@cleocode/core 2026.9.25 → 2026.10.1

package/dist/llm/plugin-facade.js

@@ -1874,7 +1874,7 @@ var init_output_contracts_data = __esm({
               // T12503: the optimistic-concurrency version agents pass to --if-match.
               updatedAt: {
                 type: ["string", "null"],
-                description: "Task version for optimistic concurrency: pass it to `cleo update|complete --if-match`."
+                description: "Task version for optimistic concurrency: pass it to `cleo update|complete --if-match`. A stale version fails with E_CONFLICT (23); E_TASK_RENAMED (26) when sync re-numbered the task you read (details.expected is its new id)."
               },
               // T12502: the human assignee and the agent claim lease are separate.
               assignee: {
@@ -13135,6 +13135,7 @@ var init_exit_codes = __esm({
       ExitCode2[ExitCode2["VERSION_CONFLICT"] = 23] = "VERSION_CONFLICT";
       ExitCode2[ExitCode2["SESSION_UNBOUND"] = 24] = "SESSION_UNBOUND";
       ExitCode2[ExitCode2["WORKTREE_LOCKED"] = 25] = "WORKTREE_LOCKED";
+      ExitCode2[ExitCode2["TASK_RENAMED"] = 26] = "TASK_RENAMED";
       ExitCode2[ExitCode2["SESSION_EXISTS"] = 30] = "SESSION_EXISTS";
       ExitCode2[ExitCode2["SESSION_NOT_FOUND"] = 31] = "SESSION_NOT_FOUND";
       ExitCode2[ExitCode2["SCOPE_CONFLICT"] = 32] = "SCOPE_CONFLICT";
@@ -17462,6 +17463,210 @@ var init_nexus_account = __esm({
   }
 });
 
+// packages/contracts/src/nexus-cloud.ts
+import { z as z26 } from "zod";
+var NEXUS_DEVICE_STATES, NEXUS_CLOUD_PROFILES, NEXUS_DEVICE_STATE_UNKNOWN, isoTime, profile, deviceState, nexusCloudCredentialSchema, nexusCloudDeviceSchema, nexusCloudOrganizationSchema, nexusCloudUserSchema, nexusCloudWhoamiSchema, nexusCloudDevicePageSchema, nexusCloudPresenceSchema, nexusCloudReplicaSchema, nexusCloudDeviceCountsSchema, projectFields, nexusCloudProjectListItemSchema, nexusCloudProjectPageSchema, nexusCloudProjectDetailSchema, nexusCloudReplicaPageSchema, NEXUS_STATUS_CHECK_IDS, NEXUS_STATUS_VERDICTS, CLOUD_STATUS_VERDICTS, knownCheckId, nexusCloudStatusCheckSchema, nexusCloudStatusSchema;
+var init_nexus_cloud = __esm({
+  "packages/contracts/src/nexus-cloud.ts"() {
+    "use strict";
+    NEXUS_DEVICE_STATES = ["active", "signed-out", "revoked"];
+    NEXUS_CLOUD_PROFILES = ["device", "read-only"];
+    NEXUS_DEVICE_STATE_UNKNOWN = "unknown";
+    isoTime = z26.iso.datetime({ offset: true });
+    profile = z26.enum(NEXUS_CLOUD_PROFILES).nullable().catch(null);
+    deviceState = z26.enum([...NEXUS_DEVICE_STATES, NEXUS_DEVICE_STATE_UNKNOWN]).catch(NEXUS_DEVICE_STATE_UNKNOWN);
+    nexusCloudCredentialSchema = z26.object({
+      kind: z26.enum(["device", "session"]),
+      credentialId: z26.string().nullable().optional(),
+      profile: profile.optional(),
+      scopes: z26.array(z26.string()).default([]),
+      createdAt: isoTime.nullable().optional(),
+      lastUsedAt: isoTime.nullable().optional(),
+      /** When the credential expires if it is not used again; null for sessions. */
+      idleExpiresAt: isoTime.nullable().optional()
+    });
+    nexusCloudDeviceSchema = z26.object({
+      deviceId: z26.string(),
+      name: z26.string(),
+      platform: z26.string().optional(),
+      arch: z26.string().nullable().optional(),
+      cliVersion: z26.string().nullable().optional(),
+      createdAt: isoTime.optional(),
+      lastSeenAt: isoTime.nullable().optional(),
+      state: deviceState,
+      signedOutAt: isoTime.nullable().optional(),
+      /** Base64 device certificate; null until the device holds a key grant. */
+      certificate: z26.string().nullable().optional(),
+      /** The current credential's profile, or null with none (signed out or revoked). */
+      profile: profile.optional(),
+      /** True for the device whose credential made this request. */
+      current: z26.boolean().default(false),
+      projects: z26.number().int().nonnegative().optional(),
+      replicas: z26.number().int().nonnegative().optional(),
+      lastSyncAt: isoTime.nullable().optional(),
+      lastPresenceAt: isoTime.nullable().optional()
+    });
+    nexusCloudOrganizationSchema = z26.object({
+      id: z26.string(),
+      name: z26.string(),
+      slug: z26.string().nullable().optional(),
+      role: z26.string().optional(),
+      personal: z26.boolean().optional()
+    });
+    nexusCloudUserSchema = z26.object({
+      id: z26.string(),
+      email: z26.string(),
+      name: z26.string().nullable().optional()
+    });
+    nexusCloudWhoamiSchema = z26.object({
+      serverTime: isoTime.optional(),
+      user: nexusCloudUserSchema,
+      organizations: z26.array(nexusCloudOrganizationSchema).default([]),
+      credential: nexusCloudCredentialSchema,
+      /** The calling device; null for a session caller. */
+      device: nexusCloudDeviceSchema.nullable()
+    });
+    nexusCloudDevicePageSchema = z26.object({
+      devices: z26.array(nexusCloudDeviceSchema),
+      nextCursor: z26.string().max(512).nullable().default(null),
+      truncated: z26.boolean().default(false)
+    });
+    nexusCloudPresenceSchema = z26.looseObject({
+      observedAt: isoTime.optional(),
+      sync: z26.object({ enabled: z26.boolean() }).optional()
+    });
+    nexusCloudReplicaSchema = z26.object({
+      projectId: z26.string(),
+      replicaId: z26.string(),
+      deviceId: z26.string(),
+      deviceName: z26.string(),
+      deviceState: deviceState.optional(),
+      attachedAt: isoTime.optional(),
+      lastSyncAt: isoTime.nullable(),
+      presence: nexusCloudPresenceSchema.nullable(),
+      presenceAt: isoTime.nullable()
+    });
+    nexusCloudDeviceCountsSchema = z26.object({
+      active: z26.number().int().nonnegative(),
+      total: z26.number().int().nonnegative()
+    });
+    projectFields = {
+      projectId: z26.string(),
+      label: z26.string().nullable(),
+      organizationId: z26.string(),
+      organizationName: z26.string().optional(),
+      remoteUrl: z26.string().nullable().optional(),
+      createdAt: isoTime.optional()
+    };
+    nexusCloudProjectListItemSchema = z26.object({
+      ...projectFields,
+      role: z26.string(),
+      streamId: z26.string().optional(),
+      headSeq: z26.number().int().nonnegative().nullable().optional(),
+      openConflicts: z26.number().int().nonnegative().optional(),
+      replicas: z26.array(nexusCloudReplicaSchema).default([]),
+      devices: nexusCloudDeviceCountsSchema.optional(),
+      replicaCount: z26.number().int().nonnegative().optional(),
+      lastSyncAt: isoTime.nullable().optional(),
+      lastPresenceAt: isoTime.nullable().optional(),
+      /** This project's replica list was cut at 50 (T12858). */
+      replicasTruncated: z26.boolean().default(false)
+    });
+    nexusCloudProjectPageSchema = z26.object({
+      projects: z26.array(nexusCloudProjectListItemSchema),
+      nextCursor: z26.string().max(512).nullable().default(null),
+      /** Anything in the page was cut (the project list or a replica list). */
+      truncated: z26.boolean().default(false),
+      /** The project list itself was cut at 1000 (T12858). */
+      projectsTruncated: z26.boolean().default(false)
+    });
+    nexusCloudProjectDetailSchema = z26.object({
+      project: z26.object({ ...projectFields, deletedAt: isoTime.nullable().optional() }),
+      role: z26.string(),
+      canTrash: z26.boolean().optional(),
+      openConflicts: z26.number().int().nonnegative(),
+      /** At most 50, oldest attachment first. */
+      replicas: z26.array(nexusCloudReplicaSchema),
+      devices: nexusCloudDeviceCountsSchema,
+      replicaCount: z26.number().int().nonnegative().optional(),
+      lastSyncAt: isoTime.nullable().optional(),
+      /** `replicas` was cut at 50. */
+      truncated: z26.boolean().default(false),
+      stream: z26.object({
+        streamId: z26.string(),
+        headSeq: z26.number().int().nonnegative(),
+        headCheckpointId: z26.string().nullable()
+      }).nullable()
+    });
+    nexusCloudReplicaPageSchema = z26.object({
+      replicas: z26.array(nexusCloudReplicaSchema),
+      devices: nexusCloudDeviceCountsSchema.optional(),
+      nextCursor: z26.string().max(512).nullable().default(null),
+      truncated: z26.boolean().default(false)
+    });
+    NEXUS_STATUS_CHECK_IDS = [
+      "credential.valid",
+      "device.registered",
+      "device.active",
+      "device.certified",
+      "project.registered",
+      "project.writable",
+      "replica.attached",
+      "presence.fresh",
+      "replica.synced",
+      "conflicts.none"
+    ];
+    NEXUS_STATUS_VERDICTS = ["ok", "attention", "not-linked", "not-registered"];
+    CLOUD_STATUS_VERDICTS = [...NEXUS_STATUS_VERDICTS, "not-signed-in"];
+    knownCheckId = z26.enum(NEXUS_STATUS_CHECK_IDS);
+    nexusCloudStatusCheckSchema = z26.object({
+      id: z26.enum(NEXUS_STATUS_CHECK_IDS),
+      ok: z26.boolean(),
+      required: z26.boolean(),
+      detail: z26.string()
+    });
+    nexusCloudStatusSchema = z26.object({
+      serverTime: isoTime.optional(),
+      apiVersion: z26.string().optional(),
+      user: nexusCloudUserSchema,
+      credential: nexusCloudCredentialSchema,
+      device: nexusCloudDeviceSchema.nullable(),
+      project: z26.object({
+        projectId: z26.string(),
+        registered: z26.boolean(),
+        organizationId: z26.string().nullable(),
+        organizationName: z26.string().nullable(),
+        role: z26.string().nullable()
+      }).nullable(),
+      replica: z26.object({
+        replicaId: z26.string(),
+        attached: z26.boolean(),
+        attachedElsewhere: z26.boolean(),
+        attachedAt: isoTime.nullable(),
+        lastSyncAt: isoTime.nullable(),
+        presenceAt: isoTime.nullable(),
+        lastReplicaSeq: z26.number().int().nonnegative().nullable().optional()
+      }).nullable(),
+      stream: z26.object({
+        streamId: z26.string(),
+        headSeq: z26.number().int().nonnegative(),
+        headCheckpointId: z26.string().nullable(),
+        openConflicts: z26.number().int().nonnegative(),
+        devices: nexusCloudDeviceCountsSchema
+      }).nullable(),
+      /** Check ids added by a newer server are dropped, never a parse failure. */
+      checks: z26.array(nexusCloudStatusCheckSchema.extend({ id: z26.string() })).transform(
+        (list) => list.flatMap((c) => {
+          const id = knownCheckId.safeParse(c.id);
+          return id.success ? [{ ...c, id: id.data }] : [];
+        })
+      ),
+      /** A verdict added by a newer server reads as `attention`: never `ok` by accident. */
+      verdict: z26.enum(NEXUS_STATUS_VERDICTS).catch("attention")
+    });
+  }
+});
+
 // packages/contracts/src/task-id.ts
 var init_task_id = __esm({
   "packages/contracts/src/task-id.ts"() {
@@ -17546,6 +17751,7 @@ var init_src = __esm({
     init_decide();
     init_decide_sites();
     init_nexus_account();
+    init_nexus_cloud();
     init_task_id();
   }
 });
@@ -17890,6 +18096,19 @@ var init_error_catalog = __esm({
             `Bind a session: run 'cleo session start --scope global --name "<name>"', 'cleo session resume <id>', or set CLEO_SESSION_ID=<id>.`
           )
         ],
+        [
+          26 /* TASK_RENAMED */,
+          def(
+            26 /* TASK_RENAMED */,
+            "TASK_RENAMED",
+            "CONFLICT",
+            "Task was re-numbered by sync",
+            409,
+            true,
+            "E_TASK_RENAMED",
+            "The task you addressed now has another id (a display-id collision re-numbered it). Re-read it with 'cleo show <new id>' and retry against that id."
+          )
+        ],
         [
           25 /* WORKTREE_LOCKED */,
           def(
@@ -19837,10 +20056,10 @@ var init_table2 = __esm({
       [IsDrizzleTable] = true;
       /** @internal */
       [ExtraConfigBuilder] = void 0;
-      constructor(name15, schema, baseName) {
+      constructor(name15, schema, baseName2) {
         this[TableName] = this[OriginalName] = name15;
         this[TableSchema] = schema;
-        this[BaseName] = baseName;
+        this[BaseName] = baseName2;
       }
     };
   }
@@ -21770,9 +21989,9 @@ var init_casing = __esm({
 });
 
 // node_modules/.pnpm/drizzle-orm@1.0.0-rc.4_@opentelemetry+api@1.9.0_@sinclair+typebox@0.34.49_@types+mssql@_b4e81f2ea693a7363d3e5dc2205249c6/node_modules/drizzle-orm/sqlite-core/table.js
-function sqliteTableBase(name15, columns, extraConfig, schema, casing, baseName = name15) {
+function sqliteTableBase(name15, columns, extraConfig, schema, casing, baseName2 = name15) {
   const casingFn = getCasingFn(casing);
-  const rawTable = new SQLiteTable(name15, schema, baseName);
+  const rawTable = new SQLiteTable(name15, schema, baseName2);
   const parsedColumns = typeof columns === "function" ? columns(getSQLiteColumnBuilders()) : columns;
   const builtColumns = Object.fromEntries(Object.entries(parsedColumns).map(([name16, colBuilderBase]) => {
     const colBuilder = colBuilderBase;
@@ -25561,6 +25780,10 @@ function decisionFor(dbPath) {
   if (!decisions.has(key)) decisions.set(key, schemaWriteRefusal(key));
   return decisions.get(key) ?? null;
 }
+function schemaWritesAllowed(nativeDb) {
+  const dbPath = nativeDb.location();
+  return !dbPath || decisionFor(dbPath) === null;
+}
 function isWorktreeBuildSchemaError(error48) {
   return error48 instanceof Error && error48.message.includes(E_WORKTREE_BUILD_SCHEMA);
 }
@@ -26599,7 +26822,10 @@ var init_row_identity_registry = __esm({
           key: ["id"],
           birth: "recorded_at",
           content: ["ac_id", "previous_text", "reason"],
-          birthFacts: ["ac_id", "previous_text", "reason", "@refFp:ac_uid"],
+          // v2 (T12802): no @refFp: the criterion's fingerprint is unknowable when
+          // it was gone before this row got its identity, so it made the value
+          // depend on fill timing. ac_id is always known.
+          birthFacts: ["ac_id", "previous_text", "reason"],
           storedRefUids: [{ column: "ac_uid", from: "ac_id", table: ACS }],
           task: "T12341"
         },
@@ -26608,7 +26834,10 @@ var init_row_identity_registry = __esm({
           kind: "minted",
           key: ["id"],
           birth: "created_at",
-          birthFacts: ["evidence_atom_id", "binding_type", "ac_text_hash", "@refFp:ac_uid"],
+          // v2 (T12802): ac_id in place of @refFp:ac_uid and ac_text_hash. Both
+          // were filled from the criterion, so a backfilled binding whose
+          // criterion was already gone got a different value (see AC history).
+          birthFacts: ["evidence_atom_id", "binding_type", "ac_id"],
           storedRefUids: [
             { column: "ac_uid", from: "ac_id", table: ACS },
             { column: "ac_text_hash", from: "ac_id", table: ACS, source: "text_hash" }
@@ -26650,7 +26879,9 @@ var init_row_identity_registry = __esm({
           // The uid IS the primary key: display-id-alias.ts computes it on write.
           table: "tasks_display_id_aliases",
           kind: "natural",
-          key: ["entity_table", "display_id", "entity_uid"],
+          // T12800: the reason is part of the key (collision-remint and
+          // remint-assigned of one id and row are distinct facts).
+          key: ["entity_table", "display_id", "entity_uid", "reason"],
           task: "T12341"
         },
         {
@@ -27232,6 +27463,20 @@ function installRowUidTriggers(db, scope) {
     );
   }
 }
+function v1ReleaseBirthFp(db, table, row) {
+  const col = (c) => row[c] ?? null;
+  const facts = table === "tasks_task_acceptance_criteria_history" ? [col("ac_id"), col("previous_text"), col("reason")] : table === "tasks_evidence_ac_bindings" ? [col("evidence_atom_id"), col("binding_type"), col("ac_text_hash")] : [];
+  if (facts.length === 0) return null;
+  const acUid = col("ac_uid");
+  let ref = "ref:none";
+  if (acUid !== null) {
+    const ac = db.prepare("SELECT birth_fp AS fp FROM main.tasks_task_acceptance_criteria WHERE uid = ?").get(acUid);
+    ref = ac === void 0 ? "ref:missing" : ac.fp;
+    if (ref === null) return null;
+  }
+  const spec = rowIdentitySpec("project", table);
+  return birthFingerprint(table, spec?.birth ? col(spec.birth) : null, [...facts, ref]);
+}
 function hasObject(db, type, name15) {
   return db.prepare("SELECT 1 FROM main.sqlite_master WHERE type = ? AND name = ?").get(type, name15) !== void 0;
 }
@@ -27315,24 +27560,41 @@ function preReleaseBirthFp(db, table, row) {
 function resetStaleIdentity(db, scope, writers) {
   if (scope !== "project" || !hasTable(db, ROW_IDENTITY_META_TABLE)) return "none";
   if (readMeta(db, ROW_IDENTITY_RECIPE_KEY) === ROW_IDENTITY_RECIPE) return "none";
-  const minted = ROW_IDENTITY.project.filter(
-    (spec) => spec.kind === "minted" && hasTable(db, spec.table) && columnsOf(db, spec.table).has(BIRTH_FP_COLUMN)
+  const minted = fingerprintOrder("project", ROW_IDENTITY.project).filter(
+    (spec) => hasTable(db, spec.table) && columnsOf(db, spec.table).has(BIRTH_FP_COLUMN)
   );
   const stale = [];
+  const cleared = /* @__PURE__ */ new Map();
+  const mark = (table, column, value) => {
+    if (value === null || value === void 0) return;
+    const key = `${table}.${column}`;
+    const set2 = cleared.get(key) ?? /* @__PURE__ */ new Set();
+    set2.add(String(value));
+    cleared.set(key, set2);
+  };
   for (const spec of minted) {
+    const deps = (spec.birthFacts ?? []).map((fact) => fingerprintRef("project", spec, fact)).filter((d) => d !== null);
+    const keyColumn = targetKey("project", spec.table);
     const rows = db.prepare(
       `SELECT rowid AS _rowid, * FROM main.${q(spec.table)} WHERE ${q(BIRTH_FP_COLUMN)} IS NOT NULL`
     ).all();
     for (const row of rows) {
-      if (row[BIRTH_FP_COLUMN] === preReleaseBirthFp(db, spec.table, row)) {
+      const derivedFromStale = deps.some(
+        (d) => cleared.get(`${d.table}.${d.key}`)?.has(String(row[d.column] ?? ""))
+      );
+      if (derivedFromStale || row[BIRTH_FP_COLUMN] === preReleaseBirthFp(db, spec.table, row) || row[BIRTH_FP_COLUMN] === v1ReleaseBirthFp(db, spec.table, row)) {
         stale.push({ table: spec.table, rowid: row._rowid });
+        mark(spec.table, keyColumn, row[keyColumn]);
+        mark(spec.table, UID_COLUMN, row[UID_COLUMN]);
       }
     }
   }
-  if (stale.length === 0) return "none";
+  const graveyardRows = scope === "project" && hasTable(db, AC_UID_GRAVEYARD) ? db.prepare(`SELECT count(*) AS n FROM main.${AC_UID_GRAVEYARD}`).get().n : 0;
+  if (stale.length === 0 && graveyardRows === 0) return "none";
   if (readMeta(db, ROW_IDENTITY_SYNCED_KEY) !== void 0) return "refused";
   db.exec("SAVEPOINT row_identity_reset");
   try {
+    if (graveyardRows > 0) writers.clearAcUidGraveyardNative(db);
     for (const { table, rowid } of stale) {
       writers.clearBirthFpNative(db, table, rowid);
     }
@@ -27348,6 +27610,106 @@ function writeRecipeMarker(db, writers = requireWriters()) {
   if (!hasTable(db, ROW_IDENTITY_META_TABLE)) return;
   writers.writeRowIdentityMetaNative(db, ROW_IDENTITY_RECIPE_KEY, ROW_IDENTITY_RECIPE);
 }
+function rowIdentityShared(db) {
+  return readMeta(db, ROW_IDENTITY_SYNCED_KEY) !== void 0;
+}
+function healRowIdentitySchema(db, scope, writers = registeredWriters) {
+  const log15 = getLogger("row-identity");
+  if (ROW_IDENTITY[scope].length === 0) {
+    return [];
+  }
+  if (!schemaWritesAllowed(db)) {
+    log15.debug({ scope }, "row identity schema heal skipped: schema writes refused for this build");
+    return [];
+  }
+  try {
+    db.exec("SAVEPOINT row_identity_heal");
+    try {
+      const healed = [
+        ...scope === "project" ? ensureIdentityTables(db) : [],
+        ...ensureRowIdentitySchema(db, scope)
+      ];
+      if (healed.length > 0) recordHealReceipt(db, scope, healed, writers);
+      db.exec("RELEASE SAVEPOINT row_identity_heal");
+      if (healed.length > 0)
+        log15.info({ scope, healed: healed.length }, "row identity schema healed");
+      return healed;
+    } catch (error48) {
+      db.exec("ROLLBACK TO SAVEPOINT row_identity_heal");
+      db.exec("RELEASE SAVEPOINT row_identity_heal");
+      throw error48;
+    }
+  } catch (error48) {
+    log15.error({ scope, error: error48 }, "row identity schema heal failed");
+    return [];
+  }
+}
+function recordHealReceipt(db, scope, healed, writers) {
+  const table = HEAL_RECEIPT_TABLE[scope];
+  const log15 = getLogger("row-identity");
+  if (table === null || !hasTable(db, table) || !writers) {
+    log15.warn({ scope, healed: healed.length }, "row identity schema healed; no receipt table");
+    return;
+  }
+  const objects = healed.map((stmt) => {
+    const col = /ALTER TABLE main\.("?)(\w+)\1 ADD COLUMN ("?)(\w+)\3/.exec(stmt);
+    if (col) return `${col[2]}.${col[4]}`;
+    const obj = /(TABLE|INDEX|TRIGGER) IF NOT EXISTS main\.("?)(\w+)\2/.exec(stmt);
+    return obj ? `${obj[1].toLowerCase()} ${obj[3]}` : stmt.slice(0, 60);
+  });
+  const receipt2 = {
+    at: (/* @__PURE__ */ new Date()).toISOString(),
+    scope,
+    statements: healed.length,
+    objects
+  };
+  const history = [...readRowIdentityHealHistory(db), receipt2].slice(-HEAL_RECEIPTS_KEPT);
+  writers.writeRowIdentityMetaNative(db, ROW_IDENTITY_HEAL_KEY, JSON.stringify(history));
+}
+function readRowIdentityHealHistory(db) {
+  const raw = readMeta(db, ROW_IDENTITY_HEAL_KEY);
+  if (raw === void 0) return [];
+  try {
+    const parsed = JSON.parse(raw);
+    return Array.isArray(parsed) ? parsed : [parsed];
+  } catch {
+    return [];
+  }
+}
+function missingRowIdentitySchema(db) {
+  if (!hasTable(db, "tasks_task_acceptance_criteria")) return [];
+  const missing = [];
+  for (const table of Object.keys(IDENTITY_TABLE_DDL)) {
+    if (!hasTable(db, table)) missing.push(`table ${table}`);
+  }
+  for (const [table, column] of [
+    ["tasks_display_id_aliases", "displaced_hlc"],
+    ["tasks_display_id_aliases", "entity_birth_fp"],
+    [AC_UID_GRAVEYARD, "birth_fp"]
+  ]) {
+    if (hasTable(db, table) && !columnsOf(db, table).has(column)) {
+      missing.push(`column ${table}.${column}`);
+    }
+  }
+  if (!hasObject(db, "trigger", "trg_tasks_ac_uid_graveyard")) {
+    missing.push("trigger trg_tasks_ac_uid_graveyard");
+  }
+  for (const spec of ROW_IDENTITY.project) {
+    if (!hasTable(db, spec.table)) continue;
+    const cols = columnsOf(db, spec.table);
+    for (const column of rowIdentityColumns("project", spec.table)) {
+      if (!cols.has(column)) missing.push(`column ${spec.table}.${column}`);
+    }
+    if (!uidIsPrimaryKey(db, spec.table) && !hasObject(db, "index", `uq_${spec.table}_uid`)) {
+      missing.push(`index uq_${spec.table}_uid`);
+    }
+    for (const ref of spec.storedRefUids ?? []) {
+      const index2 = `idx_${spec.table}_${ref.column}`;
+      if (!hasObject(db, "index", index2)) missing.push(`index ${index2}`);
+    }
+  }
+  return missing;
+}
 function prepareRowIdentity(db, scope, options = {}) {
   if (ROW_IDENTITY[scope].length === 0) return null;
   if (!rowUidFillEnabled()) return null;
@@ -27386,7 +27748,7 @@ function prepareRowIdentity(db, scope, options = {}) {
     return null;
   }
 }
-var ROW_UID_DOMAIN, ROW_BIRTH_DOMAIN, ROW_UID_SQL_FUNCTION, ROW_BIRTH_FP_SQL_FUNCTION, ROW_RANDOM_UID_SQL_FUNCTION, AC_TEXT_HASH_SQL_FUNCTION, AC_UID_GRAVEYARD, registeredWriters, STORE_TIMESTAMP, MAX_UUID_MS, ROW_IDENTITY_RECIPE, ROW_IDENTITY_META_TABLE, ROW_IDENTITY_RECIPE_KEY, ROW_IDENTITY_SYNCED_KEY, IDENTITY_TABLE_DDL, AC_UID_GRAVEYARD_TRIGGER;
+var ROW_UID_DOMAIN, ROW_BIRTH_DOMAIN, ROW_UID_SQL_FUNCTION, ROW_BIRTH_FP_SQL_FUNCTION, ROW_RANDOM_UID_SQL_FUNCTION, AC_TEXT_HASH_SQL_FUNCTION, AC_UID_GRAVEYARD, registeredWriters, STORE_TIMESTAMP, MAX_UUID_MS, ROW_IDENTITY_RECIPE, ROW_IDENTITY_META_TABLE, ROW_IDENTITY_RECIPE_KEY, ROW_IDENTITY_SYNCED_KEY, IDENTITY_TABLE_DDL, AC_UID_GRAVEYARD_TRIGGER, ROW_IDENTITY_HEAL_KEY, HEAL_RECEIPT_TABLE, HEAL_RECEIPTS_KEPT;
 var init_row_identity = __esm({
   "packages/core/src/store/row-identity.ts"() {
     "use strict";
@@ -27395,6 +27757,7 @@ var init_row_identity = __esm({
     init_ac_table();
     init_row_identity_flag();
     init_row_identity_registry();
+    init_worktree_build_guard();
     ROW_UID_DOMAIN = "cleo/row-uid/v1";
     ROW_BIRTH_DOMAIN = "cleo/row-birth/v1";
     ROW_UID_SQL_FUNCTION = "cleo_row_uid";
@@ -27404,7 +27767,7 @@ var init_row_identity = __esm({
     AC_UID_GRAVEYARD = "tasks_ac_uid_graveyard";
     STORE_TIMESTAMP = /^(\d{4})-(\d{2})-(\d{2})(?:[T ](\d{2}):(\d{2})(?::(\d{2})(?:\.(\d{1,9}))?)?)?(Z|[+-]\d{2}:?\d{2})?$/;
     MAX_UUID_MS = 2 ** 48 - 1;
-    ROW_IDENTITY_RECIPE = "cleo/row-identity/v1";
+    ROW_IDENTITY_RECIPE = "cleo/row-identity/v2";
     ROW_IDENTITY_META_TABLE = "tasks_row_identity_meta";
     ROW_IDENTITY_RECIPE_KEY = "row_identity_recipe";
     ROW_IDENTITY_SYNCED_KEY = "row_identity_synced";
@@ -27449,6 +27812,15 @@ BEGIN
   INSERT INTO ${AC_UID_GRAVEYARD} (ac_id, uid, task_id, ordinal, text, birth_fp, deleted_at)
   VALUES (OLD.id, OLD.uid, OLD.task_id, OLD.ordinal, OLD.text, OLD.birth_fp, strftime('%Y-%m-%dT%H:%M:%fZ', 'now'));
 END`;
+    ROW_IDENTITY_HEAL_KEY = "row_identity_schema_healed";
+    HEAL_RECEIPT_TABLE = {
+      project: ROW_IDENTITY_META_TABLE,
+      // The global store declares no identity table yet (ROW_IDENTITY.global is
+      // empty, so its heal never runs); the change that declares one adds its
+      // meta table here.
+      global: null
+    };
+    HEAL_RECEIPTS_KEPT = 20;
   }
 });
 
@@ -33128,7 +33500,7 @@ var init_task_claim = __esm({
 });
 
 // packages/core/src/store/converters.ts
-import { z as z26 } from "zod";
+import { z as z27 } from "zod";
 function readStoredAcceptance(row) {
   if (row.acceptanceJson === null || row.acceptanceJson === void 0) return void 0;
   try {
@@ -33286,7 +33658,7 @@ var init_converters = __esm({
     init_src();
     init_parsers();
     init_task_claim();
-    storedAcceptanceSchema = z26.custom(
+    storedAcceptanceSchema = z27.custom(
       (value) => Array.isArray(value) && value.every((item) => acceptanceItemSchema.safeParse(item).success)
     );
   }
@@ -35949,7 +36321,7 @@ import {
 } from "node:fs";
 import { createRequire as createRequire5 } from "node:module";
 import { basename as basename7, dirname as dirname12, join as join13 } from "node:path";
-import { z as z27 } from "zod";
+import { z as z28 } from "zod";
 function formatBackupTimestamp(d) {
   const pad = (n, len = 2) => String(n).padStart(len, "0");
   return `${d.getFullYear()}${pad(d.getMonth() + 1)}${pad(d.getDate())}-${pad(d.getHours())}${pad(d.getMinutes())}${pad(d.getSeconds())}`;
@@ -36086,16 +36458,16 @@ var init_backup_sidecar = __esm({
     init_logger2();
     PRE_COLLAPSE_BACKUP_TYPE = "migration";
     MARKER_PREFIX = "twin_collapse:";
-    backupSidecarSchema = z27.object({
-      backupId: z27.string().min(1),
-      type: z27.string().min(1),
-      timestamp: z27.string().min(1),
-      note: z27.string().optional(),
-      files: z27.array(z27.string()),
-      pinned: z27.boolean().optional(),
-      pinnedReason: z27.string().optional(),
-      releasedAt: z27.string().optional(),
-      releasedReason: z27.string().optional()
+    backupSidecarSchema = z28.object({
+      backupId: z28.string().min(1),
+      type: z28.string().min(1),
+      timestamp: z28.string().min(1),
+      note: z28.string().optional(),
+      files: z28.array(z28.string()),
+      pinned: z28.boolean().optional(),
+      pinnedReason: z28.string().optional(),
+      releasedAt: z28.string().optional(),
+      releasedReason: z28.string().optional()
     }).passthrough();
   }
 });
@@ -36267,7 +36639,7 @@ var init_pre_repair_snapshot = __esm({
 import { createHash as createHash5 } from "node:crypto";
 import { basename as basename8, dirname as dirname15 } from "node:path";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
-import { z as z28 } from "zod";
+import { z as z29 } from "zod";
 function hasMainTable(db, name15) {
   return db.prepare("SELECT 1 FROM main.sqlite_master WHERE type = 'table' AND name = ?").get(name15) !== void 0;
 }
@@ -37400,20 +37772,20 @@ var init_twin_collapse = __esm({
     SHADOW_WRITE_REFUSED = "E_TWIN_COLLAPSE_FAILED: store is read-only until the twin collapse succeeds; run cleo doctor twin-collapse";
     SHADOW_WRITE_OPS = ["INSERT", "UPDATE", "DELETE"];
     STICKY_ARCHIVE_KEY = `${TWIN_COLLAPSE_ARCHIVE_PREFIX}sticky_tags`;
-    FocusNotesShape = z28.object({ sessionNotes: z28.array(z28.unknown()) }).passthrough();
-    StickyArchiveShape = z28.array(z28.string());
-    RecoveryReceiptShape = z28.object({
-      task: z28.literal("T12727"),
-      id: z28.string(),
-      recoveredAt: z28.string(),
-      snapshot: z28.string().nullable(),
-      archived: z28.array(z28.object({ key: z28.string(), archiveKey: z28.string(), sha: z28.string() })),
-      focusNotesAdded: z28.number(),
-      stickyArchived: z28.array(z28.string()),
-      stickyArchiveKey: z28.string(),
-      before: z28.object({ focusState: z28.string().nullable(), stickyArchive: z28.string().nullable() }),
-      after: z28.object({ focusState: z28.string().nullable(), stickyArchive: z28.string().nullable() }),
-      rolledBackAt: z28.string().nullable()
+    FocusNotesShape = z29.object({ sessionNotes: z29.array(z29.unknown()) }).passthrough();
+    StickyArchiveShape = z29.array(z29.string());
+    RecoveryReceiptShape = z29.object({
+      task: z29.literal("T12727"),
+      id: z29.string(),
+      recoveredAt: z29.string(),
+      snapshot: z29.string().nullable(),
+      archived: z29.array(z29.object({ key: z29.string(), archiveKey: z29.string(), sha: z29.string() })),
+      focusNotesAdded: z29.number(),
+      stickyArchived: z29.array(z29.string()),
+      stickyArchiveKey: z29.string(),
+      before: z29.object({ focusState: z29.string().nullable(), stickyArchive: z29.string().nullable() }),
+      after: z29.object({ focusState: z29.string().nullable(), stickyArchive: z29.string().nullable() }),
+      rolledBackAt: z29.string().nullable()
     });
   }
 });
@@ -40995,12 +41367,12 @@ var init_safety_data_accessor = __esm({
           this.getSafetyOptions()
         );
       }
-      async insertNewTask(task) {
+      async insertNewTask(task, identity) {
         this.logVerbose(`Inserting new task ${task.id}`);
         await safeSingleTaskWrite(
           this.inner,
           task.id,
-          () => this.inner.insertNewTask(task),
+          () => this.inner.insertNewTask(task, identity),
           this.cwd,
           this.getSafetyOptions()
         );
@@ -41048,6 +41420,9 @@ var init_safety_data_accessor = __esm({
         return this.inner.findOrphanAcBindings();
       }
       // ---- Metadata (pass-through to inner) ----
+      async getTaskIdentities(taskIds) {
+        return await this.inner.getTaskIdentities?.(taskIds) ?? [];
+      }
       async getMetaValue(key) {
         return this.inner.getMetaValue(key);
       }
@@ -41421,13 +41796,147 @@ var init_cross_db_cleanup = __esm({
   }
 });
 
+// packages/core/src/store/dependency-cycles.ts
+function formatDependencyCycle(cycle) {
+  return cycle.join(" \u2192 ");
+}
+function buildAdjacency(edges) {
+  const adjacency = /* @__PURE__ */ new Map();
+  for (const { taskId, dependsOn } of edges) {
+    const next = adjacency.get(taskId);
+    if (next) next.push(dependsOn);
+    else adjacency.set(taskId, [dependsOn]);
+  }
+  for (const next of adjacency.values()) next.sort();
+  return adjacency;
+}
+function shortestPath(adjacency, from, to) {
+  if (from === to) return [from];
+  const previous = /* @__PURE__ */ new Map([[from, from]]);
+  const queue = [from];
+  for (let head = 0; head < queue.length; head++) {
+    const id = queue[head];
+    for (const next of adjacency.get(id) ?? []) {
+      if (previous.has(next)) continue;
+      previous.set(next, id);
+      if (next === to) {
+        const path = [to];
+        let cursor = id;
+        while (cursor !== from) {
+          path.push(cursor);
+          cursor = previous.get(cursor);
+        }
+        path.push(from);
+        return path.reverse();
+      }
+      queue.push(next);
+    }
+  }
+  return null;
+}
+function findClosedCycle(existing, edge) {
+  if (edge.taskId === edge.dependsOn) return [edge.taskId, edge.taskId];
+  const path = shortestPath(buildAdjacency(existing), edge.dependsOn, edge.taskId);
+  return path ? [edge.taskId, ...path] : null;
+}
+function dependencyCycleError(edge, cycle) {
+  const self = edge.taskId === edge.dependsOn;
+  const message = self ? `${DEPENDENCY_CYCLE_CODE}: task ${edge.taskId} cannot depend on itself` : `${DEPENDENCY_CYCLE_CODE}: ${edge.taskId} depends on ${edge.dependsOn} would close a dependency cycle: ${formatDependencyCycle(cycle)}`;
+  const closing = cycle.length >= 3 ? cycle[cycle.length - 2] : void 0;
+  const fix = self ? `Drop ${edge.taskId} from its own --depends list` : `Drop this dependency, or first remove another edge of the cycle, e.g. cleo update ${closing} --remove-depends ${edge.taskId}`;
+  return new CleoError(14 /* CIRCULAR_REFERENCE */, message, {
+    fix,
+    details: {
+      field: "depends",
+      actual: edge.dependsOn,
+      taskId: edge.taskId,
+      cycle: [...cycle]
+    }
+  });
+}
+function isDependencyCycleAbort(err) {
+  for (let e = err, depth = 0; e instanceof Error && depth < 8; depth++) {
+    if (e.message.includes(DEPENDENCY_CYCLE_CODE)) return true;
+    e = e.cause;
+  }
+  return false;
+}
+function readDependencyEdges(db) {
+  return db.select({
+    taskId: tasksTaskDependencies.taskId,
+    dependsOn: tasksTaskDependencies.dependsOn
+  }).from(tasksTaskDependencies).all();
+}
+function rethrowDependencyCycle(db, err, attempted) {
+  if (!isDependencyCycleAbort(err)) throw err;
+  const edges = readDependencyEdges(db);
+  for (const edge of attempted) {
+    const cycle = findClosedCycle(edges, edge);
+    if (cycle) throw dependencyCycleError(edge, cycle);
+    edges.push(edge);
+  }
+  throw err;
+}
+var DEPENDENCY_CYCLE_CODE;
+var init_dependency_cycles = __esm({
+  "packages/core/src/store/dependency-cycles.ts"() {
+    "use strict";
+    init_src();
+    init_errors2();
+    init_tasks_schema();
+    DEPENDENCY_CYCLE_CODE = "E_TASK_DEPENDENCY_CYCLE";
+  }
+});
+
 // packages/core/src/store/db-helpers.ts
 import { and as and5, eq as eq7, inArray as inArray3, sql as sql27 } from "drizzle-orm";
 async function upsertTask(db, row, archiveFields, allowOrphanParent = false) {
   await writeTaskRow(db, row, archiveFields, allowOrphanParent, false);
 }
-async function insertNewTask(db, row) {
-  await writeTaskRow(db, row, void 0, false, true);
+async function insertNewTask(db, row, identity = { origin: "new" }) {
+  await writeTaskRow(
+    db,
+    { ...row, ...await importedIdentity(db, identity, row) },
+    void 0,
+    false,
+    true
+  );
+}
+async function tableExists2(db, table) {
+  const rows = await db.all(
+    sql27`SELECT 1 AS x FROM sqlite_master WHERE type = 'table' AND name = ${table}`
+  );
+  return rows.length > 0;
+}
+async function importedIdentity(db, identity, row) {
+  if (identity.origin === "new" || !rowUidFillEnabled()) return {};
+  const fp = identity.birthFp ?? null;
+  const carried2 = identity.uid ?? null;
+  if (carried2 !== null && fp !== null) {
+    let uid = carried2;
+    if (await tableExists2(db, "tasks_uid_aliases")) {
+      for (let hop = 0; hop < 32; hop++) {
+        const found = await db.all(
+          sql27`SELECT new_uid AS uid FROM tasks_uid_aliases
+               WHERE entity_table = 'tasks_tasks' AND old_uid = ${uid} AND old_birth_fp = ${fp}`
+        );
+        const next = found[0];
+        if (!next) break;
+        uid = next.uid;
+      }
+    }
+    const [holder] = await db.select({ id: tasksTasks.id, birthFp: tasksTasks.birthFp }).from(tasksTasks).where(eq7(tasksTasks.uid, uid)).limit(1).all();
+    if (holder && holder.birthFp === fp) throw new SameRowPresentError(row.id, holder.id);
+    if (await tableExists2(db, "tasks_identity_quarantine")) {
+      const [held] = await db.all(
+        sql27`SELECT 1 AS x FROM tasks_identity_quarantine
+             WHERE entity_table = 'tasks_tasks' AND uid = ${uid} AND birth_fp = ${fp}`
+      );
+      if (held) throw new SameRowPresentError(row.id, "held");
+    }
+    if (!holder) return { uid, birthFp: fp };
+  }
+  return { uid: null, birthFp: null };
 }
 async function writeTaskRow(db, row, archiveFields, allowOrphanParent, insertOnly) {
   if (row.parentId && row.parentId === row.id) {
@@ -41578,7 +42087,11 @@ async function batchUpdateDependencies(db, tasks2, validIds) {
     for (const depId of want) if (!have.has(depId)) added.push({ taskId, dependsOn: depId });
   }
   if (added.length > 0) {
-    await db.insert(tasksTaskDependencies).values(added).onConflictDoNothing().run();
+    try {
+      await db.insert(tasksTaskDependencies).values(added).onConflictDoNothing().run();
+    } catch (err) {
+      rethrowDependencyCycle(db, err, added);
+    }
   }
 }
 async function loadDependenciesForTasks(db, tasks2, _validationIds) {
@@ -41623,15 +42136,29 @@ async function loadRelationsForTasks(db, tasks2) {
     task.relates = relations && relations.length > 0 ? relations : [];
   }
 }
-var log6;
+var log6, SameRowPresentError;
 var init_db_helpers = __esm({
   "packages/core/src/store/db-helpers.ts"() {
     "use strict";
     init_src();
     init_errors2();
     init_logger2();
+    init_dependency_cycles();
+    init_row_identity_flag();
     init_tasks_schema();
     log6 = getLogger("db-helpers");
+    SameRowPresentError = class extends CleoError {
+      /** Where the row already is: its display id, or `held` when quarantined. */
+      presentAs;
+      constructor(taskId, presentAs) {
+        super(
+          22 /* ID_COLLISION */,
+          `Task ${taskId} is already in this store (${presentAs === "held" ? "held for sync" : `as ${presentAs}`}): same uid and birth fingerprint; not written again`,
+          { details: { field: "taskId", actual: taskId, expected: presentAs } }
+        );
+        this.presentAs = presentAs;
+      }
+    };
   }
 });
 
@@ -41716,46 +42243,133 @@ function readProcessEntry(pid) {
     return null;
   }
 }
-function resolvePpidKey(ppid, lookupProcess) {
+function readProcessArgs(pid) {
+  if (process.platform === "win32" || !Number.isInteger(pid) || pid <= 1) return null;
+  try {
+    const out = execFileSync("ps", ["-o", "args=", "-p", String(pid)], {
+      encoding: "utf8",
+      timeout: 1e3,
+      stdio: ["ignore", "pipe", "ignore"],
+      env: { ...process.env, ...PS_STABLE_ENV }
+    }).trim();
+    return out === "" ? null : out;
+  } catch {
+    return null;
+  }
+}
+function baseName(token) {
+  return token.slice(token.lastIndexOf("/") + 1).replace(/^-/, "");
+}
+function programName(commandLine) {
+  const tokens = commandLine.trim().split(/\s+/);
+  const head = baseName(tokens[0] ?? "");
+  if (!RUNTIME_PATTERN.test(head)) return head;
+  for (let i = 1; i < tokens.length; i++) {
+    const token = tokens[i] ?? "";
+    if (token === "-m") return (tokens[i + 1] ?? head).split(".")[0] ?? head;
+    if (token.startsWith("-")) continue;
+    return baseName(token).replace(/\.(c|m)?(js|ts)$|\.py$/, "");
+  }
+  return head;
+}
+function isCommandStringShell(args) {
+  const tokens = args.trim().split(/\s+/);
+  const shell = programName(args);
+  let first = 1;
+  if (RUNTIME_PATTERN.test(baseName(tokens[0] ?? ""))) {
+    while (first < tokens.length && (tokens[first] ?? "").startsWith("-")) first++;
+    first++;
+  }
+  const rest = tokens.slice(first);
+  if (shell === "pwsh" || shell === "powershell") {
+    return rest.some((t) => PWSH_COMMAND_SWITCHES.has(t.toLowerCase()));
+  }
+  for (let i = 0; i < rest.length; i++) {
+    const token = rest[i] ?? "";
+    if (token === "--") return false;
+    if (token === "--command" || token === "--commands") return true;
+    if (SHELL_OPTIONS_WITH_ARGUMENT.has(token)) {
+      i++;
+      continue;
+    }
+    if (token.startsWith("--")) continue;
+    if (!/^[-+][A-Za-z]+$/.test(token)) return false;
+    if (token.startsWith("-") && token.slice(1).includes("c")) return true;
+  }
+  return false;
+}
+function resolveAncestor(ppid, lookupProcess, lookupArgs, agentId = null) {
   let pid = ppid;
-  for (let depth = 0; depth < PPID_CHAIN_MAX_DEPTH && pid > 1; depth++) {
+  for (let depth = 0; depth < PPID_CHAIN_MAX_DEPTH; depth++) {
+    if (pid <= 1) return null;
     const entry = lookupProcess(pid);
-    if (!entry) return null;
-    if (!PPID_CHAIN_LAUNCHERS.has(entry.command)) {
-      return { key: `ppid:${entry.pid}@${entry.startedAt}`, source: "ppid", kind: "ppid" };
+    if (!entry || entry.pid <= 1) return null;
+    const args = lookupArgs(entry.pid);
+    const program = programName(args ?? entry.command);
+    if (INIT_PROCESSES.has(program) || INIT_PROCESSES.has(entry.command)) return null;
+    if (OWNER_PROCESS_SHELLS.has(program)) {
+      if (args === null) return null;
+      if (!isCommandStringShell(args)) return { entry, program, type: "shell" };
+    } else if (!ANCESTOR_WRAPPERS.has(program)) {
+      if (KNOWN_HARNESSES.has(program)) return { entry, program, type: "harness" };
+      return agentId ? { entry, program, type: "host" } : null;
     }
     pid = entry.ppid;
   }
   return null;
 }
+function anchorKey(anchor, agentId, under) {
+  const proc = `${anchor.entry.pid}@${anchor.entry.startedAt}`;
+  if (anchor.type === "shell" && !agentId) {
+    return { key: `proc:${proc}`, source: "process", kind: "process" };
+  }
+  const agent = agentId ? `#agent=${agentId}` : "";
+  const scope = under ? `|${under.key}` : "";
+  return {
+    key: `harness:${anchor.program}:${proc}${agent}${scope}`,
+    source: "process",
+    kind: "harness"
+  };
+}
 function resolveTerminalKeys(options = {}) {
   const env = options.env ?? process.env;
   const keys = [];
   for (const source of TERMINAL_KEY_SOURCES) {
     const value = envValue(env, source.envVar);
     if (value === null) continue;
-    const qualifier = envValue(env, source.qualifierEnvVar);
+    const qualifiers = [source.qualifierEnvVar, ...source.extraQualifierEnvVars ?? []].map((name15) => envValue(env, name15)).filter((q2) => q2 !== null);
     keys.push({
-      key: `env:${source.envVar}=${qualifier === null ? value : `${qualifier}|${value}`}`,
+      key: `env:${source.envVar}=${[...qualifiers, value].join("|")}`,
       source: source.envVar,
       kind: source.kind
     });
   }
-  if (keys.length > 0) return keys;
-  const live = options.ppid === void 0 && options.lookupProcess === void 0;
-  let ppidKey;
+  if (keys.some((k) => k.kind === "provider")) return keys;
+  const agentId = envValue(env, "CLEO_AGENT_ID");
+  const live = options.ppid === void 0 && options.lookupProcess === void 0 && options.lookupArgs === void 0;
+  let anchor;
   if (live) {
-    if (livePpidKey === void 0) livePpidKey = resolvePpidKey(process.ppid, readProcessEntry);
-    ppidKey = livePpidKey;
+    const memoKey2 = agentId ?? "";
+    if (!liveAnchors.has(memoKey2))
+      liveAnchors.set(
+        memoKey2,
+        resolveAncestor(process.ppid, readProcessEntry, readProcessArgs, agentId)
+      );
+    anchor = liveAnchors.get(memoKey2) ?? null;
   } else {
-    ppidKey = resolvePpidKey(
+    anchor = resolveAncestor(
       options.ppid ?? process.ppid,
-      options.lookupProcess ?? readProcessEntry
+      options.lookupProcess ?? readProcessEntry,
+      options.lookupArgs ?? readProcessArgs,
+      agentId
     );
   }
-  return ppidKey ? [ppidKey] : [];
+  if (!anchor) return keys;
+  if (keys.length === 0) return [anchorKey(anchor, agentId, void 0)];
+  if (anchor.type === "shell" && !agentId) return keys;
+  return [...keys, anchorKey(anchor, agentId, keys[0])];
 }
-var TERMINAL_KEY_SOURCES, PPID_CHAIN_LAUNCHERS, PPID_CHAIN_MAX_DEPTH, livePpidKey;
+var TERMINAL_KEY_SOURCES, PPID_CHAIN_MAX_DEPTH, KNOWN_HARNESSES, RUNTIME_PATTERN, ANCESTOR_WRAPPERS, INIT_PROCESSES, SHELL_OPTIONS_WITH_ARGUMENT, PWSH_COMMAND_SWITCHES, OWNER_PROCESS_SHELLS, liveAnchors;
 var init_terminal_identity = __esm({
   "packages/core/src/sessions/terminal-identity.ts"() {
     "use strict";
@@ -41787,24 +42401,100 @@ var init_terminal_identity = __esm({
         kind: "terminal",
         origin: "konsole",
         qualifierEnvVar: "KONSOLE_DBUS_SERVICE"
+      },
+      // T12864 — non-terminal callers whose platform exports a per-job / per-login id.
+      // GitHub Actions: GITHUB_RUN_ID is per run and shared by its jobs, so it is
+      // qualified by GITHUB_RUN_ATTEMPT and GITHUB_JOB ("Variables reference",
+      // docs.github.com/en/actions/reference/workflows-and-actions/variables).
+      // Every step of one job shares the key; the steps run sequentially.
+      {
+        envVar: "GITHUB_RUN_ID",
+        kind: "terminal",
+        origin: "github-actions",
+        qualifierEnvVar: "GITHUB_RUN_ATTEMPT",
+        extraQualifierEnvVars: ["GITHUB_JOB"]
+      },
+      // GitLab CI: CI_JOB_ID is unique per job across the instance ("Predefined
+      // CI/CD variables reference", docs.gitlab.com/ci/variables/predefined_variables).
+      { envVar: "CI_JOB_ID", kind: "terminal", origin: "gitlab-ci" },
+      // OpenSSH login with a tty: SSH_TTY names the login's tty and is set only
+      // when one was allocated; SSH_CONNECTION ("client-ip client-port server-ip
+      // server-port", ssh(1) ENVIRONMENT) disambiguates it across connections. A
+      // one-shot `ssh host 'cmd'` has no tty and falls through to the ancestor walk.
+      {
+        envVar: "SSH_TTY",
+        kind: "terminal",
+        origin: "openssh",
+        qualifierEnvVar: "SSH_CONNECTION"
       }
     ];
-    PPID_CHAIN_LAUNCHERS = /* @__PURE__ */ new Set([
-      "node",
+    PPID_CHAIN_MAX_DEPTH = 12;
+    KNOWN_HARNESSES = /* @__PURE__ */ new Set([
+      "claude",
+      "codex",
+      "aider",
+      "gemini",
+      "kimi",
+      "cursor-agent",
+      "amp"
+    ]);
+    RUNTIME_PATTERN = /^(node|nodejs|bun|deno|python[0-9.]*|pypy[0-9.]*|ruby|java|php|perl)$/;
+    ANCESTOR_WRAPPERS = /* @__PURE__ */ new Set([
+      "env",
+      "timeout",
+      "gtimeout",
+      "nohup",
+      "nice",
+      "time",
+      "xargs",
+      "stdbuf",
+      "sudo",
+      "doas",
       "npm",
+      "npm-cli",
       "npx",
+      "npx-cli",
       "pnpm",
       "pnpx",
       "yarn",
-      "bun",
       "bunx",
-      "tsx",
       "corepack",
       "mise",
-      "env",
       "cleo"
     ]);
-    PPID_CHAIN_MAX_DEPTH = 4;
+    INIT_PROCESSES = /* @__PURE__ */ new Set(["launchd", "systemd", "init"]);
+    SHELL_OPTIONS_WITH_ARGUMENT = /* @__PURE__ */ new Set([
+      "-o",
+      "+o",
+      "-O",
+      "+O",
+      "--rcfile",
+      "--init-file"
+    ]);
+    PWSH_COMMAND_SWITCHES = /* @__PURE__ */ new Set([
+      "-c",
+      "-command",
+      "-commandwithargs",
+      "-cwa",
+      "-e",
+      "-ec",
+      "-encodedcommand"
+    ]);
+    OWNER_PROCESS_SHELLS = /* @__PURE__ */ new Set([
+      "sh",
+      "bash",
+      "zsh",
+      "dash",
+      "fish",
+      "ksh",
+      "tcsh",
+      "csh",
+      "pwsh",
+      "powershell",
+      "nu",
+      "xonsh"
+    ]);
+    liveAnchors = /* @__PURE__ */ new Map();
   }
 });
 
@@ -41844,7 +42534,8 @@ var init_session_binding_schema = __esm({
 });
 
 // packages/core/src/store/session-store.ts
-import { and as and6, desc as desc2, eq as eq8, isNull as isNull3, lte as lte2, or as or4 } from "drizzle-orm";
+import { existsSync as existsSync19 } from "node:fs";
+import { and as and6, desc as desc2, eq as eq8, inArray as inArray4, isNull as isNull3, lte as lte2, or as or4 } from "drizzle-orm";
 async function getSession(sessionId, cwd) {
   const scope = captureProjectScope(cwd ?? getProjectRoot(), worktreeScope.getStore());
   return worktreeScope.run(scope, async () => {
@@ -41866,8 +42557,9 @@ async function getActiveSession(cwd) {
 function splitTerminalKeys(keys) {
   return {
     provider: keys.find((k) => k.kind === "provider"),
-    pane: keys.find((k) => k.kind === "multiplexer"),
-    tab: keys.find((k) => k.kind === "terminal" || k.kind === "ppid")
+    // A harness / CLEO_AGENT_ID agent (T12864) is more specific than a pane.
+    pane: keys.find((k) => k.kind === "harness") ?? keys.find((k) => k.kind === "multiplexer"),
+    tab: keys.find((k) => k.kind === "terminal" || k.kind === "process" || k.kind === "ppid")
   };
 }
 async function readBinding(db, key) {
@@ -41947,6 +42639,7 @@ async function resolveCurrentSession(cwd) {
 async function resolveBoundSession(cwd) {
   const scope = captureProjectScope(cwd ?? getProjectRoot(), worktreeScope.getStore());
   return worktreeScope.run(scope, async () => {
+    if (!existsSync19(getDbPath(scope.worktreeRoot))) return null;
     const connId = getCurrentConnectionSessionId();
     if (connId) {
       const byConn = await getSession(connId, scope.worktreeRoot);
@@ -42098,7 +42791,7 @@ __export(registry_exports2, {
   updateAgentStatus: () => updateAgentStatus
 });
 import { randomBytes as randomBytes2 } from "node:crypto";
-import { and as and7, eq as eq9, inArray as inArray4, lt as lt2, sql as sql29 } from "drizzle-orm";
+import { and as and7, eq as eq9, inArray as inArray5, lt as lt2, sql as sql29 } from "drizzle-orm";
 function generateAgentId() {
   const now = /* @__PURE__ */ new Date();
   const ts = now.toISOString().replace(/[-:T]/g, "").substring(0, 14);
@@ -42187,11 +42880,11 @@ async function listAgentInstances(filters, cwd) {
   const conditions = [];
   if (filters?.status) {
     const statuses = Array.isArray(filters.status) ? filters.status : [filters.status];
-    conditions.push(inArray4(agentInstances.status, statuses));
+    conditions.push(inArray5(agentInstances.status, statuses));
   }
   if (filters?.agentType) {
     const types = Array.isArray(filters.agentType) ? filters.agentType : [filters.agentType];
-    conditions.push(inArray4(agentInstances.agentType, types));
+    conditions.push(inArray5(agentInstances.agentType, types));
   }
   if (filters?.sessionId) {
     conditions.push(eq9(agentInstances.sessionId, filters.sessionId));
@@ -42228,7 +42921,7 @@ async function checkAgentHealth(thresholdMs = 3e4, cwd) {
   const cutoff = new Date(Date.now() - thresholdMs).toISOString();
   return db.select().from(agentInstances).where(
     and7(
-      inArray4(agentInstances.status, ["active", "idle", "starting"]),
+      inArray5(agentInstances.status, ["active", "idle", "starting"]),
       lt2(agentInstances.lastHeartbeat, cutoff)
     )
   ).all();
@@ -42323,12 +43016,14 @@ var init_registry2 = __esm({
 // packages/core/src/store/sqlite-data-accessor.ts
 var sqlite_data_accessor_exports = {};
 __export(sqlite_data_accessor_exports, {
+  RENAMED_RECENT_MS: () => RENAMED_RECENT_MS,
   addTaskLabelsNative: () => addTaskLabelsNative,
   advanceTaskIdSequence: () => advanceTaskIdSequence,
   bindTaskAccessorScope: () => bindTaskAccessorScope,
   captureTaskAccessorScope: () => captureProjectScope,
   clearAcUidGraveyardNative: () => clearAcUidGraveyardNative,
   clearBirthFpNative: () => clearBirthFpNative,
+  clearReplacedTaskIdentityNative: () => clearReplacedTaskIdentityNative,
   clearRowUidNative: () => clearRowUidNative,
   createSqliteDataAccessor: () => createSqliteDataAccessor,
   deleteDisplayIdAliasNative: () => deleteDisplayIdAliasNative,
@@ -42339,6 +43034,7 @@ __export(sqlite_data_accessor_exports, {
   insertIdentityRowNative: () => insertIdentityRowNative,
   insertQuarantineNative: () => insertQuarantineNative,
   insertUidAliasNative: () => insertUidAliasNative,
+  readReplacedTaskBirthNative: () => readReplacedTaskBirthNative,
   rederiveAcIdsNative: () => rederiveAcIdsNative,
   rekeyQuarantineNative: () => rekeyQuarantineNative,
   relinkAcUidNative: () => relinkAcUidNative,
@@ -42355,7 +43051,7 @@ import {
   and as and8,
   eq as eq10,
   getTableColumns as getTableColumns2,
-  inArray as inArray5,
+  inArray as inArray6,
   isNull as isNull4,
   like as like2,
   lte as lte3,
@@ -42379,8 +43075,8 @@ async function selectAcBindings(db, acIds) {
     bindingType: b.bindingType,
     createdAt: b.createdAt
   };
-  const byUid = await db.select(columns).from(b).innerJoin(ac, eq10(ac.uid, b.acUid)).where(inArray5(ac.id, ids)).all();
-  const byId = await db.select(columns).from(b).leftJoin(ac, eq10(ac.uid, b.acUid)).where(inArray5(b.acId, ids)).all();
+  const byUid = await db.select(columns).from(b).innerJoin(ac, eq10(ac.uid, b.acUid)).where(inArray6(ac.id, ids)).all();
+  const byId = await db.select(columns).from(b).leftJoin(ac, eq10(ac.uid, b.acUid)).where(inArray6(b.acId, ids)).all();
   const rows = [...byUid, ...byId];
   const wanted = new Set(ids);
   const seen = /* @__PURE__ */ new Set();
@@ -42473,6 +43169,7 @@ function renameTaskDisplayIdNative(nativeDb, uid, toId, refs, guard = {}) {
   if (Number(changed) !== 1) {
     throw taskConflictError(current.id, taskVersion(current), null);
   }
+  recordLocalRename(nativeDb, uid, current.id, toId, taskVersion(current));
   const rewritten = {};
   const q2 = (name15) => `"${name15.replaceAll('"', '""')}"`;
   for (const ref of refs) {
@@ -42528,23 +43225,39 @@ function rederiveAcIdsNative(nativeDb, fromId, toId) {
   }
   return count;
 }
-function insertDisplayIdAliasNative(nativeDb, row) {
+function insertDisplayIdAliasNative(nativeDb, row, precedes) {
+  const stored = nativeDb.prepare(
+    `SELECT uid, entity_table AS entityTable, display_id AS displayId, entity_uid AS entityUid,
+              reason, origin, displaced_hlc AS displacedHlc, created_at AS createdAt,
+              entity_birth_fp AS entityBirthFp
+         FROM tasks_display_id_aliases WHERE uid = ?`
+  ).get(row.uid);
+  if (!stored) {
+    nativeDb.prepare(
+      `INSERT INTO tasks_display_id_aliases
+           (uid, entity_table, display_id, entity_uid, reason, origin, displaced_hlc, created_at,
+            entity_birth_fp)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`
+    ).run(
+      row.uid,
+      row.entityTable,
+      row.displayId,
+      row.entityUid,
+      row.reason,
+      row.origin,
+      row.displacedHlc,
+      row.createdAt,
+      row.entityBirthFp
+    );
+    return;
+  }
+  if (!precedes(row, stored)) return;
   nativeDb.prepare(
-    `INSERT OR IGNORE INTO tasks_display_id_aliases
-         (uid, entity_table, display_id, entity_uid, reason, origin, displaced_hlc, created_at,
-          entity_birth_fp)
-       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`
-  ).run(
-    row.uid,
-    row.entityTable,
-    row.displayId,
-    row.entityUid,
-    row.reason,
-    row.origin,
-    row.displacedHlc,
-    row.createdAt,
-    row.entityBirthFp
-  );
+    `UPDATE tasks_display_id_aliases
+          SET origin = ?, displaced_hlc = ?, created_at = ?,
+              entity_birth_fp = coalesce(entity_birth_fp, ?)
+        WHERE uid = ?`
+  ).run(row.origin, row.displacedHlc, row.createdAt, row.entityBirthFp, row.uid);
 }
 function deleteDisplayIdAliasNative(nativeDb, uid) {
   nativeDb.prepare("DELETE FROM tasks_display_id_aliases WHERE uid = ?").run(uid);
@@ -42606,6 +43319,63 @@ function relinkAcUidNative(nativeDb, acId, uid, birthFp) {
 function clearAcUidGraveyardNative(nativeDb) {
   nativeDb.exec("DELETE FROM tasks_ac_uid_graveyard");
 }
+function readReplacedTaskBirthNative(nativeDb, taskId) {
+  return nativeDb.prepare("SELECT created_at AS createdAt, uid FROM tasks_tasks WHERE id = ?").get(taskId);
+}
+function clearReplacedTaskIdentityNative(nativeDb, taskId, before) {
+  const row = nativeDb.prepare("SELECT uid, birth_fp AS fp, created_at AS createdAt FROM tasks_tasks WHERE id = ?").get(taskId);
+  if (!row || row.uid === null && row.fp === null) return;
+  if (before) {
+    const was = parseStoreTimestamp(before.createdAt);
+    if (was !== null && was === parseStoreTimestamp(row.createdAt)) {
+      return;
+    }
+  }
+  if (rowIdentityShared(nativeDb)) {
+    throw new CleoError(
+      6 /* VALIDATION_ERROR */,
+      `Task ${taskId} cannot be overwritten by an import: its identity is shared with other devices`,
+      {
+        fix: "Import it under a new id (the default duplicate strategy), or edit the task instead of overwriting it.",
+        details: { field: "taskId", actual: taskId }
+      }
+    );
+  }
+  const has = (table) => nativeDb.prepare("SELECT 1 AS x FROM sqlite_master WHERE type = 'table' AND name = ?").get(table) !== void 0;
+  nativeDb.prepare("UPDATE tasks_tasks SET uid = NULL, birth_fp = NULL WHERE id = ?").run(taskId);
+  for (const spec of ROW_IDENTITY.project) {
+    if (spec.kind !== "natural" || !has(spec.table)) continue;
+    const cols = (spec.keyRefs ?? []).filter((r) => r.table === "tasks_tasks").map((r) => r.column);
+    if (cols.length === 0) continue;
+    nativeDb.prepare(
+      `UPDATE main.${quoteIdent2(spec.table)} SET uid = NULL WHERE ${cols.map((c) => `${quoteIdent2(c)} = ?`).join(" OR ")}`
+    ).run(...cols.map(() => taskId));
+  }
+  const children = ["tasks_task_acceptance_criteria_history", "tasks_evidence_ac_bindings"].filter(
+    has
+  );
+  const criteria = has("tasks_task_acceptance_criteria") ? nativeDb.prepare("SELECT id, uid FROM tasks_task_acceptance_criteria WHERE task_id = ?").all(taskId) : [];
+  if (criteria.length > 0) {
+    nativeDb.prepare(
+      "UPDATE tasks_task_acceptance_criteria SET uid = NULL, birth_fp = NULL WHERE task_id = ?"
+    ).run(taskId);
+  }
+  fillRowUids(nativeDb, "project");
+  const newUid = nativeDb.prepare("SELECT uid FROM tasks_task_acceptance_criteria WHERE id = ?");
+  let rekeyed = 0;
+  for (const ac of criteria) {
+    const now = newUid.get(ac.id)?.uid ?? null;
+    for (const table of children) {
+      rekeyed += Number(
+        nativeDb.prepare(
+          `UPDATE main.${quoteIdent2(table)} SET ac_uid = ?, birth_fp = NULL
+              WHERE ac_id = ? OR (? IS NOT NULL AND ac_uid = ?)`
+        ).run(now, ac.id, ac.uid, ac.uid).changes
+      );
+    }
+  }
+  if (rekeyed > 0) fillRowUids(nativeDb, "project");
+}
 function quoteIdent2(name15) {
   return `"${name15.replaceAll('"', '""')}"`;
 }
@@ -42693,10 +43463,50 @@ function claimPredicate(guard, allowedHolders) {
   if (guard.mode === "force") return void 0;
   const mine = guard.sessionId === null ? void 0 : eq10(holder, guard.sessionId);
   if (guard.mode === "renew" || guard.mode === "release") return mine ?? sql30`0`;
-  const related = allowedHolders.length > 0 ? inArray5(holder, [...allowedHolders]) : void 0;
+  const related = allowedHolders.length > 0 ? inArray6(holder, [...allowedHolders]) : void 0;
   const expired = guard.mode === "take-over" ? or5(isNull4(tasksTasks.leaseExpiresAt), lte3(tasksTasks.leaseExpiresAt, guard.now)) : void 0;
   return or5(isNull4(holder), mine, related, expired);
 }
+function renameRecordKey(fromId) {
+  return `renamed_from:tasks_tasks:${fromId}`;
+}
+function hasIdentityMeta(nativeDb) {
+  return nativeDb.prepare(
+    "SELECT 1 AS x FROM sqlite_master WHERE type = 'table' AND name = 'tasks_row_identity_meta'"
+  ).get() !== void 0;
+}
+function recordLocalRename(nativeDb, uid, fromId, toId, fromVersion) {
+  if (!hasIdentityMeta(nativeDb)) return;
+  const record2 = { uid, fromVersion, toId, at: (/* @__PURE__ */ new Date()).toISOString() };
+  writeRowIdentityMetaNative(nativeDb, renameRecordKey(fromId), JSON.stringify(record2));
+}
+function assertNotRenamed(nativeDb, taskId, guard, current) {
+  if (!nativeDb || !hasIdentityMeta(nativeDb)) return;
+  const raw = nativeDb.prepare("SELECT value FROM tasks_row_identity_meta WHERE key = ?").get(renameRecordKey(taskId));
+  if (!raw) return;
+  let record2;
+  try {
+    record2 = JSON.parse(raw.value);
+  } catch {
+    return;
+  }
+  if (Date.now() - Date.parse(record2.at) > RENAMED_RECENT_MS) return;
+  const renamed = nativeDb.prepare("SELECT id, claimed_by_session AS claimedBySession FROM tasks_tasks WHERE uid = ?").get(record2.uid);
+  if (!renamed || renamed.id === taskId) return;
+  const expected = guard.expectedUpdatedAt;
+  const session = guard.claim?.sessionId ?? null;
+  const holdsRenamedClaim = session !== null && (guard.claim?.mode === "renew" || guard.claim?.mode === "release") && renamed.claimedBySession === session && current?.claimedBySession !== session;
+  const readRenamed = expected !== void 0 && expected === record2.fromVersion && (current === void 0 || taskVersion(current) !== expected);
+  if (!(current === void 0 || holdsRenamedClaim || readRenamed)) return;
+  throw new CleoError(
+    26 /* TASK_RENAMED */,
+    `Task ${taskId} is now ${renamed.id}: sync re-numbered it after a display-id collision, and ${taskId} ${current ? "names another task" : "names no task"}; nothing was written`,
+    {
+      fix: `Re-read it with 'cleo show ${renamed.id}' and retry against ${renamed.id}.`,
+      details: { field: "taskId", actual: taskId, expected: renamed.id }
+    }
+  );
+}
 function assertClaimAllowed(taskId, row, guard, allowedHolders) {
   const stored = claimFromColumns(row);
   if (claimAllows(stored, guard.mode, guard.sessionId, guard.now, allowedHolders)) return;
@@ -42871,13 +43681,13 @@ async function createOwnedSqliteDataAccessor(cwd, accessorScope) {
       const db = await getDb(cwd);
       const conditions = [];
       if (query.ids && query.ids.length > 0) {
-        conditions.push(inArray5(tasksAuditLog.id, [...query.ids]));
+        conditions.push(inArray6(tasksAuditLog.id, [...query.ids]));
       }
       if (query.taskIds && query.taskIds.length > 0) {
-        conditions.push(inArray5(tasksAuditLog.taskId, [...query.taskIds]));
+        conditions.push(inArray6(tasksAuditLog.taskId, [...query.taskIds]));
       }
       if (query.actions && query.actions.length > 0) {
-        conditions.push(inArray5(tasksAuditLog.action, [...query.actions]));
+        conditions.push(inArray6(tasksAuditLog.action, [...query.actions]));
       }
       if (query.since) {
         conditions.push(sql30`${tasksAuditLog.timestamp} >= ${query.since}`);
@@ -42910,8 +43720,13 @@ async function createOwnedSqliteDataAccessor(cwd, accessorScope) {
     async upsertSingleTask(task) {
       await accessor.transaction((tx) => tx.upsertSingleTask(task));
     },
-    async insertNewTask(task) {
-      await accessor.transaction((tx) => tx.insertNewTask(task));
+    async insertNewTask(task, identity) {
+      await accessor.transaction((tx) => tx.insertNewTask(task, identity));
+    },
+    async getTaskIdentities(taskIds) {
+      if (taskIds.length === 0) return [];
+      const db = await getDb(cwd);
+      return db.select({ id: tasksTasks.id, uid: tasksTasks.uid, birthFp: tasksTasks.birthFp }).from(tasksTasks).where(inArray6(tasksTasks.id, taskIds)).all();
     },
     async addRelation(taskId, relatedTo, relationType, reason) {
       return accessor.transaction(async () => {
@@ -43088,7 +43903,7 @@ async function createOwnedSqliteDataAccessor(cwd, accessorScope) {
         if (!statuses.includes("archived")) {
           conditions.push(ne2(tasksTasks.status, "archived"));
         }
-        conditions.push(inArray5(tasksTasks.status, statuses));
+        conditions.push(inArray6(tasksTasks.status, statuses));
       } else if (filters.excludeStatus) {
         const excluded = Array.isArray(filters.excludeStatus) ? filters.excludeStatus : [filters.excludeStatus];
         for (const s of excluded) {
@@ -43102,11 +43917,11 @@ async function createOwnedSqliteDataAccessor(cwd, accessorScope) {
       if (filters.phase) conditions.push(eq10(tasksTasks.phase, filters.phase));
       if (filters.severity) {
         const severities = Array.isArray(filters.severity) ? filters.severity : [filters.severity];
-        conditions.push(inArray5(tasksTasks.severity, severities));
+        conditions.push(inArray6(tasksTasks.severity, severities));
       }
       if (filters.kind) {
         const kinds = Array.isArray(filters.kind) ? filters.kind : [filters.kind];
-        conditions.push(inArray5(tasksTasks.kind, kinds));
+        conditions.push(inArray6(tasksTasks.kind, kinds));
       }
       if (filters.parentId !== void 0) {
         if (filters.parentId === null) {
@@ -43127,7 +43942,7 @@ async function createOwnedSqliteDataAccessor(cwd, accessorScope) {
       }
       if (filters.label) {
         const labelMatchIds = db.select({ taskId: tasksTaskLabels.taskId }).from(tasksTaskLabels).where(eq10(tasksTaskLabels.label, filters.label));
-        conditions.push(inArray5(tasksTasks.id, labelMatchIds));
+        conditions.push(inArray6(tasksTasks.id, labelMatchIds));
       }
       const where = conditions.length > 0 ? and8(...conditions) : void 0;
       const countResult = await db.select({ count: sql30`count(*)` }).from(tasksTasks).where(where).get();
@@ -43170,7 +43985,7 @@ async function createOwnedSqliteDataAccessor(cwd, accessorScope) {
       const conditions = [];
       if (filters?.status) {
         const statuses = Array.isArray(filters.status) ? filters.status : [filters.status];
-        conditions.push(inArray5(tasksTasks.status, statuses));
+        conditions.push(inArray6(tasksTasks.status, statuses));
       } else {
         conditions.push(ne2(tasksTasks.status, "archived"));
       }
@@ -43235,7 +44050,7 @@ async function createOwnedSqliteDataAccessor(cwd, accessorScope) {
       if (idRows.length === 0) return [];
       const db = await getDb(cwd);
       const ids = idRows.map((r) => r.id);
-      const taskRows = await db.select().from(tasksTasks).where(inArray5(tasksTasks.id, ids)).all();
+      const taskRows = await db.select().from(tasksTasks).where(inArray6(tasksTasks.id, ids)).all();
       const tasks2 = taskRows.map(rowToTask);
       if (tasks2.length > 0) {
         const allIds = await getAllTaskIds();
@@ -43264,7 +44079,7 @@ async function createOwnedSqliteDataAccessor(cwd, accessorScope) {
       if (idRows.length === 0) return [];
       const db = await getDb(cwd);
       const ids = idRows.map((r) => r.id);
-      const rows = await db.select().from(tasksTasks).where(inArray5(tasksTasks.id, ids)).all();
+      const rows = await db.select().from(tasksTasks).where(inArray6(tasksTasks.id, ids)).all();
       const tasks2 = rows.map(rowToTask);
       if (tasks2.length > 0) {
         const allIds = await getAllTaskIds();
@@ -43278,7 +44093,7 @@ async function createOwnedSqliteDataAccessor(cwd, accessorScope) {
       const depRows = await db.select().from(tasksTaskDependencies).where(eq10(tasksTaskDependencies.dependsOn, taskId)).all();
       if (depRows.length === 0) return [];
       const dependentIds = depRows.map((r) => r.taskId);
-      const rows = await db.select().from(tasksTasks).where(inArray5(tasksTasks.id, dependentIds)).all();
+      const rows = await db.select().from(tasksTasks).where(inArray6(tasksTasks.id, dependentIds)).all();
       const tasks2 = rows.map(rowToTask);
       if (tasks2.length > 0) {
         const allIds = await getAllTaskIds();
@@ -43308,7 +44123,7 @@ async function createOwnedSqliteDataAccessor(cwd, accessorScope) {
     async loadTasks(taskIds) {
       if (taskIds.length === 0) return [];
       const db = await getDb(cwd);
-      const rows = await db.select().from(tasksTasks).where(inArray5(tasksTasks.id, taskIds)).all();
+      const rows = await db.select().from(tasksTasks).where(inArray6(tasksTasks.id, taskIds)).all();
       const tasks2 = rows.map(rowToTask);
       if (tasks2.length > 0) {
         const allIds = await getAllTaskIds();
@@ -43362,6 +44177,9 @@ async function createOwnedSqliteDataAccessor(cwd, accessorScope) {
           createdAt: tasksTasks.createdAt,
           ...CLAIM_COLUMNS
         }).from(tasksTasks).where(eq10(tasksTasks.id, taskId)).limit(1).all();
+        if (guard?.claim || guard?.expectedUpdatedAt !== void 0) {
+          assertNotRenamed(getNativeTasksDb(cwd), taskId, guard, current);
+        }
         if (!current) throw new Error(`Task not found: ${taskId}`);
         const claimGuard = guard?.claim;
         const allowedHolders = claimGuard ? await claimAllowedHolders(db, claimGuard) : [];
@@ -43439,24 +44257,37 @@ async function createOwnedSqliteDataAccessor(cwd, accessorScope) {
               nativeDb.prepare(`SAVEPOINT ${spName}`).run();
             }
             try {
+              const replacedBirths = /* @__PURE__ */ new Map();
               const tx = {
                 async upsertSingleTask(task) {
                   scope.assertActive();
                   return accessor.transaction(async () => {
                     scope.assertActive();
+                    if (rowUidFillEnabled() && !replacedBirths.has(task.id)) {
+                      const before = readReplacedTaskBirthNative(nativeDb, task.id);
+                      if (before) replacedBirths.set(task.id, before);
+                    }
                     const row = taskToRow(task);
                     await upsertTask(db, row);
                     await updateDependencies(db, task.id, task.depends ?? []);
                   });
                 },
-                async insertNewTask(task) {
+                async insertNewTask(task, identity) {
                   scope.assertActive();
                   return accessor.transaction(async () => {
                     scope.assertActive();
-                    await insertNewTask(db, taskToRow(task));
+                    await insertNewTask(db, taskToRow(task), identity);
                     await updateDependencies(db, task.id, task.depends ?? []);
                   });
                 },
+                async clearTaskIdentity(taskId) {
+                  scope.assertActive();
+                  if (!rowUidFillEnabled()) return;
+                  return accessor.transaction(async () => {
+                    scope.assertActive();
+                    clearReplacedTaskIdentityNative(nativeDb, taskId, replacedBirths.get(taskId));
+                  });
+                },
                 async archiveSingleTask(taskId, fields) {
                   scope.assertActive();
                   return accessor.transaction(async () => {
@@ -43603,7 +44434,7 @@ async function createOwnedSqliteDataAccessor(cwd, accessorScope) {
                     const owned = await db.select({ id: tasksTaskAcceptanceCriteria.id }).from(tasksTaskAcceptanceCriteria).where(
                       and8(
                         eq10(tasksTaskAcceptanceCriteria.taskId, taskId),
-                        inArray5(tasksTaskAcceptanceCriteria.id, ids)
+                        inArray6(tasksTaskAcceptanceCriteria.id, ids)
                       )
                     ).all();
                     await pruneAcBindingsForAcIds(
@@ -43616,7 +44447,7 @@ async function createOwnedSqliteDataAccessor(cwd, accessorScope) {
                     await db.delete(tasksTaskAcceptanceCriteria).where(
                       and8(
                         eq10(tasksTaskAcceptanceCriteria.taskId, taskId),
-                        inArray5(tasksTaskAcceptanceCriteria.id, ids)
+                        inArray6(tasksTaskAcceptanceCriteria.id, ids)
                       )
                     ).run();
                   });
@@ -43875,7 +44706,7 @@ async function createOwnedSqliteDataAccessor(cwd, accessorScope) {
   };
   return accessor;
 }
-var _txSavepointCounter, taskTransactionQueue, TaskTransactionScope, taskTransactionContext, CLAIM_COLUMNS;
+var _txSavepointCounter, taskTransactionQueue, TaskTransactionScope, taskTransactionContext, CLAIM_COLUMNS, RENAMED_RECENT_MS;
 var init_sqlite_data_accessor = __esm({
   "packages/core/src/store/sqlite-data-accessor.ts"() {
     "use strict";
@@ -43889,6 +44720,8 @@ var init_sqlite_data_accessor = __esm({
     init_cross_db_cleanup();
     init_db_helpers();
     init_row_identity();
+    init_row_identity_flag();
+    init_row_identity_registry();
     init_audit2();
     init_session_store();
     init_sqlite3();
@@ -43921,6 +44754,7 @@ var init_sqlite_data_accessor = __esm({
       claimedAt: tasksTasks.claimedAt,
       leaseExpiresAt: tasksTasks.leaseExpiresAt
     };
+    RENAMED_RECENT_MS = 24 * 60 * 60 * 1e3;
     registerRowIdentityWriters({
       relinkAcUidNative,
       clearAcUidGraveyardNative,
@@ -44391,7 +45225,7 @@ __export(governor_exports, {
   resolveGovernorMode: () => resolveGovernorMode,
   slotFileCount: () => slotFileCount
 });
-import { existsSync as existsSync19, mkdirSync as mkdirSync6, readdirSync as readdirSync5, writeFileSync as writeFileSync5 } from "node:fs";
+import { existsSync as existsSync20, mkdirSync as mkdirSync6, readdirSync as readdirSync5, writeFileSync as writeFileSync5 } from "node:fs";
 import { availableParallelism, totalmem } from "node:os";
 import { join as join25 } from "node:path";
 import lockfile2 from "proper-lockfile";
@@ -44465,11 +45299,11 @@ function governorSlotDir(cls) {
   return join25(getCleoHome(), "locks", `resource-${cls}`);
 }
 function ensureSlotFiles(dir, count) {
-  if (!existsSync19(dir)) mkdirSync6(dir, { recursive: true });
+  if (!existsSync20(dir)) mkdirSync6(dir, { recursive: true });
   const paths = [];
   for (let i = 0; i < count; i++) {
     const p = join25(dir, `slot-${i}.lock`);
-    if (!existsSync19(p)) writeFileSync5(p, "", { flag: "a" });
+    if (!existsSync20(p)) writeFileSync5(p, "", { flag: "a" });
     paths.push(p);
   }
   return paths;
@@ -44509,7 +45343,7 @@ function shuffledIndices(n) {
 }
 async function countHeldSlots(cls, budget) {
   const dir = governorSlotDir(cls);
-  if (!existsSync19(dir)) return 0;
+  if (!existsSync20(dir)) return 0;
   const slots = ensureSlotFiles(dir, budget);
   let held = 0;
   for (const path of slots) {
@@ -44524,7 +45358,7 @@ async function countHeldSlots(cls, budget) {
 }
 function slotFileCount(cls) {
   const dir = governorSlotDir(cls);
-  if (!existsSync19(dir)) return 0;
+  if (!existsSync20(dir)) return 0;
   return readdirSync5(dir).filter((f) => f.startsWith("slot-") && f.endsWith(".lock")).length;
 }
 var _log2, _cachedMode2, _supervisorDegradeLogged, MB, STALE_MS, _supervisorHolderSeq, ResourceGovernor, governor;
@@ -44675,7 +45509,7 @@ var init_governor = __esm({
 // packages/core/src/store/exodus/recovery.ts
 import { randomUUID as randomUUID2 } from "node:crypto";
 import { constants } from "node:sqlite";
-import { z as z29 } from "zod";
+import { z as z30 } from "zod";
 function identityValues(encoded) {
   return identitySchema.parse(JSON.parse(encoded)).map(([kind, value]) => {
     if (kind === "null") return null;
@@ -45011,8 +45845,8 @@ var init_recovery = __esm({
     "use strict";
     init_row_identity_registry();
     RECEIPTS = "_exodus_recovery_rows";
-    identitySchema = z29.array(
-      z29.tuple([z29.enum(["null", "integer", "real", "text", "blob"]), z29.string()])
+    identitySchema = z30.array(
+      z30.tuple([z30.enum(["null", "integer", "real", "text", "blob"]), z30.string()])
     );
     ExodusRecoveryError = class extends Error {
     };
@@ -45022,7 +45856,7 @@ var init_recovery = __esm({
 // packages/core/src/store/exodus/archive.ts
 import {
   copyFileSync as copyFileSync5,
-  existsSync as existsSync20,
+  existsSync as existsSync21,
   mkdirSync as mkdirSync7,
   readFileSync as readFileSync8,
   renameSync as renameSync7,
@@ -45030,7 +45864,7 @@ import {
   writeFileSync as writeFileSync6
 } from "node:fs";
 import { basename as basename9, dirname as dirname19, join as join26, resolve as resolve12 } from "node:path";
-import { z as z30 } from "zod";
+import { z as z31 } from "zod";
 function scopeBaseDir(scope, cwd, targetDbPath) {
   if (targetDbPath !== void 0) return dirname19(targetDbPath);
   return scope === "project" ? resolveCleoDir(cwd) : getCleoHome();
@@ -45050,7 +45884,7 @@ function hasExodusCompleteMarker(scope, cwd, targetDbPath, nativeDb) {
     if (targetDbPath) throw error48;
     return false;
   }
-  if (!existsSync20(markerPath)) return false;
+  if (!existsSync21(markerPath)) return false;
   const marker16 = markerIdentity.parse(JSON.parse(readFileSync8(markerPath, "utf8")));
   if (nativeDb && (!marker16.databaseIdentity || !hasExodusDatabaseIdentity(nativeDb, marker16.databaseIdentity)))
     throw new Error(
@@ -45080,7 +45914,7 @@ function writeExodusCompleteMarker(scope, archivedSources, cwd, targetDbPath, da
 function moveFileInto(srcPath, destDir) {
   mkdirSync7(destDir, { recursive: true });
   let dest = join26(destDir, basename9(srcPath));
-  if (existsSync20(dest)) {
+  if (existsSync21(dest)) {
     const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "").replace(/Z$/, "Z");
     dest = join26(destDir, `${basename9(srcPath)}.${stamp}`);
   }
@@ -45093,14 +45927,14 @@ function moveFileInto(srcPath, destDir) {
   return dest;
 }
 function archiveSourceDb(source, cwd, targetDbPath) {
-  if (!existsSync20(source.path)) {
+  if (!existsSync21(source.path)) {
     return { name: source.name, sourcePath: source.path, archivedTo: null, action: "absent" };
   }
   const destDir = exodusArchiveDir(source.targetScope, cwd, targetDbPath);
   const archivedTo = moveFileInto(source.path, destDir);
   for (const suffix of SIDECAR_SUFFIXES) {
     const sidecar = `${source.path}${suffix}`;
-    if (existsSync20(sidecar)) {
+    if (existsSync21(sidecar)) {
       try {
         moveFileInto(sidecar, destDir);
       } catch (err) {
@@ -45148,7 +45982,7 @@ function detectStrandedResidue(sources, cwd) {
   const stranded = [];
   for (const source of sources) {
     if (!markedScopes.has(source.targetScope)) continue;
-    if (existsSync20(source.path)) {
+    if (existsSync21(source.path)) {
       stranded.push({ name: source.name, path: source.path, scope: source.targetScope });
     }
   }
@@ -45173,11 +46007,11 @@ var init_archive2 = __esm({
     init_ensure_config();
     init_recovery();
     log8 = getLogger("exodus-archive");
-    markerIdentity = z30.object({
-      version: z30.literal(1),
-      scope: z30.enum(["project", "global"]),
-      targetDbPath: z30.string().optional(),
-      databaseIdentity: z30.string().optional()
+    markerIdentity = z31.object({
+      version: z31.literal(1),
+      scope: z31.enum(["project", "global"]),
+      targetDbPath: z31.string().optional(),
+      databaseIdentity: z31.string().optional()
     });
     ARCHIVE_DIR_NAME = "_archive";
     MARKER_FILENAME_BY_SCOPE = {
@@ -45189,13 +46023,13 @@ var init_archive2 = __esm({
 });
 
 // packages/core/src/store/exodus/count-parity.ts
-import { existsSync as existsSync21 } from "node:fs";
+import { existsSync as existsSync22 } from "node:fs";
 function listTables2(db) {
   return db.prepare(
     "SELECT name FROM sqlite_master WHERE type='table' AND name NOT LIKE 'sqlite_%' AND name NOT LIKE '__drizzle_%' ORDER BY name"
   ).all().map((r) => r.name);
 }
-function tableExists2(db, tableName) {
+function tableExists3(db, tableName) {
   const escaped = tableName.replace(/'/g, "''");
   return db.prepare(`SELECT 1 FROM sqlite_master WHERE type='table' AND name='${escaped}'`).get() !== void 0;
 }
@@ -45210,14 +46044,14 @@ function rowCount(db, tableName) {
 function computeCountParity(sources, projectDbPath, globalDbPath) {
   const entries = [];
   let skipped = 0;
-  if (!existsSync21(projectDbPath) || !existsSync21(globalDbPath)) {
+  if (!existsSync22(projectDbPath) || !existsSync22(globalDbPath)) {
     return { ok: false, entries: [], deficits: [], checked: 0, skipped: 0 };
   }
   const projectSnap = openCleoDbSnapshot(projectDbPath, { readOnly: true });
   const globalSnap = openCleoDbSnapshot(globalDbPath, { readOnly: true });
   try {
     for (const src of sources) {
-      if (!existsSync21(src.path)) continue;
+      if (!existsSync22(src.path)) continue;
       const srcSnap = openCleoDbSnapshot(src.path, { readOnly: true });
       try {
         for (const legacyTable of listTables2(srcSnap.db)) {
@@ -45234,7 +46068,7 @@ function computeCountParity(sources, projectDbPath, globalDbPath) {
             skipped++;
             continue;
           }
-          const targetCount = tableExists2(targetSnap.db, targetTable) ? rowCount(targetSnap.db, targetTable) ?? 0 : 0;
+          const targetCount = tableExists3(targetSnap.db, targetTable) ? rowCount(targetSnap.db, targetTable) ?? 0 : 0;
           const deficit = targetCount < sourceCount ? sourceCount - targetCount : 0;
           entries.push({
             sourceDb: src.name,
@@ -45275,7 +46109,7 @@ var init_count_parity = __esm({
 });
 
 // packages/core/src/store/exodus/plan.ts
-import { existsSync as existsSync22, readdirSync as readdirSync6, statfsSync as statfsSync2, statSync as statSync6 } from "node:fs";
+import { existsSync as existsSync23, readdirSync as readdirSync6, statfsSync as statfsSync2, statSync as statSync6 } from "node:fs";
 import { join as join27 } from "node:path";
 function computeRequiredBytes(totalSourceBytes, largestSourceBytes) {
   return Math.ceil(STAGING_HEADROOM_FACTOR * largestSourceBytes) + totalSourceBytes;
@@ -45377,7 +46211,7 @@ function buildExodusPlan(cwd) {
   };
 }
 function sourcesPresent(sources) {
-  return sources.some((s) => existsSync22(s.path));
+  return sources.some((s) => existsSync23(s.path));
 }
 var STAGING_HEADROOM_FACTOR, STAGING_COPY_SKIP_THRESHOLD_BYTES;
 var init_plan2 = __esm({
@@ -45391,18 +46225,18 @@ var init_plan2 = __esm({
 });
 
 // packages/core/src/store/exodus/health.ts
-import { existsSync as existsSync23, statSync as statSync7 } from "node:fs";
+import { existsSync as existsSync24, statSync as statSync7 } from "node:fs";
 function buildExodusHealth(cwd) {
   const plan = buildExodusPlan(cwd);
-  const anyLegacyPresent = plan.sources.some((s) => existsSync23(s.path));
+  const anyLegacyPresent = plan.sources.some((s) => existsSync24(s.path));
   const parity = anyLegacyPresent ? computeCountParity(plan.sources, plan.projectDbPath, plan.globalDbPath) : { ok: true, entries: [], deficits: [], checked: 0, skipped: 0 };
   const consolidatedExistsByScope = {
-    project: existsSync23(plan.projectDbPath),
-    global: existsSync23(plan.globalDbPath)
+    project: existsSync24(plan.projectDbPath),
+    global: existsSync24(plan.globalDbPath)
   };
   const buildScope = (scope) => {
     const sources = plan.sources.filter((s) => s.targetScope === scope).map((s) => {
-      const present = existsSync23(s.path);
+      const present = existsSync24(s.path);
       let bytes = 0;
       if (present) {
         try {
@@ -45507,7 +46341,7 @@ var init_types = __esm({
 // packages/core/src/store/exodus/migrate.ts
 import {
   copyFileSync as copyFileSync6,
-  existsSync as existsSync24,
+  existsSync as existsSync25,
   mkdirSync as mkdirSync8,
   readFileSync as readFileSync9,
   renameSync as renameSync8,
@@ -45553,7 +46387,7 @@ function writeJournal(stagingDir, journal) {
 }
 function readJournal(stagingDir) {
   const journalPath = join28(stagingDir, JOURNAL_FILENAME);
-  if (!existsSync24(journalPath)) return null;
+  if (!existsSync25(journalPath)) return null;
   try {
     return JSON.parse(readFileSync9(journalPath, "utf8"));
   } catch {
@@ -45563,7 +46397,7 @@ function readJournal(stagingDir) {
 function clearExodusJournal(stagingDir) {
   const journalPath = join28(stagingDir, JOURNAL_FILENAME);
   try {
-    if (!existsSync24(journalPath)) return false;
+    if (!existsSync25(journalPath)) return false;
     unlinkSync5(journalPath);
     log10.info(
       { stagingDir },
@@ -45859,7 +46693,7 @@ async function runExodusMigrate(plan, forceCrossVersion = false, onProgress, opt
   mkdirSync8(stagingDir, { recursive: true });
   let sqliteVersion = "unknown";
   for (const src of sources) {
-    if (existsSync24(src.path)) {
+    if (existsSync25(src.path)) {
       const snap = openCleoDbSnapshot(src.path, { readOnly: true });
       sqliteVersion = getSqliteVersion(snap.db);
       snap.close();
@@ -45889,7 +46723,7 @@ async function runExodusMigrate(plan, forceCrossVersion = false, onProgress, opt
   let reseedProject = null;
   try {
     for (const src of sources) {
-      if (!existsSync24(src.path)) continue;
+      if (!existsSync25(src.path)) continue;
       const backupDest = join28(stagingDir, `${src.name.replace(/[^a-z0-9-]/g, "_")}-backup.db`);
       const srcBytes = safeStatBytes(src.path);
       const skipStagingCopy = srcBytes > plan.stagingCopyThresholdBytes;
@@ -45897,7 +46731,7 @@ async function runExodusMigrate(plan, forceCrossVersion = false, onProgress, opt
         onProgress?.(
           `Skipping full staging copy of ${src.name} (${srcBytes} bytes > ${plan.stagingCopyThresholdBytes} threshold) \u2014 source is archived, not deleted, on success.`
         );
-      } else if (!existsSync24(backupDest)) {
+      } else if (!existsSync25(backupDest)) {
         onProgress?.(`Backing up ${src.name} \u2192 staging dir\u2026`);
         copyFileSync6(src.path, backupDest);
         backupPaths.push(backupDest);
@@ -45930,8 +46764,8 @@ async function runExodusMigrate(plan, forceCrossVersion = false, onProgress, opt
     }
     prepareExodusRecovery(projectNative, stagingDir);
     if (globalNative !== null) prepareExodusRecovery(globalNative, stagingDir);
-    const projectSources = sources.filter((s) => s.targetScope === "project" && existsSync24(s.path));
-    const globalSources = sources.filter((s) => s.targetScope === "global" && existsSync24(s.path));
+    const projectSources = sources.filter((s) => s.targetScope === "project" && existsSync25(s.path));
+    const globalSources = sources.filter((s) => s.targetScope === "global" && existsSync25(s.path));
     if (globalNative === null && globalSources.length > 0)
       throw new Error("A projectOnly exodus run was given global-scope sources");
     await migrateScope(
@@ -46180,7 +47014,8 @@ var init_migrate = __esm({
     GRANDFATHERED_GUARD_TRIGGERS = [
       "tasks_tasks_parent_type_matrix_insert",
       "tasks_task_relations_non_containment_insert",
-      "tasks_task_acceptance_child_target_insert"
+      "tasks_task_acceptance_child_target_insert",
+      "tasks_task_dependencies_cycle_guard_insert"
     ];
     SOURCE_EPOCH_UNITS = /* @__PURE__ */ new Map([
       ["conduit", "seconds"],
@@ -46239,7 +47074,7 @@ __export(reconcile_exports, {
   reconcileSupersededStores: () => reconcileSupersededStores,
   unmigratedBareSources: () => unmigratedBareSources
 });
-import { copyFileSync as copyFileSync7, existsSync as existsSync25, mkdirSync as mkdirSync9, mkdtempSync, rmSync as rmSync3, writeFileSync as writeFileSync8 } from "node:fs";
+import { copyFileSync as copyFileSync7, existsSync as existsSync26, mkdirSync as mkdirSync9, mkdtempSync, rmSync as rmSync3, writeFileSync as writeFileSync8 } from "node:fs";
 import { tmpdir as tmpdir4 } from "node:os";
 import { basename as basename10, join as join29 } from "node:path";
 function ident2(name15) {
@@ -46310,7 +47145,7 @@ function assessSupersededProjectStores(liveStorePath, sources, resolveTarget = r
 }
 function legacySourcesHoldRows(sources) {
   for (const src of sources) {
-    if (!existsSync25(src.path)) continue;
+    if (!existsSync26(src.path)) continue;
     const snap = openCleoDbSnapshot(src.path, { readOnly: true });
     try {
       for (const table of orderTablesForCopy(snap.db)) {
@@ -46558,8 +47393,8 @@ async function reconcileSuppressed(projectRoot, options, liveStorePath) {
   }
 }
 async function reconcileWithScratch(projectRoot, dryRun, additive, liveStorePath, plan, resolveTarget, scratch) {
-  const fileSources = plan.sources.filter((s) => s.targetScope === "project" && existsSync25(s.path));
-  const bare = !additive && existsSync25(liveStorePath) ? await bareTaskCoreSource(liveStorePath, resolveTarget, scratch) : null;
+  const fileSources = plan.sources.filter((s) => s.targetScope === "project" && existsSync26(s.path));
+  const bare = !additive && existsSync26(liveStorePath) ? await bareTaskCoreSource(liveStorePath, resolveTarget, scratch) : null;
   const copyResolver = additive ? (sourceName, legacyTable) => {
     const r = resolveTarget(sourceName, legacyTable);
     return r.kind !== "skip" && isLiveAuthoritative(sourceName, legacyTable, r.targetName) ? { kind: "skip", reason: "additive: live-authoritative task graph" } : r;
@@ -46578,7 +47413,7 @@ async function reconcileWithScratch(projectRoot, dryRun, additive, liveStorePath
     stagingDir: null,
     receiptPath: null
   };
-  if (sources.length === 0 || !existsSync25(liveStorePath)) {
+  if (sources.length === 0 || !existsSync26(liveStorePath)) {
     return {
       ...base,
       outcome: "nothing-to-reconcile",
@@ -46770,11 +47605,11 @@ var init_seal = __esm({
 });
 
 // packages/core/src/store/exodus/status.ts
-import { existsSync as existsSync26, readdirSync as readdirSync7, readFileSync as readFileSync10, statSync as statSync9 } from "node:fs";
+import { existsSync as existsSync27, readdirSync as readdirSync7, readFileSync as readFileSync10, statSync as statSync9 } from "node:fs";
 import { join as join30 } from "node:path";
 function readJournal2(stagingDir) {
   const p = join30(stagingDir, JOURNAL_FILENAME2);
-  if (!existsSync26(p)) return null;
+  if (!existsSync27(p)) return null;
   try {
     return JSON.parse(readFileSync10(p, "utf8"));
   } catch {
@@ -46806,15 +47641,15 @@ function runExodusStatus(cwd) {
   const sourcesInfo = plan.sources.map((s) => ({
     name: s.name,
     path: s.path,
-    exists: existsSync26(s.path),
+    exists: existsSync27(s.path),
     bytes: safeBytes(s.path)
   }));
   return {
     hasStaging: latestStaging !== null,
     stagingDir: latestStaging,
     journal,
-    projectDbExists: existsSync26(projectDbPath),
-    globalDbExists: existsSync26(globalDbPath),
+    projectDbExists: existsSync27(projectDbPath),
+    globalDbExists: existsSync27(globalDbPath),
     sourcesPresent: sourcesInfo.some((s) => s.exists),
     sources: sourcesInfo
   };
@@ -46831,7 +47666,7 @@ var init_status = __esm({
 });
 
 // packages/core/src/store/exodus/verify-migration.ts
-import { existsSync as existsSync27 } from "node:fs";
+import { existsSync as existsSync28 } from "node:fs";
 import { createRequire as createRequire10 } from "node:module";
 function orderByClause(db, tableName) {
   try {
@@ -46946,7 +47781,7 @@ function listTables3(db) {
   ).all();
   return rows.map((r) => r.name);
 }
-function tableExists3(db, tableName) {
+function tableExists4(db, tableName) {
   try {
     const escaped = tableName.replace(/'/g, "''");
     return db.prepare(`SELECT 1 FROM sqlite_master WHERE type='table' AND name='${escaped}'`).get() !== void 0;
@@ -47096,10 +47931,10 @@ function orphanAlreadyInSource(targetDb, fk, sources, resolveTarget = resolveCon
     const anyFeeder = (targetTable, probe) => {
       for (const feeder of feedersOf(targetTable)) {
         const src = sources.find((s) => s.name === feeder.sourceName);
-        if (src === void 0 || !existsSync27(src.path)) continue;
+        if (src === void 0 || !existsSync28(src.path)) continue;
         const snap = openCleoDbSnapshot(src.path, { readOnly: true });
         try {
-          if (!tableExists3(snap.db, feeder.legacyTable)) continue;
+          if (!tableExists4(snap.db, feeder.legacyTable)) continue;
           const cols = new Set(
             snap.db.prepare(`PRAGMA table_info("${feeder.legacyTable}")`).all().map((c) => c.name)
           );
@@ -47151,7 +47986,7 @@ function verifyMigration(sources, projectDbPath, globalDbPath, onProgress, resol
   const preExistingForeignKeyViolations = [];
   const failureLines = [];
   const sourceOrphanSigs = /* @__PURE__ */ new Set();
-  if (!existsSync27(projectDbPath)) {
+  if (!existsSync28(projectDbPath)) {
     return {
       ok: false,
       tables: [],
@@ -47162,7 +47997,7 @@ function verifyMigration(sources, projectDbPath, globalDbPath, onProgress, resol
       error: `Consolidated project cleo.db not found at ${projectDbPath}. Run 'cleo exodus migrate' first.`
     };
   }
-  if (!existsSync27(globalDbPath)) {
+  if (!existsSync28(globalDbPath)) {
     return {
       ok: false,
       tables: [],
@@ -47177,7 +48012,7 @@ function verifyMigration(sources, projectDbPath, globalDbPath, onProgress, resol
   const globalSnap = openCleoDbSnapshot(globalDbPath, { readOnly: true });
   try {
     for (const src of sources) {
-      if (!existsSync27(src.path)) {
+      if (!existsSync28(src.path)) {
         onProgress?.(`Skipping ${src.name} (not present)`);
         continue;
       }
@@ -47302,7 +48137,7 @@ function verifyMigration(sources, projectDbPath, globalDbPath, onProgress, resol
     targetOrphans.push(...foreignKeyCheck(globalSnap.db, "global"));
     foreignKeyViolations.push(...targetOrphans);
     for (const fk of targetOrphans) {
-      const orphanDb = tableExists3(projectSnap.db, fk.table) ? projectSnap.db : globalSnap.db;
+      const orphanDb = tableExists4(projectSnap.db, fk.table) ? projectSnap.db : globalSnap.db;
       const sig = orphanSignature(orphanDb, fk);
       const preExisting = sourceOrphanSigs.has(sig) || orphanAlreadyInSource(orphanDb, fk, sources, resolveTarget);
       if (preExisting) {
@@ -47468,7 +48303,7 @@ __export(on_open_exports, {
   maybeRunExodusOnOpen: () => maybeRunExodusOnOpen,
   withExodusOnOpenSuppressed: () => withExodusOnOpenSuppressed
 });
-import { existsSync as existsSync28, mkdtempSync as mkdtempSync2, rmSync as rmSync4 } from "node:fs";
+import { existsSync as existsSync29, mkdtempSync as mkdtempSync2, rmSync as rmSync4 } from "node:fs";
 import { tmpdir as tmpdir5 } from "node:os";
 import { join as join31, resolve as resolve13 } from "node:path";
 async function withExodusOnOpenSuppressed(dbPath, fn) {
@@ -47510,7 +48345,7 @@ function remedyFor(scope) {
 }
 async function strandedLegacySources(scope, cwd) {
   const { buildExodusPlan: buildExodusPlan2, legacySourcesHoldRows: legacySourcesHoldRows2 } = await Promise.resolve().then(() => (init_exodus(), exodus_exports));
-  return buildExodusPlan2(cwd).sources.filter((s) => s.targetScope === scope && existsSync28(s.path)).filter((s) => legacySourcesHoldRows2([s])).map((s) => s.name);
+  return buildExodusPlan2(cwd).sources.filter((s) => s.targetScope === scope && existsSync29(s.path)).filter((s) => legacySourcesHoldRows2([s])).map((s) => s.name);
 }
 async function exodusStoreRewriteRefusal(dbPath, cwd) {
   const { assertOwnerStoreRewriteConfirmed: assertOwnerStoreRewriteConfirmed2, invocationDirectory: invocationDirectory2 } = await Promise.resolve().then(() => (init_worktree_isolation_guard(), worktree_isolation_guard_exports));
@@ -47642,7 +48477,7 @@ async function runExodusOnOpen(scope, dbPath, nativeDb, cwd) {
     };
   }
   const scopeSources = plan.sources.filter((s) => s.targetScope === scope);
-  if (!scopeSources.some((s) => existsSync28(s.path))) {
+  if (!scopeSources.some((s) => existsSync29(s.path))) {
     return {
       outcome: "skipped",
       reason: `no legacy ${scope}-scope source DBs present (fresh install or cross-scope-only)`
@@ -47667,7 +48502,7 @@ async function runExodusOnOpen(scope, dbPath, nativeDb, cwd) {
         {
           scope,
           dbPath,
-          sources: plan.sources.filter((s) => existsSync28(s.path)).map((s) => s.name)
+          sources: plan.sources.filter((s) => existsSync29(s.path)).map((s) => s.name)
         },
         "exodus-on-open: consolidated cleo.db is empty and legacy data present \u2014 auto-migrating"
       );
@@ -47680,7 +48515,7 @@ async function runExodusOnOpen(scope, dbPath, nativeDb, cwd) {
         const bare = scope === "project" ? await unmigratedBareSources2(
           dbPath,
           resolveTarget,
-          plan.sources.find((s) => s.name === "tasks" && existsSync28(s.path))?.path,
+          plan.sources.find((s) => s.name === "tasks" && existsSync29(s.path))?.path,
           bareScratch
         ) : { first: [], last: [] };
         const migratePlan = { ...plan, sources: [...bare.first, ...plan.sources, ...bare.last] };
@@ -47744,7 +48579,7 @@ async function runExodusOnOpen(scope, dbPath, nativeDb, cwd) {
           "exodus-on-open: parity verified \u2014 legacy data migrated into consolidated cleo.db"
         );
         try {
-          const consumed = plan.sources.filter((s) => existsSync28(s.path));
+          const consumed = plan.sources.filter((s) => existsSync29(s.path));
           const identities = await sealTargets(plan, consumed);
           const archiveResult = archiveMigratedSources(consumed, cwd, plan, identities);
           log14.info(
@@ -47819,7 +48654,7 @@ __export(dual_scope_db_exports, {
   upsertIdempotent: () => upsertIdempotent,
   withStoreSchemaOwnership: () => withStoreSchemaOwnership
 });
-import { existsSync as existsSync29, mkdirSync as mkdirSync10 } from "node:fs";
+import { existsSync as existsSync30, mkdirSync as mkdirSync10 } from "node:fs";
 import { createRequire as createRequire11 } from "node:module";
 import { dirname as dirname20, join as join32, resolve as resolve14 } from "node:path";
 function getDualScopeNativeDb(handle) {
@@ -47892,11 +48727,15 @@ async function openDualScopeDb(scope, cwd, options) {
     open
   ) : open();
 }
+function identityWorkOnOpen(nativeDb, scope) {
+  if (ROW_IDENTITY[scope].length === 0) return false;
+  return rowUidFillEnabled() || missingRowIdentitySchema(nativeDb).length > 0;
+}
 async function openDedicatedDualScopeDb(scope, dbPath, log15, execution) {
   execution?.assertActive();
   log15.debug({ scope, dbPath }, "opening DEDICATED (non-cached) dual-scope cleo.db (T11782 FIX D)");
   const dir = dirname20(dbPath);
-  if (!existsSync29(dir)) {
+  if (!existsSync30(dir)) {
     mkdirSync10(dir, { recursive: true });
   }
   execution?.assertActive();
@@ -47929,9 +48768,12 @@ async function openDedicatedDualScopeDb(scope, dbPath, log15, execution) {
           `dual-scope-db[${scope}]`
         );
         execution?.assertActive();
-        if (rowUidFillEnabled()) {
+        if (identityWorkOnOpen(nativeDb, scope)) {
           await Promise.resolve().then(() => (init_sqlite_data_accessor(), sqlite_data_accessor_exports));
-          prepareRowIdentity(nativeDb, scope, { triggers: false });
+          healRowIdentitySchema(nativeDb, scope);
+          if (rowUidFillEnabled()) {
+            prepareRowIdentity(nativeDb, scope, { triggers: false });
+          }
         }
         execution?.assertActive();
         log15.debug({ scope, dbPath }, "DEDICATED dual-scope cleo.db ready (T11782 FIX D)");
@@ -48044,7 +48886,7 @@ async function openDualScopeDbAtPath(scope, dbPath, exodusCwd, options) {
       execution?.assertActive();
       log15.debug({ scope, dbPath: normalizedPath }, "opening dual-scope cleo.db");
       const dir = dirname20(normalizedPath);
-      if (!existsSync29(dir)) {
+      if (!existsSync30(dir)) {
         mkdirSync10(dir, { recursive: true });
       }
       execution?.assertActive();
@@ -48077,9 +48919,12 @@ async function openDualScopeDbAtPath(scope, dbPath, exodusCwd, options) {
             `dual-scope-db[${scope}]`
           );
           execution?.assertActive();
-          if (rowUidFillEnabled()) {
+          if (identityWorkOnOpen(nativeDb, scope)) {
             await Promise.resolve().then(() => (init_sqlite_data_accessor(), sqlite_data_accessor_exports));
-            prepareRowIdentity(nativeDb, scope);
+            healRowIdentitySchema(nativeDb, scope);
+            if (rowUidFillEnabled()) {
+              prepareRowIdentity(nativeDb, scope);
+            }
           }
           execution?.assertActive();
           log15.debug({ scope, dbPath: normalizedPath }, "dual-scope cleo.db ready");
@@ -49209,7 +50054,7 @@ __export(nexus_sqlite_exports, {
   resetNexusDbState: () => resetNexusDbState,
   resolveNexusMigrationsFolder: () => resolveNexusMigrationsFolder
 });
-import { copyFileSync as copyFileSync8, existsSync as existsSync30 } from "node:fs";
+import { copyFileSync as copyFileSync8, existsSync as existsSync31 } from "node:fs";
 import { join as join33 } from "node:path";
 function getNexusDbPath(cwd) {
   return resolveDualScopeDbPath("project", cwd);
@@ -49261,7 +50106,7 @@ function detectAndWarnOnNestedNexus() {
   } catch {
     return false;
   }
-  if (!existsSync30(nestedPath)) return false;
+  if (!existsSync31(nestedPath)) return false;
   if (_warnedNestedPaths.has(nestedPath)) return false;
   _warnedNestedPaths.add(nestedPath);
   const canonicalPath = getNexusDbPath();
@@ -49281,7 +50126,7 @@ function detectAndWarnOnNestedNexus() {
 function _resetNestedNexusWarningGate() {
   _warnedNestedPaths.clear();
 }
-function tableExists4(nativeDb, tableName) {
+function tableExists5(nativeDb, tableName) {
   const result = nativeDb.prepare("SELECT name FROM sqlite_master WHERE type='table' AND name=?").get(tableName);
   return !!result;
 }
@@ -49290,7 +50135,7 @@ function objectExists(nativeDb, type, name15) {
   return !!result;
 }
 function ensureNexusFts5(nativeDb) {
-  if (!tableExists4(nativeDb, "nexus_nodes")) return;
+  if (!tableExists5(nativeDb, "nexus_nodes")) return;
   if (!objectExists(nativeDb, "table", "nexus_symbols_fts")) {
     nativeDb.exec(`
       CREATE VIRTUAL TABLE nexus_symbols_fts USING fts5(
@@ -49336,7 +50181,7 @@ function ensureNexusFts5(nativeDb) {
   `);
 }
 function ensureNexusRelationWeights(nativeDb) {
-  if (!tableExists4(nativeDb, "nexus_relations")) return;
+  if (!tableExists5(nativeDb, "nexus_relations")) return;
   nativeDb.exec(`
     CREATE TABLE IF NOT EXISTS nexus_relation_weights (
       relation_id       TEXT PRIMARY KEY NOT NULL,
@@ -49418,9 +50263,9 @@ function ensureNexusRelationWeights(nativeDb) {
 }
 function runNexusMigrations(nativeDb, db, dbPath) {
   const migrationsFolder = resolveNexusMigrationsFolder();
-  if (tableExists4(nativeDb, "nexus_nodes")) {
+  if (tableExists5(nativeDb, "nexus_nodes")) {
     const backupPath = dbPath.replace(/\.db$/, "-pre-cleo.db.bak");
-    if (!existsSync30(backupPath)) {
+    if (!existsSync31(backupPath)) {
       try {
         copyFileSync8(dbPath, backupPath);
       } catch {
@@ -49550,13 +50395,13 @@ var init_legacy_alias = __esm({
 
 // packages/core/src/llm/stable-device-id.ts
 import { randomUUID as randomUUID3 } from "node:crypto";
-import { existsSync as existsSync31, mkdirSync as mkdirSync11, readFileSync as readFileSync11, renameSync as renameSync9, writeFileSync as writeFileSync9 } from "node:fs";
+import { existsSync as existsSync32, mkdirSync as mkdirSync11, readFileSync as readFileSync11, renameSync as renameSync9, writeFileSync as writeFileSync9 } from "node:fs";
 import { dirname as dirname21 } from "node:path";
 import { resolveStableDeviceIdPath } from "@cleocode/paths";
 function getStableDeviceId() {
   if (_cachedDeviceId !== null) return _cachedDeviceId;
   const path = resolveStableDeviceIdPath();
-  if (existsSync31(path)) {
+  if (existsSync32(path)) {
     try {
       const raw = readFileSync11(path, "utf-8").trim();
       if (raw.length > 0) {
@@ -49569,7 +50414,7 @@ function getStableDeviceId() {
   const fresh = randomUUID3();
   try {
     const dir = dirname21(path);
-    if (!existsSync31(dir)) {
+    if (!existsSync32(dir)) {
       mkdirSync11(dir, { recursive: true });
     }
     const tmpPath = `${path}.tmp.${process.pid}`;
@@ -49645,11 +50490,11 @@ __export(path_map_exports, {
   supersededRegistryPath: () => supersededRegistryPath,
   touchProjectLocation: () => touchProjectLocation
 });
-import { existsSync as existsSync32, lstatSync, readdirSync as readdirSync8 } from "node:fs";
+import { existsSync as existsSync33, lstatSync, readdirSync as readdirSync8 } from "node:fs";
 import { lstat, readdir as readdir2 } from "node:fs/promises";
 import { isAbsolute as isAbsolute5, join as join34, relative as relative3, sep as sep5 } from "node:path";
 import { canonicalizePath as canonicalizePath3, readDeclaredProjectIdentity as readDeclaredProjectIdentity4 } from "@cleocode/paths";
-import { and as and9, desc as desc3, eq as eq12, inArray as inArray6, ne as ne3 } from "drizzle-orm";
+import { and as and9, desc as desc3, eq as eq12, inArray as inArray7, ne as ne3 } from "drizzle-orm";
 function holdingKey(projectId, path) {
   return `${projectId}\0${path}`;
 }
@@ -49797,7 +50642,7 @@ function decideEncounterBinding(db, record2) {
   const here = db.select({ state: projectLocations.state, checkoutNonce: projectLocations.checkoutNonce }).from(projectLocations).where(
     and9(
       eq12(projectLocations.projectId, record2.projectId),
-      inArray6(projectLocations.deviceId, [deviceId, LOCAL_DEVICE_SENTINEL]),
+      inArray7(projectLocations.deviceId, [deviceId, LOCAL_DEVICE_SENTINEL]),
       eq12(projectLocations.path, record2.projectPath)
     )
   ).all();
@@ -49808,7 +50653,7 @@ function decideEncounterBinding(db, record2) {
   const previous = () => db.select({ checkoutNonce: projectLocations.checkoutNonce }).from(projectLocations).where(
     and9(
       eq12(projectLocations.projectId, record2.projectId),
-      inArray6(projectLocations.deviceId, [deviceId, LOCAL_DEVICE_SENTINEL]),
+      inArray7(projectLocations.deviceId, [deviceId, LOCAL_DEVICE_SENTINEL]),
       eq12(projectLocations.path, oldPath)
     )
   ).all();
@@ -49856,7 +50701,7 @@ function hasOtherLiveLocation(db, record2, deviceId) {
       ne3(projectLocations.path, record2.projectPath)
     )
   ).all().some(
-    (location) => isStrictlyInside(record2.projectPath, location.path) && existsSync32(location.path) && readDeclaredProjectIdentity4(location.path)?.projectId === record2.projectId
+    (location) => isStrictlyInside(record2.projectPath, location.path) && existsSync33(location.path) && readDeclaredProjectIdentity4(location.path)?.projectId === record2.projectId
   );
 }
 function demoteProjectLocation(db, record2, state) {
@@ -49907,7 +50752,7 @@ function rehomeDisplacedRows(db, projectId, projectPath, deviceId, probed) {
     ).orderBy(desc3(projectLocations.lastSeen)).all();
     const present = (path) => {
       const holding = probed?.get(holdingKey(row.projectId, path));
-      return holding === void 0 ? existsSync32(path) : holding === "yes";
+      return holding === void 0 ? existsSync33(path) : holding === "yes";
     };
     const home = candidates.find(
       (c) => present(c.path) && db.select({ projectId: projectRegistry.projectId }).from(projectRegistry).where(eq12(projectRegistry.projectPath, c.path)).all().length === 0
@@ -49936,7 +50781,7 @@ async function listProjectCheckouts(projectId, opts = {}) {
       projectHash: generateProjectHash(row.path),
       firstSeen: row.firstSeen,
       lastSeen: row.lastSeen,
-      exists: local && existsSync32(row.path),
+      exists: local && existsSync33(row.path),
       deviceId: local ? deviceId : row.deviceId,
       state: row.state
     });
@@ -49969,7 +50814,7 @@ __export(project_activity_exports, {
   projectLastActivitySql: () => projectLastActivitySql,
   projectLastActivitySqlText: () => projectLastActivitySqlText
 });
-import { eq as eq13, inArray as inArray7, sql as sql32 } from "drizzle-orm";
+import { eq as eq13, inArray as inArray8, sql as sql32 } from "drizzle-orm";
 function normalizeRegistryTimestamp(value) {
   if (value === null || value === void 0 || value.length === 0) return null;
   const iso = /^\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}(\.\d+)?$/.test(value) ? `${value.replace(" ", "T")}Z` : value;
@@ -49998,7 +50843,7 @@ function markProjectsProbed(db, projectIds, now = /* @__PURE__ */ new Date()) {
   for (let i = 0; i < ids.length; i += PROBED_CHUNK) {
     const chunk = ids.slice(i, i + PROBED_CHUNK);
     changed += Number(
-      db.update(projectRegistry).set({ lastProbedAt: at }).where(inArray7(projectRegistry.projectId, chunk)).run().changes
+      db.update(projectRegistry).set({ lastProbedAt: at }).where(inArray8(projectRegistry.projectId, chunk)).run().changes
     );
   }
   return changed;
@@ -50031,11 +50876,11 @@ __export(checkout_nonce_exports, {
   readCheckoutNonce: () => readCheckoutNonce
 });
 import { randomBytes as randomBytes3 } from "node:crypto";
-import { existsSync as existsSync33, readFileSync as readFileSync12, renameSync as renameSync10, writeFileSync as writeFileSync10 } from "node:fs";
+import { existsSync as existsSync34, readFileSync as readFileSync12, renameSync as renameSync10, writeFileSync as writeFileSync10 } from "node:fs";
 import { join as join35 } from "node:path";
 function readInfo(projectRoot) {
   const path = join35(projectRoot, ".cleo", "project-info.json");
-  if (!existsSync33(path)) return null;
+  if (!existsSync34(path)) return null;
   try {
     const parsed = JSON.parse(readFileSync12(path, "utf-8"));
     return parsed !== null && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
@@ -50128,7 +50973,7 @@ __export(paths_exports, {
   validateProjectRoot: () => validateProjectRoot,
   worktreeScope: () => worktreeScope
 });
-import { existsSync as existsSync34, readFileSync as readFileSync13, statSync as statSync10 } from "node:fs";
+import { existsSync as existsSync35, readFileSync as readFileSync13, statSync as statSync10 } from "node:fs";
 import { createRequire as createRequire12 } from "node:module";
 import { homedir as homedir2 } from "node:os";
 import { dirname as dirname22, join as join36, resolve as resolve15 } from "node:path";
@@ -50154,7 +50999,7 @@ function runWithWorktreeScopeFromEnv(fn) {
 function isProjectInitialized(projectRoot) {
   const root = projectRoot ?? getProjectRoot();
   const cleoDir = join36(root, ".cleo");
-  return existsSync34(cleoDir) && existsSync34(join36(cleoDir, "tasks.db"));
+  return existsSync35(cleoDir) && existsSync35(join36(cleoDir, "tasks.db"));
 }
 function getCleoHome() {
   return getPlatformPaths().data;
@@ -50260,7 +51105,7 @@ function _resolveProjectByCwdFromNexus(cwd) {
   try {
     const cleoHome = getCleoHome();
     const globalDbPath = join36(cleoHome, "cleo.db");
-    if (!existsSync34(globalDbPath)) return null;
+    if (!existsSync35(globalDbPath)) return null;
     const start = resolve15(cwd ?? process.cwd());
     let current = start;
     const DatabaseSync3 = _getDatabaseSyncCtor();
@@ -50423,7 +51268,7 @@ function _cwdHasGitAncestor(cwd) {
   while (true) {
     const gitMarker = join36(current, ".git");
     try {
-      if (existsSync34(gitMarker)) {
+      if (existsSync35(gitMarker)) {
         return true;
       }
     } catch {
@@ -50501,7 +51346,7 @@ function getCleoGlobalCantAgentsDir() {
 function getAgentOutputsDir(cwd) {
   const projectRoot = getProjectRoot(cwd);
   const configPath = join36(projectRoot, ".cleo", "config.json");
-  if (existsSync34(configPath)) {
+  if (existsSync35(configPath)) {
     try {
       const config2 = JSON.parse(readFileSync13(configPath, "utf-8"));
       if (typeof config2.agentOutputs === "object" && config2.agentOutputs?.directory) {
@@ -50534,7 +51379,7 @@ function getManifestPath(cwd) {
   const configPath = join36(projectRoot, ".cleo", "config.json");
   const legacyFileName = ["MANIFEST", "jsonl"].join(".");
   let manifestFile = legacyFileName;
-  if (existsSync34(configPath)) {
+  if (existsSync35(configPath)) {
     try {
       const config2 = JSON.parse(readFileSync13(configPath, "utf-8"));
       const customFile = config2.agentOutputs?.manifestFile ?? config2.research?.manifestFile;
@@ -50590,7 +51435,7 @@ function resolveWorktreeRouting(cwdOverride) {
   while (current !== home && current !== "/" && current !== "") {
     const gitPath = join36(current, ".git");
     try {
-      if (existsSync34(gitPath)) {
+      if (existsSync35(gitPath)) {
         const stat3 = statSync10(gitPath);
         if (stat3.isFile()) {
           worktreePath = current;
@@ -50629,7 +51474,7 @@ function detectStrayCleoDb(routing) {
   }
   const tasksDbPath = join36(routing.worktreePath, ".cleo", "tasks.db");
   try {
-    if (existsSync34(tasksDbPath) && statSync10(tasksDbPath).isFile()) {
+    if (existsSync35(tasksDbPath) && statSync10(tasksDbPath).isFile()) {
       return tasksDbPath;
     }
   } catch {
@@ -50639,7 +51484,7 @@ function detectStrayCleoDb(routing) {
 async function resolveProjectById(projectId) {
   try {
     const { getNexusDb: getNexusDb2, getNexusRegistryDbPath: getNexusRegistryDbPath2 } = await Promise.resolve().then(() => (init_nexus_sqlite(), nexus_sqlite_exports));
-    if (!existsSync34(getNexusRegistryDbPath2())) return null;
+    if (!existsSync35(getNexusRegistryDbPath2())) return null;
     const { eq: eq14 } = await import("drizzle-orm");
     const { projectRegistry: projectRegistry2 } = await Promise.resolve().then(() => (init_nexus_schema(), nexus_schema_exports));
     const db = await getNexusDb2();
@@ -50675,7 +51520,7 @@ function _rowToRegistryEntry(row) {
 }
 function _assertProjectInfoReadable(projectRoot) {
   const infoPath = join36(projectRoot, ".cleo", "project-info.json");
-  if (existsSync34(infoPath)) JSON.parse(readFileSync13(infoPath, "utf-8"));
+  if (existsSync35(infoPath)) JSON.parse(readFileSync13(infoPath, "utf-8"));
 }
 function startProjectEncounter(key, projectRoot, infoProjectId) {
   const inFlight2 = _encountersInFlight.get(key);
@@ -50724,7 +51569,7 @@ async function recordProjectEncounter(cwd, options = {}) {
   if (!shouldAutoRegisterProject(project.projectRoot, cleoHome)) return "ephemeral";
   const checkout = captureProjectScope(project.projectRoot, worktreeScope.getStore()).worktreeRoot;
   const { getNexusRegistryDb: getNexusRegistryDb2, getNexusRegistryDbPath: getNexusRegistryDbPath2 } = await Promise.resolve().then(() => (init_nexus_sqlite(), nexus_sqlite_exports));
-  if (existsSync34(getNexusRegistryDbPath2(cleoHome))) {
+  if (existsSync35(getNexusRegistryDbPath2(cleoHome))) {
     const { and: and10, eq: eq14 } = await import("drizzle-orm");
     const { projectLocations: projectLocations2, projectRegistry: projectRegistry2 } = await Promise.resolve().then(() => (init_nexus_schema(), nexus_schema_exports));
     const { currentDeviceId: currentDeviceId2 } = await Promise.resolve().then(() => (init_path_map(), path_map_exports));
@@ -50750,7 +51595,7 @@ async function recordProjectEncounter(cwd, options = {}) {
 }
 async function markEncounterOpened(cleoHome, projectId) {
   const { getNexusRegistryDb: getNexusRegistryDb2, getNexusRegistryDbPath: getNexusRegistryDbPath2 } = await Promise.resolve().then(() => (init_nexus_sqlite(), nexus_sqlite_exports));
-  if (!existsSync34(getNexusRegistryDbPath2(cleoHome))) return;
+  if (!existsSync35(getNexusRegistryDbPath2(cleoHome))) return;
   const { markProjectOpened: markProjectOpened2 } = await Promise.resolve().then(() => (init_project_activity(), project_activity_exports));
   markProjectOpened2(await getNexusRegistryDb2(cleoHome), projectId);
 }
@@ -50912,7 +51757,7 @@ var init_paths = __esm({
 // packages/core/src/store/file-utils.ts
 import { randomBytes as randomBytes4 } from "node:crypto";
 import {
-  existsSync as existsSync35,
+  existsSync as existsSync36,
   mkdirSync as mkdirSync12,
   readdirSync as readdirSync9,
   readFileSync as readFileSync14,
@@ -50927,7 +51772,7 @@ function rotateBackup(filePath, mode) {
   const name15 = basename11(filePath);
   const backupDir = join37(dir, ".backups");
   const dirMode = typeof mode === "number" ? modeToDirMode(mode) : void 0;
-  if (!existsSync35(backupDir)) {
+  if (!existsSync36(backupDir)) {
     mkdirSync12(backupDir, { recursive: true, mode: dirMode });
   }
   for (let i = MAX_BACKUPS; i >= 1; i--) {
@@ -50940,7 +51785,7 @@ function rotateBackup(filePath, mode) {
     } else {
       const next = join37(backupDir, `${name15}.${i + 1}`);
       try {
-        if (existsSync35(current)) renameSync11(current, next);
+        if (existsSync36(current)) renameSync11(current, next);
       } catch {
       }
     }
@@ -50976,7 +51821,7 @@ function writeJsonFileAtomic(filePath, data, optsOrIndent = 2) {
     writeFileSync11(tempPath, content, "utf-8");
   }
   try {
-    if (existsSync35(filePath)) {
+    if (existsSync36(filePath)) {
       rotateBackup(filePath, mode);
     }
     renameSync11(tempPath, filePath);
@@ -51002,10 +51847,10 @@ function readJsonFile(filePath) {
 async function withLock2(filePath, transform2, opts = {}) {
   const dir = dirname23(filePath);
   const dirMode = typeof opts.mode === "number" ? modeToDirMode(opts.mode) : void 0;
-  if (!existsSync35(dir)) {
+  if (!existsSync36(dir)) {
     mkdirSync12(dir, { recursive: true, mode: dirMode });
   }
-  if (!existsSync35(filePath)) {
+  if (!existsSync36(filePath)) {
     if (typeof opts.mode === "number") {
       writeFileSync11(filePath, "", { encoding: "utf-8", mode: opts.mode });
     } else {
@@ -51027,10 +51872,10 @@ async function withLock2(filePath, transform2, opts = {}) {
 }
 async function withFileLock(filePath, operation) {
   const dir = dirname23(filePath);
-  if (!existsSync35(dir)) {
+  if (!existsSync36(dir)) {
     mkdirSync12(dir, { recursive: true });
   }
-  if (!existsSync35(filePath)) {
+  if (!existsSync36(filePath)) {
     writeFileSync11(filePath, "", "utf-8");
   }
   let release;
@@ -51402,7 +52247,7 @@ var init_cleo_pkce_seeder = __esm({
 });
 
 // packages/core/src/llm/credential-seeders/codex-cli-seeder.ts
-import { existsSync as existsSync36, readFileSync as readFileSync17 } from "node:fs";
+import { existsSync as existsSync37, readFileSync as readFileSync17 } from "node:fs";
 import { homedir as homedir4 } from "node:os";
 import { join as join41 } from "node:path";
 function getCodexAuthPath() {
@@ -51427,7 +52272,7 @@ var init_codex_cli_seeder = __esm({
        */
       async seed() {
         const authPath = getCodexAuthPath();
-        if (!existsSync36(authPath)) {
+        if (!existsSync37(authPath)) {
           return { entries: [] };
         }
         let raw;
@@ -51622,7 +52467,7 @@ var init_google_pkce = __esm({
 });
 
 // packages/core/src/llm/credential-seeders/gemini-cli-seeder.ts
-import { existsSync as existsSync37, readFileSync as readFileSync18 } from "node:fs";
+import { existsSync as existsSync38, readFileSync as readFileSync18 } from "node:fs";
 import { join as join42 } from "node:path";
 import { getCleoHome as getCleoHome5 } from "@cleocode/paths";
 function getGoogleOauthPath() {
@@ -51671,7 +52516,7 @@ var init_gemini_cli_seeder = __esm({
        */
       async seed() {
         const path = getGoogleOauthPath();
-        if (!existsSync37(path)) {
+        if (!existsSync38(path)) {
           return { entries: [] };
         }
         let raw;
@@ -51896,7 +52741,7 @@ var init_credential_seeders = __esm({
 
 // packages/core/src/llm/global-config-migration.ts
 import {
-  existsSync as existsSync38,
+  existsSync as existsSync39,
   mkdirSync as mkdirSync13,
   readFileSync as readFileSync19,
   renameSync as renameSync12,
@@ -51922,12 +52767,12 @@ function migrateGlobalConfigToConfigDir() {
     const source = legacyGlobalConfigPath();
     const target = configDirGlobalConfigPath();
     const marker16 = migrationMarkerPath();
-    if (existsSync38(marker16)) return false;
-    if (!existsSync38(source)) {
+    if (existsSync39(marker16)) return false;
+    if (!existsSync39(source)) {
       stampMarker(marker16);
       return false;
     }
-    if (existsSync38(target)) {
+    if (existsSync39(target)) {
       backupSourceQuiet(source);
       stampMarker(marker16);
       return false;
@@ -51960,7 +52805,7 @@ function migrateGlobalConfigToConfigDir() {
   } catch (err) {
     try {
       const temp = tempTargetPath();
-      if (existsSync38(temp)) unlinkSync8(temp);
+      if (existsSync39(temp)) unlinkSync8(temp);
     } catch {
     }
     console.error(
@@ -51980,7 +52825,7 @@ function stampMarker(markerPath) {
 function backupSourceQuiet(source) {
   try {
     const backup = `${source}${BACKUP_SUFFIX}`;
-    if (existsSync38(backup)) return;
+    if (existsSync39(backup)) return;
     renameSync12(source, backup);
   } catch {
   }
@@ -52003,7 +52848,7 @@ var init_global_config_migration = __esm({
 });
 
 // packages/core/src/llm/legacy-flat-key-import.ts
-import { existsSync as existsSync39, readFileSync as readFileSync20, renameSync as renameSync13, writeFileSync as writeFileSync13 } from "node:fs";
+import { existsSync as existsSync40, readFileSync as readFileSync20, renameSync as renameSync13, writeFileSync as writeFileSync13 } from "node:fs";
 import { join as join44 } from "node:path";
 import { getCleoHome as getCleoHome7 } from "@cleocode/paths";
 function migrationPaths() {
@@ -52032,7 +52877,7 @@ function writeMarker(markerPath) {
 }
 function readFlatKey(flatPath) {
   try {
-    if (!existsSync39(flatPath)) return null;
+    if (!existsSync40(flatPath)) return null;
     const raw = readFileSync20(flatPath, "utf-8").trim();
     return raw || null;
   } catch (err) {
@@ -52045,7 +52890,7 @@ function readFlatKey(flatPath) {
 }
 async function importLegacyFlatAnthropicKey() {
   const { flatPath, bakPath, markerPath } = migrationPaths();
-  if (existsSync39(markerPath)) {
+  if (existsSync40(markerPath)) {
     return { status: "marker-present", flatPath, bakPath: null, markerPath };
   }
   let existing = null;
@@ -52062,7 +52907,7 @@ async function importLegacyFlatAnthropicKey() {
     writeMarker(markerPath);
     return { status: "already-imported", flatPath, bakPath: null, markerPath };
   }
-  if (!existsSync39(flatPath)) {
+  if (!existsSync40(flatPath)) {
     writeMarker(markerPath);
     return { status: "no-flat-file", flatPath, bakPath: null, markerPath };
   }
@@ -52139,7 +52984,7 @@ __export(credentials_exports, {
   resolveProviderStatus: () => resolveProviderStatus,
   storeAnthropicApiKey: () => storeAnthropicApiKey
 });
-import { existsSync as existsSync40, mkdirSync as mkdirSync14, readFileSync as readFileSync21, writeFileSync as writeFileSync14 } from "node:fs";
+import { existsSync as existsSync41, mkdirSync as mkdirSync14, readFileSync as readFileSync21, writeFileSync as writeFileSync14 } from "node:fs";
 import { join as join45 } from "node:path";
 import { getCleoHome as getCleoHome8 } from "@cleocode/paths";
 function globalConfigPath() {
@@ -52158,7 +53003,7 @@ function readGlobalProviderKey(provider) {
 function readFlatAnthropicKey() {
   try {
     const keyFile = join45(getCleoHome8(), "anthropic-key");
-    if (!existsSync40(keyFile)) return null;
+    if (!existsSync41(keyFile)) return null;
     const stored = readFileSync21(keyFile, "utf-8").trim();
     return stored || null;
   } catch {
@@ -52167,7 +53012,7 @@ function readFlatAnthropicKey() {
 }
 function readProviderKeyFromConfig(configFile, provider) {
   try {
-    if (!existsSync40(configFile)) return null;
+    if (!existsSync41(configFile)) return null;
     const raw = readFileSync21(configFile, "utf-8");
     const config2 = JSON.parse(raw);
     const llm = config2["llm"];
@@ -52340,7 +53185,7 @@ function resolveProviderStatus(provider) {
 }
 function storeAnthropicApiKey(apiKey) {
   const dir = getCleoHome8();
-  if (!existsSync40(dir)) {
+  if (!existsSync41(dir)) {
     mkdirSync14(dir, { recursive: true });
   }
   const keyFile = join45(dir, "anthropic-key");
@@ -52408,16 +53253,16 @@ __export(credentials_store_exports, {
   pickCredentialForProviderSync: () => pickCredentialForProviderSync,
   removeCredential: () => removeCredential
 });
-import { chmodSync as chmodSync2, existsSync as existsSync41, mkdirSync as mkdirSync15, readFileSync as readFileSync22, statSync as statSync11, writeFileSync as writeFileSync15 } from "node:fs";
+import { chmodSync as chmodSync2, existsSync as existsSync42, mkdirSync as mkdirSync15, readFileSync as readFileSync22, statSync as statSync11, writeFileSync as writeFileSync15 } from "node:fs";
 import { dirname as dirname24, join as join46 } from "node:path";
 import { getCleoHome as getCleoHome9 } from "@cleocode/paths";
 function credentialsStorePath() {
   return join46(getCleoHome9(), "llm-credentials.json");
 }
 function ensureFileInitialized(path) {
-  if (existsSync41(path)) return;
+  if (existsSync42(path)) return;
   const dir = dirname24(path);
-  if (!existsSync41(dir)) {
+  if (!existsSync42(dir)) {
     mkdirSync15(dir, { recursive: true, mode: 448 });
   } else {
     try {
@@ -53115,8 +53960,8 @@ async function scanAndLoadPlugins(pluginDir, api) {
 }
 async function runDiscovery(registerProvider2, builtins) {
   const api = { registerProvider: registerProvider2 };
-  for (const profile of builtins) {
-    registerProvider2(profile);
+  for (const profile2 of builtins) {
+    registerProvider2(profile2);
   }
   await scanAndLoadPlugins(getPluginDir(), api);
 }
@@ -53139,16 +53984,16 @@ __export(provider_registry_exports, {
   listProviders: () => listProviders,
   registerProvider: () => registerProvider
 });
-function registerProvider(profile) {
-  const key = profile.name.toLowerCase();
-  _registry.set(key, profile);
-  for (const alias of profile.aliases ?? []) {
+function registerProvider(profile2) {
+  const key = profile2.name.toLowerCase();
+  _registry.set(key, profile2);
+  for (const alias of profile2.aliases ?? []) {
     const aliasKey = alias.toLowerCase();
     const existing = _aliases.get(aliasKey);
     if (existing !== void 0 && existing !== key) {
       if (_registry.has(aliasKey) && aliasKey !== key) {
         throw new TypeError(
-          `[provider-registry] Alias "${alias}" for provider "${profile.name}" conflicts with the primary name of provider "${_registry.get(aliasKey)?.name ?? aliasKey}".`
+          `[provider-registry] Alias "${alias}" for provider "${profile2.name}" conflicts with the primary name of provider "${_registry.get(aliasKey)?.name ?? aliasKey}".`
         );
       }
     }
@@ -53213,7 +54058,7 @@ var init_provider_registry = __esm({
 });
 
 // packages/core/src/llm/rate-limit-guard.ts
-import { existsSync as existsSync42, mkdirSync as mkdirSync16, unlinkSync as unlinkSync9 } from "node:fs";
+import { existsSync as existsSync43, mkdirSync as mkdirSync16, unlinkSync as unlinkSync9 } from "node:fs";
 import { join as join48 } from "node:path";
 import { getCleoHome as getCleoHome10 } from "@cleocode/paths";
 function sanitize(value) {
@@ -53269,7 +54114,7 @@ async function recordRateLimit(provider, label, opts) {
   }
   const filePath = rateLimitStatePath(provider, label);
   const dir = join48(getCleoHome10(), "rate-limit-state");
-  if (!existsSync42(dir)) {
+  if (!existsSync43(dir)) {
     mkdirSync16(dir, { recursive: true });
   }
   const state = { resetAt, recordedAt: now, source };
@@ -53621,8 +54466,8 @@ var init_credential_pool = __esm({
        */
       async _refreshOAuthCredential(existing) {
         if (!existing.refreshToken) return;
-        const profile = await getProviderProfile(this.provider);
-        const oauthCfg = profile?.oauth;
+        const profile2 = await getProviderProfile(this.provider);
+        const oauthCfg = profile2?.oauth;
         if (oauthCfg?.mode === "pkce") {
           await this._refreshViaPkce(
             existing,
@@ -54170,7 +55015,7 @@ var init_error_classifier = __esm({
 
 // packages/core/src/llm/catalog-cache.ts
 import {
-  existsSync as existsSync43,
+  existsSync as existsSync44,
   mkdirSync as mkdirSync17,
   readdirSync as readdirSync11,
   readFileSync as readFileSync23,
@@ -54188,7 +55033,7 @@ function getCatalogDir() {
   return join49(getCleoHome11(), "llm-catalog");
 }
 function findLatestCacheFile(dir) {
-  if (!existsSync43(dir)) return null;
+  if (!existsSync44(dir)) return null;
   const files = readdirSync11(dir).filter((f) => f.endsWith("-models.json")).map((f) => ({ name: f, mtime: statSync13(join49(dir, f)).mtimeMs })).sort((a, b) => b.mtime - a.mtime);
   return files.length > 0 ? join49(dir, files[0].name) : null;
 }
@@ -55573,7 +56418,7 @@ var init_structured_output = __esm({
 
 // packages/core/src/llm/transports/anthropic.ts
 import Anthropic from "@anthropic-ai/sdk";
-import { z as z31 } from "zod";
+import { z as z32 } from "zod";
 function isTextBlock(block) {
   return block.type === "text";
 }
@@ -55645,8 +56490,8 @@ function mapUsage(usage) {
 function zodSchemaFrom(responseFormat) {
   if (responseFormat == null) return null;
   const asAny = responseFormat;
-  if (asAny["schema"] instanceof z31.ZodType) return asAny["schema"];
-  if (responseFormat instanceof z31.ZodType) return responseFormat;
+  if (asAny["schema"] instanceof z32.ZodType) return asAny["schema"];
+  if (responseFormat instanceof z32.ZodType) return responseFormat;
   return null;
 }
 function getJsonSchemaString(responseFormat) {
@@ -56052,7 +56897,7 @@ ${schemaJson}`
             content = typeof validated === "string" ? validated : JSON.stringify(validated);
           } catch {
             try {
-              const repaired = repairResponseModelJson(rawContent, zodSchema2 ?? z31.unknown(), modelName);
+              const repaired = repairResponseModelJson(rawContent, zodSchema2 ?? z32.unknown(), modelName);
               content = typeof repaired === "string" ? repaired : JSON.stringify(repaired);
             } catch {
               content = rawContent || null;
@@ -57617,7 +58462,7 @@ var init_caching = __esm({
 
 // packages/core/src/llm/transports/gemini.ts
 import { GoogleGenerativeAI } from "@google/generative-ai";
-import { z as z32 } from "zod";
+import { z as z33 } from "zod";
 function messagesToRaw(messages, system) {
   const raw = [];
   if (system) {
@@ -58005,7 +58850,7 @@ var init_gemini2 = __esm({
         const parsed = response["parsed"];
         if (parsed !== null && parsed !== void 0) {
           try {
-            const zodResult = z32.string().safeParse(String(parsed));
+            const zodResult = z33.string().safeParse(String(parsed));
             if (!zodResult.success) {
               content = JSON.stringify(parsed);
             } else {
@@ -72402,7 +73247,7 @@ function resolveRef2(ref, ctx) {
 function convertBaseSchema(schema, ctx) {
   if (schema.not !== void 0) {
     if (typeof schema.not === "object" && Object.keys(schema.not).length === 0) {
-      return z33.never();
+      return z34.never();
     }
     throw new Error("not is not supported in Zod (except { not: {} } for never)");
   }
@@ -72424,7 +73269,7 @@ function convertBaseSchema(schema, ctx) {
       return ctx.refs.get(refPath);
     }
     if (ctx.processing.has(refPath)) {
-      return z33.lazy(() => {
+      return z34.lazy(() => {
         if (!ctx.refs.has(refPath)) {
           throw new Error(`Circular reference not resolved: ${refPath}`);
         }
@@ -72441,25 +73286,25 @@ function convertBaseSchema(schema, ctx) {
   if (schema.enum !== void 0) {
     const enumValues = schema.enum;
     if (ctx.version === "openapi-3.0" && schema.nullable === true && enumValues.length === 1 && enumValues[0] === null) {
-      return z33.null();
+      return z34.null();
     }
     if (enumValues.length === 0) {
-      return z33.never();
+      return z34.never();
     }
     if (enumValues.length === 1) {
-      return z33.literal(enumValues[0]);
+      return z34.literal(enumValues[0]);
     }
     if (enumValues.every((v) => typeof v === "string")) {
-      return z33.enum(enumValues);
+      return z34.enum(enumValues);
     }
-    const literalSchemas = enumValues.map((v) => z33.literal(v));
+    const literalSchemas = enumValues.map((v) => z34.literal(v));
     if (literalSchemas.length < 2) {
       return literalSchemas[0];
     }
-    return z33.union([literalSchemas[0], literalSchemas[1], ...literalSchemas.slice(2)]);
+    return z34.union([literalSchemas[0], literalSchemas[1], ...literalSchemas.slice(2)]);
   }
   if (schema.const !== void 0) {
-    return z33.literal(schema.const);
+    return z34.literal(schema.const);
   }
   const type = schema.type;
   if (Array.isArray(type)) {
@@ -72468,68 +73313,68 @@ function convertBaseSchema(schema, ctx) {
       return convertBaseSchema(typeSchema, ctx);
     });
     if (typeSchemas.length === 0) {
-      return z33.never();
+      return z34.never();
     }
     if (typeSchemas.length === 1) {
       return typeSchemas[0];
     }
-    return z33.union(typeSchemas);
+    return z34.union(typeSchemas);
   }
   if (!type) {
-    return z33.any();
+    return z34.any();
   }
   let zodSchema2;
   switch (type) {
     case "string": {
-      let stringSchema = z33.string();
+      let stringSchema = z34.string();
       if (schema.format) {
         const format = schema.format;
         if (format === "email") {
-          stringSchema = stringSchema.check(z33.email());
+          stringSchema = stringSchema.check(z34.email());
         } else if (format === "uri" || format === "uri-reference") {
-          stringSchema = stringSchema.check(z33.url());
+          stringSchema = stringSchema.check(z34.url());
         } else if (format === "uuid" || format === "guid") {
-          stringSchema = stringSchema.check(z33.uuid());
+          stringSchema = stringSchema.check(z34.uuid());
         } else if (format === "date-time") {
-          stringSchema = stringSchema.check(z33.iso.datetime());
+          stringSchema = stringSchema.check(z34.iso.datetime());
         } else if (format === "date") {
-          stringSchema = stringSchema.check(z33.iso.date());
+          stringSchema = stringSchema.check(z34.iso.date());
         } else if (format === "time") {
-          stringSchema = stringSchema.check(z33.iso.time());
+          stringSchema = stringSchema.check(z34.iso.time());
         } else if (format === "duration") {
-          stringSchema = stringSchema.check(z33.iso.duration());
+          stringSchema = stringSchema.check(z34.iso.duration());
         } else if (format === "ipv4") {
-          stringSchema = stringSchema.check(z33.ipv4());
+          stringSchema = stringSchema.check(z34.ipv4());
         } else if (format === "ipv6") {
-          stringSchema = stringSchema.check(z33.ipv6());
+          stringSchema = stringSchema.check(z34.ipv6());
         } else if (format === "mac") {
-          stringSchema = stringSchema.check(z33.mac());
+          stringSchema = stringSchema.check(z34.mac());
         } else if (format === "cidr") {
-          stringSchema = stringSchema.check(z33.cidrv4());
+          stringSchema = stringSchema.check(z34.cidrv4());
         } else if (format === "cidr-v6") {
-          stringSchema = stringSchema.check(z33.cidrv6());
+          stringSchema = stringSchema.check(z34.cidrv6());
         } else if (format === "base64") {
-          stringSchema = stringSchema.check(z33.base64());
+          stringSchema = stringSchema.check(z34.base64());
         } else if (format === "base64url") {
-          stringSchema = stringSchema.check(z33.base64url());
+          stringSchema = stringSchema.check(z34.base64url());
         } else if (format === "e164") {
-          stringSchema = stringSchema.check(z33.e164());
+          stringSchema = stringSchema.check(z34.e164());
         } else if (format === "jwt") {
-          stringSchema = stringSchema.check(z33.jwt());
+          stringSchema = stringSchema.check(z34.jwt());
         } else if (format === "emoji") {
-          stringSchema = stringSchema.check(z33.emoji());
+          stringSchema = stringSchema.check(z34.emoji());
         } else if (format === "nanoid") {
-          stringSchema = stringSchema.check(z33.nanoid());
+          stringSchema = stringSchema.check(z34.nanoid());
         } else if (format === "cuid") {
-          stringSchema = stringSchema.check(z33.cuid());
+          stringSchema = stringSchema.check(z34.cuid());
         } else if (format === "cuid2") {
-          stringSchema = stringSchema.check(z33.cuid2());
+          stringSchema = stringSchema.check(z34.cuid2());
         } else if (format === "ulid") {
-          stringSchema = stringSchema.check(z33.ulid());
+          stringSchema = stringSchema.check(z34.ulid());
         } else if (format === "xid") {
-          stringSchema = stringSchema.check(z33.xid());
+          stringSchema = stringSchema.check(z34.xid());
         } else if (format === "ksuid") {
-          stringSchema = stringSchema.check(z33.ksuid());
+          stringSchema = stringSchema.check(z34.ksuid());
         }
       }
       if (typeof schema.minLength === "number") {
@@ -72546,7 +73391,7 @@ function convertBaseSchema(schema, ctx) {
     }
     case "number":
     case "integer": {
-      let numberSchema = type === "integer" ? z33.number().int() : z33.number();
+      let numberSchema = type === "integer" ? z34.number().int() : z34.number();
       if (typeof schema.minimum === "number") {
         numberSchema = numberSchema.min(schema.minimum);
       }
@@ -72570,11 +73415,11 @@ function convertBaseSchema(schema, ctx) {
       break;
     }
     case "boolean": {
-      zodSchema2 = z33.boolean();
+      zodSchema2 = z34.boolean();
       break;
     }
     case "null": {
-      zodSchema2 = z33.null();
+      zodSchema2 = z34.null();
       break;
     }
     case "object": {
@@ -72587,14 +73432,14 @@ function convertBaseSchema(schema, ctx) {
       }
       if (schema.propertyNames) {
         const keySchema = convertSchema(schema.propertyNames, ctx);
-        const valueSchema = schema.additionalProperties && typeof schema.additionalProperties === "object" ? convertSchema(schema.additionalProperties, ctx) : z33.any();
+        const valueSchema = schema.additionalProperties && typeof schema.additionalProperties === "object" ? convertSchema(schema.additionalProperties, ctx) : z34.any();
         if (Object.keys(shape).length === 0) {
-          zodSchema2 = z33.record(keySchema, valueSchema);
+          zodSchema2 = z34.record(keySchema, valueSchema);
           break;
         }
-        const objectSchema2 = z33.object(shape).passthrough();
-        const recordSchema = z33.looseRecord(keySchema, valueSchema);
-        zodSchema2 = z33.intersection(objectSchema2, recordSchema);
+        const objectSchema2 = z34.object(shape).passthrough();
+        const recordSchema = z34.looseRecord(keySchema, valueSchema);
+        zodSchema2 = z34.intersection(objectSchema2, recordSchema);
         break;
       }
       if (schema.patternProperties) {
@@ -72603,28 +73448,28 @@ function convertBaseSchema(schema, ctx) {
         const looseRecords = [];
         for (const pattern of patternKeys) {
           const patternValue = convertSchema(patternProps[pattern], ctx);
-          const keySchema = z33.string().regex(new RegExp(pattern));
-          looseRecords.push(z33.looseRecord(keySchema, patternValue));
+          const keySchema = z34.string().regex(new RegExp(pattern));
+          looseRecords.push(z34.looseRecord(keySchema, patternValue));
         }
         const schemasToIntersect = [];
         if (Object.keys(shape).length > 0) {
-          schemasToIntersect.push(z33.object(shape).passthrough());
+          schemasToIntersect.push(z34.object(shape).passthrough());
         }
         schemasToIntersect.push(...looseRecords);
         if (schemasToIntersect.length === 0) {
-          zodSchema2 = z33.object({}).passthrough();
+          zodSchema2 = z34.object({}).passthrough();
         } else if (schemasToIntersect.length === 1) {
           zodSchema2 = schemasToIntersect[0];
         } else {
-          let result = z33.intersection(schemasToIntersect[0], schemasToIntersect[1]);
+          let result = z34.intersection(schemasToIntersect[0], schemasToIntersect[1]);
           for (let i = 2; i < schemasToIntersect.length; i++) {
-            result = z33.intersection(result, schemasToIntersect[i]);
+            result = z34.intersection(result, schemasToIntersect[i]);
           }
           zodSchema2 = result;
         }
         break;
       }
-      const objectSchema = z33.object(shape);
+      const objectSchema = z34.object(shape);
       if (schema.additionalProperties === false) {
         zodSchema2 = objectSchema.strict();
       } else if (typeof schema.additionalProperties === "object") {
@@ -72641,33 +73486,33 @@ function convertBaseSchema(schema, ctx) {
         const tupleItems = prefixItems.map((item) => convertSchema(item, ctx));
         const rest = items && typeof items === "object" && !Array.isArray(items) ? convertSchema(items, ctx) : void 0;
         if (rest) {
-          zodSchema2 = z33.tuple(tupleItems).rest(rest);
+          zodSchema2 = z34.tuple(tupleItems).rest(rest);
         } else {
-          zodSchema2 = z33.tuple(tupleItems);
+          zodSchema2 = z34.tuple(tupleItems);
         }
         if (typeof schema.minItems === "number") {
-          zodSchema2 = zodSchema2.check(z33.minLength(schema.minItems));
+          zodSchema2 = zodSchema2.check(z34.minLength(schema.minItems));
         }
         if (typeof schema.maxItems === "number") {
-          zodSchema2 = zodSchema2.check(z33.maxLength(schema.maxItems));
+          zodSchema2 = zodSchema2.check(z34.maxLength(schema.maxItems));
         }
       } else if (Array.isArray(items)) {
         const tupleItems = items.map((item) => convertSchema(item, ctx));
         const rest = schema.additionalItems && typeof schema.additionalItems === "object" ? convertSchema(schema.additionalItems, ctx) : void 0;
         if (rest) {
-          zodSchema2 = z33.tuple(tupleItems).rest(rest);
+          zodSchema2 = z34.tuple(tupleItems).rest(rest);
         } else {
-          zodSchema2 = z33.tuple(tupleItems);
+          zodSchema2 = z34.tuple(tupleItems);
         }
         if (typeof schema.minItems === "number") {
-          zodSchema2 = zodSchema2.check(z33.minLength(schema.minItems));
+          zodSchema2 = zodSchema2.check(z34.minLength(schema.minItems));
         }
         if (typeof schema.maxItems === "number") {
-          zodSchema2 = zodSchema2.check(z33.maxLength(schema.maxItems));
+          zodSchema2 = zodSchema2.check(z34.maxLength(schema.maxItems));
         }
       } else if (items !== void 0) {
         const element = convertSchema(items, ctx);
-        let arraySchema = z33.array(element);
+        let arraySchema = z34.array(element);
         if (typeof schema.minItems === "number") {
           arraySchema = arraySchema.min(schema.minItems);
         }
@@ -72676,7 +73521,7 @@ function convertBaseSchema(schema, ctx) {
         }
         zodSchema2 = arraySchema;
       } else {
-        zodSchema2 = z33.array(z33.any());
+        zodSchema2 = z34.array(z34.any());
       }
       break;
     }
@@ -72693,37 +73538,37 @@ function convertBaseSchema(schema, ctx) {
 }
 function convertSchema(schema, ctx) {
   if (typeof schema === "boolean") {
-    return schema ? z33.any() : z33.never();
+    return schema ? z34.any() : z34.never();
   }
   let baseSchema = convertBaseSchema(schema, ctx);
   const hasExplicitType = schema.type || schema.enum !== void 0 || schema.const !== void 0;
   if (schema.anyOf && Array.isArray(schema.anyOf)) {
     const options = schema.anyOf.map((s) => convertSchema(s, ctx));
-    const anyOfUnion = z33.union(options);
-    baseSchema = hasExplicitType ? z33.intersection(baseSchema, anyOfUnion) : anyOfUnion;
+    const anyOfUnion = z34.union(options);
+    baseSchema = hasExplicitType ? z34.intersection(baseSchema, anyOfUnion) : anyOfUnion;
   }
   if (schema.oneOf && Array.isArray(schema.oneOf)) {
     const options = schema.oneOf.map((s) => convertSchema(s, ctx));
-    const oneOfUnion = z33.xor(options);
-    baseSchema = hasExplicitType ? z33.intersection(baseSchema, oneOfUnion) : oneOfUnion;
+    const oneOfUnion = z34.xor(options);
+    baseSchema = hasExplicitType ? z34.intersection(baseSchema, oneOfUnion) : oneOfUnion;
   }
   if (schema.allOf && Array.isArray(schema.allOf)) {
     if (schema.allOf.length === 0) {
-      baseSchema = hasExplicitType ? baseSchema : z33.any();
+      baseSchema = hasExplicitType ? baseSchema : z34.any();
     } else {
       let result = hasExplicitType ? baseSchema : convertSchema(schema.allOf[0], ctx);
       const startIdx = hasExplicitType ? 0 : 1;
       for (let i = startIdx; i < schema.allOf.length; i++) {
-        result = z33.intersection(result, convertSchema(schema.allOf[i], ctx));
+        result = z34.intersection(result, convertSchema(schema.allOf[i], ctx));
       }
       baseSchema = result;
     }
   }
   if (schema.nullable === true && ctx.version === "openapi-3.0") {
-    baseSchema = z33.nullable(baseSchema);
+    baseSchema = z34.nullable(baseSchema);
   }
   if (schema.readOnly === true) {
-    baseSchema = z33.readonly(baseSchema);
+    baseSchema = z34.readonly(baseSchema);
   }
   const extraMeta = {};
   const coreMetadataKeys = ["$id", "id", "$comment", "$anchor", "$vocabulary", "$dynamicRef", "$dynamicAnchor"];
@@ -72750,7 +73595,7 @@ function convertSchema(schema, ctx) {
 }
 function fromJSONSchema(schema, params) {
   if (typeof schema === "boolean") {
-    return schema ? z33.any() : z33.never();
+    return schema ? z34.any() : z34.never();
   }
   const version2 = detectVersion(schema, params?.defaultTarget);
   const defs = schema.$defs || schema.definitions || {};
@@ -72764,14 +73609,14 @@ function fromJSONSchema(schema, params) {
   };
   return convertSchema(schema, ctx);
 }
-var z33, RECOGNIZED_KEYS;
+var z34, RECOGNIZED_KEYS;
 var init_from_json_schema = __esm({
   "node_modules/.pnpm/zod@4.3.6/node_modules/zod/v4/classic/from-json-schema.js"() {
     init_registries();
     init_checks2();
     init_iso();
     init_schemas2();
-    z33 = {
+    z34 = {
       ...schemas_exports2,
       ...checks_exports2,
       iso: iso_exports
@@ -86684,15 +87529,15 @@ async function selectBestProvisioned(role, opts) {
   const ollamaProvisioned = provisionedIds.includes("ollama");
   let ollamaAlive = localModels.length > 0;
   if (ollamaProvisioned && !ollamaAlive) {
-    const profile = await getProviderProfile2("ollama");
-    const ollamaBase = profile?.baseUrl ?? "http://localhost:11434";
+    const profile2 = await getProviderProfile2("ollama");
+    const ollamaBase = profile2?.baseUrl ?? "http://localhost:11434";
     ollamaAlive = await probeOllamaAlive(ollamaBase);
     if (ollamaAlive) localModels = await listOllamaModels(ollamaBase);
   }
   const scored = [];
   for (const id of provisionedIds) {
-    const profile = await getProviderProfile2(id);
-    const tier = profile?.tier ?? "standard";
+    const profile2 = await getProviderProfile2(id);
+    const tier = profile2?.tier ?? "standard";
     const costInput = 0;
     const score = scoreProvider(id, tier, taskTier, ollamaAlive, costInput);
     const storedCred = await pickCredentialForProvider2(id, { strategy: "priorityOnly" });
@@ -86887,12 +87732,12 @@ function readLlmBlock(config2) {
 }
 function resolveNamedProfile(llm, name15, source) {
   if (!name15) return void 0;
-  const profile = llm?.profiles?.[name15];
-  if (!profile?.provider || !profile.model) return void 0;
+  const profile2 = llm?.profiles?.[name15];
+  if (!profile2?.provider || !profile2.model) return void 0;
   return {
-    provider: profile.provider,
-    model: profile.model,
-    credentialLabel: profile.credentialLabel,
+    provider: profile2.provider,
+    model: profile2.model,
+    credentialLabel: profile2.credentialLabel,
     source
   };
 }
@@ -86920,11 +87765,11 @@ function resolveSystemBinding(llm, systemKey) {
 function resolveRegisteredSystemDefault(llm, systemKey) {
   const defaults = getRegisteredSystemDefault(systemKey);
   if (!defaults) return void 0;
-  const profile = resolveNamedProfile(llm, defaults.profile, "registered-default");
-  if (profile) {
+  const profile2 = resolveNamedProfile(llm, defaults.profile, "registered-default");
+  if (profile2) {
     return {
-      ...profile,
-      credentialLabel: defaults.credentialLabel ?? profile.credentialLabel
+      ...profile2,
+      credentialLabel: defaults.credentialLabel ?? profile2.credentialLabel
     };
   }
   if (defaults.provider && defaults.model) {