@gobing-ai/spur 0.3.73 → 0.3.74

package/spur.js

@@ -50296,6 +50296,7 @@ var init_models = __esm(() => {
     "gemini-3-flash-preview": { inputPricePer1M: 0.15, outputPricePer1M: 0.6 },
     "gemini-3-flash": { inputPricePer1M: 0.15, outputPricePer1M: 0.6 },
     "gemini-2.0-flash": { inputPricePer1M: 0.1, outputPricePer1M: 0.4 },
+    "gpt-6-astra": { inputPricePer1M: 2.5, outputPricePer1M: 10 },
     "gpt-4o": { inputPricePer1M: 2.5, outputPricePer1M: 10 },
     "gpt-4o-mini": { inputPricePer1M: 0.15, outputPricePer1M: 0.6 },
     "gpt-4-turbo": { inputPricePer1M: 10, outputPricePer1M: 30 },
@@ -50754,9 +50755,6 @@ var init_watermark = __esm(() => {
 });
 
 // ../../packages/domain/src/analytics/forensic-query.ts
-function withMessageDedup(where) {
-  return where === "" ? `WHERE ${MESSAGE_DEDUP}` : `${where} AND ${MESSAGE_DEDUP}`;
-}
 function escapeLike(value) {
   return value.replaceAll("!", "!!").replaceAll("%", "!%").replaceAll("_", "!_");
 }
@@ -50848,7 +50846,7 @@ async function messageRollup(db2, sel, opts) {
   const { where, params } = buildMessageWhere(sel);
   const wm = applyWatermarkToWhere(where, opts?.watermark);
   return db2.queryAll(`WITH filtered AS (
-             SELECT m.source, m.model, m.ts, m.input_tokens, m.output_tokens,
+             SELECT m.source, m.session_id, m.model, m.ts, m.input_tokens, m.output_tokens,
                     m.cache_read_tokens, m.cache_write_tokens, m.cost_usd, m.role, m.duration_ms,
                     ROW_NUMBER() OVER (PARTITION BY m.request_id ORDER BY m.rowid DESC) AS rn,
                     m.request_id
@@ -50856,7 +50854,17 @@ async function messageRollup(db2, sel, opts) {
              ${wm.where}
          ),
          selected AS (
-             SELECT * FROM filtered WHERE request_id IS NULL OR rn = 1
+             SELECT source,
+                    COALESCE(
+                        NULLIF(NULLIF(model, ''), 'unknown'),
+                        MAX(CASE WHEN model IS NOT NULL AND model != '' AND model != 'unknown' THEN model END)
+                            OVER (PARTITION BY source, session_id),
+                        NULLIF(model, ''),
+                        'unknown'
+                    ) AS model,
+                    ts, input_tokens, output_tokens, cache_read_tokens, cache_write_tokens,
+                    cost_usd, role, duration_ms
+             FROM filtered WHERE request_id IS NULL OR rn = 1
          )
          SELECT source, model, DATE(ts) AS day,
                 COUNT(*) AS messages,
@@ -50876,7 +50884,15 @@ async function toolRollup(db2, sel, opts) {
   const { where, params } = buildMessageWhere(sel);
   const wm = applyWatermarkToWhere(where, opts?.watermark);
   return db2.queryAll(`WITH filtered_messages AS (
-             SELECT m.record_hash, m.source, m.model, m.ts
+             SELECT m.record_hash, m.source, m.session_id,
+                    COALESCE(
+                        NULLIF(NULLIF(m.model, ''), 'unknown'),
+                        MAX(CASE WHEN m.model IS NOT NULL AND m.model != '' AND m.model != 'unknown' THEN m.model END)
+                            OVER (PARTITION BY m.source, m.session_id),
+                        NULLIF(m.model, ''),
+                        'unknown'
+                    ) AS model,
+                    m.ts
              FROM history_message m
              ${wm.where}
          )
@@ -51243,6 +51259,8 @@ async function loops(db2, sel, opts) {
          ORDER BY repeats DESC`, ...params, ...wm.params);
 }
 async function loopRepeatedCallsQuery(db2, params) {
+  const argsDigestSql = params.argsDigest !== null && params.argsDigest !== "" ? "tc.args_digest = ?" : "(tc.args_digest IS NULL OR tc.args_digest = '')";
+  const argsDigestParam = params.argsDigest !== null && params.argsDigest !== "" ? [params.argsDigest] : [];
   return db2.queryAll(`SELECT tc.seq AS toolSeq,
                 COALESCE(tc.started_at, m.ts) AS ts,
                 tc.tool_name AS toolName,
@@ -51256,17 +51274,17 @@ async function loopRepeatedCallsQuery(db2, params) {
                 tc.message_hash AS messageHash,
                 tc.session_id AS sessionId,
                 tc.source AS source,
-                m.model AS model,
-                (SELECT COUNT(*) FROM history_tool_call l WHERE l.message_hash = m.record_hash) AS links,
+                COALESCE(NULLIF(NULLIF(m.model, ''), 'unknown'), ?) AS model,
+                1 AS links,
                 m.input_tokens AS inputTokens,
                 m.cache_read_tokens AS cacheReadTokens,
                 m.output_tokens AS outputTokens
          FROM history_tool_call tc
          JOIN history_message m ON m.record_hash = tc.message_hash
          WHERE tc.source = ? AND tc.session_id = ? AND tc.tool_name = ?
-           AND (tc.args_digest = ? OR (tc.args_digest IS NULL AND ? = ''))
+           AND ${argsDigestSql}
          ORDER BY tc.seq ASC
-         LIMIT ?`, params.source, params.sessionId, params.toolName, params.argsDigest ?? "", params.argsDigest ?? "", params.limit ?? 50);
+         LIMIT ?`, params.model ?? null, params.source, params.sessionId, params.toolName, ...argsDigestParam, params.limit ?? 50);
 }
 async function drift(db2, sel, opts) {
   const { where, params } = buildMessageWhere(sel);
@@ -51338,7 +51356,17 @@ async function topStepsByTokens(db2, sel, top, opts) {
   const tokensOrder = rankOrderExpr(sel, "COALESCE(m.input_tokens, 0) + COALESCE(m.cache_read_tokens, 0)");
   const tokensGuard = rankOrderExpr(sel, "(m.input_tokens IS NOT NULL OR m.output_tokens IS NOT NULL)");
   const tokensPredicate = withStepPredicates(wm.where, `m.role = 'assistant' AND ${tokensGuard}`);
-  return db2.queryAll(`SELECT m.session_id AS sessionId, m.source AS source, m.ts AS ts, m.model AS model,
+  return db2.queryAll(`SELECT m.session_id AS sessionId, m.source AS source, m.ts AS ts,
+                CASE
+                    WHEN m.model IS NOT NULL AND m.model != '' AND m.model != 'unknown' THEN m.model
+                    WHEN m.session_id IS NOT NULL AND m.session_id NOT IN ('', 'unknown', 'session') THEN (
+                        SELECT m2.model FROM history_message m2
+                        WHERE m2.source = m.source AND m2.session_id = m.session_id
+                          AND m2.model IS NOT NULL AND m2.model != '' AND m2.model != 'unknown'
+                        LIMIT 1
+                    )
+                    ELSE 'unknown'
+                END AS model,
                 m.input_tokens AS inputTokens, m.cache_read_tokens AS cacheReadTokens,
                 m.output_tokens AS outputTokens, m.cost_usd AS costUsd, m.duration_ms AS durationMs
          FROM history_message m
@@ -51351,7 +51379,17 @@ async function topStepsByDuration(db2, sel, top, opts) {
   const wm = applyWatermarkToWhere(where, opts?.watermark);
   const durationOrder = rankOrderExpr(sel, "m.duration_ms");
   const durationPredicate = withStepPredicates(wm.where, `m.role = 'assistant' AND ${durationOrder} IS NOT NULL`);
-  return db2.queryAll(`SELECT m.session_id AS sessionId, m.source AS source, m.ts AS ts, m.model AS model,
+  return db2.queryAll(`SELECT m.session_id AS sessionId, m.source AS source, m.ts AS ts,
+                CASE
+                    WHEN m.model IS NOT NULL AND m.model != '' AND m.model != 'unknown' THEN m.model
+                    WHEN m.session_id IS NOT NULL AND m.session_id NOT IN ('', 'unknown', 'session') THEN (
+                        SELECT m2.model FROM history_message m2
+                        WHERE m2.source = m.source AND m2.session_id = m.session_id
+                          AND m2.model IS NOT NULL AND m2.model != '' AND m2.model != 'unknown'
+                        LIMIT 1
+                    )
+                    ELSE 'unknown'
+                END AS model,
                 m.input_tokens AS inputTokens, m.cache_read_tokens AS cacheReadTokens,
                 m.output_tokens AS outputTokens, m.cost_usd AS costUsd, m.duration_ms AS durationMs
          FROM history_message m
@@ -51374,7 +51412,17 @@ async function topCacheWasteSteps(db2, sel, top, opts) {
   const wm = applyWatermarkToWhere(where, opts?.watermark);
   const inputOrder = rankOrderExpr(sel, "m.input_tokens");
   const wastePredicate2 = withStepPredicates(wm.where, `m.role = 'assistant' AND ${inputOrder} > ? AND m.cache_read_tokens < m.input_tokens * ?`);
-  return db2.queryAll(`SELECT m.session_id AS sessionId, m.source AS source, m.ts AS ts, m.model AS model,
+  return db2.queryAll(`SELECT m.session_id AS sessionId, m.source AS source, m.ts AS ts,
+                CASE
+                    WHEN m.model IS NOT NULL AND m.model != '' AND m.model != 'unknown' THEN m.model
+                    WHEN m.session_id IS NOT NULL AND m.session_id NOT IN ('', 'unknown', 'session') THEN (
+                        SELECT m2.model FROM history_message m2
+                        WHERE m2.source = m.source AND m2.session_id = m.session_id
+                          AND m2.model IS NOT NULL AND m2.model != '' AND m2.model != 'unknown'
+                        LIMIT 1
+                    )
+                    ELSE 'unknown'
+                END AS model,
                 m.input_tokens AS inputTokens, m.cache_read_tokens AS cacheReadTokens,
                 m.output_tokens AS outputTokens, m.cost_usd AS costUsd, m.duration_ms AS durationMs
          FROM history_message m
@@ -51563,29 +51611,123 @@ function finalizeSessionDurations(events) {
     }
   }
 }
-async function queryTimelineEvents(db2, whereClause, params, subWhereClause, subParams, limit, correlationMap) {
+async function queryTimelineEvents(db2, whereClause, params, _subWhereClause, _subParams, limit, correlationMap) {
   const fetchLimit = limit + 1;
   const mainCondition = whereClause.startsWith("WHERE ") ? whereClause.slice(6) : whereClause;
-  const subCondition = subWhereClause.startsWith("WHERE ") ? subWhereClause.slice(6) : subWhereClause;
-  const dedupSubWhere = subCondition ? `WHERE ${subCondition} AND ` : "WHERE ";
-  const fullWhere = mainCondition ? `WHERE ${mainCondition} AND (m.request_id IS NULL OR m.rowid IN (SELECT MIN(dm.rowid) FROM history_message dm ${dedupSubWhere}dm.request_id IS NOT NULL GROUP BY dm.request_id))` : `WHERE (m.request_id IS NULL OR m.rowid IN (SELECT MIN(dm.rowid) FROM history_message dm ${dedupSubWhere}dm.request_id IS NOT NULL GROUP BY dm.request_id))`;
-  const rows = await db2.queryAll(`SELECT m.record_hash AS messageHash, m.seq AS messageSeq,
+  const dedupCondition = `(m.request_id IS NULL OR NOT EXISTS (
+        SELECT 1 FROM history_message dm
+        WHERE dm.request_id = m.request_id AND dm.rowid < m.rowid
+    ))`;
+  const fullWhere = mainCondition ? `WHERE ${mainCondition} AND ${dedupCondition}` : `WHERE ${dedupCondition}`;
+  const msgRows = await db2.queryAll(`SELECT m.record_hash AS messageHash, m.seq AS messageSeq,
                 COALESCE(m.turn_index, m.seq) AS turnIndex,
                 m.ts AS messageTs, m.role AS messageRole, COALESCE(m.record_type, m.role) AS recordType,
                 m.source, m.session_id AS sessionId, m.model,
                 m.duration_ms AS messageDurationMs, m.input_tokens AS inputTokens,
                 m.cache_read_tokens AS cacheReadTokens, m.output_tokens AS outputTokens,
-                m.content_text AS messagePayload,
-                (SELECT COUNT(*) FROM history_tool_call links WHERE links.message_hash = m.record_hash) AS links,
-                tc.tool_name AS toolName, COALESCE(tc.started_at, m.ts) AS toolTs,
-                tc.duration_ms AS toolDurationMs, tc.status AS toolStatus,
-                tc.args_raw AS toolArgsRaw, tc.args_digest AS toolArgsDigest, tc.error_text AS toolErrorText,
-                COALESCE(tc.seq, 0) AS toolSeq, m.rowid AS messageRowId
+                m.content_text AS messagePayload, m.rowid AS messageRowId
          FROM history_message m
-         LEFT JOIN history_tool_call tc ON tc.message_hash = m.record_hash
          ${fullWhere}
-         ORDER BY COALESCE(m.ts, '0000-00-00') DESC, m.rowid DESC, COALESCE(tc.seq, 0) DESC
-         LIMIT ?`, ...params, ...subParams, fetchLimit);
+         ORDER BY m.ts DESC NULLS LAST, m.rowid DESC
+         LIMIT ?`, ...params, fetchLimit);
+  const msgHashes = msgRows.map((r) => r.messageHash);
+  const tcMap = new Map;
+  if (msgHashes.length > 0) {
+    const inPlaceholders = msgHashes.map(() => "?").join(", ");
+    const tcRows = await db2.queryAll(`SELECT tc.message_hash AS messageHash,
+                    tc.tool_name AS toolName, COALESCE(tc.started_at, m.ts) AS toolTs,
+                    tc.duration_ms AS toolDurationMs, tc.status AS toolStatus,
+                    tc.args_raw AS toolArgsRaw, tc.args_digest AS toolArgsDigest, tc.error_text AS toolErrorText,
+                    COALESCE(tc.seq, 0) AS toolSeq
+             FROM history_tool_call tc
+             JOIN history_message m ON m.record_hash = tc.message_hash
+             WHERE tc.message_hash IN (${inPlaceholders})
+             ORDER BY tc.message_hash, COALESCE(tc.seq, 0)
+             LIMIT ?`, ...msgHashes, fetchLimit * 50);
+    for (const tc of tcRows) {
+      let list = tcMap.get(tc.messageHash);
+      if (list === undefined) {
+        list = [];
+        tcMap.set(tc.messageHash, list);
+      }
+      list.push(tc);
+    }
+  }
+  const sessionModelMap = new Map;
+  for (const row of msgRows) {
+    if (row.model && row.model !== "" && row.model !== "unknown") {
+      const key = `${row.source}:::${row.sessionId}`;
+      if (!sessionModelMap.has(key))
+        sessionModelMap.set(key, row.model);
+    }
+  }
+  for (const row of msgRows) {
+    if (!row.model || row.model === "" || row.model === "unknown") {
+      const key = `${row.source}:::${row.sessionId}`;
+      const resolved = sessionModelMap.get(key);
+      if (resolved)
+        row.model = resolved;
+    }
+  }
+  const rows = [];
+  for (const m of msgRows) {
+    const tcs = tcMap.get(m.messageHash) ?? [];
+    const links = tcs.length;
+    rows.push({
+      messageHash: m.messageHash,
+      messageSeq: m.messageSeq,
+      turnIndex: m.turnIndex,
+      messageTs: m.messageTs,
+      messageRole: m.messageRole,
+      recordType: m.recordType,
+      source: m.source,
+      sessionId: m.sessionId,
+      model: m.model,
+      messageDurationMs: m.messageDurationMs,
+      inputTokens: m.inputTokens,
+      cacheReadTokens: m.cacheReadTokens,
+      outputTokens: m.outputTokens,
+      messagePayload: m.messagePayload,
+      links,
+      toolName: null,
+      toolTs: null,
+      toolDurationMs: null,
+      toolStatus: null,
+      toolArgsRaw: null,
+      toolArgsDigest: null,
+      toolErrorText: null,
+      toolSeq: 0,
+      messageRowId: m.messageRowId
+    });
+    for (const tc of tcs) {
+      rows.push({
+        messageHash: m.messageHash,
+        messageSeq: m.messageSeq,
+        turnIndex: m.turnIndex,
+        messageTs: m.messageTs,
+        messageRole: m.messageRole,
+        recordType: m.recordType,
+        source: m.source,
+        sessionId: m.sessionId,
+        model: m.model,
+        messageDurationMs: m.messageDurationMs,
+        inputTokens: m.inputTokens,
+        cacheReadTokens: m.cacheReadTokens,
+        outputTokens: m.outputTokens,
+        messagePayload: m.messagePayload,
+        links,
+        toolName: tc.toolName,
+        toolTs: tc.toolTs,
+        toolDurationMs: tc.toolDurationMs,
+        toolStatus: tc.toolStatus,
+        toolArgsRaw: tc.toolArgsRaw,
+        toolArgsDigest: tc.toolArgsDigest,
+        toolErrorText: tc.toolErrorText,
+        toolSeq: tc.toolSeq,
+        messageRowId: m.messageRowId
+      });
+    }
+  }
   const rawEvents = [];
   let previousMessage = "";
   for (const row of rows) {
@@ -51904,37 +52046,45 @@ async function historyKpiTrend(db2, sel, opts) {
 }
 async function toolSequenceQuery(db2, scope, filters = {}, limit = 5000) {
   const fetchLimit = limit + 1;
-  const params = [];
-  const clauses = [];
+  const msgCteParams = [];
+  const tcFilterParams = [];
+  let msgCteWhere;
   if (scope.mode === "session") {
-    clauses.push("tc.source = ? AND tc.session_id = ?");
-    params.push(scope.source, scope.sessionId);
+    msgCteWhere = `WHERE m.source = ? AND m.session_id = ? AND ${MESSAGE_DEDUP}`;
+    msgCteParams.push(scope.source, scope.sessionId);
   } else {
-    const { where, params: selParams } = buildMessageWhere(scope.sel, "m");
-    if (where !== "") {
-      clauses.push(where.startsWith("WHERE ") ? where.slice(6) : where);
-      params.push(...selParams);
-    }
+    const { where: mw, params: mp } = buildMessageWhere(scope.sel, "m");
+    const msgCondition = mw.startsWith("WHERE ") ? mw.slice(6) : mw;
+    msgCteWhere = msgCondition ? `WHERE ${msgCondition} AND ${MESSAGE_DEDUP}` : `WHERE ${MESSAGE_DEDUP}`;
+    msgCteParams.push(...mp);
+  }
+  const tcFilterClauses = [];
+  if (scope.mode === "session") {
+    tcFilterClauses.push("tc.source = ? AND tc.session_id = ?");
+    tcFilterParams.push(scope.source, scope.sessionId);
   }
   if (filters.toolNames && filters.toolNames.length > 0) {
     const placeholders = filters.toolNames.map(() => "?").join(", ");
-    clauses.push(toolSelectionSql("tc", placeholders));
-    params.push(...filters.toolNames, ...filters.toolNames);
+    tcFilterClauses.push(toolSelectionSql("tc", placeholders));
+    tcFilterParams.push(...filters.toolNames, ...filters.toolNames);
   }
   if (filters.status && filters.status !== "all") {
-    clauses.push("tc.status = ?");
-    params.push(filters.status);
+    tcFilterClauses.push("tc.status = ?");
+    tcFilterParams.push(filters.status);
   }
   if (filters.search && filters.search.trim().length > 0) {
     const searchPattern = `%${escapeLike(filters.search.trim())}%`;
-    clauses.push("(tc.args_raw LIKE ? ESCAPE '!' OR tc.error_text LIKE ? ESCAPE '!' OR tc.effective_tool_name LIKE ? ESCAPE '!' OR tc.tool_name LIKE ? ESCAPE '!')");
-    params.push(searchPattern, searchPattern, searchPattern, searchPattern);
+    tcFilterClauses.push("(tc.args_raw LIKE ? ESCAPE '!' OR tc.error_text LIKE ? ESCAPE '!' OR tc.effective_tool_name LIKE ? ESCAPE '!' OR tc.tool_name LIKE ? ESCAPE '!')");
+    tcFilterParams.push(searchPattern, searchPattern, searchPattern, searchPattern);
   }
-  const whereCombined = clauses.length > 0 ? `WHERE ${clauses.join(" AND ")}` : "";
-  const folded = withMessageDedup(whereCombined);
-  params.push(fetchLimit);
-  const rows = await db2.queryAll(`SELECT tc.seq AS toolSeq,
-                COALESCE(tc.started_at, m.ts) AS ts,
+  const tcWhere = tcFilterClauses.length > 0 ? `AND ${tcFilterClauses.join(" AND ")}` : "";
+  const rows = await db2.queryAll(`WITH deduped_messages AS (
+             SELECT record_hash, session_id, source, model, input_tokens, cache_read_tokens, output_tokens, ts
+             FROM history_message m
+             ${msgCteWhere}
+         )
+         SELECT tc.seq AS toolSeq,
+                COALESCE(tc.started_at, dm.ts) AS ts,
                 tc.tool_name AS toolName,
                 tc.effective_tool_name AS effectiveToolName,
                 tc.status AS status,
@@ -51947,16 +52097,67 @@ async function toolSequenceQuery(db2, scope, filters = {}, limit = 5000) {
                 tc.message_hash AS messageHash,
                 tc.session_id AS sessionId,
                 tc.source AS source,
-                m.model AS model,
-                (SELECT COUNT(*) FROM history_tool_call l WHERE l.message_hash = m.record_hash) AS links,
-                m.input_tokens AS inputTokens,
-                m.cache_read_tokens AS cacheReadTokens,
-                m.output_tokens AS outputTokens
-         FROM history_tool_call tc
-         JOIN history_message m ON m.record_hash = tc.message_hash
-         ${folded}
-         ORDER BY COALESCE(tc.started_at, m.ts), tc.source, tc.session_id, tc.seq
-         LIMIT ?`, ...params);
+                dm.model,
+                0 AS links,
+                dm.input_tokens AS inputTokens,
+                dm.cache_read_tokens AS cacheReadTokens,
+                dm.output_tokens AS outputTokens
+         FROM deduped_messages dm
+         CROSS JOIN history_tool_call tc ON tc.message_hash = dm.record_hash
+         ${tcWhere}
+         ORDER BY COALESCE(tc.started_at, dm.ts), tc.source, tc.session_id, tc.seq
+         LIMIT ?`, ...msgCteParams, ...tcFilterParams, fetchLimit);
+  const msgHashCount = new Map;
+  for (const row of rows) {
+    msgHashCount.set(row.messageHash, (msgHashCount.get(row.messageHash) ?? 0) + 1);
+  }
+  for (const row of rows) {
+    row.links = msgHashCount.get(row.messageHash) ?? 1;
+  }
+  const tsqModelMap = new Map;
+  for (const row of rows) {
+    if (row.model && row.model !== "" && row.model !== "unknown") {
+      const key = `${row.source}:::${row.sessionId}`;
+      if (!tsqModelMap.has(key))
+        tsqModelMap.set(key, row.model);
+    }
+  }
+  const missingKeys = new Set;
+  for (const row of rows) {
+    if (!row.model || row.model === "" || row.model === "unknown") {
+      const key = `${row.source}:::${row.sessionId}`;
+      if (!tsqModelMap.has(key))
+        missingKeys.add(key);
+    }
+  }
+  if (missingKeys.size > 0) {
+    const pairs = [...missingKeys].map((k) => {
+      const [src, sid] = k.split(":::");
+      return { src, sid };
+    });
+    const placeholders = pairs.map(() => "(?, ?)").join(", ");
+    const batchParams = [];
+    for (const { src, sid } of pairs) {
+      batchParams.push(src, sid);
+    }
+    const modelRows = await db2.queryAll(`SELECT source, session_id, model
+             FROM history_message
+             WHERE (source, session_id) IN (${placeholders})
+               AND model IS NOT NULL AND model != '' AND model != 'unknown'
+             GROUP BY source, session_id
+             LIMIT ?`, ...batchParams, pairs.length);
+    for (const mr of modelRows) {
+      tsqModelMap.set(`${mr.source}:::${mr.session_id}`, mr.model);
+    }
+  }
+  for (const row of rows) {
+    if (!row.model || row.model === "" || row.model === "unknown") {
+      const key = `${row.source}:::${row.sessionId}`;
+      const resolved = tsqModelMap.get(key);
+      if (resolved)
+        row.model = resolved;
+    }
+  }
   const truncated = rows.length > limit;
   const finalRows = truncated ? rows.slice(0, limit) : rows;
   return {
@@ -52470,7 +52671,7 @@ async function rollupTableFreshness(db2) {
   }
   return result;
 }
-var ROLLUP_DEFINITION_VERSION = "v4", EMPTY_ROLLUP_WATERMARK, BUCKETED_ROLLUP_TABLES, KEYED_ROLLUP_TABLES, GLOBAL_RANKED_ROLLUP_TABLES, ALL_ROLLUP_TABLES, MSG_BUCKET_5M = `strftime('%Y-%m-%dT%H:%M:00Z', CAST(strftime('%s', m.ts) / 60 * 60 AS INTEGER), 'unixepoch')`, SKILL_BUCKET_5M = `strftime('%Y-%m-%dT%H:%M:00Z', CAST(strftime('%s', sc.started_at) / 60 * 60 AS INTEGER), 'unixepoch')`, MSG_DAY;
+var ROLLUP_DEFINITION_VERSION = "v5", EMPTY_ROLLUP_WATERMARK, BUCKETED_ROLLUP_TABLES, KEYED_ROLLUP_TABLES, GLOBAL_RANKED_ROLLUP_TABLES, ALL_ROLLUP_TABLES, MSG_BUCKET_5M = `strftime('%Y-%m-%dT%H:%M:00Z', CAST(strftime('%s', m.ts) / 60 * 60 AS INTEGER), 'unixepoch')`, SKILL_BUCKET_5M = `strftime('%Y-%m-%dT%H:%M:00Z', CAST(strftime('%s', sc.started_at) / 60 * 60 AS INTEGER), 'unixepoch')`, MSG_DAY;
 var init_rollup_watermark = __esm(() => {
   EMPTY_ROLLUP_WATERMARK = {
     importedAtWatermark: "",
@@ -52510,6 +52711,11 @@ async function historyBoardHistoryVersion(db2) {
          FROM history_message ORDER BY rowid DESC LIMIT 1`);
   return `v${HISTORY_BOARD_ROLLUP_VERSION}:message:${row?.importedAt ?? ""}:${row?.maxRowId ?? 0}`;
 }
+async function markHistoryBoardRollupsRefreshed(db2, historyVersion) {
+  await db2.run(`INSERT INTO history_board_rollup_meta (id, history_version, refreshed_at)
+         VALUES (1, ?, ?)
+         ON CONFLICT(id) DO UPDATE SET history_version = excluded.history_version, refreshed_at = excluded.refreshed_at`, historyVersion, new Date().toISOString());
+}
 async function skillCallRollup(db2) {
   return db2.queryAll(`SELECT strftime('%Y-%m-%dT%H:%M:00Z', CAST(strftime('%s', started_at) / 60 * 60 AS INTEGER), 'unixepoch') AS bucketStart,
                 source,
@@ -52555,9 +52761,10 @@ async function replaceHistoryBoardRollups(db2, seed) {
                 WITH enriched AS (
                     SELECT m.*,
                            COALESCE(
-                               m.model,
+                               NULLIF(NULLIF(m.model, ''), 'unknown'),
                                MAX(CASE WHEN m.model IS NOT NULL AND m.model != '' AND m.model != 'unknown' THEN m.model END)
                                    OVER (PARTITION BY m.source, m.session_id),
+                               NULLIF(m.model, ''),
                                'unknown'
                            ) AS effective_model
                     FROM history_message m
@@ -52588,9 +52795,10 @@ async function replaceHistoryBoardRollups(db2, seed) {
                 WITH enriched AS (
                     SELECT m.*,
                            COALESCE(
-                               m.model,
+                               NULLIF(NULLIF(m.model, ''), 'unknown'),
                                MAX(CASE WHEN m.model IS NOT NULL AND m.model != '' AND m.model != 'unknown' THEN m.model END)
                                    OVER (PARTITION BY m.source, m.session_id),
+                               NULLIF(m.model, ''),
                                'unknown'
                            ) AS effective_model,
                            COALESCE(
@@ -53022,7 +53230,9 @@ function buildSessionWhere(sel, alias3 = "s") {
 }
 async function historyBoardSessionsFromRollup(db2, sel, input) {
   const spec = buildSessionWhere(sel);
-  const order = SESSION_ORDER_COLUMNS[input.sortBy] ?? SESSION_ORDER_COLUMNS.start;
+  const sortKey = input.sortBy ?? input.sortField ?? "start";
+  const order = SESSION_ORDER_COLUMNS[sortKey] ?? SESSION_ORDER_COLUMNS.start;
+  const sortDir = (input.sortDir ?? "desc").toUpperCase();
   const offset = (input.page - 1) * input.pageSize;
   const [items, total] = await Promise.all([
     db2.queryAll(`SELECT s.source, s.session_id AS sessionId, s.model,
@@ -53034,7 +53244,7 @@ async function historyBoardSessionsFromRollup(db2, sel, input) {
                     s.assistant_duration_ms AS assistantDurationMs,
                     s.top_tool AS topTool, s.state
              FROM history_board_session_stats s ${spec.where}
-             ORDER BY ${order} ${input.sortDir.toUpperCase()}, s.session_id ASC
+             ORDER BY ${order} ${sortDir}, s.session_id ASC
              LIMIT ? OFFSET ?`, ...spec.params, input.pageSize, offset),
     db2.queryFirst(`SELECT COUNT(*) AS total FROM history_board_session_stats s ${spec.where}`, ...spec.params)
   ]);
@@ -53278,9 +53488,11 @@ function message5mBucketOps(bucket) {
                 WITH enriched AS (
                     SELECT m.*,
                            COALESCE(
-                               m.model,
-                               MAX(CASE WHEN m.model IS NOT NULL AND m.model != '' AND m.model != 'unknown' THEN m.model END)
-                                   OVER (PARTITION BY m.source, m.session_id),
+                               NULLIF(NULLIF(m.model, ''), 'unknown'),
+                               (SELECT m2.model FROM history_message m2
+                                WHERE m2.source = m.source AND m2.session_id = m.session_id
+                                  AND m2.model IS NOT NULL AND m2.model != '' AND m2.model != 'unknown'
+                                LIMIT 1),
                                'unknown'
                            ) AS effective_model
                     FROM history_message m
@@ -53317,9 +53529,11 @@ function tool5mBucketOps(bucket) {
                 WITH enriched AS (
                     SELECT m.*,
                            COALESCE(
-                               m.model,
-                               MAX(CASE WHEN m.model IS NOT NULL AND m.model != '' AND m.model != 'unknown' THEN m.model END)
-                                   OVER (PARTITION BY m.source, m.session_id),
+                               NULLIF(NULLIF(m.model, ''), 'unknown'),
+                               (SELECT m2.model FROM history_message m2
+                                WHERE m2.source = m.source AND m2.session_id = m.session_id
+                                  AND m2.model IS NOT NULL AND m2.model != '' AND m2.model != 'unknown'
+                                LIMIT 1),
                                'unknown'
                            ) AS effective_model,
                            COALESCE(
@@ -53799,6 +54013,23 @@ async function refreshHistoryBoardRollupsIncremental(db2) {
     });
   }
 }
+async function recordHistoryBoardRollupMeta(db2, historyVersion, refreshedAt = new Date().toISOString()) {
+  await db2.run(`INSERT INTO history_board_rollup_meta (id, history_version, refreshed_at)
+         VALUES (1, ?, ?)
+         ON CONFLICT(id) DO UPDATE SET history_version = excluded.history_version, refreshed_at = excluded.refreshed_at`, historyVersion, refreshedAt);
+}
+async function hasHistoryBoardRollupRows(db2, table3) {
+  const validTables = {
+    history_board_message_5m: true,
+    history_board_session_stats: true,
+    history_board_loop_findings: true
+  };
+  if (!validTables[table3]) {
+    throw new Error(`Invalid rollup probe table: ${table3}`);
+  }
+  const row = await db2.queryFirst(`SELECT 1 AS ok FROM ${table3} LIMIT 1`);
+  return row?.ok === 1;
+}
 var MESSAGE_DEDUP2 = `(m.request_id IS NULL OR NOT EXISTS (
     SELECT 1 FROM history_message o
     WHERE o.request_id = m.request_id AND o.rowid > m.rowid
@@ -60429,6 +60660,15 @@ var init_run_dao = __esm(() => {
     stampMetadata(runId, metadata) {
       return this.mergeMetadata(runId, metadata);
     }
+    stampRunIdentity(runId, definitionDigest, workflowVersion) {
+      return this.adapter.run(`UPDATE runs
+             SET metadata_json = json_set(
+                 COALESCE(NULLIF(metadata_json, ''), '{}'),
+                 '$.definitionDigest', ?1,
+                 '$.workflowVersion', ?2
+             )
+             WHERE id = ?3`, definitionDigest, workflowVersion, runId);
+    }
     stampFailureReason(runId, reason) {
       return this.adapter.run(`UPDATE runs
              SET metadata_json = json_set(
@@ -68824,14 +69064,190 @@ var init_envelope = __esm(() => {
   init_serialization();
 });
 
+// ../../packages/domain/src/retention.ts
+import { readdirSync as readdirSync5, rmSync as rmSync3, statfsSync, statSync as statSync6 } from "fs";
+import { join as join6 } from "path";
+async function estimateReclaimableBytes(db2) {
+  try {
+    const rows = await db2.queryAll("SELECT pageno, pagetype, ncell, payload, unused FROM dbstat ORDER BY pageno");
+    let slack = 0;
+    for (const row of rows)
+      slack += row.unused || 0;
+    return Math.max(0, Math.min(slack, await databaseBytes(db2)));
+  } catch {
+    return 0;
+  }
+}
+async function databaseBytes(db2) {
+  const [pageCount, pageSize] = await Promise.all([
+    db2.queryFirst("PRAGMA page_count"),
+    db2.queryFirst("PRAGMA page_size")
+  ]);
+  return (pageCount?.page_count ?? 0) * (pageSize?.page_size ?? 0);
+}
+function hasSufficientDiskSpace(dbPath, requiredBytes) {
+  try {
+    const fs3 = statfsSync(dbPath);
+    const freeBytes = fs3.bavail * fs3.bsize;
+    return freeBytes >= requiredBytes;
+  } catch {
+    return true;
+  }
+}
+async function compactDatabase(db2, opts) {
+  const bytesBefore = await databaseBytes(db2);
+  try {
+    const lastRun = await db2.queryFirst("SELECT COALESCE(MAX(ran_at), 0) AS ran_at FROM spur_retention_meta WHERE kind = 'compaction'");
+    const now = opts.now ?? new Date;
+    const lastRunAt = lastRun?.ran_at ?? 0;
+    if (lastRunAt !== undefined && lastRunAt > 0 && now.getTime() - lastRunAt < COMPACTION_MIN_INTERVAL_DAYS * DAY_MS) {
+      return { ran: false, skippedReason: "recent-run", bytesBefore, bytesAfter: bytesBefore };
+    }
+    const reclaimable = await (opts.estimateReclaim ?? estimateReclaimableBytes)(db2);
+    if (bytesBefore === 0) {
+      return { ran: false, skippedReason: "empty-db", bytesBefore, bytesAfter: bytesBefore };
+    }
+    if (reclaimable / bytesBefore < COMPACTION_MIN_RECLAIM_RATIO) {
+      return { ran: false, skippedReason: "reclaim-below-threshold", bytesBefore, bytesAfter: bytesBefore };
+    }
+    if (!hasSufficientDiskSpace(opts.dbPath, bytesBefore * 2)) {
+      return { ran: false, skippedReason: "insufficient-disk", bytesBefore, bytesAfter: bytesBefore };
+    }
+    await db2.exec("VACUUM");
+    await db2.exec("PRAGMA wal_checkpoint(TRUNCATE)");
+    const bytesAfter = await databaseBytes(db2);
+    await db2.run("INSERT INTO spur_retention_meta (kind, ran_at) VALUES ('compaction', ?)", now.getTime());
+    return { ran: true, bytesBefore, bytesAfter };
+  } catch {
+    return { ran: false, skippedReason: "error", bytesBefore, bytesAfter: bytesBefore };
+  }
+}
+async function runRetention(db2, cwd, now = new Date) {
+  const result = {
+    ruleEvalRuns: 0,
+    queueJobs: 0,
+    ledgerRows: 0,
+    backupFiles: 0,
+    compaction: { ran: false, skippedReason: "not-run", bytesBefore: 0, bytesAfter: 0 }
+  };
+  result.ruleEvalRuns = await purgeRuleEvalRuns(db2, now);
+  result.queueJobs = await purgeQueueJobs(db2, now);
+  result.ledgerRows = await purgeLedger(db2, now);
+  result.backupFiles = pruneBackups(cwd, now);
+  result.compaction = await compactDatabase(db2, { dbPath: join6(cwd, ".spur", "spur.db"), now });
+  return result;
+}
+async function purgeRuleEvalRuns(db2, now) {
+  return purgeRows(db2, `DELETE FROM rule_eval_runs WHERE created_at < ?`, new Date(now.getTime() - RULE_EVAL_RUN_RETENTION_DAYS * DAY_MS).toISOString());
+}
+async function purgeQueueJobs(db2, now) {
+  return purgeRows(db2, `DELETE FROM queue_jobs WHERE status IN ('completed', 'failed') AND updated_at < ?`, now.getTime() - QUEUE_JOB_RETENTION_DAYS * DAY_MS);
+}
+async function purgeLedger(db2, now) {
+  return purgeRows(db2, `DELETE FROM history_import_ledger WHERE imported_at < ?`, new Date(now.getTime() - LEDGER_RETENTION_DAYS * DAY_MS).toISOString());
+}
+function pruneBackups(cwd, now) {
+  const dir = join6(cwd, ".spur", "backups");
+  let entries;
+  try {
+    entries = readdirSync5(dir);
+  } catch {
+    return 0;
+  }
+  const cutoffMs = now.getTime() - BACKUP_RETENTION_DAYS * DAY_MS;
+  let reclaimed = 0;
+  for (const name of entries) {
+    const path9 = join6(dir, name);
+    try {
+      const stat = statSync6(path9);
+      if (!stat.isFile() || stat.mtimeMs >= cutoffMs)
+        continue;
+      rmSync3(path9, { force: true });
+      reclaimed += 1;
+    } catch {}
+  }
+  return reclaimed;
+}
+async function purgeRows(db2, sql4, cutoff) {
+  try {
+    await db2.run(sql4, cutoff);
+    const row = await db2.queryFirst("SELECT changes() AS n");
+    return row?.n ?? 0;
+  } catch {
+    return 0;
+  }
+}
+var RULE_EVAL_RUN_RETENTION_DAYS = 90, QUEUE_JOB_RETENTION_DAYS = 30, LEDGER_RETENTION_DAYS = 180, BACKUP_RETENTION_DAYS = 30, DAY_MS, COMPACTION_MIN_INTERVAL_DAYS = 7, COMPACTION_MIN_RECLAIM_RATIO = 0.03;
+var init_retention = __esm(() => {
+  DAY_MS = 24 * 60 * 60 * 1000;
+});
+
+// ../../packages/domain/src/maintenance.ts
+async function maintainDatabase(db2, options = {}) {
+  const start = performance.now();
+  const bytesBefore = await databaseBytes(db2);
+  let optimized = false;
+  let checkpointed = false;
+  let vacuumed = false;
+  let vacuumSkippedReason;
+  if (options.vacuum) {
+    let canVacuum = true;
+    if (options.dbPath && !hasSufficientDiskSpace(options.dbPath, bytesBefore * 2)) {
+      canVacuum = false;
+      vacuumSkippedReason = "insufficient-disk";
+    }
+    if (canVacuum) {
+      try {
+        await db2.exec("VACUUM");
+        vacuumed = true;
+        const now = options.now ?? new Date;
+        try {
+          await db2.run("INSERT INTO spur_retention_meta (kind, ran_at) VALUES ('compaction', ?)", now.getTime());
+        } catch {}
+      } catch {
+        vacuumed = false;
+        vacuumSkippedReason = "error";
+      }
+    }
+  }
+  try {
+    await db2.exec("PRAGMA optimize;");
+    optimized = true;
+  } catch {
+    optimized = false;
+  }
+  try {
+    await db2.exec("PRAGMA wal_checkpoint(TRUNCATE);");
+    checkpointed = true;
+  } catch {
+    checkpointed = false;
+  }
+  const bytesAfter = await databaseBytes(db2);
+  const bytesReclaimed = Math.max(0, bytesBefore - bytesAfter);
+  const durationMs = Math.round(performance.now() - start);
+  return {
+    optimized,
+    checkpointed,
+    vacuumed,
+    ...vacuumSkippedReason ? { vacuumSkippedReason } : {},
+    bytesBefore,
+    bytesAfter,
+    bytesReclaimed,
+    durationMs
+  };
+}
+var init_maintenance = __esm(() => {
+  init_retention();
+});
+
 // ../../packages/domain/src/planning/locks.ts
 import { closeSync, fsyncSync, mkdirSync as mkdirSync4, openSync, readFileSync as readFileSync7, renameSync as renameSync3, unlinkSync, writeSync } from "fs";
-import { dirname as dirname7, join as join6 } from "path";
+import { dirname as dirname7, join as join7 } from "path";
 function lockPathForEntity(folder, entityId) {
-  return join6(folder, `.${entityId}.lock`);
+  return join7(folder, `.${entityId}.lock`);
 }
 function createLockPath(folder) {
-  return join6(folder, ".create.lock");
+  return join7(folder, ".create.lock");
 }
 function parseLockContent(raw) {
   const str = typeof raw === "string" ? raw : raw.toString();
@@ -68936,7 +69352,7 @@ function fsyncPath(path9, swallowErrors = false) {
 function atomicWrite(dest, content, entityId, fs3, projectName = "spur") {
   const dir = dirname7(dest);
   const rand = Math.random().toString(36).slice(2, 10);
-  const tempPath = join6(dir, `.${projectName}.${entityId}.${rand}.tmp`);
+  const tempPath = join7(dir, `.${projectName}.${entityId}.${rand}.tmp`);
   fs3.writeFile(tempPath, content);
   fsyncPath(tempPath);
   renameSync3(tempPath, dest);
@@ -68945,7 +69361,7 @@ function atomicWrite(dest, content, entityId, fs3, projectName = "spur") {
 async function atomicWriteAsync(dest, content, entityId, fs3, projectName = "spur") {
   const dir = dirname7(dest);
   const rand = Math.random().toString(36).slice(2, 10);
-  const tempPath = join6(dir, `.${projectName}.${entityId}.${rand}.tmp`);
+  const tempPath = join7(dir, `.${projectName}.${entityId}.${rand}.tmp`);
   await fs3.writeFile(tempPath, content);
   fsyncPath(tempPath);
   renameSync3(tempPath, dest);
@@ -68960,7 +69376,7 @@ function cleanupTempFiles(folder, entityId, fs3, projectName = "spur") {
   let count3 = 0;
   for (const entry of entries) {
     if (entry.startsWith(prefix) && entry.endsWith(suffix)) {
-      fs3.deleteFile(join6(folder, entry));
+      fs3.deleteFile(join7(folder, entry));
       count3++;
     }
   }
@@ -69651,118 +70067,6 @@ var init_task_skeleton = __esm(() => {
   CANONICAL_INDEX = new Map(TASK_CANONICAL_SECTIONS.map((s2, i2) => [s2, i2]));
 });
 
-// ../../packages/domain/src/retention.ts
-import { readdirSync as readdirSync5, rmSync as rmSync3, statfsSync, statSync as statSync6 } from "fs";
-import { join as join7 } from "path";
-async function estimateReclaimableBytes(db2) {
-  try {
-    const rows = await db2.queryAll("SELECT pageno, pagetype, ncell, payload, unused FROM dbstat ORDER BY pageno");
-    let slack = 0;
-    for (const row of rows)
-      slack += row.unused || 0;
-    return Math.max(0, Math.min(slack, await databaseBytes(db2)));
-  } catch {
-    return 0;
-  }
-}
-async function databaseBytes(db2) {
-  const [pageCount, pageSize] = await Promise.all([
-    db2.queryFirst("PRAGMA page_count"),
-    db2.queryFirst("PRAGMA page_size")
-  ]);
-  return (pageCount?.page_count ?? 0) * (pageSize?.page_size ?? 0);
-}
-async function compactDatabase(db2, opts) {
-  const bytesBefore = await databaseBytes(db2);
-  try {
-    const lastRun = await db2.queryFirst("SELECT COALESCE(MAX(ran_at), 0) AS ran_at FROM spur_retention_meta WHERE kind = 'compaction'");
-    const now = opts.now ?? new Date;
-    const lastRunAt = lastRun?.ran_at ?? 0;
-    if (lastRunAt !== undefined && lastRunAt > 0 && now.getTime() - lastRunAt < COMPACTION_MIN_INTERVAL_DAYS * DAY_MS) {
-      return { ran: false, skippedReason: "recent-run", bytesBefore, bytesAfter: bytesBefore };
-    }
-    const reclaimable = await (opts.estimateReclaim ?? estimateReclaimableBytes)(db2);
-    if (bytesBefore === 0) {
-      return { ran: false, skippedReason: "empty-db", bytesBefore, bytesAfter: bytesBefore };
-    }
-    if (reclaimable / bytesBefore < COMPACTION_MIN_RECLAIM_RATIO) {
-      return { ran: false, skippedReason: "reclaim-below-threshold", bytesBefore, bytesAfter: bytesBefore };
-    }
-    try {
-      const fs3 = statfsSync(opts.dbPath);
-      const freeBytes = fs3.bavail * fs3.bsize;
-      if (freeBytes < bytesBefore * 2) {
-        return { ran: false, skippedReason: "insufficient-disk", bytesBefore, bytesAfter: bytesBefore };
-      }
-    } catch {}
-    await db2.exec("VACUUM");
-    const bytesAfter = await databaseBytes(db2);
-    await db2.run("INSERT INTO spur_retention_meta (kind, ran_at) VALUES ('compaction', ?)", now.getTime());
-    return { ran: true, bytesBefore, bytesAfter };
-  } catch {
-    return { ran: false, skippedReason: "error", bytesBefore, bytesAfter: bytesBefore };
-  }
-}
-async function runRetention(db2, cwd, now = new Date) {
-  const result = {
-    ruleEvalRuns: 0,
-    queueJobs: 0,
-    ledgerRows: 0,
-    backupFiles: 0,
-    compaction: { ran: false, skippedReason: "not-run", bytesBefore: 0, bytesAfter: 0 }
-  };
-  result.ruleEvalRuns = await purgeRuleEvalRuns(db2, now);
-  result.queueJobs = await purgeQueueJobs(db2, now);
-  result.ledgerRows = await purgeLedger(db2, now);
-  result.backupFiles = pruneBackups(cwd, now);
-  result.compaction = await compactDatabase(db2, { dbPath: join7(cwd, ".spur", "spur.db"), now });
-  return result;
-}
-async function purgeRuleEvalRuns(db2, now) {
-  return purgeRows(db2, `DELETE FROM rule_eval_runs WHERE created_at < ?`, new Date(now.getTime() - RULE_EVAL_RUN_RETENTION_DAYS * DAY_MS).toISOString());
-}
-async function purgeQueueJobs(db2, now) {
-  return purgeRows(db2, `DELETE FROM queue_jobs WHERE status IN ('completed', 'failed') AND updated_at < ?`, now.getTime() - QUEUE_JOB_RETENTION_DAYS * DAY_MS);
-}
-async function purgeLedger(db2, now) {
-  return purgeRows(db2, `DELETE FROM history_import_ledger WHERE imported_at < ?`, new Date(now.getTime() - LEDGER_RETENTION_DAYS * DAY_MS).toISOString());
-}
-function pruneBackups(cwd, now) {
-  const dir = join7(cwd, ".spur", "backups");
-  let entries;
-  try {
-    entries = readdirSync5(dir);
-  } catch {
-    return 0;
-  }
-  const cutoffMs = now.getTime() - BACKUP_RETENTION_DAYS * DAY_MS;
-  let reclaimed = 0;
-  for (const name of entries) {
-    const path9 = join7(dir, name);
-    try {
-      const stat = statSync6(path9);
-      if (!stat.isFile() || stat.mtimeMs >= cutoffMs)
-        continue;
-      rmSync3(path9, { force: true });
-      reclaimed += 1;
-    } catch {}
-  }
-  return reclaimed;
-}
-async function purgeRows(db2, sql4, cutoff) {
-  try {
-    await db2.run(sql4, cutoff);
-    const row = await db2.queryFirst("SELECT changes() AS n");
-    return row?.n ?? 0;
-  } catch {
-    return 0;
-  }
-}
-var RULE_EVAL_RUN_RETENTION_DAYS = 90, QUEUE_JOB_RETENTION_DAYS = 30, LEDGER_RETENTION_DAYS = 180, BACKUP_RETENTION_DAYS = 30, DAY_MS, COMPACTION_MIN_INTERVAL_DAYS = 7, COMPACTION_MIN_RECLAIM_RATIO = 0.03;
-var init_retention = __esm(() => {
-  DAY_MS = 24 * 60 * 60 * 1000;
-});
-
 // ../../packages/domain/src/stage-registry/validator.ts
 function generateRunId() {
   const crypto3 = globalThis.crypto;
@@ -70070,6 +70374,7 @@ __export(exports_src, {
   renderMarkdown: () => renderMarkdown,
   renderForensics: () => renderForensics,
   refreshHistoryBoardRollupsIncremental: () => refreshHistoryBoardRollupsIncremental,
+  recordHistoryBoardRollupMeta: () => recordHistoryBoardRollupMeta,
   readRollupWatermarks: () => readRollupWatermarks,
   readRecordedImporterSchemaVersion: () => readRecordedImporterSchemaVersion,
   readLockMetadata: () => readLockMetadata,
@@ -70095,6 +70400,8 @@ __export(exports_src, {
   mergeStubs: () => mergeStubs,
   matrixEntrySchema: () => matrixEntrySchema,
   materializeWatermarkExclude: () => materializeWatermarkExclude,
+  markHistoryBoardRollupsRefreshed: () => markHistoryBoardRollupsRefreshed,
+  maintainDatabase: () => maintainDatabase,
   loops: () => loops,
   loopRepeatedCallsQuery: () => loopRepeatedCallsQuery,
   looksLikeGherkinAc: () => looksLikeGherkinAc,
@@ -70129,6 +70436,8 @@ __export(exports_src, {
   historyBoardDimensionDailyFromMart: () => historyBoardDimensionDailyFromMart,
   historyBoardDatabaseBytes: () => historyBoardDatabaseBytes,
   historyBoardBucketsFromRollup: () => historyBoardBucketsFromRollup,
+  hasSufficientDiskSpace: () => hasSufficientDiskSpace,
+  hasHistoryBoardRollupRows: () => hasHistoryBoardRollupRows,
   getVolatileLayerNames: () => getVolatileLayerNames,
   getStageLayerSelection: () => getStageLayerSelection,
   getStageLayerNames: () => getStageLayerNames,
@@ -70165,6 +70474,7 @@ __export(exports_src, {
   deriveDimensionMartsOps: () => deriveDimensionMartsOps,
   deriveDimensionMarts: () => deriveDimensionMarts,
   dbHealthCheck: () => dbHealthCheck,
+  databaseBytes: () => databaseBytes,
   dataWindow: () => dataWindow,
   dailyTokenMatrix: () => dailyTokenMatrix,
   createQueueConsumer: () => createQueueConsumer,
@@ -70330,6 +70640,7 @@ var init_src2 = __esm(() => {
   init_bdd();
   init_dao();
   init_envelope();
+  init_maintenance();
   init_locks();
   init_markdown_document();
   init_rebuild_events();
@@ -71270,7 +71581,8 @@ function buildWorkflowSteps(def) {
         pause: node.pause === true,
         loopBack: incoming.some((e) => (order2.get(e.from) ?? -1) >= (order2.get(node.id) ?? 0)),
         conditional: node.id !== def.initialNode && incoming.length > 0 && incoming.every((e) => e.condition !== undefined),
-        nodeType: node.type ?? "action"
+        nodeType: node.type ?? "action",
+        ...typeof node.description === "string" && node.description !== "" ? { description: node.description } : {}
       };
     });
   }
@@ -71286,7 +71598,8 @@ function buildWorkflowSteps(def) {
       failure: failure.has(state.id),
       pause: state.pause === true,
       loopBack: incoming.some((t) => (order.get(t.from) ?? -1) >= (order.get(state.id) ?? 0)),
-      conditional: state.id !== def.initialState && incoming.length > 0 && incoming.every((t) => t.guard !== undefined)
+      conditional: state.id !== def.initialState && incoming.length > 0 && incoming.every((t) => t.guard !== undefined),
+      ...typeof state.description === "string" && state.description !== "" ? { description: state.description } : {}
     };
   });
 }
@@ -71297,22 +71610,30 @@ function renderWorkflowTodo(def) {
     lines.push("Declared step inventory in declaration order, not a predicted execution path.", "");
   }
   for (const step of buildWorkflowSteps(def)) {
-    const markers = [
-      step.initial ? "initial" : undefined,
-      step.terminal ? "terminal" : undefined,
-      step.failure ? "failure" : undefined,
-      step.pause ? "pause" : undefined,
-      step.loopBack ? "loop-back" : undefined,
-      step.conditional ? "conditional" : undefined,
-      step.nodeType !== undefined && step.nodeType !== "action" ? step.nodeType : undefined
-    ].filter((m) => m !== undefined);
-    lines.push(markers.length > 0 ? `- [ ] ${step.id} \u2014 ${markers.join(" \xB7 ")}` : `- [ ] ${step.id}`);
+    lines.push(formatWorkflowStepLine(step));
   }
   return lines.join(`
 `);
 }
+function formatWorkflowStepLine(step) {
+  const markers = [
+    step.initial ? "initial" : undefined,
+    step.terminal ? "terminal" : undefined,
+    step.failure ? "failure" : undefined,
+    step.pause ? "pause" : undefined,
+    step.loopBack ? "loop-back" : undefined,
+    step.conditional ? "conditional" : undefined,
+    step.nodeType !== undefined && step.nodeType !== "action" ? step.nodeType : undefined
+  ].filter((m) => m !== undefined);
+  return markers.length > 0 ? `- [ ] ${step.id} \u2014 ${markers.join(" \xB7 ")}` : `- [ ] ${step.id}`;
+}
 function renderRunPlan(def) {
-  return `plan: ${buildWorkflowSteps(def).map((s2) => s2.id).join(" \u2192 ")}`;
+  const kind = def.kind ?? "state-machine";
+  return [
+    `plan (${kind}) \u2014 declared inventory, not a predicted route:`,
+    ...buildWorkflowSteps(def).map(formatWorkflowStepLine)
+  ].join(`
+`);
 }
 function formatDuration(ms) {
   const totalSeconds = Math.round(ms / 1000);
@@ -74183,6 +74504,9 @@ var init_structural_repair = __esm(() => {
 function key(e) {
   return `${e.kind}:${e.id}:${e.code}`;
 }
+function isUnsuppressibleFinding(code) {
+  return REQUIRED_FINDING_CODES.has(code);
+}
 
 class PlanningCheckService {
   fs;
@@ -74279,18 +74603,31 @@ class PlanningCheckService {
   }
   summarizeWithStatus(status, findings, strict, overrides, accepted, id) {
     const effectiveFindings = [];
+    const notes = [];
     for (const f of findings) {
+      if (REQUIRED_REFERENCE_CODES.has(f.code) || status === "done" && COMPLETION_FINDING_CODES.has(f.code)) {
+        f.severity = "error";
+      }
+      const unsuppressible = isUnsuppressibleFinding(f.code);
       const override = overrides?.[f.code];
       if (override === "off") {
-        continue;
+        if (unsuppressible) {
+          notes.push(`summarize: override 'off' refused for unsuppressible ${f.code}`);
+        } else {
+          continue;
+        }
       }
       if (override === "error" || override === "warning") {
-        f.severity = override;
+        if (unsuppressible) {
+          notes.push(`summarize: severity override for unsuppressible ${f.code} ignored (required severity preserved)`);
+        } else {
+          f.severity = override;
+        }
       }
       if (strict && f.severity === "warning") {
         f.severity = "error";
       }
-      if (accepted && id) {
+      if (accepted && id && !unsuppressible) {
         const k = key({ kind: this.docKind, id, code: f.code });
         const acceptedSev = accepted.get(k);
         if (acceptedSev !== undefined && acceptedSev === f.severity) {
@@ -74314,13 +74651,49 @@ class PlanningCheckService {
         missingSections.push(f.section);
       }
     }
-    return { status, findings: effectiveFindings, requiredSections, missingSections, pass: !hasError };
+    return { status, findings: effectiveFindings, requiredSections, missingSections, pass: !hasError, notes };
   }
 }
+var REQUIRED_REFERENCE_CODES, COMPLETION_FINDING_CODES, REQUIRED_FINDING_CODES;
 var init_planning_check_base = __esm(() => {
   init_src2();
   init_finding_codes2();
   init_structural_repair();
+  REQUIRED_REFERENCE_CODES = new Set([
+    FINDING_CODES.L4_FEATURE_NOT_FOUND,
+    FINDING_CODES.L4_PARENT_NOT_FOUND,
+    FINDING_CODES.L4_DEPENDENCY_NOT_FOUND,
+    FINDING_CODES.L4_LINKED_TASK_PARSE_FAILED
+  ]);
+  COMPLETION_FINDING_CODES = new Set([
+    FINDING_CODES.L4_ORPHAN_SCENARIOS,
+    FINDING_CODES.L4_UNCOVERED_FEATURE_SCENARIO,
+    FINDING_CODES.L4_SCENARIO_UNVERIFIED,
+    FINDING_CODES.L4_VERIFYING_INCOMPLETE_TASKS,
+    FINDING_CODES.L4_VERDICT_ROWS_MATCH_NO_SCENARIO,
+    FINDING_CODES.L4_MALFORMED_VERDICT_ARTIFACT,
+    FINDING_CODES.L4_EVIDENCE_NOT_RECOVERABLE,
+    FINDING_CODES.L4_DOGFOOD_MISSING,
+    FINDING_CODES.L4_TESTING_VERDICT_STUB,
+    FINDING_CODES.L4_UNCOVERED_TASK_SCENARIO,
+    FINDING_CODES.L3_REVIEW_TESTING_CONTRADICTION,
+    FINDING_CODES.L4_ROLLUP_SUBTASKS_OPEN,
+    FINDING_CODES.L4_ROLLUP_MISSING_ROSTER,
+    FINDING_CODES.L4_ROLLUP_ROSTER_NOT_DECLARED_DEPENDENCY
+  ]);
+  REQUIRED_FINDING_CODES = new Set([
+    FINDING_CODES.L1_MARKDOWN_PARSE,
+    FINDING_CODES.L1_SCHEMA_VALIDATION,
+    FINDING_CODES.L2_MISSING_REQUIRED_SECTION,
+    FINDING_CODES.L3_AC_BDD_ERROR,
+    FINDING_CODES.L3_AC_BDD_INVALID,
+    FINDING_CODES.L3_REQUIREMENTS_EMPTY,
+    FINDING_CODES.L3_AC_EMPTY,
+    FINDING_CODES.L3_REQUIRED_SECTION_PLACEHOLDER,
+    ...REQUIRED_REFERENCE_CODES,
+    FINDING_CODES.L4_PREREQUISITE_CYCLE,
+    ...COMPLETION_FINDING_CODES
+  ]);
 });
 
 // ../../packages/app/src/services/task-record.ts
@@ -74901,7 +75274,8 @@ var init_feature_check = __esm(() => {
       }
       const fm = doc2.frontmatterData ?? {};
       const status = fm.status ?? "backlog";
-      const entry = this.resolveMatrixEntry(isGroupFeature(fm), status);
+      const effectiveStatus = options?.asStatus ?? status;
+      const entry = this.resolveMatrixEntry(isGroupFeature(fm), effectiveStatus);
       this.runL2(doc2, entry, findings, raw);
       this.runL3(doc2, findings, fm);
       if (options?.featuresDir) {
@@ -74912,10 +75286,10 @@ var init_feature_check = __esm(() => {
       const primaryTasksDir = options?.tasksDir ?? options?.tasksDirs?.[0];
       const runDir = options?.runDir ?? (primaryTasksDir ? defaultVerdictRunDir(primaryTasksDir) : undefined);
       const taskScanDirs = options?.tasksDirs && options.tasksDirs.length > 0 ? options.tasksDirs : options?.tasksDir ? [options.tasksDir] : [];
-      await this.runL4(doc2, featureId2, status, taskScanDirs, dogfoodDir, runDir, findings);
+      await this.runL4(doc2, featureId2, effectiveStatus, taskScanDirs, dogfoodDir, runDir, findings);
       return {
         id: featureId2,
-        ...this.summarizeWithStatus(status, findings, strict, options?.severityOverrides),
+        ...this.summarizeWithStatus(effectiveStatus, findings, strict, options?.severityOverrides),
         repairs
       };
     }
@@ -75119,6 +75493,15 @@ var init_feature_check = __esm(() => {
           message: `Feature "${featureId2}" is verifying but ${incompleteTasks.length} linked task(s) are not done/cancelled: ${incompleteTasks.join(", ")}`
         });
       }
+      if (status === "done" && incompleteTasks.length > 0) {
+        findings.push({
+          layer: "L4",
+          code: FINDING_CODES.L4_VERIFYING_INCOMPLETE_TASKS,
+          severity: "error",
+          section: "",
+          message: `Feature "${featureId2}" is done but ${incompleteTasks.length} linked task(s) are not done/cancelled: ${incompleteTasks.join(", ")}`
+        });
+      }
       if (status === "verifying" || status === "done") {
         const SELF_REFERENTIAL_PATTERNS = [
           /\.spur\/workflows\//,
@@ -76438,22 +76821,6 @@ var init_task_check = __esm(() => {
 
 // ../../packages/app/src/services/corpus-check.ts
 import { basename as basename4, dirname as dirname10, join as join13, relative, resolve as resolve3 } from "path";
-function baselineSeverity(e) {
-  return e.severity ?? "error";
-}
-function resolveProjectRoot(cwd) {
-  const fs3 = createNodeFileSystem3(cwd);
-  let current = resolve3(cwd);
-  while (true) {
-    if (fs3.exists(join13(current, ".spur", "config.yaml")) || fs3.exists(join13(current, "config", "corpus-baseline.json"))) {
-      return current;
-    }
-    const parent = dirname10(current);
-    if (parent === current)
-      return resolve3(cwd);
-    current = parent;
-  }
-}
 async function loadTaskMatrix(projectRoot) {
   const fs3 = createNodeFileSystem3(projectRoot);
   const candidates = [join13(projectRoot, ".spur", "tasks", "section-matrix.yaml")];
@@ -76502,9 +76869,7 @@ async function structuralSweep(projectRoot) {
       const wbs = fileName.match(/^(\d{4})_.+\.md$/)?.[1];
       if (wbs === undefined)
         continue;
-      const result = await taskService.check(join13(tasksDir, fileName), wbs, {
-        severityOverrides: planning.severityOverrides
-      });
+      const result = await taskService.check(join13(tasksDir, fileName), wbs);
       for (const finding of result.findings) {
         findings.push({
           kind: "task",
@@ -76519,15 +76884,14 @@ async function structuralSweep(projectRoot) {
   if (await fs3.exists(featuresDir)) {
     const featureService = new FeatureCheckService(fs3);
     for (const fileName of await fs3.readDir(featuresDir)) {
-      const id = fileName.match(/^([A-Z][1-9]*)_.+\.md$/)?.[1];
+      const id = fileName.match(/^([A-Z][0-9]*)_.+\.md$/)?.[1];
       if (id === undefined)
         continue;
       const result = await featureService.check(join13(featuresDir, fileName), id, {
         featuresDir,
         tasksDir: activeTasksDir,
         tasksDirs: taskDirs,
-        runDir: fs3.resolve(".spur/run"),
-        severityOverrides: planning.severityOverrides
+        runDir: fs3.resolve(".spur/run")
       });
       for (const finding of result.findings) {
         findings.push({
@@ -76578,6 +76942,43 @@ async function duplicateIds(cwd, taskDirs, featuresDir) {
   }
   return errors6;
 }
+async function runCorpusCheck(cwd, since, report) {
+  const projectRoot = resolveProjectRoot(cwd);
+  const sweep = await structuralSweep(projectRoot);
+  const fog = await ungraduatedFog(projectRoot, { since, report });
+  const findings = [
+    ...sweep.findings,
+    ...await duplicateIds(projectRoot, sweep.taskDirs, sweep.featuresDir),
+    ...fog.map((finding) => ({ ...finding, severity: "warning" }))
+  ];
+  const newErrors = findings.filter((finding) => finding.severity === "error");
+  const newWarnings = findings.filter((finding) => finding.severity === "warning");
+  return {
+    observed: findings.length,
+    baselined: 0,
+    newErrors,
+    newWarnings,
+    bySeverity: {
+      error: { observed: newErrors.length, baselined: 0, newCount: newErrors.length },
+      warning: { observed: newWarnings.length, baselined: 0, newCount: newWarnings.length }
+    },
+    duplicateKeys: [],
+    ok: newErrors.length === 0
+  };
+}
+function resolveProjectRoot(cwd) {
+  const fs3 = createNodeFileSystem3(cwd);
+  let current = resolve3(cwd);
+  while (true) {
+    if (fs3.exists(join13(current, ".spur", "config.yaml"))) {
+      return current;
+    }
+    const parent = dirname10(current);
+    if (parent === current)
+      return resolve3(cwd);
+    current = parent;
+  }
+}
 async function git(cwd, args) {
   try {
     const p = await new NodeProcessExecutor3().run({ command: "git", args, cwd, rejectOnError: false });
@@ -76742,71 +77143,6 @@ async function ungraduatedFog(cwd = process.cwd(), opts = {}) {
   report(`corpus-check: fog check evaluated ${spec} \u2014 ${maps} map(s) inspected.`);
   return errors6;
 }
-async function collectObservedFindings(projectRoot, since) {
-  const sweep = await structuralSweep(projectRoot);
-  const fogErrors = await ungraduatedFog(projectRoot, { since, report: () => {} });
-  return [...sweep.findings, ...await duplicateIds(projectRoot, sweep.taskDirs, sweep.featuresDir), ...fogErrors];
-}
-function duplicateBaselineKeys(baseline) {
-  const counts = new Map;
-  for (const e of baseline.entries)
-    counts.set(key(e), (counts.get(key(e)) ?? 0) + 1);
-  return [...counts].filter(([, n2]) => n2 > 1).map(([k, count3]) => ({ key: k, count: count3 })).sort((a2, b) => b.count - a2.count || a2.key.localeCompare(b.key));
-}
-function reconcileBaseline(observed, baseline) {
-  const accepted = new Map(baseline.entries.map((e) => [key(e), baselineSeverity(e)]));
-  const unexpected = observed.filter((e) => accepted.get(key(e)) !== e.severity);
-  const newErrors = unexpected.filter((e) => e.severity === "error");
-  const newWarnings = unexpected.filter((e) => e.severity === "warning");
-  const bySeverity = {
-    error: {
-      observed: observed.filter((o3) => o3.severity === "error").length,
-      baselined: baseline.entries.filter((e) => baselineSeverity(e) === "error").length,
-      newCount: newErrors.length
-    },
-    warning: {
-      observed: observed.filter((o3) => o3.severity === "warning").length,
-      baselined: baseline.entries.filter((e) => baselineSeverity(e) === "warning").length,
-      newCount: newWarnings.length
-    }
-  };
-  const duplicateKeys = duplicateBaselineKeys(baseline);
-  return {
-    observed: observed.length,
-    baselined: baseline.entries.length,
-    newErrors,
-    newWarnings,
-    bySeverity,
-    duplicateKeys,
-    ok: unexpected.length === 0 && duplicateKeys.length === 0
-  };
-}
-async function runCorpusCheck(cwd, since) {
-  const projectRoot = resolveProjectRoot(cwd);
-  const baselineFile = join13(projectRoot, "config", "corpus-baseline.json");
-  let baseline = { entries: [] };
-  if (await Bun.file(baselineFile).exists()) {
-    baseline = await Bun.file(baselineFile).json();
-  }
-  const observed = await collectObservedFindings(projectRoot, since);
-  return reconcileBaseline(observed, baseline);
-}
-async function loadAcceptedFindings(cwd) {
-  const projectRoot = resolveProjectRoot(cwd);
-  const baselineFile = join13(projectRoot, "config", "corpus-baseline.json");
-  const accepted = new Map;
-  try {
-    if (await Bun.file(baselineFile).exists()) {
-      const baseline = await Bun.file(baselineFile).json();
-      if (Array.isArray(baseline?.entries)) {
-        for (const e of baseline.entries) {
-          accepted.set(key(e), baselineSeverity(e));
-        }
-      }
-    }
-  } catch {}
-  return accepted;
-}
 var FOG_HEADING, OUT_OF_SCOPE_HEADING, FEATURE_ID, DEFAULT_BRANCHES;
 var init_corpus_check = __esm(() => {
   init_loader();
@@ -80027,32 +80363,13 @@ async function refreshHistoryRollups(db2) {
   if (await historyBoardRollupsFresh(db2)) {
     return { status: "unchanged", historyVersion: await historyBoardHistoryVersion(db2), cacheWasteSteps: 0 };
   }
+  await refreshHistoryBoardRollupsIncremental(db2);
   const historyVersion = await historyBoardHistoryVersion(db2);
-  const [messageRows, toolRows, loopRows, sourceRows, tokenSteps, durationSteps, waste, cacheWasteSteps, skillRows] = await Promise.all([
-    messageRollup(db2, ALL_HISTORY2),
-    toolRollup(db2, ALL_HISTORY2),
-    loops(db2, ALL_HISTORY2),
-    sourceSummary(db2, ALL_HISTORY2),
-    topStepsByTokens(db2, ALL_HISTORY2, RANK_DEPTH2),
-    topStepsByDuration(db2, ALL_HISTORY2, RANK_DEPTH2),
-    cacheWasteAggregate(db2, ALL_HISTORY2),
-    topCacheWasteSteps(db2, ALL_HISTORY2, RANK_DEPTH2),
-    skillCallRollup(db2)
-  ]);
-  await replaceHistoryBoardRollups(db2, {
-    historyVersion,
-    messageRows,
-    toolRows,
-    loopRows,
-    sourceRows,
-    tokenSteps,
-    durationSteps,
-    cacheWasteSteps,
-    skill5m: skillRows
-  });
+  await recordHistoryBoardRollupMeta(db2, historyVersion);
+  const waste = await cacheWasteAggregate(db2, ALL_HISTORY2);
   return { status: "refreshed", historyVersion, cacheWasteSteps: waste?.steps ?? 0 };
 }
-var ALL_HISTORY2, RANK_DEPTH2 = 1000, HistorySchemaVersionMismatchError;
+var ALL_HISTORY2, HistorySchemaVersionMismatchError;
 var init_history_analysis_service = __esm(() => {
   init_src2();
   ALL_HISTORY2 = {
@@ -80258,7 +80575,7 @@ class MockHistoryBoardService {
     const totalTokensWithCache = totalBilled + totalCacheSaved;
     const cacheSavedPercent = totalTokensWithCache > 0 ? Math.round(totalCacheSaved / totalTokensWithCache * 100) : 0;
     const errorRate = totalTools > 0 ? Math.round(totalErrors / totalTools * 1000) / 10 : 0;
-    const bucket = filter?.bucket === "auto" || filter?.bucket === undefined ? filter?.range === "1h" ? "1m" : filter?.range === "4h" ? "3m" : filter?.range === "24h" ? "10m" : filter?.range === "7d" ? "30m" : "1d" : filter.bucket;
+    const bucket = filter?.bucket === "auto" || filter?.bucket === undefined ? filter?.range === "1h" ? "1m" : filter?.range === "4h" ? "1m" : filter?.range === "24h" ? "10m" : filter?.range === "7d" ? "30m" : "1d" : filter.bucket;
     const bucketInterval = {
       "1m": 1 * 60000,
       "3m": 3 * 60000,
@@ -80270,6 +80587,14 @@ class MockHistoryBoardService {
       "1d": 86400000
     }[bucket];
     const dimension = filter?.dimension ?? "model";
+    const ensureBucket = (map2, key2) => {
+      let entry = map2[key2];
+      if (!entry) {
+        entry = { total: 0, cacheRead: 0, output: 0, series: {} };
+        map2[key2] = entry;
+      }
+      return entry;
+    };
     const buckets = {};
     const modelBuckets = {};
     const sourceBuckets = {};
@@ -80277,35 +80602,35 @@ class MockHistoryBoardService {
     const skillBuckets = {};
     for (const s3 of matching) {
       const bKey = new Date(Math.floor(s3.start / bucketInterval) * bucketInterval).toISOString();
-      if (!buckets[bKey])
-        buckets[bKey] = { total: 0, cacheRead: 0, series: {} };
-      if (!modelBuckets[bKey])
-        modelBuckets[bKey] = { total: 0, cacheRead: 0, series: {} };
-      if (!sourceBuckets[bKey])
-        sourceBuckets[bKey] = { total: 0, cacheRead: 0, series: {} };
-      if (!toolBuckets[bKey])
-        toolBuckets[bKey] = { total: 0, cacheRead: 0, series: {} };
-      if (!skillBuckets[bKey])
-        skillBuckets[bKey] = { total: 0, cacheRead: 0, series: {} };
-      buckets[bKey].total += s3.tokens.billedTokens;
-      buckets[bKey].cacheRead += s3.tokens.cacheReadTokens;
-      modelBuckets[bKey].total += s3.tokens.billedTokens;
-      modelBuckets[bKey].cacheRead += s3.tokens.cacheReadTokens;
-      sourceBuckets[bKey].total += s3.tokens.billedTokens;
-      sourceBuckets[bKey].cacheRead += s3.tokens.cacheReadTokens;
-      toolBuckets[bKey].total += s3.tokens.billedTokens;
-      toolBuckets[bKey].cacheRead += s3.tokens.cacheReadTokens;
-      skillBuckets[bKey].total += s3.tokens.billedTokens;
-      skillBuckets[bKey].cacheRead += s3.tokens.cacheReadTokens;
-      modelBuckets[bKey].series[s3.model] = (modelBuckets[bKey].series[s3.model] ?? 0) + s3.tokens.billedTokens;
-      sourceBuckets[bKey].series[s3.source] = (sourceBuckets[bKey].series[s3.source] ?? 0) + s3.tokens.billedTokens;
+      const b = ensureBucket(buckets, bKey);
+      const mb = ensureBucket(modelBuckets, bKey);
+      const sb = ensureBucket(sourceBuckets, bKey);
+      const tb = ensureBucket(toolBuckets, bKey);
+      const kb = ensureBucket(skillBuckets, bKey);
+      b.total += s3.tokens.billedTokens;
+      b.cacheRead += s3.tokens.cacheReadTokens;
+      b.output += s3.tokens.outputTokens;
+      mb.total += s3.tokens.billedTokens;
+      mb.cacheRead += s3.tokens.cacheReadTokens;
+      mb.output += s3.tokens.outputTokens;
+      sb.total += s3.tokens.billedTokens;
+      sb.cacheRead += s3.tokens.cacheReadTokens;
+      sb.output += s3.tokens.outputTokens;
+      tb.total += s3.tokens.billedTokens;
+      tb.cacheRead += s3.tokens.cacheReadTokens;
+      tb.output += s3.tokens.outputTokens;
+      kb.total += s3.tokens.billedTokens;
+      kb.cacheRead += s3.tokens.cacheReadTokens;
+      kb.output += s3.tokens.outputTokens;
+      mb.series[s3.model] = (mb.series[s3.model] ?? 0) + s3.tokens.billedTokens;
+      sb.series[s3.source] = (sb.series[s3.source] ?? 0) + s3.tokens.billedTokens;
       const toolWeight = Object.values(s3.toolMix).reduce((sum, count3) => sum + count3, 0);
       for (const [tool, count3] of Object.entries(s3.toolMix)) {
-        toolBuckets[bKey].series[tool] = (toolBuckets[bKey].series[tool] ?? 0) + (toolWeight > 0 ? s3.tokens.billedTokens * count3 / toolWeight : 0);
+        tb.series[tool] = (tb.series[tool] ?? 0) + (toolWeight > 0 ? s3.tokens.billedTokens * count3 / toolWeight : 0);
       }
       const skillWeight = Object.values(s3.skillMix).reduce((sum, count3) => sum + count3, 0);
       for (const [skill, count3] of Object.entries(s3.skillMix)) {
-        skillBuckets[bKey].series[skill] = (skillBuckets[bKey].series[skill] ?? 0) + (skillWeight > 0 ? s3.tokens.billedTokens * count3 / skillWeight : 0);
+        kb.series[skill] = (kb.series[skill] ?? 0) + (skillWeight > 0 ? s3.tokens.billedTokens * count3 / skillWeight : 0);
       }
       const dimensions = dimension === "model" ? [[s3.model, s3.tokens.billedTokens]] : dimension === "source" ? [[s3.source, s3.tokens.billedTokens]] : Object.entries(dimension === "tool" ? s3.toolMix : s3.skillMix).map(([key2, count3]) => [
         key2,
@@ -80314,15 +80639,17 @@ class MockHistoryBoardService {
       const weight = dimensions.reduce((sum, [, count3]) => sum + count3, 0);
       for (const [key2, count3] of dimensions) {
         const tokens = dimension === "model" || dimension === "source" ? count3 : weight > 0 ? s3.tokens.billedTokens * count3 / weight : 0;
-        buckets[bKey].series[key2] = (buckets[bKey].series[key2] ?? 0) + tokens;
+        b.series[key2] = (b.series[key2] ?? 0) + tokens;
       }
     }
     const toTimeSeries = (map2) => Object.entries(map2).sort(([a2], [b]) => a2.localeCompare(b)).map(([bKey, bVal]) => {
       const denom = bVal.total + bVal.cacheRead;
       const ratio = denom > 0 ? Math.round(bVal.cacheRead / denom * 100) : 0;
+      const gainRatio = denom > 0 ? Math.round(bVal.output / denom * 1000) / 10 : 0;
       return {
         bucketStart: bKey,
         cacheHitRatio: ratio,
+        gainRatio,
         series: bVal.series
       };
     });
@@ -81239,7 +81566,7 @@ function resolveBucket(bucket, range = "4h") {
   if (range === "1h")
     return "1m";
   if (range === "4h")
-    return "3m";
+    return "1m";
   if (range === "24h")
     return "10m";
   if (range === "7d")
@@ -81364,9 +81691,12 @@ function projectSummary(rows, extras) {
   const useCalls = totalBucketTokens === 0;
   const timeSeries = new Map;
   for (const row of rows.buckets) {
-    const point = timeSeries.get(row.bucketStart) ?? { cacheRead: 0, billed: 0, series: {} };
-    const billed = useCalls ? row.calls ?? 0 : (row.freshInputTokens ?? 0) + (row.outputTokens ?? 0);
+    const point = timeSeries.get(row.bucketStart) ?? { cacheRead: 0, billed: 0, output: 0, series: {} };
+    const fresh = row.freshInputTokens ?? 0;
+    const output2 = row.outputTokens ?? 0;
+    const billed = useCalls ? row.calls ?? 0 : fresh + output2;
     point.billed += billed;
+    point.output += output2;
     point.cacheRead += row.cacheReadTokens ?? 0;
     point.series[row.key] = (point.series[row.key] ?? 0) + billed;
     timeSeries.set(row.bucketStart, point);
@@ -81400,11 +81730,15 @@ function projectSummary(rows, extras) {
       toolCallsCount: rows.toolCalls,
       errorRate: rows.toolCalls > 0 ? Math.round(rows.toolErrors / rows.toolCalls * 1000) / 10 : 0
     },
-    timeSeries: Array.from(timeSeries.entries()).map(([bucketStart, point]) => ({
-      bucketStart,
-      cacheHitRatio: point.billed + point.cacheRead > 0 ? Math.round(point.cacheRead / (point.billed + point.cacheRead) * 100) : 0,
-      series: point.series
-    })),
+    timeSeries: Array.from(timeSeries.entries()).map(([bucketStart, point]) => {
+      const totalTokens = point.billed + point.cacheRead;
+      return {
+        bucketStart,
+        cacheHitRatio: totalTokens > 0 ? Math.round(point.cacheRead / totalTokens * 100) : 0,
+        gainRatio: totalTokens > 0 ? Math.round(point.output / totalTokens * 1000) / 10 : 0,
+        series: point.series
+      };
+    }),
     topModels: toTopItems(rows.models, false),
     topSources: toTopItems(rows.sources, true),
     topTools: topToolRows.map((row) => ({
@@ -81546,18 +81880,25 @@ function projectSkillTimeSeries(buckets) {
   const useCalls = totalTokens === 0;
   const byBucket = new Map;
   for (const row of buckets) {
-    const point = byBucket.get(row.bucketStart) ?? { cacheRead: 0, billed: 0, series: {} };
-    const val = useCalls ? row.calls ?? 0 : (row.freshInputTokens ?? 0) + (row.outputTokens ?? 0);
+    const point = byBucket.get(row.bucketStart) ?? { cacheRead: 0, billed: 0, output: 0, series: {} };
+    const fresh = row.freshInputTokens ?? 0;
+    const output2 = row.outputTokens ?? 0;
+    const val = useCalls ? row.calls ?? 0 : fresh + output2;
     point.billed += val;
+    point.output += output2;
     point.cacheRead += row.cacheReadTokens ?? 0;
     point.series[row.key] = (point.series[row.key] ?? 0) + val;
     byBucket.set(row.bucketStart, point);
   }
-  return Array.from(byBucket.entries()).sort(([a2], [b]) => a2.localeCompare(b)).map(([bucketStart, point]) => ({
-    bucketStart,
-    cacheHitRatio: point.billed + point.cacheRead > 0 ? Math.round(point.cacheRead / (point.billed + point.cacheRead) * 100) : 0,
-    series: point.series
-  }));
+  return Array.from(byBucket.entries()).sort(([a2], [b]) => a2.localeCompare(b)).map(([bucketStart, point]) => {
+    const totalTokens2 = point.billed + point.cacheRead;
+    return {
+      bucketStart,
+      cacheHitRatio: totalTokens2 > 0 ? Math.round(point.cacheRead / totalTokens2 * 100) : 0,
+      gainRatio: totalTokens2 > 0 ? Math.round(point.output / totalTokens2 * 1000) / 10 : 0,
+      series: point.series
+    };
+  });
 }
 function projectPreviousKpis(rows) {
   const totalBilledTokens = rows.models.reduce((sum, row) => sum + row.freshInputTokens + row.outputTokens, 0);
@@ -82430,7 +82771,10 @@ class LiveHistoryBoardService {
     }
     const sel = toArtifactSelector(filter);
     const rollupsFresh = await historyBoardRollupsFresh(db2);
-    const [loopRows, cacheWasteRows, sessionRows, largeSteps, slowStepsRows, modelCompRows] = rollupsFresh ? await Promise.all([
+    const hasRollupRows = await hasHistoryBoardRollupRows(db2, "history_board_loop_findings");
+    const useRollup = rollupsFresh || hasRollupRows;
+    const effectiveSel = rollupsFresh ? sel : boundStaleSelector(sel);
+    const [loopRows, cacheWasteRows, sessionRows, largeSteps, slowStepsRows, modelCompRows] = useRollup ? await Promise.all([
       historyBoardLoopsFromRollup(db2, sel, 100),
       historyBoardRankedStepsFromRollup(db2, sel, "cache-waste", 10),
       historyBoardHeavySessionsFromRollup(db2, sel, 5),
@@ -82438,57 +82782,69 @@ class LiveHistoryBoardService {
       historyBoardRankedStepsFromRollup(db2, sel, "duration", 10),
       historyBoardModelComparisonFromRollup(db2, sel)
     ]) : await Promise.all([
-      loops(db2, sel),
-      topCacheWasteSteps(db2, sel, 10),
-      bySession(db2, sel, 5),
-      topStepsByTokens(db2, sel, 10),
-      topStepsByDuration(db2, sel, 10),
-      modelComparison(db2, sel)
+      loops(db2, effectiveSel),
+      topCacheWasteSteps(db2, effectiveSel, 10),
+      bySession(db2, effectiveSel, 5),
+      topStepsByTokens(db2, effectiveSel, 10),
+      topStepsByDuration(db2, effectiveSel, 10),
+      modelComparison(db2, effectiveSel)
     ]);
-    const loopFindings = await Promise.all(loopRows.map(async (l) => {
-      let repeatedCalls = [];
-      try {
-        const callRows = await loopRepeatedCallsQuery(db2, {
-          source: l.source,
-          sessionId: l.sessionId,
-          toolName: l.toolName,
-          argsDigest: l.argsDigest,
-          limit: 50
-        });
-        repeatedCalls = callRows.map((row) => {
-          const category = toolCategory(row.toolName);
-          const links = row.links && row.links > 0 ? row.links : 1;
-          const billedTokens = row.inputTokens + row.outputTokens;
-          return {
-            seq: row.toolSeq,
-            toolSeq: row.toolSeq,
-            ts: row.ts,
-            toolName: row.toolName,
-            category,
-            status: row.status === "ok" ? "ok" : row.status === "error" ? "error" : "unknown",
-            durationMs: row.durationMs,
-            durationSource: row.durationMs !== null ? "measured" : "unmeasured",
-            resultBytes: row.resultBytes,
-            argsRaw: row.argsRaw,
-            argsDigest: row.argsDigest,
-            errorText: row.errorText,
-            callId: row.callId,
-            messageHash: row.messageHash,
-            sessionId: row.sessionId,
-            source: row.source,
-            model: row.model,
-            tokens: {
-              billedTokens: Math.round(billedTokens / links),
-              freshInputTokens: Math.round(row.inputTokens / links),
-              cacheReadTokens: Math.round(row.cacheReadTokens / links),
-              outputTokens: Math.round(row.outputTokens / links),
-              cacheSavedTokens: 0
-            }
-          };
-        });
-      } catch {
-        repeatedCalls = [];
+    const EAGER_LOOP_DETAIL_LIMIT = 10;
+    const loopFindings = await Promise.all(loopRows.map(async (l, idx) => {
+      let repeatedCalls;
+      let avgTokens = 250;
+      if (idx < EAGER_LOOP_DETAIL_LIMIT) {
+        try {
+          const callRows = await loopRepeatedCallsQuery(db2, {
+            source: l.source,
+            sessionId: l.sessionId,
+            toolName: l.toolName,
+            argsDigest: l.argsDigest,
+            model: l.model,
+            limit: 50
+          });
+          if (callRows.length > 0) {
+            const totalSampleTokens = callRows.reduce((acc, r) => acc + (r.inputTokens ?? 0) + (r.outputTokens ?? 0), 0);
+            avgTokens = Math.max(1, Math.round(totalSampleTokens / callRows.length));
+          }
+          repeatedCalls = callRows.map((row) => {
+            const category = toolCategory(row.toolName);
+            const freshInputTokens = row.inputTokens ?? 0;
+            const cacheReadTokens = row.cacheReadTokens ?? 0;
+            const outputTokens = row.outputTokens ?? 0;
+            const billedTokens = freshInputTokens + outputTokens;
+            return {
+              seq: row.toolSeq,
+              toolSeq: row.toolSeq,
+              ts: row.ts,
+              toolName: row.toolName,
+              category,
+              status: row.status === "ok" ? "ok" : row.status === "error" ? "error" : "unknown",
+              durationMs: row.durationMs ?? null,
+              durationSource: row.durationMs !== null ? "measured" : "unmeasured",
+              resultBytes: row.resultBytes ?? null,
+              argsRaw: row.argsRaw ?? null,
+              argsDigest: row.argsDigest ?? null,
+              errorText: row.errorText ?? null,
+              callId: row.callId ?? null,
+              messageHash: row.messageHash,
+              sessionId: row.sessionId,
+              source: row.source,
+              model: row.model ?? null,
+              tokens: {
+                billedTokens,
+                freshInputTokens,
+                cacheReadTokens,
+                outputTokens,
+                cacheSavedTokens: 0
+              }
+            };
+          });
+        } catch {
+          repeatedCalls = [];
+        }
       }
+      const wastedTokens = Math.max(0, l.repeats - 1) * avgTokens;
       return {
         tool: l.toolName,
         argsHint: l.argsDigest ?? "repeated execution",
@@ -82496,7 +82852,7 @@ class LiveHistoryBoardService {
         repeats: l.repeats,
         fromSeq: l.firstSeq,
         toSeq: l.lastSeq,
-        wastedTokens: l.repeats * 250,
+        wastedTokens,
         repeatedCalls
       };
     }));
@@ -83200,6 +83556,14 @@ class HistoryService {
     const db2 = await this.ctx.getDb();
     return resetHistoryTables(db2);
   }
+  async maintain(opts = {}) {
+    const db2 = await this.ctx.getDb();
+    const dbPath = this.ctx.cwd ? join15(this.ctx.cwd, ".spur", "spur.db") : undefined;
+    return maintainDatabase(db2, {
+      ...opts,
+      ...dbPath && opts.dbPath === undefined ? { dbPath } : {}
+    });
+  }
   async analyze(selector, opts = {}) {
     const top = opts.top ?? 20;
     const db2 = await this.ctx.getDb();
@@ -83353,6 +83717,12 @@ class HistoryService {
         attribution2.ambiguousEvidence += sourceAttribution.ambiguousEvidence;
       }
     }
+    if (opts.dryRun !== true && opts.skipRollupRefresh !== true) {
+      const db2 = await this.ctx.getDb();
+      try {
+        await refreshHistoryRollups(db2);
+      } catch {}
+    }
     return { entries, exitCode: computeExitCode(entries), warnings, attribution: attribution2 };
   }
   async daily(opts = {}) {
@@ -90317,7 +90687,6 @@ var init_http_request = __esm(() => {
 
 // ../../packages/app/src/workflow/composition-baseline.ts
 import crypto3 from "crypto";
-import { resolve as resolve11 } from "path";
 function canonicalJsonStringify(obj) {
   if (obj === null || typeof obj !== "object") {
     return JSON.stringify(obj);
@@ -90379,131 +90748,7 @@ function extractResolvedWorkflowFacts(workflow) {
     actions
   };
 }
-async function checkWorkflowComposition(options) {
-  const fs3 = options.fileSystem ?? createNodeFileSystem3();
-  const baselineFile = options.baselinePath ?? resolve11(options.projectRoot, "config/workflow-composition-baseline.json");
-  let baseline = options.baseline;
-  if (!baseline) {
-    if (!await fs3.exists(baselineFile)) {
-      return {
-        pass: false,
-        errors: [`Baseline file not found at ${baselineFile}`],
-        diffs: []
-      };
-    }
-    const content = await fs3.readFile(baselineFile);
-    try {
-      baseline = JSON.parse(content);
-    } catch (e) {
-      return {
-        pass: false,
-        errors: [`Failed to parse baseline JSON: ${e instanceof Error ? e.message : String(e)}`],
-        diffs: []
-      };
-    }
-  }
-  const errors6 = [];
-  const diffs = [];
-  for (const [name, expected] of Object.entries(baseline.workflows)) {
-    const defPath = resolve11(options.projectRoot, expected.definition);
-    if (!await fs3.exists(defPath)) {
-      errors6.push(`Workflow definition for "${name}" missing at ${expected.definition}`);
-      diffs.push({
-        workflow: name,
-        field: "definition",
-        expected: expected.definition,
-        actual: null
-      });
-      continue;
-    }
-    let def;
-    try {
-      def = await loadWorkflowDef(defPath, { validateSchema: false });
-    } catch (e) {
-      errors6.push(`Failed to load workflow definition "${name}": ${e instanceof Error ? e.message : String(e)}`);
-      continue;
-    }
-    const facts = extractResolvedWorkflowFacts(def);
-    const sortedExpectedTerminals = [...expected.terminalStates].sort();
-    const sortedActualTerminals = [...facts.terminalStates].sort();
-    if (JSON.stringify(sortedExpectedTerminals) !== JSON.stringify(sortedActualTerminals)) {
-      errors6.push(`Workflow "${name}" terminalStates mismatch`);
-      diffs.push({
-        workflow: name,
-        field: "terminalStates",
-        expected: expected.terminalStates,
-        actual: facts.terminalStates
-      });
-    }
-    const sortedExpectedModelQueries = [...expected.modelQueries].sort();
-    const sortedActualModelQueries = [...facts.modelQueries].sort();
-    if (JSON.stringify(sortedExpectedModelQueries) !== JSON.stringify(sortedActualModelQueries)) {
-      errors6.push(`Workflow "${name}" modelQueries mismatch`);
-      diffs.push({
-        workflow: name,
-        field: "modelQueries",
-        expected: expected.modelQueries,
-        actual: facts.modelQueries
-      });
-    }
-    const expectedActionKeys = Object.keys(expected.actions).sort();
-    const actualActionKeys = Object.keys(facts.actions).sort();
-    for (const actionKey of expectedActionKeys) {
-      if (!facts.actions[actionKey]) {
-        errors6.push(`Workflow "${name}" action "${actionKey}" is listed in baseline but missing from live definition`);
-        diffs.push({
-          workflow: name,
-          field: `actions.${actionKey}`,
-          expected: expected.actions[actionKey],
-          actual: null
-        });
-      } else {
-        const expAction = expected.actions[actionKey];
-        const actAction = facts.actions[actionKey];
-        if (expAction && actAction) {
-          if (expAction.kind !== actAction.kind) {
-            errors6.push(`Workflow "${name}" action "${actionKey}" kind mismatch: expected ${expAction.kind}, got ${actAction.kind}`);
-            diffs.push({
-              workflow: name,
-              field: `actions.${actionKey}.kind`,
-              expected: expAction.kind,
-              actual: actAction.kind
-            });
-          }
-          if (expAction.invocation !== actAction.invocation) {
-            errors6.push(`Workflow "${name}" action "${actionKey}" invocation mismatch`);
-            diffs.push({
-              workflow: name,
-              field: `actions.${actionKey}.invocation`,
-              expected: expAction.invocation,
-              actual: actAction.invocation
-            });
-          }
-        }
-      }
-    }
-    for (const actionKey of actualActionKeys) {
-      if (!expected.actions[actionKey]) {
-        errors6.push(`Workflow "${name}" action "${actionKey}" present in live definition but unlisted in baseline`);
-        diffs.push({
-          workflow: name,
-          field: `actions.${actionKey}`,
-          expected: null,
-          actual: facts.actions[actionKey]
-        });
-      }
-    }
-  }
-  return {
-    pass: errors6.length === 0,
-    errors: errors6,
-    diffs
-  };
-}
-var init_composition_baseline = __esm(() => {
-  init_dist8();
-  init_dist5();
-});
+var init_composition_baseline = () => {};
 
 // ../../packages/app/src/workflow/proof-input-fingerprint.ts
 import crypto4 from "crypto";
@@ -90810,7 +91055,7 @@ var init_rule_check = __esm(() => {
 });
 
 // ../../packages/app/src/workflow/actions/run-artifact.ts
-import { normalize as normalize3, resolve as resolve12 } from "path";
+import { normalize as normalize3, resolve as resolve11 } from "path";
 
 class RunArtifactActionRunner {
   getDb;
@@ -90838,8 +91083,8 @@ class RunArtifactActionRunner {
       };
     }
     const workdir = context4.workdir ?? process.cwd();
-    const allowedDir = resolve12(workdir, ".spur", "run");
-    const resolvedPath = resolve12(workdir, pathRaw);
+    const allowedDir = resolve11(workdir, ".spur", "run");
+    const resolvedPath = resolve11(workdir, pathRaw);
     const normalized = normalize3(resolvedPath);
     if (!normalized.startsWith(allowedDir)) {
       return {
@@ -91206,7 +91451,7 @@ var init_checkpoint_contract = __esm(() => {
 });
 
 // ../../packages/app/src/workflow/workflow-resolver.ts
-import { basename as basename7, isAbsolute as isAbsolute6, join as join23, resolve as resolve13 } from "path";
+import { basename as basename7, isAbsolute as isAbsolute6, join as join23, resolve as resolve12 } from "path";
 function createEmbeddedSchemaOptions(embedded) {
   if (embedded === undefined || embedded.size === 0)
     return;
@@ -91237,7 +91482,7 @@ async function readWorkflowNameFast(fs3, filePath) {
 }
 async function scanWorkflowByName(cwd, name) {
   const fs3 = createNodeFileSystem3();
-  const projectSpurDir = resolve13(cwd, ".spur", "workflows");
+  const projectSpurDir = resolve12(cwd, ".spur", "workflows");
   if (fs3.exists(projectSpurDir)) {
     try {
       const files = (await fs3.readDir(projectSpurDir)).filter((f) => f.endsWith(".yaml") || f.endsWith(".yml"));
@@ -91270,7 +91515,7 @@ async function scanWorkflowByName(cwd, name) {
 }
 function resolveWorkflowFile(cwd, file2) {
   const fs3 = createNodeFileSystem3();
-  const projectPath = resolve13(cwd, file2);
+  const projectPath = resolve12(cwd, file2);
   if (fs3.exists(projectPath)) {
     return { path: projectPath, source: "project" };
   }
@@ -91278,20 +91523,20 @@ function resolveWorkflowFile(cwd, file2) {
   const base2 = basename7(file2);
   if (!isAbsolute6(file2)) {
     const withYaml = isYaml ? file2 : `${file2}.yaml`;
-    const projectSpur = resolve13(cwd, ".spur", "workflows", withYaml);
+    const projectSpur = resolve12(cwd, ".spur", "workflows", withYaml);
     if (fs3.exists(projectSpur)) {
       return { path: projectSpur, source: "project" };
     }
     if (!isYaml) {
-      const projectDirect = resolve13(cwd, `${file2}.yaml`);
+      const projectDirect = resolve12(cwd, `${file2}.yaml`);
       if (fs3.exists(projectDirect)) {
         return { path: projectDirect, source: "project" };
       }
-      const projectSpurPipeline = resolve13(cwd, ".spur", "workflows", `${file2}-pipeline.yaml`);
+      const projectSpurPipeline = resolve12(cwd, ".spur", "workflows", `${file2}-pipeline.yaml`);
       if (fs3.exists(projectSpurPipeline)) {
         return { path: projectSpurPipeline, source: "project" };
       }
-      const projectDirectPipeline = resolve13(cwd, `${file2}-pipeline.yaml`);
+      const projectDirectPipeline = resolve12(cwd, `${file2}-pipeline.yaml`);
       if (fs3.exists(projectDirectPipeline)) {
         return { path: projectDirectPipeline, source: "project" };
       }
@@ -91355,9 +91600,9 @@ var init_workflow_resolver = __esm(() => {
 });
 
 // ../../packages/app/src/services/workflow-service.ts
-import { existsSync as existsSync10, readFileSync as readFileSync10, realpathSync as realpathSync5 } from "fs";
+import { realpathSync as realpathSync5 } from "fs";
 import { homedir as homedir8 } from "os";
-import { basename as basename8, dirname as dirname17, join as join24, resolve as resolve14, sep as sep3 } from "path";
+import { basename as basename8, dirname as dirname17, join as join24, resolve as resolve13, sep as sep3 } from "path";
 function signalSubprocess(pid) {
   if (!Number.isInteger(pid) || pid <= 1)
     return false;
@@ -91400,13 +91645,9 @@ function withSelfPidRecording(inner, db2) {
     }
   });
 }
-function withDefinitionDigestRecording(inner, db2, definitionDigest) {
-  if (!definitionDigest)
-    return inner;
+function withRunIdentityRecording(inner, db2, identity7) {
   const stamp = async (runId) => {
-    try {
-      await new RunDao(db2).mergeMetadata(runId, { definitionDigest });
-    } catch {}
+    await new RunDao(db2).stampRunIdentity(runId, identity7.definitionDigest, identity7.workflowVersion);
   };
   return new Proxy(inner, {
     get(target, prop, receiver) {
@@ -91510,7 +91751,7 @@ class WorkflowAppService {
   }
   async run(file2, opts = {}) {
     const eventsBus = this.ctx.events?.();
-    const resolved = await resolveWorkflowDefinition(this.ctx.cwd, file2, {
+    const resolved = opts.resolvedDefinition ?? await resolveWorkflowDefinition(this.ctx.cwd, file2, {
       validateSchema: true,
       embeddedSchemas: this.ctx.embeddedSchemas?.()
     });
@@ -91547,6 +91788,8 @@ class WorkflowAppService {
     await this.stampFailureReason(runId, result);
     await this.maybeLinkPipelineRun(file2, runId, opts);
     const runResult = result;
+    runResult.definitionDigest = resolved.digest;
+    runResult.version = workflowVersionLiteral(workflow);
     if (warnings.length > 0) {
       for (const warning of warnings) {
         try {
@@ -91656,7 +91899,7 @@ class WorkflowAppService {
     try {
       sessionsReal = realpathSync5(sessionsDir);
     } catch {
-      sessionsReal = resolve14(sessionsDir);
+      sessionsReal = resolve13(sessionsDir);
     }
     const cutoffMs = Date.now() - retentionDays * 24 * 60 * 60 * 1000;
     const reclaimed = [];
@@ -91675,7 +91918,7 @@ class WorkflowAppService {
       try {
         resolved = realpathSync5(path9);
       } catch {
-        resolved = resolve14(path9);
+        resolved = resolve13(path9);
       }
       if (!resolved.startsWith(sessionsReal + sep3)) {
         skipped.push({ name, reason: "path-confinement: resolved outside .spur/memory/sessions" });
@@ -91764,6 +92007,11 @@ class WorkflowAppService {
       rawMeta = {};
     }
     const persistedDigest = typeof rawMeta.definitionDigest === "string" ? rawMeta.definitionDigest : null;
+    const identityStamped = "workflowVersion" in rawMeta;
+    const persistedVersion = identityStamped && (typeof rawMeta.workflowVersion === "string" || rawMeta.workflowVersion === null) ? rawMeta.workflowVersion : undefined;
+    if (identityStamped && persistedDigest === null) {
+      throw new Error(`Cannot resume run "${runId}": workflow definition drift detected (identity-stamped run has no recorded definition digest, currently ${resolved.digest}). Resume refused.`);
+    }
     if (persistedDigest !== null && persistedDigest !== resolved.digest) {
       if (opts?.allowDigestMismatch !== true && opts?.force !== true) {
         const prompt = `Workflow definition drift detected for run "${runId}": launched with ${persistedDigest}, currently ${resolved.digest}. Continue with modified definition?`;
@@ -91793,7 +92041,11 @@ class WorkflowAppService {
       } : {}
     });
     await this.stampFailureReason(runId, result);
-    return result;
+    const runResult = result;
+    runResult.definitionDigest = persistedDigest;
+    if (persistedVersion !== undefined)
+      runResult.version = persistedVersion;
+    return runResult;
   }
   async stampFailureReason(runId, result) {
     if (result.status !== "failed" || typeof result.reason !== "string" || result.reason === "") {
@@ -91855,21 +92107,21 @@ class WorkflowAppService {
     const entries = [];
     const scannedPaths = new Set;
     for (const relPath of workflowPaths) {
-      const absPath = resolve14(projectRoot, relPath);
+      const absPath = resolve13(projectRoot, relPath);
       layers.push({ id: "project", path: absPath });
       scannedPaths.add(absPath);
       try {
-        const found = await scanWorkflowFiles(absPath, "project");
+        const found = await scanWorkflowFiles(absPath, "project", (filePath) => this.loadListEntry(filePath));
         entries.push(...found);
       } catch {}
     }
     for (const relPath of workflowPaths) {
-      const absPath = resolve14(globalRoot, relPath);
+      const absPath = resolve13(globalRoot, relPath);
       if (scannedPaths.has(absPath))
         continue;
       layers.push({ id: "global", path: absPath });
       try {
-        const found = await scanWorkflowFiles(absPath, "global");
+        const found = await scanWorkflowFiles(absPath, "global", (filePath) => this.loadListEntry(filePath));
         entries.push(...found);
       } catch {}
     }
@@ -91978,6 +92230,33 @@ class WorkflowAppService {
       ...outputArtifact !== undefined ? { outputArtifact } : {}
     };
   }
+  async loadListEntry(filePath) {
+    try {
+      const resolved = await resolveWorkflowDefinition(this.ctx.cwd, filePath, {
+        validateSchema: true,
+        embeddedSchemas: this.ctx.embeddedSchemas?.()
+      });
+      return {
+        name: resolved.workflow.name,
+        kind: resolved.workflow.kind ?? "state-machine",
+        valid: true,
+        version: workflowVersionLiteral(resolved.workflow),
+        definitionDigest: resolved.digest
+      };
+    } catch (error51) {
+      const meta3 = await extractWorkflowMeta(filePath);
+      return {
+        name: meta3.name,
+        kind: meta3.kind,
+        valid: false,
+        error: error51 instanceof Error ? error51.message : String(error51)
+      };
+    }
+  }
+  async stampPlanArtifactPath(runId, planArtifactPath) {
+    const db2 = await this.ctx.getDb();
+    await new RunDao(db2).mergeMetadata(runId, { planArtifactPath });
+  }
   async createEngineService(opts = {}) {
     const processExec = this.ctx.processExecutor?.();
     const host = createDefaultWorkflowEngineHost(processExec !== undefined ? { processExecutor: processExec } : {});
@@ -92021,8 +92300,10 @@ class WorkflowAppService {
       persistence2 = withSelfPidRecording(persistence2, db2);
     }
     if (opts.extensions !== undefined) {
-      const digest = computeDefinitionDigest(opts.extensions.workflow);
-      persistence2 = withDefinitionDigestRecording(persistence2, db2, digest);
+      persistence2 = withRunIdentityRecording(persistence2, db2, {
+        definitionDigest: computeDefinitionDigest(opts.extensions.workflow),
+        workflowVersion: workflowVersionLiteral(opts.extensions.workflow)
+      });
     }
     const adapter = bus ? new ObservableWorkflowAdapter(persistence2, opts.extensions !== undefined ? withWorkflowIdentity(bus, opts.extensions.workflow) : bus) : persistence2;
     return new WorkflowService(host, adapter);
@@ -92039,6 +92320,9 @@ class WorkflowAppService {
     });
   }
 }
+function workflowVersionLiteral(workflow) {
+  return typeof workflow.version === "string" && workflow.version !== "" ? workflow.version : null;
+}
 function collectShellCommands(def) {
   const entries = [];
   const visitAction = (stateId, action, idx) => {
@@ -92196,7 +92480,7 @@ function collectUndeclaredShellVarViolations(def) {
 }
 function collectCompositionAdvisory(def, workflowFile) {
   const findings = [];
-  let suppressed = 0;
+  const workflowName = basename8(workflowFile, ".yaml");
   const shellLines = (command) => command.split(/\n|;/).map((u2) => u2.trim()).filter((u2) => u2.length > 0 && !u2.startsWith("#")).length;
   const agentRunSeverity = (prompt) => {
     if (prompt.length < 200)
@@ -92205,17 +92489,6 @@ function collectCompositionAdvisory(def, workflowFile) {
       return "medium";
     return "high";
   };
-  const baseline = loadCompositionBaselineFor(workflowFile);
-  const workflowName = basename8(workflowFile, ".yaml");
-  const adjudicated = (actionKey) => {
-    if (!baseline)
-      return false;
-    const entry = baseline.workflows[workflowName];
-    if (!entry)
-      return false;
-    const action = entry.actions[actionKey];
-    return action?.disposition !== undefined;
-  };
   const visitAction = (stateId, action, idx, phase) => {
     const actionKey = `${stateId}:${phase}:${idx}`;
     if (action.kind === "shell") {
@@ -92225,16 +92498,12 @@ function collectCompositionAdvisory(def, workflowFile) {
       const measured = shellLines(cmd);
       if (measured < 6)
         return;
-      if (adjudicated(actionKey)) {
-        suppressed += 1;
-        return;
-      }
       findings.push({
         workflow: workflowName,
         state: stateId,
         actionKey,
         measure: { kind: "shell-lines", measured, threshold: 6 },
-        recommendation: `shell action at ${actionKey} measures ${measured} lines (>5 frozen threshold, ADR-069) \u2014 extract to a script or record a disposition in config/workflow-composition-baseline.json`
+        recommendation: `shell action at ${actionKey} measures ${measured} lines (>5 frozen threshold, ADR-069) \u2014 extract to a script under scripts/ or plugins/sp/scripts`
       });
     } else if (action.kind === "agent.run") {
       const input = action.options?.input;
@@ -92242,18 +92511,14 @@ function collectCompositionAdvisory(def, workflowFile) {
         return;
       if (input.trimStart().startsWith("/"))
         return;
-      if (adjudicated(actionKey)) {
-        suppressed += 1;
-      } else {
-        const severity = agentRunSeverity(input);
-        findings.push({
-          workflow: workflowName,
-          state: stateId,
-          actionKey,
-          measure: { kind: "agent-run-chars", measured: input.length, severity },
-          recommendation: `agent.run prompt at ${actionKey} is ${input.length} chars, not slash-pinned (severity ${severity}) \u2014 pin to a slash command or a script with a bounded prompt`
-        });
-      }
+      const severity = agentRunSeverity(input);
+      findings.push({
+        workflow: workflowName,
+        state: stateId,
+        actionKey,
+        measure: { kind: "agent-run-chars", measured: input.length, severity },
+        recommendation: `agent.run prompt at ${actionKey} is ${input.length} chars, not slash-pinned (severity ${severity}) \u2014 pin to a slash command or a script with a bounded prompt`
+      });
     }
   };
   if (def.kind === "transition-flow" || def.kind === undefined) {
@@ -92271,22 +92536,7 @@ function collectCompositionAdvisory(def, workflowFile) {
         visitAction(state.id, action, i2, "onExit");
     }
   }
-  return { findings, suppressed };
-}
-function loadCompositionBaselineFor(workflowFile) {
-  let dir = dirname17(resolve14(workflowFile));
-  for (let i2 = 0;i2 < 10; i2++) {
-    const candidate = join24(dir, "config/workflow-composition-baseline.json");
-    if (existsSync10(candidate)) {
-      try {
-        return JSON.parse(readFileSync10(candidate, "utf8"));
-      } catch {
-        return;
-      }
-    }
-    dir = dirname17(dir);
-  }
-  return;
+  return { findings };
 }
 async function fileExists(path9) {
   const fs3 = createNodeFileSystem3();
@@ -92329,7 +92579,7 @@ async function outputArtifactForRun(cwd, runId) {
   const relative5 = join24(".spur", "run", `${runId}.log`);
   return await fileExists(join24(cwd, relative5)) ? relative5 : undefined;
 }
-async function scanWorkflowFiles(rootPath, source) {
+async function scanWorkflowFiles(rootPath, source, loadEntry) {
   const entries = [];
   const fs3 = createNodeFileSystem3();
   const rootStat = await fs3.stat(rootPath);
@@ -92340,7 +92590,7 @@ async function scanWorkflowFiles(rootPath, source) {
   async function walk3(dirPath) {
     const names = await fs3.readDir(dirPath);
     for (const name of names) {
-      const fullPath = resolve14(dirPath, name);
+      const fullPath = resolve13(dirPath, name);
       const st = await fs3.stat(fullPath);
       if (!st)
         continue;
@@ -92348,8 +92598,8 @@ async function scanWorkflowFiles(rootPath, source) {
         await walk3(fullPath);
       } else if (st.isFile() && (name.endsWith(".yaml") || name.endsWith(".yml"))) {
         const displayPath = fullPath.startsWith(rootPath) ? fullPath.slice(rootPath.length + 1) : fullPath;
-        const meta3 = await extractWorkflowMeta(fullPath);
-        entries.push({ ...meta3, path: displayPath, source });
+        const entry = await loadEntry(fullPath);
+        entries.push({ ...entry, path: displayPath, source });
       }
     }
   }
@@ -92388,12 +92638,20 @@ async function extractWorkflowMeta(filePath) {
 function rowToTraceEntry(row, cwd) {
   let isDryRun = false;
   let failureReason;
+  let version3;
+  let definitionDigest;
   try {
     const meta3 = JSON.parse(row.metadata_json);
     isDryRun = meta3.dryRun === true;
     if (typeof meta3.failureReason === "string" && meta3.failureReason !== "") {
       failureReason = meta3.failureReason;
     }
+    if ("workflowVersion" in meta3 && (typeof meta3.workflowVersion === "string" || meta3.workflowVersion === null)) {
+      version3 = meta3.workflowVersion;
+    }
+    if (typeof meta3.definitionDigest === "string" && meta3.definitionDigest !== "") {
+      definitionDigest = meta3.definitionDigest;
+    }
   } catch {}
   const entry = {
     runId: row.id,
@@ -92406,7 +92664,9 @@ function rowToTraceEntry(row, cwd) {
     project: systemEventProjectContext(cwd),
     durationMs: durationBetween(row.started_at, row.completed_at),
     outcome: traceOutcome(row.status),
-    ...failureReason !== undefined ? { failureReason } : {}
+    ...failureReason !== undefined ? { failureReason } : {},
+    ...version3 !== undefined ? { version: version3 } : {},
+    ...definitionDigest !== undefined ? { definitionDigest } : {}
   };
   const nextAction = traceNextAction(entry);
   if (nextAction !== undefined)
@@ -92503,7 +92763,7 @@ async function partialArtifactForAction(cwd, runId, node, ok) {
   if (ok !== false || !TRACE_IDENTIFIER.test(runId) || !TRACE_IDENTIFIER.test(node))
     return;
   const relativePath2 = join24(".spur", "run", `${runId}-${node}-partial.md`);
-  return await fileExists(resolve14(cwd, relativePath2)) ? relativePath2 : undefined;
+  return await fileExists(resolve13(cwd, relativePath2)) ? relativePath2 : undefined;
 }
 var TASK_PIPELINE_WORKFLOW = "task-pipeline", PIPELINE_LINK_KIND = "pipeline", TRACE_IDENTIFIER, TRACE_RESULT_FIELDS, TRACE_INVOCATION_FIELDS;
 var init_workflow_service = __esm(() => {
@@ -92541,7 +92801,7 @@ var init_workflow_service = __esm(() => {
 });
 
 // ../../packages/app/src/workflow/idea-handoff.ts
-import { resolve as resolve15 } from "path";
+import { resolve as resolve14 } from "path";
 function processEvidence(r) {
   return `exit=${r.exitCode ?? "null"}${r.signal ? ` signal=${r.signal}` : ""}: ${r.stderr.trim() || "no stderr"}`;
 }
@@ -92551,11 +92811,11 @@ async function finalizeIdeaHandoff(options) {
   const executor = options.processExecutor ?? new NodeProcessExecutor3;
   const spurBin = options.spurBin ?? "spur";
   const { runId, featureId: featureId2 } = options;
-  const runDir = resolve15(root, ".spur", "run");
-  const batchPath = resolve15(runDir, `${runId}-idea-task-batch.json`);
-  const resultPath = resolve15(runDir, `${runId}-idea-batch-create-result.json`);
-  const orderPath = resolve15(runDir, `${runId}-idea-task-order.json`);
-  const reportPath = resolve15(runDir, `${runId}-idea-handoff.md`);
+  const runDir = resolve14(root, ".spur", "run");
+  const batchPath = resolve14(runDir, `${runId}-idea-task-batch.json`);
+  const resultPath = resolve14(runDir, `${runId}-idea-batch-create-result.json`);
+  const orderPath = resolve14(runDir, `${runId}-idea-task-order.json`);
+  const reportPath = resolve14(runDir, `${runId}-idea-handoff.md`);
   const spurSplit = splitLaunchCommand(spurBin, 'idea-handoff "spurBin"');
   if ("error" in spurSplit) {
     return {
@@ -92955,6 +93215,7 @@ async function projectWorkflowProgress(runId, options) {
     }
   } catch {}
   const recordedDigest = typeof rawMeta.definitionDigest === "string" ? rawMeta.definitionDigest : null;
+  const recordedVersion = "workflowVersion" in rawMeta && (typeof rawMeta.workflowVersion === "string" || rawMeta.workflowVersion === null) ? rawMeta.workflowVersion : undefined;
   let normalizedStatus = "unknown";
   const statusLower = (runRow.status ?? "").toLowerCase();
   if (statusLower === "done" || statusLower === "completed") {
@@ -93006,6 +93267,7 @@ async function projectWorkflowProgress(runId, options) {
       workflow: workflowName,
       status: normalizedStatus,
       definitionDigest: recordedDigest,
+      ...recordedVersion !== undefined ? { version: recordedVersion } : {},
       currentState,
       states: [],
       transitions,
@@ -93184,6 +93446,7 @@ async function projectWorkflowProgress(runId, options) {
     workflow: smDef.name || workflowName,
     status: normalizedStatus,
     definitionDigest: recordedDigest,
+    ...recordedVersion !== undefined ? { version: recordedVersion } : {},
     currentState,
     states: statesProgress,
     transitions,
@@ -93342,7 +93605,6 @@ __export(exports_src2, {
   registerSpurBuiltins: () => registerSpurBuiltins,
   refreshHistoryRollups: () => refreshHistoryRollups,
   redactAndBound: () => redactAndBound,
-  reconcileBaseline: () => reconcileBaseline,
   readVerdictArtifact: () => readVerdictArtifact,
   readVerdict: () => readVerdict,
   qualifySectionBody: () => qualifySectionBody,
@@ -93365,7 +93627,6 @@ __export(exports_src2, {
   normalizeSystemEventPayload: () => normalizeSystemEventPayload,
   normalizeProjectPath: () => normalizeProjectPath,
   looksLikeOpaqueId: () => looksLikeOpaqueId,
-  loadAcceptedFindings: () => loadAcceptedFindings,
   isSystemEventEnvelopeV2: () => isSystemEventEnvelopeV2,
   isRecordAuthoredReview: () => isRecordAuthoredReview,
   isPortLive: () => isPortLive,
@@ -93412,20 +93673,17 @@ __export(exports_src2, {
   computeExitCode: () => computeExitCode,
   computeDefinitionDigest: () => computeDefinitionDigest,
   computeAggregate: () => computeAggregate,
-  collectObservedFindings: () => collectObservedFindings,
   classifyTaskOutcome: () => classifyTaskOutcome,
   classifyPortBindError: () => classifyPortBindError,
   classifyDispatch: () => classifyDispatch,
   clampToolUseLimit: () => clampToolUseLimit,
   clampRunStoreLimit: () => clampRunStoreLimit,
-  checkWorkflowComposition: () => checkWorkflowComposition,
   canonicalJsonStringify: () => canonicalJsonStringify,
   buildWorkflowSteps: () => buildWorkflowSteps,
   buildTrackedBasenameIndex: () => buildTrackedBasenameIndex,
   buildSystemEventEnvelope: () => buildSystemEventEnvelope,
   buildEscalationPacket: () => buildEscalationPacket,
   bridgeEventBus: () => bridgeEventBus,
-  baselineSeverity: () => baselineSeverity,
   attributeSessions: () => attributeSessions,
   assertPiImporterSafe: () => assertPiImporterSafe,
   anchorQualify: () => anchorQualify,
@@ -101666,15 +101924,15 @@ function parseTimeout(raw) {
   return n3;
 }
 function loopSleep(ms, signal) {
-  return new Promise((resolve16) => {
+  return new Promise((resolve15) => {
     if (signal?.aborted) {
-      resolve16();
+      resolve15();
       return;
     }
-    const timer = setTimeout(resolve16, ms);
+    const timer = setTimeout(resolve15, ms);
     signal?.addEventListener("abort", () => {
       clearTimeout(timer);
-      resolve16();
+      resolve15();
     }, { once: true });
   });
 }
@@ -101805,7 +102063,7 @@ function waitFail(context4, options, code, message) {
 
 // src/release-ops.ts
 init_dist5();
-import { existsSync as existsSync11, readdirSync as readdirSync7, readFileSync as readFileSync11 } from "fs";
+import { existsSync as existsSync10, readdirSync as readdirSync7, readFileSync as readFileSync10 } from "fs";
 import { join as join26 } from "path";
 var SEMVER = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z-.]+)?(?:\+[0-9A-Za-z-.]+)?$/;
 function releaseTag(config4, version3) {
@@ -101852,7 +102110,7 @@ async function readJson(path9) {
 function rootWorkspaceGlobs(repoRoot) {
   let root;
   try {
-    root = JSON.parse(readFileSync11(join26(repoRoot, "package.json"), "utf8"));
+    root = JSON.parse(readFileSync10(join26(repoRoot, "package.json"), "utf8"));
   } catch {
     return [];
   }
@@ -101870,10 +102128,10 @@ function workspaceDirs(repoRoot) {
       continue;
     const parent = glob.slice(0, -2);
     const parentAbs = join26(repoRoot, parent);
-    if (!existsSync11(parentAbs))
+    if (!existsSync10(parentAbs))
       continue;
     for (const entry of readdirSync7(parentAbs, { withFileTypes: true })) {
-      if (entry.isDirectory() && existsSync11(join26(parentAbs, entry.name, "package.json"))) {
+      if (entry.isDirectory() && existsSync10(join26(parentAbs, entry.name, "package.json"))) {
         dirs.push(`${parent}/${entry.name}`);
       }
     }
@@ -101901,7 +102159,7 @@ async function releaseContext(repoRoot) {
   const shortName = (name) => name.split("/").pop() ?? name;
   const packages = new Map;
   for (const ws of workspaces2) {
-    const versionSourceFile = existsSync11(join26(repoRoot, ws.dir, "src", "config.ts")) ? `${ws.dir}/src/config.ts` : undefined;
+    const versionSourceFile = existsSync10(join26(repoRoot, ws.dir, "src", "config.ts")) ? `${ws.dir}/src/config.ts` : undefined;
     packages.set(shortName(ws.name), {
       packageDir: ws.dir,
       packageName: ws.name,
@@ -102071,7 +102329,7 @@ async function bumpVersion(ctx, config4, version3, options, output2) {
   staged.push(...await updateWorkspacePins(ctx, config4.packageName, previous, version3, output2));
   await syncMarketplaceAndPlugins(ctx, version3, staged, output2);
   const lockPath = join26(ctx.repoRoot, "bun.lock");
-  if (existsSync11(lockPath) && Bun.file(lockPath).size > 0)
+  if (existsSync10(lockPath) && Bun.file(lockPath).size > 0)
     staged.push("bun.lock");
   await git2(ctx.repoRoot, ["add", ...staged]);
   const message = `${config4.releaseCommitType}(${config4.releaseCommitScope}): ${config4.releaseCommitSubject(version3)}`;
@@ -102146,7 +102404,7 @@ async function bumpAll(ctx, version3, options, output2) {
   }
   await syncMarketplaceAndPlugins(ctx, version3, staged, output2);
   const lockPath = join26(ctx.repoRoot, "bun.lock");
-  if (existsSync11(lockPath) && Bun.file(lockPath).size > 0)
+  if (existsSync10(lockPath) && Bun.file(lockPath).size > 0)
     staged.push("bun.lock");
   await git2(ctx.repoRoot, ["add", ...staged]);
   const shortNames = configs.map((c3) => c3.packageName.split("/").pop() ?? c3.packageName).join(" + ");
@@ -102536,7 +102794,7 @@ function registerFeatureCommand(program2, context4) {
         if (current === "active") {
           await assertFeatureCheckPass(context4, id, options.folder, false, "verifying");
         } else if (current === "verifying") {
-          await assertFeatureCheckPass(context4, id, options.folder, true, "done");
+          await assertFeatureCheckPass(context4, id, options.folder, false, "done");
         }
         const result = await svc.transition(id, next);
         history.push({ from: result.fromStatus ?? current, to: result.toStatus ?? next });
@@ -102806,7 +103064,7 @@ import { createRequire } from "module";
 var CLI_CONFIG = {
   binaryName: "spur",
   binaryLabel: "spur",
-  binaryVersion: "0.3.73",
+  binaryVersion: "0.3.74",
   configDir: ".spur",
   configFile: ".spur/config.yaml",
   databaseFile: ".spur/spur.db"
@@ -103191,7 +103449,7 @@ init_loader();
 init_src2();
 init_dist10();
 import { homedir as homedir9 } from "os";
-import { join as join27, resolve as resolve16 } from "path";
+import { join as join27, resolve as resolve15 } from "path";
 
 // src/config/scaffold-manifest.ts
 var SCAFFOLD_MANIFEST = [
@@ -103252,7 +103510,7 @@ If \`.spur/context/\` is absent, proceed normally. Never block work on its absen
 `;
 function globalRulesRoot(context4) {
   const override = context4.env.SPUR_GLOBAL_RULES_DIR;
-  return override !== undefined && override.length > 0 ? resolve16(context4.cwd, override) : join27(homedir9(), GLOBAL_RULES_DIR2);
+  return override !== undefined && override.length > 0 ? resolve15(context4.cwd, override) : join27(homedir9(), GLOBAL_RULES_DIR2);
 }
 async function writeIfNew(context4, path9, content, force, result) {
   if (!force && await context4.fs.exists(path9)) {
@@ -103280,7 +103538,7 @@ async function seedGlobalRules(context4) {
 }
 function resolveGlobalConfigDir(context4) {
   const globalOverride = context4.env.SPUR_GLOBAL_RULES_DIR;
-  return globalOverride !== undefined && globalOverride.length > 0 ? resolve16(context4.cwd, globalOverride) : join27(homedir9(), GLOBAL_CONFIG_DIR);
+  return globalOverride !== undefined && globalOverride.length > 0 ? resolve15(context4.cwd, globalOverride) : join27(homedir9(), GLOBAL_CONFIG_DIR);
 }
 async function seedGlobalConfig(context4) {
   const source = bundledConfigRoot();
@@ -103520,6 +103778,42 @@ ${contextEntry}
   });
 }
 
+// src/commands/maintain.ts
+init_src();
+init_src2();
+import { join as join28 } from "path";
+function registerMaintainCommand(program2, context4, options = {}) {
+  program2.command("maintain", { hidden: options.hidden === true }).summary("run database maintenance (optimize, WAL checkpoint truncation, optional VACUUM)").description("Run database maintenance: PRAGMA optimize, WAL checkpoint truncation; optionally VACUUM compaction.").option("--vacuum", "Run VACUUM defragmentation and page compaction", false).option(...SHARED_OPTIONS.jsonSupported).option(...SHARED_OPTIONS.jsonEnvelope).action(async (options2) => {
+    const db2 = await context4.getDb();
+    const dbPath = context4.env.DATABASE_URL ?? join28(context4.cwd, DEFAULT_DATABASE_URL);
+    const result = await maintainDatabase(db2, {
+      vacuum: options2.vacuum === true,
+      dbPath: dbPath.startsWith(":memory:") ? undefined : dbPath
+    });
+    context4.output.write(options2.json ? toEnvelopeJson(result, { enveloped: options2.jsonEnvelope }) : formatMaintenanceResult(result));
+    if (!result.optimized && !result.checkpointed) {
+      context4.setExitCode(1);
+    }
+  });
+}
+function formatMaintenanceResult(r) {
+  const lines = [
+    `database maintenance completed in ${r.durationMs}ms:`,
+    `  optimize: ${r.optimized ? "ok" : "failed"}`,
+    `  wal_checkpoint: ${r.checkpointed ? "ok (truncated)" : "failed"}`,
+    `  vacuum: ${r.vacuumed ? "ok" : r.vacuumSkippedReason ? `skipped (${r.vacuumSkippedReason})` : "skipped"}`
+  ];
+  if (r.vacuumed && r.bytesReclaimed > 0) {
+    const mbReclaimed = (r.bytesReclaimed / (1024 * 1024)).toFixed(2);
+    lines.push(`  reclaimed: ${mbReclaimed} MB`);
+  }
+  const mbBefore = (r.bytesBefore / (1024 * 1024)).toFixed(2);
+  const mbAfter = (r.bytesAfter / (1024 * 1024)).toFixed(2);
+  lines.push(`  size: ${mbAfter} MB (was ${mbBefore} MB)`);
+  return lines.join(`
+`);
+}
+
 // src/commands/message.ts
 init_src2();
 await init_src3();
@@ -103790,15 +104084,15 @@ async function runMessageWatch(svc, output2, options, runtime = {}) {
   }
 }
 function defaultSleep(ms, signal) {
-  return new Promise((resolve17) => {
+  return new Promise((resolve16) => {
     if (signal?.aborted) {
-      resolve17();
+      resolve16();
       return;
     }
-    const timer = setTimeout(resolve17, ms);
+    const timer = setTimeout(resolve16, ms);
     signal?.addEventListener("abort", () => {
       clearTimeout(timer);
-      resolve17();
+      resolve16();
     }, { once: true });
   });
 }
@@ -103825,15 +104119,15 @@ function parseTimeout2(raw) {
   return n3;
 }
 function sendSleep(ms, signal) {
-  return new Promise((resolve17) => {
+  return new Promise((resolve16) => {
     if (signal?.aborted) {
-      resolve17();
+      resolve16();
       return;
     }
-    const timer = setTimeout(resolve17, ms);
+    const timer = setTimeout(resolve16, ms);
     signal?.addEventListener("abort", () => {
       clearTimeout(timer);
-      resolve17();
+      resolve16();
     }, { once: true });
   });
 }
@@ -103891,10 +104185,10 @@ async function waitForPendingDrain(agentService, teamService, pin, timeoutMs, si
 
 // src/commands/migrate.ts
 init_src2();
-import { join as join28 } from "path";
+import { join as join29 } from "path";
 function registerMigrateCommand(program2, context4, options = {}) {
   program2.command("migrate", { hidden: options.hidden === true }).summary("apply CLI-owned schema migrations").option(...SHARED_OPTIONS.json).option(...SHARED_OPTIONS.jsonEnvelope).action(async (options2) => {
-    const migrations = await loadSqlMigrations(join28(context4.cwd, "drizzle")).catch(() => {
+    const migrations = await loadSqlMigrations(join29(context4.cwd, "drizzle")).catch(() => {
       return;
     });
     const applied = await applyCliMigrations(await context4.getDb(), migrations);
@@ -103906,12 +104200,12 @@ function registerMigrateCommand(program2, context4, options = {}) {
 // src/commands/projects.ts
 init_dist5();
 await init_src3();
-import { basename as basename10, resolve as resolve17 } from "path";
+import { basename as basename10, resolve as resolve16 } from "path";
 function registerProjectsCommand(program2, context4) {
   const projectsCmd = program2.command("projects").summary("manage the Spur multi-project registry");
   projectsCmd.command("add").argument("<path>", "Project root directory path").option(...SHARED_OPTIONS.nameProjectDisplay).option(...SHARED_OPTIONS.jsonProjectsResponse).option(...SHARED_OPTIONS.jsonEnvelope).action(async (pathArg, options) => {
     try {
-      const absolutePath = resolve17(context4.cwd, pathArg);
+      const absolutePath = resolve16(context4.cwd, pathArg);
       if (!await context4.fs.exists(absolutePath)) {
         throw new Error(`Directory does not exist: ${absolutePath}`);
       }
@@ -104333,7 +104627,7 @@ function formatTraceDetail(detail) {
 
 // src/commands/serve.ts
 init_src();
-import { join as join32 } from "path";
+import { join as join33 } from "path";
 
 // ../server/src/index.ts
 init_src();
@@ -104343,11 +104637,11 @@ init_src();
 init_loader();
 init_src2();
 await init_src3();
-import { basename as basename12, dirname as dirname20, isAbsolute as isAbsolute7, join as join31 } from "path";
+import { basename as basename12, dirname as dirname20, isAbsolute as isAbsolute7, join as join32 } from "path";
 init_dist5();
 
 // ../server/src/bootstrap.ts
-import { join as join29 } from "path";
+import { join as join30 } from "path";
 
 // ../../node_modules/.bun/radash@12.1.1/node_modules/radash/dist/esm/async.mjs
 var guard = (func, shouldGuard) => {
@@ -104620,8 +104914,8 @@ class EventPublisher {
       if (bufferedEvents.length > 0) {
         return { done: false, value: bufferedEvents.shift() };
       }
-      return new Promise((resolve18, reject) => {
-        pullResolvers.push([resolve18, reject]);
+      return new Promise((resolve17, reject) => {
+        pullResolvers.push([resolve17, reject]);
       });
     }, async () => {
       unsubscribe();
@@ -110265,6 +110559,7 @@ var historyKpiTrendPointSchema = exports_external.object({
 var historyTimeSeriesPointSchema = exports_external.object({
   bucketStart: exports_external.string(),
   cacheHitRatio: exports_external.number(),
+  gainRatio: exports_external.number().optional(),
   series: exports_external.record(exports_external.string(), exports_external.number())
 });
 var historyTopItemSchema = exports_external.object({
@@ -113767,7 +114062,7 @@ function createApp(appRt, opts) {
     app.use("*", async (c3, next) => {
       const pathname = c3.req.path === "/" ? "/index.html" : c3.req.path;
       try {
-        const file2 = Bun.file(join29(webDistPath, pathname));
+        const file2 = Bun.file(join30(webDistPath, pathname));
         if (await file2.exists()) {
           const headers = new Headers({ "content-type": file2.type });
           return new Response(file2.stream(), { headers });
@@ -113780,7 +114075,7 @@ function createApp(appRt, opts) {
         return c3.json({ error: "Not Found" }, 404);
       }
       try {
-        const indexFile = Bun.file(join29(webDistPath, "index.html"));
+        const indexFile = Bun.file(join30(webDistPath, "index.html"));
         if (await indexFile.exists()) {
           return new Response(indexFile.stream(), {
             headers: { "content-type": "text/html; charset=utf-8" }
@@ -113801,7 +114096,7 @@ init_src();
 init_src2();
 init_dist5();
 await init_src3();
-import { dirname as dirname19, join as join30 } from "path";
+import { dirname as dirname19, join as join31 } from "path";
 var NOOP_OUTPUT = { write: (_s) => {}, error: (_s) => {} };
 
 class LazyPlanningEventEmitter {
@@ -113837,7 +114132,7 @@ class NotConfiguredError extends Error {
 function createServerContext(appRt, options) {
   const cwd = options.cwd;
   const fs3 = options.fs;
-  const dbUrl = options.dbUrl ?? join30(cwd, DEFAULT_DATABASE_URL);
+  const dbUrl = options.dbUrl ?? join31(cwd, DEFAULT_DATABASE_URL);
   const eventsBus = options.eventsBus ?? appRt.events;
   const jobQueueEnabled = options.jobQueueEnabled ?? false;
   const eventProjectContext = systemEventProjectContext(cwd);
@@ -114123,7 +114418,7 @@ async function loadServerSectionMatrix() {
   }
   const root = bundledConfigRoot();
   if (root !== null) {
-    const matrixPath = join31(root, "tasks", "section-matrix.yaml");
+    const matrixPath = join32(root, "tasks", "section-matrix.yaml");
     if (await nodeFs.exists(matrixPath)) {
       return await loadStructuredSpurConfig(matrixPath, {
         validateJsonSchema: false
@@ -114132,7 +114427,7 @@ async function loadServerSectionMatrix() {
   }
   throw new Error(`no canonical section-matrix found for task creation (F92 R1); tried:
 ` + `  - ${localPath}
-` + (root !== null ? `  - ${join31(root, "tasks", "section-matrix.yaml")}
+` + (root !== null ? `  - ${join32(root, "tasks", "section-matrix.yaml")}
 ` : "") + "copy/generate section-matrix.yaml from the canonical build-time matrix asset (repo `config` `tasks` tree) into one of those paths");
 }
 var SYSTEM_EVENTS_PRUNE_JOB = "system-events-prune";
@@ -114270,15 +114565,15 @@ async function handleFeatureActionJob(ctx, env, payload) {
   await runFeatureActionJob(ctx, env, payload);
 }
 async function resolveWebDistPath(configuredPath) {
-  const candidates = configuredPath && configuredPath.trim() !== "" ? [isAbsolute7(configuredPath) ? configuredPath : join31(process.cwd(), configuredPath)] : [
-    join31(process.cwd(), "dist/web"),
-    join31(import.meta.dir, "web"),
-    join31(dirname20(process.execPath), "web"),
-    join31(dirname20(process.execPath), "../web"),
-    join31(import.meta.dir, "../../../dist/web")
+  const candidates = configuredPath && configuredPath.trim() !== "" ? [isAbsolute7(configuredPath) ? configuredPath : join32(process.cwd(), configuredPath)] : [
+    join32(process.cwd(), "dist/web"),
+    join32(import.meta.dir, "web"),
+    join32(dirname20(process.execPath), "web"),
+    join32(dirname20(process.execPath), "../web"),
+    join32(import.meta.dir, "../../../dist/web")
   ];
   for (const candidate of candidates) {
-    if (await Bun.file(join31(candidate, "index.html")).exists()) {
+    if (await Bun.file(join32(candidate, "index.html")).exists()) {
       return candidate;
     }
   }
@@ -114442,7 +114737,7 @@ if (false) {}
 
 // src/commands/serve.ts
 function resolveServeDbUrl(cwd, env, configuredUrl) {
-  return env.DATABASE_URL === undefined ? join32(cwd, DEFAULT_DATABASE_URL) : configuredUrl;
+  return env.DATABASE_URL === undefined ? join33(cwd, DEFAULT_DATABASE_URL) : configuredUrl;
 }
 function registerServeCommand(program2, context4, options = {}) {
   program2.command("serve", { hidden: options.hidden === true }).summary("start the Spur web server (local fallback)").option(...SHARED_OPTIONS.portServe, parseInt).option("--host <addr>", "Bind address (env: HOST, default: localhost)").option("--no-open", "Skip opening the browser").option(...SHARED_OPTIONS.cwdServe, context4.cwd).option(...SHARED_OPTIONS.jsonServePortUrl).option(...SHARED_OPTIONS.jsonEnvelope).action(async (options2) => {
@@ -114482,7 +114777,7 @@ function registerServeCommand(program2, context4, options = {}) {
 }
 
 // src/commands/status.ts
-import { join as join33 } from "path";
+import { join as join34 } from "path";
 
 // src/errors.ts
 class CommandError extends Error {
@@ -114553,8 +114848,8 @@ function registerStatusCommand(program2, context4, options = {}) {
 }
 async function runStatusCore(path9, options, context4) {
   const [packageJsonExists, spurConfigExists, git3, agentSpecs] = await Promise.all([
-    context4.fs.exists(join33(context4.cwd, "package.json")),
-    context4.fs.exists(join33(context4.cwd, ".spur", "config.yaml")),
+    context4.fs.exists(join34(context4.cwd, "package.json")),
+    context4.fs.exists(join34(context4.cwd, ".spur", "config.yaml")),
     gitContext(context4.cwd),
     listAgentSpecIds(context4)
   ]);
@@ -114582,14 +114877,14 @@ async function runStatusCore(path9, options, context4) {
   return status.ok ? 0 : 1;
 }
 async function listAgentSpecIds(context4) {
-  const dir = join33(context4.cwd, ".spur", "agents");
+  const dir = join34(context4.cwd, ".spur", "agents");
   if (!await context4.fs.exists(dir))
     return [];
   const entries = await context4.fs.readDir(dir);
   return entries.filter((entry) => entry.endsWith(".yaml") || entry.endsWith(".yml")).map((entry) => entry.replace(/\.ya?ml$/, "")).sort();
 }
 async function readTargetStatus(context4, targetPath) {
-  const resolved = join33(context4.cwd, targetPath);
+  const resolved = join34(context4.cwd, targetPath);
   const stat = await context4.fs.stat(resolved);
   if (stat === null)
     throw new CommandError(`status failed: path does not exist at ${resolved}`);
@@ -114601,8 +114896,8 @@ init_loader();
 init_src2();
 init_dist5();
 await init_src3();
-import { existsSync as existsSync12, readFileSync as readFileSync12 } from "fs";
-import { dirname as dirname21, join as join34 } from "path";
+import { existsSync as existsSync11, readFileSync as readFileSync11 } from "fs";
+import { dirname as dirname21, join as join35 } from "path";
 // schemas/section-matrix.schema.json
 var section_matrix_schema_default = {
   $schema: "http://json-schema.org/draft-07/schema#",
@@ -115704,7 +115999,7 @@ ${result.content}`);
         let forcedDoneVerdict;
         if (status === "done") {
           const current = await svc.show(wbs);
-          const verdictDir = options.verdictDir ?? join34(context4.cwd, ".spur", "run");
+          const verdictDir = options.verdictDir ?? join35(context4.cwd, ".spur", "run");
           const loaded = await readVerdictArtifact(context4.fs, verdictDir, wbs);
           const guardOutcome = evaluateDoneTransition({
             wbs,
@@ -116150,73 +116445,42 @@ ${result.content}`);
       context4.setExitCode(1);
     }
   });
-  task.command("check").summary("Validate a task file through the four-layer check (design \xA73).").argument("[wbs]", "Task WBS number (validates all tasks in the folder when omitted)").option(...SHARED_OPTIONS.strictTaskAll).option("--strict-core", "Compatibility alias (F92 R2): historically the done-gate label; kept so installed plugins/workflows that call it keep working. No longer meaningful on its own \u2014 target-state selection (`--as`) supplies the real done semantics.").option(...SHARED_OPTIONS.asTaskF92).option("--corpus", "Sweep every task and feature against config/corpus-baseline.json").option("--since <ref>", "Scope the corpus fog check to changes since a git ref (requires --corpus)").option("--fix", "repair structural findings in place (heading presence/level/order; adds missing R-item checkbox markers \u2014 flipping verified boxes is task record's job, not --fix)").option(...SHARED_OPTIONS.folderTasks).option(...SHARED_OPTIONS.json).option(...SHARED_OPTIONS.jsonEnvelope).action(async (wbs, options) => {
+  task.command("check").summary("Validate a task file through the four-layer check (design \xA73).").argument("[wbs]", "Task WBS number (validates all tasks in the folder when omitted)").option("--corpus", "Explicit unsuppressed audit of active tasks and features; warnings are advisory").option("--since <ref>", "Scope the corpus fog comparison to changes since a git ref (requires --corpus)").option(...SHARED_OPTIONS.strictTaskAll).option("--strict-core", "Compatibility alias (F92 R2): historically the done-gate label; kept so installed plugins/workflows that call it keep working. No longer meaningful on its own \u2014 target-state selection (`--as`) supplies the real done semantics.").option(...SHARED_OPTIONS.asTaskF92).option("--fix", "repair structural findings in place (heading presence/level/order; adds missing R-item checkbox markers \u2014 flipping verified boxes is task record's job, not --fix)").option(...SHARED_OPTIONS.folderTasks).option(...SHARED_OPTIONS.json).option(...SHARED_OPTIONS.jsonEnvelope).action(async (wbs, options) => {
     const json3 = options.json === true;
     const strict = options.strict === true;
-    const asStatus = options.as === undefined ? undefined : canonicalStatusOrRaw(options.as);
-    if (options.as !== undefined && !TASK_STATUSES.includes(asStatus ?? "")) {
-      writeJsonError(context4.output, options, `invalid --as status "${options.as}" (canonical: ${TASK_STATUSES.join(", ")})`, "VALIDATION_FAILED");
-      context4.setExitCode(2);
-      return;
-    }
-    if (asStatus !== undefined && options.corpus === true) {
-      writeJsonError(context4.output, options, "--as <status> is a single-task target projection and cannot be combined with --corpus", "VALIDATION_FAILED");
-      context4.setExitCode(2);
-      return;
-    }
-    if (options.fix === true && options.corpus === true) {
-      writeJsonError(context4.output, options, "--fix repairs files in place and cannot be combined with --corpus", "VALIDATION_FAILED");
+    if (options.since !== undefined && !options.corpus || options.corpus && (wbs || options.as || options.fix || options.folder || strict || options.strictCore) || options.since?.startsWith("-")) {
+      writeJsonError(context4.output, options, "--corpus accepts only --since and JSON output options; --since requires --corpus and a git ref", "VALIDATION_FAILED");
       context4.setExitCode(2);
       return;
     }
-    try {
-      if (options.corpus === true) {
-        if (wbs !== undefined) {
-          writeJsonError(context4.output, options, "--corpus validates the whole corpus and cannot be combined with a WBS", "VALIDATION_FAILED");
-          context4.setExitCode(2);
-          return;
-        }
-        if (String(options.since ?? "").startsWith("-")) {
-          writeJsonError(context4.output, options, "--since requires a git ref value (e.g. --since HEAD~1)", "VALIDATION_FAILED");
-          context4.setExitCode(2);
-          return;
-        }
-        if (options.since !== undefined) {
-          const fogRange = await resolveFogRange(context4.cwd, options.since);
-          if ("skip" in fogRange) {
-            context4.output.error(`corpus-check: fog check SKIPPED (${fogRange.skip}) \u2014 range ${fogRange.spec} was not evaluated.`);
-          }
-        }
-        const result = await runCorpusCheck(context4.cwd, options.since);
+    if (options.corpus) {
+      try {
+        const result = await runCorpusCheck(context4.cwd, options.since, context4.output.error.bind(context4.output));
         if (json3) {
           context4.output.write(toEnvelopeJson(result, { enveloped: options.jsonEnvelope }));
         } else {
-          const e = result.bySeverity.error;
-          const w = result.bySeverity.warning;
-          context4.output.write(`corpus-check: swept tasks + features \u2014 errors ${e.observed} observed, ` + `${e.baselined} baselined, ${e.newCount} new; ` + `warnings ${w.observed} observed, ${w.baselined} baselined, ` + `${w.newCount} new.`);
-          for (const error51 of result.newErrors) {
-            context4.output.error(`  NEW    [error]   ${error51.kind} ${error51.id}: ${error51.code} \u2014 ${error51.message}`);
-          }
-          for (const warning of result.newWarnings) {
-            context4.output.error(`  NEW    [warning] ${warning.kind} ${warning.id}: ${warning.code} \u2014 ${warning.message}`);
+          context4.output.write(`corpus-check: ${result.newErrors.length} errors, ${result.newWarnings.length} warnings; no suppressions. Use --json for full findings.`);
+          for (const finding of result.newErrors) {
+            writeJsonError(context4.output, options, `${finding.kind}:${finding.id}:${finding.code}: ${finding.message}`);
           }
-          for (const dup of result.duplicateKeys) {
-            context4.output.error(`  DUP    ${dup.key} \u2014 ${dup.count} entries for one key; reconciliation is key-addressed, ` + "so the extras over-cover and hide a partial reduction. Keep one entry per key.");
-          }
-          context4.output.write(result.ok ? "corpus-check OK \u2014 no corpus errors or warnings outside the accepted baseline." : "corpus-check FAILED \u2014 fix the new findings above, or accept them by regenerating the snapshot: bun run scripts/commands/regen-corpus-baseline.ts.");
         }
         if (!result.ok)
           context4.setExitCode(1);
-        return;
-      }
-      if (options.since !== undefined) {
-        writeJsonError(context4.output, options, "--since requires --corpus", "VALIDATION_FAILED");
-        context4.setExitCode(2);
-        return;
+      } catch (err) {
+        writeJsonError(context4.output, options, String(err));
+        context4.setExitCode(1);
       }
+      return;
+    }
+    const asStatus = options.as === undefined ? undefined : canonicalStatusOrRaw(options.as);
+    if (options.as !== undefined && !TASK_STATUSES.includes(asStatus ?? "")) {
+      writeJsonError(context4.output, options, `invalid --as status "${options.as}" (canonical: ${TASK_STATUSES.join(", ")})`, "VALIDATION_FAILED");
+      context4.setExitCode(2);
+      return;
+    }
+    try {
       const svc = await makeCheckService(context4);
       const planningFolders = await resolvePlanningFolders(context4.fs);
-      const accepted = await loadAcceptedFindings(context4.cwd);
       const activeFolder = planningFolders.foldersConfig.active_folder;
       const tasksDir = context4.fs.resolve(options.folder ?? activeFolder);
       const printResult = (result) => {
@@ -116250,7 +116514,6 @@ ${result.wbs} (${result.status}): ${result.pass ? "PASS" : "FAIL"}`);
             strict,
             asStatus,
             severityOverrides: planningFolders.severityOverrides,
-            accepted,
             fix: options.fix === true
           });
           results.push(result);
@@ -116270,7 +116533,6 @@ ${result.wbs} (${result.status}): ${result.pass ? "PASS" : "FAIL"}`);
             strict,
             asStatus,
             severityOverrides: planningFolders.severityOverrides,
-            accepted,
             fix: options.fix === true
           });
           results.push(result);
@@ -116420,15 +116682,15 @@ function loadTemplateBodies(projectRoot, variant) {
   if (cached2 !== undefined)
     return cached2;
   let bodies = {};
-  const localPath = join34(projectRoot, ".spur", "tasks", "templates", `${variant}.md`);
-  if (existsSync12(localPath)) {
-    bodies = extractTemplateBodies(readFileSync12(localPath, "utf8"));
+  const localPath = join35(projectRoot, ".spur", "tasks", "templates", `${variant}.md`);
+  if (existsSync11(localPath)) {
+    bodies = extractTemplateBodies(readFileSync11(localPath, "utf8"));
   } else {
     const root = bundledConfigRoot();
     if (root !== null) {
-      const templatePath = join34(root, "templates", "task", `${variant}.md`);
-      if (existsSync12(templatePath)) {
-        bodies = extractTemplateBodies(readFileSync12(templatePath, "utf8"));
+      const templatePath = join35(root, "templates", "task", `${variant}.md`);
+      if (existsSync11(templatePath)) {
+        bodies = extractTemplateBodies(readFileSync11(templatePath, "utf8"));
       }
     }
   }
@@ -116455,12 +116717,10 @@ async function runDoneGateCheck(context4, wbs, folderOverride, targetStatus) {
     return false;
   }
   const svc = new TaskCheckService(context4.fs, await loadSectionMatrix(context4.cwd), await makeTaskLocator(context4));
-  const accepted = await loadAcceptedFindings(context4.cwd);
   const result = await svc.check(hit.filePath, wbs, {
     strict: false,
     asStatus: targetStatus,
-    severityOverrides: planningFolders.severityOverrides,
-    accepted
+    severityOverrides: planningFolders.severityOverrides
   });
   return result.pass;
 }
@@ -116486,7 +116746,7 @@ async function loadSectionMatrixUncached(projectRoot) {
   }
   const root = bundledConfigRoot();
   if (root !== null) {
-    const matrixPath = join34(root, "tasks", "section-matrix.yaml");
+    const matrixPath = join35(root, "tasks", "section-matrix.yaml");
     if (await fs3.exists(matrixPath)) {
       const data = await loadStructuredSpurConfig(matrixPath, {
         validateJsonSchema: true,
@@ -116497,7 +116757,7 @@ async function loadSectionMatrixUncached(projectRoot) {
   }
   throw new Error(`no canonical section-matrix found for task section authority (F92 R1); tried:
 ` + `  - ${localPath}
-` + (root !== null ? `  - ${join34(root, "tasks", "section-matrix.yaml")}
+` + (root !== null ? `  - ${join35(root, "tasks", "section-matrix.yaml")}
 ` : "") + "copy/generate section-matrix.yaml from the canonical build-time matrix asset (repo `config` `tasks` tree) into one of those paths");
 }
 
@@ -116780,13 +117040,13 @@ async function runTeamDown(team, options, context4) {
 }
 
 // src/commands/workflow.ts
+init_capability_attestation();
 init_loader();
-init_dist8();
 init_dist7();
 init_dist5();
 await init_src3();
 import { closeSync as closeSync5, fstatSync as fstatSync3, openSync as openSync5, readSync as readSync3 } from "fs";
-import { join as join35 } from "path";
+import { join as join36 } from "path";
 import { createInterface } from "readline";
 import { setTimeout as sleep5 } from "timers/promises";
 
@@ -116878,7 +117138,7 @@ function markWorkflowRunActive() {
 function clearWorkflowRunActive() {
   delete process.env[WORKFLOW_RUN_ACTIVE_ENV];
 }
-async function spawnAsyncWorkflowWorker(spurBin, cmd) {
+async function spawnAsyncWorkflowWorker(spurBin, cmd, extraEnv) {
   const line = [spurBin, ...cmd].map(shQuote2).join(" ");
   const env = {};
   for (const [key2, value2] of Object.entries(process.env)) {
@@ -116886,6 +117146,9 @@ async function spawnAsyncWorkflowWorker(spurBin, cmd) {
       env[key2] = value2;
   }
   env.SPUR_ASYNC_WORKER = "1";
+  for (const [key2, value2] of Object.entries(extraEnv ?? {})) {
+    env[key2] = value2;
+  }
   await new NodeProcessExecutor3().run({
     command: process.platform === "win32" ? "cmd" : "/bin/sh",
     args: process.platform === "win32" ? ["/c", `start /b "" ${[spurBin, ...cmd].map((c3) => `"${c3.replace(/"/g, '""')}"`).join(" ")}`] : ["-c", `nohup ${line} </dev/null >/dev/null 2>&1 &`],
@@ -116939,6 +117202,35 @@ async function waitForRunRegistration(service, runId, timeoutMs = asyncRegisterT
     }
   }
 }
+function expectedDigestMismatch(resolvedDigest, expectedDigest) {
+  if (expectedDigest === undefined)
+    return null;
+  if (resolvedDigest !== expectedDigest) {
+    return "workflow run: refusing to start \u2014 resolved definition digest " + `${resolvedDigest ?? "<resolution failed>"} differs from the expected digest ` + `${expectedDigest} sent by the async launcher`;
+  }
+  return null;
+}
+async function writeWorkflowPlanArtifact(cwd, runId, resolved, secretValues) {
+  const def = resolved.workflow;
+  const payload = toJson2({
+    runId,
+    name: def.name,
+    kind: def.kind ?? "state-machine",
+    format: "todo",
+    version: def.version ?? null,
+    definitionDigest: resolved.digest,
+    steps: buildWorkflowSteps(def).map((step) => ({
+      ...step,
+      ...step.description !== undefined ? { description: redactAndBound(step.description, secretValues, 512) } : {}
+    }))
+  });
+  const { mkdir, writeFile } = await import("fs/promises");
+  const artifactsDir = join36(cwd, ".spur", "run");
+  await mkdir(artifactsDir, { recursive: true });
+  const artifactPath = join36(artifactsDir, `${runId}-workflow-plan.json`);
+  await writeFile(artifactPath, payload);
+  return artifactPath;
+}
 async function makeEscalationPacketSink(bus, context4) {
   try {
     let locator;
@@ -116993,7 +117285,7 @@ function resolveWorkflowPaths(config4) {
   for (const path9 of paths) {
     if (path9.startsWith(BUNDLED_PATH_PREFIX)) {
       if (bundledRoot !== null)
-        expanded.push(join35(bundledRoot, path9.slice(BUNDLED_PATH_PREFIX.length)));
+        expanded.push(join36(bundledRoot, path9.slice(BUNDLED_PATH_PREFIX.length)));
     } else {
       expanded.push(path9);
     }
@@ -117027,14 +117319,11 @@ function registerWorkflowCommand(program2, context4) {
     } else if (result.valid) {
       context4.output.write(`workflow valid: ${result.workflow.name} (${formatWorkflowVersion(result.workflow.version)})`);
       const c3 = result.composition;
-      if (c3 && (c3.findings.length > 0 || c3.suppressed > 0)) {
+      if (c3 && c3.findings.length > 0) {
         for (const f of c3.findings) {
           const m = f.measure.kind === "shell-lines" ? `${f.measure.measured} shell lines (threshold ${f.measure.threshold})` : `${f.measure.measured} prompt chars (severity ${f.measure.severity})`;
           context4.output.error(`composition advisory: ${f.actionKey} \u2014 ${m} \u2014 ${f.recommendation}`);
         }
-        if (c3.suppressed > 0) {
-          context4.output.error(`composition advisory: ${c3.suppressed} shell finding(s) suppressed by baseline dispositions (guards excluded wholesale; docs/design/workflow-shell-ownership.md)`);
-        }
       }
     } else {
       context4.output.error(`workflow invalid: ${result.file}
@@ -117071,9 +117360,9 @@ ${result.errors.map((m) => `  - ${m}`).join(`
     const detail = options.verbose === true ? "full" : requestedDetail ?? "invocation";
     if (process.env[WORKFLOW_RUN_ACTIVE_ENV] === "1") {
       writeJsonError(context4.output, options, `workflow run: refusing to start \u2014 already inside an active workflow run (${WORKFLOW_RUN_ACTIVE_ENV}=1).
-` + `A pipeline that starts another pipeline forks a worktree and an agent run per level, without bound.
-` + `If you are an agent running inside a pipeline step: do NOT start a pipeline here. Report what you
-` + "needed and let the operator run it from a clean shell.", "VALIDATION_FAILED");
+A pipeline that starts another pipeline forks a worktree and an agent run per level, without bound.
+If you are an agent running inside a pipeline step: do NOT start a pipeline here. Report what you
+needed and let the operator run it from a clean shell.`, "VALIDATION_FAILED");
       context4.setExitCode(1);
       return;
     }
@@ -117106,8 +117395,22 @@ ${result.errors.map((m) => `  - ${m}`).join(`
       if (options.log === false) {
         cmd.push("--no-log");
       }
+      let resolvedDefinition2;
+      let planArtifactPath;
+      try {
+        resolvedDefinition2 = await resolveWorkflowDefinition(context4.cwd, file2, {
+          embeddedSchemas: EMBEDDED_SPUR_SCHEMAS
+        });
+        planArtifactPath = await writeWorkflowPlanArtifact(context4.cwd, runId2, resolvedDefinition2, configuredSecretValues(context4.env));
+      } catch (error51) {
+        writeJsonError(context4.output, options, `workflow run --async: ${error51 instanceof Error ? error51.message : String(error51)}`, "VALIDATION_FAILED");
+        context4.setExitCode(1);
+        return;
+      }
       try {
-        await spawnAsyncWorkflowWorker(spurBin, cmd);
+        await spawnAsyncWorkflowWorker(spurBin, cmd, {
+          SPUR_EXPECTED_DEFINITION_DIGEST: resolvedDefinition2.digest
+        });
       } catch {
         markWorkflowRunActive();
         let result2;
@@ -117115,7 +117418,8 @@ ${result.errors.map((m) => `  - ${m}`).join(`
           result2 = await makeSvc(options.json).run(file2, {
             runId: runId2,
             vars: { spurBin: resolveSpurBin(), ...parseVars(options.vars) },
-            dryRun: options.dryRun || undefined
+            dryRun: options.dryRun || undefined,
+            resolvedDefinition: resolvedDefinition2
           });
         } finally {
           clearWorkflowRunActive();
@@ -117140,11 +117444,15 @@ ${result.errors.map((m) => `  - ${m}`).join(`
         context4.setExitCode(1);
         return;
       }
-      const asyncResult = { runId: runId2, status: "started", workflowName: file2 };
+      try {
+        await makeSvc(options.json).stampPlanArtifactPath(runId2, planArtifactPath);
+      } catch {}
+      const asyncResult = { runId: runId2, status: "started", workflowName: file2, planArtifactPath };
       if (json3)
         context4.output.write(toEnvelopeJson(asyncResult, { enveloped: options.jsonEnvelope }));
       else if (!silent) {
         context4.output.write(`Started async run: ${runId2}
+Plan: ${planArtifactPath}
 Monitor with: spur workflow trace ${runId2} --follow`);
       }
       context4.setExitCode(0);
@@ -117172,19 +117480,49 @@ Monitor with: spur workflow trace ${runId2} --follow`);
       traceWriter = new WorkflowTraceWriter(context4.cwd, runId);
       traceWriter.attach(bus);
     }
-    let planPreview;
-    if (options.plan !== false) {
+    const expectedDigest = process.env.SPUR_EXPECTED_DEFINITION_DIGEST;
+    let resolvedDefinition;
+    if (options.plan !== false || expectedDigest !== undefined) {
       try {
-        const resolved = resolveWorkflowFile(context4.cwd, file2);
-        if (resolved.path !== null) {
-          const def = await loadWorkflowDef(resolved.path, { validateSchema: false });
-          planPreview = renderRunPlan(def);
+        resolvedDefinition = await resolveWorkflowDefinition(context4.cwd, file2, {
+          embeddedSchemas: EMBEDDED_SPUR_SCHEMAS
+        });
+      } catch (error51) {
+        if (expectedDigest !== undefined) {
+          writeJsonError(context4.output, options, `workflow run: refusing to start \u2014 ${error51 instanceof Error ? error51.message : String(error51)}`, "VALIDATION_FAILED");
+          context4.setExitCode(1);
+          return;
         }
-      } catch {}
+      }
+    }
+    const mismatch = expectedDigestMismatch(resolvedDefinition?.digest, expectedDigest);
+    if (mismatch !== null) {
+      writeJsonError(context4.output, options, mismatch, "VALIDATION_FAILED");
+      context4.setExitCode(1);
+      return;
+    }
+    let planPreview;
+    if (options.plan !== false && resolvedDefinition !== undefined) {
+      planPreview = renderRunPlan(resolvedDefinition.workflow);
+    }
+    if (resolvedDefinition !== undefined) {
+      const executors = context4.spurConfig?.agent?.executors;
+      const flow = resolvedDefinition.workflow;
+      const agentRunActions = flow.kind === "transition-flow" ? flow.nodes.flatMap((node) => node.action?.kind === "agent.run" ? [node.action] : []) : flow.states.flatMap((state) => (state.onEnter ?? []).filter((a2) => a2.kind === "agent.run"));
+      for (const action of agentRunActions) {
+        const pin = action.options?.agent;
+        const requires = parseRequiresCapabilities(action.options?.requiresCapabilities);
+        if (typeof pin !== "string" || !requires.ok)
+          continue;
+        const evaluation = evaluateCapabilities(requires.requires, executors?.find((e) => e.name === pin));
+        if (!evaluation.ok) {
+          context4.output.error(`Warning: capability preflight (0777 R4): ${capabilityDiagnostic(pin, evaluation)}`);
+        }
+      }
     }
     const runLog = options.log === false ? undefined : new WorkflowRunLogSink({
       bus,
-      dir: join35(context4.cwd, ".spur", "run"),
+      dir: join36(context4.cwd, ".spur", "run"),
       runId,
       ...planPreview !== undefined ? { planPreview } : {},
       ...resolveOutputLogConfig(context4.spurConfig ?? null)
@@ -117234,15 +117572,9 @@ Monitor with: spur workflow trace ${runId2} --follow`);
     }
     const steeringController = options.steer === true ? await (async () => {
       let identity7;
-      try {
-        const resolved = resolveWorkflowFile(context4.cwd, file2);
-        if (resolved.path !== null) {
-          const def = await loadWorkflowDef(resolved.path, {
-            validateSchema: false
-          });
-          identity7 = createWorkflowEventIdentity(def);
-        }
-      } catch {}
+      if (resolvedDefinition !== undefined) {
+        identity7 = createWorkflowEventIdentity(resolvedDefinition.workflow);
+      }
       return new WorkflowSteeringController((ack) => {
         bus.emit("workflow.steering", identity7 === undefined ? ack : decorateWorkflowEvent(identity7, "workflow.steering", ack));
         context4.output.write(`[steer] ${ack.accepted ? "ack" : "nack"} ${ack.operation} \xB7 ${ack.reason ?? `version=${ack.version}`}`);
@@ -117264,7 +117596,8 @@ Monitor with: spur workflow trace ${runId2} --follow`);
         vars,
         dryRun: options.dryRun || undefined,
         recordSelfPid: process.env.SPUR_ASYNC_WORKER === "1",
-        ...steeringController !== undefined ? { steeringController } : {}
+        ...steeringController !== undefined ? { steeringController } : {},
+        ...resolvedDefinition !== undefined ? { resolvedDefinition } : {}
       });
     } finally {
       clearWorkflowRunActive();
@@ -117342,7 +117675,7 @@ Monitor with: spur workflow trace ${runId2} --follow`);
       ledger.unsubscribe();
     }
   });
-  workflow.command("clean").description("Housekeeping: finalize orphaned runs stuck in running/pending past a staleness threshold " + "(mark as failed) and reclaim retained run logs older than workflow.logRetentionDays. " + "`--logs` scopes to log reclamation only. To cancel a single live run by id, use " + "`spur workflow cancel <run-id>` instead.").option("--older-than <minutes>", "Staleness threshold in minutes (stale-run scope only)", "30").option(...SHARED_OPTIONS.forceWorkflowClean).option("--logs", "Scope to retained run-log reclamation only (skip stale-run finalization)").option(...SHARED_OPTIONS.dryRunWorkflowClean).option(...SHARED_OPTIONS.jsonSupported).option(...SHARED_OPTIONS.jsonEnvelope).action(async (options) => {
+  workflow.command("clean").description("Housekeeping: finalize orphaned runs stuck in running/pending past a staleness threshold (mark as failed) and reclaim retained run logs older than workflow.logRetentionDays. `--logs` scopes to log reclamation only. To cancel a single live run by id, use `spur workflow cancel <run-id>` instead.").option("--older-than <minutes>", "Staleness threshold in minutes (stale-run scope only)", "30").option(...SHARED_OPTIONS.forceWorkflowClean).option("--logs", "Scope to retained run-log reclamation only (skip stale-run finalization)").option(...SHARED_OPTIONS.dryRunWorkflowClean).option(...SHARED_OPTIONS.jsonSupported).option(...SHARED_OPTIONS.jsonEnvelope).action(async (options) => {
     const dryRun = options.dryRun === true;
     const logsOnly = options.logs === true;
     const force = options.force === true;
@@ -117441,21 +117774,25 @@ Monitor with: spur workflow trace ${runId2} --follow`);
       context4.setExitCode(1);
       return;
     }
-    const filePath = resolved.path;
-    let def;
+    let resolvedDefinition;
     try {
-      def = await loadWorkflowDef(filePath, { validateSchema: true });
+      resolvedDefinition = await resolveWorkflowDefinition(context4.cwd, file2, {
+        embeddedSchemas: EMBEDDED_SPUR_SCHEMAS
+      });
     } catch (err) {
       writeJsonError(context4.output, options, `workflow show: cannot read or parse ${file2} \u2014 ${err instanceof Error ? err.message : String(err)}`, "VALIDATION_FAILED");
       context4.setExitCode(1);
       return;
     }
+    const def = resolvedDefinition.workflow;
     if (options.json) {
       if (options.format === "todo") {
         context4.output.write(toJson2({
           name: def.name,
           kind: def.kind ?? "state-machine",
           format: "todo",
+          version: resolvedDefinition.workflow.version ?? null,
+          definitionDigest: resolvedDefinition.digest,
           steps: buildWorkflowSteps(def)
         }));
       } else {
@@ -117463,6 +117800,8 @@ Monitor with: spur workflow trace ${runId2} --follow`);
           name: def.name,
           kind: def.kind ?? "state-machine",
           format: "mermaid",
+          version: resolvedDefinition.workflow.version ?? null,
+          definitionDigest: resolvedDefinition.digest,
           diagram: renderWorkflowMermaid(def)
         }));
       }
@@ -117710,7 +118049,7 @@ function readRunLogChunk(logPath, offset) {
   }
 }
 async function followRunLog(service, runId, dir, pollMs, write, wait = (ms) => sleep5(ms)) {
-  const logPath = join35(dir, ".spur", "run", `${runId}.log`);
+  const logPath = join36(dir, ".spur", "run", `${runId}.log`);
   let offset = 0;
   let everRead = false;
   while (true) {
@@ -117773,7 +118112,7 @@ init_src();
 init_src2();
 init_dist5();
 await init_src3();
-import { dirname as dirname22, join as join36, resolve as resolve18 } from "path";
+import { dirname as dirname22, join as join37, resolve as resolve17 } from "path";
 import { isatty as isatty4 } from "tty";
 
 // ../../node_modules/.bun/@clack+core@1.4.1/node_modules/@clack/core/dist/index.mjs
@@ -119188,7 +119527,7 @@ function resolveAgentRoles(agentConfig) {
   return resolved;
 }
 function createCliContext(options) {
-  const cwd = resolve18(options.cwd ?? process.cwd());
+  const cwd = resolve17(options.cwd ?? process.cwd());
   const env = options.env ?? process.env;
   const fs3 = createNodeFileSystem3(cwd);
   const agentConfig = options.agentConfig ?? options.spurConfig?.agent;
@@ -119236,7 +119575,7 @@ function createCliContext(options) {
 function noopSetExitCode(_code) {}
 async function createMigratedDbAdapter(cwd = process.cwd(), env = process.env, dbUrl) {
   const config4 = buildConfigFromEnv(env);
-  const configuredUrl = env.DATABASE_URL === undefined ? join36(cwd, DEFAULT_DATABASE_URL) : config4.database.url;
+  const configuredUrl = env.DATABASE_URL === undefined ? join37(cwd, DEFAULT_DATABASE_URL) : config4.database.url;
   const url2 = dbUrl ?? configuredUrl;
   if (url2 !== IN_MEMORY_DATABASE_URL) {
     await createNodeFileSystem3().ensureDir(dirname22(url2));
@@ -119317,10 +119656,12 @@ async function runCommandDispatch(argv, context4, output2) {
   registerRuleCommand(program2, context4);
   const selfCommand = program2.command("self").summary("inspect and manage the Spur installation itself");
   registerInitCommand(selfCommand, context4);
+  registerMaintainCommand(selfCommand, context4);
   registerMigrateCommand(selfCommand, context4);
   registerServeCommand(selfCommand, context4);
   registerStatusCommand(selfCommand, context4);
   registerInitCommand(program2, context4, { hidden: true });
+  registerMaintainCommand(program2, context4, { hidden: true });
   registerMigrateCommand(program2, context4, { hidden: true });
   registerServeCommand(program2, context4, { hidden: true });
   registerStatusCommand(program2, context4, { hidden: true });