@cleocode/core 2026.9.25 → 2026.9.26

package/dist/selfimprove/fix-gen.js

@@ -2009,7 +2009,7 @@ var init_output_contracts_data = __esm({
               // T12503: the optimistic-concurrency version agents pass to --if-match.
               updatedAt: {
                 type: ["string", "null"],
-                description: "Task version for optimistic concurrency: pass it to `cleo update|complete --if-match`."
+                description: "Task version for optimistic concurrency: pass it to `cleo update|complete --if-match`. A stale version fails with E_CONFLICT (23); E_TASK_RENAMED (26) when sync re-numbered the task you read (details.expected is its new id)."
               },
               // T12502: the human assignee and the agent claim lease are separate.
               assignee: {
@@ -13270,6 +13270,7 @@ var init_exit_codes = __esm({
       ExitCode2[ExitCode2["VERSION_CONFLICT"] = 23] = "VERSION_CONFLICT";
       ExitCode2[ExitCode2["SESSION_UNBOUND"] = 24] = "SESSION_UNBOUND";
       ExitCode2[ExitCode2["WORKTREE_LOCKED"] = 25] = "WORKTREE_LOCKED";
+      ExitCode2[ExitCode2["TASK_RENAMED"] = 26] = "TASK_RENAMED";
       ExitCode2[ExitCode2["SESSION_EXISTS"] = 30] = "SESSION_EXISTS";
       ExitCode2[ExitCode2["SESSION_NOT_FOUND"] = 31] = "SESSION_NOT_FOUND";
       ExitCode2[ExitCode2["SCOPE_CONFLICT"] = 32] = "SCOPE_CONFLICT";
@@ -18059,6 +18060,19 @@ var init_error_catalog = __esm({
             `Bind a session: run 'cleo session start --scope global --name "<name>"', 'cleo session resume <id>', or set CLEO_SESSION_ID=<id>.`
           )
         ],
+        [
+          26 /* TASK_RENAMED */,
+          def(
+            26 /* TASK_RENAMED */,
+            "TASK_RENAMED",
+            "CONFLICT",
+            "Task was re-numbered by sync",
+            409,
+            true,
+            "E_TASK_RENAMED",
+            "The task you addressed now has another id (a display-id collision re-numbered it). Re-read it with 'cleo show <new id>' and retry against that id."
+          )
+        ],
         [
           25 /* WORKTREE_LOCKED */,
           def(
@@ -20006,10 +20020,10 @@ var init_table2 = __esm({
       [IsDrizzleTable] = true;
       /** @internal */
       [ExtraConfigBuilder] = void 0;
-      constructor(name15, schema, baseName) {
+      constructor(name15, schema, baseName2) {
         this[TableName] = this[OriginalName] = name15;
         this[TableSchema] = schema;
-        this[BaseName] = baseName;
+        this[BaseName] = baseName2;
       }
     };
   }
@@ -21939,9 +21953,9 @@ var init_casing = __esm({
 });
 
 // node_modules/.pnpm/drizzle-orm@1.0.0-rc.4_@opentelemetry+api@1.9.0_@sinclair+typebox@0.34.49_@types+mssql@_b4e81f2ea693a7363d3e5dc2205249c6/node_modules/drizzle-orm/sqlite-core/table.js
-function sqliteTableBase(name15, columns, extraConfig, schema, casing, baseName = name15) {
+function sqliteTableBase(name15, columns, extraConfig, schema, casing, baseName2 = name15) {
   const casingFn = getCasingFn(casing);
-  const rawTable = new SQLiteTable(name15, schema, baseName);
+  const rawTable = new SQLiteTable(name15, schema, baseName2);
   const parsedColumns = typeof columns === "function" ? columns(getSQLiteColumnBuilders()) : columns;
   const builtColumns = Object.fromEntries(Object.entries(parsedColumns).map(([name16, colBuilderBase]) => {
     const colBuilder = colBuilderBase;
@@ -25707,6 +25721,10 @@ function decisionFor(dbPath) {
   if (!decisions.has(key)) decisions.set(key, schemaWriteRefusal(key));
   return decisions.get(key) ?? null;
 }
+function schemaWritesAllowed(nativeDb) {
+  const dbPath = nativeDb.location();
+  return !dbPath || decisionFor(dbPath) === null;
+}
 function isWorktreeBuildSchemaError(error48) {
   return error48 instanceof Error && error48.message.includes(E_WORKTREE_BUILD_SCHEMA);
 }
@@ -26745,7 +26763,10 @@ var init_row_identity_registry = __esm({
           key: ["id"],
           birth: "recorded_at",
           content: ["ac_id", "previous_text", "reason"],
-          birthFacts: ["ac_id", "previous_text", "reason", "@refFp:ac_uid"],
+          // v2 (T12802): no @refFp: the criterion's fingerprint is unknowable when
+          // it was gone before this row got its identity, so it made the value
+          // depend on fill timing. ac_id is always known.
+          birthFacts: ["ac_id", "previous_text", "reason"],
           storedRefUids: [{ column: "ac_uid", from: "ac_id", table: ACS }],
           task: "T12341"
         },
@@ -26754,7 +26775,10 @@ var init_row_identity_registry = __esm({
           kind: "minted",
           key: ["id"],
           birth: "created_at",
-          birthFacts: ["evidence_atom_id", "binding_type", "ac_text_hash", "@refFp:ac_uid"],
+          // v2 (T12802): ac_id in place of @refFp:ac_uid and ac_text_hash. Both
+          // were filled from the criterion, so a backfilled binding whose
+          // criterion was already gone got a different value (see AC history).
+          birthFacts: ["evidence_atom_id", "binding_type", "ac_id"],
           storedRefUids: [
             { column: "ac_uid", from: "ac_id", table: ACS },
             { column: "ac_text_hash", from: "ac_id", table: ACS, source: "text_hash" }
@@ -26796,7 +26820,9 @@ var init_row_identity_registry = __esm({
           // The uid IS the primary key: display-id-alias.ts computes it on write.
           table: "tasks_display_id_aliases",
           kind: "natural",
-          key: ["entity_table", "display_id", "entity_uid"],
+          // T12800: the reason is part of the key (collision-remint and
+          // remint-assigned of one id and row are distinct facts).
+          key: ["entity_table", "display_id", "entity_uid", "reason"],
           task: "T12341"
         },
         {
@@ -27378,6 +27404,20 @@ function installRowUidTriggers(db, scope) {
     );
   }
 }
+function v1ReleaseBirthFp(db, table, row) {
+  const col = (c) => row[c] ?? null;
+  const facts = table === "tasks_task_acceptance_criteria_history" ? [col("ac_id"), col("previous_text"), col("reason")] : table === "tasks_evidence_ac_bindings" ? [col("evidence_atom_id"), col("binding_type"), col("ac_text_hash")] : [];
+  if (facts.length === 0) return null;
+  const acUid = col("ac_uid");
+  let ref = "ref:none";
+  if (acUid !== null) {
+    const ac = db.prepare("SELECT birth_fp AS fp FROM main.tasks_task_acceptance_criteria WHERE uid = ?").get(acUid);
+    ref = ac === void 0 ? "ref:missing" : ac.fp;
+    if (ref === null) return null;
+  }
+  const spec = rowIdentitySpec("project", table);
+  return birthFingerprint(table, spec?.birth ? col(spec.birth) : null, [...facts, ref]);
+}
 function hasObject(db, type, name15) {
   return db.prepare("SELECT 1 FROM main.sqlite_master WHERE type = ? AND name = ?").get(type, name15) !== void 0;
 }
@@ -27461,24 +27501,41 @@ function preReleaseBirthFp(db, table, row) {
 function resetStaleIdentity(db, scope, writers) {
   if (scope !== "project" || !hasTable(db, ROW_IDENTITY_META_TABLE)) return "none";
   if (readMeta(db, ROW_IDENTITY_RECIPE_KEY) === ROW_IDENTITY_RECIPE) return "none";
-  const minted = ROW_IDENTITY.project.filter(
-    (spec) => spec.kind === "minted" && hasTable(db, spec.table) && columnsOf(db, spec.table).has(BIRTH_FP_COLUMN)
+  const minted = fingerprintOrder("project", ROW_IDENTITY.project).filter(
+    (spec) => hasTable(db, spec.table) && columnsOf(db, spec.table).has(BIRTH_FP_COLUMN)
   );
   const stale = [];
+  const cleared = /* @__PURE__ */ new Map();
+  const mark = (table, column, value) => {
+    if (value === null || value === void 0) return;
+    const key = `${table}.${column}`;
+    const set2 = cleared.get(key) ?? /* @__PURE__ */ new Set();
+    set2.add(String(value));
+    cleared.set(key, set2);
+  };
   for (const spec of minted) {
+    const deps = (spec.birthFacts ?? []).map((fact) => fingerprintRef("project", spec, fact)).filter((d) => d !== null);
+    const keyColumn = targetKey("project", spec.table);
     const rows = db.prepare(
       `SELECT rowid AS _rowid, * FROM main.${q(spec.table)} WHERE ${q(BIRTH_FP_COLUMN)} IS NOT NULL`
     ).all();
     for (const row of rows) {
-      if (row[BIRTH_FP_COLUMN] === preReleaseBirthFp(db, spec.table, row)) {
+      const derivedFromStale = deps.some(
+        (d) => cleared.get(`${d.table}.${d.key}`)?.has(String(row[d.column] ?? ""))
+      );
+      if (derivedFromStale || row[BIRTH_FP_COLUMN] === preReleaseBirthFp(db, spec.table, row) || row[BIRTH_FP_COLUMN] === v1ReleaseBirthFp(db, spec.table, row)) {
         stale.push({ table: spec.table, rowid: row._rowid });
+        mark(spec.table, keyColumn, row[keyColumn]);
+        mark(spec.table, UID_COLUMN, row[UID_COLUMN]);
       }
     }
   }
-  if (stale.length === 0) return "none";
+  const graveyardRows = scope === "project" && hasTable(db, AC_UID_GRAVEYARD) ? db.prepare(`SELECT count(*) AS n FROM main.${AC_UID_GRAVEYARD}`).get().n : 0;
+  if (stale.length === 0 && graveyardRows === 0) return "none";
   if (readMeta(db, ROW_IDENTITY_SYNCED_KEY) !== void 0) return "refused";
   db.exec("SAVEPOINT row_identity_reset");
   try {
+    if (graveyardRows > 0) writers.clearAcUidGraveyardNative(db);
     for (const { table, rowid } of stale) {
       writers.clearBirthFpNative(db, table, rowid);
     }
@@ -27494,6 +27551,106 @@ function writeRecipeMarker(db, writers = requireWriters()) {
   if (!hasTable(db, ROW_IDENTITY_META_TABLE)) return;
   writers.writeRowIdentityMetaNative(db, ROW_IDENTITY_RECIPE_KEY, ROW_IDENTITY_RECIPE);
 }
+function rowIdentityShared(db) {
+  return readMeta(db, ROW_IDENTITY_SYNCED_KEY) !== void 0;
+}
+function healRowIdentitySchema(db, scope, writers = registeredWriters) {
+  const log15 = getLogger("row-identity");
+  if (ROW_IDENTITY[scope].length === 0) {
+    return [];
+  }
+  if (!schemaWritesAllowed(db)) {
+    log15.debug({ scope }, "row identity schema heal skipped: schema writes refused for this build");
+    return [];
+  }
+  try {
+    db.exec("SAVEPOINT row_identity_heal");
+    try {
+      const healed = [
+        ...scope === "project" ? ensureIdentityTables(db) : [],
+        ...ensureRowIdentitySchema(db, scope)
+      ];
+      if (healed.length > 0) recordHealReceipt(db, scope, healed, writers);
+      db.exec("RELEASE SAVEPOINT row_identity_heal");
+      if (healed.length > 0)
+        log15.info({ scope, healed: healed.length }, "row identity schema healed");
+      return healed;
+    } catch (error48) {
+      db.exec("ROLLBACK TO SAVEPOINT row_identity_heal");
+      db.exec("RELEASE SAVEPOINT row_identity_heal");
+      throw error48;
+    }
+  } catch (error48) {
+    log15.error({ scope, error: error48 }, "row identity schema heal failed");
+    return [];
+  }
+}
+function recordHealReceipt(db, scope, healed, writers) {
+  const table = HEAL_RECEIPT_TABLE[scope];
+  const log15 = getLogger("row-identity");
+  if (table === null || !hasTable(db, table) || !writers) {
+    log15.warn({ scope, healed: healed.length }, "row identity schema healed; no receipt table");
+    return;
+  }
+  const objects = healed.map((stmt) => {
+    const col = /ALTER TABLE main\.("?)(\w+)\1 ADD COLUMN ("?)(\w+)\3/.exec(stmt);
+    if (col) return `${col[2]}.${col[4]}`;
+    const obj = /(TABLE|INDEX|TRIGGER) IF NOT EXISTS main\.("?)(\w+)\2/.exec(stmt);
+    return obj ? `${obj[1].toLowerCase()} ${obj[3]}` : stmt.slice(0, 60);
+  });
+  const receipt2 = {
+    at: (/* @__PURE__ */ new Date()).toISOString(),
+    scope,
+    statements: healed.length,
+    objects
+  };
+  const history = [...readRowIdentityHealHistory(db), receipt2].slice(-HEAL_RECEIPTS_KEPT);
+  writers.writeRowIdentityMetaNative(db, ROW_IDENTITY_HEAL_KEY, JSON.stringify(history));
+}
+function readRowIdentityHealHistory(db) {
+  const raw = readMeta(db, ROW_IDENTITY_HEAL_KEY);
+  if (raw === void 0) return [];
+  try {
+    const parsed = JSON.parse(raw);
+    return Array.isArray(parsed) ? parsed : [parsed];
+  } catch {
+    return [];
+  }
+}
+function missingRowIdentitySchema(db) {
+  if (!hasTable(db, "tasks_task_acceptance_criteria")) return [];
+  const missing = [];
+  for (const table of Object.keys(IDENTITY_TABLE_DDL)) {
+    if (!hasTable(db, table)) missing.push(`table ${table}`);
+  }
+  for (const [table, column] of [
+    ["tasks_display_id_aliases", "displaced_hlc"],
+    ["tasks_display_id_aliases", "entity_birth_fp"],
+    [AC_UID_GRAVEYARD, "birth_fp"]
+  ]) {
+    if (hasTable(db, table) && !columnsOf(db, table).has(column)) {
+      missing.push(`column ${table}.${column}`);
+    }
+  }
+  if (!hasObject(db, "trigger", "trg_tasks_ac_uid_graveyard")) {
+    missing.push("trigger trg_tasks_ac_uid_graveyard");
+  }
+  for (const spec of ROW_IDENTITY.project) {
+    if (!hasTable(db, spec.table)) continue;
+    const cols = columnsOf(db, spec.table);
+    for (const column of rowIdentityColumns("project", spec.table)) {
+      if (!cols.has(column)) missing.push(`column ${spec.table}.${column}`);
+    }
+    if (!uidIsPrimaryKey(db, spec.table) && !hasObject(db, "index", `uq_${spec.table}_uid`)) {
+      missing.push(`index uq_${spec.table}_uid`);
+    }
+    for (const ref of spec.storedRefUids ?? []) {
+      const index2 = `idx_${spec.table}_${ref.column}`;
+      if (!hasObject(db, "index", index2)) missing.push(`index ${index2}`);
+    }
+  }
+  return missing;
+}
 function prepareRowIdentity(db, scope, options = {}) {
   if (ROW_IDENTITY[scope].length === 0) return null;
   if (!rowUidFillEnabled()) return null;
@@ -27532,7 +27689,7 @@ function prepareRowIdentity(db, scope, options = {}) {
     return null;
   }
 }
-var ROW_UID_DOMAIN, ROW_BIRTH_DOMAIN, ROW_UID_SQL_FUNCTION, ROW_BIRTH_FP_SQL_FUNCTION, ROW_RANDOM_UID_SQL_FUNCTION, AC_TEXT_HASH_SQL_FUNCTION, AC_UID_GRAVEYARD, registeredWriters, STORE_TIMESTAMP, MAX_UUID_MS, ROW_IDENTITY_RECIPE, ROW_IDENTITY_META_TABLE, ROW_IDENTITY_RECIPE_KEY, ROW_IDENTITY_SYNCED_KEY, IDENTITY_TABLE_DDL, AC_UID_GRAVEYARD_TRIGGER;
+var ROW_UID_DOMAIN, ROW_BIRTH_DOMAIN, ROW_UID_SQL_FUNCTION, ROW_BIRTH_FP_SQL_FUNCTION, ROW_RANDOM_UID_SQL_FUNCTION, AC_TEXT_HASH_SQL_FUNCTION, AC_UID_GRAVEYARD, registeredWriters, STORE_TIMESTAMP, MAX_UUID_MS, ROW_IDENTITY_RECIPE, ROW_IDENTITY_META_TABLE, ROW_IDENTITY_RECIPE_KEY, ROW_IDENTITY_SYNCED_KEY, IDENTITY_TABLE_DDL, AC_UID_GRAVEYARD_TRIGGER, ROW_IDENTITY_HEAL_KEY, HEAL_RECEIPT_TABLE, HEAL_RECEIPTS_KEPT;
 var init_row_identity = __esm({
   "packages/core/src/store/row-identity.ts"() {
     "use strict";
@@ -27541,6 +27698,7 @@ var init_row_identity = __esm({
     init_ac_table();
     init_row_identity_flag();
     init_row_identity_registry();
+    init_worktree_build_guard();
     ROW_UID_DOMAIN = "cleo/row-uid/v1";
     ROW_BIRTH_DOMAIN = "cleo/row-birth/v1";
     ROW_UID_SQL_FUNCTION = "cleo_row_uid";
@@ -27550,7 +27708,7 @@ var init_row_identity = __esm({
     AC_UID_GRAVEYARD = "tasks_ac_uid_graveyard";
     STORE_TIMESTAMP = /^(\d{4})-(\d{2})-(\d{2})(?:[T ](\d{2}):(\d{2})(?::(\d{2})(?:\.(\d{1,9}))?)?)?(Z|[+-]\d{2}:?\d{2})?$/;
     MAX_UUID_MS = 2 ** 48 - 1;
-    ROW_IDENTITY_RECIPE = "cleo/row-identity/v1";
+    ROW_IDENTITY_RECIPE = "cleo/row-identity/v2";
     ROW_IDENTITY_META_TABLE = "tasks_row_identity_meta";
     ROW_IDENTITY_RECIPE_KEY = "row_identity_recipe";
     ROW_IDENTITY_SYNCED_KEY = "row_identity_synced";
@@ -27595,6 +27753,15 @@ BEGIN
   INSERT INTO ${AC_UID_GRAVEYARD} (ac_id, uid, task_id, ordinal, text, birth_fp, deleted_at)
   VALUES (OLD.id, OLD.uid, OLD.task_id, OLD.ordinal, OLD.text, OLD.birth_fp, strftime('%Y-%m-%dT%H:%M:%fZ', 'now'));
 END`;
+    ROW_IDENTITY_HEAL_KEY = "row_identity_schema_healed";
+    HEAL_RECEIPT_TABLE = {
+      project: ROW_IDENTITY_META_TABLE,
+      // The global store declares no identity table yet (ROW_IDENTITY.global is
+      // empty, so its heal never runs); the change that declares one adds its
+      // meta table here.
+      global: null
+    };
+    HEAL_RECEIPTS_KEPT = 20;
   }
 });
 
@@ -41141,12 +41308,12 @@ var init_safety_data_accessor = __esm({
           this.getSafetyOptions()
         );
       }
-      async insertNewTask(task) {
+      async insertNewTask(task, identity) {
         this.logVerbose(`Inserting new task ${task.id}`);
         await safeSingleTaskWrite(
           this.inner,
           task.id,
-          () => this.inner.insertNewTask(task),
+          () => this.inner.insertNewTask(task, identity),
           this.cwd,
           this.getSafetyOptions()
         );
@@ -41194,6 +41361,9 @@ var init_safety_data_accessor = __esm({
         return this.inner.findOrphanAcBindings();
       }
       // ---- Metadata (pass-through to inner) ----
+      async getTaskIdentities(taskIds) {
+        return await this.inner.getTaskIdentities?.(taskIds) ?? [];
+      }
       async getMetaValue(key) {
         return this.inner.getMetaValue(key);
       }
@@ -41567,13 +41737,147 @@ var init_cross_db_cleanup = __esm({
   }
 });
 
+// packages/core/src/store/dependency-cycles.ts
+function formatDependencyCycle(cycle) {
+  return cycle.join(" \u2192 ");
+}
+function buildAdjacency(edges) {
+  const adjacency = /* @__PURE__ */ new Map();
+  for (const { taskId, dependsOn } of edges) {
+    const next = adjacency.get(taskId);
+    if (next) next.push(dependsOn);
+    else adjacency.set(taskId, [dependsOn]);
+  }
+  for (const next of adjacency.values()) next.sort();
+  return adjacency;
+}
+function shortestPath(adjacency, from, to) {
+  if (from === to) return [from];
+  const previous = /* @__PURE__ */ new Map([[from, from]]);
+  const queue = [from];
+  for (let head = 0; head < queue.length; head++) {
+    const id = queue[head];
+    for (const next of adjacency.get(id) ?? []) {
+      if (previous.has(next)) continue;
+      previous.set(next, id);
+      if (next === to) {
+        const path = [to];
+        let cursor = id;
+        while (cursor !== from) {
+          path.push(cursor);
+          cursor = previous.get(cursor);
+        }
+        path.push(from);
+        return path.reverse();
+      }
+      queue.push(next);
+    }
+  }
+  return null;
+}
+function findClosedCycle(existing, edge) {
+  if (edge.taskId === edge.dependsOn) return [edge.taskId, edge.taskId];
+  const path = shortestPath(buildAdjacency(existing), edge.dependsOn, edge.taskId);
+  return path ? [edge.taskId, ...path] : null;
+}
+function dependencyCycleError(edge, cycle) {
+  const self = edge.taskId === edge.dependsOn;
+  const message = self ? `${DEPENDENCY_CYCLE_CODE}: task ${edge.taskId} cannot depend on itself` : `${DEPENDENCY_CYCLE_CODE}: ${edge.taskId} depends on ${edge.dependsOn} would close a dependency cycle: ${formatDependencyCycle(cycle)}`;
+  const closing = cycle.length >= 3 ? cycle[cycle.length - 2] : void 0;
+  const fix = self ? `Drop ${edge.taskId} from its own --depends list` : `Drop this dependency, or first remove another edge of the cycle, e.g. cleo update ${closing} --remove-depends ${edge.taskId}`;
+  return new CleoError(14 /* CIRCULAR_REFERENCE */, message, {
+    fix,
+    details: {
+      field: "depends",
+      actual: edge.dependsOn,
+      taskId: edge.taskId,
+      cycle: [...cycle]
+    }
+  });
+}
+function isDependencyCycleAbort(err) {
+  for (let e = err, depth = 0; e instanceof Error && depth < 8; depth++) {
+    if (e.message.includes(DEPENDENCY_CYCLE_CODE)) return true;
+    e = e.cause;
+  }
+  return false;
+}
+function readDependencyEdges(db) {
+  return db.select({
+    taskId: tasksTaskDependencies.taskId,
+    dependsOn: tasksTaskDependencies.dependsOn
+  }).from(tasksTaskDependencies).all();
+}
+function rethrowDependencyCycle(db, err, attempted) {
+  if (!isDependencyCycleAbort(err)) throw err;
+  const edges = readDependencyEdges(db);
+  for (const edge of attempted) {
+    const cycle = findClosedCycle(edges, edge);
+    if (cycle) throw dependencyCycleError(edge, cycle);
+    edges.push(edge);
+  }
+  throw err;
+}
+var DEPENDENCY_CYCLE_CODE;
+var init_dependency_cycles = __esm({
+  "packages/core/src/store/dependency-cycles.ts"() {
+    "use strict";
+    init_src();
+    init_errors2();
+    init_tasks_schema();
+    DEPENDENCY_CYCLE_CODE = "E_TASK_DEPENDENCY_CYCLE";
+  }
+});
+
 // packages/core/src/store/db-helpers.ts
 import { and as and5, eq as eq7, inArray as inArray3, sql as sql27 } from "drizzle-orm";
 async function upsertTask(db, row, archiveFields, allowOrphanParent = false) {
   await writeTaskRow(db, row, archiveFields, allowOrphanParent, false);
 }
-async function insertNewTask(db, row) {
-  await writeTaskRow(db, row, void 0, false, true);
+async function insertNewTask(db, row, identity = { origin: "new" }) {
+  await writeTaskRow(
+    db,
+    { ...row, ...await importedIdentity(db, identity, row) },
+    void 0,
+    false,
+    true
+  );
+}
+async function tableExists2(db, table) {
+  const rows = await db.all(
+    sql27`SELECT 1 AS x FROM sqlite_master WHERE type = 'table' AND name = ${table}`
+  );
+  return rows.length > 0;
+}
+async function importedIdentity(db, identity, row) {
+  if (identity.origin === "new" || !rowUidFillEnabled()) return {};
+  const fp = identity.birthFp ?? null;
+  const carried2 = identity.uid ?? null;
+  if (carried2 !== null && fp !== null) {
+    let uid = carried2;
+    if (await tableExists2(db, "tasks_uid_aliases")) {
+      for (let hop = 0; hop < 32; hop++) {
+        const found = await db.all(
+          sql27`SELECT new_uid AS uid FROM tasks_uid_aliases
+               WHERE entity_table = 'tasks_tasks' AND old_uid = ${uid} AND old_birth_fp = ${fp}`
+        );
+        const next = found[0];
+        if (!next) break;
+        uid = next.uid;
+      }
+    }
+    const [holder] = await db.select({ id: tasksTasks.id, birthFp: tasksTasks.birthFp }).from(tasksTasks).where(eq7(tasksTasks.uid, uid)).limit(1).all();
+    if (holder && holder.birthFp === fp) throw new SameRowPresentError(row.id, holder.id);
+    if (await tableExists2(db, "tasks_identity_quarantine")) {
+      const [held] = await db.all(
+        sql27`SELECT 1 AS x FROM tasks_identity_quarantine
+             WHERE entity_table = 'tasks_tasks' AND uid = ${uid} AND birth_fp = ${fp}`
+      );
+      if (held) throw new SameRowPresentError(row.id, "held");
+    }
+    if (!holder) return { uid, birthFp: fp };
+  }
+  return { uid: null, birthFp: null };
 }
 async function writeTaskRow(db, row, archiveFields, allowOrphanParent, insertOnly) {
   if (row.parentId && row.parentId === row.id) {
@@ -41724,7 +42028,11 @@ async function batchUpdateDependencies(db, tasks2, validIds) {
     for (const depId of want) if (!have.has(depId)) added.push({ taskId, dependsOn: depId });
   }
   if (added.length > 0) {
-    await db.insert(tasksTaskDependencies).values(added).onConflictDoNothing().run();
+    try {
+      await db.insert(tasksTaskDependencies).values(added).onConflictDoNothing().run();
+    } catch (err) {
+      rethrowDependencyCycle(db, err, added);
+    }
   }
 }
 async function loadDependenciesForTasks(db, tasks2, _validationIds) {
@@ -41769,15 +42077,29 @@ async function loadRelationsForTasks(db, tasks2) {
     task.relates = relations && relations.length > 0 ? relations : [];
   }
 }
-var log6;
+var log6, SameRowPresentError;
 var init_db_helpers = __esm({
   "packages/core/src/store/db-helpers.ts"() {
     "use strict";
     init_src();
     init_errors2();
     init_logger();
+    init_dependency_cycles();
+    init_row_identity_flag();
     init_tasks_schema();
     log6 = getLogger("db-helpers");
+    SameRowPresentError = class extends CleoError {
+      /** Where the row already is: its display id, or `held` when quarantined. */
+      presentAs;
+      constructor(taskId, presentAs) {
+        super(
+          22 /* ID_COLLISION */,
+          `Task ${taskId} is already in this store (${presentAs === "held" ? "held for sync" : `as ${presentAs}`}): same uid and birth fingerprint; not written again`,
+          { details: { field: "taskId", actual: taskId, expected: presentAs } }
+        );
+        this.presentAs = presentAs;
+      }
+    };
   }
 });
 
@@ -41862,46 +42184,133 @@ function readProcessEntry(pid) {
     return null;
   }
 }
-function resolvePpidKey(ppid, lookupProcess) {
+function readProcessArgs(pid) {
+  if (process.platform === "win32" || !Number.isInteger(pid) || pid <= 1) return null;
+  try {
+    const out = execFileSync("ps", ["-o", "args=", "-p", String(pid)], {
+      encoding: "utf8",
+      timeout: 1e3,
+      stdio: ["ignore", "pipe", "ignore"],
+      env: { ...process.env, ...PS_STABLE_ENV }
+    }).trim();
+    return out === "" ? null : out;
+  } catch {
+    return null;
+  }
+}
+function baseName(token) {
+  return token.slice(token.lastIndexOf("/") + 1).replace(/^-/, "");
+}
+function programName(commandLine) {
+  const tokens = commandLine.trim().split(/\s+/);
+  const head = baseName(tokens[0] ?? "");
+  if (!RUNTIME_PATTERN.test(head)) return head;
+  for (let i = 1; i < tokens.length; i++) {
+    const token = tokens[i] ?? "";
+    if (token === "-m") return (tokens[i + 1] ?? head).split(".")[0] ?? head;
+    if (token.startsWith("-")) continue;
+    return baseName(token).replace(/\.(c|m)?(js|ts)$|\.py$/, "");
+  }
+  return head;
+}
+function isCommandStringShell(args) {
+  const tokens = args.trim().split(/\s+/);
+  const shell = programName(args);
+  let first = 1;
+  if (RUNTIME_PATTERN.test(baseName(tokens[0] ?? ""))) {
+    while (first < tokens.length && (tokens[first] ?? "").startsWith("-")) first++;
+    first++;
+  }
+  const rest = tokens.slice(first);
+  if (shell === "pwsh" || shell === "powershell") {
+    return rest.some((t) => PWSH_COMMAND_SWITCHES.has(t.toLowerCase()));
+  }
+  for (let i = 0; i < rest.length; i++) {
+    const token = rest[i] ?? "";
+    if (token === "--") return false;
+    if (token === "--command" || token === "--commands") return true;
+    if (SHELL_OPTIONS_WITH_ARGUMENT.has(token)) {
+      i++;
+      continue;
+    }
+    if (token.startsWith("--")) continue;
+    if (!/^[-+][A-Za-z]+$/.test(token)) return false;
+    if (token.startsWith("-") && token.slice(1).includes("c")) return true;
+  }
+  return false;
+}
+function resolveAncestor(ppid, lookupProcess, lookupArgs, agentId = null) {
   let pid = ppid;
-  for (let depth = 0; depth < PPID_CHAIN_MAX_DEPTH && pid > 1; depth++) {
+  for (let depth = 0; depth < PPID_CHAIN_MAX_DEPTH; depth++) {
+    if (pid <= 1) return null;
     const entry = lookupProcess(pid);
-    if (!entry) return null;
-    if (!PPID_CHAIN_LAUNCHERS.has(entry.command)) {
-      return { key: `ppid:${entry.pid}@${entry.startedAt}`, source: "ppid", kind: "ppid" };
+    if (!entry || entry.pid <= 1) return null;
+    const args = lookupArgs(entry.pid);
+    const program = programName(args ?? entry.command);
+    if (INIT_PROCESSES.has(program) || INIT_PROCESSES.has(entry.command)) return null;
+    if (OWNER_PROCESS_SHELLS.has(program)) {
+      if (args === null) return null;
+      if (!isCommandStringShell(args)) return { entry, program, type: "shell" };
+    } else if (!ANCESTOR_WRAPPERS.has(program)) {
+      if (KNOWN_HARNESSES.has(program)) return { entry, program, type: "harness" };
+      return agentId ? { entry, program, type: "host" } : null;
     }
     pid = entry.ppid;
   }
   return null;
 }
+function anchorKey(anchor, agentId, under) {
+  const proc = `${anchor.entry.pid}@${anchor.entry.startedAt}`;
+  if (anchor.type === "shell" && !agentId) {
+    return { key: `proc:${proc}`, source: "process", kind: "process" };
+  }
+  const agent = agentId ? `#agent=${agentId}` : "";
+  const scope = under ? `|${under.key}` : "";
+  return {
+    key: `harness:${anchor.program}:${proc}${agent}${scope}`,
+    source: "process",
+    kind: "harness"
+  };
+}
 function resolveTerminalKeys(options = {}) {
   const env = options.env ?? process.env;
   const keys = [];
   for (const source of TERMINAL_KEY_SOURCES) {
     const value = envValue(env, source.envVar);
     if (value === null) continue;
-    const qualifier = envValue(env, source.qualifierEnvVar);
+    const qualifiers = [source.qualifierEnvVar, ...source.extraQualifierEnvVars ?? []].map((name15) => envValue(env, name15)).filter((q2) => q2 !== null);
     keys.push({
-      key: `env:${source.envVar}=${qualifier === null ? value : `${qualifier}|${value}`}`,
+      key: `env:${source.envVar}=${[...qualifiers, value].join("|")}`,
       source: source.envVar,
       kind: source.kind
     });
   }
-  if (keys.length > 0) return keys;
-  const live = options.ppid === void 0 && options.lookupProcess === void 0;
-  let ppidKey;
+  if (keys.some((k) => k.kind === "provider")) return keys;
+  const agentId = envValue(env, "CLEO_AGENT_ID");
+  const live = options.ppid === void 0 && options.lookupProcess === void 0 && options.lookupArgs === void 0;
+  let anchor;
   if (live) {
-    if (livePpidKey === void 0) livePpidKey = resolvePpidKey(process.ppid, readProcessEntry);
-    ppidKey = livePpidKey;
+    const memoKey2 = agentId ?? "";
+    if (!liveAnchors.has(memoKey2))
+      liveAnchors.set(
+        memoKey2,
+        resolveAncestor(process.ppid, readProcessEntry, readProcessArgs, agentId)
+      );
+    anchor = liveAnchors.get(memoKey2) ?? null;
   } else {
-    ppidKey = resolvePpidKey(
+    anchor = resolveAncestor(
       options.ppid ?? process.ppid,
-      options.lookupProcess ?? readProcessEntry
+      options.lookupProcess ?? readProcessEntry,
+      options.lookupArgs ?? readProcessArgs,
+      agentId
     );
   }
-  return ppidKey ? [ppidKey] : [];
+  if (!anchor) return keys;
+  if (keys.length === 0) return [anchorKey(anchor, agentId, void 0)];
+  if (anchor.type === "shell" && !agentId) return keys;
+  return [...keys, anchorKey(anchor, agentId, keys[0])];
 }
-var TERMINAL_KEY_SOURCES, PPID_CHAIN_LAUNCHERS, PPID_CHAIN_MAX_DEPTH, livePpidKey;
+var TERMINAL_KEY_SOURCES, PPID_CHAIN_MAX_DEPTH, KNOWN_HARNESSES, RUNTIME_PATTERN, ANCESTOR_WRAPPERS, INIT_PROCESSES, SHELL_OPTIONS_WITH_ARGUMENT, PWSH_COMMAND_SWITCHES, OWNER_PROCESS_SHELLS, liveAnchors;
 var init_terminal_identity = __esm({
   "packages/core/src/sessions/terminal-identity.ts"() {
     "use strict";
@@ -41933,24 +42342,100 @@ var init_terminal_identity = __esm({
         kind: "terminal",
         origin: "konsole",
         qualifierEnvVar: "KONSOLE_DBUS_SERVICE"
+      },
+      // T12864 — non-terminal callers whose platform exports a per-job / per-login id.
+      // GitHub Actions: GITHUB_RUN_ID is per run and shared by its jobs, so it is
+      // qualified by GITHUB_RUN_ATTEMPT and GITHUB_JOB ("Variables reference",
+      // docs.github.com/en/actions/reference/workflows-and-actions/variables).
+      // Every step of one job shares the key; the steps run sequentially.
+      {
+        envVar: "GITHUB_RUN_ID",
+        kind: "terminal",
+        origin: "github-actions",
+        qualifierEnvVar: "GITHUB_RUN_ATTEMPT",
+        extraQualifierEnvVars: ["GITHUB_JOB"]
+      },
+      // GitLab CI: CI_JOB_ID is unique per job across the instance ("Predefined
+      // CI/CD variables reference", docs.gitlab.com/ci/variables/predefined_variables).
+      { envVar: "CI_JOB_ID", kind: "terminal", origin: "gitlab-ci" },
+      // OpenSSH login with a tty: SSH_TTY names the login's tty and is set only
+      // when one was allocated; SSH_CONNECTION ("client-ip client-port server-ip
+      // server-port", ssh(1) ENVIRONMENT) disambiguates it across connections. A
+      // one-shot `ssh host 'cmd'` has no tty and falls through to the ancestor walk.
+      {
+        envVar: "SSH_TTY",
+        kind: "terminal",
+        origin: "openssh",
+        qualifierEnvVar: "SSH_CONNECTION"
       }
     ];
-    PPID_CHAIN_LAUNCHERS = /* @__PURE__ */ new Set([
-      "node",
+    PPID_CHAIN_MAX_DEPTH = 12;
+    KNOWN_HARNESSES = /* @__PURE__ */ new Set([
+      "claude",
+      "codex",
+      "aider",
+      "gemini",
+      "kimi",
+      "cursor-agent",
+      "amp"
+    ]);
+    RUNTIME_PATTERN = /^(node|nodejs|bun|deno|python[0-9.]*|pypy[0-9.]*|ruby|java|php|perl)$/;
+    ANCESTOR_WRAPPERS = /* @__PURE__ */ new Set([
+      "env",
+      "timeout",
+      "gtimeout",
+      "nohup",
+      "nice",
+      "time",
+      "xargs",
+      "stdbuf",
+      "sudo",
+      "doas",
       "npm",
+      "npm-cli",
       "npx",
+      "npx-cli",
       "pnpm",
       "pnpx",
       "yarn",
-      "bun",
       "bunx",
-      "tsx",
       "corepack",
       "mise",
-      "env",
       "cleo"
     ]);
-    PPID_CHAIN_MAX_DEPTH = 4;
+    INIT_PROCESSES = /* @__PURE__ */ new Set(["launchd", "systemd", "init"]);
+    SHELL_OPTIONS_WITH_ARGUMENT = /* @__PURE__ */ new Set([
+      "-o",
+      "+o",
+      "-O",
+      "+O",
+      "--rcfile",
+      "--init-file"
+    ]);
+    PWSH_COMMAND_SWITCHES = /* @__PURE__ */ new Set([
+      "-c",
+      "-command",
+      "-commandwithargs",
+      "-cwa",
+      "-e",
+      "-ec",
+      "-encodedcommand"
+    ]);
+    OWNER_PROCESS_SHELLS = /* @__PURE__ */ new Set([
+      "sh",
+      "bash",
+      "zsh",
+      "dash",
+      "fish",
+      "ksh",
+      "tcsh",
+      "csh",
+      "pwsh",
+      "powershell",
+      "nu",
+      "xonsh"
+    ]);
+    liveAnchors = /* @__PURE__ */ new Map();
   }
 });
 
@@ -41990,7 +42475,8 @@ var init_session_binding_schema = __esm({
 });
 
 // packages/core/src/store/session-store.ts
-import { and as and6, desc as desc2, eq as eq8, isNull as isNull3, lte as lte2, or as or4 } from "drizzle-orm";
+import { existsSync as existsSync20 } from "node:fs";
+import { and as and6, desc as desc2, eq as eq8, inArray as inArray4, isNull as isNull3, lte as lte2, or as or4 } from "drizzle-orm";
 async function getSession(sessionId, cwd) {
   const scope = captureProjectScope(cwd ?? getProjectRoot(), worktreeScope.getStore());
   return worktreeScope.run(scope, async () => {
@@ -42012,8 +42498,9 @@ async function getActiveSession(cwd) {
 function splitTerminalKeys(keys) {
   return {
     provider: keys.find((k) => k.kind === "provider"),
-    pane: keys.find((k) => k.kind === "multiplexer"),
-    tab: keys.find((k) => k.kind === "terminal" || k.kind === "ppid")
+    // A harness / CLEO_AGENT_ID agent (T12864) is more specific than a pane.
+    pane: keys.find((k) => k.kind === "harness") ?? keys.find((k) => k.kind === "multiplexer"),
+    tab: keys.find((k) => k.kind === "terminal" || k.kind === "process" || k.kind === "ppid")
   };
 }
 async function readBinding(db, key) {
@@ -42093,6 +42580,7 @@ async function resolveCurrentSession(cwd) {
 async function resolveBoundSession(cwd) {
   const scope = captureProjectScope(cwd ?? getProjectRoot(), worktreeScope.getStore());
   return worktreeScope.run(scope, async () => {
+    if (!existsSync20(getDbPath(scope.worktreeRoot))) return null;
     const connId = getCurrentConnectionSessionId();
     if (connId) {
       const byConn = await getSession(connId, scope.worktreeRoot);
@@ -42244,7 +42732,7 @@ __export(registry_exports2, {
   updateAgentStatus: () => updateAgentStatus
 });
 import { randomBytes as randomBytes2 } from "node:crypto";
-import { and as and7, eq as eq9, inArray as inArray4, lt as lt2, sql as sql29 } from "drizzle-orm";
+import { and as and7, eq as eq9, inArray as inArray5, lt as lt2, sql as sql29 } from "drizzle-orm";
 function generateAgentId() {
   const now = /* @__PURE__ */ new Date();
   const ts = now.toISOString().replace(/[-:T]/g, "").substring(0, 14);
@@ -42333,11 +42821,11 @@ async function listAgentInstances(filters, cwd) {
   const conditions = [];
   if (filters?.status) {
     const statuses = Array.isArray(filters.status) ? filters.status : [filters.status];
-    conditions.push(inArray4(agentInstances.status, statuses));
+    conditions.push(inArray5(agentInstances.status, statuses));
   }
   if (filters?.agentType) {
     const types = Array.isArray(filters.agentType) ? filters.agentType : [filters.agentType];
-    conditions.push(inArray4(agentInstances.agentType, types));
+    conditions.push(inArray5(agentInstances.agentType, types));
   }
   if (filters?.sessionId) {
     conditions.push(eq9(agentInstances.sessionId, filters.sessionId));
@@ -42374,7 +42862,7 @@ async function checkAgentHealth(thresholdMs = 3e4, cwd) {
   const cutoff = new Date(Date.now() - thresholdMs).toISOString();
   return db.select().from(agentInstances).where(
     and7(
-      inArray4(agentInstances.status, ["active", "idle", "starting"]),
+      inArray5(agentInstances.status, ["active", "idle", "starting"]),
       lt2(agentInstances.lastHeartbeat, cutoff)
     )
   ).all();
@@ -42469,12 +42957,14 @@ var init_registry2 = __esm({
 // packages/core/src/store/sqlite-data-accessor.ts
 var sqlite_data_accessor_exports = {};
 __export(sqlite_data_accessor_exports, {
+  RENAMED_RECENT_MS: () => RENAMED_RECENT_MS,
   addTaskLabelsNative: () => addTaskLabelsNative,
   advanceTaskIdSequence: () => advanceTaskIdSequence,
   bindTaskAccessorScope: () => bindTaskAccessorScope,
   captureTaskAccessorScope: () => captureProjectScope,
   clearAcUidGraveyardNative: () => clearAcUidGraveyardNative,
   clearBirthFpNative: () => clearBirthFpNative,
+  clearReplacedTaskIdentityNative: () => clearReplacedTaskIdentityNative,
   clearRowUidNative: () => clearRowUidNative,
   createSqliteDataAccessor: () => createSqliteDataAccessor,
   deleteDisplayIdAliasNative: () => deleteDisplayIdAliasNative,
@@ -42485,6 +42975,7 @@ __export(sqlite_data_accessor_exports, {
   insertIdentityRowNative: () => insertIdentityRowNative,
   insertQuarantineNative: () => insertQuarantineNative,
   insertUidAliasNative: () => insertUidAliasNative,
+  readReplacedTaskBirthNative: () => readReplacedTaskBirthNative,
   rederiveAcIdsNative: () => rederiveAcIdsNative,
   rekeyQuarantineNative: () => rekeyQuarantineNative,
   relinkAcUidNative: () => relinkAcUidNative,
@@ -42501,7 +42992,7 @@ import {
   and as and8,
   eq as eq10,
   getTableColumns as getTableColumns2,
-  inArray as inArray5,
+  inArray as inArray6,
   isNull as isNull4,
   like as like2,
   lte as lte3,
@@ -42525,8 +43016,8 @@ async function selectAcBindings(db, acIds) {
     bindingType: b.bindingType,
     createdAt: b.createdAt
   };
-  const byUid = await db.select(columns).from(b).innerJoin(ac, eq10(ac.uid, b.acUid)).where(inArray5(ac.id, ids)).all();
-  const byId = await db.select(columns).from(b).leftJoin(ac, eq10(ac.uid, b.acUid)).where(inArray5(b.acId, ids)).all();
+  const byUid = await db.select(columns).from(b).innerJoin(ac, eq10(ac.uid, b.acUid)).where(inArray6(ac.id, ids)).all();
+  const byId = await db.select(columns).from(b).leftJoin(ac, eq10(ac.uid, b.acUid)).where(inArray6(b.acId, ids)).all();
   const rows = [...byUid, ...byId];
   const wanted = new Set(ids);
   const seen = /* @__PURE__ */ new Set();
@@ -42619,6 +43110,7 @@ function renameTaskDisplayIdNative(nativeDb, uid, toId, refs, guard = {}) {
   if (Number(changed) !== 1) {
     throw taskConflictError(current.id, taskVersion(current), null);
   }
+  recordLocalRename(nativeDb, uid, current.id, toId, taskVersion(current));
   const rewritten = {};
   const q2 = (name15) => `"${name15.replaceAll('"', '""')}"`;
   for (const ref of refs) {
@@ -42674,23 +43166,39 @@ function rederiveAcIdsNative(nativeDb, fromId, toId) {
   }
   return count;
 }
-function insertDisplayIdAliasNative(nativeDb, row) {
+function insertDisplayIdAliasNative(nativeDb, row, precedes) {
+  const stored = nativeDb.prepare(
+    `SELECT uid, entity_table AS entityTable, display_id AS displayId, entity_uid AS entityUid,
+              reason, origin, displaced_hlc AS displacedHlc, created_at AS createdAt,
+              entity_birth_fp AS entityBirthFp
+         FROM tasks_display_id_aliases WHERE uid = ?`
+  ).get(row.uid);
+  if (!stored) {
+    nativeDb.prepare(
+      `INSERT INTO tasks_display_id_aliases
+           (uid, entity_table, display_id, entity_uid, reason, origin, displaced_hlc, created_at,
+            entity_birth_fp)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`
+    ).run(
+      row.uid,
+      row.entityTable,
+      row.displayId,
+      row.entityUid,
+      row.reason,
+      row.origin,
+      row.displacedHlc,
+      row.createdAt,
+      row.entityBirthFp
+    );
+    return;
+  }
+  if (!precedes(row, stored)) return;
   nativeDb.prepare(
-    `INSERT OR IGNORE INTO tasks_display_id_aliases
-         (uid, entity_table, display_id, entity_uid, reason, origin, displaced_hlc, created_at,
-          entity_birth_fp)
-       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`
-  ).run(
-    row.uid,
-    row.entityTable,
-    row.displayId,
-    row.entityUid,
-    row.reason,
-    row.origin,
-    row.displacedHlc,
-    row.createdAt,
-    row.entityBirthFp
-  );
+    `UPDATE tasks_display_id_aliases
+          SET origin = ?, displaced_hlc = ?, created_at = ?,
+              entity_birth_fp = coalesce(entity_birth_fp, ?)
+        WHERE uid = ?`
+  ).run(row.origin, row.displacedHlc, row.createdAt, row.entityBirthFp, row.uid);
 }
 function deleteDisplayIdAliasNative(nativeDb, uid) {
   nativeDb.prepare("DELETE FROM tasks_display_id_aliases WHERE uid = ?").run(uid);
@@ -42752,6 +43260,63 @@ function relinkAcUidNative(nativeDb, acId, uid, birthFp) {
 function clearAcUidGraveyardNative(nativeDb) {
   nativeDb.exec("DELETE FROM tasks_ac_uid_graveyard");
 }
+function readReplacedTaskBirthNative(nativeDb, taskId) {
+  return nativeDb.prepare("SELECT created_at AS createdAt, uid FROM tasks_tasks WHERE id = ?").get(taskId);
+}
+function clearReplacedTaskIdentityNative(nativeDb, taskId, before) {
+  const row = nativeDb.prepare("SELECT uid, birth_fp AS fp, created_at AS createdAt FROM tasks_tasks WHERE id = ?").get(taskId);
+  if (!row || row.uid === null && row.fp === null) return;
+  if (before) {
+    const was = parseStoreTimestamp(before.createdAt);
+    if (was !== null && was === parseStoreTimestamp(row.createdAt)) {
+      return;
+    }
+  }
+  if (rowIdentityShared(nativeDb)) {
+    throw new CleoError(
+      6 /* VALIDATION_ERROR */,
+      `Task ${taskId} cannot be overwritten by an import: its identity is shared with other devices`,
+      {
+        fix: "Import it under a new id (the default duplicate strategy), or edit the task instead of overwriting it.",
+        details: { field: "taskId", actual: taskId }
+      }
+    );
+  }
+  const has = (table) => nativeDb.prepare("SELECT 1 AS x FROM sqlite_master WHERE type = 'table' AND name = ?").get(table) !== void 0;
+  nativeDb.prepare("UPDATE tasks_tasks SET uid = NULL, birth_fp = NULL WHERE id = ?").run(taskId);
+  for (const spec of ROW_IDENTITY.project) {
+    if (spec.kind !== "natural" || !has(spec.table)) continue;
+    const cols = (spec.keyRefs ?? []).filter((r) => r.table === "tasks_tasks").map((r) => r.column);
+    if (cols.length === 0) continue;
+    nativeDb.prepare(
+      `UPDATE main.${quoteIdent2(spec.table)} SET uid = NULL WHERE ${cols.map((c) => `${quoteIdent2(c)} = ?`).join(" OR ")}`
+    ).run(...cols.map(() => taskId));
+  }
+  const children = ["tasks_task_acceptance_criteria_history", "tasks_evidence_ac_bindings"].filter(
+    has
+  );
+  const criteria = has("tasks_task_acceptance_criteria") ? nativeDb.prepare("SELECT id, uid FROM tasks_task_acceptance_criteria WHERE task_id = ?").all(taskId) : [];
+  if (criteria.length > 0) {
+    nativeDb.prepare(
+      "UPDATE tasks_task_acceptance_criteria SET uid = NULL, birth_fp = NULL WHERE task_id = ?"
+    ).run(taskId);
+  }
+  fillRowUids(nativeDb, "project");
+  const newUid = nativeDb.prepare("SELECT uid FROM tasks_task_acceptance_criteria WHERE id = ?");
+  let rekeyed = 0;
+  for (const ac of criteria) {
+    const now = newUid.get(ac.id)?.uid ?? null;
+    for (const table of children) {
+      rekeyed += Number(
+        nativeDb.prepare(
+          `UPDATE main.${quoteIdent2(table)} SET ac_uid = ?, birth_fp = NULL
+              WHERE ac_id = ? OR (? IS NOT NULL AND ac_uid = ?)`
+        ).run(now, ac.id, ac.uid, ac.uid).changes
+      );
+    }
+  }
+  if (rekeyed > 0) fillRowUids(nativeDb, "project");
+}
 function quoteIdent2(name15) {
   return `"${name15.replaceAll('"', '""')}"`;
 }
@@ -42839,10 +43404,50 @@ function claimPredicate(guard, allowedHolders) {
   if (guard.mode === "force") return void 0;
   const mine = guard.sessionId === null ? void 0 : eq10(holder, guard.sessionId);
   if (guard.mode === "renew" || guard.mode === "release") return mine ?? sql30`0`;
-  const related = allowedHolders.length > 0 ? inArray5(holder, [...allowedHolders]) : void 0;
+  const related = allowedHolders.length > 0 ? inArray6(holder, [...allowedHolders]) : void 0;
   const expired = guard.mode === "take-over" ? or5(isNull4(tasksTasks.leaseExpiresAt), lte3(tasksTasks.leaseExpiresAt, guard.now)) : void 0;
   return or5(isNull4(holder), mine, related, expired);
 }
+function renameRecordKey(fromId) {
+  return `renamed_from:tasks_tasks:${fromId}`;
+}
+function hasIdentityMeta(nativeDb) {
+  return nativeDb.prepare(
+    "SELECT 1 AS x FROM sqlite_master WHERE type = 'table' AND name = 'tasks_row_identity_meta'"
+  ).get() !== void 0;
+}
+function recordLocalRename(nativeDb, uid, fromId, toId, fromVersion) {
+  if (!hasIdentityMeta(nativeDb)) return;
+  const record2 = { uid, fromVersion, toId, at: (/* @__PURE__ */ new Date()).toISOString() };
+  writeRowIdentityMetaNative(nativeDb, renameRecordKey(fromId), JSON.stringify(record2));
+}
+function assertNotRenamed(nativeDb, taskId, guard, current) {
+  if (!nativeDb || !hasIdentityMeta(nativeDb)) return;
+  const raw = nativeDb.prepare("SELECT value FROM tasks_row_identity_meta WHERE key = ?").get(renameRecordKey(taskId));
+  if (!raw) return;
+  let record2;
+  try {
+    record2 = JSON.parse(raw.value);
+  } catch {
+    return;
+  }
+  if (Date.now() - Date.parse(record2.at) > RENAMED_RECENT_MS) return;
+  const renamed = nativeDb.prepare("SELECT id, claimed_by_session AS claimedBySession FROM tasks_tasks WHERE uid = ?").get(record2.uid);
+  if (!renamed || renamed.id === taskId) return;
+  const expected = guard.expectedUpdatedAt;
+  const session = guard.claim?.sessionId ?? null;
+  const holdsRenamedClaim = session !== null && (guard.claim?.mode === "renew" || guard.claim?.mode === "release") && renamed.claimedBySession === session && current?.claimedBySession !== session;
+  const readRenamed = expected !== void 0 && expected === record2.fromVersion && (current === void 0 || taskVersion(current) !== expected);
+  if (!(current === void 0 || holdsRenamedClaim || readRenamed)) return;
+  throw new CleoError(
+    26 /* TASK_RENAMED */,
+    `Task ${taskId} is now ${renamed.id}: sync re-numbered it after a display-id collision, and ${taskId} ${current ? "names another task" : "names no task"}; nothing was written`,
+    {
+      fix: `Re-read it with 'cleo show ${renamed.id}' and retry against ${renamed.id}.`,
+      details: { field: "taskId", actual: taskId, expected: renamed.id }
+    }
+  );
+}
 function assertClaimAllowed(taskId, row, guard, allowedHolders) {
   const stored = claimFromColumns(row);
   if (claimAllows(stored, guard.mode, guard.sessionId, guard.now, allowedHolders)) return;
@@ -43017,13 +43622,13 @@ async function createOwnedSqliteDataAccessor(cwd, accessorScope) {
       const db = await getDb(cwd);
       const conditions = [];
       if (query.ids && query.ids.length > 0) {
-        conditions.push(inArray5(tasksAuditLog.id, [...query.ids]));
+        conditions.push(inArray6(tasksAuditLog.id, [...query.ids]));
       }
       if (query.taskIds && query.taskIds.length > 0) {
-        conditions.push(inArray5(tasksAuditLog.taskId, [...query.taskIds]));
+        conditions.push(inArray6(tasksAuditLog.taskId, [...query.taskIds]));
       }
       if (query.actions && query.actions.length > 0) {
-        conditions.push(inArray5(tasksAuditLog.action, [...query.actions]));
+        conditions.push(inArray6(tasksAuditLog.action, [...query.actions]));
       }
       if (query.since) {
         conditions.push(sql30`${tasksAuditLog.timestamp} >= ${query.since}`);
@@ -43056,8 +43661,13 @@ async function createOwnedSqliteDataAccessor(cwd, accessorScope) {
     async upsertSingleTask(task) {
       await accessor.transaction((tx) => tx.upsertSingleTask(task));
     },
-    async insertNewTask(task) {
-      await accessor.transaction((tx) => tx.insertNewTask(task));
+    async insertNewTask(task, identity) {
+      await accessor.transaction((tx) => tx.insertNewTask(task, identity));
+    },
+    async getTaskIdentities(taskIds) {
+      if (taskIds.length === 0) return [];
+      const db = await getDb(cwd);
+      return db.select({ id: tasksTasks.id, uid: tasksTasks.uid, birthFp: tasksTasks.birthFp }).from(tasksTasks).where(inArray6(tasksTasks.id, taskIds)).all();
     },
     async addRelation(taskId, relatedTo, relationType, reason) {
       return accessor.transaction(async () => {
@@ -43234,7 +43844,7 @@ async function createOwnedSqliteDataAccessor(cwd, accessorScope) {
         if (!statuses.includes("archived")) {
           conditions.push(ne2(tasksTasks.status, "archived"));
         }
-        conditions.push(inArray5(tasksTasks.status, statuses));
+        conditions.push(inArray6(tasksTasks.status, statuses));
       } else if (filters.excludeStatus) {
         const excluded = Array.isArray(filters.excludeStatus) ? filters.excludeStatus : [filters.excludeStatus];
         for (const s of excluded) {
@@ -43248,11 +43858,11 @@ async function createOwnedSqliteDataAccessor(cwd, accessorScope) {
       if (filters.phase) conditions.push(eq10(tasksTasks.phase, filters.phase));
       if (filters.severity) {
         const severities = Array.isArray(filters.severity) ? filters.severity : [filters.severity];
-        conditions.push(inArray5(tasksTasks.severity, severities));
+        conditions.push(inArray6(tasksTasks.severity, severities));
       }
       if (filters.kind) {
         const kinds = Array.isArray(filters.kind) ? filters.kind : [filters.kind];
-        conditions.push(inArray5(tasksTasks.kind, kinds));
+        conditions.push(inArray6(tasksTasks.kind, kinds));
       }
       if (filters.parentId !== void 0) {
         if (filters.parentId === null) {
@@ -43273,7 +43883,7 @@ async function createOwnedSqliteDataAccessor(cwd, accessorScope) {
       }
       if (filters.label) {
         const labelMatchIds = db.select({ taskId: tasksTaskLabels.taskId }).from(tasksTaskLabels).where(eq10(tasksTaskLabels.label, filters.label));
-        conditions.push(inArray5(tasksTasks.id, labelMatchIds));
+        conditions.push(inArray6(tasksTasks.id, labelMatchIds));
       }
       const where = conditions.length > 0 ? and8(...conditions) : void 0;
       const countResult = await db.select({ count: sql30`count(*)` }).from(tasksTasks).where(where).get();
@@ -43316,7 +43926,7 @@ async function createOwnedSqliteDataAccessor(cwd, accessorScope) {
       const conditions = [];
       if (filters?.status) {
         const statuses = Array.isArray(filters.status) ? filters.status : [filters.status];
-        conditions.push(inArray5(tasksTasks.status, statuses));
+        conditions.push(inArray6(tasksTasks.status, statuses));
       } else {
         conditions.push(ne2(tasksTasks.status, "archived"));
       }
@@ -43381,7 +43991,7 @@ async function createOwnedSqliteDataAccessor(cwd, accessorScope) {
       if (idRows.length === 0) return [];
       const db = await getDb(cwd);
       const ids = idRows.map((r) => r.id);
-      const taskRows = await db.select().from(tasksTasks).where(inArray5(tasksTasks.id, ids)).all();
+      const taskRows = await db.select().from(tasksTasks).where(inArray6(tasksTasks.id, ids)).all();
       const tasks2 = taskRows.map(rowToTask);
       if (tasks2.length > 0) {
         const allIds = await getAllTaskIds();
@@ -43410,7 +44020,7 @@ async function createOwnedSqliteDataAccessor(cwd, accessorScope) {
       if (idRows.length === 0) return [];
       const db = await getDb(cwd);
       const ids = idRows.map((r) => r.id);
-      const rows = await db.select().from(tasksTasks).where(inArray5(tasksTasks.id, ids)).all();
+      const rows = await db.select().from(tasksTasks).where(inArray6(tasksTasks.id, ids)).all();
       const tasks2 = rows.map(rowToTask);
       if (tasks2.length > 0) {
         const allIds = await getAllTaskIds();
@@ -43424,7 +44034,7 @@ async function createOwnedSqliteDataAccessor(cwd, accessorScope) {
       const depRows = await db.select().from(tasksTaskDependencies).where(eq10(tasksTaskDependencies.dependsOn, taskId)).all();
       if (depRows.length === 0) return [];
       const dependentIds = depRows.map((r) => r.taskId);
-      const rows = await db.select().from(tasksTasks).where(inArray5(tasksTasks.id, dependentIds)).all();
+      const rows = await db.select().from(tasksTasks).where(inArray6(tasksTasks.id, dependentIds)).all();
       const tasks2 = rows.map(rowToTask);
       if (tasks2.length > 0) {
         const allIds = await getAllTaskIds();
@@ -43454,7 +44064,7 @@ async function createOwnedSqliteDataAccessor(cwd, accessorScope) {
     async loadTasks(taskIds) {
       if (taskIds.length === 0) return [];
       const db = await getDb(cwd);
-      const rows = await db.select().from(tasksTasks).where(inArray5(tasksTasks.id, taskIds)).all();
+      const rows = await db.select().from(tasksTasks).where(inArray6(tasksTasks.id, taskIds)).all();
       const tasks2 = rows.map(rowToTask);
       if (tasks2.length > 0) {
         const allIds = await getAllTaskIds();
@@ -43508,6 +44118,9 @@ async function createOwnedSqliteDataAccessor(cwd, accessorScope) {
           createdAt: tasksTasks.createdAt,
           ...CLAIM_COLUMNS
         }).from(tasksTasks).where(eq10(tasksTasks.id, taskId)).limit(1).all();
+        if (guard?.claim || guard?.expectedUpdatedAt !== void 0) {
+          assertNotRenamed(getNativeTasksDb(cwd), taskId, guard, current);
+        }
         if (!current) throw new Error(`Task not found: ${taskId}`);
         const claimGuard = guard?.claim;
         const allowedHolders = claimGuard ? await claimAllowedHolders(db, claimGuard) : [];
@@ -43585,24 +44198,37 @@ async function createOwnedSqliteDataAccessor(cwd, accessorScope) {
               nativeDb.prepare(`SAVEPOINT ${spName}`).run();
             }
             try {
+              const replacedBirths = /* @__PURE__ */ new Map();
               const tx = {
                 async upsertSingleTask(task) {
                   scope.assertActive();
                   return accessor.transaction(async () => {
                     scope.assertActive();
+                    if (rowUidFillEnabled() && !replacedBirths.has(task.id)) {
+                      const before = readReplacedTaskBirthNative(nativeDb, task.id);
+                      if (before) replacedBirths.set(task.id, before);
+                    }
                     const row = taskToRow(task);
                     await upsertTask(db, row);
                     await updateDependencies(db, task.id, task.depends ?? []);
                   });
                 },
-                async insertNewTask(task) {
+                async insertNewTask(task, identity) {
                   scope.assertActive();
                   return accessor.transaction(async () => {
                     scope.assertActive();
-                    await insertNewTask(db, taskToRow(task));
+                    await insertNewTask(db, taskToRow(task), identity);
                     await updateDependencies(db, task.id, task.depends ?? []);
                   });
                 },
+                async clearTaskIdentity(taskId) {
+                  scope.assertActive();
+                  if (!rowUidFillEnabled()) return;
+                  return accessor.transaction(async () => {
+                    scope.assertActive();
+                    clearReplacedTaskIdentityNative(nativeDb, taskId, replacedBirths.get(taskId));
+                  });
+                },
                 async archiveSingleTask(taskId, fields) {
                   scope.assertActive();
                   return accessor.transaction(async () => {
@@ -43749,7 +44375,7 @@ async function createOwnedSqliteDataAccessor(cwd, accessorScope) {
                     const owned = await db.select({ id: tasksTaskAcceptanceCriteria.id }).from(tasksTaskAcceptanceCriteria).where(
                       and8(
                         eq10(tasksTaskAcceptanceCriteria.taskId, taskId),
-                        inArray5(tasksTaskAcceptanceCriteria.id, ids)
+                        inArray6(tasksTaskAcceptanceCriteria.id, ids)
                       )
                     ).all();
                     await pruneAcBindingsForAcIds(
@@ -43762,7 +44388,7 @@ async function createOwnedSqliteDataAccessor(cwd, accessorScope) {
                     await db.delete(tasksTaskAcceptanceCriteria).where(
                       and8(
                         eq10(tasksTaskAcceptanceCriteria.taskId, taskId),
-                        inArray5(tasksTaskAcceptanceCriteria.id, ids)
+                        inArray6(tasksTaskAcceptanceCriteria.id, ids)
                       )
                     ).run();
                   });
@@ -44021,7 +44647,7 @@ async function createOwnedSqliteDataAccessor(cwd, accessorScope) {
   };
   return accessor;
 }
-var _txSavepointCounter, taskTransactionQueue, TaskTransactionScope, taskTransactionContext, CLAIM_COLUMNS;
+var _txSavepointCounter, taskTransactionQueue, TaskTransactionScope, taskTransactionContext, CLAIM_COLUMNS, RENAMED_RECENT_MS;
 var init_sqlite_data_accessor = __esm({
   "packages/core/src/store/sqlite-data-accessor.ts"() {
     "use strict";
@@ -44035,6 +44661,8 @@ var init_sqlite_data_accessor = __esm({
     init_cross_db_cleanup();
     init_db_helpers();
     init_row_identity();
+    init_row_identity_flag();
+    init_row_identity_registry();
     init_audit2();
     init_session_store();
     init_sqlite3();
@@ -44067,6 +44695,7 @@ var init_sqlite_data_accessor = __esm({
       claimedAt: tasksTasks.claimedAt,
       leaseExpiresAt: tasksTasks.leaseExpiresAt
     };
+    RENAMED_RECENT_MS = 24 * 60 * 60 * 1e3;
     registerRowIdentityWriters({
       relinkAcUidNative,
       clearAcUidGraveyardNative,
@@ -44537,7 +45166,7 @@ __export(governor_exports, {
   resolveGovernorMode: () => resolveGovernorMode,
   slotFileCount: () => slotFileCount
 });
-import { existsSync as existsSync20, mkdirSync as mkdirSync6, readdirSync as readdirSync5, writeFileSync as writeFileSync5 } from "node:fs";
+import { existsSync as existsSync21, mkdirSync as mkdirSync6, readdirSync as readdirSync5, writeFileSync as writeFileSync5 } from "node:fs";
 import { availableParallelism, totalmem } from "node:os";
 import { join as join27 } from "node:path";
 import lockfile2 from "proper-lockfile";
@@ -44611,11 +45240,11 @@ function governorSlotDir(cls) {
   return join27(getCleoHome(), "locks", `resource-${cls}`);
 }
 function ensureSlotFiles(dir, count) {
-  if (!existsSync20(dir)) mkdirSync6(dir, { recursive: true });
+  if (!existsSync21(dir)) mkdirSync6(dir, { recursive: true });
   const paths = [];
   for (let i = 0; i < count; i++) {
     const p = join27(dir, `slot-${i}.lock`);
-    if (!existsSync20(p)) writeFileSync5(p, "", { flag: "a" });
+    if (!existsSync21(p)) writeFileSync5(p, "", { flag: "a" });
     paths.push(p);
   }
   return paths;
@@ -44655,7 +45284,7 @@ function shuffledIndices(n) {
 }
 async function countHeldSlots(cls, budget) {
   const dir = governorSlotDir(cls);
-  if (!existsSync20(dir)) return 0;
+  if (!existsSync21(dir)) return 0;
   const slots = ensureSlotFiles(dir, budget);
   let held = 0;
   for (const path of slots) {
@@ -44670,7 +45299,7 @@ async function countHeldSlots(cls, budget) {
 }
 function slotFileCount(cls) {
   const dir = governorSlotDir(cls);
-  if (!existsSync20(dir)) return 0;
+  if (!existsSync21(dir)) return 0;
   return readdirSync5(dir).filter((f) => f.startsWith("slot-") && f.endsWith(".lock")).length;
 }
 var _log2, _cachedMode2, _supervisorDegradeLogged, MB, STALE_MS, _supervisorHolderSeq, ResourceGovernor, governor;
@@ -45168,7 +45797,7 @@ var init_recovery = __esm({
 // packages/core/src/store/exodus/archive.ts
 import {
   copyFileSync as copyFileSync5,
-  existsSync as existsSync21,
+  existsSync as existsSync22,
   mkdirSync as mkdirSync7,
   readFileSync as readFileSync9,
   renameSync as renameSync7,
@@ -45196,7 +45825,7 @@ function hasExodusCompleteMarker(scope, cwd, targetDbPath, nativeDb) {
     if (targetDbPath) throw error48;
     return false;
   }
-  if (!existsSync21(markerPath)) return false;
+  if (!existsSync22(markerPath)) return false;
   const marker16 = markerIdentity.parse(JSON.parse(readFileSync9(markerPath, "utf8")));
   if (nativeDb && (!marker16.databaseIdentity || !hasExodusDatabaseIdentity(nativeDb, marker16.databaseIdentity)))
     throw new Error(
@@ -45226,7 +45855,7 @@ function writeExodusCompleteMarker(scope, archivedSources, cwd, targetDbPath, da
 function moveFileInto(srcPath, destDir) {
   mkdirSync7(destDir, { recursive: true });
   let dest = join28(destDir, basename9(srcPath));
-  if (existsSync21(dest)) {
+  if (existsSync22(dest)) {
     const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "").replace(/Z$/, "Z");
     dest = join28(destDir, `${basename9(srcPath)}.${stamp}`);
   }
@@ -45239,14 +45868,14 @@ function moveFileInto(srcPath, destDir) {
   return dest;
 }
 function archiveSourceDb(source, cwd, targetDbPath) {
-  if (!existsSync21(source.path)) {
+  if (!existsSync22(source.path)) {
     return { name: source.name, sourcePath: source.path, archivedTo: null, action: "absent" };
   }
   const destDir = exodusArchiveDir(source.targetScope, cwd, targetDbPath);
   const archivedTo = moveFileInto(source.path, destDir);
   for (const suffix of SIDECAR_SUFFIXES) {
     const sidecar = `${source.path}${suffix}`;
-    if (existsSync21(sidecar)) {
+    if (existsSync22(sidecar)) {
       try {
         moveFileInto(sidecar, destDir);
       } catch (err) {
@@ -45294,7 +45923,7 @@ function detectStrandedResidue(sources, cwd) {
   const stranded = [];
   for (const source of sources) {
     if (!markedScopes.has(source.targetScope)) continue;
-    if (existsSync21(source.path)) {
+    if (existsSync22(source.path)) {
       stranded.push({ name: source.name, path: source.path, scope: source.targetScope });
     }
   }
@@ -45335,13 +45964,13 @@ var init_archive2 = __esm({
 });
 
 // packages/core/src/store/exodus/count-parity.ts
-import { existsSync as existsSync22 } from "node:fs";
+import { existsSync as existsSync23 } from "node:fs";
 function listTables2(db) {
   return db.prepare(
     "SELECT name FROM sqlite_master WHERE type='table' AND name NOT LIKE 'sqlite_%' AND name NOT LIKE '__drizzle_%' ORDER BY name"
   ).all().map((r) => r.name);
 }
-function tableExists2(db, tableName) {
+function tableExists3(db, tableName) {
   const escaped = tableName.replace(/'/g, "''");
   return db.prepare(`SELECT 1 FROM sqlite_master WHERE type='table' AND name='${escaped}'`).get() !== void 0;
 }
@@ -45356,14 +45985,14 @@ function rowCount(db, tableName) {
 function computeCountParity(sources, projectDbPath, globalDbPath) {
   const entries = [];
   let skipped = 0;
-  if (!existsSync22(projectDbPath) || !existsSync22(globalDbPath)) {
+  if (!existsSync23(projectDbPath) || !existsSync23(globalDbPath)) {
     return { ok: false, entries: [], deficits: [], checked: 0, skipped: 0 };
   }
   const projectSnap = openCleoDbSnapshot(projectDbPath, { readOnly: true });
   const globalSnap = openCleoDbSnapshot(globalDbPath, { readOnly: true });
   try {
     for (const src of sources) {
-      if (!existsSync22(src.path)) continue;
+      if (!existsSync23(src.path)) continue;
       const srcSnap = openCleoDbSnapshot(src.path, { readOnly: true });
       try {
         for (const legacyTable of listTables2(srcSnap.db)) {
@@ -45380,7 +46009,7 @@ function computeCountParity(sources, projectDbPath, globalDbPath) {
             skipped++;
             continue;
           }
-          const targetCount = tableExists2(targetSnap.db, targetTable) ? rowCount(targetSnap.db, targetTable) ?? 0 : 0;
+          const targetCount = tableExists3(targetSnap.db, targetTable) ? rowCount(targetSnap.db, targetTable) ?? 0 : 0;
           const deficit = targetCount < sourceCount ? sourceCount - targetCount : 0;
           entries.push({
             sourceDb: src.name,
@@ -45421,7 +46050,7 @@ var init_count_parity = __esm({
 });
 
 // packages/core/src/store/exodus/plan.ts
-import { existsSync as existsSync23, readdirSync as readdirSync6, statfsSync as statfsSync2, statSync as statSync6 } from "node:fs";
+import { existsSync as existsSync24, readdirSync as readdirSync6, statfsSync as statfsSync2, statSync as statSync6 } from "node:fs";
 import { join as join29 } from "node:path";
 function computeRequiredBytes(totalSourceBytes, largestSourceBytes) {
   return Math.ceil(STAGING_HEADROOM_FACTOR * largestSourceBytes) + totalSourceBytes;
@@ -45523,7 +46152,7 @@ function buildExodusPlan(cwd) {
   };
 }
 function sourcesPresent(sources) {
-  return sources.some((s) => existsSync23(s.path));
+  return sources.some((s) => existsSync24(s.path));
 }
 var STAGING_HEADROOM_FACTOR, STAGING_COPY_SKIP_THRESHOLD_BYTES;
 var init_plan2 = __esm({
@@ -45537,18 +46166,18 @@ var init_plan2 = __esm({
 });
 
 // packages/core/src/store/exodus/health.ts
-import { existsSync as existsSync24, statSync as statSync7 } from "node:fs";
+import { existsSync as existsSync25, statSync as statSync7 } from "node:fs";
 function buildExodusHealth(cwd) {
   const plan = buildExodusPlan(cwd);
-  const anyLegacyPresent = plan.sources.some((s) => existsSync24(s.path));
+  const anyLegacyPresent = plan.sources.some((s) => existsSync25(s.path));
   const parity = anyLegacyPresent ? computeCountParity(plan.sources, plan.projectDbPath, plan.globalDbPath) : { ok: true, entries: [], deficits: [], checked: 0, skipped: 0 };
   const consolidatedExistsByScope = {
-    project: existsSync24(plan.projectDbPath),
-    global: existsSync24(plan.globalDbPath)
+    project: existsSync25(plan.projectDbPath),
+    global: existsSync25(plan.globalDbPath)
   };
   const buildScope = (scope) => {
     const sources = plan.sources.filter((s) => s.targetScope === scope).map((s) => {
-      const present = existsSync24(s.path);
+      const present = existsSync25(s.path);
       let bytes = 0;
       if (present) {
         try {
@@ -45653,7 +46282,7 @@ var init_types = __esm({
 // packages/core/src/store/exodus/migrate.ts
 import {
   copyFileSync as copyFileSync6,
-  existsSync as existsSync25,
+  existsSync as existsSync26,
   mkdirSync as mkdirSync8,
   readFileSync as readFileSync10,
   renameSync as renameSync8,
@@ -45699,7 +46328,7 @@ function writeJournal(stagingDir, journal) {
 }
 function readJournal(stagingDir) {
   const journalPath = join30(stagingDir, JOURNAL_FILENAME);
-  if (!existsSync25(journalPath)) return null;
+  if (!existsSync26(journalPath)) return null;
   try {
     return JSON.parse(readFileSync10(journalPath, "utf8"));
   } catch {
@@ -45709,7 +46338,7 @@ function readJournal(stagingDir) {
 function clearExodusJournal(stagingDir) {
   const journalPath = join30(stagingDir, JOURNAL_FILENAME);
   try {
-    if (!existsSync25(journalPath)) return false;
+    if (!existsSync26(journalPath)) return false;
     unlinkSync5(journalPath);
     log10.info(
       { stagingDir },
@@ -46005,7 +46634,7 @@ async function runExodusMigrate(plan, forceCrossVersion = false, onProgress, opt
   mkdirSync8(stagingDir, { recursive: true });
   let sqliteVersion = "unknown";
   for (const src of sources) {
-    if (existsSync25(src.path)) {
+    if (existsSync26(src.path)) {
       const snap = openCleoDbSnapshot(src.path, { readOnly: true });
       sqliteVersion = getSqliteVersion(snap.db);
       snap.close();
@@ -46035,7 +46664,7 @@ async function runExodusMigrate(plan, forceCrossVersion = false, onProgress, opt
   let reseedProject = null;
   try {
     for (const src of sources) {
-      if (!existsSync25(src.path)) continue;
+      if (!existsSync26(src.path)) continue;
       const backupDest = join30(stagingDir, `${src.name.replace(/[^a-z0-9-]/g, "_")}-backup.db`);
       const srcBytes = safeStatBytes(src.path);
       const skipStagingCopy = srcBytes > plan.stagingCopyThresholdBytes;
@@ -46043,7 +46672,7 @@ async function runExodusMigrate(plan, forceCrossVersion = false, onProgress, opt
         onProgress?.(
           `Skipping full staging copy of ${src.name} (${srcBytes} bytes > ${plan.stagingCopyThresholdBytes} threshold) \u2014 source is archived, not deleted, on success.`
         );
-      } else if (!existsSync25(backupDest)) {
+      } else if (!existsSync26(backupDest)) {
         onProgress?.(`Backing up ${src.name} \u2192 staging dir\u2026`);
         copyFileSync6(src.path, backupDest);
         backupPaths.push(backupDest);
@@ -46076,8 +46705,8 @@ async function runExodusMigrate(plan, forceCrossVersion = false, onProgress, opt
     }
     prepareExodusRecovery(projectNative, stagingDir);
     if (globalNative !== null) prepareExodusRecovery(globalNative, stagingDir);
-    const projectSources = sources.filter((s) => s.targetScope === "project" && existsSync25(s.path));
-    const globalSources = sources.filter((s) => s.targetScope === "global" && existsSync25(s.path));
+    const projectSources = sources.filter((s) => s.targetScope === "project" && existsSync26(s.path));
+    const globalSources = sources.filter((s) => s.targetScope === "global" && existsSync26(s.path));
     if (globalNative === null && globalSources.length > 0)
       throw new Error("A projectOnly exodus run was given global-scope sources");
     await migrateScope(
@@ -46326,7 +46955,8 @@ var init_migrate = __esm({
     GRANDFATHERED_GUARD_TRIGGERS = [
       "tasks_tasks_parent_type_matrix_insert",
       "tasks_task_relations_non_containment_insert",
-      "tasks_task_acceptance_child_target_insert"
+      "tasks_task_acceptance_child_target_insert",
+      "tasks_task_dependencies_cycle_guard_insert"
     ];
     SOURCE_EPOCH_UNITS = /* @__PURE__ */ new Map([
       ["conduit", "seconds"],
@@ -46385,7 +47015,7 @@ __export(reconcile_exports, {
   reconcileSupersededStores: () => reconcileSupersededStores,
   unmigratedBareSources: () => unmigratedBareSources
 });
-import { copyFileSync as copyFileSync7, existsSync as existsSync26, mkdirSync as mkdirSync9, mkdtempSync, rmSync as rmSync3, writeFileSync as writeFileSync8 } from "node:fs";
+import { copyFileSync as copyFileSync7, existsSync as existsSync27, mkdirSync as mkdirSync9, mkdtempSync, rmSync as rmSync3, writeFileSync as writeFileSync8 } from "node:fs";
 import { tmpdir as tmpdir4 } from "node:os";
 import { basename as basename10, join as join31 } from "node:path";
 function ident2(name15) {
@@ -46456,7 +47086,7 @@ function assessSupersededProjectStores(liveStorePath, sources, resolveTarget = r
 }
 function legacySourcesHoldRows(sources) {
   for (const src of sources) {
-    if (!existsSync26(src.path)) continue;
+    if (!existsSync27(src.path)) continue;
     const snap = openCleoDbSnapshot(src.path, { readOnly: true });
     try {
       for (const table of orderTablesForCopy(snap.db)) {
@@ -46704,8 +47334,8 @@ async function reconcileSuppressed(projectRoot, options, liveStorePath) {
   }
 }
 async function reconcileWithScratch(projectRoot, dryRun, additive, liveStorePath, plan, resolveTarget, scratch) {
-  const fileSources = plan.sources.filter((s) => s.targetScope === "project" && existsSync26(s.path));
-  const bare = !additive && existsSync26(liveStorePath) ? await bareTaskCoreSource(liveStorePath, resolveTarget, scratch) : null;
+  const fileSources = plan.sources.filter((s) => s.targetScope === "project" && existsSync27(s.path));
+  const bare = !additive && existsSync27(liveStorePath) ? await bareTaskCoreSource(liveStorePath, resolveTarget, scratch) : null;
   const copyResolver = additive ? (sourceName, legacyTable) => {
     const r = resolveTarget(sourceName, legacyTable);
     return r.kind !== "skip" && isLiveAuthoritative(sourceName, legacyTable, r.targetName) ? { kind: "skip", reason: "additive: live-authoritative task graph" } : r;
@@ -46724,7 +47354,7 @@ async function reconcileWithScratch(projectRoot, dryRun, additive, liveStorePath
     stagingDir: null,
     receiptPath: null
   };
-  if (sources.length === 0 || !existsSync26(liveStorePath)) {
+  if (sources.length === 0 || !existsSync27(liveStorePath)) {
     return {
       ...base,
       outcome: "nothing-to-reconcile",
@@ -46916,11 +47546,11 @@ var init_seal = __esm({
 });
 
 // packages/core/src/store/exodus/status.ts
-import { existsSync as existsSync27, readdirSync as readdirSync7, readFileSync as readFileSync11, statSync as statSync9 } from "node:fs";
+import { existsSync as existsSync28, readdirSync as readdirSync7, readFileSync as readFileSync11, statSync as statSync9 } from "node:fs";
 import { join as join32 } from "node:path";
 function readJournal2(stagingDir) {
   const p = join32(stagingDir, JOURNAL_FILENAME2);
-  if (!existsSync27(p)) return null;
+  if (!existsSync28(p)) return null;
   try {
     return JSON.parse(readFileSync11(p, "utf8"));
   } catch {
@@ -46952,15 +47582,15 @@ function runExodusStatus(cwd) {
   const sourcesInfo = plan.sources.map((s) => ({
     name: s.name,
     path: s.path,
-    exists: existsSync27(s.path),
+    exists: existsSync28(s.path),
     bytes: safeBytes(s.path)
   }));
   return {
     hasStaging: latestStaging !== null,
     stagingDir: latestStaging,
     journal,
-    projectDbExists: existsSync27(projectDbPath),
-    globalDbExists: existsSync27(globalDbPath),
+    projectDbExists: existsSync28(projectDbPath),
+    globalDbExists: existsSync28(globalDbPath),
     sourcesPresent: sourcesInfo.some((s) => s.exists),
     sources: sourcesInfo
   };
@@ -46977,7 +47607,7 @@ var init_status = __esm({
 });
 
 // packages/core/src/store/exodus/verify-migration.ts
-import { existsSync as existsSync28 } from "node:fs";
+import { existsSync as existsSync29 } from "node:fs";
 import { createRequire as createRequire10 } from "node:module";
 function orderByClause(db, tableName) {
   try {
@@ -47092,7 +47722,7 @@ function listTables3(db) {
   ).all();
   return rows.map((r) => r.name);
 }
-function tableExists3(db, tableName) {
+function tableExists4(db, tableName) {
   try {
     const escaped = tableName.replace(/'/g, "''");
     return db.prepare(`SELECT 1 FROM sqlite_master WHERE type='table' AND name='${escaped}'`).get() !== void 0;
@@ -47242,10 +47872,10 @@ function orphanAlreadyInSource(targetDb, fk, sources, resolveTarget = resolveCon
     const anyFeeder = (targetTable, probe) => {
       for (const feeder of feedersOf(targetTable)) {
         const src = sources.find((s) => s.name === feeder.sourceName);
-        if (src === void 0 || !existsSync28(src.path)) continue;
+        if (src === void 0 || !existsSync29(src.path)) continue;
         const snap = openCleoDbSnapshot(src.path, { readOnly: true });
         try {
-          if (!tableExists3(snap.db, feeder.legacyTable)) continue;
+          if (!tableExists4(snap.db, feeder.legacyTable)) continue;
           const cols = new Set(
             snap.db.prepare(`PRAGMA table_info("${feeder.legacyTable}")`).all().map((c) => c.name)
           );
@@ -47297,7 +47927,7 @@ function verifyMigration(sources, projectDbPath, globalDbPath, onProgress, resol
   const preExistingForeignKeyViolations = [];
   const failureLines = [];
   const sourceOrphanSigs = /* @__PURE__ */ new Set();
-  if (!existsSync28(projectDbPath)) {
+  if (!existsSync29(projectDbPath)) {
     return {
       ok: false,
       tables: [],
@@ -47308,7 +47938,7 @@ function verifyMigration(sources, projectDbPath, globalDbPath, onProgress, resol
       error: `Consolidated project cleo.db not found at ${projectDbPath}. Run 'cleo exodus migrate' first.`
     };
   }
-  if (!existsSync28(globalDbPath)) {
+  if (!existsSync29(globalDbPath)) {
     return {
       ok: false,
       tables: [],
@@ -47323,7 +47953,7 @@ function verifyMigration(sources, projectDbPath, globalDbPath, onProgress, resol
   const globalSnap = openCleoDbSnapshot(globalDbPath, { readOnly: true });
   try {
     for (const src of sources) {
-      if (!existsSync28(src.path)) {
+      if (!existsSync29(src.path)) {
         onProgress?.(`Skipping ${src.name} (not present)`);
         continue;
       }
@@ -47448,7 +48078,7 @@ function verifyMigration(sources, projectDbPath, globalDbPath, onProgress, resol
     targetOrphans.push(...foreignKeyCheck(globalSnap.db, "global"));
     foreignKeyViolations.push(...targetOrphans);
     for (const fk of targetOrphans) {
-      const orphanDb = tableExists3(projectSnap.db, fk.table) ? projectSnap.db : globalSnap.db;
+      const orphanDb = tableExists4(projectSnap.db, fk.table) ? projectSnap.db : globalSnap.db;
       const sig = orphanSignature(orphanDb, fk);
       const preExisting = sourceOrphanSigs.has(sig) || orphanAlreadyInSource(orphanDb, fk, sources, resolveTarget);
       if (preExisting) {
@@ -47614,7 +48244,7 @@ __export(on_open_exports, {
   maybeRunExodusOnOpen: () => maybeRunExodusOnOpen,
   withExodusOnOpenSuppressed: () => withExodusOnOpenSuppressed
 });
-import { existsSync as existsSync29, mkdtempSync as mkdtempSync2, rmSync as rmSync4 } from "node:fs";
+import { existsSync as existsSync30, mkdtempSync as mkdtempSync2, rmSync as rmSync4 } from "node:fs";
 import { tmpdir as tmpdir5 } from "node:os";
 import { join as join33, resolve as resolve13 } from "node:path";
 async function withExodusOnOpenSuppressed(dbPath, fn) {
@@ -47656,7 +48286,7 @@ function remedyFor(scope) {
 }
 async function strandedLegacySources(scope, cwd) {
   const { buildExodusPlan: buildExodusPlan2, legacySourcesHoldRows: legacySourcesHoldRows2 } = await Promise.resolve().then(() => (init_exodus(), exodus_exports));
-  return buildExodusPlan2(cwd).sources.filter((s) => s.targetScope === scope && existsSync29(s.path)).filter((s) => legacySourcesHoldRows2([s])).map((s) => s.name);
+  return buildExodusPlan2(cwd).sources.filter((s) => s.targetScope === scope && existsSync30(s.path)).filter((s) => legacySourcesHoldRows2([s])).map((s) => s.name);
 }
 async function exodusStoreRewriteRefusal(dbPath, cwd) {
   const { assertOwnerStoreRewriteConfirmed: assertOwnerStoreRewriteConfirmed2, invocationDirectory: invocationDirectory2 } = await Promise.resolve().then(() => (init_worktree_isolation_guard(), worktree_isolation_guard_exports));
@@ -47788,7 +48418,7 @@ async function runExodusOnOpen(scope, dbPath, nativeDb, cwd) {
     };
   }
   const scopeSources = plan.sources.filter((s) => s.targetScope === scope);
-  if (!scopeSources.some((s) => existsSync29(s.path))) {
+  if (!scopeSources.some((s) => existsSync30(s.path))) {
     return {
       outcome: "skipped",
       reason: `no legacy ${scope}-scope source DBs present (fresh install or cross-scope-only)`
@@ -47813,7 +48443,7 @@ async function runExodusOnOpen(scope, dbPath, nativeDb, cwd) {
         {
           scope,
           dbPath,
-          sources: plan.sources.filter((s) => existsSync29(s.path)).map((s) => s.name)
+          sources: plan.sources.filter((s) => existsSync30(s.path)).map((s) => s.name)
         },
         "exodus-on-open: consolidated cleo.db is empty and legacy data present \u2014 auto-migrating"
       );
@@ -47826,7 +48456,7 @@ async function runExodusOnOpen(scope, dbPath, nativeDb, cwd) {
         const bare = scope === "project" ? await unmigratedBareSources2(
           dbPath,
           resolveTarget,
-          plan.sources.find((s) => s.name === "tasks" && existsSync29(s.path))?.path,
+          plan.sources.find((s) => s.name === "tasks" && existsSync30(s.path))?.path,
           bareScratch
         ) : { first: [], last: [] };
         const migratePlan = { ...plan, sources: [...bare.first, ...plan.sources, ...bare.last] };
@@ -47890,7 +48520,7 @@ async function runExodusOnOpen(scope, dbPath, nativeDb, cwd) {
           "exodus-on-open: parity verified \u2014 legacy data migrated into consolidated cleo.db"
         );
         try {
-          const consumed = plan.sources.filter((s) => existsSync29(s.path));
+          const consumed = plan.sources.filter((s) => existsSync30(s.path));
           const identities = await sealTargets(plan, consumed);
           const archiveResult = archiveMigratedSources(consumed, cwd, plan, identities);
           log14.info(
@@ -47965,7 +48595,7 @@ __export(dual_scope_db_exports, {
   upsertIdempotent: () => upsertIdempotent,
   withStoreSchemaOwnership: () => withStoreSchemaOwnership
 });
-import { existsSync as existsSync30, mkdirSync as mkdirSync10 } from "node:fs";
+import { existsSync as existsSync31, mkdirSync as mkdirSync10 } from "node:fs";
 import { createRequire as createRequire11 } from "node:module";
 import { dirname as dirname21, join as join34, resolve as resolve14 } from "node:path";
 function getDualScopeNativeDb(handle) {
@@ -48038,11 +48668,15 @@ async function openDualScopeDb(scope, cwd, options) {
     open
   ) : open();
 }
+function identityWorkOnOpen(nativeDb, scope) {
+  if (ROW_IDENTITY[scope].length === 0) return false;
+  return rowUidFillEnabled() || missingRowIdentitySchema(nativeDb).length > 0;
+}
 async function openDedicatedDualScopeDb(scope, dbPath, log15, execution) {
   execution?.assertActive();
   log15.debug({ scope, dbPath }, "opening DEDICATED (non-cached) dual-scope cleo.db (T11782 FIX D)");
   const dir = dirname21(dbPath);
-  if (!existsSync30(dir)) {
+  if (!existsSync31(dir)) {
     mkdirSync10(dir, { recursive: true });
   }
   execution?.assertActive();
@@ -48075,9 +48709,12 @@ async function openDedicatedDualScopeDb(scope, dbPath, log15, execution) {
           `dual-scope-db[${scope}]`
         );
         execution?.assertActive();
-        if (rowUidFillEnabled()) {
+        if (identityWorkOnOpen(nativeDb, scope)) {
           await Promise.resolve().then(() => (init_sqlite_data_accessor(), sqlite_data_accessor_exports));
-          prepareRowIdentity(nativeDb, scope, { triggers: false });
+          healRowIdentitySchema(nativeDb, scope);
+          if (rowUidFillEnabled()) {
+            prepareRowIdentity(nativeDb, scope, { triggers: false });
+          }
         }
         execution?.assertActive();
         log15.debug({ scope, dbPath }, "DEDICATED dual-scope cleo.db ready (T11782 FIX D)");
@@ -48190,7 +48827,7 @@ async function openDualScopeDbAtPath(scope, dbPath, exodusCwd, options) {
       execution?.assertActive();
       log15.debug({ scope, dbPath: normalizedPath }, "opening dual-scope cleo.db");
       const dir = dirname21(normalizedPath);
-      if (!existsSync30(dir)) {
+      if (!existsSync31(dir)) {
         mkdirSync10(dir, { recursive: true });
       }
       execution?.assertActive();
@@ -48223,9 +48860,12 @@ async function openDualScopeDbAtPath(scope, dbPath, exodusCwd, options) {
             `dual-scope-db[${scope}]`
           );
           execution?.assertActive();
-          if (rowUidFillEnabled()) {
+          if (identityWorkOnOpen(nativeDb, scope)) {
             await Promise.resolve().then(() => (init_sqlite_data_accessor(), sqlite_data_accessor_exports));
-            prepareRowIdentity(nativeDb, scope);
+            healRowIdentitySchema(nativeDb, scope);
+            if (rowUidFillEnabled()) {
+              prepareRowIdentity(nativeDb, scope);
+            }
           }
           execution?.assertActive();
           log15.debug({ scope, dbPath: normalizedPath }, "dual-scope cleo.db ready");
@@ -49355,7 +49995,7 @@ __export(nexus_sqlite_exports, {
   resetNexusDbState: () => resetNexusDbState,
   resolveNexusMigrationsFolder: () => resolveNexusMigrationsFolder
 });
-import { copyFileSync as copyFileSync8, existsSync as existsSync31 } from "node:fs";
+import { copyFileSync as copyFileSync8, existsSync as existsSync32 } from "node:fs";
 import { join as join35 } from "node:path";
 function getNexusDbPath(cwd) {
   return resolveDualScopeDbPath("project", cwd);
@@ -49407,7 +50047,7 @@ function detectAndWarnOnNestedNexus() {
   } catch {
     return false;
   }
-  if (!existsSync31(nestedPath)) return false;
+  if (!existsSync32(nestedPath)) return false;
   if (_warnedNestedPaths.has(nestedPath)) return false;
   _warnedNestedPaths.add(nestedPath);
   const canonicalPath = getNexusDbPath();
@@ -49427,7 +50067,7 @@ function detectAndWarnOnNestedNexus() {
 function _resetNestedNexusWarningGate() {
   _warnedNestedPaths.clear();
 }
-function tableExists4(nativeDb, tableName) {
+function tableExists5(nativeDb, tableName) {
   const result = nativeDb.prepare("SELECT name FROM sqlite_master WHERE type='table' AND name=?").get(tableName);
   return !!result;
 }
@@ -49436,7 +50076,7 @@ function objectExists(nativeDb, type, name15) {
   return !!result;
 }
 function ensureNexusFts5(nativeDb) {
-  if (!tableExists4(nativeDb, "nexus_nodes")) return;
+  if (!tableExists5(nativeDb, "nexus_nodes")) return;
   if (!objectExists(nativeDb, "table", "nexus_symbols_fts")) {
     nativeDb.exec(`
       CREATE VIRTUAL TABLE nexus_symbols_fts USING fts5(
@@ -49482,7 +50122,7 @@ function ensureNexusFts5(nativeDb) {
   `);
 }
 function ensureNexusRelationWeights(nativeDb) {
-  if (!tableExists4(nativeDb, "nexus_relations")) return;
+  if (!tableExists5(nativeDb, "nexus_relations")) return;
   nativeDb.exec(`
     CREATE TABLE IF NOT EXISTS nexus_relation_weights (
       relation_id       TEXT PRIMARY KEY NOT NULL,
@@ -49564,9 +50204,9 @@ function ensureNexusRelationWeights(nativeDb) {
 }
 function runNexusMigrations(nativeDb, db, dbPath) {
   const migrationsFolder = resolveNexusMigrationsFolder();
-  if (tableExists4(nativeDb, "nexus_nodes")) {
+  if (tableExists5(nativeDb, "nexus_nodes")) {
     const backupPath = dbPath.replace(/\.db$/, "-pre-cleo.db.bak");
-    if (!existsSync31(backupPath)) {
+    if (!existsSync32(backupPath)) {
       try {
         copyFileSync8(dbPath, backupPath);
       } catch {
@@ -49696,13 +50336,13 @@ var init_legacy_alias = __esm({
 
 // packages/core/src/llm/stable-device-id.ts
 import { randomUUID as randomUUID3 } from "node:crypto";
-import { existsSync as existsSync32, mkdirSync as mkdirSync11, readFileSync as readFileSync12, renameSync as renameSync9, writeFileSync as writeFileSync9 } from "node:fs";
+import { existsSync as existsSync33, mkdirSync as mkdirSync11, readFileSync as readFileSync12, renameSync as renameSync9, writeFileSync as writeFileSync9 } from "node:fs";
 import { dirname as dirname22 } from "node:path";
 import { resolveStableDeviceIdPath } from "@cleocode/paths";
 function getStableDeviceId() {
   if (_cachedDeviceId !== null) return _cachedDeviceId;
   const path = resolveStableDeviceIdPath();
-  if (existsSync32(path)) {
+  if (existsSync33(path)) {
     try {
       const raw = readFileSync12(path, "utf-8").trim();
       if (raw.length > 0) {
@@ -49715,7 +50355,7 @@ function getStableDeviceId() {
   const fresh = randomUUID3();
   try {
     const dir = dirname22(path);
-    if (!existsSync32(dir)) {
+    if (!existsSync33(dir)) {
       mkdirSync11(dir, { recursive: true });
     }
     const tmpPath = `${path}.tmp.${process.pid}`;
@@ -49791,11 +50431,11 @@ __export(path_map_exports, {
   supersededRegistryPath: () => supersededRegistryPath,
   touchProjectLocation: () => touchProjectLocation
 });
-import { existsSync as existsSync33, lstatSync, readdirSync as readdirSync8 } from "node:fs";
+import { existsSync as existsSync34, lstatSync, readdirSync as readdirSync8 } from "node:fs";
 import { lstat, readdir as readdir2 } from "node:fs/promises";
 import { isAbsolute as isAbsolute5, join as join36, relative as relative3, sep as sep5 } from "node:path";
 import { canonicalizePath as canonicalizePath3, readDeclaredProjectIdentity as readDeclaredProjectIdentity4 } from "@cleocode/paths";
-import { and as and9, desc as desc3, eq as eq12, inArray as inArray6, ne as ne3 } from "drizzle-orm";
+import { and as and9, desc as desc3, eq as eq12, inArray as inArray7, ne as ne3 } from "drizzle-orm";
 function holdingKey(projectId, path) {
   return `${projectId}\0${path}`;
 }
@@ -49943,7 +50583,7 @@ function decideEncounterBinding(db, record2) {
   const here = db.select({ state: projectLocations.state, checkoutNonce: projectLocations.checkoutNonce }).from(projectLocations).where(
     and9(
       eq12(projectLocations.projectId, record2.projectId),
-      inArray6(projectLocations.deviceId, [deviceId, LOCAL_DEVICE_SENTINEL]),
+      inArray7(projectLocations.deviceId, [deviceId, LOCAL_DEVICE_SENTINEL]),
       eq12(projectLocations.path, record2.projectPath)
     )
   ).all();
@@ -49954,7 +50594,7 @@ function decideEncounterBinding(db, record2) {
   const previous = () => db.select({ checkoutNonce: projectLocations.checkoutNonce }).from(projectLocations).where(
     and9(
       eq12(projectLocations.projectId, record2.projectId),
-      inArray6(projectLocations.deviceId, [deviceId, LOCAL_DEVICE_SENTINEL]),
+      inArray7(projectLocations.deviceId, [deviceId, LOCAL_DEVICE_SENTINEL]),
       eq12(projectLocations.path, oldPath)
     )
   ).all();
@@ -50002,7 +50642,7 @@ function hasOtherLiveLocation(db, record2, deviceId) {
       ne3(projectLocations.path, record2.projectPath)
     )
   ).all().some(
-    (location) => isStrictlyInside(record2.projectPath, location.path) && existsSync33(location.path) && readDeclaredProjectIdentity4(location.path)?.projectId === record2.projectId
+    (location) => isStrictlyInside(record2.projectPath, location.path) && existsSync34(location.path) && readDeclaredProjectIdentity4(location.path)?.projectId === record2.projectId
   );
 }
 function demoteProjectLocation(db, record2, state) {
@@ -50053,7 +50693,7 @@ function rehomeDisplacedRows(db, projectId, projectPath, deviceId, probed) {
     ).orderBy(desc3(projectLocations.lastSeen)).all();
     const present = (path) => {
       const holding = probed?.get(holdingKey(row.projectId, path));
-      return holding === void 0 ? existsSync33(path) : holding === "yes";
+      return holding === void 0 ? existsSync34(path) : holding === "yes";
     };
     const home = candidates.find(
       (c) => present(c.path) && db.select({ projectId: projectRegistry.projectId }).from(projectRegistry).where(eq12(projectRegistry.projectPath, c.path)).all().length === 0
@@ -50082,7 +50722,7 @@ async function listProjectCheckouts(projectId, opts = {}) {
       projectHash: generateProjectHash(row.path),
       firstSeen: row.firstSeen,
       lastSeen: row.lastSeen,
-      exists: local && existsSync33(row.path),
+      exists: local && existsSync34(row.path),
       deviceId: local ? deviceId : row.deviceId,
       state: row.state
     });
@@ -50115,7 +50755,7 @@ __export(project_activity_exports, {
   projectLastActivitySql: () => projectLastActivitySql,
   projectLastActivitySqlText: () => projectLastActivitySqlText
 });
-import { eq as eq13, inArray as inArray7, sql as sql32 } from "drizzle-orm";
+import { eq as eq13, inArray as inArray8, sql as sql32 } from "drizzle-orm";
 function normalizeRegistryTimestamp(value) {
   if (value === null || value === void 0 || value.length === 0) return null;
   const iso = /^\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}(\.\d+)?$/.test(value) ? `${value.replace(" ", "T")}Z` : value;
@@ -50144,7 +50784,7 @@ function markProjectsProbed(db, projectIds, now = /* @__PURE__ */ new Date()) {
   for (let i = 0; i < ids.length; i += PROBED_CHUNK) {
     const chunk = ids.slice(i, i + PROBED_CHUNK);
     changed += Number(
-      db.update(projectRegistry).set({ lastProbedAt: at }).where(inArray7(projectRegistry.projectId, chunk)).run().changes
+      db.update(projectRegistry).set({ lastProbedAt: at }).where(inArray8(projectRegistry.projectId, chunk)).run().changes
     );
   }
   return changed;
@@ -50177,11 +50817,11 @@ __export(checkout_nonce_exports, {
   readCheckoutNonce: () => readCheckoutNonce
 });
 import { randomBytes as randomBytes3 } from "node:crypto";
-import { existsSync as existsSync34, readFileSync as readFileSync13, renameSync as renameSync10, writeFileSync as writeFileSync10 } from "node:fs";
+import { existsSync as existsSync35, readFileSync as readFileSync13, renameSync as renameSync10, writeFileSync as writeFileSync10 } from "node:fs";
 import { join as join37 } from "node:path";
 function readInfo(projectRoot) {
   const path = join37(projectRoot, ".cleo", "project-info.json");
-  if (!existsSync34(path)) return null;
+  if (!existsSync35(path)) return null;
   try {
     const parsed = JSON.parse(readFileSync13(path, "utf-8"));
     return parsed !== null && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
@@ -50274,7 +50914,7 @@ __export(paths_exports, {
   validateProjectRoot: () => validateProjectRoot,
   worktreeScope: () => worktreeScope
 });
-import { existsSync as existsSync35, readFileSync as readFileSync14, statSync as statSync10 } from "node:fs";
+import { existsSync as existsSync36, readFileSync as readFileSync14, statSync as statSync10 } from "node:fs";
 import { createRequire as createRequire12 } from "node:module";
 import { homedir as homedir2 } from "node:os";
 import { dirname as dirname23, join as join38, resolve as resolve15 } from "node:path";
@@ -50300,7 +50940,7 @@ function runWithWorktreeScopeFromEnv(fn) {
 function isProjectInitialized(projectRoot) {
   const root = projectRoot ?? getProjectRoot();
   const cleoDir = join38(root, ".cleo");
-  return existsSync35(cleoDir) && existsSync35(join38(cleoDir, "tasks.db"));
+  return existsSync36(cleoDir) && existsSync36(join38(cleoDir, "tasks.db"));
 }
 function getCleoHome() {
   return getPlatformPaths().data;
@@ -50406,7 +51046,7 @@ function _resolveProjectByCwdFromNexus(cwd) {
   try {
     const cleoHome = getCleoHome();
     const globalDbPath = join38(cleoHome, "cleo.db");
-    if (!existsSync35(globalDbPath)) return null;
+    if (!existsSync36(globalDbPath)) return null;
     const start = resolve15(cwd ?? process.cwd());
     let current = start;
     const DatabaseSync3 = _getDatabaseSyncCtor();
@@ -50569,7 +51209,7 @@ function _cwdHasGitAncestor(cwd) {
   while (true) {
     const gitMarker = join38(current, ".git");
     try {
-      if (existsSync35(gitMarker)) {
+      if (existsSync36(gitMarker)) {
         return true;
       }
     } catch {
@@ -50647,7 +51287,7 @@ function getCleoGlobalCantAgentsDir() {
 function getAgentOutputsDir(cwd) {
   const projectRoot = getProjectRoot(cwd);
   const configPath = join38(projectRoot, ".cleo", "config.json");
-  if (existsSync35(configPath)) {
+  if (existsSync36(configPath)) {
     try {
       const config2 = JSON.parse(readFileSync14(configPath, "utf-8"));
       if (typeof config2.agentOutputs === "object" && config2.agentOutputs?.directory) {
@@ -50680,7 +51320,7 @@ function getManifestPath(cwd) {
   const configPath = join38(projectRoot, ".cleo", "config.json");
   const legacyFileName = ["MANIFEST", "jsonl"].join(".");
   let manifestFile = legacyFileName;
-  if (existsSync35(configPath)) {
+  if (existsSync36(configPath)) {
     try {
       const config2 = JSON.parse(readFileSync14(configPath, "utf-8"));
       const customFile = config2.agentOutputs?.manifestFile ?? config2.research?.manifestFile;
@@ -50736,7 +51376,7 @@ function resolveWorktreeRouting(cwdOverride) {
   while (current !== home && current !== "/" && current !== "") {
     const gitPath = join38(current, ".git");
     try {
-      if (existsSync35(gitPath)) {
+      if (existsSync36(gitPath)) {
         const stat3 = statSync10(gitPath);
         if (stat3.isFile()) {
           worktreePath = current;
@@ -50775,7 +51415,7 @@ function detectStrayCleoDb(routing) {
   }
   const tasksDbPath = join38(routing.worktreePath, ".cleo", "tasks.db");
   try {
-    if (existsSync35(tasksDbPath) && statSync10(tasksDbPath).isFile()) {
+    if (existsSync36(tasksDbPath) && statSync10(tasksDbPath).isFile()) {
       return tasksDbPath;
     }
   } catch {
@@ -50785,7 +51425,7 @@ function detectStrayCleoDb(routing) {
 async function resolveProjectById(projectId) {
   try {
     const { getNexusDb: getNexusDb2, getNexusRegistryDbPath: getNexusRegistryDbPath2 } = await Promise.resolve().then(() => (init_nexus_sqlite(), nexus_sqlite_exports));
-    if (!existsSync35(getNexusRegistryDbPath2())) return null;
+    if (!existsSync36(getNexusRegistryDbPath2())) return null;
     const { eq: eq14 } = await import("drizzle-orm");
     const { projectRegistry: projectRegistry2 } = await Promise.resolve().then(() => (init_nexus_schema(), nexus_schema_exports));
     const db = await getNexusDb2();
@@ -50821,7 +51461,7 @@ function _rowToRegistryEntry(row) {
 }
 function _assertProjectInfoReadable(projectRoot) {
   const infoPath = join38(projectRoot, ".cleo", "project-info.json");
-  if (existsSync35(infoPath)) JSON.parse(readFileSync14(infoPath, "utf-8"));
+  if (existsSync36(infoPath)) JSON.parse(readFileSync14(infoPath, "utf-8"));
 }
 function startProjectEncounter(key, projectRoot, infoProjectId) {
   const inFlight2 = _encountersInFlight.get(key);
@@ -50870,7 +51510,7 @@ async function recordProjectEncounter(cwd, options = {}) {
   if (!shouldAutoRegisterProject(project.projectRoot, cleoHome)) return "ephemeral";
   const checkout = captureProjectScope(project.projectRoot, worktreeScope.getStore()).worktreeRoot;
   const { getNexusRegistryDb: getNexusRegistryDb2, getNexusRegistryDbPath: getNexusRegistryDbPath2 } = await Promise.resolve().then(() => (init_nexus_sqlite(), nexus_sqlite_exports));
-  if (existsSync35(getNexusRegistryDbPath2(cleoHome))) {
+  if (existsSync36(getNexusRegistryDbPath2(cleoHome))) {
     const { and: and10, eq: eq14 } = await import("drizzle-orm");
     const { projectLocations: projectLocations2, projectRegistry: projectRegistry2 } = await Promise.resolve().then(() => (init_nexus_schema(), nexus_schema_exports));
     const { currentDeviceId: currentDeviceId2 } = await Promise.resolve().then(() => (init_path_map(), path_map_exports));
@@ -50896,7 +51536,7 @@ async function recordProjectEncounter(cwd, options = {}) {
 }
 async function markEncounterOpened(cleoHome, projectId) {
   const { getNexusRegistryDb: getNexusRegistryDb2, getNexusRegistryDbPath: getNexusRegistryDbPath2 } = await Promise.resolve().then(() => (init_nexus_sqlite(), nexus_sqlite_exports));
-  if (!existsSync35(getNexusRegistryDbPath2(cleoHome))) return;
+  if (!existsSync36(getNexusRegistryDbPath2(cleoHome))) return;
   const { markProjectOpened: markProjectOpened2 } = await Promise.resolve().then(() => (init_project_activity(), project_activity_exports));
   markProjectOpened2(await getNexusRegistryDb2(cleoHome), projectId);
 }
@@ -51139,7 +51779,7 @@ var init_api_mode = __esm({
 // packages/core/src/store/file-utils.ts
 import { randomBytes as randomBytes4 } from "node:crypto";
 import {
-  existsSync as existsSync36,
+  existsSync as existsSync37,
   mkdirSync as mkdirSync12,
   readdirSync as readdirSync9,
   readFileSync as readFileSync15,
@@ -51154,7 +51794,7 @@ function rotateBackup(filePath, mode) {
   const name15 = basename11(filePath);
   const backupDir = join39(dir, ".backups");
   const dirMode = typeof mode === "number" ? modeToDirMode(mode) : void 0;
-  if (!existsSync36(backupDir)) {
+  if (!existsSync37(backupDir)) {
     mkdirSync12(backupDir, { recursive: true, mode: dirMode });
   }
   for (let i = MAX_BACKUPS; i >= 1; i--) {
@@ -51167,7 +51807,7 @@ function rotateBackup(filePath, mode) {
     } else {
       const next = join39(backupDir, `${name15}.${i + 1}`);
       try {
-        if (existsSync36(current)) renameSync11(current, next);
+        if (existsSync37(current)) renameSync11(current, next);
       } catch {
       }
     }
@@ -51203,7 +51843,7 @@ function writeJsonFileAtomic(filePath, data, optsOrIndent = 2) {
     writeFileSync11(tempPath, content, "utf-8");
   }
   try {
-    if (existsSync36(filePath)) {
+    if (existsSync37(filePath)) {
       rotateBackup(filePath, mode);
     }
     renameSync11(tempPath, filePath);
@@ -51229,10 +51869,10 @@ function readJsonFile(filePath) {
 async function withLock2(filePath, transform2, opts = {}) {
   const dir = dirname24(filePath);
   const dirMode = typeof opts.mode === "number" ? modeToDirMode(opts.mode) : void 0;
-  if (!existsSync36(dir)) {
+  if (!existsSync37(dir)) {
     mkdirSync12(dir, { recursive: true, mode: dirMode });
   }
-  if (!existsSync36(filePath)) {
+  if (!existsSync37(filePath)) {
     if (typeof opts.mode === "number") {
       writeFileSync11(filePath, "", { encoding: "utf-8", mode: opts.mode });
     } else {
@@ -51254,10 +51894,10 @@ async function withLock2(filePath, transform2, opts = {}) {
 }
 async function withFileLock(filePath, operation) {
   const dir = dirname24(filePath);
-  if (!existsSync36(dir)) {
+  if (!existsSync37(dir)) {
     mkdirSync12(dir, { recursive: true });
   }
-  if (!existsSync36(filePath)) {
+  if (!existsSync37(filePath)) {
     writeFileSync11(filePath, "", "utf-8");
   }
   let release;
@@ -51614,7 +52254,7 @@ var init_cleo_pkce_seeder = __esm({
 });
 
 // packages/core/src/llm/credential-seeders/codex-cli-seeder.ts
-import { existsSync as existsSync37, readFileSync as readFileSync18 } from "node:fs";
+import { existsSync as existsSync38, readFileSync as readFileSync18 } from "node:fs";
 import { homedir as homedir4 } from "node:os";
 import { join as join43 } from "node:path";
 function getCodexAuthPath() {
@@ -51639,7 +52279,7 @@ var init_codex_cli_seeder = __esm({
        */
       async seed() {
         const authPath = getCodexAuthPath();
-        if (!existsSync37(authPath)) {
+        if (!existsSync38(authPath)) {
           return { entries: [] };
         }
         let raw;
@@ -51834,7 +52474,7 @@ var init_google_pkce = __esm({
 });
 
 // packages/core/src/llm/credential-seeders/gemini-cli-seeder.ts
-import { existsSync as existsSync38, readFileSync as readFileSync19 } from "node:fs";
+import { existsSync as existsSync39, readFileSync as readFileSync19 } from "node:fs";
 import { join as join44 } from "node:path";
 import { getCleoHome as getCleoHome5 } from "@cleocode/paths";
 function getGoogleOauthPath() {
@@ -51883,7 +52523,7 @@ var init_gemini_cli_seeder = __esm({
        */
       async seed() {
         const path = getGoogleOauthPath();
-        if (!existsSync38(path)) {
+        if (!existsSync39(path)) {
           return { entries: [] };
         }
         let raw;
@@ -52108,7 +52748,7 @@ var init_credential_seeders = __esm({
 
 // packages/core/src/llm/global-config-migration.ts
 import {
-  existsSync as existsSync39,
+  existsSync as existsSync40,
   mkdirSync as mkdirSync13,
   readFileSync as readFileSync20,
   renameSync as renameSync12,
@@ -52134,12 +52774,12 @@ function migrateGlobalConfigToConfigDir() {
     const source = legacyGlobalConfigPath();
     const target = configDirGlobalConfigPath();
     const marker16 = migrationMarkerPath();
-    if (existsSync39(marker16)) return false;
-    if (!existsSync39(source)) {
+    if (existsSync40(marker16)) return false;
+    if (!existsSync40(source)) {
       stampMarker(marker16);
       return false;
     }
-    if (existsSync39(target)) {
+    if (existsSync40(target)) {
       backupSourceQuiet(source);
       stampMarker(marker16);
       return false;
@@ -52172,7 +52812,7 @@ function migrateGlobalConfigToConfigDir() {
   } catch (err) {
     try {
       const temp = tempTargetPath();
-      if (existsSync39(temp)) unlinkSync8(temp);
+      if (existsSync40(temp)) unlinkSync8(temp);
     } catch {
     }
     console.error(
@@ -52192,7 +52832,7 @@ function stampMarker(markerPath) {
 function backupSourceQuiet(source) {
   try {
     const backup = `${source}${BACKUP_SUFFIX}`;
-    if (existsSync39(backup)) return;
+    if (existsSync40(backup)) return;
     renameSync12(source, backup);
   } catch {
   }
@@ -52215,7 +52855,7 @@ var init_global_config_migration = __esm({
 });
 
 // packages/core/src/llm/legacy-flat-key-import.ts
-import { existsSync as existsSync40, readFileSync as readFileSync21, renameSync as renameSync13, writeFileSync as writeFileSync13 } from "node:fs";
+import { existsSync as existsSync41, readFileSync as readFileSync21, renameSync as renameSync13, writeFileSync as writeFileSync13 } from "node:fs";
 import { join as join46 } from "node:path";
 import { getCleoHome as getCleoHome7 } from "@cleocode/paths";
 function migrationPaths() {
@@ -52244,7 +52884,7 @@ function writeMarker(markerPath) {
 }
 function readFlatKey(flatPath) {
   try {
-    if (!existsSync40(flatPath)) return null;
+    if (!existsSync41(flatPath)) return null;
     const raw = readFileSync21(flatPath, "utf-8").trim();
     return raw || null;
   } catch (err) {
@@ -52257,7 +52897,7 @@ function readFlatKey(flatPath) {
 }
 async function importLegacyFlatAnthropicKey() {
   const { flatPath, bakPath, markerPath } = migrationPaths();
-  if (existsSync40(markerPath)) {
+  if (existsSync41(markerPath)) {
     return { status: "marker-present", flatPath, bakPath: null, markerPath };
   }
   let existing = null;
@@ -52274,7 +52914,7 @@ async function importLegacyFlatAnthropicKey() {
     writeMarker(markerPath);
     return { status: "already-imported", flatPath, bakPath: null, markerPath };
   }
-  if (!existsSync40(flatPath)) {
+  if (!existsSync41(flatPath)) {
     writeMarker(markerPath);
     return { status: "no-flat-file", flatPath, bakPath: null, markerPath };
   }
@@ -52336,7 +52976,7 @@ var init_legacy_flat_key_import = __esm({
 });
 
 // packages/core/src/llm/credentials.ts
-import { existsSync as existsSync41, mkdirSync as mkdirSync14, readFileSync as readFileSync22, writeFileSync as writeFileSync14 } from "node:fs";
+import { existsSync as existsSync42, mkdirSync as mkdirSync14, readFileSync as readFileSync22, writeFileSync as writeFileSync14 } from "node:fs";
 import { join as join47 } from "node:path";
 import { getCleoHome as getCleoHome8 } from "@cleocode/paths";
 function globalConfigPath() {
@@ -52355,7 +52995,7 @@ function readGlobalProviderKey(provider) {
 function readFlatAnthropicKey() {
   try {
     const keyFile = join47(getCleoHome8(), "anthropic-key");
-    if (!existsSync41(keyFile)) return null;
+    if (!existsSync42(keyFile)) return null;
     const stored = readFileSync22(keyFile, "utf-8").trim();
     return stored || null;
   } catch {
@@ -52364,7 +53004,7 @@ function readFlatAnthropicKey() {
 }
 function readProviderKeyFromConfig(configFile, provider) {
   try {
-    if (!existsSync41(configFile)) return null;
+    if (!existsSync42(configFile)) return null;
     const raw = readFileSync22(configFile, "utf-8");
     const config2 = JSON.parse(raw);
     const llm = config2["llm"];
@@ -52504,16 +53144,16 @@ __export(credentials_store_exports, {
   pickCredentialForProviderSync: () => pickCredentialForProviderSync,
   removeCredential: () => removeCredential
 });
-import { chmodSync as chmodSync2, existsSync as existsSync42, mkdirSync as mkdirSync15, readFileSync as readFileSync23, statSync as statSync11, writeFileSync as writeFileSync15 } from "node:fs";
+import { chmodSync as chmodSync2, existsSync as existsSync43, mkdirSync as mkdirSync15, readFileSync as readFileSync23, statSync as statSync11, writeFileSync as writeFileSync15 } from "node:fs";
 import { dirname as dirname25, join as join48 } from "node:path";
 import { getCleoHome as getCleoHome9 } from "@cleocode/paths";
 function credentialsStorePath() {
   return join48(getCleoHome9(), "llm-credentials.json");
 }
 function ensureFileInitialized(path) {
-  if (existsSync42(path)) return;
+  if (existsSync43(path)) return;
   const dir = dirname25(path);
-  if (!existsSync42(dir)) {
+  if (!existsSync43(dir)) {
     mkdirSync15(dir, { recursive: true, mode: 448 });
   } else {
     try {
@@ -53309,7 +53949,7 @@ var init_provider_registry = __esm({
 });
 
 // packages/core/src/llm/rate-limit-guard.ts
-import { existsSync as existsSync43, mkdirSync as mkdirSync16, unlinkSync as unlinkSync9 } from "node:fs";
+import { existsSync as existsSync44, mkdirSync as mkdirSync16, unlinkSync as unlinkSync9 } from "node:fs";
 import { join as join50 } from "node:path";
 import { getCleoHome as getCleoHome10 } from "@cleocode/paths";
 function sanitize(value) {
@@ -53365,7 +54005,7 @@ async function recordRateLimit(provider, label, opts) {
   }
   const filePath = rateLimitStatePath(provider, label);
   const dir = join50(getCleoHome10(), "rate-limit-state");
-  if (!existsSync43(dir)) {
+  if (!existsSync44(dir)) {
     mkdirSync16(dir, { recursive: true });
   }
   const state = { resetAt, recordedAt: now, source };
@@ -53950,7 +54590,7 @@ var init_local_inference_probe = __esm({
 
 // packages/core/src/llm/catalog-cache.ts
 import {
-  existsSync as existsSync44,
+  existsSync as existsSync45,
   mkdirSync as mkdirSync17,
   readdirSync as readdirSync11,
   readFileSync as readFileSync24,
@@ -53968,7 +54608,7 @@ function getCatalogDir() {
   return join51(getCleoHome11(), "llm-catalog");
 }
 function findLatestCacheFile(dir) {
-  if (!existsSync44(dir)) return null;
+  if (!existsSync45(dir)) return null;
   const files = readdirSync11(dir).filter((f) => f.endsWith("-models.json")).map((f) => ({ name: f, mtime: statSync13(join51(dir, f)).mtimeMs })).sort((a, b) => b.mtime - a.mtime);
   return files.length > 0 ? join51(dir, files[0].name) : null;
 }