choiceDecisionAnswerSchema, scoreDecisionAnswerSchema, decisionAnswerSchema, decisionOutcomeSchema, decisionProviderConfigSchema;
+var DECISION_QUESTION_TYPES, DECISION_OUTCOME_SOURCES, DECISION_REQUEST_LIMITS, DECISION_PROVIDER_KINDS, decisionQuestionTypeSchema, decisionOutcomeSourceSchema, decisionInstructionsSchema, unitIntervalSchema, decisionStateSchema, noulDecisionQuestionSchema, choiceDecisionQuestionSchema, scoreDecisionQuestionSchema, decisionQuestionSchema, decisionRequestSchema, noulDecisionAnswerSchema, choiceDecisionAnswerSchema, scoreDecisionAnswerSchema, decisionAnswerSchema, decisionOutcomeSchema, decisionProviderKindSchema, decisionProviderConfigSchema;
 var init_decide = __esm({
   "packages/contracts/src/decide.ts"() {
     "use strict";
@@ -17074,6 +17114,7 @@ var init_decide = __esm({
       /** Maximum number of levels on a `score` question's scale. */
       maxScoreLevels: 10
     };
+    DECISION_PROVIDER_KINDS = ["layahost", "jev"];
     decisionQuestionTypeSchema = z24.enum(DECISION_QUESTION_TYPES);
     decisionOutcomeSourceSchema = z24.enum(DECISION_OUTCOME_SOURCES);
     decisionInstructionsSchema = z24.union([z24.string(), z24.record(z24.string(), z24.json())]);
@@ -17111,6 +17152,8 @@ var init_decide = __esm({
     ]);
     decisionRequestSchema = z24.object({
       model: z24.string().min(1).optional(),
+      lang: z24.string().regex(/^[a-z]{2,3}(-[A-Za-z0-9]{2,8})?$/).optional(),
+      cache: z24.boolean().optional(),
       state: decisionStateSchema,
       questions: z24.record(z24.string().min(1), decisionQuestionSchema).refine(
         (questions) => {
@@ -17151,14 +17194,26 @@ var init_decide = __esm({
       requestId: z24.string().min(1).optional(),
       latencyMs: z24.number().nonnegative(),
       costUsd: z24.number().nonnegative().optional(),
+      costMicros: z24.number().int().nonnegative().optional(),
+      balanceMicros: z24.number().int().optional(),
+      checkpoint: z24.string().min(1).optional(),
       inputTokens: z24.number().int().nonnegative().optional()
     });
+    decisionProviderKindSchema = z24.enum(DECISION_PROVIDER_KINDS);
     decisionProviderConfigSchema = z24.object({
-      baseUrl: z24.url()
+      baseUrl: z24.url(),
+      provider: decisionProviderKindSchema.optional()
     });
   }
 });
 
+// packages/contracts/src/decide-sites.ts
+var init_decide_sites = __esm({
+  "packages/contracts/src/decide-sites.ts"() {
+    "use strict";
+  }
+});
+
 // packages/contracts/src/task-id.ts
 var init_task_id = __esm({
   "packages/contracts/src/task-id.ts"() {
@@ -17240,6 +17295,7 @@ var init_src = __esm({
     init_caamp_markers();
     init_collection_keys();
     init_decide();
+    init_decide_sites();
     init_task_id();
   }
 });
@@ -18759,6 +18815,37 @@ function linkedWorktreeMainRoot(dir) {
   if (basename2(commonDir) === ".git") return dirname2(commonDir);
   return readCoreWorktree(commonDir);
 }
+function describeWorktreeOwner(dir) {
+  const mainRoot = linkedWorktreeMainRoot(dir);
+  if (mainRoot === null) {
+    const bare = bareRepositoryOfWorktree(dir);
+    return bare === null ? "owning repository unknown (unreadable gitlink)" : `owning repository ${bare} is a bare git repository with no main checkout to hold a CLEO store; clone it to a regular checkout, run \`cleo init\` there, and create worktrees from that checkout`;
+  }
+  let projectId = null;
+  try {
+    const parsed = JSON.parse(
+      readFileSync2(join3(mainRoot, ".cleo", "project-info.json"), "utf-8")
+    );
+    if (typeof parsed === "object" && parsed !== null && "projectId" in parsed) {
+      const value = parsed.projectId;
+      if (typeof value === "string" && value !== "") projectId = value;
+    }
+  } catch {
+  }
+  return projectId === null ? `owning repository ${mainRoot} (not an initialised CLEO project)` : `owning project ${mainRoot} (projectId ${projectId})`;
+}
+function bareRepositoryOfWorktree(dir) {
+  const gitdir = readGitlinkTarget(dir);
+  if (!gitdir || basename2(dirname2(gitdir)) !== "worktrees") return null;
+  const commonDir = dirname2(dirname2(gitdir));
+  try {
+    const config2 = readFileSync2(join3(commonDir, "config"), "utf-8");
+    const core = /^\[core\][^[]*/m.exec(config2)?.[0] ?? "";
+    return /^\s*bare\s*=\s*true\s*$/im.test(core) ? commonDir : null;
+  } catch {
+    return null;
+  }
+}
 function readCoreWorktree(gitDir) {
   try {
     const config2 = readFileSync2(join3(gitDir, "config"), "utf-8");
@@ -19208,13 +19295,13 @@ function captureWriteFence(input) {
   return writeFence;
 }
 function observeOperation(context, work) {
-  return new Promise((resolve15) => {
+  return new Promise((resolve17) => {
     let observed = false;
     const finish = (result) => {
       if (observed) return;
       observed = true;
       context.signal.removeEventListener("abort", abort);
-      resolve15(result);
+      resolve17(result);
     };
     const abort = () => {
       const reason = context.signal.reason;
@@ -19848,7 +19935,7 @@ var init_sql = __esm({
         return new SQL([new StringChunk(str)]);
       }
       _sql.raw = raw;
-      function join49(chunks, separator) {
+      function join50(chunks, separator) {
         const result = [];
         for (const [i, chunk] of chunks.entries()) {
           if (i > 0 && separator !== void 0) result.push(separator);
@@ -19856,7 +19943,7 @@ var init_sql = __esm({
         }
         return new SQL(result);
       }
-      _sql.join = join49;
+      _sql.join = join50;
       function identifier2(value) {
         return new Name(value);
       }
@@ -21871,7 +21958,7 @@ var init_select = __esm({
           const baseTableName = this.tableName;
           const tableName = getTableLikeName(table);
           for (const item of extractUsedTable(table)) this.usedTables.add(item);
-          if (typeof tableName === "string" && this.config.joins?.some((join49) => join49.alias === tableName)) throw new Error(`Alias "${tableName}" is already used in this query`);
+          if (typeof tableName === "string" && this.config.joins?.some((join50) => join50.alias === tableName)) throw new Error(`Alias "${tableName}" is already used in this query`);
           if (!this.isPartialSelect) {
             if (Object.keys(this.joinsNotNullableMap).length === 1 && typeof baseTableName === "string") this.config.fields = { [baseTableName]: this.config.fields };
             if (typeof tableName === "string" && !is(table, SQL)) {
@@ -23468,7 +23555,7 @@ var init_dialect = __esm({
           if (!joins2) return;
           const withEntries = Object.entries(joins2).filter(([_, v]) => v);
           if (!withEntries.length) return;
-          return sql.join(withEntries.map(([k, join49]) => {
+          return sql.join(withEntries.map(([k, join50]) => {
             const relation = tableConfig.relations[k];
             const isSingle2 = is(relation, One);
             const targetTable = aliasedTable(relation.targetTable, `d${currentDepth + 1}`);
@@ -23479,7 +23566,7 @@ var init_dialect = __esm({
               table: targetTable,
               mode: isSingle2 ? "first" : "many",
               schema,
-              queryConfig: join49,
+              queryConfig: join50,
               tableConfig: schema[relation.targetTableName],
               relationWhere: filter2,
               isNested: true,
@@ -23493,7 +23580,7 @@ var init_dialect = __esm({
               key: k,
               selection: innerQuery.selection,
               isArray: !isSingle2,
-              isOptional: (relation.optional ?? false) || join49 !== true && !!join49.where
+              isOptional: (relation.optional ?? false) || join50 !== true && !!join50.where
             });
             const jsonColumns = sql.join(innerQuery.selection.map((s) => {
               return sql`${sql.raw(this.escapeString(s.key))}, ${s.selection ? sql`${jsonb2}(${sql.identifier(s.key)})` : sql.identifier(s.key)}`;
@@ -23915,7 +24002,7 @@ var init_update = __esm({
       createJoin(joinType) {
         return ((table, on) => {
           const tableName = getTableLikeName(table);
-          if (typeof tableName === "string" && this.config.joins.some((join49) => join49.alias === tableName)) throw new Error(`Alias "${tableName}" is already used in this query`);
+          if (typeof tableName === "string" && this.config.joins.some((join50) => join50.alias === tableName)) throw new Error(`Alias "${tableName}" is already used in this query`);
           if (typeof on === "function") {
             const from = this.config.from ? is(table, SQLiteTable) ? table[Table.Symbol.Columns] : is(table, Subquery) ? table._.selectedFields : is(table, SQLiteViewBase) ? table[ViewBaseConfig].selectedFields : void 0 : void 0;
             on = on(new Proxy(this.config.table[Table.Symbol.Columns], new SelectionProxyHandler({
@@ -25063,7 +25150,7 @@ async function withWriteRetry(fn, opts = {}) {
   throw contentionErr;
 }
 function sleep(ms) {
-  return new Promise((resolve15) => setTimeout(resolve15, ms));
+  return new Promise((resolve17) => setTimeout(resolve17, ms));
 }
 var DEFAULT_MAX_ATTEMPTS, DEFAULT_BASE_DELAY_MS, DEFAULT_JITTER_MS;
 var init_with_retry = __esm({
@@ -25075,9 +25162,250 @@ var init_with_retry = __esm({
   }
 });
 
+// packages/core/src/store/worktree-build-guard.ts
+import { existsSync as existsSync4, readFileSync as readFileSync3, realpathSync as realpathSync3 } from "node:fs";
+import { createRequire } from "node:module";
+import { dirname as dirname3, isAbsolute as isAbsolute3, join as join5, relative as relative2, resolve as resolve2, sep as sep2 } from "node:path";
+import { fileURLToPath } from "node:url";
+function realOrResolved(path) {
+  try {
+    return realpathSync3(path);
+  } catch {
+    return resolve2(path);
+  }
+}
+function isWithin(root, path) {
+  const local = relative2(root, path);
+  return local === "" || !isAbsolute3(local) && local !== ".." && !local.startsWith(`..${sep2}`);
+}
+function insideGitCheckout(dir) {
+  let current = dir;
+  for (; ; ) {
+    if (existsSync4(join5(current, ".git"))) return true;
+    const parent = dirname3(current);
+    if (parent === current) return false;
+    current = parent;
+  }
+}
+function insideTestSandbox(path) {
+  let dir = dirname3(path);
+  for (; ; ) {
+    if (existsSync4(join5(dir, TEST_SANDBOX_MARKER))) return !insideGitCheckout(dir);
+    const parent = dirname3(dir);
+    if (parent === dir) return false;
+    dir = parent;
+  }
+}
+function linkedWorktreeRootOf(path) {
+  let dir = realOrResolved(path);
+  for (; ; ) {
+    if (isGitLinkedCheckout(dir)) return dir;
+    if (existsSync4(join5(dir, ".git"))) return null;
+    const parent = dirname3(dir);
+    if (parent === dir) return null;
+    dir = parent;
+  }
+}
+function readBuildProvenance(codePath) {
+  let dir = dirname3(codePath);
+  for (; ; ) {
+    const stamp = join5(dir, "build-provenance.json");
+    if (existsSync4(stamp)) {
+      try {
+        const parsed = JSON.parse(readFileSync3(stamp, "utf8"));
+        if (typeof parsed === "object" && parsed !== null && "linkedWorktree" in parsed) {
+          const value = parsed.linkedWorktree;
+          if (value === null || typeof value === "string") return { linkedWorktree: value };
+        }
+      } catch {
+      }
+      return null;
+    }
+    if (existsSync4(join5(dir, "package.json"))) return null;
+    const parent = dirname3(dir);
+    if (parent === dir) return null;
+    dir = parent;
+  }
+}
+function devBuildWorktree(options = {}) {
+  const codePath = options.codePath ?? overrides?.codePath ?? fileURLToPath(import.meta.url);
+  const provenance = options.provenance !== void 0 ? options.provenance : overrides?.provenance !== void 0 ? overrides.provenance : readBuildProvenance(codePath);
+  if (provenance) return provenance.linkedWorktree;
+  if (codePath.split(/[\\/]/).includes("node_modules")) return null;
+  return linkedWorktreeRootOf(codePath);
+}
+function schemaWriteRefusal(dbPath, options = {}) {
+  const env = options.env ?? overrides?.env ?? process.env;
+  const buildWorktree = devBuildWorktree(options);
+  if (buildWorktree === null) return null;
+  const store = realOrResolved(dbPath);
+  if (isWithin(realOrResolved(buildWorktree), store)) return null;
+  if (env["VITEST"]) return null;
+  const honourTestSandbox = options.honourTestSandbox ?? overrides?.honourTestSandbox ?? true;
+  if (honourTestSandbox && insideTestSandbox(store)) return null;
+  if (env[ALLOW_WORKTREE_BUILD_MIGRATIONS_ENV] === "1") return null;
+  return `Refusing to change the schema of ${store}: this CLI was built inside the git worktree ${buildWorktree}, and its schema may be unreleased. Run the released \`cleo\` against this store, or opt in with ${ALLOW_WORKTREE_BUILD_MIGRATIONS_ENV}=1 (T12687).`;
+}
+function decisionFor(dbPath) {
+  const key = realOrResolved(dbPath);
+  if (!decisions.has(key)) decisions.set(key, schemaWriteRefusal(key));
+  return decisions.get(key) ?? null;
+}
+function isWorktreeBuildSchemaError(error48) {
+  return error48 instanceof Error && error48.message.includes(E_WORKTREE_BUILD_SCHEMA);
+}
+function codes() {
+  if (authorizerCodes) return authorizerCodes;
+  const sqlite = createRequire(import.meta.url)("node:sqlite").constants;
+  authorizerCodes = {
+    sqlite,
+    creates: /* @__PURE__ */ new Map([
+      [sqlite.SQLITE_CREATE_TABLE, "table"],
+      [sqlite.SQLITE_CREATE_VTABLE, "table"],
+      [sqlite.SQLITE_CREATE_INDEX, "index"],
+      [sqlite.SQLITE_CREATE_TRIGGER, "trigger"],
+      [sqlite.SQLITE_CREATE_VIEW, "view"]
+    ]),
+    changes: /* @__PURE__ */ new Set([
+      sqlite.SQLITE_ALTER_TABLE,
+      sqlite.SQLITE_DROP_TABLE,
+      sqlite.SQLITE_DROP_INDEX,
+      sqlite.SQLITE_DROP_TRIGGER,
+      sqlite.SQLITE_DROP_VIEW,
+      sqlite.SQLITE_DROP_VTABLE
+    ])
+  };
+  return authorizerCodes;
+}
+function attachRefusal(name15) {
+  if (name15 === "" || name15 === ":memory:") return null;
+  if (typeof name15 !== "string" || /^file:/i.test(name15) || name15.includes("?")) {
+    return UNKNOWN_ATTACH_REFUSAL;
+  }
+  return decisionFor(name15);
+}
+function readSchemas(nativeDb) {
+  const schemas = /* @__PURE__ */ new Map();
+  const list = nativeDb.prepare("PRAGMA database_list").all();
+  for (const { name: name15, file: file2 } of list) {
+    if (name15 === "temp") continue;
+    const rows = nativeDb.prepare(`SELECT type, name FROM "${name15.replaceAll('"', '""')}".sqlite_master`).all();
+    schemas.set(name15.toLowerCase(), {
+      refusal: file2 ? decisionFor(file2) : null,
+      // '' = in-memory
+      objects: new Set(rows.map((r) => `${r.type}:${r.name}`))
+    });
+  }
+  return schemas;
+}
+function guardActive() {
+  const env = overrides?.env ?? process.env;
+  if (env["VITEST"]) return false;
+  if (overrides) return devBuildWorktree() !== null;
+  if (processBuildWorktree === void 0) processBuildWorktree = devBuildWorktree();
+  return processBuildWorktree !== null;
+}
+function installSchemaWriteGuard(nativeDb) {
+  if (!guardActive()) return false;
+  const location = nativeDb.location();
+  const mainRefusal = location ? decisionFor(location) : null;
+  if (typeof nativeDb.setAuthorizer !== "function") {
+    if (mainRefusal) throw new WorktreeBuildSchemaError(mainRefusal);
+    return false;
+  }
+  const state = {
+    schemas: readSchemas(nativeDb),
+    unmappedAttachRefusal: null,
+    stale: false,
+    lastDenied: null
+  };
+  guards.set(nativeDb, state);
+  const { sqlite, creates, changes } = codes();
+  nativeDb.setAuthorizer((action, arg1, arg2, dbName) => {
+    if (action === sqlite.SQLITE_ATTACH) {
+      const refusal2 = attachRefusal(arg1);
+      if (refusal2 && !state.unmappedAttachRefusal) state.unmappedAttachRefusal = refusal2;
+      return sqlite.SQLITE_OK;
+    }
+    if (action === sqlite.SQLITE_DETACH) {
+      state.stale = true;
+      return sqlite.SQLITE_OK;
+    }
+    const createType = creates.get(action);
+    if (createType === void 0 && !changes.has(action)) return sqlite.SQLITE_OK;
+    const schema = ((action === sqlite.SQLITE_ALTER_TABLE ? arg1 : dbName) ?? "main").toLowerCase();
+    if (schema === "temp") return sqlite.SQLITE_OK;
+    const mapped = state.schemas.get(schema);
+    const policy = state.stale ? void 0 : mapped;
+    const refusal = policy ? policy.refusal : (mapped?.refusal ?? null) || state.unmappedAttachRefusal;
+    if (refusal === null) return sqlite.SQLITE_OK;
+    if (createType !== void 0 && policy?.objects.has(`${createType}:${arg1}`)) {
+      return sqlite.SQLITE_OK;
+    }
+    state.lastDenied = {
+      what: createType !== void 0 ? `CREATE ${createType} ${schema}.${arg1}` : `schema change on ${schema}.${(action === sqlite.SQLITE_ALTER_TABLE ? arg2 : arg1) ?? ""}`,
+      refusal
+    };
+    return sqlite.SQLITE_DENY;
+  });
+  return mainRefusal !== null;
+}
+function refreshSchemaWriteGuard(nativeDb) {
+  const state = guards.get(nativeDb);
+  if (!state) return;
+  state.schemas = readSchemas(nativeDb);
+  state.unmappedAttachRefusal = null;
+  state.stale = false;
+}
+function explainSchemaWriteDenial(nativeDb, error48) {
+  if (!(error48 instanceof Error) || !/not authorized/i.test(error48.message)) return error48;
+  const denied = guards.get(nativeDb)?.lastDenied;
+  if (!denied) return error48;
+  return new WorktreeBuildSchemaError(`${denied.refusal} Denied: ${denied.what}.`);
+}
+function pendingMigrations(nativeDb, migrations) {
+  const hasJournal = nativeDb.prepare("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = '__drizzle_migrations'").get();
+  const applied = hasJournal ? new Set(
+    nativeDb.prepare('SELECT hash FROM main."__drizzle_migrations"').all().map((row) => row.hash)
+  ) : /* @__PURE__ */ new Set();
+  return migrations.filter((m) => !applied.has(m.hash)).map((m) => m.name ?? m.hash);
+}
+function assertNoPendingMigrationsForWorktreeBuild(nativeDb, migrations) {
+  const dbPath = nativeDb.location();
+  if (!dbPath) return;
+  const refusal = decisionFor(dbPath);
+  if (refusal === null) return;
+  const pending = pendingMigrations(nativeDb, migrations);
+  if (pending.length === 0) return;
+  throw new WorktreeBuildSchemaError(`${refusal} Pending migrations: ${pending.join(", ")}.`);
+}
+var ALLOW_WORKTREE_BUILD_MIGRATIONS_ENV, TEST_SANDBOX_MARKER, E_WORKTREE_BUILD_SCHEMA, overrides, decisions, WorktreeBuildSchemaError, authorizerCodes, guards, UNKNOWN_ATTACH_REFUSAL, processBuildWorktree;
+var init_worktree_build_guard = __esm({
+  "packages/core/src/store/worktree-build-guard.ts"() {
+    "use strict";
+    init_src();
+    init_errors2();
+    init_project_scope();
+    ALLOW_WORKTREE_BUILD_MIGRATIONS_ENV = "CLEO_ALLOW_WORKTREE_BUILD_MIGRATIONS";
+    TEST_SANDBOX_MARKER = ".cleo-test-sandbox";
+    E_WORKTREE_BUILD_SCHEMA = "E_WORKTREE_BUILD_SCHEMA";
+    overrides = null;
+    decisions = /* @__PURE__ */ new Map();
+    WorktreeBuildSchemaError = class extends CleoError {
+      constructor(message) {
+        super(8 /* CONFIG_ERROR */, `${E_WORKTREE_BUILD_SCHEMA}: ${message}`, {
+          fix: `Use the released \`cleo\` for this store, run the build against a store inside its own worktree, or set ${ALLOW_WORKTREE_BUILD_MIGRATIONS_ENV}=1 to accept the schema change.`
+        });
+      }
+    };
+    guards = /* @__PURE__ */ new WeakMap();
+    UNKNOWN_ATTACH_REFUSAL = "a store was ATTACHed by a bound, computed or URI filename, so this build cannot tell whose store it is; schema changes on unmapped schemas are refused until the guard is refreshed";
+  }
+});
+
 // packages/core/src/store/migration-manager.ts
-import { copyFileSync, existsSync as existsSync4 } from "node:fs";
-import { dirname as dirname3, join as join5 } from "node:path";
+import { copyFileSync, existsSync as existsSync5 } from "node:fs";
+import { dirname as dirname4, join as join6 } from "node:path";
 function stripSqlComments(sql29) {
   return sql29.replace(/--[^\n]*/g, "").replace(/\/\*[\s\S]*?\*\//g, "");
 }
@@ -25116,10 +25444,10 @@ function computeEliminatedTables(migrations) {
   return eliminated;
 }
 function resolveConsolidationCutoverPrefix(migrationsFolder) {
-  const parent = dirname3(migrationsFolder);
+  const parent = dirname4(migrationsFolder);
   for (const setName of ["drizzle-cleo-project", "drizzle-cleo-global"]) {
-    const folder = join5(parent, setName);
-    if (!existsSync4(folder)) continue;
+    const folder = join6(parent, setName);
+    if (!existsSync5(folder)) continue;
     try {
       const consolidation = readMigrationFiles({ migrationsFolder: folder }).find(
         (m) => /-consolidation-cleo-/.test(m.name ?? "")
@@ -25143,7 +25471,7 @@ function tableExists(nativeDb, tableName) {
 }
 function createSafetyBackup(dbPath) {
   const backupPath = dbPath.replace(/\.db$/, "-pre-cleo.db.bak");
-  if (!existsSync4(backupPath)) {
+  if (!existsSync5(backupPath)) {
     try {
       copyFileSync(dbPath, backupPath);
     } catch {
@@ -25261,6 +25589,16 @@ function readSiblingMigrationHashes(siblingFolder) {
     return /* @__PURE__ */ new Set();
   }
 }
+function readSiblingNewestMillis(siblingFolder) {
+  try {
+    return Math.max(
+      0,
+      ...readMigrationFiles({ migrationsFolder: siblingFolder }).map((m) => m.folderMillis)
+    );
+  } catch {
+    return 0;
+  }
+}
 function ensureJournalHashUnique(nativeDb) {
   if (!tableExists(nativeDb, "__drizzle_migrations")) return;
   try {
@@ -25309,6 +25647,7 @@ function upgradeSharedJournalFormat(nativeDb, lineageFolders) {
   return { named, unnamed: rows.length - named };
 }
 function reconcileJournal(nativeDb, migrationsFolder, existenceTable2, logSubsystem, siblingMigrationsFolders = []) {
+  assertNoPendingMigrationsForWorktreeBuild(nativeDb, readMigrationFiles({ migrationsFolder }));
   const eliminatedTables = computeEliminatedTables(readMigrationFiles({ migrationsFolder }));
   const cutoverPrefix = resolveConsolidationCutoverPrefix(migrationsFolder);
   if (siblingMigrationsFolders.length > 0)
@@ -25340,8 +25679,15 @@ function reconcileJournal(nativeDb, migrationsFolder, existenceTable2, logSubsys
         knownHashes.add(m);
       }
     }
-    const dbEntries = nativeDb.prepare('SELECT id, hash FROM "__drizzle_migrations"').all();
-    const orphanedEntries = dbEntries.filter((e) => !knownHashes.has(e.hash));
+    const newestKnownMillis = Math.max(
+      0,
+      ...localMigrations.map((m) => m.folderMillis),
+      ...siblingMigrationsFolders.filter((folder) => folder !== migrationsFolder).map(readSiblingNewestMillis)
+    );
+    const dbEntries = nativeDb.prepare('SELECT id, hash, created_at FROM "__drizzle_migrations"').all();
+    const orphanedEntries = dbEntries.filter(
+      (e) => !knownHashes.has(e.hash) && !(Number(e.created_at) > newestKnownMillis)
+    );
     const hasOrphanedEntries = orphanedEntries.length > 0;
     if (hasOrphanedEntries) {
       const dbHashes = new Set(dbEntries.map((e) => e.hash));
@@ -25583,6 +25929,8 @@ function sanitizeMigrationStatements(migrations) {
 }
 function migrateSanitized(db, config2) {
   const raw = readMigrationFiles(config2);
+  const client = db.$client;
+  if (client) assertNoPendingMigrationsForWorktreeBuild(client, raw);
   const sanitized = sanitizeMigrationStatements(raw);
   migrateSync(sanitized, db._.session, config2);
 }
@@ -25646,6 +25994,7 @@ var init_migration_manager = __esm({
     init_sqlite_core();
     init_logger2();
     init_with_retry();
+    init_worktree_build_guard();
     MAX_MIGRATION_RETRIES = 5;
     MIGRATION_RETRY_BASE_DELAY_MS = 100;
     MIGRATION_RETRY_MAX_DELAY_MS = 2e3;
@@ -25655,13 +26004,13 @@ var init_migration_manager = __esm({
 });
 
 // packages/core/src/store/relocated-store-guard.ts
-import { existsSync as existsSync5, realpathSync as realpathSync3 } from "node:fs";
-import { createRequire } from "node:module";
-import { basename as basename3, dirname as dirname4 } from "node:path";
+import { existsSync as existsSync6, realpathSync as realpathSync4 } from "node:fs";
+import { createRequire as createRequire2 } from "node:module";
+import { basename as basename3, dirname as dirname5 } from "node:path";
 import { readDeclaredProjectIdentity as readDeclaredProjectIdentity2, readPortableProjectId } from "@cleocode/paths";
 function real2(p) {
   try {
-    return realpathSync3(p);
+    return realpathSync4(p);
   } catch {
     return p;
   }
@@ -25678,7 +26027,7 @@ function liveElsewhere(globalDbPath, projectId, root) {
       "SELECT project_path AS projectPath FROM nexus_project_registry WHERE project_id = ?"
     ).get(projectId);
     const live = row?.projectPath;
-    if (!live || paths.has(live) || !existsSync5(live)) return null;
+    if (!live || paths.has(live) || !existsSync6(live)) return null;
     if (!isStrictlyInsideDir(root, live)) return null;
     return readDeclaredProjectIdentity2(live)?.projectId === projectId ? live : null;
   } catch {
@@ -25692,14 +26041,14 @@ function detectRelocatedRoot(root, globalDbPath) {
   if (tombstone)
     return { projectId: tombstone.projectId, movedTo: tombstone.movedTo, via: "tombstone" };
   const declared = readPortableProjectId(root);
-  if (declared.status !== "valid" || !existsSync5(globalDbPath)) return null;
+  if (declared.status !== "valid" || !existsSync6(globalDbPath)) return null;
   const movedTo = liveElsewhere(globalDbPath, declared.projectId, root);
   return movedTo ? { projectId: declared.projectId, movedTo, via: "registry" } : null;
 }
 function assertStoreNotRelocated(dbPath, globalDbPath) {
-  if (basename3(dbPath) !== "cleo.db" || basename3(dirname4(dbPath)) !== ".cleo") return;
-  if (existsSync5(dbPath) || globalDbPath === dbPath) return;
-  const root = dirname4(dirname4(dbPath));
+  if (basename3(dbPath) !== "cleo.db" || basename3(dirname5(dbPath)) !== ".cleo") return;
+  if (existsSync6(dbPath) || globalDbPath === dbPath) return;
+  const root = dirname5(dirname5(dbPath));
   if (_adopted.has(root)) return;
   const moved = detectRelocatedRoot(root, globalDbPath);
   if (moved) throw projectMovedError(root, moved, void 0, moved.via);
@@ -25709,17 +26058,17 @@ var init_relocated_store_guard = __esm({
   "packages/core/src/store/relocated-store-guard.ts"() {
     "use strict";
     init_project_tombstone();
-    _require = createRequire(import.meta.url);
+    _require = createRequire2(import.meta.url);
     _adopted = /* @__PURE__ */ new Set();
   }
 });
 
 // packages/core/src/store/resolve-migrations-folder.ts
-import { createRequire as createRequire2 } from "node:module";
-import { dirname as dirname5, join as join6 } from "node:path";
-import { fileURLToPath } from "node:url";
+import { createRequire as createRequire3 } from "node:module";
+import { dirname as dirname6, join as join7 } from "node:path";
+import { fileURLToPath as fileURLToPath2 } from "node:url";
 function coreRootFromEntry(entryPath) {
-  return dirname5(dirname5(entryPath));
+  return dirname6(dirname6(entryPath));
 }
 function resolveConsolidatedJournalSiblings(ownSetName) {
   return CONSOLIDATED_JOURNAL_LINEAGES.filter((name15) => name15 !== ownSetName).map(
@@ -25729,14 +26078,14 @@ function resolveConsolidatedJournalSiblings(ownSetName) {
 function resolveCorePackageMigrationsFolder(setName) {
   try {
     const resolved = import.meta.resolve("@cleocode/core", import.meta.url);
-    const entryPath = fileURLToPath(resolved);
-    return join6(coreRootFromEntry(entryPath), "migrations", setName);
+    const entryPath = fileURLToPath2(resolved);
+    return join7(coreRootFromEntry(entryPath), "migrations", setName);
   } catch {
   }
-  const _require7 = createRequire2(import.meta.url);
+  const _require7 = createRequire3(import.meta.url);
   try {
     const entryPath = _require7.resolve("@cleocode/core");
-    return join6(coreRootFromEntry(entryPath), "migrations", setName);
+    return join7(coreRootFromEntry(entryPath), "migrations", setName);
   } catch (err) {
     throw new Error(
       `resolveCorePackageMigrationsFolder("${setName}"): cannot locate @cleocode/core from "${import.meta.url}". Ensure @cleocode/core is installed (workspace or npm). Original error: ${err.message}`
@@ -25832,11 +26181,11 @@ var init_sqlite_pragmas = __esm({
 });
 
 // packages/core/src/store/worktree-isolation-guard.ts
-import { basename as basename4, dirname as dirname6, join as join7 } from "node:path";
+import { basename as basename4, dirname as dirname7, join as join8, resolve as resolve3 } from "node:path";
 function assertStorePathIsNotWorktreeResident(role, dbPath) {
-  const cleoDir = dirname6(dbPath);
+  const cleoDir = dirname7(dbPath);
   if (basename4(cleoDir) !== ".cleo") return;
-  const projectRoot = dirname6(cleoDir);
+  const projectRoot = dirname7(cleoDir);
   if (!isGitLinkedCheckout(projectRoot)) return;
   if (process.env["CLEO_ALLOW_WORKTREE_DB_CREATE"] === "1") {
     process.stderr.write(
@@ -25845,9 +26194,10 @@ function assertStorePathIsNotWorktreeResident(role, dbPath) {
     );
     return;
   }
+  const owner = describeWorktreeOwner(projectRoot);
   throw new CleoError(
     8 /* CONFIG_ERROR */,
-    `E_WT_DB_ISOLATION_VIOLATION: refusing to open '${role}' DB at ${dbPath} \u2014 parent ${projectRoot} is a git worktree (gitlink). DBs must open against the canonical project root.`,
+    `E_WT_DB_ISOLATION_VIOLATION: refusing to open '${role}' DB at ${dbPath} \u2014 parent ${projectRoot} is a git worktree (gitlink); ${owner}. DBs must open against the canonical project root.`,
     {
       fix: `Run from the canonical project root, or make sure the worktree's main repository is an initialised CLEO project so it resolves there. Inspect stranded worktree stores with \`cleo doctor worktree-stores\`. Emergency override (audited): CLEO_ALLOW_WORKTREE_DB_CREATE=1.`
     }
@@ -25860,7 +26210,7 @@ function assertDbPathIsNotWorktreeResident(role, cwd) {
   } catch {
     return;
   }
-  assertStorePathIsNotWorktreeResident(role, join7(cleoDir, PROJECT_STORE_FILENAME2));
+  assertStorePathIsNotWorktreeResident(role, join8(cleoDir, PROJECT_STORE_FILENAME2));
 }
 var PROJECT_STORE_FILENAME2;
 var init_worktree_isolation_guard = __esm({
@@ -25880,10 +26230,10 @@ __export(sqlite_native_exports, {
   getDbSyncConstructor: () => getDbSyncConstructor,
   openNativeDatabase: () => openNativeDatabase
 });
-import { realpathSync as realpathSync4 } from "node:fs";
-import { createRequire as createRequire3 } from "node:module";
+import { realpathSync as realpathSync5 } from "node:fs";
+import { createRequire as createRequire4 } from "node:module";
 import { tmpdir as tmpdir2 } from "node:os";
-import { delimiter, dirname as dirname7, isAbsolute as isAbsolute3, join as join8, resolve as resolve2, sep as sep2 } from "node:path";
+import { delimiter, dirname as dirname8, isAbsolute as isAbsolute4, join as join9, resolve as resolve4, sep as sep3 } from "node:path";
 function getDbSyncConstructor() {
   if (_ctor === null) {
     const mod = _require2("node:sqlite");
@@ -25892,19 +26242,19 @@ function getDbSyncConstructor() {
   return _ctor;
 }
 function resolveAbsoluteSafe(p) {
-  const abs = isAbsolute3(p) ? p : resolve2(p);
+  const abs = isAbsolute4(p) ? p : resolve4(p);
   try {
-    return realpathSync4(abs);
+    return realpathSync5(abs);
   } catch {
     const missingParts = [];
     let cursor = abs;
     while (true) {
-      const parent = dirname7(cursor);
+      const parent = dirname8(cursor);
       if (parent === cursor) return abs;
-      missingParts.unshift(cursor.slice(parent.length + (parent.endsWith(sep2) ? 0 : 1)));
+      missingParts.unshift(cursor.slice(parent.length + (parent.endsWith(sep3) ? 0 : 1)));
       cursor = parent;
       try {
-        return join8(realpathSync4(cursor), ...missingParts);
+        return join9(realpathSync5(cursor), ...missingParts);
       } catch {
       }
     }
@@ -25912,7 +26262,7 @@ function resolveAbsoluteSafe(p) {
 }
 function isPathUnder(child, parent) {
   if (child === parent) return true;
-  const withSep = parent.endsWith(sep2) ? parent : parent + sep2;
+  const withSep = parent.endsWith(sep3) ? parent : parent + sep3;
   return child.startsWith(withSep);
 }
 function assertVitestSafePath(path) {
@@ -25935,6 +26285,7 @@ function openNativeDatabase(path, options) {
   assertVitestSafePath(path);
   const DatabaseSyncCtor = getDbSyncConstructor();
   const db = new DatabaseSyncCtor(path, {
+    // schema-guard-exempt: the native chokepoint; every writable caller installs the guard
     enableForeignKeyConstraints: true,
     readOnly: options?.readonly ?? false,
     // Default handle-open lock timeout mirrors the SSoT busy_timeout
@@ -25986,7 +26337,7 @@ var init_sqlite_native = __esm({
   "packages/core/src/store/sqlite-native.ts"() {
     "use strict";
     init_sqlite_pragmas();
-    _require2 = createRequire3(import.meta.url);
+    _require2 = createRequire4(import.meta.url);
     _ctor = null;
   }
 });
@@ -26060,7 +26411,7 @@ var init_writer_lease_schema = __esm({
 // packages/core/src/store/writer-lease.ts
 import { AsyncLocalStorage as AsyncLocalStorage3 } from "node:async_hooks";
 import { randomUUID } from "node:crypto";
-import { realpathSync as realpathSync5, statSync as statSync2 } from "node:fs";
+import { realpathSync as realpathSync6, statSync as statSync2 } from "node:fs";
 import { resolve as resolvePath } from "node:path";
 function log() {
   if (_log === null) _log = getLogger("writer-lease");
@@ -26150,7 +26501,7 @@ function resolveDbIdentity(db) {
   return identity;
 }
 function sleepAsync(ms) {
-  return new Promise((resolve15) => setTimeout(resolve15, Math.max(0, Math.round(ms))));
+  return new Promise((resolve17) => setTimeout(resolve17, Math.max(0, Math.round(ms))));
 }
 function isPidAlive(pid) {
   try {
@@ -26489,7 +26840,7 @@ function assertColdOpenFile(frame) {
 async function withRequiredColdOpenLease(scope, nativeDb, fn, opts) {
   opts.execution?.assertActive();
   const captured = opts.requiredIdentity;
-  const path = realpathSync5(captured.dbPath);
+  const path = realpathSync6(captured.dbPath);
   const identity = statSync2(path, { bigint: true });
   if (captured.scope !== scope || captured.fileDevice !== String(identity.dev) || captured.fileInode !== String(identity.ino)) {
     throw new LeaseUnavailableError(
@@ -26522,6 +26873,7 @@ async function withRequiredColdOpenLease(scope, nativeDb, fn, opts) {
   }
   const remaining = opts.execution ? Math.max(1, opts.execution.deadlineAt - Date.now()) : ACQUIRE_DEADLINE_MS;
   const owned = openNativeDatabase(path, { timeout: Math.min(ACQUIRE_DEADLINE_MS, remaining) });
+  installSchemaWriteGuard(owned);
   try {
     opts.execution?.assertActive();
     const afterOpen = statSync2(path, { bigint: true });
@@ -26715,6 +27067,7 @@ var init_writer_lease = __esm({
     init_background_ops();
     init_dual_scope_db();
     init_sqlite_native();
+    init_worktree_build_guard();
     init_writer_lease_schema();
     DEFAULT_TTL_MS = 3e4;
     DEFAULT_PRIORITY = 100;
@@ -27257,10 +27610,10 @@ var init_monitor = __esm({
 
 // packages/core/src/resources/supervisor-admit.ts
 import { connect } from "node:net";
-import { join as join9 } from "node:path";
+import { join as join10 } from "node:path";
 import { getCleoHome as getCleoHome2 } from "@cleocode/paths";
 function resolveSupervisorSocketPath() {
-  return process.env.CLEO_SUPERVISOR_SOCKET ?? join9(getCleoHome2(), SUPERVISOR_SOCKET_NAME);
+  return process.env.CLEO_SUPERVISOR_SOCKET ?? join10(getCleoHome2(), SUPERVISOR_SOCKET_NAME);
 }
 async function sendResourceAdmit(socketPath, cls, holderId, budget) {
   const result = await sendLeaseRequest(
@@ -27283,7 +27636,7 @@ async function sendResourceRelease(socketPath, cls, holderId) {
   return { unavailable: true, reason: `unexpected response kind: ${result.kind}` };
 }
 function sendLeaseRequest(socketPath, request, expectedKind) {
-  return new Promise((resolve15) => {
+  return new Promise((resolve17) => {
     const id = `ra-${process.pid}-${request.kind}`;
     const envelope = LeaseIpcRequestEnvelopeSchema.parse({
       protocol_version: LEASE_IPC_PROTOCOL_VERSION,
@@ -27301,7 +27654,7 @@ function sendLeaseRequest(socketPath, request, expectedKind) {
       settled = true;
       socket.removeAllListeners();
       socket.destroy();
-      resolve15(value);
+      resolve17(value);
     };
     const degrade = (reason) => done({ unavailable: true, reason });
     socket.setTimeout(REQUEST_TIMEOUT_MS);
@@ -27372,9 +27725,9 @@ __export(governor_exports, {
   resolveGovernorMode: () => resolveGovernorMode,
   slotFileCount: () => slotFileCount
 });
-import { existsSync as existsSync6, mkdirSync, readdirSync as readdirSync2, writeFileSync as writeFileSync3 } from "node:fs";
+import { existsSync as existsSync7, mkdirSync, readdirSync as readdirSync2, writeFileSync as writeFileSync3 } from "node:fs";
 import { availableParallelism, totalmem } from "node:os";
-import { join as join10 } from "node:path";
+import { join as join11 } from "node:path";
 import lockfile from "proper-lockfile";
 function log2() {
   if (_log2 === null) _log2 = getLogger("resource-governor");
@@ -27443,14 +27796,14 @@ function clamp(lo, v, hi) {
   return Math.max(lo, Math.min(v, hi));
 }
 function governorSlotDir(cls) {
-  return join10(getCleoHome(), "locks", `resource-${cls}`);
+  return join11(getCleoHome(), "locks", `resource-${cls}`);
 }
 function ensureSlotFiles(dir, count) {
-  if (!existsSync6(dir)) mkdirSync(dir, { recursive: true });
+  if (!existsSync7(dir)) mkdirSync(dir, { recursive: true });
   const paths = [];
   for (let i = 0; i < count; i++) {
-    const p = join10(dir, `slot-${i}.lock`);
-    if (!existsSync6(p)) writeFileSync3(p, "", { flag: "a" });
+    const p = join11(dir, `slot-${i}.lock`);
+    if (!existsSync7(p)) writeFileSync3(p, "", { flag: "a" });
     paths.push(p);
   }
   return paths;
@@ -27490,7 +27843,7 @@ function shuffledIndices(n) {
 }
 async function countHeldSlots(cls, budget) {
   const dir = governorSlotDir(cls);
-  if (!existsSync6(dir)) return 0;
+  if (!existsSync7(dir)) return 0;
   const slots = ensureSlotFiles(dir, budget);
   let held = 0;
   for (const path of slots) {
@@ -27505,7 +27858,7 @@ async function countHeldSlots(cls, budget) {
 }
 function slotFileCount(cls) {
   const dir = governorSlotDir(cls);
-  if (!existsSync6(dir)) return 0;
+  if (!existsSync7(dir)) return 0;
   return readdirSync2(dir).filter((f) => f.startsWith("slot-") && f.endsWith(".lock")).length;
 }
 var _log2, _cachedMode2, _supervisorDegradeLogged, MB, STALE_MS, _supervisorHolderSeq, ResourceGovernor, governor;
@@ -27705,11 +28058,11 @@ var init_lock = __esm({
 
 // packages/core/src/store/atomic.ts
 import { mkdir, readFile as readFile2, rename, unlink } from "node:fs/promises";
-import { dirname as dirname8 } from "node:path";
+import { dirname as dirname9 } from "node:path";
 import writeFileAtomic from "write-file-atomic";
 async function atomicWrite(filePath, data, options) {
   try {
-    await mkdir(dirname8(filePath), { recursive: true });
+    await mkdir(dirname9(filePath), { recursive: true });
     await writeFileAtomic(filePath, data, {
       encoding: options?.encoding ?? "utf8",
       mode: options?.mode
@@ -27742,7 +28095,7 @@ var init_atomic = __esm({
 
 // packages/core/src/store/backup.ts
 import { copyFile, rename as fsRename, mkdir as mkdir2, readdir, stat as stat2, unlink as unlink2 } from "node:fs/promises";
-import { basename as basename5, join as join11 } from "node:path";
+import { basename as basename5, dirname as dirname10, join as join12 } from "node:path";
 async function createBackup(filePath, backupDir, maxBackups = DEFAULT_MAX_BACKUPS) {
   try {
     await mkdir2(backupDir, { recursive: true });
@@ -27753,14 +28106,14 @@ async function createBackup(filePath, backupDir, maxBackups = DEFAULT_MAX_BACKUP
       throw new CleoError(3 /* FILE_ERROR */, `Cannot backup: source file not found: ${filePath}`);
     }
     for (let i = maxBackups; i >= 1; i--) {
-      const current = join11(backupDir, `${fileName}.${i}`);
+      const current = join12(backupDir, `${fileName}.${i}`);
       if (i === maxBackups) {
         try {
           await unlink2(current);
         } catch {
         }
       } else {
-        const next = join11(backupDir, `${fileName}.${i + 1}`);
+        const next = join12(backupDir, `${fileName}.${i + 1}`);
         try {
           await stat2(current);
           await fsRename(current, next);
@@ -27768,7 +28121,7 @@ async function createBackup(filePath, backupDir, maxBackups = DEFAULT_MAX_BACKUP
         }
       }
     }
-    const backupPath = join11(backupDir, `${fileName}.1`);
+    const backupPath = join12(backupDir, `${fileName}.1`);
     await copyFile(filePath, backupPath);
     return backupPath;
   } catch (err) {
@@ -27782,6 +28135,7 @@ var init_backup = __esm({
     "use strict";
     init_src();
     init_errors2();
+    init_worktree_isolation_guard();
     DEFAULT_MAX_BACKUPS = 5;
   }
 });
@@ -28066,7 +28420,7 @@ __export(identity_exports, {
 import { execFile } from "node:child_process";
 import { createHash as createHash2 } from "node:crypto";
 import { readFile as readFile3 } from "node:fs/promises";
-import { join as join12, resolve as resolve3 } from "node:path";
+import { join as join13, resolve as resolve5 } from "node:path";
 import { promisify } from "node:util";
 import { legacyProjectId } from "@cleocode/paths";
 import { legacyProjectId as legacyProjectId2 } from "@cleocode/paths";
@@ -28074,14 +28428,14 @@ async function findGitRoot(fromPath, execution) {
   execution?.assertActive();
   try {
     const { stdout } = await execFileAsync("git", ["rev-parse", "--show-toplevel"], {
-      cwd: resolve3(fromPath),
+      cwd: resolve5(fromPath),
       signal: execution?.signal,
       timeout: execution ? Math.max(1, execution.remainingMs()) : void 0,
       killSignal: "SIGKILL",
       maxBuffer: 64 * 1024
     });
     execution?.assertActive();
-    return resolve3(stdout.trim());
+    return resolve5(stdout.trim());
   } catch {
     execution?.assertActive();
     return null;
@@ -28091,7 +28445,7 @@ async function findGitRemoteUrl(fromPath, execution) {
   execution?.assertActive();
   try {
     const { stdout } = await execFileAsync("git", ["remote", "get-url", "origin"], {
-      cwd: resolve3(fromPath),
+      cwd: resolve5(fromPath),
       signal: execution?.signal,
       timeout: execution ? Math.max(1, execution.remainingMs()) : void 0,
       killSignal: "SIGKILL",
@@ -28121,7 +28475,7 @@ async function collectCheckoutEvidence(fromPath, execution) {
     try {
       const args = ["--no-replace-objects", "rev-list", "--max-parents=0", "HEAD"];
       const { stdout } = await execFileAsync("git", args, {
-        cwd: resolve3(fromPath),
+        cwd: resolve5(fromPath),
         signal: execution?.signal,
         timeout: execution ? Math.max(1, execution.remainingMs()) : void 0,
         killSignal: "SIGKILL",
@@ -28144,7 +28498,7 @@ async function collectCheckoutEvidence(fromPath, execution) {
 async function readProjectInfoName(repoRoot, execution) {
   execution?.assertActive();
   try {
-    const raw = await readFile3(join12(repoRoot, ".cleo", "project-info.json"), {
+    const raw = await readFile3(join13(repoRoot, ".cleo", "project-info.json"), {
       encoding: "utf8",
       signal: execution?.signal
     });
@@ -28159,7 +28513,7 @@ async function readProjectInfoName(repoRoot, execution) {
 }
 async function projectPathFingerprint(repoPath, execution) {
   execution?.assertActive();
-  const realRepoPath = resolve3(repoPath);
+  const realRepoPath = resolve5(repoPath);
   const results = await Promise.allSettled([
     findGitRoot(realRepoPath, execution),
     findGitRemoteUrl(realRepoPath, execution)
@@ -28183,9 +28537,9 @@ async function projectPathFingerprint(repoPath, execution) {
 }
 function computeLegacyAliases(repoPath, additionalPaths) {
   const aliases = /* @__PURE__ */ new Set();
-  aliases.add(legacyProjectId(resolve3(repoPath)));
+  aliases.add(legacyProjectId(resolve5(repoPath)));
   for (const p of additionalPaths ?? []) {
-    aliases.add(legacyProjectId(resolve3(p)));
+    aliases.add(legacyProjectId(resolve5(p)));
   }
   return [...aliases];
 }
@@ -28219,17 +28573,17 @@ var init_project_identity = __esm({
 });
 
 // packages/core/src/scaffold/ensure-config.ts
-import { existsSync as existsSync7, readFileSync as readFileSync3 } from "node:fs";
-import { basename as basename6, dirname as dirname9, join as join13, resolve as resolve4 } from "node:path";
-import { fileURLToPath as fileURLToPath2 } from "node:url";
+import { existsSync as existsSync8, readFileSync as readFileSync4 } from "node:fs";
+import { basename as basename6, dirname as dirname11, join as join14, resolve as resolve6 } from "node:path";
+import { fileURLToPath as fileURLToPath3 } from "node:url";
 function getPackageRoot() {
-  const thisFile = fileURLToPath2(import.meta.url);
-  return resolve4(dirname9(thisFile), "..", "..");
+  const thisFile = fileURLToPath3(import.meta.url);
+  return resolve6(dirname11(thisFile), "..", "..");
 }
 function getCleoVersion() {
   try {
-    const pkgPath = join13(getPackageRoot(), "package.json");
-    const pkg = JSON.parse(readFileSync3(pkgPath, "utf-8"));
+    const pkgPath = join14(getPackageRoot(), "package.json");
+    const pkg = JSON.parse(readFileSync4(pkgPath, "utf-8"));
     return pkg.version ?? "0.0.0";
   } catch {
     return "0.0.0";
@@ -28588,25 +28942,25 @@ var init_recovery = __esm({
 // packages/core/src/store/exodus/archive.ts
 import {
   copyFileSync as copyFileSync2,
-  existsSync as existsSync8,
+  existsSync as existsSync9,
   mkdirSync as mkdirSync2,
-  readFileSync as readFileSync4,
+  readFileSync as readFileSync5,
   renameSync as renameSync3,
   unlinkSync,
   writeFileSync as writeFileSync4
 } from "node:fs";
-import { basename as basename7, dirname as dirname10, join as join14, resolve as resolve5 } from "node:path";
+import { basename as basename7, dirname as dirname12, join as join15, resolve as resolve7 } from "node:path";
 import { z as z26 } from "zod";
 function scopeBaseDir(scope, cwd, targetDbPath) {
-  if (targetDbPath !== void 0) return dirname10(targetDbPath);
+  if (targetDbPath !== void 0) return dirname12(targetDbPath);
   return scope === "project" ? resolveCleoDir(cwd) : getCleoHome();
 }
 function exodusArchiveDir(scope, cwd, targetDbPath) {
-  return join14(scopeBaseDir(scope, cwd, targetDbPath), ARCHIVE_DIR_NAME);
+  return join15(scopeBaseDir(scope, cwd, targetDbPath), ARCHIVE_DIR_NAME);
 }
 function exodusMarkerPath(scope, cwd, targetDbPath) {
   const marker16 = targetDbPath !== void 0 && basename7(targetDbPath) !== "cleo.db" ? `${basename7(targetDbPath)}.${MARKER_FILENAME_BY_SCOPE[scope]}` : MARKER_FILENAME_BY_SCOPE[scope];
-  return join14(scopeBaseDir(scope, cwd, targetDbPath), marker16);
+  return join15(scopeBaseDir(scope, cwd, targetDbPath), marker16);
 }
 function hasExodusCompleteMarker(scope, cwd, targetDbPath, nativeDb) {
   let markerPath;
@@ -28616,13 +28970,13 @@ function hasExodusCompleteMarker(scope, cwd, targetDbPath, nativeDb) {
     if (targetDbPath) throw error48;
     return false;
   }
-  if (!existsSync8(markerPath)) return false;
-  const marker16 = markerIdentity.parse(JSON.parse(readFileSync4(markerPath, "utf8")));
+  if (!existsSync9(markerPath)) return false;
+  const marker16 = markerIdentity.parse(JSON.parse(readFileSync5(markerPath, "utf8")));
   if (nativeDb && (!marker16.databaseIdentity || !hasExodusDatabaseIdentity(nativeDb, marker16.databaseIdentity)))
     throw new Error(
       "Exodus completion marker does not certify this database generation; assessment required"
     );
-  return marker16.scope === scope && (!targetDbPath || !marker16.targetDbPath || resolve5(marker16.targetDbPath) === resolve5(targetDbPath));
+  return marker16.scope === scope && (!targetDbPath || !marker16.targetDbPath || resolve7(marker16.targetDbPath) === resolve7(targetDbPath));
 }
 function writeExodusCompleteMarker(scope, archivedSources, cwd, targetDbPath, databaseIdentity) {
   const markerPath = exodusMarkerPath(scope, cwd, targetDbPath);
@@ -28634,7 +28988,7 @@ function writeExodusCompleteMarker(scope, archivedSources, cwd, targetDbPath, da
     cleoVersion: getCleoVersion(),
     completedAt: (/* @__PURE__ */ new Date()).toISOString(),
     archivedSources: [...archivedSources],
-    targetDbPath: resolve5(targetDbPath ?? join14(baseDir, "cleo.db")),
+    targetDbPath: resolve7(targetDbPath ?? join15(baseDir, "cleo.db")),
     ...databaseIdentity ? { databaseIdentity } : {}
   };
   const tmpPath = `${markerPath}.tmp`;
@@ -28645,10 +28999,10 @@ function writeExodusCompleteMarker(scope, archivedSources, cwd, targetDbPath, da
 }
 function moveFileInto(srcPath, destDir) {
   mkdirSync2(destDir, { recursive: true });
-  let dest = join14(destDir, basename7(srcPath));
-  if (existsSync8(dest)) {
+  let dest = join15(destDir, basename7(srcPath));
+  if (existsSync9(dest)) {
     const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "").replace(/Z$/, "Z");
-    dest = join14(destDir, `${basename7(srcPath)}.${stamp}`);
+    dest = join15(destDir, `${basename7(srcPath)}.${stamp}`);
   }
   try {
     renameSync3(srcPath, dest);
@@ -28659,14 +29013,14 @@ function moveFileInto(srcPath, destDir) {
   return dest;
 }
 function archiveSourceDb(source, cwd, targetDbPath) {
-  if (!existsSync8(source.path)) {
+  if (!existsSync9(source.path)) {
     return { name: source.name, sourcePath: source.path, archivedTo: null, action: "absent" };
   }
   const destDir = exodusArchiveDir(source.targetScope, cwd, targetDbPath);
   const archivedTo = moveFileInto(source.path, destDir);
   for (const suffix of SIDECAR_SUFFIXES) {
     const sidecar = `${source.path}${suffix}`;
-    if (existsSync8(sidecar)) {
+    if (existsSync9(sidecar)) {
       try {
         moveFileInto(sidecar, destDir);
       } catch (err) {
@@ -28714,7 +29068,7 @@ function detectStrandedResidue(sources, cwd) {
   const stranded = [];
   for (const source of sources) {
     if (!markedScopes.has(source.targetScope)) continue;
-    if (existsSync8(source.path)) {
+    if (existsSync9(source.path)) {
       stranded.push({ name: source.name, path: source.path, scope: source.targetScope });
     }
   }
@@ -28779,7 +29133,7 @@ __export(open_cleo_db_exports, {
   openCleoDbSnapshot: () => openCleoDbSnapshot,
   validateProjectIdConsistency: () => validateProjectIdConsistency
 });
-import { createRequire as createRequire4 } from "node:module";
+import { createRequire as createRequire5 } from "node:module";
 function unwrapNativeSqliteDb(db) {
   if (db && typeof db === "object" && "$client" in db) {
     return db.$client ?? db;
@@ -28843,9 +29197,10 @@ async function openCleoDb(role, cwd) {
 }
 function openCleoDbSnapshot(path, options = {}) {
   const { readOnly = true, applyPragmas = true } = options;
-  const _require7 = createRequire4(import.meta.url);
+  const _require7 = createRequire5(import.meta.url);
   const { DatabaseSync: DatabaseSyncCtor } = _require7("node:sqlite");
   const db = new DatabaseSyncCtor(path, { readOnly });
+  if (!readOnly) installSchemaWriteGuard(db);
   if (applyPragmas) {
     applyPerfPragmas(db, { enableWal: !readOnly });
   }
@@ -28873,6 +29228,7 @@ var init_open_cleo_db = __esm({
     init_project_info();
     init_dual_scope_db();
     init_sqlite_pragmas();
+    init_worktree_build_guard();
     init_worktree_isolation_guard();
     PROJECT_ID_TRACKING_ROLES = /* @__PURE__ */ new Set(["global"]);
   }
@@ -29212,7 +29568,7 @@ var init_table_name_map = __esm({
 });
 
 // packages/core/src/store/exodus/count-parity.ts
-import { existsSync as existsSync9 } from "node:fs";
+import { existsSync as existsSync10 } from "node:fs";
 function listTables(db) {
   return db.prepare(
     "SELECT name FROM sqlite_master WHERE type='table' AND name NOT LIKE 'sqlite_%' AND name NOT LIKE '__drizzle_%' ORDER BY name"
@@ -29233,14 +29589,14 @@ function rowCount(db, tableName) {
 function computeCountParity(sources, projectDbPath, globalDbPath) {
   const entries = [];
   let skipped = 0;
-  if (!existsSync9(projectDbPath) || !existsSync9(globalDbPath)) {
+  if (!existsSync10(projectDbPath) || !existsSync10(globalDbPath)) {
     return { ok: false, entries: [], deficits: [], checked: 0, skipped: 0 };
   }
   const projectSnap = openCleoDbSnapshot(projectDbPath, { readOnly: true });
   const globalSnap = openCleoDbSnapshot(globalDbPath, { readOnly: true });
   try {
     for (const src of sources) {
-      if (!existsSync9(src.path)) continue;
+      if (!existsSync10(src.path)) continue;
       const srcSnap = openCleoDbSnapshot(src.path, { readOnly: true });
       try {
         for (const legacyTable of listTables(srcSnap.db)) {
@@ -29298,8 +29654,8 @@ var init_count_parity = __esm({
 });
 
 // packages/core/src/store/exodus/plan.ts
-import { existsSync as existsSync10, readdirSync as readdirSync3, statfsSync, statSync as statSync3 } from "node:fs";
-import { join as join15 } from "node:path";
+import { existsSync as existsSync11, readdirSync as readdirSync3, statfsSync, statSync as statSync3 } from "node:fs";
+import { join as join16 } from "node:path";
 function computeRequiredBytes(totalSourceBytes, largestSourceBytes) {
   return Math.ceil(STAGING_HEADROOM_FACTOR * largestSourceBytes) + totalSourceBytes;
 }
@@ -29310,33 +29666,33 @@ function buildSourceDescriptors(cwd) {
     // Project-tier — go into consolidated project-scope cleo.db
     {
       name: "tasks",
-      path: join15(cleoDir, "tasks.db"),
+      path: join16(cleoDir, "tasks.db"),
       targetScope: "project"
     },
     {
       name: "brain (project)",
-      path: join15(cleoDir, "brain.db"),
+      path: join16(cleoDir, "brain.db"),
       targetScope: "project"
     },
     {
       name: "conduit",
-      path: join15(cleoDir, "conduit.db"),
+      path: join16(cleoDir, "conduit.db"),
       targetScope: "project"
     },
     // Global-tier — go into consolidated global-scope cleo.db
     {
       name: "nexus",
-      path: join15(cleoHome, "nexus.db"),
+      path: join16(cleoHome, "nexus.db"),
       targetScope: "global"
     },
     {
       name: "signaldock",
-      path: join15(cleoHome, "signaldock.db"),
+      path: join16(cleoHome, "signaldock.db"),
       targetScope: "global"
     },
     {
       name: "skills",
-      path: join15(cleoHome, "skills.db"),
+      path: join16(cleoHome, "skills.db"),
       targetScope: "global"
     }
   ];
@@ -29365,7 +29721,7 @@ function findExistingStaging(cleoDir) {
     const entries = readdirSync3(cleoDir, { withFileTypes: true });
     const stagingDirs = entries.filter((e) => e.isDirectory() && e.name.startsWith("exodus-staging-")).map((e) => e.name).sort().reverse();
     if (stagingDirs.length > 0) {
-      return join15(cleoDir, stagingDirs[0]);
+      return join16(cleoDir, stagingDirs[0]);
     }
   } catch {
   }
@@ -29381,7 +29737,7 @@ function buildExodusPlan(cwd) {
   const availableBytes = getAvailableBytes(cleoDir);
   const diskPreflight = totalSourceBytes === 0 || availableBytes >= requiredBytes;
   const existingStaging = findExistingStaging(cleoDir);
-  const stagingDir = existingStaging ?? join15(cleoDir, deriveStagingDirName());
+  const stagingDir = existingStaging ?? join16(cleoDir, deriveStagingDirName());
   const resumeFromStaging = existingStaging !== null;
   const projectDbPath = resolveDualScopeDbPath("project", cwd);
   const globalDbPath = resolveDualScopeDbPath("global");
@@ -29400,7 +29756,7 @@ function buildExodusPlan(cwd) {
   };
 }
 function sourcesPresent(sources) {
-  return sources.some((s) => existsSync10(s.path));
+  return sources.some((s) => existsSync11(s.path));
 }
 var STAGING_HEADROOM_FACTOR, STAGING_COPY_SKIP_THRESHOLD_BYTES;
 var init_plan2 = __esm({
@@ -29414,18 +29770,18 @@ var init_plan2 = __esm({
 });
 
 // packages/core/src/store/exodus/health.ts
-import { existsSync as existsSync11, statSync as statSync4 } from "node:fs";
+import { existsSync as existsSync12, statSync as statSync4 } from "node:fs";
 function buildExodusHealth(cwd) {
   const plan = buildExodusPlan(cwd);
-  const anyLegacyPresent = plan.sources.some((s) => existsSync11(s.path));
+  const anyLegacyPresent = plan.sources.some((s) => existsSync12(s.path));
   const parity = anyLegacyPresent ? computeCountParity(plan.sources, plan.projectDbPath, plan.globalDbPath) : { ok: true, entries: [], deficits: [], checked: 0, skipped: 0 };
   const consolidatedExistsByScope = {
-    project: existsSync11(plan.projectDbPath),
-    global: existsSync11(plan.globalDbPath)
+    project: existsSync12(plan.projectDbPath),
+    global: existsSync12(plan.globalDbPath)
   };
   const buildScope = (scope) => {
     const sources = plan.sources.filter((s) => s.targetScope === scope).map((s) => {
-      const present = existsSync11(s.path);
+      const present = existsSync12(s.path);
       let bytes = 0;
       if (present) {
         try {
@@ -29777,8 +30133,8 @@ var init_types = __esm({
 });
 
 // packages/core/src/store/backup-sidecar.ts
-import { existsSync as existsSync12, readdirSync as readdirSync4, renameSync as renameSync4, statSync as statSync5, unlinkSync as unlinkSync2, writeFileSync as writeFileSync5 } from "node:fs";
-import { join as join16 } from "node:path";
+import { existsSync as existsSync13, readdirSync as readdirSync4, renameSync as renameSync4, statSync as statSync5, unlinkSync as unlinkSync2, writeFileSync as writeFileSync5 } from "node:fs";
+import { join as join17 } from "node:path";
 function formatBackupTimestamp(d) {
   const pad = (n, len = 2) => String(n).padStart(len, "0");
   return `${d.getFullYear()}${pad(d.getMonth() + 1)}${pad(d.getDate())}-${pad(d.getHours())}${pad(d.getMinutes())}${pad(d.getSeconds())}`;
@@ -29789,8 +30145,8 @@ function rotateBackupDir(backupDir, maxSnapshots, backupType) {
     const ownedPattern = new RegExp(`\\.${escapedType}-`);
     const files = readdirSync4(backupDir).filter((f) => !f.endsWith(".meta.json") && !f.endsWith(".tmp") && ownedPattern.test(f)).map((f) => ({
       name: f,
-      path: join16(backupDir, f),
-      mtimeMs: statSync5(join16(backupDir, f)).mtimeMs
+      path: join17(backupDir, f),
+      mtimeMs: statSync5(join17(backupDir, f)).mtimeMs
     })).sort((a, b) => a.mtimeMs - b.mtimeMs);
     while (files.length > maxSnapshots) {
       const oldest = files.shift();
@@ -29798,7 +30154,7 @@ function rotateBackupDir(backupDir, maxSnapshots, backupType) {
       try {
         unlinkSync2(oldest.path);
         const metaPath = `${oldest.path}.meta.json`;
-        if (existsSync12(metaPath)) unlinkSync2(metaPath);
+        if (existsSync13(metaPath)) unlinkSync2(metaPath);
       } catch {
       }
     }
@@ -29806,7 +30162,7 @@ function rotateBackupDir(backupDir, maxSnapshots, backupType) {
   }
 }
 function writeBackupSidecar(backupDir, sidecar) {
-  const dest = join16(backupDir, `${sidecar.backupId}.meta.json`);
+  const dest = join17(backupDir, `${sidecar.backupId}.meta.json`);
   const tmp = `${dest}.${process.pid}.${Date.now()}.tmp`;
   writeFileSync5(tmp, JSON.stringify(sidecar, null, 2));
   renameSync4(tmp, dest);
@@ -29818,23 +30174,23 @@ var init_backup_sidecar = __esm({
 });
 
 // packages/core/src/store/pre-repair-snapshot.ts
-import { existsSync as existsSync13, mkdirSync as mkdirSync3, statfsSync as statfsSync2 } from "node:fs";
-import { dirname as dirname11, join as join17 } from "node:path";
+import { existsSync as existsSync14, mkdirSync as mkdirSync3, statfsSync as statfsSync2 } from "node:fs";
+import { dirname as dirname13, join as join18 } from "node:path";
 function writePreRepairSnapshot(nativeDb, dbPath, label) {
   const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
-  const backupDir = join17(dirname11(dbPath), "backups");
+  const backupDir = join18(dirname13(dbPath), "backups");
   mkdirSync3(backupDir, { recursive: true });
-  const snapshotPath = join17(backupDir, `cleo-pre-${label}-${stamp}.db`);
+  const snapshotPath = join18(backupDir, `cleo-pre-${label}-${stamp}.db`);
   nativeDb.exec(`VACUUM INTO '${snapshotPath.replace(/'/g, "''")}'`);
   return snapshotPath;
 }
 function existingAncestor(path) {
   let p = path;
-  while (!existsSync13(p) && dirname11(p) !== p) p = dirname11(p);
+  while (!existsSync14(p) && dirname13(p) !== p) p = dirname13(p);
   return p;
 }
 function planMigrationSnapshot(nativeDb, dbPath) {
-  const backupDir = join17(dirname11(dbPath), "backups", "sqlite");
+  const backupDir = join18(dirname13(dbPath), "backups", "sqlite");
   const pragma = (name15) => Number(nativeDb.prepare(`PRAGMA main.${name15}`).get()[name15] ?? 0);
   const liveBytes = (pragma("page_count") - pragma("freelist_count")) * pragma("page_size");
   let availableBytes = null;
@@ -29846,13 +30202,13 @@ function planMigrationSnapshot(nativeDb, dbPath) {
   }
   const base = `migration-${formatBackupTimestamp(/* @__PURE__ */ new Date())}`;
   let backupId = base;
-  for (let n = 2; existsSync13(join17(backupDir, `${backupId}.meta.json`)); n++) {
+  for (let n = 2; existsSync14(join18(backupDir, `${backupId}.meta.json`)); n++) {
     backupId = `${base}-${n}`;
   }
   return {
     backupDir,
     backupId,
-    snapshotPath: join17(backupDir, `cleo.db.${backupId}`),
+    snapshotPath: join18(backupDir, `cleo.db.${backupId}`),
     requiredBytes: liveBytes + SNAPSHOT_HEADROOM_BYTES,
     availableBytes
   };
@@ -30092,7 +30448,7 @@ var init_legacy_tasks_lineage = __esm({
 
 // packages/core/src/store/ports/domain-binding.ts
 import { AsyncLocalStorage as AsyncLocalStorage4 } from "node:async_hooks";
-import { resolve as resolve6 } from "node:path";
+import { resolve as resolve8 } from "node:path";
 function getCleoRuntime() {
   if (!_runtime) {
     _runtime = createCleoRuntime();
@@ -30160,6 +30516,8 @@ async function bindAgainst(key, store, establish) {
           () => establish(native, store)
         );
         return { store, native, db };
+      } catch (error48) {
+        throw explainSchemaWriteDenial(native, error48);
       } finally {
         membership.active = false;
       }
@@ -30209,7 +30567,7 @@ async function bindLive(scope, key, dbPath, openStore, establish) {
   );
 }
 async function bindProjectDomain(domain2, cwd, establish) {
-  const dbPath = resolve6(resolveDualScopeDbPath("project", cwd));
+  const dbPath = resolve8(resolveDualScopeDbPath("project", cwd));
   const row = await bindLive(
     "project",
     bindingKey("project", dbPath, domain2),
@@ -30220,7 +30578,7 @@ async function bindProjectDomain(domain2, cwd, establish) {
   return row;
 }
 async function bindGlobalDomain(domain2, establish, cwd) {
-  const dbPath = resolve6(resolveDualScopeDbPath("global"));
+  const dbPath = resolve8(resolveDualScopeDbPath("global"));
   const row = await bindLive(
     "global",
     bindingKey("global", dbPath, domain2),
@@ -30231,7 +30589,7 @@ async function bindGlobalDomain(domain2, establish, cwd) {
   return row;
 }
 async function bindGlobalDomainAtPath(domain2, dbPath, establish) {
-  const normalized = resolve6(dbPath);
+  const normalized = resolve8(dbPath);
   const row = await bindLive(
     "global",
     bindingKey("global", normalized, domain2),
@@ -30242,7 +30600,7 @@ async function bindGlobalDomainAtPath(domain2, dbPath, establish) {
   return row;
 }
 function peekDomainAtPath(scope, dbPath, domain2) {
-  const row = _bindings.get(bindingKey(scope, resolve6(dbPath), domain2));
+  const row = _bindings.get(bindingKey(scope, resolve8(dbPath), domain2));
   if (!row?.native.isOpen) return null;
   return row;
 }
@@ -30251,12 +30609,12 @@ function releaseDomainBindings(filter2) {
     _bindings.clear();
     return;
   }
-  const wantPath = filter2.dbPath === void 0 ? void 0 : resolve6(filter2.dbPath);
+  const wantPath = filter2.dbPath === void 0 ? void 0 : resolve8(filter2.dbPath);
   for (const key of [..._bindings.keys()]) {
-    const sep5 = key.indexOf("::");
+    const sep6 = key.indexOf("::");
     const lastSep = key.lastIndexOf("::");
-    const scope = key.slice(0, sep5);
-    const dbPath = key.slice(sep5 + 2, lastSep);
+    const scope = key.slice(0, sep6);
+    const dbPath = key.slice(sep6 + 2, lastSep);
     const domain2 = key.slice(lastSep + 2);
     if (filter2.scope !== void 0 && scope !== filter2.scope) continue;
     if (wantPath !== void 0 && dbPath !== wantPath) continue;
@@ -30271,7 +30629,7 @@ function boundProjectNative(domain2, cwd) {
   return peekProjectDomain(domain2, cwd)?.native ?? null;
 }
 function peekProjectDomain(domain2, cwd) {
-  const dbPath = resolve6(resolveDualScopeDbPath("project", cwd));
+  const dbPath = resolve8(resolveDualScopeDbPath("project", cwd));
   const row = _bindings.get(bindingKey("project", dbPath, domain2));
   if (row?.native.isOpen) return row;
   if (cwd !== void 0) return null;
@@ -30286,7 +30644,7 @@ function peekProjectDomain(domain2, cwd) {
   return sole ?? null;
 }
 function peekGlobalDomain(domain2) {
-  const dbPath = resolve6(resolveDualScopeDbPath("global"));
+  const dbPath = resolve8(resolveDualScopeDbPath("global"));
   const row = _bindings.get(bindingKey("global", dbPath, domain2));
   if (!row || !row.native.isOpen) return null;
   return row;
@@ -30297,6 +30655,7 @@ var init_domain_binding = __esm({
     "use strict";
     init_project_scope();
     init_dual_scope_db();
+    init_worktree_build_guard();
     _runtime = null;
     _bindings = /* @__PURE__ */ new Map();
     _inflight = /* @__PURE__ */ new Map();
@@ -30307,9 +30666,9 @@ var init_domain_binding = __esm({
 
 // packages/core/src/telemetry/sqlite.ts
 import { mkdirSync as mkdirSync4 } from "node:fs";
-import { dirname as dirname12, join as join18 } from "node:path";
+import { dirname as dirname14, join as join19 } from "node:path";
 function getTelemetryDbPath() {
-  return join18(getCleoHome(), DB_FILENAME);
+  return join19(getCleoHome(), DB_FILENAME);
 }
 function resolveTelemetryMigrationsFolder() {
   return resolveCorePackageMigrationsFolder("drizzle-telemetry");
@@ -30357,8 +30716,9 @@ async function getTelemetryDb() {
   _initPromise = (async () => {
     const dbPath = requestedPath;
     _dbPath = dbPath;
-    mkdirSync4(dirname12(dbPath), { recursive: true });
+    mkdirSync4(dirname14(dbPath), { recursive: true });
     const nativeDb = openNativeDatabase(dbPath);
+    installSchemaWriteGuard(nativeDb);
     _nativeDb = nativeDb;
     const db = drizzle({ client: nativeDb });
     runTelemetryMigrations(nativeDb, db);
@@ -30379,6 +30739,7 @@ var init_sqlite2 = __esm({
     init_migration_manager();
     init_resolve_migrations_folder();
     init_sqlite3();
+    init_worktree_build_guard();
     DB_FILENAME = "telemetry.db";
     TELEMETRY_SCHEMA_VERSION = "1.0.0";
     _db = null;
@@ -30389,11 +30750,11 @@ var init_sqlite2 = __esm({
 });
 
 // packages/core/src/store/agent-registry-store.ts
-import { existsSync as existsSync14 } from "node:fs";
-import { join as join19 } from "node:path";
+import { existsSync as existsSync15 } from "node:fs";
+import { join as join20 } from "node:path";
 function getGlobalAgentRegistryDbPath() {
   const cleoHome = getCleoHome();
-  const dbPath = join19(cleoHome, "cleo.db");
+  const dbPath = join20(cleoHome, "cleo.db");
   if (!dbPath.startsWith(cleoHome)) {
     throw new Error(
       `BUG: getGlobalAgentRegistryDbPath() resolved to "${dbPath}" which is NOT under getCleoHome() ("${cleoHome}"). The Agent Registry is global-only per ADR-037. This indicates a code path that bypasses path resolution \u2014 fix the caller, do not suppress this error.`
@@ -30460,7 +30821,7 @@ function establishAgentRegistrySchema(native) {
 }
 async function ensureGlobalAgentRegistryDb() {
   const dbPath = getGlobalAgentRegistryDbPath();
-  const alreadyExists = existsSync14(dbPath);
+  const alreadyExists = existsSync15(dbPath);
   let created = false;
   const { native: nativeDb } = await bindGlobalDomainAtPath(
     AGENT_REGISTRY_DOMAIN,
@@ -30505,8 +30866,8 @@ var init_agent_registry_store = __esm({
 });
 
 // packages/core/src/store/conduit-sqlite.ts
-import { existsSync as existsSync15 } from "node:fs";
-import { createRequire as createRequire5 } from "node:module";
+import { existsSync as existsSync16 } from "node:fs";
+import { createRequire as createRequire6 } from "node:module";
 function _getDrizzle() {
   if (_drizzle === null) {
     const mod = _require3("drizzle-orm/node-sqlite");
@@ -30534,7 +30895,7 @@ function runConduitMigrations(nativeDb) {
 }
 async function ensureConduitDb(projectRoot) {
   const dbPath = getConduitDbPath(projectRoot);
-  const alreadyExists = peekProjectDomain("conduit", projectRoot) !== null || existsSync15(dbPath);
+  const alreadyExists = peekProjectDomain("conduit", projectRoot) !== null || existsSync16(dbPath);
   await bindConduitDomain(projectRoot);
   return { action: alreadyExists ? "exists" : "created", path: dbPath };
 }
@@ -30560,7 +30921,8 @@ var init_conduit_sqlite = __esm({
     init_domain_binding();
     init_resolve_migrations_folder();
     init_sqlite_pragmas();
-    _require3 = createRequire5(import.meta.url);
+    init_worktree_build_guard();
+    _require3 = createRequire6(import.meta.url);
     ({ DatabaseSync: DatabaseSync2 } = _require3("node:sqlite"));
     _drizzle = null;
     CONDUIT_SCHEMA_VERSION = "2026.4.23";
@@ -32434,216 +32796,6 @@ var init_memory_schema = __esm({
   }
 });
 
-// packages/core/src/store/snapshot-gate.ts
-import { join as join20 } from "node:path";
-function readGateState(db) {
-  const row = db.prepare("SELECT value FROM tasks_schema_meta WHERE key = ?").get(SNAPSHOT_GATE_META_KEY);
-  const state = { generation: 0, prefixes: {} };
-  if (!row) return state;
-  try {
-    const parsed = JSON.parse(row.value);
-    if (parsed === null || typeof parsed !== "object") return state;
-    if (typeof parsed.generation === "number" && Number.isSafeInteger(parsed.generation)) {
-      state.generation = parsed.generation;
-    }
-    for (const [prefix, e] of Object.entries(parsed.prefixes ?? {})) {
-      if (e && typeof e.generation === "number" && typeof e.startedAt === "number" && typeof e.completedAt === "number") {
-        state.prefixes[prefix] = {
-          generation: e.generation,
-          startedAt: e.startedAt,
-          completedAt: e.completedAt
-        };
-      }
-    }
-  } catch {
-  }
-  return state;
-}
-function writeGateState(db, state) {
-  db.prepare(
-    "INSERT INTO tasks_schema_meta (key, value) VALUES (?, ?) ON CONFLICT(key) DO UPDATE SET value = excluded.value"
-  ).run(SNAPSHOT_GATE_META_KEY, JSON.stringify(state));
-}
-function tryReadGateState(db) {
-  if (!db) return null;
-  try {
-    return readGateState(db);
-  } catch {
-    return null;
-  }
-}
-function needsSnapshot(entry, mode, nowMs, seenGeneration) {
-  if (!entry) return true;
-  if (mode === "required") return seenGeneration === null || entry.generation <= seenGeneration;
-  const elapsed = nowMs - entry.startedAt;
-  return elapsed < 0 || elapsed >= SNAPSHOT_DEBOUNCE_MS;
-}
-async function runGatedSnapshot(opts, snapshot) {
-  const now = opts.now ?? Date.now;
-  const mode = opts.mode ?? "routine";
-  const db = opts.stateDb;
-  const none = (skipped, error48) => ({
-    snapshotted: [],
-    linked: [],
-    absent: [],
-    failed: [],
-    skipped,
-    ...error48 !== void 0 && { error: error48 }
-  });
-  const entryState = tryReadGateState(db);
-  const seenGeneration = mode === "required" ? opts.seenGeneration ?? entryState?.generation ?? null : null;
-  if (mode === "routine") {
-    if (!entryState) return none("state-unavailable");
-    const nowMs = now();
-    if (!opts.prefixes.some((p) => needsSnapshot(entryState.prefixes[p], mode, nowMs, null))) {
-      return none("debounced");
-    }
-  }
-  const lockPath2 = join20(opts.backupDir, GATE_LOCK_BASENAME);
-  let release;
-  try {
-    release = await acquireLock(lockPath2, {
-      retries: mode === "required" ? opts.lockWaitRetries ?? SNAPSHOT_LOCK_WAIT_RETRIES : 0,
-      stale: SNAPSHOT_LOCK_STALE_MS,
-      // A compromised lock (e.g. the backup dir was removed) must not throw
-      // from a timer and crash the host process.
-      onCompromised: () => {
-      }
-    });
-  } catch {
-    if (mode === "routine") return none("in-flight");
-    return none(
-      "lock-timeout",
-      `Snapshot lock ${lockPath2}.lock is still held after waiting. Another snapshot is running, or a crashed process left the lock (it expires after ${SNAPSHOT_LOCK_STALE_MS / 6e4} minutes). Remove it if no snapshot is running.`
-    );
-  }
-  try {
-    try {
-      opts.onLockAcquired?.();
-    } catch {
-    }
-    const state = tryReadGateState(db);
-    if (!state && mode === "routine") return none("state-unavailable");
-    const startMs = now();
-    const admitted = mode === "required" && opts.alwaysSnapshot === true ? [...opts.prefixes] : opts.prefixes.filter(
-      (p) => needsSnapshot(state?.prefixes[p], mode, startMs, seenGeneration)
-    );
-    if (admitted.length === 0) return none(mode === "routine" ? "debounced" : "covered");
-    const generation = (state?.generation ?? 0) + 1;
-    let claimed = false;
-    if (db && state) {
-      try {
-        writeGateState(db, { ...state, generation });
-        claimed = true;
-      } catch {
-      }
-    }
-    const snapshotted = [];
-    const linked = [];
-    const absent = [];
-    const failed = [];
-    for (const prefix of admitted) {
-      try {
-        const outcome = await snapshot(prefix);
-        if (outcome === "absent") absent.push(prefix);
-        else {
-          snapshotted.push(prefix);
-          if (outcome === "linked") linked.push(prefix);
-        }
-      } catch {
-        failed.push(prefix);
-      }
-    }
-    const satisfied = [...snapshotted, ...absent];
-    if (db && claimed && satisfied.length > 0) {
-      try {
-        const latest = readGateState(db);
-        const completedAt = now();
-        latest.generation = Math.max(latest.generation, generation);
-        for (const p of satisfied) {
-          latest.prefixes[p] = { generation, startedAt: startMs, completedAt };
-        }
-        writeGateState(db, latest);
-      } catch {
-      }
-    }
-    return { snapshotted, linked, absent, failed, skipped: null };
-  } finally {
-    await release().catch(() => {
-    });
-  }
-}
-function isValidStamp(ymd, hms) {
-  const y = Number(ymd.slice(0, 4));
-  const mo = Number(ymd.slice(4, 6));
-  const d = Number(ymd.slice(6, 8));
-  const h = Number(hms.slice(0, 2));
-  const mi = Number(hms.slice(2, 4));
-  const se = Number(hms.slice(4, 6));
-  if (mo < 1 || mo > 12 || d < 1 || h > 23 || mi > 59 || se > 59) return false;
-  const probe = new Date(Date.UTC(y, mo - 1, d));
-  return probe.getUTCFullYear() === y && probe.getUTCMonth() === mo - 1 && probe.getUTCDate() === d;
-}
-function selectSnapshotsToKeep(names, ctx = {}) {
-  const policy = ctx.policy ?? DEFAULT_SNAPSHOT_RETENTION;
-  const keep = /* @__PURE__ */ new Set();
-  const stamped = [];
-  for (const name15 of names) {
-    const m = STAMP_PATTERN.exec(name15);
-    const ymd = m?.[1];
-    const hms = m?.[2];
-    if (!ymd || !hms || !isValidStamp(ymd, hms)) {
-      keep.add(name15);
-      continue;
-    }
-    const stamp = `${ymd}-${hms}`;
-    if (ctx.nowStamp !== void 0 && stamp > ctx.nowStamp) {
-      keep.add(name15);
-      continue;
-    }
-    stamped.push({ name: name15, stamp });
-  }
-  if (ctx.pinned !== void 0 && names.includes(ctx.pinned)) keep.add(ctx.pinned);
-  stamped.sort((a, b) => a.stamp < b.stamp ? 1 : a.stamp > b.stamp ? -1 : 0);
-  for (const s of stamped.slice(0, policy.latest)) keep.add(s.name);
-  const keepNewestPerBucket = (bucketOf, slots) => {
-    const seen = /* @__PURE__ */ new Set();
-    for (const s of stamped) {
-      const bucket = bucketOf(s.stamp);
-      if (seen.has(bucket)) continue;
-      if (seen.size >= slots) break;
-      seen.add(bucket);
-      keep.add(s.name);
-    }
-  };
-  keepNewestPerBucket(
-    (stamp) => `${stamp.slice(0, 11)}q${Math.floor(Number(stamp.slice(11, 13)) / 15)}`,
-    policy.quarterHourly
-  );
-  keepNewestPerBucket((stamp) => stamp.slice(0, 11), policy.hourly);
-  keepNewestPerBucket((stamp) => stamp.slice(0, 8), policy.daily);
-  return keep;
-}
-var SNAPSHOT_DEBOUNCE_MS, SNAPSHOT_LOCK_STALE_MS, SNAPSHOT_LOCK_WAIT_RETRIES, SNAPSHOT_GATE_META_KEY, GATE_LOCK_BASENAME, DEFAULT_SNAPSHOT_RETENTION, STAMP_PATTERN;
-var init_snapshot_gate = __esm({
-  "packages/core/src/store/snapshot-gate.ts"() {
-    "use strict";
-    init_lock();
-    SNAPSHOT_DEBOUNCE_MS = 5 * 6e4;
-    SNAPSHOT_LOCK_STALE_MS = 10 * 6e4;
-    SNAPSHOT_LOCK_WAIT_RETRIES = 90;
-    SNAPSHOT_GATE_META_KEY = "sqlite_snapshot_gate";
-    GATE_LOCK_BASENAME = ".snapshot-gate";
-    DEFAULT_SNAPSHOT_RETENTION = {
-      latest: 1,
-      quarterHourly: 3,
-      hourly: 3,
-      daily: 3
-    };
-    STAMP_PATTERN = /-(\d{8})-(\d{6})\.db$/;
-  }
-});
-
 // packages/core/src/store/twin-collapse.ts
 import { createHash as createHash3 } from "node:crypto";
 function hasMainTable(db, name15) {
@@ -32720,6 +32872,22 @@ function mergeSchemaMetaValue(key, bare, twin) {
   const field = SCHEMA_META_COUNTER_FIELDS[key];
   return field === void 0 ? bare : withMaxCounter(bare, twin, field);
 }
+function mirrorCounterToBare(db, key) {
+  if (SCHEMA_META_COUNTER_FIELDS[key] === void 0) return;
+  if (!hasMainTable(db, "schema_meta")) return;
+  const twin = readKv(db, "tasks_schema_meta", key);
+  if (twin === void 0) return;
+  const bare = readKv(db, "schema_meta", key);
+  const next = bare === void 0 ? twin : mergeSchemaMetaValue(key, bare, twin);
+  if (next === null || next === bare) return;
+  writeKv(db, "schema_meta", key, next);
+}
+function bareCounterOf(db, key) {
+  const name15 = SCHEMA_META_COUNTER_FIELDS[key];
+  if (name15 === void 0 || !hasMainTable(db, "schema_meta")) return 0;
+  const bare = readKv(db, "schema_meta", key);
+  return (bare === void 0 ? void 0 : counterOf(bare, name15)) ?? 0;
+}
 function kvRows(db, table, schema = "main") {
   const rows = db.prepare(`SELECT key, value FROM ${schema}.${table}`).all();
   return new Map(rows.map((r) => [r.key, r.value]));
@@ -32852,6 +33020,39 @@ function applyStickyRows(db, schema, plan) {
   }
   return { inserted, replaced: 0, deleted };
 }
+function tagsOf(tagsJson) {
+  if (!tagsJson) return [];
+  try {
+    const parsed = JSON.parse(tagsJson);
+    if (!Array.isArray(parsed)) return [];
+    return [...new Set(parsed.filter((t) => typeof t === "string" && t.length > 0))];
+  } catch {
+    return [];
+  }
+}
+function syncStickyJunction(db, schema) {
+  const notes = db.prepare("SELECT id, tags_json FROM main.brain_sticky_notes").all();
+  const have = /* @__PURE__ */ new Map();
+  for (const r of db.prepare(`SELECT sticky_id, tag FROM ${schema}.brain_sticky_tags`).all()) {
+    const set2 = have.get(r.sticky_id) ?? /* @__PURE__ */ new Set();
+    set2.add(r.tag);
+    have.set(r.sticky_id, set2);
+  }
+  const insert = db.prepare(
+    `INSERT OR IGNORE INTO ${schema}.brain_sticky_tags (sticky_id, tag) VALUES (?, ?)`
+  );
+  const del = db.prepare(`DELETE FROM ${schema}.brain_sticky_tags WHERE sticky_id = ? AND tag = ?`);
+  let inserted = 0;
+  let deleted = 0;
+  for (const note of notes) {
+    const want = new Set(tagsOf(note.tags_json));
+    const current = have.get(note.id) ?? /* @__PURE__ */ new Set();
+    for (const tag of want)
+      if (!current.has(tag)) inserted += Number(insert.run(note.id, tag).changes);
+    for (const tag of current) if (!want.has(tag)) deleted += Number(del.run(note.id, tag).changes);
+  }
+  return { inserted, deleted };
+}
 function twinCollapseFailureOf(db) {
   return degraded.get(db);
 }
@@ -33061,7 +33262,7 @@ function collapseTwinTables(nativeDb, dbPath, options = {}) {
   }
   return inOrder();
 }
-var log6, TWIN_COLLAPSE_MARKER_PREFIX, TWIN_COLLAPSE_FAILURE_PREFIX, SCHEMA_META_COUNTER_FIELDS, SCHEMA_META_NEVER_DELETED, MAX_CONFLICTS, sha, ABSENT, hashMap, emptyPlan, SCHEMA_META, hashSets, EMPTY_SET, STICKY_TAGS, PAIRS, degraded, SHADOW_WRITE_REFUSED, SHADOW_WRITE_OPS;
+var log6, TWIN_COLLAPSE_MARKER_PREFIX, TWIN_COLLAPSE_FAILURE_PREFIX, SNAPSHOT_GATE_KEY, SCHEMA_META_COUNTER_FIELDS, SCHEMA_META_NEVER_DELETED, MAX_CONFLICTS, sha, ABSENT, hashMap, emptyPlan, SCHEMA_META, hashSets, EMPTY_SET, STICKY_TAGS, PAIRS, degraded, SHADOW_WRITE_REFUSED, SHADOW_WRITE_OPS;
 var init_twin_collapse = __esm({
   "packages/core/src/store/twin-collapse.ts"() {
     "use strict";
@@ -33069,18 +33270,18 @@ var init_twin_collapse = __esm({
     init_errors2();
     init_logger2();
     init_pre_repair_snapshot();
-    init_snapshot_gate();
     log6 = getLogger("twin-collapse");
     TWIN_COLLAPSE_MARKER_PREFIX = "twin_collapse:";
     TWIN_COLLAPSE_FAILURE_PREFIX = "twin_collapse_failed:";
+    SNAPSHOT_GATE_KEY = "sqlite_snapshot_gate";
     SCHEMA_META_COUNTER_FIELDS = {
       task_id_sequence: "counter",
-      [SNAPSHOT_GATE_META_KEY]: "generation",
+      [SNAPSHOT_GATE_KEY]: "generation",
       file_meta: "generation"
     };
     SCHEMA_META_NEVER_DELETED = /* @__PURE__ */ new Set([
       "task_id_sequence",
-      SNAPSHOT_GATE_META_KEY
+      SNAPSHOT_GATE_KEY
     ]);
     MAX_CONFLICTS = 50;
     sha = (value) => createHash3("sha256").update(value).digest("hex");
@@ -33145,7 +33346,12 @@ var init_twin_collapse = __esm({
           throw new Error(
             `sticky_tags collapse did not verify: ${missing} missing, ${lingering} not removed`
           );
-        return counts;
+        const synced = syncStickyJunction(db, "main");
+        return {
+          inserted: counts.inserted + synced.inserted,
+          replaced: 0,
+          deleted: counts.deleted + synced.deleted
+        };
       },
       shadow(db, plan) {
         db.exec(
@@ -33156,6 +33362,7 @@ var init_twin_collapse = __esm({
           "INSERT INTO temp.brain_sticky_tags (sticky_id, tag) SELECT sticky_id, tag FROM main.brain_sticky_tags"
         );
         applyStickyRows(db, "temp", plan);
+        syncStickyJunction(db, "temp");
       }
     };
     PAIRS = [SCHEMA_META, STICKY_TAGS];
@@ -33187,7 +33394,7 @@ __export(config_exports, {
   parseConfigValue: () => parseConfigValue,
   setConfigValue: () => setConfigValue
 });
-import { existsSync as existsSync16 } from "node:fs";
+import { existsSync as existsSync17 } from "node:fs";
 function getNestedValue(obj, path) {
   const parts = path.split(".");
   let current = obj;
@@ -33309,7 +33516,7 @@ function parseConfigValue(value) {
 }
 async function setConfigValue(key, value, cwd, opts) {
   const configPath = opts?.global ? getGlobalConfigPath() : getConfigPath(cwd);
-  if (!existsSync16(configPath)) {
+  if (!existsSync17(configPath)) {
     await atomicWriteJson(configPath, {});
   }
   const config2 = await readJson(configPath) ?? {};
@@ -33321,7 +33528,7 @@ async function setConfigValue(key, value, cwd, opts) {
 async function applyStrictnessPreset(preset, cwd, opts) {
   const definition = STRICTNESS_PRESETS[preset];
   const configPath = opts?.global ? getGlobalConfigPath() : getConfigPath(cwd);
-  if (!existsSync16(configPath)) {
+  if (!existsSync17(configPath)) {
     await atomicWriteJson(configPath, {});
   }
   const config2 = await readJson(configPath) ?? {};
@@ -33898,6 +34105,7 @@ var init_cross_db_cleanup = __esm({
     "use strict";
     init_memory_sqlite();
     init_memory_schema();
+    init_worktree_build_guard();
   }
 });
 
@@ -38590,7 +38798,7 @@ __export(sqlite_data_accessor_exports, {
   setMetaValue: () => setMetaValue
 });
 import { AsyncLocalStorage as AsyncLocalStorage6 } from "node:async_hooks";
-import { resolve as resolve7 } from "node:path";
+import { resolve as resolve9 } from "node:path";
 import {
   and as and5,
   eq as eq6,
@@ -38630,9 +38838,12 @@ async function writeMetaValue(cwd, key, value) {
     target: tasksSchemaMeta.key,
     set: { value: json2 }
   }).run();
+  const native = getNativeTasksDb(cwd);
+  if (native) mirrorCounterToBare(native, key);
 }
 function advanceTaskIdSequence(nativeDb, floor) {
   assertTwinCollapseWritable(nativeDb);
+  const lowest = Math.max(floor, bareCounterOf(nativeDb, "task_id_sequence"));
   nativeDb.prepare(`
       UPDATE tasks_schema_meta
       SET value = json_set(value,
@@ -38641,7 +38852,8 @@ function advanceTaskIdSequence(nativeDb, floor) {
         '$.checksum', 'alloc-' || strftime('%s','now')
       )
       WHERE key = 'task_id_sequence'
-    `).run(floor, floor);
+    `).run(lowest, lowest);
+  mirrorCounterToBare(nativeDb, "task_id_sequence");
   const row = nativeDb.prepare(`
       SELECT json_extract(value, '$.counter') AS counter
       FROM tasks_schema_meta WHERE key = 'task_id_sequence'
@@ -38695,7 +38907,7 @@ function bindTaskAccessorScope(accessor, scope) {
 }
 async function createSqliteDataAccessor(cwd) {
   const scope = captureProjectScope(
-    resolve7(cwd ?? getProjectRoot()),
+    resolve9(cwd ?? getProjectRoot()),
     worktreeScope.getStore()
   );
   return worktreeScope.run(
@@ -38810,7 +39022,9 @@ async function createOwnedSqliteDataAccessor(cwd, accessorScope) {
             actor: entry.actor ?? "system",
             detailsJson: entry.details ? JSON.stringify(entry.details) : "{}",
             beforeJson: entry.before ? JSON.stringify(entry.before) : null,
-            afterJson: entry.after ? JSON.stringify(entry.after) : null
+            afterJson: entry.after ? JSON.stringify(entry.after) : null,
+            // T12693: the session a ranking change ran in.
+            sessionId: typeof entry.sessionId === "string" ? entry.sessionId : null
           }).run()
         );
       });
@@ -38818,6 +39032,9 @@ async function createOwnedSqliteDataAccessor(cwd, accessorScope) {
     async queryAuditLog(query) {
       const db = await getDb(cwd);
       const conditions = [];
+      if (query.ids && query.ids.length > 0) {
+        conditions.push(inArray4(tasksAuditLog.id, [...query.ids]));
+      }
       if (query.taskIds && query.taskIds.length > 0) {
         conditions.push(inArray4(tasksAuditLog.taskId, [...query.taskIds]));
       }
@@ -38836,7 +39053,8 @@ async function createOwnedSqliteDataAccessor(cwd, accessorScope) {
         actor: tasksAuditLog.actor,
         detailsJson: tasksAuditLog.detailsJson,
         beforeJson: tasksAuditLog.beforeJson,
-        afterJson: tasksAuditLog.afterJson
+        afterJson: tasksAuditLog.afterJson,
+        sessionId: tasksAuditLog.sessionId
       }).from(tasksAuditLog).where(conditions.length > 0 ? and5(...conditions) : void 0).orderBy(sql26`${tasksAuditLog.timestamp} DESC`).limit(limit).all();
       return rows.map((row) => ({
         id: row.id,
@@ -38846,7 +39064,8 @@ async function createOwnedSqliteDataAccessor(cwd, accessorScope) {
         actor: row.actor,
         detailsJson: row.detailsJson ?? null,
         beforeJson: row.beforeJson ?? null,
-        afterJson: row.afterJson ?? null
+        afterJson: row.afterJson ?? null,
+        sessionId: row.sessionId ?? null
       }));
     },
     // ---- Fine-grained task operations (T5034) ----
@@ -39684,7 +39903,7 @@ var init_sqlite_data_accessor = __esm({
 });
 
 // packages/core/src/sequence/index.ts
-import { existsSync as existsSync17, readFileSync as readFileSync5, renameSync as renameSync5 } from "node:fs";
+import { existsSync as existsSync18, readFileSync as readFileSync6, renameSync as renameSync5 } from "node:fs";
 import { join as join21 } from "node:path";
 function getLegacySequenceJsonPath(cwd) {
   return join21(resolveOrCwd(cwd), ".cleo", ".sequence.json");
@@ -39701,19 +39920,19 @@ function isSeedSequence(value) {
   return value.counter === 0 && value.lastId === "T000" && value.checksum === "seed";
 }
 function readLegacySequenceFile(path) {
-  if (!existsSync17(path)) return null;
+  if (!existsSync18(path)) return null;
   try {
-    const parsed = JSON.parse(readFileSync5(path, "utf-8"));
+    const parsed = JSON.parse(readFileSync6(path, "utf-8"));
     return isValidSequenceState(parsed) ? parsed : null;
   } catch {
     return null;
   }
 }
 function renameLegacyFile(path) {
-  if (!existsSync17(path)) return;
+  if (!existsSync18(path)) return;
   const migratedPath = `${path}.migrated`;
   try {
-    if (!existsSync17(migratedPath)) {
+    if (!existsSync18(migratedPath)) {
       renameSync5(path, migratedPath);
       return;
     }
@@ -39879,12 +40098,12 @@ var init_checkpoint_git_dir = __esm({
 
 // packages/core/src/store/git-checkpoint.ts
 import { execFile as execFile2 } from "node:child_process";
-import { existsSync as existsSync18 } from "node:fs";
+import { existsSync as existsSync19 } from "node:fs";
 import { readFile as readFile4, writeFile } from "node:fs/promises";
-import { join as join23, resolve as resolve8 } from "node:path";
+import { join as join23, resolve as resolve10 } from "node:path";
 import { promisify as promisify2 } from "node:util";
 function makeCleoGitEnv(cleoDir) {
-  const abs = resolve8(cleoDir);
+  const abs = resolve10(cleoDir);
   return {
     ...process.env,
     GIT_DIR: checkpointGitDir(abs),
@@ -39894,7 +40113,7 @@ function makeCleoGitEnv(cleoDir) {
 async function cleoGitCommand(args, cleoDir) {
   try {
     const result = await execFileAsync2("git", args, {
-      cwd: resolve8(cleoDir),
+      cwd: resolve10(cleoDir),
       // absolute cwd so relative paths in args resolve correctly
       env: makeCleoGitEnv(cleoDir),
       timeout: 1e4
@@ -39905,7 +40124,7 @@ async function cleoGitCommand(args, cleoDir) {
   }
 }
 function isCleoGitInitialized(cleoDir) {
-  return existsSync18(join23(checkpointGitDir(cleoDir), "HEAD"));
+  return existsSync19(join23(checkpointGitDir(cleoDir), "HEAD"));
 }
 async function loadStateFileAllowlist(cwd) {
   try {
@@ -39949,14 +40168,14 @@ async function isCleoGitRepo(cleoDir) {
   return result.success && (result.stdout === "true" || isCleoGitInitialized(cleoDir));
 }
 function isMergeInProgress(cleoDir) {
-  return existsSync18(join23(checkpointGitDir(cleoDir), "MERGE_HEAD"));
+  return existsSync19(join23(checkpointGitDir(cleoDir), "MERGE_HEAD"));
 }
 async function isDetachedHead(cleoDir) {
   const result = await cleoGitCommand(["symbolic-ref", "HEAD"], cleoDir);
   return !result.success;
 }
 function isRebaseInProgress(cleoDir) {
-  return existsSync18(join23(checkpointGitDir(cleoDir), "rebase-merge")) || existsSync18(join23(checkpointGitDir(cleoDir), "rebase-apply"));
+  return existsSync19(join23(checkpointGitDir(cleoDir), "rebase-merge")) || existsSync19(join23(checkpointGitDir(cleoDir), "rebase-apply"));
 }
 async function recordCheckpointTime(cleoDir) {
   try {
@@ -39980,7 +40199,7 @@ async function getChangedStateFiles(cleoDir, cwd) {
   const allStateFiles = await getAllStateFiles(cwd);
   for (const stateFile of allStateFiles) {
     const fullPath = join23(cleoDir, stateFile);
-    if (!existsSync18(fullPath)) continue;
+    if (!existsSync19(fullPath)) continue;
     const diffResult = await cleoGitCommand(["diff", "--quiet", "--", stateFile], cleoDir);
     const cachedResult = await cleoGitCommand(
       ["diff", "--cached", "--quiet", "--", stateFile],
@@ -40007,7 +40226,7 @@ async function shouldCheckpoint(options) {
   const config2 = await loadCheckpointConfig(cwd);
   if (!config2.enabled) return false;
   const cleoDir = getCleoDir(cwd);
-  if (!existsSync18(cleoDir)) return false;
+  if (!existsSync19(cleoDir)) return false;
   if (!isCleoGitInitialized(cleoDir)) return false;
   if (!await isCleoGitRepo(cleoDir)) return false;
   if (isMergeInProgress(cleoDir)) return false;
@@ -40080,6 +40299,218 @@ var init_git_checkpoint = __esm({
   }
 });
 
+// packages/core/src/store/snapshot-gate.ts
+import { join as join24 } from "node:path";
+function readGateState(db) {
+  const row = db.prepare("SELECT value FROM tasks_schema_meta WHERE key = ?").get(SNAPSHOT_GATE_META_KEY);
+  const state = { generation: 0, prefixes: {} };
+  if (!row) return state;
+  try {
+    const parsed = JSON.parse(row.value);
+    if (parsed === null || typeof parsed !== "object") return state;
+    if (typeof parsed.generation === "number" && Number.isSafeInteger(parsed.generation)) {
+      state.generation = parsed.generation;
+    }
+    for (const [prefix, e] of Object.entries(parsed.prefixes ?? {})) {
+      if (e && typeof e.generation === "number" && typeof e.startedAt === "number" && typeof e.completedAt === "number") {
+        state.prefixes[prefix] = {
+          generation: e.generation,
+          startedAt: e.startedAt,
+          completedAt: e.completedAt
+        };
+      }
+    }
+  } catch {
+  }
+  return state;
+}
+function writeGateState(db, state) {
+  db.prepare(
+    "INSERT INTO tasks_schema_meta (key, value) VALUES (?, ?) ON CONFLICT(key) DO UPDATE SET value = excluded.value"
+  ).run(SNAPSHOT_GATE_META_KEY, JSON.stringify(state));
+  mirrorCounterToBare(db, SNAPSHOT_GATE_META_KEY);
+}
+function tryReadGateState(db) {
+  if (!db) return null;
+  try {
+    return readGateState(db);
+  } catch {
+    return null;
+  }
+}
+function needsSnapshot(entry, mode, nowMs, seenGeneration) {
+  if (!entry) return true;
+  if (mode === "required") return seenGeneration === null || entry.generation <= seenGeneration;
+  const elapsed = nowMs - entry.startedAt;
+  return elapsed < 0 || elapsed >= SNAPSHOT_DEBOUNCE_MS;
+}
+async function runGatedSnapshot(opts, snapshot) {
+  const now = opts.now ?? Date.now;
+  const mode = opts.mode ?? "routine";
+  const db = opts.stateDb;
+  const none = (skipped, error48) => ({
+    snapshotted: [],
+    linked: [],
+    absent: [],
+    failed: [],
+    skipped,
+    ...error48 !== void 0 && { error: error48 }
+  });
+  const entryState = tryReadGateState(db);
+  const seenGeneration = mode === "required" ? opts.seenGeneration ?? entryState?.generation ?? null : null;
+  if (mode === "routine") {
+    if (!entryState) return none("state-unavailable");
+    const nowMs = now();
+    if (!opts.prefixes.some((p) => needsSnapshot(entryState.prefixes[p], mode, nowMs, null))) {
+      return none("debounced");
+    }
+  }
+  const lockPath2 = join24(opts.backupDir, GATE_LOCK_BASENAME);
+  let release;
+  try {
+    release = await acquireLock(lockPath2, {
+      retries: mode === "required" ? opts.lockWaitRetries ?? SNAPSHOT_LOCK_WAIT_RETRIES : 0,
+      stale: SNAPSHOT_LOCK_STALE_MS,
+      // A compromised lock (e.g. the backup dir was removed) must not throw
+      // from a timer and crash the host process.
+      onCompromised: () => {
+      }
+    });
+  } catch {
+    if (mode === "routine") return none("in-flight");
+    return none(
+      "lock-timeout",
+      `Snapshot lock ${lockPath2}.lock is still held after waiting. Another snapshot is running, or a crashed process left the lock (it expires after ${SNAPSHOT_LOCK_STALE_MS / 6e4} minutes). Remove it if no snapshot is running.`
+    );
+  }
+  try {
+    try {
+      opts.onLockAcquired?.();
+    } catch {
+    }
+    const state = tryReadGateState(db);
+    if (!state && mode === "routine") return none("state-unavailable");
+    const startMs = now();
+    const admitted = mode === "required" && opts.alwaysSnapshot === true ? [...opts.prefixes] : opts.prefixes.filter(
+      (p) => needsSnapshot(state?.prefixes[p], mode, startMs, seenGeneration)
+    );
+    if (admitted.length === 0) return none(mode === "routine" ? "debounced" : "covered");
+    const generation = (state?.generation ?? 0) + 1;
+    let claimed = false;
+    if (db && state) {
+      try {
+        writeGateState(db, { ...state, generation });
+        claimed = true;
+      } catch {
+      }
+    }
+    const snapshotted = [];
+    const linked = [];
+    const absent = [];
+    const failed = [];
+    for (const prefix of admitted) {
+      try {
+        const outcome = await snapshot(prefix);
+        if (outcome === "absent") absent.push(prefix);
+        else {
+          snapshotted.push(prefix);
+          if (outcome === "linked") linked.push(prefix);
+        }
+      } catch {
+        failed.push(prefix);
+      }
+    }
+    const satisfied = [...snapshotted, ...absent];
+    if (db && claimed && satisfied.length > 0) {
+      try {
+        const latest = readGateState(db);
+        const completedAt = now();
+        latest.generation = Math.max(latest.generation, generation);
+        for (const p of satisfied) {
+          latest.prefixes[p] = { generation, startedAt: startMs, completedAt };
+        }
+        writeGateState(db, latest);
+      } catch {
+      }
+    }
+    return { snapshotted, linked, absent, failed, skipped: null };
+  } finally {
+    await release().catch(() => {
+    });
+  }
+}
+function isValidStamp(ymd, hms) {
+  const y = Number(ymd.slice(0, 4));
+  const mo = Number(ymd.slice(4, 6));
+  const d = Number(ymd.slice(6, 8));
+  const h = Number(hms.slice(0, 2));
+  const mi = Number(hms.slice(2, 4));
+  const se = Number(hms.slice(4, 6));
+  if (mo < 1 || mo > 12 || d < 1 || h > 23 || mi > 59 || se > 59) return false;
+  const probe = new Date(Date.UTC(y, mo - 1, d));
+  return probe.getUTCFullYear() === y && probe.getUTCMonth() === mo - 1 && probe.getUTCDate() === d;
+}
+function selectSnapshotsToKeep(names, ctx = {}) {
+  const policy = ctx.policy ?? DEFAULT_SNAPSHOT_RETENTION;
+  const keep = /* @__PURE__ */ new Set();
+  const stamped = [];
+  for (const name15 of names) {
+    const m = STAMP_PATTERN.exec(name15);
+    const ymd = m?.[1];
+    const hms = m?.[2];
+    if (!ymd || !hms || !isValidStamp(ymd, hms)) {
+      keep.add(name15);
+      continue;
+    }
+    const stamp = `${ymd}-${hms}`;
+    if (ctx.nowStamp !== void 0 && stamp > ctx.nowStamp) {
+      keep.add(name15);
+      continue;
+    }
+    stamped.push({ name: name15, stamp });
+  }
+  if (ctx.pinned !== void 0 && names.includes(ctx.pinned)) keep.add(ctx.pinned);
+  stamped.sort((a, b) => a.stamp < b.stamp ? 1 : a.stamp > b.stamp ? -1 : 0);
+  for (const s of stamped.slice(0, policy.latest)) keep.add(s.name);
+  const keepNewestPerBucket = (bucketOf, slots) => {
+    const seen = /* @__PURE__ */ new Set();
+    for (const s of stamped) {
+      const bucket = bucketOf(s.stamp);
+      if (seen.has(bucket)) continue;
+      if (seen.size >= slots) break;
+      seen.add(bucket);
+      keep.add(s.name);
+    }
+  };
+  keepNewestPerBucket(
+    (stamp) => `${stamp.slice(0, 11)}q${Math.floor(Number(stamp.slice(11, 13)) / 15)}`,
+    policy.quarterHourly
+  );
+  keepNewestPerBucket((stamp) => stamp.slice(0, 11), policy.hourly);
+  keepNewestPerBucket((stamp) => stamp.slice(0, 8), policy.daily);
+  return keep;
+}
+var SNAPSHOT_DEBOUNCE_MS, SNAPSHOT_LOCK_STALE_MS, SNAPSHOT_LOCK_WAIT_RETRIES, SNAPSHOT_GATE_META_KEY, GATE_LOCK_BASENAME, DEFAULT_SNAPSHOT_RETENTION, STAMP_PATTERN;
+var init_snapshot_gate = __esm({
+  "packages/core/src/store/snapshot-gate.ts"() {
+    "use strict";
+    init_lock();
+    init_twin_collapse();
+    SNAPSHOT_DEBOUNCE_MS = 5 * 6e4;
+    SNAPSHOT_LOCK_STALE_MS = 10 * 6e4;
+    SNAPSHOT_LOCK_WAIT_RETRIES = 90;
+    SNAPSHOT_GATE_META_KEY = "sqlite_snapshot_gate";
+    GATE_LOCK_BASENAME = ".snapshot-gate";
+    DEFAULT_SNAPSHOT_RETENTION = {
+      latest: 1,
+      quarterHourly: 3,
+      hourly: 3,
+      daily: 3
+    };
+    STAMP_PATTERN = /-(\d{8})-(\d{6})\.db$/;
+  }
+});
+
 // packages/core/src/store/data-safety-central.ts
 import { eq as eq7 } from "drizzle-orm";
 function inSafetyScope(cwd, operation) {
@@ -40490,7 +40921,7 @@ __export(data_accessor_exports, {
   getAccessorDb: () => getAccessorDb,
   getTaskAccessor: () => getTaskAccessor
 });
-import { resolve as resolve9 } from "node:path";
+import { resolve as resolve11 } from "node:path";
 function assertTestEnv(dbPath) {
   const testMode = process.env["CLEO_TEST_MODE"];
   if (testMode !== "1") return;
@@ -40511,7 +40942,7 @@ function assertTestEnv(dbPath) {
   }
 }
 async function createDataAccessor(cwd) {
-  const root = resolve9(cwd ?? getProjectRoot());
+  const root = resolve11(cwd ?? getProjectRoot());
   const inherited = worktreeScope.getStore();
   const captured = inherited ? { ...inherited } : void 0;
   captured?.execution?.assertActive();
@@ -40555,7 +40986,7 @@ __export(memory_sqlite_exports, {
   resetBrainDbState: () => resetBrainDbState,
   resolveBrainMigrationsFolder: () => resolveBrainMigrationsFolder
 });
-import { createRequire as createRequire6 } from "node:module";
+import { createRequire as createRequire7 } from "node:module";
 function _getDrizzle2() {
   if (_drizzle2 === null) {
     const mod = _require4("drizzle-orm/node-sqlite");
@@ -40692,7 +41123,7 @@ var init_memory_sqlite = __esm({
     init_resolve_migrations_folder();
     init_memory_schema();
     init_twin_collapse();
-    _require4 = createRequire6(import.meta.url);
+    _require4 = createRequire7(import.meta.url);
     _drizzle2 = null;
     BRAIN_SCHEMA_VERSION = "1.0.0";
     CONSOLIDATED_BRAIN_TABLES = [
@@ -40880,11 +41311,11 @@ var init_skills_schema = __esm({
 });
 
 // packages/core/src/store/skills-db.ts
-import { join as join24 } from "node:path";
+import { join as join25 } from "node:path";
 import { and as and6, eq as eq8 } from "drizzle-orm";
 function getDefaultSkillsDbPath() {
   const cleoHome = getCleoHome();
-  const dbPath = join24(cleoHome, "cleo.db");
+  const dbPath = join25(cleoHome, "cleo.db");
   if (!dbPath.startsWith(cleoHome)) {
     throw new Error(
       `BUG: getDefaultSkillsDbPath() resolved to "${dbPath}" which is NOT under getCleoHome() ("${cleoHome}"). The skills registry is global-only per SG-CLEO-SKILLS-architecture-v3.md \xA74. Fix the caller, do not suppress.`
@@ -40932,19 +41363,19 @@ import {
   chmodSync,
   closeSync,
   copyFileSync as copyFileSync3,
-  existsSync as existsSync19,
+  existsSync as existsSync20,
   fsyncSync,
   linkSync,
   mkdirSync as mkdirSync5,
   openSync,
   readdirSync as readdirSync5,
-  realpathSync as realpathSync6,
+  realpathSync as realpathSync7,
   renameSync as renameSync6,
   rmSync,
   statSync as statSync6,
   unlinkSync as unlinkSync3
 } from "node:fs";
-import { dirname as dirname13, join as join25, sep as sep3 } from "node:path";
+import { dirname as dirname15, join as join26, sep as sep4 } from "node:path";
 function resolveInventoryPath(entry, cwd) {
   try {
     if (entry.tier === "global") {
@@ -40980,8 +41411,8 @@ async function openAgentRegistryDbForSnapshot() {
 }
 async function openTelemetryDbForSnapshot() {
   try {
-    const path = join25(getCleoHome(), "telemetry.db");
-    if (!existsSync19(path)) return null;
+    const path = join26(getCleoHome(), "telemetry.db");
+    if (!existsSync20(path)) return null;
   } catch {
     return null;
   }
@@ -41093,7 +41524,7 @@ function rotateSnapshots(backupDir, prefix, justWritten) {
     for (const name15 of names) {
       if (keep.has(name15)) continue;
       try {
-        unlinkSync3(join25(backupDir, name15));
+        unlinkSync3(join26(backupDir, name15));
       } catch {
       }
     }
@@ -41115,7 +41546,7 @@ async function snapshotProjectTargetsGated(targets, opts) {
   let backupDir;
   try {
     const cleoDir = getCleoDir(cwd);
-    backupDir = join25(cleoDir, "backups", "sqlite");
+    backupDir = join26(cleoDir, "backups", "sqlite");
     mkdirSync5(backupDir, { recursive: true });
   } catch {
     return null;
@@ -41147,7 +41578,7 @@ function sourceFileOf(db) {
   const location = db.location();
   if (!location) return null;
   try {
-    return realpathSync6(location);
+    return realpathSync7(location);
   } catch {
     return location;
   }
@@ -41158,10 +41589,10 @@ function hasLocation(db) {
 function assertOwnedByProject(source, prefix, cwd) {
   let cleoDir = getCleoDir(cwd);
   try {
-    cleoDir = realpathSync6(cleoDir);
+    cleoDir = realpathSync7(cleoDir);
   } catch {
   }
-  if (!source.startsWith(cleoDir + sep3)) {
+  if (!source.startsWith(cleoDir + sep4)) {
     throw new Error(
       `refusing to snapshot ${prefix}: its database ${source} is not inside ${cleoDir}`
     );
@@ -41190,7 +41621,7 @@ function commitSnapshotFile(tmp, dest) {
   }
   renameSync6(tmp, dest);
   try {
-    const dirFd = openSync(dirname13(dest), "r");
+    const dirFd = openSync(dirname15(dest), "r");
     try {
       fsyncSync(dirFd);
     } finally {
@@ -41213,7 +41644,7 @@ function removeDeadTempSnapshots(backupDir) {
       const m = TEMP_SNAPSHOT_RE.exec(name15);
       if (!m) continue;
       const pid = Number(m[1]);
-      const path = join25(backupDir, name15);
+      const path = join26(backupDir, name15);
       const stale = pid !== process.pid && (!isPidAlive2(pid) || Date.now() - statSync6(path).mtimeMs > TEMP_SNAPSHOT_MAX_AGE_MS);
       if (stale) rmSync(path, { force: true });
     }
@@ -41223,7 +41654,7 @@ function removeDeadTempSnapshots(backupDir) {
 async function freeSnapshotName(backupDir, prefix) {
   for (let attempt = 0; attempt < SNAPSHOT_NAME_ATTEMPTS; attempt++) {
     const name15 = `${prefix}-${formatTimestamp(/* @__PURE__ */ new Date())}.db`;
-    if (!existsSync19(join25(backupDir, name15))) return name15;
+    if (!existsSync20(join26(backupDir, name15))) return name15;
     await new Promise((r) => setTimeout(r, 1e3 - Date.now() % 1e3 + 5));
   }
   throw new Error(`no free snapshot filename for ${prefix} in ${backupDir}`);
@@ -41251,7 +41682,7 @@ async function snapshotOne(target, backupDir, writtenBySource, cwd) {
     if (opened && target.closeDb) target.closeDb(opened);
     throw err;
   }
-  const dest = join25(backupDir, destName);
+  const dest = join26(backupDir, destName);
   removeDeadTempSnapshots(backupDir);
   const existing = source !== null ? writtenBySource.get(source) : void 0;
   if (existing !== void 0) {
@@ -41305,13 +41736,13 @@ async function vacuumIntoBackup(opts = {}) {
 function listSqliteBackupsForPrefix(prefix, cwd) {
   try {
     const cleoDir = getCleoDir(cwd);
-    const backupDir = join25(cleoDir, "backups", "sqlite");
-    if (!existsSync19(backupDir)) return [];
+    const backupDir = join26(cleoDir, "backups", "sqlite");
+    if (!existsSync20(backupDir)) return [];
     const pattern = snapshotPattern(prefix);
     return readdirSync5(backupDir).filter((f) => pattern.test(f)).map((f) => ({
       name: f,
-      path: join25(backupDir, f),
-      mtimeMs: statSync6(join25(backupDir, f)).mtimeMs
+      path: join26(backupDir, f),
+      mtimeMs: statSync6(join26(backupDir, f)).mtimeMs
     })).sort((a, b) => b.mtimeMs - a.mtimeMs);
   } catch {
     return [];
@@ -41381,15 +41812,16 @@ __export(sqlite_exports, {
   resetDbState: () => resetDbState,
   resolveMigrationsFolder: () => resolveMigrationsFolder,
   schema: () => tasks_schema_exports,
-  seedTasksMeta: () => seedTasksMeta
+  seedTasksMeta: () => seedTasksMeta,
+  worktreeRecoveryRefusal: () => worktreeRecoveryRefusal
 });
-import { copyFileSync as copyFileSync4, existsSync as existsSync20, realpathSync as realpathSync7, renameSync as renameSync7, unlinkSync as unlinkSync4 } from "node:fs";
-import { createRequire as createRequire7 } from "node:module";
-import { basename as basename8, dirname as dirname14, resolve as resolve10 } from "node:path";
+import { copyFileSync as copyFileSync4, existsSync as existsSync21, realpathSync as realpathSync8, renameSync as renameSync7, unlinkSync as unlinkSync4 } from "node:fs";
+import { createRequire as createRequire8 } from "node:module";
+import { basename as basename8, dirname as dirname16, resolve as resolve12 } from "node:path";
 import { eq as eq9 } from "drizzle-orm";
 function _getDrizzle3() {
   if (_drizzle3 === null) {
-    const _require7 = createRequire7(import.meta.url);
+    const _require7 = createRequire8(import.meta.url);
     const mod = _require7("drizzle-orm/node-sqlite");
     _drizzle3 = mod.drizzle;
   }
@@ -41425,13 +41857,19 @@ function countBackupTasks(backupDb) {
   return 0;
 }
 function isSameDirectory(a, b) {
-  if (resolve10(a) === resolve10(b)) return true;
+  if (resolve12(a) === resolve12(b)) return true;
   try {
-    return realpathSync7(a) === realpathSync7(b);
+    return realpathSync8(a) === realpathSync8(b);
   } catch {
     return false;
   }
 }
+function worktreeRecoveryRefusal(dbPath) {
+  const storeCleoDir = dirname16(dbPath);
+  const root = dirname16(storeCleoDir);
+  if (basename8(storeCleoDir) !== ".cleo" || !isGitLinkedCheckout(root)) return null;
+  return `Auto-recovery refused: ${dbPath} lives inside the git worktree ${root}; ${describeWorktreeOwner(root)}. A worktree uses its owning project's store and never receives a restored copy (T12460, T12677).`;
+}
 async function autoRecoverFromBackup(nativeDb, dbPath, cwd) {
   const { openNativeDatabase: openNativeDatabase2 } = await Promise.resolve().then(() => (init_sqlite_native(), sqlite_native_exports));
   const log15 = getLogger("sqlite");
@@ -41440,12 +41878,10 @@ async function autoRecoverFromBackup(nativeDb, dbPath, cwd) {
     const countResult = nativeDb.prepare("SELECT COUNT(*) as cnt FROM tasks_tasks").get();
     const taskCount = countResult?.cnt ?? 0;
     if (taskCount > 0) return false;
-    const storeCleoDir = dirname14(dbPath);
-    if (basename8(storeCleoDir) === ".cleo" && isGitLinkedCheckout(dirname14(storeCleoDir))) {
-      log15.warn(
-        { dbPath },
-        "Auto-recovery refused: the empty store lives inside a git worktree (T12460). Worktrees must resolve the parent project store."
-      );
+    const storeCleoDir = dirname16(dbPath);
+    const worktreeRefusal = worktreeRecoveryRefusal(dbPath);
+    if (worktreeRefusal !== null) {
+      log15.warn({ dbPath }, worktreeRefusal);
       return false;
     }
     const backups = listSqliteBackups(cwd);
@@ -41453,7 +41889,7 @@ async function autoRecoverFromBackup(nativeDb, dbPath, cwd) {
       return false;
     }
     const newestBackup = backups[0];
-    const backupCleoDir = dirname14(dirname14(dirname14(newestBackup.path)));
+    const backupCleoDir = dirname16(dirname16(dirname16(newestBackup.path)));
     if (!isSameDirectory(backupCleoDir, storeCleoDir)) {
       log15.warn(
         { dbPath, backupPath: newestBackup.path },
@@ -41575,6 +42011,7 @@ function runMigrations(nativeDb, db, dbPath) {
   try {
     migrateWithRetry(db, migrationsFolder, nativeDb, "tasks", "sqlite");
   } catch (error48) {
+    if (isWorktreeBuildSchemaError(error48)) throw error48;
     if (isSqliteBusy(error48) || !tableExists(nativeDb, "tasks_tasks")) throw error48;
     try {
       rebuildLegacyTasksLineage(
@@ -41616,7 +42053,7 @@ async function getSchemaVersion(cwd) {
   return result[0]?.value ?? null;
 }
 function dbExists(cwd) {
-  return existsSync20(resolveDualScopeDbPath("project", cwd));
+  return existsSync21(resolveDualScopeDbPath("project", cwd));
 }
 function getNativeDb(cwd) {
   return boundProjectNative("tasks", cwd);
@@ -41652,6 +42089,7 @@ var init_sqlite3 = __esm({
     init_resolve_migrations_folder();
     init_sqlite_backup();
     init_twin_collapse();
+    init_worktree_build_guard();
     init_worktree_isolation_guard();
     init_sqlite_native();
     init_tasks_schema();
@@ -41680,15 +42118,15 @@ var init_sqlite3 = __esm({
 // packages/core/src/store/exodus/migrate.ts
 import {
   copyFileSync as copyFileSync5,
-  existsSync as existsSync21,
+  existsSync as existsSync22,
   mkdirSync as mkdirSync6,
-  readFileSync as readFileSync6,
+  readFileSync as readFileSync7,
   renameSync as renameSync8,
   statSync as statSync7,
   unlinkSync as unlinkSync5,
   writeFileSync as writeFileSync6
 } from "node:fs";
-import { join as join26 } from "node:path";
+import { join as join27 } from "node:path";
 function getSqliteVersion(db) {
   try {
     const row = db.prepare("SELECT sqlite_version() AS v").get();
@@ -41719,24 +42157,24 @@ function restoreGrandfatheredGuards(db, suspended) {
   }
 }
 function writeJournal(stagingDir, journal) {
-  const journalPath = join26(stagingDir, JOURNAL_FILENAME);
+  const journalPath = join27(stagingDir, JOURNAL_FILENAME);
   const tmpPath = `${journalPath}.tmp`;
   writeFileSync6(tmpPath, JSON.stringify(journal, null, 2) + "\n", "utf8");
   renameSync8(tmpPath, journalPath);
 }
 function readJournal(stagingDir) {
-  const journalPath = join26(stagingDir, JOURNAL_FILENAME);
-  if (!existsSync21(journalPath)) return null;
+  const journalPath = join27(stagingDir, JOURNAL_FILENAME);
+  if (!existsSync22(journalPath)) return null;
   try {
-    return JSON.parse(readFileSync6(journalPath, "utf8"));
+    return JSON.parse(readFileSync7(journalPath, "utf8"));
   } catch {
     return null;
   }
 }
 function clearExodusJournal(stagingDir) {
-  const journalPath = join26(stagingDir, JOURNAL_FILENAME);
+  const journalPath = join27(stagingDir, JOURNAL_FILENAME);
   try {
-    if (!existsSync21(journalPath)) return false;
+    if (!existsSync22(journalPath)) return false;
     unlinkSync5(journalPath);
     log10.info(
       { stagingDir },
@@ -42032,7 +42470,7 @@ async function runExodusMigrate(plan, forceCrossVersion = false, onProgress, opt
   mkdirSync6(stagingDir, { recursive: true });
   let sqliteVersion = "unknown";
   for (const src of sources) {
-    if (existsSync21(src.path)) {
+    if (existsSync22(src.path)) {
       const snap = openCleoDbSnapshot(src.path, { readOnly: true });
       sqliteVersion = getSqliteVersion(snap.db);
       snap.close();
@@ -42062,15 +42500,15 @@ async function runExodusMigrate(plan, forceCrossVersion = false, onProgress, opt
   let reseedProject = null;
   try {
     for (const src of sources) {
-      if (!existsSync21(src.path)) continue;
-      const backupDest = join26(stagingDir, `${src.name.replace(/[^a-z0-9-]/g, "_")}-backup.db`);
+      if (!existsSync22(src.path)) continue;
+      const backupDest = join27(stagingDir, `${src.name.replace(/[^a-z0-9-]/g, "_")}-backup.db`);
       const srcBytes = safeStatBytes(src.path);
       const skipStagingCopy = srcBytes > plan.stagingCopyThresholdBytes;
       if (skipStagingCopy) {
         onProgress?.(
           `Skipping full staging copy of ${src.name} (${srcBytes} bytes > ${plan.stagingCopyThresholdBytes} threshold) \u2014 source is archived, not deleted, on success.`
         );
-      } else if (!existsSync21(backupDest)) {
+      } else if (!existsSync22(backupDest)) {
         onProgress?.(`Backing up ${src.name} \u2192 staging dir\u2026`);
         copyFileSync5(src.path, backupDest);
         backupPaths.push(backupDest);
@@ -42103,8 +42541,8 @@ async function runExodusMigrate(plan, forceCrossVersion = false, onProgress, opt
     }
     prepareExodusRecovery(projectNative, stagingDir);
     if (globalNative !== null) prepareExodusRecovery(globalNative, stagingDir);
-    const projectSources = sources.filter((s) => s.targetScope === "project" && existsSync21(s.path));
-    const globalSources = sources.filter((s) => s.targetScope === "global" && existsSync21(s.path));
+    const projectSources = sources.filter((s) => s.targetScope === "project" && existsSync22(s.path));
+    const globalSources = sources.filter((s) => s.targetScope === "global" && existsSync22(s.path));
     if (globalNative === null && globalSources.length > 0)
       throw new Error("A projectOnly exodus run was given global-scope sources");
     await migrateScope(
@@ -42412,9 +42850,9 @@ __export(reconcile_exports, {
   reconcileSupersededStores: () => reconcileSupersededStores,
   unmigratedBareSources: () => unmigratedBareSources
 });
-import { copyFileSync as copyFileSync6, existsSync as existsSync22, mkdirSync as mkdirSync7, mkdtempSync, rmSync as rmSync2, writeFileSync as writeFileSync7 } from "node:fs";
+import { copyFileSync as copyFileSync6, existsSync as existsSync23, mkdirSync as mkdirSync7, mkdtempSync, rmSync as rmSync2, writeFileSync as writeFileSync7 } from "node:fs";
 import { tmpdir as tmpdir3 } from "node:os";
-import { basename as basename9, join as join27 } from "node:path";
+import { basename as basename9, join as join28 } from "node:path";
 function ident2(name15) {
   return `"${name15.replace(/"/g, '""')}"`;
 }
@@ -42483,7 +42921,7 @@ function assessSupersededProjectStores(liveStorePath, sources, resolveTarget = r
 }
 function legacySourcesHoldRows(sources) {
   for (const src of sources) {
-    if (!existsSync22(src.path)) continue;
+    if (!existsSync23(src.path)) continue;
     const snap = openCleoDbSnapshot(src.path, { readOnly: true });
     try {
       for (const table of orderTablesForCopy(snap.db)) {
@@ -42514,8 +42952,8 @@ async function bareTaskCoreSource(liveStorePath, resolveTarget, outDir) {
     live.close();
   }
   if (tables.length === 0) return null;
-  const seedPath = await buildFreshProjectStore(join27(outDir, "fresh-project-seed.db"));
-  const path = join27(outDir, "cleo-bare-task-core.db");
+  const seedPath = await buildFreshProjectStore(join28(outDir, "fresh-project-seed.db"));
+  const path = join28(outDir, "cleo-bare-task-core.db");
   const snap = openCleoDbSnapshot(path, { readOnly: false });
   let kept = 0;
   try {
@@ -42563,7 +43001,7 @@ async function buildFreshProjectStore(path) {
 }
 function snapshotFresherBareRows(barePath, legacyTasksPath, stagingDir) {
   if (legacyTasksPath === void 0) return null;
-  const path = join27(stagingDir, "cleo-bare-task-core-fresher.db");
+  const path = join28(stagingDir, "cleo-bare-task-core-fresher.db");
   const snap = openCleoDbSnapshot(barePath, { readOnly: true });
   try {
     snap.db.exec(`VACUUM INTO '${path.replace(/'/g, "''")}'`);
@@ -42714,7 +43152,7 @@ async function reconcileSuppressed(projectRoot, options, liveStorePath) {
   const additive = options.additive === true;
   const plan = buildExodusPlan(projectRoot);
   const resolveTarget = await buildRuntimeTargetResolver();
-  const scratch = mkdtempSync(join27(tmpdir3(), "cleo-reconcile-"));
+  const scratch = mkdtempSync(join28(tmpdir3(), "cleo-reconcile-"));
   try {
     return await reconcileWithScratch(
       projectRoot,
@@ -42730,8 +43168,8 @@ async function reconcileSuppressed(projectRoot, options, liveStorePath) {
   }
 }
 async function reconcileWithScratch(projectRoot, dryRun, additive, liveStorePath, plan, resolveTarget, scratch) {
-  const fileSources = plan.sources.filter((s) => s.targetScope === "project" && existsSync22(s.path));
-  const bare = !additive && existsSync22(liveStorePath) ? await bareTaskCoreSource(liveStorePath, resolveTarget, scratch) : null;
+  const fileSources = plan.sources.filter((s) => s.targetScope === "project" && existsSync23(s.path));
+  const bare = !additive && existsSync23(liveStorePath) ? await bareTaskCoreSource(liveStorePath, resolveTarget, scratch) : null;
   const copyResolver = additive ? (sourceName, legacyTable) => {
     const r = resolveTarget(sourceName, legacyTable);
     return r.kind !== "skip" && isLiveAuthoritative(sourceName, legacyTable, r.targetName) ? { kind: "skip", reason: "additive: live-authoritative task graph" } : r;
@@ -42750,7 +43188,7 @@ async function reconcileWithScratch(projectRoot, dryRun, additive, liveStorePath
     stagingDir: null,
     receiptPath: null
   };
-  if (sources.length === 0 || !existsSync22(liveStorePath)) {
+  if (sources.length === 0 || !existsSync23(liveStorePath)) {
     return {
       ...base,
       outcome: "nothing-to-reconcile",
@@ -42790,11 +43228,11 @@ async function reconcileWithScratch(projectRoot, dryRun, additive, liveStorePath
     };
   }
   const iso = (/* @__PURE__ */ new Date()).toISOString().replace(/[:]/g, "").replace(/\..+Z$/, "Z");
-  const stagingDir = join27(resolveCleoDir(projectRoot), `${RECONCILE_DIR_PREFIX}${iso}`);
+  const stagingDir = join28(resolveCleoDir(projectRoot), `${RECONCILE_DIR_PREFIX}${iso}`);
   mkdirSync7(stagingDir, { recursive: true });
   const copySources = sources.map((s) => {
     if (s !== bare) return s;
-    const kept = join27(stagingDir, basename9(s.path));
+    const kept = join28(stagingDir, basename9(s.path));
     copyFileSync6(s.path, kept);
     return { ...s, path: kept };
   });
@@ -42814,7 +43252,7 @@ async function reconcileWithScratch(projectRoot, dryRun, additive, liveStorePath
   const result = await withLock(
     `${liveStorePath}.exodus-on-open.lock`,
     async () => {
-      const liveBefore = join27(scratch, "live-before.db");
+      const liveBefore = join28(scratch, "live-before.db");
       snapshotLive(liveStorePath, liveBefore);
       const migrated = await runExodusMigrate(reconcilePlan, false, (msg) => log11.debug(msg), {
         projectOnly: true,
@@ -42864,7 +43302,7 @@ async function reconcileWithScratch(projectRoot, dryRun, additive, liveStorePath
     },
     { stale: 6e5, retries: 30 }
   );
-  const receiptPath = join27(stagingDir, RECEIPT_FILENAME);
+  const receiptPath = join28(stagingDir, RECEIPT_FILENAME);
   const receipt2 = { ...result, receiptPath };
   writeFileSync7(receiptPath, `${JSON.stringify(receipt2, null, 2)}
 `, "utf8");
@@ -42941,20 +43379,20 @@ var init_seal = __esm({
 });
 
 // packages/core/src/store/exodus/status.ts
-import { existsSync as existsSync23, readdirSync as readdirSync6, readFileSync as readFileSync7, statSync as statSync8 } from "node:fs";
-import { join as join28 } from "node:path";
+import { existsSync as existsSync24, readdirSync as readdirSync6, readFileSync as readFileSync8, statSync as statSync8 } from "node:fs";
+import { join as join29 } from "node:path";
 function readJournal2(stagingDir) {
-  const p = join28(stagingDir, JOURNAL_FILENAME2);
-  if (!existsSync23(p)) return null;
+  const p = join29(stagingDir, JOURNAL_FILENAME2);
+  if (!existsSync24(p)) return null;
   try {
-    return JSON.parse(readFileSync7(p, "utf8"));
+    return JSON.parse(readFileSync8(p, "utf8"));
   } catch {
     return null;
   }
 }
 function findStagingDirs(cleoDir) {
   try {
-    return readdirSync6(cleoDir, { withFileTypes: true }).filter((e) => e.isDirectory() && e.name.startsWith("exodus-staging-")).map((e) => join28(cleoDir, e.name)).sort().reverse();
+    return readdirSync6(cleoDir, { withFileTypes: true }).filter((e) => e.isDirectory() && e.name.startsWith("exodus-staging-")).map((e) => join29(cleoDir, e.name)).sort().reverse();
   } catch {
     return [];
   }
@@ -42977,15 +43415,15 @@ function runExodusStatus(cwd) {
   const sourcesInfo = plan.sources.map((s) => ({
     name: s.name,
     path: s.path,
-    exists: existsSync23(s.path),
+    exists: existsSync24(s.path),
     bytes: safeBytes(s.path)
   }));
   return {
     hasStaging: latestStaging !== null,
     stagingDir: latestStaging,
     journal,
-    projectDbExists: existsSync23(projectDbPath),
-    globalDbExists: existsSync23(globalDbPath),
+    projectDbExists: existsSync24(projectDbPath),
+    globalDbExists: existsSync24(globalDbPath),
     sourcesPresent: sourcesInfo.some((s) => s.exists),
     sources: sourcesInfo
   };
@@ -43002,8 +43440,8 @@ var init_status = __esm({
 });
 
 // packages/core/src/store/exodus/verify-migration.ts
-import { existsSync as existsSync24 } from "node:fs";
-import { createRequire as createRequire8 } from "node:module";
+import { existsSync as existsSync25 } from "node:fs";
+import { createRequire as createRequire9 } from "node:module";
 function orderByClause(db, tableName) {
   try {
     const pragma = db.prepare(`PRAGMA table_info("${tableName}")`).all();
@@ -43267,7 +43705,7 @@ function orphanAlreadyInSource(targetDb, fk, sources, resolveTarget = resolveCon
     const anyFeeder = (targetTable, probe) => {
       for (const feeder of feedersOf(targetTable)) {
         const src = sources.find((s) => s.name === feeder.sourceName);
-        if (src === void 0 || !existsSync24(src.path)) continue;
+        if (src === void 0 || !existsSync25(src.path)) continue;
         const snap = openCleoDbSnapshot(src.path, { readOnly: true });
         try {
           if (!tableExists3(snap.db, feeder.legacyTable)) continue;
@@ -43322,7 +43760,7 @@ function verifyMigration(sources, projectDbPath, globalDbPath, onProgress, resol
   const preExistingForeignKeyViolations = [];
   const failureLines = [];
   const sourceOrphanSigs = /* @__PURE__ */ new Set();
-  if (!existsSync24(projectDbPath)) {
+  if (!existsSync25(projectDbPath)) {
     return {
       ok: false,
       tables: [],
@@ -43333,7 +43771,7 @@ function verifyMigration(sources, projectDbPath, globalDbPath, onProgress, resol
       error: `Consolidated project cleo.db not found at ${projectDbPath}. Run 'cleo exodus migrate' first.`
     };
   }
-  if (!existsSync24(globalDbPath)) {
+  if (!existsSync25(globalDbPath)) {
     return {
       ok: false,
       tables: [],
@@ -43348,7 +43786,7 @@ function verifyMigration(sources, projectDbPath, globalDbPath, onProgress, resol
   const globalSnap = openCleoDbSnapshot(globalDbPath, { readOnly: true });
   try {
     for (const src of sources) {
-      if (!existsSync24(src.path)) {
+      if (!existsSync25(src.path)) {
         onProgress?.(`Skipping ${src.name} (not present)`);
         continue;
       }
@@ -43543,7 +43981,7 @@ var init_verify_migration = __esm({
     init_column_transforms();
     init_table_name_map();
     log13 = getLogger("verify-migration");
-    _require5 = createRequire8(import.meta.url);
+    _require5 = createRequire9(import.meta.url);
     CHECK_ENUM_REGEX = /CHECK\s*\(\s*"([^"]+)"\s+(?:IS\s+NULL\s+OR\s+"[^"]+"\s+)?IN\s*\(([^)]*)\)\s*\)/gi;
   }
 });
@@ -43639,11 +44077,11 @@ __export(on_open_exports, {
   maybeRunExodusOnOpen: () => maybeRunExodusOnOpen,
   withExodusOnOpenSuppressed: () => withExodusOnOpenSuppressed
 });
-import { existsSync as existsSync25, mkdtempSync as mkdtempSync2, rmSync as rmSync3 } from "node:fs";
+import { existsSync as existsSync26, mkdtempSync as mkdtempSync2, rmSync as rmSync3 } from "node:fs";
 import { tmpdir as tmpdir4 } from "node:os";
-import { join as join29, resolve as resolve11 } from "node:path";
+import { join as join30, resolve as resolve13 } from "node:path";
 async function withExodusOnOpenSuppressed(dbPath, fn) {
-  const key = resolve11(dbPath);
+  const key = resolve13(dbPath);
   _reconcileInProgress.set(key, (_reconcileInProgress.get(key) ?? 0) + 1);
   try {
     return await fn();
@@ -43681,7 +44119,7 @@ function remedyFor(scope) {
 }
 async function strandedLegacySources(scope, cwd) {
   const { buildExodusPlan: buildExodusPlan2, legacySourcesHoldRows: legacySourcesHoldRows2 } = await Promise.resolve().then(() => (init_exodus(), exodus_exports));
-  return buildExodusPlan2(cwd).sources.filter((s) => s.targetScope === scope && existsSync25(s.path)).filter((s) => legacySourcesHoldRows2([s])).map((s) => s.name);
+  return buildExodusPlan2(cwd).sources.filter((s) => s.targetScope === scope && existsSync26(s.path)).filter((s) => legacySourcesHoldRows2([s])).map((s) => s.name);
 }
 async function rollbackBothScopes(plan) {
   const { getDualScopeNativeDb: getDualScopeNativeDb2, openDualScopeDbAtPath: openDualScopeDbAtPath2 } = await Promise.resolve().then(() => (init_dual_scope_db(), dual_scope_db_exports));
@@ -43759,7 +44197,7 @@ async function runExodusOnOpen(scope, dbPath, nativeDb, cwd) {
   if (_exodusInProgress) {
     return { outcome: "skipped", reason: "re-entrant open during active migration" };
   }
-  if (_reconcileInProgress.has(resolve11(dbPath))) {
+  if (_reconcileInProgress.has(resolve13(dbPath))) {
     return {
       outcome: "skipped",
       reason: "an explicit superseded-store reconcile of this store is in progress"
@@ -43792,14 +44230,14 @@ async function runExodusOnOpen(scope, dbPath, nativeDb, cwd) {
   const { buildExodusPlan: buildExodusPlan2, runExodusMigrate: runExodusMigrate2, verifyMigration: verifyMigration2, clearExodusJournal: clearExodusJournal2 } = await Promise.resolve().then(() => (init_exodus(), exodus_exports));
   const plan = buildExodusPlan2(cwd);
   const plannedTarget = scope === "project" ? plan.projectDbPath : plan.globalDbPath;
-  if (resolve11(plannedTarget) !== resolve11(dbPath)) {
+  if (resolve13(plannedTarget) !== resolve13(dbPath)) {
     return {
       outcome: "aborted",
       reason: `migration plan target ${plannedTarget} does not match opened database ${dbPath}; no migration applied`
     };
   }
   const scopeSources = plan.sources.filter((s) => s.targetScope === scope);
-  if (!scopeSources.some((s) => existsSync25(s.path))) {
+  if (!scopeSources.some((s) => existsSync26(s.path))) {
     return {
       outcome: "skipped",
       reason: `no legacy ${scope}-scope source DBs present (fresh install or cross-scope-only)`
@@ -43816,12 +44254,12 @@ async function runExodusOnOpen(scope, dbPath, nativeDb, cwd) {
         {
           scope,
           dbPath,
-          sources: plan.sources.filter((s) => existsSync25(s.path)).map((s) => s.name)
+          sources: plan.sources.filter((s) => existsSync26(s.path)).map((s) => s.name)
         },
         "exodus-on-open: consolidated cleo.db is empty and legacy data present \u2014 auto-migrating"
       );
       _exodusInProgress = true;
-      const bareScratch = mkdtempSync2(join29(tmpdir4(), "cleo-exodus-bare-"));
+      const bareScratch = mkdtempSync2(join30(tmpdir4(), "cleo-exodus-bare-"));
       try {
         const { buildRuntimeTargetResolver: buildRuntimeTargetResolver2 } = await Promise.resolve().then(() => (init_runtime_targets(), runtime_targets_exports));
         const resolveTarget = await buildRuntimeTargetResolver2();
@@ -43829,7 +44267,7 @@ async function runExodusOnOpen(scope, dbPath, nativeDb, cwd) {
         const bare = scope === "project" ? await unmigratedBareSources2(
           dbPath,
           resolveTarget,
-          plan.sources.find((s) => s.name === "tasks" && existsSync25(s.path))?.path,
+          plan.sources.find((s) => s.name === "tasks" && existsSync26(s.path))?.path,
           bareScratch
         ) : { first: [], last: [] };
         const migratePlan = { ...plan, sources: [...bare.first, ...plan.sources, ...bare.last] };
@@ -43893,7 +44331,7 @@ async function runExodusOnOpen(scope, dbPath, nativeDb, cwd) {
           "exodus-on-open: parity verified \u2014 legacy data migrated into consolidated cleo.db"
         );
         try {
-          const consumed = plan.sources.filter((s) => existsSync25(s.path));
+          const consumed = plan.sources.filter((s) => existsSync26(s.path));
           const identities = await sealTargets(plan, consumed);
           const archiveResult = archiveMigratedSources(consumed, cwd, plan, identities);
           log14.info(
@@ -43968,9 +44406,9 @@ __export(dual_scope_db_exports, {
   upsertIdempotent: () => upsertIdempotent,
   withStoreSchemaOwnership: () => withStoreSchemaOwnership
 });
-import { existsSync as existsSync26, mkdirSync as mkdirSync8 } from "node:fs";
-import { createRequire as createRequire9 } from "node:module";
-import { dirname as dirname15, join as join30, resolve as resolve12 } from "node:path";
+import { existsSync as existsSync27, mkdirSync as mkdirSync8 } from "node:fs";
+import { createRequire as createRequire10 } from "node:module";
+import { dirname as dirname17, join as join31, resolve as resolve14 } from "node:path";
 function getDualScopeNativeDb(handle) {
   const db = handle.db;
   if ("$client" in db && db.$client instanceof getDatabaseSyncCtor()) return db.$client;
@@ -43992,9 +44430,9 @@ function cacheKey(scope, dbPath) {
 }
 function resolveDualScopeDbPath(scope, cwd, capturedGlobalHome) {
   if (scope === "project") {
-    return join30(resolveCleoDir(cwd), "cleo.db");
+    return join31(resolveCleoDir(cwd), "cleo.db");
   }
-  return join30(capturedGlobalHome ?? getCleoHome(), "cleo.db");
+  return join31(capturedGlobalHome ?? getCleoHome(), "cleo.db");
 }
 function migrationsSetName(scope) {
   return scope === "project" ? "drizzle-cleo-project" : "drizzle-cleo-global";
@@ -44044,8 +44482,8 @@ async function openDualScopeDb(scope, cwd, options) {
 async function openDedicatedDualScopeDb(scope, dbPath, log15, execution) {
   execution?.assertActive();
   log15.debug({ scope, dbPath }, "opening DEDICATED (non-cached) dual-scope cleo.db (T11782 FIX D)");
-  const dir = dirname15(dbPath);
-  if (!existsSync26(dir)) {
+  const dir = dirname17(dbPath);
+  if (!existsSync27(dir)) {
     mkdirSync8(dir, { recursive: true });
   }
   execution?.assertActive();
@@ -44053,6 +44491,7 @@ async function openDedicatedDualScopeDb(scope, dbPath, log15, execution) {
   const nativeDb = new DatabaseSyncCtor(dbPath, { allowExtension: true });
   try {
     applyPerfPragmas(nativeDb, memoryBoundedPragmaOverrides());
+    installSchemaWriteGuard(nativeDb);
     const drizzle2 = getDrizzle();
     const db = drizzle2({ client: nativeDb });
     const migrationsFolder = resolveCorePackageMigrationsFolder(migrationsSetName(scope));
@@ -44101,11 +44540,12 @@ async function openDedicatedDualScopeDb(scope, dbPath, log15, execution) {
     execution?.assertActive();
     return handle;
   } catch (err) {
+    const explained = explainSchemaWriteDenial(nativeDb, err);
     try {
       nativeDb.close();
     } catch {
     }
-    throw err;
+    throw explained;
   }
 }
 async function openDualScopeDbAtPath(scope, dbPath, exodusCwd, options) {
@@ -44126,7 +44566,7 @@ async function openDualScopeDbAtPath(scope, dbPath, exodusCwd, options) {
     );
   }
   const dedicated = options?.dedicated === true;
-  const normalizedPath = resolve12(dbPath);
+  const normalizedPath = resolve14(dbPath);
   const key = cacheKey(scope, normalizedPath);
   if (!dedicated) {
     const existing = _cache.get(key);
@@ -44163,8 +44603,8 @@ async function openDualScopeDbAtPath(scope, dbPath, exodusCwd, options) {
   }
   let initResolve = null;
   let initReject = null;
-  const initPromise = new Promise((resolve15, reject) => {
-    initResolve = resolve15;
+  const initPromise = new Promise((resolve17, reject) => {
+    initResolve = resolve17;
     initReject = reject;
   });
   _cache.set(key, {
@@ -44185,8 +44625,8 @@ async function openDualScopeDbAtPath(scope, dbPath, exodusCwd, options) {
     try {
       execution?.assertActive();
       log15.debug({ scope, dbPath: normalizedPath }, "opening dual-scope cleo.db");
-      const dir = dirname15(normalizedPath);
-      if (!existsSync26(dir)) {
+      const dir = dirname17(normalizedPath);
+      if (!existsSync27(dir)) {
         mkdirSync8(dir, { recursive: true });
       }
       execution?.assertActive();
@@ -44194,6 +44634,7 @@ async function openDualScopeDbAtPath(scope, dbPath, exodusCwd, options) {
       const nativeDb = new DatabaseSyncCtor(normalizedPath, { allowExtension: true });
       openingNative = nativeDb;
       applyPerfPragmas(nativeDb, memoryBoundedPragmaOverrides());
+      installSchemaWriteGuard(nativeDb);
       const drizzle2 = getDrizzle();
       const db = drizzle2({ client: nativeDb });
       const migrationsFolder = resolveCorePackageMigrationsFolder(migrationsSetName(scope));
@@ -44324,12 +44765,13 @@ async function openDualScopeDbAtPath(scope, dbPath, exodusCwd, options) {
       execution?.assertActive();
       initResolve(finalHandle);
     } catch (err) {
+      const explained = openingNative ? explainSchemaWriteDenial(openingNative, err) : err;
       try {
         if (!published && openingNative?.isOpen) openingNative.close();
       } catch (closeError) {
         log15.warn({ closeError }, "failed to close unpublished database initializer");
       }
-      initReject(err);
+      initReject(explained);
     }
   })();
   return initPromise;
@@ -44402,6 +44844,7 @@ var init_dual_scope_db = __esm({
     init_relocated_store_guard();
     init_resolve_migrations_folder();
     init_sqlite_pragmas();
+    init_worktree_build_guard();
     init_worktree_isolation_guard();
     init_writer_lease();
     ExodusAbortWriteUnsafeError = class extends Error {
@@ -44424,7 +44867,7 @@ var init_dual_scope_db = __esm({
       }
     };
     _cache = /* @__PURE__ */ new Map();
-    _require6 = createRequire9(import.meta.url);
+    _require6 = createRequire10(import.meta.url);
     _drizzle4 = null;
     _DatabaseSyncCtor = null;
     EntryCancelledError = class extends Error {
@@ -44455,7 +44898,7 @@ var init_dual_scope_db = __esm({
       }
       /** @inheritdoc */
       async openProject(dbPath, options) {
-        const normalized = resolve12(dbPath);
+        const normalized = resolve14(dbPath);
         if (options?.dedicated) {
           const handle = await openDualScopeDbAtPath("project", normalized, options?.exodusCwd, {
             dedicated: true
@@ -44467,7 +44910,7 @@ var init_dual_scope_db = __esm({
       /** @inheritdoc */
       async openGlobal(options) {
         const dbPath = resolveDualScopeDbPath("global");
-        const normalized = resolve12(dbPath);
+        const normalized = resolve14(dbPath);
         if (options?.dedicated) {
           const handle = await openDualScopeDbAtPath("global", normalized, options?.exodusCwd, {
             dedicated: true
@@ -44478,7 +44921,7 @@ var init_dual_scope_db = __esm({
       }
       /** @inheritdoc */
       async openGlobalAt(dbPath, options) {
-        const normalized = resolve12(dbPath);
+        const normalized = resolve14(dbPath);
         if (options?.dedicated) {
           const handle = await openDualScopeDbAtPath("global", normalized, options?.exodusCwd, {
             dedicated: true
@@ -44489,7 +44932,7 @@ var init_dual_scope_db = __esm({
       }
       /** @inheritdoc */
       closeProject(dbPath) {
-        const normalized = resolve12(dbPath);
+        const normalized = resolve14(dbPath);
         this.closeEntry("project", normalized);
       }
       /** @inheritdoc */
@@ -44526,8 +44969,8 @@ var init_dual_scope_db = __esm({
         const entryId = ++this._nextId;
         let initResolve;
         let initReject;
-        const initPromise = new Promise((resolve15, reject) => {
-          initResolve = resolve15;
+        const initPromise = new Promise((resolve17, reject) => {
+          initResolve = resolve17;
           initReject = reject;
         });
         this._registry.set(key, { id: entryId, store: null, initPromise });
@@ -45320,8 +45763,8 @@ __export(nexus_sqlite_exports, {
   resetNexusDbState: () => resetNexusDbState,
   resolveNexusMigrationsFolder: () => resolveNexusMigrationsFolder
 });
-import { copyFileSync as copyFileSync7, existsSync as existsSync27 } from "node:fs";
-import { join as join31 } from "node:path";
+import { copyFileSync as copyFileSync7, existsSync as existsSync28 } from "node:fs";
+import { join as join32 } from "node:path";
 function getNexusDbPath(cwd) {
   return resolveDualScopeDbPath("project", cwd);
 }
@@ -45357,12 +45800,13 @@ function ensureGlobalRegistryAttached(nativeDb) {
     }
   }
   nativeDb.exec(`ATTACH DATABASE '${escaped}' AS ${NEXUS_GLOBAL_ATTACH_ALIAS}`);
+  refreshSchemaWriteGuard(nativeDb);
 }
 function resolveNexusMigrationsFolder() {
   return resolveCorePackageMigrationsFolder("drizzle-nexus");
 }
 function getNestedNexusSentinelPath() {
-  return join31(getCleoHome(), "nexus", NESTED_NEXUS_SENTINEL);
+  return join32(getCleoHome(), "nexus", NESTED_NEXUS_SENTINEL);
 }
 function detectAndWarnOnNestedNexus() {
   let nestedPath;
@@ -45371,7 +45815,7 @@ function detectAndWarnOnNestedNexus() {
   } catch {
     return false;
   }
-  if (!existsSync27(nestedPath)) return false;
+  if (!existsSync28(nestedPath)) return false;
   if (_warnedNestedPaths.has(nestedPath)) return false;
   _warnedNestedPaths.add(nestedPath);
   const canonicalPath = getNexusDbPath();
@@ -45530,7 +45974,7 @@ function runNexusMigrations(nativeDb, db, dbPath) {
   const migrationsFolder = resolveNexusMigrationsFolder();
   if (tableExists4(nativeDb, "nexus_nodes")) {
     const backupPath = dbPath.replace(/\.db$/, "-pre-cleo.db.bak");
-    if (!existsSync27(backupPath)) {
+    if (!existsSync28(backupPath)) {
       try {
         copyFileSync7(dbPath, backupPath);
       } catch {
@@ -45625,6 +46069,7 @@ var init_nexus_sqlite = __esm({
     init_resolve_migrations_folder();
     init_nexus_schema();
     init_with_retry();
+    init_worktree_build_guard();
     NEXUS_SCHEMA_VERSION = "1.0.0";
     NEXUS_GLOBAL_ATTACH_ALIAS = "nexus_global";
     NESTED_NEXUS_SENTINEL = "nexus.db";
@@ -45659,15 +46104,15 @@ var init_legacy_alias = __esm({
 
 // packages/core/src/llm/stable-device-id.ts
 import { randomUUID as randomUUID3 } from "node:crypto";
-import { existsSync as existsSync28, mkdirSync as mkdirSync9, readFileSync as readFileSync8, renameSync as renameSync9, writeFileSync as writeFileSync8 } from "node:fs";
-import { dirname as dirname16 } from "node:path";
+import { existsSync as existsSync29, mkdirSync as mkdirSync9, readFileSync as readFileSync9, renameSync as renameSync9, writeFileSync as writeFileSync8 } from "node:fs";
+import { dirname as dirname18 } from "node:path";
 import { resolveStableDeviceIdPath } from "@cleocode/paths";
 function getStableDeviceId() {
   if (_cachedDeviceId !== null) return _cachedDeviceId;
   const path = resolveStableDeviceIdPath();
-  if (existsSync28(path)) {
+  if (existsSync29(path)) {
     try {
-      const raw = readFileSync8(path, "utf-8").trim();
+      const raw = readFileSync9(path, "utf-8").trim();
       if (raw.length > 0) {
         _cachedDeviceId = raw;
         return raw;
@@ -45677,8 +46122,8 @@ function getStableDeviceId() {
   }
   const fresh = randomUUID3();
   try {
-    const dir = dirname16(path);
-    if (!existsSync28(dir)) {
+    const dir = dirname18(path);
+    if (!existsSync29(dir)) {
       mkdirSync9(dir, { recursive: true });
     }
     const tmpPath = `${path}.tmp.${process.pid}`;
@@ -45715,8 +46160,8 @@ var init_registry_roots = __esm({
 // packages/core/src/nexus/projects-scan.ts
 async function withinBudget(promise2, ms) {
   let timer;
-  const expiry = new Promise((resolve15) => {
-    timer = setTimeout(() => resolve15("timeout"), ms);
+  const expiry = new Promise((resolve17) => {
+    timer = setTimeout(() => resolve17("timeout"), ms);
     timer.unref();
   });
   try {
@@ -45754,9 +46199,9 @@ __export(path_map_exports, {
   supersededRegistryPath: () => supersededRegistryPath,
   touchProjectLocation: () => touchProjectLocation
 });
-import { existsSync as existsSync29, lstatSync, readdirSync as readdirSync7 } from "node:fs";
+import { existsSync as existsSync30, lstatSync, readdirSync as readdirSync7 } from "node:fs";
 import { lstat, readdir as readdir2 } from "node:fs/promises";
-import { isAbsolute as isAbsolute4, join as join32, relative as relative2, sep as sep4 } from "node:path";
+import { isAbsolute as isAbsolute5, join as join33, relative as relative3, sep as sep5 } from "node:path";
 import { canonicalizePath as canonicalizePath3, readDeclaredProjectIdentity as readDeclaredProjectIdentity3 } from "@cleocode/paths";
 import { and as and7, desc as desc3, eq as eq11, inArray as inArray5, ne as ne3 } from "drizzle-orm";
 function holdingKey(projectId, path) {
@@ -45772,7 +46217,7 @@ function isSupersededRegistryPath(projectPath) {
   return projectPath.startsWith(SUPERSEDED_PATH_PREFIX);
 }
 function projectHolding(path, projectId) {
-  const cleoDir = join32(path, ".cleo");
+  const cleoDir = join33(path, ".cleo");
   try {
     lstatSync(cleoDir);
     readdirSync7(cleoDir);
@@ -45784,7 +46229,7 @@ function projectHolding(path, projectId) {
   return declared === null || declared.projectId === projectId ? "yes" : "no";
 }
 async function probeProjectHolding(path, projectId, timeoutMs) {
-  const cleoDir = join32(path, ".cleo");
+  const cleoDir = join33(path, ".cleo");
   const probe = async () => {
     try {
       await lstat(cleoDir);
@@ -45802,8 +46247,8 @@ async function probeProjectHolding(path, projectId, timeoutMs) {
   return declared === null || declared.projectId === projectId ? "yes" : "no";
 }
 function isStrictlyInside(outer, inner) {
-  const rel = relative2(canonicalizePath3(outer), canonicalizePath3(inner));
-  return rel.length > 0 && rel !== ".." && !rel.startsWith(`..${sep4}`) && !isAbsolute4(rel);
+  const rel = relative3(canonicalizePath3(outer), canonicalizePath3(inner));
+  return rel.length > 0 && rel !== ".." && !rel.startsWith(`..${sep5}`) && !isAbsolute5(rel);
 }
 function locationKey(projectId, deviceId, path) {
   return and7(
@@ -45965,7 +46410,7 @@ function hasOtherLiveLocation(db, record2, deviceId) {
       ne3(projectLocations.path, record2.projectPath)
     )
   ).all().some(
-    (location) => isStrictlyInside(record2.projectPath, location.path) && existsSync29(location.path) && readDeclaredProjectIdentity3(location.path)?.projectId === record2.projectId
+    (location) => isStrictlyInside(record2.projectPath, location.path) && existsSync30(location.path) && readDeclaredProjectIdentity3(location.path)?.projectId === record2.projectId
   );
 }
 function demoteProjectLocation(db, record2, state) {
@@ -46016,7 +46461,7 @@ function rehomeDisplacedRows(db, projectId, projectPath, deviceId, probed) {
     ).orderBy(desc3(projectLocations.lastSeen)).all();
     const present = (path) => {
       const holding = probed?.get(holdingKey(row.projectId, path));
-      return holding === void 0 ? existsSync29(path) : holding === "yes";
+      return holding === void 0 ? existsSync30(path) : holding === "yes";
     };
     const home = candidates.find(
       (c) => present(c.path) && db.select({ projectId: projectRegistry.projectId }).from(projectRegistry).where(eq11(projectRegistry.projectPath, c.path)).all().length === 0
@@ -46045,7 +46490,7 @@ async function listProjectCheckouts(projectId, opts = {}) {
       projectHash: generateProjectHash(row.path),
       firstSeen: row.firstSeen,
       lastSeen: row.lastSeen,
-      exists: local && existsSync29(row.path),
+      exists: local && existsSync30(row.path),
       deviceId: local ? deviceId : row.deviceId,
       state: row.state
     });
@@ -46074,13 +46519,13 @@ __export(checkout_nonce_exports, {
   readCheckoutNonce: () => readCheckoutNonce
 });
 import { randomBytes as randomBytes2 } from "node:crypto";
-import { existsSync as existsSync30, readFileSync as readFileSync9, renameSync as renameSync10, writeFileSync as writeFileSync9 } from "node:fs";
-import { join as join33 } from "node:path";
+import { existsSync as existsSync31, readFileSync as readFileSync10, renameSync as renameSync10, writeFileSync as writeFileSync9 } from "node:fs";
+import { join as join34 } from "node:path";
 function readInfo(projectRoot) {
-  const path = join33(projectRoot, ".cleo", "project-info.json");
-  if (!existsSync30(path)) return null;
+  const path = join34(projectRoot, ".cleo", "project-info.json");
+  if (!existsSync31(path)) return null;
   try {
-    const parsed = JSON.parse(readFileSync9(path, "utf-8"));
+    const parsed = JSON.parse(readFileSync10(path, "utf-8"));
     return parsed !== null && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
   } catch {
     return null;
@@ -46096,7 +46541,7 @@ function ensureCheckoutNonce(projectRoot) {
   const info = readInfo(projectRoot);
   if (!info) return null;
   const nonce = randomBytes2(16).toString("hex");
-  const path = join33(projectRoot, ".cleo", "project-info.json");
+  const path = join34(projectRoot, ".cleo", "project-info.json");
   const temp = `${path}.${randomBytes2(6).toString("hex")}.tmp`;
   writeFileSync9(temp, `${JSON.stringify({ ...info, [CHECKOUT_NONCE_FIELD]: nonce }, null, 2)}
 `);
@@ -46171,10 +46616,10 @@ __export(paths_exports, {
   validateProjectRoot: () => validateProjectRoot,
   worktreeScope: () => worktreeScope
 });
-import { existsSync as existsSync31, readFileSync as readFileSync10, statSync as statSync9 } from "node:fs";
-import { createRequire as createRequire10 } from "node:module";
+import { existsSync as existsSync32, readFileSync as readFileSync11, statSync as statSync9 } from "node:fs";
+import { createRequire as createRequire11 } from "node:module";
 import { homedir as homedir2 } from "node:os";
-import { basename as basename10, dirname as dirname17, join as join34, resolve as resolve13 } from "node:path";
+import { basename as basename10, dirname as dirname19, join as join35, resolve as resolve15 } from "node:path";
 import {
   getCanonicalTemplatesTildePath as _getCanonicalTemplatesTildePath,
   getCleoTemplatesTildePath as _getCleoTemplatesTildePath,
@@ -46184,7 +46629,7 @@ import {
   resolveCanonicalCleoDir as _resolveCanonicalCleoDir
 } from "@cleocode/paths";
 function _getDatabaseSyncCtor() {
-  const _require7 = createRequire10(import.meta.url);
+  const _require7 = createRequire11(import.meta.url);
   const mod = _require7("node:sqlite");
   return mod.DatabaseSync;
 }
@@ -46196,20 +46641,20 @@ function runWithWorktreeScopeFromEnv(fn) {
 }
 function isProjectInitialized(projectRoot) {
   const root = projectRoot ?? getProjectRoot();
-  const cleoDir = join34(root, ".cleo");
-  return existsSync31(cleoDir) && existsSync31(join34(cleoDir, "tasks.db"));
+  const cleoDir = join35(root, ".cleo");
+  return existsSync32(cleoDir) && existsSync32(join35(cleoDir, "tasks.db"));
 }
 function getCleoHome() {
   return getPlatformPaths().data;
 }
 function getCleoTemplatesDir() {
-  return join34(getCleoHome(), "templates");
+  return join35(getCleoHome(), "templates");
 }
 function getCleoSchemasDir() {
-  return join34(getCleoHome(), "schemas");
+  return join35(getCleoHome(), "schemas");
 }
 function getCleoDocsDir() {
-  return join34(getCleoHome(), "docs");
+  return join35(getCleoHome(), "docs");
 }
 function getCleoDir(cwd) {
   if (cwd) {
@@ -46258,24 +46703,24 @@ function getCleoDirAbsolute(cwd, opts) {
     try {
       const projectRoot = getProjectRoot(cwd);
       const canonical = _resolveCanonicalCleoDir(project.projectId);
-      if (canonical !== null && canonical === resolve13(projectRoot, cleoDir)) {
+      if (canonical !== null && canonical === resolve15(projectRoot, cleoDir)) {
         return canonical;
       }
-      return resolve13(projectRoot, cleoDir);
+      return resolve15(projectRoot, cleoDir);
     } catch {
-      return resolve13(project.projectRoot, cleoDir);
+      return resolve15(project.projectRoot, cleoDir);
     }
   }
   try {
-    return resolve13(getProjectRoot(cwd), cleoDir);
+    return resolve15(getProjectRoot(cwd), cleoDir);
   } catch (err) {
     if (opts?.bootstrap) {
-      return resolve13(cwd ?? process.cwd(), cleoDir);
+      return resolve15(cwd ?? process.cwd(), cleoDir);
     }
     if (_cwdHasGitAncestor(cwd)) {
       throw err;
     }
-    return resolve13(cwd ?? process.cwd(), cleoDir);
+    return resolve15(cwd ?? process.cwd(), cleoDir);
   }
 }
 function resolveCanonicalCleoDir(projectId) {
@@ -46302,9 +46747,9 @@ function resolveCanonicalCleoDir(projectId) {
 function _resolveProjectByCwdFromNexus(cwd) {
   try {
     const cleoHome = getCleoHome();
-    const globalDbPath = join34(cleoHome, "cleo.db");
-    if (!existsSync31(globalDbPath)) return null;
-    const start = resolve13(cwd ?? process.cwd());
+    const globalDbPath = join35(cleoHome, "cleo.db");
+    if (!existsSync32(globalDbPath)) return null;
+    const start = resolve15(cwd ?? process.cwd());
     let current = start;
     const DatabaseSync3 = _getDatabaseSyncCtor();
     const db = new DatabaseSync3(globalDbPath, { readOnly: true });
@@ -46317,7 +46762,7 @@ function _resolveProjectByCwdFromNexus(cwd) {
         if (row && typeof row.project_id === "string" && row.project_id.length > 0) {
           return row.project_id;
         }
-        const parent = dirname17(current);
+        const parent = dirname19(current);
         if (parent === current) break;
         current = parent;
       }
@@ -46337,18 +46782,18 @@ function _cleoDirEnvOverride() {
 }
 function _findCleoDirRoot(cwd) {
   const homeRoot = homedir2();
-  let current = resolve13(cwd ?? process.cwd());
+  let current = resolve15(cwd ?? process.cwd());
   while (true) {
     const isDangerousRoot = current === homeRoot || current === "/" || current === "";
     if (!isDangerousRoot) {
       try {
-        if (statSync9(join34(current, ".cleo")).isDirectory()) {
+        if (statSync9(join35(current, ".cleo")).isDirectory()) {
           return current;
         }
       } catch {
       }
     }
-    const parent = dirname17(current);
+    const parent = dirname19(current);
     if (parent === current) break;
     current = parent;
   }
@@ -46367,7 +46812,7 @@ function resolveProjectByCwd(cwd) {
   if (pathsResult !== null) {
     return pathsResult.projectId;
   }
-  const start = resolve13(from ?? process.cwd());
+  const start = resolve15(from ?? process.cwd());
   let current = start;
   while (true) {
     const mainRepo = _resolveMainRepoFromGitlink(current);
@@ -46378,7 +46823,7 @@ function resolveProjectByCwd(cwd) {
       }
       break;
     }
-    const parent = dirname17(current);
+    const parent = dirname19(current);
     if (parent === current) break;
     current = parent;
   }
@@ -46397,7 +46842,7 @@ function resolveProjectByCwd(cwd) {
 function resolveCleoDir(cwd) {
   const scope = worktreeScope.getStore();
   if (scope !== void 0) {
-    return join34(resolveStoreOwnerRoot(scope.worktreeRoot), ".cleo");
+    return join35(resolveStoreOwnerRoot(scope.worktreeRoot), ".cleo");
   }
   const override = _cleoDirEnvOverride();
   if (override !== null) {
@@ -46405,16 +46850,16 @@ function resolveCleoDir(cwd) {
   }
   const root = _findCleoDirRoot(cwd);
   if (root !== null) {
-    return join34(resolveStoreOwnerRoot(root), ".cleo");
+    return join35(resolveStoreOwnerRoot(root), ".cleo");
   }
-  const start = resolve13(cwd ?? process.cwd());
+  const start = resolve15(cwd ?? process.cwd());
   let current = start;
   while (true) {
     const mainRepo = _resolveMainRepoFromGitlink(current);
     if (mainRepo !== null) {
-      return join34(mainRepo, ".cleo");
+      return join35(mainRepo, ".cleo");
     }
-    const parent = dirname17(current);
+    const parent = dirname19(current);
     if (parent === current) {
       break;
     }
@@ -46453,25 +46898,25 @@ function _resolveCleoDir(cwd) {
   const project = _pathsResolveProjectByCwd(cwd);
   if (project !== null) {
     try {
-      return resolve13(getProjectRoot(cwd), cleoDir);
+      return resolve15(getProjectRoot(cwd), cleoDir);
     } catch {
-      return resolve13(project.projectRoot, cleoDir);
+      return resolve15(project.projectRoot, cleoDir);
     }
   }
   return getCleoDirAbsolute(cwd);
 }
 function _cwdHasGitAncestor(cwd) {
-  const start = resolve13(cwd ?? process.cwd());
+  const start = resolve15(cwd ?? process.cwd());
   let current = start;
   while (true) {
-    const gitMarker = join34(current, ".git");
+    const gitMarker = join35(current, ".git");
     try {
-      if (existsSync31(gitMarker)) {
+      if (existsSync32(gitMarker)) {
         return true;
       }
     } catch {
     }
-    const parent = dirname17(current);
+    const parent = dirname19(current);
     if (parent === current) return false;
     current = parent;
   }
@@ -46498,55 +46943,55 @@ function resolveProjectPath(relativePath, cwd) {
     return relativePath;
   }
   if (relativePath.startsWith("~/") || relativePath.startsWith("~\\") || relativePath === "~") {
-    return resolve13(homedir2(), relativePath.slice(2));
+    return resolve15(homedir2(), relativePath.slice(2));
   }
-  return resolve13(getProjectRoot(cwd), relativePath);
+  return resolve15(getProjectRoot(cwd), relativePath);
 }
 function getTaskPath(cwd) {
-  return join34(_resolveCleoDir(cwd), "tasks.db");
+  return join35(_resolveCleoDir(cwd), "tasks.db");
 }
 function getConfigPath(cwd) {
-  return join34(_resolveCleoDir(cwd), "config.json");
+  return join35(_resolveCleoDir(cwd), "config.json");
 }
 function getSessionsPath(cwd) {
-  return join34(_resolveCleoDir(cwd), "sessions.json");
+  return join35(_resolveCleoDir(cwd), "sessions.json");
 }
 function getArchivePath(cwd) {
-  return join34(_resolveCleoDir(cwd), "tasks-archive.json");
+  return join35(_resolveCleoDir(cwd), "tasks-archive.json");
 }
 function getLogPath(cwd) {
-  return join34(_resolveCleoDir(cwd), "logs", "cleo.log");
+  return join35(_resolveCleoDir(cwd), "logs", "cleo.log");
 }
 function getBackupDir(cwd) {
-  return join34(_resolveCleoDir(cwd), "backups", "operational");
+  return join35(_resolveCleoDir(cwd), "backups", "operational");
 }
 function getGlobalConfigPath() {
-  return join34(getCleoHome(), "config.json");
+  return join35(getCleoHome(), "config.json");
 }
 function getCleoGlobalRecipesDir() {
-  return join34(getCleoHome(), "global-recipes");
+  return join35(getCleoHome(), "global-recipes");
 }
 function getCleoGlobalJustfilePath() {
-  return join34(getCleoGlobalRecipesDir(), "justfile");
+  return join35(getCleoGlobalRecipesDir(), "justfile");
 }
 function getCleoPiExtensionsDir() {
-  return join34(getCleoHome(), "pi-extensions");
+  return join35(getCleoHome(), "pi-extensions");
 }
 function getCleoCantWorkflowsDir() {
-  return join34(getCleoHome(), "cant-workflows");
+  return join35(getCleoHome(), "cant-workflows");
 }
 function getCleoGlobalAgentsDir() {
-  return join34(getCleoHome(), "agents");
+  return join35(getCleoHome(), "agents");
 }
 function getCleoGlobalCantAgentsDir() {
-  return join34(getCleoHome(), "cant", "agents");
+  return join35(getCleoHome(), "cant", "agents");
 }
 function getAgentOutputsDir(cwd) {
   const projectRoot = getProjectRoot(cwd);
-  const configPath = join34(projectRoot, ".cleo", "config.json");
-  if (existsSync31(configPath)) {
+  const configPath = join35(projectRoot, ".cleo", "config.json");
+  if (existsSync32(configPath)) {
     try {
-      const config2 = JSON.parse(readFileSync10(configPath, "utf-8"));
+      const config2 = JSON.parse(readFileSync11(configPath, "utf-8"));
       if (typeof config2.agentOutputs === "object" && config2.agentOutputs?.directory) {
         return config2.agentOutputs.directory;
       }
@@ -46569,17 +47014,17 @@ function getAgentOutputsAbsolute(cwd) {
   if (isAbsolutePath2(dir)) {
     return dir;
   }
-  return resolve13(getProjectRoot(cwd), dir);
+  return resolve15(getProjectRoot(cwd), dir);
 }
 function getManifestPath(cwd) {
   const outputDir = getAgentOutputsDir(cwd);
   const projectRoot = getProjectRoot(cwd);
-  const configPath = join34(projectRoot, ".cleo", "config.json");
+  const configPath = join35(projectRoot, ".cleo", "config.json");
   const legacyFileName = ["MANIFEST", "jsonl"].join(".");
   let manifestFile = legacyFileName;
-  if (existsSync31(configPath)) {
+  if (existsSync32(configPath)) {
     try {
-      const config2 = JSON.parse(readFileSync10(configPath, "utf-8"));
+      const config2 = JSON.parse(readFileSync11(configPath, "utf-8"));
       const customFile = config2.agentOutputs?.manifestFile ?? config2.research?.manifestFile;
       if (customFile) {
         manifestFile = customFile;
@@ -46587,12 +47032,12 @@ function getManifestPath(cwd) {
     } catch {
     }
   }
-  return resolve13(projectRoot, outputDir, manifestFile);
+  return resolve15(projectRoot, outputDir, manifestFile);
 }
 function getManifestArchivePath(cwd) {
   const outputDir = getAgentOutputsDir(cwd);
   const projectRoot = getProjectRoot(cwd);
-  return resolve13(projectRoot, outputDir, "MANIFEST.archive.jsonl");
+  return resolve15(projectRoot, outputDir, "MANIFEST.archive.jsonl");
 }
 function isAbsolutePath2(path) {
   return _isAbsolutePath(path);
@@ -46616,24 +47061,24 @@ function getCanonicalTemplatesTildePath() {
   return _getCanonicalTemplatesTildePath();
 }
 function getAgentsHome() {
-  return process.env["AGENTS_HOME"] ?? join34(homedir2(), ".agents");
+  return process.env["AGENTS_HOME"] ?? join35(homedir2(), ".agents");
 }
 function getClaudeAgentsDir() {
-  const claudeDir = process.env["CLAUDE_HOME"] ?? join34(homedir2(), ".claude");
-  return join34(claudeDir, "agents");
+  const claudeDir = process.env["CLAUDE_HOME"] ?? join35(homedir2(), ".claude");
+  return join35(claudeDir, "agents");
 }
 function getClaudeMemDbPath() {
-  return process.env["CLAUDE_MEM_DB"] ?? join34(homedir2(), ".claude-mem", "claude-mem.db");
+  return process.env["CLAUDE_MEM_DB"] ?? join35(homedir2(), ".claude-mem", "claude-mem.db");
 }
 function resolveWorktreeRouting(cwdOverride) {
-  const cwd = resolve13(cwdOverride ?? process.cwd());
+  const cwd = resolve15(cwdOverride ?? process.cwd());
   const home = homedir2();
   let worktreePath;
   let current = cwd;
   while (current !== home && current !== "/" && current !== "") {
-    const gitPath = join34(current, ".git");
+    const gitPath = join35(current, ".git");
     try {
-      if (existsSync31(gitPath)) {
+      if (existsSync32(gitPath)) {
         const stat3 = statSync9(gitPath);
         if (stat3.isFile()) {
           worktreePath = current;
@@ -46645,7 +47090,7 @@ function resolveWorktreeRouting(cwdOverride) {
       }
     } catch {
     }
-    const parent = dirname17(current);
+    const parent = dirname19(current);
     if (parent === current) break;
     current = parent;
   }
@@ -46662,17 +47107,17 @@ function resolveWorktreeRouting(cwdOverride) {
 }
 function resolveWorktreeFilePath(filePath, routing) {
   if (!routing.isWorktree || routing.worktreePath === void 0) {
-    return resolve13(filePath);
+    return resolve15(filePath);
   }
-  return resolve13(routing.cwd, filePath);
+  return resolve15(routing.cwd, filePath);
 }
 function detectStrayCleoDb(routing) {
   if (!routing.isWorktree || routing.worktreePath === void 0) {
     return void 0;
   }
-  const tasksDbPath = join34(routing.worktreePath, ".cleo", "tasks.db");
+  const tasksDbPath = join35(routing.worktreePath, ".cleo", "tasks.db");
   try {
-    if (existsSync31(tasksDbPath) && statSync9(tasksDbPath).isFile()) {
+    if (existsSync32(tasksDbPath) && statSync9(tasksDbPath).isFile()) {
       return tasksDbPath;
     }
   } catch {
@@ -46682,7 +47127,7 @@ function detectStrayCleoDb(routing) {
 async function resolveProjectById(projectId) {
   try {
     const { getNexusDb: getNexusDb2, getNexusRegistryDbPath: getNexusRegistryDbPath2 } = await Promise.resolve().then(() => (init_nexus_sqlite(), nexus_sqlite_exports));
-    if (!existsSync31(getNexusRegistryDbPath2())) return null;
+    if (!existsSync32(getNexusRegistryDbPath2())) return null;
     const { eq: eq12 } = await import("drizzle-orm");
     const { projectRegistry: projectRegistry2 } = await Promise.resolve().then(() => (init_nexus_schema(), nexus_schema_exports));
     const db = await getNexusDb2();
@@ -46717,9 +47162,9 @@ function _rowToRegistryEntry(row) {
   };
 }
 function _readProjectNameFromInfo(projectRoot) {
-  const infoPath = join34(projectRoot, ".cleo", "project-info.json");
-  if (!existsSync31(infoPath)) return void 0;
-  const raw = readFileSync10(infoPath, "utf-8");
+  const infoPath = join35(projectRoot, ".cleo", "project-info.json");
+  if (!existsSync32(infoPath)) return void 0;
+  const raw = readFileSync11(infoPath, "utf-8");
   const data = JSON.parse(raw);
   return typeof data.name === "string" && data.name.length > 0 ? data.name : void 0;
 }
@@ -46770,7 +47215,7 @@ async function recordProjectEncounter(cwd) {
   if (!shouldAutoRegisterProject(project.projectRoot, cleoHome)) return "ephemeral";
   const checkout = captureProjectScope(project.projectRoot, worktreeScope.getStore()).worktreeRoot;
   const { getNexusRegistryDb: getNexusRegistryDb2, getNexusRegistryDbPath: getNexusRegistryDbPath2 } = await Promise.resolve().then(() => (init_nexus_sqlite(), nexus_sqlite_exports));
-  if (existsSync31(getNexusRegistryDbPath2(cleoHome))) {
+  if (existsSync32(getNexusRegistryDbPath2(cleoHome))) {
     const { and: and8, eq: eq12 } = await import("drizzle-orm");
     const { projectLocations: projectLocations2, projectRegistry: projectRegistry2 } = await Promise.resolve().then(() => (init_nexus_schema(), nexus_schema_exports));
     const { currentDeviceId: currentDeviceId2 } = await Promise.resolve().then(() => (init_path_map(), path_map_exports));
@@ -46947,42 +47392,42 @@ var init_paths = __esm({
 // packages/core/src/store/file-utils.ts
 import { randomBytes as randomBytes3 } from "node:crypto";
 import {
-  existsSync as existsSync32,
+  existsSync as existsSync33,
   mkdirSync as mkdirSync10,
   readdirSync as readdirSync8,
-  readFileSync as readFileSync11,
+  readFileSync as readFileSync12,
   renameSync as renameSync11,
   unlinkSync as unlinkSync6,
   writeFileSync as writeFileSync10
 } from "node:fs";
-import { basename as basename11, dirname as dirname18, join as join35 } from "node:path";
+import { basename as basename11, dirname as dirname20, join as join36 } from "node:path";
 import * as lockfile3 from "proper-lockfile";
 function rotateBackup(filePath, mode) {
-  const dir = dirname18(filePath);
+  const dir = dirname20(filePath);
   const name15 = basename11(filePath);
-  const backupDir = join35(dir, ".backups");
+  const backupDir = join36(dir, ".backups");
   const dirMode = typeof mode === "number" ? modeToDirMode(mode) : void 0;
-  if (!existsSync32(backupDir)) {
+  if (!existsSync33(backupDir)) {
     mkdirSync10(backupDir, { recursive: true, mode: dirMode });
   }
   for (let i = MAX_BACKUPS; i >= 1; i--) {
-    const current = join35(backupDir, `${name15}.${i}`);
+    const current = join36(backupDir, `${name15}.${i}`);
     if (i === MAX_BACKUPS) {
       try {
         unlinkSync6(current);
       } catch {
       }
     } else {
-      const next = join35(backupDir, `${name15}.${i + 1}`);
+      const next = join36(backupDir, `${name15}.${i + 1}`);
       try {
-        if (existsSync32(current)) renameSync11(current, next);
+        if (existsSync33(current)) renameSync11(current, next);
       } catch {
       }
     }
   }
   try {
-    const content = readFileSync11(filePath, "utf-8");
-    const backupPath = join35(backupDir, `${name15}.1`);
+    const content = readFileSync12(filePath, "utf-8");
+    const backupPath = join36(backupDir, `${name15}.1`);
     if (typeof mode === "number") {
       writeFileSync10(backupPath, content, { encoding: "utf-8", mode });
     } else {
@@ -47002,8 +47447,8 @@ function writeJsonFileAtomic(filePath, data, optsOrIndent = 2) {
   const opts = typeof optsOrIndent === "number" ? { indent: optsOrIndent } : optsOrIndent;
   const indent = opts.indent ?? 2;
   const mode = opts.mode;
-  const dir = dirname18(filePath);
-  const tempPath = join35(dir, `.${basename11(filePath)}.${randomBytes3(6).toString("hex")}.tmp`);
+  const dir = dirname20(filePath);
+  const tempPath = join36(dir, `.${basename11(filePath)}.${randomBytes3(6).toString("hex")}.tmp`);
   const content = JSON.stringify(data, null, indent) + "\n";
   if (typeof mode === "number") {
     writeFileSync10(tempPath, content, { encoding: "utf-8", mode });
@@ -47011,7 +47456,7 @@ function writeJsonFileAtomic(filePath, data, optsOrIndent = 2) {
     writeFileSync10(tempPath, content, "utf-8");
   }
   try {
-    if (existsSync32(filePath)) {
+    if (existsSync33(filePath)) {
       rotateBackup(filePath, mode);
     }
     renameSync11(tempPath, filePath);
@@ -47025,7 +47470,7 @@ function writeJsonFileAtomic(filePath, data, optsOrIndent = 2) {
 }
 function readJsonFile(filePath) {
   try {
-    const content = readFileSync11(filePath, "utf-8");
+    const content = readFileSync12(filePath, "utf-8");
     return JSON.parse(content);
   } catch (error48) {
     if (error48.code === "ENOENT") {
@@ -47035,12 +47480,12 @@ function readJsonFile(filePath) {
   }
 }
 async function withLock2(filePath, transform2, opts = {}) {
-  const dir = dirname18(filePath);
+  const dir = dirname20(filePath);
   const dirMode = typeof opts.mode === "number" ? modeToDirMode(opts.mode) : void 0;
-  if (!existsSync32(dir)) {
+  if (!existsSync33(dir)) {
     mkdirSync10(dir, { recursive: true, mode: dirMode });
   }
-  if (!existsSync32(filePath)) {
+  if (!existsSync33(filePath)) {
     if (typeof opts.mode === "number") {
       writeFileSync10(filePath, "", { encoding: "utf-8", mode: opts.mode });
     } else {
@@ -47061,11 +47506,11 @@ async function withLock2(filePath, transform2, opts = {}) {
   }
 }
 async function withFileLock(filePath, operation) {
-  const dir = dirname18(filePath);
-  if (!existsSync32(dir)) {
+  const dir = dirname20(filePath);
+  if (!existsSync33(dir)) {
     mkdirSync10(dir, { recursive: true });
   }
-  if (!existsSync32(filePath)) {
+  if (!existsSync33(filePath)) {
     writeFileSync10(filePath, "", "utf-8");
   }
   let release;
@@ -47099,10 +47544,10 @@ var init_file_utils = __esm({
 
 // packages/core/src/llm/credential-removal.ts
 import { unlinkSync as unlinkSync7 } from "node:fs";
-import { join as join36 } from "node:path";
+import { join as join37 } from "node:path";
 import { getCleoHome as getCleoHome4 } from "@cleocode/paths";
 function suppressionStatePath() {
-  return join36(getCleoHome4(), SUPPRESSION_FILENAME);
+  return join37(getCleoHome4(), SUPPRESSION_FILENAME);
 }
 function readSuppressionFile() {
   const data = readJsonFile(suppressionStatePath());
@@ -47206,7 +47651,7 @@ var init_credential_removal = __esm({
       sourceId: "cleo-pkce",
       description: "Delete CLEO-issued PKCE token at <CLEO_HOME>/anthropic-oauth.json",
       async remove() {
-        const path = join36(getCleoHome4(), "anthropic-oauth.json");
+        const path = join37(getCleoHome4(), "anthropic-oauth.json");
         const cleaned = [];
         try {
           unlinkSync7(path);
@@ -47264,12 +47709,12 @@ var init_credential_removal = __esm({
 });
 
 // packages/core/src/llm/credential-seeders/claude-code-seeder.ts
-import { readFileSync as readFileSync12 } from "node:fs";
+import { readFileSync as readFileSync13 } from "node:fs";
 import { homedir as homedir3 } from "node:os";
-import { join as join37 } from "node:path";
+import { join as join38 } from "node:path";
 function defaultReadCredentialFile() {
   try {
-    return readFileSync12(join37(homedir3(), ".claude", ".credentials.json"), "utf-8");
+    return readFileSync13(join38(homedir3(), ".claude", ".credentials.json"), "utf-8");
   } catch {
     return null;
   }
@@ -47363,14 +47808,14 @@ var init_claude_code_seeder = __esm({
 });
 
 // packages/core/src/llm/credential-seeders/cleo-pkce-seeder.ts
-import { readFileSync as readFileSync13 } from "node:fs";
-import { join as join38 } from "node:path";
+import { readFileSync as readFileSync14 } from "node:fs";
+import { join as join39 } from "node:path";
 function defaultCleoPkcePath() {
-  return join38(getCleoHome(), "anthropic-oauth.json");
+  return join39(getCleoHome(), "anthropic-oauth.json");
 }
 function defaultReadCredentialFile2() {
   try {
-    return readFileSync13(defaultCleoPkcePath(), "utf-8");
+    return readFileSync14(defaultCleoPkcePath(), "utf-8");
   } catch {
     return null;
   }
@@ -47437,13 +47882,13 @@ var init_cleo_pkce_seeder = __esm({
 });
 
 // packages/core/src/llm/credential-seeders/codex-cli-seeder.ts
-import { existsSync as existsSync33, readFileSync as readFileSync14 } from "node:fs";
+import { existsSync as existsSync34, readFileSync as readFileSync15 } from "node:fs";
 import { homedir as homedir4 } from "node:os";
-import { join as join39 } from "node:path";
+import { join as join40 } from "node:path";
 function getCodexAuthPath() {
   const codexHome = (process.env["CODEX_HOME"] ?? "").trim();
-  const root = codexHome || join39(homedir4(), ".codex");
-  return join39(root, "auth.json");
+  const root = codexHome || join40(homedir4(), ".codex");
+  return join40(root, "auth.json");
 }
 var CodexCliSeeder, codexCliSeeder;
 var init_codex_cli_seeder = __esm({
@@ -47462,12 +47907,12 @@ var init_codex_cli_seeder = __esm({
        */
       async seed() {
         const authPath = getCodexAuthPath();
-        if (!existsSync33(authPath)) {
+        if (!existsSync34(authPath)) {
           return { entries: [] };
         }
         let raw;
         try {
-          raw = readFileSync14(authPath, "utf-8");
+          raw = readFileSync15(authPath, "utf-8");
         } catch (err) {
           return {
             entries: [],
@@ -47657,11 +48102,11 @@ var init_google_pkce = __esm({
 });
 
 // packages/core/src/llm/credential-seeders/gemini-cli-seeder.ts
-import { existsSync as existsSync34, readFileSync as readFileSync15 } from "node:fs";
-import { join as join40 } from "node:path";
+import { existsSync as existsSync35, readFileSync as readFileSync16 } from "node:fs";
+import { join as join41 } from "node:path";
 import { getCleoHome as getCleoHome5 } from "@cleocode/paths";
 function getGoogleOauthPath() {
-  return join40(getCleoHome5(), "google_oauth.json");
+  return join41(getCleoHome5(), "google_oauth.json");
 }
 function parseGoogleOauthFile(raw) {
   let json2;
@@ -47706,12 +48151,12 @@ var init_gemini_cli_seeder = __esm({
        */
       async seed() {
         const path = getGoogleOauthPath();
-        if (!existsSync34(path)) {
+        if (!existsSync35(path)) {
           return { entries: [] };
         }
         let raw;
         try {
-          raw = readFileSync15(path, "utf-8");
+          raw = readFileSync16(path, "utf-8");
         } catch (err) {
           return {
             entries: [],
@@ -47931,23 +48376,23 @@ var init_credential_seeders = __esm({
 
 // packages/core/src/llm/global-config-migration.ts
 import {
-  existsSync as existsSync35,
+  existsSync as existsSync36,
   mkdirSync as mkdirSync11,
-  readFileSync as readFileSync16,
+  readFileSync as readFileSync17,
   renameSync as renameSync12,
   unlinkSync as unlinkSync8,
   writeFileSync as writeFileSync11
 } from "node:fs";
-import { join as join41 } from "node:path";
+import { join as join42 } from "node:path";
 import { getCleoHome as getCleoHome6, getCleoPlatformPaths as getCleoPlatformPaths2 } from "@cleocode/paths";
 function configDirGlobalConfigPath() {
-  return join41(getCleoPlatformPaths2().config, GLOBAL_CONFIG_FILENAME);
+  return join42(getCleoPlatformPaths2().config, GLOBAL_CONFIG_FILENAME);
 }
 function legacyGlobalConfigPath() {
-  return join41(getCleoHome6(), GLOBAL_CONFIG_FILENAME);
+  return join42(getCleoHome6(), GLOBAL_CONFIG_FILENAME);
 }
 function migrationMarkerPath() {
-  return join41(getCleoHome6(), MIGRATIONS_SUBDIR, MIGRATION_MARKER);
+  return join42(getCleoHome6(), MIGRATIONS_SUBDIR, MIGRATION_MARKER);
 }
 function tempTargetPath() {
   return `${configDirGlobalConfigPath()}.tmp`;
@@ -47957,17 +48402,17 @@ function migrateGlobalConfigToConfigDir() {
     const source = legacyGlobalConfigPath();
     const target = configDirGlobalConfigPath();
     const marker16 = migrationMarkerPath();
-    if (existsSync35(marker16)) return false;
-    if (!existsSync35(source)) {
+    if (existsSync36(marker16)) return false;
+    if (!existsSync36(source)) {
       stampMarker(marker16);
       return false;
     }
-    if (existsSync35(target)) {
+    if (existsSync36(target)) {
       backupSourceQuiet(source);
       stampMarker(marker16);
       return false;
     }
-    const raw = readFileSync16(source, "utf-8");
+    const raw = readFileSync17(source, "utf-8");
     try {
       JSON.parse(raw);
     } catch (err) {
@@ -47995,7 +48440,7 @@ function migrateGlobalConfigToConfigDir() {
   } catch (err) {
     try {
       const temp = tempTargetPath();
-      if (existsSync35(temp)) unlinkSync8(temp);
+      if (existsSync36(temp)) unlinkSync8(temp);
     } catch {
     }
     console.error(
@@ -48006,7 +48451,7 @@ function migrateGlobalConfigToConfigDir() {
 }
 function stampMarker(markerPath) {
   try {
-    mkdirSync11(join41(getCleoHome6(), MIGRATIONS_SUBDIR), { recursive: true });
+    mkdirSync11(join42(getCleoHome6(), MIGRATIONS_SUBDIR), { recursive: true });
     writeFileSync11(markerPath, `${(/* @__PURE__ */ new Date()).toISOString()}
 `, { mode: 420 });
   } catch {
@@ -48015,7 +48460,7 @@ function stampMarker(markerPath) {
 function backupSourceQuiet(source) {
   try {
     const backup = `${source}${BACKUP_SUFFIX}`;
-    if (existsSync35(backup)) return;
+    if (existsSync36(backup)) return;
     renameSync12(source, backup);
   } catch {
   }
@@ -48038,15 +48483,15 @@ var init_global_config_migration = __esm({
 });
 
 // packages/core/src/llm/legacy-flat-key-import.ts
-import { existsSync as existsSync36, readFileSync as readFileSync17, renameSync as renameSync13, writeFileSync as writeFileSync12 } from "node:fs";
-import { join as join42 } from "node:path";
+import { existsSync as existsSync37, readFileSync as readFileSync18, renameSync as renameSync13, writeFileSync as writeFileSync12 } from "node:fs";
+import { join as join43 } from "node:path";
 import { getCleoHome as getCleoHome7 } from "@cleocode/paths";
 function migrationPaths() {
   const home = getCleoHome7();
   return {
-    flatPath: join42(home, "anthropic-key"),
-    bakPath: join42(home, `anthropic-key${LEGACY_FLAT_KEY_BAK_SUFFIX}`),
-    markerPath: join42(home, LEGACY_FLAT_KEY_MARKER)
+    flatPath: join43(home, "anthropic-key"),
+    bakPath: join43(home, `anthropic-key${LEGACY_FLAT_KEY_BAK_SUFFIX}`),
+    markerPath: join43(home, LEGACY_FLAT_KEY_MARKER)
   };
 }
 function writeMarker(markerPath) {
@@ -48067,8 +48512,8 @@ function writeMarker(markerPath) {
 }
 function readFlatKey(flatPath) {
   try {
-    if (!existsSync36(flatPath)) return null;
-    const raw = readFileSync17(flatPath, "utf-8").trim();
+    if (!existsSync37(flatPath)) return null;
+    const raw = readFileSync18(flatPath, "utf-8").trim();
     return raw || null;
   } catch (err) {
     logger.warn(
@@ -48080,7 +48525,7 @@ function readFlatKey(flatPath) {
 }
 async function importLegacyFlatAnthropicKey() {
   const { flatPath, bakPath, markerPath } = migrationPaths();
-  if (existsSync36(markerPath)) {
+  if (existsSync37(markerPath)) {
     return { status: "marker-present", flatPath, bakPath: null, markerPath };
   }
   let existing = null;
@@ -48097,7 +48542,7 @@ async function importLegacyFlatAnthropicKey() {
     writeMarker(markerPath);
     return { status: "already-imported", flatPath, bakPath: null, markerPath };
   }
-  if (!existsSync36(flatPath)) {
+  if (!existsSync37(flatPath)) {
     writeMarker(markerPath);
     return { status: "no-flat-file", flatPath, bakPath: null, markerPath };
   }
@@ -48174,15 +48619,15 @@ __export(credentials_exports, {
   resolveProviderStatus: () => resolveProviderStatus,
   storeAnthropicApiKey: () => storeAnthropicApiKey
 });
-import { existsSync as existsSync37, mkdirSync as mkdirSync12, readFileSync as readFileSync18, writeFileSync as writeFileSync13 } from "node:fs";
-import { join as join43 } from "node:path";
+import { existsSync as existsSync38, mkdirSync as mkdirSync12, readFileSync as readFileSync19, writeFileSync as writeFileSync13 } from "node:fs";
+import { join as join44 } from "node:path";
 import { getCleoHome as getCleoHome8 } from "@cleocode/paths";
 function globalConfigPath() {
   return configDirGlobalConfigPath();
 }
 function projectConfigPath(projectRoot) {
   const cleoDir = process.env["CLEO_DIR"] ?? ".cleo";
-  return join43(projectRoot, cleoDir, "config.json");
+  return join44(projectRoot, cleoDir, "config.json");
 }
 function readGlobalProviderKey(provider) {
   ensureGlobalConfigMigrated();
@@ -48192,9 +48637,9 @@ function readGlobalProviderKey(provider) {
 }
 function readFlatAnthropicKey() {
   try {
-    const keyFile = join43(getCleoHome8(), "anthropic-key");
-    if (!existsSync37(keyFile)) return null;
-    const stored = readFileSync18(keyFile, "utf-8").trim();
+    const keyFile = join44(getCleoHome8(), "anthropic-key");
+    if (!existsSync38(keyFile)) return null;
+    const stored = readFileSync19(keyFile, "utf-8").trim();
     return stored || null;
   } catch {
     return null;
@@ -48202,8 +48647,8 @@ function readFlatAnthropicKey() {
 }
 function readProviderKeyFromConfig(configFile, provider) {
   try {
-    if (!existsSync37(configFile)) return null;
-    const raw = readFileSync18(configFile, "utf-8");
+    if (!existsSync38(configFile)) return null;
+    const raw = readFileSync19(configFile, "utf-8");
     const config2 = JSON.parse(raw);
     const llm = config2["llm"];
     if (!llm || typeof llm !== "object") return null;
@@ -48375,10 +48820,10 @@ function resolveProviderStatus(provider) {
 }
 function storeAnthropicApiKey(apiKey) {
   const dir = getCleoHome8();
-  if (!existsSync37(dir)) {
+  if (!existsSync38(dir)) {
     mkdirSync12(dir, { recursive: true });
   }
-  const keyFile = join43(dir, "anthropic-key");
+  const keyFile = join44(dir, "anthropic-key");
   writeFileSync13(keyFile, apiKey.trim(), { mode: 384 });
 }
 function clearAnthropicKeyCache() {
@@ -48443,16 +48888,16 @@ __export(credentials_store_exports, {
   pickCredentialForProviderSync: () => pickCredentialForProviderSync,
   removeCredential: () => removeCredential
 });
-import { chmodSync as chmodSync2, existsSync as existsSync38, mkdirSync as mkdirSync13, readFileSync as readFileSync19, statSync as statSync10, writeFileSync as writeFileSync14 } from "node:fs";
-import { dirname as dirname19, join as join44 } from "node:path";
+import { chmodSync as chmodSync2, existsSync as existsSync39, mkdirSync as mkdirSync13, readFileSync as readFileSync20, statSync as statSync10, writeFileSync as writeFileSync14 } from "node:fs";
+import { dirname as dirname21, join as join45 } from "node:path";
 import { getCleoHome as getCleoHome9 } from "@cleocode/paths";
 function credentialsStorePath() {
-  return join44(getCleoHome9(), "llm-credentials.json");
+  return join45(getCleoHome9(), "llm-credentials.json");
 }
 function ensureFileInitialized(path) {
-  if (existsSync38(path)) return;
-  const dir = dirname19(path);
-  if (!existsSync38(dir)) {
+  if (existsSync39(path)) return;
+  const dir = dirname21(path);
+  if (!existsSync39(dir)) {
     mkdirSync13(dir, { recursive: true, mode: 448 });
   } else {
     try {
@@ -48496,7 +48941,7 @@ function readStoreSync() {
   const path = credentialsStorePath();
   let raw;
   try {
-    raw = readFileSync19(path, "utf-8");
+    raw = readFileSync20(path, "utf-8");
   } catch {
     return emptyStore();
   }
@@ -49085,13 +49530,13 @@ var init_xai = __esm({
 
 // packages/core/src/llm/provider-registry/loader.ts
 import { readdirSync as readdirSync9, statSync as statSync11 } from "node:fs";
-import { join as join45 } from "node:path";
+import { join as join46 } from "node:path";
 import { pathToFileURL } from "node:url";
 function isPluginFile(filename) {
   return PLUGIN_EXTENSIONS.some((ext) => filename.endsWith(ext));
 }
 function getPluginDir() {
-  return join45(getCleoHome(), "plugins", "model-providers");
+  return join46(getCleoHome(), "plugins", "model-providers");
 }
 async function loadOnePlugin(absPath, api) {
   let mod;
@@ -49139,13 +49584,13 @@ async function scanAndLoadPlugins(pluginDir, api) {
   }
   const pluginFiles = entries.filter((name15) => !name15.startsWith(".") && isPluginFile(name15)).filter((name15) => {
     try {
-      return statSync11(join45(pluginDir, name15)).isFile();
+      return statSync11(join46(pluginDir, name15)).isFile();
     } catch {
       return false;
     }
   }).sort();
   for (const filename of pluginFiles) {
-    await loadOnePlugin(join45(pluginDir, filename), api);
+    await loadOnePlugin(join46(pluginDir, filename), api);
   }
 }
 async function runDiscovery(registerProvider2, builtins) {
@@ -49248,15 +49693,15 @@ var init_provider_registry = __esm({
 });
 
 // packages/core/src/llm/rate-limit-guard.ts
-import { existsSync as existsSync39, mkdirSync as mkdirSync14, unlinkSync as unlinkSync9 } from "node:fs";
-import { join as join46 } from "node:path";
+import { existsSync as existsSync40, mkdirSync as mkdirSync14, unlinkSync as unlinkSync9 } from "node:fs";
+import { join as join47 } from "node:path";
 import { getCleoHome as getCleoHome10 } from "@cleocode/paths";
 function sanitize(value) {
   return value.replace(/[^a-zA-Z0-9_-]/g, "_");
 }
 function rateLimitStatePath(provider, label) {
-  const dir = join46(getCleoHome10(), "rate-limit-state");
-  return join46(dir, `${sanitize(provider)}-${sanitize(label)}.json`);
+  const dir = join47(getCleoHome10(), "rate-limit-state");
+  return join47(dir, `${sanitize(provider)}-${sanitize(label)}.json`);
 }
 function parseResetFromHeaders(headers) {
   const get = (k) => {
@@ -49303,8 +49748,8 @@ async function recordRateLimit(provider, label, opts) {
     source = "default";
   }
   const filePath = rateLimitStatePath(provider, label);
-  const dir = join46(getCleoHome10(), "rate-limit-state");
-  if (!existsSync39(dir)) {
+  const dir = join47(getCleoHome10(), "rate-limit-state");
+  if (!existsSync40(dir)) {
     mkdirSync14(dir, { recursive: true });
   }
   const state = { resetAt, recordedAt: now, source };
@@ -50205,31 +50650,31 @@ var init_error_classifier = __esm({
 
 // packages/core/src/llm/catalog-cache.ts
 import {
-  existsSync as existsSync40,
+  existsSync as existsSync41,
   mkdirSync as mkdirSync15,
   readdirSync as readdirSync10,
-  readFileSync as readFileSync20,
+  readFileSync as readFileSync21,
   statSync as statSync12,
   symlinkSync,
   unlinkSync as unlinkSync10,
   writeFileSync as writeFileSync15
 } from "node:fs";
-import { join as join47 } from "node:path";
+import { join as join48 } from "node:path";
 import { getCleoHome as getCleoHome11 } from "@cleocode/paths";
 function getCatalogDir() {
   if (process.env["CLEO_DATA_DIR"]) {
-    return join47(process.env["CLEO_DATA_DIR"], "llm-catalog");
+    return join48(process.env["CLEO_DATA_DIR"], "llm-catalog");
   }
-  return join47(getCleoHome11(), "llm-catalog");
+  return join48(getCleoHome11(), "llm-catalog");
 }
 function findLatestCacheFile(dir) {
-  if (!existsSync40(dir)) return null;
-  const files = readdirSync10(dir).filter((f) => f.endsWith("-models.json")).map((f) => ({ name: f, mtime: statSync12(join47(dir, f)).mtimeMs })).sort((a, b) => b.mtime - a.mtime);
-  return files.length > 0 ? join47(dir, files[0].name) : null;
+  if (!existsSync41(dir)) return null;
+  const files = readdirSync10(dir).filter((f) => f.endsWith("-models.json")).map((f) => ({ name: f, mtime: statSync12(join48(dir, f)).mtimeMs })).sort((a, b) => b.mtime - a.mtime);
+  return files.length > 0 ? join48(dir, files[0].name) : null;
 }
 function readCacheFile(filePath) {
   try {
-    const raw = readFileSync20(filePath, "utf-8");
+    const raw = readFileSync21(filePath, "utf-8");
     return JSON.parse(raw);
   } catch {
     return null;
@@ -50242,16 +50687,16 @@ var init_catalog_cache = __esm({
 });
 
 // packages/core/src/llm/model-metadata.ts
-import { readFileSync as readFileSync21 } from "node:fs";
-import { dirname as dirname20, join as join48 } from "node:path";
-import { fileURLToPath as fileURLToPath3 } from "node:url";
+import { readFileSync as readFileSync22 } from "node:fs";
+import { dirname as dirname22, join as join49 } from "node:path";
+import { fileURLToPath as fileURLToPath4 } from "node:url";
 function getCuratedTable() {
   if (_curated !== void 0) {
     return _curated;
   }
-  const thisDir = dirname20(fileURLToPath3(import.meta.url));
-  const jsonPath = join48(thisDir, "curated-models.json");
-  const raw = JSON.parse(readFileSync21(jsonPath, "utf-8"));
+  const thisDir = dirname22(fileURLToPath4(import.meta.url));
+  const jsonPath = join49(thisDir, "curated-models.json");
+  const raw = JSON.parse(readFileSync22(jsonPath, "utf-8"));
   _curated = raw.models;
   return _curated;
 }
@@ -50336,7 +50781,7 @@ function storedToResolved(stored) {
   };
 }
 function sleep3(ms) {
-  return new Promise((resolve15) => setTimeout(resolve15, ms));
+  return new Promise((resolve17) => setTimeout(resolve17, ms));
 }
 function backoffMs(policy, attempt) {
   const base = policy.baseDelayMs * 2 ** attempt;
@@ -54278,7 +54723,7 @@ function normalizeOllamaToolCall(tc) {
   };
 }
 function sleep4(ms) {
-  return new Promise((resolve15) => setTimeout(resolve15, ms));
+  return new Promise((resolve17) => setTimeout(resolve17, ms));
 }
 var OLLAMA_DEFAULT_BASE_URL, MAX_RETRIES, INITIAL_BACKOFF_MS, RETRYABLE_STATUS_CODES, OllamaTransport;
 var init_ollama2 = __esm({
@@ -74792,7 +75237,7 @@ function createProviderToolFactoryWithOutputSchema({
     supportsDeferredResults
   });
 }
-async function resolve14(value) {
+async function resolve16(value) {
   if (typeof value === "function") {
     value = value();
   }
@@ -78826,14 +79271,14 @@ var init_dist4 = __esm({
         headers
       }) {
         return combineHeaders(
-          await resolve14(this.config.headers),
+          await resolve16(this.config.headers),
           headers,
           betas.size > 0 ? { "anthropic-beta": Array.from(betas).join(",") } : {}
         );
       }
       async getBetasFromHeaders(requestHeaders) {
         var _a17, _b16;
-        const configHeaders = await resolve14(this.config.headers);
+        const configHeaders = await resolve16(this.config.headers);
         const configBetaHeader = (_a17 = configHeaders["anthropic-beta"]) != null ? _a17 : "";
         const requestBetaHeader = (_b16 = requestHeaders == null ? void 0 : requestHeaders["anthropic-beta"]) != null ? _b16 : "";
         return new Set(