@mu-crew/mu 3.8.1 → 3.10.0

package/dist/index.d.ts

@@ -84,6 +84,12 @@ interface HasNextSteps {
     errorNextSteps(): NextStep[];
 }
 
+/**
+ * Resolve the canonical mu state directory:
+ *   MU_STATE_DIR > $XDG_STATE_HOME/mu (absolute only) > ~/.local/state/mu
+ */
+declare function defaultStateDir(): string;
+
 type Db = Database;
 interface OpenDbOptions {
     /**
@@ -98,11 +104,6 @@ interface OpenDbOptions {
      */
     readonly?: boolean;
 }
-/**
- * Resolve the canonical mu state directory:
- *   MU_STATE_DIR > $XDG_STATE_HOME/mu > ~/.local/state/mu
- */
-declare function defaultStateDir(): string;
 /**
  * Resolve the canonical DB path:
  *   MU_DB_PATH > <state-dir>/mu.db
@@ -110,10 +111,17 @@ declare function defaultStateDir(): string;
 declare function defaultDbPath(): string;
 /**
  * Open the mu database. Creates the parent directory and applies the schema
- * idempotently on every open. Safe to call from many short-lived processes
+ * idempotently when it is missing or differs from this build (an
+ * up-to-date DB opens without a write). Safe to call from many short-lived processes
  * concurrently — WAL mode handles cross-process writes.
  */
 declare function openDb(options?: OpenDbOptions): Db;
+declare class WorkstreamNotFoundError extends Error implements HasNextSteps {
+    readonly workstream: string;
+    readonly name = "WorkstreamNotFoundError";
+    constructor(workstream: string);
+    errorNextSteps(): NextStep[];
+}
 /**
  * Thrown by openDb when the on-disk DB is older than the current
  * schema. There is no in-place migration ladder; the old DB is left
@@ -126,6 +134,17 @@ declare class SchemaTooOldError extends Error implements HasNextSteps {
     constructor(detectedVersion: number, requiredVersion: number);
     errorNextSteps(): NextStep[];
 }
+/**
+ * Thrown by openDb when the on-disk DB was written by a NEWER mu.
+ * The DB is left untouched. Maps to exit code 4 (conflict).
+ */
+declare class SchemaTooNewError extends Error implements HasNextSteps {
+    readonly detectedVersion: number;
+    readonly supportedVersion: number;
+    readonly name = "SchemaTooNewError";
+    constructor(detectedVersion: number, supportedVersion: number);
+    errorNextSteps(): NextStep[];
+}
 /** The schema version a fresh DB starts at. v11 adds tasks.substate
  *  and the task_substates lookup table on top of v10's three-state
  *  lifecycle (OPEN, IN_PROGRESS, CLOSED). See CHANGELOG.md. */
@@ -133,13 +152,14 @@ declare const CURRENT_SCHEMA_VERSION = 11;
 /** Tables a healthy DB must contain. Single source of truth so
  *  `mu doctor` and any other consumer don't drift. Adding a new table
  *  = one new entry here AND a CREATE TABLE in CURRENT_SCHEMA, plus a
- *  CURRENT_SCHEMA_VERSION bump. Sorted; exactly 11 entries in v11. */
+ *  CURRENT_SCHEMA_VERSION bump (sync_fingerprints went in without one:
+ *  additive, and an older mu ignores it). Sorted; exactly 12 entries. */
 declare const EXPECTED_TABLES: readonly string[];
 /** Op entities that cross machines. Everything else is machine-local.
  *  Readonly tuple (not `string[]`) so `SyncedEntity` is a real union
  *  and downstream code gets compile-time checking, not raw strings. */
 declare const SYNCED_ENTITIES: readonly ["workstream", "task", "edge", "note", "message"];
-/** One of the six op entities that sync. Derived from the tuple, so
+/** One of the op entities that sync. Derived from the tuple, so
  *  adding an entity is a one-line change with no type to keep in step. */
 type SyncedEntity = (typeof SYNCED_ENTITIES)[number];
 /** Op entities this build KNOWS are machine-local: their payloads name
@@ -177,6 +197,7 @@ type PortableTable = (typeof PORTABLE_TABLES)[number];
  *    machine_identity IS the per-machine identity.
  *    schema_version   local bookkeeping.
  *    sync_peers       local bookkeeping (per-peer watermarks).
+ *    sync_fingerprints local cache of what the last clean ingest saw.
  *    task_substates   seeded identically on every machine from
  *                     TASK_SUBSTATE_ROWS; code, not data.
  *    ops              see below — the carrier, not cargo.
@@ -193,7 +214,7 @@ type PortableTable = (typeof PORTABLE_TABLES)[number];
  *  is an FK into `agents`, and `agents` is machine-local. Therefore
  *  OWNERSHIP DOES NOT SYNC. The deleted db-sync.ts reached the same
  *  conclusion via an `includeOwners` flag; here it is structural. */
-declare const MACHINE_LOCAL_TABLES: readonly ["agents", "machine_identity", "ops", "schema_version", "sync_peers", "task_substates", "vcs_workspaces"];
+declare const MACHINE_LOCAL_TABLES: readonly ["agents", "machine_identity", "ops", "schema_version", "sync_fingerprints", "sync_peers", "task_substates", "vcs_workspaces"];
 type MachineLocalTable = (typeof MACHINE_LOCAL_TABLES)[number];
 
 /** The multiplexers mu can drive. */
@@ -466,9 +487,9 @@ interface MuxBackend {
     enableMuPaneBordersForSession(session: string): Promise<number>;
     enableMuPaneBordersForPane(paneId: string): Promise<void>;
     /** Copy-pasteable shell line that lands the user on `target`. */
-    attachHint(target: AttachTarget): string;
+    attachHint(target: AttachTarget): string | Promise<string>;
     /** The same attach, as argv steps to spawn in order. */
-    attachCommands(target: AttachTarget): readonly MuxCommand[];
+    attachCommands(target: AttachTarget): readonly MuxCommand[] | Promise<readonly MuxCommand[]>;
     /** Backend-specific `PaneNotFoundError` remediation. */
     paneNotFoundNextSteps(paneId: string): NextStep[];
     /** Version + ambient facts for `mu doctor`. Never throws: an
@@ -632,11 +653,12 @@ declare class HerdrWorkspaceGroupCloseError extends Error {
     constructor(session: string, workspaceId: string, detail: string);
     errorNextSteps(): NextStep[];
 }
-/** A `MuxBackend` method whose herdr implementation is owned by another
- *  task. Never thrown on any path mu currently drives on herdr. */
+/** A creation verb was handed a command to run. herdr cannot do that
+ *  in one step (see `rejectCommand`), so this is a bug in the caller:
+ *  spawn passes no command on herdr and calls `startAgentInPane`. */
 declare class HerdrNotImplementedError extends Error {
     readonly name = "HerdrNotImplementedError";
-    constructor(method: string, owner: string);
+    constructor(method: string);
 }
 interface HerdrExecResult {
     stdout: string;
@@ -762,7 +784,8 @@ declare function newSessionWithPane(name: string, opts: NewSessionWithPaneOption
  * Four swallowed shapes:
  *   - "can't find session: <name>"  — session never existed.
  *   - "session not found"           — alternate phrasing on some tmux builds.
- *   - "no server running on <path>" — the tmux server itself has exited
+ *   - "no server running on <path>" (or "error connecting to <path> (No
+ *     such file or directory)", see NO_SERVER_RE) — the tmux server itself has exited
  *     (typical when the test suite runs against a private `tmux -L
  *     <socket>` server and the just-killed session was its last; tmux
  *     quietly shuts the server down). Without this, killSession would
@@ -922,7 +945,10 @@ declare function defaultSendReadinessMs(): number;
 declare function hasWorkMarker(scrollback: string): boolean;
 /**
  * Block until the pane is ready to ACCEPT input, or the budget expires.
- * Returns true if the pane quiesced, false on timeout.
+ * Returns true if the pane quiesced, false on timeout. Throws the
+ * capture's TmuxError at once when the pane or the server is gone:
+ * a dead pane never quiesces, so polling it would only burn the whole
+ * budget before the send fails anyway.
  *
  * WHY THIS EXISTS (dogfood_send_after_new_dropped, reproduced 3/6 at
  * sleep=0.3s and 1/5 at sleep=2s against a real pi pane):
@@ -999,7 +1025,12 @@ declare function sendToPane(paneId: string, text: string, opts?: SendOptions): P
  *
  * - No options: full scrollback (`-S - -E -`)
  * - `lines: 0`: visible pane only
- * - `lines: N`: last N lines (`-S -N`)
+ * - `lines: N`: last N lines, ending at the last non-blank row
+ *
+ * `-S -N` counts from the TOP of the visible screen, so tmux returns the
+ * N rows above the screen plus every visible row, blank rows below the
+ * cursor included. That range always holds the last N non-blank-ended
+ * lines, so drop the trailing blank rows and keep the last N.
  */
 declare function capturePane(paneId: string, opts?: CaptureOptions): Promise<string>;
 declare function attachHint(target: AttachTarget): string;
@@ -1011,12 +1042,18 @@ declare function paneNotFoundNextSteps(paneId: string): NextStep[];
  * reporting different env vars needs no doctor change.
  */
 declare function healthCheck(): Promise<MuxHealth>;
+/** `MuxBackend` with tmux's synchronous attach methods: SDK callers of
+ *  `tmuxBackend.attachHint()` keep getting a string, not a Promise. */
+interface TmuxBackend extends MuxBackend {
+    attachHint(target: AttachTarget): string;
+    attachCommands(target: AttachTarget): readonly MuxCommand[];
+}
 /**
  * The tmux implementation of `MuxBackend`. A frozen record of the
  * module's functions — no state of its own, so swapping backends is a
  * pointer assignment (see ./detect.ts).
  */
-declare const tmuxBackend: MuxBackend;
+declare const tmuxBackend: TmuxBackend;
 
 type mux_AttachTarget = AttachTarget;
 type mux_CaptureOptions = CaptureOptions;
@@ -1075,17 +1112,14 @@ declare namespace mux {
  *   "full"        Default for `mu state` and `mu agent list`. Prunes
  *                 ghosts (deleting the registry row, which fires the
  *                 deleteAgent reaper that flips IN_PROGRESS tasks back
- *                 to OPEN with [reaper] notes), runs status detection
- *                 against surviving panes, surfaces orphans.
+ *                 to OPEN with [reaper] notes), refreshes pane titles
+ *                 of surviving agents, surfaces orphans.
  *
  *   "report-only" Pure observation. Counts would-be-pruned ghosts
- *                 without deleting; skips status detection entirely
- *                 (no DB writes, no tmux title writes); surfaces
- *                 orphans (pure read). Used by `mu undo` (the
- *                 post-restore pass MUST NOT delete rows the snapshot
- *                 just restored — see
- *                 snap_undo_reconcile_destroys_recovered_agents) and
- *                 `mu doctor` (read-only diagnostic).
+ *                 without deleting; skips the title refresh (no DB
+ *                 writes, no tmux title writes); surfaces orphans
+ *                 (pure read). Used by `mu doctor` (read-only
+ *                 diagnostic).
  *
  * Mid-spawn placeholders are protected directly in the prune loop, so read
  * paths no longer need a separate mode just to avoid racing spawn's workspace
@@ -1175,6 +1209,14 @@ interface RebaseResult {
      *  resolveGitMainRef() symbolic ref; for jj/sl it's the literal
      *  `trunk()` revset (or whatever the operator passed via fromRef). */
     fromRef: string;
+    /** Concrete commit id of the workspace's new fork point: fromRef's
+     *  commit, or the previous fork point when that already descends from
+     *  it (parent_ref never moves backward). The caller writes it to
+     *  `vcs_workspaces.parent_ref` so staleness, `mu workspace commits`
+     *  and the close-time clean check measure from the new base. Omitted
+     *  when the backend cannot resolve a single commit (e.g. a jj revset
+     *  naming several); the caller then keeps the old value. */
+    parentRef?: string;
     /** Commit subjects (or descriptions) that got replayed, oldest-first.
      *  Empty when the workspace was already at fromRef (no-op). */
     replayed: string[];
@@ -1206,6 +1248,56 @@ interface ShowCommitResult {
     /** Human-readable error message; omitted on success. */
     error?: string;
 }
+/**
+ * Thrown by `rebaseTo` / `commitsSinceBase` on the `none` backend
+ * (cp -a snapshots have no notion of a rebase target / fork point).
+ * Maps to exit code 4.
+ */
+declare class WorkspaceVcsRequiredError extends Error implements HasNextSteps {
+    readonly verb: string;
+    readonly workspacePath: string;
+    readonly name = "WorkspaceVcsRequiredError";
+    constructor(verb: string, workspacePath: string);
+    errorNextSteps(): NextStep[];
+}
+/**
+ * Thrown by `rebaseTo` when the workspace has uncommitted changes
+ * the rebase would clobber. Carries the dirty file list so the operator
+ * can decide between commit/stash/--force. Maps to exit code 4.
+ */
+declare class WorkspaceDirtyError extends Error implements HasNextSteps {
+    readonly workspacePath: string;
+    readonly files: readonly string[];
+    readonly name = "WorkspaceDirtyError";
+    /** The verb that refused. Only `rebaseTo` refuses this way today,
+     *  but the field keeps the message + nextSteps self-describing. */
+    readonly verb: string;
+    constructor(workspacePath: string, files: readonly string[], verb?: string);
+    errorNextSteps(): NextStep[];
+}
+/**
+ * Thrown by `rebaseTo` when the rebase produced conflicts. Carries the
+ * conflicting paths (git/sl) or commits (jj). Maps to exit code 5.
+ *
+ * git and sl abort the rebase before throwing, so the workspace is back
+ * at its pre-rebase state (`aborted` is true). jj cannot abort: the
+ * rebase is done and the conflicts are committed in place (`aborted` is
+ * false). Either way the row's parent_ref is unchanged, so the hint
+ * ends with re-running refresh: once the conflicts are resolved, that
+ * rebase is clean and records the base the disk is on.
+ */
+declare class WorkspaceConflictError extends Error implements HasNextSteps {
+    readonly workspacePath: string;
+    readonly fromRef: string;
+    readonly conflicts: readonly string[];
+    /** True when the backend aborted the rebase and the workspace is unchanged. */
+    readonly aborted: boolean;
+    readonly name = "WorkspaceConflictError";
+    constructor(workspacePath: string, fromRef: string, conflicts: readonly string[], 
+    /** True when the backend aborted the rebase and the workspace is unchanged. */
+    aborted?: boolean);
+    errorNextSteps(): NextStep[];
+}
 interface CreateWorkspaceOptions$1 {
     /** The repository being branched from. Absolute path. */
     projectRoot: string;
@@ -1237,6 +1329,10 @@ interface FreeWorkspaceResult$1 {
     /** The commit id that captured the pending changes, when `commit` was
      *  true and there was something to commit. Otherwise undefined. */
     committedRef?: string;
+    /** Branch created to keep the workspace's commits reachable after the
+     *  worktree is removed (git with `commit`, when HEAD was on no branch,
+     *  remote or tag). Otherwise undefined. */
+    branch?: string;
     /** True iff the on-disk path was actually removed (vs. already gone). */
     removed: boolean;
 }
@@ -1265,8 +1361,13 @@ interface VcsBackend {
      *    missing refs, the `none` backend which has no notion of "main")
      *
      * Callers treat null as "unknown — render — — and don't warn".
+     *
+     * `mainRefCache`, when given, is shared across the rows of one
+     * decorate call so a backend that must resolve "main" per repo (git's
+     * origin/HEAD probe) does it once per repo, not once per workspace.
+     * Backends that resolve main inside the count command ignore it.
      */
-    commitsBehind(workspacePath: string, ref: string): Promise<number | null>;
+    commitsBehind(workspacePath: string, ref: string, mainRefCache?: Map<string, Promise<string | undefined>>): Promise<number | null>;
     /**
      * Rebase the workspace onto `fromRef` (or the backend's tracked
      * base when undefined: `origin/HEAD` for git, `trunk()` for jj/sl).
@@ -1275,15 +1376,17 @@ interface VcsBackend {
      * Backend-specific behaviour:
      *   - git: refuses on dirty WC (WorkspaceDirtyError); fetches first;
      *     `git rebase <ref>`. On conflict, aborts the rebase and throws
-     *     WorkspaceConflictError so the operator resolves manually.
+     *     WorkspaceConflictError (aborted); the workspace is unchanged.
+     *     Any other rebase failure is rethrown.
      *   - jj:  always-snapshotted, so dirty is never an issue. After
      *     `jj rebase -d <ref>` the conflict-set is queried via
      *     `jj log -r 'conflict()'`. Conflicts surface as
      *     WorkspaceConflictError without an abort (jj's conflict markers
      *     persist as commits; the operator resolves in-place).
-     *   - sl:  similar to jj. `sl rebase -d <ref>`; conflicts via
-     *     `sl resolve -l`. On dirty WC sl errors itself; we wrap that
-     *     into WorkspaceDirtyError.
+     *   - sl:  like git. Refuses on dirty WC (WorkspaceDirtyError);
+     *     `sl rebase -d <ref>`; conflicts via `sl resolve --list`, then
+     *     aborts and throws WorkspaceConflictError (aborted). Any other
+     *     rebase failure is rethrown.
      *   - none: throws WorkspaceVcsRequiredError unconditionally.
      *
      * Surfaced by fb_workspace_recycle_verb: dogfood between waves
@@ -1291,7 +1394,10 @@ interface VcsBackend {
      * main; that killed the worker's LLM context. `refresh` updates
      * the on-disk dir without touching the agent or pane.
      */
-    rebaseTo(workspacePath: string, fromRef?: string): Promise<RebaseResult>;
+    rebaseTo(workspacePath: string, fromRef?: string, 
+    /** The row's current parent_ref. Kept as the result's parentRef
+     *  when it already descends from fromRef and is under the head. */
+    previousParentRef?: string): Promise<RebaseResult>;
     /**
      * Cheap "is the working copy clean?" probe used by close-auto-free
      * (allow_mu_agent_close_without_discard). Definition: ZERO uncommitted
@@ -1434,9 +1540,9 @@ declare function checkCommandResolvable(command: string): Promise<CommandResolut
 interface SpawnAgentOptions {
     name: string;
     workstream: string;
-    /** Defaults to "pi". 0.1.0 only really supports "pi" but the column
-     *  accepts any string for forward-compat with future multi-CLI support
-     *  (claude/codex). */
+    /** Defaults to "pi". Any CLI is accepted: pi is driven over its control
+     *  socket; others run `MU_<CLI>_COMMAND` (or the cli name) and get
+     *  text by mux paste. */
     cli?: string;
     /** The actual command to run in the pane. Defaults to the cli value. */
     command?: string;
@@ -1468,6 +1574,9 @@ interface SpawnAgentOptions {
     /** Run the control-socket handshake for pi agents (default true).
      *  `false` skips it and reports `ctl: "skipped"`. */
     ctl?: boolean;
+    /** When `name` is taken in the workstream, take the next free one
+     *  (see `nextFreeAgentName`) instead of failing with AgentExistsError. */
+    nextFree?: boolean;
 }
 /** Outcome of the spawn-time control-socket handshake. */
 type SpawnCtl = "ok" | "missing" | "refused" | "skipped";
@@ -1504,7 +1613,7 @@ declare function spawnAgent(db: Db, opts: SpawnAgentOptions): Promise<SpawnedAge
 declare function defaultSpawnLivenessMs(): number;
 
 interface AdoptAgentOptions {
-    /** tmux pane id (e.g. '%15'). Must already exist on the tmux server. */
+    /** Mux pane id (tmux '%15', herdr 'w1:p2'). Must already exist. */
     paneId: string;
     /** Workstream to adopt the pane into. The pane MUST be in the
      *  matching tmux session (`mu-<workstream>`); cross-session adopt is
@@ -1553,18 +1662,18 @@ interface AdoptAgentResult {
  * Validation order (matches the design in note #100):
  *   1. Pane id format     -> assertValidPaneId via paneExists / setPaneTitle
  *   2. Pane exists        -> PaneNotFoundError
- *   3. Pane is in session -> AgentNotInWorkstreamError (cross-session)
+ *   3. Pane is in session -> PaneNotInSessionError (cross-session)
  *   4. Resolved name OK   -> isValidAgentName / Error('agent name invalid')
  *   5. Idempotent check   -> if pane already owned by an agent of this
  *                            name, return alreadyAdopted=true
  *   6. Name not taken     -> AgentExistsError (else)
  *   7. Insert + retitle.
  *
- * Status starts at 'free' — reconcile/detect will update it on the next
- * `mu agent list` based on actual pane content (the pi prompt yields
- * 'free'; an agent mid-thought yields 'busy'; etc.). We don't run
- * detection inline here because the caller may not have $TMUX, and
- * adoption shouldn't depend on a captured-pane probe succeeding.
+ * The row's `status` column is the deprecated constant 'spawning' (see
+ * insertAgent); runtime state is read at display time by
+ * src/agent-state.ts (control socket, murmur, or herdr), never from
+ * pane text. Adoption runs no state probe, so it does not depend on
+ * the agent's control socket or a captured pane answering.
  */
 declare function adoptAgent(db: Db, opts: AdoptAgentOptions): Promise<AdoptAgentResult>;
 
@@ -1620,6 +1729,13 @@ declare class AgentExistsError extends Error implements HasNextSteps {
     constructor(agentName: string);
     errorNextSteps(): NextStep[];
 }
+/** `spawn --next-free` found no free valid name near the asked one. */
+declare class AgentNameExhaustedError extends Error implements HasNextSteps {
+    readonly agentName: string;
+    readonly name = "AgentNameExhaustedError";
+    constructor(agentName: string, reason: string);
+    errorNextSteps(): NextStep[];
+}
 declare class AgentNotFoundError extends Error implements HasNextSteps {
     readonly agentName: string;
     /** Optional workstream context. When set, the message is enriched
@@ -1656,6 +1772,20 @@ declare class AgentNotInWorkstreamError extends Error implements HasNextSteps {
     constructor(agentName: string, expectedWorkstream: string, actualWorkstream: string);
     errorNextSteps(): NextStep[];
 }
+/**
+ * `mu agent adopt` of a pane that exists but is not in the workstream's
+ * mux session. Distinct from AgentNotInWorkstreamError: the subject is a
+ * pane, not an agent, and its owning session is not known without
+ * another mux query. Maps to exit code 4 (conflict).
+ */
+declare class PaneNotInSessionError extends Error implements HasNextSteps {
+    readonly paneId: string;
+    readonly workstream: string;
+    readonly expectedSession: string;
+    readonly name = "PaneNotInSessionError";
+    constructor(paneId: string, workstream: string, expectedSession: string);
+    errorNextSteps(): NextStep[];
+}
 /**
  * Thrown when an agent's pane is created and titled successfully but the
  * spawned process exits within the liveness window (default 1500ms;
@@ -1804,6 +1934,27 @@ declare class AgentFreshNeedsCtlError extends Error implements HasNextSteps {
     constructor(agentName: string, workstream: string, cli: string);
     errorNextSteps(): NextStep[];
 }
+/**
+ * The agent's pi serves the control socket with an extension it loaded
+ * before mu learned `op` (e.g. `fresh`): running pi processes keep the
+ * extension code they started with. pi's `/reload` re-imports the
+ * extension through the `mu link pi` shim and keeps the socket; a
+ * respawn always works. An extension that serves op `command` takes
+ * `/reload` over ctl; an older one needs it typed (`--via mux`).
+ */
+declare class AgentExtensionOutdatedError extends Error implements HasNextSteps {
+    readonly agentName: string;
+    readonly workstream: string;
+    readonly op: string;
+    readonly extVersion?: string | undefined;
+    /** Ops the extension serves (from its "unknown op" reply); absent from old extensions. */
+    readonly ops?: readonly string[] | undefined;
+    readonly name = "AgentExtensionOutdatedError";
+    constructor(agentName: string, workstream: string, op: string, extVersion?: string | undefined, 
+    /** Ops the extension serves (from its "unknown op" reply); absent from old extensions. */
+    ops?: readonly string[] | undefined);
+    errorNextSteps(): NextStep[];
+}
 /**
  * `send --fresh` or a session command (`/new`, `/reload`, `/compact`)
  * refused: pi is mid-turn, and running it would abandon the turn.
@@ -2047,8 +2198,11 @@ declare function listAgents(db: Db, opts?: {
 declare function composeAgentTitle(db: Db, agent: AgentRow): string;
 /** Push a fresh pane title for `agentName`. Best-effort — a missing
  *  agent, a placeholder pane id, or a tmux failure are all swallowed
- *  silently (titles are decorative; never block the calling verb). */
-declare function refreshAgentTitle(db: Db, agentName: string, workstream: string): Promise<void>;
+ *  silently (titles are decorative; never block the calling verb).
+ *  `currentTitle` is the pane's live title when the caller already read
+ *  it (reconcile); the write is skipped when it equals the new title,
+ *  since each retitle is a mux server write plus a status redraw. */
+declare function refreshAgentTitle(db: Db, agentName: string, workstream: string, currentTitle?: string): Promise<void>;
 /**
  * Delete an agent row. Returns true if a row was matched. Idempotent;
  * deleting an agent that doesn't exist returns false without throwing.
@@ -2153,10 +2307,7 @@ interface ListLiveAgentsOptions {
      * documented mutating behaviour `mu agent list` has always had,
      * now also used by `mu state`).
      *
-     * `mu doctor` and `mu undo` pass `"report-only"`: count drift,
-     * mutate nothing. `mu undo` MUST use this so a post-restore
-     * reconcile doesn't delete the rows the snapshot just restored
-     * (snap_undo_reconcile_destroys_recovered_agents).
+     * `mu doctor` passes `"report-only"`: count drift, mutate nothing.
      *
      * Mid-spawn placeholders (pane id `%pending-<name>`) are protected
      * directly in reconcile's prune loop, independent of mode
@@ -2179,9 +2330,8 @@ interface LiveAgentsView {
 /**
  * Return the live, reality-reconciled view of agents in a workstream.
  * `mu state` and `mu agent list` call this with the default `mode: "full"`
- * (mutating); read-only diagnostic / restore paths
- * (`mu doctor`, `mu undo`) call it with `mode: "report-only"` to mutate
- * nothing at all.
+ * (mutating); the read-only diagnostic (`mu doctor`) calls it with
+ * `mode: "report-only"` to mutate nothing at all.
  */
 declare function listLiveAgents(db: Db, opts: ListLiveAgentsOptions): Promise<LiveAgentsView>;
 
@@ -2463,7 +2613,8 @@ interface CloseTaskOptions extends EvidenceOption {
      *  as a bare `addNote` without `--author`). Surfaced in mufeedback
      *  task_close_evidence_does_not_append_the. */
     author?: string;
-    /** Closing substate; default "done". Any CLOSED/* satisfies edges. */
+    /** Closing substate; default "done" (or, for an already-CLOSED task,
+     *  its current substate). Any CLOSED/* satisfies edges. */
     as?: CloseSubstate;
     /** Required (non-empty) unless `as` is "done"; stored as a
      *  `<AS>: <why>` note in the same op group. */
@@ -2478,9 +2629,9 @@ interface CloseTaskResult extends SetStatusResult {
     unblocked: string[];
 }
 /** Convenience: setTaskStatus(db, id, "CLOSED"). Accepts evidence.
- *  Skipped
- *  for the idempotent no-op (already CLOSED) so we don't accumulate
- *  empty-delta snapshots on retry loops.
+ *  Notes are skipped for the idempotent no-op (already CLOSED with the
+ *  same substate; a bare close without `as` keeps the current one) so
+ *  retry loops don't accumulate duplicates.
  *
  *  With `ifReady: true`, returns a `CloseSkippedResult` (no mutation,
  *  no snapshot) when any blocker is still OPEN / IN_PROGRESS. Used by
@@ -2593,7 +2744,7 @@ interface ClaimTaskOptions extends AttributedEvidence {
      */
     agentWorkstream?: string;
     /**
-     * Anonymous claim: write `owner = NULL` instead of resolving an agent
+     * Anonymous claim: write `owner_id = NULL` instead of resolving an agent
      * name and checking the FK. Use when the actor is the orchestrator
      * (or a script, or a human) doing direct work in a workstream they
      * aren't a registered worker in.
@@ -2604,9 +2755,10 @@ interface ClaimTaskOptions extends AttributedEvidence {
      *
      * Resolution order for the actor name (used as the log source):
      *   1. `actor` if explicitly passed.
-     *   2. Current pane title (when `$TMUX_PANE` is set).
-     *   3. `$USER`.
-     *   4. The literal string 'unknown'.
+     *   2. `$MU_AGENT_NAME`.
+     *   3. The mux's current agent name (pane title on tmux).
+     *   4. `$USER`.
+     *   5. The literal string 'orchestrator'.
      *
      * Mutually exclusive with `agentName` (the two are alternative
      * answers to "who's the actor for this claim?"). Passing both is a
@@ -2644,14 +2796,15 @@ interface ClaimResult {
  * Claim a task. Two modes:
  *
  *   Worker claim (default):
- *     Resolve an agent name from `opts.agentName` or from $TMUX_PANE's
- *     pane title. The name MUST exist in the agents table (FK on
- *     tasks.owner). Sets `owner = <name>`. This is what mu-spawned
+ *     Resolve an agent name from `opts.agentName`, else $MU_AGENT_NAME,
+ *     else the mux's current agent name (pane title on tmux). The name
+ *     MUST exist in the agents table (`tasks.owner_id` is an FK to
+ *     `agents.id`). Sets `owner_id` to that agent. This is what mu-spawned
  *     workers do, and what `mu task claim --for <worker>` does for
  *     orchestrator dispatch.
  *
  *   Anonymous claim (--self):
- *     Skip the name -> agents FK lookup entirely. Sets `owner = NULL`.
+ *     Skip the name -> agents FK lookup entirely. Sets `owner_id = NULL`.
  *     Records the actor in `agent_logs.source` instead. This is the
  *     orchestrator-doing-direct-work path — the actor is logged but
  *     not registered as a worker pane.
@@ -2867,12 +3020,15 @@ interface DeleteTaskResult {
      *  found an existing task with zero edges and zero notes
      *  (`present: true, deletedEdges: 0, deletedNotes: 0`). */
     present: boolean;
+    /** The op group the delete wrote, for `mu undo <group> --yes`. Null
+     *  when nothing was deleted (dry-run or missing row). */
+    group: string | null;
 }
 interface DeleteTaskOptions {
     /** When true, return the cascade preview (would-be edge / note
-     *  counts) without mutating and without snapshotting. The CLI uses
-     *  this to power the bare `mu task delete <id>` two-phase pattern
-     *  (mirrors `mu workstream teardown` / `mu snapshot prune`). Surfaced
+     *  counts) without mutating. The CLI uses this to power the bare
+     *  `mu task delete <id>` two-phase pattern (mirrors
+     *  `mu workstream teardown` / `mu undo`). Surfaced
      *  by feedback ws task
      *  fb_task_delete_no_yes (impact=30): a dogfood report typed
      *  `mu task delete X --yes` (mirroring workstream teardown) and got
@@ -2889,10 +3045,9 @@ interface DeleteTaskOptions {
  * `changes()` only reports rows directly affected by the DELETE.
  *
  * With `opts.dryRun: true`, returns the would-be counts without
- * touching the DB and without taking a snapshot (no mutation = no
- * snapshot — same reasoning that gates the closeTask snap on the
- * idempotent no-op path). The CLI bare `mu task delete <id>` form
- * uses this; `--yes` calls through with `dryRun: false`.
+ * touching the DB (no mutation, so no op is written). The CLI bare
+ * `mu task delete <id>` form uses this; `--yes` calls through with
+ * `dryRun: false`.
  */
 declare function deleteTask(db: Db, localId: string, workstream: string, opts?: DeleteTaskOptions): DeleteTaskResult;
 interface UpdateTaskOptions {
@@ -3042,6 +3197,9 @@ interface FreeWorkspaceResult {
     /** The committed ref, when `commit` was true and there was something
      *  to commit. */
     committedRef?: string;
+    /** Branch mu created to keep the workspace's commits reachable after
+     *  removal (git `--commit` on a detached HEAD). */
+    branch?: string;
     /** True iff the on-disk path was actually removed. */
     removed: boolean;
     /** True iff the DB row was actually deleted. */
@@ -3121,6 +3279,19 @@ declare class TaskNotFoundError extends Error implements HasNextSteps {
     constructor(taskId: string);
     errorNextSteps(): NextStep[];
 }
+/**
+ * Thrown by `addTask` when `localId` violates the schema regex
+ * `/^[a-z][a-z0-9_-]{0,63}$/`. Replaces a bare `TypeError` so the
+ * CLI's `handle()` wrapper can map it to exit code 2 (usage, with the
+ * verb's --help, like WorkstreamNameInvalidError) and surface a `--json` `nextSteps` block pointing at
+ * the auto-derived-id workflow and a sanitised candidate.
+ */
+declare class TaskIdInvalidError extends Error implements HasNextSteps {
+    readonly attempted: string;
+    readonly name = "TaskIdInvalidError";
+    constructor(attempted: string);
+    errorNextSteps(): NextStep[];
+}
 declare class TaskExistsError extends Error implements HasNextSteps {
     readonly taskId: string;
     readonly name = "TaskExistsError";
@@ -3153,7 +3324,7 @@ declare class TaskAlreadyOwnedError extends Error implements HasNextSteps {
  * Thrown when `mu task claim` resolves a claimer agent name (from the
  * pane title or --for) that has no matching row in the agents table.
  *
- * The FK on `tasks.owner` references `agents.name`; without this guard
+ * The FK on `tasks.owner_id` references `agents.id`; without this guard
  * the claim attempt would fail with the unhelpful 'FOREIGN KEY constraint
  * failed' from SQLite. This typed error gives the user actionable next
  * steps (run `mu agent adopt <pane-id>` to register, or use --for to pick a
@@ -3174,6 +3345,12 @@ declare class ClaimerNotRegisteredError extends Error implements HasNextSteps {
      */
     errorNextSteps(): NextStep[];
 }
+declare class TaskClaimStaleWorkspaceError extends Error implements HasNextSteps {
+    readonly staleness: WorkspaceStaleness;
+    readonly name = "TaskClaimStaleWorkspaceError";
+    constructor(staleness: WorkspaceStaleness);
+    errorNextSteps(): NextStep[];
+}
 declare class CycleError extends Error implements HasNextSteps {
     readonly from: string;
     readonly to: string;
@@ -3181,6 +3358,64 @@ declare class CycleError extends Error implements HasNextSteps {
     constructor(from: string, to: string);
     errorNextSteps(): NextStep[];
 }
+/**
+ * Thrown by the `mu task wait` CLI wrapper when the per-poll
+ * reconciler detects that a watched task transitioned
+ * `IN_PROGRESS → OPEN` between polls (the reaper saw the owner's
+ * pane was gone and flipped the task back). With `--status CLOSED`
+ * (the default) the wait can never satisfy by progress — the worker
+ * is dead — so we abort fast instead of running out the operator's
+ * `--timeout`.
+ *
+ * Maps to exit code 6 (REAPER_DETECTED) via the cli.ts handler. The
+ * suppression rule (only fire when target=CLOSED) lives in the
+ * caller; this error type is a pure data carrier.
+ *
+ * Surfaced live by task_wait_reconcile_dead_panes (twice in one
+ * v0.3 dispatch wave: tmux restart killed worker panes; `mu task
+ * wait --timeout 1800` blocked silently for 25 min instead of
+ * failing in seconds).
+ */
+declare class ReaperDetectedDuringWaitError extends Error implements HasNextSteps {
+    readonly taskId: string;
+    readonly previousOwner: string | null;
+    readonly workstream: string;
+    readonly name = "ReaperDetectedDuringWaitError";
+    constructor(taskId: string, previousOwner: string | null, workstream: string);
+    errorNextSteps(): NextStep[];
+}
+declare class StallDetectedDuringWaitError extends Error implements HasNextSteps {
+    readonly taskName: string;
+    readonly owner: string | null;
+    readonly workstream: string;
+    readonly ageSecs: number;
+    /** The owner runs pi (control socket): `mu agent abort` stops its turn. */
+    readonly ownerExpectsCtl: boolean;
+    /** The owner's ctl run count at the stall, when its socket answered. */
+    readonly ownerRuns?: number | undefined;
+    /** The owner's workstream when it differs from the task's
+     *  (`task claim --for <ws>/<agent>`). Agent commands use it. */
+    readonly ownerWorkstream: string;
+    readonly name = "StallDetectedDuringWaitError";
+    constructor(taskName: string, owner: string | null, workstream: string, ageSecs: number, 
+    /** The owner runs pi (control socket): `mu agent abort` stops its turn. */
+    ownerExpectsCtl?: boolean, 
+    /** The owner's ctl run count at the stall, when its socket answered. */
+    ownerRuns?: number | undefined, 
+    /** The owner's workstream when it differs from the task's
+     *  (`task claim --for <ws>/<agent>`). Agent commands use it. */
+    ownerWorkstream?: string);
+    /**
+     * Diagnose before acting. `mu agent read` comes FIRST because the
+     * predicate that threw cannot tell the three causes of needs_input
+     * apart, and the evidence is in the pane rather than the task row.
+     * The earlier order led with "poke the worker", which is the right
+     * move for only one of the three and actively wrong for a worker
+     * waiting on an answer — a poke with no answer in it just restates
+     * the question.
+     */
+    errorNextSteps(): NextStep[];
+}
 declare class CrossWorkstreamEdgeError extends Error implements HasNextSteps {
     readonly blocker: string;
     readonly blockerWorkstream: string;
@@ -3253,6 +3488,16 @@ declare class InvalidSubstateError extends Error implements HasNextSteps {
     errorNextSteps(): NextStep[];
 }
 
+/** Thrown when a title has no ASCII letter or digit, so no id can be
+ *  derived from it (any non-ASCII script, or pure punctuation). Exit 2
+ *  (usage) with the verb's --help; the fix is the `<id>` positional.
+ *  Lives here, not in errors.ts, because errors.ts imports this file. */
+declare class TaskTitleSlugEmptyError extends Error implements HasNextSteps {
+    readonly title: string;
+    readonly name = "TaskTitleSlugEmptyError";
+    constructor(title: string);
+    errorNextSteps(): NextStep[];
+}
 declare function isValidTaskId(id: string): boolean;
 /**
  * Lowercase title; collapse non-alnum runs into single `_`; trim
@@ -3262,7 +3507,7 @@ declare function isValidTaskId(id: string): boolean;
  * when one exists, else hard-truncate). Mirrors `tg`'s `id_from_title`
  * but adds the soft cap.
  *
- * Throws if `title` yields an empty slug after stripping.
+ * Throws `TaskTitleSlugEmptyError` if `title` yields an empty slug.
  */
 declare function slugifyTitle(title: string): string;
 /**
@@ -3379,8 +3624,11 @@ declare function listGoals(db: Db, workstream: string): TaskRow[];
  *  named SDK helper so CLI renderers don't re-derive the row-shape
  *  conversion (review_code_raw_task_state_duplicate). */
 declare function listInProgress(db: Db, workstream: string): TaskRow[];
-/** Most-recently-closed tasks in a workstream, newest first, capped at
- *  `limit` (default 5). Used by `mu state` for its 'recent closed'
+/** CLOSED tasks in a workstream, most recently updated first, capped at
+ *  `limit` (default 5). `updated_at` is a proxy for close time: there is
+ *  no `closed_at` column, and a later note or edge change on a CLOSED
+ *  task bumps `updated_at` (touchTask), moving it up. Used by `mu state`
+ *  for its 'recent closed'
  *  slice; exposed as a named SDK helper so the CLI no longer needs the
  *  raw-row type that was duplicating RawTaskRow
  *  (review_code_raw_task_state_duplicate). */
@@ -3406,8 +3654,9 @@ interface ListNotesOptions {
      *  an error here — CLI-side validation rejects `--tail 0`. */
     tail?: number;
     /** ISO-8601 cutoff: only notes with `created_at > since` survive.
-     *  Comparison is lexicographic on the ISO string (matches the way
-     *  the rest of the codebase compares ISO timestamps). */
+     *  Any `Date.parse`-able value; it is normalised to `toISOString()`
+     *  form (the stored shape) before the text comparison, so offsets
+     *  and second-precision cutoffs compare as instants. */
     since?: string;
     /** When true and `since` is unset, look up the `created_at` of the
      *  most recent `task claim` event for this task and use it as the
@@ -3631,9 +3880,12 @@ declare class LinkConflictError extends Error implements HasNextSteps {
 }
 /** Install the extension shim (or, with `copy`, an inlined copy pinned
  *  to this version). `replacedCopy` is true when an existing file without
- *  the shim marker was overwritten. */
+ *  the shim marker was overwritten. A symlink at the destination (e.g. to
+ *  a dev checkout) is never written through: a live one needs `force`,
+ *  which replaces the link itself, never its target. */
 declare function linkPi(opts?: LinkOptions & {
     copy?: boolean;
+    force?: boolean;
 }): {
     path: string;
     replacedCopy: boolean;
@@ -3664,7 +3916,7 @@ interface LogRow {
      *  render as "system" rather than the string "null". */
     source: string;
     /** Structured intent ('task.close', 'agent.spawn', ...). Null only for
-     *  operator-authored prose lines (`mu log write` / a `--kind` ledger),
+     *  operator-authored prose lines (`mu log "<text>"` / a `--kind` ledger),
      *  which name no state change. The formatter in src/log-render.ts
      *  renders from this — never from the payload text. */
     intent: string | null;
@@ -3683,6 +3935,15 @@ interface LogRow {
     /** ISO 8601 timestamp set at insert time. */
     createdAt: string;
 }
+/** Raised when a group-id prefix matches more than one group.
+ *  Astronomically unlikely with uuids, but silently picking one of two
+ *  candidate groups to UNDO is not an acceptable failure mode. */
+declare class GroupIdAmbiguousError extends Error implements HasNextSteps {
+    readonly prefix: string;
+    readonly candidates: readonly string[];
+    constructor(prefix: string, candidates: readonly string[]);
+    errorNextSteps(): NextStep[];
+}
 interface AppendLogOptions {
     /** Workstream this entry belongs to. `null` for machine-wide. */
     workstream: string | null;
@@ -3698,6 +3959,14 @@ interface AppendLogOptions {
      *  to name. */
     intent?: string;
 }
+/** Raised by `appendLog` for a kind in RESERVED_LOG_KINDS. Usage lane
+ *  (exit 2): the operator picked a tag that names a projectable entity. */
+declare class LogKindReservedError extends Error implements HasNextSteps {
+    readonly kind: string;
+    readonly name = "LogKindReservedError";
+    constructor(kind: string);
+    errorNextSteps(): NextStep[];
+}
 /**
  * Append a log entry. Returns the inserted row (with assigned `seq`).
  * Constant-time. Single INSERT; safe to call from any state-changing
@@ -3865,6 +4134,11 @@ interface WorkstreamSnapshotSlowFields {
     commitsBackend?: VcsBackendName | null;
     doctor: DoctorSummary | null;
 }
+/**
+ * Fast TUI/state snapshot tier: pure SQLite reads only. Subprocess-backed
+ * fields are intentionally empty placeholders so callers can merge the last
+ * slow-tier values without blocking a 1s render tick on tmux or VCS probes.
+ */
 declare function loadWorkstreamSnapshotFast(db: Db, workstream: string, opts?: LoadWorkstreamSnapshotOptions): Promise<WorkstreamSnapshot>;
 /**
  * Slow snapshot tier: fields backed by tmux / VCS subprocess probes (plus
@@ -3927,6 +4201,10 @@ interface DoctorSummary {
     /** Convenience: how many rows are warn or fail. Card subtitle
      *  reads this directly. Pure derivation from `checks`. */
     problemCount: number;
+    /** Where the murmur row read agent state from. The slot-9 popup
+     *  re-derives the full check list and passes this back, so its
+     *  murmur row matches the card's (herdr on herdr). */
+    agentStateSource?: "murmur" | "herdr";
 }
 /**
  * Compute the doctor summary for a workstream. Pure-ish: runs cheap
@@ -3951,7 +4229,7 @@ declare function countProblems(checks: readonly DoctorCheck[]): number;
  * just `.checks`. Pure-ish (same cheap synchronous DB reads as
  * `loadDoctorSummary`).
  */
-declare function loadDoctorChecks(db: Db, snapshot: WorkstreamSnapshot | null): readonly DoctorCheck[];
+declare function loadDoctorChecks(db: Db, snapshot: WorkstreamSnapshot | null, agentStateSource?: "murmur" | "herdr"): readonly DoctorCheck[];
 /**
  * Map a check row to the most useful informational command the
  * operator might paste. Read-only by construction: `mu agent list`,
@@ -4023,8 +4301,9 @@ interface CheapDriftReport {
 /**
  * Every live row must have at least one op naming its natural key.
  *
- * ~1ms on a 200-task DB: four indexed NOT EXISTS scans, no rebuild, no
- * temp file. Cheap enough to run on every `mu doctor`.
+ * Four indexed NOT EXISTS scans, no rebuild, no temp file: ~10 ms on a
+ * 2.3k-task, 10.7k-note, 67k-op DB. Cheap enough to run on every `mu
+ * doctor` and the TUI slow tick.
  *
  * WHAT IT CATCHES: a row that exists with no history — an uncaptured
  * INSERT, or a mutation path that bypassed the triggers entirely.
@@ -4082,11 +4361,15 @@ declare class DriftDetectedError extends Error implements HasNextSteps {
 
 /** Sub-directory of the state dir holding lock directories. */
 declare function locksDir(): string;
-interface FileLockOptions {
+interface FileLockOptions<T = unknown> {
     acquireTimeoutMs?: number;
     staleLockMs?: number;
     /** Env var consulted for the acquire timeout, if any. */
     timeoutEnvVar?: string;
+    /** Run instead of `fn` when the lock cannot be taken (contended past
+     *  the deadline, or the lock dir cannot be created). Absent, `fn` runs
+     *  unlocked. */
+    onUnavailable?: () => T;
 }
 /**
  * Run `fn` while holding the lock directory at `lockPath`.
@@ -4095,7 +4378,7 @@ interface FileLockOptions {
  * Records pid + acquisition time in `meta.json` for stale-lock
  * diagnostics.
  */
-declare function withFileLock<T>(lockPath: string, label: string, fn: () => Promise<T>, opts?: FileLockOptions): Promise<T>;
+declare function withFileLock<T>(lockPath: string, label: string, fn: () => Promise<T>, opts?: FileLockOptions<T>): Promise<T>;
 /** Read a held lock's metadata, or null. Exposed for tests. */
 declare function readFileLockMeta(lockPath: string): Promise<{
     pid: number;
@@ -4113,6 +4396,17 @@ interface FleetHazard {
     /** Multi-line explanation + remediation, shown when non-ok. */
     remediation?: readonly string[];
 }
+/**
+ * `mu doctor` found at least one `fail`-severity row. Thrown after the
+ * whole report is printed (or the --json payload emitted) so scripts and
+ * CI see a non-zero exit; maps to exit 5 like drift, because a `fail`
+ * row means the substrate is unsafe, not that a hint is pending.
+ */
+declare class HazardFailError extends Error {
+    readonly failedRows: readonly string[];
+    readonly name = "HazardFailError";
+    constructor(failedRows: readonly string[]);
+}
 /**
  * True iff `child` is inside `parent` (or is `parent`).
  *
@@ -4330,7 +4624,7 @@ declare function nextHlc(db: Db, now?: number): string;
  *
  *     wall = max(local_wall, remote_wall, now)
  *
- * The counter has three explicit cases, by which of the three won:
+ * The counter has four explicit cases, by which of the three won:
  *   - `now` strictly won            -> counter = 0 (fresh millisecond)
  *   - local and remote tie at max   -> counter = max(local_c, remote_c) + 1
  *   - only local is at max          -> counter = local_c + 1
@@ -4350,7 +4644,7 @@ declare function receiveHlc(db: Db, remoteHlc: string, now?: number): string;
 /** Every intent mu writes: the local ones (`emitEvent`, for changes no
  *  trigger can see) plus the capture-trigger ones (set via
  *  `withOpContext` around a portable-table mutation). */
-type CaptureIntent = "task.add" | "task.update" | "task.note" | "task.delete" | "task.close" | "task.open" | "task.park" | "task.unpark" | "task.reject" | "task.defer" | "task.claim" | "task.release" | "task.reap" | "task.block" | "task.unblock" | "task.reparent" | "workstream.init" | "workstream.teardown" | "workstream.destroy";
+type CaptureIntent = "task.add" | "task.update" | "task.note" | "task.delete" | "task.close" | "task.open" | "task.park" | "task.unpark" | "task.accept" | "task.reject" | "task.defer" | "task.claim" | "task.release" | "task.reap" | "task.block" | "task.unblock" | "task.reparent" | "workstream.init" | "workstream.teardown" | "sql.write" | "workstream.destroy";
 type KnownIntent = CaptureIntent | LocalIntent;
 /** A log row, reduced to what rendering needs. Structural so both
  *  `LogRow` (the SDK shape) and raw op rows satisfy it. */
@@ -4402,7 +4696,7 @@ declare const KNOWN_VERBS: readonly string[];
  * Render one op as prose.
  *
  * Returns null when the row is not a rendered op at all — operator prose
- * from `mu log write` / a `--kind` ledger, which has no intent and
+ * from `mu log "<text>"` / a `--kind` ledger, which has no intent and
  * should be shown verbatim. Callers print `payload` in that case.
  */
 declare function renderOp(row: RenderableOp): RenderedOp | null;
@@ -4521,8 +4815,9 @@ interface RebuildReport {
     /** Ops copied into the target's log. Every op, not just synced ones. */
     opsCopied: number;
     /** Ops that projected into a portable table. Always <= opsCopied:
-     *  log-only entities (message / event / broadcast / marker) are
-     *  copied but have no table to land in. */
+     *  log-only entities (message / event / broadcast), machine-local
+     *  agent / workspace ops and legacy log-only intents are copied but
+     *  have no table to land in. */
     opsProjected: number;
     /** Ops that changed a row when applied. Lower than opsProjected
      *  whenever later ops superseded earlier ones — which is normal and
@@ -4559,6 +4854,39 @@ interface RebuildOptions {
  */
 declare function rebuildInto(source: Db, opts: RebuildOptions): RebuildReport;
 
+/** Serialisable running state: eight hash words (hex), bytes hashed so
+ *  far, and the partial trailing block not yet compressed (base64). */
+interface Sha256State {
+    h: string;
+    n: number;
+    tail: string;
+}
+
+/** Whole-file verification sidecar. */
+interface SegmentManifest {
+    v: number;
+    machine: string;
+    count: number;
+    lastHlc: string | null;
+    sha256: string;
+    updatedAt: string;
+    /** Bytes of the segment `sha256` covers. Written by the owner so its
+     *  next flush can trust this manifest instead of rescanning; absent in
+     *  manifests from older builds. */
+    size?: number;
+    /** The segment's mtime when this manifest was written (owner-local). */
+    mtimeMs?: number;
+    /** Running hash state after `size` bytes, so an append rehashes only
+     *  what it added. */
+    shaState?: Sha256State;
+    /** sha256 over the fields above (`manifestSeal`). The owner trusts
+     *  count/size/shaState only when it matches, so a torn or hand-edited
+     *  manifest falls back to the full scan instead of being persisted. */
+    seal?: string;
+}
+/** Read a segment's manifest, or null when absent/unparsable. */
+declare function readManifest(segment: string): SegmentManifest | null;
+
 /** Current segment line format. Bumped only on a breaking shape change;
  *  a reader that sees a version it does not know REFUSES the line rather
  *  than guessing at its meaning. */
@@ -4577,15 +4905,6 @@ interface SegmentLine {
     payload: unknown;
     crc: string;
 }
-/** Whole-file verification sidecar. */
-interface SegmentManifest {
-    v: number;
-    machine: string;
-    count: number;
-    lastHlc: string | null;
-    sha256: string;
-    updatedAt: string;
-}
 /** Why a segment line was rejected. Reported, never silently swallowed. */
 type SegmentDefectKind = "torn-write" | "manifest-mismatch" | "crc-mismatch" | "non-monotonic-hlc" | "unknown-version" | "malformed-shape" | "entity-not-synced" | "duplicate-op";
 interface SegmentDefect {
@@ -4614,7 +4933,10 @@ interface FlushResult {
     appended: number;
     /** Total lines in the segment afterwards. */
     total: number;
-    /** Ops skipped because their entity is machine-local. */
+    /** Ops skipped because their entity is machine-local. A full scan
+     *  (`verify`, or an untrusted manifest) counts every unflushed one; the
+     *  fast path counts only those up to the last op it appended, so a
+     *  no-op ambient flush reports 0 (see `pendingLines`). */
     skippedLocal: number;
     /**
      * Non-null when THIS MACHINE'S OWN segment was found defective past
@@ -4630,34 +4952,22 @@ interface FlushResult {
      * to be (`mu sync`, `ambientFlush`).
      */
     selfRepaired: SegmentDefect | null;
+    /**
+     * True when ops were pending but another process held the segment
+     * lock past the wait, so this call wrote nothing. The ops stay
+     * unflushed in `ops` (the segment's last hlc is the watermark), and
+     * the next flush appends them. Never set on a successful flush.
+     */
+    lockBusy?: boolean;
 }
-/**
- * Append this machine's not-yet-flushed ops to its own segment.
- *
- * FILTERING IS LOAD-BEARING. Only ops whose entity is in
- * `SYNCED_ENTITIES` are written. Machine-local ops (agent.*, workspace.*)
- * are captured and DO appear in `mu log`, but they must never reach a
- * segment: they carry pane ids and absolute paths that are meaningless,
- * and frequently wrong, on another machine. "Not synced" is not "not
- * logged".
- *
- * Also filters `machine_id = <me>`: a segment holds ONE machine's ops.
- * Ops ingested from a peer live in our `ops` table too, and re-flushing
- * them into our own segment would duplicate a peer's history under our
- * name — and would grow without bound as two machines echoed each other.
- *
- * The high-water mark is the last hlc already in the file (read from the
- * manifest when present, else derived by scanning), so flush is
- * incremental and idempotent: calling it twice appends nothing the second
- * time.
- */
-declare function flushSegment(db: Db, dir?: string | null): Promise<FlushResult>;
+declare function flushSegment(db: Db, dir?: string | null, opts?: {
+    verify?: boolean;
+    lockWaitMs?: number;
+}): Promise<FlushResult>;
 /** Number of GOOD lines in a segment (stopping at the first defect, as
  *  ingest does). The denominator of "how far behind am I" — exported for
  *  `mu sync`'s peer table. */
 declare function segmentLineCount(path: string): number;
-/** Read a segment's manifest, or null when absent/unparsable. */
-declare function readManifest(segment: string): SegmentManifest | null;
 /**
  * Verify a segment against its manifest (layer 4).
  *
@@ -4674,6 +4984,13 @@ declare function verifyAgainstManifest(segment: string): {
 interface PeerSegment {
     /** Machine id the segment belongs to. */
     machineId: string;
+    /** Key of this FILE's watermark in `sync_peers`: the machine id for
+     *  the peer's own segment, the full file stem for a conflict copy.
+     *  A copy diverges from its original, so line N of one says nothing
+     *  about line N of the other; sharing one watermark skipped every op
+     *  that existed only in the copy. Optional for SDK callers written
+     *  before it existed: absent means the machine id (`peerWatermarkKey`). */
+    watermarkKey?: string;
     /** Path on disk. */
     path: string;
     /** True for a Syncthing-style conflict copy. */
@@ -4695,7 +5012,9 @@ interface PeerSegment {
  */
 declare function discoverPeers(dir: string, selfMachineId: string): PeerSegment[];
 /**
- * How far into a peer's segment we have applied.
+ * How far into one segment file we have applied, keyed by
+ * `PeerSegment.watermarkKey` (the machine id, or a conflict copy's own
+ * stem).
  *
  * ONE INTEGER SUFFICES because segments are append-only and ordered — a
  * set or a vector clock would be strictly more state for no more
@@ -4706,15 +5025,24 @@ declare function discoverPeers(dir: string, selfMachineId: string): PeerSegment[
  * `ops.seq` (which is a local-only cursor on their machine and means
  * nothing here).
  */
-declare function getWatermark(db: Db, machineId: string): number;
-declare function setWatermark(db: Db, machineId: string, value: number): void;
+declare function getWatermark(db: Db, watermarkKey: string): number;
+/**
+ * Store a watermark and stamp `last_seen_at` with the ISO time. The
+ * segment fingerprint goes to `sync_fingerprints` when the caller just
+ * read the file cleanly to its end (`segmentCaughtUp`). Every other
+ * write deletes it, so a reset or partial ingest never vouches for the
+ * file.
+ */
+declare function setWatermark(db: Db, watermarkKey: string, value: number, fingerprint?: string | null): void;
 /** Reset a peer's watermark so the next ingest re-reads from zero. The
  *  universal repair, safe because ingest is idempotent. */
-declare function resetWatermark(db: Db, machineId: string): void;
+declare function resetWatermark(db: Db, watermarkKey: string): void;
 interface IngestResult {
     machineId: string;
     path: string;
-    /** Lines read past the watermark. */
+    /** Lines consumed past the starting watermark: applied plus skipped
+     *  (refused, re-delivered, historical log-only) lines. A line that
+     *  halted ingest is not counted. */
     read: number;
     /** Ops applied (some are no-ops: already present, or lost an LWW). */
     applied: number;
@@ -4750,11 +5078,40 @@ interface IngestResult {
  * lines, forever — so it is reported and SKIPPED. A non-monotonic line
  * we have NOT seen before is still real damage and still halts.
  *
+ * A HISTORICAL log-only line (`isLegacyLogOnlyIntent`: a prose payload
+ * under an otherwise projectable entity, written by a mu older than the
+ * flush filter) is skipped silently, exactly as flush and `--from` skip
+ * it. Applying it threw a JSON SyntaxError that rolled back the whole
+ * segment on every invocation.
+ *
+ * A manifest mismatch (layer 4) is reported but does not halt: every
+ * line still present is individually valid, so applying them is safe.
+ *
  * Calls `receiveHlc` per op so the local clock advances past the peer's,
  * which is what makes "laptop edits after seeing the devserver's op" order
  * correctly rather than losing to it.
  */
-declare function ingestSegment(db: Db, peer: PeerSegment): IngestResult;
+declare function ingestSegment(db: Db, peer: PeerSegment, opts?: {
+    verify?: boolean;
+}): IngestResult;
+/**
+ * Apply ONE incoming op and record it in the local `ops` table.
+ *
+ * The shared tail of every ingest path — segment ingest above, and the
+ * `mu sync --from <peer.db>` reader in `src/sync.ts`, which is a
+ * different READER over the same apply semantics. Extracted so the two
+ * cannot drift: a second copy of "advance the clock, apply, record" is
+ * how one of them silently stops advancing the clock.
+ *
+ * Three steps, in this order:
+ *   1. `receiveHlc` BEFORE applying, so anything we mint afterwards
+ *      sorts above the peer's op.
+ *   2. `applyOp`, which is capture-suppressed (no echo op is minted).
+ *   3. Record the op locally so it survives, participates in
+ *      provenance, and can be re-flushed by rebuild. INSERT OR IGNORE
+ *      makes this idempotent via UNIQUE (machine_id, hlc) — the
+ *      property that lets "re-read from zero" be the universal repair.
+ */
 declare function applyIncomingOp(db: Db, op: Op): {
     changed: boolean;
 };
@@ -4767,7 +5124,7 @@ interface SyncPassResult {
 /**
  * One flush + one ingest of every discovered peer.
  *
- * This is the SDK seam `mu sync` (v2-sync) will call; it deliberately
+ * The SDK seam `mu sync` calls (src/cli/sync.ts); it deliberately
  * prints nothing and starts nothing. No daemon, no watcher, no polling
  * loop that outlives the command — the anti-feature pledges are firm, and
  * mu never moves files itself: the operator owns transport.
@@ -4818,7 +5175,12 @@ interface PeerStatus {
     path: string;
     /** True for a Syncthing-style `*.sync-conflict-*.jsonl` copy. */
     conflictCopy: boolean;
-    /** Lines of this peer's segment already applied. */
+    /** `sync_peers` key of this file's watermark (see `PeerSegment`).
+     *  `peerStatuses` always sets it. Optional so SDK callers that build
+     *  the pre-watermarkKey shape still compile; absent means the machine
+     *  id (`peerWatermarkKey`). */
+    watermarkKey?: string;
+    /** Lines of this segment file already applied. */
     watermark: number;
     /** GOOD lines currently in the segment (a defect stops the count). */
     total: number;
@@ -4838,10 +5200,16 @@ declare function peerStatuses(db: Db, dir: string): PeerStatus[];
 /** Resolve an operator-typed peer reference (full machine id, or any
  *  unique prefix) against the discovered peers. Ambiguity is a
  *  UsageError, never a guess — repairing the wrong peer would re-read a
- *  whole segment for nothing and confuse the report. */
+ *  whole segment for nothing and confuse the report.
+ *
+ *  A ref names a MACHINE, so a segment and its conflict copies (same
+ *  machine id) count as one match; the peer's own segment is returned
+ *  when present. Counting them separately made the short id `mu sync`
+ *  prints unresolvable. */
 declare function resolvePeerRef(peers: readonly PeerStatus[], ref: string): PeerStatus;
-/** Reset a peer's watermark so the next ingest re-reads its segment from
- *  zero. Safe by construction: apply is idempotent and `ops` dedupes on
+/** Reset the watermark of every segment file a peer has (its own and
+ *  any conflict copies) so the next ingest re-reads them from zero. Safe
+ *  by construction: apply is idempotent and `ops` dedupes on
  *  `UNIQUE (machine_id, hlc)`. */
 declare function repairPeer(db: Db, ref: string, dir: string): PeerStatus;
 /** Is sync configured at all? THE single `if` the no-sync case pays.
@@ -4880,8 +5248,12 @@ declare function ambientIngest(db: Db, opts?: AmbientOptions): Promise<AmbientRe
  * laptop followed by `mu sync` on the devserver would show nothing —
  * exactly the no-hands claim, broken.
  *
- * Runs under the cross-process file lock inside `flushSegment`, so two
- * concurrent mu processes cannot interleave partial lines.
+ * Appends under the cross-process file lock inside `flushSegment`, so
+ * two concurrent mu processes cannot interleave partial lines. A flush
+ * with nothing to append skips the lock, so read-only verbs never queue.
+ * A flush that cannot take the lock within AMBIENT_FLUSH_LOCK_WAIT_MS
+ * writes nothing (`lockBusy`) and the verb carries on silently: its ops
+ * stay pending in `ops` and the next invocation's flush appends them.
  */
 declare function ambientFlush(db: Db, opts?: AmbientOptions): Promise<FlushResult | null>;
 /**
@@ -4960,6 +5332,7 @@ declare const tmux_PaneNotFoundError: typeof PaneNotFoundError;
 type tmux_SendOptions = SendOptions;
 type tmux_SendWarning = SendWarning;
 type tmux_SplitWindowOptions = SplitWindowOptions;
+type tmux_TmuxBackend = TmuxBackend;
 type tmux_TmuxError = TmuxError;
 declare const tmux_TmuxError: typeof TmuxError;
 type tmux_TmuxExecResult = TmuxExecResult;
@@ -5010,7 +5383,7 @@ declare const tmux_sleep: typeof sleep;
 declare const tmux_splitWindow: typeof splitWindow;
 declare const tmux_tmuxBackend: typeof tmuxBackend;
 declare namespace tmux {
-  export { type tmux_AttachTarget as AttachTarget, type tmux_CaptureOptions as CaptureOptions, type tmux_MuxCommand as MuxCommand, tmux_MuxError as MuxError, type tmux_MuxHealth as MuxHealth, type tmux_NewSessionOptions as NewSessionOptions, type tmux_NewSessionWithPaneOptions as NewSessionWithPaneOptions, type tmux_NewWindowOptions as NewWindowOptions, tmux_PANE_ID_RE as PANE_ID_RE, tmux_PaneNotFoundError as PaneNotFoundError, type tmux_SendOptions as SendOptions, type tmux_SendWarning as SendWarning, type tmux_SplitWindowOptions as SplitWindowOptions, tmux_TmuxError as TmuxError, type tmux_TmuxExecResult as TmuxExecResult, type tmux_TmuxExecutor as TmuxExecutor, type tmux_TmuxPane as TmuxPane, type tmux_TmuxSession as TmuxSession, type tmux_TmuxWindow as TmuxWindow, tmux_assertValidPaneId as assertValidPaneId, tmux_attachCommands as attachCommands, tmux_attachHint as attachHint, tmux_awaitPaneQuiescence as awaitPaneQuiescence, tmux_capturePane as capturePane, tmux_currentAgentName as currentAgentName, tmux_currentPaneTitle as currentPaneTitle, tmux_currentSessionName as currentSessionName, tmux_defaultSendDelayMs as defaultSendDelayMs, tmux_defaultSendReadinessMs as defaultSendReadinessMs, tmux_enableMuPaneBorders as enableMuPaneBorders, tmux_enableMuPaneBordersForPane as enableMuPaneBordersForPane, tmux_enableMuPaneBordersForSession as enableMuPaneBordersForSession, tmux_getPaneTitle as getPaneTitle, tmux_getWindowIdForPane as getWindowIdForPane, tmux_hasWorkMarker as hasWorkMarker, tmux_healthCheck as healthCheck, tmux_isValidPaneId as isValidPaneId, tmux_killPane as killPane, tmux_killSession as killSession, tmux_listPanes as listPanes, tmux_listPanesInSession as listPanesInSession, tmux_listSessions as listSessions, tmux_listWindows as listWindows, tmux_newSession as newSession, tmux_newSessionWithPane as newSessionWithPane, tmux_newWindow as newWindow, tmux_paneExists as paneExists, tmux_paneNotFoundNextSteps as paneNotFoundNextSteps, tmux_paneTTY as paneTTY, tmux_parseAgentNameFromTitle as parseAgentNameFromTitle, tmux_resetSleep as resetSleep, tmux_resetTmuxExecutor as resetTmuxExecutor, tmux_selectLayout as selectLayout, tmux_sendToPane as sendToPane, tmux_sessionExists as sessionExists, tmux_setPaneTitle as setPaneTitle, tmux_setSleepForTests as setSleepForTests, tmux_setTmuxExecutor as setTmuxExecutor, tmux_sleep as sleep, tmux_splitWindow as splitWindow, tmux$1 as tmux, tmux_tmuxBackend as tmuxBackend };
+  export { type tmux_AttachTarget as AttachTarget, type tmux_CaptureOptions as CaptureOptions, type tmux_MuxCommand as MuxCommand, tmux_MuxError as MuxError, type tmux_MuxHealth as MuxHealth, type tmux_NewSessionOptions as NewSessionOptions, type tmux_NewSessionWithPaneOptions as NewSessionWithPaneOptions, type tmux_NewWindowOptions as NewWindowOptions, tmux_PANE_ID_RE as PANE_ID_RE, tmux_PaneNotFoundError as PaneNotFoundError, type tmux_SendOptions as SendOptions, type tmux_SendWarning as SendWarning, type tmux_SplitWindowOptions as SplitWindowOptions, type tmux_TmuxBackend as TmuxBackend, tmux_TmuxError as TmuxError, type tmux_TmuxExecResult as TmuxExecResult, type tmux_TmuxExecutor as TmuxExecutor, type tmux_TmuxPane as TmuxPane, type tmux_TmuxSession as TmuxSession, type tmux_TmuxWindow as TmuxWindow, tmux_assertValidPaneId as assertValidPaneId, tmux_attachCommands as attachCommands, tmux_attachHint as attachHint, tmux_awaitPaneQuiescence as awaitPaneQuiescence, tmux_capturePane as capturePane, tmux_currentAgentName as currentAgentName, tmux_currentPaneTitle as currentPaneTitle, tmux_currentSessionName as currentSessionName, tmux_defaultSendDelayMs as defaultSendDelayMs, tmux_defaultSendReadinessMs as defaultSendReadinessMs, tmux_enableMuPaneBorders as enableMuPaneBorders, tmux_enableMuPaneBordersForPane as enableMuPaneBordersForPane, tmux_enableMuPaneBordersForSession as enableMuPaneBordersForSession, tmux_getPaneTitle as getPaneTitle, tmux_getWindowIdForPane as getWindowIdForPane, tmux_hasWorkMarker as hasWorkMarker, tmux_healthCheck as healthCheck, tmux_isValidPaneId as isValidPaneId, tmux_killPane as killPane, tmux_killSession as killSession, tmux_listPanes as listPanes, tmux_listPanesInSession as listPanesInSession, tmux_listSessions as listSessions, tmux_listWindows as listWindows, tmux_newSession as newSession, tmux_newSessionWithPane as newSessionWithPane, tmux_newWindow as newWindow, tmux_paneExists as paneExists, tmux_paneNotFoundNextSteps as paneNotFoundNextSteps, tmux_paneTTY as paneTTY, tmux_parseAgentNameFromTitle as parseAgentNameFromTitle, tmux_resetSleep as resetSleep, tmux_resetTmuxExecutor as resetTmuxExecutor, tmux_selectLayout as selectLayout, tmux_sendToPane as sendToPane, tmux_sessionExists as sessionExists, tmux_setPaneTitle as setPaneTitle, tmux_setSleepForTests as setSleepForTests, tmux_setTmuxExecutor as setTmuxExecutor, tmux_sleep as sleep, tmux_splitWindow as splitWindow, tmux$1 as tmux, tmux_tmuxBackend as tmuxBackend };
 }
 
 /** What undoing one op will do. */
@@ -5052,8 +5425,9 @@ interface UndoPlan {
 interface UndoResult {
     plan: UndoPlan;
     /** Group id of the ops the UNDO itself wrote — pass this to
-     *  `mu undo` to redo. */
-    undoGroupId: string;
+     *  `mu undo` to redo. Null when no inverse changed a row: the undo
+     *  wrote no ops, so there is no group to redo. */
+    undoGroupId: string | null;
     /** Inverse ops that actually changed a row. */
     applied: number;
 }
@@ -5098,8 +5472,12 @@ declare class UndoSupersededError extends Error implements HasNextSteps {
  * Returns `{ found: false }` when no earlier op named the field, which
  * means the field had no value before this op — so there is nothing to
  * restore and the op must have been part of the row's creation.
+ *
+ * `machineId` limits the lookup to one machine's ops. Undo passes it for
+ * `owner_id`, whose live value only this machine's ops ever wrote (apply
+ * strips it from peers' ops).
  */
-declare function priorFieldValue(db: Db, entity: string, key: string, hlc: string, field: string): {
+declare function priorFieldValue(db: Db, entity: string, key: string, hlc: string, field: string, machineId?: string): {
     found: true;
     value: string | number | null;
 } | {
@@ -5172,8 +5550,10 @@ interface UndoOptions {
 declare function undoGroup(db: Db, groupId: string, opts?: UndoOptions): UndoResult;
 
 declare function isValidWorkstreamName(name: string): boolean;
-/** Thrown by `ensureWorkstream` and `mu workstream init` when the name
- *  doesn't match the rules. */
+/** A workstream name collision. Exported SDK error class mapped to exit
+ *  4 (conflict) by `classifyError`; no mu verb throws it today
+ *  (`ensureWorkstream` is idempotent). Invalid names throw
+ *  `WorkstreamNameInvalidError`. */
 declare class WorkstreamExistsError extends Error implements HasNextSteps {
     readonly workstream: string;
     readonly name: string;
@@ -5186,6 +5566,15 @@ declare class WorkstreamNameInvalidError extends Error implements HasNextSteps {
     constructor(attempted: string);
     errorNextSteps(): NextStep[];
 }
+/** Thrown by `mu workstream init` when the operator tries to create a
+ *  reserved workstream (e.g. `scratch`) explicitly. The name is not
+ *  invalid — it auto-creates on spawn — it just can't be `init`ed. */
+declare class WorkstreamNameReservedError extends Error implements HasNextSteps {
+    readonly attempted: string;
+    readonly name = "WorkstreamNameReservedError";
+    constructor(attempted: string);
+    errorNextSteps(): NextStep[];
+}
 /**
  * Ensure a row exists in the `workstreams` table for `name`. Idempotent;
  * INSERT OR IGNORE so concurrent callers race safely. Called by
@@ -5276,6 +5665,18 @@ interface WorkstreamOptions {
 }
 interface TeardownWorkstreamOptions extends WorkstreamOptions {
 }
+/**
+ * Discover every workstream visible on this machine. The union of:
+ *   - rows in the `workstreams` table (canonical DB source; populated by
+ *     `mu init` and auto-created by insertAgent / addTask)
+ *   - mux sessions named `mu-*` (with the prefix stripped) — catches
+ *     externally-created sessions (e.g. `tmux new-session -s mu-foo`)
+ *     that mu hasn't observed yet
+ *
+ * Returns one `WorkstreamSummary` per workstream, sorted by name.
+ * Useful as a pre-flight before `mu init` ("is this name taken?") and
+ * for `mu doctor`-style diagnostics.
+ */
 declare function listWorkstreams(db: Db): Promise<WorkstreamSummary[]>;
 declare function summarizeWorkstream(db: Db, opts: WorkstreamOptions): Promise<WorkstreamSummary>;
 /**
@@ -5289,4 +5690,4 @@ declare function summarizeWorkstream(db: Db, opts: WorkstreamOptions): Promise<W
  */
 declare function teardownWorkstream(db: Db, opts: TeardownWorkstreamOptions): Promise<TeardownResult>;
 
-export { AGENT_STATE_GLYPH, type AbortAgentOptions, type AbortResult, type AddNoteOptions, type AddTaskOptions, type AdoptAgentOptions, type AdoptAgentResult, AgentAbortNeedsCtlError, AgentAbortTimeoutError, AgentBusyError, AgentCtlUnreachableError, AgentDiedOnSpawnError, AgentExistsError, AgentFreshNeedsCtlError, AgentNotFoundError, AgentNotInWorkstreamError, type AgentRow, AgentSlashCommandUnsupportedError, AgentSpawnCliNotFoundError, AgentSpawnStartupError, type AmbientOptions, type AmbientResult, type AppendLogOptions, type ApplyResult, type BlockEdgeResult, CAPTURE_TRIGGER_DDL, CURRENT_SCHEMA_VERSION, type CaptureDb, type CaptureIntent, type CaptureOptions, type CaseCollision, type CheapDriftReport, type ClaimResult, type ClaimTaskOptions, ClaimerNotRegisteredError, type CloseAgentOptions, type CloseAgentResult, type CloseSubstate, type CloseTaskResult, type CommandResolutionResult, type CommandResolver, CrossWorkstreamEdgeError, type CtlLink, CycleError, DEFAULT_SUBSTATE, DRIFT_REPORT_CAP, type Db, type DeleteTaskResult, type DoctorCheck, type DoctorStatus, type DoctorSummary, DriftDetectedError, type DriftRecord, type DriftReport, EXPECTED_TABLES, type EvidenceOption, type FileLockOptions, type FleetHazard, type FlushResult, type FsProbe, type FullDag, GLYPH, type GroupSummary, type HazardSeverity, type Hlc, HlcOverflowError, HlcParseError, HomeDirAsProjectRootError, type IdFromTitleResult, type IngestFromDbResult, type IngestResult, type InsertAgentInput, InvalidSubstateError, type InverseOp, KNOWN_INTENTS, KNOWN_VERBS, type KickAgentOptions, type KickAgentResult, type KickProcessExecutor, type KickSignal, type KnownIntent, LinkConflictError, type LinkState, type LinkStatus, type ListLiveAgentsOptions, type ListLogsOptions, type ListNotesOptions, type ListReadyOptions, type ListTasksOptions, type LiveAgent, type LiveAgentsView, type LoadFullDagOptions, type LoadWorkstreamSnapshotOptions, type LocalIntent, type LogKind, type LogRow, MACHINE_LOCAL_ENTITIES, MACHINE_LOCAL_TABLES, MU_SHIM_MARKER, MachineIdentityMissingError, type MachineLocalEntity, type MachineLocalLoss, type MachineLocalTable, type MuxBackend, type MuxBackendName, MuxError, type MuxPane, type MuxPaneStatus, type MuxSession, type MuxWindow, type NewSessionOptions, type NewWindowOptions, NoForegroundProcessError, NoMultiplexerError, NothingToUndoError, OP_CTX_DDL, type Op, type OpContext, OpEntityNotSyncedError, OpKeyMalformedError, type OpenDbOptions, type OwnedTasksSummary, PANE_ID_RE, PEER_SHORT_LEN, PEER_STALE_MS, PORTABLE_TABLES, PaneNotFoundError, type ParkTaskOptions, type PeerSegment, type PeerStatus, type PortableTable, type RebuildOptions, type RebuildReport, RebuildTargetExistsError, RebuildTargetIsSourceError, type ReconcileMode, type ReconcileOptions, type ReconcileReport, type ReleaseResult, type ReleaseTaskOptions, type RemoveBlockEdgeResult, type RenderableOp, type RenderedOp, type ReparentTaskResult, type RoiBucket, type RuntimeState, SEGMENT_FORMAT_VERSION, SYNCED_ENTITIES, SchemaTooOldError, type SegmentDefect, type SegmentDefectKind, type SegmentLine, type SegmentManifest, type SendOptions, type SendResult, type SendWarning, type SetStatusOptions, type SetStatusResult, type SlugifyResult, type SpawnAgentOptions, type SplitWindowOptions, type StateReading, type StateSource, type StrandedWorkspaceOrphan, SubstateReasonRequiredError, type SyncPassResult, SyncPeerNotFoundError, SyncPeerRefAmbiguousError, SyncSourceNotFoundError, type SyncedEntity, TASK_STATUSES, TASK_STATUS_LIST, TASK_SUBSTATES, TASK_SUBSTATE_ROWS, TaskAlreadyOwnedError, type TaskEdgeWithStatus, type TaskEdges, type TaskEdgesWithStatus, TaskExistsError, TaskInTriageError, TaskNotFoundError, TaskNotInWorkstreamError, type TaskNoteRow, type TaskPair, TaskParkStateError, TaskParkedError, type TaskRow, type TaskStatus, type TaskSubstate, type TaskWaitOptions, type TaskWaitRef, type TaskWaitResult, type TaskWaitTaskState, type TeardownResult, TmuxError, type TmuxExecResult, type TmuxExecutor, type TmuxPane, type TmuxSession, type TmuxWindow, type Track, type Transport, UNKNOWN_REASON, UndoGroupNotFoundError, type UndoOptions, type UndoPlan, type UndoResult, UndoSupersededError, type UpdateTaskOptions, type UpdateTaskResult, type VcsBackend, type VcsBackendName, WORKSPACE_STALE_THRESHOLD, WorkspaceExistsError, type WorkspaceFailure, WorkspaceNotFoundError, type WorkspaceOrphan, WorkspacePathNotEmptyError, WorkspacePreservedError, type WorkspaceRow, type WorkspaceStaleness, WorkstreamExistsError, WorkstreamNameInvalidError, type WorkstreamOptions, type WorkstreamSnapshot, type WorkstreamSnapshotSlowFields, type WorkstreamSummary, abortAgent, acceptTask, activeMux, addBlockEdge, addNote, addTask, adoptAgent, agentKey, agentStateGlyph, agentStateHistogram, ambientFlush, ambientIngest, ambientSyncPass, appendLog, applyIncomingOp, applyOp, applyOps, assertValidPaneId, awaitPaneQuiescence, backendByName, capturePane, checkCaseCollisions, checkCheapDriftInvariant, checkCommandResolvable, checkDbInsideSyncDir, checkDrift, checkFleetHazards, checkNetworkMount, claimTask, classifyFsType, closeAgent, closeTask, compareHlc, composeAgentTitle, countProblems, createWorkspace, ctlRuntimeState, currentAgentName, currentOpContext, currentPaneTitle, decorateWithDirty, decorateWithStaleness, defaultDbPath, defaultSendDelayMs, defaultSendReadinessMs, defaultSpawnLivenessMs, defaultStateDir, deleteAgent, deleteTask, detectBackend, detectMux, discoverPeers, driftRemediation, emitEvent, ensureWorkstream, envVarNameForCli, expectsCtl, findCaseCollisions, flushSegment, foregroundPgid, formatDriftRecord, formatHlc, formatPair, freeWorkspace, getAgent, getAgentByPane, getParallelTracks, getPrerequisites, getTask, getTaskEdges, getTaskEdgesWithStatus, getWaitPollCount, getWatermark, getWorkspaceForAgent, getWorkspaceStaleness, gitBackend, hasWorkMarker, idFromTitle, idFromTitleVerbose, ingestFromDb, ingestSegment, insertAgent, inspectLinks, installCapture, interruptAgent, isKickSignal, isPathInside, isTaskStatus, isValidAgentName, isValidPair, isValidPaneId, isValidTaskId, isValidWorkstreamName, isWorkspaceStale, jjBackend, kickAgent, killPane, killSession, latestSeq, linkPi, linkSkill, listAgents, listAllOrphanWorkspaces, listBlocked, listGoals, listInProgress, listLiveAgents, listLogs, listNotes, listPanes, listPanesInSession, listReady, listRecentClosed, listRecentGroups, listSessions, listTasks, listTasksByOwner, listWindows, listWorkspaceOrphans, listWorkspaces, listWorkstreams, loadDoctorChecks, loadDoctorSummary, loadFullDag, loadWorkstreamSnapshot, loadWorkstreamSnapshotFast, loadWorkstreamSnapshotSlow, localMachineId, locksDir, mapLegacyStatus, mergeSnapshotFastSlow, mostRecentGroup, murmurAvailable, mux, muxByName, newSession, newSessionWithPane, newWindow, nextHlc, noneBackend, opSubject, openDb, openTask, paneExists, paneTTY, parkTask, parseAgentNameFromTitle, parseHlc, parseOpKey, parsePsTtyOutput, peerStatuses, planUndo, priorFieldValue, probeFilesystem, readAgent, readAgentStates, readFileLockMeta, readManifest, rebuildInto, receiveHlc, reconcile, refreshAgentTitle, releaseTask, remediationParagraph, removeBlockEdge, renderForest, renderOp, renderOpLine, renderTaskTree, repairPeer, reparentTask, resetCommandResolverForTests, resetKickProcessExecutor, resetMux, resetSleep, resetTmuxExecutor, resetWaitPollCount, resetWatermark, resolveActorIdentity, resolveCliCommand, resolveCliCommandWithSource, resolveGroupId, resolvePair, resolvePeerRef, roiBucket, segmentLineCount, segmentPath, selectLayout, sendToAgent, sendToPane, sendViaTransport, sessionExists, setCommandResolverForTests, setKickProcessExecutor, setMuxForTests, setPaneTitle, setSleepForTests, setTaskStatus, setTmuxExecutor, setWaitSleepForTests, setWaitStuckWarnForTests, setWatermark, slBackend, sleep, slugifyTitle, slugifyTitleVerbose, spawnAgent, splitWindow, summarizeOwnedTasks, summarizeWorkstream, syncDir, syncEnabled, syncPass, teardownWorkstream, tmux, tmuxBackend, transportNextSteps, undoGroup, unparkTask, updateTask, verifyAgainstManifest, waitForTasks, withCaptureSuppressed, withFileLock, withOpContext, workspacePath, workspacesRoot, yankCommandForCheck };
+export { AGENT_STATE_GLYPH, type AbortAgentOptions, type AbortResult, type AddNoteOptions, type AddTaskOptions, type AdoptAgentOptions, type AdoptAgentResult, AgentAbortNeedsCtlError, AgentAbortTimeoutError, AgentBusyError, AgentCtlUnreachableError, AgentDiedOnSpawnError, AgentExistsError, AgentExtensionOutdatedError, AgentFreshNeedsCtlError, AgentNameExhaustedError, AgentNotFoundError, AgentNotInWorkstreamError, type AgentRow, AgentSlashCommandUnsupportedError, AgentSpawnCliNotFoundError, AgentSpawnStartupError, type AmbientOptions, type AmbientResult, type AppendLogOptions, type ApplyResult, type BlockEdgeResult, CAPTURE_TRIGGER_DDL, CURRENT_SCHEMA_VERSION, type CaptureDb, type CaptureIntent, type CaptureOptions, type CaseCollision, type CheapDriftReport, type ClaimResult, type ClaimTaskOptions, ClaimerNotRegisteredError, type CloseAgentOptions, type CloseAgentResult, type CloseSubstate, type CloseTaskResult, type CommandResolutionResult, type CommandResolver, CrossWorkstreamEdgeError, type CtlLink, CycleError, DEFAULT_SUBSTATE, DRIFT_REPORT_CAP, type Db, type DeleteTaskResult, type DoctorCheck, type DoctorStatus, type DoctorSummary, DriftDetectedError, type DriftRecord, type DriftReport, EXPECTED_TABLES, type EvidenceOption, type FileLockOptions, type FleetHazard, type FlushResult, type FsProbe, type FullDag, GLYPH, GroupIdAmbiguousError, type GroupSummary, HazardFailError, type HazardSeverity, type Hlc, HlcOverflowError, HlcParseError, HomeDirAsProjectRootError, type IdFromTitleResult, type IngestFromDbResult, type IngestResult, type InsertAgentInput, InvalidSubstateError, type InverseOp, KNOWN_INTENTS, KNOWN_VERBS, type KickAgentOptions, type KickAgentResult, type KickProcessExecutor, type KickSignal, type KnownIntent, LinkConflictError, type LinkState, type LinkStatus, type ListLiveAgentsOptions, type ListLogsOptions, type ListNotesOptions, type ListReadyOptions, type ListTasksOptions, type LiveAgent, type LiveAgentsView, type LoadFullDagOptions, type LoadWorkstreamSnapshotOptions, type LocalIntent, type LogKind, LogKindReservedError, type LogRow, MACHINE_LOCAL_ENTITIES, MACHINE_LOCAL_TABLES, MU_SHIM_MARKER, MachineIdentityMissingError, type MachineLocalEntity, type MachineLocalLoss, type MachineLocalTable, type MuxBackend, type MuxBackendName, MuxError, type MuxPane, type MuxPaneStatus, type MuxSession, type MuxWindow, type NewSessionOptions, type NewWindowOptions, NoForegroundProcessError, NoMultiplexerError, NothingToUndoError, OP_CTX_DDL, type Op, type OpContext, OpEntityNotSyncedError, OpKeyMalformedError, type OpenDbOptions, type OwnedTasksSummary, PANE_ID_RE, PEER_SHORT_LEN, PEER_STALE_MS, PORTABLE_TABLES, PaneNotFoundError, PaneNotInSessionError, type ParkTaskOptions, type PeerSegment, type PeerStatus, type PortableTable, ReaperDetectedDuringWaitError, type RebuildOptions, type RebuildReport, RebuildTargetExistsError, RebuildTargetIsSourceError, type ReconcileMode, type ReconcileOptions, type ReconcileReport, type ReleaseResult, type ReleaseTaskOptions, type RemoveBlockEdgeResult, type RenderableOp, type RenderedOp, type ReparentTaskResult, type RoiBucket, type RuntimeState, SEGMENT_FORMAT_VERSION, SYNCED_ENTITIES, SchemaTooNewError, SchemaTooOldError, type SegmentDefect, type SegmentDefectKind, type SegmentLine, type SegmentManifest, type SendOptions, type SendResult, type SendWarning, type SetStatusOptions, type SetStatusResult, type SlugifyResult, type SpawnAgentOptions, type SplitWindowOptions, StallDetectedDuringWaitError, type StateReading, type StateSource, type StrandedWorkspaceOrphan, SubstateReasonRequiredError, type SyncPassResult, SyncPeerNotFoundError, SyncPeerRefAmbiguousError, SyncSourceNotFoundError, type SyncedEntity, TASK_STATUSES, TASK_STATUS_LIST, TASK_SUBSTATES, TASK_SUBSTATE_ROWS, TaskAlreadyOwnedError, TaskClaimStaleWorkspaceError, type TaskEdgeWithStatus, type TaskEdges, type TaskEdgesWithStatus, TaskExistsError, TaskIdInvalidError, TaskInTriageError, TaskNotFoundError, TaskNotInWorkstreamError, type TaskNoteRow, type TaskPair, TaskParkStateError, TaskParkedError, type TaskRow, type TaskStatus, type TaskSubstate, TaskTitleSlugEmptyError, type TaskWaitOptions, type TaskWaitRef, type TaskWaitResult, type TaskWaitTaskState, type TeardownResult, TmuxError, type TmuxExecResult, type TmuxExecutor, type TmuxPane, type TmuxSession, type TmuxWindow, type Track, type Transport, UNKNOWN_REASON, UndoGroupNotFoundError, type UndoOptions, type UndoPlan, type UndoResult, UndoSupersededError, type UpdateTaskOptions, type UpdateTaskResult, type VcsBackend, type VcsBackendName, WORKSPACE_STALE_THRESHOLD, WorkspaceConflictError, WorkspaceDirtyError, WorkspaceExistsError, type WorkspaceFailure, WorkspaceNotFoundError, type WorkspaceOrphan, WorkspacePathNotEmptyError, WorkspacePreservedError, type WorkspaceRow, type WorkspaceStaleness, WorkspaceVcsRequiredError, WorkstreamExistsError, WorkstreamNameInvalidError, WorkstreamNameReservedError, WorkstreamNotFoundError, type WorkstreamOptions, type WorkstreamSnapshot, type WorkstreamSnapshotSlowFields, type WorkstreamSummary, abortAgent, acceptTask, activeMux, addBlockEdge, addNote, addTask, adoptAgent, agentKey, agentStateGlyph, agentStateHistogram, ambientFlush, ambientIngest, ambientSyncPass, appendLog, applyIncomingOp, applyOp, applyOps, assertValidPaneId, awaitPaneQuiescence, backendByName, capturePane, checkCaseCollisions, checkCheapDriftInvariant, checkCommandResolvable, checkDbInsideSyncDir, checkDrift, checkFleetHazards, checkNetworkMount, claimTask, classifyFsType, closeAgent, closeTask, compareHlc, composeAgentTitle, countProblems, createWorkspace, ctlRuntimeState, currentAgentName, currentOpContext, currentPaneTitle, decorateWithDirty, decorateWithStaleness, defaultDbPath, defaultSendDelayMs, defaultSendReadinessMs, defaultSpawnLivenessMs, defaultStateDir, deleteAgent, deleteTask, detectBackend, detectMux, discoverPeers, driftRemediation, emitEvent, ensureWorkstream, envVarNameForCli, expectsCtl, findCaseCollisions, flushSegment, foregroundPgid, formatDriftRecord, formatHlc, formatPair, freeWorkspace, getAgent, getAgentByPane, getParallelTracks, getPrerequisites, getTask, getTaskEdges, getTaskEdgesWithStatus, getWaitPollCount, getWatermark, getWorkspaceForAgent, getWorkspaceStaleness, gitBackend, hasWorkMarker, idFromTitle, idFromTitleVerbose, ingestFromDb, ingestSegment, insertAgent, inspectLinks, installCapture, interruptAgent, isKickSignal, isPathInside, isTaskStatus, isValidAgentName, isValidPair, isValidPaneId, isValidTaskId, isValidWorkstreamName, isWorkspaceStale, jjBackend, kickAgent, killPane, killSession, latestSeq, linkPi, linkSkill, listAgents, listAllOrphanWorkspaces, listBlocked, listGoals, listInProgress, listLiveAgents, listLogs, listNotes, listPanes, listPanesInSession, listReady, listRecentClosed, listRecentGroups, listSessions, listTasks, listTasksByOwner, listWindows, listWorkspaceOrphans, listWorkspaces, listWorkstreams, loadDoctorChecks, loadDoctorSummary, loadFullDag, loadWorkstreamSnapshot, loadWorkstreamSnapshotFast, loadWorkstreamSnapshotSlow, localMachineId, locksDir, mapLegacyStatus, mergeSnapshotFastSlow, mostRecentGroup, murmurAvailable, mux, muxByName, newSession, newSessionWithPane, newWindow, nextHlc, noneBackend, opSubject, openDb, openTask, paneExists, paneTTY, parkTask, parseAgentNameFromTitle, parseHlc, parseOpKey, parsePsTtyOutput, peerStatuses, planUndo, priorFieldValue, probeFilesystem, readAgent, readAgentStates, readFileLockMeta, readManifest, rebuildInto, receiveHlc, reconcile, refreshAgentTitle, releaseTask, remediationParagraph, removeBlockEdge, renderForest, renderOp, renderOpLine, renderTaskTree, repairPeer, reparentTask, resetCommandResolverForTests, resetKickProcessExecutor, resetMux, resetSleep, resetTmuxExecutor, resetWaitPollCount, resetWatermark, resolveActorIdentity, resolveCliCommand, resolveCliCommandWithSource, resolveGroupId, resolvePair, resolvePeerRef, roiBucket, segmentLineCount, segmentPath, selectLayout, sendToAgent, sendToPane, sendViaTransport, sessionExists, setCommandResolverForTests, setKickProcessExecutor, setMuxForTests, setPaneTitle, setSleepForTests, setTaskStatus, setTmuxExecutor, setWaitSleepForTests, setWaitStuckWarnForTests, setWatermark, slBackend, sleep, slugifyTitle, slugifyTitleVerbose, spawnAgent, splitWindow, summarizeOwnedTasks, summarizeWorkstream, syncDir, syncEnabled, syncPass, teardownWorkstream, tmux, tmuxBackend, transportNextSteps, undoGroup, unparkTask, updateTask, verifyAgainstManifest, waitForTasks, withCaptureSuppressed, withFileLock, withOpContext, workspacePath, workspacesRoot, yankCommandForCheck };