@cleocode/cleo 2026.4.152 → 2026.4.153

package/dist/cli/index.js

@@ -385,7 +385,18 @@ var init_branch_lock = __esm({
       /** L4c: override requires TTY but stdin/stderr is not a TTY. */
       E_OVERRIDE_NEEDS_TTY: "E_OVERRIDE_NEEDS_TTY",
       /** L4d: session override limit exceeded. */
-      E_OVERRIDE_RATE_LIMIT: "E_OVERRIDE_RATE_LIMIT"
+      E_OVERRIDE_RATE_LIMIT: "E_OVERRIDE_RATE_LIMIT",
+      /**
+       * T1501 / P0-5: per-session cap (default 3) exceeded without a valid waiver doc.
+       * Set CLEO_OWNER_OVERRIDE_WAIVER=<absolute path> to a file containing
+       * `cap-waiver: true` in its frontmatter to bypass the cap.
+       */
+      E_OVERRIDE_CAP_EXCEEDED: "E_OVERRIDE_CAP_EXCEEDED",
+      /**
+       * T1502 / P0-6: the same evidence atom was used across >3 distinct tasks and
+       * `--shared-evidence` was not passed (or CLEO_STRICT_EVIDENCE=1 is set in CI).
+       */
+      E_SHARED_EVIDENCE_FLAG_REQUIRED: "E_SHARED_EVIDENCE_FLAG_REQUIRED"
     };
   }
 });
@@ -5290,6 +5301,32 @@ var init_registry = __esm({
           }
         ]
       },
+      // T1147 W7 — sweep mutate variant (approve, rollback) — routes to same handler as query
+      // Registered separately so mutate:memory.sweep resolves correctly (T1496/P0-1)
+      {
+        gateway: "mutate",
+        domain: "memory",
+        operation: "sweep",
+        description: "memory.sweep (mutate) \u2014 T1147 W7 BRAIN noise sweep approve/rollback. approve <runId>: apply sweep to live brain tables. rollback <runId>: discard a staged run without applying changes.",
+        tier: 0,
+        idempotent: false,
+        sessionRequired: false,
+        requiredParams: [],
+        params: [
+          {
+            name: "approve",
+            type: "string",
+            required: false,
+            description: "Run ID to approve and apply to live tables."
+          },
+          {
+            name: "rollback",
+            type: "string",
+            required: false,
+            description: "Run ID to roll back without applying changes."
+          }
+        ]
+      },
       // T791 — LLM extraction backend status
       {
         gateway: "query",
@@ -8563,6 +8600,25 @@ var init_registry = __esm({
             description: "Remove worktrees idle for longer than this many hours (default: 24)"
           }
         ]
+      },
+      // T1462 — Single-task worktree prune (auto-triggered by cleo complete)
+      {
+        gateway: "mutate",
+        domain: "orchestrate",
+        operation: "worktree.prune",
+        description: "orchestrate.worktree.prune (mutate) \u2014 prune the worktree for a single completed task, or all orphaned worktrees when no taskId is supplied",
+        tier: 2,
+        idempotent: true,
+        sessionRequired: false,
+        requiredParams: [],
+        params: [
+          {
+            name: "taskId",
+            type: "string",
+            required: false,
+            description: "Task ID whose worktree should be pruned (omit for bulk prune)"
+          }
+        ]
       }
     ];
     counts = getCounts();
@@ -9584,6 +9640,7 @@ import {
   paginate,
   parseScope,
   persistHandoff,
+  readSessionOverrideCount,
   recordAssumption,
   recordDecision,
   showSession,
@@ -9598,12 +9655,14 @@ async function sessionStatus(projectRoot) {
     const focusState = await accessor.getMetaValue("focus_state");
     const sessions2 = await accessor.loadSessions();
     const active = sessions2.find((s) => s.status === "active");
+    const overrideCount = active ? readSessionOverrideCount(projectRoot, active.id) : 0;
     return {
       success: true,
       data: {
         hasActiveSession: !!active,
         session: active || null,
-        taskWork: focusState || null
+        taskWork: focusState || null,
+        overrideCount
       }
     };
   } catch {
@@ -14605,8 +14664,10 @@ import {
 import {
   appendForceBypassLine,
   appendGateAuditLine,
+  checkAndIncrementOverrideCap,
   checkGateEvidenceMinimum,
   composeGateEvidence,
+  enforceSharedEvidence,
   getAccessor as getAccessor7,
   parseEvidence,
   validateAtom
@@ -15111,6 +15172,44 @@ async function validateGateVerify(params, projectRoot) {
     }
     const isWriteRequiringEvidence = (all || gate && value !== false) && !reset;
     const override = readOverrideState();
+    let sessionOverrideOrdinal;
+    let isWorktreeCtx = false;
+    if (override.override && isWriteRequiringEvidence) {
+      const command = (process.argv.slice(1).join(" ") || "cleo").slice(0, 512);
+      const capResult = checkAndIncrementOverrideCap(
+        root,
+        sessionId ?? "global",
+        void 0,
+        command
+      );
+      if (!capResult.allowed) {
+        return engineError(
+          capResult.errorCode ?? "E_OVERRIDE_CAP_EXCEEDED",
+          capResult.errorMessage ?? "Per-session override cap exceeded."
+        );
+      }
+      sessionOverrideOrdinal = capResult.sessionOverrideOrdinal;
+      isWorktreeCtx = capResult.workTreeContext === true;
+    }
+    let sharedEvidenceAcknowledged = false;
+    let sharedAtomWarned = false;
+    if (isWriteRequiringEvidence && !override.override && params.evidence && sessionId) {
+      const seResult = enforceSharedEvidence(
+        root,
+        sessionId,
+        taskId,
+        params.evidence,
+        params.sharedEvidence === true
+      );
+      if (!seResult.allowed) {
+        return engineError(
+          seResult.errorCode ?? "E_SHARED_EVIDENCE_FLAG_REQUIRED",
+          seResult.errorMessage ?? "Shared evidence flag required."
+        );
+      }
+      sharedEvidenceAcknowledged = seResult.acknowledged === true;
+      sharedAtomWarned = seResult.warned === true;
+    }
     let verification = task.verification ?? initVerification();
     if (!verification.evidence) {
       verification.evidence = {};
@@ -15225,7 +15324,18 @@ Or set CLEO_OWNER_OVERRIDE=1 with CLEO_OWNER_OVERRIDE_REASON=<reason> for emerge
             ...auditRecord,
             overrideReason: override.reason,
             pid: process.pid,
-            command: (process.argv.slice(1).join(" ") || "cleo").slice(0, 512)
+            command: (process.argv.slice(1).join(" ") || "cleo").slice(0, 512),
+            ...sessionOverrideOrdinal !== void 0 ? { sessionOverrideOrdinal } : {},
+            ...isWorktreeCtx ? { workTreeContext: true } : {}
+          });
+        } else if ((sharedEvidenceAcknowledged || sharedAtomWarned) && action !== "reset") {
+          await appendForceBypassLine(root, {
+            ...auditRecord,
+            overrideReason: "shared-evidence",
+            pid: process.pid,
+            command: (process.argv.slice(1).join(" ") || "cleo").slice(0, 512),
+            ...sharedEvidenceAcknowledged ? { sharedEvidence: true } : {},
+            ...sharedAtomWarned ? { sharedAtomWarning: true } : {}
           });
         }
       } catch {
@@ -17729,7 +17839,8 @@ var init_check = __esm({
           all: params.all,
           reset: params.reset,
           evidence: params.evidence,
-          sessionId: params.sessionId
+          sessionId: params.sessionId,
+          sharedEvidence: params.sharedEvidence
         };
         const result = await validateGateVerify(gateParams, projectRoot);
         setImmediate(async () => {
@@ -19273,7 +19384,7 @@ var init_memory2 = __esm({
           switch (operation) {
             case "find": {
               const query = paramStringRequired(params, "query");
-              if (!query) {
+              if (!query)
                 return errorResult(
                   "query",
                   "memory",
@@ -19282,24 +19393,27 @@ var init_memory2 = __esm({
                   "query is required",
                   startTime
                 );
-              }
-              const result = await memoryFind(
-                {
-                  query,
-                  limit: paramNumber(params, "limit"),
-                  tables: paramStringArray(params, "tables"),
-                  dateStart: paramString(params, "dateStart"),
-                  dateEnd: paramString(params, "dateEnd"),
-                  // T418: optional agent filter for per-agent mental model retrieval
-                  agent: paramString(params, "agent")
-                },
-                projectRoot
+              return wrapResult(
+                await memoryFind(
+                  {
+                    query,
+                    limit: paramNumber(params, "limit"),
+                    tables: paramStringArray(params, "tables"),
+                    dateStart: paramString(params, "dateStart"),
+                    dateEnd: paramString(params, "dateEnd"),
+                    agent: paramString(params, "agent")
+                  },
+                  projectRoot
+                ),
+                "query",
+                "memory",
+                operation,
+                startTime
               );
-              return wrapResult(result, "query", "memory", operation, startTime);
             }
             case "timeline": {
               const anchor = paramStringRequired(params, "anchor");
-              if (!anchor) {
+              if (!anchor)
                 return errorResult(
                   "query",
                   "memory",
@@ -19308,20 +19422,24 @@ var init_memory2 = __esm({
                   "anchor is required",
                   startTime
                 );
-              }
-              const result = await memoryTimeline(
-                {
-                  anchor,
-                  depthBefore: paramNumber(params, "depthBefore"),
-                  depthAfter: paramNumber(params, "depthAfter")
-                },
-                projectRoot
+              return wrapResult(
+                await memoryTimeline(
+                  {
+                    anchor,
+                    depthBefore: paramNumber(params, "depthBefore"),
+                    depthAfter: paramNumber(params, "depthAfter")
+                  },
+                  projectRoot
+                ),
+                "query",
+                "memory",
+                operation,
+                startTime
               );
-              return wrapResult(result, "query", "memory", operation, startTime);
             }
             case "fetch": {
               const ids = paramStringArray(params, "ids");
-              if (!ids || ids.length === 0) {
+              if (!ids || ids.length === 0)
                 return errorResult(
                   "query",
                   "memory",
@@ -19330,9 +19448,13 @@ var init_memory2 = __esm({
                   "ids is required (non-empty array)",
                   startTime
                 );
-              }
-              const result = await memoryFetch({ ids }, projectRoot);
-              return wrapResult(result, "query", "memory", operation, startTime);
+              return wrapResult(
+                await memoryFetch({ ids }, projectRoot),
+                "query",
+                "memory",
+                operation,
+                startTime
+              );
             }
             case "decision.find": {
               const result = await memoryDecisionFind(
@@ -20786,6 +20908,10 @@ var init_memory2 = __esm({
                 return handleErrorResult("mutate", "memory", operation, rollbackErr, startTime);
               }
             }
+            // T1147 W7 — sweep mutate operations (approve, rollback) delegate to query handler
+            // which already handles all sweep sub-commands via a unified case block.
+            case "sweep":
+              return this.query(operation, params);
             default:
               return unsupportedOp("mutate", "memory", operation, startTime);
           }
@@ -20862,6 +20988,8 @@ var init_memory2 = __esm({
             "precompact-flush",
             // T1006 — write a diary-typed observation
             "diary.write",
+            // T1147 W7 — sweep mutate operations (approve, rollback)
+            "sweep",
             // T1003 — staged backfill operations
             "backfill.run",
             "backfill.approve",
@@ -21692,6 +21820,45 @@ import {
   getNexusNativeDb as getNexusNativeDb2,
   getProjectRoot as getProjectRoot7
 } from "@cleocode/core/internal";
+function nexusQueryEnvelopeToResponse(envelope, operation, startTime) {
+  const env = envelope;
+  let pageMetadata = env.page;
+  let resultData = env.data;
+  if (!pageMetadata && env.success && resultData && typeof resultData === "object") {
+    const dataObj = resultData;
+    if ("page" in dataObj && dataObj.page) {
+      pageMetadata = dataObj.page;
+      const { page: _removed, ...cleanData } = dataObj;
+      resultData = cleanData;
+    }
+  }
+  return wrapResult(
+    {
+      success: env.success,
+      data: resultData,
+      page: pageMetadata,
+      error: env.error ? { code: String(env.error.code), message: env.error.message } : void 0
+    },
+    "query",
+    "nexus",
+    operation,
+    startTime
+  );
+}
+function nexusMutateEnvelopeToResponse(envelope, operation, startTime) {
+  const env = envelope;
+  return wrapResult(
+    {
+      success: env.success,
+      data: env.data,
+      error: env.error ? { code: String(env.error.code), message: env.error.message } : void 0
+    },
+    "mutate",
+    "nexus",
+    operation,
+    startTime
+  );
+}
 async function handleTopEntries(operation, params, startTime) {
   const rawLimit = params?.limit;
   const limit = typeof rawLimit === "number" && Number.isFinite(rawLimit) && rawLimit > 0 ? Math.floor(rawLimit) : 20;
@@ -22430,29 +22597,7 @@ var init_nexus2 = __esm({
             operation,
             params ?? {}
           );
-          const env = envelope;
-          let pageMetadata = env.page;
-          let resultData = env.data;
-          if (!pageMetadata && env.success && resultData && typeof resultData === "object") {
-            const dataObj = resultData;
-            if ("page" in dataObj && dataObj.page) {
-              pageMetadata = dataObj.page;
-              const { page: _removed, ...cleanData } = dataObj;
-              resultData = cleanData;
-            }
-          }
-          return wrapResult(
-            {
-              success: env.success,
-              data: resultData,
-              page: pageMetadata,
-              error: env.error ? { code: String(env.error.code), message: env.error.message } : void 0
-            },
-            "query",
-            "nexus",
-            operation,
-            startTime
-          );
+          return nexusQueryEnvelopeToResponse(envelope, operation, startTime);
         } catch (error) {
           getLogger9("domain:nexus").error(
             { gateway: "query", domain: "nexus", operation, err: error },
@@ -22478,18 +22623,7 @@ var init_nexus2 = __esm({
             operation,
             params ?? {}
           );
-          const env = envelope;
-          return wrapResult(
-            {
-              success: env.success,
-              data: env.data,
-              error: env.error ? { code: String(env.error.code), message: env.error.message } : void 0
-            },
-            "mutate",
-            "nexus",
-            operation,
-            startTime
-          );
+          return nexusMutateEnvelopeToResponse(envelope, operation, startTime);
         } catch (error) {
           getLogger9("domain:nexus").error(
             { gateway: "mutate", domain: "nexus", operation, err: error },
@@ -28220,6 +28354,31 @@ async function handleWorktreeCleanup(projectRoot, taskIds, startTime) {
     return handleErrorResult("mutate", "orchestrate", "worktree.cleanup", error, startTime);
   }
 }
+async function handleWorktreePrune(projectRoot, taskId, startTime) {
+  try {
+    const { pruneWorktree, pruneOrphanedWorktrees } = await import("@cleocode/core/internal");
+    if (taskId) {
+      const result2 = pruneWorktree(taskId, projectRoot);
+      return {
+        meta: dispatchMeta("mutate", "orchestrate", "worktree.prune", startTime),
+        success: true,
+        data: result2
+      };
+    }
+    const result = pruneOrphanedWorktrees(projectRoot, void 0);
+    return {
+      meta: dispatchMeta("mutate", "orchestrate", "worktree.prune", startTime),
+      success: true,
+      data: { ...result, mode: "bulk" }
+    };
+  } catch (error) {
+    getLogger11("domain:orchestrate").error(
+      { operation: "worktree.prune", taskId, err: error },
+      error instanceof Error ? error.message : String(error)
+    );
+    return handleErrorResult("mutate", "orchestrate", "worktree.prune", error, startTime);
+  }
+}
 var ivtrHandler, OrchestrateHandler, FANOUT_MANIFEST_MAX_SIZE, fanoutManifestStore;
 var init_orchestrate2 = __esm({
   "packages/cleo/src/dispatch/domains/orchestrate.ts"() {
@@ -28287,9 +28446,10 @@ var init_orchestrate2 = __esm({
               const result = await orchestrateAnalyze(epicId, projectRoot, mode);
               return wrapResult(result, "query", "orchestrate", "analyze", startTime);
             }
+            // T408: prompt-based CANT team routing (ADR-030 §5: query, idempotent, advisory)
             case "classify": {
               const request = params?.request;
-              if (!request) {
+              if (!request)
                 return errorResult(
                   "query",
                   "orchestrate",
@@ -28298,10 +28458,13 @@ var init_orchestrate2 = __esm({
                   "request is required",
                   startTime
                 );
-              }
-              const context = params?.context;
-              const result = await orchestrateClassify(request, context, projectRoot);
-              return wrapResult(result, "query", "orchestrate", operation, startTime);
+              return wrapResult(
+                await orchestrateClassify(request, params?.context, projectRoot),
+                "query",
+                "orchestrate",
+                operation,
+                startTime
+              );
             }
             case "fanout.status": {
               const manifestEntryId = params?.manifestEntryId;
@@ -28594,6 +28757,11 @@ var init_orchestrate2 = __esm({
               const taskIds = params?.taskIds;
               return handleWorktreeCleanup(projectRoot, taskIds, startTime);
             }
+            // T1462 — Single-task worktree prune (used by `cleo orchestrate prune`)
+            case "worktree.prune": {
+              const taskId = params?.taskId;
+              return handleWorktreePrune(projectRoot, taskId, startTime);
+            }
             case "parallel": {
               return routeByParam(params, "action", {
                 start: async () => {
@@ -28650,9 +28818,10 @@ var init_orchestrate2 = __esm({
                 }
               });
             }
+            // T409: Promise.allSettled fanout wrapper (ADR-030 §5: not idempotent, concurrent)
             case "fanout": {
               const items = params?.items;
-              if (!items || !Array.isArray(items) || items.length === 0) {
+              if (!items || !Array.isArray(items) || items.length === 0)
                 return errorResult(
                   "mutate",
                   "orchestrate",
@@ -28661,9 +28830,13 @@ var init_orchestrate2 = __esm({
                   "items array is required and must be non-empty",
                   startTime
                 );
-              }
-              const result = await orchestrateFanout(items, projectRoot);
-              return wrapResult(result, "mutate", "orchestrate", operation, startTime);
+              return wrapResult(
+                await orchestrateFanout(items, projectRoot),
+                "mutate",
+                "orchestrate",
+                operation,
+                startTime
+              );
             }
             case "tessera.instantiate": {
               const templateId = params?.templateId;
@@ -28785,7 +28958,9 @@ var init_orchestrate2 = __esm({
             "reject",
             // T1118 L1 — Worktree lifecycle
             "worktree.complete",
-            "worktree.cleanup"
+            "worktree.cleanup",
+            // T1462 — Single-task worktree prune
+            "worktree.prune"
           ]
         };
       }
@@ -29003,6 +29178,44 @@ async function chainAdvanceOp(params) {
     getProjectRoot10()
   );
 }
+function pipelinePhaseListResponse(envelope, params, operation, startTime) {
+  const listData = envelope.data ?? {};
+  const phases = listData?.phases ?? [];
+  const total = listData?.summary?.total ?? phases.length;
+  const { limit, offset } = getListParams(params);
+  const page = paginate5(phases, limit, offset);
+  return {
+    meta: dispatchMeta("query", "pipeline", operation, startTime),
+    success: true,
+    data: { ...listData, phases: page.items, total, filtered: total },
+    page: page.page
+  };
+}
+function pipelineChainListResponse(envelope, params, operation, startTime) {
+  const rawData = envelope.data ?? { _chains: [] };
+  const chains = rawData._chains ?? [];
+  const { limit, offset } = getListParams(params);
+  const page = paginate5(chains, limit, offset);
+  return {
+    meta: dispatchMeta("query", "pipeline", operation, startTime),
+    success: true,
+    data: { chains: page.items, total: chains.length, filtered: chains.length },
+    page: page.page
+  };
+}
+function pipelineEnvelopeResponse(envelope, operation, startTime) {
+  const envelopeData = envelope.data;
+  const enginePage = envelopeData?._enginePage;
+  const responseData = envelopeData?._enginePage !== void 0 ? (({ _enginePage: _p, ...rest }) => rest)(
+    envelopeData
+  ) : envelopeData;
+  return {
+    meta: dispatchMeta("query", "pipeline", operation, startTime),
+    success: true,
+    data: responseData,
+    ...enginePage ? { page: enginePage } : {}
+  };
+}
 var coreOps, _pipelineTypedHandler, PipelineHandler;
 var init_pipeline3 = __esm({
   "packages/cleo/src/dispatch/domains/pipeline.ts"() {
@@ -29369,52 +29582,11 @@ var init_pipeline3 = __esm({
               }
             };
           }
-          if (operation === "phase.list") {
-            const rawData = envelope.data;
-            const listData = rawData;
-            const phases = listData?.phases ?? [];
-            const total = listData?.summary?.total ?? phases.length;
-            const { limit, offset } = getListParams(params);
-            const page = paginate5(phases, limit, offset);
-            return {
-              meta: dispatchMeta("query", "pipeline", operation, startTime),
-              success: true,
-              data: {
-                ...listData,
-                phases: page.items,
-                total,
-                filtered: total
-              },
-              page: page.page
-            };
-          }
-          if (operation === "chain.list") {
-            const rawData = envelope.data;
-            const chains = rawData._chains ?? [];
-            const { limit, offset } = getListParams(params);
-            const page = paginate5(chains, limit, offset);
-            return {
-              meta: dispatchMeta("query", "pipeline", operation, startTime),
-              success: true,
-              data: {
-                chains: page.items,
-                total: chains.length,
-                filtered: chains.length
-              },
-              page: page.page
-            };
-          }
-          const envelopeData = envelope.data;
-          const enginePage = envelopeData?._enginePage;
-          const responseData = envelopeData?._enginePage !== void 0 ? (({ _enginePage: _p, ...rest }) => rest)(
-            envelopeData
-          ) : envelopeData;
-          return {
-            meta: dispatchMeta("query", "pipeline", operation, startTime),
-            success: true,
-            data: responseData,
-            ...enginePage ? { page: enginePage } : {}
-          };
+          if (operation === "phase.list")
+            return pipelinePhaseListResponse(envelope, params, operation, startTime);
+          if (operation === "chain.list")
+            return pipelineChainListResponse(envelope, params, operation, startTime);
+          return pipelineEnvelopeResponse(envelope, operation, startTime);
         } catch (error) {
           getLogger12("domain:pipeline").error(
             { gateway: "query", domain: "pipeline", operation, err: error },
@@ -29549,12 +29721,10 @@ var init_release2 = __esm({
         const startTime = Date.now();
         try {
           switch (operation) {
-            // ------------------------------------------------------------------
             // release.gate — IVTR gate check (RELEASE-03)
-            // ------------------------------------------------------------------
             case "gate": {
               const epicId = params?.["epicId"];
-              if (!epicId) {
+              if (!epicId)
                 return errorResult(
                   "query",
                   "release",
@@ -29563,18 +29733,18 @@ var init_release2 = __esm({
                   "epicId is required",
                   startTime
                 );
-              }
-              const force = params?.["force"] === true;
-              const projectRoot = getProjectRoot11();
-              const result = await releaseGateCheck(epicId, force, projectRoot);
-              return wrapResult(result, "query", "release", operation, startTime);
+              return wrapResult(
+                await releaseGateCheck(epicId, params?.["force"] === true, getProjectRoot11()),
+                "query",
+                "release",
+                operation,
+                startTime
+              );
             }
-            // ------------------------------------------------------------------
             // release.ivtr-suggest — IVTR auto-suggest (RELEASE-07)
-            // ------------------------------------------------------------------
             case "ivtr-suggest": {
               const taskId = params?.["taskId"];
-              if (!taskId) {
+              if (!taskId)
                 return errorResult(
                   "query",
                   "release",
@@ -29583,10 +29753,13 @@ var init_release2 = __esm({
                   "taskId is required",
                   startTime
                 );
-              }
-              const projectRoot = getProjectRoot11();
-              const result = await releaseIvtrAutoSuggest(taskId, projectRoot);
-              return wrapResult(result, "query", "release", operation, startTime);
+              return wrapResult(
+                await releaseIvtrAutoSuggest(taskId, getProjectRoot11()),
+                "query",
+                "release",
+                operation,
+                startTime
+              );
             }
             default:
               return errorResult(
@@ -29622,13 +29795,10 @@ var init_release2 = __esm({
         const startTime = Date.now();
         try {
           switch (operation) {
-            // ------------------------------------------------------------------
-            // release.gate — IVTR gate check (RELEASE-03)
-            // Pre-ship guard: blocks release.ship when tasks are not IVTR released.
-            // ------------------------------------------------------------------
+            // release.gate — IVTR gate check (RELEASE-03, no DB writes)
             case "gate": {
               const epicId = params?.["epicId"];
-              if (!epicId) {
+              if (!epicId)
                 return errorResult(
                   "mutate",
                   "release",
@@ -29637,19 +29807,18 @@ var init_release2 = __esm({
                   "epicId is required",
                   startTime
                 );
-              }
-              const force = params?.["force"] === true;
-              const projectRoot = getProjectRoot11();
-              const result = await releaseGateCheck(epicId, force, projectRoot);
-              return wrapResult(result, "mutate", "release", operation, startTime);
+              return wrapResult(
+                await releaseGateCheck(epicId, params?.["force"] === true, getProjectRoot11()),
+                "mutate",
+                "release",
+                operation,
+                startTime
+              );
             }
-            // ------------------------------------------------------------------
-            // release.ivtr-suggest — IVTR auto-suggest (RELEASE-07)
-            // Triggered after ivtr.release succeeds; checks if all siblings are done.
-            // ------------------------------------------------------------------
+            // release.ivtr-suggest — IVTR auto-suggest (RELEASE-07, no DB writes)
             case "ivtr-suggest": {
               const taskId = params?.["taskId"];
-              if (!taskId) {
+              if (!taskId)
                 return errorResult(
                   "mutate",
                   "release",
@@ -29658,10 +29827,13 @@ var init_release2 = __esm({
                   "taskId is required",
                   startTime
                 );
-              }
-              const projectRoot = getProjectRoot11();
-              const result = await releaseIvtrAutoSuggest(taskId, projectRoot);
-              return wrapResult(result, "mutate", "release", operation, startTime);
+              return wrapResult(
+                await releaseIvtrAutoSuggest(taskId, getProjectRoot11()),
+                "mutate",
+                "release",
+                operation,
+                startTime
+              );
             }
             default:
               return errorResult(
@@ -30070,10 +30242,12 @@ var init_session3 = __esm({
       // Query ops
       // -------------------------------------------------------------------------
       // Engine guarantees data on success; fallback mirrors empty-state shape.
+      // overrideCount included per T1501 / P0-5.
       status: async (_params) => wrapCoreResult(await coreOps3.status(), "status", {
         hasActiveSession: false,
         session: null,
-        taskWork: null
+        taskWork: null,
+        overrideCount: 0
       }),
       list: async (params) => wrapCoreResult(await coreOps3.list(params), "list"),
       // session.show absorbs debrief.show via include param (T5615)
@@ -30362,6 +30536,7 @@ var init_session3 = __esm({
 });
 
 // packages/cleo/src/dispatch/engines/sticky-engine.ts
+import { paginate as paginate6 } from "@cleocode/core";
 import {
   addSticky,
   archiveSticky,
@@ -30381,10 +30556,17 @@ async function stickyAdd(projectRoot, params) {
     return engineError("E_INTERNAL", String(error));
   }
 }
-async function stickyList(projectRoot, params = {}) {
+async function stickyListFiltered(projectRoot, filters, limit, offset) {
   try {
-    const stickies = await listStickies(params, projectRoot);
-    return { success: true, data: { stickies, total: stickies.length } };
+    const filteredStickies = await listStickies(filters, projectRoot);
+    const hasFilter = filters.status !== void 0 || filters.color !== void 0 || filters.priority !== void 0 || filters.tags !== void 0 && filters.tags.length > 0;
+    const total = hasFilter ? (await listStickies({}, projectRoot)).length : filteredStickies.length;
+    const page = paginate6(filteredStickies, limit, offset);
+    return {
+      success: true,
+      data: { stickies: page.items, total, filtered: filteredStickies.length },
+      page: page.page
+    };
   } catch (error) {
     return engineError("E_INTERNAL", String(error));
   }
@@ -30474,14 +30656,13 @@ var init_sticky_engine = __esm({
 });
 
 // packages/cleo/src/dispatch/domains/sticky.ts
-import { getLogger as getLogger15, getProjectRoot as getProjectRoot14, paginate as paginate6 } from "@cleocode/core";
+import { getLogger as getLogger15, getProjectRoot as getProjectRoot14 } from "@cleocode/core";
 var StickyHandler;
 var init_sticky = __esm({
   "packages/cleo/src/dispatch/domains/sticky.ts"() {
     "use strict";
     init_sticky_engine();
     init_base();
-    init_meta2();
     StickyHandler = class {
       // -----------------------------------------------------------------------
       // Query
@@ -30492,36 +30673,18 @@ var init_sticky = __esm({
         try {
           switch (operation) {
             case "list": {
-              const tags = params?.tags;
-              const filters = {
-                status: params?.status,
-                color: params?.color,
-                priority: params?.priority,
-                tags
-              };
-              const result = await stickyList(projectRoot, filters);
-              if (!result.success) {
-                return wrapResult(result, "query", "sticky", operation, startTime);
-              }
-              const filteredStickies = result.data?.stickies ?? [];
-              const hasFilter = filters.status !== void 0 || filters.color !== void 0 || filters.priority !== void 0 || tags !== void 0 && tags.length > 0;
-              const totalResult = hasFilter ? await stickyList(projectRoot, {}) : result;
-              if (!totalResult.success) {
-                return wrapResult(totalResult, "query", "sticky", operation, startTime);
-              }
-              const limit = params?.limit;
-              const offset = params?.offset;
-              const page = paginate6(filteredStickies, limit, offset);
-              return {
-                meta: dispatchMeta("query", "sticky", operation, startTime),
-                success: true,
-                data: {
-                  stickies: page.items,
-                  total: totalResult.data?.total ?? filteredStickies.length,
-                  filtered: filteredStickies.length
+              const result = await stickyListFiltered(
+                projectRoot,
+                {
+                  status: params?.status,
+                  color: params?.color,
+                  priority: params?.priority,
+                  tags: params?.tags
                 },
-                page: page.page
-              };
+                params?.limit,
+                params?.offset
+              );
+              return wrapResult(result, "query", "sticky", operation, startTime);
             }
             case "show": {
               const stickyId = params?.stickyId;
@@ -52305,6 +52468,29 @@ var fanoutCommand = defineCommand({
     );
   }
 });
+var pruneCommand = defineCommand({
+  meta: {
+    name: "prune",
+    description: "Remove stale agent worktrees (after task completion or crash)"
+  },
+  args: {
+    taskId: {
+      type: "positional",
+      description: "Task ID whose worktree should be pruned (omit for bulk prune)",
+      required: false
+    }
+  },
+  async run({ args }) {
+    const taskId = typeof args.taskId === "string" && args.taskId.length > 0 ? args.taskId : void 0;
+    await dispatchFromCli(
+      "mutate",
+      "orchestrate",
+      "worktree.prune",
+      { taskId },
+      { command: "orchestrate" }
+    );
+  }
+});
 var conduitStatusCommand = defineCommand({
   meta: { name: "conduit-status", description: "Get conduit messaging status" },
   async run() {
@@ -52486,6 +52672,7 @@ var orchestrateCommand = defineCommand({
     handoff: handoffCommand,
     "spawn-execute": spawnExecuteCommand,
     fanout: fanoutCommand,
+    prune: pruneCommand,
     "conduit-status": conduitStatusCommand,
     "conduit-peek": conduitPeekCommand,
     "conduit-start": conduitStartCommand,
@@ -58622,7 +58809,7 @@ var migrateCommand2 = defineCommand({
     }
   }
 });
-var pruneCommand = defineCommand({
+var pruneCommand2 = defineCommand({
   meta: {
     name: "prune",
     description: "Prune session transcripts older than the specified duration. Dry-run by default."
@@ -58749,7 +58936,7 @@ var transcriptCommand = defineCommand({
     scan: scanCommand,
     extract: extractCommand,
     migrate: migrateCommand2,
-    prune: pruneCommand
+    prune: pruneCommand2
   },
   async run({ cmd, rawArgs }) {
     const firstArg = rawArgs?.find((a) => !a.startsWith("-"));
@@ -59095,6 +59282,10 @@ var verifyCommand2 = defineCommand({
     explain: {
       type: "boolean",
       description: "Enrich read-only view with per-gate evidence breakdown, re-validation status, and blockers[] preventing `cleo complete` (T1013 / ADR-051)."
+    },
+    "shared-evidence": {
+      type: "boolean",
+      description: "Acknowledge that the same evidence atom is applied to >3 distinct tasks in this session (T1502 / ADR-059). Without this flag, such reuse triggers a warning; in strict mode (CLEO_STRICT_EVIDENCE=1) it is a hard reject."
     }
   },
   async run({ args, cmd }) {
@@ -59116,7 +59307,8 @@ var verifyCommand2 = defineCommand({
         agent: args.agent,
         all: args.all,
         reset: args.reset,
-        evidence: args.evidence
+        evidence: args.evidence,
+        sharedEvidence: args["shared-evidence"] ?? false
       },
       { command: "verify" }
     );