@hasna/todos 0.11.66 → 0.11.67

package/dist/cli/index.js

@@ -1011,7 +1011,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
         this._exitCallback = (err) => {
           if (err.code !== "commander.executeSubCommandAsync") {
             throw err;
-          } else {}
+          }
         };
       }
       return this;
@@ -3266,6 +3266,22 @@ var init_migrations = __esm(() => {
   CREATE INDEX IF NOT EXISTS idx_task_findings_source ON task_findings(source);
   CREATE INDEX IF NOT EXISTS idx_task_findings_fingerprint ON task_findings(fingerprint);
   INSERT OR IGNORE INTO _migrations (id) VALUES (62);
+  `,
+    `
+  CREATE TABLE IF NOT EXISTS storage_tombstones (
+    id TEXT PRIMARY KEY,
+    object_type TEXT NOT NULL,
+    object_id TEXT NOT NULL,
+    deleted_at TEXT NOT NULL,
+    updated_at TEXT NOT NULL,
+    source_machine_id TEXT,
+    payload TEXT,
+    version INTEGER,
+    UNIQUE(object_type, object_id)
+  );
+  CREATE INDEX IF NOT EXISTS idx_storage_tombstones_object ON storage_tombstones(object_type, object_id);
+  CREATE INDEX IF NOT EXISTS idx_storage_tombstones_updated ON storage_tombstones(updated_at);
+  INSERT OR IGNORE INTO _migrations (id) VALUES (63);
   `
   ];
 });
@@ -3787,6 +3803,20 @@ function ensureSchema(db) {
     )`);
   ensureIndex("CREATE INDEX IF NOT EXISTS idx_project_machine_paths_project ON project_machine_paths(project_id)");
   ensureIndex("CREATE INDEX IF NOT EXISTS idx_project_machine_paths_machine ON project_machine_paths(machine_id)");
+  ensureTable("storage_tombstones", `
+    CREATE TABLE storage_tombstones (
+      id TEXT PRIMARY KEY,
+      object_type TEXT NOT NULL,
+      object_id TEXT NOT NULL,
+      deleted_at TEXT NOT NULL,
+      updated_at TEXT NOT NULL,
+      source_machine_id TEXT,
+      payload TEXT,
+      version INTEGER,
+      UNIQUE(object_type, object_id)
+    )`);
+  ensureIndex("CREATE INDEX IF NOT EXISTS idx_storage_tombstones_object ON storage_tombstones(object_type, object_id)");
+  ensureIndex("CREATE INDEX IF NOT EXISTS idx_storage_tombstones_updated ON storage_tombstones(updated_at)");
   ensureTable("machines", `
     CREATE TABLE machines (
       id TEXT PRIMARY KEY, name TEXT NOT NULL UNIQUE, hostname TEXT, platform TEXT,
@@ -4981,6 +5011,80 @@ var init_types = __esm(() => {
   };
 });
 
+// src/db/storage-tombstones.ts
+function recordStorageTombstone(input, db) {
+  const d = db ?? getDatabase();
+  const deletedAt = input.deleted_at ?? now();
+  const machineId = input.source_machine_id ?? currentStorageMachineId(d);
+  d.run(`INSERT INTO storage_tombstones (
+       id, object_type, object_id, deleted_at, updated_at, source_machine_id, payload, version
+     ) VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+     ON CONFLICT(object_type, object_id) DO UPDATE SET
+       deleted_at = excluded.deleted_at,
+       updated_at = excluded.updated_at,
+       source_machine_id = excluded.source_machine_id,
+       payload = excluded.payload,
+       version = excluded.version
+     WHERE storage_tombstones.updated_at IS NULL OR storage_tombstones.updated_at <= excluded.updated_at`, [
+    uuid(),
+    input.object_type,
+    input.object_id,
+    deletedAt,
+    deletedAt,
+    machineId,
+    input.payload ? JSON.stringify(input.payload) : null,
+    input.version ?? null
+  ]);
+  return getStorageTombstone(input.object_type, input.object_id, d);
+}
+function getStorageTombstone(objectType, objectId, db) {
+  const d = db ?? getDatabase();
+  const row = d.query("SELECT * FROM storage_tombstones WHERE object_type = ? AND object_id = ?").get(objectType, objectId);
+  return row ? rowToStorageTombstone(row) : null;
+}
+function listStorageTombstones(db) {
+  const d = db ?? getDatabase();
+  return d.query("SELECT * FROM storage_tombstones ORDER BY updated_at ASC, object_type ASC, object_id ASC").all().map(rowToStorageTombstone);
+}
+function shouldApplyStorageTombstone(tombstone, existingUpdatedAt) {
+  const tombstoneClock = Date.parse(tombstone.updated_at || tombstone.deleted_at);
+  if (!existingUpdatedAt)
+    return true;
+  const existingClock = Date.parse(existingUpdatedAt);
+  if (Number.isNaN(tombstoneClock))
+    return true;
+  if (Number.isNaN(existingClock))
+    return true;
+  return tombstoneClock >= existingClock;
+}
+function rowToStorageTombstone(row) {
+  return {
+    ...row,
+    payload: parsePayload(row.payload)
+  };
+}
+function parsePayload(value) {
+  if (!value)
+    return null;
+  try {
+    const parsed = JSON.parse(value);
+    return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+function currentStorageMachineId(db) {
+  try {
+    return getMachineId(db);
+  } catch {
+    return null;
+  }
+}
+var init_storage_tombstones = __esm(() => {
+  init_database();
+  init_machines();
+});
+
 // src/db/projects.ts
 var exports_projects = {};
 __export(exports_projects, {
@@ -5032,8 +5136,9 @@ function createProject(input, db) {
   const timestamp = now();
   const taskListId = input.task_list_id ?? `todos-${slugify(input.name)}`;
   const taskPrefix = input.task_prefix || generatePrefix(input.name, d);
-  d.run(`INSERT INTO projects (id, name, path, description, task_list_id, task_prefix, task_counter, created_at, updated_at)
-     VALUES (?, ?, ?, ?, ?, ?, 0, ?, ?)`, [id, input.name, input.path, input.description || null, taskListId, taskPrefix, timestamp, timestamp]);
+  const machineId = currentStorageMachineId(d);
+  d.run(`INSERT INTO projects (id, name, path, description, task_list_id, task_prefix, task_counter, created_at, updated_at, machine_id)
+     VALUES (?, ?, ?, ?, ?, ?, 0, ?, ?, ?)`, [id, input.name, input.path, input.description || null, taskListId, taskPrefix, timestamp, timestamp, machineId]);
   return getProject(id, d);
 }
 function getProject(id, db) {
@@ -5112,6 +5217,14 @@ function renameProject(id, input, db) {
 }
 function deleteProject(id, db) {
   const d = db || getDatabase();
+  const project = getProject(id, d);
+  if (!project)
+    return false;
+  recordStorageTombstone({
+    object_type: "projects",
+    object_id: id,
+    payload: project
+  }, d);
   const result = d.run("DELETE FROM projects WHERE id = ?", [id]);
   return result.changes > 0;
 }
@@ -5216,6 +5329,14 @@ function listMachineLocalPaths(projectId, db) {
 function removeMachineLocalPath(projectId, machineId, db) {
   const d = db || getDatabase();
   const mid = machineId ?? getMachineId(d);
+  const existing = d.query("SELECT * FROM project_machine_paths WHERE project_id = ? AND machine_id = ?").get(projectId, mid);
+  if (!existing)
+    return false;
+  recordStorageTombstone({
+    object_type: "project_machine_paths",
+    object_id: existing.id,
+    payload: existing
+  }, d);
   const result = d.run("DELETE FROM project_machine_paths WHERE project_id = ? AND machine_id = ?", [projectId, mid]);
   return result.changes > 0;
 }
@@ -5223,6 +5344,7 @@ var init_projects = __esm(() => {
   init_types();
   init_database();
   init_machines();
+  init_storage_tombstones();
 });
 
 // src/lib/sync-utils.ts
@@ -5467,6 +5589,57 @@ var init_completion_guard = __esm(() => {
   init_projects();
 });
 
+// src/lib/event-emission-safety.ts
+import { tmpdir } from "os";
+import { resolve as resolve3, sep } from "path";
+function envFlag(name) {
+  const value = process.env[name];
+  return value === "1" || value === "true" || value === "yes";
+}
+function isUnder(parent, child) {
+  const normalizedParent = resolve3(parent);
+  const normalizedChild = resolve3(child);
+  return normalizedChild === normalizedParent || normalizedChild.startsWith(`${normalizedParent}${sep}`);
+}
+function databasePathFromDatabase(db) {
+  const filename = db?.filename;
+  return typeof filename === "string" && filename.trim() ? filename : undefined;
+}
+function isEphemeralTodosDatabase(dbPath) {
+  const resolvedPath = dbPath ?? getDatabasePath();
+  if (resolvedPath === ":memory:" || resolvedPath.startsWith("file::memory:"))
+    return true;
+  return isUnder(tmpdir(), resolvedPath);
+}
+function hasExplicitSharedEventsStore() {
+  return Boolean(process.env["HASNA_EVENTS_DIR"] || process.env["HASNA_EVENTS_HOME"]);
+}
+function usesIsolatedTodosHome() {
+  return isUnder(tmpdir(), getTodosGlobalDir());
+}
+function shouldEmitSharedTaskEvents(dbPath) {
+  if (envFlag("TODOS_DISABLE_SHARED_EVENTS"))
+    return false;
+  if (envFlag("TODOS_ALLOW_EPHEMERAL_SHARED_EVENTS"))
+    return true;
+  if (!isEphemeralTodosDatabase(dbPath))
+    return true;
+  return hasExplicitSharedEventsStore();
+}
+function shouldDeliverLocalLifecycleHooks(dbPath) {
+  if (envFlag("TODOS_DISABLE_LOCAL_EVENT_HOOKS"))
+    return false;
+  if (envFlag("TODOS_ALLOW_EPHEMERAL_LOCAL_EVENT_HOOKS"))
+    return true;
+  if (!isEphemeralTodosDatabase(dbPath))
+    return true;
+  return usesIsolatedTodosHome();
+}
+var init_event_emission_safety = __esm(() => {
+  init_database();
+  init_sync_utils();
+});
+
 // src/lib/redaction.ts
 var exports_redaction = {};
 __export(exports_redaction, {
@@ -5587,9 +5760,9 @@ __export(exports_workspace_trust, {
   getWorkspaceTrustStatus: () => getWorkspaceTrustStatus,
   checkWorkspacePermission: () => checkWorkspacePermission
 });
-import { relative, resolve as resolve3 } from "path";
+import { relative, resolve as resolve4 } from "path";
 function normalizePath(path) {
-  return resolve3(path);
+  return resolve4(path);
 }
 function unique2(values) {
   return Array.from(new Set((values || []).map((value) => value.trim()).filter(Boolean)));
@@ -5780,9 +5953,9 @@ __export(exports_runner_sandbox, {
   explainRunnerSandbox: () => explainRunnerSandbox,
   checkRunnerSandbox: () => checkRunnerSandbox
 });
-import { relative as relative2, resolve as resolve4 } from "path";
+import { relative as relative2, resolve as resolve5 } from "path";
 function normalizePath2(path) {
-  return resolve4(path);
+  return resolve5(path);
 }
 function unique3(values) {
   return Array.from(new Set((values || []).map((value) => value.trim()).filter(Boolean)));
@@ -5986,7 +6159,7 @@ __export(exports_event_hooks, {
 });
 import { createHash, randomUUID } from "crypto";
 import { appendFileSync, mkdirSync as mkdirSync3 } from "fs";
-import { dirname as dirname4, resolve as resolve5 } from "path";
+import { dirname as dirname4, resolve as resolve6 } from "path";
 import { createConnection } from "net";
 function safeName(name) {
   const trimmed = name.trim();
@@ -6124,7 +6297,7 @@ async function deliverHook(hook, envelope) {
       if (hook.target === "stdout") {
         output = line.trim();
       } else if (hook.target === "file") {
-        const filePath = resolve5(hook.file_path);
+        const filePath = resolve6(hook.file_path);
         mkdirSync3(dirname4(filePath), { recursive: true });
         appendFileSync(filePath, line);
       } else if (hook.target === "socket") {
@@ -6199,6 +6372,8 @@ async function emitLocalEventHooks(input) {
   return Promise.all(hooks.map((hook) => deliverHook(hook, envelope)));
 }
 function emitLocalEventHooksQuiet(input) {
+  if (!shouldDeliverLocalLifecycleHooks(input.databasePath))
+    return;
   emitLocalEventHooks(input).catch(() => {});
 }
 async function testLocalEventHook(name, input) {
@@ -6212,6 +6387,7 @@ var init_event_hooks = __esm(() => {
   init_redaction();
   init_runner_sandbox();
   init_config();
+  init_event_emission_safety();
   LOCAL_EVENT_TYPES = [
     "task.created",
     "task.assigned",
@@ -6544,7 +6720,7 @@ async function dispatchCommand(event, channel) {
     HASNA_EVENT_SCHEMA_VERSION: event.schemaVersion,
     HASNA_EVENT_JSON: eventJson
   };
-  return new Promise((resolve6) => {
+  return new Promise((resolve7) => {
     const child = spawn(channel.command.command, channel.command.args ?? [], {
       cwd: channel.command.cwd,
       env,
@@ -6562,7 +6738,7 @@ async function dispatchCommand(event, channel) {
     });
     child.on("error", (error) => {
       clearTimeout(timeout);
-      resolve6({
+      resolve7({
         attempt: 1,
         status: "failed",
         startedAt,
@@ -6575,7 +6751,7 @@ async function dispatchCommand(event, channel) {
     child.on("close", (code, signal) => {
       clearTimeout(timeout);
       const success = code === 0;
-      resolve6({
+      resolve7({
         attempt: 1,
         status: success ? "success" : "failed",
         startedAt,
@@ -6842,14 +7018,15 @@ function createTaskList(input, db) {
   const id = uuid();
   const timestamp = now();
   const slug = input.slug || slugify(input.name);
+  const machineId = currentStorageMachineId(d);
   if (!input.project_id) {
     const existing = d.query("SELECT id FROM task_lists WHERE project_id IS NULL AND slug = ?").get(slug);
     if (existing) {
       throw new Error(`Standalone task list with slug "${slug}" already exists`);
     }
   }
-  d.run(`INSERT INTO task_lists (id, project_id, slug, name, description, metadata, created_at, updated_at)
-     VALUES (?, ?, ?, ?, ?, ?, ?, ?)`, [id, input.project_id || null, slug, input.name, input.description || null, JSON.stringify(input.metadata || {}), timestamp, timestamp]);
+  d.run(`INSERT INTO task_lists (id, project_id, slug, name, description, metadata, created_at, updated_at, machine_id)
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`, [id, input.project_id || null, slug, input.name, input.description || null, JSON.stringify(input.metadata || {}), timestamp, timestamp, machineId]);
   return getTaskList(id, d);
 }
 function getTaskList(id, db) {
@@ -6899,6 +7076,14 @@ function updateTaskList(id, input, db) {
 }
 function deleteTaskList(id, db) {
   const d = db || getDatabase();
+  const list = getTaskList(id, d);
+  if (!list)
+    return false;
+  recordStorageTombstone({
+    object_type: "task_lists",
+    object_id: id,
+    payload: list
+  }, d);
   return d.run("DELETE FROM task_lists WHERE id = ?", [id]).changes > 0;
 }
 function ensureTaskList(name, slug, projectId, db) {
@@ -6912,6 +7097,7 @@ var init_task_lists = __esm(() => {
   init_types();
   init_database();
   init_projects();
+  init_storage_tombstones();
 });
 
 // src/lib/task-route-contract.ts
@@ -7118,6 +7304,8 @@ function readMachineLocalPath(project) {
   }
 }
 async function emitSharedTaskEvent(input) {
+  if (!shouldEmitSharedTaskEvents(input.databasePath))
+    return;
   const data = taskEventData(input.task, input.data);
   await new EventsClient().emit({
     source: SOURCE,
@@ -7141,6 +7329,7 @@ var init_shared_events = __esm(() => {
   init_database();
   init_projects();
   init_task_lists();
+  init_event_emission_safety();
 });
 
 // src/lib/secret-redaction.ts
@@ -7396,8 +7585,9 @@ function logTaskChange(taskId, action, field, oldValue, newValue, agentId, db) {
   const d = db || getDatabase();
   const id = uuid();
   const timestamp = now();
-  d.run(`INSERT INTO task_history (id, task_id, action, field, old_value, new_value, agent_id, created_at)
-     VALUES (?, ?, ?, ?, ?, ?, ?, ?)`, [id, taskId, action, field || null, oldValue ?? null, newValue ?? null, agentId || null, timestamp]);
+  const machineId = currentStorageMachineId(d);
+  d.run(`INSERT INTO task_history (id, task_id, action, field, old_value, new_value, agent_id, created_at, machine_id)
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`, [id, taskId, action, field || null, oldValue ?? null, newValue ?? null, agentId || null, timestamp, machineId]);
   try {
     const { logActivity: logActivity2 } = (init_activity_audit(), __toCommonJS(exports_activity_audit));
     logActivity2({
@@ -7410,7 +7600,7 @@ function logTaskChange(taskId, action, field, oldValue, newValue, agentId, db) {
       actor_id: agentId ?? undefined
     }, d);
   } catch {}
-  return { id, task_id: taskId, action, field: field || null, old_value: oldValue ?? null, new_value: newValue ?? null, agent_id: agentId || null, created_at: timestamp };
+  return { id, task_id: taskId, action, field: field || null, old_value: oldValue ?? null, new_value: newValue ?? null, agent_id: agentId || null, created_at: timestamp, machine_id: machineId };
 }
 function getTaskHistory(taskId, db) {
   const d = db || getDatabase();
@@ -7448,6 +7638,7 @@ function getRecap(hours = 8, projectId, db) {
 }
 var init_audit = __esm(() => {
   init_database();
+  init_storage_tombstones();
 });
 
 // src/db/webhooks.ts
@@ -7713,13 +7904,14 @@ function createTask(input, db) {
   const d = db || getDatabase();
   const timestamp = now();
   const tags = input.tags || [];
+  const machineId = currentStorageMachineId(d);
   const assignedBy = input.assigned_by || input.agent_id;
   const assignedFromProject = input.assigned_from_project || null;
   let id = uuid();
   for (let attempt = 0;attempt < 3; attempt++) {
     try {
-      d.run(`INSERT INTO tasks (id, short_id, project_id, parent_id, plan_id, task_list_id, cycle_id, title, description, status, priority, agent_id, assigned_to, session_id, working_dir, tags, metadata, version, created_at, updated_at, due_at, estimated_minutes, sla_minutes, confidence, retry_count, max_retries, retry_after, requires_approval, approved_by, approved_at, recurrence_rule, recurrence_parent_id, spawns_template_id, reason, spawned_from_session, assigned_by, assigned_from_project, task_type)
-         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 1, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`, [
+      d.run(`INSERT INTO tasks (id, short_id, project_id, parent_id, plan_id, task_list_id, cycle_id, title, description, status, priority, agent_id, assigned_to, session_id, working_dir, tags, metadata, version, created_at, updated_at, due_at, estimated_minutes, sla_minutes, confidence, retry_count, max_retries, retry_after, requires_approval, approved_by, approved_at, recurrence_rule, recurrence_parent_id, spawns_template_id, reason, spawned_from_session, assigned_by, assigned_from_project, task_type, machine_id)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 1, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`, [
         id,
         null,
         input.project_id || null,
@@ -7756,7 +7948,8 @@ function createTask(input, db) {
         input.spawned_from_session || null,
         assignedBy || null,
         assignedFromProject || null,
-        input.task_type || null
+        input.task_type || null,
+        machineId
       ]);
       break;
     } catch (e) {
@@ -7772,9 +7965,10 @@ function createTask(input, db) {
   }
   const task = getTask(id, d);
   const payload = taskEventData(task);
+  const databasePath = databasePathFromDatabase(d);
   dispatchWebhook2("task.created", payload, d).catch(() => {});
-  emitLocalEventHooksQuiet({ type: "task.created", payload });
-  emitSharedTaskEventQuiet({ type: "task.created", task });
+  emitLocalEventHooksQuiet({ type: "task.created", payload, databasePath });
+  emitSharedTaskEventQuiet({ type: "task.created", task, databasePath });
   return task;
 }
 function getTask(id, db) {
@@ -8192,29 +8386,39 @@ function updateTask(id, input, db) {
     approved_by: input.approved_by ?? task.approved_by,
     approved_at: input.approved_by ? timestamp : task.approved_at
   };
+  const databasePath = databasePathFromDatabase(d);
   if (input.assigned_to !== undefined && input.assigned_to !== task.assigned_to) {
     const payload = taskEventData(updatedTask, { assigned_to: input.assigned_to, old_assigned_to: task.assigned_to });
     dispatchWebhook2("task.assigned", payload, d).catch(() => {});
-    emitLocalEventHooksQuiet({ type: "task.assigned", payload });
-    emitSharedTaskEventQuiet({ type: "task.assigned", task: updatedTask, data: { old_assigned_to: task.assigned_to } });
+    emitLocalEventHooksQuiet({ type: "task.assigned", payload, databasePath });
+    emitSharedTaskEventQuiet({ type: "task.assigned", task: updatedTask, data: { old_assigned_to: task.assigned_to }, databasePath });
   }
   if (input.status !== undefined && input.status !== task.status) {
     const payload = taskEventData(updatedTask, { old_status: task.status, new_status: input.status });
     dispatchWebhook2("task.status_changed", payload, d).catch(() => {});
-    emitLocalEventHooksQuiet({ type: "task.status_changed", payload });
-    emitSharedTaskEventQuiet({ type: "task.status_changed", task: updatedTask, data: { old_status: task.status, new_status: input.status } });
+    emitLocalEventHooksQuiet({ type: "task.status_changed", payload, databasePath });
+    emitSharedTaskEventQuiet({ type: "task.status_changed", task: updatedTask, data: { old_status: task.status, new_status: input.status }, databasePath });
   }
   if (input.approved_by !== undefined) {
-    emitLocalEventHooksQuiet({ type: "approval.decided", payload: { id, approved_by: input.approved_by, title: task.title } });
+    emitLocalEventHooksQuiet({ type: "approval.decided", payload: { id, approved_by: input.approved_by, title: task.title }, databasePath });
   }
   const updatePayload = taskEventData(updatedTask);
   dispatchWebhook2("task.updated", updatePayload, d).catch(() => {});
-  emitLocalEventHooksQuiet({ type: "task.updated", payload: updatePayload });
-  emitSharedTaskEventQuiet({ type: "task.updated", task: updatedTask });
+  emitLocalEventHooksQuiet({ type: "task.updated", payload: updatePayload, databasePath });
+  emitSharedTaskEventQuiet({ type: "task.updated", task: updatedTask, databasePath });
   return updatedTask;
 }
 function deleteTask(id, db) {
   const d = db || getDatabase();
+  const row = d.query("SELECT * FROM tasks WHERE id = ?").get(id);
+  if (!row)
+    return false;
+  recordStorageTombstone({
+    object_type: "tasks",
+    object_id: id,
+    payload: rowToTask(row),
+    version: row.version
+  }, d);
   const result = d.run("DELETE FROM tasks WHERE id = ?", [id]);
   return result.changes > 0;
 }
@@ -8222,11 +8426,13 @@ var init_task_crud = __esm(() => {
   init_types();
   init_database();
   init_completion_guard();
+  init_event_emission_safety();
   init_event_hooks();
   init_shared_events();
   init_audit();
   init_webhooks();
   init_checklists();
+  init_storage_tombstones();
 });
 
 // src/lib/recurrence.ts
@@ -8375,8 +8581,9 @@ function resolveTemplateId(id, d) {
 function createTemplate(input, db) {
   const d = db || getDatabase();
   const id = uuid();
-  d.run(`INSERT INTO task_templates (id, name, title_pattern, description, priority, tags, variables, project_id, plan_id, metadata, created_at)
-     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`, [
+  const machineId = currentStorageMachineId(d);
+  d.run(`INSERT INTO task_templates (id, name, title_pattern, description, priority, tags, variables, project_id, plan_id, metadata, created_at, machine_id)
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`, [
     id,
     input.name,
     input.title_pattern,
@@ -8387,7 +8594,8 @@ function createTemplate(input, db) {
     input.project_id || null,
     input.plan_id || null,
     JSON.stringify(input.metadata || {}),
-    now()
+    now(),
+    machineId
   ]);
   if (input.tasks && input.tasks.length > 0) {
     addTemplateTasks(id, input.tasks, d);
@@ -8411,6 +8619,15 @@ function deleteTemplate(id, db) {
   const resolved = resolveTemplateId(id, d);
   if (!resolved)
     return false;
+  const template = getTemplate(resolved, d);
+  if (!template)
+    return false;
+  recordStorageTombstone({
+    object_type: "templates",
+    object_id: resolved,
+    payload: template,
+    version: template.version
+  }, d);
   return d.run("DELETE FROM task_templates WHERE id = ?", [resolved]).changes > 0;
 }
 function updateTemplate(id, updates, db) {
@@ -8780,6 +8997,7 @@ function previewTemplate(templateId, variables, db) {
 var init_templates = __esm(() => {
   init_database();
   init_tasks();
+  init_storage_tombstones();
 });
 
 // src/db/task-graph.ts
@@ -8946,6 +9164,7 @@ function getBlockingDeps(id, db) {
 }
 function startTask(id, agentId, db) {
   const d = db || getDatabase();
+  const databasePath = databasePathFromDatabase(d);
   const task = getTask(id, d);
   if (!task)
     throw new TaskNotFoundError(id);
@@ -8960,7 +9179,8 @@ function startTask(id, agentId, db) {
         agent_id: agentId,
         title: task.title,
         blockers: blocking.map((b) => ({ id: b.id, short_id: b.short_id, title: b.title, status: b.status }))
-      }
+      },
+      databasePath
     });
     throw new Error(`Task is blocked by ${blocking.length} unfinished dependency(ies): ${blockerIds}`);
   }
@@ -8982,12 +9202,13 @@ function startTask(id, agentId, db) {
   const startedTask = { ...task, status: "in_progress", assigned_to: agentId, locked_by: agentId, locked_at: timestamp, started_at: task.started_at || timestamp, version: task.version + 1, updated_at: timestamp };
   const payload = taskEventData(startedTask, { agent_id: agentId });
   dispatchWebhook2("task.started", payload, d).catch(() => {});
-  emitLocalEventHooksQuiet({ type: "task.started", payload });
-  emitSharedTaskEventQuiet({ type: "task.started", task: startedTask, data: { agent_id: agentId } });
+  emitLocalEventHooksQuiet({ type: "task.started", payload, databasePath });
+  emitSharedTaskEventQuiet({ type: "task.started", task: startedTask, data: { agent_id: agentId }, databasePath });
   return startedTask;
 }
 function completeTask(id, agentId, db, options) {
   const d = db || getDatabase();
+  const databasePath = databasePathFromDatabase(d);
   const task = getTask(id, d);
   if (!task)
     throw new TaskNotFoundError(id);
@@ -9033,8 +9254,8 @@ function completeTask(id, agentId, db, options) {
   };
   const completionPayload = taskEventData(completedTaskForEvent, { agent_id: agentId, completed_at: timestamp });
   dispatchWebhook2("task.completed", completionPayload, d).catch(() => {});
-  emitLocalEventHooksQuiet({ type: "task.completed", payload: completionPayload });
-  emitSharedTaskEventQuiet({ type: "task.completed", task: completedTaskForEvent, data: { agent_id: agentId, completed_at: timestamp } });
+  emitLocalEventHooksQuiet({ type: "task.completed", payload: completionPayload, databasePath });
+  emitSharedTaskEventQuiet({ type: "task.completed", task: completedTaskForEvent, data: { agent_id: agentId, completed_at: timestamp }, databasePath });
   let spawnedTask = null;
   if (task.recurrence_rule && !options?.skip_recurrence) {
     spawnedTask = spawnNextRecurrence(task, d, timestamp);
@@ -9078,9 +9299,9 @@ function completeTask(id, agentId, db, options) {
       const depTask = getTask(dep.id, d);
       const payload = depTask ? taskEventData(depTask, { unblocked_by: id }) : { id: dep.id, unblocked_by: id, title: dep.title };
       dispatchWebhook2("task.unblocked", payload, d).catch(() => {});
-      emitLocalEventHooksQuiet({ type: "task.unblocked", payload });
+      emitLocalEventHooksQuiet({ type: "task.unblocked", payload, databasePath });
       if (depTask)
-        emitSharedTaskEventQuiet({ type: "task.unblocked", task: depTask, data: { unblocked_by: id } });
+        emitSharedTaskEventQuiet({ type: "task.unblocked", task: depTask, data: { unblocked_by: id }, databasePath });
     }
   }
   return { ...task, status: "completed", locked_by: null, locked_at: null, completed_at: timestamp, confidence, version: task.version + 1, updated_at: timestamp, metadata: meta };
@@ -9250,6 +9471,7 @@ function getTasksChangedSince(since, filters, db) {
 }
 function failTask(id, agentId, reason, options, db) {
   const d = db || getDatabase();
+  const databasePath = databasePathFromDatabase(d);
   const task = getTask(id, d);
   if (!task)
     throw new TaskNotFoundError(id);
@@ -9278,8 +9500,8 @@ function failTask(id, agentId, reason, options, db) {
   logTaskChange(id, "fail", "status", task.status, "failed", agentId || null, d);
   const failurePayload = taskEventData(failedTask, { reason, error_code: options?.error_code, agent_id: agentId });
   dispatchWebhook2("task.failed", failurePayload, d).catch(() => {});
-  emitLocalEventHooksQuiet({ type: "task.failed", payload: failurePayload });
-  emitSharedTaskEventQuiet({ type: "task.failed", task: failedTask, data: { reason, error_code: options?.error_code, agent_id: agentId }, severity: "warning" });
+  emitLocalEventHooksQuiet({ type: "task.failed", payload: failurePayload, databasePath });
+  emitSharedTaskEventQuiet({ type: "task.failed", task: failedTask, data: { reason, error_code: options?.error_code, agent_id: agentId }, severity: "warning", databasePath });
   let retryTask;
   if (options?.retry) {
     const retryCount = (task.retry_count || 0) + 1;
@@ -9339,6 +9561,7 @@ function getStaleTasks(staleQuery = 30, filters, db) {
 }
 function stealTask(agentId, opts, db) {
   const d = db || getDatabase();
+  const databasePath = databasePathFromDatabase(d);
   const staleMinutes = opts?.stale_minutes ?? 30;
   const staleTasks = getStaleTasks(staleMinutes, { project_id: opts?.project_id, task_list_id: opts?.task_list_id }, d);
   if (staleTasks.length === 0)
@@ -9357,8 +9580,8 @@ function stealTask(agentId, opts, db) {
   const stolenTask = { ...target, assigned_to: agentId, locked_by: agentId, locked_at: timestamp, updated_at: timestamp, version: target.version + 1 };
   const payload = taskEventData(stolenTask, { agent_id: agentId, stolen_from: target.assigned_to });
   dispatchWebhook2("task.assigned", payload, d).catch(() => {});
-  emitLocalEventHooksQuiet({ type: "task.assigned", payload });
-  emitSharedTaskEventQuiet({ type: "task.assigned", task: stolenTask, data: { agent_id: agentId, stolen_from: target.assigned_to } });
+  emitLocalEventHooksQuiet({ type: "task.assigned", payload, databasePath });
+  emitSharedTaskEventQuiet({ type: "task.assigned", task: stolenTask, data: { agent_id: agentId, stolen_from: target.assigned_to }, databasePath });
   return stolenTask;
 }
 function claimOrSteal(agentId, filters, db) {
@@ -9406,6 +9629,7 @@ var init_task_lifecycle = __esm(() => {
   init_types();
   init_database();
   init_completion_guard();
+  init_event_emission_safety();
   init_event_hooks();
   init_shared_events();
   init_audit();
@@ -10113,8 +10337,9 @@ function createPlan(input, db) {
   const d = db || getDatabase();
   const id = uuid();
   const timestamp = now();
-  d.run(`INSERT INTO plans (id, project_id, task_list_id, agent_id, name, description, status, created_at, updated_at)
-     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`, [
+  const machineId = currentStorageMachineId(d);
+  d.run(`INSERT INTO plans (id, project_id, task_list_id, agent_id, name, description, status, created_at, updated_at, machine_id)
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`, [
     id,
     input.project_id || null,
     input.task_list_id || null,
@@ -10123,7 +10348,8 @@ function createPlan(input, db) {
     input.description || null,
     input.status || "active",
     timestamp,
-    timestamp
+    timestamp,
+    machineId
   ]);
   return getPlan(id, d);
 }
@@ -10171,19 +10397,30 @@ function updatePlan(id, input, db) {
   const updated = getPlan(id, d);
   emitLocalEventHooksQuiet({
     type: "plan.updated",
-    payload: { id, old_status: plan.status, new_status: updated.status, name: updated.name, project_id: updated.project_id }
+    payload: { id, old_status: plan.status, new_status: updated.status, name: updated.name, project_id: updated.project_id },
+    databasePath: databasePathFromDatabase(d)
   });
   return updated;
 }
 function deletePlan(id, db) {
   const d = db || getDatabase();
+  const plan = getPlan(id, d);
+  if (!plan)
+    return false;
+  recordStorageTombstone({
+    object_type: "plans",
+    object_id: id,
+    payload: plan
+  }, d);
   const result = d.run("DELETE FROM plans WHERE id = ?", [id]);
   return result.changes > 0;
 }
 var init_plans = __esm(() => {
   init_types();
+  init_event_emission_safety();
   init_event_hooks();
   init_database();
+  init_storage_tombstones();
 });
 
 // src/db/boards.ts
@@ -10590,20 +10827,20 @@ var init_boards = __esm(() => {
 // src/lib/artifact-store.ts
 import { createHash as createHash2 } from "crypto";
 import { existsSync as existsSync7, mkdirSync as mkdirSync4, readFileSync as readFileSync3, rmSync, statSync as statSync2, writeFileSync as writeFileSync2 } from "fs";
-import { basename, dirname as dirname5, join as join6, resolve as resolve6 } from "path";
-import { tmpdir } from "os";
+import { basename, dirname as dirname5, join as join6, resolve as resolve7 } from "path";
+import { tmpdir as tmpdir2 } from "os";
 function isInMemoryDb2(path) {
   return path === ":memory:" || path.startsWith("file::memory:");
 }
 function artifactStoreRoot() {
   if (process.env["HASNA_TODOS_ARTIFACTS_DIR"])
-    return resolve6(process.env["HASNA_TODOS_ARTIFACTS_DIR"]);
+    return resolve7(process.env["HASNA_TODOS_ARTIFACTS_DIR"]);
   if (process.env["TODOS_ARTIFACTS_DIR"])
-    return resolve6(process.env["TODOS_ARTIFACTS_DIR"]);
+    return resolve7(process.env["TODOS_ARTIFACTS_DIR"]);
   const dbPath = getDatabasePath();
   if (isInMemoryDb2(dbPath))
-    return join6(tmpdir(), "hasna-todos-artifacts");
-  return join6(dirname5(resolve6(dbPath)), "artifacts");
+    return join6(tmpdir2(), "hasna-todos-artifacts");
+  return join6(dirname5(resolve7(dbPath)), "artifacts");
 }
 function artifactStorePath(relativePath) {
   const normalized = relativePath.replace(/\\/g, "/");
@@ -10650,7 +10887,7 @@ function mediaTypeFor(path, textLike) {
   return "application/octet-stream";
 }
 function storeArtifactContent(input) {
-  const sourcePath = resolve6(input.path);
+  const sourcePath = resolve7(input.path);
   if (!existsSync7(sourcePath))
     return null;
   const sourceStat = statSync2(sourcePath);
@@ -11367,7 +11604,11 @@ function startTaskRun(input, db) {
     }, d);
   }
   const run = getTaskRun(id, d);
-  emitLocalEventHooksQuiet({ type: "run.started", payload: { id: run.id, task_id: run.task_id, agent_id: run.agent_id, title: run.title } });
+  emitLocalEventHooksQuiet({
+    type: "run.started",
+    payload: { id: run.id, task_id: run.task_id, agent_id: run.agent_id, title: run.title },
+    databasePath: databasePathFromDatabase(d)
+  });
   return run;
 }
 function beginTaskRunTransaction(input, db) {
@@ -11636,7 +11877,8 @@ function finishTaskRun(input, db) {
   const updated = getTaskRun(run.id, d);
   emitLocalEventHooksQuiet({
     type: `run.${input.status}`,
-    payload: { id: updated.id, task_id: updated.task_id, agent_id: updated.agent_id, status: updated.status, summary: updated.summary, completed_at: timestamp }
+    payload: { id: updated.id, task_id: updated.task_id, agent_id: updated.agent_id, status: updated.status, summary: updated.summary, completed_at: timestamp },
+    databasePath: databasePathFromDatabase(d)
   });
   return updated;
 }
@@ -11720,6 +11962,7 @@ function getTaskRunLedger(runId, db) {
 var LOOP_RUN_TRANSACTION_SCHEMA_VERSION = "todos.loop_run_transaction.v1";
 var init_task_runs = __esm(() => {
   init_artifact_store();
+  init_event_emission_safety();
   init_event_hooks();
   init_redaction();
   init_types();
@@ -12217,7 +12460,7 @@ __export(exports_helpers, {
 });
 import chalk from "chalk";
 import { execSync } from "child_process";
-import { resolve as resolve7 } from "path";
+import { resolve as resolve8 } from "path";
 function handleError(e) {
   console.error(chalk.red(e instanceof Error ? e.message : String(e)));
   process.exit(1);
@@ -12246,7 +12489,7 @@ function detectGitRoot() {
 }
 function resolveExplicitProject(input) {
   const db = getDatabase();
-  const byPath = getProjectByPath(resolve7(input), db);
+  const byPath = getProjectByPath(resolve8(input), db);
   if (byPath)
     return byPath;
   const id = resolvePartialId(db, "projects", input);
@@ -12515,6 +12758,8 @@ function pointerPatch(previous, input, key) {
   if (!Object.prototype.hasOwnProperty.call(input, key))
     return previous;
   const value = input[key];
+  if (value === undefined)
+    return previous;
   return typeof value === "string" && value.trim() ? value : undefined;
 }
 var init_task_routing = __esm(() => {
@@ -12531,7 +12776,7 @@ __export(exports_task_commands, {
   registerTaskCommands: () => registerTaskCommands
 });
 import chalk2 from "chalk";
-import { basename as basename3, resolve as resolve8 } from "path";
+import { basename as basename3, resolve as resolve9 } from "path";
 function resolveProjectIdOrSlug(input) {
   const db = getDatabase();
   const byId = getProject(input, db);
@@ -12541,7 +12786,7 @@ function resolveProjectIdOrSlug(input) {
   if (row)
     return row.id;
   if (isPathLike(input)) {
-    const projectPath = resolve8(input);
+    const projectPath = resolve9(input);
     const byPath = getProjectByPath(projectPath, db);
     return (byPath ?? ensureProject(basename3(projectPath), projectPath, db)).id;
   }
@@ -12701,7 +12946,7 @@ function registerTaskCommands(program2) {
         task_list_id: taskListId,
         tags: parseTags(opts.tags),
         metadata: buildExpectationMetadata(opts),
-        working_dir: opts.workingDir ? resolve8(opts.workingDir) : process.cwd(),
+        working_dir: opts.workingDir ? resolve9(opts.workingDir) : process.cwd(),
         project_id: projectId,
         assigned_to: opts.assign,
         agent_id: globalOpts.agent,
@@ -15272,7 +15517,7 @@ __export(exports_project_bootstrap, {
   bootstrapProject: () => bootstrapProject
 });
 import { existsSync as existsSync10, readFileSync as readFileSync5, statSync as statSync3 } from "fs";
-import { basename as basename4, dirname as dirname6, resolve as resolve9 } from "path";
+import { basename as basename4, dirname as dirname6, resolve as resolve10 } from "path";
 function safeStat(path) {
   try {
     return statSync3(path);
@@ -15281,7 +15526,7 @@ function safeStat(path) {
   }
 }
 function canonicalPath(input) {
-  const resolved = resolve9(input);
+  const resolved = resolve10(input);
   const stats = safeStat(resolved);
   if (stats?.isFile())
     return dirname6(resolved);
@@ -15290,7 +15535,7 @@ function canonicalPath(input) {
 function findUp(start, marker) {
   let current = canonicalPath(start);
   while (true) {
-    if (existsSync10(resolve9(current, marker)))
+    if (existsSync10(resolve10(current, marker)))
       return current;
     const parent = dirname6(current);
     if (parent === current)
@@ -15301,7 +15546,7 @@ function findUp(start, marker) {
 function readPackageJson(path) {
   if (!path)
     return null;
-  const file = resolve9(path, "package.json");
+  const file = resolve10(path, "package.json");
   if (!existsSync10(file))
     return null;
   try {
@@ -15324,7 +15569,7 @@ function workspaceMarker(root, rootPackage) {
   if (rootPackage?.workspaces)
     markers.push("package.json#workspaces");
   for (const marker of ["pnpm-workspace.yaml", "turbo.json", "nx.json", "lerna.json", "rush.json", "bun.lock", "bun.lockb"]) {
-    if (existsSync10(resolve9(root, marker)))
+    if (existsSync10(resolve10(root, marker)))
       markers.push(marker);
   }
   const kind = markers.find((marker) => marker !== "bun.lock" && marker !== "bun.lockb") ?? null;
@@ -15460,7 +15705,7 @@ __export(exports_extract, {
 });
 import { existsSync as existsSync11, readFileSync as readFileSync6, statSync as statSync4 } from "fs";
 import { createHash as createHash3 } from "crypto";
-import { relative as relative3, resolve as resolve10, join as join10 } from "path";
+import { relative as relative3, resolve as resolve11, join as join10 } from "path";
 function stableHash(value) {
   return createHash3("sha256").update(value).digest("hex");
 }
@@ -15468,7 +15713,7 @@ function normalizePathForMatch(value) {
   return value.replace(/\\/g, "/").replace(/^\.\//, "");
 }
 function readGitignorePatterns(basePath) {
-  const root = statSync4(basePath).isFile() ? resolve10(basePath, "..") : basePath;
+  const root = statSync4(basePath).isFile() ? resolve11(basePath, "..") : basePath;
   const gitignorePath = join10(root, ".gitignore");
   if (!existsSync11(gitignorePath))
     return [];
@@ -15604,7 +15849,7 @@ function collectFiles(basePath, extensions, excludes, respectGitignore) {
   return files.sort();
 }
 function buildCodebaseIndex(options) {
-  const basePath = resolve10(options.path);
+  const basePath = resolve11(options.path);
   const tags = options.patterns || [...EXTRACT_TAGS];
   const extensions = options.extensions ? new Set(options.extensions.map((e) => e.startsWith(".") ? e : `.${e}`)) : DEFAULT_EXTENSIONS;
   const excludes = options.exclude || [];
@@ -15615,7 +15860,7 @@ function buildCodebaseIndex(options) {
     const fullPath = statSync4(basePath).isFile() ? basePath : join10(basePath, file);
     try {
       const source = readFileSync6(fullPath, "utf-8");
-      const relPath = statSync4(basePath).isFile() ? relative3(resolve10(basePath, ".."), fullPath) : file;
+      const relPath = statSync4(basePath).isFile() ? relative3(resolve11(basePath, ".."), fullPath) : file;
       indexed.push({
         file: relPath,
         checksum: stableHash(source).slice(0, 24),
@@ -15635,7 +15880,7 @@ function buildCodebaseIndex(options) {
   };
 }
 function extractTodos(options, db) {
-  const basePath = resolve10(options.path);
+  const basePath = resolve11(options.path);
   const tags = options.patterns || [...EXTRACT_TAGS];
   const extensions = options.extensions ? new Set(options.extensions.map((e) => e.startsWith(".") ? e : `.${e}`)) : DEFAULT_EXTENSIONS;
   const excludes = options.exclude || [];
@@ -15646,7 +15891,7 @@ function extractTodos(options, db) {
     const fullPath = statSync4(basePath).isFile() ? basePath : join10(basePath, file);
     try {
       const source = readFileSync6(fullPath, "utf-8");
-      const relPath = statSync4(basePath).isFile() ? relative3(resolve10(basePath, ".."), fullPath) : file;
+      const relPath = statSync4(basePath).isFile() ? relative3(resolve11(basePath, ".."), fullPath) : file;
       const comments = extractFromSource(source, relPath, tags);
       allComments.push(...comments);
     } catch {}
@@ -15740,7 +15985,7 @@ async function watchSourceTodos(options, onRun) {
   const interval = Math.max(100, options.interval_ms || 2000);
   const once = options.once !== false && (!options.max_runs || options.max_runs <= 1);
   const maxRuns = options.max_runs ?? (once ? 1 : Number.POSITIVE_INFINITY);
-  const root = resolve10(options.path);
+  const root = resolve11(options.path);
   const runs = [];
   let previous = new Map;
   for (let runNumber = 1;runNumber <= maxRuns; runNumber++) {
@@ -16911,7 +17156,7 @@ __export(exports_project_commands, {
   registerProjectCommands: () => registerProjectCommands
 });
 import chalk4 from "chalk";
-import { basename as basename5, resolve as resolve11 } from "path";
+import { basename as basename5, resolve as resolve12 } from "path";
 function collectOption(value, previous = []) {
   return [...previous, value];
 }
@@ -17253,7 +17498,7 @@ function registerProjectCommands(program2) {
   program2.command("projects").description("List and manage projects").option("--add <path>", "Register a project by path").option("--name <name>", "Project name (with --add)").option("--task-list-id <id>", "Custom task list ID (with --add)").action(async (opts) => {
     const globalOpts = program2.opts();
     if (opts.add) {
-      const projectPath = resolve11(opts.add);
+      const projectPath = resolve12(opts.add);
       const name = opts.name || basename5(projectPath);
       const existing = getProjectByPath(projectPath);
       let project;
@@ -17337,7 +17582,7 @@ function registerProjectCommands(program2) {
         console.error(chalk4.red(`Project not found: ${projectId}`));
         process.exit(1);
       }
-      const entry = setMachineLocalPath2(resolved, resolve11(projectPath));
+      const entry = setMachineLocalPath2(resolved, resolve12(projectPath));
       if (useJson) {
         output(entry, true);
       } else {
@@ -17404,7 +17649,7 @@ function registerProjectCommands(program2) {
       const patterns = opts.pattern ? opts.pattern.split(",").map((t) => t.trim().toUpperCase()) : undefined;
       const taskListId = opts.list ? resolveTaskListId(opts.list) : undefined;
       const result = extractTodos2({
-        path: resolve11(scanPath),
+        path: resolve12(scanPath),
         patterns,
         project_id: projectId,
         task_list_id: taskListId,
@@ -17465,7 +17710,7 @@ Indexed ${result.index.files.length} file(s), ${result.index.total_symbols} symb
       const taskListId = opts.list ? resolveTaskListId(opts.list) : undefined;
       const maxRuns = opts.maxRuns ? parseInt(opts.maxRuns, 10) : 1;
       const result = await watchSourceTodos2({
-        path: resolve11(scanPath),
+        path: resolve12(scanPath),
         patterns,
         project_id: projectId,
         task_list_id: taskListId,
@@ -17502,7 +17747,7 @@ Indexed ${result.index.files.length} file(s), ${result.index.total_symbols} symb
     const writeOutput = async (content) => {
       if (opts.output) {
         const { writeFileSync: writeFileSync5 } = await import("fs");
-        writeFileSync5(resolve11(opts.output), content.endsWith(`
+        writeFileSync5(resolve12(opts.output), content.endsWith(`
 `) ? content : `${content}
 `);
       } else {
@@ -17517,12 +17762,12 @@ Indexed ${result.index.files.length} file(s), ${result.index.total_symbols} symb
       const exported = opts.encrypt ? createEncryptedBridgeBundle2(bundle, { profile: opts.encryptionProfile }) : bundle;
       const json = JSON.stringify(exported, null, 2);
       await writeOutput(json);
-      emitLocalEventHooksQuiet3({ type: "export.finished", payload: { format: "bridge", encrypted: Boolean(opts.encrypt), project_id: projectId, output: opts.output ? resolve11(opts.output) : null, stats: bundle.stats } });
+      emitLocalEventHooksQuiet3({ type: "export.finished", payload: { format: "bridge", encrypted: Boolean(opts.encrypt), project_id: projectId, output: opts.output ? resolve12(opts.output) : null, stats: bundle.stats } });
       if (!opts.encrypt && !opts.allowPlaintextSensitive) {
         console.error(chalk4.yellow("Warning: bridge exports are plaintext JSON. Use --encrypt for sensitive metadata, evidence, and artifact bundles."));
       }
       if (opts.output && !globalOpts.json) {
-        console.log(chalk4.green(`${opts.encrypt ? "Encrypted bridge export" : "Bridge export"} written to ${resolve11(opts.output)}`));
+        console.log(chalk4.green(`${opts.encrypt ? "Encrypted bridge export" : "Bridge export"} written to ${resolve12(opts.output)}`));
       }
       return;
     }
@@ -17535,7 +17780,7 @@ Indexed ${result.index.files.length} file(s), ${result.index.total_symbols} symb
       await writeOutput(JSON.stringify(tasks, null, 2));
     }
     const { emitLocalEventHooksQuiet: emitLocalEventHooksQuiet2 } = await Promise.resolve().then(() => (init_event_hooks(), exports_event_hooks));
-    emitLocalEventHooksQuiet2({ type: "export.finished", payload: { format: opts.format, project_id: projectId, output: opts.output ? resolve11(opts.output) : null, count: exportedCount } });
+    emitLocalEventHooksQuiet2({ type: "export.finished", payload: { format: opts.format, project_id: projectId, output: opts.output ? resolve12(opts.output) : null, count: exportedCount } });
   });
   program2.command("bridge-import <file>").description("Dry-run or apply a local hasna/todos bridge export bundle").option("--apply", "Apply the import. Defaults to dry-run.").option("--decrypt", "Decrypt an encrypted bridge export before importing").option("--resolve-conflicts", "Safely merge existing local tasks by filling blank fields, unioning tags, and recording unresolved divergences").action(async (file, opts) => {
     const globalOpts = program2.opts();
@@ -17543,13 +17788,13 @@ Indexed ${result.index.files.length} file(s), ${result.index.total_symbols} symb
       const { readFileSync: readFileSync7 } = await import("fs");
       const { importLocalBridgeBundle: importLocalBridgeBundle2 } = await Promise.resolve().then(() => (init_local_bridge(), exports_local_bridge));
       const { decryptBridgeBundle: decryptBridgeBundle2, isEncryptedBridgeBundle: isEncryptedBridgeBundle2 } = await Promise.resolve().then(() => (init_local_encryption(), exports_local_encryption));
-      const parsed = JSON.parse(readFileSync7(resolve11(file), "utf-8"));
+      const parsed = JSON.parse(readFileSync7(resolve12(file), "utf-8"));
       const bundle = isEncryptedBridgeBundle2(parsed) ? opts.decrypt ? decryptBridgeBundle2(parsed) : (() => {
         throw new Error("Bridge bundle is encrypted. Re-run with --decrypt and the configured key environment variable set.");
       })() : parsed;
       const result = importLocalBridgeBundle2(bundle, { dryRun: !opts.apply, conflictStrategy: opts.resolveConflicts ? "safe_merge" : "skip" });
       const { emitLocalEventHooksQuiet: emitLocalEventHooksQuiet2 } = await Promise.resolve().then(() => (init_event_hooks(), exports_event_hooks));
-      emitLocalEventHooksQuiet2({ type: "import.finished", payload: { file: resolve11(file), dry_run: result.dry_run, ok: result.ok, inserted: result.inserted, skipped: result.skipped, conflicts: result.conflicts.length, issues: result.issues.length } });
+      emitLocalEventHooksQuiet2({ type: "import.finished", payload: { file: resolve12(file), dry_run: result.dry_run, ok: result.ok, inserted: result.inserted, skipped: result.skipped, conflicts: result.conflicts.length, issues: result.issues.length } });
       if (globalOpts.json) {
         output(result, true);
         return;
@@ -17579,9 +17824,9 @@ Indexed ${result.index.files.length} file(s), ${result.index.total_symbols} symb
     try {
       const { readFileSync: readFileSync7 } = await import("fs");
       const { importTodosMarkdown: importTodosMarkdown2 } = await Promise.resolve().then(() => (init_todos_md(), exports_todos_md));
-      const result = importTodosMarkdown2(readFileSync7(resolve11(file), "utf-8"), { dryRun: !opts.apply, conflictStrategy: opts.resolveConflicts ? "safe_merge" : "skip" });
+      const result = importTodosMarkdown2(readFileSync7(resolve12(file), "utf-8"), { dryRun: !opts.apply, conflictStrategy: opts.resolveConflicts ? "safe_merge" : "skip" });
       const { emitLocalEventHooksQuiet: emitLocalEventHooksQuiet2 } = await Promise.resolve().then(() => (init_event_hooks(), exports_event_hooks));
-      emitLocalEventHooksQuiet2({ type: "import.finished", payload: { file: resolve11(file), format: "todos.md", dry_run: result.dry_run, ok: result.ok, inserted: result.inserted, skipped: result.skipped, issues: result.issues.length } });
+      emitLocalEventHooksQuiet2({ type: "import.finished", payload: { file: resolve12(file), format: "todos.md", dry_run: result.dry_run, ok: result.ok, inserted: result.inserted, skipped: result.skipped, issues: result.issues.length } });
       if (globalOpts.json) {
         output(result, true);
         return;
@@ -18076,6 +18321,7 @@ function rowToAgent(row) {
 }
 function registerAgent(input, db) {
   const d = db || getDatabase();
+  const machineId = currentStorageMachineId(d);
   const existingNames = d.query("SELECT name FROM agents").all().map((row) => row.name);
   const normalizedName = validateAgentName(input.name, existingNames);
   const existing = getAgentByName(normalizedName, d);
@@ -18116,14 +18362,18 @@ function registerAgent(input, db) {
       updates.push("active_project_id = ?");
       params.push(input.project_id);
     }
+    if (!existing.machine_id && machineId) {
+      updates.push("machine_id = ?");
+      params.push(machineId);
+    }
     params.push(existing.id);
     d.run(`UPDATE agents SET ${updates.join(", ")} WHERE id = ?`, params);
     return getAgent(existing.id, d);
   }
   const id = shortUuid();
   const timestamp = now();
-  d.run(`INSERT INTO agents (id, name, description, role, title, level, permissions, capabilities, reports_to, org_id, metadata, created_at, last_seen_at, session_id, working_dir, active_project_id)
-     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`, [
+  d.run(`INSERT INTO agents (id, name, description, role, title, level, permissions, capabilities, reports_to, org_id, metadata, created_at, last_seen_at, session_id, working_dir, active_project_id, machine_id)
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`, [
     id,
     normalizedName,
     input.description || null,
@@ -18139,7 +18389,8 @@ function registerAgent(input, db) {
     timestamp,
     input.session_id || null,
     input.working_dir || null,
-    input.project_id && input.session_id ? input.project_id : null
+    input.project_id && input.session_id ? input.project_id : null,
+    machineId
   ]);
   return getAgent(id, d);
 }
@@ -18322,6 +18573,7 @@ function getCapableAgents(capabilities, opts, db) {
 }
 var init_agents = __esm(() => {
   init_database();
+  init_storage_tombstones();
   init_agent_names();
 });
 
@@ -19584,7 +19836,7 @@ __export(exports_local_extensions, {
 });
 import { createHash as createHash5, createVerify } from "crypto";
 import { existsSync as existsSync13, readdirSync as readdirSync3, readFileSync as readFileSync7, statSync as statSync5 } from "fs";
-import { basename as basename6, join as join11, resolve as resolve12 } from "path";
+import { basename as basename6, join as join11, resolve as resolve13 } from "path";
 function isObject(value) {
   return Boolean(value && typeof value === "object" && !Array.isArray(value));
 }
@@ -19842,7 +20094,7 @@ function verifyExtensionSignature(input) {
   return verifier.verify(input.public_key, decodeSignature(input.signature));
 }
 function inspectExtensionSource(source2) {
-  const resolved = resolve12(source2);
+  const resolved = resolve13(source2);
   if (!existsSync13(resolved))
     throw new Error(`extension source not found: ${source2}`);
   const stat = statSync5(resolved);
@@ -19940,7 +20192,7 @@ function testExtensionCompatibility(sourceOrManifest) {
 function projectExtensionSources(projectPath) {
   if (!projectPath)
     return [];
-  const root = resolve12(projectPath);
+  const root = resolve13(projectPath);
   const candidates = [
     join11(root, "todos.extension.json"),
     join11(root, ".todos", "todos.extension.json")
@@ -19959,7 +20211,7 @@ function projectExtensionSources(projectPath) {
 }
 function discoverLocalExtensions(options = {}) {
   const config = loadConfig();
-  const projectPath = options.project_path ? resolve12(options.project_path) : null;
+  const projectPath = options.project_path ? resolve13(options.project_path) : null;
   const configuredSources = [
     ...config.extension_sources || [],
     ...projectPath ? config.project_overrides?.[projectPath]?.extension_sources || [] : []
@@ -19967,7 +20219,7 @@ function discoverLocalExtensions(options = {}) {
   const sources = Array.from(new Set([
     ...configuredSources,
     ...projectExtensionSources(projectPath || undefined)
-  ])).map((source2) => projectPath && !source2.startsWith("/") ? resolve12(projectPath, source2) : resolve12(source2));
+  ])).map((source2) => projectPath && !source2.startsWith("/") ? resolve13(projectPath, source2) : resolve13(source2));
   const warnings = [];
   const discovered = [];
   for (const source2 of sources) {
@@ -20227,9 +20479,9 @@ __export(exports_policy_packs, {
   getPolicyPack: () => getPolicyPack,
   explainPolicyPack: () => explainPolicyPack
 });
-import { relative as relative4, resolve as resolve13 } from "path";
+import { relative as relative4, resolve as resolve14 } from "path";
 function normalizePath3(path) {
-  return resolve13(path);
+  return resolve14(path);
 }
 function unique5(values) {
   return Array.from(new Set((values || []).map((value) => value.trim()).filter(Boolean)));
@@ -20284,7 +20536,7 @@ function commandMatches(commands, pattern) {
 }
 function pathMatches(paths, pattern, root) {
   return paths.filter((path) => {
-    const candidate = path.startsWith("/") ? path : resolve13(root, path);
+    const candidate = path.startsWith("/") ? path : resolve14(root, path);
     if (!isPathInside3(root, candidate))
       return matchesPattern3(path, pattern);
     return matchesPattern3(path, pattern) || matchesPattern3(relative4(root, candidate), pattern);
@@ -20641,7 +20893,8 @@ function logApprovalEvent(taskId, action, gate, agentId, db) {
   if (action === "approved" || action === "rejected" || action === "expired") {
     emitLocalEventHooksQuiet({
       type: "approval.decided",
-      payload: { task_id: taskId, gate: gate.gate, status: gate.status, reviewer: gate.reviewer, run_id: gate.run_id }
+      payload: { task_id: taskId, gate: gate.gate, status: gate.status, reviewer: gate.reviewer, run_id: gate.run_id },
+      databasePath: databasePathFromDatabase(db)
     });
   }
 }
@@ -20787,6 +21040,7 @@ var init_approval_gates = __esm(() => {
   init_task_runs();
   init_tasks();
   init_types();
+  init_event_emission_safety();
   init_event_hooks();
 });
 
@@ -21638,7 +21892,7 @@ var init_doctor = __esm(() => {
 });
 
 // src/server/routes.ts
-import { join as join13, resolve as resolve14, sep } from "path";
+import { join as join13, resolve as resolve15, sep as sep2 } from "path";
 function parseFieldsParam(url) {
   const fieldsParam = url.searchParams.get("fields");
   return fieldsParam ? fieldsParam.split(",").map((f) => f.trim()).filter(Boolean) : undefined;
@@ -22376,9 +22630,9 @@ function handleStaticFiles(path, method, ctx, json2, serveStaticFile2) {
     return null;
   if (path !== "/") {
     const filePath = join13(ctx.dashboardDir, path);
-    const resolvedFile = resolve14(filePath);
-    const resolvedBase = resolve14(ctx.dashboardDir);
-    if (!resolvedFile.startsWith(resolvedBase + sep) && resolvedFile !== resolvedBase) {
+    const resolvedFile = resolve15(filePath);
+    const resolvedBase = resolve15(ctx.dashboardDir);
+    if (!resolvedFile.startsWith(resolvedBase + sep2) && resolvedFile !== resolvedBase) {
       return json2({ error: "Forbidden" }, 403);
     }
     const res2 = serveStaticFile2(filePath);
@@ -27381,7 +27635,7 @@ __export(exports_mention_resolver, {
   resolveMentions: () => resolveMentions
 });
 import { existsSync as existsSync15, readdirSync as readdirSync4, readFileSync as readFileSync8, statSync as statSync7 } from "fs";
-import { basename as basename8, isAbsolute, join as join14, relative as relative5, resolve as resolve15, sep as sep2 } from "path";
+import { basename as basename8, isAbsolute, join as join14, relative as relative5, resolve as resolve16, sep as sep3 } from "path";
 function blankResolution(parsed) {
   return {
     input: parsed.input,
@@ -27404,11 +27658,11 @@ function backlink(kind, key, label, target = key) {
   return { kind, key, label, target };
 }
 function normalizeWorkspace(workspace) {
-  return resolve15(workspace || process.cwd());
+  return resolve16(workspace || process.cwd());
 }
 function isInside(root, absolutePath) {
   const rel = relative5(root, absolutePath);
-  return rel === "" || !rel.startsWith("..") && !rel.includes(`..${sep2}`) && !isAbsolute(rel);
+  return rel === "" || !rel.startsWith("..") && !rel.includes(`..${sep3}`) && !isAbsolute(rel);
 }
 function normalizeRelativePath(value) {
   const normalized = value.trim().replace(/^\.?\//, "").replace(/\\/g, "/");
@@ -27472,7 +27726,7 @@ function resolveFile(parsed, workspace) {
     resolution.warnings.push("path is empty or escapes the workspace");
     return resolution;
   }
-  const absolutePath = resolve15(workspace, relPath);
+  const absolutePath = resolve16(workspace, relPath);
   if (!isInside(workspace, absolutePath)) {
     resolution.path = relPath;
     resolution.warnings.push("path escapes the workspace");
@@ -29999,7 +30253,7 @@ function canonicalize(value) {
 function hash(value) {
   return createHash7("sha256").update(value).digest("hex");
 }
-function parsePayload(value) {
+function parsePayload2(value) {
   if (!value)
     return {};
   try {
@@ -30098,7 +30352,7 @@ function taskScopedRows(db, scope) {
       FROM handoffs h
       WHERE h.project_id IS NULL OR h.project_id = COALESCE(?, h.project_id)
     `).all(scope.project_id ?? null).filter((row) => {
-      const payload = parsePayload(row.payload_json);
+      const payload = parsePayload2(row.payload_json);
       const taskRefs = parseStringArray(payload["task_ids"]);
       const runRefs = parseStringArray(payload["run_ids"]);
       if (scope.project_id && row.project_id !== scope.project_id)
@@ -30129,7 +30383,7 @@ function toLedgerEntries(rows) {
   });
   let previous = LOCAL_AUDIT_LEDGER_INITIAL_HASH;
   return ordered.map((row, index) => {
-    const payload = parsePayload(row.payload_json);
+    const payload = parsePayload2(row.payload_json);
     const payloadHash = hash(canonicalize({ source: row.source, source_id: row.source_id, created_at: row.created_at, payload }));
     const chainHash = hash(`${previous}
 ${payloadHash}`);
@@ -30277,7 +30531,7 @@ __export(exports_release_compatibility, {
   LOCAL_RELEASE_COMPATIBILITY_SCHEMA_VERSION: () => LOCAL_RELEASE_COMPATIBILITY_SCHEMA_VERSION
 });
 import { readFileSync as readFileSync9 } from "fs";
-import { join as join15, resolve as resolve16 } from "path";
+import { join as join15, resolve as resolve17 } from "path";
 import { Database as Database2 } from "bun:sqlite";
 function pass(id, message, details) {
   return { id, status: "passed", message, details };
@@ -30385,7 +30639,7 @@ function checkChangelog() {
   ];
 }
 function createReleaseCompatibilityReport(options = {}) {
-  const root = resolve16(options.root ?? process.cwd());
+  const root = resolve17(options.root ?? process.cwd());
   const packageJson = readPackageJson2(root);
   const simulatedLevels = options.simulated_levels ?? defaultSimulationLevels();
   const checks = [
@@ -36065,7 +36319,7 @@ function classifyLog(text) {
 async function sleep3(ms) {
   if (ms <= 0)
     return;
-  await new Promise((resolve17) => setTimeout(resolve17, ms));
+  await new Promise((resolve18) => setTimeout(resolve18, ms));
 }
 async function runCommandProvider(provider, input) {
   const commandTemplate = input.command || provider.command;
@@ -38415,7 +38669,7 @@ __export(exports_local_backups, {
 });
 import { createHash as createHash8 } from "crypto";
 import { readFileSync as readFileSync11, writeFileSync as writeFileSync5 } from "fs";
-import { dirname as dirname8, resolve as resolve17 } from "path";
+import { dirname as dirname8, resolve as resolve18 } from "path";
 import { mkdirSync as mkdirSync7 } from "fs";
 function stableJson(value) {
   if (value === null || typeof value !== "object")
@@ -38517,14 +38771,14 @@ function createLocalBackup(options = {}, db) {
   return backup;
 }
 function writeLocalBackupFile(backup, outputPath) {
-  const path = resolve17(outputPath);
+  const path = resolve18(outputPath);
   mkdirSync7(dirname8(path), { recursive: true });
   writeFileSync5(path, `${JSON.stringify(backup, null, 2)}
 `);
   return path;
 }
 function readLocalBackupFile(path) {
-  return JSON.parse(readFileSync11(resolve17(path), "utf-8"));
+  return JSON.parse(readFileSync11(resolve18(path), "utf-8"));
 }
 function verifyLocalBackup(value, options = {}, db) {
   const verifiedAt = options.verified_at ?? now();
@@ -42820,7 +43074,8 @@ function writeQueue(task2, queue, actor, action, db) {
   logTaskChange(task2.id, `review_queue.${action}`, "review_queue", null, JSON.stringify(queue), actor, d);
   emitLocalEventHooksQuiet({
     type: `review.${action}`,
-    payload: { task_id: task2.id, queue: queue.queue, state: queue.state, reviewer: queue.reviewer, claimed_by: queue.claimed_by }
+    payload: { task_id: task2.id, queue: queue.queue, state: queue.state, reviewer: queue.reviewer, claimed_by: queue.claimed_by },
+    databasePath: databasePathFromDatabase(d)
   });
   return itemFromTask(taskOrThrow2(task2.id, d), queue, d);
 }
@@ -43124,6 +43379,7 @@ var init_review_queues = __esm(() => {
   init_database();
   init_tasks();
   init_config();
+  init_event_emission_safety();
   init_event_hooks();
   init_task_contracts();
   STATES = new Set(["requested", "claimed", "approved", "changes_requested", "returned", "reopened"]);
@@ -45222,8 +45478,8 @@ __export(exports_environment_snapshots, {
 import { createHash as createHash12 } from "crypto";
 import { existsSync as existsSync17, readFileSync as readFileSync13, statSync as statSync8 } from "fs";
 import { hostname as hostname2, platform, arch } from "os";
-import { dirname as dirname9, join as join17, resolve as resolve18 } from "path";
-import { tmpdir as tmpdir2 } from "os";
+import { dirname as dirname9, join as join17, resolve as resolve19 } from "path";
+import { tmpdir as tmpdir3 } from "os";
 function sha2566(value) {
   return createHash12("sha256").update(value).digest("hex");
 }
@@ -45336,15 +45592,15 @@ function commandEnv(env, includeValues) {
 function defaultSnapshotDir() {
   const dbPath = getDatabasePath();
   if (dbPath === ":memory:" || dbPath.startsWith("file::memory:"))
-    return join17(tmpdir2(), "hasna-todos", "environment-snapshots");
-  return join17(dirname9(resolve18(dbPath)), "environment-snapshots");
+    return join17(tmpdir3(), "hasna-todos", "environment-snapshots");
+  return join17(dirname9(resolve19(dbPath)), "environment-snapshots");
 }
 function snapshotWithId(snapshot) {
   const digest = sha2566(JSON.stringify(snapshot)).slice(0, 24);
   return { id: `env_${digest}`, ...snapshot };
 }
 function captureEnvironmentSnapshot(input = {}) {
-  const root = resolve18(input.root || process.cwd());
+  const root = resolve19(input.root || process.cwd());
   const env = input.env || process.env;
   const warnings = [];
   const manifests = MANIFEST_FILES.map((file) => manifestRecord(root, file)).filter((file) => Boolean(file));
@@ -45384,13 +45640,13 @@ function captureEnvironmentSnapshot(input = {}) {
   });
 }
 function writeEnvironmentSnapshot(snapshot, outputPath) {
-  const path = outputPath ? resolve18(outputPath) : join17(defaultSnapshotDir(), `${snapshot.id}.json`);
+  const path = outputPath ? resolve19(outputPath) : join17(defaultSnapshotDir(), `${snapshot.id}.json`);
   ensureDir2(dirname9(path));
   writeJsonFile(path, snapshot);
   return path;
 }
 function readEnvironmentSnapshot(path) {
-  const snapshot = readJsonFile(resolve18(path));
+  const snapshot = readJsonFile(resolve19(path));
   if (!snapshot || snapshot.schema_version !== 1 || typeof snapshot.id !== "string") {
     throw new Error(`Invalid environment snapshot: ${path}`);
   }
@@ -53241,7 +53497,7 @@ __export(exports_machines, {
 import chalk10 from "chalk";
 import { execSync as execSync4 } from "child_process";
 import { readFileSync as readFileSync17, unlinkSync as unlinkSync2, writeFileSync as writeFileSync10 } from "fs";
-import { tmpdir as tmpdir3 } from "os";
+import { tmpdir as tmpdir4 } from "os";
 import { join as join21 } from "path";
 function getOrCreateLocalMachineName() {
   return process.env["TODOS_MACHINE_NAME"] || __require("os").hostname() || "unknown";
@@ -53280,7 +53536,7 @@ function remoteTempPath(sshAddress) {
 }
 function readRemoteBridgeBundle(sshAddress) {
   const remotePath = remoteTempPath(sshAddress);
-  const localPath = join21(tmpdir3(), `todos-bridge-pull-${uuid()}.json`);
+  const localPath = join21(tmpdir4(), `todos-bridge-pull-${uuid()}.json`);
   try {
     runSsh(sshAddress, `todos export --format bridge --allow-plaintext-sensitive --output ${shellQuote(remotePath)}`, 120000);
     scpFromRemote(sshAddress, remotePath, localPath);
@@ -53295,7 +53551,7 @@ function readRemoteBridgeBundle(sshAddress) {
   }
 }
 function writeLocalBridgeBundle() {
-  const localPath = join21(tmpdir3(), `todos-bridge-push-${uuid()}.json`);
+  const localPath = join21(tmpdir4(), `todos-bridge-push-${uuid()}.json`);
   writeFileSync10(localPath, JSON.stringify(createLocalBridgeBundle(), null, 2));
   return localPath;
 }
@@ -54359,7 +54615,7 @@ __export(exports_onboarding_commands, {
   registerOnboardingCommands: () => registerOnboardingCommands
 });
 import chalk17 from "chalk";
-import { resolve as resolve19 } from "path";
+import { resolve as resolve20 } from "path";
 function registerOnboardingCommands(program2) {
   program2.command("onboarding").alias("demo-fixtures").description("List, show, write, or import bundled local onboarding fixtures").option("--show <name>", "Show one fixture bridge bundle as JSON").option("--write <dir>", "Write all bundled fixture bridge bundles to a directory").option("--import <name>", "Dry-run or apply an onboarding fixture import").option("--apply", "Apply an onboarding fixture import. Defaults to dry-run.").option("--resolve-conflicts", "Safely merge existing local tasks while preserving divergent fields").action(async (opts) => {
     const globalOpts = program2.opts();
@@ -54375,7 +54631,7 @@ function registerOnboardingCommands(program2) {
         return;
       }
       if (opts.write) {
-        const result = writeOnboardingFixtureFiles2(resolve19(opts.write));
+        const result = writeOnboardingFixtureFiles2(resolve20(opts.write));
         if (globalOpts.json) {
           output(result, true);
           return;
@@ -57955,7 +58211,7 @@ __export(exports_sdk_fixture_commands, {
   registerSdkFixtureCommands: () => registerSdkFixtureCommands
 });
 import chalk19 from "chalk";
-import { resolve as resolve20 } from "path";
+import { resolve as resolve21 } from "path";
 function registerSdkFixtureCommands(program2) {
   program2.command("sdk-fixtures").description("List, show, or write local SDK integration fixtures").option("--show", "Print the full fixture pack JSON").option("--write <dir>", "Write fixture pack, bridge fixture, contract snapshots, and example index to a directory").action(async (opts) => {
     const globalOpts = program2.opts();
@@ -57966,7 +58222,7 @@ function registerSdkFixtureCommands(program2) {
         writeSdkIntegrationFixtures: writeSdkIntegrationFixtures2
       } = await Promise.resolve().then(() => (init_sdk_integration_fixtures(), exports_sdk_integration_fixtures));
       if (opts.write) {
-        const result = writeSdkIntegrationFixtures2(resolve20(opts.write));
+        const result = writeSdkIntegrationFixtures2(resolve21(opts.write));
         if (globalOpts.json) {
           console.log(JSON.stringify(result));
           return;
@@ -58788,7 +59044,7 @@ __export(exports_local_backup_commands, {
   registerLocalBackupCommands: () => registerLocalBackupCommands
 });
 import chalk26 from "chalk";
-import { resolve as resolve21 } from "path";
+import { resolve as resolve22 } from "path";
 function globalOptions6(program2) {
   const command = program2;
   return command.optsWithGlobals?.() ?? program2.opts();
@@ -58810,10 +59066,10 @@ function registerLocalBackupCommands(program2) {
       const projectId = opts.projectId ?? autoProject(globalOpts);
       const backupBundle = createLocalBackup2({
         project_id: projectId,
-        output_path: opts.output ? resolve21(opts.output) : undefined
+        output_path: opts.output ? resolve22(opts.output) : undefined
       });
       const result = {
-        output_path: opts.output ? resolve21(opts.output) : null,
+        output_path: opts.output ? resolve22(opts.output) : null,
         backup: backupBundle
       };
       if (opts.json || globalOpts.json) {
@@ -59072,11 +59328,13 @@ function exportSqliteTodosStorageSnapshot(db) {
     source: "sqlite",
     tasks: listTasks({ include_archived: true }, d),
     projects: listProjects(d),
+    projectMachinePaths: listProjectMachinePaths(d),
     plans: listPlans(undefined, d),
     agents: listAgents({ include_archived: true }, d),
     taskLists: listTaskLists(undefined, d),
     templates: listTemplates(d),
-    auditHistory: getRecentActivity(Number.MAX_SAFE_INTEGER, d)
+    auditHistory: getRecentActivity(Number.MAX_SAFE_INTEGER, d),
+    tombstones: listStorageTombstones(d)
   };
 }
 function importSqliteTodosStorageSnapshot(snapshot, db) {
@@ -59084,13 +59342,19 @@ function importSqliteTodosStorageSnapshot(snapshot, db) {
   const result = {
     inserted: 0,
     updated: 0,
+    deleted: 0,
     skipped: 0,
     errors: []
   };
-  const applyRows = (table, columns, rows, updateClockColumn, afterUpsert) => {
+  const applyRows = (objectType2, table, columns, rows, updateClockColumn, afterUpsert) => {
     for (const row of rows) {
       try {
         const record = asRecord2(row);
+        const tombstone = typeof record["id"] === "string" ? getStorageTombstone(objectType2, record["id"], d) : null;
+        if (tombstone && shouldApplyStorageTombstone(tombstone, rowClock(record, updateClockColumn))) {
+          result.skipped += 1;
+          continue;
+        }
         const state = upsertById(d, table, columns, record, updateClockColumn);
         if (state === "inserted")
           result.inserted += 1;
@@ -59104,17 +59368,19 @@ function importSqliteTodosStorageSnapshot(snapshot, db) {
       }
     }
   };
-  applyRows("projects", PROJECT_COLUMNS, snapshot.projects, "updated_at");
-  applyRows("agents", AGENT_COLUMNS, snapshot.agents, "last_seen_at");
-  applyRows("task_lists", TASK_LIST_COLUMNS, snapshot.taskLists, "updated_at");
-  applyRows("plans", PLAN_COLUMNS, snapshot.plans, "updated_at");
-  applyRows("task_templates", TEMPLATE_COLUMNS, snapshot.templates);
-  applyRows("tasks", TASK_COLUMNS, sortedTasks2(snapshot.tasks), "updated_at", (row, changed) => {
+  applyRows("projects", "projects", PROJECT_COLUMNS, snapshot.projects, "updated_at");
+  applyRows("project_machine_paths", "project_machine_paths", PROJECT_MACHINE_PATH_COLUMNS, snapshot.projectMachinePaths ?? [], "updated_at");
+  applyRows("agents", "agents", AGENT_COLUMNS, snapshot.agents, "last_seen_at");
+  applyRows("task_lists", "task_lists", TASK_LIST_COLUMNS, snapshot.taskLists, "updated_at");
+  applyRows("plans", "plans", PLAN_COLUMNS, snapshot.plans, "updated_at");
+  applyRows("templates", "task_templates", TEMPLATE_COLUMNS, snapshot.templates);
+  applyRows("tasks", "tasks", TASK_COLUMNS, sortedTasks2(snapshot.tasks), "updated_at", (row, changed) => {
     if (changed && Array.isArray(row["tags"]) && typeof row["id"] === "string") {
       replaceTaskTags(row["id"], row["tags"].filter((tag) => typeof tag === "string"), d);
     }
   });
-  applyRows("task_history", AUDIT_COLUMNS, snapshot.auditHistory);
+  applyRows("audit_history", "task_history", AUDIT_COLUMNS, snapshot.auditHistory);
+  applyTombstones(d, snapshot.tombstones ?? [], result);
   return result;
 }
 function upsertById(db, table, columns, row, updateClockColumn) {
@@ -59169,7 +59435,86 @@ function sortedTasks2(tasks) {
     visit(task2);
   return result;
 }
-var PROJECT_COLUMNS, TASK_LIST_COLUMNS, PLAN_COLUMNS, AGENT_COLUMNS, TEMPLATE_COLUMNS, TASK_COLUMNS, AUDIT_COLUMNS, JSON_COLUMNS, BOOLEAN_COLUMNS;
+function applyTombstones(db, tombstones, result) {
+  for (const tombstone of tombstones) {
+    try {
+      recordStorageTombstone({
+        object_type: tombstone.object_type,
+        object_id: tombstone.object_id,
+        deleted_at: tombstone.deleted_at,
+        source_machine_id: tombstone.source_machine_id ?? null,
+        payload: tombstone.payload ?? null,
+        version: tombstone.version ?? null
+      }, db);
+      const table = tableForTombstone(tombstone.object_type);
+      const existing = existingClock(db, table, tombstone.object_id);
+      if (!shouldApplyStorageTombstone(tombstone, existing)) {
+        result.skipped += 1;
+        continue;
+      }
+      const deletedTags = table === "tasks" ? db.run("DELETE FROM task_tags WHERE task_id = ?", [tombstone.object_id]).changes : 0;
+      const deleted = db.run(`DELETE FROM ${table} WHERE id = ?`, [tombstone.object_id]).changes;
+      if (deleted > 0 || deletedTags > 0)
+        result.deleted = (result.deleted ?? 0) + 1;
+      else
+        result.skipped += 1;
+    } catch (error) {
+      result.errors.push(error instanceof Error ? error.message : String(error));
+    }
+  }
+}
+function tableForTombstone(objectType2) {
+  if (objectType2 === "tasks")
+    return "tasks";
+  if (objectType2 === "projects")
+    return "projects";
+  if (objectType2 === "project_machine_paths")
+    return "project_machine_paths";
+  if (objectType2 === "plans")
+    return "plans";
+  if (objectType2 === "agents")
+    return "agents";
+  if (objectType2 === "task_lists")
+    return "task_lists";
+  if (objectType2 === "templates")
+    return "task_templates";
+  return "task_history";
+}
+function listRows(db, table, columns) {
+  return db.query(`SELECT ${columns.join(", ")} FROM ${table} ORDER BY id`).all();
+}
+function listProjectMachinePaths(db) {
+  return listRows(db, "project_machine_paths", PROJECT_MACHINE_PATH_COLUMNS).map((row) => ({
+    id: String(row.id),
+    project_id: String(row.project_id),
+    machine_id: String(row.machine_id),
+    path: String(row.path),
+    created_at: String(row.created_at),
+    updated_at: String(row.updated_at)
+  }));
+}
+function existingClock(db, table, id) {
+  const clockColumns = clockColumnsForTable(table);
+  const row = db.query(`SELECT ${clockColumns.join(", ")} FROM ${table} WHERE id = ?`).get(id);
+  return row?.updated_at ?? row?.last_seen_at ?? row?.created_at ?? null;
+}
+function rowClock(row, updateClockColumn) {
+  const value = updateClockColumn ? row[updateClockColumn] : null;
+  return stringClock(value) ?? stringClock(row["updated_at"]) ?? stringClock(row["last_seen_at"]) ?? stringClock(row["created_at"]);
+}
+function stringClock(value) {
+  return typeof value === "string" && value ? value : null;
+}
+function clockColumnsForTable(table) {
+  if (table === "agents")
+    return ["last_seen_at", "created_at"];
+  if (table === "task_templates")
+    return ["created_at"];
+  if (table === "task_history")
+    return ["created_at"];
+  return ["updated_at", "created_at"];
+}
+var PROJECT_COLUMNS, PROJECT_MACHINE_PATH_COLUMNS, TASK_LIST_COLUMNS, PLAN_COLUMNS, AGENT_COLUMNS, TEMPLATE_COLUMNS, TASK_COLUMNS, AUDIT_COLUMNS, JSON_COLUMNS, BOOLEAN_COLUMNS;
 var init_sqlite_snapshot = __esm(() => {
   init_database();
   init_agents();
@@ -59179,6 +59524,7 @@ var init_sqlite_snapshot = __esm(() => {
   init_task_lists();
   init_tasks();
   init_templates();
+  init_storage_tombstones();
   PROJECT_COLUMNS = [
     "id",
     "name",
@@ -59192,6 +59538,14 @@ var init_sqlite_snapshot = __esm(() => {
     "machine_id",
     "synced_at"
   ];
+  PROJECT_MACHINE_PATH_COLUMNS = [
+    "id",
+    "project_id",
+    "machine_id",
+    "path",
+    "created_at",
+    "updated_at"
+  ];
   TASK_LIST_COLUMNS = [
     "id",
     "project_id",
@@ -59501,7 +59855,7 @@ class PostgresTodosSyncStore {
   }
   async pullSnapshot(options = {}) {
     const params = [this.service];
-    const filters = ["service = $1", "deleted_at IS NULL"];
+    const filters = ["service = $1"];
     if (options.since) {
       params.push(options.since);
       filters.push(`updated_at > $${params.length}::timestamptz`);
@@ -59510,7 +59864,7 @@ class PostgresTodosSyncStore {
       params.push(options.objectTypes);
       filters.push(`object_type = ANY($${params.length}::text[])`);
     }
-    const response = await this.client.query(`SELECT object_type, payload FROM ${this.tableName}
+    const response = await this.client.query(`SELECT object_type, object_id, payload, updated_at, deleted_at, source_machine_id, version FROM ${this.tableName}
        WHERE ${filters.join(" AND ")}
        ORDER BY updated_at ASC, object_type ASC, object_id ASC`, params);
     return rowsToSnapshot(response.rows);
@@ -59534,11 +59888,20 @@ function snapshotEntries(snapshot) {
   return [
     ...snapshot.tasks.map((payload) => entry("tasks", payload, snapshot.exportedAt)),
     ...snapshot.projects.map((payload) => entry("projects", payload, snapshot.exportedAt)),
+    ...(snapshot.projectMachinePaths ?? []).map((payload) => entry("project_machine_paths", payload, snapshot.exportedAt)),
     ...snapshot.plans.map((payload) => entry("plans", payload, snapshot.exportedAt)),
     ...snapshot.agents.map((payload) => entry("agents", payload, snapshot.exportedAt)),
     ...snapshot.taskLists.map((payload) => entry("task_lists", payload, snapshot.exportedAt)),
     ...snapshot.templates.map((payload) => entry("templates", payload, snapshot.exportedAt)),
-    ...snapshot.auditHistory.map((payload) => entry("audit_history", payload, snapshot.exportedAt))
+    ...snapshot.auditHistory.map((payload) => entry("audit_history", payload, snapshot.exportedAt)),
+    ...(snapshot.tombstones ?? []).map((tombstone) => ({
+      type: tombstone.object_type,
+      id: tombstone.object_id,
+      payload: tombstone.payload ?? { id: tombstone.object_id, deleted_at: tombstone.deleted_at },
+      updatedAt: tombstone.updated_at || tombstone.deleted_at,
+      deletedAt: tombstone.deleted_at,
+      version: tombstone.version ?? null
+    }))
   ];
 }
 function entry(type, payload, fallbackUpdatedAt) {
@@ -59560,19 +59923,38 @@ function rowsToSnapshot(rows) {
     source: "postgres",
     tasks: [],
     projects: [],
+    projectMachinePaths: [],
     plans: [],
     agents: [],
     taskLists: [],
     templates: [],
-    auditHistory: []
+    auditHistory: [],
+    tombstones: []
   };
   for (const row of rows) {
     const payload = payloadRecord(row.payload);
+    const deletedAt = stringValue(row.deleted_at);
+    if (deletedAt) {
+      snapshot.tombstones ??= [];
+      snapshot.tombstones.push({
+        object_type: row.object_type,
+        object_id: stringValue(row.object_id) ?? stringValue(payload["id"]) ?? "",
+        deleted_at: deletedAt,
+        updated_at: stringValue(row.updated_at) ?? deletedAt,
+        source_machine_id: stringValue(row.source_machine_id),
+        payload,
+        version: numberValue2(row.version)
+      });
+      continue;
+    }
     if (row.object_type === "tasks")
       snapshot.tasks.push(payload);
     else if (row.object_type === "projects")
       snapshot.projects.push(payload);
-    else if (row.object_type === "plans")
+    else if (row.object_type === "project_machine_paths") {
+      snapshot.projectMachinePaths ??= [];
+      snapshot.projectMachinePaths.push(payload);
+    } else if (row.object_type === "plans")
       snapshot.plans.push(payload);
     else if (row.object_type === "agents")
       snapshot.agents.push(payload);
@@ -59593,6 +59975,8 @@ function payloadRecord(value) {
   throw new Error("Postgres sync payload must be a JSON object");
 }
 function stringValue(value) {
+  if (value instanceof Date)
+    return value.toISOString();
   return typeof value === "string" && value ? value : null;
 }
 function numberValue2(value) {
@@ -59751,6 +60135,9 @@ class PostgresJsonRecordStore {
     this.tableName = options.tableName ?? DEFAULT_TODOS_POSTGRES_SYNC_TABLE;
     this.cursorTableName = options.cursorTableName ?? DEFAULT_TODOS_POSTGRES_CURSOR_TABLE;
   }
+  machineId(context) {
+    return context?.requestId ?? this.sourceMachineId ?? null;
+  }
   async ensureSchema() {
     this.schemaReady ??= (async () => {
       for (const sql of postgresTodosSyncSchemaSql(this.tableName, this.cursorTableName)) {
@@ -59782,6 +60169,25 @@ class PostgresJsonRecordStore {
       updatedAt: stringValue2(row.updated_at) ?? new Date().toISOString()
     }));
   }
+  async listTombstones() {
+    await this.ensureSchema();
+    const result = await this.options.client.query(`SELECT object_type, object_id, payload, updated_at, deleted_at, source_machine_id, version
+       FROM ${this.tableName}
+       WHERE service = $1 AND deleted_at IS NOT NULL
+       ORDER BY updated_at ASC, object_type ASC, object_id ASC`, [this.service]);
+    return result.rows.map((row) => {
+      const deletedAt = stringValue2(row.deleted_at) ?? stringValue2(row.updated_at) ?? new Date().toISOString();
+      return {
+        object_type: row.object_type,
+        object_id: row.object_id,
+        deleted_at: deletedAt,
+        updated_at: stringValue2(row.updated_at) ?? deletedAt,
+        source_machine_id: stringValue2(row.source_machine_id),
+        payload: payloadRecord2(row.payload),
+        version: numberValue3(row.version)
+      };
+    });
+  }
   async upsert(type, value, context = {}) {
     await this.ensureSchema();
     const updatedAt = stringValue2(value.updated_at) ?? stringValue2(value.created_at) ?? new Date().toISOString();
@@ -59794,7 +60200,8 @@ class PostgresJsonRecordStore {
         updated_at = EXCLUDED.updated_at,
         deleted_at = NULL,
         source_machine_id = EXCLUDED.source_machine_id,
-        version = EXCLUDED.version`, [
+        version = EXCLUDED.version
+      WHERE ${this.tableName}.updated_at IS NULL OR ${this.tableName}.updated_at <= EXCLUDED.updated_at`, [
       this.service,
       type,
       value.id,
@@ -59811,13 +60218,58 @@ class PostgresJsonRecordStore {
     if (!existing)
       return false;
     const timestamp3 = new Date().toISOString();
-    await this.options.client.query(`UPDATE ${this.tableName}
-       SET deleted_at = $4::timestamptz,
-           updated_at = $4::timestamptz,
-           source_machine_id = $5
-       WHERE service = $1 AND object_type = $2 AND object_id = $3`, [this.service, type, id, timestamp3, context.requestId ?? this.sourceMachineId ?? null]);
+    return this.tombstone({
+      object_type: type,
+      object_id: id,
+      deleted_at: timestamp3,
+      updated_at: timestamp3,
+      payload: existing,
+      version: numberValue3(existing["version"])
+    }, context);
+  }
+  async tombstone(tombstone, context = {}) {
+    await this.ensureSchema();
+    const deletedAt = stringValue2(tombstone.deleted_at) ?? new Date().toISOString();
+    const updatedAt = stringValue2(tombstone.updated_at) ?? deletedAt;
+    const existing = await this.clock(tombstone.object_type, tombstone.object_id);
+    if (existing && compareClock(existing.updatedAt, updatedAt) > 0)
+      return false;
+    await this.options.client.query(`INSERT INTO ${this.tableName} (
+        service, object_type, object_id, payload, updated_at,
+        deleted_at, source_machine_id, version
+      ) VALUES ($1, $2, $3, $4::jsonb, $5::timestamptz, $6::timestamptz, $7, $8)
+      ON CONFLICT (service, object_type, object_id) DO UPDATE SET
+        payload = EXCLUDED.payload,
+        updated_at = EXCLUDED.updated_at,
+        deleted_at = EXCLUDED.deleted_at,
+        source_machine_id = EXCLUDED.source_machine_id,
+        version = EXCLUDED.version
+      WHERE ${this.tableName}.updated_at IS NULL OR ${this.tableName}.updated_at <= EXCLUDED.updated_at`, [
+      this.service,
+      tombstone.object_type,
+      tombstone.object_id,
+      JSON.stringify(tombstone.payload ?? { id: tombstone.object_id, deleted_at: deletedAt }),
+      updatedAt,
+      deletedAt,
+      tombstone.source_machine_id ?? context.requestId ?? this.sourceMachineId ?? null,
+      tombstone.version ?? null
+    ]);
     return true;
   }
+  async clock(type, id) {
+    await this.ensureSchema();
+    const result = await this.options.client.query(`SELECT object_type, object_id, updated_at, deleted_at
+       FROM ${this.tableName}
+       WHERE service = $1 AND object_type = $2 AND object_id = $3
+       LIMIT 1`, [this.service, type, id]);
+    const row = result.rows[0];
+    if (!row)
+      return null;
+    return {
+      updatedAt: stringValue2(row.updated_at) ?? new Date().toISOString(),
+      deletedAt: stringValue2(row.deleted_at)
+    };
+  }
   async getCursor(name) {
     await this.ensureSchema();
     const result = await this.options.client.query(`SELECT value FROM ${this.cursorTableName} WHERE service = $1 AND cursor_name = $2`, [this.service, name]);
@@ -59886,7 +60338,10 @@ async function createTask3(input, store, context) {
     runner_started_at: null,
     runner_completed_at: null,
     current_step: null,
-    total_steps: null
+    total_steps: null,
+    machine_id: store.machineId(context),
+    synced_at: null,
+    archived_at: null
   };
   await store.upsert("tasks", task2, context);
   await logTaskChange2(task2.id, "created", "status", null, task2.status, task2.assigned_by ?? task2.agent_id, store, context);
@@ -60011,7 +60466,9 @@ async function createProject2(input, store, context) {
     task_prefix: input.task_prefix ?? await generateProjectPrefix(input.name, store),
     task_counter: 0,
     created_at: timestamp3,
-    updated_at: timestamp3
+    updated_at: timestamp3,
+    machine_id: store.machineId(context),
+    synced_at: null
   };
   return store.upsert("projects", project, context);
 }
@@ -60031,7 +60488,9 @@ async function createPlan2(input, store, context) {
     description: input.description ?? null,
     status: input.status ?? "active",
     created_at: timestamp3,
-    updated_at: timestamp3
+    updated_at: timestamp3,
+    machine_id: store.machineId(context),
+    synced_at: null
   }, context);
 }
 async function updatePlan2(id, input, store) {
@@ -60061,7 +60520,9 @@ async function registerAgent2(input, store, context) {
     last_seen_at: timestamp3,
     session_id: input.session_id ?? context?.sessionId ?? existing?.session_id ?? null,
     working_dir: input.working_dir ?? existing?.working_dir ?? null,
-    active_project_id: input.project_id ?? context?.projectId ?? existing?.active_project_id ?? null
+    active_project_id: input.project_id ?? context?.projectId ?? existing?.active_project_id ?? null,
+    machine_id: existing?.machine_id ?? store.machineId(context),
+    synced_at: existing?.synced_at ?? null
   };
   return store.upsert("agents", agent, context);
 }
@@ -60088,7 +60549,9 @@ async function createTaskList2(input, store, context) {
     description: input.description ?? null,
     metadata: input.metadata ?? {},
     created_at: timestamp3,
-    updated_at: timestamp3
+    updated_at: timestamp3,
+    machine_id: store.machineId(context),
+    synced_at: null
   }, context);
 }
 async function updateTaskList2(id, input, store) {
@@ -60114,7 +60577,9 @@ async function createTemplate2(input, store, context) {
     project_id: input.project_id ?? context?.projectId ?? null,
     plan_id: input.plan_id ?? null,
     metadata: input.metadata ?? {},
-    created_at: timestamp3
+    created_at: timestamp3,
+    machine_id: store.machineId(context),
+    synced_at: null
   }, context);
 }
 async function updateTemplate2(id, input, store) {
@@ -60139,7 +60604,8 @@ async function logTaskChange2(taskId, action, field2, oldValue, newValue, agentI
     old_value: oldValue ?? null,
     new_value: newValue ?? null,
     agent_id: agentId ?? context?.agentId ?? null,
-    created_at: new Date().toISOString()
+    created_at: new Date().toISOString(),
+    machine_id: store.machineId(context)
   };
   return store.upsert("audit_history", entry2, context);
 }
@@ -60162,18 +60628,21 @@ async function exportSnapshot(store) {
     source: "postgres",
     tasks: await store.list("tasks"),
     projects: await store.list("projects"),
+    projectMachinePaths: await store.list("project_machine_paths"),
     plans: await store.list("plans"),
     agents: await store.list("agents"),
     taskLists: await store.list("task_lists"),
     templates: await store.list("templates"),
-    auditHistory: await store.list("audit_history")
+    auditHistory: await store.list("audit_history"),
+    tombstones: await store.listTombstones()
   };
 }
 async function importSnapshot(snapshot, store, context) {
-  const result = { inserted: 0, updated: 0, skipped: 0, errors: [] };
+  const result = { inserted: 0, updated: 0, deleted: 0, skipped: 0, errors: [] };
   const entries = [
     ...snapshot.tasks.map((row) => ["tasks", row]),
     ...snapshot.projects.map((row) => ["projects", row]),
+    ...(snapshot.projectMachinePaths ?? []).map((row) => ["project_machine_paths", row]),
     ...snapshot.plans.map((row) => ["plans", row]),
     ...snapshot.agents.map((row) => ["agents", row]),
     ...snapshot.taskLists.map((row) => ["task_lists", row]),
@@ -60192,6 +60661,25 @@ async function importSnapshot(snapshot, store, context) {
       result.errors.push(error instanceof Error ? error.message : String(error));
     }
   }
+  for (const tombstone of snapshot.tombstones ?? []) {
+    try {
+      const deleted = await store.tombstone({
+        object_type: tombstone.object_type,
+        object_id: tombstone.object_id,
+        deleted_at: tombstone.deleted_at,
+        updated_at: tombstone.updated_at,
+        source_machine_id: tombstone.source_machine_id ?? null,
+        payload: tombstone.payload ?? null,
+        version: tombstone.version ?? null
+      }, context);
+      if (deleted)
+        result.deleted = (result.deleted ?? 0) + 1;
+      else
+        result.skipped += 1;
+    } catch (error) {
+      result.errors.push(error instanceof Error ? error.message : String(error));
+    }
+  }
   return result;
 }
 async function requireRecord(type, id, store) {
@@ -60274,8 +60762,17 @@ function payloadRecord2(value) {
   throw new Error("Postgres storage payload must be a JSON object");
 }
 function stringValue2(value) {
+  if (value instanceof Date)
+    return value.toISOString();
   return typeof value === "string" && value ? value : null;
 }
+function compareClock(left, right) {
+  const leftClock = Date.parse(left);
+  const rightClock = Date.parse(right);
+  if (Number.isNaN(leftClock) || Number.isNaN(rightClock))
+    return left.localeCompare(right);
+  return leftClock - rightClock;
+}
 function numberValue3(value) {
   return typeof value === "number" && Number.isSafeInteger(value) ? value : null;
 }
@@ -60949,6 +61446,7 @@ var init_native_storage_status = __esm(() => {
 // src/cli/commands/storage-commands.ts
 var exports_storage_commands = {};
 __export(exports_storage_commands, {
+  s3CredentialsFromEnv: () => s3CredentialsFromEnv,
   registerStorageCommands: () => registerStorageCommands
 });
 import chalk27 from "chalk";
@@ -61027,13 +61525,13 @@ function artifactFilter(opts) {
     ...opts.includeAlreadySynced ? { includeAlreadySynced: true } : {}
   };
 }
-function s3CredentialsFromEnv() {
-  const { TODOS_STORAGE_ENV: TODOS_STORAGE_ENV2 } = (init_storage(), __toCommonJS(exports_storage));
-  const accessKeyId = process.env[TODOS_STORAGE_ENV2.s3AccessKeyId]?.trim();
-  const secretAccessKey = process.env[TODOS_STORAGE_ENV2.s3SecretAccessKey]?.trim();
-  const sessionToken = process.env[TODOS_STORAGE_ENV2.s3SessionToken]?.trim();
+function s3CredentialsFromEnv(env = process.env) {
+  const { TODOS_STORAGE_ENV: TODOS_STORAGE_ENV2, TODOS_STORAGE_FALLBACK_ENV: TODOS_STORAGE_FALLBACK_ENV2 } = (init_storage(), __toCommonJS(exports_storage));
+  const accessKeyId = (env[TODOS_STORAGE_ENV2.s3AccessKeyId] ?? env[TODOS_STORAGE_FALLBACK_ENV2.s3AccessKeyId])?.trim();
+  const secretAccessKey = (env[TODOS_STORAGE_ENV2.s3SecretAccessKey] ?? env[TODOS_STORAGE_FALLBACK_ENV2.s3SecretAccessKey])?.trim();
+  const sessionToken = (env[TODOS_STORAGE_ENV2.s3SessionToken] ?? env[TODOS_STORAGE_FALLBACK_ENV2.s3SessionToken])?.trim();
   if (!accessKeyId || !secretAccessKey) {
-    throw new Error(`${TODOS_STORAGE_ENV2.s3AccessKeyId} and ${TODOS_STORAGE_ENV2.s3SecretAccessKey} are required for --apply`);
+    throw new Error(`${TODOS_STORAGE_ENV2.s3AccessKeyId}/${TODOS_STORAGE_FALLBACK_ENV2.s3AccessKeyId} and ${TODOS_STORAGE_ENV2.s3SecretAccessKey}/${TODOS_STORAGE_FALLBACK_ENV2.s3SecretAccessKey} are required for --apply`);
   }
   return {
     accessKeyId,