heyspex 0.1.0 → 0.2.0

package/dist/cli/hs-workspace.mjs

@@ -5,8 +5,290 @@ var __esm = (fn, res) => function __init() {
   return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
 };
 
+// vendor/heyspex-mcp/credentials.mjs
+import { mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import os, { homedir } from "node:os";
+import { dirname as dirname2, join as join2, resolve } from "node:path";
+function credentialsFilePath(homeDir = homedir()) {
+  return join2(homeDir, ".heyspex", "credentials.yaml");
+}
+function parseMcpToken(raw) {
+  if (typeof raw !== "string" || raw.length === 0) return null;
+  const token = raw.match(MCP_TOKEN_LINE_RE)?.[1]?.trim();
+  return token ? token : null;
+}
+function isValidAccountId(id) {
+  return typeof id === "string" && ACCOUNT_ID_RE.test(id);
+}
+function topLevelScalar(raw, key) {
+  const re = new RegExp(`^${key}:[ \\t]*["']?([^"'\\r\\n#]+)`, "m");
+  const value = raw.match(re)?.[1]?.trim();
+  return value ? value : null;
+}
+function decodeScalar(text2) {
+  const t = text2.trim();
+  if (t === "" || t === "null" || t === "~") return null;
+  if (t.startsWith('"')) {
+    try {
+      const v = JSON.parse(t);
+      return typeof v === "string" && v ? v : null;
+    } catch {
+      return t.replace(/^"|"$/g, "") || null;
+    }
+  }
+  if (t.startsWith("'")) return t.replace(/^'|'$/g, "") || null;
+  const bare = t.replace(/\s+#.*$/, "").trim();
+  return bare || null;
+}
+function emptyAccount() {
+  return { mcp_token: null, console_url: null, email: null, paired_at: null };
+}
+function findAccountsBlock(lines) {
+  const start = lines.findIndex((l) => /^accounts:[ \t]*(#.*)?$/.test(l));
+  if (start < 0) return null;
+  let end = start + 1;
+  while (end < lines.length && (lines[end].trim() === "" || /^[ \t]/.test(lines[end]))) end += 1;
+  while (end > start + 1 && lines[end - 1].trim() === "") end -= 1;
+  return { start, end };
+}
+function parseAccountsBlock(lines) {
+  const accounts = {};
+  const block = findAccountsBlock(lines);
+  if (!block) return accounts;
+  let current = null;
+  for (const line of lines.slice(block.start + 1, block.end)) {
+    const header = line.match(/^ {2}([^\s:#][^:]*):[ \t]*(#.*)?$/);
+    if (header) {
+      const id = decodeScalar(header[1]);
+      current = isValidAccountId(id) ? id : null;
+      if (current) accounts[current] = emptyAccount();
+      continue;
+    }
+    const field = line.match(/^ {4}([a-z_]+):(.*)$/);
+    if (field && current && ACCOUNT_FIELDS.includes(field[1])) {
+      accounts[current][field[1]] = decodeScalar(field[2]);
+    }
+  }
+  return accounts;
+}
+function parseCredentialsStore(raw) {
+  const text2 = typeof raw === "string" ? raw : "";
+  if (topLevelScalar(text2, "schema_version") !== String(CREDENTIALS_SCHEMA_VERSION)) {
+    const token = parseMcpToken(text2);
+    if (!token) return { schemaVersion: 1, currentAccountId: null, accounts: {} };
+    return {
+      schemaVersion: 1,
+      currentAccountId: LEGACY_ACCOUNT_ID,
+      accounts: {
+        [LEGACY_ACCOUNT_ID]: { ...emptyAccount(), mcp_token: token, console_url: topLevelScalar(text2, "console_url") }
+      }
+    };
+  }
+  const accounts = parseAccountsBlock(text2.split(/\r?\n/));
+  const current = topLevelScalar(text2, "current_account_id");
+  return {
+    schemaVersion: 2,
+    currentAccountId: current && accounts[current] ? current : null,
+    accounts
+  };
+}
+function resolveBearer({ envToken, credentialsText, accountId: accountId2, legacyAccountId } = {}) {
+  const fromEnv = typeof envToken === "string" ? envToken.trim() : "";
+  if (fromEnv) return { token: fromEnv, source: "env" };
+  const store = parseCredentialsStore(credentialsText);
+  let entry;
+  if (typeof accountId2 === "string" && accountId2.trim()) {
+    const wanted = accountId2.trim();
+    entry = store.accounts[wanted];
+    if (!entry && store.schemaVersion === 1 && legacyAccountId && wanted === legacyAccountId) {
+      entry = store.accounts[LEGACY_ACCOUNT_ID];
+    }
+  } else {
+    entry = store.currentAccountId ? store.accounts[store.currentAccountId] : void 0;
+  }
+  if (entry?.mcp_token) return { token: entry.mcp_token, source: "credentials-file" };
+  return { token: null, source: null };
+}
+function readTextOrNull(read, path4) {
+  try {
+    const raw = read(path4);
+    return typeof raw === "string" ? raw : null;
+  } catch {
+    return null;
+  }
+}
+function readLegacyConfigAccountId(read, homeDir) {
+  const raw = readTextOrNull(read, join2(homeDir, ".heyspex", "config.yaml"));
+  const value = raw?.match(CONFIG_ACCOUNT_ID_RE)?.[1]?.trim() ?? "";
+  return value || null;
+}
+function readBearer({ env = process.env, homeDir = homedir(), readFile: readFile2, accountId: accountId2 } = {}) {
+  const read = readFile2 ?? ((p) => readFileSync(p, "utf8"));
+  const credentialsText = readTextOrNull(read, credentialsFilePath(homeDir));
+  const named = typeof accountId2 === "string" && accountId2.trim() ? accountId2.trim() : null;
+  const legacyAccountId = named && parseCredentialsStore(credentialsText).schemaVersion === 1 ? readLegacyConfigAccountId(read, homeDir) : null;
+  return resolveBearer({ envToken: env?.[MCP_TOKEN_ENV], credentialsText, accountId: named, legacyAccountId });
+}
+function readCurrentAccountId({ homeDir = homedir(), readFile: readFile2 } = {}) {
+  const read = readFile2 ?? ((p) => readFileSync(p, "utf8"));
+  const store = parseCredentialsStore(readTextOrNull(read, credentialsFilePath(homeDir)));
+  if (store.schemaVersion === 2 && store.currentAccountId && store.currentAccountId !== LEGACY_ACCOUNT_ID) {
+    return store.currentAccountId;
+  }
+  if (store.schemaVersion === 2 && store.currentAccountId === null) return null;
+  return readLegacyConfigAccountId(read, homeDir);
+}
+function describeBearerSource(source) {
+  if (source === "env") return `${MCP_TOKEN_ENV} (env)`;
+  if (source === "credentials-file") return "~/.heyspex/credentials.yaml (mcp_token)";
+  return "none";
+}
+var MCP_TOKEN_ENV, MCP_TOKEN_LINE_RE, CREDENTIALS_SCHEMA_VERSION, LEGACY_ACCOUNT_ID, ACCOUNT_FIELDS, ACCOUNT_ID_RE, CONFIG_ACCOUNT_ID_RE;
+var init_credentials = __esm({
+  "vendor/heyspex-mcp/credentials.mjs"() {
+    "use strict";
+    MCP_TOKEN_ENV = "HEYSPEX_MCP_TOKEN";
+    MCP_TOKEN_LINE_RE = /^mcp_token:[ \t]*["']?([^"'\r\n#]+)/m;
+    CREDENTIALS_SCHEMA_VERSION = 2;
+    LEGACY_ACCOUNT_ID = "legacy";
+    ACCOUNT_FIELDS = ["mcp_token", "console_url", "email", "paired_at"];
+    ACCOUNT_ID_RE = /^[A-Za-z0-9][A-Za-z0-9_.@+-]*$/;
+    CONFIG_ACCOUNT_ID_RE = /^account_id:\s*["']?([^"'\r\n#]+)/m;
+  }
+});
+
+// scripts/lib/dev-mode.mjs
+import { mkdirSync as mkdirSync3, readFileSync as readFileSync6, writeFileSync as writeFileSync3 } from "node:fs";
+import { homedir as homedir6 } from "node:os";
+import { join as join7 } from "node:path";
+function devModeFilePath(homeDir = homedir6()) {
+  return join7(homeDir, ".heyspex", DEV_MODE_FILENAME);
+}
+function normalizeMode(raw) {
+  const v = String(raw ?? "").trim().toLowerCase();
+  if (v === "prod" || v === "production") return { mode: "prod", reliance: "cloud" };
+  if (v === "dev") return { mode: "dev", reliance: null };
+  if (v === "local") return { mode: "dev", reliance: "local" };
+  if (v === "cloud") return { mode: "dev", reliance: "cloud" };
+  return null;
+}
+function normalizeReliance(raw) {
+  const v = String(raw ?? "").trim().toLowerCase();
+  return v === "local" || v === "cloud" ? v : null;
+}
+function deriveSemantics(mode, reliance) {
+  const effectiveReliance = mode === "prod" ? "cloud" : reliance ?? "local";
+  const local = mode === "dev" && effectiveReliance === "local";
+  return {
+    reliance: effectiveReliance,
+    consoleUrl: local ? LOCAL_CONSOLE_URL : CLOUD_CONSOLE_URL,
+    readTier: local ? "disk" : "neon",
+    vaultWriteMode: local ? "local" : "cloud"
+  };
+}
+function readLocalDevModeRecord({ homeDir = homedir6(), readFile: readFile2 = defaultReadFile } = {}) {
+  let raw;
+  try {
+    raw = readFile2(devModeFilePath(homeDir));
+  } catch {
+    return { record: null, parseError: null };
+  }
+  try {
+    const parsed = JSON.parse(raw);
+    const mode = parsed?.mode === "prod" || parsed?.mode === "dev" ? parsed.mode : null;
+    const reliance = normalizeReliance(parsed?.reliance);
+    if (!mode || mode === "dev" && !reliance) {
+      return { record: null, parseError: `invalid dev-mode record: ${JSON.stringify(parsed)}` };
+    }
+    return {
+      record: {
+        mode,
+        reliance: mode === "prod" ? "cloud" : reliance,
+        console_url: typeof parsed.console_url === "string" ? parsed.console_url : null,
+        updated_at: typeof parsed.updated_at === "string" ? parsed.updated_at : null,
+        source: typeof parsed.source === "string" ? parsed.source : null
+      },
+      parseError: null
+    };
+  } catch (err) {
+    return { record: null, parseError: `unparseable dev-mode.json: ${String(err?.message ?? err)}` };
+  }
+}
+function resolveDevMode({
+  env = process.env,
+  homeDir = homedir6(),
+  readFile: readFile2 = defaultReadFile,
+  cloudSetting = void 0
+} = {}) {
+  const local = readLocalDevModeRecord({ homeDir, readFile: readFile2 });
+  const cloudKnown = cloudSetting !== void 0;
+  const cloudValue = cloudKnown && cloudSetting ? {
+    mode: cloudSetting.mode === "dev" ? "dev" : "prod",
+    reliance: normalizeReliance(cloudSetting.reliance) ?? "cloud"
+  } : null;
+  let mode;
+  let reliance;
+  let source;
+  let relianceSource;
+  const envParsed = normalizeMode(env.HEYSPEX_DEV_MODE);
+  if (envParsed) {
+    mode = envParsed.mode;
+    const envReliance = envParsed.reliance ?? normalizeReliance(env.HEYSPEX_DEV_RELIANCE);
+    reliance = envReliance ?? "local";
+    source = "env";
+    relianceSource = envReliance ? "env" : "assumed-local";
+  } else if (local.record) {
+    mode = local.record.mode;
+    reliance = local.record.reliance;
+    source = "local-override";
+  } else if (cloudValue) {
+    mode = cloudValue.mode;
+    reliance = cloudValue.reliance;
+    source = "cloud-setting";
+  } else {
+    mode = "prod";
+    reliance = "cloud";
+    source = "default";
+  }
+  const semantics = deriveSemantics(mode, reliance);
+  const consoleUrl = source === "local-override" && local.record?.console_url ? local.record.console_url.replace(/\/+$/, "") : semantics.consoleUrl;
+  const staleAgainstCloud = source === "local-override" && cloudValue !== null && (cloudValue.mode !== mode || mode === "dev" && cloudValue.reliance !== semantics.reliance);
+  return {
+    mode,
+    reliance: semantics.reliance,
+    consoleUrl,
+    readTier: semantics.readTier,
+    vaultWriteMode: semantics.vaultWriteMode,
+    sources: {
+      mode: source,
+      reliance: relianceSource ?? source,
+      consoleUrl: source === "local-override" && local.record?.console_url ? "local-override" : "derived",
+      readTier: "derived",
+      vaultWriteMode: "derived"
+    },
+    localOverride: {
+      present: local.record !== null,
+      record: local.record,
+      parseError: local.parseError,
+      staleAgainstCloud
+    },
+    cloudSetting: { known: cloudKnown, value: cloudValue }
+  };
+}
+var CLOUD_CONSOLE_URL, LOCAL_CONSOLE_URL, DEV_MODE_FILENAME, defaultReadFile;
+var init_dev_mode = __esm({
+  "scripts/lib/dev-mode.mjs"() {
+    "use strict";
+    init_credentials();
+    CLOUD_CONSOLE_URL = "https://app.heyspex.com";
+    LOCAL_CONSOLE_URL = "http://localhost:3000";
+    DEV_MODE_FILENAME = "dev-mode.json";
+    defaultReadFile = (p) => readFileSync6(p, "utf8");
+  }
+});
+
 // dist/cli/._sql-orm-inert.cli-shim.mjs
-var inert, sql, and, eq, bigint, bigserial, boolean, foreignKey, index, integer, jsonb, pgEnum, pgTable, primaryKey, text, timestamp, uniqueIndex;
+var inert, customType, sql, and, eq, bigint, bigserial, boolean, foreignKey, index, integer, jsonb, pgEnum, pgTable, primaryKey, text, timestamp, uniqueIndex;
 var init_sql_orm_inert_cli_shim = __esm({
   "dist/cli/._sql-orm-inert.cli-shim.mjs"() {
     "use strict";
@@ -24,6 +306,7 @@ var init_sql_orm_inert_cli_shim = __esm({
         return inert;
       }
     });
+    customType = inert;
     sql = inert;
     and = inert;
     eq = inert;
@@ -69,7 +352,7 @@ var init_interfaces = __esm({
 });
 
 // spex-console/src/lib/db/schema/postgres.ts
-var edgeTypeEnum, validationSeverityEnum, outboxOpEnum, specs, tags, edges, wikilinks, aliases, validationIssues, indexMeta, frontmatterFields, eventOutbox, captureSessions, handoffContext, claimEventKindEnum, activeClaimStatusEnum, pendingReasonEnum, focusEventKindEnum, specEventKindEnum, focusPin, captureFocusPin, captureFocusSelection, focusSelection, focusSkips, activeClaims, claimWaiters, claimEvents, focusEvents, focusAreas, focusAreasEvents, specEvents, rateLimitBuckets, userVaults, milestoneSnapshots, modelRegistryEntries, launchIntentStatusEnum, launchIntents, companionRelayPresence, companionSettingsStore, wipLedger, gatherResults, agentSessions, usageEvents, streamEvents, jobStreams, resolutionStatusEnum, resolutionFocusPin, resolutionLedger, workspaces, vaults, accountSettings, vaultGrants, githubInstallations, fleetMachines, fleetTasks, fleetResults, userApiKeys, apiKeys, mcpSessions, pairingCodes, companionSessions, inviteRequests, notifications, webhookIngestions, specSettlements;
+var edgeTypeEnum, validationSeverityEnum, outboxOpEnum, tsvector, specs, tags, edges, wikilinks, specLinks, aliases, validationIssues, indexMeta, frontmatterFields, eventOutbox, captureSessions, handoffContext, claimEventKindEnum, activeClaimStatusEnum, pendingReasonEnum, focusEventKindEnum, specEventKindEnum, focusPin, captureFocusPin, captureFocusSelection, focusSelection, focusSkips, activeClaims, claimWaiters, fileClaims, claimEvents, focusEvents, focusAreas, focusAreasEvents, specEvents, rateLimitBuckets, userVaults, milestoneSnapshots, modelRegistryEntries, launchIntentStatusEnum, launchIntents, companionRelayPresence, companionSettingsStore, consoleSettingsStore, wipLedger, wipLedgerArchive, gatherResults, agentSessions, usageEvents, streamEvents, jobStreams, resolutionStatusEnum, resolutionFocusPin, resolutionLedger, workspaces, vaults, accountSettings, vaultGrants, pendingVaultGrants, githubInstallations, fleetMachines, fleetTasks, fleetResults, userApiKeys, apiKeys, mcpSessions, pairingCodes, companionSessions, inviteRequests, notifications, webhookIngestions, specSettlements;
 var init_postgres = __esm({
   "spex-console/src/lib/db/schema/postgres.ts"() {
     "use strict";
@@ -84,6 +367,11 @@ var init_postgres = __esm({
     ]);
     validationSeverityEnum = pgEnum("validation_severity", ["error", "warning"]);
     outboxOpEnum = pgEnum("outbox_op", ["upsert", "delete"]);
+    tsvector = customType({
+      dataType() {
+        return "tsvector";
+      }
+    });
     specs = pgTable(
       "specs",
       {
@@ -124,11 +412,47 @@ var init_postgres = __esm({
         // `family:` field when present, else derives it via `familyOf` (parse
         // fallback from `id`/basename). Nothing should string-parse family from `id`
         // once this column is populated — see `dev-factory/handoffs/NAMING-V3-MIGRATION-BRIEF.md`.
-        family: text("family")
+        family: text("family"),
+        // Lexical search vector ([[HS-0E1G-8KK5-TASK-generated-search-vector-column-gin]]
+        // of [[HS-FI33-8KK5-EPIC-lexical-retrieval-in-postgres-generated]]; research:
+        // [[HS-HPEH-8KK5-RES-infinitely-scaling-spec-vault-nothing]] §Lexical retrieval).
+        // GENERATED ALWAYS … STORED: Postgres rewrites it on every INSERT/UPDATE of
+        // `name` / `body_text`, so the write path never touches it and it can never
+        // drift from the row. `coalesce` is mandatory — a NULL operand poisons the
+        // whole vector (NULL || tsvector = NULL). Title is weight A, body weight B so
+        // `ts_rank_cd` ranks a title hit above a body hit. Two-argument
+        // `to_tsvector('english', …)` is required inside a generated column (the
+        // one-argument form depends on a session setting and is not IMMUTABLE).
+        // Still lexical-only: no embeddings ([[retrieval-substrate-lexical-not-embeddings-gate-b-no]]).
+        searchVector: tsvector("search_vector").generatedAlwaysAs(
+          sql`setweight(to_tsvector('english', coalesce("name", '')), 'A') || setweight(to_tsvector('english', coalesce("body_text", '')), 'B')`
+        ),
+        // Single-column tenant-qualified key ([[HS-ZUZF-8KK5-TASK-per-vault-database-routing-switch-and]]
+        // of [[HS-91S9-8KK5-EPIC-large-tenant-tier-bm25-search]]). The specs PRIMARY
+        // KEY is COMPOSITE (vault_id, id) — but ParadeDB `pg_search` (the BM25 task,
+        // [[HS-KZJ1-8KK5-TASK-bm25-pg-search-index-and-query-path]]) requires a
+        // SINGLE-column unique key for its index. `vault_id || ':' || id` is that
+        // key: both operands are NOT NULL so no `coalesce` is needed (unlike
+        // `search_vector` above), `||` on text is IMMUTABLE so it is legal in a
+        // GENERATED … STORED expression, and STORED means the write path never sets
+        // it and it can never drift from the row. The unique index below is the
+        // constraint pg_search will point at.
+        specKey: text("spec_key").generatedAlwaysAs(sql`"vault_id" || ':' || "id"`)
       },
       (table) => [
         // Composite PK (vault_id, id): the same HS-XXXX id may exist once PER VAULT.
         primaryKey({ columns: [table.vaultId, table.id] }),
+        // Full-text search: `search_vector @@ websearch_to_tsquery('english', $q)`
+        // answers from this GIN index instead of scanning bodies. Built plainly in
+        // the migration (scripts/migrate.mjs wraps each migration in a transaction,
+        // and CREATE INDEX CONCURRENTLY cannot run inside one); for a large live
+        // table use scripts/build-search-indexes-concurrently.mjs
+        // (docs/search-index-runbook.md).
+        index("specs_search_idx").using("gin", table.searchVector),
+        // Near-miss title lookups (`name % $q` / `similarity(name, $q)` / `ILIKE
+        // '%term%'`) via pg_trgm. Needs `CREATE EXTENSION pg_trgm` — hand-added to
+        // the same migration because drizzle-kit cannot express extensions.
+        index("specs_name_trgm_idx").using("gin", table.name.op("gin_trgm_ops")),
         // SpexConsole main list views filter by type + status
         index("specs_type_status_idx").on(table.type, table.status),
         // Family-graph lookups (Naming V3 step 1) — group specs by family key.
@@ -141,7 +465,22 @@ var init_postgres = __esm({
         // (deleted_at IS NULL) so soft-deleted orphans don't block re-indexing. The
         // upsert path soft-deletes any conflicting row first. Scoped by vault so the
         // same rel_path can be indexed independently under two vaults.
-        uniqueIndex("specs_relpath_user_uq").on(table.relPath, table.userId, table.vaultId).where(sql`${table.deletedAt} IS NULL`)
+        uniqueIndex("specs_relpath_user_uq").on(table.relPath, table.userId, table.vaultId).where(sql`${table.deletedAt} IS NULL`),
+        // Keyset paging ([[HS-C6FO-8KK5-TASK-keyset-spec-list-endpoint-query-layer]]):
+        // the immutable sort key is (created, id) — never `updated_at`, which moves
+        // edited rows between pages. Partial (deleted_at IS NULL) so soft-deleted
+        // rows never cost the index a page. Unfiltered list-query root.
+        index("specs_vault_created_id_idx").on(table.vaultId, table.created, table.id).where(sql`${table.deletedAt} IS NULL`),
+        // Same keyset shape, pre-filtered by type — the Docs list's most common
+        // filter (e.g. `type=task`).
+        index("specs_vault_type_created_id_idx").on(table.vaultId, table.type, table.created, table.id).where(sql`${table.deletedAt} IS NULL`),
+        // Same keyset shape, pre-filtered by status — the Docs list's other common
+        // filter (e.g. `status=open`).
+        index("specs_vault_status_created_id_idx").on(table.vaultId, table.status, table.created, table.id).where(sql`${table.deletedAt} IS NULL`),
+        // The single-column unique constraint `pg_search` needs (see `specKey`).
+        // NOT partial: pg_search indexes the whole table, and a partial unique
+        // index would not qualify as its key.
+        uniqueIndex("specs_spec_key_uq").on(table.specKey)
       ]
     );
     tags = pgTable(
@@ -221,6 +560,30 @@ var init_postgres = __esm({
         index("wikilinks_target_idx").on(table.targetBasename)
       ]
     );
+    specLinks = pgTable(
+      "spec_links",
+      {
+        id: bigserial("id", { mode: "number" }).primaryKey(),
+        vaultId: text("vault_id").notNull(),
+        subjectId: text("subject_id").notNull(),
+        objectId: text("object_id"),
+        objectKey: text("object_key").notNull(),
+        kind: text("kind").notNull().default("wikilink").$type(),
+        createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
+      },
+      (table) => [
+        foreignKey({
+          columns: [table.vaultId, table.subjectId],
+          foreignColumns: [specs.vaultId, specs.id]
+        }).onDelete("cascade"),
+        // Forward refs: what does this spec point at?
+        index("spec_links_subject_idx").on(table.vaultId, table.subjectId, table.id),
+        // Backlinks: what points at this spec?
+        index("spec_links_object_idx").on(table.vaultId, table.objectId, table.id),
+        // Backlinks by basename (unresolved forward references / rename survival).
+        index("spec_links_object_key_idx").on(table.vaultId, table.objectKey, table.id)
+      ]
+    );
     aliases = pgTable(
       "aliases",
       {
@@ -624,6 +987,38 @@ var init_postgres = __esm({
         )
       ]
     );
+    fileClaims = pgTable(
+      "file_claims",
+      {
+        // Tenant-isolation scope ([[HS-ZP5H-TASK]]) — mirrors `active_claims.vault_id`.
+        vaultId: text("vault_id").notNull().default(DEFAULT_VAULT_ID),
+        filePath: text("file_path").notNull(),
+        // Persistent human accountable for this lease ([[HS-LLBO-ALE0-RES-multi-user-teams-on-a-shared-spec-vault]]).
+        // Resolved from the caller's vault scope at the call site — never a
+        // literal `SINGLE_USER_ID` baked in here. Distinct column from `agent_id`
+        // below: the agent is the ephemeral worker, never the owner.
+        ownerUserId: text("owner_user_id").notNull().default(SINGLE_USER_ID),
+        agentId: text("agent_id").notNull(),
+        sessionId: text("session_id").notNull(),
+        // Spec id the agent is working on when claiming this file, if any.
+        // Informational only — mirrors `FileClaim.workingSpecId`.
+        workingSpecId: text("working_spec_id"),
+        claimedAt: timestamp("claimed_at", { withTimezone: true }).notNull().default(sql`now()`),
+        // Reuses `active_claim_status` — same value domain as the file-side
+        // `LeaseStatus` union ("working" | "pending" | "blocked").
+        status: activeClaimStatusEnum("status").notNull().default("working"),
+        lastActivityAt: timestamp("last_activity_at", { withTimezone: true }).notNull().default(sql`now()`),
+        heartbeatAt: timestamp("heartbeat_at", { withTimezone: true }),
+        expiresAt: timestamp("expires_at", { withTimezone: true }),
+        // Shared global order: DEFAULT nextval on the SAME sequence `active_claims`
+        // and `claim_waiters` mint from — not a per-table bigserial, which would
+        // mint a second, unrelated counter and defeat the shared fencing contract.
+        sequence: bigint("sequence", { mode: "number" }).notNull().unique().default(sql`nextval('active_claims_sequence_seq')`),
+        createdAt: timestamp("created_at", { withTimezone: true }).notNull().default(sql`now()`),
+        updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().default(sql`now()`)
+      },
+      (table) => [primaryKey({ columns: [table.vaultId, table.filePath] })]
+    );
     claimEvents = pgTable(
       "claim_events",
       {
@@ -750,6 +1145,7 @@ var init_postgres = __esm({
       "rate_limit_buckets",
       {
         userId: text("user_id").notNull(),
+        vaultId: text("vault_id").notNull().default(""),
         bucket: text("bucket").notNull(),
         windowStart: timestamp("window_start", { withTimezone: true }).notNull(),
         count: integer("count").notNull().default(0),
@@ -757,7 +1153,7 @@ var init_postgres = __esm({
         updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().default(sql`now()`)
       },
       (table) => [
-        primaryKey({ columns: [table.userId, table.bucket, table.windowStart] }),
+        primaryKey({ columns: [table.userId, table.vaultId, table.bucket, table.windowStart] }),
         // Background reaper / dashboards: enumerate stale rows by `window_start`
         // older than the longest live window. The hot path uses the composite PK.
         index("rate_limit_buckets_window_idx").on(table.windowStart)
@@ -889,6 +1285,17 @@ var init_postgres = __esm({
       },
       (table) => [primaryKey({ columns: [table.userId, table.vaultId] })]
     );
+    consoleSettingsStore = pgTable(
+      "console_settings",
+      {
+        userId: text("user_id").notNull().default(SINGLE_USER_ID),
+        vaultId: text("vault_id").notNull().default(DEFAULT_VAULT_ID),
+        namespace: text("namespace").notNull(),
+        payload: jsonb("payload").notNull(),
+        updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().default(sql`now()`)
+      },
+      (table) => [primaryKey({ columns: [table.userId, table.vaultId, table.namespace] })]
+    );
     wipLedger = pgTable(
       "wip_ledger",
       {
@@ -901,6 +1308,27 @@ var init_postgres = __esm({
       },
       (table) => [primaryKey({ columns: [table.vaultId, table.specId] })]
     );
+    wipLedgerArchive = pgTable(
+      "wip_ledger_archive",
+      {
+        id: bigserial("id", { mode: "number" }).primaryKey(),
+        vaultId: text("vault_id").notNull().default(DEFAULT_VAULT_ID),
+        specId: text("spec_id").notNull(),
+        /** The full WipEntry blob at the moment it was archived — see `WipEntry` in `src/lib/wip-state.ts`. */
+        payload: jsonb("payload").notNull(),
+        archivedAt: timestamp("archived_at", { withTimezone: true }).notNull().default(sql`now()`)
+      },
+      (table) => [
+        // "newest archived record for this (vault, spec)" — the restore lookup.
+        index("wip_ledger_archive_vault_spec_idx").on(
+          table.vaultId,
+          table.specId,
+          table.archivedAt.desc()
+        ),
+        // The purge cron's own scan: "every row older than a cutoff, any vault".
+        index("wip_ledger_archive_archived_at_idx").on(table.archivedAt)
+      ]
+    );
     gatherResults = pgTable(
       "gather_results",
       {
@@ -918,6 +1346,16 @@ var init_postgres = __esm({
          * ([[HS-RIZN-DIL5-DIAG-spexcrawl-search-returns-zero-pages-on]]).
          */
         search: jsonb("search"),
+        /**
+         * A completed site walk's duplicate/orphan audit — which pages say
+         * exactly the same thing as each other, and which pages nothing else
+         * links to ([[HS-4TNX-ABF9-TASK-carry-the-site-audit-report-from-a]]).
+         * The second job-level report beside `pages`, carried exactly as
+         * `search` is: open shape (the Companion owns the fields), null for a
+         * single-page gather, a research job, and uploads from Companions that
+         * predate the report.
+         */
+        siteAudit: jsonb("site_audit"),
         createdAt: timestamp("created_at", { withTimezone: true }).default(sql`now()`)
       },
       (table) => [primaryKey({ columns: [table.jobId, table.idempotencyKey] })]
@@ -1100,6 +1538,44 @@ var init_postgres = __esm({
       repoRootAbs: text("repo_root_abs"),
       githubRemote: text("github_remote"),
       schemaVersion: integer("schema_version").notNull().default(1),
+      /**
+       * Price plan the vault is on — `free` | `pro` | `enterprise`, the same
+       * vocabulary as `ApiKeyPlan` in `api-key-rate-limit.ts`
+       * ([[HS-JRER-8KK5-TASK-per-vault-plan-tier-tier-limits-table]]). Drives the
+       * per-tier statement timeout / work_mem / rate-limit budgets in
+       * `src/lib/plan-tier.ts` (`PLAN_TIER_LIMITS`, `resolveVaultPlanTier`). How a
+       * vault GETS a tier (billing) is out of scope — the column defaults every
+       * vault to `free` so the most conservative limits apply until a tier is set.
+       * Readers must treat an unknown value as `free`.
+       */
+      planTier: text("plan_tier").notNull().default("free"),
+      /**
+       * Dedicated-database routing key ([[HS-ZUZF-8KK5-TASK-per-vault-database-routing-switch-and]]).
+       *
+       * NULL (the default, and every vault today) = this vault lives in the SHARED
+       * database, i.e. the one `DATABASE_URL` points at. A non-null value is a
+       * short opaque REF — never a connection string and never a secret. The ref
+       * NAMES where the credential lives: environment variable
+       * `HEYSPEX_DEDICATED_DB_<REF>` (uppercased, non-alphanumerics → `_`), or
+       * `dedicated_databases.<ref>` in `~/.heyspex/credentials.yaml`. Resolution
+       * and the per-ref pool memo live in `src/lib/db/clients/vault-router.ts`;
+       * `scripts/migrate.mjs` migrates every ref listed in `DEDICATED_DATABASE_REFS`
+       * alongside the shared database.
+       *
+       * The `vaults` table itself ALWAYS stays on the shared control plane — the
+       * router reads this column through the admin connection, so the row that says
+       * "vault X is elsewhere" is never itself elsewhere.
+       */
+      databaseRef: text("database_ref"),
+      /**
+       * Which lexical-search substrate this vault's queries use — `gin` (the
+       * built-in `search_vector` GIN index shipped in migration 0068) or `bm25`
+       * (ParadeDB `pg_search`, evaluated by
+       * [[HS-KZJ1-8KK5-TASK-bm25-pg-search-index-and-query-path]]). Declared here
+       * so the BM25 task is a per-vault flag flip rather than a global cutover;
+       * nothing reads it yet. Readers must treat an unknown value as `gin`.
+       */
+      searchEngine: text("search_engine").notNull().default("gin"),
       createdAt: timestamp("created_at", { withTimezone: true }).notNull().default(sql`now()`),
       updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().default(sql`now()`),
       /** Vault equivalent of `workspaces.archived` — see that column's doc comment. */
@@ -1131,6 +1607,22 @@ var init_postgres = __esm({
       },
       (table) => [primaryKey({ columns: [table.vaultId, table.accountId] })]
     );
+    pendingVaultGrants = pgTable(
+      "pending_vault_grants",
+      {
+        id: text("id").primaryKey(),
+        vaultId: text("vault_id").notNull().references(() => vaults.id, { onDelete: "cascade" }),
+        email: text("email").notNull(),
+        access: text("access").notNull().default("read"),
+        invitedBy: text("invited_by").notNull(),
+        createdAt: timestamp("created_at", { withTimezone: true }).notNull().default(sql`now()`),
+        fulfilledAt: timestamp("fulfilled_at", { withTimezone: true }),
+        fulfilledAccountId: text("fulfilled_account_id")
+      },
+      (table) => [
+        uniqueIndex("pending_vault_grants_vault_id_email_idx").on(table.vaultId, table.email)
+      ]
+    );
     githubInstallations = pgTable(
       "github_installations",
       {
@@ -1361,6 +1853,31 @@ var init_postgres = __esm({
         // new | invited | declined
         /** Clerk invitation id, set when an approval actually issues one. */
         clerkInvitationId: text("clerk_invitation_id"),
+        /**
+         * The Clerk invitation's accept URL, stored alongside the id at approve
+         * time so the admin surface can show/copy/resend it without a live Clerk
+         * round trip for every render
+         * ([[HS-7DKO-JQ64-TASK-approve-sends-the-customer-a-resend]]).
+         */
+        clerkInvitationUrl: text("clerk_invitation_url"),
+        /** When the first-party approval email (Resend) was confirmed sent. Null until it succeeds. */
+        approvalEmailSentAt: timestamp("approval_email_sent_at", { withTimezone: true }),
+        /** Why the approval email failed or was skipped — never blocks approval, just recorded. */
+        approvalEmailError: text("approval_email_error"),
+        /**
+         * Resend's message id for the approval email currently on the row — the
+         * key a later `POST /api/webhooks/resend` delivery matches back to this
+         * row ([[HS-HUK3-JQ64-TASK-approval-email-delivery-proof-store-the]]).
+         * Reset (and re-set) on every approve/resend, since each send mints a new
+         * Resend message id.
+         */
+        approvalEmailId: text("approval_email_id"),
+        /** Resend delivery-webhook outcome: sent | delayed | delivered | bounced | complained. Null until a webhook arrives. */
+        approvalEmailDeliveryStatus: text("approval_email_delivery_status"),
+        /** When the most recently applied delivery-webhook event was recorded. */
+        approvalEmailDeliveryAt: timestamp("approval_email_delivery_at", { withTimezone: true }),
+        /** Bounce/complaint detail from the webhook payload (e.g. the bounce message). */
+        approvalEmailDeliveryDetail: text("approval_email_delivery_detail"),
         /** Account id of the admin who approved/declined — audit trail for the decision. */
         reviewedBy: text("reviewed_by"),
         reviewedAt: timestamp("reviewed_at", { withTimezone: true }),
@@ -1480,130 +1997,116 @@ var init_postgres = __esm({
   }
 });
 
-// spex-console/src/lib/vault-registry/neon-probe.ts
-function withTimeout(promise, ms, label) {
-  return new Promise((resolve, reject) => {
-    const timer = setTimeout(() => reject(new NeonProbeTimeoutError(label, ms)), ms);
-    promise.then(
-      (value) => {
-        clearTimeout(timer);
-        resolve(value);
-      },
-      (err) => {
-        clearTimeout(timer);
-        reject(err instanceof Error ? err : new Error(String(err)));
-      }
-    );
-  });
-}
-function sleep(ms) {
-  return new Promise((resolve) => setTimeout(resolve, ms));
-}
-function emitProbeFailure(options, failure) {
+// spex-console/bin/hs-workspace.ts
+import { readFileSync as readFileSync9 } from "node:fs";
+import path3 from "node:path";
+import process3 from "node:process";
+import { createInterface as createInterface2 } from "node:readline/promises";
+
+// spex-console/src/lib/cli/control-shared.ts
+import path from "node:path";
+
+// scripts/lib/hs-command.mjs
+import { existsSync } from "node:fs";
+import { delimiter, dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+var HS_BIN_NAME = "hs";
+var HS_DISPATCHER_PATH = (() => {
   try {
-    options?.onFailure?.(failure);
+    const here = dirname(fileURLToPath(import.meta.url));
+    return join(dirname(dirname(here)), "bin", "hs.mjs");
   } catch {
+    return null;
   }
+})();
+function shellQuote(p) {
+  return /[\\\s]/.test(p) ? `"${p}"` : p;
 }
-async function runNeonReachabilityProbe(attempt, options = {}, label = "Neon reachability probe") {
-  const timeoutMs = options.timeoutMs ?? NEON_PROBE_TIMEOUT_MS;
-  const backoffMs = options.backoffMs ?? [];
-  const deadlineMs = options.deadlineMs ?? Number.POSITIVE_INFINITY;
-  const attempts = backoffMs.length + 1;
-  let startedAt = Date.now();
-  let suspensions = 0;
-  for (let i = 0; i < attempts; i++) {
-    const attemptStartedAt = Date.now();
-    try {
-      await withTimeout(Promise.resolve().then(attempt), timeoutMs, label);
-      return true;
-    } catch (err) {
-      const elapsedMs = Date.now() - attemptStartedAt;
-      const suspended = elapsedMs >= timeoutMs * SUSPENSION_ELAPSED_FACTOR && elapsedMs - timeoutMs >= SUSPENSION_MIN_OVERSHOOT_MS;
-      if (suspended && suspensions < MAX_SUSPENSION_RETRIES) {
-        suspensions += 1;
-        emitProbeFailure(options, {
-          reason: "suspended",
-          attempt: i + 1,
-          attempts,
-          timeoutMs,
-          elapsedMs,
-          willRetry: true,
-          error: err
-        });
-        startedAt = Date.now();
-        i -= 1;
-        continue;
-      }
-      const isLast = i === attempts - 1;
-      const pastDeadline = Date.now() - startedAt >= deadlineMs;
-      const willRetry = !isLast && !pastDeadline;
-      emitProbeFailure(options, {
-        reason: err instanceof NeonProbeTimeoutError ? "timeout" : "error",
-        attempt: i + 1,
-        attempts,
-        timeoutMs,
-        elapsedMs,
-        willRetry,
-        error: err
-      });
-      if (!willRetry) return false;
-      await sleep(backoffMs[i]);
-    }
-  }
-  return false;
+var HS_DISPATCHER_PREFIX = HS_DISPATCHER_PATH ? `node ${shellQuote(HS_DISPATCHER_PATH)}` : HS_BIN_NAME;
+
+// vendor/heyspex-mcp/console-fetch.mjs
+init_credentials();
+import { readFileSync as readFileSync4 } from "node:fs";
+import { homedir as homedir4 } from "node:os";
+import { join as join5 } from "node:path";
+
+// vendor/heyspex-mcp/session-owner.mjs
+init_credentials();
+import { readFileSync as readFileSync2 } from "node:fs";
+import { homedir as homedir2 } from "node:os";
+import { join as join3 } from "node:path";
+function resolveSessionOwnerUncached({ env = process.env, homeDir = homedir2(), readFile: readFile2 } = {}) {
+  const fromEnv = typeof env?.HS_ACCOUNT_ID === "string" ? env.HS_ACCOUNT_ID.trim() : "";
+  if (fromEnv) return fromEnv;
+  return readCurrentAccountId({ homeDir, readFile: readFile2 });
 }
-var NEON_PROBE_TIMEOUT_MS, SUSPENSION_ELAPSED_FACTOR, SUSPENSION_MIN_OVERSHOOT_MS, MAX_SUSPENSION_RETRIES, NeonProbeTimeoutError;
-var init_neon_probe = __esm({
-  "spex-console/src/lib/vault-registry/neon-probe.ts"() {
-    "use strict";
-    NEON_PROBE_TIMEOUT_MS = 1500;
-    SUSPENSION_ELAPSED_FACTOR = 3;
-    SUSPENSION_MIN_OVERSHOOT_MS = 5e3;
-    MAX_SUSPENSION_RETRIES = 2;
-    NeonProbeTimeoutError = class _NeonProbeTimeoutError extends Error {
-      timeoutMs;
-      constructor(label, timeoutMs) {
-        super(`${label} timed out after ${timeoutMs}ms`);
-        this.name = "NeonProbeTimeoutError";
-        this.timeoutMs = timeoutMs;
-        Object.setPrototypeOf(this, _NeonProbeTimeoutError.prototype);
-      }
-    };
-  }
-});
+
+// vendor/heyspex-mcp/vault-less-endpoints.mjs
+var VAULT_LESS_ENDPOINTS = Object.freeze([
+  "* /api/mcp/session",
+  "* /api/mcp/pairing-codes",
+  "POST /api/vaults",
+  "GET /api/vaults",
+  "POST /api/workspaces",
+  "GET /api/workspaces",
+  "* /api/admin/dev-mode"
+]);
+function pathnameOf(path4) {
+  const raw = String(path4 ?? "").split("?")[0].split("#")[0];
+  const noTrailing = raw.length > 1 ? raw.replace(/\/+$/, "") : raw;
+  return noTrailing || "/";
+}
+function isVaultLessEndpoint(method, path4) {
+  const m = String(method || "GET").toUpperCase();
+  const pathname = pathnameOf(path4);
+  return VAULT_LESS_ENDPOINTS.some((row) => {
+    const [rowMethod, rowPath] = row.split(" ");
+    return rowPath === pathname && (rowMethod === "*" || rowMethod === m);
+  });
+}
+
+// vendor/heyspex-mcp/vault-resolve.mjs
+import { existsSync as existsSync2, readFileSync as readFileSync3 } from "node:fs";
+import { homedir as homedir3, tmpdir } from "node:os";
+import { dirname as dirname3, join as join4, resolve as resolve2 } from "node:path";
+
+// vendor/heyspex-mcp/console-fetch.mjs
+var SCOPE_REFUSAL_CODES = Object.freeze(["VAULT_SCOPE_MISMATCH", "ACCOUNT_MISMATCH", "VAULT_NOT_REGISTERED"]);
+
+// spex-console/src/lib/cli/control-shared.ts
+init_credentials();
+
+// spex-console/src/lib/vault-registry/registry-file.ts
+import { existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync5, renameSync as renameSync2, writeFileSync as writeFileSync2 } from "node:fs";
+import { homedir as homedir5 } from "node:os";
+import { dirname as dirname4, join as join6, resolve as resolve3 } from "node:path";
 
 // spex-console/src/lib/vault-registry/types.ts
+var LEGACY_REGISTRY_ACCOUNT_ID = "legacy";
+var VAULT_REGISTRY_SCHEMA_VERSION = 2;
 function emptyVaultRegistry() {
   return {
     schema_version: VAULT_REGISTRY_SCHEMA_VERSION,
+    current_account_id: null,
+    accounts: {},
     workspaces: [],
-    vaults: [],
-    active_workspace_id: null,
-    active_vault_id: null
+    vaults: []
   };
 }
-var VAULT_REGISTRY_SCHEMA_VERSION;
-var init_types = __esm({
-  "spex-console/src/lib/vault-registry/types.ts"() {
-    "use strict";
-    VAULT_REGISTRY_SCHEMA_VERSION = 1;
-  }
-});
 
 // spex-console/src/lib/vault-registry/registry-file.ts
-import { existsSync, mkdirSync, readFileSync as readFileSync4, renameSync, writeFileSync } from "node:fs";
-import { homedir as homedir3 } from "node:os";
-import { dirname, join as join3 } from "node:path";
 function vaultRegistryDir(opts = {}) {
-  return opts.registryDir ?? join3(homedir3(), ".heyspex");
+  return opts.registryDir ?? join6(homedir5(), ".heyspex");
 }
 function vaultRegistryFilePath(opts = {}) {
-  return join3(vaultRegistryDir(opts), "registry.json");
+  return join6(vaultRegistryDir(opts), "registry.json");
 }
 function isNonEmptyString(v) {
   return typeof v === "string" && v.trim().length > 0;
 }
+function accountOf(o) {
+  return isNonEmptyString(o.account_id) ? o.account_id : LEGACY_REGISTRY_ACCOUNT_ID;
+}
 function normalizeWorkspace(raw) {
   if (!raw || typeof raw !== "object") return null;
   const o = raw;
@@ -1614,7 +2117,8 @@ function normalizeWorkspace(raw) {
     id: o.id,
     display_name: o.display_name,
     created_at: o.created_at,
-    archived: o.archived === true
+    archived: o.archived === true,
+    account_id: accountOf(o)
   };
   if (isNonEmptyString(o.github_org)) record.github_org = o.github_org;
   return record;
@@ -1635,57 +2139,161 @@ function normalizeVault(raw) {
     repo_root_abs: o.repo_root_abs,
     schema_version: o.schema_version,
     registered_at: o.registered_at,
-    archived: o.archived === true
+    archived: o.archived === true,
+    account_id: accountOf(o)
   };
   if (isNonEmptyString(o.github_remote)) record.github_remote = o.github_remote;
   return record;
 }
+function normalizeStoredPointers(raw) {
+  const o = raw && typeof raw === "object" ? raw : {};
+  const out = {};
+  for (const field of ["active_vault_id", "active_workspace_id"]) {
+    const v = o[field];
+    if (v === null || isNonEmptyString(v)) out[field] = v;
+  }
+  return out;
+}
+function normalizePointers(raw) {
+  const o = raw && typeof raw === "object" ? raw : {};
+  return {
+    active_vault_id: isNonEmptyString(o.active_vault_id) ? o.active_vault_id : null,
+    active_workspace_id: isNonEmptyString(o.active_workspace_id) ? o.active_workspace_id : null
+  };
+}
+function registryFileSchemaOf(json) {
+  if (!json || typeof json !== "object" || Array.isArray(json)) return null;
+  return json.schema_version === 2 ? 2 : 1;
+}
 function parseVaultRegistryFile(json) {
-  const fallback = emptyVaultRegistry();
-  if (!json || typeof json !== "object") return fallback;
+  const schema = registryFileSchemaOf(json);
+  if (schema === null) return emptyVaultRegistry();
   const o = json;
   const workspacesRaw = Array.isArray(o.workspaces) ? o.workspaces : [];
   const workspaces2 = workspacesRaw.map(normalizeWorkspace).filter((w) => w !== null);
   const vaultsRaw = Array.isArray(o.vaults) ? o.vaults : [];
   const vaults2 = vaultsRaw.map(normalizeVault).filter((v) => v !== null);
-  const active_workspace_id = isNonEmptyString(o.active_workspace_id) ? o.active_workspace_id : null;
-  const active_vault_id = isNonEmptyString(o.active_vault_id) ? o.active_vault_id : null;
+  if (schema === 1) {
+    const legacy = normalizePointers(o);
+    const hasLegacyState = legacy.active_vault_id !== null || legacy.active_workspace_id !== null || workspaces2.length > 0 || vaults2.length > 0;
+    return {
+      schema_version: VAULT_REGISTRY_SCHEMA_VERSION,
+      current_account_id: hasLegacyState ? LEGACY_REGISTRY_ACCOUNT_ID : null,
+      accounts: hasLegacyState ? { [LEGACY_REGISTRY_ACCOUNT_ID]: legacy } : {},
+      workspaces: workspaces2,
+      vaults: vaults2
+    };
+  }
+  const accounts = {};
+  if (o.accounts && typeof o.accounts === "object" && !Array.isArray(o.accounts)) {
+    for (const [id, pointers] of Object.entries(o.accounts)) {
+      if (isNonEmptyString(id)) accounts[id] = normalizeStoredPointers(pointers);
+    }
+  }
   return {
     schema_version: VAULT_REGISTRY_SCHEMA_VERSION,
+    current_account_id: isNonEmptyString(o.current_account_id) ? o.current_account_id : null,
+    accounts,
     workspaces: workspaces2,
-    vaults: vaults2,
-    active_workspace_id,
-    active_vault_id
+    vaults: vaults2
   };
 }
-function loadVaultRegistry(opts = {}) {
+function readRegistryJson(opts) {
   const filePath = vaultRegistryFilePath(opts);
-  if (!existsSync(filePath)) return emptyVaultRegistry();
+  if (!existsSync3(filePath)) return { kind: "missing" };
   try {
-    const raw = readFileSync4(filePath, "utf8");
-    return parseVaultRegistryFile(JSON.parse(raw));
+    const raw = readFileSync5(filePath, "utf8");
+    const json = JSON.parse(raw);
+    if (registryFileSchemaOf(json) === null) return { kind: "unreadable" };
+    return { kind: "ok", raw, json };
   } catch {
-    return emptyVaultRegistry();
+    return { kind: "unreadable" };
   }
 }
-function writeVaultRegistry(registry, opts = {}) {
-  const filePath = vaultRegistryFilePath(opts);
-  mkdirSync(dirname(filePath), { recursive: true });
-  const tmpPath = `${filePath}.tmp`;
-  writeFileSync(tmpPath, `${JSON.stringify(registry, null, 2)}
-`, "utf8");
-  renameSync(tmpPath, filePath);
+function inspectVaultRegistry(opts = {}) {
+  const read = readRegistryJson(opts);
+  if (read.kind !== "ok") {
+    return {
+      registry: emptyVaultRegistry(),
+      file_schema_version: null,
+      registry_unreadable: read.kind === "unreadable"
+    };
+  }
+  return {
+    registry: parseVaultRegistryFile(read.json),
+    file_schema_version: registryFileSchemaOf(read.json),
+    registry_unreadable: false
+  };
 }
-function isValidId(id) {
-  if (!isNonEmptyString(id)) return false;
-  if (id.includes("/") || id.includes("\\")) return false;
-  if (id === "." || id === "..") return false;
+function loadVaultRegistry(opts = {}) {
+  return inspectVaultRegistry(opts).registry;
+}
+function ownsRegistryRows(registry, accountId2) {
+  return registry.vaults.some((v) => v.account_id === accountId2) || registry.workspaces.some((w) => w.account_id === accountId2);
+}
+function accountPointersOf(registry, accountId2) {
+  const own = accountId2 ? registry.accounts[accountId2] : void 0;
+  const legacy = registry.accounts[LEGACY_REGISTRY_ACCOUNT_ID];
+  const clearsCount = Boolean(accountId2) && ownsRegistryRows(registry, accountId2);
+  const pick = (field) => {
+    const mine = own?.[field];
+    if (isNonEmptyString(mine)) return mine;
+    if (mine === null && clearsCount && accountId2 !== LEGACY_REGISTRY_ACCOUNT_ID) return null;
+    const fallback = legacy?.[field];
+    return isNonEmptyString(fallback) ? fallback : null;
+  };
+  return {
+    active_vault_id: pick("active_vault_id"),
+    active_workspace_id: pick("active_workspace_id")
+  };
+}
+function serializeVaultRegistry(registry) {
+  return `${JSON.stringify(registry, null, 2)}
+`;
+}
+function underTestRunner() {
+  return Boolean(process.env.VITEST) || Boolean(process.env.NODE_TEST_CONTEXT);
+}
+function samePathLoose(a, b) {
+  const norm = (p) => {
+    const r = resolve3(p).replace(/[\\/]+$/, "");
+    return process.platform === "win32" ? r.toLowerCase() : r;
+  };
+  return norm(a) === norm(b);
+}
+function assertNotRealHomeRegistryUnderTest(filePath) {
+  if (!underTestRunner()) return;
+  if (samePathLoose(dirname4(filePath), join6(homedir5(), ".heyspex"))) {
+    throw new Error(
+      `registry-file: refusing to write ${filePath} under a test runner \u2014 that is the real ~/.heyspex registry. Pass opts.registryDir (a temp dir).`
+    );
+  }
+}
+function writeVaultRegistry(registry, opts = {}) {
+  const filePath = vaultRegistryFilePath(opts);
+  assertNotRealHomeRegistryUnderTest(filePath);
+  mkdirSync2(dirname4(filePath), { recursive: true });
+  const tmpPath = `${filePath}.tmp`;
+  writeFileSync2(tmpPath, serializeVaultRegistry(registry), "utf8");
+  renameSync2(tmpPath, filePath);
+}
+function isValidId(id) {
+  if (!isNonEmptyString(id)) return false;
+  if (id.includes("/") || id.includes("\\")) return false;
+  if (id === "." || id === "..") return false;
   return true;
 }
+function requireAccountId(fn, accountId2) {
+  if (!isNonEmptyString(accountId2)) {
+    throw new Error(`${fn}: account_id is required`);
+  }
+  return accountId2;
+}
 function registerWorkspace(record, opts = {}) {
   if (!isValidId(record.id)) {
     throw new Error(`registerWorkspace: invalid workspace id "${record.id}"`);
   }
+  requireAccountId("registerWorkspace", record.account_id);
   const registry = loadVaultRegistry(opts);
   const idx = registry.workspaces.findIndex((w) => w.id === record.id);
   if (idx >= 0) {
@@ -1696,30 +2304,927 @@ function registerWorkspace(record, opts = {}) {
   writeVaultRegistry(registry, opts);
   return registry;
 }
-function setActiveWorkspaceId(workspaceId, opts = {}) {
-  const registry = loadVaultRegistry(opts);
-  registry.active_workspace_id = workspaceId;
-  writeVaultRegistry(registry, opts);
-  return registry;
+function writeAccountPointer(fn, accountId2, field, value, opts) {
+  requireAccountId(fn, accountId2);
+  if (value !== null && !isNonEmptyString(value)) {
+    throw new Error(`${fn}: ${field} must be a non-empty string or null`);
+  }
+  if (opts === null || typeof opts !== "object") {
+    throw new Error(`${fn}: opts must be an object`);
+  }
+  const registry = loadVaultRegistry(opts);
+  const row = { ...registry.accounts[accountId2] ?? {}, [field]: value };
+  registry.accounts = { ...registry.accounts, [accountId2]: row };
+  if (registry.current_account_id === null || registry.current_account_id === LEGACY_REGISTRY_ACCOUNT_ID && accountId2 !== LEGACY_REGISTRY_ACCOUNT_ID) {
+    registry.current_account_id = accountId2;
+  }
+  writeVaultRegistry(registry, opts);
+  return registry;
+}
+function setActiveWorkspaceId(accountId2, workspaceId, opts = {}) {
+  return writeAccountPointer(
+    "setActiveWorkspaceId",
+    accountId2,
+    "active_workspace_id",
+    workspaceId,
+    opts
+  );
+}
+function clearPointerEverywhere(registry, field, id) {
+  for (const [accountId2, pointers] of Object.entries(registry.accounts)) {
+    if (pointers[field] === id) registry.accounts[accountId2] = { ...pointers, [field]: null };
+  }
+}
+function removeWorkspace(id, opts = {}) {
+  const registry = loadVaultRegistry(opts);
+  registry.workspaces = registry.workspaces.filter((w) => w.id !== id);
+  clearPointerEverywhere(registry, "active_workspace_id", id);
+  writeVaultRegistry(registry, opts);
+  return registry;
+}
+
+// spex-console/src/lib/cli/control-shared.ts
+var EXIT = {
+  /** Success. */
+  OK: 0,
+  /**
+   * A read-only CHECK ran correctly and its answer is "no" — `hs connect
+   * --check` on an unconnected repo. Distinct from {@link EXIT.USAGE} so a
+   * script can tell "you typed the command wrong" from "the command worked,
+   * the repo is not connected". Both were `1` until 2026-09-18, which made
+   * `--check` unusable in a conditional: every caller had to parse stdout to
+   * find out which of the two had happened.
+   */
+  CHECK_FAILED: 2,
+  /** Usage error — unknown subcommand/flag, or a missing required argument. */
+  USAGE: 1,
+  /** Claim race lost — the spec is already claimed by another agent (409). */
+  CONFLICT: 9,
+  /** Target not found — release of an unheld claim, etc. (404). */
+  NOT_FOUND: 10,
+  /** Invalid argument — bad `--ttl`, unknown `--kind`, unparseable date. */
+  INVALID_ARG: 11,
+  /** SpexConsole unreachable (network error reaching the dev server). */
+  CONSOLE_UNREACHABLE: 12,
+  /** Server failure — a non-OK response that isn't 400/402/404/409. */
+  WRITE_FAILED: 13,
+  /** Neon control plane absent — the endpoint returned 402 (upgrade required). */
+  NEON_REQUIRED: 14,
+  /**
+   * A cross-account `--account <id>` override was refused — the caller is
+   * not a builder/admin (`resolveScopedAccountId`'s `forbidden_account_override`,
+   * [[HS-X3GB-EKLJ-TASK-hs-cli-account-flag-for-cross-account]]). Distinct
+   * from `USAGE`/`INVALID_ARG` — this is an authorization refusal, not a
+   * malformed command.
+   */
+  FORBIDDEN: 15,
+  /**
+   * A CLOUD write refused because no account id could be resolved (no
+   * `HS_ACCOUNT_ID` env var, no `account_id:` in `~/.heyspex/config.yaml`) --
+   * `resolveCloudAccountIdOrRefuse` in `vault-workspace-shared.ts`
+   * ([[HS-YU1S-UAGY-TASK-cloud-writes-refuse-without-a]]). Distinct from
+   * `FORBIDDEN` -- this is "not signed in at all", not "signed in but not
+   * authorized for this override".
+   */
+  SIGN_IN_REQUIRED: 16,
+  /**
+   * Signed in, but the account a repo would be attached to was not confirmed:
+   * a non-interactive install/connect with no matching `--account` / `--yes`,
+   * an `account_id` that disagrees with the bearer's user, or the human
+   * aborting the identity prompt (`install-identity.ts`,
+   * [[HS-HAQI-KODY-DIAG-hs-install-and-hs-connect-bind-a-new]]).
+   */
+  IDENTITY_UNCONFIRMED: 17,
+  /**
+   * The repo this verb runs in is not registered on this machine (no
+   * `~/.heyspex/registry.json` row for its root, or a legacy slug row with no
+   * cloud `vault_id` in its heyspex.yaml), so the call was refused LOCALLY —
+   * nothing was sent. Names `hs connect`
+   * ([[HS-MVG4-WW9R-TASK-mcp-and-hs-name-account-vault-on-every]]).
+   */
+  VAULT_NOT_REGISTERED: 18,
+  /**
+   * The local half of a setup verb (`hs connect`, `hs vault *`, `hs workspace
+   * *`) was written but the CLOUD half did not land -- the console refused
+   * it or was never reached. The verb's receipt names the failed half and the
+   * exact command to re-run
+   * ([[HS-STCY-WW9R-TASK-add-a-shared-receipt-that-reads-back]], invariant 6).
+   * Distinct from {@link EXIT.WRITE_FAILED} so a script can tell "re-run to
+   * sync the cloud" from a generic server failure.
+   */
+  CLOUD_WRITE_FAILED: 19,
+  /**
+   * The repo's committed `heyspex.yaml` records `account: <A>` but the machine
+   * is signed in as another account, so `hs connect` refused and wrote
+   * nothing (marker, registry, cloud). Repair: `hs login --switch-account <A>`
+   * ([[HS-VWUD-WW9R-TASK-record-the-connecting-account-in]], invariant 4).
+   */
+  ACCOUNT_MISMATCH: 20,
+  /**
+   * Both sides of a setup verb's receipt were read back and still DISAGREE
+   * after a short bounded re-read of the cloud side (a briefly stale read is
+   * absorbed first). The write may well have landed; what the verb cannot
+   * claim is that this machine and the console now say the same thing. The
+   * receipt prints the diffs and the command to re-run
+   * ([[HS-FKSR-WW9R-TASK-make-one-hs-connect-run-create-a-cloud]], invariant 6).
+   * Distinct from {@link EXIT.CLOUD_WRITE_FAILED} (a write that did not land).
+   */
+  RECEIPT_DISAGREE: 21
+};
+var VAULT_ID_HEADER = "x-heyspex-vault-id";
+var ACCOUNT_ID_HEADER = "x-heyspex-account-id";
+function readPairedBearer(opts = {}) {
+  return readBearer(opts);
+}
+function readPairedToken(opts = {}) {
+  return readPairedBearer(opts).token ?? void 0;
+}
+function scopeHeadersFor(scope, method, path4) {
+  if (scope === "none") {
+    if (!isVaultLessEndpoint(method, path4)) {
+      throw new Error(
+        `controlRequest: scope "none" is only allowed for the vault-less endpoints (${VAULT_LESS_ENDPOINTS.join(", ")}); ${method.toUpperCase()} ${path4} is vault-scoped and must name { accountId, vaultId }.`
+      );
+    }
+    return {};
+  }
+  return { [VAULT_ID_HEADER]: scope.vaultId, [ACCOUNT_ID_HEADER]: scope.accountId };
+}
+function cloudRequestScope(scope) {
+  const named = { accountId: scope.accountId, vaultId: scope.vaultId };
+  return {
+    ...named,
+    headersFor: (method, path4) => isVaultLessEndpoint(method, path4) ? {} : scopeHeadersFor(named, method, path4)
+  };
+}
+function withCloudScope(deps, accountId2, vaultId) {
+  if (!deps?.http || !vaultId || !accountId2) return deps;
+  return { ...deps, http: { ...deps.http, scope: cloudRequestScope({ accountId: accountId2, vaultId }) } };
+}
+
+// scripts/lib/console-url-resolver.mjs
+init_dev_mode();
+import { readFileSync as readFileSync7 } from "node:fs";
+import { homedir as homedir7 } from "node:os";
+import { join as join8 } from "node:path";
+var DEFAULT_CONSOLE_URL = LOCAL_CONSOLE_URL;
+function trimTrailingSlash(url) {
+  return url.replace(/\/+$/, "");
+}
+var LOOPBACK_HOSTS = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "::1", "[::1]", "0.0.0.0"]);
+function isLoopbackConsoleUrl(url) {
+  if (typeof url !== "string" || !url) return false;
+  try {
+    return LOOPBACK_HOSTS.has(new URL(url).hostname.toLowerCase());
+  } catch {
+    return false;
+  }
+}
+var staleLoopbackCredentialsWarned = false;
+function warnStaleLoopbackCredentialsOnce(credentialsUrl, derivedUrl, { log }) {
+  if (staleLoopbackCredentialsWarned) return;
+  staleLoopbackCredentialsWarned = true;
+  try {
+    log(
+      `[heyspex] ignoring console_url ${credentialsUrl} from ~/.heyspex/credentials.yaml: the resolved reliance is cloud, and a loopback console cannot serve it \u2014 using ${derivedUrl} (set HEYSPEX_CONSOLE_URL to override explicitly, or run \`hs dev mode:local\` to go back to a local console).
+`
+    );
+  } catch {
+  }
+}
+function readCredentialsConsoleUrl({ homeDir = homedir7(), readFile: readFile2 = defaultReadFile2 } = {}) {
+  try {
+    const raw = readFile2(join8(homeDir, ".heyspex", "credentials.yaml"));
+    const match = String(raw ?? "").match(/^console_url:\s*["']?([^"'\r\n#]+)/m);
+    const value = match?.[1]?.trim();
+    return value && value.length > 0 ? trimTrailingSlash(value) : null;
+  } catch {
+    return null;
+  }
+}
+function defaultReadFile2(p) {
+  return readFileSync7(p, "utf8");
+}
+function readDiscoveryFileConsoleUrl(repoRoot, { readDiscovery = defaultReadFile2 } = {}) {
+  if (!repoRoot) return null;
+  try {
+    const discovery = String(readDiscovery(join8(repoRoot, ".heyspex", "console-url")) ?? "").trim();
+    if (discovery.length > 0) return trimTrailingSlash(discovery);
+  } catch {
+  }
+  return null;
+}
+var ConsoleUrlUnresolvedError = class extends Error {
+  constructor() {
+    super(
+      "resolveConsoleUrl: local reliance with no HEYSPEX_CONSOLE_URL env, no console_url: in ~/.heyspex/credentials.yaml, and no .heyspex/console-url discovery file \u2014 refusing to silently fall back to the localhost:3000 default in strict mode."
+    );
+    this.name = "ConsoleUrlUnresolvedError";
+  }
+};
+function resolveModeEnvelope({ env, homeDir }) {
+  try {
+    const resolved = resolveDevMode({ env, homeDir });
+    return {
+      reliance: resolved.reliance === "cloud" ? "cloud" : "local",
+      consoleUrl: resolved.consoleUrl || DEFAULT_CONSOLE_URL
+    };
+  } catch {
+    return { reliance: "local", consoleUrl: DEFAULT_CONSOLE_URL };
+  }
+}
+function resolveConsoleUrl({
+  repoRoot,
+  env = process.env,
+  homeDir = homedir7(),
+  strict = false,
+  devMode,
+  log = (line) => process.stderr.write(line),
+  readFile: readFile2 = defaultReadFile2,
+  readDiscovery = defaultReadFile2
+} = {}) {
+  const envUrl = env.HEYSPEX_CONSOLE_URL?.trim();
+  if (envUrl) return trimTrailingSlash(envUrl);
+  const mode = devMode ?? resolveModeEnvelope({ env, homeDir });
+  const cloud = mode.reliance === "cloud";
+  const derivedUrl = trimTrailingSlash(
+    cloud && isLoopbackConsoleUrl(mode.consoleUrl) ? CLOUD_CONSOLE_URL : mode.consoleUrl || DEFAULT_CONSOLE_URL
+  );
+  const credentialsUrl = readCredentialsConsoleUrl({ homeDir, readFile: readFile2 });
+  if (credentialsUrl) {
+    if (cloud && isLoopbackConsoleUrl(credentialsUrl)) {
+      warnStaleLoopbackCredentialsOnce(credentialsUrl, derivedUrl, { log });
+    } else {
+      return credentialsUrl;
+    }
+  }
+  if (!cloud) {
+    const discoveryUrl = readDiscoveryFileConsoleUrl(repoRoot, { readDiscovery });
+    if (discoveryUrl) return discoveryUrl;
+    if (strict) throw new ConsoleUrlUnresolvedError();
+  }
+  return derivedUrl;
+}
+
+// spex-console/src/lib/cli/defer.ts
+function resolveSpexConsoleUrl(vaultRoot, readDiscovery, opts = {}) {
+  return resolveConsoleUrl({
+    repoRoot: vaultRoot,
+    env: opts.env,
+    homeDir: opts.homeDir,
+    readFile: opts.readFile,
+    readDiscovery,
+    log: opts.log
+  });
+}
+var HELP = [
+  "Usage:",
+  "  hs defer <spec-id> [--until <when>] [--json] [--no-daemon]",
+  "  hs undefer <spec-id> [--json] [--no-daemon]",
+  "",
+  "Time-shift a spec via its `defer_until` frontmatter field. A deferred spec is",
+  "scheduler-invisible until the date passes, then auto-revives.",
+  "",
+  "Arguments:",
+  "  <spec-id>        The spec to defer/undefer (e.g. HS-TASK-EWL5).",
+  "",
+  "Flags:",
+  "  --until <when>   ISO date, or relative offset +Nd / +Nw / +Nm / +Ny.",
+  "                   Defaults to +1y (matches the console Defer button).",
+  "                   Ignored by `undefer` (which always clears the field).",
+  "  --json           Emit a machine-readable JSON result.",
+  "  --no-daemon      Write straight to the vault (no console needed; CI path).",
+  "  --help, -h       Show this help.",
+  "",
+  "Exit codes: 0 ok \xB7 1 usage \xB7 10 not-found \xB7 11 bad-arg \xB7 12 console-unreachable \xB7 13 write-failed"
+].join("\n");
+
+// spex-console/src/lib/cli/install-identity.ts
+import { spawnSync } from "node:child_process";
+import { existsSync as existsSync4 } from "node:fs";
+import { homedir as homedir9 } from "node:os";
+import { join as join9 } from "node:path";
+import { createInterface } from "node:readline/promises";
+
+// scripts/lib/shared-path-helpers.mjs
+import { isAbsolute, resolve as resolve4, sep } from "node:path";
+function resolveCodeRoot({
+  explicit,
+  packageRoot,
+  vaultRoot,
+  env = process.env
+} = {}) {
+  const fromExplicit = typeof explicit === "string" ? explicit.trim() : "";
+  if (fromExplicit) return fromExplicit;
+  const fromEnv = typeof env?.HS_PKG_ROOT === "string" ? env.HS_PKG_ROOT.trim() : "";
+  if (fromEnv) return fromEnv;
+  const fromPackage = typeof packageRoot === "string" ? packageRoot.trim() : "";
+  if (fromPackage) return fromPackage;
+  const fromVault = typeof vaultRoot === "string" ? vaultRoot.trim() : "";
+  return fromVault;
+}
+
+// spex-console/src/lib/cli/install-identity.ts
+init_credentials();
+
+// vendor/heyspex-mcp/whoami.mjs
+init_credentials();
+import { homedir as homedir8 } from "node:os";
+var SESSION_PATH = "/api/mcp/session";
+async function probeCredentialIdentity({ consoleUrl, token, fetchImpl = fetch } = {}) {
+  if (!token) return { kind: "no_credential" };
+  const base = String(consoleUrl ?? "").trim().replace(/\/+$/, "");
+  let res;
+  try {
+    res = await fetchImpl(`${base}${SESSION_PATH}`, {
+      method: "GET",
+      headers: { authorization: `Bearer ${token}` },
+      cache: "no-store"
+    });
+  } catch (err) {
+    return { kind: "unreachable", message: err?.message ?? String(err) };
+  }
+  if (res.status === 401 || res.status === 403) return { kind: "rejected", status: res.status };
+  if (res.status === 404 || res.status === 405) return { kind: "unsupported", status: res.status };
+  let body = null;
+  try {
+    body = await res.json();
+  } catch {
+    body = null;
+  }
+  if (!res.ok || !body || typeof body.userId !== "string" || !body.userId.trim()) {
+    return { kind: "unreachable", message: `console returned ${res.status}` };
+  }
+  return {
+    kind: "identified",
+    accountId: body.userId.trim(),
+    email: typeof body.email === "string" && body.email.trim() ? body.email.trim() : null,
+    displayName: typeof body.displayName === "string" && body.displayName.trim() ? body.displayName.trim() : null,
+    // How the console authenticated this caller (the route's `mode`, e.g. a
+    // bearer); the `hs login` receipt shows it ([[HS-CRNE-WW9R-TASK-give-hs-install-and-hs-login-the]]).
+    mode: typeof body.mode === "string" && body.mode.trim() ? body.mode.trim() : null,
+    consoleUrl: base
+  };
+}
+function formatIdentity({ email, accountId: accountId2 }) {
+  return email ? `${email} (${accountId2})` : accountId2;
+}
+
+// spex-console/src/lib/cli/init.ts
+import { randomUUID } from "node:crypto";
+var HELP2 = [
+  "Usage:",
+  "  hs init [--console-url <url>] [--vault-root <path>] [--force] [--json]",
+  "  hs init --customer-vault <dir> [--console-url <url>] [--principles <all|none|a,b>]",
+  "                          [--vault-name <name>] [--git] [--json]",
+  "",
+  "Write the top-level heyspex.yaml vault marker (schema_version, console_url,",
+  "vault_root, vault_id; `hs connect` also records `account:`, the account id the",
+  "repo was connected under) \u2014 the committed file the console / web companion read",
+  "to bootstrap a vault. Idempotent: an existing marker is left untouched unless",
+  "--force, EXCEPT a missing vault_id is backfilled in place either way (backward",
+  "compatible \u2014 no schema_version bump). vault_id is reused exactly when already",
+  "present; a fresh one is minted only when absent.",
+  "Also scaffolds the vault_root folder and seeds .heyspex/config.yaml (the",
+  "HeySpex workflow settings, ADR-0009) from the shipped template",
+  "(vendor/heyspex-mcp/config-seed.yaml) when that file is absent. An existing",
+  ".heyspex/config.yaml is never rewritten \u2014 not even with --force; change its",
+  "values with `hs settings set <key> <value>`.",
+  "",
+  "--customer-vault <dir> scaffolds a REAL customer vault at <dir> instead: the",
+  "specs/ folder tree, heyspex.yaml, the seeded .heyspex/config.yaml, and every",
+  "row of the template shipping manifest",
+  "(spex-console/src/lib/cli/template-manifest.ts) \u2014 universal docs",
+  "copied verbatim, template-shape docs written as author-prompt skeletons \u2014",
+  "plus a generated CLAUDE.md, the kept-principles index, and the template_version",
+  "pin; with --git, one initial `git init` + commit. Rerunnable: a <dir> that already",
+  "holds heyspex.yaml and an empty/placeholder-only specs/ is accepted, existing",
+  "files are never overwritten (an existing CLAUDE.md gets a CLAUDE.md.template",
+  "beside it), and the result lists each manifest row as created or kept. Refuses a",
+  "non-empty <dir> without heyspex.yaml, or a specs/ holding managed specs.",
+  "See init.customer-vault.ts.",
+  "",
+  "Flags:",
+  "  --console-url <url>  console_url value (default: the mode-aware console --",
+  "                       $HEYSPEX_CONSOLE_URL, else the signed-in console, else",
+  "                       https://app.heyspex.com in prod mode).",
+  "  --vault-root <path>  vault_root value (default: specs/).",
+  "  --customer-vault <dir> Scaffold a new customer vault at <dir> (see above).",
+  "  --principles <all|none|a,b> Which universal principle docs to ship",
+  "                       (--customer-vault only). Omitted + a TTY: interactive",
+  "                       keep/skip prompt per principle. Omitted + no TTY: all.",
+  "  --vault-name <name>  Display name for the scaffolded vault (--customer-vault",
+  "                       only; default: <dir>'s basename).",
+  "  --git                Also run git init + one initial commit (--customer-vault only;",
+  "                       default: no git). --no-git is accepted as a no-op.",
+  "  --force              Overwrite an existing heyspex.yaml (never .heyspex/config.yaml).",
+  "  --json               Emit a machine-readable JSON result.",
+  "  --help, -h           Show this help.",
+  "",
+  "Exit codes: 0 ok \xB7 1 usage \xB7 11 bad-arg \xB7 13 write-failed"
+].join("\n");
+
+// spex-console/src/lib/cli/install-identity.ts
+var SWITCH_HINT = "Sign in as another account with `hs login --switch-account` (or create one with `hs login --create-account`).";
+var ATTACH_WORDING = {
+  willBe: "This repo will be attached to",
+  wouldBe: "It would be attached to",
+  act: "attach this repo",
+  choose: "Choose the account this repo should belong to.",
+  noAccount: "there is no account to attach this repo to",
+  whichAccount: "which account this repo would be attached to",
+  accountFlag: "--account",
+  yesFlag: "--yes"
+};
+var WRITE_WORDING = {
+  willBe: "This change will be made as",
+  wouldBe: "It would be made as",
+  act: "make this change",
+  choose: "Choose the account this change should be made as.",
+  noAccount: "there is no account to make this change as",
+  whichAccount: "which account this change would be made as",
+  accountFlag: "--as",
+  yesFlag: "--confirm-account"
+};
+function extractWriteIdentityFlags(argv) {
+  const flags = { yes: false };
+  const rest = [];
+  for (let i = 0; i < argv.length; i++) {
+    const arg = argv[i];
+    if (arg === "--as" || arg.startsWith("--as=")) {
+      const v = arg === "--as" ? argv[++i] : arg.slice("--as=".length);
+      if (v === void 0 || v.trim() === "" || v.trim().startsWith("-")) {
+        return { flags, rest, error: "--as requires the signed-in account's email or account id" };
+      }
+      flags.account = v.trim();
+    } else if (arg === "--confirm-account") {
+      flags.yes = true;
+    } else {
+      rest.push(arg);
+    }
+  }
+  return { flags, rest };
+}
+function matchesAccount(identity, wanted) {
+  const w = wanted.trim().toLowerCase();
+  return identity.accountId.toLowerCase() === w || (identity.email?.toLowerCase() ?? "") === w;
+}
+function formatShownIdentity(identity) {
+  return formatIdentity(identity) + (identity.unverified ? " [unverified - console not yet updated]" : "") + (identity.tokenSource ? ` [token: ${describeBearerSource(identity.tokenSource)}]` : "");
+}
+async function probeBearerIdentity(opts) {
+  const probe = await probeCredentialIdentity({
+    consoleUrl: opts.consoleUrl,
+    token: opts.bearer.token,
+    fetchImpl: opts.fetchImpl ?? fetch
+  });
+  if (probe.kind === "identified" && opts.bearer.source) {
+    return { ...probe, tokenSource: opts.bearer.source };
+  }
+  return probe;
+}
+function decideIdentity(input) {
+  const { probe, configAccountId, flags, interactive, consoleUrl, verb } = input;
+  const w = input.wording ?? ATTACH_WORDING;
+  if (isLoopbackConsoleUrl(consoleUrl)) {
+    return {
+      action: "proceed",
+      identity: null,
+      note: `Local console (${consoleUrl}): no cloud account is bound by this run.`
+    };
+  }
+  if (probe.kind === "no_credential" || probe.kind === "rejected") {
+    const why = probe.kind === "no_credential" ? "This machine is not signed in to HeySpex" : `The stored sign-in was rejected by ${consoleUrl} (HTTP ${probe.status}) - revoked, or from another console`;
+    if (interactive) {
+      return {
+        action: "prompt",
+        identity: null,
+        message: `${why}. ${w.choose}`,
+        choices: ["switch", "create", "quit"]
+      };
+    }
+    return {
+      action: "refuse",
+      code: EXIT.SIGN_IN_REQUIRED,
+      message: `${verb}: refusing -- ${why.charAt(0).toLowerCase()}${why.slice(1)}, so ${w.noAccount}. Run \`hs login\` (or \`hs login --create-account\`) first; nothing was written.`
+    };
+  }
+  if (probe.kind === "unreachable") {
+    if (flags.yes) {
+      return {
+        action: "proceed",
+        identity: null,
+        note: `Could not reach ${consoleUrl} to confirm the account (${probe.message}); continuing because ${w.yesFlag} was given.`
+      };
+    }
+    return {
+      action: "refuse",
+      code: EXIT.CONSOLE_UNREACHABLE,
+      message: `${verb}: refusing -- could not reach ${consoleUrl} to confirm ${w.whichAccount} (${probe.message}). Retry when online, or pass ${w.yesFlag} to continue without confirming. Nothing was written.`
+    };
+  }
+  let identity;
+  if (probe.kind === "unsupported") {
+    if (!configAccountId) {
+      return {
+        action: "refuse",
+        code: EXIT.SIGN_IN_REQUIRED,
+        message: `${verb}: refusing -- ${consoleUrl} cannot confirm whose sign-in this is yet, and no current account is recorded in ~/.heyspex/credentials.yaml.Run \`hs login\` first; nothing was written.`
+      };
+    }
+    identity = { accountId: configAccountId, email: null, unverified: true };
+  } else {
+    identity = {
+      accountId: probe.accountId,
+      email: probe.email,
+      ...probe.tokenSource ? { tokenSource: probe.tokenSource } : {}
+    };
+    if (configAccountId && configAccountId !== probe.accountId) {
+      const message2 = `The sign-in on this machine belongs to ${formatIdentity(identity)}, but this machine's current account (~/.heyspex/credentials.yaml, or HS_ACCOUNT_ID) is ${configAccountId}. A repo bound now would be registered under one and written under the other.`;
+      if (interactive) {
+        return { action: "prompt", identity, message: message2, choices: ["switch", "create", "quit"] };
+      }
+      return {
+        action: "refuse",
+        code: EXIT.IDENTITY_UNCONFIRMED,
+        message: `${verb}: refusing -- ${message2} ${SWITCH_HINT} Nothing was written.`
+      };
+    }
+  }
+  const shown = formatShownIdentity(identity);
+  if (flags.account !== void 0) {
+    if (matchesAccount(identity, flags.account)) {
+      return { action: "proceed", identity, note: `${w.willBe} ${shown}.` };
+    }
+    return {
+      action: "refuse",
+      code: EXIT.IDENTITY_UNCONFIRMED,
+      message: `${verb}: refusing -- ${w.accountFlag} ${flags.account} does not match the signed-in account ${shown}. ${SWITCH_HINT} Nothing was written.`
+    };
+  }
+  if (flags.yes) {
+    return { action: "proceed", identity, note: `${w.willBe} ${shown} (${w.yesFlag}).` };
+  }
+  if (interactive) {
+    return {
+      action: "prompt",
+      identity,
+      message: `${w.willBe} ${shown} on ${consoleUrl}.`,
+      choices: ["continue", "switch", "create", "quit"]
+    };
+  }
+  return {
+    action: "refuse",
+    code: EXIT.IDENTITY_UNCONFIRMED,
+    message: `${verb}: refusing to ${w.act} without confirming the account. ${w.wouldBe} ${shown} on ${consoleUrl}. Confirm with ${w.accountFlag} ${identity.email ?? identity.accountId} (or ${w.yesFlag}), or ${SWITCH_HINT.charAt(0).toLowerCase()}${SWITCH_HINT.slice(1)} An agent should ask the user which account to use. Nothing was written.`
+  };
+}
+function renderChoices(choices, signedIn) {
+  const label = {
+    continue: "[Enter] continue",
+    switch: signedIn ? "[s] sign in with a different account" : "[s] sign in",
+    create: "[n] create a new account",
+    quit: "[q] abort"
+  };
+  return choices.map((c) => label[c]).join(" - ");
+}
+function parseChoice(answer, choices) {
+  const a = answer.trim().toLowerCase();
+  const picked = a === "" || a === "c" || a === "continue" || a === "y" || a === "yes" ? "continue" : a === "s" || a === "switch" || a === "sign in" ? "switch" : a === "n" || a === "new" || a === "create" ? "create" : a === "q" || a === "quit" || a === "abort" ? "quit" : null;
+  return picked && choices.includes(picked) ? picked : null;
+}
+function refusal(code, message2, reason) {
+  return {
+    ok: false,
+    result: { code, message: message2, payload: { ok: false, error: reason, message: message2 }, isError: true }
+  };
+}
+var MAX_ROUNDS = 4;
+async function runIdentityGate(io, flags, verb, wording = ATTACH_WORDING) {
+  for (let round = 0; round < MAX_ROUNDS; round++) {
+    const probe = await io.probe();
+    const decision = decideIdentity({
+      probe,
+      configAccountId: io.readConfigAccountId(),
+      flags,
+      interactive: io.interactive,
+      consoleUrl: io.consoleUrl,
+      verb,
+      wording
+    });
+    if (decision.action === "proceed") {
+      io.print(decision.note);
+      return { ok: true, identity: decision.identity, note: decision.note };
+    }
+    if (decision.action === "refuse") {
+      return refusal(decision.code, decision.message, "identity_unconfirmed");
+    }
+    io.print(decision.message);
+    const menu = renderChoices(decision.choices, decision.identity !== null);
+    let choice = null;
+    while (choice === null) {
+      choice = parseChoice(await io.ask(`${menu}: `), decision.choices);
+    }
+    if (choice === "continue") {
+      const note = `${wording.willBe} ${formatShownIdentity(decision.identity)}.`;
+      return { ok: true, identity: decision.identity, note };
+    }
+    if (choice === "quit") {
+      return refusal(
+        EXIT.IDENTITY_UNCONFIRMED,
+        `${verb}: aborted - nothing was written.`,
+        "aborted"
+      );
+    }
+    const code = await io.runLogin(choice === "create" ? "create" : "select_account");
+    if (code !== 0) {
+      io.print(`hs login exited ${code}; the account was not changed.`);
+    }
+  }
+  return refusal(
+    EXIT.IDENTITY_UNCONFIRMED,
+    `${verb}: refusing -- the account was still not confirmed after several sign-in attempts. Nothing was written.`,
+    "identity_unconfirmed"
+  );
+}
+var WORKSPACE_WRITE_VERBS = /* @__PURE__ */ new Set([
+  "create",
+  "rename",
+  "unregister",
+  "archive",
+  "restore"
+]);
+async function gateWriteVerb(opts) {
+  if (!opts.writeVerbs.has(opts.sub)) return null;
+  return runIdentityGate(opts.io, opts.flags, `${opts.namespace} ${opts.sub}`, WRITE_WORDING);
+}
+function readConfiguredAccountId(env = process.env, homeDir = homedir9()) {
+  return resolveSessionOwnerUncached({ env, homeDir });
+}
+function isInteractiveTerminal() {
+  return Boolean(process.stdin.isTTY && process.stderr.isTTY) && process.env.CI !== "true";
+}
+function defaultIdentityGateIo(opts) {
+  const consoleUrl = opts.consoleUrl.trim().replace(/\/+$/, "");
+  const loginCli = [opts.platformRoot, resolveCodeRoot({})].filter((r) => Boolean(r && r.trim())).map((r) => join9(r, "vendor", "heyspex-mcp", "cli.mjs")).find((p) => existsSync4(p));
+  return {
+    consoleUrl,
+    interactive: opts.interactive ?? isInteractiveTerminal(),
+    probe: () => probeBearerIdentity({ consoleUrl, bearer: readPairedBearer(), fetchImpl: fetch }),
+    readConfigAccountId: () => readConfiguredAccountId(),
+    ask: async (question) => {
+      const rl = createInterface({ input: process.stdin, output: process.stderr });
+      try {
+        return await rl.question(question);
+      } finally {
+        rl.close();
+      }
+    },
+    runLogin: async (prompt) => {
+      const flag = prompt === "create" ? "--create-account" : "--switch-account";
+      if (!loginCli) {
+        process.stderr.write(
+          `Run \`hs login ${flag}\` in another terminal, then come back here.
+`
+        );
+        const rl = createInterface({ input: process.stdin, output: process.stderr });
+        try {
+          await rl.question("Press Enter when the sign-in has finished: ");
+        } finally {
+          rl.close();
+        }
+        return 0;
+      }
+      const res = spawnSync(
+        process.execPath,
+        [loginCli, "login", flag, "--console-url", consoleUrl],
+        {
+          stdio: "inherit",
+          env: { ...process.env, HEYSPEX_DISABLE_STDIO_BOOTSTRAP: "1" }
+        }
+      );
+      return res.status ?? 1;
+    },
+    print: (line) => process.stderr.write(`${line}
+`)
+  };
+}
+
+// spex-console/src/lib/vault-registry/account-pointer.ts
+init_sql_orm_inert_cli_shim();
+
+// spex-console/src/lib/cli/vault-workspace-shared.ts
+import { readFileSync as readFileSync8 } from "node:fs";
+import os2 from "node:os";
+
+// spex-console/src/lib/cli/default-workspace.ts
+function defaultWorkspaceId(accountId2) {
+  const sanitized = accountId2.replace(/[/\\.\s]+/g, "-").replace(/^-+|-+$/g, "");
+  return `ws-${sanitized || "account"}`;
+}
+
+// spex-console/src/lib/cli/vault-workspace-shared.ts
+function resolveConfiguredAccountId(opts = {}) {
+  return resolveSessionOwnerUncached({
+    env: opts.env ?? process.env,
+    homeDir: opts.homeDir ?? os2.homedir(),
+    readFile: opts.readFile ?? ((p) => readFileSync8(p, "utf-8"))
+  });
+}
+var CLOUD_ACCOUNT_ID_REQUIRED_MESSAGE = "refusing -- no signed-in account (no HS_ACCOUNT_ID env var, and no account_id: in ~/.heyspex/config.yaml). Run `hs login` first; nothing was written.";
+function resolveCloudAccountIdOrRefuse(opts = {}) {
+  const accountId2 = resolveConfiguredAccountId(opts);
+  return accountId2 ? { ok: true, accountId: accountId2 } : { ok: false, message: CLOUD_ACCOUNT_ID_REQUIRED_MESSAGE };
+}
+var WORKSPACE_OWNED_BY_OTHER_ACCOUNT = "workspace_owned_by_other_account";
+function workspaceOwnedByOtherAccountMessage(id) {
+  return `workspace "${id}" belongs to another HeySpex account, so nothing was changed. Pick a different workspace id (e.g. \`--workspace <new-id>\`), or sign in as the account that owns it (\`hs login --switch-account\`). Transferring a workspace between accounts is not supported.`;
+}
+function classifyHttpFailureReason(res) {
+  if (res.status === 0) return "network-error";
+  if (res.status === 401) return "unauthorized";
+  return "server-error";
+}
+async function cloudHttpRequest(http, method, path4, body) {
+  const scopeHeaders = http.scope ? http.scope.headersFor(method, path4) : {};
+  try {
+    const res = await http.fetchImpl(`${http.consoleUrl}${path4}`, {
+      method,
+      headers: {
+        "content-type": "application/json",
+        ...http.token ? { authorization: `Bearer ${http.token}` } : {},
+        ...scopeHeaders
+      },
+      ...body !== void 0 ? { body: JSON.stringify(body) } : {}
+    });
+    let json = null;
+    try {
+      json = await res.json();
+    } catch {
+    }
+    return { ok: res.ok, status: res.status, json };
+  } catch {
+    return { ok: false, status: 0, json: null };
+  }
+}
+function isCloudWriteFailure(value) {
+  return typeof value === "object" && value !== null && value.kind === "cloud_write_failed";
+}
+function cloudWriteFailure(http, res) {
+  const where = http.consoleUrl;
+  let message2;
+  if (res.status === 0) {
+    message2 = `could not reach the console at ${where} -- nothing was changed; check the connection and re-run the command to retry`;
+  } else if (res.status === 401) {
+    message2 = `the console at ${where} refused the sign-in token (HTTP 401) -- nothing was changed; run \`hs login\` and re-run the command`;
+  } else {
+    const code = errorCodeOf(res.json);
+    message2 = `the console at ${where} answered HTTP ${res.status}${code ? ` (${code})` : ""} -- nothing was changed; re-run the command to retry`;
+  }
+  return { kind: "cloud_write_failed", status: res.status, message: message2 };
+}
+function errorCodeOf(json) {
+  if (!json || typeof json !== "object") return null;
+  const v = json.error;
+  return typeof v === "string" ? v : null;
+}
+async function classifyWorkspaceConflictHttp(id, conflictJson, http) {
+  if (errorCodeOf(conflictJson) === WORKSPACE_OWNED_BY_OTHER_ACCOUNT) {
+    return { written: false, reason: "owned-by-other-account" };
+  }
+  if (conflictJson && typeof conflictJson === "object" && conflictJson.owned_by_caller === true) {
+    return { written: true };
+  }
+  const list = await cloudHttpRequest(http, "GET", "/api/workspaces?include_archived=true");
+  if (!list.ok) return { written: false, reason: classifyHttpFailureReason(list) };
+  const rows = list.json?.workspaces;
+  if (!Array.isArray(rows)) return { written: false, reason: "server-error" };
+  return rows.some((w) => w.id === id) ? { written: true } : { written: false, reason: "owned-by-other-account" };
+}
+async function mutateHttp(http, method, path4, body, landed) {
+  const res = await cloudHttpRequest(http, method, path4, body);
+  if (res.ok) return landed;
+  if (res.status === 404) return "not_found";
+  return cloudWriteFailure(http, res);
+}
+function manageVerbPath(kind, id) {
+  return `/api/${kind}/${encodeURIComponent(id)}`;
+}
+
+// spex-console/src/lib/vault-registry/account-pointer.ts
+init_postgres_client_cli_shim();
+init_postgres();
+
+// spex-console/src/lib/vault-registry/neon-probe.ts
+var NEON_PROBE_TIMEOUT_MS = 1500;
+var SUSPENSION_ELAPSED_FACTOR = 3;
+var SUSPENSION_MIN_OVERSHOOT_MS = 5e3;
+var MAX_SUSPENSION_RETRIES = 2;
+function withTimeout(promise, ms, label) {
+  return new Promise((resolve5, reject) => {
+    const timer = setTimeout(() => reject(new NeonProbeTimeoutError(label, ms)), ms);
+    promise.then(
+      (value) => {
+        clearTimeout(timer);
+        resolve5(value);
+      },
+      (err) => {
+        clearTimeout(timer);
+        reject(err instanceof Error ? err : new Error(String(err)));
+      }
+    );
+  });
+}
+var NeonProbeTimeoutError = class _NeonProbeTimeoutError extends Error {
+  timeoutMs;
+  constructor(label, timeoutMs) {
+    super(`${label} timed out after ${timeoutMs}ms`);
+    this.name = "NeonProbeTimeoutError";
+    this.timeoutMs = timeoutMs;
+    Object.setPrototypeOf(this, _NeonProbeTimeoutError.prototype);
+  }
+};
+function sleep(ms) {
+  return new Promise((resolve5) => setTimeout(resolve5, ms));
 }
-function removeWorkspace(id, opts = {}) {
-  const registry = loadVaultRegistry(opts);
-  registry.workspaces = registry.workspaces.filter((w) => w.id !== id);
-  if (registry.active_workspace_id === id) {
-    registry.active_workspace_id = null;
+function emitProbeFailure(options, failure) {
+  try {
+    options?.onFailure?.(failure);
+  } catch {
   }
-  writeVaultRegistry(registry, opts);
-  return registry;
 }
-var init_registry_file = __esm({
-  "spex-console/src/lib/vault-registry/registry-file.ts"() {
-    "use strict";
-    init_types();
-    init_types();
+async function runNeonReachabilityProbe(attempt, options = {}, label = "Neon reachability probe") {
+  const timeoutMs = options.timeoutMs ?? NEON_PROBE_TIMEOUT_MS;
+  const backoffMs = options.backoffMs ?? [];
+  const deadlineMs = options.deadlineMs ?? Number.POSITIVE_INFINITY;
+  const attempts = backoffMs.length + 1;
+  let startedAt = Date.now();
+  let suspensions = 0;
+  for (let i = 0; i < attempts; i++) {
+    const attemptStartedAt = Date.now();
+    try {
+      await withTimeout(Promise.resolve().then(attempt), timeoutMs, label);
+      return true;
+    } catch (err) {
+      const elapsedMs = Date.now() - attemptStartedAt;
+      const suspended = elapsedMs >= timeoutMs * SUSPENSION_ELAPSED_FACTOR && elapsedMs - timeoutMs >= SUSPENSION_MIN_OVERSHOOT_MS;
+      if (suspended && suspensions < MAX_SUSPENSION_RETRIES) {
+        suspensions += 1;
+        emitProbeFailure(options, {
+          reason: "suspended",
+          attempt: i + 1,
+          attempts,
+          timeoutMs,
+          elapsedMs,
+          willRetry: true,
+          error: err
+        });
+        startedAt = Date.now();
+        i -= 1;
+        continue;
+      }
+      const isLast = i === attempts - 1;
+      const pastDeadline = Date.now() - startedAt >= deadlineMs;
+      const willRetry = !isLast && !pastDeadline;
+      emitProbeFailure(options, {
+        reason: err instanceof NeonProbeTimeoutError ? "timeout" : "error",
+        attempt: i + 1,
+        attempts,
+        timeoutMs,
+        elapsedMs,
+        willRetry,
+        error: err
+      });
+      if (!willRetry) return false;
+      await sleep(backoffMs[i]);
+    }
   }
-});
+  return false;
+}
 
 // spex-console/src/lib/vault-registry/account-pointer.ts
+var UnknownWorkspaceIdError = class extends Error {
+  workspaceId;
+  constructor(workspaceId) {
+    super(
+      `setActiveWorkspace: unknown workspace id "${workspaceId}" \u2014 no matching row in Neon "workspaces" or registry.json's workspaces[] list. Nothing was written.`
+    );
+    this.name = "UnknownWorkspaceIdError";
+    this.workspaceId = workspaceId;
+  }
+};
+var CloudPointerWriteError = class extends Error {
+  status;
+  consoleUrl;
+  constructor(consoleUrl, status, code) {
+    super(
+      status === 0 ? `could not reach the console at ${consoleUrl} to write the active pointer` : status === 401 ? `the console at ${consoleUrl} refused the sign-in token (HTTP 401) -- run \`hs login\`` : `the console at ${consoleUrl} answered HTTP ${status}${code ? ` (${code})` : ""} to the active-pointer write`
+    );
+    this.name = "CloudPointerWriteError";
+    this.status = status;
+    this.consoleUrl = consoleUrl;
+  }
+};
 async function isNeonReachable(deps) {
   if (deps.neonReachable !== void 0) return deps.neonReachable;
   const usingInjectedDb = deps.db !== void 0;
@@ -1742,6 +3247,19 @@ async function isNeonReachable(deps) {
     await db.execute(sql`select 1`);
   }, deps.probe);
 }
+function shouldUseHttp(deps) {
+  return deps.db === void 0 && deps.http !== void 0;
+}
+async function readPointerHttp(http) {
+  const res = await cloudHttpRequest(http, "GET", "/api/vaults/active");
+  if (!res.ok || !res.json || typeof res.json !== "object") return null;
+  return res.json;
+}
+function errorCodeOf2(json) {
+  if (!json || typeof json !== "object") return null;
+  const v = json.error;
+  return typeof v === "string" ? v : null;
+}
 async function accountSettingsRow(accountId2, db) {
   const rows = await db.select().from(accountSettings).where(eq(accountSettings.accountId, accountId2)).limit(1);
   return rows[0] ?? null;
@@ -1761,14 +3279,30 @@ function workspaceExistsInRegistry(workspaceId, opts) {
   return loadVaultRegistry(opts).workspaces.some((w) => w.id === workspaceId);
 }
 async function getActiveWorkspace(accountId2, deps = {}) {
-  if (await isNeonReachable(deps)) {
+  if (shouldUseHttp(deps)) {
+    const body = await readPointerHttp(deps.http);
+    if (body) {
+      return typeof body.workspace_id === "string" && body.workspace_id ? body.workspace_id : null;
+    }
+  } else if (await isNeonReachable(deps)) {
     const db = deps.db ?? getPostgresDb();
     const row = await accountSettingsRow(accountId2, db);
     return row?.activeWorkspaceId ?? null;
   }
-  return loadVaultRegistry(deps.registryOpts).active_workspace_id;
+  return accountPointersOf(loadVaultRegistry(deps.registryOpts), accountId2).active_workspace_id;
 }
 async function setActiveWorkspace(accountId2, workspaceId, deps = {}) {
+  if (shouldUseHttp(deps)) {
+    const res = await cloudHttpRequest(deps.http, "POST", "/api/vaults/active", {
+      workspace_id: workspaceId
+    });
+    if (res.ok) return;
+    const code = errorCodeOf2(res.json);
+    if (res.status === 404 && code === "unknown_workspace") {
+      throw new UnknownWorkspaceIdError(workspaceId);
+    }
+    throw new CloudPointerWriteError(deps.http.consoleUrl, res.status, code);
+  }
   if (await isNeonReachable(deps)) {
     const db = deps.db ?? getPostgresDb();
     if (!await workspaceExistsInNeon(accountId2, workspaceId, db)) {
@@ -1781,108 +3315,50 @@ async function setActiveWorkspace(accountId2, workspaceId, deps = {}) {
   if (!workspaceExistsInRegistry(workspaceId, registryOpts)) {
     throw new UnknownWorkspaceIdError(workspaceId);
   }
-  setActiveWorkspaceId(workspaceId, registryOpts);
+  setActiveWorkspaceId(accountId2, workspaceId, registryOpts);
 }
 async function clearActiveWorkspace(accountId2, deps = {}) {
-  if (await isNeonReachable(deps)) {
+  if (!shouldUseHttp(deps) && await isNeonReachable(deps)) {
     const db = deps.db ?? getPostgresDb();
     await upsertAccountSettings(accountId2, { activeWorkspaceId: null }, db);
     return;
   }
-  setActiveWorkspaceId(null, deps.registryOpts ?? {});
+  setActiveWorkspaceId(accountId2, null, deps.registryOpts ?? {});
 }
-var UnknownWorkspaceIdError;
-var init_account_pointer = __esm({
-  "spex-console/src/lib/vault-registry/account-pointer.ts"() {
-    "use strict";
-    init_sql_orm_inert_cli_shim();
-    init_postgres_client_cli_shim();
-    init_postgres();
-    init_neon_probe();
-    init_registry_file();
-    UnknownWorkspaceIdError = class extends Error {
-      workspaceId;
-      constructor(workspaceId) {
-        super(
-          `setActiveWorkspace: unknown workspace id "${workspaceId}" \u2014 no matching row in Neon "workspaces" or registry.json's workspaces[] list. Nothing was written.`
-        );
-        this.name = "UnknownWorkspaceIdError";
-        this.workspaceId = workspaceId;
-      }
-    };
+
+// dist/cli/._admin-scope-inert.cli-shim.mjs
+async function resolveScopedAccountId(callerAccountId, requestedAccountId) {
+  const target = requestedAccountId == null ? "" : String(requestedAccountId).trim();
+  if (!target || target === callerAccountId) {
+    return { ok: true, accountId: callerAccountId };
   }
-});
+  return {
+    ok: false,
+    code: "forbidden_account_override",
+    message: "Only a builder/admin may act on another account's workspaces or vaults."
+  };
+}
+
+// spex-console/src/lib/vault-registry/vault-workspace-store.ts
+init_sql_orm_inert_cli_shim();
+init_postgres_client_cli_shim();
+init_postgres();
 
 // spex-console/src/lib/vault-registry/repo-identity.ts
 import path2 from "node:path";
-var init_repo_identity = __esm({
-  "spex-console/src/lib/vault-registry/repo-identity.ts"() {
-    "use strict";
-  }
-});
 
-// spex-console/src/lib/cli/vault-workspace-shared.ts
-import { readFileSync as readFileSync5 } from "node:fs";
-import os2 from "node:os";
-import path3 from "node:path";
-function resolveCliAccountId(opts = {}) {
-  const env = opts.env ?? process.env;
-  const fromEnv = env.HS_ACCOUNT_ID?.trim();
-  if (fromEnv) return fromEnv;
-  try {
-    const homeDir = opts.homeDir ?? os2.homedir();
-    const readFile2 = opts.readFile ?? ((p) => readFileSync5(p, "utf-8"));
-    const config = readFile2(path3.join(homeDir, ".heyspex", "config.yaml"));
-    const match = config.match(/^account_id:\s*["']?([^"'\r\n#]+)/m);
-    const value = match?.[1]?.trim();
-    if (value && value.length > 0) return value;
-  } catch {
-  }
-  return DEFAULT_ACCOUNT_ID;
-}
-async function cloudHttpRequest(http, method, path5, body) {
-  try {
-    const res = await http.fetchImpl(`${http.consoleUrl}${path5}`, {
-      method,
-      headers: {
-        "content-type": "application/json",
-        ...http.token ? { authorization: `Bearer ${http.token}` } : {}
-      },
-      ...body !== void 0 ? { body: JSON.stringify(body) } : {}
-    });
-    let json = null;
-    try {
-      json = await res.json();
-    } catch {
-    }
-    return { ok: res.ok, status: res.status, json };
-  } catch {
-    return { ok: false, status: 0, json: null };
-  }
+// spex-console/src/lib/vault-registry/vault-workspace-store.ts
+function mapProbeFailureReason(reason) {
+  return reason === "not-configured" ? "not-configured" : "network-error";
 }
 function shouldUseCloudHttp(deps) {
-  return deps.db === void 0 && deps.http !== void 0 && !isPostgresConfigured();
+  return deps.db === void 0 && deps.http !== void 0;
 }
-async function upsertWorkspaceHttp(record, http) {
-  const res = await cloudHttpRequest(http, "POST", "/api/workspaces", {
-    id: record.id,
-    display_name: record.displayName,
-    ...record.githubOrg ? { github_org: record.githubOrg } : {}
-  });
-  return res.status === 201 || res.status === 409;
-}
-async function insertWorkspaceStrictHttp(record, http) {
-  const res = await cloudHttpRequest(http, "POST", "/api/workspaces", {
-    id: record.id,
-    display_name: record.displayName,
-    ...record.githubOrg ? { github_org: record.githubOrg } : {}
-  });
-  if (res.status === 201) return "inserted";
-  if (res.status === 409) return "conflict";
-  return "unreachable";
-}
-async function isNeonReachableForWrite(deps) {
-  if (deps.neonReachable !== void 0) return deps.neonReachable;
+async function isNeonReachableForWriteWithReason(deps) {
+  if (shouldUseCloudHttp(deps)) return { reachable: false, reason: "not-configured" };
+  if (deps.neonReachable !== void 0) {
+    return deps.neonReachable ? { reachable: true } : { reachable: false, reason: "network-error" };
+  }
   const usingInjectedDb = deps.db !== void 0;
   if (!usingInjectedDb && !isPostgresConfigured()) {
     emitProbeFailure(deps.probe, {
@@ -1896,19 +3372,46 @@ async function isNeonReachableForWrite(deps) {
         "isPostgresConfigured() is false \u2014 no DATABASE_URL env var and no usable ~/.heyspex/credentials.yaml. Neon was never contacted."
       )
     });
-    return false;
+    return { reachable: false, reason: "not-configured" };
   }
-  return runNeonReachabilityProbe(async () => {
-    const db = deps.db ?? getPostgresDb();
-    await db.execute(sql`select 1`);
-  }, deps.probe);
+  let reason = "network-error";
+  const reachable = await runNeonReachabilityProbe(
+    async () => {
+      const db = deps.db ?? getPostgresDb();
+      await db.execute(sql`select 1`);
+    },
+    {
+      ...deps.probe,
+      onFailure: (failure) => {
+        reason = mapProbeFailureReason(failure.reason);
+        deps.probe?.onFailure?.(failure);
+      }
+    }
+  );
+  return reachable ? { reachable: true } : { reachable: false, reason };
+}
+async function isNeonReachableForWrite(deps) {
+  return (await isNeonReachableForWriteWithReason(deps)).reachable;
 }
-async function upsertWorkspaceNeon(record, accountId2, deps = {}) {
-  if (shouldUseCloudHttp(deps)) return upsertWorkspaceHttp(record, deps.http);
-  if (!await isNeonReachableForWrite(deps)) return false;
+async function upsertWorkspaceNeonReasoned(record, accountId2, deps = {}) {
+  if (isReservedForOtherAccountsDefault(record.id, accountId2)) {
+    return { written: false, reason: "owned-by-other-account" };
+  }
+  if (shouldUseCloudHttp(deps)) {
+    const res = await cloudHttpRequest(deps.http, "POST", "/api/workspaces", {
+      id: record.id,
+      display_name: record.displayName,
+      ...record.githubOrg ? { github_org: record.githubOrg } : {}
+    });
+    if (res.status === 201) return { written: true };
+    if (res.status === 409) return classifyWorkspaceConflictHttp(record.id, res.json, deps.http);
+    return { written: false, reason: classifyHttpFailureReason(res) };
+  }
+  const reach = await isNeonReachableForWriteWithReason(deps);
+  if (!reach.reachable) return { written: false, reason: reach.reason };
   try {
     const db = deps.db ?? getPostgresDb();
-    await db.insert(workspaces).values({
+    const rows = await db.insert(workspaces).values({
       id: record.id,
       accountId: accountId2,
       displayName: record.displayName,
@@ -1918,16 +3421,27 @@ async function upsertWorkspaceNeon(record, accountId2, deps = {}) {
       set: {
         displayName: record.displayName,
         ...record.githubOrg ? { githubOrg: record.githubOrg } : {}
-      }
-    });
-    return true;
+      },
+      setWhere: eq(workspaces.accountId, accountId2)
+    }).returning({ id: workspaces.id });
+    return rows.length > 0 ? { written: true } : { written: false, reason: "owned-by-other-account" };
   } catch {
-    return false;
+    return { written: false, reason: "server-error" };
   }
 }
-async function insertWorkspaceNeonStrict(record, accountId2, deps = {}) {
-  if (shouldUseCloudHttp(deps)) return insertWorkspaceStrictHttp(record, deps.http);
-  if (!await isNeonReachableForWrite(deps)) return "unreachable";
+async function insertWorkspaceNeonStrictReasoned(record, accountId2, deps = {}) {
+  if (shouldUseCloudHttp(deps)) {
+    const res = await cloudHttpRequest(deps.http, "POST", "/api/workspaces", {
+      id: record.id,
+      display_name: record.displayName,
+      ...record.githubOrg ? { github_org: record.githubOrg } : {}
+    });
+    if (res.status === 201) return { result: "inserted" };
+    if (res.status === 409) return { result: "conflict" };
+    return { result: "unreachable", reason: classifyHttpFailureReason(res) };
+  }
+  const reach = await isNeonReachableForWriteWithReason(deps);
+  if (!reach.reachable) return { result: "unreachable", reason: reach.reason };
   try {
     const db = deps.db ?? getPostgresDb();
     const rows = await db.insert(workspaces).values({
@@ -1936,9 +3450,9 @@ async function insertWorkspaceNeonStrict(record, accountId2, deps = {}) {
       displayName: record.displayName,
       ...record.githubOrg ? { githubOrg: record.githubOrg } : {}
     }).onConflictDoNothing({ target: workspaces.id }).returning({ id: workspaces.id });
-    return rows.length > 0 ? "inserted" : "conflict";
+    return { result: rows.length > 0 ? "inserted" : "conflict" };
   } catch {
-    return "unreachable";
+    return { result: "unreachable", reason: "server-error" };
   }
 }
 async function listWorkspacesNeon(accountId2, deps = {}) {
@@ -1962,6 +3476,15 @@ async function listWorkspacesNeon(accountId2, deps = {}) {
   }
 }
 async function renameWorkspaceNeon(id, displayName, accountId2, deps = {}) {
+  if (shouldUseCloudHttp(deps)) {
+    return mutateHttp(
+      deps.http,
+      "PATCH",
+      manageVerbPath("workspaces", id),
+      { display_name: displayName },
+      "updated"
+    );
+  }
   if (!await isNeonReachableForWrite(deps)) return "unreachable";
   try {
     const db = deps.db ?? getPostgresDb();
@@ -1972,6 +3495,15 @@ async function renameWorkspaceNeon(id, displayName, accountId2, deps = {}) {
   }
 }
 async function setWorkspaceArchivedNeon(id, archived, accountId2, deps = {}) {
+  if (shouldUseCloudHttp(deps)) {
+    return mutateHttp(
+      deps.http,
+      "PATCH",
+      manageVerbPath("workspaces", id),
+      { archived },
+      "updated"
+    );
+  }
   if (!await isNeonReachableForWrite(deps)) return "unreachable";
   try {
     const db = deps.db ?? getPostgresDb();
@@ -1982,6 +3514,9 @@ async function setWorkspaceArchivedNeon(id, archived, accountId2, deps = {}) {
   }
 }
 async function deleteWorkspaceNeon(id, accountId2, deps = {}) {
+  if (shouldUseCloudHttp(deps)) {
+    return mutateHttp(deps.http, "DELETE", manageVerbPath("workspaces", id), void 0, "deleted");
+  }
   if (!await isNeonReachableForWrite(deps)) return "unreachable";
   try {
     const db = deps.db ?? getPostgresDb();
@@ -1991,146 +3526,22 @@ async function deleteWorkspaceNeon(id, accountId2, deps = {}) {
     return "unreachable";
   }
 }
-var DEFAULT_ACCOUNT_ID;
-var init_vault_workspace_shared = __esm({
-  "spex-console/src/lib/cli/vault-workspace-shared.ts"() {
-    "use strict";
-    init_sql_orm_inert_cli_shim();
-    init_postgres_client_cli_shim();
-    init_interfaces();
-    init_postgres();
-    init_neon_probe();
-    init_repo_identity();
-    DEFAULT_ACCOUNT_ID = SINGLE_USER_ID;
-  }
-});
-
-// spex-console/bin/hs-workspace.ts
-import { readFileSync as readFileSync6 } from "node:fs";
-import path4 from "node:path";
-import process2 from "node:process";
-import { createInterface } from "node:readline/promises";
-
-// spex-console/src/lib/cli/control-shared.ts
-import { readFileSync } from "node:fs";
-import { homedir } from "node:os";
-import { join } from "node:path";
-var EXIT = {
-  /** Success. */
-  OK: 0,
-  /** Usage error — unknown subcommand/flag, or a missing required argument. */
-  USAGE: 1,
-  /** Claim race lost — the spec is already claimed by another agent (409). */
-  CONFLICT: 9,
-  /** Target not found — release of an unheld claim, etc. (404). */
-  NOT_FOUND: 10,
-  /** Invalid argument — bad `--ttl`, unknown `--kind`, unparseable date. */
-  INVALID_ARG: 11,
-  /** SpexConsole unreachable (network error reaching the dev server). */
-  CONSOLE_UNREACHABLE: 12,
-  /** Server failure — a non-OK response that isn't 400/402/404/409. */
-  WRITE_FAILED: 13,
-  /** Neon control plane absent — the endpoint returned 402 (upgrade required). */
-  NEON_REQUIRED: 14,
-  /**
-   * A cross-account `--account <id>` override was refused — the caller is
-   * not a builder/admin (`resolveScopedAccountId`'s `forbidden_account_override`,
-   * [[HS-X3GB-EKLJ-TASK-hs-cli-account-flag-for-cross-account]]). Distinct
-   * from `USAGE`/`INVALID_ARG` — this is an authorization refusal, not a
-   * malformed command.
-   */
-  FORBIDDEN: 15
-};
-function readPairedToken() {
-  try {
-    const raw = readFileSync(join(homedir(), ".heyspex", "credentials.yaml"), "utf-8");
-    const match = raw.match(/\b(hsmcp_[A-Za-z0-9_-]+|hscmp_[A-Za-z0-9_-]+)\b/);
-    return match?.[1];
-  } catch {
-    return void 0;
-  }
-}
-
-// spex-console/src/lib/cli/defer.ts
-import { readFileSync as readFileSync3 } from "node:fs";
-import os from "node:os";
-import path from "node:path";
-
-// scripts/lib/console-url-resolver.mjs
-import { readFileSync as readFileSync2 } from "node:fs";
-import { homedir as homedir2 } from "node:os";
-import { join as join2 } from "node:path";
-var DEFAULT_CONSOLE_URL = "https://app.heyspex.com";
-
-// spex-console/src/lib/cli/defer.ts
-function resolveSpexConsoleUrl(vaultRoot, readDiscovery, opts = {}) {
-  const env = opts.env ?? process.env;
-  const raw = (env.HEYSPEX_CONSOLE_URL ?? env.HEYSPEX_COCKPIT_URL)?.trim();
-  if (raw && raw.length > 0) return raw.replace(/\/+$/, "");
+async function findWorkspaceForAccountNeon(workspaceId, accountId2, deps = {}) {
+  if (!await isNeonReachableForWrite(deps)) return "unreachable";
+  const db = deps.db ?? getPostgresDb();
   try {
-    const homeDir = opts.homeDir ?? os.homedir();
-    const readFile2 = opts.readFile ?? ((p) => readFileSync3(p, "utf-8"));
-    const credentials = readFile2(path.join(homeDir, ".heyspex", "credentials.yaml"));
-    const match = credentials.match(/^console_url:\s*["']?([^"'\r\n#]+)/m);
-    const value = match?.[1]?.trim();
-    if (value && value.length > 0) return value.replace(/\/+$/, "");
+    const rows = await db.select({ id: workspaces.id, displayName: workspaces.displayName }).from(workspaces).where(and(eq(workspaces.id, workspaceId), eq(workspaces.accountId, accountId2))).limit(1);
+    const row = rows[0];
+    return row ? { id: row.id, displayName: row.displayName } : null;
   } catch {
+    return "unreachable";
   }
-  for (const name of ["console-url", "cockpit-url"]) {
-    try {
-      const discovery = readDiscovery(`${vaultRoot}/.heyspex/${name}`);
-      if (discovery && discovery.trim().length > 0) {
-        return discovery.trim().replace(/\/+$/, "");
-      }
-    } catch {
-    }
-  }
-  return DEFAULT_CONSOLE_URL;
-}
-var HELP = [
-  "Usage:",
-  "  hs defer <spec-id> [--until <when>] [--json] [--no-daemon]",
-  "  hs undefer <spec-id> [--json] [--no-daemon]",
-  "",
-  "Time-shift a spec via its `defer_until` frontmatter field. A deferred spec is",
-  "scheduler-invisible until the date passes, then auto-revives.",
-  "",
-  "Arguments:",
-  "  <spec-id>        The spec to defer/undefer (e.g. HS-TASK-EWL5).",
-  "",
-  "Flags:",
-  "  --until <when>   ISO date, or relative offset +Nd / +Nw / +Nm / +Ny.",
-  "                   Defaults to +1y (matches the console Defer button).",
-  "                   Ignored by `undefer` (which always clears the field).",
-  "  --json           Emit a machine-readable JSON result.",
-  "  --no-daemon      Write straight to the vault (no console needed; CI path).",
-  "  --help, -h       Show this help.",
-  "",
-  "Exit codes: 0 ok \xB7 1 usage \xB7 10 not-found \xB7 11 bad-arg \xB7 12 console-unreachable \xB7 13 write-failed"
-].join("\n");
-
-// spex-console/src/lib/cli/workspace.ts
-init_account_pointer();
-
-// dist/cli/._admin-scope-inert.cli-shim.mjs
-async function resolveScopedAccountId(callerAccountId, requestedAccountId) {
-  const target = requestedAccountId == null ? "" : String(requestedAccountId).trim();
-  if (!target || target === callerAccountId) {
-    return { ok: true, accountId: callerAccountId };
-  }
-  return {
-    ok: false,
-    code: "forbidden_account_override",
-    message: "Only a builder/admin may act on another account's workspaces or vaults."
-  };
 }
-
-// spex-console/src/lib/vault-registry/archive.ts
-init_vault_workspace_shared();
+function isReservedForOtherAccountsDefault(workspaceId, accountId2) {
+  return workspaceId.startsWith("ws-user_") && workspaceId !== defaultWorkspaceId(accountId2);
+}
 
 // spex-console/src/lib/vault-registry/active-repoint.ts
-init_account_pointer();
-init_registry_file();
 function pointerDeps(deps) {
   return deps.accountPointer ?? { registryOpts: deps.registryOpts };
 }
@@ -2151,7 +3562,9 @@ async function repointActiveWorkspaceOnRemoval(accountId2, removedWorkspaceId, d
 }
 
 // spex-console/src/lib/vault-registry/archive.ts
-init_registry_file();
+function cloudWriteFailed(failure) {
+  return { ok: false, code: "cloud_write_failed", message: failure.message };
+}
 function workspaceNotFound(id) {
   return { ok: false, code: "workspace_not_found", message: `workspace "${id}" not found` };
 }
@@ -2166,6 +3579,7 @@ async function setWorkspaceArchivedState(input, archived, deps = {}) {
     deps.neon ?? {}
   );
   if (neonResult === "not_found") return workspaceNotFound(input.id);
+  if (isCloudWriteFailure(neonResult)) return cloudWriteFailed(neonResult);
   if (archived) {
     await repointActiveWorkspaceOnRemoval(input.accountId, input.id, {
       registryOpts: deps.registryOpts,
@@ -2218,24 +3632,68 @@ function buildCloseNotDestroyConfirm(kind, verb, displayName) {
 }
 
 // spex-console/src/lib/vault-registry/list.ts
-init_vault_workspace_shared();
-init_account_pointer();
-init_registry_file();
-import { existsSync as existsSync2 } from "node:fs";
+import { existsSync as existsSync5 } from "node:fs";
+
+// spex-console/src/lib/vault-registry/side-effects.ts
+function isLocalRegistryHost() {
+  const override = process.env.HEYSPEX_VAULT_WRITE_MODE?.trim().toLowerCase();
+  if (override === "cloud") return false;
+  if (override === "local") return true;
+  return process.env.VERCEL !== "1";
+}
+function sideEffectErrorMessage(err) {
+  return err instanceof Error ? err.message : String(err);
+}
+function runRegistrySideEffect(write) {
+  const step = "registry_json";
+  if (!isLocalRegistryHost()) return { step, ok: true, skipped: true };
+  try {
+    write();
+    return { step, ok: true };
+  } catch (err) {
+    const error = sideEffectErrorMessage(err);
+    console.error(`[vault-registry] post-write side step "${step}" failed: ${error}`);
+    return { step, ok: false, error };
+  }
+}
+function registryWritten(effect) {
+  return effect.ok && effect.skipped !== true;
+}
+
+// spex-console/src/lib/vault-registry/list.ts
 function pointerDeps2(deps) {
   return deps.accountPointer ?? { registryOpts: deps.registryOpts };
 }
+async function resolveSharedNeonReachable(deps, pDeps) {
+  if (pDeps.neonReachable !== void 0) return pDeps.neonReachable;
+  if (!isLocalRegistryHost()) return true;
+  const probe = deps.neonReachableProbe ?? ((d) => isNeonReachableForWrite({ db: d.db, probe: d.probe }));
+  return probe(pDeps);
+}
 function localWorkspaceRows(deps) {
   return loadVaultRegistry(deps.registryOpts).workspaces;
 }
+function originTaggedWorkspaceRows(neonRows, deps) {
+  if (neonRows === null) {
+    const rows = deps.allowLocalRegistryFallback ? localWorkspaceRows(deps) : [];
+    return rows.map((w) => ({ ...w, origin: "registry-only" }));
+  }
+  const cloudRows = neonRows.map((w) => ({ ...w, origin: "cloud-backed" }));
+  if (!deps.allowLocalRegistryFallback) return cloudRows;
+  const cloudIds = new Set(cloudRows.map((w) => w.id));
+  const localOnlyRows = localWorkspaceRows(deps).filter((w) => !cloudIds.has(w.id)).map((w) => ({ ...w, origin: "registry-only" }));
+  return [...cloudRows, ...localOnlyRows];
+}
 async function listWorkspaces(accountId2, deps = {}) {
   const pDeps = pointerDeps2(deps);
+  const neonReachable = await resolveSharedNeonReachable(deps, pDeps);
+  const sharedPointerDeps = { ...pDeps, neonReachable };
   const neonRows = await (deps.neonListWorkspaces ?? listWorkspacesNeon)(accountId2, {
     db: pDeps.db,
-    neonReachable: pDeps.neonReachable
+    neonReachable
   });
-  const rows = neonRows ?? (deps.allowLocalRegistryFallback ? localWorkspaceRows(deps) : []);
-  const activeId = await getActiveWorkspace(accountId2, pDeps);
+  const rows = originTaggedWorkspaceRows(neonRows, deps);
+  const activeId = await getActiveWorkspace(accountId2, sharedPointerDeps);
   const scoped = deps.includeArchived ? rows : rows.filter((w) => !w.archived);
   return {
     workspaces: scoped.map((w) => ({ ...w, active: w.id === activeId })),
@@ -2243,12 +3701,7 @@ async function listWorkspaces(accountId2, deps = {}) {
   };
 }
 
-// spex-console/src/lib/cli/workspace.ts
-init_registry_file();
-
 // spex-console/src/lib/vault-registry/workspace-create.ts
-init_vault_workspace_shared();
-init_registry_file();
 var MAX_DISPLAY_NAME_LEN = 60;
 var MAX_SLUG_LEN = 40;
 var MAX_SLUG_SUFFIX = 9;
@@ -2285,7 +3738,7 @@ function exhaustedSlugError(trimmedName, base) {
     message: `could not find a free slug for "${trimmedName}" -- ${base} through ${base}-${MAX_SLUG_SUFFIX} are all taken`
   };
 }
-function createOffline(input, trimmedName, now, deps) {
+function createOffline(input, trimmedName, now, deps, neonWriteReason) {
   const existingIds = new Set(loadVaultRegistry(deps.registryOpts).workspaces.map((w) => w.id));
   let id;
   if (input.id !== void 0) {
@@ -2303,10 +3756,22 @@ function createOffline(input, trimmedName, now, deps) {
     if (!free) return exhaustedSlugError(trimmedName, base);
     id = free;
   }
-  registerWorkspace({ id, display_name: trimmedName, created_at: now }, deps.registryOpts);
+  const registry = runRegistrySideEffect(
+    () => registerWorkspace(
+      { id, display_name: trimmedName, created_at: now, account_id: input.accountId },
+      deps.registryOpts
+    )
+  );
   return {
     ok: true,
-    workspace: { id, display_name: trimmedName, neon_written: false, registry_written: true }
+    workspace: {
+      id,
+      display_name: trimmedName,
+      neon_written: false,
+      ...neonWriteReason ? { neon_write_reason: neonWriteReason } : {},
+      registry_written: registryWritten(registry),
+      side_effects: [registry]
+    }
   };
 }
 async function createWorkspace(input, deps = {}) {
@@ -2328,19 +3793,40 @@ async function createWorkspace(input, deps = {}) {
       };
     }
     const id = input.id;
-    registerWorkspace({ id, display_name: trimmedName, created_at: now }, deps.registryOpts);
-    const neonWritten = await upsertWorkspaceNeon(
+    if (isReservedForOtherAccountsDefault(id, input.accountId)) {
+      return {
+        ok: false,
+        code: WORKSPACE_OWNED_BY_OTHER_ACCOUNT,
+        message: workspaceOwnedByOtherAccountMessage(id)
+      };
+    }
+    const upserted = await upsertWorkspaceNeonReasoned(
       { id, displayName: trimmedName },
       input.accountId,
       deps.neon
     );
+    if (upserted.reason === "owned-by-other-account") {
+      return {
+        ok: false,
+        code: WORKSPACE_OWNED_BY_OTHER_ACCOUNT,
+        message: workspaceOwnedByOtherAccountMessage(id)
+      };
+    }
+    const registry = runRegistrySideEffect(
+      () => registerWorkspace(
+        { id, display_name: trimmedName, created_at: now, account_id: input.accountId },
+        deps.registryOpts
+      )
+    );
     return {
       ok: true,
       workspace: {
         id,
         display_name: trimmedName,
-        neon_written: neonWritten,
-        registry_written: true
+        neon_written: upserted.written,
+        ...upserted.reason ? { neon_write_reason: upserted.reason } : {},
+        registry_written: registryWritten(registry),
+        side_effects: [registry]
       }
     };
   }
@@ -2351,17 +3837,31 @@ async function createWorkspace(input, deps = {}) {
       message: `invalid workspace id "${input.id}" -- must be non-empty with no path separators`
     };
   }
+  if (input.id !== void 0 && isReservedForOtherAccountsDefault(input.id, input.accountId)) {
+    return {
+      ok: false,
+      code: WORKSPACE_OWNED_BY_OTHER_ACCOUNT,
+      message: workspaceOwnedByOtherAccountMessage(input.id)
+    };
+  }
   const { base, candidates } = input.id !== void 0 ? { base: input.id, candidates: [input.id] } : derivedCandidates(trimmedName);
   for (const candidate of candidates) {
-    const result = await insertWorkspaceNeonStrict(
+    const { result, reason } = await insertWorkspaceNeonStrictReasoned(
       { id: candidate, displayName: trimmedName },
       input.accountId,
       deps.neon ?? {}
     );
     if (result === "inserted") {
-      registerWorkspace(
-        { id: candidate, display_name: trimmedName, created_at: now },
-        deps.registryOpts
+      const registry = runRegistrySideEffect(
+        () => registerWorkspace(
+          {
+            id: candidate,
+            display_name: trimmedName,
+            created_at: now,
+            account_id: input.accountId
+          },
+          deps.registryOpts
+        )
       );
       return {
         ok: true,
@@ -2369,18 +3869,28 @@ async function createWorkspace(input, deps = {}) {
           id: candidate,
           display_name: trimmedName,
           neon_written: true,
-          registry_written: true
+          registry_written: registryWritten(registry),
+          side_effects: [registry]
         }
       };
     }
     if (result === "unreachable") {
-      return createOffline(input, trimmedName, now, deps);
+      return createOffline(input, trimmedName, now, deps, reason);
     }
     if (input.id !== void 0) {
+      const owner = await findWorkspaceForAccountNeon(input.id, input.accountId, deps.neon ?? {});
+      if (owner === null) {
+        return {
+          ok: false,
+          code: WORKSPACE_OWNED_BY_OTHER_ACCOUNT,
+          message: workspaceOwnedByOtherAccountMessage(input.id)
+        };
+      }
       return {
         ok: false,
         code: "duplicate_workspace",
-        message: `workspace "${input.id}" already exists`
+        message: `workspace "${input.id}" already exists`,
+        ...owner !== "unreachable" ? { owned_by_caller: true } : {}
       };
     }
   }
@@ -2388,12 +3898,13 @@ async function createWorkspace(input, deps = {}) {
 }
 
 // spex-console/src/lib/vault-registry/workspace-manage.ts
-init_vault_workspace_shared();
-init_registry_file();
 var MAX_DISPLAY_NAME_LEN2 = 60;
 function notFound(id) {
   return { ok: false, code: "workspace_not_found", message: `workspace "${id}" not found` };
 }
+function cloudWriteFailed2(failure) {
+  return { ok: false, code: "cloud_write_failed", message: failure.message };
+}
 async function renameWorkspace(input, deps = {}) {
   const trimmedName = input.displayName.trim();
   if (trimmedName.length < 1 || trimmedName.length > MAX_DISPLAY_NAME_LEN2) {
@@ -2413,6 +3924,7 @@ async function renameWorkspace(input, deps = {}) {
     deps.neon ?? {}
   );
   if (neonResult === "not_found") return notFound(input.id);
+  if (isCloudWriteFailure(neonResult)) return cloudWriteFailed2(neonResult);
   registerWorkspace(
     {
       ...existing,
@@ -2436,6 +3948,7 @@ async function unregisterWorkspace(input, deps = {}) {
   if (!existing) return notFound(input.id);
   const neonResult = await deleteWorkspaceNeon(input.id, input.accountId, deps.neon ?? {});
   if (neonResult === "not_found") return notFound(input.id);
+  if (isCloudWriteFailure(neonResult)) return cloudWriteFailed2(neonResult);
   await repointActiveWorkspaceOnRemoval(input.accountId, input.id, {
     registryOpts: deps.registryOpts,
     accountPointer: { ...deps.neon, registryOpts: deps.registryOpts }
@@ -2451,8 +3964,312 @@ async function unregisterWorkspace(input, deps = {}) {
   };
 }
 
+// spex-console/src/lib/cli/receipt.ts
+var RECEIPT_AGREEMENT_FIELDS = [
+  "vault_id",
+  "workspace_id",
+  "account_id",
+  "active_vault_id"
+];
+var ALL_FIELDS = [
+  ...RECEIPT_AGREEMENT_FIELDS,
+  "display_name",
+  "archived"
+];
+function unreadSide(reason) {
+  return {
+    read: false,
+    reason,
+    vault_id: null,
+    workspace_id: null,
+    account_id: null,
+    active_vault_id: null
+  };
+}
+function valueOf(side, field) {
+  const v = side[field];
+  return v === void 0 ? null : v;
+}
+function comparable(field, a, b) {
+  return field !== "account_id" || a !== null && b !== null;
+}
+function buildReceipt(input) {
+  const local = input.local ?? unreadSide("not read back");
+  const cloud = input.cloud ?? unreadSide("not read back");
+  if (input.failed?.reason) {
+    const target = input.failed.side === "cloud" ? cloud : local;
+    target.reason = input.failed.reason;
+  }
+  const verified = local.read && cloud.read;
+  const expected = input.expected ?? {};
+  const fields = ALL_FIELDS.filter(
+    (f) => RECEIPT_AGREEMENT_FIELDS.includes(f) || Object.hasOwn(expected, f)
+  );
+  const diffs = [];
+  if (verified) {
+    for (const field of fields) {
+      const l = valueOf(local, field);
+      const c = valueOf(cloud, field);
+      const hasExpected = Object.hasOwn(expected, field);
+      const want = hasExpected ? expected[field] ?? null : void 0;
+      const sidesDiffer = comparable(field, l, c) && l !== c;
+      const offTarget = hasExpected && (l !== want || c !== want);
+      if (sidesDiffer || offTarget) {
+        diffs.push({ field, local: l, cloud: c, ...hasExpected ? { expected: want } : {} });
+      }
+    }
+  }
+  const changed = [];
+  for (const side of ["local", "cloud"]) {
+    const before = input.before?.[side];
+    const after = side === "local" ? local : cloud;
+    if (!before?.read || !after.read) continue;
+    for (const field of ALL_FIELDS) {
+      const from = valueOf(before, field);
+      const to = valueOf(after, field);
+      if (from !== to) changed.push({ side, field, from, to });
+    }
+  }
+  return {
+    local,
+    cloud,
+    verified,
+    agree: verified && diffs.length === 0,
+    diffs,
+    changed,
+    ...input.failed ? { failed: input.failed.side } : {},
+    ...input.retry ? { retry: input.retry } : {}
+  };
+}
+function withReceipt(result, receipt) {
+  return {
+    ...result,
+    message: [result.message, formatReceipt(receipt)].filter(Boolean).join("\n"),
+    payload: { ...result.payload, receipt }
+  };
+}
+function shellArg(value) {
+  return /^[\w@%+=:,./\\-]+$/.test(value) ? value : JSON.stringify(value);
+}
+function accountFlag(account) {
+  return account ? ` --account ${shellArg(account)}` : "";
+}
+function receiptStatus(receipt) {
+  if (receipt.failed) return "failed";
+  if (!receipt.verified) return "unverified";
+  if (!receipt.agree) return "disagree";
+  return "verified";
+}
+var LABELS = {
+  vault_id: "vault",
+  workspace_id: "workspace",
+  account_id: "account",
+  active_vault_id: "active vault",
+  display_name: "name",
+  archived: "archived"
+};
+function cell(side, field) {
+  if (!side.read) return "(not read)";
+  const v = valueOf(side, field);
+  if (v === null) return "(none)";
+  if (typeof v === "boolean") return v ? "yes" : "no";
+  return v;
+}
+function formatReceipt(receipt) {
+  const shown = ALL_FIELDS.filter(
+    (f) => RECEIPT_AGREEMENT_FIELDS.includes(f) || receipt.local[f] !== void 0 || receipt.cloud[f] !== void 0
+  );
+  const rows = [
+    ["", "local (this machine)", "cloud (console)"],
+    ...shown.map((f) => [
+      LABELS[f],
+      cell(receipt.local, f),
+      cell(receipt.cloud, f)
+    ])
+  ];
+  const w0 = Math.max(...rows.map((r) => r[0].length));
+  const w1 = Math.max(...rows.map((r) => r[1].length));
+  const lines = [
+    "Read back after the write:",
+    ...rows.map(([a, b, c]) => `  ${a.padEnd(w0)}  ${b.padEnd(w1)}  ${c}`.trimEnd())
+  ];
+  const status = receiptStatus(receipt);
+  if (status === "failed") {
+    const side = receipt.failed;
+    const reason = receipt[side].reason;
+    lines.push(
+      `Result: failed -- the ${side} half did not land${reason ? ` (${reason})` : ""}.` + (receipt.retry ? ` Retry: \`${receipt.retry}\`` : "")
+    );
+  } else if (status === "unverified") {
+    const unread = ["local", "cloud"].filter((s) => !receipt[s].read);
+    const why = unread.map((s) => `${s}${receipt[s].reason ? `: ${receipt[s].reason}` : ""}`).join("; ");
+    lines.push(
+      `Result: unverified -- the write was made, but the ${unread.join(" and ")} side was not read back (${why}).`
+    );
+  } else if (status === "disagree") {
+    const fields = receipt.diffs.map((d) => LABELS[d.field]).join(", ");
+    const reads = receipt.cloud_reads && receipt.cloud_reads > 1 ? ` after ${receipt.cloud_reads} reads of the cloud side` : "";
+    const show = (v) => v === void 0 || v === null ? "(none)" : typeof v === "boolean" ? v ? "yes" : "no" : v;
+    lines.push(
+      `Result: the two sides disagree on ${fields}${reads}.` + (receipt.retry ? ` Retry: \`${receipt.retry}\`` : ""),
+      ...receipt.diffs.map(
+        (d) => `  ${LABELS[d.field]}: local ${show(d.local)} | cloud ${show(d.cloud)}` + (d.expected !== void 0 ? ` | expected ${show(d.expected)}` : "")
+      )
+    );
+  } else {
+    lines.push("Result: verified -- both sides were read back and agree.");
+  }
+  return lines.join("\n");
+}
+
+// spex-console/src/lib/cli/receipt-readback.ts
+var RECEIPT_CLOUD_READS = 3;
+var RECEIPT_REREAD_DELAY_MS = 1e3;
+var realSleep = (ms) => new Promise((resolve5) => {
+  setTimeout(resolve5, ms);
+});
+function message(err) {
+  return err instanceof Error ? err.message : String(err);
+}
+function readLocalReceiptSide(subject, registryOpts = {}) {
+  try {
+    const registry = loadVaultRegistry(registryOpts);
+    const pointer = accountPointersOf(registry, subject.accountId);
+    const ownerOf = (account) => account && account !== LEGACY_REGISTRY_ACCOUNT_ID ? account : null;
+    if (subject.vaultId) {
+      const row2 = registry.vaults.find((v) => v.id === subject.vaultId);
+      return {
+        read: true,
+        vault_id: row2?.id ?? null,
+        workspace_id: row2?.workspace_id ?? null,
+        account_id: ownerOf(row2?.account_id),
+        active_vault_id: pointer.active_vault_id ?? null,
+        display_name: row2?.display_name ?? null,
+        archived: row2 ? row2.archived ?? false : null
+      };
+    }
+    const row = subject.workspaceId ? registry.workspaces.find((w) => w.id === subject.workspaceId) : void 0;
+    return {
+      read: true,
+      vault_id: null,
+      workspace_id: row?.id ?? null,
+      account_id: ownerOf(row?.account_id),
+      active_vault_id: pointer.active_vault_id ?? null,
+      ...subject.workspaceId ? {
+        display_name: row?.display_name ?? null,
+        archived: row ? row.archived ?? false : null
+      } : {}
+    };
+  } catch (err) {
+    return unreadSide(`registry.json could not be read: ${message(err)}`);
+  }
+}
+async function readList(http, path4, key) {
+  const res = await cloudHttpRequest(http, "GET", path4);
+  const rows = res.json?.[key];
+  if (!res.ok || !Array.isArray(rows)) {
+    return { reason: `GET ${path4.split("?")[0]} answered HTTP ${res.status}` };
+  }
+  return { rows: rows.filter((r) => Boolean(r) && typeof r === "object") };
+}
+var str = (v) => typeof v === "string" && v ? v : null;
+async function readCloudReceiptSide(subject, http) {
+  if (!http) return unreadSide("no cloud transport on this call");
+  const active = await cloudHttpRequest(http, "GET", "/api/vaults/active");
+  if (!active.ok || !active.json || typeof active.json !== "object") {
+    return unreadSide(`GET /api/vaults/active answered HTTP ${active.status}`);
+  }
+  const activeVaultId = str(active.json.vault_id);
+  if (subject.vaultId) {
+    const list2 = await readList(http, "/api/vaults?include_archived=true", "vaults");
+    if ("reason" in list2) return unreadSide(list2.reason);
+    const row2 = list2.rows.find((r) => r.id === subject.vaultId);
+    return {
+      read: true,
+      vault_id: row2 ? subject.vaultId : null,
+      workspace_id: str(row2?.workspace_id),
+      account_id: row2 && row2.granted !== true ? subject.accountId : null,
+      active_vault_id: activeVaultId,
+      display_name: str(row2?.display_name),
+      archived: row2 ? row2.archived === true : null
+    };
+  }
+  if (!subject.workspaceId) {
+    return {
+      read: true,
+      vault_id: null,
+      workspace_id: null,
+      account_id: null,
+      active_vault_id: activeVaultId
+    };
+  }
+  const list = await readList(http, "/api/workspaces?include_archived=true", "workspaces");
+  if ("reason" in list) return unreadSide(list.reason);
+  const row = list.rows.find((r) => r.id === subject.workspaceId);
+  return {
+    read: true,
+    vault_id: null,
+    workspace_id: row ? subject.workspaceId : null,
+    account_id: row ? subject.accountId : null,
+    active_vault_id: activeVaultId,
+    display_name: str(row?.display_name),
+    archived: row ? row.archived === true : null
+  };
+}
+async function readSettledReceipt(subject, deps, build) {
+  const sides = await readReceiptSides(subject, deps);
+  let receipt = build(sides);
+  const maxReads = Math.max(1, deps.cloudReads ?? RECEIPT_CLOUD_READS);
+  const sleep2 = deps.sleep ?? realSleep;
+  let reads = 1;
+  while (!receipt.failed && receipt.verified && !receipt.agree && reads < maxReads) {
+    await sleep2(RECEIPT_REREAD_DELAY_MS);
+    const cloud = await readCloudReceiptSide(subject, deps.http);
+    reads += 1;
+    receipt = build({ local: sides.local, cloud });
+  }
+  return { ...receipt, cloud_reads: reads };
+}
+function receiptDisagrees(receipt) {
+  return !receipt.failed && receipt.verified && !receipt.agree;
+}
+async function finishWithReceipt(result, deps, subject, opts) {
+  const failed = opts.failedReason !== void 0;
+  const receipt = await readSettledReceipt(
+    subject,
+    deps,
+    (sides) => buildReceipt({
+      ...sides,
+      ...opts.before ? { before: opts.before } : {},
+      ...opts.expected && !failed ? { expected: opts.expected } : {},
+      ...failed ? { failed: { side: "cloud", reason: opts.failedReason } } : {},
+      ...failed && opts.retry ? { retry: opts.retry } : {}
+    })
+  );
+  if (failed) {
+    return withReceipt({ ...result, code: EXIT.CLOUD_WRITE_FAILED, isError: true }, receipt);
+  }
+  if (receiptDisagrees(receipt)) {
+    if (opts.retry) receipt.retry = opts.retry;
+    return withReceipt(
+      {
+        ...result,
+        code: EXIT.RECEIPT_DISAGREE,
+        isError: true,
+        payload: { ...result.payload, ok: false, error: "receipt_disagree" }
+      },
+      receipt
+    );
+  }
+  return withReceipt(result, receipt);
+}
+async function readReceiptSides(subject, deps) {
+  const local = readLocalReceiptSide(subject, deps.registryOpts);
+  const cloud = await readCloudReceiptSide(subject, deps.http);
+  return { local, cloud };
+}
+
 // spex-console/src/lib/cli/workspace.ts
-init_vault_workspace_shared();
 function parseWorkspaceArgs(argv) {
   const subRaw = argv[0];
   if (subRaw === "--help" || subRaw === "-h" || subRaw === void 0) {
@@ -2564,8 +4381,78 @@ function parseWorkspaceArgs(argv) {
 function accountPointerDeps(deps) {
   return { registryOpts: deps.registryOpts, ...deps.neon ?? {} };
 }
+function scopedToActiveVault(deps) {
+  const acct = accountId(deps);
+  let vaultId = null;
+  try {
+    vaultId = accountPointersOf(loadVaultRegistry(deps.registryOpts), acct).active_vault_id ?? null;
+  } catch {
+  }
+  return { ...deps, neon: withCloudScope(deps.neon, acct, vaultId) };
+}
+function readWorkspaceSides(deps, subject) {
+  return readReceiptSides(subject, { registryOpts: deps.registryOpts, http: deps.neon?.http });
+}
+function finishWorkspaceWrite(result, deps, subject, opts) {
+  return finishWithReceipt(
+    result,
+    { registryOpts: deps.registryOpts, http: deps.neon?.http, sleep: deps.receiptSleep },
+    subject,
+    opts
+  );
+}
+async function manageWithReceipt(verb, workspaceId, effectiveAccountId, deps, retry, write, success, expected) {
+  deps = scopedToActiveVault(deps);
+  const subject = { accountId: effectiveAccountId, workspaceId };
+  const before = await readWorkspaceSides(deps, subject);
+  const result = await write(deps);
+  if (!result.ok) {
+    if (result.code === "cloud_write_failed") {
+      return finishWorkspaceWrite(
+        {
+          code: EXIT.CLOUD_WRITE_FAILED,
+          message: `hs workspace ${verb}: the cloud half failed -- ${result.message} Retry: \`${retry}\``,
+          payload: { ok: false, error: result.code, message: result.message, retry },
+          isError: true
+        },
+        deps,
+        subject,
+        { before, failedReason: result.message, retry }
+      );
+    }
+    return {
+      code: statusForWorkspaceManageError(result.code),
+      message: `hs workspace ${verb}: ${result.message}`,
+      payload: { ok: false, error: result.code, message: result.message },
+      isError: true
+    };
+  }
+  const selection = await activeWorkspaceSelection(deps, effectiveAccountId);
+  const done = success(result.workspace, selection);
+  return finishWorkspaceWrite(
+    { code: EXIT.OK, message: done.message, payload: done.payload, isError: false },
+    deps,
+    subject,
+    { before, expected, retry }
+  );
+}
 function accountId(deps) {
-  return deps.accountId ?? resolveCliAccountId();
+  if (deps.accountId) return deps.accountId;
+  const strict = resolveCloudAccountIdOrRefuse(deps.accountIdOpts);
+  if (strict.ok) return strict.accountId;
+  throw new Error(`hs workspace: ${strict.message}`);
+}
+function strictAccountId(deps) {
+  if (deps.accountId) return { ok: true, accountId: deps.accountId };
+  return resolveCloudAccountIdOrRefuse(deps.accountIdOpts);
+}
+function signInRequiredResult(verb, message2) {
+  return {
+    code: EXIT.SIGN_IN_REQUIRED,
+    message: `hs workspace ${verb}: ${message2}`,
+    payload: { ok: false, error: "sign_in_required", message: message2 },
+    isError: true
+  };
 }
 async function resolveEffectiveAccountId(deps, requestedAccount, verb) {
   const scope = await resolveScopedAccountId(accountId(deps), requestedAccount);
@@ -2604,7 +4491,9 @@ async function runList(args, deps) {
       isError: false
     };
   }
-  const lines = workspaces2.length ? workspaces2.map((w) => `${w.active ? "* " : "  "}${w.id}  ${w.display_name}`).join("\n") : '  (no workspaces registered -- run `hs workspace create --id <slug> --name "..."`)';
+  const lines = workspaces2.length ? workspaces2.map(
+    (w) => `${w.active ? "* " : "  "}${w.id}  ${w.display_name}` + (w.origin === "registry-only" ? "  (this machine only)" : "")
+  ).join("\n") : '  (no workspaces registered -- run `hs workspace create --id <slug> --name "..."`)';
   return {
     code: EXIT.OK,
     message: `${workspaces2.length} registered workspace(s):
@@ -2613,13 +4502,58 @@ ${lines}`,
     isError: false
   };
 }
+function describeNeonWriteFailure(reason) {
+  switch (reason) {
+    case "not-configured":
+      return "Neon is not configured on this machine";
+    case "unauthorized":
+      return "the cloud write was unauthorized -- run `hs login`";
+    case "network-error":
+      return "the cloud console could not be reached";
+    case "server-error":
+      return "the cloud console rejected the write";
+    case "owned-by-other-account":
+      return "that id belongs to another account";
+    case "workspace-owned-by-other-account":
+      return "that workspace belongs to another account";
+    default:
+      return "Neon unreachable";
+  }
+}
 async function runCreate(args, deps) {
+  const strict = strictAccountId(deps);
+  if (!strict.ok) return signInRequiredResult("create", strict.message);
+  deps = scopedToActiveVault(deps);
+  const subject = { accountId: strict.accountId, workspaceId: args.id };
+  const before = await readWorkspaceSides(deps, subject);
+  const retry = `hs workspace create --id ${shellArg(args.id)} --name ${shellArg(args.name)}`;
+  const holds = (s) => s.read && s.workspace_id === args.id && s.display_name === args.name && s.archived !== true;
+  if (deps.neon?.http && holds(before.local) && holds(before.cloud)) {
+    return finishWorkspaceWrite(
+      {
+        code: EXIT.OK,
+        message: `Workspace "${args.id}" (${args.name}) already exists on both sides -- nothing to change.`,
+        payload: {
+          ok: true,
+          id: args.id,
+          display_name: args.name,
+          unchanged: true,
+          neon_written: false,
+          registry_written: false
+        },
+        isError: false
+      },
+      deps,
+      subject,
+      { before, expected: { workspace_id: args.id, display_name: args.name }, retry }
+    );
+  }
   const result = await createWorkspace(
-    { accountId: accountId(deps), id: args.id, displayName: args.name },
+    { accountId: strict.accountId, id: args.id, displayName: args.name },
     { registryOpts: deps.registryOpts, neon: deps.neon, now: deps.now, allowIdUpsert: true }
   );
   if (!result.ok) {
-    const code = result.code === "duplicate_workspace" ? EXIT.CONFLICT : EXIT.INVALID_ARG;
+    const code = result.code === "duplicate_workspace" || result.code === "workspace_owned_by_other_account" ? EXIT.CONFLICT : EXIT.INVALID_ARG;
     return {
       code,
       message: `hs workspace create: ${result.message}`,
@@ -2627,15 +4561,36 @@ async function runCreate(args, deps) {
       isError: true
     };
   }
-  const { id, display_name, neon_written, registry_written } = result.workspace;
-  return {
-    code: EXIT.OK,
-    message: `Created workspace "${id}" (${display_name})` + (neon_written ? " in Neon + registry.json." : " in registry.json (Neon unreachable -- registry.json only)."),
-    payload: { ok: true, id, display_name, neon_written, registry_written },
-    isError: false
-  };
+  const { id, display_name, neon_written, neon_write_reason, registry_written } = result.workspace;
+  const cloudFailed = !neon_written && deps.neon?.http !== void 0;
+  const failureText = describeNeonWriteFailure(neon_write_reason);
+  return finishWorkspaceWrite(
+    {
+      code: EXIT.OK,
+      message: cloudFailed ? `hs workspace create: created workspace "${id}" (${display_name}) in registry.json only -- the cloud half failed (${failureText}). Retry: \`${retry}\`` : `Created workspace "${id}" (${display_name})` + (neon_written ? " in Neon + registry.json." : ` in registry.json only (${failureText}).`),
+      payload: {
+        ok: !cloudFailed,
+        ...cloudFailed ? { error: "cloud_write_failed", retry } : {},
+        id,
+        display_name,
+        neon_written,
+        ...neon_write_reason ? { neon_write_reason } : {},
+        registry_written
+      },
+      isError: false
+    },
+    deps,
+    { ...subject, workspaceId: id },
+    {
+      before,
+      expected: { workspace_id: id, display_name },
+      ...cloudFailed ? { failedReason: neon_write_reason ?? "server-error" } : {},
+      retry
+    }
+  );
 }
 async function runSwitch(args, deps) {
+  deps = scopedToActiveVault(deps);
   try {
     await setActiveWorkspace(accountId(deps), args.id, accountPointerDeps(deps));
   } catch (err) {
@@ -2647,6 +4602,21 @@ async function runSwitch(args, deps) {
         isError: true
       };
     }
+    if (err instanceof CloudPointerWriteError) {
+      const message2 = `hs workspace switch: active workspace pointer not updated in the cloud (${err.message}) -- re-run \`hs workspace switch ${args.id}\` to retry.`;
+      return {
+        code: EXIT.CLOUD_WRITE_FAILED,
+        message: message2,
+        payload: {
+          ok: false,
+          error: "cloud_pointer_failed",
+          workspace_id: args.id,
+          http_status: err.status,
+          message: message2
+        },
+        isError: true
+      };
+    }
     throw err;
   }
   return {
@@ -2661,36 +4631,35 @@ async function activeWorkspaceSelection(deps, effectiveAccountId = accountId(dep
   return { line: `Active workspace: ${workspaceId ?? "(none)"}`, workspaceId };
 }
 function statusForWorkspaceManageError(code) {
-  return code === "workspace_not_found" ? EXIT.NOT_FOUND : EXIT.INVALID_ARG;
+  if (code === "workspace_not_found" || code === "vault_not_found") return EXIT.NOT_FOUND;
+  if (code === "cloud_write_failed") return EXIT.CLOUD_WRITE_FAILED;
+  return EXIT.INVALID_ARG;
 }
 async function runRename(args, deps) {
   const scoped = await resolveEffectiveAccountId(deps, args.account, "rename");
   if (!scoped.ok) return scoped.result;
-  const result = await renameWorkspace(
-    { accountId: scoped.accountId, id: args.id, displayName: args.name },
-    { registryOpts: deps.registryOpts, neon: deps.neon }
-  );
-  if (!result.ok) {
-    return {
-      code: statusForWorkspaceManageError(result.code),
-      message: `hs workspace rename: ${result.message}`,
-      payload: { ok: false, error: result.code, message: result.message },
-      isError: true
-    };
-  }
-  const selection = await activeWorkspaceSelection(deps, scoped.accountId);
-  return {
-    code: EXIT.OK,
-    message: `Renamed workspace "${result.workspace.id}" to "${result.workspace.display_name}".
+  return manageWithReceipt(
+    "rename",
+    args.id,
+    scoped.accountId,
+    deps,
+    `hs workspace rename ${shellArg(args.id)} --name ${shellArg(args.name)}${accountFlag(args.account)}`,
+    (d) => renameWorkspace(
+      { accountId: scoped.accountId, id: args.id, displayName: args.name },
+      { registryOpts: d.registryOpts, neon: d.neon }
+    ),
+    (workspace, selection) => ({
+      message: `Renamed workspace "${workspace.id}" to "${workspace.display_name}".
 ${selection.line}`,
-    payload: {
-      ok: true,
-      id: result.workspace.id,
-      display_name: result.workspace.display_name,
-      active_workspace_id: selection.workspaceId
-    },
-    isError: false
-  };
+      payload: {
+        ok: true,
+        id: workspace.id,
+        display_name: workspace.display_name,
+        active_workspace_id: selection.workspaceId
+      }
+    }),
+    { display_name: args.name.trim() }
+  );
 }
 async function confirmRemoval(deps, displayName, verb, yes) {
   if (yes) return true;
@@ -2714,6 +4683,7 @@ async function runUnregister(args, deps) {
   const displayName = existing?.display_name ?? args.id;
   const proceed = await confirmRemoval(deps, displayName, "unregister", args.yes);
   if (!proceed) return cancelledResult("unregister");
+  deps = scopedToActiveVault(deps);
   const result = await unregisterWorkspace(
     { accountId: scoped.accountId, id: args.id },
     { registryOpts: deps.registryOpts, neon: deps.neon }
@@ -2747,62 +4717,59 @@ async function runArchive(args, deps) {
   const displayName = existing?.display_name ?? args.id;
   const proceed = await confirmRemoval(deps, displayName, "archive", args.yes);
   if (!proceed) return cancelledResult("archive");
-  const result = await archiveWorkspace(
-    { accountId: scoped.accountId, id: args.id },
-    { registryOpts: deps.registryOpts, neon: deps.neon }
-  );
-  if (!result.ok) {
-    return {
-      code: EXIT.NOT_FOUND,
-      message: `hs workspace archive: ${result.message}`,
-      payload: { ok: false, error: result.code, message: result.message },
-      isError: true
-    };
-  }
-  const selection = await activeWorkspaceSelection(deps, scoped.accountId);
-  return {
-    code: EXIT.OK,
-    message: `Archived workspace "${result.workspace.id}". ${CLOSE_NOT_DESTROY_STATEMENT}
+  return manageWithReceipt(
+    "archive",
+    args.id,
+    scoped.accountId,
+    deps,
+    `hs workspace archive ${shellArg(args.id)} --yes${accountFlag(args.account)}`,
+    (d) => archiveWorkspace(
+      { accountId: scoped.accountId, id: args.id },
+      { registryOpts: d.registryOpts, neon: d.neon }
+    ),
+    (workspace, selection) => ({
+      message: `Archived workspace "${workspace.id}". ${CLOSE_NOT_DESTROY_STATEMENT}
 ${selection.line}`,
-    payload: {
-      ok: true,
-      id: result.workspace.id,
-      archived: result.workspace.archived,
-      active_workspace_id: selection.workspaceId
-    },
-    isError: false
-  };
+      payload: {
+        ok: true,
+        id: workspace.id,
+        archived: workspace.archived,
+        active_workspace_id: selection.workspaceId
+      }
+    }),
+    { archived: true }
+  );
 }
 async function runRestore(args, deps) {
   const scoped = await resolveEffectiveAccountId(deps, args.account, "restore");
   if (!scoped.ok) return scoped.result;
-  const result = await restoreWorkspace(
-    { accountId: scoped.accountId, id: args.id },
-    { registryOpts: deps.registryOpts, neon: deps.neon }
-  );
-  if (!result.ok) {
-    return {
-      code: EXIT.NOT_FOUND,
-      message: `hs workspace restore: ${result.message}`,
-      payload: { ok: false, error: result.code, message: result.message },
-      isError: true
-    };
-  }
-  const selection = await activeWorkspaceSelection(deps, scoped.accountId);
-  return {
-    code: EXIT.OK,
-    message: `Restored workspace "${result.workspace.id}".
+  return manageWithReceipt(
+    "restore",
+    args.id,
+    scoped.accountId,
+    deps,
+    `hs workspace restore ${shellArg(args.id)}${accountFlag(args.account)}`,
+    (d) => restoreWorkspace(
+      { accountId: scoped.accountId, id: args.id },
+      { registryOpts: d.registryOpts, neon: d.neon }
+    ),
+    (workspace, selection) => ({
+      message: `Restored workspace "${workspace.id}".
 ${selection.line}`,
-    payload: {
-      ok: true,
-      id: result.workspace.id,
-      archived: result.workspace.archived,
-      active_workspace_id: selection.workspaceId
-    },
-    isError: false
-  };
+      payload: {
+        ok: true,
+        id: workspace.id,
+        archived: workspace.archived,
+        active_workspace_id: selection.workspaceId
+      }
+    }),
+    { archived: false }
+  );
 }
 async function runWorkspace(args, deps) {
+  const strict = strictAccountId(deps);
+  if (!strict.ok) return signInRequiredResult(args.sub, strict.message);
+  deps = { ...deps, accountId: strict.accountId };
   if (args.sub === "list") return runList(args, deps);
   if (args.sub === "create") return runCreate(args, deps);
   if (args.sub === "switch") return runSwitch(args, deps);
@@ -2811,7 +4778,7 @@ async function runWorkspace(args, deps) {
   if (args.sub === "archive") return runArchive(args, deps);
   return runRestore(args, deps);
 }
-var HELP2 = [
+var HELP3 = [
   "Usage:",
   "  hs workspace list [--json]                          List registered workspaces, mark active",
   '  hs workspace create --id <slug> --name "<name>"      Create a workspace (Neon + registry.json)',
@@ -2841,24 +4808,64 @@ var HELP2 = [
   "  --account <id>    Act on a DIFFERENT account's workspace instead of your own",
   "                    (list/rename/unregister/archive/restore only) -- builder/admin-gated",
   "                    server-side; refused for a non-builder caller (exit 15).",
+  "  --as <email|id>  Confirm the SIGNED-IN account this write is made as (create/rename/",
+  "                    unregister/archive/restore). Must match the account this machine is",
+  "                    signed in as, or the command refuses. Not the same as --account:",
+  "                    --account picks the TARGET account, --as confirms who is acting.",
+  "  --confirm-account Confirm whichever account is signed in, without naming it (--as is safer).",
+  "                    A terminal is asked instead; with no terminal, a write verb needs --as or",
+  "                    --confirm-account (exit 17 otherwise). A machine whose config.yaml",
+  "                    account_id disagrees with its sign-in is always refused.",
   "  --json            Emit a machine-readable JSON result.",
   "  --help, -h        Show this help.",
   "",
-  "Exit codes: 0 ok \xB7 1 usage \xB7 9 conflict \xB7 10 not-found \xB7 11 bad-arg \xB7 15 forbidden (--account)"
+  "A workspace id that belongs to ANOTHER account is never overwritten: create refuses (exit 9).",
+  "",
+  "Exit codes: 0 ok \xB7 1 usage \xB7 9 conflict \xB7 10 not-found \xB7 11 bad-arg \xB7 15 forbidden (--account) \xB7",
+  "12 console unreachable (account check) \xB7 16 sign-in-required (create -- run `hs login`) \xB7",
+  "17 account not confirmed (--as / --confirm-account)"
 ].join("\n");
 
+// spex-console/bin/run-entry.ts
+import process2 from "node:process";
+var BinExit = class extends Error {
+  code;
+  constructor(code) {
+    super(`exit ${code}`);
+    this.name = "BinExit";
+    this.code = code;
+  }
+};
+function runEntry(name, main2, options = {}) {
+  const { fallbackCode = 1, unhandledLabel = "unhandled" } = options;
+  void (async () => {
+    try {
+      await main2();
+    } catch (err) {
+      if (err instanceof BinExit) {
+        process2.exitCode = err.code;
+        return;
+      }
+      const message2 = err instanceof Error ? err.message : String(err);
+      process2.stderr.write(`${name}: ${unhandledLabel}: ${message2}
+`);
+      process2.exitCode = fallbackCode;
+    }
+  })();
+}
+
 // spex-console/bin/hs-workspace.ts
 function readFile(p) {
   try {
-    return readFileSync6(p, "utf8");
+    return readFileSync9(p, "utf8");
   } catch {
     return null;
   }
 }
-var INTERACTIVE = process2.stdin.isTTY === true;
+var INTERACTIVE = process3.stdin.isTTY === true;
 async function confirm(question) {
   if (!INTERACTIVE) return false;
-  const rl = createInterface({ input: process2.stdin, output: process2.stdout });
+  const rl = createInterface2({ input: process3.stdin, output: process3.stdout });
   try {
     const answer = (await rl.question(question)).trim().toLowerCase();
     return answer === "y" || answer === "yes" || answer === "proceed";
@@ -2867,32 +4874,51 @@ async function confirm(question) {
   }
 }
 async function main() {
-  const parsed = parseWorkspaceArgs(process2.argv.slice(3));
+  const identityArgv = extractWriteIdentityFlags(process3.argv.slice(3));
+  if (identityArgv.error) {
+    process3.stderr.write(`hs workspace: ${identityArgv.error}
+`);
+    process3.exitCode = EXIT.INVALID_ARG;
+    return;
+  }
+  const parsed = parseWorkspaceArgs(identityArgv.rest);
   if (parsed.help) {
-    process2.stdout.write(`${HELP2}
+    process3.stdout.write(`${HELP3}
 `);
-    process2.exit(EXIT.OK);
+    process3.exitCode = EXIT.OK;
+    return;
   }
   if (parsed.error) {
-    process2.stderr.write(`hs workspace: ${parsed.error.message}
+    process3.stderr.write(`hs workspace: ${parsed.error.message}
 `);
-    process2.exit(parsed.error.code);
+    process3.exitCode = parsed.error.code;
+    return;
   }
-  const vaultRoot = process2.env.HS_VAULT_ROOT ? path4.resolve(process2.env.HS_VAULT_ROOT) : process2.cwd();
+  const vaultRoot = process3.env.HS_VAULT_ROOT ? path3.resolve(process3.env.HS_VAULT_ROOT) : process3.cwd();
   const consoleUrl = resolveSpexConsoleUrl(vaultRoot, readFile);
+  const gate = await gateWriteVerb({
+    namespace: "hs workspace",
+    sub: parsed.args.sub,
+    writeVerbs: WORKSPACE_WRITE_VERBS,
+    flags: identityArgv.flags,
+    io: defaultIdentityGateIo({ consoleUrl, platformRoot: path3.resolve(process3.cwd(), "..") })
+  });
+  if (gate && !gate.ok) {
+    process3.stderr.write(
+      `${parsed.args.json ? JSON.stringify(gate.result.payload) : gate.result.message}
+`
+    );
+    process3.exitCode = gate.result.code;
+    return;
+  }
   const result = await runWorkspace(parsed.args, {
     now: () => (/* @__PURE__ */ new Date()).toISOString(),
     confirm,
     neon: { http: { fetchImpl: fetch, consoleUrl, token: readPairedToken() } }
   });
-  const sink = result.isError ? process2.stderr : process2.stdout;
+  const sink = result.isError ? process3.stderr : process3.stdout;
   sink.write(`${parsed.args.json ? JSON.stringify(result.payload) : result.message}
 `);
-  process2.exit(result.code);
+  process3.exitCode = result.code;
 }
-main().catch((err) => {
-  const message = err instanceof Error ? err.message : String(err);
-  process2.stderr.write(`hs workspace: unhandled: ${message}
-`);
-  process2.exit(EXIT.WRITE_FAILED);
-});
+runEntry("hs workspace", main, { fallbackCode: EXIT.WRITE_FAILED });