@cleocode/core 2026.9.25 → 2026.9.26

package/dist/store/row-identity.d.ts

@@ -325,7 +325,28 @@ export declare function installRowUidTriggers(db: DatabaseSync, scope: TableScop
  * {@link ROW_IDENTITY_RECIPE_KEY} by the first fill; bumped by any change to a
  * recipe, a frozen content or birth-fact list, or the encoding.
  */
-export declare const ROW_IDENTITY_RECIPE = "cleo/row-identity/v1";
+export declare const ROW_IDENTITY_RECIPE = "cleo/row-identity/v2";
+/**
+ * The recipe 9.25 shipped (v1). v2 changed only the birth facts of AC history
+ * and evidence bindings (@refFp:ac_uid and ac_text_hash → none / ac_id,
+ * T12802); a store filled
+ * with v1 has those two tables' fingerprints re-derived (see
+ * {@link v1ReleaseBirthFp}).
+ */
+export declare const ROW_IDENTITY_RECIPE_V1 = "cleo/row-identity/v1";
+/**
+ * The v1 fingerprint of an AC-history or binding row, to recognise a value
+ * the 9.25 recipe derived: v1 hashed the criterion's fingerprint
+ * (`@refFp:ac_uid`), or `ref:none` / `ref:missing`. Other tables: `null`
+ * (their v1 and v2 recipes are the same).
+ *
+ * @param db - Connection on the project `cleo.db`.
+ * @param table - Declared minted table.
+ * @param row - The stored row.
+ * @returns The v1 value, or `null`.
+ * @task T12802
+ */
+export declare function v1ReleaseBirthFp(db: DatabaseSync, table: string, row: Readonly<Record<string, UidInput>>): string | null;
 /**
  * Local-only key/value table of the row-identity layer. Not
  * `tasks_schema_meta`: the twin collapse drops twin-only keys of that table on
@@ -370,6 +391,16 @@ export declare function preReleaseBirthFp(db: DatabaseSync, table: string, row:
  * @param db - Connection on the project `cleo.db`.
  */
 export declare function writeRecipeMarker(db: DatabaseSync, writers?: RowIdentityWriters): void;
+/**
+ * Whether the store's identity values are shared with other devices
+ * ({@link ROW_IDENTITY_SYNCED_KEY} present): from then on no local write may
+ * clear or re-point a uid.
+ *
+ * @param db - Connection on the project `cleo.db`.
+ * @returns True once identity has been sent or received.
+ * @task T12806
+ */
+export declare function rowIdentityShared(db: DatabaseSync): boolean;
 /**
  * Record that identity values are now SHARED with other devices: the recipe
  * marker, and {@link ROW_IDENTITY_SYNCED_KEY} (first write wins, with the
@@ -383,6 +414,65 @@ export declare function writeRecipeMarker(db: DatabaseSync, writers?: RowIdentit
  * @task T12746
  */
 export declare function markRowIdentityShared(db: DatabaseSync, direction: 'send' | 'receive', writers?: RowIdentityWriters): void;
+/**
+ * Re-create the row-identity SCHEMA a store should have, on every open,
+ * whatever the fill flag (T12878). DDL only: the identity tables, the
+ * graveyard trigger, the columns an early table lacks, the uid columns and
+ * their indexes. No row value is read or written. A store whose uid migration
+ * was journaled without running its statements (journal Scenario 3 Case A:
+ * live cleocode under 9.25, spec §12.2) gets the full schema here; the fill,
+ * refill and TEMP triggers stay opt-in ({@link prepareRowIdentity}).
+ *
+ * Never throws: a failure is logged and the open continues.
+ *
+ * @param db - Connection on a `cleo.db`, inside the cold-open lease.
+ * @param scope - The store's scope.
+ * @returns The DDL statements it ran (empty when the schema was complete).
+ * @task T12878
+ */
+export declare function healRowIdentitySchema(db: DatabaseSync, scope: TableScope, writers?: RowIdentityWriters | undefined): string[];
+/**
+ * Meta key of the heal receipt: when the open last re-created missing
+ * identity schema, and what (T12878). Local-only bookkeeping of the heal
+ * itself, in `tasks_row_identity_meta`; no row value of any other table is
+ * written. `cleo doctor` (the `row_identity` check) shows it.
+ */
+export declare const ROW_IDENTITY_HEAL_KEY = "row_identity_schema_healed";
+/** The receipt {@link healRowIdentitySchema} leaves when it re-created schema. */
+export interface RowIdentityHealReceipt {
+    readonly at: string;
+    readonly scope?: TableScope;
+    readonly statements: number;
+    /** Objects re-created or columns added (table, index, trigger or `table.column`). */
+    readonly objects: readonly string[];
+}
+/**
+ * The last heal receipt of a store, read-only (`undefined` when the schema
+ * never needed healing).
+ *
+ * @param db - Connection on a project `cleo.db` (read-only is fine).
+ * @returns The receipt.
+ * @task T12878
+ */
+export declare function readRowIdentityHealReceipt(db: DatabaseSync): RowIdentityHealReceipt | undefined;
+/**
+ * Every heal receipt a store kept, oldest first (read-only).
+ *
+ * @param db - Connection on a project `cleo.db` (read-only is fine).
+ * @returns The receipts (empty when the schema never needed healing).
+ * @task T12878
+ */
+export declare function readRowIdentityHealHistory(db: DatabaseSync): RowIdentityHealReceipt[];
+/**
+ * Identity schema a project store lacks, read-only: missing identity tables,
+ * the graveyard trigger, and the alias / graveyard columns an early table
+ * lacks (T12878; the open heals them).
+ *
+ * @param db - Connection on a project `cleo.db` (read-only is fine).
+ * @returns What is missing (empty when complete).
+ * @task T12878
+ */
+export declare function missingRowIdentitySchema(db: DatabaseSync): string[];
 export declare function prepareRowIdentity(db: DatabaseSync, scope: TableScope, options?: {
     readonly triggers?: boolean;
     readonly writers?: RowIdentityWriters;

package/dist/store/row-identity.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"row-identity.d.ts","sourceRoot":"","sources":["../../src/store/row-identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8DG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,KAAK,EAAmC,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAKvF,OAAO,EACL,eAAe,EACf,YAAY,EACZ,kBAAkB,EAClB,eAAe,EACf,UAAU,EACX,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,kBAAkB,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC;AAE1F,2FAA2F;AAC3F,eAAO,MAAM,cAAc,oBAAoB,CAAC;AAEhD,4DAA4D;AAC5D,eAAO,MAAM,gBAAgB,sBAAsB,CAAC;AAEpD,iEAAiE;AACjE,eAAO,MAAM,oBAAoB,iBAAiB,CAAC;AAEnD,iEAAiE;AACjE,eAAO,MAAM,yBAAyB,sBAAsB,CAAC;AAE7D,yFAAyF;AACzF,eAAO,MAAM,2BAA2B,wBAAwB,CAAC;AAEjE,qEAAqE;AACrE,eAAO,MAAM,yBAAyB,sBAAsB,CAAC;AAE7D,yDAAyD;AACzD,eAAO,MAAM,gBAAgB,2BAA2B,CAAC;AAEzD;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,iBAAiB,CAAC,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAAC;IAC/F,yBAAyB,CAAC,EAAE,EAAE,YAAY,GAAG,IAAI,CAAC;IAClD,0BAA0B,CAAC,EAAE,EAAE,YAAY,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/E,wBAAwB,CACtB,EAAE,EAAE,YAAY,EAChB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,KAAK,CAAC,EAAE,MAAM,GACb,MAAM,CAAC;IACV,kBAAkB,CAAC,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1E;AAID;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,kBAAkB,GAAG,IAAI,CAE5E;AAUD,0DAA0D;AAC1D,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,UAAU,GAAG,IAAI,CAAC;AAEpE;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,SAAS,QAAQ,EAAE,GAAG,MAAM,CA2BnE;AAMD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,QAAQ,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAsB9E;AAWD;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,YAAY,CAC1B,KAAK,EAAE,UAAU,EACjB,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,SAAS,QAAQ,EAAE,EACxB,KAAK,EAAE,QAAQ,EACf,SAAS,GAAE,SAAS,QAAQ,EAAO,EACnC,OAAO,GAAE,SAAS,QAAQ,EAAO,GAChC,MAAM,CAyBR;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,eAAe,CAC7B,KAAK,EAAE,UAAU,EACjB,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,MAAM,GAClB,MAAM,CAaR;AAED,0FAA0F;AAC1F,MAAM,MAAM,aAAa,GAAG,SAAS,GAAG,gBAAgB,CAAC;AAEzD;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAC3B,KAAK,EAAE,UAAU,EACjB,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,SAAS,QAAQ,EAAE,EAC1B,MAAM,GAAE,aAAyB,GAChC,MAAM,CAQR;AAaD;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAElD;AAOD;;;;;;;;;;;;GAYG;AACH,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,QAAQ,EACf,KAAK,EAAE,SAAS,QAAQ,EAAE,GACzB,MAAM,CAOR;AAED,mDAAmD;AACnD,MAAM,MAAM,QAAQ,GAAG,UAAU,GAAG,WAAW,GAAG,SAAS,CAAC;AAE5D;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,MAAM,GAAG,IAAI,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,QAAQ,CAG7E;AAwOD;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,UAAU,GAAG,IAAI,CA0BhF;AAuDD;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,UAAU,GAAG,MAAM,EAAE,CAkCrF;AAED,mEAAmE;AACnE,MAAM,WAAW,mBAAmB;IAClC,sFAAsF;IACtF,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACxD,iFAAiF;IACjF,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACxD,0FAA0F;IAC1F,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACxD;AAED,8BAA8B;AAC9B,MAAM,WAAW,gBAAgB;IAC/B,8BAA8B;IAC9B,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAClD,0DAA0D;IAC1D,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD,4CAA4C;IAC5C,QAAQ,CAAC,aAAa,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACzD,qEAAqE;IACrE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,8EAA8E;IAC9E,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACpD,6BAA6B;IAC7B,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,CAAC;IACvC,gDAAgD;IAChD,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,CAAC;CACjD;AA+DD;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAC3B,EAAE,EAAE,YAAY,EAChB,KAAK,EAAE,UAAU,EACjB,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,kBAAqC,GAC7C,MAAM,CAIR;AA6GD;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,UAAU,GAAG,mBAAmB,CAyC5F;AAED;;;;;;;;;GASG;AACH,wBAAgB,WAAW,CACzB,EAAE,EAAE,YAAY,EAChB,KAAK,EAAE,UAAU,EACjB,OAAO,GAAE,kBAAqC,GAC7C,IAAI,CAAC,gBAAgB,EAAE,QAAQ,GAAG,UAAU,GAAG,QAAQ,CAAC,CA+B1D;AAED;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CAAC,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,UAAU,GAAG,IAAI,CA+B/E;AAED;;;;;;;;;;;GAWG;AACH;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,yBAAyB,CAAC;AAE1D;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,4BAA4B,CAAC;AAEjE,oFAAoF;AACpF,eAAO,MAAM,uBAAuB,wBAAwB,CAAC;AAE7D;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,wBAAwB,CAAC;AAuD7D;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,EAAE,EAAE,YAAY,GAAG,MAAM,EAAE,CA4B/D;AAoBD;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAC/B,EAAE,EAAE,YAAY,EAChB,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,GACtC,MAAM,GAAG,IAAI,CAkDf;AAsDD;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,EAAE,EAAE,YAAY,EAChB,OAAO,GAAE,kBAAqC,GAC7C,IAAI,CAGN;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,qBAAqB,CACnC,EAAE,EAAE,YAAY,EAChB,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,OAAO,GAAE,kBAAqC,GAC7C,IAAI,CASN;AAED,wBAAgB,kBAAkB,CAChC,EAAE,EAAE,YAAY,EAChB,KAAK,EAAE,UAAU,EACjB,OAAO,GAAE;IAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,kBAAkB,CAAA;CAAO,GACnF,gBAAgB,GAAG,IAAI,CAqCzB"}
+{"version":3,"file":"row-identity.d.ts","sourceRoot":"","sources":["../../src/store/row-identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8DG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,KAAK,EAAmC,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAKvF,OAAO,EACL,eAAe,EACf,YAAY,EACZ,kBAAkB,EAClB,eAAe,EACf,UAAU,EACX,MAAM,4BAA4B,CAAC;AAGpC,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,kBAAkB,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC;AAE1F,2FAA2F;AAC3F,eAAO,MAAM,cAAc,oBAAoB,CAAC;AAEhD,4DAA4D;AAC5D,eAAO,MAAM,gBAAgB,sBAAsB,CAAC;AAEpD,iEAAiE;AACjE,eAAO,MAAM,oBAAoB,iBAAiB,CAAC;AAEnD,iEAAiE;AACjE,eAAO,MAAM,yBAAyB,sBAAsB,CAAC;AAE7D,yFAAyF;AACzF,eAAO,MAAM,2BAA2B,wBAAwB,CAAC;AAEjE,qEAAqE;AACrE,eAAO,MAAM,yBAAyB,sBAAsB,CAAC;AAE7D,yDAAyD;AACzD,eAAO,MAAM,gBAAgB,2BAA2B,CAAC;AAEzD;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,iBAAiB,CAAC,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAAC;IAC/F,yBAAyB,CAAC,EAAE,EAAE,YAAY,GAAG,IAAI,CAAC;IAClD,0BAA0B,CAAC,EAAE,EAAE,YAAY,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/E,wBAAwB,CACtB,EAAE,EAAE,YAAY,EAChB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,KAAK,CAAC,EAAE,MAAM,GACb,MAAM,CAAC;IACV,kBAAkB,CAAC,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1E;AAID;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,kBAAkB,GAAG,IAAI,CAE5E;AAUD,0DAA0D;AAC1D,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,UAAU,GAAG,IAAI,CAAC;AAEpE;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,SAAS,QAAQ,EAAE,GAAG,MAAM,CA2BnE;AAMD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,QAAQ,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAsB9E;AAWD;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,YAAY,CAC1B,KAAK,EAAE,UAAU,EACjB,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,SAAS,QAAQ,EAAE,EACxB,KAAK,EAAE,QAAQ,EACf,SAAS,GAAE,SAAS,QAAQ,EAAO,EACnC,OAAO,GAAE,SAAS,QAAQ,EAAO,GAChC,MAAM,CAyBR;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,eAAe,CAC7B,KAAK,EAAE,UAAU,EACjB,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,MAAM,GAClB,MAAM,CAaR;AAED,0FAA0F;AAC1F,MAAM,MAAM,aAAa,GAAG,SAAS,GAAG,gBAAgB,CAAC;AAEzD;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAC3B,KAAK,EAAE,UAAU,EACjB,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,SAAS,QAAQ,EAAE,EAC1B,MAAM,GAAE,aAAyB,GAChC,MAAM,CAQR;AAaD;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAElD;AAOD;;;;;;;;;;;;GAYG;AACH,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,QAAQ,EACf,KAAK,EAAE,SAAS,QAAQ,EAAE,GACzB,MAAM,CAOR;AAED,mDAAmD;AACnD,MAAM,MAAM,QAAQ,GAAG,UAAU,GAAG,WAAW,GAAG,SAAS,CAAC;AAE5D;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,MAAM,GAAG,IAAI,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,QAAQ,CAG7E;AAwOD;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,UAAU,GAAG,IAAI,CA0BhF;AAuDD;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,UAAU,GAAG,MAAM,EAAE,CAkCrF;AAED,mEAAmE;AACnE,MAAM,WAAW,mBAAmB;IAClC,sFAAsF;IACtF,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACxD,iFAAiF;IACjF,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACxD,0FAA0F;IAC1F,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACxD;AAED,8BAA8B;AAC9B,MAAM,WAAW,gBAAgB;IAC/B,8BAA8B;IAC9B,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAClD,0DAA0D;IAC1D,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD,4CAA4C;IAC5C,QAAQ,CAAC,aAAa,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACzD,qEAAqE;IACrE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,8EAA8E;IAC9E,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACpD,6BAA6B;IAC7B,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,CAAC;IACvC,gDAAgD;IAChD,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,CAAC;CACjD;AA+DD;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAC3B,EAAE,EAAE,YAAY,EAChB,KAAK,EAAE,UAAU,EACjB,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,kBAAqC,GAC7C,MAAM,CAIR;AA6GD;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,UAAU,GAAG,mBAAmB,CAyC5F;AAED;;;;;;;;;GASG;AACH,wBAAgB,WAAW,CACzB,EAAE,EAAE,YAAY,EAChB,KAAK,EAAE,UAAU,EACjB,OAAO,GAAE,kBAAqC,GAC7C,IAAI,CAAC,gBAAgB,EAAE,QAAQ,GAAG,UAAU,GAAG,QAAQ,CAAC,CA+B1D;AAED;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CAAC,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,UAAU,GAAG,IAAI,CA+B/E;AAED;;;;;;;;;;;GAWG;AACH;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,yBAAyB,CAAC;AAE1D;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,yBAAyB,CAAC;AAE7D;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAC9B,EAAE,EAAE,YAAY,EAChB,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,GACtC,MAAM,GAAG,IAAI,CAoBf;AAED;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,4BAA4B,CAAC;AAEjE,oFAAoF;AACpF,eAAO,MAAM,uBAAuB,wBAAwB,CAAC;AAE7D;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,wBAAwB,CAAC;AAuD7D;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,EAAE,EAAE,YAAY,GAAG,MAAM,EAAE,CA4B/D;AAoBD;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAC/B,EAAE,EAAE,YAAY,EAChB,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,GACtC,MAAM,GAAG,IAAI,CAkDf;AA+FD;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,EAAE,EAAE,YAAY,EAChB,OAAO,GAAE,kBAAqC,GAC7C,IAAI,CAGN;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,EAAE,EAAE,YAAY,GAAG,OAAO,CAE3D;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,qBAAqB,CACnC,EAAE,EAAE,YAAY,EAChB,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,OAAO,GAAE,kBAAqC,GAC7C,IAAI,CASN;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,qBAAqB,CACnC,EAAE,EAAE,YAAY,EAChB,KAAK,EAAE,UAAU,EACjB,OAAO,GAAE,kBAAkB,GAAG,SAA6B,GAC1D,MAAM,EAAE,CAkCV;AAED;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,+BAA+B,CAAC;AAElE,kFAAkF;AAClF,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,CAAC,EAAE,UAAU,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,qFAAqF;IACrF,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC;AA2CD;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CAAC,EAAE,EAAE,YAAY,GAAG,sBAAsB,GAAG,SAAS,CAG/F;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,EAAE,EAAE,YAAY,GAAG,sBAAsB,EAAE,CASrF;AAED;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CAAC,EAAE,EAAE,YAAY,GAAG,MAAM,EAAE,CAkCnE;AAED,wBAAgB,kBAAkB,CAChC,EAAE,EAAE,YAAY,EAChB,KAAK,EAAE,UAAU,EACjB,OAAO,GAAE;IAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,kBAAkB,CAAA;CAAO,GACnF,gBAAgB,GAAG,IAAI,CAqCzB"}

package/dist/store/row-identity.js

@@ -67,6 +67,7 @@ import { getLogger } from '../logger.js';
 import { acTextHash } from '../tasks/ac-table.js';
 import { rowUidFillEnabled } from './row-identity-flag.js';
 import { BIRTH_FP_COLUMN, ROW_IDENTITY, rowIdentityColumns, rowIdentitySpec, UID_COLUMN, } from './row-identity-registry.js';
+import { schemaWritesAllowed } from './worktree-build-guard.js';
 export { BIRTH_FP_COLUMN, ROW_IDENTITY, rowIdentityColumns, rowIdentitySpec, UID_COLUMN };
 /** Domain separator hashed into every deterministic uid. Changing it re-keys every row. */
 export const ROW_UID_DOMAIN = 'cleo/row-uid/v1';
@@ -938,7 +939,49 @@ export function installRowUidTriggers(db, scope) {
  * {@link ROW_IDENTITY_RECIPE_KEY} by the first fill; bumped by any change to a
  * recipe, a frozen content or birth-fact list, or the encoding.
  */
-export const ROW_IDENTITY_RECIPE = 'cleo/row-identity/v1';
+export const ROW_IDENTITY_RECIPE = 'cleo/row-identity/v2';
+/**
+ * The recipe 9.25 shipped (v1). v2 changed only the birth facts of AC history
+ * and evidence bindings (@refFp:ac_uid and ac_text_hash → none / ac_id,
+ * T12802); a store filled
+ * with v1 has those two tables' fingerprints re-derived (see
+ * {@link v1ReleaseBirthFp}).
+ */
+export const ROW_IDENTITY_RECIPE_V1 = 'cleo/row-identity/v1';
+/**
+ * The v1 fingerprint of an AC-history or binding row, to recognise a value
+ * the 9.25 recipe derived: v1 hashed the criterion's fingerprint
+ * (`@refFp:ac_uid`), or `ref:none` / `ref:missing`. Other tables: `null`
+ * (their v1 and v2 recipes are the same).
+ *
+ * @param db - Connection on the project `cleo.db`.
+ * @param table - Declared minted table.
+ * @param row - The stored row.
+ * @returns The v1 value, or `null`.
+ * @task T12802
+ */
+export function v1ReleaseBirthFp(db, table, row) {
+    const col = (c) => row[c] ?? null;
+    const facts = table === 'tasks_task_acceptance_criteria_history'
+        ? [col('ac_id'), col('previous_text'), col('reason')]
+        : table === 'tasks_evidence_ac_bindings'
+            ? [col('evidence_atom_id'), col('binding_type'), col('ac_text_hash')]
+            : [];
+    if (facts.length === 0)
+        return null;
+    const acUid = col('ac_uid');
+    let ref = 'ref:none';
+    if (acUid !== null) {
+        const ac = db
+            .prepare('SELECT birth_fp AS fp FROM main.tasks_task_acceptance_criteria WHERE uid = ?')
+            .get(acUid);
+        ref = ac === undefined ? 'ref:missing' : ac.fp;
+        if (ref === null)
+            return null;
+    }
+    const spec = rowIdentitySpec('project', table);
+    return birthFingerprint(table, spec?.birth ? col(spec.birth) : null, [...facts, ref]);
+}
 /**
  * Local-only key/value table of the row-identity layer. Not
  * `tasks_schema_meta`: the twin collapse drops twin-only keys of that table on
@@ -1124,7 +1167,8 @@ export function preReleaseBirthFp(db, table, row) {
  * Birth fingerprints a pre-release build derived (e.g. a worktree CLI that
  * opened live cleocode, 2026-09-28) are cleared, so the fill re-derives them
  * with the release recipe. Targeted: a value is cleared ONLY when it equals
- * {@link preReleaseBirthFp} of its row; values from any other source (a
+ * {@link preReleaseBirthFp} of its row, or hashes a fingerprint cleared here
+ * (@ownerFp / @refFp; T12801); values from any other source (a
  * device that received them by sync, a store whose meta table was lost) are
  * kept, and alias rows are never touched. The uid recipe did not change, so
  * uids are kept. Runs only while the recipe marker is missing or stale, and
@@ -1135,26 +1179,64 @@ function resetStaleIdentity(db, scope, writers) {
         return 'none';
     if (readMeta(db, ROW_IDENTITY_RECIPE_KEY) === ROW_IDENTITY_RECIPE)
         return 'none';
-    const minted = ROW_IDENTITY.project.filter((spec) => spec.kind === 'minted' &&
-        hasTable(db, spec.table) &&
-        columnsOf(db, spec.table).has(BIRTH_FP_COLUMN));
+    const minted = fingerprintOrder('project', ROW_IDENTITY.project).filter((spec) => hasTable(db, spec.table) && columnsOf(db, spec.table).has(BIRTH_FP_COLUMN));
+    // A value is stale when it equals the pre-release recipe of its row, OR when
+    // it was derived from a stale value: a fingerprint that hashes its owner's
+    // or its criterion's fingerprint (@ownerFp / @refFp) whose source is being
+    // cleared. That covers a criterion whose uid and fingerprint an edit carried
+    // onto a new row (the pre-release recipe cannot be recomputed from the new
+    // row, T12801). Tables are visited owners first.
     const stale = [];
+    const cleared = new Map(); // `${table}.${column}` → cleared values
+    const mark = (table, column, value) => {
+        if (value === null || value === undefined)
+            return;
+        const key = `${table}.${column}`;
+        const set = cleared.get(key) ?? new Set();
+        set.add(String(value));
+        cleared.set(key, set);
+    };
     for (const spec of minted) {
+        const deps = (spec.birthFacts ?? [])
+            .map((fact) => fingerprintRef('project', spec, fact))
+            .filter((d) => d !== null);
+        const keyColumn = targetKey('project', spec.table);
         const rows = db
             .prepare(`SELECT rowid AS _rowid, * FROM main.${q(spec.table)} WHERE ${q(BIRTH_FP_COLUMN)} IS NOT NULL`)
             .all();
         for (const row of rows) {
-            if (row[BIRTH_FP_COLUMN] === preReleaseBirthFp(db, spec.table, row)) {
+            const derivedFromStale = deps.some((d) => cleared.get(`${d.table}.${d.key}`)?.has(String(row[d.column] ?? '')));
+            // Three sources of a stale value, all kept (T12801 x T12802): derived
+            // from a value cleared in this pass, the pre-release recipe, or the
+            // 9.25 (v1) recipe.
+            if (derivedFromStale ||
+                row[BIRTH_FP_COLUMN] === preReleaseBirthFp(db, spec.table, row) ||
+                row[BIRTH_FP_COLUMN] === v1ReleaseBirthFp(db, spec.table, row)) {
                 stale.push({ table: spec.table, rowid: row._rowid });
+                mark(spec.table, keyColumn, row[keyColumn]);
+                mark(spec.table, UID_COLUMN, row[UID_COLUMN]);
             }
         }
     }
-    if (stale.length === 0)
+    // The AC uid graveyard records deletions made while the recipe marker was
+    // missing or stale: with the fill off, the schema heal (T12878) restores
+    // its trigger, which then records the stale pre-release uid and birth_fp of
+    // every criterion deleted since. Relinking those would carry a stale
+    // fingerprint into the release recipe and, through the ordinal fallback,
+    // hand a deleted criterion's uid to an unrelated new one. They are not an
+    // older build's delete-and-recreate of one edit, so they are dropped in
+    // this same step, before the fill relinks anything (T12878 review F1).
+    const graveyardRows = scope === 'project' && hasTable(db, AC_UID_GRAVEYARD)
+        ? db.prepare(`SELECT count(*) AS n FROM main.${AC_UID_GRAVEYARD}`).get().n
+        : 0;
+    if (stale.length === 0 && graveyardRows === 0)
         return 'none';
     if (readMeta(db, ROW_IDENTITY_SYNCED_KEY) !== undefined)
         return 'refused';
     db.exec('SAVEPOINT row_identity_reset');
     try {
+        if (graveyardRows > 0)
+            writers.clearAcUidGraveyardNative(db);
         for (const { table, rowid } of stale) {
             writers.clearBirthFpNative(db, table, rowid);
         }
@@ -1179,6 +1261,18 @@ export function writeRecipeMarker(db, writers = requireWriters()) {
         return;
     writers.writeRowIdentityMetaNative(db, ROW_IDENTITY_RECIPE_KEY, ROW_IDENTITY_RECIPE);
 }
+/**
+ * Whether the store's identity values are shared with other devices
+ * ({@link ROW_IDENTITY_SYNCED_KEY} present): from then on no local write may
+ * clear or re-point a uid.
+ *
+ * @param db - Connection on the project `cleo.db`.
+ * @returns True once identity has been sent or received.
+ * @task T12806
+ */
+export function rowIdentityShared(db) {
+    return readMeta(db, ROW_IDENTITY_SYNCED_KEY) !== undefined;
+}
 /**
  * Record that identity values are now SHARED with other devices: the recipe
  * marker, and {@link ROW_IDENTITY_SYNCED_KEY} (first write wins, with the
@@ -1200,6 +1294,181 @@ export function markRowIdentityShared(db, direction, writers = requireWriters())
         return;
     writers.writeRowIdentityMetaNative(db, ROW_IDENTITY_SYNCED_KEY, JSON.stringify({ first: direction, at: new Date().toISOString() }));
 }
+/**
+ * Re-create the row-identity SCHEMA a store should have, on every open,
+ * whatever the fill flag (T12878). DDL only: the identity tables, the
+ * graveyard trigger, the columns an early table lacks, the uid columns and
+ * their indexes. No row value is read or written. A store whose uid migration
+ * was journaled without running its statements (journal Scenario 3 Case A:
+ * live cleocode under 9.25, spec §12.2) gets the full schema here; the fill,
+ * refill and TEMP triggers stay opt-in ({@link prepareRowIdentity}).
+ *
+ * Never throws: a failure is logged and the open continues.
+ *
+ * @param db - Connection on a `cleo.db`, inside the cold-open lease.
+ * @param scope - The store's scope.
+ * @returns The DDL statements it ran (empty when the schema was complete).
+ * @task T12878
+ */
+export function healRowIdentitySchema(db, scope, writers = registeredWriters) {
+    const log = getLogger('row-identity');
+    if (ROW_IDENTITY[scope].length === 0) {
+        // Nothing is declared in this scope yet (the global store today): there is
+        // no identity schema to heal, so nothing to record either.
+        return [];
+    }
+    // A build that may not change this store's schema (a worktree-built CLI on a
+    // live store, T12687) never heals it: the released build will.
+    if (!schemaWritesAllowed(db)) {
+        log.debug({ scope }, 'row identity schema heal skipped: schema writes refused for this build');
+        return [];
+    }
+    try {
+        db.exec('SAVEPOINT row_identity_heal');
+        try {
+            const healed = [
+                ...(scope === 'project' ? ensureIdentityTables(db) : []),
+                ...ensureRowIdentitySchema(db, scope),
+            ];
+            if (healed.length > 0)
+                recordHealReceipt(db, scope, healed, writers);
+            db.exec('RELEASE SAVEPOINT row_identity_heal');
+            if (healed.length > 0)
+                log.info({ scope, healed: healed.length }, 'row identity schema healed');
+            return healed;
+        }
+        catch (error) {
+            db.exec('ROLLBACK TO SAVEPOINT row_identity_heal');
+            db.exec('RELEASE SAVEPOINT row_identity_heal');
+            throw error;
+        }
+    }
+    catch (error) {
+        log.error({ scope, error }, 'row identity schema heal failed');
+        return [];
+    }
+}
+/**
+ * Meta key of the heal receipt: when the open last re-created missing
+ * identity schema, and what (T12878). Local-only bookkeeping of the heal
+ * itself, in `tasks_row_identity_meta`; no row value of any other table is
+ * written. `cleo doctor` (the `row_identity` check) shows it.
+ */
+export const ROW_IDENTITY_HEAL_KEY = 'row_identity_schema_healed';
+/** The table holding each scope's heal receipts (`null`: the scope has none yet). */
+const HEAL_RECEIPT_TABLE = {
+    project: ROW_IDENTITY_META_TABLE,
+    // The global store declares no identity table yet (ROW_IDENTITY.global is
+    // empty, so its heal never runs); the change that declares one adds its
+    // meta table here.
+    global: null,
+};
+/** How many heal receipts a store keeps (newest last). */
+const HEAL_RECEIPTS_KEPT = 20;
+function recordHealReceipt(db, scope, healed, writers) {
+    const table = HEAL_RECEIPT_TABLE[scope];
+    const log = getLogger('row-identity');
+    if (table === null || !hasTable(db, table) || !writers) {
+        log.warn({ scope, healed: healed.length }, 'row identity schema healed; no receipt table');
+        return;
+    }
+    const objects = healed.map((stmt) => {
+        const col = /ALTER TABLE main\.("?)(\w+)\1 ADD COLUMN ("?)(\w+)\3/.exec(stmt);
+        if (col)
+            return `${col[2]}.${col[4]}`;
+        const obj = /(TABLE|INDEX|TRIGGER) IF NOT EXISTS main\.("?)(\w+)\2/.exec(stmt);
+        return obj ? `${obj[1].toLowerCase()} ${obj[3]}` : stmt.slice(0, 60);
+    });
+    const receipt = {
+        at: new Date().toISOString(),
+        scope,
+        statements: healed.length,
+        objects,
+    };
+    // Appended, never overwritten: a later partial heal keeps the earlier ones.
+    const history = [...readRowIdentityHealHistory(db), receipt].slice(-HEAL_RECEIPTS_KEPT);
+    writers.writeRowIdentityMetaNative(db, ROW_IDENTITY_HEAL_KEY, JSON.stringify(history));
+}
+/**
+ * The last heal receipt of a store, read-only (`undefined` when the schema
+ * never needed healing).
+ *
+ * @param db - Connection on a project `cleo.db` (read-only is fine).
+ * @returns The receipt.
+ * @task T12878
+ */
+export function readRowIdentityHealReceipt(db) {
+    const history = readRowIdentityHealHistory(db);
+    return history[history.length - 1];
+}
+/**
+ * Every heal receipt a store kept, oldest first (read-only).
+ *
+ * @param db - Connection on a project `cleo.db` (read-only is fine).
+ * @returns The receipts (empty when the schema never needed healing).
+ * @task T12878
+ */
+export function readRowIdentityHealHistory(db) {
+    const raw = readMeta(db, ROW_IDENTITY_HEAL_KEY);
+    if (raw === undefined)
+        return [];
+    try {
+        const parsed = JSON.parse(raw);
+        return Array.isArray(parsed) ? parsed : [parsed];
+    }
+    catch {
+        return [];
+    }
+}
+/**
+ * Identity schema a project store lacks, read-only: missing identity tables,
+ * the graveyard trigger, and the alias / graveyard columns an early table
+ * lacks (T12878; the open heals them).
+ *
+ * @param db - Connection on a project `cleo.db` (read-only is fine).
+ * @returns What is missing (empty when complete).
+ * @task T12878
+ */
+export function missingRowIdentitySchema(db) {
+    if (!hasTable(db, 'tasks_task_acceptance_criteria'))
+        return [];
+    const missing = [];
+    for (const table of Object.keys(IDENTITY_TABLE_DDL)) {
+        if (!hasTable(db, table))
+            missing.push(`table ${table}`);
+    }
+    for (const [table, column] of [
+        ['tasks_display_id_aliases', 'displaced_hlc'],
+        ['tasks_display_id_aliases', 'entity_birth_fp'],
+        [AC_UID_GRAVEYARD, 'birth_fp'],
+    ]) {
+        if (hasTable(db, table) && !columnsOf(db, table).has(column)) {
+            missing.push(`column ${table}.${column}`);
+        }
+    }
+    if (!hasObject(db, 'trigger', 'trg_tasks_ac_uid_graveyard')) {
+        missing.push('trigger trg_tasks_ac_uid_graveyard');
+    }
+    // The uid columns and indexes ensureRowIdentitySchema heals.
+    for (const spec of ROW_IDENTITY.project) {
+        if (!hasTable(db, spec.table))
+            continue;
+        const cols = columnsOf(db, spec.table);
+        for (const column of rowIdentityColumns('project', spec.table)) {
+            if (!cols.has(column))
+                missing.push(`column ${spec.table}.${column}`);
+        }
+        if (!uidIsPrimaryKey(db, spec.table) && !hasObject(db, 'index', `uq_${spec.table}_uid`)) {
+            missing.push(`index uq_${spec.table}_uid`);
+        }
+        for (const ref of spec.storedRefUids ?? []) {
+            const index = `idx_${spec.table}_${ref.column}`;
+            if (!hasObject(db, 'index', index))
+                missing.push(`index ${index}`);
+        }
+    }
+    return missing;
+}
 export function prepareRowIdentity(db, scope, options = {}) {
     if (ROW_IDENTITY[scope].length === 0)
         return null;