@cleocode/core 2026.9.25 → 2026.10.1

package/dist/docs/export-document.js

@@ -1850,7 +1850,7 @@ var init_output_contracts_data = __esm({
               // T12503: the optimistic-concurrency version agents pass to --if-match.
               updatedAt: {
                 type: ["string", "null"],
-                description: "Task version for optimistic concurrency: pass it to `cleo update|complete --if-match`."
+                description: "Task version for optimistic concurrency: pass it to `cleo update|complete --if-match`. A stale version fails with E_CONFLICT (23); E_TASK_RENAMED (26) when sync re-numbered the task you read (details.expected is its new id)."
               },
               // T12502: the human assignee and the agent claim lease are separate.
               assignee: {
@@ -13111,6 +13111,7 @@ var init_exit_codes = __esm({
       ExitCode2[ExitCode2["VERSION_CONFLICT"] = 23] = "VERSION_CONFLICT";
       ExitCode2[ExitCode2["SESSION_UNBOUND"] = 24] = "SESSION_UNBOUND";
       ExitCode2[ExitCode2["WORKTREE_LOCKED"] = 25] = "WORKTREE_LOCKED";
+      ExitCode2[ExitCode2["TASK_RENAMED"] = 26] = "TASK_RENAMED";
       ExitCode2[ExitCode2["SESSION_EXISTS"] = 30] = "SESSION_EXISTS";
       ExitCode2[ExitCode2["SESSION_NOT_FOUND"] = 31] = "SESSION_NOT_FOUND";
       ExitCode2[ExitCode2["SCOPE_CONFLICT"] = 32] = "SCOPE_CONFLICT";
@@ -17365,6 +17366,210 @@ var init_nexus_account = __esm({
   }
 });
 
+// packages/contracts/src/nexus-cloud.ts
+import { z as z26 } from "zod";
+var NEXUS_DEVICE_STATES, NEXUS_CLOUD_PROFILES, NEXUS_DEVICE_STATE_UNKNOWN, isoTime, profile, deviceState, nexusCloudCredentialSchema, nexusCloudDeviceSchema, nexusCloudOrganizationSchema, nexusCloudUserSchema, nexusCloudWhoamiSchema, nexusCloudDevicePageSchema, nexusCloudPresenceSchema, nexusCloudReplicaSchema, nexusCloudDeviceCountsSchema, projectFields, nexusCloudProjectListItemSchema, nexusCloudProjectPageSchema, nexusCloudProjectDetailSchema, nexusCloudReplicaPageSchema, NEXUS_STATUS_CHECK_IDS, NEXUS_STATUS_VERDICTS, CLOUD_STATUS_VERDICTS, knownCheckId, nexusCloudStatusCheckSchema, nexusCloudStatusSchema;
+var init_nexus_cloud = __esm({
+  "packages/contracts/src/nexus-cloud.ts"() {
+    "use strict";
+    NEXUS_DEVICE_STATES = ["active", "signed-out", "revoked"];
+    NEXUS_CLOUD_PROFILES = ["device", "read-only"];
+    NEXUS_DEVICE_STATE_UNKNOWN = "unknown";
+    isoTime = z26.iso.datetime({ offset: true });
+    profile = z26.enum(NEXUS_CLOUD_PROFILES).nullable().catch(null);
+    deviceState = z26.enum([...NEXUS_DEVICE_STATES, NEXUS_DEVICE_STATE_UNKNOWN]).catch(NEXUS_DEVICE_STATE_UNKNOWN);
+    nexusCloudCredentialSchema = z26.object({
+      kind: z26.enum(["device", "session"]),
+      credentialId: z26.string().nullable().optional(),
+      profile: profile.optional(),
+      scopes: z26.array(z26.string()).default([]),
+      createdAt: isoTime.nullable().optional(),
+      lastUsedAt: isoTime.nullable().optional(),
+      /** When the credential expires if it is not used again; null for sessions. */
+      idleExpiresAt: isoTime.nullable().optional()
+    });
+    nexusCloudDeviceSchema = z26.object({
+      deviceId: z26.string(),
+      name: z26.string(),
+      platform: z26.string().optional(),
+      arch: z26.string().nullable().optional(),
+      cliVersion: z26.string().nullable().optional(),
+      createdAt: isoTime.optional(),
+      lastSeenAt: isoTime.nullable().optional(),
+      state: deviceState,
+      signedOutAt: isoTime.nullable().optional(),
+      /** Base64 device certificate; null until the device holds a key grant. */
+      certificate: z26.string().nullable().optional(),
+      /** The current credential's profile, or null with none (signed out or revoked). */
+      profile: profile.optional(),
+      /** True for the device whose credential made this request. */
+      current: z26.boolean().default(false),
+      projects: z26.number().int().nonnegative().optional(),
+      replicas: z26.number().int().nonnegative().optional(),
+      lastSyncAt: isoTime.nullable().optional(),
+      lastPresenceAt: isoTime.nullable().optional()
+    });
+    nexusCloudOrganizationSchema = z26.object({
+      id: z26.string(),
+      name: z26.string(),
+      slug: z26.string().nullable().optional(),
+      role: z26.string().optional(),
+      personal: z26.boolean().optional()
+    });
+    nexusCloudUserSchema = z26.object({
+      id: z26.string(),
+      email: z26.string(),
+      name: z26.string().nullable().optional()
+    });
+    nexusCloudWhoamiSchema = z26.object({
+      serverTime: isoTime.optional(),
+      user: nexusCloudUserSchema,
+      organizations: z26.array(nexusCloudOrganizationSchema).default([]),
+      credential: nexusCloudCredentialSchema,
+      /** The calling device; null for a session caller. */
+      device: nexusCloudDeviceSchema.nullable()
+    });
+    nexusCloudDevicePageSchema = z26.object({
+      devices: z26.array(nexusCloudDeviceSchema),
+      nextCursor: z26.string().max(512).nullable().default(null),
+      truncated: z26.boolean().default(false)
+    });
+    nexusCloudPresenceSchema = z26.looseObject({
+      observedAt: isoTime.optional(),
+      sync: z26.object({ enabled: z26.boolean() }).optional()
+    });
+    nexusCloudReplicaSchema = z26.object({
+      projectId: z26.string(),
+      replicaId: z26.string(),
+      deviceId: z26.string(),
+      deviceName: z26.string(),
+      deviceState: deviceState.optional(),
+      attachedAt: isoTime.optional(),
+      lastSyncAt: isoTime.nullable(),
+      presence: nexusCloudPresenceSchema.nullable(),
+      presenceAt: isoTime.nullable()
+    });
+    nexusCloudDeviceCountsSchema = z26.object({
+      active: z26.number().int().nonnegative(),
+      total: z26.number().int().nonnegative()
+    });
+    projectFields = {
+      projectId: z26.string(),
+      label: z26.string().nullable(),
+      organizationId: z26.string(),
+      organizationName: z26.string().optional(),
+      remoteUrl: z26.string().nullable().optional(),
+      createdAt: isoTime.optional()
+    };
+    nexusCloudProjectListItemSchema = z26.object({
+      ...projectFields,
+      role: z26.string(),
+      streamId: z26.string().optional(),
+      headSeq: z26.number().int().nonnegative().nullable().optional(),
+      openConflicts: z26.number().int().nonnegative().optional(),
+      replicas: z26.array(nexusCloudReplicaSchema).default([]),
+      devices: nexusCloudDeviceCountsSchema.optional(),
+      replicaCount: z26.number().int().nonnegative().optional(),
+      lastSyncAt: isoTime.nullable().optional(),
+      lastPresenceAt: isoTime.nullable().optional(),
+      /** This project's replica list was cut at 50 (T12858). */
+      replicasTruncated: z26.boolean().default(false)
+    });
+    nexusCloudProjectPageSchema = z26.object({
+      projects: z26.array(nexusCloudProjectListItemSchema),
+      nextCursor: z26.string().max(512).nullable().default(null),
+      /** Anything in the page was cut (the project list or a replica list). */
+      truncated: z26.boolean().default(false),
+      /** The project list itself was cut at 1000 (T12858). */
+      projectsTruncated: z26.boolean().default(false)
+    });
+    nexusCloudProjectDetailSchema = z26.object({
+      project: z26.object({ ...projectFields, deletedAt: isoTime.nullable().optional() }),
+      role: z26.string(),
+      canTrash: z26.boolean().optional(),
+      openConflicts: z26.number().int().nonnegative(),
+      /** At most 50, oldest attachment first. */
+      replicas: z26.array(nexusCloudReplicaSchema),
+      devices: nexusCloudDeviceCountsSchema,
+      replicaCount: z26.number().int().nonnegative().optional(),
+      lastSyncAt: isoTime.nullable().optional(),
+      /** `replicas` was cut at 50. */
+      truncated: z26.boolean().default(false),
+      stream: z26.object({
+        streamId: z26.string(),
+        headSeq: z26.number().int().nonnegative(),
+        headCheckpointId: z26.string().nullable()
+      }).nullable()
+    });
+    nexusCloudReplicaPageSchema = z26.object({
+      replicas: z26.array(nexusCloudReplicaSchema),
+      devices: nexusCloudDeviceCountsSchema.optional(),
+      nextCursor: z26.string().max(512).nullable().default(null),
+      truncated: z26.boolean().default(false)
+    });
+    NEXUS_STATUS_CHECK_IDS = [
+      "credential.valid",
+      "device.registered",
+      "device.active",
+      "device.certified",
+      "project.registered",
+      "project.writable",
+      "replica.attached",
+      "presence.fresh",
+      "replica.synced",
+      "conflicts.none"
+    ];
+    NEXUS_STATUS_VERDICTS = ["ok", "attention", "not-linked", "not-registered"];
+    CLOUD_STATUS_VERDICTS = [...NEXUS_STATUS_VERDICTS, "not-signed-in"];
+    knownCheckId = z26.enum(NEXUS_STATUS_CHECK_IDS);
+    nexusCloudStatusCheckSchema = z26.object({
+      id: z26.enum(NEXUS_STATUS_CHECK_IDS),
+      ok: z26.boolean(),
+      required: z26.boolean(),
+      detail: z26.string()
+    });
+    nexusCloudStatusSchema = z26.object({
+      serverTime: isoTime.optional(),
+      apiVersion: z26.string().optional(),
+      user: nexusCloudUserSchema,
+      credential: nexusCloudCredentialSchema,
+      device: nexusCloudDeviceSchema.nullable(),
+      project: z26.object({
+        projectId: z26.string(),
+        registered: z26.boolean(),
+        organizationId: z26.string().nullable(),
+        organizationName: z26.string().nullable(),
+        role: z26.string().nullable()
+      }).nullable(),
+      replica: z26.object({
+        replicaId: z26.string(),
+        attached: z26.boolean(),
+        attachedElsewhere: z26.boolean(),
+        attachedAt: isoTime.nullable(),
+        lastSyncAt: isoTime.nullable(),
+        presenceAt: isoTime.nullable(),
+        lastReplicaSeq: z26.number().int().nonnegative().nullable().optional()
+      }).nullable(),
+      stream: z26.object({
+        streamId: z26.string(),
+        headSeq: z26.number().int().nonnegative(),
+        headCheckpointId: z26.string().nullable(),
+        openConflicts: z26.number().int().nonnegative(),
+        devices: nexusCloudDeviceCountsSchema
+      }).nullable(),
+      /** Check ids added by a newer server are dropped, never a parse failure. */
+      checks: z26.array(nexusCloudStatusCheckSchema.extend({ id: z26.string() })).transform(
+        (list) => list.flatMap((c) => {
+          const id = knownCheckId.safeParse(c.id);
+          return id.success ? [{ ...c, id: id.data }] : [];
+        })
+      ),
+      /** A verdict added by a newer server reads as `attention`: never `ok` by accident. */
+      verdict: z26.enum(NEXUS_STATUS_VERDICTS).catch("attention")
+    });
+  }
+});
+
 // packages/contracts/src/task-id.ts
 var init_task_id = __esm({
   "packages/contracts/src/task-id.ts"() {
@@ -17449,6 +17654,7 @@ var init_src = __esm({
     init_decide();
     init_decide_sites();
     init_nexus_account();
+    init_nexus_cloud();
     init_task_id();
   }
 });
@@ -17771,6 +17977,19 @@ var init_error_catalog = __esm({
             `Bind a session: run 'cleo session start --scope global --name "<name>"', 'cleo session resume <id>', or set CLEO_SESSION_ID=<id>.`
           )
         ],
+        [
+          26 /* TASK_RENAMED */,
+          def(
+            26 /* TASK_RENAMED */,
+            "TASK_RENAMED",
+            "CONFLICT",
+            "Task was re-numbered by sync",
+            409,
+            true,
+            "E_TASK_RENAMED",
+            "The task you addressed now has another id (a display-id collision re-numbered it). Re-read it with 'cleo show <new id>' and retry against that id."
+          )
+        ],
         [
           25 /* WORKTREE_LOCKED */,
           def(
@@ -19718,10 +19937,10 @@ var init_table2 = __esm({
       [IsDrizzleTable] = true;
       /** @internal */
       [ExtraConfigBuilder] = void 0;
-      constructor(name2, schema, baseName) {
+      constructor(name2, schema, baseName2) {
         this[TableName] = this[OriginalName] = name2;
         this[TableSchema] = schema;
-        this[BaseName] = baseName;
+        this[BaseName] = baseName2;
       }
     };
   }
@@ -21651,9 +21870,9 @@ var init_casing = __esm({
 });
 
 // node_modules/.pnpm/drizzle-orm@1.0.0-rc.4_@opentelemetry+api@1.9.0_@sinclair+typebox@0.34.49_@types+mssql@_b4e81f2ea693a7363d3e5dc2205249c6/node_modules/drizzle-orm/sqlite-core/table.js
-function sqliteTableBase(name2, columns, extraConfig, schema, casing, baseName = name2) {
+function sqliteTableBase(name2, columns, extraConfig, schema, casing, baseName2 = name2) {
   const casingFn = getCasingFn(casing);
-  const rawTable = new SQLiteTable(name2, schema, baseName);
+  const rawTable = new SQLiteTable(name2, schema, baseName2);
   const parsedColumns = typeof columns === "function" ? columns(getSQLiteColumnBuilders()) : columns;
   const builtColumns = Object.fromEntries(Object.entries(parsedColumns).map(([name3, colBuilderBase]) => {
     const colBuilder = colBuilderBase;
@@ -25450,6 +25669,10 @@ function decisionFor(dbPath) {
   if (!decisions.has(key)) decisions.set(key, schemaWriteRefusal(key));
   return decisions.get(key) ?? null;
 }
+function schemaWritesAllowed(nativeDb) {
+  const dbPath = nativeDb.location();
+  return !dbPath || decisionFor(dbPath) === null;
+}
 function isWorktreeBuildSchemaError(error) {
   return error instanceof Error && error.message.includes(E_WORKTREE_BUILD_SCHEMA);
 }
@@ -26488,7 +26711,10 @@ var init_row_identity_registry = __esm({
           key: ["id"],
           birth: "recorded_at",
           content: ["ac_id", "previous_text", "reason"],
-          birthFacts: ["ac_id", "previous_text", "reason", "@refFp:ac_uid"],
+          // v2 (T12802): no @refFp: the criterion's fingerprint is unknowable when
+          // it was gone before this row got its identity, so it made the value
+          // depend on fill timing. ac_id is always known.
+          birthFacts: ["ac_id", "previous_text", "reason"],
           storedRefUids: [{ column: "ac_uid", from: "ac_id", table: ACS }],
           task: "T12341"
         },
@@ -26497,7 +26723,10 @@ var init_row_identity_registry = __esm({
           kind: "minted",
           key: ["id"],
           birth: "created_at",
-          birthFacts: ["evidence_atom_id", "binding_type", "ac_text_hash", "@refFp:ac_uid"],
+          // v2 (T12802): ac_id in place of @refFp:ac_uid and ac_text_hash. Both
+          // were filled from the criterion, so a backfilled binding whose
+          // criterion was already gone got a different value (see AC history).
+          birthFacts: ["evidence_atom_id", "binding_type", "ac_id"],
           storedRefUids: [
             { column: "ac_uid", from: "ac_id", table: ACS },
             { column: "ac_text_hash", from: "ac_id", table: ACS, source: "text_hash" }
@@ -26539,7 +26768,9 @@ var init_row_identity_registry = __esm({
           // The uid IS the primary key: display-id-alias.ts computes it on write.
           table: "tasks_display_id_aliases",
           kind: "natural",
-          key: ["entity_table", "display_id", "entity_uid"],
+          // T12800: the reason is part of the key (collision-remint and
+          // remint-assigned of one id and row are distinct facts).
+          key: ["entity_table", "display_id", "entity_uid", "reason"],
           task: "T12341"
         },
         {
@@ -27121,6 +27352,20 @@ function installRowUidTriggers(db, scope) {
     );
   }
 }
+function v1ReleaseBirthFp(db, table, row) {
+  const col = (c) => row[c] ?? null;
+  const facts = table === "tasks_task_acceptance_criteria_history" ? [col("ac_id"), col("previous_text"), col("reason")] : table === "tasks_evidence_ac_bindings" ? [col("evidence_atom_id"), col("binding_type"), col("ac_text_hash")] : [];
+  if (facts.length === 0) return null;
+  const acUid = col("ac_uid");
+  let ref = "ref:none";
+  if (acUid !== null) {
+    const ac = db.prepare("SELECT birth_fp AS fp FROM main.tasks_task_acceptance_criteria WHERE uid = ?").get(acUid);
+    ref = ac === void 0 ? "ref:missing" : ac.fp;
+    if (ref === null) return null;
+  }
+  const spec = rowIdentitySpec("project", table);
+  return birthFingerprint(table, spec?.birth ? col(spec.birth) : null, [...facts, ref]);
+}
 function hasObject(db, type, name2) {
   return db.prepare("SELECT 1 FROM main.sqlite_master WHERE type = ? AND name = ?").get(type, name2) !== void 0;
 }
@@ -27204,24 +27449,41 @@ function preReleaseBirthFp(db, table, row) {
 function resetStaleIdentity(db, scope, writers) {
   if (scope !== "project" || !hasTable(db, ROW_IDENTITY_META_TABLE)) return "none";
   if (readMeta(db, ROW_IDENTITY_RECIPE_KEY) === ROW_IDENTITY_RECIPE) return "none";
-  const minted = ROW_IDENTITY.project.filter(
-    (spec) => spec.kind === "minted" && hasTable(db, spec.table) && columnsOf(db, spec.table).has(BIRTH_FP_COLUMN)
+  const minted = fingerprintOrder("project", ROW_IDENTITY.project).filter(
+    (spec) => hasTable(db, spec.table) && columnsOf(db, spec.table).has(BIRTH_FP_COLUMN)
   );
   const stale = [];
+  const cleared = /* @__PURE__ */ new Map();
+  const mark = (table, column, value) => {
+    if (value === null || value === void 0) return;
+    const key = `${table}.${column}`;
+    const set = cleared.get(key) ?? /* @__PURE__ */ new Set();
+    set.add(String(value));
+    cleared.set(key, set);
+  };
   for (const spec of minted) {
+    const deps = (spec.birthFacts ?? []).map((fact) => fingerprintRef("project", spec, fact)).filter((d) => d !== null);
+    const keyColumn = targetKey("project", spec.table);
     const rows = db.prepare(
       `SELECT rowid AS _rowid, * FROM main.${q(spec.table)} WHERE ${q(BIRTH_FP_COLUMN)} IS NOT NULL`
     ).all();
     for (const row of rows) {
-      if (row[BIRTH_FP_COLUMN] === preReleaseBirthFp(db, spec.table, row)) {
+      const derivedFromStale = deps.some(
+        (d) => cleared.get(`${d.table}.${d.key}`)?.has(String(row[d.column] ?? ""))
+      );
+      if (derivedFromStale || row[BIRTH_FP_COLUMN] === preReleaseBirthFp(db, spec.table, row) || row[BIRTH_FP_COLUMN] === v1ReleaseBirthFp(db, spec.table, row)) {
         stale.push({ table: spec.table, rowid: row._rowid });
+        mark(spec.table, keyColumn, row[keyColumn]);
+        mark(spec.table, UID_COLUMN, row[UID_COLUMN]);
       }
     }
   }
-  if (stale.length === 0) return "none";
+  const graveyardRows = scope === "project" && hasTable(db, AC_UID_GRAVEYARD) ? db.prepare(`SELECT count(*) AS n FROM main.${AC_UID_GRAVEYARD}`).get().n : 0;
+  if (stale.length === 0 && graveyardRows === 0) return "none";
   if (readMeta(db, ROW_IDENTITY_SYNCED_KEY) !== void 0) return "refused";
   db.exec("SAVEPOINT row_identity_reset");
   try {
+    if (graveyardRows > 0) writers.clearAcUidGraveyardNative(db);
     for (const { table, rowid } of stale) {
       writers.clearBirthFpNative(db, table, rowid);
     }
@@ -27237,6 +27499,106 @@ function writeRecipeMarker(db, writers = requireWriters()) {
   if (!hasTable(db, ROW_IDENTITY_META_TABLE)) return;
   writers.writeRowIdentityMetaNative(db, ROW_IDENTITY_RECIPE_KEY, ROW_IDENTITY_RECIPE);
 }
+function rowIdentityShared(db) {
+  return readMeta(db, ROW_IDENTITY_SYNCED_KEY) !== void 0;
+}
+function healRowIdentitySchema(db, scope, writers = registeredWriters) {
+  const log15 = getLogger("row-identity");
+  if (ROW_IDENTITY[scope].length === 0) {
+    return [];
+  }
+  if (!schemaWritesAllowed(db)) {
+    log15.debug({ scope }, "row identity schema heal skipped: schema writes refused for this build");
+    return [];
+  }
+  try {
+    db.exec("SAVEPOINT row_identity_heal");
+    try {
+      const healed = [
+        ...scope === "project" ? ensureIdentityTables(db) : [],
+        ...ensureRowIdentitySchema(db, scope)
+      ];
+      if (healed.length > 0) recordHealReceipt(db, scope, healed, writers);
+      db.exec("RELEASE SAVEPOINT row_identity_heal");
+      if (healed.length > 0)
+        log15.info({ scope, healed: healed.length }, "row identity schema healed");
+      return healed;
+    } catch (error) {
+      db.exec("ROLLBACK TO SAVEPOINT row_identity_heal");
+      db.exec("RELEASE SAVEPOINT row_identity_heal");
+      throw error;
+    }
+  } catch (error) {
+    log15.error({ scope, error }, "row identity schema heal failed");
+    return [];
+  }
+}
+function recordHealReceipt(db, scope, healed, writers) {
+  const table = HEAL_RECEIPT_TABLE[scope];
+  const log15 = getLogger("row-identity");
+  if (table === null || !hasTable(db, table) || !writers) {
+    log15.warn({ scope, healed: healed.length }, "row identity schema healed; no receipt table");
+    return;
+  }
+  const objects = healed.map((stmt) => {
+    const col = /ALTER TABLE main\.("?)(\w+)\1 ADD COLUMN ("?)(\w+)\3/.exec(stmt);
+    if (col) return `${col[2]}.${col[4]}`;
+    const obj = /(TABLE|INDEX|TRIGGER) IF NOT EXISTS main\.("?)(\w+)\2/.exec(stmt);
+    return obj ? `${obj[1].toLowerCase()} ${obj[3]}` : stmt.slice(0, 60);
+  });
+  const receipt2 = {
+    at: (/* @__PURE__ */ new Date()).toISOString(),
+    scope,
+    statements: healed.length,
+    objects
+  };
+  const history = [...readRowIdentityHealHistory(db), receipt2].slice(-HEAL_RECEIPTS_KEPT);
+  writers.writeRowIdentityMetaNative(db, ROW_IDENTITY_HEAL_KEY, JSON.stringify(history));
+}
+function readRowIdentityHealHistory(db) {
+  const raw = readMeta(db, ROW_IDENTITY_HEAL_KEY);
+  if (raw === void 0) return [];
+  try {
+    const parsed = JSON.parse(raw);
+    return Array.isArray(parsed) ? parsed : [parsed];
+  } catch {
+    return [];
+  }
+}
+function missingRowIdentitySchema(db) {
+  if (!hasTable(db, "tasks_task_acceptance_criteria")) return [];
+  const missing = [];
+  for (const table of Object.keys(IDENTITY_TABLE_DDL)) {
+    if (!hasTable(db, table)) missing.push(`table ${table}`);
+  }
+  for (const [table, column] of [
+    ["tasks_display_id_aliases", "displaced_hlc"],
+    ["tasks_display_id_aliases", "entity_birth_fp"],
+    [AC_UID_GRAVEYARD, "birth_fp"]
+  ]) {
+    if (hasTable(db, table) && !columnsOf(db, table).has(column)) {
+      missing.push(`column ${table}.${column}`);
+    }
+  }
+  if (!hasObject(db, "trigger", "trg_tasks_ac_uid_graveyard")) {
+    missing.push("trigger trg_tasks_ac_uid_graveyard");
+  }
+  for (const spec of ROW_IDENTITY.project) {
+    if (!hasTable(db, spec.table)) continue;
+    const cols = columnsOf(db, spec.table);
+    for (const column of rowIdentityColumns("project", spec.table)) {
+      if (!cols.has(column)) missing.push(`column ${spec.table}.${column}`);
+    }
+    if (!uidIsPrimaryKey(db, spec.table) && !hasObject(db, "index", `uq_${spec.table}_uid`)) {
+      missing.push(`index uq_${spec.table}_uid`);
+    }
+    for (const ref of spec.storedRefUids ?? []) {
+      const index2 = `idx_${spec.table}_${ref.column}`;
+      if (!hasObject(db, "index", index2)) missing.push(`index ${index2}`);
+    }
+  }
+  return missing;
+}
 function prepareRowIdentity(db, scope, options = {}) {
   if (ROW_IDENTITY[scope].length === 0) return null;
   if (!rowUidFillEnabled()) return null;
@@ -27275,7 +27637,7 @@ function prepareRowIdentity(db, scope, options = {}) {
     return null;
   }
 }
-var ROW_UID_DOMAIN, ROW_BIRTH_DOMAIN, ROW_UID_SQL_FUNCTION, ROW_BIRTH_FP_SQL_FUNCTION, ROW_RANDOM_UID_SQL_FUNCTION, AC_TEXT_HASH_SQL_FUNCTION, AC_UID_GRAVEYARD, registeredWriters, STORE_TIMESTAMP, MAX_UUID_MS, ROW_IDENTITY_RECIPE, ROW_IDENTITY_META_TABLE, ROW_IDENTITY_RECIPE_KEY, ROW_IDENTITY_SYNCED_KEY, IDENTITY_TABLE_DDL, AC_UID_GRAVEYARD_TRIGGER;
+var ROW_UID_DOMAIN, ROW_BIRTH_DOMAIN, ROW_UID_SQL_FUNCTION, ROW_BIRTH_FP_SQL_FUNCTION, ROW_RANDOM_UID_SQL_FUNCTION, AC_TEXT_HASH_SQL_FUNCTION, AC_UID_GRAVEYARD, registeredWriters, STORE_TIMESTAMP, MAX_UUID_MS, ROW_IDENTITY_RECIPE, ROW_IDENTITY_META_TABLE, ROW_IDENTITY_RECIPE_KEY, ROW_IDENTITY_SYNCED_KEY, IDENTITY_TABLE_DDL, AC_UID_GRAVEYARD_TRIGGER, ROW_IDENTITY_HEAL_KEY, HEAL_RECEIPT_TABLE, HEAL_RECEIPTS_KEPT;
 var init_row_identity = __esm({
   "packages/core/src/store/row-identity.ts"() {
     "use strict";
@@ -27284,6 +27646,7 @@ var init_row_identity = __esm({
     init_ac_table();
     init_row_identity_flag();
     init_row_identity_registry();
+    init_worktree_build_guard();
     ROW_UID_DOMAIN = "cleo/row-uid/v1";
     ROW_BIRTH_DOMAIN = "cleo/row-birth/v1";
     ROW_UID_SQL_FUNCTION = "cleo_row_uid";
@@ -27293,7 +27656,7 @@ var init_row_identity = __esm({
     AC_UID_GRAVEYARD = "tasks_ac_uid_graveyard";
     STORE_TIMESTAMP = /^(\d{4})-(\d{2})-(\d{2})(?:[T ](\d{2}):(\d{2})(?::(\d{2})(?:\.(\d{1,9}))?)?)?(Z|[+-]\d{2}:?\d{2})?$/;
     MAX_UUID_MS = 2 ** 48 - 1;
-    ROW_IDENTITY_RECIPE = "cleo/row-identity/v1";
+    ROW_IDENTITY_RECIPE = "cleo/row-identity/v2";
     ROW_IDENTITY_META_TABLE = "tasks_row_identity_meta";
     ROW_IDENTITY_RECIPE_KEY = "row_identity_recipe";
     ROW_IDENTITY_SYNCED_KEY = "row_identity_synced";
@@ -27338,6 +27701,15 @@ BEGIN
   INSERT INTO ${AC_UID_GRAVEYARD} (ac_id, uid, task_id, ordinal, text, birth_fp, deleted_at)
   VALUES (OLD.id, OLD.uid, OLD.task_id, OLD.ordinal, OLD.text, OLD.birth_fp, strftime('%Y-%m-%dT%H:%M:%fZ', 'now'));
 END`;
+    ROW_IDENTITY_HEAL_KEY = "row_identity_schema_healed";
+    HEAL_RECEIPT_TABLE = {
+      project: ROW_IDENTITY_META_TABLE,
+      // The global store declares no identity table yet (ROW_IDENTITY.global is
+      // empty, so its heal never runs); the change that declares one adds its
+      // meta table here.
+      global: null
+    };
+    HEAL_RECEIPTS_KEPT = 20;
   }
 });
 
@@ -33031,7 +33403,7 @@ var init_task_claim = __esm({
 });
 
 // packages/core/src/store/converters.ts
-import { z as z26 } from "zod";
+import { z as z27 } from "zod";
 function readStoredAcceptance(row) {
   if (row.acceptanceJson === null || row.acceptanceJson === void 0) return void 0;
   try {
@@ -33189,7 +33561,7 @@ var init_converters = __esm({
     init_src();
     init_parsers();
     init_task_claim();
-    storedAcceptanceSchema = z26.custom(
+    storedAcceptanceSchema = z27.custom(
       (value) => Array.isArray(value) && value.every((item) => acceptanceItemSchema.safeParse(item).success)
     );
   }
@@ -35852,7 +36224,7 @@ import {
 } from "node:fs";
 import { createRequire as createRequire5 } from "node:module";
 import { basename as basename7, dirname as dirname12, join as join13 } from "node:path";
-import { z as z27 } from "zod";
+import { z as z28 } from "zod";
 function formatBackupTimestamp(d) {
   const pad = (n, len = 2) => String(n).padStart(len, "0");
   return `${d.getFullYear()}${pad(d.getMonth() + 1)}${pad(d.getDate())}-${pad(d.getHours())}${pad(d.getMinutes())}${pad(d.getSeconds())}`;
@@ -35989,16 +36361,16 @@ var init_backup_sidecar = __esm({
     init_logger2();
     PRE_COLLAPSE_BACKUP_TYPE = "migration";
     MARKER_PREFIX = "twin_collapse:";
-    backupSidecarSchema = z27.object({
-      backupId: z27.string().min(1),
-      type: z27.string().min(1),
-      timestamp: z27.string().min(1),
-      note: z27.string().optional(),
-      files: z27.array(z27.string()),
-      pinned: z27.boolean().optional(),
-      pinnedReason: z27.string().optional(),
-      releasedAt: z27.string().optional(),
-      releasedReason: z27.string().optional()
+    backupSidecarSchema = z28.object({
+      backupId: z28.string().min(1),
+      type: z28.string().min(1),
+      timestamp: z28.string().min(1),
+      note: z28.string().optional(),
+      files: z28.array(z28.string()),
+      pinned: z28.boolean().optional(),
+      pinnedReason: z28.string().optional(),
+      releasedAt: z28.string().optional(),
+      releasedReason: z28.string().optional()
     }).passthrough();
   }
 });
@@ -36170,7 +36542,7 @@ var init_pre_repair_snapshot = __esm({
 import { createHash as createHash5 } from "node:crypto";
 import { basename as basename8, dirname as dirname15 } from "node:path";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
-import { z as z28 } from "zod";
+import { z as z29 } from "zod";
 function hasMainTable(db, name2) {
   return db.prepare("SELECT 1 FROM main.sqlite_master WHERE type = 'table' AND name = ?").get(name2) !== void 0;
 }
@@ -37303,20 +37675,20 @@ var init_twin_collapse = __esm({
     SHADOW_WRITE_REFUSED = "E_TWIN_COLLAPSE_FAILED: store is read-only until the twin collapse succeeds; run cleo doctor twin-collapse";
     SHADOW_WRITE_OPS = ["INSERT", "UPDATE", "DELETE"];
     STICKY_ARCHIVE_KEY = `${TWIN_COLLAPSE_ARCHIVE_PREFIX}sticky_tags`;
-    FocusNotesShape = z28.object({ sessionNotes: z28.array(z28.unknown()) }).passthrough();
-    StickyArchiveShape = z28.array(z28.string());
-    RecoveryReceiptShape = z28.object({
-      task: z28.literal("T12727"),
-      id: z28.string(),
-      recoveredAt: z28.string(),
-      snapshot: z28.string().nullable(),
-      archived: z28.array(z28.object({ key: z28.string(), archiveKey: z28.string(), sha: z28.string() })),
-      focusNotesAdded: z28.number(),
-      stickyArchived: z28.array(z28.string()),
-      stickyArchiveKey: z28.string(),
-      before: z28.object({ focusState: z28.string().nullable(), stickyArchive: z28.string().nullable() }),
-      after: z28.object({ focusState: z28.string().nullable(), stickyArchive: z28.string().nullable() }),
-      rolledBackAt: z28.string().nullable()
+    FocusNotesShape = z29.object({ sessionNotes: z29.array(z29.unknown()) }).passthrough();
+    StickyArchiveShape = z29.array(z29.string());
+    RecoveryReceiptShape = z29.object({
+      task: z29.literal("T12727"),
+      id: z29.string(),
+      recoveredAt: z29.string(),
+      snapshot: z29.string().nullable(),
+      archived: z29.array(z29.object({ key: z29.string(), archiveKey: z29.string(), sha: z29.string() })),
+      focusNotesAdded: z29.number(),
+      stickyArchived: z29.array(z29.string()),
+      stickyArchiveKey: z29.string(),
+      before: z29.object({ focusState: z29.string().nullable(), stickyArchive: z29.string().nullable() }),
+      after: z29.object({ focusState: z29.string().nullable(), stickyArchive: z29.string().nullable() }),
+      rolledBackAt: z29.string().nullable()
     });
   }
 });
@@ -40898,12 +41270,12 @@ var init_safety_data_accessor = __esm({
           this.getSafetyOptions()
         );
       }
-      async insertNewTask(task) {
+      async insertNewTask(task, identity) {
         this.logVerbose(`Inserting new task ${task.id}`);
         await safeSingleTaskWrite(
           this.inner,
           task.id,
-          () => this.inner.insertNewTask(task),
+          () => this.inner.insertNewTask(task, identity),
           this.cwd,
           this.getSafetyOptions()
         );
@@ -40951,6 +41323,9 @@ var init_safety_data_accessor = __esm({
         return this.inner.findOrphanAcBindings();
       }
       // ---- Metadata (pass-through to inner) ----
+      async getTaskIdentities(taskIds) {
+        return await this.inner.getTaskIdentities?.(taskIds) ?? [];
+      }
       async getMetaValue(key) {
         return this.inner.getMetaValue(key);
       }
@@ -41324,13 +41699,147 @@ var init_cross_db_cleanup = __esm({
   }
 });
 
+// packages/core/src/store/dependency-cycles.ts
+function formatDependencyCycle(cycle) {
+  return cycle.join(" \u2192 ");
+}
+function buildAdjacency(edges) {
+  const adjacency = /* @__PURE__ */ new Map();
+  for (const { taskId, dependsOn } of edges) {
+    const next = adjacency.get(taskId);
+    if (next) next.push(dependsOn);
+    else adjacency.set(taskId, [dependsOn]);
+  }
+  for (const next of adjacency.values()) next.sort();
+  return adjacency;
+}
+function shortestPath(adjacency, from, to) {
+  if (from === to) return [from];
+  const previous = /* @__PURE__ */ new Map([[from, from]]);
+  const queue = [from];
+  for (let head = 0; head < queue.length; head++) {
+    const id = queue[head];
+    for (const next of adjacency.get(id) ?? []) {
+      if (previous.has(next)) continue;
+      previous.set(next, id);
+      if (next === to) {
+        const path2 = [to];
+        let cursor = id;
+        while (cursor !== from) {
+          path2.push(cursor);
+          cursor = previous.get(cursor);
+        }
+        path2.push(from);
+        return path2.reverse();
+      }
+      queue.push(next);
+    }
+  }
+  return null;
+}
+function findClosedCycle(existing, edge) {
+  if (edge.taskId === edge.dependsOn) return [edge.taskId, edge.taskId];
+  const path2 = shortestPath(buildAdjacency(existing), edge.dependsOn, edge.taskId);
+  return path2 ? [edge.taskId, ...path2] : null;
+}
+function dependencyCycleError(edge, cycle) {
+  const self = edge.taskId === edge.dependsOn;
+  const message = self ? `${DEPENDENCY_CYCLE_CODE}: task ${edge.taskId} cannot depend on itself` : `${DEPENDENCY_CYCLE_CODE}: ${edge.taskId} depends on ${edge.dependsOn} would close a dependency cycle: ${formatDependencyCycle(cycle)}`;
+  const closing = cycle.length >= 3 ? cycle[cycle.length - 2] : void 0;
+  const fix = self ? `Drop ${edge.taskId} from its own --depends list` : `Drop this dependency, or first remove another edge of the cycle, e.g. cleo update ${closing} --remove-depends ${edge.taskId}`;
+  return new CleoError(14 /* CIRCULAR_REFERENCE */, message, {
+    fix,
+    details: {
+      field: "depends",
+      actual: edge.dependsOn,
+      taskId: edge.taskId,
+      cycle: [...cycle]
+    }
+  });
+}
+function isDependencyCycleAbort(err) {
+  for (let e = err, depth = 0; e instanceof Error && depth < 8; depth++) {
+    if (e.message.includes(DEPENDENCY_CYCLE_CODE)) return true;
+    e = e.cause;
+  }
+  return false;
+}
+function readDependencyEdges(db) {
+  return db.select({
+    taskId: tasksTaskDependencies.taskId,
+    dependsOn: tasksTaskDependencies.dependsOn
+  }).from(tasksTaskDependencies).all();
+}
+function rethrowDependencyCycle(db, err, attempted) {
+  if (!isDependencyCycleAbort(err)) throw err;
+  const edges = readDependencyEdges(db);
+  for (const edge of attempted) {
+    const cycle = findClosedCycle(edges, edge);
+    if (cycle) throw dependencyCycleError(edge, cycle);
+    edges.push(edge);
+  }
+  throw err;
+}
+var DEPENDENCY_CYCLE_CODE;
+var init_dependency_cycles = __esm({
+  "packages/core/src/store/dependency-cycles.ts"() {
+    "use strict";
+    init_src();
+    init_errors2();
+    init_tasks_schema();
+    DEPENDENCY_CYCLE_CODE = "E_TASK_DEPENDENCY_CYCLE";
+  }
+});
+
 // packages/core/src/store/db-helpers.ts
 import { and as and5, eq as eq7, inArray as inArray3, sql as sql27 } from "drizzle-orm";
 async function upsertTask(db, row, archiveFields, allowOrphanParent = false) {
   await writeTaskRow(db, row, archiveFields, allowOrphanParent, false);
 }
-async function insertNewTask(db, row) {
-  await writeTaskRow(db, row, void 0, false, true);
+async function insertNewTask(db, row, identity = { origin: "new" }) {
+  await writeTaskRow(
+    db,
+    { ...row, ...await importedIdentity(db, identity, row) },
+    void 0,
+    false,
+    true
+  );
+}
+async function tableExists2(db, table) {
+  const rows = await db.all(
+    sql27`SELECT 1 AS x FROM sqlite_master WHERE type = 'table' AND name = ${table}`
+  );
+  return rows.length > 0;
+}
+async function importedIdentity(db, identity, row) {
+  if (identity.origin === "new" || !rowUidFillEnabled()) return {};
+  const fp = identity.birthFp ?? null;
+  const carried2 = identity.uid ?? null;
+  if (carried2 !== null && fp !== null) {
+    let uid = carried2;
+    if (await tableExists2(db, "tasks_uid_aliases")) {
+      for (let hop = 0; hop < 32; hop++) {
+        const found = await db.all(
+          sql27`SELECT new_uid AS uid FROM tasks_uid_aliases
+               WHERE entity_table = 'tasks_tasks' AND old_uid = ${uid} AND old_birth_fp = ${fp}`
+        );
+        const next = found[0];
+        if (!next) break;
+        uid = next.uid;
+      }
+    }
+    const [holder] = await db.select({ id: tasksTasks.id, birthFp: tasksTasks.birthFp }).from(tasksTasks).where(eq7(tasksTasks.uid, uid)).limit(1).all();
+    if (holder && holder.birthFp === fp) throw new SameRowPresentError(row.id, holder.id);
+    if (await tableExists2(db, "tasks_identity_quarantine")) {
+      const [held] = await db.all(
+        sql27`SELECT 1 AS x FROM tasks_identity_quarantine
+             WHERE entity_table = 'tasks_tasks' AND uid = ${uid} AND birth_fp = ${fp}`
+      );
+      if (held) throw new SameRowPresentError(row.id, "held");
+    }
+    if (!holder) return { uid, birthFp: fp };
+  }
+  return { uid: null, birthFp: null };
 }
 async function writeTaskRow(db, row, archiveFields, allowOrphanParent, insertOnly) {
   if (row.parentId && row.parentId === row.id) {
@@ -41481,7 +41990,11 @@ async function batchUpdateDependencies(db, tasks2, validIds) {
     for (const depId of want) if (!have.has(depId)) added.push({ taskId, dependsOn: depId });
   }
   if (added.length > 0) {
-    await db.insert(tasksTaskDependencies).values(added).onConflictDoNothing().run();
+    try {
+      await db.insert(tasksTaskDependencies).values(added).onConflictDoNothing().run();
+    } catch (err) {
+      rethrowDependencyCycle(db, err, added);
+    }
   }
 }
 async function loadDependenciesForTasks(db, tasks2, _validationIds) {
@@ -41526,15 +42039,29 @@ async function loadRelationsForTasks(db, tasks2) {
     task.relates = relations && relations.length > 0 ? relations : [];
   }
 }
-var log6;
+var log6, SameRowPresentError;
 var init_db_helpers = __esm({
   "packages/core/src/store/db-helpers.ts"() {
     "use strict";
     init_src();
     init_errors2();
     init_logger2();
+    init_dependency_cycles();
+    init_row_identity_flag();
     init_tasks_schema();
     log6 = getLogger("db-helpers");
+    SameRowPresentError = class extends CleoError {
+      /** Where the row already is: its display id, or `held` when quarantined. */
+      presentAs;
+      constructor(taskId, presentAs) {
+        super(
+          22 /* ID_COLLISION */,
+          `Task ${taskId} is already in this store (${presentAs === "held" ? "held for sync" : `as ${presentAs}`}): same uid and birth fingerprint; not written again`,
+          { details: { field: "taskId", actual: taskId, expected: presentAs } }
+        );
+        this.presentAs = presentAs;
+      }
+    };
   }
 });
 
@@ -41619,46 +42146,133 @@ function readProcessEntry(pid) {
     return null;
   }
 }
-function resolvePpidKey(ppid, lookupProcess) {
+function readProcessArgs(pid) {
+  if (process.platform === "win32" || !Number.isInteger(pid) || pid <= 1) return null;
+  try {
+    const out = execFileSync("ps", ["-o", "args=", "-p", String(pid)], {
+      encoding: "utf8",
+      timeout: 1e3,
+      stdio: ["ignore", "pipe", "ignore"],
+      env: { ...process.env, ...PS_STABLE_ENV }
+    }).trim();
+    return out === "" ? null : out;
+  } catch {
+    return null;
+  }
+}
+function baseName(token) {
+  return token.slice(token.lastIndexOf("/") + 1).replace(/^-/, "");
+}
+function programName(commandLine) {
+  const tokens = commandLine.trim().split(/\s+/);
+  const head = baseName(tokens[0] ?? "");
+  if (!RUNTIME_PATTERN.test(head)) return head;
+  for (let i = 1; i < tokens.length; i++) {
+    const token = tokens[i] ?? "";
+    if (token === "-m") return (tokens[i + 1] ?? head).split(".")[0] ?? head;
+    if (token.startsWith("-")) continue;
+    return baseName(token).replace(/\.(c|m)?(js|ts)$|\.py$/, "");
+  }
+  return head;
+}
+function isCommandStringShell(args) {
+  const tokens = args.trim().split(/\s+/);
+  const shell = programName(args);
+  let first = 1;
+  if (RUNTIME_PATTERN.test(baseName(tokens[0] ?? ""))) {
+    while (first < tokens.length && (tokens[first] ?? "").startsWith("-")) first++;
+    first++;
+  }
+  const rest = tokens.slice(first);
+  if (shell === "pwsh" || shell === "powershell") {
+    return rest.some((t) => PWSH_COMMAND_SWITCHES.has(t.toLowerCase()));
+  }
+  for (let i = 0; i < rest.length; i++) {
+    const token = rest[i] ?? "";
+    if (token === "--") return false;
+    if (token === "--command" || token === "--commands") return true;
+    if (SHELL_OPTIONS_WITH_ARGUMENT.has(token)) {
+      i++;
+      continue;
+    }
+    if (token.startsWith("--")) continue;
+    if (!/^[-+][A-Za-z]+$/.test(token)) return false;
+    if (token.startsWith("-") && token.slice(1).includes("c")) return true;
+  }
+  return false;
+}
+function resolveAncestor(ppid, lookupProcess, lookupArgs, agentId = null) {
   let pid = ppid;
-  for (let depth = 0; depth < PPID_CHAIN_MAX_DEPTH && pid > 1; depth++) {
+  for (let depth = 0; depth < PPID_CHAIN_MAX_DEPTH; depth++) {
+    if (pid <= 1) return null;
     const entry = lookupProcess(pid);
-    if (!entry) return null;
-    if (!PPID_CHAIN_LAUNCHERS.has(entry.command)) {
-      return { key: `ppid:${entry.pid}@${entry.startedAt}`, source: "ppid", kind: "ppid" };
+    if (!entry || entry.pid <= 1) return null;
+    const args = lookupArgs(entry.pid);
+    const program = programName(args ?? entry.command);
+    if (INIT_PROCESSES.has(program) || INIT_PROCESSES.has(entry.command)) return null;
+    if (OWNER_PROCESS_SHELLS.has(program)) {
+      if (args === null) return null;
+      if (!isCommandStringShell(args)) return { entry, program, type: "shell" };
+    } else if (!ANCESTOR_WRAPPERS.has(program)) {
+      if (KNOWN_HARNESSES.has(program)) return { entry, program, type: "harness" };
+      return agentId ? { entry, program, type: "host" } : null;
     }
     pid = entry.ppid;
   }
   return null;
 }
+function anchorKey(anchor, agentId, under) {
+  const proc = `${anchor.entry.pid}@${anchor.entry.startedAt}`;
+  if (anchor.type === "shell" && !agentId) {
+    return { key: `proc:${proc}`, source: "process", kind: "process" };
+  }
+  const agent = agentId ? `#agent=${agentId}` : "";
+  const scope = under ? `|${under.key}` : "";
+  return {
+    key: `harness:${anchor.program}:${proc}${agent}${scope}`,
+    source: "process",
+    kind: "harness"
+  };
+}
 function resolveTerminalKeys(options = {}) {
   const env = options.env ?? process.env;
   const keys = [];
   for (const source of TERMINAL_KEY_SOURCES) {
     const value = envValue(env, source.envVar);
     if (value === null) continue;
-    const qualifier = envValue(env, source.qualifierEnvVar);
+    const qualifiers = [source.qualifierEnvVar, ...source.extraQualifierEnvVars ?? []].map((name2) => envValue(env, name2)).filter((q2) => q2 !== null);
     keys.push({
-      key: `env:${source.envVar}=${qualifier === null ? value : `${qualifier}|${value}`}`,
+      key: `env:${source.envVar}=${[...qualifiers, value].join("|")}`,
       source: source.envVar,
       kind: source.kind
     });
   }
-  if (keys.length > 0) return keys;
-  const live = options.ppid === void 0 && options.lookupProcess === void 0;
-  let ppidKey;
+  if (keys.some((k) => k.kind === "provider")) return keys;
+  const agentId = envValue(env, "CLEO_AGENT_ID");
+  const live = options.ppid === void 0 && options.lookupProcess === void 0 && options.lookupArgs === void 0;
+  let anchor;
   if (live) {
-    if (livePpidKey === void 0) livePpidKey = resolvePpidKey(process.ppid, readProcessEntry);
-    ppidKey = livePpidKey;
+    const memoKey2 = agentId ?? "";
+    if (!liveAnchors.has(memoKey2))
+      liveAnchors.set(
+        memoKey2,
+        resolveAncestor(process.ppid, readProcessEntry, readProcessArgs, agentId)
+      );
+    anchor = liveAnchors.get(memoKey2) ?? null;
   } else {
-    ppidKey = resolvePpidKey(
+    anchor = resolveAncestor(
       options.ppid ?? process.ppid,
-      options.lookupProcess ?? readProcessEntry
+      options.lookupProcess ?? readProcessEntry,
+      options.lookupArgs ?? readProcessArgs,
+      agentId
     );
   }
-  return ppidKey ? [ppidKey] : [];
+  if (!anchor) return keys;
+  if (keys.length === 0) return [anchorKey(anchor, agentId, void 0)];
+  if (anchor.type === "shell" && !agentId) return keys;
+  return [...keys, anchorKey(anchor, agentId, keys[0])];
 }
-var TERMINAL_KEY_SOURCES, PPID_CHAIN_LAUNCHERS, PPID_CHAIN_MAX_DEPTH, livePpidKey;
+var TERMINAL_KEY_SOURCES, PPID_CHAIN_MAX_DEPTH, KNOWN_HARNESSES, RUNTIME_PATTERN, ANCESTOR_WRAPPERS, INIT_PROCESSES, SHELL_OPTIONS_WITH_ARGUMENT, PWSH_COMMAND_SWITCHES, OWNER_PROCESS_SHELLS, liveAnchors;
 var init_terminal_identity = __esm({
   "packages/core/src/sessions/terminal-identity.ts"() {
     "use strict";
@@ -41690,24 +42304,100 @@ var init_terminal_identity = __esm({
         kind: "terminal",
         origin: "konsole",
         qualifierEnvVar: "KONSOLE_DBUS_SERVICE"
+      },
+      // T12864 — non-terminal callers whose platform exports a per-job / per-login id.
+      // GitHub Actions: GITHUB_RUN_ID is per run and shared by its jobs, so it is
+      // qualified by GITHUB_RUN_ATTEMPT and GITHUB_JOB ("Variables reference",
+      // docs.github.com/en/actions/reference/workflows-and-actions/variables).
+      // Every step of one job shares the key; the steps run sequentially.
+      {
+        envVar: "GITHUB_RUN_ID",
+        kind: "terminal",
+        origin: "github-actions",
+        qualifierEnvVar: "GITHUB_RUN_ATTEMPT",
+        extraQualifierEnvVars: ["GITHUB_JOB"]
+      },
+      // GitLab CI: CI_JOB_ID is unique per job across the instance ("Predefined
+      // CI/CD variables reference", docs.gitlab.com/ci/variables/predefined_variables).
+      { envVar: "CI_JOB_ID", kind: "terminal", origin: "gitlab-ci" },
+      // OpenSSH login with a tty: SSH_TTY names the login's tty and is set only
+      // when one was allocated; SSH_CONNECTION ("client-ip client-port server-ip
+      // server-port", ssh(1) ENVIRONMENT) disambiguates it across connections. A
+      // one-shot `ssh host 'cmd'` has no tty and falls through to the ancestor walk.
+      {
+        envVar: "SSH_TTY",
+        kind: "terminal",
+        origin: "openssh",
+        qualifierEnvVar: "SSH_CONNECTION"
       }
     ];
-    PPID_CHAIN_LAUNCHERS = /* @__PURE__ */ new Set([
-      "node",
+    PPID_CHAIN_MAX_DEPTH = 12;
+    KNOWN_HARNESSES = /* @__PURE__ */ new Set([
+      "claude",
+      "codex",
+      "aider",
+      "gemini",
+      "kimi",
+      "cursor-agent",
+      "amp"
+    ]);
+    RUNTIME_PATTERN = /^(node|nodejs|bun|deno|python[0-9.]*|pypy[0-9.]*|ruby|java|php|perl)$/;
+    ANCESTOR_WRAPPERS = /* @__PURE__ */ new Set([
+      "env",
+      "timeout",
+      "gtimeout",
+      "nohup",
+      "nice",
+      "time",
+      "xargs",
+      "stdbuf",
+      "sudo",
+      "doas",
       "npm",
+      "npm-cli",
       "npx",
+      "npx-cli",
       "pnpm",
       "pnpx",
       "yarn",
-      "bun",
       "bunx",
-      "tsx",
       "corepack",
       "mise",
-      "env",
       "cleo"
     ]);
-    PPID_CHAIN_MAX_DEPTH = 4;
+    INIT_PROCESSES = /* @__PURE__ */ new Set(["launchd", "systemd", "init"]);
+    SHELL_OPTIONS_WITH_ARGUMENT = /* @__PURE__ */ new Set([
+      "-o",
+      "+o",
+      "-O",
+      "+O",
+      "--rcfile",
+      "--init-file"
+    ]);
+    PWSH_COMMAND_SWITCHES = /* @__PURE__ */ new Set([
+      "-c",
+      "-command",
+      "-commandwithargs",
+      "-cwa",
+      "-e",
+      "-ec",
+      "-encodedcommand"
+    ]);
+    OWNER_PROCESS_SHELLS = /* @__PURE__ */ new Set([
+      "sh",
+      "bash",
+      "zsh",
+      "dash",
+      "fish",
+      "ksh",
+      "tcsh",
+      "csh",
+      "pwsh",
+      "powershell",
+      "nu",
+      "xonsh"
+    ]);
+    liveAnchors = /* @__PURE__ */ new Map();
   }
 });
 
@@ -41747,7 +42437,8 @@ var init_session_binding_schema = __esm({
 });
 
 // packages/core/src/store/session-store.ts
-import { and as and6, desc as desc2, eq as eq8, isNull as isNull3, lte as lte2, or as or4 } from "drizzle-orm";
+import { existsSync as existsSync19 } from "node:fs";
+import { and as and6, desc as desc2, eq as eq8, inArray as inArray4, isNull as isNull3, lte as lte2, or as or4 } from "drizzle-orm";
 async function getSession(sessionId, cwd) {
   const scope = captureProjectScope(cwd ?? getProjectRoot(), worktreeScope.getStore());
   return worktreeScope.run(scope, async () => {
@@ -41769,8 +42460,9 @@ async function getActiveSession(cwd) {
 function splitTerminalKeys(keys) {
   return {
     provider: keys.find((k) => k.kind === "provider"),
-    pane: keys.find((k) => k.kind === "multiplexer"),
-    tab: keys.find((k) => k.kind === "terminal" || k.kind === "ppid")
+    // A harness / CLEO_AGENT_ID agent (T12864) is more specific than a pane.
+    pane: keys.find((k) => k.kind === "harness") ?? keys.find((k) => k.kind === "multiplexer"),
+    tab: keys.find((k) => k.kind === "terminal" || k.kind === "process" || k.kind === "ppid")
   };
 }
 async function readBinding(db, key) {
@@ -41850,6 +42542,7 @@ async function resolveCurrentSession(cwd) {
 async function resolveBoundSession(cwd) {
   const scope = captureProjectScope(cwd ?? getProjectRoot(), worktreeScope.getStore());
   return worktreeScope.run(scope, async () => {
+    if (!existsSync19(getDbPath(scope.worktreeRoot))) return null;
     const connId = getCurrentConnectionSessionId();
     if (connId) {
       const byConn = await getSession(connId, scope.worktreeRoot);
@@ -42001,7 +42694,7 @@ __export(registry_exports2, {
   updateAgentStatus: () => updateAgentStatus
 });
 import { randomBytes as randomBytes2 } from "node:crypto";
-import { and as and7, eq as eq9, inArray as inArray4, lt as lt2, sql as sql29 } from "drizzle-orm";
+import { and as and7, eq as eq9, inArray as inArray5, lt as lt2, sql as sql29 } from "drizzle-orm";
 function generateAgentId() {
   const now = /* @__PURE__ */ new Date();
   const ts = now.toISOString().replace(/[-:T]/g, "").substring(0, 14);
@@ -42090,11 +42783,11 @@ async function listAgentInstances(filters, cwd) {
   const conditions = [];
   if (filters?.status) {
     const statuses = Array.isArray(filters.status) ? filters.status : [filters.status];
-    conditions.push(inArray4(agentInstances.status, statuses));
+    conditions.push(inArray5(agentInstances.status, statuses));
   }
   if (filters?.agentType) {
     const types = Array.isArray(filters.agentType) ? filters.agentType : [filters.agentType];
-    conditions.push(inArray4(agentInstances.agentType, types));
+    conditions.push(inArray5(agentInstances.agentType, types));
   }
   if (filters?.sessionId) {
     conditions.push(eq9(agentInstances.sessionId, filters.sessionId));
@@ -42131,7 +42824,7 @@ async function checkAgentHealth(thresholdMs = 3e4, cwd) {
   const cutoff = new Date(Date.now() - thresholdMs).toISOString();
   return db.select().from(agentInstances).where(
     and7(
-      inArray4(agentInstances.status, ["active", "idle", "starting"]),
+      inArray5(agentInstances.status, ["active", "idle", "starting"]),
       lt2(agentInstances.lastHeartbeat, cutoff)
     )
   ).all();
@@ -42226,12 +42919,14 @@ var init_registry2 = __esm({
 // packages/core/src/store/sqlite-data-accessor.ts
 var sqlite_data_accessor_exports = {};
 __export(sqlite_data_accessor_exports, {
+  RENAMED_RECENT_MS: () => RENAMED_RECENT_MS,
   addTaskLabelsNative: () => addTaskLabelsNative,
   advanceTaskIdSequence: () => advanceTaskIdSequence,
   bindTaskAccessorScope: () => bindTaskAccessorScope,
   captureTaskAccessorScope: () => captureProjectScope,
   clearAcUidGraveyardNative: () => clearAcUidGraveyardNative,
   clearBirthFpNative: () => clearBirthFpNative,
+  clearReplacedTaskIdentityNative: () => clearReplacedTaskIdentityNative,
   clearRowUidNative: () => clearRowUidNative,
   createSqliteDataAccessor: () => createSqliteDataAccessor,
   deleteDisplayIdAliasNative: () => deleteDisplayIdAliasNative,
@@ -42242,6 +42937,7 @@ __export(sqlite_data_accessor_exports, {
   insertIdentityRowNative: () => insertIdentityRowNative,
   insertQuarantineNative: () => insertQuarantineNative,
   insertUidAliasNative: () => insertUidAliasNative,
+  readReplacedTaskBirthNative: () => readReplacedTaskBirthNative,
   rederiveAcIdsNative: () => rederiveAcIdsNative,
   rekeyQuarantineNative: () => rekeyQuarantineNative,
   relinkAcUidNative: () => relinkAcUidNative,
@@ -42258,7 +42954,7 @@ import {
   and as and8,
   eq as eq10,
   getTableColumns as getTableColumns2,
-  inArray as inArray5,
+  inArray as inArray6,
   isNull as isNull4,
   like as like2,
   lte as lte3,
@@ -42282,8 +42978,8 @@ async function selectAcBindings(db, acIds) {
     bindingType: b.bindingType,
     createdAt: b.createdAt
   };
-  const byUid = await db.select(columns).from(b).innerJoin(ac, eq10(ac.uid, b.acUid)).where(inArray5(ac.id, ids)).all();
-  const byId = await db.select(columns).from(b).leftJoin(ac, eq10(ac.uid, b.acUid)).where(inArray5(b.acId, ids)).all();
+  const byUid = await db.select(columns).from(b).innerJoin(ac, eq10(ac.uid, b.acUid)).where(inArray6(ac.id, ids)).all();
+  const byId = await db.select(columns).from(b).leftJoin(ac, eq10(ac.uid, b.acUid)).where(inArray6(b.acId, ids)).all();
   const rows = [...byUid, ...byId];
   const wanted = new Set(ids);
   const seen = /* @__PURE__ */ new Set();
@@ -42376,6 +43072,7 @@ function renameTaskDisplayIdNative(nativeDb, uid, toId, refs, guard = {}) {
   if (Number(changed) !== 1) {
     throw taskConflictError(current.id, taskVersion(current), null);
   }
+  recordLocalRename(nativeDb, uid, current.id, toId, taskVersion(current));
   const rewritten = {};
   const q2 = (name2) => `"${name2.replaceAll('"', '""')}"`;
   for (const ref of refs) {
@@ -42431,23 +43128,39 @@ function rederiveAcIdsNative(nativeDb, fromId, toId) {
   }
   return count;
 }
-function insertDisplayIdAliasNative(nativeDb, row) {
+function insertDisplayIdAliasNative(nativeDb, row, precedes) {
+  const stored = nativeDb.prepare(
+    `SELECT uid, entity_table AS entityTable, display_id AS displayId, entity_uid AS entityUid,
+              reason, origin, displaced_hlc AS displacedHlc, created_at AS createdAt,
+              entity_birth_fp AS entityBirthFp
+         FROM tasks_display_id_aliases WHERE uid = ?`
+  ).get(row.uid);
+  if (!stored) {
+    nativeDb.prepare(
+      `INSERT INTO tasks_display_id_aliases
+           (uid, entity_table, display_id, entity_uid, reason, origin, displaced_hlc, created_at,
+            entity_birth_fp)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`
+    ).run(
+      row.uid,
+      row.entityTable,
+      row.displayId,
+      row.entityUid,
+      row.reason,
+      row.origin,
+      row.displacedHlc,
+      row.createdAt,
+      row.entityBirthFp
+    );
+    return;
+  }
+  if (!precedes(row, stored)) return;
   nativeDb.prepare(
-    `INSERT OR IGNORE INTO tasks_display_id_aliases
-         (uid, entity_table, display_id, entity_uid, reason, origin, displaced_hlc, created_at,
-          entity_birth_fp)
-       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`
-  ).run(
-    row.uid,
-    row.entityTable,
-    row.displayId,
-    row.entityUid,
-    row.reason,
-    row.origin,
-    row.displacedHlc,
-    row.createdAt,
-    row.entityBirthFp
-  );
+    `UPDATE tasks_display_id_aliases
+          SET origin = ?, displaced_hlc = ?, created_at = ?,
+              entity_birth_fp = coalesce(entity_birth_fp, ?)
+        WHERE uid = ?`
+  ).run(row.origin, row.displacedHlc, row.createdAt, row.entityBirthFp, row.uid);
 }
 function deleteDisplayIdAliasNative(nativeDb, uid) {
   nativeDb.prepare("DELETE FROM tasks_display_id_aliases WHERE uid = ?").run(uid);
@@ -42509,6 +43222,63 @@ function relinkAcUidNative(nativeDb, acId, uid, birthFp) {
 function clearAcUidGraveyardNative(nativeDb) {
   nativeDb.exec("DELETE FROM tasks_ac_uid_graveyard");
 }
+function readReplacedTaskBirthNative(nativeDb, taskId) {
+  return nativeDb.prepare("SELECT created_at AS createdAt, uid FROM tasks_tasks WHERE id = ?").get(taskId);
+}
+function clearReplacedTaskIdentityNative(nativeDb, taskId, before) {
+  const row = nativeDb.prepare("SELECT uid, birth_fp AS fp, created_at AS createdAt FROM tasks_tasks WHERE id = ?").get(taskId);
+  if (!row || row.uid === null && row.fp === null) return;
+  if (before) {
+    const was = parseStoreTimestamp(before.createdAt);
+    if (was !== null && was === parseStoreTimestamp(row.createdAt)) {
+      return;
+    }
+  }
+  if (rowIdentityShared(nativeDb)) {
+    throw new CleoError(
+      6 /* VALIDATION_ERROR */,
+      `Task ${taskId} cannot be overwritten by an import: its identity is shared with other devices`,
+      {
+        fix: "Import it under a new id (the default duplicate strategy), or edit the task instead of overwriting it.",
+        details: { field: "taskId", actual: taskId }
+      }
+    );
+  }
+  const has = (table) => nativeDb.prepare("SELECT 1 AS x FROM sqlite_master WHERE type = 'table' AND name = ?").get(table) !== void 0;
+  nativeDb.prepare("UPDATE tasks_tasks SET uid = NULL, birth_fp = NULL WHERE id = ?").run(taskId);
+  for (const spec of ROW_IDENTITY.project) {
+    if (spec.kind !== "natural" || !has(spec.table)) continue;
+    const cols = (spec.keyRefs ?? []).filter((r) => r.table === "tasks_tasks").map((r) => r.column);
+    if (cols.length === 0) continue;
+    nativeDb.prepare(
+      `UPDATE main.${quoteIdent2(spec.table)} SET uid = NULL WHERE ${cols.map((c) => `${quoteIdent2(c)} = ?`).join(" OR ")}`
+    ).run(...cols.map(() => taskId));
+  }
+  const children = ["tasks_task_acceptance_criteria_history", "tasks_evidence_ac_bindings"].filter(
+    has
+  );
+  const criteria = has("tasks_task_acceptance_criteria") ? nativeDb.prepare("SELECT id, uid FROM tasks_task_acceptance_criteria WHERE task_id = ?").all(taskId) : [];
+  if (criteria.length > 0) {
+    nativeDb.prepare(
+      "UPDATE tasks_task_acceptance_criteria SET uid = NULL, birth_fp = NULL WHERE task_id = ?"
+    ).run(taskId);
+  }
+  fillRowUids(nativeDb, "project");
+  const newUid = nativeDb.prepare("SELECT uid FROM tasks_task_acceptance_criteria WHERE id = ?");
+  let rekeyed = 0;
+  for (const ac of criteria) {
+    const now = newUid.get(ac.id)?.uid ?? null;
+    for (const table of children) {
+      rekeyed += Number(
+        nativeDb.prepare(
+          `UPDATE main.${quoteIdent2(table)} SET ac_uid = ?, birth_fp = NULL
+              WHERE ac_id = ? OR (? IS NOT NULL AND ac_uid = ?)`
+        ).run(now, ac.id, ac.uid, ac.uid).changes
+      );
+    }
+  }
+  if (rekeyed > 0) fillRowUids(nativeDb, "project");
+}
 function quoteIdent2(name2) {
   return `"${name2.replaceAll('"', '""')}"`;
 }
@@ -42596,10 +43366,50 @@ function claimPredicate(guard, allowedHolders) {
   if (guard.mode === "force") return void 0;
   const mine = guard.sessionId === null ? void 0 : eq10(holder, guard.sessionId);
   if (guard.mode === "renew" || guard.mode === "release") return mine ?? sql30`0`;
-  const related = allowedHolders.length > 0 ? inArray5(holder, [...allowedHolders]) : void 0;
+  const related = allowedHolders.length > 0 ? inArray6(holder, [...allowedHolders]) : void 0;
   const expired = guard.mode === "take-over" ? or5(isNull4(tasksTasks.leaseExpiresAt), lte3(tasksTasks.leaseExpiresAt, guard.now)) : void 0;
   return or5(isNull4(holder), mine, related, expired);
 }
+function renameRecordKey(fromId) {
+  return `renamed_from:tasks_tasks:${fromId}`;
+}
+function hasIdentityMeta(nativeDb) {
+  return nativeDb.prepare(
+    "SELECT 1 AS x FROM sqlite_master WHERE type = 'table' AND name = 'tasks_row_identity_meta'"
+  ).get() !== void 0;
+}
+function recordLocalRename(nativeDb, uid, fromId, toId, fromVersion) {
+  if (!hasIdentityMeta(nativeDb)) return;
+  const record = { uid, fromVersion, toId, at: (/* @__PURE__ */ new Date()).toISOString() };
+  writeRowIdentityMetaNative(nativeDb, renameRecordKey(fromId), JSON.stringify(record));
+}
+function assertNotRenamed(nativeDb, taskId, guard, current) {
+  if (!nativeDb || !hasIdentityMeta(nativeDb)) return;
+  const raw = nativeDb.prepare("SELECT value FROM tasks_row_identity_meta WHERE key = ?").get(renameRecordKey(taskId));
+  if (!raw) return;
+  let record;
+  try {
+    record = JSON.parse(raw.value);
+  } catch {
+    return;
+  }
+  if (Date.now() - Date.parse(record.at) > RENAMED_RECENT_MS) return;
+  const renamed = nativeDb.prepare("SELECT id, claimed_by_session AS claimedBySession FROM tasks_tasks WHERE uid = ?").get(record.uid);
+  if (!renamed || renamed.id === taskId) return;
+  const expected = guard.expectedUpdatedAt;
+  const session = guard.claim?.sessionId ?? null;
+  const holdsRenamedClaim = session !== null && (guard.claim?.mode === "renew" || guard.claim?.mode === "release") && renamed.claimedBySession === session && current?.claimedBySession !== session;
+  const readRenamed = expected !== void 0 && expected === record.fromVersion && (current === void 0 || taskVersion(current) !== expected);
+  if (!(current === void 0 || holdsRenamedClaim || readRenamed)) return;
+  throw new CleoError(
+    26 /* TASK_RENAMED */,
+    `Task ${taskId} is now ${renamed.id}: sync re-numbered it after a display-id collision, and ${taskId} ${current ? "names another task" : "names no task"}; nothing was written`,
+    {
+      fix: `Re-read it with 'cleo show ${renamed.id}' and retry against ${renamed.id}.`,
+      details: { field: "taskId", actual: taskId, expected: renamed.id }
+    }
+  );
+}
 function assertClaimAllowed(taskId, row, guard, allowedHolders) {
   const stored = claimFromColumns(row);
   if (claimAllows(stored, guard.mode, guard.sessionId, guard.now, allowedHolders)) return;
@@ -42774,13 +43584,13 @@ async function createOwnedSqliteDataAccessor(cwd, accessorScope) {
       const db = await getDb(cwd);
       const conditions = [];
       if (query.ids && query.ids.length > 0) {
-        conditions.push(inArray5(tasksAuditLog.id, [...query.ids]));
+        conditions.push(inArray6(tasksAuditLog.id, [...query.ids]));
       }
       if (query.taskIds && query.taskIds.length > 0) {
-        conditions.push(inArray5(tasksAuditLog.taskId, [...query.taskIds]));
+        conditions.push(inArray6(tasksAuditLog.taskId, [...query.taskIds]));
       }
       if (query.actions && query.actions.length > 0) {
-        conditions.push(inArray5(tasksAuditLog.action, [...query.actions]));
+        conditions.push(inArray6(tasksAuditLog.action, [...query.actions]));
       }
       if (query.since) {
         conditions.push(sql30`${tasksAuditLog.timestamp} >= ${query.since}`);
@@ -42813,8 +43623,13 @@ async function createOwnedSqliteDataAccessor(cwd, accessorScope) {
     async upsertSingleTask(task) {
       await accessor.transaction((tx) => tx.upsertSingleTask(task));
     },
-    async insertNewTask(task) {
-      await accessor.transaction((tx) => tx.insertNewTask(task));
+    async insertNewTask(task, identity) {
+      await accessor.transaction((tx) => tx.insertNewTask(task, identity));
+    },
+    async getTaskIdentities(taskIds) {
+      if (taskIds.length === 0) return [];
+      const db = await getDb(cwd);
+      return db.select({ id: tasksTasks.id, uid: tasksTasks.uid, birthFp: tasksTasks.birthFp }).from(tasksTasks).where(inArray6(tasksTasks.id, taskIds)).all();
     },
     async addRelation(taskId, relatedTo, relationType, reason) {
       return accessor.transaction(async () => {
@@ -42991,7 +43806,7 @@ async function createOwnedSqliteDataAccessor(cwd, accessorScope) {
         if (!statuses.includes("archived")) {
           conditions.push(ne2(tasksTasks.status, "archived"));
         }
-        conditions.push(inArray5(tasksTasks.status, statuses));
+        conditions.push(inArray6(tasksTasks.status, statuses));
       } else if (filters.excludeStatus) {
         const excluded = Array.isArray(filters.excludeStatus) ? filters.excludeStatus : [filters.excludeStatus];
         for (const s of excluded) {
@@ -43005,11 +43820,11 @@ async function createOwnedSqliteDataAccessor(cwd, accessorScope) {
       if (filters.phase) conditions.push(eq10(tasksTasks.phase, filters.phase));
       if (filters.severity) {
         const severities = Array.isArray(filters.severity) ? filters.severity : [filters.severity];
-        conditions.push(inArray5(tasksTasks.severity, severities));
+        conditions.push(inArray6(tasksTasks.severity, severities));
       }
       if (filters.kind) {
         const kinds = Array.isArray(filters.kind) ? filters.kind : [filters.kind];
-        conditions.push(inArray5(tasksTasks.kind, kinds));
+        conditions.push(inArray6(tasksTasks.kind, kinds));
       }
       if (filters.parentId !== void 0) {
         if (filters.parentId === null) {
@@ -43030,7 +43845,7 @@ async function createOwnedSqliteDataAccessor(cwd, accessorScope) {
       }
       if (filters.label) {
         const labelMatchIds = db.select({ taskId: tasksTaskLabels.taskId }).from(tasksTaskLabels).where(eq10(tasksTaskLabels.label, filters.label));
-        conditions.push(inArray5(tasksTasks.id, labelMatchIds));
+        conditions.push(inArray6(tasksTasks.id, labelMatchIds));
       }
       const where = conditions.length > 0 ? and8(...conditions) : void 0;
       const countResult = await db.select({ count: sql30`count(*)` }).from(tasksTasks).where(where).get();
@@ -43073,7 +43888,7 @@ async function createOwnedSqliteDataAccessor(cwd, accessorScope) {
       const conditions = [];
       if (filters?.status) {
         const statuses = Array.isArray(filters.status) ? filters.status : [filters.status];
-        conditions.push(inArray5(tasksTasks.status, statuses));
+        conditions.push(inArray6(tasksTasks.status, statuses));
       } else {
         conditions.push(ne2(tasksTasks.status, "archived"));
       }
@@ -43138,7 +43953,7 @@ async function createOwnedSqliteDataAccessor(cwd, accessorScope) {
       if (idRows.length === 0) return [];
       const db = await getDb(cwd);
       const ids = idRows.map((r) => r.id);
-      const taskRows = await db.select().from(tasksTasks).where(inArray5(tasksTasks.id, ids)).all();
+      const taskRows = await db.select().from(tasksTasks).where(inArray6(tasksTasks.id, ids)).all();
       const tasks2 = taskRows.map(rowToTask);
       if (tasks2.length > 0) {
         const allIds = await getAllTaskIds();
@@ -43167,7 +43982,7 @@ async function createOwnedSqliteDataAccessor(cwd, accessorScope) {
       if (idRows.length === 0) return [];
       const db = await getDb(cwd);
       const ids = idRows.map((r) => r.id);
-      const rows = await db.select().from(tasksTasks).where(inArray5(tasksTasks.id, ids)).all();
+      const rows = await db.select().from(tasksTasks).where(inArray6(tasksTasks.id, ids)).all();
       const tasks2 = rows.map(rowToTask);
       if (tasks2.length > 0) {
         const allIds = await getAllTaskIds();
@@ -43181,7 +43996,7 @@ async function createOwnedSqliteDataAccessor(cwd, accessorScope) {
       const depRows = await db.select().from(tasksTaskDependencies).where(eq10(tasksTaskDependencies.dependsOn, taskId)).all();
       if (depRows.length === 0) return [];
       const dependentIds = depRows.map((r) => r.taskId);
-      const rows = await db.select().from(tasksTasks).where(inArray5(tasksTasks.id, dependentIds)).all();
+      const rows = await db.select().from(tasksTasks).where(inArray6(tasksTasks.id, dependentIds)).all();
       const tasks2 = rows.map(rowToTask);
       if (tasks2.length > 0) {
         const allIds = await getAllTaskIds();
@@ -43211,7 +44026,7 @@ async function createOwnedSqliteDataAccessor(cwd, accessorScope) {
     async loadTasks(taskIds) {
       if (taskIds.length === 0) return [];
       const db = await getDb(cwd);
-      const rows = await db.select().from(tasksTasks).where(inArray5(tasksTasks.id, taskIds)).all();
+      const rows = await db.select().from(tasksTasks).where(inArray6(tasksTasks.id, taskIds)).all();
       const tasks2 = rows.map(rowToTask);
       if (tasks2.length > 0) {
         const allIds = await getAllTaskIds();
@@ -43265,6 +44080,9 @@ async function createOwnedSqliteDataAccessor(cwd, accessorScope) {
           createdAt: tasksTasks.createdAt,
           ...CLAIM_COLUMNS
         }).from(tasksTasks).where(eq10(tasksTasks.id, taskId)).limit(1).all();
+        if (guard?.claim || guard?.expectedUpdatedAt !== void 0) {
+          assertNotRenamed(getNativeTasksDb(cwd), taskId, guard, current);
+        }
         if (!current) throw new Error(`Task not found: ${taskId}`);
         const claimGuard = guard?.claim;
         const allowedHolders = claimGuard ? await claimAllowedHolders(db, claimGuard) : [];
@@ -43342,24 +44160,37 @@ async function createOwnedSqliteDataAccessor(cwd, accessorScope) {
               nativeDb.prepare(`SAVEPOINT ${spName}`).run();
             }
             try {
+              const replacedBirths = /* @__PURE__ */ new Map();
               const tx = {
                 async upsertSingleTask(task) {
                   scope.assertActive();
                   return accessor.transaction(async () => {
                     scope.assertActive();
+                    if (rowUidFillEnabled() && !replacedBirths.has(task.id)) {
+                      const before = readReplacedTaskBirthNative(nativeDb, task.id);
+                      if (before) replacedBirths.set(task.id, before);
+                    }
                     const row = taskToRow(task);
                     await upsertTask(db, row);
                     await updateDependencies(db, task.id, task.depends ?? []);
                   });
                 },
-                async insertNewTask(task) {
+                async insertNewTask(task, identity) {
                   scope.assertActive();
                   return accessor.transaction(async () => {
                     scope.assertActive();
-                    await insertNewTask(db, taskToRow(task));
+                    await insertNewTask(db, taskToRow(task), identity);
                     await updateDependencies(db, task.id, task.depends ?? []);
                   });
                 },
+                async clearTaskIdentity(taskId) {
+                  scope.assertActive();
+                  if (!rowUidFillEnabled()) return;
+                  return accessor.transaction(async () => {
+                    scope.assertActive();
+                    clearReplacedTaskIdentityNative(nativeDb, taskId, replacedBirths.get(taskId));
+                  });
+                },
                 async archiveSingleTask(taskId, fields) {
                   scope.assertActive();
                   return accessor.transaction(async () => {
@@ -43506,7 +44337,7 @@ async function createOwnedSqliteDataAccessor(cwd, accessorScope) {
                     const owned = await db.select({ id: tasksTaskAcceptanceCriteria.id }).from(tasksTaskAcceptanceCriteria).where(
                       and8(
                         eq10(tasksTaskAcceptanceCriteria.taskId, taskId),
-                        inArray5(tasksTaskAcceptanceCriteria.id, ids)
+                        inArray6(tasksTaskAcceptanceCriteria.id, ids)
                       )
                     ).all();
                     await pruneAcBindingsForAcIds(
@@ -43519,7 +44350,7 @@ async function createOwnedSqliteDataAccessor(cwd, accessorScope) {
                     await db.delete(tasksTaskAcceptanceCriteria).where(
                       and8(
                         eq10(tasksTaskAcceptanceCriteria.taskId, taskId),
-                        inArray5(tasksTaskAcceptanceCriteria.id, ids)
+                        inArray6(tasksTaskAcceptanceCriteria.id, ids)
                       )
                     ).run();
                   });
@@ -43778,7 +44609,7 @@ async function createOwnedSqliteDataAccessor(cwd, accessorScope) {
   };
   return accessor;
 }
-var _txSavepointCounter, taskTransactionQueue, TaskTransactionScope, taskTransactionContext, CLAIM_COLUMNS;
+var _txSavepointCounter, taskTransactionQueue, TaskTransactionScope, taskTransactionContext, CLAIM_COLUMNS, RENAMED_RECENT_MS;
 var init_sqlite_data_accessor = __esm({
   "packages/core/src/store/sqlite-data-accessor.ts"() {
     "use strict";
@@ -43792,6 +44623,8 @@ var init_sqlite_data_accessor = __esm({
     init_cross_db_cleanup();
     init_db_helpers();
     init_row_identity();
+    init_row_identity_flag();
+    init_row_identity_registry();
     init_audit2();
     init_session_store();
     init_sqlite3();
@@ -43824,6 +44657,7 @@ var init_sqlite_data_accessor = __esm({
       claimedAt: tasksTasks.claimedAt,
       leaseExpiresAt: tasksTasks.leaseExpiresAt
     };
+    RENAMED_RECENT_MS = 24 * 60 * 60 * 1e3;
     registerRowIdentityWriters({
       relinkAcUidNative,
       clearAcUidGraveyardNative,
@@ -44294,7 +45128,7 @@ __export(governor_exports, {
   resolveGovernorMode: () => resolveGovernorMode,
   slotFileCount: () => slotFileCount
 });
-import { existsSync as existsSync19, mkdirSync as mkdirSync6, readdirSync as readdirSync5, writeFileSync as writeFileSync5 } from "node:fs";
+import { existsSync as existsSync20, mkdirSync as mkdirSync6, readdirSync as readdirSync5, writeFileSync as writeFileSync5 } from "node:fs";
 import { availableParallelism, totalmem } from "node:os";
 import { join as join25 } from "node:path";
 import lockfile2 from "proper-lockfile";
@@ -44368,11 +45202,11 @@ function governorSlotDir(cls) {
   return join25(getCleoHome(), "locks", `resource-${cls}`);
 }
 function ensureSlotFiles(dir, count) {
-  if (!existsSync19(dir)) mkdirSync6(dir, { recursive: true });
+  if (!existsSync20(dir)) mkdirSync6(dir, { recursive: true });
   const paths = [];
   for (let i = 0; i < count; i++) {
     const p = join25(dir, `slot-${i}.lock`);
-    if (!existsSync19(p)) writeFileSync5(p, "", { flag: "a" });
+    if (!existsSync20(p)) writeFileSync5(p, "", { flag: "a" });
     paths.push(p);
   }
   return paths;
@@ -44412,7 +45246,7 @@ function shuffledIndices(n) {
 }
 async function countHeldSlots(cls, budget) {
   const dir = governorSlotDir(cls);
-  if (!existsSync19(dir)) return 0;
+  if (!existsSync20(dir)) return 0;
   const slots = ensureSlotFiles(dir, budget);
   let held = 0;
   for (const path2 of slots) {
@@ -44427,7 +45261,7 @@ async function countHeldSlots(cls, budget) {
 }
 function slotFileCount(cls) {
   const dir = governorSlotDir(cls);
-  if (!existsSync19(dir)) return 0;
+  if (!existsSync20(dir)) return 0;
   return readdirSync5(dir).filter((f) => f.startsWith("slot-") && f.endsWith(".lock")).length;
 }
 var _log2, _cachedMode2, _supervisorDegradeLogged, MB, STALE_MS, _supervisorHolderSeq, ResourceGovernor, governor;
@@ -44578,7 +45412,7 @@ var init_governor = __esm({
 // packages/core/src/store/exodus/recovery.ts
 import { randomUUID as randomUUID2 } from "node:crypto";
 import { constants } from "node:sqlite";
-import { z as z29 } from "zod";
+import { z as z30 } from "zod";
 function identityValues(encoded) {
   return identitySchema.parse(JSON.parse(encoded)).map(([kind, value]) => {
     if (kind === "null") return null;
@@ -44914,8 +45748,8 @@ var init_recovery = __esm({
     "use strict";
     init_row_identity_registry();
     RECEIPTS = "_exodus_recovery_rows";
-    identitySchema = z29.array(
-      z29.tuple([z29.enum(["null", "integer", "real", "text", "blob"]), z29.string()])
+    identitySchema = z30.array(
+      z30.tuple([z30.enum(["null", "integer", "real", "text", "blob"]), z30.string()])
     );
     ExodusRecoveryError = class extends Error {
     };
@@ -44925,7 +45759,7 @@ var init_recovery = __esm({
 // packages/core/src/store/exodus/archive.ts
 import {
   copyFileSync as copyFileSync5,
-  existsSync as existsSync20,
+  existsSync as existsSync21,
   mkdirSync as mkdirSync7,
   readFileSync as readFileSync8,
   renameSync as renameSync7,
@@ -44933,7 +45767,7 @@ import {
   writeFileSync as writeFileSync6
 } from "node:fs";
 import { basename as basename9, dirname as dirname19, join as join26, resolve as resolve12 } from "node:path";
-import { z as z30 } from "zod";
+import { z as z31 } from "zod";
 function scopeBaseDir(scope, cwd, targetDbPath) {
   if (targetDbPath !== void 0) return dirname19(targetDbPath);
   return scope === "project" ? resolveCleoDir(cwd) : getCleoHome();
@@ -44953,7 +45787,7 @@ function hasExodusCompleteMarker(scope, cwd, targetDbPath, nativeDb) {
     if (targetDbPath) throw error;
     return false;
   }
-  if (!existsSync20(markerPath)) return false;
+  if (!existsSync21(markerPath)) return false;
   const marker = markerIdentity.parse(JSON.parse(readFileSync8(markerPath, "utf8")));
   if (nativeDb && (!marker.databaseIdentity || !hasExodusDatabaseIdentity(nativeDb, marker.databaseIdentity)))
     throw new Error(
@@ -44983,7 +45817,7 @@ function writeExodusCompleteMarker(scope, archivedSources, cwd, targetDbPath, da
 function moveFileInto(srcPath, destDir) {
   mkdirSync7(destDir, { recursive: true });
   let dest = join26(destDir, basename9(srcPath));
-  if (existsSync20(dest)) {
+  if (existsSync21(dest)) {
     const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "").replace(/Z$/, "Z");
     dest = join26(destDir, `${basename9(srcPath)}.${stamp}`);
   }
@@ -44996,14 +45830,14 @@ function moveFileInto(srcPath, destDir) {
   return dest;
 }
 function archiveSourceDb(source, cwd, targetDbPath) {
-  if (!existsSync20(source.path)) {
+  if (!existsSync21(source.path)) {
     return { name: source.name, sourcePath: source.path, archivedTo: null, action: "absent" };
   }
   const destDir = exodusArchiveDir(source.targetScope, cwd, targetDbPath);
   const archivedTo = moveFileInto(source.path, destDir);
   for (const suffix of SIDECAR_SUFFIXES) {
     const sidecar = `${source.path}${suffix}`;
-    if (existsSync20(sidecar)) {
+    if (existsSync21(sidecar)) {
       try {
         moveFileInto(sidecar, destDir);
       } catch (err) {
@@ -45051,7 +45885,7 @@ function detectStrandedResidue(sources, cwd) {
   const stranded = [];
   for (const source of sources) {
     if (!markedScopes.has(source.targetScope)) continue;
-    if (existsSync20(source.path)) {
+    if (existsSync21(source.path)) {
       stranded.push({ name: source.name, path: source.path, scope: source.targetScope });
     }
   }
@@ -45076,11 +45910,11 @@ var init_archive2 = __esm({
     init_ensure_config();
     init_recovery();
     log8 = getLogger("exodus-archive");
-    markerIdentity = z30.object({
-      version: z30.literal(1),
-      scope: z30.enum(["project", "global"]),
-      targetDbPath: z30.string().optional(),
-      databaseIdentity: z30.string().optional()
+    markerIdentity = z31.object({
+      version: z31.literal(1),
+      scope: z31.enum(["project", "global"]),
+      targetDbPath: z31.string().optional(),
+      databaseIdentity: z31.string().optional()
     });
     ARCHIVE_DIR_NAME = "_archive";
     MARKER_FILENAME_BY_SCOPE = {
@@ -45092,13 +45926,13 @@ var init_archive2 = __esm({
 });
 
 // packages/core/src/store/exodus/count-parity.ts
-import { existsSync as existsSync21 } from "node:fs";
+import { existsSync as existsSync22 } from "node:fs";
 function listTables2(db) {
   return db.prepare(
     "SELECT name FROM sqlite_master WHERE type='table' AND name NOT LIKE 'sqlite_%' AND name NOT LIKE '__drizzle_%' ORDER BY name"
   ).all().map((r) => r.name);
 }
-function tableExists2(db, tableName) {
+function tableExists3(db, tableName) {
   const escaped = tableName.replace(/'/g, "''");
   return db.prepare(`SELECT 1 FROM sqlite_master WHERE type='table' AND name='${escaped}'`).get() !== void 0;
 }
@@ -45113,14 +45947,14 @@ function rowCount(db, tableName) {
 function computeCountParity(sources, projectDbPath, globalDbPath) {
   const entries = [];
   let skipped = 0;
-  if (!existsSync21(projectDbPath) || !existsSync21(globalDbPath)) {
+  if (!existsSync22(projectDbPath) || !existsSync22(globalDbPath)) {
     return { ok: false, entries: [], deficits: [], checked: 0, skipped: 0 };
   }
   const projectSnap = openCleoDbSnapshot(projectDbPath, { readOnly: true });
   const globalSnap = openCleoDbSnapshot(globalDbPath, { readOnly: true });
   try {
     for (const src of sources) {
-      if (!existsSync21(src.path)) continue;
+      if (!existsSync22(src.path)) continue;
       const srcSnap = openCleoDbSnapshot(src.path, { readOnly: true });
       try {
         for (const legacyTable of listTables2(srcSnap.db)) {
@@ -45137,7 +45971,7 @@ function computeCountParity(sources, projectDbPath, globalDbPath) {
             skipped++;
             continue;
           }
-          const targetCount = tableExists2(targetSnap.db, targetTable) ? rowCount(targetSnap.db, targetTable) ?? 0 : 0;
+          const targetCount = tableExists3(targetSnap.db, targetTable) ? rowCount(targetSnap.db, targetTable) ?? 0 : 0;
           const deficit = targetCount < sourceCount ? sourceCount - targetCount : 0;
           entries.push({
             sourceDb: src.name,
@@ -45178,7 +46012,7 @@ var init_count_parity = __esm({
 });
 
 // packages/core/src/store/exodus/plan.ts
-import { existsSync as existsSync22, readdirSync as readdirSync6, statfsSync as statfsSync2, statSync as statSync6 } from "node:fs";
+import { existsSync as existsSync23, readdirSync as readdirSync6, statfsSync as statfsSync2, statSync as statSync6 } from "node:fs";
 import { join as join27 } from "node:path";
 function computeRequiredBytes(totalSourceBytes, largestSourceBytes) {
   return Math.ceil(STAGING_HEADROOM_FACTOR * largestSourceBytes) + totalSourceBytes;
@@ -45280,7 +46114,7 @@ function buildExodusPlan(cwd) {
   };
 }
 function sourcesPresent(sources) {
-  return sources.some((s) => existsSync22(s.path));
+  return sources.some((s) => existsSync23(s.path));
 }
 var STAGING_HEADROOM_FACTOR, STAGING_COPY_SKIP_THRESHOLD_BYTES;
 var init_plan2 = __esm({
@@ -45294,18 +46128,18 @@ var init_plan2 = __esm({
 });
 
 // packages/core/src/store/exodus/health.ts
-import { existsSync as existsSync23, statSync as statSync7 } from "node:fs";
+import { existsSync as existsSync24, statSync as statSync7 } from "node:fs";
 function buildExodusHealth(cwd) {
   const plan = buildExodusPlan(cwd);
-  const anyLegacyPresent = plan.sources.some((s) => existsSync23(s.path));
+  const anyLegacyPresent = plan.sources.some((s) => existsSync24(s.path));
   const parity = anyLegacyPresent ? computeCountParity(plan.sources, plan.projectDbPath, plan.globalDbPath) : { ok: true, entries: [], deficits: [], checked: 0, skipped: 0 };
   const consolidatedExistsByScope = {
-    project: existsSync23(plan.projectDbPath),
-    global: existsSync23(plan.globalDbPath)
+    project: existsSync24(plan.projectDbPath),
+    global: existsSync24(plan.globalDbPath)
   };
   const buildScope = (scope) => {
     const sources = plan.sources.filter((s) => s.targetScope === scope).map((s) => {
-      const present = existsSync23(s.path);
+      const present = existsSync24(s.path);
       let bytes = 0;
       if (present) {
         try {
@@ -45410,7 +46244,7 @@ var init_types = __esm({
 // packages/core/src/store/exodus/migrate.ts
 import {
   copyFileSync as copyFileSync6,
-  existsSync as existsSync24,
+  existsSync as existsSync25,
   mkdirSync as mkdirSync8,
   readFileSync as readFileSync9,
   renameSync as renameSync8,
@@ -45456,7 +46290,7 @@ function writeJournal(stagingDir, journal) {
 }
 function readJournal(stagingDir) {
   const journalPath = join28(stagingDir, JOURNAL_FILENAME);
-  if (!existsSync24(journalPath)) return null;
+  if (!existsSync25(journalPath)) return null;
   try {
     return JSON.parse(readFileSync9(journalPath, "utf8"));
   } catch {
@@ -45466,7 +46300,7 @@ function readJournal(stagingDir) {
 function clearExodusJournal(stagingDir) {
   const journalPath = join28(stagingDir, JOURNAL_FILENAME);
   try {
-    if (!existsSync24(journalPath)) return false;
+    if (!existsSync25(journalPath)) return false;
     unlinkSync5(journalPath);
     log10.info(
       { stagingDir },
@@ -45762,7 +46596,7 @@ async function runExodusMigrate(plan, forceCrossVersion = false, onProgress, opt
   mkdirSync8(stagingDir, { recursive: true });
   let sqliteVersion = "unknown";
   for (const src of sources) {
-    if (existsSync24(src.path)) {
+    if (existsSync25(src.path)) {
       const snap = openCleoDbSnapshot(src.path, { readOnly: true });
       sqliteVersion = getSqliteVersion(snap.db);
       snap.close();
@@ -45792,7 +46626,7 @@ async function runExodusMigrate(plan, forceCrossVersion = false, onProgress, opt
   let reseedProject = null;
   try {
     for (const src of sources) {
-      if (!existsSync24(src.path)) continue;
+      if (!existsSync25(src.path)) continue;
       const backupDest = join28(stagingDir, `${src.name.replace(/[^a-z0-9-]/g, "_")}-backup.db`);
       const srcBytes = safeStatBytes(src.path);
       const skipStagingCopy = srcBytes > plan.stagingCopyThresholdBytes;
@@ -45800,7 +46634,7 @@ async function runExodusMigrate(plan, forceCrossVersion = false, onProgress, opt
         onProgress?.(
           `Skipping full staging copy of ${src.name} (${srcBytes} bytes > ${plan.stagingCopyThresholdBytes} threshold) \u2014 source is archived, not deleted, on success.`
         );
-      } else if (!existsSync24(backupDest)) {
+      } else if (!existsSync25(backupDest)) {
         onProgress?.(`Backing up ${src.name} \u2192 staging dir\u2026`);
         copyFileSync6(src.path, backupDest);
         backupPaths.push(backupDest);
@@ -45833,8 +46667,8 @@ async function runExodusMigrate(plan, forceCrossVersion = false, onProgress, opt
     }
     prepareExodusRecovery(projectNative, stagingDir);
     if (globalNative !== null) prepareExodusRecovery(globalNative, stagingDir);
-    const projectSources = sources.filter((s) => s.targetScope === "project" && existsSync24(s.path));
-    const globalSources = sources.filter((s) => s.targetScope === "global" && existsSync24(s.path));
+    const projectSources = sources.filter((s) => s.targetScope === "project" && existsSync25(s.path));
+    const globalSources = sources.filter((s) => s.targetScope === "global" && existsSync25(s.path));
     if (globalNative === null && globalSources.length > 0)
       throw new Error("A projectOnly exodus run was given global-scope sources");
     await migrateScope(
@@ -46083,7 +46917,8 @@ var init_migrate = __esm({
     GRANDFATHERED_GUARD_TRIGGERS = [
       "tasks_tasks_parent_type_matrix_insert",
       "tasks_task_relations_non_containment_insert",
-      "tasks_task_acceptance_child_target_insert"
+      "tasks_task_acceptance_child_target_insert",
+      "tasks_task_dependencies_cycle_guard_insert"
     ];
     SOURCE_EPOCH_UNITS = /* @__PURE__ */ new Map([
       ["conduit", "seconds"],
@@ -46142,7 +46977,7 @@ __export(reconcile_exports, {
   reconcileSupersededStores: () => reconcileSupersededStores,
   unmigratedBareSources: () => unmigratedBareSources
 });
-import { copyFileSync as copyFileSync7, existsSync as existsSync25, mkdirSync as mkdirSync9, mkdtempSync, rmSync as rmSync3, writeFileSync as writeFileSync8 } from "node:fs";
+import { copyFileSync as copyFileSync7, existsSync as existsSync26, mkdirSync as mkdirSync9, mkdtempSync, rmSync as rmSync3, writeFileSync as writeFileSync8 } from "node:fs";
 import { tmpdir as tmpdir4 } from "node:os";
 import { basename as basename10, join as join29 } from "node:path";
 function ident2(name2) {
@@ -46213,7 +47048,7 @@ function assessSupersededProjectStores(liveStorePath, sources, resolveTarget = r
 }
 function legacySourcesHoldRows(sources) {
   for (const src of sources) {
-    if (!existsSync25(src.path)) continue;
+    if (!existsSync26(src.path)) continue;
     const snap = openCleoDbSnapshot(src.path, { readOnly: true });
     try {
       for (const table of orderTablesForCopy(snap.db)) {
@@ -46461,8 +47296,8 @@ async function reconcileSuppressed(projectRoot, options, liveStorePath) {
   }
 }
 async function reconcileWithScratch(projectRoot, dryRun, additive, liveStorePath, plan, resolveTarget, scratch) {
-  const fileSources = plan.sources.filter((s) => s.targetScope === "project" && existsSync25(s.path));
-  const bare = !additive && existsSync25(liveStorePath) ? await bareTaskCoreSource(liveStorePath, resolveTarget, scratch) : null;
+  const fileSources = plan.sources.filter((s) => s.targetScope === "project" && existsSync26(s.path));
+  const bare = !additive && existsSync26(liveStorePath) ? await bareTaskCoreSource(liveStorePath, resolveTarget, scratch) : null;
   const copyResolver = additive ? (sourceName, legacyTable) => {
     const r = resolveTarget(sourceName, legacyTable);
     return r.kind !== "skip" && isLiveAuthoritative(sourceName, legacyTable, r.targetName) ? { kind: "skip", reason: "additive: live-authoritative task graph" } : r;
@@ -46481,7 +47316,7 @@ async function reconcileWithScratch(projectRoot, dryRun, additive, liveStorePath
     stagingDir: null,
     receiptPath: null
   };
-  if (sources.length === 0 || !existsSync25(liveStorePath)) {
+  if (sources.length === 0 || !existsSync26(liveStorePath)) {
     return {
       ...base,
       outcome: "nothing-to-reconcile",
@@ -46673,11 +47508,11 @@ var init_seal = __esm({
 });
 
 // packages/core/src/store/exodus/status.ts
-import { existsSync as existsSync26, readdirSync as readdirSync7, readFileSync as readFileSync10, statSync as statSync9 } from "node:fs";
+import { existsSync as existsSync27, readdirSync as readdirSync7, readFileSync as readFileSync10, statSync as statSync9 } from "node:fs";
 import { join as join30 } from "node:path";
 function readJournal2(stagingDir) {
   const p = join30(stagingDir, JOURNAL_FILENAME2);
-  if (!existsSync26(p)) return null;
+  if (!existsSync27(p)) return null;
   try {
     return JSON.parse(readFileSync10(p, "utf8"));
   } catch {
@@ -46709,15 +47544,15 @@ function runExodusStatus(cwd) {
   const sourcesInfo = plan.sources.map((s) => ({
     name: s.name,
     path: s.path,
-    exists: existsSync26(s.path),
+    exists: existsSync27(s.path),
     bytes: safeBytes(s.path)
   }));
   return {
     hasStaging: latestStaging !== null,
     stagingDir: latestStaging,
     journal,
-    projectDbExists: existsSync26(projectDbPath),
-    globalDbExists: existsSync26(globalDbPath),
+    projectDbExists: existsSync27(projectDbPath),
+    globalDbExists: existsSync27(globalDbPath),
     sourcesPresent: sourcesInfo.some((s) => s.exists),
     sources: sourcesInfo
   };
@@ -46734,7 +47569,7 @@ var init_status = __esm({
 });
 
 // packages/core/src/store/exodus/verify-migration.ts
-import { existsSync as existsSync27 } from "node:fs";
+import { existsSync as existsSync28 } from "node:fs";
 import { createRequire as createRequire10 } from "node:module";
 function orderByClause(db, tableName) {
   try {
@@ -46849,7 +47684,7 @@ function listTables3(db) {
   ).all();
   return rows.map((r) => r.name);
 }
-function tableExists3(db, tableName) {
+function tableExists4(db, tableName) {
   try {
     const escaped = tableName.replace(/'/g, "''");
     return db.prepare(`SELECT 1 FROM sqlite_master WHERE type='table' AND name='${escaped}'`).get() !== void 0;
@@ -46999,10 +47834,10 @@ function orphanAlreadyInSource(targetDb, fk, sources, resolveTarget = resolveCon
     const anyFeeder = (targetTable, probe) => {
       for (const feeder of feedersOf(targetTable)) {
         const src = sources.find((s) => s.name === feeder.sourceName);
-        if (src === void 0 || !existsSync27(src.path)) continue;
+        if (src === void 0 || !existsSync28(src.path)) continue;
         const snap = openCleoDbSnapshot(src.path, { readOnly: true });
         try {
-          if (!tableExists3(snap.db, feeder.legacyTable)) continue;
+          if (!tableExists4(snap.db, feeder.legacyTable)) continue;
           const cols = new Set(
             snap.db.prepare(`PRAGMA table_info("${feeder.legacyTable}")`).all().map((c) => c.name)
           );
@@ -47054,7 +47889,7 @@ function verifyMigration(sources, projectDbPath, globalDbPath, onProgress, resol
   const preExistingForeignKeyViolations = [];
   const failureLines = [];
   const sourceOrphanSigs = /* @__PURE__ */ new Set();
-  if (!existsSync27(projectDbPath)) {
+  if (!existsSync28(projectDbPath)) {
     return {
       ok: false,
       tables: [],
@@ -47065,7 +47900,7 @@ function verifyMigration(sources, projectDbPath, globalDbPath, onProgress, resol
       error: `Consolidated project cleo.db not found at ${projectDbPath}. Run 'cleo exodus migrate' first.`
     };
   }
-  if (!existsSync27(globalDbPath)) {
+  if (!existsSync28(globalDbPath)) {
     return {
       ok: false,
       tables: [],
@@ -47080,7 +47915,7 @@ function verifyMigration(sources, projectDbPath, globalDbPath, onProgress, resol
   const globalSnap = openCleoDbSnapshot(globalDbPath, { readOnly: true });
   try {
     for (const src of sources) {
-      if (!existsSync27(src.path)) {
+      if (!existsSync28(src.path)) {
         onProgress?.(`Skipping ${src.name} (not present)`);
         continue;
       }
@@ -47205,7 +48040,7 @@ function verifyMigration(sources, projectDbPath, globalDbPath, onProgress, resol
     targetOrphans.push(...foreignKeyCheck(globalSnap.db, "global"));
     foreignKeyViolations.push(...targetOrphans);
     for (const fk of targetOrphans) {
-      const orphanDb = tableExists3(projectSnap.db, fk.table) ? projectSnap.db : globalSnap.db;
+      const orphanDb = tableExists4(projectSnap.db, fk.table) ? projectSnap.db : globalSnap.db;
       const sig = orphanSignature(orphanDb, fk);
       const preExisting = sourceOrphanSigs.has(sig) || orphanAlreadyInSource(orphanDb, fk, sources, resolveTarget);
       if (preExisting) {
@@ -47371,7 +48206,7 @@ __export(on_open_exports, {
   maybeRunExodusOnOpen: () => maybeRunExodusOnOpen,
   withExodusOnOpenSuppressed: () => withExodusOnOpenSuppressed
 });
-import { existsSync as existsSync28, mkdtempSync as mkdtempSync2, rmSync as rmSync4 } from "node:fs";
+import { existsSync as existsSync29, mkdtempSync as mkdtempSync2, rmSync as rmSync4 } from "node:fs";
 import { tmpdir as tmpdir5 } from "node:os";
 import { join as join31, resolve as resolve13 } from "node:path";
 async function withExodusOnOpenSuppressed(dbPath, fn) {
@@ -47413,7 +48248,7 @@ function remedyFor(scope) {
 }
 async function strandedLegacySources(scope, cwd) {
   const { buildExodusPlan: buildExodusPlan2, legacySourcesHoldRows: legacySourcesHoldRows2 } = await Promise.resolve().then(() => (init_exodus(), exodus_exports));
-  return buildExodusPlan2(cwd).sources.filter((s) => s.targetScope === scope && existsSync28(s.path)).filter((s) => legacySourcesHoldRows2([s])).map((s) => s.name);
+  return buildExodusPlan2(cwd).sources.filter((s) => s.targetScope === scope && existsSync29(s.path)).filter((s) => legacySourcesHoldRows2([s])).map((s) => s.name);
 }
 async function exodusStoreRewriteRefusal(dbPath, cwd) {
   const { assertOwnerStoreRewriteConfirmed: assertOwnerStoreRewriteConfirmed2, invocationDirectory: invocationDirectory2 } = await Promise.resolve().then(() => (init_worktree_isolation_guard(), worktree_isolation_guard_exports));
@@ -47545,7 +48380,7 @@ async function runExodusOnOpen(scope, dbPath, nativeDb, cwd) {
     };
   }
   const scopeSources = plan.sources.filter((s) => s.targetScope === scope);
-  if (!scopeSources.some((s) => existsSync28(s.path))) {
+  if (!scopeSources.some((s) => existsSync29(s.path))) {
     return {
       outcome: "skipped",
       reason: `no legacy ${scope}-scope source DBs present (fresh install or cross-scope-only)`
@@ -47570,7 +48405,7 @@ async function runExodusOnOpen(scope, dbPath, nativeDb, cwd) {
         {
           scope,
           dbPath,
-          sources: plan.sources.filter((s) => existsSync28(s.path)).map((s) => s.name)
+          sources: plan.sources.filter((s) => existsSync29(s.path)).map((s) => s.name)
         },
         "exodus-on-open: consolidated cleo.db is empty and legacy data present \u2014 auto-migrating"
       );
@@ -47583,7 +48418,7 @@ async function runExodusOnOpen(scope, dbPath, nativeDb, cwd) {
         const bare = scope === "project" ? await unmigratedBareSources2(
           dbPath,
           resolveTarget,
-          plan.sources.find((s) => s.name === "tasks" && existsSync28(s.path))?.path,
+          plan.sources.find((s) => s.name === "tasks" && existsSync29(s.path))?.path,
           bareScratch
         ) : { first: [], last: [] };
         const migratePlan = { ...plan, sources: [...bare.first, ...plan.sources, ...bare.last] };
@@ -47647,7 +48482,7 @@ async function runExodusOnOpen(scope, dbPath, nativeDb, cwd) {
           "exodus-on-open: parity verified \u2014 legacy data migrated into consolidated cleo.db"
         );
         try {
-          const consumed = plan.sources.filter((s) => existsSync28(s.path));
+          const consumed = plan.sources.filter((s) => existsSync29(s.path));
           const identities = await sealTargets(plan, consumed);
           const archiveResult = archiveMigratedSources(consumed, cwd, plan, identities);
           log14.info(
@@ -47722,7 +48557,7 @@ __export(dual_scope_db_exports, {
   upsertIdempotent: () => upsertIdempotent,
   withStoreSchemaOwnership: () => withStoreSchemaOwnership
 });
-import { existsSync as existsSync29, mkdirSync as mkdirSync10 } from "node:fs";
+import { existsSync as existsSync30, mkdirSync as mkdirSync10 } from "node:fs";
 import { createRequire as createRequire11 } from "node:module";
 import { dirname as dirname20, join as join32, resolve as resolve14 } from "node:path";
 function getDualScopeNativeDb(handle) {
@@ -47795,11 +48630,15 @@ async function openDualScopeDb(scope, cwd, options) {
     open
   ) : open();
 }
+function identityWorkOnOpen(nativeDb, scope) {
+  if (ROW_IDENTITY[scope].length === 0) return false;
+  return rowUidFillEnabled() || missingRowIdentitySchema(nativeDb).length > 0;
+}
 async function openDedicatedDualScopeDb(scope, dbPath, log15, execution) {
   execution?.assertActive();
   log15.debug({ scope, dbPath }, "opening DEDICATED (non-cached) dual-scope cleo.db (T11782 FIX D)");
   const dir = dirname20(dbPath);
-  if (!existsSync29(dir)) {
+  if (!existsSync30(dir)) {
     mkdirSync10(dir, { recursive: true });
   }
   execution?.assertActive();
@@ -47832,9 +48671,12 @@ async function openDedicatedDualScopeDb(scope, dbPath, log15, execution) {
           `dual-scope-db[${scope}]`
         );
         execution?.assertActive();
-        if (rowUidFillEnabled()) {
+        if (identityWorkOnOpen(nativeDb, scope)) {
           await Promise.resolve().then(() => (init_sqlite_data_accessor(), sqlite_data_accessor_exports));
-          prepareRowIdentity(nativeDb, scope, { triggers: false });
+          healRowIdentitySchema(nativeDb, scope);
+          if (rowUidFillEnabled()) {
+            prepareRowIdentity(nativeDb, scope, { triggers: false });
+          }
         }
         execution?.assertActive();
         log15.debug({ scope, dbPath }, "DEDICATED dual-scope cleo.db ready (T11782 FIX D)");
@@ -47947,7 +48789,7 @@ async function openDualScopeDbAtPath(scope, dbPath, exodusCwd, options) {
       execution?.assertActive();
       log15.debug({ scope, dbPath: normalizedPath }, "opening dual-scope cleo.db");
       const dir = dirname20(normalizedPath);
-      if (!existsSync29(dir)) {
+      if (!existsSync30(dir)) {
         mkdirSync10(dir, { recursive: true });
       }
       execution?.assertActive();
@@ -47980,9 +48822,12 @@ async function openDualScopeDbAtPath(scope, dbPath, exodusCwd, options) {
             `dual-scope-db[${scope}]`
           );
           execution?.assertActive();
-          if (rowUidFillEnabled()) {
+          if (identityWorkOnOpen(nativeDb, scope)) {
             await Promise.resolve().then(() => (init_sqlite_data_accessor(), sqlite_data_accessor_exports));
-            prepareRowIdentity(nativeDb, scope);
+            healRowIdentitySchema(nativeDb, scope);
+            if (rowUidFillEnabled()) {
+              prepareRowIdentity(nativeDb, scope);
+            }
           }
           execution?.assertActive();
           log15.debug({ scope, dbPath: normalizedPath }, "dual-scope cleo.db ready");
@@ -49112,7 +49957,7 @@ __export(nexus_sqlite_exports, {
   resetNexusDbState: () => resetNexusDbState,
   resolveNexusMigrationsFolder: () => resolveNexusMigrationsFolder
 });
-import { copyFileSync as copyFileSync8, existsSync as existsSync30 } from "node:fs";
+import { copyFileSync as copyFileSync8, existsSync as existsSync31 } from "node:fs";
 import { join as join33 } from "node:path";
 function getNexusDbPath(cwd) {
   return resolveDualScopeDbPath("project", cwd);
@@ -49164,7 +50009,7 @@ function detectAndWarnOnNestedNexus() {
   } catch {
     return false;
   }
-  if (!existsSync30(nestedPath)) return false;
+  if (!existsSync31(nestedPath)) return false;
   if (_warnedNestedPaths.has(nestedPath)) return false;
   _warnedNestedPaths.add(nestedPath);
   const canonicalPath = getNexusDbPath();
@@ -49184,7 +50029,7 @@ function detectAndWarnOnNestedNexus() {
 function _resetNestedNexusWarningGate() {
   _warnedNestedPaths.clear();
 }
-function tableExists4(nativeDb, tableName) {
+function tableExists5(nativeDb, tableName) {
   const result = nativeDb.prepare("SELECT name FROM sqlite_master WHERE type='table' AND name=?").get(tableName);
   return !!result;
 }
@@ -49193,7 +50038,7 @@ function objectExists(nativeDb, type, name2) {
   return !!result;
 }
 function ensureNexusFts5(nativeDb) {
-  if (!tableExists4(nativeDb, "nexus_nodes")) return;
+  if (!tableExists5(nativeDb, "nexus_nodes")) return;
   if (!objectExists(nativeDb, "table", "nexus_symbols_fts")) {
     nativeDb.exec(`
       CREATE VIRTUAL TABLE nexus_symbols_fts USING fts5(
@@ -49239,7 +50084,7 @@ function ensureNexusFts5(nativeDb) {
   `);
 }
 function ensureNexusRelationWeights(nativeDb) {
-  if (!tableExists4(nativeDb, "nexus_relations")) return;
+  if (!tableExists5(nativeDb, "nexus_relations")) return;
   nativeDb.exec(`
     CREATE TABLE IF NOT EXISTS nexus_relation_weights (
       relation_id       TEXT PRIMARY KEY NOT NULL,
@@ -49321,9 +50166,9 @@ function ensureNexusRelationWeights(nativeDb) {
 }
 function runNexusMigrations(nativeDb, db, dbPath) {
   const migrationsFolder = resolveNexusMigrationsFolder();
-  if (tableExists4(nativeDb, "nexus_nodes")) {
+  if (tableExists5(nativeDb, "nexus_nodes")) {
     const backupPath = dbPath.replace(/\.db$/, "-pre-cleo.db.bak");
-    if (!existsSync30(backupPath)) {
+    if (!existsSync31(backupPath)) {
       try {
         copyFileSync8(dbPath, backupPath);
       } catch {
@@ -49453,13 +50298,13 @@ var init_legacy_alias = __esm({
 
 // packages/core/src/llm/stable-device-id.ts
 import { randomUUID as randomUUID3 } from "node:crypto";
-import { existsSync as existsSync31, mkdirSync as mkdirSync11, readFileSync as readFileSync11, renameSync as renameSync9, writeFileSync as writeFileSync9 } from "node:fs";
+import { existsSync as existsSync32, mkdirSync as mkdirSync11, readFileSync as readFileSync11, renameSync as renameSync9, writeFileSync as writeFileSync9 } from "node:fs";
 import { dirname as dirname21 } from "node:path";
 import { resolveStableDeviceIdPath } from "@cleocode/paths";
 function getStableDeviceId() {
   if (_cachedDeviceId !== null) return _cachedDeviceId;
   const path2 = resolveStableDeviceIdPath();
-  if (existsSync31(path2)) {
+  if (existsSync32(path2)) {
     try {
       const raw = readFileSync11(path2, "utf-8").trim();
       if (raw.length > 0) {
@@ -49472,7 +50317,7 @@ function getStableDeviceId() {
   const fresh = randomUUID3();
   try {
     const dir = dirname21(path2);
-    if (!existsSync31(dir)) {
+    if (!existsSync32(dir)) {
       mkdirSync11(dir, { recursive: true });
     }
     const tmpPath = `${path2}.tmp.${process.pid}`;
@@ -49548,11 +50393,11 @@ __export(path_map_exports, {
   supersededRegistryPath: () => supersededRegistryPath,
   touchProjectLocation: () => touchProjectLocation
 });
-import { existsSync as existsSync32, lstatSync, readdirSync as readdirSync8 } from "node:fs";
+import { existsSync as existsSync33, lstatSync, readdirSync as readdirSync8 } from "node:fs";
 import { lstat, readdir as readdir2 } from "node:fs/promises";
 import { isAbsolute as isAbsolute5, join as join34, relative as relative3, sep as sep5 } from "node:path";
 import { canonicalizePath as canonicalizePath3, readDeclaredProjectIdentity as readDeclaredProjectIdentity4 } from "@cleocode/paths";
-import { and as and9, desc as desc3, eq as eq12, inArray as inArray6, ne as ne3 } from "drizzle-orm";
+import { and as and9, desc as desc3, eq as eq12, inArray as inArray7, ne as ne3 } from "drizzle-orm";
 function holdingKey(projectId, path2) {
   return `${projectId}\0${path2}`;
 }
@@ -49700,7 +50545,7 @@ function decideEncounterBinding(db, record) {
   const here = db.select({ state: projectLocations.state, checkoutNonce: projectLocations.checkoutNonce }).from(projectLocations).where(
     and9(
       eq12(projectLocations.projectId, record.projectId),
-      inArray6(projectLocations.deviceId, [deviceId, LOCAL_DEVICE_SENTINEL]),
+      inArray7(projectLocations.deviceId, [deviceId, LOCAL_DEVICE_SENTINEL]),
       eq12(projectLocations.path, record.projectPath)
     )
   ).all();
@@ -49711,7 +50556,7 @@ function decideEncounterBinding(db, record) {
   const previous = () => db.select({ checkoutNonce: projectLocations.checkoutNonce }).from(projectLocations).where(
     and9(
       eq12(projectLocations.projectId, record.projectId),
-      inArray6(projectLocations.deviceId, [deviceId, LOCAL_DEVICE_SENTINEL]),
+      inArray7(projectLocations.deviceId, [deviceId, LOCAL_DEVICE_SENTINEL]),
       eq12(projectLocations.path, oldPath)
     )
   ).all();
@@ -49759,7 +50604,7 @@ function hasOtherLiveLocation(db, record, deviceId) {
       ne3(projectLocations.path, record.projectPath)
     )
   ).all().some(
-    (location) => isStrictlyInside(record.projectPath, location.path) && existsSync32(location.path) && readDeclaredProjectIdentity4(location.path)?.projectId === record.projectId
+    (location) => isStrictlyInside(record.projectPath, location.path) && existsSync33(location.path) && readDeclaredProjectIdentity4(location.path)?.projectId === record.projectId
   );
 }
 function demoteProjectLocation(db, record, state) {
@@ -49810,7 +50655,7 @@ function rehomeDisplacedRows(db, projectId, projectPath, deviceId, probed) {
     ).orderBy(desc3(projectLocations.lastSeen)).all();
     const present = (path2) => {
       const holding = probed?.get(holdingKey(row.projectId, path2));
-      return holding === void 0 ? existsSync32(path2) : holding === "yes";
+      return holding === void 0 ? existsSync33(path2) : holding === "yes";
     };
     const home = candidates.find(
       (c) => present(c.path) && db.select({ projectId: projectRegistry.projectId }).from(projectRegistry).where(eq12(projectRegistry.projectPath, c.path)).all().length === 0
@@ -49839,7 +50684,7 @@ async function listProjectCheckouts(projectId, opts = {}) {
       projectHash: generateProjectHash(row.path),
       firstSeen: row.firstSeen,
       lastSeen: row.lastSeen,
-      exists: local && existsSync32(row.path),
+      exists: local && existsSync33(row.path),
       deviceId: local ? deviceId : row.deviceId,
       state: row.state
     });
@@ -49872,7 +50717,7 @@ __export(project_activity_exports, {
   projectLastActivitySql: () => projectLastActivitySql,
   projectLastActivitySqlText: () => projectLastActivitySqlText
 });
-import { eq as eq13, inArray as inArray7, sql as sql32 } from "drizzle-orm";
+import { eq as eq13, inArray as inArray8, sql as sql32 } from "drizzle-orm";
 function normalizeRegistryTimestamp(value) {
   if (value === null || value === void 0 || value.length === 0) return null;
   const iso = /^\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}(\.\d+)?$/.test(value) ? `${value.replace(" ", "T")}Z` : value;
@@ -49901,7 +50746,7 @@ function markProjectsProbed(db, projectIds, now = /* @__PURE__ */ new Date()) {
   for (let i = 0; i < ids.length; i += PROBED_CHUNK) {
     const chunk = ids.slice(i, i + PROBED_CHUNK);
     changed += Number(
-      db.update(projectRegistry).set({ lastProbedAt: at }).where(inArray7(projectRegistry.projectId, chunk)).run().changes
+      db.update(projectRegistry).set({ lastProbedAt: at }).where(inArray8(projectRegistry.projectId, chunk)).run().changes
     );
   }
   return changed;
@@ -49934,11 +50779,11 @@ __export(checkout_nonce_exports, {
   readCheckoutNonce: () => readCheckoutNonce
 });
 import { randomBytes as randomBytes3 } from "node:crypto";
-import { existsSync as existsSync33, readFileSync as readFileSync12, renameSync as renameSync10, writeFileSync as writeFileSync10 } from "node:fs";
+import { existsSync as existsSync34, readFileSync as readFileSync12, renameSync as renameSync10, writeFileSync as writeFileSync10 } from "node:fs";
 import { join as join35 } from "node:path";
 function readInfo(projectRoot) {
   const path2 = join35(projectRoot, ".cleo", "project-info.json");
-  if (!existsSync33(path2)) return null;
+  if (!existsSync34(path2)) return null;
   try {
     const parsed = JSON.parse(readFileSync12(path2, "utf-8"));
     return parsed !== null && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
@@ -50031,7 +50876,7 @@ __export(paths_exports, {
   validateProjectRoot: () => validateProjectRoot,
   worktreeScope: () => worktreeScope
 });
-import { existsSync as existsSync34, readFileSync as readFileSync13, statSync as statSync10 } from "node:fs";
+import { existsSync as existsSync35, readFileSync as readFileSync13, statSync as statSync10 } from "node:fs";
 import { createRequire as createRequire12 } from "node:module";
 import { homedir as homedir2 } from "node:os";
 import { dirname as dirname22, join as join36, resolve as resolve15 } from "node:path";
@@ -50057,7 +50902,7 @@ function runWithWorktreeScopeFromEnv(fn) {
 function isProjectInitialized(projectRoot) {
   const root = projectRoot ?? getProjectRoot();
   const cleoDir = join36(root, ".cleo");
-  return existsSync34(cleoDir) && existsSync34(join36(cleoDir, "tasks.db"));
+  return existsSync35(cleoDir) && existsSync35(join36(cleoDir, "tasks.db"));
 }
 function getCleoHome() {
   return getPlatformPaths().data;
@@ -50163,7 +51008,7 @@ function _resolveProjectByCwdFromNexus(cwd) {
   try {
     const cleoHome = getCleoHome();
     const globalDbPath = join36(cleoHome, "cleo.db");
-    if (!existsSync34(globalDbPath)) return null;
+    if (!existsSync35(globalDbPath)) return null;
     const start = resolve15(cwd ?? process.cwd());
     let current = start;
     const DatabaseSync3 = _getDatabaseSyncCtor();
@@ -50326,7 +51171,7 @@ function _cwdHasGitAncestor(cwd) {
   while (true) {
     const gitMarker = join36(current, ".git");
     try {
-      if (existsSync34(gitMarker)) {
+      if (existsSync35(gitMarker)) {
         return true;
       }
     } catch {
@@ -50404,7 +51249,7 @@ function getCleoGlobalCantAgentsDir() {
 function getAgentOutputsDir(cwd) {
   const projectRoot = getProjectRoot(cwd);
   const configPath = join36(projectRoot, ".cleo", "config.json");
-  if (existsSync34(configPath)) {
+  if (existsSync35(configPath)) {
     try {
       const config = JSON.parse(readFileSync13(configPath, "utf-8"));
       if (typeof config.agentOutputs === "object" && config.agentOutputs?.directory) {
@@ -50437,7 +51282,7 @@ function getManifestPath(cwd) {
   const configPath = join36(projectRoot, ".cleo", "config.json");
   const legacyFileName = ["MANIFEST", "jsonl"].join(".");
   let manifestFile = legacyFileName;
-  if (existsSync34(configPath)) {
+  if (existsSync35(configPath)) {
     try {
       const config = JSON.parse(readFileSync13(configPath, "utf-8"));
       const customFile = config.agentOutputs?.manifestFile ?? config.research?.manifestFile;
@@ -50493,7 +51338,7 @@ function resolveWorktreeRouting(cwdOverride) {
   while (current !== home && current !== "/" && current !== "") {
     const gitPath = join36(current, ".git");
     try {
-      if (existsSync34(gitPath)) {
+      if (existsSync35(gitPath)) {
         const stat3 = statSync10(gitPath);
         if (stat3.isFile()) {
           worktreePath = current;
@@ -50532,7 +51377,7 @@ function detectStrayCleoDb(routing) {
   }
   const tasksDbPath = join36(routing.worktreePath, ".cleo", "tasks.db");
   try {
-    if (existsSync34(tasksDbPath) && statSync10(tasksDbPath).isFile()) {
+    if (existsSync35(tasksDbPath) && statSync10(tasksDbPath).isFile()) {
       return tasksDbPath;
     }
   } catch {
@@ -50542,7 +51387,7 @@ function detectStrayCleoDb(routing) {
 async function resolveProjectById(projectId) {
   try {
     const { getNexusDb: getNexusDb2, getNexusRegistryDbPath: getNexusRegistryDbPath2 } = await Promise.resolve().then(() => (init_nexus_sqlite(), nexus_sqlite_exports));
-    if (!existsSync34(getNexusRegistryDbPath2())) return null;
+    if (!existsSync35(getNexusRegistryDbPath2())) return null;
     const { eq: eq16 } = await import("drizzle-orm");
     const { projectRegistry: projectRegistry2 } = await Promise.resolve().then(() => (init_nexus_schema(), nexus_schema_exports));
     const db = await getNexusDb2();
@@ -50578,7 +51423,7 @@ function _rowToRegistryEntry(row) {
 }
 function _assertProjectInfoReadable(projectRoot) {
   const infoPath = join36(projectRoot, ".cleo", "project-info.json");
-  if (existsSync34(infoPath)) JSON.parse(readFileSync13(infoPath, "utf-8"));
+  if (existsSync35(infoPath)) JSON.parse(readFileSync13(infoPath, "utf-8"));
 }
 function startProjectEncounter(key, projectRoot, infoProjectId) {
   const inFlight2 = _encountersInFlight.get(key);
@@ -50627,7 +51472,7 @@ async function recordProjectEncounter(cwd, options = {}) {
   if (!shouldAutoRegisterProject(project.projectRoot, cleoHome)) return "ephemeral";
   const checkout = captureProjectScope(project.projectRoot, worktreeScope.getStore()).worktreeRoot;
   const { getNexusRegistryDb: getNexusRegistryDb2, getNexusRegistryDbPath: getNexusRegistryDbPath2 } = await Promise.resolve().then(() => (init_nexus_sqlite(), nexus_sqlite_exports));
-  if (existsSync34(getNexusRegistryDbPath2(cleoHome))) {
+  if (existsSync35(getNexusRegistryDbPath2(cleoHome))) {
     const { and: and12, eq: eq16 } = await import("drizzle-orm");
     const { projectLocations: projectLocations2, projectRegistry: projectRegistry2 } = await Promise.resolve().then(() => (init_nexus_schema(), nexus_schema_exports));
     const { currentDeviceId: currentDeviceId2 } = await Promise.resolve().then(() => (init_path_map(), path_map_exports));
@@ -50653,7 +51498,7 @@ async function recordProjectEncounter(cwd, options = {}) {
 }
 async function markEncounterOpened(cleoHome, projectId) {
   const { getNexusRegistryDb: getNexusRegistryDb2, getNexusRegistryDbPath: getNexusRegistryDbPath2 } = await Promise.resolve().then(() => (init_nexus_sqlite(), nexus_sqlite_exports));
-  if (!existsSync34(getNexusRegistryDbPath2(cleoHome))) return;
+  if (!existsSync35(getNexusRegistryDbPath2(cleoHome))) return;
   const { markProjectOpened: markProjectOpened2 } = await Promise.resolve().then(() => (init_project_activity(), project_activity_exports));
   markProjectOpened2(await getNexusRegistryDb2(cleoHome), projectId);
 }
@@ -50826,7 +51671,7 @@ var init_eligibility = __esm({
 
 // packages/core/src/store/background-jobs.ts
 import { createHash as createHash6, randomUUID as randomUUID4 } from "node:crypto";
-import { and as and10, asc as asc2, eq as eq14, getTableColumns as getTableColumns3, gt as gt2, inArray as inArray8, isNull as isNull5, ne as ne4, or as or6, sql as sql33 } from "drizzle-orm";
+import { and as and10, asc as asc2, eq as eq14, getTableColumns as getTableColumns3, gt as gt2, inArray as inArray9, isNull as isNull5, ne as ne4, or as or6, sql as sql33 } from "drizzle-orm";
 function assertOperationWriteFence(db, execution) {
   assertOperationJobState(db, execution, "running");
 }
@@ -51801,7 +52646,7 @@ __export(memory_accessor_exports, {
   logConsolidationComplete: () => logConsolidationComplete,
   logConsolidationStart: () => logConsolidationStart
 });
-import { and as and11, asc as asc3, desc as desc4, eq as eq15, gt as gt3, gte as gte2, inArray as inArray9, isNull as isNull6, lt as lt3, ne as ne5, or as or7, sql as sql35 } from "drizzle-orm";
+import { and as and11, asc as asc3, desc as desc4, eq as eq15, gt as gt3, gte as gte2, inArray as inArray10, isNull as isNull6, lt as lt3, ne as ne5, or as or7, sql as sql35 } from "drizzle-orm";
 async function getBrainAccessor(cwd) {
   const db = await getBrainDb(cwd);
   return new BrainDataAccessor(db);
@@ -52230,8 +53075,8 @@ var init_memory_accessor = __esm({
         }
         if (params.tags && params.tags.length > 0) {
           const wantedTags = [...new Set(params.tags)];
-          const matchingIds = this.db.select({ stickyId: brainStickyTags.stickyId }).from(brainStickyTags).where(inArray9(brainStickyTags.tag, wantedTags)).groupBy(brainStickyTags.stickyId).having(sql35`count(distinct ${brainStickyTags.tag}) = ${wantedTags.length}`);
-          conditions.push(inArray9(brainStickyNotes.id, matchingIds));
+          const matchingIds = this.db.select({ stickyId: brainStickyTags.stickyId }).from(brainStickyTags).where(inArray10(brainStickyTags.tag, wantedTags)).groupBy(brainStickyTags.stickyId).having(sql35`count(distinct ${brainStickyTags.tag}) = ${wantedTags.length}`);
+          conditions.push(inArray10(brainStickyNotes.id, matchingIds));
         }
         let query = this.db.select().from(brainStickyNotes).orderBy(desc4(brainStickyNotes.createdAt));
         if (conditions.length > 0) {
@@ -52330,8 +53175,8 @@ var init_memory_accessor = __esm({
         }
         if (params.tags && params.tags.length > 0) {
           const wanted = [...new Set(params.tags)];
-          const matchingIds = this.db.select({ id: sql35`a.id` }).from(sql35`${t} AS a, json_each(a.tags) AS je`).where(inArray9(sql35`je.value`, wanted)).groupBy(sql35`a.id`).having(sql35`count(distinct je.value) = ${wanted.length}`);
-          conditions.push(inArray9(t.id, matchingIds));
+          const matchingIds = this.db.select({ id: sql35`a.id` }).from(sql35`${t} AS a, json_each(a.tags) AS je`).where(inArray10(sql35`je.value`, wanted)).groupBy(sql35`a.id`).having(sql35`count(distinct je.value) = ${wanted.length}`);
+          conditions.push(inArray10(t.id, matchingIds));
         }
         const where = conditions.length > 0 ? and11(...conditions) : void 0;
         return this.selectAttention(where, params.limit);