@hasna/todos 0.15.52 → 0.16.0

package/dist/storage.js

@@ -253,7 +253,7 @@ function isBlockingDependencyStatus(status) {
 function isTerminalStatus(status) {
   return status === "completed" || status === "failed" || status === "cancelled";
 }
-var TASK_STATUSES, TASK_PRIORITIES, PLAN_STATUSES, VersionConflictError, TaskNotFoundError, TaskNotStartableError, TaskReferenceAmbiguousError, ProjectNotFoundError, ResourceConflictError, PlanRevisionConflictError, PlanNotFoundError, LockError, StaleLockHandoffError, AgentNotFoundError, IdentityAliasAmbiguousError, IdentityIdImmutableError, TaskListNotFoundError, DependencyCycleError, CompletionGuardError, DISPATCH_STATUSES, DispatchNotFoundError;
+var TASK_STATUSES, TASK_PRIORITIES, PLAN_STATUSES, VersionConflictError, TaskNotFoundError, TaskNotStartableError, TaskReferenceAmbiguousError, ProjectNotFoundError, ResourceConflictError, PlanRevisionConflictError, PlanNotFoundError, LockError, StaleLockHandoffError, AgentNotFoundError, IdentityAliasAmbiguousError, IdentityIdImmutableError, TaskListNotFoundError, DependencyCycleError, CompletionGuardError, DISPATCH_STATUSES, DispatchNotFoundError, InputValidationError;
 var init_types = __esm(() => {
   TASK_STATUSES = [
     "pending",
@@ -268,7 +268,7 @@ var init_types = __esm(() => {
     "high",
     "critical"
   ];
-  PLAN_STATUSES = ["active", "completed", "archived"];
+  PLAN_STATUSES = ["active", "completed", "archived", "planning", "cancelled"];
   VersionConflictError = class VersionConflictError extends Error {
     taskId;
     expectedVersion;
@@ -457,6 +457,72 @@ var init_types = __esm(() => {
       this.name = "DispatchNotFoundError";
     }
   };
+  InputValidationError = class InputValidationError extends Error {
+    static code = "INVALID_INPUT";
+    code = InputValidationError.code;
+    suggestion;
+    constructor(message, suggestion) {
+      super(message);
+      this.name = "InputValidationError";
+      this.suggestion = suggestion;
+    }
+  };
+});
+
+// src/lib/local-opt-in.ts
+import {
+  clientTransportEnvKeys,
+  credentialOverrideEnvKey,
+  credentialPointerEnvKey,
+  CREDENTIAL_PROFILE_ENV_KEY
+} from "@hasna/contracts/client";
+function isTodosLocalOptIn(env = process.env) {
+  return TODOS_LOCAL_OPT_IN_ENV_KEYS.some((key) => (env[key] ?? "").trim() !== "");
+}
+function todosAuthorityEnvKeys() {
+  const keys = clientTransportEnvKeys("todos");
+  return [
+    ...keys.apiUrlKeys,
+    ...keys.apiKeyKeys,
+    credentialOverrideEnvKey("todos"),
+    credentialPointerEnvKey("todos"),
+    CREDENTIAL_PROFILE_ENV_KEY
+  ];
+}
+function hasTodosEnvAuthorityIntent(env = process.env) {
+  return todosAuthorityEnvKeys().some((key) => (env[key] ?? "").trim() !== "");
+}
+function selectsTodosLocalStore(env = process.env) {
+  return !hasTodosEnvAuthorityIntent(env) && isTodosLocalOptIn(env);
+}
+function todosResolverEnv(env) {
+  const blanks = todosAuthorityEnvKeys().filter((key) => (key in env) && (env[key] ?? "").trim() === "");
+  if (blanks.length === 0)
+    return env;
+  const next = { ...env };
+  for (const key of blanks)
+    delete next[key];
+  return next;
+}
+function isAmbientTodosEnv(env) {
+  if (typeof process !== "undefined" && env === process.env)
+    return true;
+  return env[CONTRACTS_AMBIENT_ENVIRONMENT] === true;
+}
+function todosResolverInputs(env, credentials = {}) {
+  const normalised = todosResolverEnv(env);
+  if (normalised === env)
+    return { env: normalised, credentials };
+  const keychain = { ...credentials.keychain };
+  if (keychain.enabled === undefined && keychain.run === undefined) {
+    keychain.enabled = isAmbientTodosEnv(env);
+  }
+  return { env: normalised, credentials: { ...credentials, keychain } };
+}
+var TODOS_LOCAL_OPT_IN_ENV_KEYS, CONTRACTS_AMBIENT_ENVIRONMENT;
+var init_local_opt_in = __esm(() => {
+  TODOS_LOCAL_OPT_IN_ENV_KEYS = ["HASNA_TODOS_LOCAL", "TODOS_LOCAL"];
+  CONTRACTS_AMBIENT_ENVIRONMENT = Symbol.for("hasna:contracts:ambientClientEnvironment");
 });
 
 // src/project-registration/schema.ts
@@ -2028,16 +2094,18 @@ var init_migrations = __esm(() => {
   SET leaf_task_id = COALESCE(leaf_task_id, (
         SELECT attempt.leaf_task_id
         FROM pr_group_attempts AS attempt
+        JOIN pr_groups AS owner ON owner.id = attempt.group_id
         WHERE attempt.group_id = pr_groups.id
-        ORDER BY CASE WHEN attempt.id = pr_groups.active_attempt_id THEN 0 ELSE 1 END,
+        ORDER BY CASE WHEN attempt.id = owner.active_attempt_id THEN 0 ELSE 1 END,
                  attempt.created_at ASC, attempt.id ASC
         LIMIT 1
       )),
       branch = COALESCE(branch, (
         SELECT attempt.branch
         FROM pr_group_attempts AS attempt
+        JOIN pr_groups AS owner ON owner.id = attempt.group_id
         WHERE attempt.group_id = pr_groups.id
-        ORDER BY CASE WHEN attempt.id = pr_groups.active_attempt_id THEN 0 ELSE 1 END,
+        ORDER BY CASE WHEN attempt.id = owner.active_attempt_id THEN 0 ELSE 1 END,
                  attempt.created_at ASC, attempt.id ASC
         LIMIT 1
       ));
@@ -2060,16 +2128,18 @@ var init_migrations = __esm(() => {
   SET pr_number = COALESCE(pr_number, (
         SELECT attempt.pr_number
         FROM pr_group_attempts AS attempt
+        JOIN pr_groups AS owner ON owner.id = attempt.group_id
         WHERE attempt.group_id = pr_groups.id AND attempt.pr_number IS NOT NULL
-        ORDER BY CASE WHEN attempt.id = pr_groups.active_attempt_id THEN 0 ELSE 1 END,
+        ORDER BY CASE WHEN attempt.id = owner.active_attempt_id THEN 0 ELSE 1 END,
                  attempt.created_at ASC, attempt.id ASC
         LIMIT 1
       )),
       base_sha = COALESCE(base_sha, (
         SELECT attempt.base_sha
         FROM pr_group_attempts AS attempt
+        JOIN pr_groups AS owner ON owner.id = attempt.group_id
         WHERE attempt.group_id = pr_groups.id AND attempt.base_sha IS NOT NULL
-        ORDER BY CASE WHEN attempt.id = pr_groups.active_attempt_id THEN 0 ELSE 1 END,
+        ORDER BY CASE WHEN attempt.id = owner.active_attempt_id THEN 0 ELSE 1 END,
                  attempt.created_at ASC, attempt.id ASC
         LIMIT 1
       ));
@@ -2108,7 +2178,7 @@ var init_migrations = __esm(() => {
       ));
 
   INSERT OR IGNORE INTO _migrations (id)
-  SELECT 66
+  SELECT 67
   WHERE NOT EXISTS (
     SELECT 1 FROM pr_groups WHERE leaf_task_id IS NULL OR branch IS NULL
   )
@@ -2313,32 +2383,52 @@ var init_migrations = __esm(() => {
 });
 
 // src/db/schema.ts
+function runPrGroupLineageMigration(db, migration, rebuild) {
+  if (db.inTransaction)
+    throw new Error("PR-group migration requires its own transaction");
+  const priorForeignKeys = db.query("PRAGMA foreign_keys").get().foreign_keys;
+  try {
+    if (rebuild)
+      db.exec("PRAGMA foreign_keys = OFF");
+    db.exec("BEGIN IMMEDIATE");
+    for (const statement of migration.split(/;\s*(?:\n|$)/).map((value) => value.trim()).filter(Boolean)) {
+      if (/^(?:PRAGMA foreign_keys\s*=|BEGIN IMMEDIATE$|COMMIT$)/i.test(statement))
+        continue;
+      db.run(statement);
+    }
+    const completed = db.query("SELECT id FROM _migrations WHERE id = ?").get(rebuild ? 68 : 67);
+    if (!completed)
+      throw new Error("PR-group lineage backfill is incomplete; migration rolled back");
+    if (rebuild && db.query("PRAGMA foreign_key_check").all().length) {
+      throw new Error("PR-group migration failed foreign-key integrity verification");
+    }
+    db.exec("COMMIT");
+  } catch (error) {
+    if (db.inTransaction)
+      db.exec("ROLLBACK");
+    throw error;
+  } finally {
+    db.exec(`PRAGMA foreign_keys = ${priorForeignKeys ? "ON" : "OFF"}`);
+  }
+}
 function runMigrations(db) {
-  let strictMigrationFailure = null;
-  const executeMigration = (migration, index) => {
+  let currentLevel = 0;
+  try {
+    currentLevel = db.query("SELECT MAX(id) as max_id FROM _migrations").get()?.max_id ?? 0;
+  } catch {}
+  for (let index = currentLevel;index < MIGRATIONS.length; index++) {
     try {
-      db.exec(migration);
+      if (index === 66 || index === 67)
+        runPrGroupLineageMigration(db, MIGRATIONS[index], index === 67);
+      else
+        db.exec(MIGRATIONS[index]);
     } catch (error) {
-      try {
+      if (db.inTransaction)
         db.exec("ROLLBACK");
-      } catch {}
-      if (index + 1 >= 68)
-        strictMigrationFailure = error;
-    }
-  };
-  try {
-    const result = db.query("SELECT MAX(id) as max_id FROM _migrations").get();
-    const currentLevel = result?.max_id ?? 0;
-    for (let i = currentLevel;i < MIGRATIONS.length; i++) {
-      executeMigration(MIGRATIONS[i], i);
-    }
-  } catch {
-    for (const [index, migration] of MIGRATIONS.entries()) {
-      executeMigration(migration, index);
+      if (index + 1 >= 67)
+        throw error;
     }
   }
-  if (strictMigrationFailure)
-    throw strictMigrationFailure;
   ensureSchema(db);
 }
 function planSlugBase(value) {
@@ -3650,16 +3740,18 @@ function ensureSchema(db) {
       SET leaf_task_id = COALESCE(leaf_task_id, (
             SELECT attempt.leaf_task_id
             FROM pr_group_attempts AS attempt
+            JOIN pr_groups AS owner ON owner.id = attempt.group_id
             WHERE attempt.group_id = pr_groups.id
-            ORDER BY CASE WHEN attempt.id = pr_groups.active_attempt_id THEN 0 ELSE 1 END,
+            ORDER BY CASE WHEN attempt.id = owner.active_attempt_id THEN 0 ELSE 1 END,
                      attempt.created_at ASC, attempt.id ASC
             LIMIT 1
           )),
           branch = COALESCE(branch, (
             SELECT attempt.branch
             FROM pr_group_attempts AS attempt
+            JOIN pr_groups AS owner ON owner.id = attempt.group_id
             WHERE attempt.group_id = pr_groups.id
-            ORDER BY CASE WHEN attempt.id = pr_groups.active_attempt_id THEN 0 ELSE 1 END,
+            ORDER BY CASE WHEN attempt.id = owner.active_attempt_id THEN 0 ELSE 1 END,
                      attempt.created_at ASC, attempt.id ASC
             LIMIT 1
           ));
@@ -3680,16 +3772,18 @@ function ensureSchema(db) {
       SET pr_number = COALESCE(pr_number, (
             SELECT attempt.pr_number
             FROM pr_group_attempts AS attempt
+            JOIN pr_groups AS owner ON owner.id = attempt.group_id
             WHERE attempt.group_id = pr_groups.id AND attempt.pr_number IS NOT NULL
-            ORDER BY CASE WHEN attempt.id = pr_groups.active_attempt_id THEN 0 ELSE 1 END,
+            ORDER BY CASE WHEN attempt.id = owner.active_attempt_id THEN 0 ELSE 1 END,
                      attempt.created_at ASC, attempt.id ASC
             LIMIT 1
           )),
           base_sha = COALESCE(base_sha, (
             SELECT attempt.base_sha
             FROM pr_group_attempts AS attempt
+            JOIN pr_groups AS owner ON owner.id = attempt.group_id
             WHERE attempt.group_id = pr_groups.id AND attempt.base_sha IS NOT NULL
-            ORDER BY CASE WHEN attempt.id = pr_groups.active_attempt_id THEN 0 ELSE 1 END,
+            ORDER BY CASE WHEN attempt.id = owner.active_attempt_id THEN 0 ELSE 1 END,
                      attempt.created_at ASC, attempt.id ASC
             LIMIT 1
           ));
@@ -3801,6 +3895,28 @@ var init_schema = __esm(() => {
   init_migrations();
 });
 
+// src/lib/env.ts
+var alias = (canonical, legacy) => process.env[canonical] ?? process.env[legacy], env;
+var init_env = __esm(() => {
+  env = {
+    profile: () => alias("HASNA_TODOS_PROFILE", "TODOS_PROFILE"),
+    toolGroups: () => alias("HASNA_TODOS_TOOL_GROUPS", "TODOS_TOOL_GROUPS"),
+    machineId: () => alias("HASNA_TODOS_MACHINE_ID", "TODOS_MACHINE_ID"),
+    machineName: () => alias("HASNA_TODOS_MACHINE_NAME", "TODOS_MACHINE_NAME"),
+    rateLimitMax: () => alias("HASNA_TODOS_RATE_LIMIT_MAX", "TODOS_RATE_LIMIT_MAX"),
+    trustProxy: () => alias("HASNA_TODOS_TRUST_PROXY", "TODOS_TRUST_PROXY"),
+    autoProject: () => alias("HASNA_TODOS_AUTO_PROJECT", "TODOS_AUTO_PROJECT"),
+    aiFormat: () => alias("HASNA_TODOS_AI_FORMAT", "TODOS_AI_FORMAT"),
+    syncAgents: () => alias("HASNA_TODOS_SYNC_AGENTS", "TODOS_SYNC_AGENTS"),
+    taskListId: () => alias("HASNA_TODOS_TASK_LIST_ID", "TODOS_TASK_LIST_ID"),
+    claudeTaskList: () => alias("HASNA_TODOS_CLAUDE_TASK_LIST", "TODOS_CLAUDE_TASK_LIST"),
+    sandboxProfilesPath: () => alias("HASNA_TODOS_SANDBOX_PROFILES_PATH", "TODOS_SANDBOX_PROFILES_PATH"),
+    seatRosterPath: () => alias("HASNA_TODOS_SEAT_ROSTER_PATH", "TODOS_SEAT_ROSTER_PATH"),
+    delegateNoticeChannel: () => alias("HASNA_TODOS_DELEGATE_NOTICE_CHANNEL", "TODOS_DELEGATE_NOTICE_CHANNEL"),
+    delegateNotifyBin: () => alias("HASNA_TODOS_DELEGATE_NOTIFY_BIN", "TODOS_DELEGATE_NOTIFY_BIN")
+  };
+});
+
 // src/db/machines.ts
 import { existsSync } from "fs";
 import { hostname as osHostname, platform as osPlatform, arch as osArch } from "os";
@@ -3863,7 +3979,7 @@ function extractTopology(machine) {
 }
 function getOrCreateLocalMachine(db) {
   const d = db || getDatabase();
-  const name = process.env["TODOS_MACHINE_NAME"] || osHostname();
+  const name = env.machineName() || osHostname();
   const host = osHostname();
   const plat = osPlatform();
   const existing = d.query("SELECT * FROM machines WHERE name = ?").get(name);
@@ -3932,7 +4048,7 @@ function registerMachine(name, opts, db) {
 }
 function updateMachineHeartbeat(idOrName, opts = {}, db) {
   const d = db || getDatabase();
-  const key = idOrName || process.env["TODOS_MACHINE_NAME"] || osHostname();
+  const key = idOrName || env.machineName() || osHostname();
   const row = d.query("SELECT * FROM machines WHERE id = ? OR name = ?").get(key, key);
   if (!row) {
     return registerMachine(key, {
@@ -4084,6 +4200,7 @@ function backfillMachineId(db, force = false) {
 var _machineId = null, TABLES_WITH_MACHINE_ID;
 var init_machines = __esm(() => {
   init_database();
+  init_env();
   TABLES_WITH_MACHINE_ID = [
     "projects",
     "tasks",
@@ -4282,108 +4399,100 @@ var init_identity_mapping = __esm(() => {
   });
 });
 
-// node_modules/.bun/@hasna+paths@0.1.0/node_modules/@hasna/paths/dist/index.js
+// src/lib/paths.ts
+import { existsSync as existsSync2 } from "fs";
 import { homedir } from "os";
-import { join } from "path";
-function assertApp(app) {
+import { join, resolve as resolve2 } from "path";
+import { homedir as pathsResolverHomedir } from "os";
+import { join as pathsResolverJoin } from "path";
+function pathsResolverAssertApp(app) {
   if (typeof app !== "string" || app.length === 0) {
     throw new TypeError("paths: app must be a non-empty string");
   }
-  if (!APP_SLUG_RE.test(app)) {
+  if (!PATHS_RESOLVER_APP_SLUG_RE.test(app)) {
     throw new TypeError(`paths: invalid app slug "${app}" \u2014 expected lowercase kebab-case ([a-z0-9]+(-[a-z0-9]+)*)`);
   }
 }
-function envOf(options) {
-  return options.env ?? process.env;
-}
-function envValue(options, kind) {
-  const value = envOf(options)[KIND_ENV[kind]];
-  return typeof value === "string" && value.length > 0 ? value : undefined;
-}
-function isMacOS(platform) {
-  return platform === "darwin";
+function pathsResolverAssertKind(kind) {
+  if (!Object.keys(PATHS_RESOLVER_KIND_ENV).includes(kind)) {
+    throw new TypeError(`paths: invalid path kind "${kind}" \u2014 expected one of ${Object.keys(PATHS_RESOLVER_KIND_ENV).join(", ")}`);
+  }
 }
-function baseDir(kind, options) {
-  const override = envValue(options, kind);
-  if (override)
+function pathsResolverBaseDir(kind, options) {
+  pathsResolverAssertKind(kind);
+  const env2 = options.env ?? process.env;
+  const override = env2[PATHS_RESOLVER_KIND_ENV[kind]];
+  if (typeof override === "string" && override.length > 0)
     return override;
-  const home = options.home ?? homedir();
+  const home = options.home ?? pathsResolverHomedir();
   const platform = options.platform ?? process.platform;
-  if (isMacOS(platform)) {
+  if (platform === "darwin") {
     switch (kind) {
       case "config":
       case "data":
-        return join(home, "Library", "Application Support", "Hasna");
+        return pathsResolverJoin(home, "Library", "Application Support", "Hasna");
       case "cache":
-        return join(home, "Library", "Caches", "Hasna");
+        return pathsResolverJoin(home, "Library", "Caches", "Hasna");
       case "state":
-        return join(home, "Library", "Logs", "Hasna");
+        return pathsResolverJoin(home, "Library", "Logs", "Hasna");
     }
   }
   switch (kind) {
     case "config":
-      return join(home, ".config", "hasna");
+      return pathsResolverJoin(home, ".config", "hasna");
     case "data":
-      return join(home, ".local", "share", "hasna");
+      return pathsResolverJoin(home, ".local", "share", "hasna");
     case "state":
-      return join(home, ".local", "state", "hasna");
+      return pathsResolverJoin(home, ".local", "state", "hasna");
     case "cache":
-      return join(home, ".cache", "hasna");
+      return pathsResolverJoin(home, ".cache", "hasna");
   }
 }
-function resolvePath(kind, options) {
-  assertApp(options.app);
-  const appSegment = options.internal === true ? join("internal", options.app) : options.app;
-  return join(baseDir(kind, options), appSegment);
+function pathsResolverResolve(kind, options) {
+  pathsResolverAssertApp(options.app);
+  const appSegment = options.internal === true ? pathsResolverJoin("internal", options.app) : options.app;
+  return pathsResolverJoin(pathsResolverBaseDir(kind, options), appSegment);
 }
 function dataDir(options) {
-  return resolvePath("data", options);
+  return pathsResolverResolve("data", options);
 }
-var KIND_ENV, APP_SLUG_RE;
-var init_dist = __esm(() => {
-  KIND_ENV = {
-    config: "HASNA_CONFIG_HOME",
-    data: "HASNA_DATA_HOME",
-    state: "HASNA_STATE_HOME",
-    cache: "HASNA_CACHE_HOME"
-  };
-  APP_SLUG_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
-});
-
-// src/lib/paths.ts
-import { existsSync as existsSync2 } from "fs";
-import { homedir as homedir2 } from "os";
-import { join as join2, resolve as resolve2 } from "path";
-function effectiveHome(env = process.env) {
-  return env.HOME || env.USERPROFILE || homedir2();
+function effectiveHome(env2 = process.env) {
+  return env2.HOME || env2.USERPROFILE || homedir();
 }
-function legacyHomeDir(env = process.env) {
-  return join2(effectiveHome(env), ".hasna", "todos");
+function legacyHomeDir(env2 = process.env) {
+  return join(effectiveHome(env2), ".hasna", "todos");
 }
-function resolverHome(env = process.env) {
-  return dataDir({ app: "todos", home: effectiveHome(env), env });
+function resolverHome(env2 = process.env) {
+  return dataDir({ app: "todos", home: effectiveHome(env2), env: env2 });
 }
-function adoptResolverHome(resolved, env = process.env) {
-  const dataOverride = env.HASNA_DATA_HOME;
+function adoptResolverHome(resolved, env2 = process.env) {
+  const dataOverride = env2.HASNA_DATA_HOME;
   if (typeof dataOverride === "string" && dataOverride.trim().length > 0)
     return true;
-  return existsSync2(join2(resolved, "todos.db")) || existsSync2(join2(resolved, "config.json"));
+  return existsSync2(join(resolved, "todos.db")) || existsSync2(join(resolved, "config.json"));
 }
-function getTodosDir(env = process.env) {
-  const resolved = resolverHome(env);
-  return resolve2(adoptResolverHome(resolved, env) ? resolved : legacyHomeDir(env));
+function getTodosDir(env2 = process.env) {
+  const resolved = resolverHome(env2);
+  return resolve2(adoptResolverHome(resolved, env2) ? resolved : legacyHomeDir(env2));
 }
+var PATHS_RESOLVER_KIND_ENV, PATHS_RESOLVER_APP_SLUG_RE;
 var init_paths = __esm(() => {
-  init_dist();
+  PATHS_RESOLVER_KIND_ENV = {
+    config: "HASNA_CONFIG_HOME",
+    data: "HASNA_DATA_HOME",
+    state: "HASNA_STATE_HOME",
+    cache: "HASNA_CACHE_HOME"
+  };
+  PATHS_RESOLVER_APP_SLUG_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
 });
 
 // src/lib/sync-utils.ts
 import { existsSync as existsSync3, mkdirSync, readFileSync, readdirSync, statSync, writeFileSync } from "fs";
 import { createHash } from "crypto";
-import { homedir as homedir3 } from "os";
-import { join as join3 } from "path";
+import { homedir as homedir2 } from "os";
+import { join as join2 } from "path";
 function getHomeDir() {
-  return process.env["HOME"] || process.env["USERPROFILE"] || homedir3();
+  return process.env["HOME"] || process.env["USERPROFILE"] || homedir2();
 }
 function getTodosGlobalDir() {
   return getTodosDir();
@@ -4409,14 +4518,14 @@ function writeJsonFile(path, data) {
 `);
 }
 function readHighWaterMark(dir) {
-  const path = join3(dir, ".highwatermark");
+  const path = join2(dir, ".highwatermark");
   if (!existsSync3(path))
     return 1;
   const val = parseInt(readFileSync(path, "utf-8").trim(), 10);
   return isNaN(val) ? 1 : val;
 }
 function writeHighWaterMark(dir, value) {
-  writeFileSync(join3(dir, ".highwatermark"), String(value));
+  writeFileSync(join2(dir, ".highwatermark"), String(value));
 }
 function getFileMtimeMs(path) {
   try {
@@ -4576,7 +4685,7 @@ __export(exports_database, {
 });
 import { Database } from "bun:sqlite";
 import { existsSync as existsSync4, mkdirSync as mkdirSync2 } from "fs";
-import { dirname, join as join4, resolve as resolve3 } from "path";
+import { dirname, join as join3, resolve as resolve3 } from "path";
 function isInMemoryDb(path) {
   return path === ":memory:" || path.startsWith("file::memory:");
 }
@@ -4585,7 +4694,7 @@ function findNearestProjectDb(startDir) {
   const stopAt = gitRoot ? resolve3(gitRoot) : resolve3(startDir);
   let dir = resolve3(startDir);
   while (true) {
-    const candidate = join4(dir, ".hasna", "todos", "todos.db");
+    const candidate = join3(dir, ".hasna", "todos", "todos.db");
     if (existsSync4(candidate))
       return candidate;
     if (dir === stopAt)
@@ -4600,7 +4709,7 @@ function findNearestProjectDb(startDir) {
 function findGitRoot(startDir) {
   let dir = resolve3(startDir);
   while (true) {
-    if (existsSync4(join4(dir, ".git")))
+    if (existsSync4(join3(dir, ".git")))
       return dir;
     const parent = dirname(dir);
     if (parent === dir)
@@ -4610,7 +4719,7 @@ function findGitRoot(startDir) {
   return null;
 }
 function getGlobalDbPath() {
-  return join4(getTodosGlobalDir(), "todos.db");
+  return join3(getTodosGlobalDir(), "todos.db");
 }
 function hasExplicitProjectArg(args = process.argv.slice(2)) {
   return args.some((arg) => arg === "--project" || arg.startsWith("--project="));
@@ -4648,7 +4757,7 @@ function getDbPath() {
   if (process.env["TODOS_DB_SCOPE"] === "project") {
     const gitRoot = findGitRoot(cwd);
     if (gitRoot && canCreateScopedProjectDb()) {
-      return join4(gitRoot, ".hasna", "todos", "todos.db");
+      return join3(gitRoot, ".hasna", "todos", "todos.db");
     }
   }
   return getGlobalDbPath();
@@ -4689,6 +4798,9 @@ function maybeInstallShadowCapture(db) {
   }
 }
 function getDatabase(dbPath) {
+  if (dbPath === undefined && !selectsTodosLocalStore()) {
+    throw new Error("API_DATABASE_FALLBACK_FORBIDDEN: this operation must use the shared Todos API; implicit SQLite access is unavailable");
+  }
   const path = dbPath || getDbPath();
   if (_db && _dbPath === path)
     return _db;
@@ -4828,6 +4940,7 @@ function lowerInClause(column, values, params) {
 }
 var LOCK_EXPIRY_MINUTES = 30, _db = null, _dbPath = null, ALLOWED_TABLES;
 var init_database = __esm(() => {
+  init_local_opt_in();
   init_schema();
   init_machines();
   init_identity_mapping();
@@ -4838,9 +4951,9 @@ var init_database = __esm(() => {
 
 // src/lib/config.ts
 import { existsSync as existsSync5, readFileSync as readFileSync2 } from "fs";
-import { dirname as dirname2, join as join5 } from "path";
+import { dirname as dirname2, join as join4 } from "path";
 function getConfigPath() {
-  return join5(getTodosGlobalDir(), "config.json");
+  return join4(getTodosGlobalDir(), "config.json");
 }
 function normalizeAgent(agent) {
   return agent.trim().toLowerCase();
@@ -4891,21 +5004,6 @@ function normalizeApiUrl(value) {
     return null;
   return trimmed.replace(/\/+$/, "");
 }
-function getLocalApiConfig(env = process.env) {
-  const config = loadConfig();
-  const envApiUrl = normalizeApiUrl(env["TODOS_URL"]);
-  const configApiUrl = normalizeApiUrl(config.apiUrl);
-  const apiUrl = envApiUrl ?? configApiUrl;
-  const apiKey = env["TODOS_API_KEY"] || config.apiKey || null;
-  return {
-    apiUrl,
-    apiKey,
-    source: {
-      apiUrl: envApiUrl ? "TODOS_URL" : configApiUrl ? "config" : "none",
-      apiKey: env["TODOS_API_KEY"] ? "TODOS_API_KEY" : config.apiKey ? "config" : "none"
-    }
-  };
-}
 function getSyncAgentsFromConfig() {
   const config = loadConfig();
   const agents = config.sync_agents;
@@ -5756,11 +5854,11 @@ function writeAllowed(profile, root, writePath) {
     return isPathInside(scopeRoot, target);
   });
 }
-function redactedEnvKeys(profile, env) {
-  if (!env)
+function redactedEnvKeys(profile, env2) {
+  if (!env2)
     return [];
   const patterns = unique2([...DEFAULT_ENV_REDACTIONS, ...profile.env_redactions]).map((item) => item.toUpperCase());
-  return Object.keys(env).filter((key) => patterns.some((pattern) => key.toUpperCase().includes(pattern)));
+  return Object.keys(env2).filter((key) => patterns.some((pattern) => key.toUpperCase().includes(pattern)));
 }
 function checkWorkspacePermission(input = {}) {
   const status = getWorkspaceTrustStatus(input.path || process.cwd());
@@ -5898,18 +5996,18 @@ function profileByName(name, path) {
   const resolved = normalizePath2(path);
   return profiles.find((profile) => isPathInside2(profile.root, resolved)) || defaultProfile2("default", resolved);
 }
-function redactedEnvKeys2(profile, env) {
-  if (!env)
+function redactedEnvKeys2(profile, env2) {
+  if (!env2)
     return [];
   const patterns = unique3([...DEFAULT_ENV_REDACTIONS2, ...profile.env_redactions]).map((item) => item.toUpperCase());
-  return Object.keys(env).filter((key) => patterns.some((pattern) => key.toUpperCase().includes(pattern)));
+  return Object.keys(env2).filter((key) => patterns.some((pattern) => key.toUpperCase().includes(pattern)));
 }
-function omittedEnvKeys(profile, env) {
-  if (!env)
+function omittedEnvKeys(profile, env2) {
+  if (!env2)
     return [];
   if (profile.env_allowlist.includes("*"))
     return [];
-  return Object.keys(env).filter((key) => !profile.env_allowlist.some((pattern) => matchesPattern2(key, pattern)));
+  return Object.keys(env2).filter((key) => !profile.env_allowlist.some((pattern) => matchesPattern2(key, pattern)));
 }
 function resolveFromCwd(cwd, path) {
   return normalizePath2(path.startsWith("/") ? path : `${cwd}/${path}`);
@@ -6292,15 +6390,23 @@ var init_event_hooks = __esm(() => {
   VALID_TARGETS = new Set(["stdout", "file", "socket", "script"]);
 });
 
-// node_modules/.bun/@hasna+events@0.1.16/node_modules/@hasna/events/dist/index.js
+// node_modules/.bun/@hasna+events@0.1.17/node_modules/@hasna/events/dist/index.js
 import { chmod, mkdir, readFile, rename, writeFile } from "fs/promises";
 import { Buffer as Buffer2 } from "buffer";
+import { existsSync as existsSync22 } from "fs";
+import { join as join32 } from "path";
 import { existsSync as existsSync6 } from "fs";
-import { homedir as homedir4 } from "os";
-import { join as join6 } from "path";
+import { homedir as homedir22 } from "os";
+import { join as join22, resolve as resolve8 } from "path";
+import { homedir as homedir3 } from "os";
+import { join as join5 } from "path";
 import { createHmac, timingSafeEqual } from "crypto";
+import { lookup as dnsLookup } from "dns/promises";
+import { isIP } from "net";
 import { randomUUID as randomUUID2 } from "crypto";
 import { spawn } from "child_process";
+import { request as nodeHttpRequest } from "http";
+import { request as nodeHttpsRequest } from "https";
 import { randomUUID as randomUUID22 } from "crypto";
 function getPathValue(input, path) {
   return path.split(".").reduce((value, part) => {
@@ -6397,8 +6503,93 @@ function channelMatchesEvent(channel, event) {
     return true;
   return channel.filters.some((filter) => eventMatchesFilter(event, filter));
 }
+function assertApp(app) {
+  if (typeof app !== "string" || app.length === 0) {
+    throw new TypeError("paths: app must be a non-empty string");
+  }
+  if (!APP_SLUG_RE.test(app)) {
+    throw new TypeError(`paths: invalid app slug "${app}" \u2014 expected lowercase kebab-case ([a-z0-9]+(-[a-z0-9]+)*)`);
+  }
+}
+function envOf(options) {
+  return options.env ?? process.env;
+}
+function envValue(options, kind) {
+  const value = envOf(options)[KIND_ENV[kind]];
+  return typeof value === "string" && value.length > 0 ? value : undefined;
+}
+function isMacOS(platform) {
+  return platform === "darwin";
+}
+function baseDir(kind, options) {
+  const override = envValue(options, kind);
+  if (override)
+    return override;
+  const home = options.home ?? homedir3();
+  const platform = options.platform ?? process.platform;
+  if (isMacOS(platform)) {
+    switch (kind) {
+      case "config":
+      case "data":
+        return join5(home, "Library", "Application Support", "Hasna");
+      case "cache":
+        return join5(home, "Library", "Caches", "Hasna");
+      case "state":
+        return join5(home, "Library", "Logs", "Hasna");
+    }
+  }
+  switch (kind) {
+    case "config":
+      return join5(home, ".config", "hasna");
+    case "data":
+      return join5(home, ".local", "share", "hasna");
+    case "state":
+      return join5(home, ".local", "state", "hasna");
+    case "cache":
+      return join5(home, ".cache", "hasna");
+  }
+}
+function resolvePath(kind, options) {
+  assertApp(options.app);
+  const appSegment = options.internal === true ? join5("internal", options.app) : options.app;
+  return join5(baseDir(kind, options), appSegment);
+}
+function dataDir2(options) {
+  return resolvePath("data", options);
+}
+function effectiveHome2() {
+  return process.env["HOME"] || process.env["USERPROFILE"] || homedir22();
+}
+function legacyHomeDir2() {
+  return join22(effectiveHome2(), ".hasna", "events");
+}
+function resolverHome2() {
+  return dataDir2({ app: "events", home: effectiveHome2() || undefined });
+}
+function adoptResolverHome2(resolved, env2 = process.env) {
+  const dataOverride = env2.HASNA_DATA_HOME;
+  if (typeof dataOverride === "string" && dataOverride.trim().length > 0)
+    return true;
+  return existsSync6(join22(resolved, EVENTS_STORE_SENTINEL_FILE));
+}
+function exactEventsHome() {
+  const dir = process.env[HASNA_EVENTS_DIR_ENV];
+  if (dir && dir.trim())
+    return dir.trim();
+  const home = process.env[HASNA_EVENTS_HOME_ENV];
+  if (home && home.trim())
+    return home.trim();
+  return;
+}
+function getEventsHome() {
+  const exact = exactEventsHome();
+  if (exact)
+    return resolve8(exact);
+  const resolved = resolverHome2();
+  return adoptResolverHome2(resolved) ? resolve8(resolved) : resolve8(legacyHomeDir2());
+}
 function getEventsDataDir(override) {
-  return override || process.env[HASNA_EVENTS_DIR_ENV] || process.env[HASNA_EVENTS_HOME_ENV] || join6(homedir4(), ".hasna", "events");
+  return override || getEventsHome();
 }
 
 class JsonEventsStore {
@@ -6407,12 +6598,12 @@ class JsonEventsStore {
   channelsPath;
   eventsPath;
   deliveriesPath;
-  constructor(dataDir2 = getEventsDataDir()) {
-    this.dataDir = dataDir2;
-    this.runtime = localJsonRuntime(dataDir2);
-    this.channelsPath = join6(dataDir2, "channels.json");
-    this.eventsPath = join6(dataDir2, "events.json");
-    this.deliveriesPath = join6(dataDir2, "deliveries.json");
+  constructor(dataDir22 = getEventsDataDir()) {
+    this.dataDir = dataDir22;
+    this.runtime = localJsonRuntime(dataDir22);
+    this.channelsPath = join32(dataDir22, "channels.json");
+    this.eventsPath = join32(dataDir22, "events.json");
+    this.deliveriesPath = join32(dataDir22, "deliveries.json");
   }
   async init() {
     await mkdir(this.dataDir, { recursive: true, mode: 448 });
@@ -6529,7 +6720,7 @@ class JsonEventsStore {
     };
   }
   async ensureArrayFile(path) {
-    if (!existsSync6(path)) {
+    if (!existsSync22(path)) {
       await writeFile(path, `[]
 `, { encoding: "utf-8", mode: 384 });
     }
@@ -6559,7 +6750,7 @@ class JsonEventsStore {
     });
   }
 }
-function localJsonRuntime(dataDir2 = getEventsDataDir()) {
+function localJsonRuntime(dataDir22 = getEventsDataDir()) {
   return {
     mode: "local-files",
     name: "json-events-store",
@@ -6572,7 +6763,7 @@ function localJsonRuntime(dataDir2 = getEventsDataDir()) {
     durable: true,
     idempotency: "best-effort-local",
     replayCursors: true,
-    description: `Local JSON files in ${dataDir2}; no SQLite, Postgres, S3, or AWS runtime is configured by this store.`
+    description: `Local JSON files in ${dataDir22}; no SQLite, Postgres, S3, or AWS runtime is configured by this store.`
   };
 }
 function encodeLocalJsonEventCursor(offset, options = {}) {
@@ -6643,6 +6834,177 @@ function signPayload(secret, timestamp2, body) {
   const digest = createHmac("sha256", secret).update(buildSignatureBase(timestamp2, body)).digest("hex");
   return `sha256=${digest}`;
 }
+function isPrivateAddress(address) {
+  const normalized = stripZoneId(address);
+  const version = isIP(normalized);
+  if (version === 4) {
+    const integer = ipv4ToInt(normalized);
+    if (integer === undefined)
+      return true;
+    return IPV4_PRIVATE_RANGES.some(([low, high]) => integer >= low && integer <= high);
+  }
+  if (version === 6) {
+    const groups = ipv6Groups(normalized);
+    if (!groups)
+      return true;
+    for (const prefix of IPV6_SPECIAL_PREFIXES) {
+      if (!ipv6MatchesPrefix(groups, prefix.groups, prefix.bits))
+        continue;
+      if (prefix.bits === 96 && groups[5] === 65535) {
+        return isPrivateAddress(ipv4IntToString(groups[6] << 16 | groups[7]));
+      }
+      if (prefix.bits === 16 && groups[0] === 8194) {
+        return isPrivateAddress(ipv4IntToString(groups[1] << 16 | groups[2]));
+      }
+      return true;
+    }
+    return false;
+  }
+  return true;
+}
+async function resolveWebhookTarget(url, policy = {}) {
+  const hostname = normalizeHostname(url.hostname);
+  const allowlist = (policy.allowPrivateHosts ?? []).map((entry) => normalizeHostname(entry.toLowerCase()));
+  if (allowlist.includes(hostname)) {
+    const version2 = isIP(hostname);
+    if (version2 === 4 || version2 === 6) {
+      return { hostname, addresses: [hostname] };
+    }
+    const lookup2 = policy.lookup ?? defaultTargetLookup;
+    let resolved2;
+    try {
+      resolved2 = await lookup2(hostname);
+    } catch {
+      throw new Error(`Webhook target ${hostname} could not be resolved`);
+    }
+    if (!Array.isArray(resolved2) || resolved2.length === 0) {
+      throw new Error(`Webhook target ${hostname} resolved to no addresses`);
+    }
+    const addresses = resolved2.map((entry) => normalizeHostname(entry.address));
+    return { hostname, addresses };
+  }
+  const version = isIP(hostname);
+  if (version === 4 || version === 6) {
+    if (isPrivateAddress(hostname)) {
+      throw new Error(`Webhook target ${hostname} is a private or special-use address`);
+    }
+    return { hostname, addresses: [hostname] };
+  }
+  const lookup = policy.lookup ?? defaultTargetLookup;
+  let resolved;
+  try {
+    resolved = await lookup(hostname);
+  } catch {
+    throw new Error(`Webhook target ${hostname} could not be resolved`);
+  }
+  if (!Array.isArray(resolved) || resolved.length === 0) {
+    throw new Error(`Webhook target ${hostname} resolved to no addresses`);
+  }
+  const allowed = [];
+  for (const entry of resolved) {
+    const address = normalizeHostname(entry.address);
+    if (isPrivateAddress(address)) {
+      if (allowlist.includes(address)) {
+        allowed.push(address);
+        continue;
+      }
+      throw new Error(`Webhook target ${hostname} resolves to private or special-use address ${address}`);
+    }
+    allowed.push(address);
+  }
+  if (allowed.length === 0) {
+    throw new Error(`Webhook target ${hostname} resolved to no public addresses`);
+  }
+  return { hostname, addresses: allowed };
+}
+function normalizeMaxRedirects(value) {
+  if (value === undefined)
+    return DEFAULT_MAX_REDIRECTS;
+  if (!Number.isInteger(value) || value < 0)
+    throw new Error("webhookTargetPolicy.maxRedirects must be a non-negative integer");
+  return value;
+}
+function normalizeHostname(hostname) {
+  const lower = hostname.toLowerCase();
+  if (lower.startsWith("[") && lower.endsWith("]"))
+    return lower.slice(1, -1);
+  return lower;
+}
+function stripZoneId(address) {
+  const percent = address.indexOf("%");
+  return percent === -1 ? address : address.slice(0, percent);
+}
+function ipv4ToInt(address) {
+  const parts = address.split(".");
+  if (parts.length !== 4)
+    return;
+  let value = 0;
+  for (const part of parts) {
+    if (!/^\d{1,3}$/.test(part))
+      return;
+    const octet = Number(part);
+    if (octet > 255)
+      return;
+    value = value << 8 | octet;
+  }
+  return value >>> 0;
+}
+function ipv4IntToString(integer) {
+  return [
+    integer >>> 24 & 255,
+    integer >>> 16 & 255,
+    integer >>> 8 & 255,
+    integer & 255
+  ].join(".");
+}
+function ipv6Groups(address) {
+  const raw = stripZoneId(address);
+  const doubleColon = raw.indexOf("::");
+  const headText = doubleColon === -1 ? raw : raw.slice(0, doubleColon);
+  const tailText = doubleColon === -1 ? "" : raw.slice(doubleColon + 2);
+  const parseGroups = (text) => {
+    if (text === "")
+      return [];
+    const out = [];
+    for (const part of text.split(":")) {
+      if (part.includes(".")) {
+        const v4 = ipv4ToInt(part);
+        if (v4 === undefined)
+          return;
+        out.push(v4 >>> 16 & 65535, v4 & 65535);
+      } else {
+        if (!/^[0-9a-fA-F]{1,4}$/.test(part))
+          return;
+        out.push(parseInt(part, 16));
+      }
+    }
+    return out;
+  };
+  const head = parseGroups(headText);
+  if (!head)
+    return;
+  const tail = parseGroups(tailText);
+  if (!tail)
+    return;
+  const total = head.length + tail.length;
+  if (doubleColon === -1) {
+    return total === 8 ? head : undefined;
+  }
+  if (total >= 8)
+    return;
+  return [...head, ...new Array(8 - total).fill(0), ...tail];
+}
+function ipv6MatchesPrefix(groups, prefixGroups, prefixBits) {
+  let remaining = prefixBits;
+  for (let index = 0;index < prefixGroups.length && remaining > 0; index += 1) {
+    const take = Math.min(16, remaining);
+    const mask = 65535 << 16 - take & 65535;
+    if ((groups[index] & mask) !== (prefixGroups[index] & mask))
+      return false;
+    remaining -= take;
+  }
+  return true;
+}
 function now2() {
   return new Date().toISOString();
 }
@@ -6673,9 +7035,18 @@ function buildWebhookRequest(event, channel, options = {}) {
   }
   return { body, headers };
 }
+function normalizeWebhookUrl(raw) {
+  const url = new URL(raw);
+  if (url.username !== "" || url.password !== "") {
+    url.username = "";
+    url.password = "";
+  }
+  return url.toString();
+}
 async function dispatchWebhook(event, channel, options = {}) {
   if (!channel.webhook)
     throw new Error(`Channel ${channel.id} has no webhook config`);
+  const webhookUrl = normalizeWebhookUrl(channel.webhook.url);
   const startedAt = now2();
   let secret = channel.webhook.secret;
   if (channel.webhook.secretRef) {
@@ -6692,10 +7063,14 @@ async function dispatchWebhook(event, channel, options = {}) {
   }
   const timestamp2 = (options.now?.() ?? new Date).toISOString();
   const { body, headers } = buildWebhookRequest(event, channel, { secret, timestamp: timestamp2 });
+  const validateTargets = options.webhookTargetPolicy !== undefined || options.fetchImpl === undefined;
+  if (validateTargets) {
+    return dispatchValidatedWebhook(event, channel, { body, headers, startedAt, options });
+  }
   const controller = new AbortController;
   const timeout = setTimeout(() => controller.abort(), channel.webhook.timeoutMs ?? 15000);
   try {
-    const response = await (options.fetchImpl ?? fetch)(channel.webhook.url, {
+    const response = await (options.fetchImpl ?? fetch)(webhookUrl, {
       method: "POST",
       headers,
       body,
@@ -6723,6 +7098,130 @@ async function dispatchWebhook(event, channel, options = {}) {
     clearTimeout(timeout);
   }
 }
+function isRedirectStatus(status) {
+  return status === 301 || status === 302 || status === 303 || status === 307 || status === 308;
+}
+function redirectKeepsBody(status) {
+  return status === 307 || status === 308;
+}
+async function pinnedNativeRequest(target, addresses, method, headers, body, signal, tls) {
+  const isHttps = target.protocol === "https:";
+  if (!isHttps && target.protocol !== "http:") {
+    throw new Error(`Webhook target uses unsupported protocol ${target.protocol}`);
+  }
+  const defaultPort = isHttps ? 443 : 80;
+  const port = target.port ? Number(target.port) : defaultPort;
+  const requestOptions = {
+    hostname: target.hostname,
+    port,
+    path: `${target.pathname}${target.search}`,
+    method,
+    headers,
+    ...tls?.ca ? { ca: tls.ca } : {},
+    lookup: (hostname, _options, callback) => {
+      const entries = addresses.map((address) => ({
+        address,
+        family: address.includes(":") ? 6 : 4
+      }));
+      callback(null, entries);
+    }
+  };
+  return new Promise((resolve22, reject) => {
+    const request = isHttps ? nodeHttpsRequest(requestOptions, onResponse) : nodeHttpRequest(requestOptions, onResponse);
+    const onAbort = () => {
+      const error = new Error("The operation was aborted.");
+      error.name = "AbortError";
+      request.destroy(error);
+    };
+    if (signal.aborted)
+      onAbort();
+    else
+      signal.addEventListener("abort", onAbort, { once: true });
+    request.on("error", reject);
+    if (body !== undefined)
+      request.write(body);
+    request.end();
+    function onResponse(response) {
+      const chunks = [];
+      response.on("data", (chunk) => chunks.push(Buffer.from(chunk)));
+      response.on("error", reject);
+      response.on("end", () => {
+        const headersRecord = {};
+        for (const [name, value] of Object.entries(response.headers)) {
+          if (typeof value === "string")
+            headersRecord[name] = value;
+          else if (Array.isArray(value))
+            headersRecord[name] = value.join(", ");
+        }
+        resolve22(new Response(Buffer.concat(chunks), { status: response.statusCode ?? 200, headers: headersRecord }));
+      });
+    }
+  });
+}
+async function dispatchValidatedWebhook(event, channel, input) {
+  const { body, headers, startedAt, options } = input;
+  const webhook = channel.webhook;
+  if (!webhook)
+    throw new Error(`Channel ${channel.id} has no webhook config`);
+  const policy = options.webhookTargetPolicy ?? {};
+  const maxRedirects = normalizeMaxRedirects(policy.maxRedirects);
+  const controller = new AbortController;
+  const timeout = setTimeout(() => controller.abort(), webhook.timeoutMs ?? 15000);
+  try {
+    let target = new URL(normalizeWebhookUrl(webhook.url));
+    let requestHeaders = headers;
+    let method = "POST";
+    let requestBody = body;
+    let redirectsFollowed = 0;
+    for (;; ) {
+      const resolved = await resolveWebhookTarget(target, policy).catch((error) => {
+        throw new Error(`Webhook target rejected by SSRF guard: ${error.message}`);
+      });
+      const response = options.fetchImpl ? await options.fetchImpl(target, {
+        method,
+        headers: requestHeaders,
+        body: requestBody,
+        signal: controller.signal,
+        redirect: "manual"
+      }) : await pinnedNativeRequest(target, resolved.addresses, method, requestHeaders, requestBody, controller.signal, options.tls);
+      const location = response.headers.get("location");
+      if (isRedirectStatus(response.status) && location) {
+        if (redirectsFollowed >= maxRedirects) {
+          return failedAttempt(startedAt, `Webhook target exceeded ${maxRedirects} redirects`);
+        }
+        redirectsFollowed += 1;
+        const next = new URL(location, target);
+        target = next;
+        if (!redirectKeepsBody(response.status)) {
+          method = "GET";
+          requestBody = undefined;
+          requestHeaders = Object.fromEntries(Object.entries(requestHeaders).filter(([name]) => name.toLowerCase() !== "content-type" && name.toLowerCase() !== "content-length"));
+        }
+        continue;
+      }
+      const responseBody = truncate(await response.text());
+      return {
+        attempt: 1,
+        status: response.ok ? "success" : "failed",
+        startedAt,
+        completedAt: now2(),
+        responseStatus: response.status,
+        responseBody,
+        error: response.ok ? undefined : `Webhook returned HTTP ${response.status}`
+      };
+    }
+  } catch (error) {
+    return {
+      attempt: 1,
+      status: "failed",
+      startedAt,
+      completedAt: now2(),
+      error: error instanceof Error ? error.message : String(error)
+    };
+  } finally {
+    clearTimeout(timeout);
+  }
+}
 function failedAttempt(startedAt, error) {
   return {
     attempt: 1,
@@ -6737,7 +7236,7 @@ async function dispatchCommand(event, channel) {
     throw new Error(`Channel ${channel.id} has no command config`);
   const startedAt = now2();
   const eventJson = JSON.stringify(event);
-  const env = {
+  const env2 = {
     ...process.env,
     ...channel.command.env,
     HASNA_CHANNEL_ID: channel.id,
@@ -6751,10 +7250,10 @@ async function dispatchCommand(event, channel) {
     HASNA_EVENT_SCHEMA_VERSION: event.schemaVersion,
     HASNA_EVENT_JSON: eventJson
   };
-  return new Promise((resolve8) => {
+  return new Promise((resolve22) => {
     const child = spawn(channel.command.command, channel.command.args ?? [], {
       cwd: channel.command.cwd,
-      env,
+      env: env2,
       stdio: ["pipe", "pipe", "pipe"]
     });
     let stdout = "";
@@ -6769,7 +7268,7 @@ async function dispatchCommand(event, channel) {
     });
     child.on("error", (error) => {
       clearTimeout(timeout);
-      resolve8({
+      resolve22({
         attempt: 1,
         status: "failed",
         startedAt,
@@ -6782,7 +7281,7 @@ async function dispatchCommand(event, channel) {
     child.on("close", (code, signal) => {
       clearTimeout(timeout);
       const success = code === 0;
-      resolve8({
+      resolve22({
         attempt: 1,
         status: success ? "success" : "failed",
         startedAt,
@@ -6918,7 +7417,9 @@ class EventsClient {
     this.transportOptions = {
       fetchImpl: options.fetchImpl,
       secretResolver: options.secretResolver,
-      now: options.now
+      now: options.now,
+      tls: options.tls,
+      webhookTargetPolicy: options.webhookTargetPolicy
     };
     this.catalog = options.catalog ?? defaultEventTypeCatalog;
     this.validateCatalogTypes = options.validateCatalogTypes ?? false;
@@ -7123,9 +7624,51 @@ function normalizeRetryPolicy(policy) {
     multiplier: Math.max(1, policy?.multiplier ?? 2)
   };
 }
-var HASNA_EVENTS_DIR_ENV = "HASNA_EVENTS_DIR", HASNA_EVENTS_HOME_ENV = "HASNA_EVENTS_HOME", LOCAL_JSON_EVENT_CURSOR_PREFIX = "local-json-v1:", DEFAULT_EVENT_PAGE_LIMIT = 100, MAX_EVENT_PAGE_LIMIT = 1000, DEFAULT_SIGNATURE_TOLERANCE_MS, EventValidationError, defaultEventTypeCatalog, APP_EVENT_V1_MAX_DATA_BYTES;
-var init_dist2 = __esm(() => {
+var KIND_ENV, APP_SLUG_RE, HASNA_EVENTS_DIR_ENV = "HASNA_EVENTS_DIR", HASNA_EVENTS_HOME_ENV = "HASNA_EVENTS_HOME", EVENTS_STORE_SENTINEL_FILE = "events.json", LOCAL_JSON_EVENT_CURSOR_PREFIX = "local-json-v1:", DEFAULT_EVENT_PAGE_LIMIT = 100, MAX_EVENT_PAGE_LIMIT = 1000, DEFAULT_SIGNATURE_TOLERANCE_MS, DEFAULT_MAX_REDIRECTS = 5, IPV4_PRIVATE_RANGES, IPV6_SPECIAL_PREFIXES, defaultTargetLookup = async (hostname) => {
+  return dnsLookup(hostname, { all: true, verbatim: false });
+}, EventValidationError, defaultEventTypeCatalog, APP_EVENT_V1_MAX_DATA_BYTES;
+var init_dist = __esm(() => {
+  KIND_ENV = {
+    config: "HASNA_CONFIG_HOME",
+    data: "HASNA_DATA_HOME",
+    state: "HASNA_STATE_HOME",
+    cache: "HASNA_CACHE_HOME"
+  };
+  APP_SLUG_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
   DEFAULT_SIGNATURE_TOLERANCE_MS = 5 * 60 * 1000;
+  IPV4_PRIVATE_RANGES = [
+    [0, 16777215],
+    [167772160, 184549375],
+    [1681915904, 1686110207],
+    [2130706432, 2147483647],
+    [2851995648, 2852061183],
+    [2886729728, 2887778303],
+    [3221225472, 3221225727],
+    [3221225984, 3221226239],
+    [3227017984, 3227018239],
+    [3232235520, 3232301055],
+    [3323068416, 3323199487],
+    [3325256704, 3325256959],
+    [3405803776, 3405804031],
+    [3758096384, 4294967295]
+  ];
+  IPV6_SPECIAL_PREFIXES = [
+    { groups: [0, 0, 0, 0, 0, 0, 0, 0], bits: 128 },
+    { groups: [0, 0, 0, 0, 0, 0, 0, 1], bits: 128 },
+    { groups: [0, 0, 0, 0, 0, 65535, 0, 0], bits: 96 },
+    { groups: [100, 65435, 0, 0, 0, 0, 0, 0], bits: 96 },
+    { groups: [256, 0, 0, 0, 0, 0, 0, 0], bits: 64 },
+    { groups: [8193, 0, 0, 0, 0, 0, 0, 0], bits: 32 },
+    { groups: [8193, 2, 0, 0, 0, 0, 0, 0], bits: 48 },
+    { groups: [8193, 16, 0, 0, 0, 0, 0, 0], bits: 28 },
+    { groups: [8193, 3512, 0, 0, 0, 0, 0, 0], bits: 32 },
+    { groups: [8194, 0, 0, 0, 0, 0, 0, 0], bits: 16 },
+    { groups: [16383, 0, 0, 0, 0, 0, 0, 0], bits: 20 },
+    { groups: [64512, 0, 0, 0, 0, 0, 0, 0], bits: 7 },
+    { groups: [65152, 0, 0, 0, 0, 0, 0, 0], bits: 10 },
+    { groups: [65216, 0, 0, 0, 0, 0, 0, 0], bits: 10 },
+    { groups: [65280, 0, 0, 0, 0, 0, 0, 0], bits: 8 }
+  ];
   EventValidationError = class EventValidationError extends Error {
     eventType;
     issues;
@@ -7149,6 +7692,8 @@ function rowToTaskList(row) {
   };
 }
 function createTaskList(input, db) {
+  if (input.status !== undefined)
+    throw new Error("The explicit SQLite storage cannot retain task-list status; use the shared API");
   const d = db || getDatabase();
   return d.transaction(() => {
     const id = uuid();
@@ -7190,6 +7735,8 @@ function listTaskLists(projectId, db) {
   return d.query("SELECT * FROM task_lists ORDER BY name").all().map(rowToTaskList);
 }
 function updateTaskList(id, input, db) {
+  if (input.status !== undefined)
+    throw new Error("The explicit SQLite storage cannot retain task-list status; use the shared API");
   const d = db || getDatabase();
   return d.transaction(() => {
     const existing = getTaskList(id, d);
@@ -7547,7 +8094,7 @@ function emitSharedTaskEventQuiet(input) {
 }
 var SOURCE = "todos";
 var init_shared_events = __esm(() => {
-  init_dist2();
+  init_dist();
   init_database();
   init_projects();
   init_task_lists();
@@ -11188,7 +11735,13 @@ function resolveCreateSlug(input, projectId, db) {
   }
   return nextPlanSlug(planSlugBase2(input.name), projectId, db);
 }
+function assertLegacyPlanInput(input) {
+  if (input.start_date !== undefined || input.end_date !== undefined || input.status === "planning" || input.status === "cancelled") {
+    throw new Error("Plan calendar dates and planning/cancelled statuses require the shared Todos API; explicit SQLite storage cannot retain them");
+  }
+}
 function createPlan(input, db) {
+  assertLegacyPlanInput(input);
   const d = db || getDatabase();
   const id = uuid();
   const timestamp2 = now();
@@ -11269,6 +11822,7 @@ function updatePlanStored(id, input, db) {
   return updated;
 }
 function updatePlan(id, input, db) {
+  assertLegacyPlanInput(input);
   const d = db || getDatabase();
   return d.transaction(() => {
     guardPlanRowsSqlite([id], d);
@@ -11743,27 +12297,27 @@ var init_boards = __esm(() => {
 // src/lib/artifact-store.ts
 import { createHash as createHash3 } from "crypto";
 import { existsSync as existsSync8, mkdirSync as mkdirSync4, readFileSync as readFileSync4, rmSync, statSync as statSync2, writeFileSync as writeFileSync2 } from "fs";
-import { basename, dirname as dirname4, join as join7, resolve as resolve8 } from "path";
+import { basename, dirname as dirname4, join as join6, resolve as resolve9 } from "path";
 import { tmpdir as tmpdir2 } from "os";
 function isInMemoryDb2(path) {
   return path === ":memory:" || path.startsWith("file::memory:");
 }
 function artifactStoreRoot() {
   if (process.env["HASNA_TODOS_ARTIFACTS_DIR"])
-    return resolve8(process.env["HASNA_TODOS_ARTIFACTS_DIR"]);
+    return resolve9(process.env["HASNA_TODOS_ARTIFACTS_DIR"]);
   if (process.env["TODOS_ARTIFACTS_DIR"])
-    return resolve8(process.env["TODOS_ARTIFACTS_DIR"]);
+    return resolve9(process.env["TODOS_ARTIFACTS_DIR"]);
   const dbPath = getDatabasePath();
   if (isInMemoryDb2(dbPath))
-    return join7(tmpdir2(), "hasna-todos-artifacts");
-  return join7(dirname4(resolve8(dbPath)), "artifacts");
+    return join6(tmpdir2(), "hasna-todos-artifacts");
+  return join6(dirname4(resolve9(dbPath)), "artifacts");
 }
 function artifactStorePath(relativePath) {
   const normalized = relativePath.replace(/\\/g, "/");
   if (normalized.includes("..") || normalized.startsWith("/") || normalized.length === 0) {
     throw new Error("Invalid artifact store path");
   }
-  return join7(artifactStoreRoot(), normalized);
+  return join6(artifactStoreRoot(), normalized);
 }
 function sha256(buffer) {
   return createHash3("sha256").update(buffer).digest("hex");
@@ -11803,7 +12357,7 @@ function mediaTypeFor(path, textLike) {
   return "application/octet-stream";
 }
 function storeArtifactContent(input) {
-  const sourcePath = resolve8(input.path);
+  const sourcePath = resolve9(input.path);
   if (!existsSync8(sourcePath))
     return null;
   const sourceStat = statSync2(sourcePath);
@@ -11821,7 +12375,7 @@ function storeArtifactContent(input) {
       redactionStatus = "redacted";
   }
   const storedSha = sha256(storedBuffer);
-  const relativePath = join7("sha256", storedSha.slice(0, 2), storedSha).replace(/\\/g, "/");
+  const relativePath = join6("sha256", storedSha.slice(0, 2), storedSha).replace(/\\/g, "/");
   const destination = artifactStorePath(relativePath);
   if (!existsSync8(destination)) {
     mkdirSync4(dirname4(destination), { recursive: true });
@@ -11958,19 +12512,19 @@ function importStoredArtifactContent(content) {
 }
 function getArtifactStoreRoot(dbPath) {
   if (process.env["HASNA_TODOS_ARTIFACTS_DIR"])
-    return resolve8(process.env["HASNA_TODOS_ARTIFACTS_DIR"]);
+    return resolve9(process.env["HASNA_TODOS_ARTIFACTS_DIR"]);
   if (process.env["TODOS_ARTIFACTS_DIR"])
-    return resolve8(process.env["TODOS_ARTIFACTS_DIR"]);
+    return resolve9(process.env["TODOS_ARTIFACTS_DIR"]);
   const path = dbPath ?? getDatabasePath();
   if (isInMemoryDb2(path))
-    return join7(tmpdir2(), "hasna-todos-artifacts");
-  return join7(dirname4(resolve8(path)), "artifacts");
+    return join6(tmpdir2(), "hasna-todos-artifacts");
+  return join6(dirname4(resolve9(path)), "artifacts");
 }
 function computeContentHash(path) {
-  return sha256(readFileSync4(resolve8(path)));
+  return sha256(readFileSync4(resolve9(path)));
 }
 function storeArtifactFile(input) {
-  const sourcePath = resolve8(input.sourcePath);
+  const sourcePath = resolve9(input.sourcePath);
   if (!existsSync8(sourcePath)) {
     throw new Error(`Source file not found: ${input.sourcePath}`);
   }
@@ -11984,7 +12538,7 @@ function storeArtifactFile(input) {
   let localPath = sourcePath;
   if (storageMode === "copy") {
     const fileName = input.name && input.name.trim().length > 0 ? basename(input.name) : basename(sourcePath);
-    const destination = join7(getArtifactStoreRoot(input.dbPath), input.artifactId, fileName);
+    const destination = join6(getArtifactStoreRoot(input.dbPath), input.artifactId, fileName);
     mkdirSync4(dirname4(destination), { recursive: true });
     writeFileSync2(destination, buffer);
     localPath = destination;
@@ -12019,7 +12573,7 @@ function buildArtifactExportManifest(artifacts, dbPath) {
   };
 }
 function writeArtifactExportManifest(manifest, outputPath) {
-  const destination = resolve8(outputPath);
+  const destination = resolve9(outputPath);
   mkdirSync4(dirname4(destination), { recursive: true });
   writeFileSync2(destination, `${JSON.stringify(manifest, null, 2)}
 `);
@@ -12707,7 +13261,9 @@ function finishTaskRunTransaction(input, db) {
   const key = input.key ? normalizeTransactionKey({ key: input.key }) : "";
   const run = input.run_id ? getTaskRun(resolveTaskRunId(input.run_id, d), d) : key ? findTaskRunByTransactionKey(key, input.task_id, d) : null;
   if (!run) {
-    throw new Error(input.run_id ? `Run not found: ${input.run_id}` : "runs finish requires a run id or --key");
+    if (input.run_id)
+      throw new InputValidationError(`Run not found: ${input.run_id}`, "Pass an existing run id, or --key.");
+    throw new InputValidationError("runs finish requires a run id or --key", "Pass run_id, or key with task_id.");
   }
   if (input.task_id && run.task_id !== input.task_id) {
     throw new Error(`Run ${run.id} belongs to task ${run.task_id}, not ${input.task_id}`);
@@ -13692,9 +14248,9 @@ function normalizeGeneratedAgentNames(db) {
 
 // src/db/agents.ts
 function getActiveWindowMs() {
-  const env = process.env["TODOS_AGENT_TIMEOUT_MS"];
-  if (env) {
-    const parsed = parseInt(env, 10);
+  const env2 = process.env["TODOS_AGENT_TIMEOUT_MS"];
+  if (env2) {
+    const parsed = parseInt(env2, 10);
     if (!isNaN(parsed) && parsed > 0)
       return parsed;
   }
@@ -14540,19 +15096,184 @@ function rollbackPlanProjectLinkSqlite(input, db) {
   })();
 }
 
-// src/storage/sqlite-snapshot.ts
-init_database();
-init_audit();
-init_plans();
-init_projects();
-init_task_lists();
-init_tasks();
-init_templates();
-init_storage_tombstones();
-
-// src/storage/audit-history-import.ts
-var AUDIT_HISTORY_DIVERGENT_REPLAY = "AUDIT_HISTORY_DIVERGENT_REPLAY";
-var AUDIT_HISTORY_TOMBSTONE_FORBIDDEN = "AUDIT_HISTORY_TOMBSTONE_FORBIDDEN";
+// src/storage/machine-registry.ts
+import { randomUUID as randomUUID3 } from "crypto";
+import { isDeepStrictEqual } from "util";
+class MachineRegistryError extends Error {
+  status;
+  constructor(message, status = 409) {
+    super(message);
+    this.status = status;
+  }
+}
+var fields = new Set(["id", "name", "hostname", "platform", "last_seen_at", "metadata", "created_at", "ssh_address", "is_primary", "archived_at"]);
+function validateMachines(value) {
+  if (!Array.isArray(value) || value.length > 1e4)
+    throw new MachineRegistryError("machines must be an array of at most 10000 complete records", 400);
+  for (const row of value) {
+    if (!row || typeof row !== "object" || Array.isArray(row) || Object.keys(row).some((key) => !fields.has(key)))
+      throw new MachineRegistryError("Invalid machine record fields", 400);
+    for (const key of ["id", "name", "last_seen_at", "created_at"])
+      if (typeof row[key] !== "string" || !row[key].trim() || row[key].length > 1024)
+        throw new MachineRegistryError(`Invalid machine ${key}`, 400);
+    for (const key of ["hostname", "platform", "ssh_address", "archived_at"])
+      if (row[key] !== null && typeof row[key] !== "string")
+        throw new MachineRegistryError(`Invalid machine ${key}`, 400);
+    for (const key of ["last_seen_at", "created_at", "archived_at"])
+      if (row[key] !== null && !Number.isFinite(Date.parse(row[key])))
+        throw new MachineRegistryError(`Invalid machine ${key}`, 400);
+    if (typeof row.is_primary !== "boolean" || !row.metadata || typeof row.metadata !== "object" || Array.isArray(row.metadata))
+      throw new MachineRegistryError("Invalid machine flags or metadata", 400);
+    if (!isDeepStrictEqual(JSON.parse(JSON.stringify(row.metadata)), row.metadata))
+      throw new MachineRegistryError("Machine metadata must preserve JSON values exactly", 400);
+    if (JSON.stringify(row.metadata).length > 262144)
+      throw new MachineRegistryError("Machine metadata is too large", 400);
+    if (row.is_primary && row.archived_at !== null)
+      throw new MachineRegistryError("An archived machine cannot be primary", 400);
+  }
+  return value;
+}
+function planMachineImport(existing, incoming) {
+  const rows = validateMachines(incoming);
+  const byId = new Map(existing.map((row) => [row.id, row]));
+  const byName = new Map(existing.map((row) => [row.name, row.id]));
+  const insert = [];
+  let skipped = 0;
+  for (const row of rows) {
+    const prior = byId.get(row.id);
+    if (prior && !isDeepStrictEqual(prior, row))
+      throw new MachineRegistryError("Machine migration conflicts with an existing identity; reconcile before retrying");
+    if (byName.has(row.name) && byName.get(row.name) !== row.id)
+      throw new MachineRegistryError("Machine name belongs to a different identity; migration was not applied");
+    if (prior)
+      skipped++;
+    else {
+      insert.push(row);
+      byId.set(row.id, row);
+      byName.set(row.name, row.id);
+    }
+  }
+  if ([...byId.values()].filter((row) => row.is_primary).length > 1)
+    throw new MachineRegistryError("Machine migration would create multiple primary machines");
+  return { rows: insert, skipped };
+}
+function createPostgresMachineRegistry(client, service, table, ensure) {
+  if (!/^[a-zA-Z_][a-zA-Z0-9_]*$/.test(table))
+    throw new Error("Invalid machine registry table");
+  async function list(connection = client) {
+    await ensure();
+    const result = await connection.query(`SELECT payload FROM ${table} WHERE service=$1 AND object_type='machines' AND deleted_at IS NULL ORDER BY object_id`, [service]);
+    return validateMachines(result.rows.map((row) => typeof row.payload === "string" ? JSON.parse(row.payload) : row.payload));
+  }
+  return { list, async execute(input) {
+    if (!input || typeof input !== "object" || Array.isArray(input) || !["register", "heartbeat", "set-primary", "archive", "unarchive", "delete", "import"].includes(input.action))
+      throw new MachineRegistryError("Invalid machine operation", 400);
+    if (Object.keys(input).some((key) => !["action", "name", "id", "options", "machines"].includes(key)))
+      throw new MachineRegistryError("Unknown machine operation fields", 400);
+    if (input.options !== undefined && (!input.options || typeof input.options !== "object" || Array.isArray(input.options)))
+      throw new MachineRegistryError("Invalid machine options", 400);
+    await ensure();
+    if (!client.transaction)
+      throw new MachineRegistryError("Machine registry requires a transactional server backend", 501);
+    return client.transaction(async (tx) => {
+      await tx.query("SELECT pg_advisory_xact_lock(hashtextextended($1, 0))", [`${service}:machine-registry`]);
+      const current = await list(tx);
+      let changed = [];
+      let skipped = 0;
+      let machine;
+      let deleted;
+      const stamp = new Date().toISOString();
+      if (input.action === "import") {
+        const plan = planMachineImport(current, input.machines);
+        const ids = plan.rows.map((row) => row.id);
+        if (ids.length) {
+          const retired = await tx.query(`SELECT object_id FROM ${table} WHERE service=$1 AND object_type='machines' AND object_id IN (SELECT jsonb_array_elements_text($2::text::jsonb)) AND deleted_at IS NOT NULL`, [service, JSON.stringify(ids)]);
+          if (retired.rows.length)
+            throw new MachineRegistryError("Machine migration contains a retired identity");
+        }
+        changed = plan.rows;
+        skipped = plan.skipped;
+      } else {
+        if (typeof input.name !== "string" || !input.name.trim() || input.name.length > 1024)
+          throw new MachineRegistryError("Machine name or ID is required", 400);
+        const matches = current.filter((row) => row.name === input.name || row.id === input.name);
+        if (matches.length > 1)
+          throw new MachineRegistryError("Machine selector is ambiguous between a name and another identity; use an unambiguous selector");
+        const prior = matches[0];
+        if (input.action === "register" || input.action === "heartbeat") {
+          const opts = input.options ?? {};
+          const allowed = new Set(["hostname", "platform", "ssh_address", "primary", "tailscale_name", "tailscale_ip", "lan_address", "workspace_path", "git_root", "arch"]);
+          for (const [key, value] of Object.entries(opts)) {
+            if (!allowed.has(key) || (key === "primary" ? typeof value !== "boolean" : typeof value !== "string" || value.length > 4096))
+              throw new MachineRegistryError("Invalid machine registration options", 400);
+          }
+          if (input.id !== undefined && (typeof input.id !== "string" || !input.id.trim() || input.id.length > 1024))
+            throw new MachineRegistryError("Invalid stable machine ID", 400);
+          if (prior && input.id && input.id !== prior.id)
+            throw new MachineRegistryError("Machine registration ID does not match existing identity");
+          if (!prior && input.id && current.some((row) => row.id === input.id))
+            throw new MachineRegistryError("Machine ID already belongs to another name");
+          const metadata = { ...prior?.metadata };
+          for (const key of ["tailscale_name", "tailscale_ip", "lan_address", "workspace_path", "git_root", "arch"])
+            if (opts[key] !== undefined)
+              metadata[key] = opts[key];
+          if (!prior && input.id) {
+            const retired = await tx.query(`SELECT object_id FROM ${table} WHERE service=$1 AND object_type='machines' AND object_id=$2 AND deleted_at IS NOT NULL`, [service, input.id]);
+            if (retired.rows.length)
+              throw new MachineRegistryError("Machine identity has been retired");
+          }
+          machine = { id: prior?.id ?? input.id ?? randomUUID3(), name: prior?.name ?? input.name, hostname: opts.hostname ?? prior?.hostname ?? null, platform: opts.platform ?? prior?.platform ?? null, ssh_address: opts.ssh_address ?? prior?.ssh_address ?? null, created_at: prior?.created_at ?? stamp, last_seen_at: stamp, archived_at: prior?.archived_at ?? null, is_primary: opts.primary === true || (prior?.is_primary ?? false), metadata };
+          if (machine.archived_at && machine.is_primary)
+            throw new MachineRegistryError("Cannot set archived machine as primary");
+          changed = [machine];
+          if (opts.primary === true)
+            changed.push(...current.filter((row) => row.is_primary && row.id !== machine.id).map((row) => ({ ...row, is_primary: false })));
+        } else {
+          if (!prior)
+            throw new MachineRegistryError("Machine not found", 404);
+          machine = { ...prior };
+          if (input.action === "set-primary") {
+            if (prior.archived_at)
+              throw new MachineRegistryError("Cannot set archived machine as primary");
+            machine.is_primary = true;
+            changed = current.filter((row) => row.is_primary && row.id !== prior.id).map((row) => ({ ...row, is_primary: false }));
+          } else if (input.action === "archive" || input.action === "delete") {
+            if (prior.is_primary)
+              throw new MachineRegistryError("Cannot archive or delete the primary machine");
+            const refs = await tx.query(`SELECT object_id FROM ${table} WHERE service=$1 AND object_type<>'machines' AND deleted_at IS NULL AND payload->>'machine_id'=$2 AND ($3='delete' OR (object_type='tasks' AND payload->>'status' IN ('pending','in_progress'))) LIMIT 1`, [service, prior.id, input.action]);
+            if (refs.rows.length)
+              throw new MachineRegistryError("Machine still has referenced records or active tasks");
+            machine.archived_at = stamp;
+            deleted = input.action === "delete" ? true : undefined;
+          } else if (input.action === "unarchive")
+            machine.archived_at = null;
+          else
+            throw new MachineRegistryError("Unknown machine action", 400);
+          changed.push(machine);
+        }
+      }
+      for (const row of changed) {
+        await tx.query(`INSERT INTO ${table} (service,object_type,object_id,payload,updated_at,deleted_at,version) VALUES ($1,'machines',$2,$3::text::jsonb,$4,$5,1) ON CONFLICT (service,object_type,object_id) DO UPDATE SET payload=EXCLUDED.payload,updated_at=EXCLUDED.updated_at,deleted_at=EXCLUDED.deleted_at,version=COALESCE(${table}.version,0)+1`, [service, row.id, JSON.stringify(row), stamp, deleted && row.id === machine?.id ? stamp : null]);
+      }
+      const machines = await list(tx);
+      return { schema_version: 2, machines, ...machine ? { machine } : {}, inserted: changed.filter((row) => !current.some((old) => old.id === row.id)).length, skipped, ...deleted ? { deleted } : {} };
+    });
+  } };
+}
+
+// src/storage/sqlite-snapshot.ts
+init_database();
+init_audit();
+init_plans();
+init_projects();
+init_task_lists();
+init_tasks();
+init_templates();
+init_storage_tombstones();
+
+// src/storage/audit-history-import.ts
+var AUDIT_HISTORY_DIVERGENT_REPLAY = "AUDIT_HISTORY_DIVERGENT_REPLAY";
+var AUDIT_HISTORY_TOMBSTONE_FORBIDDEN = "AUDIT_HISTORY_TOMBSTONE_FORBIDDEN";
 var AUDIT_HISTORY_FIELDS = [
   "id",
   "task_id",
@@ -14753,6 +15474,7 @@ function exportSqliteTodosStorageSnapshot(db) {
   return {
     exportedAt: new Date().toISOString(),
     source: "sqlite",
+    machines: exportSqliteMachines(d),
     tasks: listTasks({ include_archived: true }, d),
     projects: listProjects(d),
     projectMachinePaths: listProjectMachinePaths(d),
@@ -14766,7 +15488,6 @@ function exportSqliteTodosStorageSnapshot(db) {
   };
 }
 function importSqliteTodosStorageSnapshot(snapshot, db) {
-  const d = db ?? getDatabase();
   const result = {
     inserted: 0,
     updated: 0,
@@ -14774,6 +15495,22 @@ function importSqliteTodosStorageSnapshot(snapshot, db) {
     skipped: 0,
     errors: []
   };
+  if (snapshot.taskLists.some((row) => row.status !== undefined)) {
+    result.errors.push("The explicit SQLite storage cannot retain task-list status; use the shared API");
+    return result;
+  }
+  const d = db ?? getDatabase();
+  if ((snapshot.tombstones ?? []).some((row) => row.object_type === "machines")) {
+    result.errors.push("Machine tombstones require explicit registry lifecycle operations");
+    return result;
+  }
+  try {
+    if (snapshot.machines !== undefined)
+      validateMachines(snapshot.machines);
+  } catch (e) {
+    result.errors.push(e instanceof Error ? e.message : String(e));
+    return result;
+  }
   result.errors.push(...validateSnapshotRoutingRecords(snapshot.projects, snapshot.taskLists));
   if (result.errors.length === 0) {
     const existingProjects = d.query("SELECT id, task_list_id FROM projects").all();
@@ -14784,6 +15521,20 @@ function importSqliteTodosStorageSnapshot(snapshot, db) {
   result.errors.push(...auditImport.errors);
   if (result.errors.length > 0)
     return result;
+  if (snapshot.machines?.length) {
+    try {
+      d.transaction(() => {
+        const plan = planMachineImport(exportSqliteMachines(d), snapshot.machines);
+        for (const row of plan.rows)
+          d.run("INSERT INTO machines (id,name,hostname,platform,last_seen_at,metadata,created_at,ssh_address,is_primary,archived_at) VALUES (?,?,?,?,?,?,?,?,?,?)", [row.id, row.name, row.hostname, row.platform, row.last_seen_at, JSON.stringify(row.metadata), row.created_at, row.ssh_address, Number(row.is_primary), row.archived_at]);
+        result.inserted += plan.rows.length;
+        result.skipped += plan.skipped;
+      })();
+    } catch (error) {
+      result.errors.push(error instanceof Error ? error.message : String(error));
+      return result;
+    }
+  }
   result.skipped += auditImport.identicalReplayCount;
   const applyRows = (objectType, table, columns, rows, updateClockColumn, acceptEqualClock = true, afterUpsert) => {
     for (const row of rows) {
@@ -15018,6 +15769,17 @@ function clockColumnsForTable(table) {
     return ["created_at"];
   return ["updated_at", "created_at"];
 }
+function exportSqliteMachines(db) {
+  const columns = ["id", "name", "hostname", "platform", "last_seen_at", "metadata", "created_at", "ssh_address", "is_primary", "archived_at"];
+  const observed = db.query("PRAGMA table_info(machines)").all().map((row) => row.name);
+  if (observed.length !== columns.length || observed.some((name) => !columns.includes(name)))
+    throw new Error("Machine SQLite schema differs from the lossless migration contract; preserve the source and upgrade the migrator");
+  return validateMachines(db.query("SELECT * FROM machines ORDER BY id").all().map((row) => {
+    if (row.is_primary !== 0 && row.is_primary !== 1)
+      throw new Error("Machine is_primary must be the raw SQLite integer 0 or 1; migration refused");
+    return { ...row, is_primary: row.is_primary === 1, metadata: JSON.parse(String(row.metadata)) };
+  }));
+}
 
 // src/storage/local-sqlite.ts
 var TASK_UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
@@ -15223,9 +15985,1158 @@ function createLocalSqliteTodosStorageAdapter(options = {}) {
   return adapter;
 }
 
+// src/lib/builtin-template-library.ts
+import { mkdirSync as mkdirSync5, writeFileSync as writeFileSync3 } from "fs";
+import { join as join7 } from "path";
+var BUILTIN_TEMPLATE_LIBRARY_VERSION = "2026-05-21";
+var BUILTIN_TEMPLATE_LIBRARY_SOURCE = "bundled-local-template-library";
+var TEMPLATE_LIBRARY_SCHEMA = "todos.template_library.v1";
+var BUILTIN_TEMPLATES = [
+  {
+    name: "bug-fix",
+    description: "Reproduce, diagnose, fix, test, and release a defect.",
+    category: "bug-fix",
+    version: BUILTIN_TEMPLATE_LIBRARY_VERSION,
+    variables: [
+      { name: "bug", required: true, description: "Bug description" }
+    ],
+    tasks: [
+      {
+        position: 0,
+        title_pattern: "Reproduce: {bug}",
+        priority: "critical",
+        tags: ["bug", "repro"]
+      },
+      {
+        position: 1,
+        title_pattern: "Diagnose root cause of {bug}",
+        priority: "critical",
+        tags: ["bug", "diagnosis"],
+        depends_on_positions: [0]
+      },
+      {
+        position: 2,
+        title_pattern: "Write regression test for {bug}",
+        priority: "high",
+        tags: ["bug", "test"],
+        depends_on_positions: [1]
+      },
+      {
+        position: 3,
+        title_pattern: "Implement fix for {bug}",
+        priority: "critical",
+        tags: ["bug", "implementation"],
+        depends_on_positions: [2]
+      },
+      {
+        position: 4,
+        title_pattern: "Run full verification for {bug}",
+        priority: "high",
+        tags: ["bug", "verification"],
+        depends_on_positions: [3]
+      },
+      {
+        position: 5,
+        title_pattern: "Publish and smoke test fix for {bug}",
+        priority: "high",
+        tags: ["bug", "release"],
+        depends_on_positions: [4]
+      }
+    ]
+  },
+  {
+    name: "feature-implementation",
+    description: "Plan, build, test, document, and release a product feature.",
+    category: "feature",
+    version: BUILTIN_TEMPLATE_LIBRARY_VERSION,
+    variables: [
+      { name: "feature", required: true, description: "Feature name" },
+      {
+        name: "scope",
+        required: false,
+        default: "medium",
+        description: "Implementation size or risk"
+      }
+    ],
+    tasks: [
+      {
+        position: 0,
+        title_pattern: "Define acceptance criteria for {feature}",
+        priority: "high",
+        tags: ["feature", "spec"]
+      },
+      {
+        position: 1,
+        title_pattern: "Design {scope} implementation plan for {feature}",
+        priority: "high",
+        tags: ["feature", "design"],
+        depends_on_positions: [0]
+      },
+      {
+        position: 2,
+        title_pattern: "Implement {feature}",
+        priority: "critical",
+        tags: ["feature", "implementation"],
+        depends_on_positions: [1]
+      },
+      {
+        position: 3,
+        title_pattern: "Add tests for {feature}",
+        priority: "high",
+        tags: ["feature", "test"],
+        depends_on_positions: [2]
+      },
+      {
+        position: 4,
+        title_pattern: "Update docs for {feature}",
+        priority: "medium",
+        tags: ["feature", "docs"],
+        depends_on_positions: [2]
+      },
+      {
+        position: 5,
+        title_pattern: "Run release checks for {feature}",
+        priority: "high",
+        tags: ["feature", "verification"],
+        depends_on_positions: [3, 4]
+      }
+    ]
+  },
+  {
+    name: "security-review",
+    description: "Threat model, test, remediate, and report on security posture.",
+    category: "security",
+    version: BUILTIN_TEMPLATE_LIBRARY_VERSION,
+    variables: [
+      {
+        name: "target",
+        required: true,
+        description: "System, package, or change under review"
+      }
+    ],
+    tasks: [
+      {
+        position: 0,
+        title_pattern: "Map trust boundaries for {target}",
+        priority: "critical",
+        tags: ["security", "threat-model"]
+      },
+      {
+        position: 1,
+        title_pattern: "Scan {target} for vulnerabilities and secret exposure",
+        priority: "critical",
+        tags: ["security", "scan"],
+        depends_on_positions: [0]
+      },
+      {
+        position: 2,
+        title_pattern: "Review authz, data access, and dependency risks in {target}",
+        priority: "critical",
+        tags: ["security", "review"],
+        depends_on_positions: [0]
+      },
+      {
+        position: 3,
+        title_pattern: "Fix critical security findings in {target}",
+        priority: "critical",
+        tags: ["security", "fix"],
+        depends_on_positions: [1, 2]
+      },
+      {
+        position: 4,
+        title_pattern: "Retest {target} security fixes",
+        priority: "high",
+        tags: ["security", "verification"],
+        depends_on_positions: [3]
+      },
+      {
+        position: 5,
+        title_pattern: "Write local security review report for {target}",
+        priority: "medium",
+        tags: ["security", "report"],
+        depends_on_positions: [4]
+      }
+    ]
+  },
+  {
+    name: "release",
+    description: "Prepare, verify, publish, install, and smoke test a package release.",
+    category: "release",
+    version: BUILTIN_TEMPLATE_LIBRARY_VERSION,
+    variables: [
+      { name: "package", required: true, description: "Package name" },
+      {
+        name: "version",
+        required: false,
+        default: "patch",
+        description: "Release version or bump type"
+      }
+    ],
+    tasks: [
+      {
+        position: 0,
+        title_pattern: "Prepare {package} {version} release notes",
+        priority: "medium",
+        tags: ["release", "docs"]
+      },
+      {
+        position: 1,
+        title_pattern: "Run full tests for {package}",
+        priority: "critical",
+        tags: ["release", "test"]
+      },
+      {
+        position: 2,
+        title_pattern: "Run build and release verification for {package}",
+        priority: "critical",
+        tags: ["release", "verification"],
+        depends_on_positions: [1]
+      },
+      {
+        position: 3,
+        title_pattern: "Scan {package} release diff for secrets",
+        priority: "critical",
+        tags: ["release", "security"],
+        depends_on_positions: [2]
+      },
+      {
+        position: 4,
+        title_pattern: "Publish {package} {version}",
+        priority: "high",
+        tags: ["release", "publish"],
+        depends_on_positions: [3]
+      },
+      {
+        position: 5,
+        title_pattern: "Install and smoke test published {package}",
+        priority: "high",
+        tags: ["release", "smoke"],
+        depends_on_positions: [4]
+      }
+    ]
+  },
+  {
+    name: "migration",
+    description: "Plan, test, apply, and verify a schema or data migration.",
+    category: "migration",
+    version: BUILTIN_TEMPLATE_LIBRARY_VERSION,
+    variables: [
+      {
+        name: "migration",
+        required: true,
+        description: "Migration name or objective"
+      }
+    ],
+    tasks: [
+      {
+        position: 0,
+        title_pattern: "Design migration plan for {migration}",
+        priority: "critical",
+        tags: ["migration", "plan"]
+      },
+      {
+        position: 1,
+        title_pattern: "Write rollback plan for {migration}",
+        priority: "critical",
+        tags: ["migration", "rollback"],
+        depends_on_positions: [0]
+      },
+      {
+        position: 2,
+        title_pattern: "Implement migration {migration}",
+        priority: "critical",
+        tags: ["migration", "implementation"],
+        depends_on_positions: [0]
+      },
+      {
+        position: 3,
+        title_pattern: "Test migration {migration} on fixture data",
+        priority: "high",
+        tags: ["migration", "test"],
+        depends_on_positions: [2]
+      },
+      {
+        position: 4,
+        title_pattern: "Run migration {migration} verification and drift checks",
+        priority: "high",
+        tags: ["migration", "verification"],
+        depends_on_positions: [1, 3]
+      },
+      {
+        position: 5,
+        title_pattern: "Document migration {migration} evidence",
+        priority: "medium",
+        tags: ["migration", "docs"],
+        depends_on_positions: [4]
+      }
+    ]
+  },
+  {
+    name: "incident",
+    description: "Triage, mitigate, repair, verify, and retrospect an incident.",
+    category: "incident",
+    version: BUILTIN_TEMPLATE_LIBRARY_VERSION,
+    variables: [
+      { name: "incident", required: true, description: "Incident summary" }
+    ],
+    tasks: [
+      {
+        position: 0,
+        title_pattern: "Triage incident: {incident}",
+        priority: "critical",
+        tags: ["incident", "triage"]
+      },
+      {
+        position: 1,
+        title_pattern: "Mitigate customer impact for {incident}",
+        priority: "critical",
+        tags: ["incident", "mitigation"],
+        depends_on_positions: [0]
+      },
+      {
+        position: 2,
+        title_pattern: "Diagnose root cause for {incident}",
+        priority: "critical",
+        tags: ["incident", "diagnosis"],
+        depends_on_positions: [0]
+      },
+      {
+        position: 3,
+        title_pattern: "Implement durable repair for {incident}",
+        priority: "critical",
+        tags: ["incident", "repair"],
+        depends_on_positions: [2]
+      },
+      {
+        position: 4,
+        title_pattern: "Verify recovery from {incident}",
+        priority: "high",
+        tags: ["incident", "verification"],
+        depends_on_positions: [1, 3]
+      },
+      {
+        position: 5,
+        title_pattern: "Write retrospective for {incident}",
+        priority: "medium",
+        tags: ["incident", "retro"],
+        depends_on_positions: [4]
+      }
+    ]
+  },
+  {
+    name: "docs-refresh",
+    description: "Audit, update, validate, and publish documentation changes.",
+    category: "docs",
+    version: BUILTIN_TEMPLATE_LIBRARY_VERSION,
+    variables: [
+      {
+        name: "area",
+        required: true,
+        description: "Documentation area or product surface"
+      }
+    ],
+    tasks: [
+      {
+        position: 0,
+        title_pattern: "Audit current docs for {area}",
+        priority: "medium",
+        tags: ["docs", "audit"]
+      },
+      {
+        position: 1,
+        title_pattern: "Update examples and commands for {area}",
+        priority: "medium",
+        tags: ["docs", "examples"],
+        depends_on_positions: [0]
+      },
+      {
+        position: 2,
+        title_pattern: "Validate docs snippets for {area}",
+        priority: "high",
+        tags: ["docs", "verification"],
+        depends_on_positions: [1]
+      },
+      {
+        position: 3,
+        title_pattern: "Refresh screenshots or generated artifacts for {area}",
+        priority: "medium",
+        tags: ["docs", "assets"],
+        depends_on_positions: [1]
+      },
+      {
+        position: 4,
+        title_pattern: "Publish docs refresh for {area}",
+        priority: "medium",
+        tags: ["docs", "release"],
+        depends_on_positions: [2, 3]
+      }
+    ]
+  },
+  {
+    name: "qa",
+    description: "Build a focused QA plan, execute checks, file defects, and sign off.",
+    category: "qa",
+    version: BUILTIN_TEMPLATE_LIBRARY_VERSION,
+    variables: [
+      {
+        name: "target",
+        required: true,
+        description: "Feature, release, or workflow under QA"
+      }
+    ],
+    tasks: [
+      {
+        position: 0,
+        title_pattern: "Create QA matrix for {target}",
+        priority: "high",
+        tags: ["qa", "plan"]
+      },
+      {
+        position: 1,
+        title_pattern: "Run happy-path QA for {target}",
+        priority: "high",
+        tags: ["qa", "manual"],
+        depends_on_positions: [0]
+      },
+      {
+        position: 2,
+        title_pattern: "Run edge-case QA for {target}",
+        priority: "high",
+        tags: ["qa", "edge-cases"],
+        depends_on_positions: [0]
+      },
+      {
+        position: 3,
+        title_pattern: "File and dedupe QA defects for {target}",
+        priority: "medium",
+        tags: ["qa", "bugs"],
+        depends_on_positions: [1, 2]
+      },
+      {
+        position: 4,
+        title_pattern: "Verify QA fixes for {target}",
+        priority: "high",
+        tags: ["qa", "verification"],
+        depends_on_positions: [3]
+      },
+      {
+        position: 5,
+        title_pattern: "Record QA signoff for {target}",
+        priority: "medium",
+        tags: ["qa", "signoff"],
+        depends_on_positions: [4]
+      }
+    ]
+  },
+  {
+    name: "open-source-project",
+    description: "Full open-source project bootstrap \u2014 scaffold to publish",
+    category: "open-source",
+    version: BUILTIN_TEMPLATE_LIBRARY_VERSION,
+    variables: [
+      { name: "name", required: true, description: "Service name" },
+      {
+        name: "org",
+        required: false,
+        default: "hasna",
+        description: "GitHub org"
+      }
+    ],
+    tasks: [
+      {
+        position: 0,
+        title_pattern: "Scaffold {name} package structure",
+        priority: "critical"
+      },
+      {
+        position: 1,
+        title_pattern: "Create {name} SQLite database + migrations",
+        priority: "critical",
+        depends_on_positions: [0]
+      },
+      {
+        position: 2,
+        title_pattern: "Implement {name} CRUD operations",
+        priority: "high",
+        depends_on_positions: [1]
+      },
+      {
+        position: 3,
+        title_pattern: "Build {name} MCP server with standard tools",
+        priority: "high",
+        depends_on_positions: [2]
+      },
+      {
+        position: 4,
+        title_pattern: "Build {name} CLI with Commander.js",
+        priority: "high",
+        depends_on_positions: [2]
+      },
+      {
+        position: 5,
+        title_pattern: "Build {name} REST API",
+        priority: "medium",
+        depends_on_positions: [2]
+      },
+      {
+        position: 6,
+        title_pattern: "Write unit tests for {name}",
+        priority: "high",
+        depends_on_positions: [2, 3, 4]
+      },
+      {
+        position: 7,
+        title_pattern: "Add Apache 2.0 license and README",
+        priority: "medium",
+        depends_on_positions: [0]
+      },
+      {
+        position: 8,
+        title_pattern: "Create GitHub repo {org}/{name}",
+        priority: "medium",
+        depends_on_positions: [7]
+      },
+      {
+        position: 9,
+        title_pattern: "Add local backup and restore workflow for {name}",
+        priority: "medium",
+        depends_on_positions: [1]
+      },
+      {
+        position: 10,
+        title_pattern: "Add agent tools (register_agent, heartbeat, set_focus, list_agents)",
+        priority: "medium",
+        depends_on_positions: [3]
+      },
+      {
+        position: 11,
+        title_pattern: "Publish @hasna/{name} to npm",
+        priority: "high",
+        depends_on_positions: [6, 7, 8]
+      },
+      {
+        position: 12,
+        title_pattern: "Install @hasna/{name} globally and verify",
+        priority: "medium",
+        depends_on_positions: [11]
+      }
+    ]
+  },
+  {
+    name: "release",
+    version: BUILTIN_TEMPLATE_LIBRARY_VERSION,
+    category: "ops",
+    description: "Version release workflow \u2014 test, changelog, publish, verify",
+    variables: [
+      {
+        name: "version",
+        required: true,
+        description: "Release version (e.g. 1.2.0)"
+      },
+      {
+        name: "package",
+        required: false,
+        default: "package",
+        description: "Package name"
+      }
+    ],
+    tasks: [
+      {
+        position: 0,
+        title_pattern: "Run full test suite for {package} {version}",
+        priority: "critical"
+      },
+      {
+        position: 1,
+        title_pattern: "Update changelog for {version}",
+        priority: "high",
+        depends_on_positions: [0]
+      },
+      {
+        position: 2,
+        title_pattern: "Bump version to {version}",
+        priority: "high",
+        depends_on_positions: [1]
+      },
+      {
+        position: 3,
+        title_pattern: "Publish {package} {version}",
+        priority: "critical",
+        depends_on_positions: [2]
+      },
+      {
+        position: 4,
+        title_pattern: "Verify {package} {version} install and CLI",
+        priority: "high",
+        depends_on_positions: [3]
+      }
+    ]
+  },
+  {
+    name: "docs-refresh",
+    version: BUILTIN_TEMPLATE_LIBRARY_VERSION,
+    category: "workflow",
+    description: "Documentation refresh \u2014 audit, update, verify links",
+    variables: [
+      {
+        name: "scope",
+        required: true,
+        description: "Docs scope (README, API, AGENTS.md)"
+      }
+    ],
+    tasks: [
+      {
+        position: 0,
+        title_pattern: "Audit outdated sections in {scope}",
+        priority: "high"
+      },
+      {
+        position: 1,
+        title_pattern: "Update {scope} for current behavior",
+        priority: "high",
+        depends_on_positions: [0]
+      },
+      {
+        position: 2,
+        title_pattern: "Verify examples in {scope} still work",
+        priority: "medium",
+        depends_on_positions: [1]
+      },
+      {
+        position: 3,
+        title_pattern: "Fix broken links in {scope}",
+        priority: "medium",
+        depends_on_positions: [1]
+      }
+    ]
+  },
+  {
+    name: "migration",
+    version: BUILTIN_TEMPLATE_LIBRARY_VERSION,
+    category: "ops",
+    description: "Schema/data migration workflow",
+    variables: [
+      {
+        name: "migration",
+        required: true,
+        description: "Migration name or ID"
+      },
+      {
+        name: "target",
+        required: false,
+        default: "sqlite",
+        description: "Target store"
+      }
+    ],
+    tasks: [
+      {
+        position: 0,
+        title_pattern: "Write forward migration for {migration} ({target})",
+        priority: "critical"
+      },
+      {
+        position: 1,
+        title_pattern: "Add migration tests for {migration}",
+        priority: "high",
+        depends_on_positions: [0]
+      },
+      {
+        position: 2,
+        title_pattern: "Run migration dry-run on copy",
+        priority: "high",
+        depends_on_positions: [1]
+      },
+      {
+        position: 3,
+        title_pattern: "Apply {migration} and verify integrity",
+        priority: "critical",
+        depends_on_positions: [2]
+      },
+      {
+        position: 4,
+        title_pattern: "Document rollback for {migration}",
+        priority: "medium",
+        depends_on_positions: [3]
+      }
+    ]
+  },
+  {
+    name: "incident-response",
+    version: BUILTIN_TEMPLATE_LIBRARY_VERSION,
+    category: "ops",
+    description: "Incident triage, mitigation, postmortem",
+    variables: [
+      { name: "incident", required: true, description: "Incident summary" }
+    ],
+    tasks: [
+      {
+        position: 0,
+        title_pattern: "Triage: {incident}",
+        priority: "critical",
+        tags: ["incident"]
+      },
+      {
+        position: 1,
+        title_pattern: "Mitigate impact of {incident}",
+        priority: "critical",
+        depends_on_positions: [0],
+        tags: ["incident"]
+      },
+      {
+        position: 2,
+        title_pattern: "Identify root cause: {incident}",
+        priority: "critical",
+        depends_on_positions: [1]
+      },
+      {
+        position: 3,
+        title_pattern: "Permanent fix for {incident}",
+        priority: "high",
+        depends_on_positions: [2]
+      },
+      {
+        position: 4,
+        title_pattern: "Write postmortem for {incident}",
+        priority: "medium",
+        depends_on_positions: [3]
+      },
+      {
+        position: 5,
+        title_pattern: "Add monitoring/alert for {incident} class",
+        priority: "medium",
+        depends_on_positions: [4]
+      }
+    ]
+  }
+];
+function templateMetadata(template) {
+  return {
+    source: BUILTIN_TEMPLATE_LIBRARY_SOURCE,
+    library_version: template.version,
+    category: template.category,
+    template_file: `${template.name}.json`,
+    local_only: true,
+    marketplace_free: true
+  };
+}
+function listBuiltinTemplates() {
+  return BUILTIN_TEMPLATES.map((template) => ({
+    ...template,
+    variables: template.variables.map((variable) => ({ ...variable })),
+    tasks: template.tasks.map((task) => ({
+      ...task,
+      tags: task.tags ? [...task.tags] : undefined
+    }))
+  }));
+}
+function getBuiltinTemplate(name) {
+  return listBuiltinTemplates().find((template) => template.name === name) ?? null;
+}
+function exportBuiltinTemplate(name) {
+  const template = getBuiltinTemplate(name);
+  if (!template)
+    throw new Error(`Built-in template not found: ${name}`);
+  return {
+    name: template.name,
+    title_pattern: `${template.name}: {${template.variables[0]?.name ?? "name"}}`,
+    description: template.description,
+    priority: "medium",
+    tags: [template.category, "local-template"],
+    variables: template.variables,
+    project_id: null,
+    plan_id: null,
+    metadata: templateMetadata(template),
+    tasks: template.tasks.map((task) => ({
+      position: task.position,
+      title_pattern: task.title_pattern,
+      description: task.description ?? null,
+      priority: task.priority ?? "medium",
+      tags: task.tags ?? [template.category],
+      task_type: task.task_type ?? null,
+      condition: task.condition ?? null,
+      include_template_id: task.include_template_id ?? null,
+      depends_on_positions: task.depends_on_positions ?? task.depends_on ?? [],
+      metadata: task.metadata ?? { category: template.category }
+    }))
+  };
+}
+function exportBuiltinTemplateFiles() {
+  return BUILTIN_TEMPLATES.map((template) => ({
+    filename: `${template.name}.json`,
+    template: exportBuiltinTemplate(template.name)
+  }));
+}
+function writeBuiltinTemplateFiles(directory) {
+  mkdirSync5(directory, { recursive: true });
+  const files = [];
+  for (const entry of exportBuiltinTemplateFiles()) {
+    const path = join7(directory, entry.filename);
+    writeFileSync3(path, `${JSON.stringify(entry.template, null, 2)}
+`, "utf-8");
+    files.push(path);
+  }
+  return { directory, written: files.length, files };
+}
+function builtinTemplateInputs() {
+  return listBuiltinTemplates().map((bt) => ({
+    name: bt.name,
+    title_pattern: `${bt.name}: {${bt.variables[0]?.name || "name"}}`,
+    description: bt.description,
+    tags: [bt.category, "local-template"],
+    variables: bt.variables,
+    metadata: templateMetadata(bt),
+    tasks: bt.tasks.map((task) => ({
+      title_pattern: task.title_pattern,
+      description: task.description,
+      priority: task.priority,
+      tags: task.tags,
+      task_type: task.task_type,
+      depends_on: task.depends_on_positions || task.depends_on,
+      metadata: task.metadata
+    }))
+  }));
+}
+
+// src/lib/plan-schedule.ts
+function validatePlanSchedule(value) {
+  for (const key of ["start_date", "end_date"]) {
+    const date = value[key];
+    if (date === undefined || date === null)
+      continue;
+    if (typeof date !== "string" || !/^\d{4}-\d{2}-\d{2}$/.test(date) || !Number.isFinite(Date.parse(date)) || new Date(date).toISOString().slice(0, 10) !== date)
+      return `${key} must be a valid ISO calendar date (YYYY-MM-DD)`;
+  }
+  if (typeof value.start_date === "string" && typeof value.end_date === "string" && value.start_date > value.end_date)
+    return "end_date must not precede start_date";
+  return null;
+}
+
+// src/storage/atomic-project-migration.ts
+init_types();
+import { createHash as createHash5 } from "crypto";
+var families = { projects: "projects", tasks: "tasks", plans: "plans", taskLists: "task_lists", auditHistory: "audit_history" };
+
+class AtomicMigrationError extends Error {
+  status;
+  record;
+  constructor(status, message, record) {
+    super(message);
+    this.status = status;
+    this.record = record;
+    this.name = "AtomicMigrationError";
+  }
+}
+function fail(message, status = 409, record) {
+  throw new AtomicMigrationError(status, message, record && { object_type: record.object_type, object_id: record.object_id });
+}
+function plain(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value) && (Object.getPrototypeOf(value) === Object.prototype || Object.getPrototypeOf(value) === null);
+}
+function canonical(value, depth = 0) {
+  if (depth > 32)
+    fail("Migration JSON depth exceeds 32", 400);
+  if (value === null || typeof value === "boolean" || typeof value === "string")
+    return JSON.stringify(value);
+  if (typeof value === "number" && Number.isFinite(value))
+    return JSON.stringify(value);
+  if (Array.isArray(value))
+    return "[" + value.map((v) => canonical(v, depth + 1)).join(",") + "]";
+  if (plain(value))
+    return "{" + Object.keys(value).sort().map((k) => JSON.stringify(k) + ":" + canonical(value[k], depth + 1)).join(",") + "}";
+  return fail("Migration requires finite JSON values", 400);
+}
+function atomicMigrationHash(value) {
+  return createHash5("sha256").update(canonical(value)).digest("hex");
+}
+function stamp(value) {
+  if (typeof value !== "string" || !/^\d{4}-\d\d-\d\dT\d\d:\d\d:\d\d\.\d{3}Z$/.test(value) || !Number.isFinite(Date.parse(value)) || new Date(value).toISOString() !== value)
+    fail("Migration clocks require canonical millisecond UTC timestamps", 400);
+  return value;
+}
+function version(value) {
+  if (value == null)
+    return 0;
+  if (!Number.isSafeInteger(value) || Number(value) < 0)
+    fail("Invalid migration version", 400);
+  return value;
+}
+function key(row) {
+  return row.object_type + "\x00" + row.object_id;
+}
+function normalized(row) {
+  return { ...row, source_machine_id: row.source_machine_id ?? null, updated_at: new Date(row.updated_at).toISOString(), deleted_at: row.deleted_at ? new Date(row.deleted_at).toISOString() : null };
+}
+function digest(row) {
+  return atomicMigrationHash(normalized(row));
+}
+function compare(a, b) {
+  return Date.parse(String(a.updated_at)) - Date.parse(String(b.updated_at)) || version(a.version) - version(b.version);
+}
+function identity(value) {
+  if (typeof value !== "string" || !value.trim() || value.length > 256 || value.includes("\x00"))
+    fail("Invalid migration record identity", 400);
+  return value;
+}
+function validate(request) {
+  if (!plain(request) || request.schema_version !== 1 || typeof request.operation_id !== "string" || !/^[A-Za-z0-9._:-]{8,128}$/.test(request.operation_id))
+    fail("Invalid migration operation identity/version", 400);
+  if (Object.keys(request).some((k) => !["schema_version", "operation_id", "expected_authority", "snapshot", "snapshot_hash"].includes(k)) || Buffer.byteLength(canonical(request)) > 2200000)
+    fail("Unsupported or oversized migration envelope", 400);
+  if (!plain(request.expected_authority))
+    fail("Expected migration authority is required", 400);
+  identity(request.expected_authority.tenant_id);
+  identity(request.expected_authority.kid);
+  identity(request.expected_authority.deployment_id);
+  if (!plain(request.snapshot))
+    fail("Migration snapshot must be an object", 400);
+  const encoded = canonical(request.snapshot);
+  if (Buffer.byteLength(encoded) > 2 * 1024 * 1024)
+    fail("Migration snapshot exceeds 2 MiB", 413);
+  if (atomicMigrationHash(request.snapshot) !== request.snapshot_hash)
+    fail("Migration snapshot hash mismatch", 400);
+  const allowed = new Set([...Object.keys(families), "tombstones", "exportedAt", "source"]);
+  for (const [name, value] of Object.entries(request.snapshot))
+    if (!allowed.has(name) && !(Array.isArray(value) && value.length === 0))
+      fail(`Unsupported atomic migration family: ${name}`, 400);
+  const rows = [];
+  for (const [name, type] of Object.entries(families)) {
+    const values = request.snapshot[name] ?? [];
+    if (!Array.isArray(values))
+      fail(`Invalid migration array: ${name}`, 400);
+    for (const value of values) {
+      if (!plain(value))
+        fail("Invalid migration record", 400);
+      const id = identity(value.id);
+      const clock = stamp(value.updated_at ?? value.created_at);
+      if (type === "tasks") {
+        if (typeof value.title !== "string" || !TASK_STATUSES.includes(value.status) || !TASK_PRIORITIES.includes(value.priority))
+          fail("Invalid task migration payload", 400);
+        if (value.locked_by || value.runner_id)
+          fail("Active task leases require separate migration reconciliation", 409);
+      }
+      if (type === "plans" && (typeof value.name !== "string" || !PLAN_STATUSES.includes(value.status)))
+        fail("Invalid plan migration payload", 400);
+      if (type === "projects" && typeof value.name !== "string")
+        fail("Invalid project migration payload", 400);
+      if (type === "audit_history" && (typeof value.task_id !== "string" || typeof value.action !== "string"))
+        fail("Invalid history migration payload", 400);
+      rows.push({ object_type: type, object_id: id, payload: value, updated_at: clock, deleted_at: null, version: value.version == null ? null : version(value.version), source_machine_id: typeof value.source_machine_id === "string" ? value.source_machine_id : null });
+    }
+  }
+  const tombstones = request.snapshot.tombstones ?? [];
+  if (!Array.isArray(tombstones))
+    fail("Invalid tombstone array", 400);
+  for (const value of tombstones) {
+    if (!plain(value) || value.object_type !== "projects")
+      fail("Atomic migration supports only project tombstones", 400);
+    if (!plain(value.payload))
+      fail("Project tombstone must preserve its original payload", 400);
+    if (stamp(value.updated_at) < stamp(value.deleted_at))
+      fail("Tombstone update clock precedes deletion", 400);
+    const id = identity(value.object_id);
+    if (value.payload.id !== id)
+      fail("Tombstone payload identity mismatch", 400);
+    rows.push({ object_type: "projects", object_id: id, payload: value.payload, updated_at: stamp(value.updated_at), deleted_at: stamp(value.deleted_at), version: value.version == null ? null : version(value.version), source_machine_id: typeof value.source_machine_id === "string" ? value.source_machine_id : null });
+  }
+  if (!rows.length || rows.length > 1000)
+    fail("Atomic migration requires 1-1000 records", 400);
+  const unique4 = new Map;
+  for (const row of rows) {
+    const previous = unique4.get(key(row));
+    if (previous && digest(previous) !== digest(row))
+      fail("Divergent duplicate migration identity", 409, row);
+    unique4.set(key(row), row);
+  }
+  return [...unique4.values()];
+}
+function validateGraph(rows) {
+  const live = [...rows.values()].filter((r) => !r.deleted_at);
+  const get = (type, id) => typeof id === "string" ? rows.get(type + "\x00" + id) : undefined;
+  for (const row of live) {
+    if (row.object_type === "audit_history") {
+      if (!get("tasks", row.payload.task_id))
+        fail("Migration history references an unknown task", 409, row);
+      continue;
+    }
+    if (!["projects", "tasks", "plans", "task_lists"].includes(row.object_type))
+      continue;
+    if (row.object_type === "tasks" && row.payload.plan_id) {
+      const plan = get("plans", row.payload.plan_id);
+      if (plan && !plan.deleted_at && (plan.payload.project_id ?? null) !== (row.payload.project_id ?? null))
+        fail("Migration task project conflicts with its plan", 409, row);
+    }
+    if (["tasks", "plans"].includes(row.object_type) && row.payload.task_list_id != null) {
+      const selector = row.payload.task_list_id;
+      if (typeof selector !== "string" || !selector)
+        fail("Invalid migration task-list selector", 409, row);
+      const candidates = live.filter((candidate) => candidate.object_type === "task_lists" && (candidate.payload.project_id ?? null) === (row.payload.project_id ?? null) && (candidate.object_id === selector || candidate.payload.slug === selector));
+      const project = get("projects", row.payload.project_id);
+      const canonicalDefault = project && !project.deleted_at && project.payload.task_list_id === selector;
+      if (candidates.length > 1 || !candidates.length && !canonicalDefault)
+        fail("Migration task-list reference is missing or ambiguous; explicit reconciliation required", 409, row);
+    }
+    const refs = [];
+    if (row.object_type === "projects")
+      refs.push(["projects", row.payload.parent_id]);
+    else
+      refs.push(["projects", row.payload.project_id]);
+    if (row.object_type === "tasks")
+      refs.push(["tasks", row.payload.parent_id], ["plans", row.payload.plan_id]);
+    for (const [type, id] of refs) {
+      if (id == null)
+        continue;
+      if (typeof id !== "string" || !id || !get(type, id) || get(type, id).deleted_at)
+        fail("Migration reference is missing or deleted", 409, row);
+    }
+    if (row.object_type === "tasks" && row.payload.parent_id) {
+      const parent = get("tasks", row.payload.parent_id);
+      if ((parent.payload.project_id ?? null) !== (row.payload.project_id ?? null))
+        fail("Migration task parent crosses project scope", 409, row);
+    }
+  }
+  for (const type of ["projects", "tasks"])
+    for (const row of live.filter((r) => r.object_type === type)) {
+      const seen = new Set;
+      let cursor = row;
+      while (cursor) {
+        if (seen.has(cursor.object_id))
+          fail("Migration hierarchy contains a cycle", 409, row);
+        seen.add(cursor.object_id);
+        cursor = get(type, cursor.payload.parent_id);
+      }
+    }
+  const projects = live.filter((r) => r.object_type === "projects").map((r) => r.payload);
+  const lists = live.filter((r) => r.object_type === "task_lists").map((r) => r.payload);
+  const errors = validateSnapshotRoutingRecords(projects, lists);
+  if (errors.length)
+    fail("Migration project/list routing conflict");
+}
+function createAtomicProjectMigration(options) {
+  if (!/^[a-zA-Z_][a-zA-Z0-9_]*$/.test(options.table))
+    throw new Error("Unsafe migration table");
+  return { async apply(request) {
+    const incoming = validate(request);
+    if (!options.client.transaction)
+      fail("Atomic migration requires a transaction-capable backend", 501);
+    await options.ensureSchema();
+    return options.client.transaction(async (client) => {
+      const deadline = Date.now() + 20000;
+      await client.query("SET LOCAL lock_timeout = '5s'");
+      await client.query("SET LOCAL statement_timeout = '15s'");
+      await client.query("SET LOCAL synchronous_commit = 'on'");
+      const durability = await client.query("SELECT current_setting('fsync') AS fsync,current_setting('full_page_writes') AS full_page_writes,current_setting('synchronous_commit') AS synchronous_commit");
+      const durable = durability.rows[0];
+      if (durable?.fsync !== "on" || durable.full_page_writes !== "on" || durable.synchronous_commit !== "on")
+        fail("Migration database durability settings are not ready", 503);
+      await client.query("SELECT pg_advisory_xact_lock(hashtextextended($1 || ':task-parent-integrity',0))", [options.service]);
+      await client.query(`LOCK TABLE ${options.table} IN SHARE ROW EXCLUSIVE MODE`);
+      const journalId = atomicMigrationHash({ operation_id: request.operation_id });
+      const journal = await client.query(`SELECT payload->>'request_hash' AS request_hash,payload->'receipt' AS receipt FROM ${options.table} WHERE service=$1 AND object_type='atomic_project_migrations' AND object_id=$2`, [options.service, journalId]);
+      const requestHash = atomicMigrationHash(request);
+      if (journal.rows[0]) {
+        if (journal.rows[0].request_hash !== requestHash)
+          fail("Migration operation identity was already used for another request");
+        return journal.rows[0].receipt;
+      }
+      const bounds = await client.query(`SELECT count(*)::text AS records,COALESCE(sum(octet_length(payload::text)),0)::text AS bytes,COALESCE(max(octet_length(payload::text)),0)::text AS largest FROM ${options.table} WHERE service=$1 AND object_type IN ('projects','tasks','plans','task_lists','audit_history')`, [options.service]);
+      const size = bounds.rows[0];
+      if (!size || Number(size.records) > 1e4 || Number(size.bytes) > 16 * 1024 * 1024 || Number(size.largest) > 2 * 1024 * 1024)
+        fail("Atomic migration destination exceeds its bounded row/byte scope", 413);
+      const selected = await client.query(`SELECT object_type,object_id,payload,updated_at,deleted_at,version,source_machine_id FROM ${options.table} WHERE service=$1 AND object_type IN ('projects','tasks','plans','task_lists','audit_history') LIMIT 10001 FOR UPDATE`, [options.service]);
+      if (selected.rows.length > 1e4)
+        fail("Atomic migration destination exceeds bounded 10000-record scope", 413);
+      for (const row of selected.rows) {
+        canonical(row.payload);
+        if (Date.now() > deadline)
+          fail("Migration destination validation exceeded time budget", 503);
+      }
+      const original = new Map(selected.rows.map((r) => [key(r), normalized(r)]));
+      const current = new Map(original);
+      const receipts = [];
+      const receipt = (source, before, after, outcome) => receipts.push({ object_type: source.object_type, object_id: source.object_id, outcome, before_hash: before ? digest(before) : null, after_hash: digest(after), source_hash: digest(source) });
+      for (const row of incoming.filter((r) => !r.deleted_at)) {
+        const before = current.get(key(row));
+        if (before) {
+          if (digest(before) === digest(row)) {
+            receipt(row, before, before, "identical");
+            continue;
+          }
+          if (before.object_type === "tasks" && (before.payload.locked_by || before.payload.runner_id))
+            fail("Active destination task lease requires reconciliation", 409, before);
+          if (row.object_type === "audit_history")
+            fail("Immutable history identity conflict", 409, row);
+          const clock = compare(row, before);
+          if (clock === 0)
+            fail("Ambiguous equal-clock migration conflict", 409, row);
+          if (clock < 0) {
+            receipt(row, before, before, "superseded");
+            continue;
+          }
+          if (before.deleted_at)
+            fail("Migration cannot implicitly resurrect a deleted record", 409, row);
+        }
+        current.set(key(row), row);
+        receipt(row, before, row, before ? "updated" : "inserted");
+      }
+      for (const row of incoming.filter((r) => r.deleted_at)) {
+        const before = current.get(key(row));
+        if (before) {
+          if (digest(before) === digest(row)) {
+            receipt(row, before, before, "identical");
+            continue;
+          }
+          const clock = compare(row, before);
+          if (clock === 0)
+            fail("Ambiguous equal-clock lifecycle conflict", 409, row);
+          if (clock < 0) {
+            receipt(row, before, before, "superseded");
+            continue;
+          }
+        }
+        for (const [id, linked] of current) {
+          if (linked.deleted_at)
+            continue;
+          const field = linked.object_type === "projects" ? "parent_id" : "project_id";
+          if (!["projects", "tasks", "plans", "task_lists"].includes(linked.object_type) || linked.payload[field] !== row.object_id)
+            continue;
+          if (compare(linked, row) > 0)
+            fail("A newer linked record conflicts with the historical project deletion", 409, linked);
+          if (linked.object_type === "tasks" && (linked.payload.locked_by || linked.payload.runner_id))
+            fail("Active linked task lease requires reconciliation", 409, linked);
+          const detached = { ...linked, payload: { ...linked.payload, [field]: null, updated_at: row.updated_at }, updated_at: row.updated_at };
+          if (linked.object_type === "tasks") {
+            detached.version = version(linked.version) + 1;
+            detached.payload.version = detached.version;
+          }
+          current.set(id, detached);
+          receipt(linked, linked, detached, "detached");
+        }
+        current.set(key(row), row);
+        receipt(row, before, row, "deleted");
+      }
+      validateGraph(current);
+      for (const [id, row] of current) {
+        if (Date.now() > deadline)
+          fail("Atomic migration exceeded its transaction time budget", 503);
+        const before = original.get(id);
+        if (before && digest(before) === digest(row))
+          continue;
+        await client.query(`INSERT INTO ${options.table}(service,object_type,object_id,payload,updated_at,deleted_at,version,source_machine_id) VALUES($1,$2,$3,$4::jsonb,$5::timestamptz,$6::timestamptz,$7,$8) ON CONFLICT(service,object_type,object_id) DO UPDATE SET payload=EXCLUDED.payload,updated_at=EXCLUDED.updated_at,deleted_at=EXCLUDED.deleted_at,version=EXCLUDED.version,source_machine_id=EXCLUDED.source_machine_id`, [options.service, row.object_type, row.object_id, row.payload, row.updated_at, row.deleted_at, row.version, row.source_machine_id ?? null]);
+      }
+      const result = { schema_version: 1, operation_id: request.operation_id, snapshot_hash: request.snapshot_hash, authority: request.expected_authority, status: "complete", records: receipts };
+      const changedKeys = new Set(receipts.map((row) => key(row)));
+      const evidence = { request_hash: requestHash, request, receipt: result, before: [...original.values()].filter((row) => changedKeys.has(key(row))) };
+      if (Date.now() > deadline)
+        fail("Atomic migration exceeded its transaction time budget", 503);
+      await client.query(`INSERT INTO ${options.table}(service,object_type,object_id,payload,updated_at) VALUES($1,'atomic_project_migrations',$2,$3::jsonb,now())`, [options.service, journalId, evidence]);
+      return result;
+    });
+  } };
+}
+
 // src/storage/postgres-adapter.ts
 init_types();
-import { randomUUID as randomUUID3 } from "crypto";
+import { randomUUID as randomUUID4 } from "crypto";
 init_creator_identity();
 
 // src/lib/instant-compare.ts
@@ -15269,8 +17180,8 @@ function sqliteJulianDay(value) {
   const ms = Date.UTC(year, month - 1, day, hour, minute, second);
   return (ms + micros / 1000) / 86400000 + 2440587.5 - offsetMinutes / 1440;
 }
-function changedSinceStampNewer(stamp, since) {
-  const stampJd = sqliteJulianDay(stamp);
+function changedSinceStampNewer(stamp2, since) {
+  const stampJd = sqliteJulianDay(stamp2);
   if (stampJd === null)
     return true;
   const sinceJd = sqliteJulianDay(since);
@@ -15504,6 +17415,10 @@ class PostgresTodosSyncStore {
     }
   }
   async pushSnapshot(snapshot, context = {}) {
+    if ((snapshot.tombstones ?? []).some((row) => row.object_type === "machines"))
+      throw new Error("Machine tombstones require explicit registry lifecycle operations");
+    if (snapshot.machines !== undefined)
+      validateMachines(snapshot.machines);
     const routingErrors = validateSnapshotRoutingRecords(snapshot.projects, snapshot.taskLists);
     if (routingErrors.length > 0) {
       throw new Error(`Invalid snapshot routing metadata: ${routingErrors.join("; ")}`);
@@ -15526,6 +17441,14 @@ class PostgresTodosSyncStore {
         throw new ResourceConflictError("SNAPSHOT_DESTINATION_CONFLICT", `Snapshot routing conflicts with destination: ${destinationErrors.join("; ")}`);
       }
       const result = { records: 0, objectTypes: {} };
+      if (snapshot.machines?.length) {
+        if (!this.client.transaction)
+          throw new Error("Machine snapshot migration requires transaction(callback)");
+        const registry = createPostgresMachineRegistry({ query: client.query.bind(client), transaction: (fn) => fn(client) }, this.service, this.tableName, async () => {});
+        const receipt = await registry.execute({ action: "import", machines: snapshot.machines });
+        result.records += receipt.inserted + receipt.skipped;
+        result.objectTypes.machines = receipt.inserted + receipt.skipped;
+      }
       const sourceMachineId = context.requestId ?? this.sourceMachineId ?? null;
       for (const entry of snapshotEntries(snapshot)) {
         if (entry.deletedAt === null)
@@ -15689,6 +17612,7 @@ function rowsToSnapshot(rows) {
     tasks: [],
     projects: [],
     projectMachinePaths: [],
+    machines: [],
     plans: [],
     agents: [],
     taskLists: [],
@@ -15700,6 +17624,12 @@ function rowsToSnapshot(rows) {
   for (const row of rows) {
     const payload = payloadRecord(row.payload);
     const deletedAt = stringValue(row.deleted_at);
+    if (row.object_type === "machines") {
+      if (deletedAt)
+        throw new Error("Snapshot contains retired machine identities; use the authoritative registry instead of silently discarding tombstones");
+      snapshot.machines.push(payload);
+      continue;
+    }
     if (deletedAt) {
       snapshot.tombstones ??= [];
       snapshot.tombstones.push({
@@ -15760,12 +17690,12 @@ init_redaction();
 init_task_parent_integrity();
 
 // src/task-manifest/canonical.ts
-import { createHash as createHash5 } from "crypto";
+import { createHash as createHash6 } from "crypto";
 function canonicalize2(value) {
   if (Array.isArray(value))
     return value.map(canonicalize2);
   if (value !== null && typeof value === "object") {
-    return Object.fromEntries(Object.entries(value).filter(([, entry2]) => entry2 !== undefined).sort(([left], [right]) => left.localeCompare(right)).map(([key, entry2]) => [key, canonicalize2(entry2)]));
+    return Object.fromEntries(Object.entries(value).filter(([, entry2]) => entry2 !== undefined).sort(([left], [right]) => left.localeCompare(right)).map(([key2, entry2]) => [key2, canonicalize2(entry2)]));
   }
   return value;
 }
@@ -15773,10 +17703,10 @@ function canonicalJson(value) {
   return JSON.stringify(canonicalize2(value));
 }
 function canonicalDigest(value) {
-  return createHash5("sha256").update(canonicalJson(value)).digest("hex");
+  return createHash6("sha256").update(canonicalJson(value)).digest("hex");
 }
 function deterministicUuid(namespace, ...parts) {
-  const bytes = createHash5("sha256").update([namespace, ...parts].join("\x1F")).digest().subarray(0, 16);
+  const bytes = createHash6("sha256").update([namespace, ...parts].join("\x1F")).digest().subarray(0, 16);
   bytes[6] = bytes[6] & 15 | 80;
   bytes[8] = bytes[8] & 63 | 128;
   const hex = bytes.toString("hex");
@@ -15836,13 +17766,14 @@ function createPostgresTodosStorageAdapter(options) {
       find: (ref) => findGitRefs(ref, store)
     },
     projects: {
-      create: (input, context) => createProject2(input, store, context),
+      create: (input, context) => store.withDependencyGraphTransaction((scoped) => createProject2(input, scoped, context)),
       get: (id) => store.get("projects", id),
       getByPath: async (path) => (await store.list("projects")).find((project) => project.path === path) ?? null,
       list: async () => (await store.list("projects")).sort((a, b) => a.name.localeCompare(b.name)),
-      update: (id, input) => updateProject2(id, input, store),
+      update: (id, input) => store.withDependencyGraphTransaction((scoped) => updateProject2(id, input, scoped)),
       rename: (id, input, context) => store.renameProject(id, input.new_slug, input.name, context),
-      delete: (id, context) => store.delete("projects", id, context)
+      delete: async (id, context) => (await store.deleteProjectPreserving(id, false, context)).deleted,
+      deletePreserving: (id, force, context, requireCompletedTasks) => store.deleteProjectPreserving(id, force, context, requireCompletedTasks)
     },
     plans: {
       create: (input, context) => createPlan2(input, store, context),
@@ -15851,6 +17782,7 @@ function createPostgresTodosStorageAdapter(options) {
       update: (id, input) => updatePlan2(id, input, store),
       completeAtRevision: (id, expectedUpdatedAt, context) => store.completePlanAtRevision(id, expectedUpdatedAt, context),
       delete: (id, context) => store.deletePlan(id, context),
+      deletePreserving: (id, force, context) => store.deletePlanPreserving(id, force, context),
       addComment: (input, context) => addPlanComment2(input, store, context),
       getComments: async (planId) => {
         const pages = [];
@@ -15875,7 +17807,7 @@ function createPostgresTodosStorageAdapter(options) {
       apply: (input, context) => store.applyPlanProjectLink(input, context),
       rollback: (input, context) => store.rollbackPlanProjectLink(input, context),
       getReceipt: (receiptId) => store.getPlanProjectLinkReceipt(receiptId),
-      getReceiptByIdempotencyKey: (key) => store.getPlanProjectLinkReceiptByIdempotencyKey(key)
+      getReceiptByIdempotencyKey: (key2) => store.getPlanProjectLinkReceiptByIdempotencyKey(key2)
     },
     agents: {
       register: (input, context) => registerAgent2(input, store, context),
@@ -15888,17 +17820,27 @@ function createPostgresTodosStorageAdapter(options) {
     },
     taskLists: {
       create: (input, context) => createTaskList2(input, store, context),
-      get: (id) => store.get("task_lists", id),
-      getBySlug: async (slug, projectId) => (await store.list("task_lists")).find((list) => list.slug === slug && (projectId === undefined || list.project_id === projectId)) ?? null,
-      list: async (projectId) => (await store.list("task_lists")).filter((list) => projectId === undefined || list.project_id === projectId).sort((a, b) => a.name.localeCompare(b.name)),
-      update: (id, input) => updateTaskList2(id, input, store),
-      delete: (id, context) => store.delete("task_lists", id, context)
+      get: async (id) => {
+        const list = await store.get("task_lists", id);
+        return list ? withTaskListStatus(list) : null;
+      },
+      getBySlug: async (slug, projectId) => {
+        const list = (await store.list("task_lists")).find((list2) => list2.slug === slug && (projectId === undefined || list2.project_id === projectId));
+        return list ? withTaskListStatus(list) : null;
+      },
+      list: async (projectId) => (await store.list("task_lists")).map(withTaskListStatus).filter((list) => projectId === undefined || list.project_id === projectId).sort((a, b) => a.name.localeCompare(b.name)),
+      update: (id, input) => store.withDependencyGraphTransaction((scoped) => updateTaskList2(id, input, scoped)).then(withTaskListStatus),
+      delete: async (id, context) => (await store.deleteTaskListPreserving(id, false, context)).deleted,
+      deletePreserving: (id, force, context) => store.deleteTaskListPreserving(id, force, context)
     },
     templates: {
+      updateWithHistory: (id, input) => store.withTemplateTransaction((scoped) => updateTemplate2(id, input, scoped)),
+      history: (id) => store.withTemplateTransaction((scoped) => readTemplateHistory(id, scoped)),
+      initialize: (context) => store.withTemplateTransaction((scoped) => initializeTemplates(scoped, context)),
       create: (input, context) => createTemplate2(input, store, context),
       get: (id) => store.get("templates", id),
       list: async () => (await store.list("templates")).sort((a, b) => a.name.localeCompare(b.name)),
-      update: (id, input) => updateTemplate2(id, input, store),
+      update: (id, input) => store.withTemplateTransaction((scoped) => updateTemplate2(id, input, scoped)),
       delete: (id, context) => deleteTemplate2(id, store, context),
       getWithTasks: async (id) => {
         const template = await store.get("templates", id);
@@ -15932,10 +17874,12 @@ function createPostgresTodosStorageAdapter(options) {
       getTaskHistory: async (taskId) => (await store.list("audit_history")).filter((entry2) => entry2.task_id === taskId).sort((a, b) => a.created_at.localeCompare(b.created_at)),
       getRecentActivity: async (limit = 20) => (await store.list("audit_history")).sort((a, b) => b.created_at.localeCompare(a.created_at)).slice(0, limit)
     },
+    machines: createPostgresMachineRegistry(options.client, options.service ?? "todos", options.tableName ?? DEFAULT_TODOS_POSTGRES_SYNC_TABLE, () => store.ensureSchema()),
+    atomicProjectMigration: createAtomicProjectMigration({ client: options.client, table: options.tableName ?? DEFAULT_TODOS_POSTGRES_SYNC_TABLE, service: options.service ?? "todos", ensureSchema: () => store.ensureSchema() }),
     sync: {
       getTasksChangedSince: (since, filters) => getChangedSince(since, filters, store),
       exportSnapshot: () => exportSnapshot(store),
-      importSnapshot: (snapshot, context) => importSnapshot(snapshot, store, context)
+      importSnapshot: (snapshot, context) => importSnapshot(snapshot, store, context, adapter.machines)
     },
     integrity: {
       report: () => store.integrityReport()
@@ -15952,6 +17896,7 @@ class PostgresJsonRecordStore {
   tableName;
   cursorTableName;
   schemaReady = null;
+  projectIntegrityLocked = false;
   constructor(options) {
     this.options = options;
     this.service = options.service ?? "todos";
@@ -15962,6 +17907,43 @@ class PostgresJsonRecordStore {
   machineId(context) {
     return context?.requestId ?? this.sourceMachineId ?? null;
   }
+  async withDependencyGraphTransaction(fn) {
+    await this.ensureSchema();
+    return this.withTaskParentIntegrityTransaction(async (client) => {
+      const scoped = new PostgresJsonRecordStore({ ...this.options, client });
+      scoped.schemaReady = Promise.resolve();
+      scoped.projectIntegrityLocked = true;
+      return fn(scoped);
+    });
+  }
+  async withTemplateTransaction(fn) {
+    await this.ensureSchema();
+    const transaction = this.options.client.transaction;
+    if (!transaction)
+      throw new Error("TEMPLATE_ATOMICITY_UNAVAILABLE: upgrade the Todos storage backend");
+    return transaction(async (client) => {
+      await client.query("/* todos:template-integrity-lock */ SELECT pg_advisory_xact_lock(hashtextextended($1 || ':template-integrity', 0))", [this.service]);
+      const scoped = new PostgresJsonRecordStore({ ...this.options, client });
+      scoped.schemaReady = Promise.resolve();
+      return fn(scoped);
+    });
+  }
+  async lockTemplate(id) {
+    await this.options.client.query(`/* todos:template-row-lock */ SELECT object_id FROM ${this.tableName} WHERE service = $1 AND object_type = 'templates' AND object_id = $2 AND deleted_at IS NULL FOR UPDATE`, [this.service, id]);
+  }
+  async persistTemplateRevision(template, previousVersion) {
+    const result = await this.options.client.query(`/* todos:template-version-cas */ UPDATE ${this.tableName}
+       SET payload = $3::jsonb,
+           updated_at = GREATEST(clock_timestamp(), COALESCE(updated_at, 'epoch'::timestamptz) + interval '1 microsecond'),
+           version = $5
+       WHERE service = $1 AND object_type = 'templates' AND object_id = $2
+         AND deleted_at IS NULL AND (payload->>'version')::integer = $4
+         AND COALESCE(version, 1) = $4
+       RETURNING payload`, [this.service, template.id, jsonbParam(template), previousVersion, template.version]);
+    if (result.rows.length !== 1)
+      throw new ResourceConflictError("TEMPLATE_VERSION_CONFLICT", "Template revision write was refused; no history was committed");
+    return payloadRecord2(result.rows[0].payload);
+  }
   async ensureSchema() {
     if (!this.schemaReady) {
       this.schemaReady = (async () => {
@@ -16148,6 +18130,8 @@ class PostgresJsonRecordStore {
         return "1=0";
       return `${column} IN (${values.map((v) => p(v)).join(", ")})`;
     };
+    if (filter.include_archived === false)
+      conds.push(`(payload->>'archived_at' IS NULL)`);
     if (filter.ids)
       conds.push(inClause("payload->>'id'", filter.ids));
     if (filter.project_id !== undefined)
@@ -16316,6 +18300,32 @@ class PostgresJsonRecordStore {
         throw new Error("Invalid task-list project scope \u2014 project_id must be null, missing, or a non-empty string");
       }
     }
+    const projectTypes = new Set(["projects", "tasks", "plans", "task_lists"]);
+    const reference = type === "projects" ? value.parent_id : value.project_id;
+    const planReference = value.plan_id;
+    const needsPlanFence = type === "tasks" && typeof planReference === "string" && planReference.length > 0;
+    const listReference = value.task_list_id;
+    const needsListFence = (type === "tasks" || type === "plans") && typeof listReference === "string" && listReference.length > 0;
+    const needsProjectFence = needsListFence || needsPlanFence || type === "projects" || projectTypes.has(type) && typeof reference === "string" && reference.length > 0;
+    if (needsProjectFence && !this.projectIntegrityLocked) {
+      return this.withDependencyGraphTransaction((scoped) => scoped.upsert(type, value, context));
+    }
+    if (needsListFence)
+      await this.assertTaskListMembership(type, value.id, listReference);
+    if (needsPlanFence) {
+      const plan = await this.options.client.query(`SELECT object_id FROM ${this.tableName} WHERE service=$1 AND object_type='plans' AND object_id=$2 AND deleted_at IS NULL FOR KEY SHARE`, [this.service, planReference]);
+      if (!plan.rows.length)
+        throw new PlanNotFoundError(planReference);
+    }
+    if (projectTypes.has(type)) {
+      if (typeof reference === "string" && reference)
+        await this.assertLiveProject(reference);
+      if (type === "projects") {
+        const prior = await this.options.client.query(`SELECT deleted_at FROM ${this.tableName} WHERE service=$1 AND object_type='projects' AND object_id=$2 FOR UPDATE`, [this.service, value.id]);
+        if (prior.rows[0]?.deleted_at)
+          throw new ProjectNotFoundError(value.id);
+      }
+    }
     await this.ensureSchema();
     const updatedAt = stringValue2(value.updated_at) ?? stringValue2(value.created_at) ?? new Date().toISOString();
     let result;
@@ -16397,10 +18407,13 @@ class PostgresJsonRecordStore {
     if (planIds.length === 0 && !parentGuard)
       return this.upsert("tasks", value, context);
     await this.ensureSchema();
-    if (parentGuard && !queryClient) {
+    if (!queryClient) {
       return this.withTaskParentIntegrityTransaction((client2) => this.upsertTaskWithPlanMembershipGuard(value, guardedPlanIds, explicitProject, context, parentGuard, client2));
     }
     const client = queryClient ?? this.options.client;
+    if (value.project_id)
+      await this.assertLiveProject(value.project_id, client);
+    await this.assertTaskListMembership("tasks", value.id, value.task_list_id, client);
     const updatedAt = value.updated_at;
     const targetPlanId = value.plan_id;
     const result = await client.query(`/* todos:task-plan-membership-guard todos:task-parent-integrity-guard */ WITH RECURSIVE
@@ -16535,8 +18548,11 @@ class PostgresJsonRecordStore {
     }
     return payloadRecord2(row.payload);
   }
-  async updatePlanWithProjectLinkGuard(value, context = {}) {
+  async updatePlanWithProjectLinkGuard(value, expectedUpdatedAt, context = {}) {
+    if (!this.projectIntegrityLocked)
+      return this.withDependencyGraphTransaction((scoped) => scoped.updatePlanWithProjectLinkGuard(value, expectedUpdatedAt, context));
     await this.ensureSchema();
+    await this.assertTaskListMembership("plans", value.id, value.task_list_id);
     const result = await this.options.client.query(`/* todos:plan-update-project-link-guard */ WITH locked_plan AS MATERIALIZED (
          SELECT payload FROM ${this.tableName}
          WHERE service = $1 AND object_type = 'plans' AND object_id = $2 AND deleted_at IS NULL
@@ -16555,19 +18571,24 @@ class PostgresJsonRecordStore {
            version = COALESCE(r.version, 0) + 1
          FROM locked_plan
          WHERE r.service = $1 AND r.object_type = 'plans' AND r.object_id = $2 AND r.deleted_at IS NULL
+           AND locked_plan.payload->>'updated_at' = $6
          RETURNING r.payload
        )
        SELECT EXISTS (SELECT 1 FROM locked_plan) AS plan_found,
+              (SELECT payload->>'updated_at' FROM locked_plan) AS current_revision,
               (SELECT payload FROM stored) AS payload`, [
       this.service,
       value.id,
       jsonbParam(value),
       value.updated_at,
-      context.requestId ?? this.sourceMachineId ?? null
+      context.requestId ?? this.sourceMachineId ?? null,
+      expectedUpdatedAt
     ]);
     const row = result.rows[0];
-    if (!row?.plan_found || !row.payload)
+    if (!row?.plan_found)
       throw new PlanNotFoundError(value.id);
+    if (!row.payload)
+      throw new PlanRevisionConflictError(value.id, expectedUpdatedAt, row.current_revision);
     return payloadRecord2(row.payload);
   }
   async completePlanAtRevision(id, expectedUpdatedAt, context = {}) {
@@ -16841,6 +18862,71 @@ class PostgresJsonRecordStore {
       return null;
     return Number(row.counter);
   }
+  async assertTaskListMembership(type, id, target, client = this.options.client) {
+    if (target === undefined || target === null || target === "")
+      return;
+    const prior = await client.query(`SELECT payload->>'task_list_id' AS task_list_id FROM ${this.tableName} WHERE service=$1 AND object_type=$2 AND object_id=$3 AND deleted_at IS NULL`, [this.service, type, id]);
+    if (prior.rows[0]?.task_list_id === target)
+      return;
+    const list = await client.query(`SELECT object_id FROM ${this.tableName} WHERE service=$1 AND object_type='task_lists' AND object_id=$2 AND deleted_at IS NULL FOR KEY SHARE`, [this.service, target]);
+    if (!list.rows.length)
+      throw new TaskListNotFoundError(String(target));
+  }
+  async deleteTaskListPreserving(id, force, context = {}) {
+    await this.ensureSchema();
+    return this.withTaskParentIntegrityTransaction(async (client) => {
+      const receipt = { schema_version: 1, task_list_id: id, deleted: false, detached_task_ids: [], detached_plan_ids: [], detached_tasks: 0, detached_plans: 0 };
+      const target = await client.query(`SELECT object_id,updated_at FROM ${this.tableName} WHERE service=$1 AND object_type='task_lists' AND object_id=$2 AND deleted_at IS NULL FOR UPDATE`, [this.service, id]);
+      if (!target.rows.length)
+        return receipt;
+      const related = await client.query(`SELECT object_type,object_id,updated_at FROM ${this.tableName} WHERE service=$1 AND deleted_at IS NULL AND object_type IN ('tasks','plans') AND payload->>'task_list_id'=$2 ORDER BY object_type,object_id FOR UPDATE`, [this.service, id]);
+      if (related.rows.length && !force)
+        throw new ResourceConflictError("TASK_LIST_NOT_EMPTY", "Task list has linked records; force confirms detaching them without deleting content or history");
+      const timestamp2 = new Date([...target.rows, ...related.rows].reduce((latest, row) => Math.max(latest, Date.parse(String(row.updated_at)) + 1), Date.now())).toISOString();
+      await client.query(`UPDATE ${this.tableName} SET payload=jsonb_set(payload,'{task_list_id}','null'::jsonb)||jsonb_build_object('updated_at',$3::text)||CASE WHEN object_type='tasks' THEN jsonb_build_object('version',COALESCE((payload->>'version')::integer,0)+1) ELSE '{}'::jsonb END,updated_at=$3::timestamptz,version=COALESCE(version,0)+1,source_machine_id=$4 WHERE service=$1 AND deleted_at IS NULL AND object_type IN ('tasks','plans') AND payload->>'task_list_id'=$2`, [this.service, id, timestamp2, this.machineId(context)]);
+      await client.query(`UPDATE ${this.tableName} SET deleted_at=$3::timestamptz,updated_at=$3::timestamptz,version=COALESCE(version,0)+1,source_machine_id=$4 WHERE service=$1 AND object_type='task_lists' AND object_id=$2 AND deleted_at IS NULL`, [this.service, id, timestamp2, this.machineId(context)]);
+      receipt.deleted = true;
+      receipt.detached_task_ids = related.rows.filter((row) => row.object_type === "tasks").map((row) => row.object_id);
+      receipt.detached_plan_ids = related.rows.filter((row) => row.object_type === "plans").map((row) => row.object_id);
+      receipt.detached_tasks = receipt.detached_task_ids.length;
+      receipt.detached_plans = receipt.detached_plan_ids.length;
+      return receipt;
+    });
+  }
+  async assertLiveProject(id, client = this.options.client) {
+    const result = await client.query(`SELECT object_id FROM ${this.tableName} WHERE service=$1 AND object_type='projects' AND object_id=$2 AND deleted_at IS NULL FOR KEY SHARE`, [this.service, id]);
+    if (!result.rows.length)
+      throw new ProjectNotFoundError(id);
+  }
+  async deleteProjectPreserving(id, force, context = {}, requireCompletedTasks = false) {
+    await this.ensureSchema();
+    return this.withTaskParentIntegrityTransaction(async (client) => {
+      const project = await client.query(`SELECT object_id FROM ${this.tableName} WHERE service=$1 AND object_type='projects' AND object_id=$2 AND deleted_at IS NULL FOR UPDATE`, [this.service, id]);
+      const receipt = { schema_version: 1, project_id: id, deleted: false, preserved_tasks: 0, preserved_plans: 0, detached_task_lists: 0, detached_child_projects: 0 };
+      if (!project.rows.length)
+        return receipt;
+      const related = await client.query(`SELECT object_type,object_id,payload->>'status' AS status FROM ${this.tableName} WHERE service=$1 AND deleted_at IS NULL AND ((object_type IN ('tasks','plans','task_lists') AND payload->>'project_id'=$2) OR (object_type='projects' AND payload->>'parent_id'=$2)) FOR UPDATE`, [this.service, id]);
+      if (requireCompletedTasks && related.rows.some((row) => row.object_type === "tasks" && row.status !== "completed" && row.status !== "cancelled"))
+        throw new ResourceConflictError("PROJECT_INCOMPLETE", "Project has incomplete tasks; deregistration refused");
+      if (related.rows.length && !force)
+        throw new ResourceConflictError("PROJECT_NOT_EMPTY", "Project has linked records; force confirms detaching them without deleting their content");
+      const timestamp2 = new Date().toISOString();
+      await client.query(`UPDATE ${this.tableName} SET payload=jsonb_set(jsonb_set(payload,CASE WHEN object_type='projects' THEN '{parent_id}'::text[] ELSE '{project_id}'::text[] END,'null'::jsonb),'{updated_at}',to_jsonb($3::text)) || CASE WHEN object_type='tasks' THEN jsonb_build_object('version',COALESCE((payload->>'version')::integer,0)+1) ELSE '{}'::jsonb END, updated_at=$3::timestamptz, version=CASE WHEN object_type='tasks' THEN COALESCE(version,0)+1 ELSE version END,source_machine_id=$4 WHERE service=$1 AND deleted_at IS NULL AND ((object_type IN ('tasks','plans','task_lists') AND payload->>'project_id'=$2) OR (object_type='projects' AND payload->>'parent_id'=$2))`, [this.service, id, timestamp2, context.requestId ?? this.sourceMachineId ?? null]);
+      await client.query(`UPDATE ${this.tableName} SET deleted_at=$3::timestamptz,updated_at=$3::timestamptz,source_machine_id=$4 WHERE service=$1 AND object_type='projects' AND object_id=$2 AND deleted_at IS NULL`, [this.service, id, timestamp2, context.requestId ?? this.sourceMachineId ?? null]);
+      receipt.deleted = true;
+      for (const row of related.rows) {
+        if (row.object_type === "tasks")
+          receipt.preserved_tasks++;
+        else if (row.object_type === "plans")
+          receipt.preserved_plans++;
+        else if (row.object_type === "task_lists")
+          receipt.detached_task_lists++;
+        else
+          receipt.detached_child_projects++;
+      }
+      return receipt;
+    });
+  }
   async delete(type, id, context = {}) {
     await this.ensureSchema();
     const existing = await this.get(type, id);
@@ -16945,7 +19031,7 @@ class PostgresJsonRecordStore {
     }
     return result.rows[0] ? assertPlanProjectLinkReceipt(result.rows[0].payload) : null;
   }
-  async currentPlanProjectLinkResult(receipt, action) {
+  async currentPlanProjectLinkResult(receipt, action, previouslyCommitted = false) {
     const [plan, project, tasks] = await Promise.all([
       this.get("plans", receipt.plan_id),
       this.get("projects", receipt.project_id),
@@ -16953,11 +19039,14 @@ class PostgresJsonRecordStore {
     ]);
     const sortedTasks2 = tasks.sort((left, right) => left.id.localeCompare(right.id));
     if (!plan || !project || planProjectLinkResultDigest(plan, sortedTasks2) !== receipt.result_digest) {
-      throw new PlanProjectLinkError("PLAN_PROJECT_LINK_RESULT_DRIFT", "The accepted plan-project-link result has drifted", { receipt_id: receipt.receipt_id });
+      throw new PlanProjectLinkError("PLAN_PROJECT_LINK_RESULT_DRIFT", previouslyCommitted ? "The plan-project link was already committed; current state has drifted from its immutable receipt" : "The accepted plan-project-link result has drifted", { receipt_id: receipt.receipt_id, ...previouslyCommitted ? { operation_committed: true, current_state_matches_receipt: false, receipt } : {} });
     }
     return { mode: "apply", action, plan, project, tasks: sortedTasks2, receipt };
   }
   async applyPlanProjectLink(input, context = {}) {
+    if (!this.projectIntegrityLocked) {
+      return this.withDependencyGraphTransaction((scoped) => scoped.applyPlanProjectLink(input, context));
+    }
     await this.ensureSchema();
     const existing = await this.getPlanProjectLinkReceipt(input.receipt_id);
     if (existing) {
@@ -16968,7 +19057,7 @@ class PostgresJsonRecordStore {
       if (rolledBack) {
         throw new PlanProjectLinkError("PLAN_PROJECT_LINK_IDEMPOTENCY_CONFLICT", "The accepted plan-project link has already been rolled back", { receipt_id: input.receipt_id });
       }
-      return this.currentPlanProjectLinkResult(existing, "already_linked");
+      return this.currentPlanProjectLinkResult(existing, "already_linked", true);
     }
     const [plan, project, tasks, scopedPlans] = await Promise.all([
       this.get("plans", input.plan_id),
@@ -17110,7 +19199,7 @@ class PostgresJsonRecordStore {
       if (isPostgresUniqueViolation(error)) {
         const raced = await this.getPlanProjectLinkReceipt(input.receipt_id);
         if (raced && raced.plan_id === input.plan_id && raced.project_id === input.project_id) {
-          return this.currentPlanProjectLinkResult(raced, "already_linked");
+          return this.currentPlanProjectLinkResult(raced, "already_linked", true);
         }
         throw new PlanProjectLinkError("PLAN_PROJECT_LINK_IDEMPOTENCY_CONFLICT", "The idempotency key raced with a different plan-project link", { idempotency_key: input.idempotency_key });
       }
@@ -17133,7 +19222,7 @@ class PostgresJsonRecordStore {
     if (accepted.plan_id !== plan.id || accepted.project_id !== project.id) {
       throw new PlanProjectLinkError("PLAN_PROJECT_LINK_IDEMPOTENCY_CONFLICT", "The idempotency key was accepted for a different target");
     }
-    return this.currentPlanProjectLinkResult(accepted, alreadyLinked ? "already_linked" : "linked");
+    return this.currentPlanProjectLinkResult(accepted, alreadyLinked ? "already_linked" : "linked", row.existing_receipt != null);
   }
   async rollbackPlanProjectLink(input, context = {}) {
     await this.ensureSchema();
@@ -17256,6 +19345,28 @@ class PostgresJsonRecordStore {
       throw new PlanProjectLinkError("PLAN_PROJECT_LINK_ROLLBACK_CONFLICT", "Rollback did not produce an immutable receipt");
     return accepted;
   }
+  async deletePlanPreserving(id, force, context = {}) {
+    await this.ensureSchema();
+    return this.withTaskParentIntegrityTransaction(async (client) => {
+      const receipt = { schema_version: 1, plan_id: id, deleted: false, detached_task_ids: [], detached_task_list_ids: [], detached_tasks: 0, detached_task_lists: 0 };
+      const target = await client.query(`SELECT object_id,payload->>'task_list_id' AS task_list_id FROM ${this.tableName} WHERE service=$1 AND object_type='plans' AND object_id=$2 AND deleted_at IS NULL FOR UPDATE`, [this.service, id]);
+      if (!target.rows.length)
+        return receipt;
+      const related = await client.query(`SELECT object_type,object_id FROM ${this.tableName} WHERE service=$1 AND deleted_at IS NULL AND ((object_type='tasks' AND payload->>'plan_id'=$2) OR (object_type='task_lists' AND object_id=$3)) ORDER BY object_type,object_id FOR UPDATE`, [this.service, id, target.rows[0].task_list_id]);
+      const notes = await client.query(`SELECT object_id FROM ${this.tableName} WHERE service=$1 AND object_type='plan_comments' AND payload->>'plan_id'=$2 AND deleted_at IS NULL LIMIT 1`, [this.service, id]);
+      if ((related.rows.length || notes.rows.length) && !force)
+        throw new ResourceConflictError("PLAN_NOT_EMPTY", "Plan has linked records; force confirms detaching them while preserving content and history");
+      const timestamp2 = new Date().toISOString();
+      await client.query(`UPDATE ${this.tableName} SET payload=jsonb_set(payload,'{plan_id}','null'::jsonb) || jsonb_build_object('updated_at',$3::text) || jsonb_build_object('version',COALESCE((payload->>'version')::integer,0)+1),updated_at=$3::timestamptz,version=COALESCE(version,0)+1,source_machine_id=$4 WHERE service=$1 AND deleted_at IS NULL AND object_type='tasks' AND payload->>'plan_id'=$2`, [this.service, id, timestamp2, this.machineId(context)]);
+      await client.query(`UPDATE ${this.tableName} SET deleted_at=$3::timestamptz,updated_at=$3::timestamptz,version=COALESCE(version,0)+1,source_machine_id=$4 WHERE service=$1 AND object_type='plans' AND object_id=$2 AND deleted_at IS NULL`, [this.service, id, timestamp2, this.machineId(context)]);
+      receipt.deleted = true;
+      receipt.detached_task_ids = related.rows.filter((row) => row.object_type === "tasks").map((row) => row.object_id);
+      receipt.detached_task_list_ids = related.rows.filter((row) => row.object_type === "task_lists").map((row) => row.object_id);
+      receipt.detached_tasks = receipt.detached_task_ids.length;
+      receipt.detached_task_lists = receipt.detached_task_list_ids.length;
+      return receipt;
+    });
+  }
   async deletePlan(id, context = {}) {
     await this.ensureSchema();
     const timestamp2 = new Date().toISOString();
@@ -17302,6 +19413,8 @@ class PostgresJsonRecordStore {
   }
   async tombstone(tombstone, context = {}) {
     await this.ensureSchema();
+    if (tombstone.object_type === "atomic_project_migrations")
+      throw new Error("Migration evidence is immutable");
     const deletedAt = stringValue2(tombstone.deleted_at) ?? new Date().toISOString();
     const updatedAt = stringValue2(tombstone.updated_at) ?? deletedAt;
     const existing = await this.clock(tombstone.object_type, tombstone.object_id);
@@ -17359,7 +19472,7 @@ class PostgresJsonRecordStore {
 }
 async function createTask2(input, store, context) {
   const timestamp2 = new Date().toISOString();
-  const taskId = randomUUID3();
+  const taskId = randomUUID4();
   await assertTaskParentIntegrityAsync(taskId, input.parent_id, (id) => store.get("tasks", id));
   const linkedPlan = input.plan_id ? await store.get("plans", input.plan_id) : null;
   const requestedProjectId = input.project_id ?? context?.projectId ?? null;
@@ -17581,42 +19694,46 @@ function dependencyId(taskId, dependsOn) {
   return `${taskId}::${dependsOn}`;
 }
 async function addDependency2(taskId, dependsOn, store, context) {
-  if (taskId === dependsOn)
-    throw new Error("A task cannot depend on itself");
-  if (!await store.get("tasks", taskId))
-    throw new Error(`Task not found: ${taskId}`);
-  if (!await store.get("tasks", dependsOn))
-    throw new Error(`Task not found: ${dependsOn}`);
-  const edges = await store.list("dependencies");
-  const adjacency = new Map;
-  for (const edge of edges) {
-    if (!adjacency.has(edge.task_id))
-      adjacency.set(edge.task_id, []);
-    adjacency.get(edge.task_id).push(edge.depends_on);
-  }
-  const queue = [dependsOn];
-  const seen = new Set;
-  while (queue.length) {
-    const node = queue.shift();
-    if (node === taskId)
-      throw new Error(`Adding dependency ${taskId} -> ${dependsOn} would create a cycle`);
-    if (seen.has(node))
-      continue;
-    seen.add(node);
-    for (const next of adjacency.get(node) ?? [])
-      queue.push(next);
-  }
-  const timestamp2 = new Date().toISOString();
-  const record = { id: dependencyId(taskId, dependsOn), task_id: taskId, depends_on: dependsOn, created_at: timestamp2, updated_at: timestamp2 };
-  await store.upsert("dependencies", record, context);
-  return { task_id: taskId, depends_on: dependsOn };
+  return store.withDependencyGraphTransaction(async (store2) => {
+    if (taskId === dependsOn)
+      throw new Error("A task cannot depend on itself");
+    if (!await store2.get("tasks", taskId))
+      throw new Error(`Task not found: ${taskId}`);
+    if (!await store2.get("tasks", dependsOn))
+      throw new Error(`Task not found: ${dependsOn}`);
+    const edges = await store2.list("dependencies");
+    const adjacency = new Map;
+    for (const edge of edges) {
+      if (!adjacency.has(edge.task_id))
+        adjacency.set(edge.task_id, []);
+      adjacency.get(edge.task_id).push(edge.depends_on);
+    }
+    const queue = [dependsOn];
+    const seen = new Set;
+    while (queue.length) {
+      const node = queue.shift();
+      if (node === taskId)
+        throw new Error(`Adding dependency ${taskId} -> ${dependsOn} would create a cycle`);
+      if (seen.has(node))
+        continue;
+      seen.add(node);
+      for (const next of adjacency.get(node) ?? [])
+        queue.push(next);
+    }
+    const timestamp2 = new Date().toISOString();
+    const record = { id: dependencyId(taskId, dependsOn), task_id: taskId, depends_on: dependsOn, created_at: timestamp2, updated_at: timestamp2 };
+    await store2.upsert("dependencies", record, context);
+    return { task_id: taskId, depends_on: dependsOn };
+  });
 }
 async function removeDependency2(taskId, dependsOn, store) {
-  const existing = await store.get("dependencies", dependencyId(taskId, dependsOn));
-  if (!existing)
-    return false;
-  await store.delete("dependencies", dependencyId(taskId, dependsOn));
-  return true;
+  return store.withDependencyGraphTransaction(async (store2) => {
+    const existing = await store2.get("dependencies", dependencyId(taskId, dependsOn));
+    if (!existing)
+      return false;
+    await store2.delete("dependencies", dependencyId(taskId, dependsOn));
+    return true;
+  });
 }
 async function listDependencies(taskId, store) {
   const edges = await store.list("dependencies");
@@ -17632,7 +19749,7 @@ async function addVerification(input, store, context) {
     throw new Error(`Task not found: ${input.task_id}`);
   const timestamp2 = new Date().toISOString();
   const verification = {
-    id: randomUUID3(),
+    id: randomUUID4(),
     task_id: input.task_id,
     command: input.command,
     status: input.status ?? "unknown",
@@ -17653,7 +19770,7 @@ async function addCommit(input, store, context) {
     throw new Error(`Task not found: ${input.task_id}`);
   const timestamp2 = new Date().toISOString();
   const commit = {
-    id: randomUUID3(),
+    id: randomUUID4(),
     task_id: input.task_id,
     sha: input.sha,
     message: input.message ?? null,
@@ -17749,7 +19866,7 @@ async function createProject2(input, store, context) {
   if (!derivedSlug || !taskListId)
     throw new Error("Project name and task-list slug must be non-empty");
   const parentId = input.parent_id ?? null;
-  const id = randomUUID3();
+  const id = randomUUID4();
   if (parentId !== null) {
     const parent = await store.get("projects", parentId);
     if (!parent)
@@ -17760,6 +19877,9 @@ async function createProject2(input, store, context) {
     id,
     name: input.name,
     path: input.path,
+    status: input.status ?? "active",
+    short_id: input.short_id ?? null,
+    metadata: input.metadata ?? {},
     description: input.description ?? null,
     task_list_id: taskListId,
     task_prefix: input.task_prefix ?? await generateProjectPrefix(input.name, store),
@@ -17807,6 +19927,9 @@ async function updateProject2(id, input, store) {
   return store.upsert("projects", updated);
 }
 async function createPlan2(input, store, context) {
+  const scheduleError = validatePlanSchedule(input);
+  if (scheduleError)
+    throw new Error(scheduleError);
   const timestamp2 = new Date().toISOString();
   const projectId = input.project_id ?? context?.projectId ?? null;
   const slug = await resolvePostgresPlanSlug({
@@ -17816,7 +19939,7 @@ async function createPlan2(input, store, context) {
     store
   });
   return store.upsert("plans", {
-    id: randomUUID3(),
+    id: randomUUID4(),
     slug,
     project_id: projectId,
     task_list_id: input.task_list_id ?? context?.taskListId ?? null,
@@ -17824,6 +19947,8 @@ async function createPlan2(input, store, context) {
     name: input.name,
     description: input.description ?? null,
     status: input.status ?? "active",
+    ...input.start_date !== undefined ? { start_date: input.start_date } : {},
+    ...input.end_date !== undefined ? { end_date: input.end_date } : {},
     created_at: timestamp2,
     updated_at: timestamp2,
     machine_id: store.machineId(context),
@@ -17832,6 +19957,9 @@ async function createPlan2(input, store, context) {
 }
 async function updatePlan2(id, input, store) {
   const plan = await requireRecord("plans", id, store);
+  const scheduleError = validatePlanSchedule({ ...plan, ...input });
+  if (scheduleError)
+    throw new Error(scheduleError);
   const patch = definedPatch(input);
   if (input.slug !== undefined) {
     patch.slug = await resolvePostgresPlanSlug({
@@ -17846,8 +19974,8 @@ async function updatePlan2(id, input, store) {
     ...plan,
     ...patch,
     project_id: plan.project_id,
-    updated_at: new Date().toISOString()
-  });
+    updated_at: new Date(Math.max(Date.now(), Date.parse(plan.updated_at) + 1)).toISOString()
+  }, plan.updated_at);
 }
 function matchAgentByName(agents, name, options) {
   const target = normalizeAgentNameInput(name);
@@ -17868,7 +19996,7 @@ async function registerAgent2(input, store, context) {
   }
   const timestamp2 = new Date().toISOString();
   const agent = {
-    id: existing?.id ?? randomUUID3().slice(0, 8),
+    id: existing?.id ?? randomUUID4().slice(0, 8),
     name: canonicalName,
     description: input.description ?? existing?.description ?? null,
     role: input.role ?? existing?.role ?? null,
@@ -17935,18 +20063,24 @@ async function releaseAgent2(idOrName, sessionId, store, context) {
   const updated = await store.upsert("agents", { ...agent, session_id: null, last_seen_at: new Date().toISOString() }, context);
   return { agent: updated, released: true };
 }
+function withTaskListStatus(list) {
+  return { ...list, status: list.status ?? "active" };
+}
 async function createTaskList2(input, store, context) {
+  if (input.status !== undefined && !["active", "completed", "archived"].includes(input.status))
+    throw new Error("Invalid task-list status");
   const timestamp2 = new Date().toISOString();
   const slug = slugifyRaw(input.slug === undefined ? input.name : input.slug);
   if (!slug)
     throw new Error("Invalid task-list slug \u2014 must be non-empty kebab-case");
   return store.upsert("task_lists", {
-    id: randomUUID3(),
+    id: randomUUID4(),
     project_id: input.project_id ?? context?.projectId ?? null,
     slug,
     name: input.name,
     description: input.description ?? null,
     metadata: input.metadata ?? {},
+    status: input.status ?? "active",
     created_at: timestamp2,
     updated_at: timestamp2,
     machine_id: store.machineId(context),
@@ -17954,6 +20088,8 @@ async function createTaskList2(input, store, context) {
   }, context);
 }
 async function updateTaskList2(id, input, store) {
+  if (input.status !== undefined && !["active", "completed", "archived"].includes(input.status))
+    throw new Error("Invalid task-list status");
   const list = await requireRecord("task_lists", id, store);
   const patch = definedPatch(input);
   const projectId = input.project_id === "" || input.project_id === null ? null : input.project_id === undefined ? list.project_id : input.project_id;
@@ -17976,13 +20112,13 @@ async function updateTaskList2(id, input, store) {
     ...list,
     ...patch,
     metadata: input.metadata ?? list.metadata,
-    updated_at: new Date().toISOString()
+    updated_at: new Date(Math.max(Date.now(), Date.parse(list.updated_at) + 1)).toISOString()
   });
 }
 async function createTemplate2(input, store, context) {
   const timestamp2 = new Date().toISOString();
   const template = {
-    id: randomUUID3(),
+    id: randomUUID4(),
     name: input.name,
     title_pattern: input.title_pattern,
     description: input.description ?? null,
@@ -18003,7 +20139,7 @@ async function createTemplate2(input, store, context) {
 }
 function buildTemplateTasks(templateId, inputs, timestamp2) {
   return inputs.map((input, position) => ({
-    id: randomUUID3(),
+    id: randomUUID4(),
     template_id: templateId,
     position,
     title_pattern: input.title_pattern,
@@ -18021,22 +20157,107 @@ function buildTemplateTasks(templateId, inputs, timestamp2) {
 async function deleteTemplate2(id, store, context) {
   return store.deleteTemplateWithTasks(id, context);
 }
-async function updateTemplate2(id, input, store) {
+async function templateWithTasks(id, store) {
   const template = await store.get("templates", id);
   if (!template)
     return null;
-  return store.upsert("templates", {
-    ...template,
-    ...definedPatch(input),
-    tags: input.tags ?? template.tags,
-    variables: input.variables ?? template.variables,
-    metadata: input.metadata ?? template.metadata,
-    version: template.version + 1
+  const tasks = (await store.list("template_tasks")).filter((row) => row.template_id === id).sort((a, b) => a.position - b.position || a.id.localeCompare(b.id));
+  return { ...template, tasks };
+}
+async function updateTemplate2(id, input, store) {
+  await store.lockTemplate(id);
+  const current = await templateWithTasks(id, store);
+  if (!current)
+    return null;
+  if (!Number.isSafeInteger(current.version) || current.version < 1 || current.version >= 1e4)
+    throw new Error("Template revision is invalid or exceeds the supported bound");
+  if (input.expected_version !== undefined && input.expected_version !== current.version) {
+    throw new ResourceConflictError("TEMPLATE_VERSION_CONFLICT", "Template changed; fetch its current version before updating");
+  }
+  const {
+    id: _id,
+    version: _version,
+    created_at: _created,
+    machine_id: _machine,
+    synced_at: _synced,
+    ...snapshot
+  } = current;
+  await store.upsert("template_versions", {
+    id: randomUUID4(),
+    template_id: id,
+    version: current.version,
+    snapshot: JSON.stringify(snapshot),
+    created_at: new Date().toISOString()
   });
+  const { tasks, ...template } = current;
+  const { expected_version: _expected, ...patch } = input;
+  const updated = await store.persistTemplateRevision({
+    ...template,
+    ...definedPatch(patch),
+    version: current.version + 1
+  }, current.version);
+  return { ...updated, tasks };
+}
+async function readTemplateHistory(id, store) {
+  await store.lockTemplate(id);
+  const current = await store.get("templates", id);
+  if (!current)
+    return null;
+  if (!Number.isSafeInteger(current.version) || current.version < 1 || current.version > 1e4)
+    throw new Error("Template history exceeds the supported version bound");
+  const versions = (await store.list("template_versions")).filter((row) => row.template_id === id).sort((a, b) => b.version - a.version);
+  const seen = new Set;
+  for (const row of versions) {
+    if (!Number.isSafeInteger(row.version) || row.version < 1 || row.version >= current.version || seen.has(row.version))
+      throw new Error("Template history has conflicting versions");
+    seen.add(row.version);
+  }
+  const missing_versions = Array.from({ length: current.version - 1 }, (_, index) => index + 1).filter((version2) => !seen.has(version2));
+  return {
+    current_version: current.version,
+    versions,
+    selection: {
+      schema_version: 1,
+      template_id: id,
+      complete: missing_versions.length === 0,
+      missing_versions
+    }
+  };
+}
+async function initializeTemplates(store, context) {
+  const existing = await store.list("templates");
+  const records = [];
+  for (const [definition_index, input] of builtinTemplateInputs().entries()) {
+    const matches = existing.filter((row) => row.name === input.name);
+    if (matches.length) {
+      records.push({
+        definition_index,
+        ids: matches.map((row) => row.id).sort(),
+        name: input.name,
+        status: "skipped"
+      });
+    } else {
+      const template = await createTemplate2(input, store, context);
+      records.push({
+        definition_index,
+        ids: [template.id],
+        name: template.name,
+        status: "created"
+      });
+    }
+  }
+  const names = records.filter((row) => row.status === "created").map((row) => row.name);
+  return {
+    schema_version: 1,
+    created: names.length,
+    skipped: records.length - names.length,
+    names,
+    records
+  };
 }
 async function logTaskChange2(taskId, action, field, oldValue, newValue, agentId, store, context) {
   const entry2 = {
-    id: randomUUID3(),
+    id: randomUUID4(),
     task_id: taskId,
     action,
     field: field ?? null,
@@ -18050,7 +20271,7 @@ async function logTaskChange2(taskId, action, field, oldValue, newValue, agentId
 }
 async function addComment2(input, store, context) {
   const comment = {
-    id: randomUUID3(),
+    id: randomUUID4(),
     task_id: input.task_id,
     agent_id: input.agent_id ?? context?.agentId ?? null,
     session_id: input.session_id ?? context?.sessionId ?? null,
@@ -18066,7 +20287,7 @@ function redactComment(comment) {
 }
 async function addPlanComment2(input, store, context) {
   const comment = {
-    id: randomUUID3(),
+    id: randomUUID4(),
     plan_id: input.plan_id,
     agent_id: input.agent_id ?? context?.agentId ?? null,
     session_id: input.session_id ?? context?.sessionId ?? null,
@@ -18084,6 +20305,7 @@ async function exportSnapshot(store) {
   return {
     exportedAt: new Date().toISOString(),
     source: "postgres",
+    machines: await store.list("machines"),
     tasks: await store.list("tasks"),
     projects: await store.list("projects"),
     projectMachinePaths: await store.list("project_machine_paths"),
@@ -18096,8 +20318,27 @@ async function exportSnapshot(store) {
     tombstones: await store.listTombstones()
   };
 }
-async function importSnapshot(snapshot, store, context) {
+async function importSnapshot(snapshot, store, context, machines) {
   const result = { inserted: 0, updated: 0, deleted: 0, skipped: 0, errors: [] };
+  if ((snapshot.tombstones ?? []).some((row) => row.object_type === "atomic_project_migrations")) {
+    result.errors.push("Migration evidence is immutable");
+    return result;
+  }
+  if ((snapshot.tombstones ?? []).some((row) => row.object_type === "machines")) {
+    result.errors.push("Machine tombstones require explicit registry lifecycle operations");
+    return result;
+  }
+  if ((snapshot.tombstones ?? []).some((row) => row.object_type === "projects")) {
+    result.errors.push("Project tombstones require explicit reference-preserving project deletion");
+    return result;
+  }
+  try {
+    if (snapshot.machines !== undefined)
+      validateMachines(snapshot.machines);
+  } catch (e) {
+    result.errors.push(e instanceof Error ? e.message : String(e));
+    return result;
+  }
   result.errors.push(...validateSnapshotRoutingRecords(snapshot.projects, snapshot.taskLists));
   if (result.errors.length > 0)
     return result;
@@ -18108,18 +20349,47 @@ async function importSnapshot(snapshot, store, context) {
   result.errors.push(...validateSnapshotRoutingDestinationConflicts(snapshot.projects, snapshot.taskLists, existingProjects, existingTaskLists));
   if (result.errors.length > 0)
     return result;
+  if (new Set(snapshot.projects.map((project) => project.id)).size !== snapshot.projects.length) {
+    result.errors.push("Snapshot contains duplicate project identities");
+    return result;
+  }
+  const orderedProjects = [];
+  const pendingProjects = new Map(snapshot.projects.map((project) => [project.id, project]));
+  while (pendingProjects.size > 0) {
+    const ready = [...pendingProjects.values()].filter((project) => !project.parent_id || !pendingProjects.has(project.parent_id));
+    if (ready.length === 0) {
+      result.errors.push("Snapshot project hierarchy contains a cycle");
+      return result;
+    }
+    for (const project of ready) {
+      orderedProjects.push(project);
+      pendingProjects.delete(project.id);
+    }
+  }
   const auditHistory = await preflightAuditHistoryImport2(snapshot.auditHistory, snapshot.tombstones ?? [], store);
   result.errors.push(...auditHistory.errors);
   if (result.errors.length > 0)
     return result;
+  if (snapshot.machines?.length) {
+    try {
+      if (!machines)
+        throw new Error("Machine registry import is unavailable");
+      const receipt = await machines.execute({ action: "import", machines: snapshot.machines });
+      result.inserted += receipt.inserted;
+      result.skipped += receipt.skipped;
+    } catch (error) {
+      result.errors.push(error instanceof Error ? error.message : String(error));
+      return result;
+    }
+  }
   result.skipped += auditHistory.identical;
   const entries = [
-    ...snapshot.tasks.map((row) => ["tasks", row]),
-    ...snapshot.projects.map((row) => ["projects", row]),
+    ...orderedProjects.map((row) => ["projects", row]),
     ...(snapshot.projectMachinePaths ?? []).map((row) => ["project_machine_paths", row]),
-    ...snapshot.plans.map((row) => ["plans", row]),
     ...snapshot.agents.map((row) => ["agents", row]),
     ...snapshot.taskLists.map((row) => ["task_lists", row]),
+    ...snapshot.plans.map((row) => ["plans", row]),
+    ...snapshot.tasks.map((row) => ["tasks", row]),
     ...snapshot.templates.map((row) => ["templates", row]),
     ...(snapshot.templateTasks ?? []).map((row) => ["template_tasks", row])
   ];
@@ -18306,7 +20576,7 @@ async function retryOnTransientPostgresError(fn, attempts = 2, delayMs = 150) {
       lastError = error;
       if (!isTransientPostgresError(error) || attempt === attempts)
         throw error;
-      await new Promise((resolve9) => setTimeout(resolve9, delayMs * attempt));
+      await new Promise((resolve10) => setTimeout(resolve10, delayMs * attempt));
     }
   }
   throw lastError;
@@ -18373,7 +20643,7 @@ class TodosShadowMirror {
       lastError: this.metrics.lastError
     };
   }
-  enqueueUpsert(key, record, context) {
+  enqueueUpsert(key2, record, context) {
     if (!record || typeof record !== "object")
       return;
     const payload = record;
@@ -18382,7 +20652,7 @@ class TodosShadowMirror {
     this.metrics.enqueued += 1;
     this.queue.push({
       kind: "upsert",
-      key,
+      key: key2,
       record: payload,
       ...context ? { context } : {},
       enqueuedAt: Date.now(),
@@ -18407,8 +20677,8 @@ class TodosShadowMirror {
   async flush() {
     if (this.idle())
       return;
-    await new Promise((resolve9) => {
-      this.idleResolvers.push(resolve9);
+    await new Promise((resolve10) => {
+      this.idleResolvers.push(resolve10);
       this.pump();
     });
   }
@@ -18420,8 +20690,8 @@ class TodosShadowMirror {
       return;
     const resolvers = this.idleResolvers;
     this.idleResolvers = [];
-    for (const resolve9 of resolvers)
-      resolve9();
+    for (const resolve10 of resolvers)
+      resolve10();
   }
   pump() {
     if (this.pumping)
@@ -18759,8 +21029,8 @@ function createTodosCloudQueryClient(url, options = {}) {
   };
   return client;
 }
-function createTodosCloudQueryClientFromEnv(env = process.env, options = {}) {
-  const url = getTodosStorageDatabaseUrl(env);
+function createTodosCloudQueryClientFromEnv(env2 = process.env, options = {}) {
+  const url = getTodosStorageDatabaseUrl(env2);
   if (!url)
     return null;
   return createTodosCloudQueryClient(url, options);
@@ -18900,7 +21170,7 @@ class TodosShadowOutbox {
         const remaining = deadline - Date.now();
         if (remaining <= 0)
           break;
-        await new Promise((resolve9) => setTimeout(resolve9, Math.min(200, remaining)));
+        await new Promise((resolve10) => setTimeout(resolve10, Math.min(200, remaining)));
       }
     }
     return this.getStats();
@@ -19078,8 +21348,8 @@ var _capturedDb = null;
 var _outbox = null;
 var _cloud = null;
 var _exitRegistered = false;
-function maybeInstallShadowCapture2(db, env = process.env) {
-  if (!isTodosShadowEnabled(env))
+function maybeInstallShadowCapture2(db, env2 = process.env) {
+  if (!isTodosShadowEnabled(env2))
     return false;
   if (_capturedDb === db)
     return true;
@@ -19087,15 +21357,15 @@ function maybeInstallShadowCapture2(db, env = process.env) {
   _capturedDb = db;
   return true;
 }
-function getRuntimeShadowOutbox(db, env = process.env) {
-  if (!isTodosShadowEnabled(env)) {
-    throw new Error(`dual-write shadow is disabled: set ${getTodosStorageShadowEnvName(env)}=1 to enable it`);
+function getRuntimeShadowOutbox(db, env2 = process.env) {
+  if (!isTodosShadowEnabled(env2)) {
+    throw new Error(`dual-write shadow is disabled: set ${getTodosStorageShadowEnvName(env2)}=1 to enable it`);
   }
   if (_outbox && _capturedDb === db)
     return _outbox;
-  const cloud = createTodosCloudQueryClientFromEnv(env);
+  const cloud = createTodosCloudQueryClientFromEnv(env2);
   if (!cloud) {
-    throw new Error(`dual-write shadow drain requires a remote Postgres DSN in ${getTodosStorageDatabaseEnv(env)}`);
+    throw new Error(`dual-write shadow drain requires a remote Postgres DSN in ${getTodosStorageDatabaseEnv(env2)}`);
   }
   _cloud = cloud;
   installShadowOutboxSchema(db);
@@ -19103,28 +21373,28 @@ function getRuntimeShadowOutbox(db, env = process.env) {
   _outbox = new TodosShadowOutbox({ db, postgresClient: cloud });
   return _outbox;
 }
-function startRuntimeShadowDrain(db, env = process.env) {
-  if (!isTodosShadowEnabled(env))
+function startRuntimeShadowDrain(db, env2 = process.env) {
+  if (!isTodosShadowEnabled(env2))
     return;
-  maybeInstallShadowCapture2(db, env);
+  maybeInstallShadowCapture2(db, env2);
   try {
-    const outbox = getRuntimeShadowOutbox(db, env);
+    const outbox = getRuntimeShadowOutbox(db, env2);
     outbox.startLoop();
-    registerShadowExitFlush(db, env);
+    registerShadowExitFlush(db, env2);
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error);
     console.error(`[todos] shadow drain not started: ${message}`);
   }
 }
-function registerShadowExitFlush(db, env = process.env) {
+function registerShadowExitFlush(db, env2 = process.env) {
   if (_exitRegistered)
     return;
-  if (!isTodosShadowEnabled(env))
+  if (!isTodosShadowEnabled(env2))
     return;
   _exitRegistered = true;
   const flush = async () => {
     try {
-      const outbox = getRuntimeShadowOutbox(db, env);
+      const outbox = getRuntimeShadowOutbox(db, env2);
       await outbox.flush(5000);
     } catch {} finally {
       await closeRuntimeShadowCloud();
@@ -19282,7 +21552,7 @@ function isCommentRedactionBackfillComplete(result) {
   return !result.dry_run && result.conflicts === 0 && result.remaining_candidates === 0;
 }
 // src/storage/s3-artifacts.ts
-import { createHash as createHash6, createHmac as createHmac2 } from "crypto";
+import { createHash as createHash7, createHmac as createHmac2 } from "crypto";
 function createTodosS3ArtifactStore(options) {
   const requestFetch = options.fetch ?? fetch;
   const now3 = options.now ?? (() => new Date);
@@ -19290,8 +21560,8 @@ function createTodosS3ArtifactStore(options) {
     objectKey: (relativePath) => buildS3ObjectKey(options.config, relativePath),
     objectUrl: (relativePath) => buildS3ObjectUrl(options.config, buildS3ObjectKey(options.config, relativePath)),
     async putObject(input) {
-      const key = buildS3ObjectKey(options.config, input.key);
-      const url = buildS3ObjectUrl(options.config, key);
+      const key2 = buildS3ObjectKey(options.config, input.key);
+      const url = buildS3ObjectUrl(options.config, key2);
       const body = normalizeBody(input.body);
       const headers = {
         "content-type": input.contentType ?? "application/octet-stream"
@@ -19314,7 +21584,7 @@ function createTodosS3ArtifactStore(options) {
         throw new Error(`S3 put failed with HTTP ${response.status}`);
       return {
         bucket: options.config.bucket,
-        key,
+        key: key2,
         url: url.toString(),
         etag: response.headers.get("etag") ?? undefined
       };
@@ -19354,11 +21624,11 @@ function createTodosS3ArtifactStore(options) {
 }
 function buildS3ObjectKey(config, relativePath) {
   const prefix = normalizeS3Prefix(config.prefix);
-  const key = normalizeS3Key(relativePath);
-  return `${prefix}${key}`;
+  const key2 = normalizeS3Key(relativePath);
+  return `${prefix}${key2}`;
 }
-function buildS3ObjectUrl(config, key) {
-  const encodedKey = encodeS3Path(key);
+function buildS3ObjectUrl(config, key2) {
+  const encodedKey = encodeS3Path(key2);
   if (config.endpoint || config.forcePathStyle) {
     const base = new URL(config.endpoint ?? `https://s3.${config.region ?? "us-east-1"}.amazonaws.com`);
     base.pathname = `${trimTrailingSlash(base.pathname)}/${encodeURIComponent(config.bucket)}/${encodedKey}`;
@@ -19422,25 +21692,25 @@ function normalizeBody(body) {
   throw new Error("S3 body must be a string, Uint8Array, Buffer, or ArrayBuffer");
 }
 function normalizeS3Prefix(value) {
-  const normalized = value.replace(/\\/g, "/").replace(/^\/+/, "");
-  if (!normalized || normalized.includes(".."))
+  const normalized2 = value.replace(/\\/g, "/").replace(/^\/+/, "");
+  if (!normalized2 || normalized2.includes(".."))
     throw new Error("Invalid S3 object key");
-  return normalized.endsWith("/") ? normalized : `${normalized}/`;
+  return normalized2.endsWith("/") ? normalized2 : `${normalized2}/`;
 }
 function normalizeS3Key(value) {
-  const normalized = value.replace(/\\/g, "/").replace(/^\/+/, "");
-  if (!normalized || normalized.includes("..") || normalized.endsWith("/"))
+  const normalized2 = value.replace(/\\/g, "/").replace(/^\/+/, "");
+  if (!normalized2 || normalized2.includes("..") || normalized2.endsWith("/"))
     throw new Error("Invalid S3 object key");
-  return normalized;
+  return normalized2;
 }
-function encodeS3Path(key) {
-  return key.split("/").filter(Boolean).map((part) => encodeURIComponent(part)).join("/");
+function encodeS3Path(key2) {
+  return key2.split("/").filter(Boolean).map((part) => encodeURIComponent(part)).join("/");
 }
 function trimTrailingSlash(value) {
   return value.replace(/\/+$/, "");
 }
 function canonicalQuery(url) {
-  return [...url.searchParams.entries()].sort(([a], [b]) => a.localeCompare(b)).map(([key, value]) => `${encodeURIComponent(key)}=${encodeURIComponent(value)}`).join("&");
+  return [...url.searchParams.entries()].sort(([a], [b]) => a.localeCompare(b)).map(([key2, value]) => `${encodeURIComponent(key2)}=${encodeURIComponent(value)}`).join("&");
 }
 function normalizeHeaders(headers) {
   const entries = Object.entries(headers).map(([name, value]) => [
@@ -19454,13 +21724,13 @@ function toAmzDate(date) {
   return date.toISOString().replace(/[:-]|\.\d{3}/g, "");
 }
 function sha256Hex(value) {
-  return createHash6("sha256").update(value).digest("hex");
+  return createHash7("sha256").update(value).digest("hex");
 }
-function hmac(key, value) {
-  return createHmac2("sha256", key).update(value).digest();
+function hmac(key2, value) {
+  return createHmac2("sha256", key2).update(value).digest();
 }
-function hmacHex(key, value) {
-  return createHmac2("sha256", key).update(value).digest("hex");
+function hmacHex(key2, value) {
+  return createHmac2("sha256", key2).update(value).digest("hex");
 }
 function getSigningKey(secretAccessKey, dateStamp, region, service) {
   const dateKey = hmac(`AWS4${secretAccessKey}`, dateStamp);
@@ -19494,7 +21764,7 @@ async function uploadRunArtifactsToS3(options) {
         continue;
       }
       const ref = await options.store.putObject({
-        key: content.relative_path,
+        key: remoteArtifactKey(artifact.task_id, content.sha256),
         body: Buffer.from(content.base64, "base64"),
         contentType: mediaType(metadata) ?? "application/octet-stream",
         metadata: {
@@ -19508,7 +21778,8 @@ async function uploadRunArtifactsToS3(options) {
         provider: "s3",
         bucket: ref.bucket,
         key: ref.key,
-        relative_path: content.relative_path,
+        relative_path: remoteArtifactKey(artifact.task_id, content.sha256),
+        local_path: content.relative_path,
         url: ref.url,
         sha256: content.sha256,
         size_bytes: content.size_bytes,
@@ -19612,7 +21883,7 @@ async function downloadRunArtifactsFromS3(options) {
       const bytes = Buffer.from(await response.arrayBuffer());
       const report = importStoredArtifactContent({
         artifact_id: artifact.id,
-        relative_path: remote.relative_path,
+        relative_path: remote.local_path ?? remote.relative_path,
         sha256: remote.sha256,
         size_bytes: remote.size_bytes,
         base64: bytes.toString("base64")
@@ -19644,6 +21915,12 @@ async function downloadRunArtifactsFromS3(options) {
 function emptyResult() {
   return { uploaded: 0, downloaded: 0, skipped: 0, errors: [], artifacts: [] };
 }
+function remoteArtifactKey(taskId, sha2562) {
+  if (!/^[0-9a-f]{64}$/.test(sha2562)) {
+    throw new Error("run artifact digest must be a lowercase hex sha-256; refusing to build an object key from it");
+  }
+  return `artifacts/${taskId}/${sha2562}`;
+}
 function planArtifact(artifact, status, remote) {
   return {
     id: artifact.id,
@@ -19707,10 +21984,106 @@ function mediaType(metadata) {
   const value = store["media_type"];
   return typeof value === "string" ? value : null;
 }
+// src/storage/run-artifact-creation-upload.ts
+init_database();
+init_artifact_store();
+init_config();
+async function uploadRunArtifactAtCreation(input) {
+  const db = input.db ?? getDatabase();
+  const now3 = input.now ?? (() => new Date);
+  try {
+    const artifact = getRunArtifactById(db, input.artifactId);
+    if (!artifact)
+      return { uploaded: false, reason: "artifact_not_found" };
+    const metadata = artifact.metadata;
+    const existing = remoteRef(metadata);
+    if (existing)
+      return { uploaded: true, reason: "already_remote", ref: existing };
+    if (!input.store) {
+      const config = loadTodosStorageConfig(input.env ?? process.env);
+      if (!config.objectStorage)
+        return { uploaded: false, reason: "s3_not_configured" };
+      const credentials = creationCredentialsFromEnv(input.env ?? process.env);
+      if (!credentials)
+        return { uploaded: false, reason: "s3_credentials_missing" };
+      input.store = createTodosS3ArtifactStore({ config: config.objectStorage, credentials });
+    }
+    const store = input.store;
+    const content = exportStoredArtifactContent({
+      id: artifact.id,
+      path: artifact.path,
+      size_bytes: artifact.size_bytes,
+      sha256: artifact.sha256,
+      metadata
+    });
+    if (!content)
+      return { uploaded: false, reason: "no_local_content" };
+    const relativePath = remoteArtifactKey(artifact.task_id, content.sha256);
+    const ref = await store.putObject({
+      key: relativePath,
+      body: Buffer.from(content.base64, "base64"),
+      contentType: mediaType2(metadata) ?? "application/octet-stream",
+      metadata: {
+        artifact_id: artifact.id,
+        run_id: artifact.run_id,
+        task_id: artifact.task_id,
+        sha256: content.sha256
+      }
+    });
+    const remote = {
+      provider: "s3",
+      bucket: ref.bucket,
+      key: ref.key,
+      relative_path: relativePath,
+      local_path: content.relative_path,
+      url: ref.url,
+      sha256: content.sha256,
+      size_bytes: content.size_bytes,
+      uploaded_at: now3().toISOString()
+    };
+    updateArtifactMetadata(db, artifact.id, {
+      ...metadata,
+      remote_artifact_store: remote
+    });
+    return { uploaded: true, reason: "uploaded", ref: remote };
+  } catch (error) {
+    return {
+      uploaded: false,
+      reason: "upload_error",
+      error: error instanceof Error ? error.message : String(error)
+    };
+  }
+}
+function creationCredentialsFromEnv(env2) {
+  const accessKeyId = readCredentialEnv(env2, "s3AccessKeyId");
+  const secretAccessKey = readCredentialEnv(env2, "s3SecretAccessKey");
+  if (!accessKeyId || !secretAccessKey)
+    return null;
+  const sessionToken = readCredentialEnv(env2, "s3SessionToken");
+  return sessionToken ? { accessKeyId, secretAccessKey, sessionToken } : { accessKeyId, secretAccessKey };
+}
+function readCredentialEnv(env2, key2) {
+  const value = env2[TODOS_STORAGE_ENV[key2]] ?? env2[TODOS_STORAGE_FALLBACK_ENV[key2]];
+  const trimmed = value?.trim();
+  return trimmed ? trimmed : undefined;
+}
+function getRunArtifactById(db, id) {
+  const row = db.query("SELECT * FROM task_run_artifacts WHERE id = ?").get(id);
+  return row ? { ...row, metadata: parseMetadata2(row.metadata) } : null;
+}
+function mediaType2(metadata) {
+  const store = metadata["artifact_store"];
+  if (!store || typeof store !== "object" || Array.isArray(store))
+    return null;
+  const value = store["media_type"];
+  return typeof value === "string" ? value : null;
+}
 export {
   uploadRunArtifactsToS3,
+  uploadRunArtifactAtCreation,
   startRuntimeShadowDrain,
   signAwsV4Request,
+  remoteArtifactKey,
   registerShadowExitFlush,
   postgresTodosSyncSchemaSql,
   postgresTodosScopedSlugUniqueIndexSql,