@cleocode/cleo 2026.4.152 → 2026.4.154

package/dist/cli/index.js

@@ -385,7 +385,18 @@ var init_branch_lock = __esm({
       /** L4c: override requires TTY but stdin/stderr is not a TTY. */
       E_OVERRIDE_NEEDS_TTY: "E_OVERRIDE_NEEDS_TTY",
       /** L4d: session override limit exceeded. */
-      E_OVERRIDE_RATE_LIMIT: "E_OVERRIDE_RATE_LIMIT"
+      E_OVERRIDE_RATE_LIMIT: "E_OVERRIDE_RATE_LIMIT",
+      /**
+       * T1501 / P0-5: per-session cap (default 3) exceeded without a valid waiver doc.
+       * Set CLEO_OWNER_OVERRIDE_WAIVER=<absolute path> to a file containing
+       * `cap-waiver: true` in its frontmatter to bypass the cap.
+       */
+      E_OVERRIDE_CAP_EXCEEDED: "E_OVERRIDE_CAP_EXCEEDED",
+      /**
+       * T1502 / P0-6: the same evidence atom was used across >3 distinct tasks and
+       * `--shared-evidence` was not passed (or CLEO_STRICT_EVIDENCE=1 is set in CI).
+       */
+      E_SHARED_EVIDENCE_FLAG_REQUIRED: "E_SHARED_EVIDENCE_FLAG_REQUIRED"
     };
   }
 });
@@ -3772,6 +3783,17 @@ var init_registry = __esm({
         requiredParams: [],
         params: []
       },
+      {
+        gateway: "query",
+        domain: "check",
+        operation: "test.coverage",
+        description: "check.test.coverage (query) \u2014 dedicated test coverage sub-op (T1434)",
+        tier: 1,
+        idempotent: true,
+        sessionRequired: false,
+        requiredParams: [],
+        params: []
+      },
       {
         gateway: "query",
         domain: "check",
@@ -5290,6 +5312,32 @@ var init_registry = __esm({
           }
         ]
       },
+      // T1147 W7 — sweep mutate variant (approve, rollback) — routes to same handler as query
+      // Registered separately so mutate:memory.sweep resolves correctly (T1496/P0-1)
+      {
+        gateway: "mutate",
+        domain: "memory",
+        operation: "sweep",
+        description: "memory.sweep (mutate) \u2014 T1147 W7 BRAIN noise sweep approve/rollback. approve <runId>: apply sweep to live brain tables. rollback <runId>: discard a staged run without applying changes.",
+        tier: 0,
+        idempotent: false,
+        sessionRequired: false,
+        requiredParams: [],
+        params: [
+          {
+            name: "approve",
+            type: "string",
+            required: false,
+            description: "Run ID to approve and apply to live tables."
+          },
+          {
+            name: "rollback",
+            type: "string",
+            required: false,
+            description: "Run ID to roll back without applying changes."
+          }
+        ]
+      },
       // T791 — LLM extraction backend status
       {
         gateway: "query",
@@ -8563,6 +8611,25 @@ var init_registry = __esm({
             description: "Remove worktrees idle for longer than this many hours (default: 24)"
           }
         ]
+      },
+      // T1462 — Single-task worktree prune (auto-triggered by cleo complete)
+      {
+        gateway: "mutate",
+        domain: "orchestrate",
+        operation: "worktree.prune",
+        description: "orchestrate.worktree.prune (mutate) \u2014 prune the worktree for a single completed task, or all orphaned worktrees when no taskId is supplied",
+        tier: 2,
+        idempotent: true,
+        sessionRequired: false,
+        requiredParams: [],
+        params: [
+          {
+            name: "taskId",
+            type: "string",
+            required: false,
+            description: "Task ID whose worktree should be pruned (omit for bulk prune)"
+          }
+        ]
       }
     ];
     counts = getCounts();
@@ -9584,6 +9651,7 @@ import {
   paginate,
   parseScope,
   persistHandoff,
+  readSessionOverrideCount,
   recordAssumption,
   recordDecision,
   showSession,
@@ -9598,12 +9666,14 @@ async function sessionStatus(projectRoot) {
     const focusState = await accessor.getMetaValue("focus_state");
     const sessions2 = await accessor.loadSessions();
     const active = sessions2.find((s) => s.status === "active");
+    const overrideCount = active ? readSessionOverrideCount(projectRoot, active.id) : 0;
     return {
       success: true,
       data: {
         hasActiveSession: !!active,
         session: active || null,
-        taskWork: focusState || null
+        taskWork: focusState || null,
+        overrideCount
       }
     };
   } catch {
@@ -14605,8 +14675,10 @@ import {
 import {
   appendForceBypassLine,
   appendGateAuditLine,
+  checkAndIncrementOverrideCap,
   checkGateEvidenceMinimum,
   composeGateEvidence,
+  enforceSharedEvidence,
   getAccessor as getAccessor7,
   parseEvidence,
   validateAtom
@@ -15111,6 +15183,44 @@ async function validateGateVerify(params, projectRoot) {
     }
     const isWriteRequiringEvidence = (all || gate && value !== false) && !reset;
     const override = readOverrideState();
+    let sessionOverrideOrdinal;
+    let isWorktreeCtx = false;
+    if (override.override && isWriteRequiringEvidence) {
+      const command = (process.argv.slice(1).join(" ") || "cleo").slice(0, 512);
+      const capResult = checkAndIncrementOverrideCap(
+        root,
+        sessionId ?? "global",
+        void 0,
+        command
+      );
+      if (!capResult.allowed) {
+        return engineError(
+          capResult.errorCode ?? "E_OVERRIDE_CAP_EXCEEDED",
+          capResult.errorMessage ?? "Per-session override cap exceeded."
+        );
+      }
+      sessionOverrideOrdinal = capResult.sessionOverrideOrdinal;
+      isWorktreeCtx = capResult.workTreeContext === true;
+    }
+    let sharedEvidenceAcknowledged = false;
+    let sharedAtomWarned = false;
+    if (isWriteRequiringEvidence && !override.override && params.evidence && sessionId) {
+      const seResult = enforceSharedEvidence(
+        root,
+        sessionId,
+        taskId,
+        params.evidence,
+        params.sharedEvidence === true
+      );
+      if (!seResult.allowed) {
+        return engineError(
+          seResult.errorCode ?? "E_SHARED_EVIDENCE_FLAG_REQUIRED",
+          seResult.errorMessage ?? "Shared evidence flag required."
+        );
+      }
+      sharedEvidenceAcknowledged = seResult.acknowledged === true;
+      sharedAtomWarned = seResult.warned === true;
+    }
     let verification = task.verification ?? initVerification();
     if (!verification.evidence) {
       verification.evidence = {};
@@ -15225,7 +15335,18 @@ Or set CLEO_OWNER_OVERRIDE=1 with CLEO_OWNER_OVERRIDE_REASON=<reason> for emerge
             ...auditRecord,
             overrideReason: override.reason,
             pid: process.pid,
-            command: (process.argv.slice(1).join(" ") || "cleo").slice(0, 512)
+            command: (process.argv.slice(1).join(" ") || "cleo").slice(0, 512),
+            ...sessionOverrideOrdinal !== void 0 ? { sessionOverrideOrdinal } : {},
+            ...isWorktreeCtx ? { workTreeContext: true } : {}
+          });
+        } else if ((sharedEvidenceAcknowledged || sharedAtomWarned) && action !== "reset") {
+          await appendForceBypassLine(root, {
+            ...auditRecord,
+            overrideReason: "shared-evidence",
+            pid: process.pid,
+            command: (process.argv.slice(1).join(" ") || "cleo").slice(0, 512),
+            ...sharedEvidenceAcknowledged ? { sharedEvidence: true } : {},
+            ...sharedAtomWarned ? { sharedAtomWarning: true } : {}
           });
         }
       } catch {
@@ -17729,7 +17850,8 @@ var init_check = __esm({
           all: params.all,
           reset: params.reset,
           evidence: params.evidence,
-          sessionId: params.sessionId
+          sessionId: params.sessionId,
+          sharedEvidence: params.sharedEvidence
         };
         const result = await validateGateVerify(gateParams, projectRoot);
         setImmediate(async () => {
@@ -17818,6 +17940,7 @@ var init_check = __esm({
             "compliance.summary",
             "workflow.compliance",
             "test",
+            "test.coverage",
             "coherence",
             "gate.status",
             "archive.stats",
@@ -18590,197 +18713,375 @@ function mimeFromPath(filePath) {
   if (lower.endsWith(".css")) return "text/css";
   return "application/octet-stream";
 }
-var DocsHandler;
+function docsEnvelopeToResponse(envelope, gateway, operation, startTime) {
+  if (!envelope.success) {
+    return {
+      meta: dispatchMeta(gateway, "docs", operation, startTime),
+      success: false,
+      error: {
+        code: String(envelope.error?.code ?? "E_INTERNAL"),
+        message: envelope.error?.message ?? "Unknown error"
+      }
+    };
+  }
+  let attachmentBackend;
+  let responseData = envelope.data;
+  if (responseData !== null && responseData !== void 0 && typeof responseData === "object") {
+    const dataObj = responseData;
+    if ("attachmentBackend" in dataObj && dataObj["attachmentBackend"] !== void 0) {
+      attachmentBackend = dataObj["attachmentBackend"];
+      const { attachmentBackend: _lifted, ...cleanData } = dataObj;
+      responseData = cleanData;
+    }
+  }
+  return {
+    meta: {
+      ...dispatchMeta(gateway, "docs", operation, startTime),
+      ...attachmentBackend !== void 0 ? { attachmentBackend } : {}
+    },
+    success: true,
+    data: responseData
+  };
+}
+var _docsTypedHandler, QUERY_OPS3, MUTATE_OPS3, DocsHandler;
 var init_docs = __esm({
   "packages/cleo/src/dispatch/domains/docs.ts"() {
     "use strict";
+    init_typed();
     init_base();
     init_meta2();
+    _docsTypedHandler = defineTypedHandler("docs", {
+      // ── docs.list ──────────────────────────────────────────────────────────────
+      list: async (params) => {
+        const ownerId = params.task ?? params.session ?? params.observation;
+        if (!ownerId) {
+          return lafsError(
+            "E_INVALID_INPUT",
+            "Provide one of --task, --session, or --observation to scope the list.",
+            "list"
+          );
+        }
+        const ownerType = inferOwnerType(ownerId);
+        const store = createAttachmentStore();
+        const attachments = await store.listByOwner(ownerType, ownerId);
+        const backend = await resolveAttachmentBackend();
+        return lafsSuccess(
+          {
+            ownerId,
+            ownerType,
+            count: attachments.length,
+            attachments: attachments.map((m) => ({
+              id: m.id,
+              sha256: `${m.sha256.slice(0, 8)}\u2026`,
+              // Cast: contracts AttachmentKind doesn't include 'llmtxt-doc' (contracts gap T1529)
+              kind: m.attachment.kind,
+              mime: m.attachment.kind === "local-file" || m.attachment.kind === "blob" ? m.attachment.mime : m.attachment.mime ?? "\u2014",
+              size: m.attachment.kind === "local-file" || m.attachment.kind === "blob" ? m.attachment.size : void 0,
+              description: m.attachment.description,
+              labels: m.attachment.labels,
+              createdAt: m.createdAt,
+              refCount: m.refCount
+            })),
+            // Cast: core returns 'llmtxt'|'legacy'; contracts uses 'legacy'|'llmstxt-v2' (drift T1529)
+            attachmentBackend: backend
+          },
+          "list"
+        );
+      },
+      // ── docs.generate ──────────────────────────────────────────────────────────
+      generate: async (params) => {
+        const forId = params.for;
+        if (!forId) {
+          return lafsError("E_INVALID_INPUT", "--for <taskId|epicId> is required", "generate");
+        }
+        const cwd = getProjectRoot4();
+        const result = await generateDocsLlmsTxt({ ownerId: forId, cwd });
+        let attachmentId;
+        let attachmentSha256;
+        if (params.attach) {
+          const store = createAttachmentStore();
+          const ownerType = inferOwnerType(forId);
+          const contentBytes = Buffer.from(result.content, "utf-8");
+          const llmsTxtDescriptor = {
+            kind: "llms-txt",
+            source: "generated",
+            content: result.content,
+            description: `llms.txt for ${forId} (${result.attachmentCount} docs)`,
+            labels: ["llms-txt", "generated"]
+          };
+          const meta = await store.put(
+            contentBytes,
+            llmsTxtDescriptor,
+            ownerType,
+            forId,
+            "cleo-docs-generate",
+            cwd
+          );
+          attachmentId = meta.id;
+          attachmentSha256 = meta.sha256;
+        }
+        return lafsSuccess(
+          {
+            forId,
+            content: result.content,
+            attachmentCount: result.attachmentCount,
+            usedLlmtxtPackage: result.usedLlmtxtPackage,
+            ...attachmentId !== void 0 ? {
+              attached: true,
+              attachmentId,
+              attachmentSha256
+            } : { attached: false }
+          },
+          "generate"
+        );
+      },
+      // ── docs.fetch ─────────────────────────────────────────────────────────────
+      fetch: async (params) => {
+        const ref = params.attachmentRef;
+        if (!ref) {
+          return lafsError(
+            "E_INVALID_INPUT",
+            "attachmentRef is required (attachment ID or SHA-256 hex)",
+            "fetch"
+          );
+        }
+        const store = createAttachmentStore();
+        const isSha256 = /^[0-9a-f]{64}$/i.test(ref);
+        let fetchResult = null;
+        let metadata = await store.getMetadata(ref);
+        if (metadata) {
+          fetchResult = await store.get(metadata.sha256);
+        } else if (isSha256) {
+          fetchResult = await store.get(ref);
+          if (fetchResult) {
+            metadata = fetchResult.metadata;
+          }
+        }
+        if (!fetchResult || !metadata) {
+          return lafsError("E_NOT_FOUND", `Attachment not found: ${ref}`, "fetch");
+        }
+        const cwd = getProjectRoot4();
+        const cleoDir = getCleoDirAbsolute(cwd);
+        let storagePath;
+        if (metadata.attachment.kind === "local-file") {
+          storagePath = metadata.attachment.path;
+        } else if (metadata.attachment.kind === "blob") {
+          const prefix = metadata.sha256.slice(0, 2);
+          const rest = metadata.sha256.slice(2);
+          const extMap = {
+            "text/markdown": ".md",
+            "text/plain": ".txt",
+            "application/json": ".json",
+            "application/pdf": ".pdf"
+          };
+          const mime = metadata.attachment.kind === "blob" ? metadata.attachment.mime : "application/octet-stream";
+          const ext = extMap[mime] ?? ".bin";
+          storagePath = resolve2(cleoDir, "attachments", "sha256", prefix, `${rest}${ext}`);
+        }
+        const MAX_INLINE = 1024 * 1024;
+        const bytesBase64 = fetchResult.bytes.length <= MAX_INLINE ? fetchResult.bytes.toString("base64") : void 0;
+        const backend = await resolveAttachmentBackend();
+        return lafsSuccess(
+          {
+            // Cast: core's AttachmentMetadata vs contracts/operations/docs AttachmentMetadata differ
+            // in their nested attachment field structure (T1529 contracts gap). The runtime
+            // value is compatible for all callers; the two interfaces diverged at the type level.
+            metadata,
+            path: storagePath,
+            sizeBytes: fetchResult.bytes.length,
+            ...bytesBase64 !== void 0 ? { bytesBase64 } : {},
+            inlined: bytesBase64 !== void 0,
+            // Cast: core returns 'llmtxt'|'legacy'; contracts uses 'legacy'|'llmstxt-v2' (T1529)
+            attachmentBackend: backend
+          },
+          "fetch"
+        );
+      },
+      // ── docs.add ───────────────────────────────────────────────────────────────
+      add: async (params) => {
+        const {
+          ownerId,
+          file: filePath,
+          url,
+          desc: description,
+          labels: rawLabels,
+          attachedBy: rawAttachedBy
+        } = params;
+        if (!ownerId) {
+          return lafsError("E_INVALID_INPUT", "ownerId is required", "add");
+        }
+        if (!filePath && !url) {
+          return lafsError(
+            "E_INVALID_INPUT",
+            "Provide either a file path (positional or --file) or --url",
+            "add"
+          );
+        }
+        const labels = parseLabels(rawLabels);
+        const attachedBy = rawAttachedBy ?? "human";
+        const ownerType = inferOwnerType(ownerId);
+        const store = createAttachmentStore();
+        if (filePath) {
+          const absPath = resolve2(filePath);
+          let bytes;
+          try {
+            bytes = await readFile(absPath);
+          } catch {
+            return lafsError("E_FILE_ERROR", `Cannot read file: ${absPath}`, "add");
+          }
+          const mime = mimeFromPath(absPath);
+          const attachment = {
+            kind: "local-file",
+            path: absPath,
+            mime,
+            size: bytes.length,
+            ...description ? { description } : {},
+            ...labels ? { labels } : {}
+          };
+          const meta = await store.put(bytes, attachment, ownerType, ownerId, attachedBy);
+          let backend = "legacy";
+          try {
+            const v2 = createAttachmentStoreV2(getProjectRoot4());
+            const v2Result = await v2.put(ownerId, {
+              name: absPath.split(/[\\/]/).pop() ?? meta.sha256.slice(0, 12),
+              data: new Uint8Array(bytes),
+              contentType: mime
+            });
+            backend = v2Result.backend;
+          } catch {
+            backend = await resolveAttachmentBackend();
+          }
+          import("@cleocode/core/internal").then(
+            ({ ensureLlmtxtNode }) => ensureLlmtxtNode(
+              getProjectRoot4(),
+              meta.sha256,
+              `${ownerType}:${ownerId}`,
+              absPath.split("/").pop() ?? meta.sha256.slice(0, 12)
+            )
+          ).catch(() => {
+          });
+          return lafsSuccess(
+            {
+              attachmentId: meta.id,
+              sha256: meta.sha256,
+              refCount: meta.refCount,
+              kind: "local-file",
+              ownerId,
+              ownerType,
+              // Cast: core returns 'llmtxt'|'legacy'; contracts uses 'legacy'|'llmstxt-v2' (T1529)
+              attachmentBackend: backend
+            },
+            "add"
+          );
+        }
+        if (url) {
+          const attachment = {
+            kind: "url",
+            url,
+            ...description ? { description } : {},
+            ...labels ? { labels } : {}
+          };
+          const urlBytes = Buffer.from(url, "utf-8");
+          const meta = await store.put(urlBytes, attachment, ownerType, ownerId, attachedBy);
+          import("@cleocode/core/internal").then(
+            ({ ensureLlmtxtNode }) => ensureLlmtxtNode(getProjectRoot4(), meta.sha256, `${ownerType}:${ownerId}`, url)
+          ).catch(() => {
+          });
+          const backend = "legacy";
+          return lafsSuccess(
+            {
+              attachmentId: meta.id,
+              sha256: meta.sha256,
+              refCount: meta.refCount,
+              kind: "url",
+              url,
+              ownerId,
+              ownerType,
+              // Cast: core returns 'llmtxt'|'legacy'; contracts uses 'legacy'|'llmstxt-v2' (T1529)
+              attachmentBackend: backend
+            },
+            "add"
+          );
+        }
+        return lafsError("E_INVALID_INPUT", "Unreachable: no file or url", "add");
+      },
+      // ── docs.remove ────────────────────────────────────────────────────────────
+      remove: async (params) => {
+        const { attachmentRef: ref, from: fromOwner } = params;
+        if (!ref) {
+          return lafsError(
+            "E_INVALID_INPUT",
+            "attachmentRef is required (attachment ID or SHA-256 hex)",
+            "remove"
+          );
+        }
+        if (!fromOwner) {
+          return lafsError("E_INVALID_INPUT", "--from <ownerId> is required", "remove");
+        }
+        const store = createAttachmentStore();
+        const ownerType = inferOwnerType(fromOwner);
+        let attachmentId = ref;
+        if (/^[0-9a-f]{64}$/i.test(ref)) {
+          const result = await store.get(ref);
+          if (!result) {
+            return lafsError("E_NOT_FOUND", `No attachment found with SHA-256: ${ref}`, "remove");
+          }
+          attachmentId = result.metadata.id;
+        }
+        const derefResult = await store.deref(attachmentId, ownerType, fromOwner);
+        if (derefResult.status === "not-found") {
+          return lafsError(
+            "E_NOT_FOUND",
+            `Attachment ref not found: ${attachmentId} on owner ${fromOwner}`,
+            "remove"
+          );
+        }
+        const blobPurged = derefResult.status === "removed";
+        const refCountAfter = derefResult.status === "derefd" ? derefResult.refCountAfter : 0;
+        try {
+          const v2 = createAttachmentStoreV2(getProjectRoot4());
+          await v2.remove(attachmentId, fromOwner);
+        } catch {
+        }
+        const backend = await resolveAttachmentBackend();
+        return lafsSuccess(
+          {
+            removed: blobPurged,
+            attachmentId,
+            from: fromOwner,
+            refCountAfter,
+            blobPurged,
+            // Cast: core returns 'llmtxt'|'legacy'; contracts uses 'legacy'|'llmstxt-v2' (T1529)
+            attachmentBackend: backend
+          },
+          "remove"
+        );
+      }
+    });
+    QUERY_OPS3 = /* @__PURE__ */ new Set(["list", "fetch", "generate"]);
+    MUTATE_OPS3 = /* @__PURE__ */ new Set(["add", "remove"]);
     DocsHandler = class {
       // -----------------------------------------------------------------------
       // Query
       // -----------------------------------------------------------------------
+      /**
+       * Execute a read-only docs query operation.
+       *
+       * @param operation - The docs query op name (e.g. 'list', 'fetch', 'generate').
+       * @param params - Raw params from the dispatcher (narrowed internally).
+       */
       async query(operation, params) {
         const startTime = Date.now();
+        if (!QUERY_OPS3.has(operation)) {
+          return unsupportedOp("query", "docs", operation, startTime);
+        }
         try {
-          switch (operation) {
-            // ── docs.list ────────────────────────────────────────────────────
-            case "list": {
-              const taskId = params?.task;
-              const sessionId = params?.session;
-              const observationId = params?.observation;
-              const ownerId = taskId ?? sessionId ?? observationId;
-              if (!ownerId) {
-                return errorResult(
-                  "query",
-                  "docs",
-                  operation,
-                  "E_INVALID_INPUT",
-                  "Provide one of --task, --session, or --observation to scope the list.",
-                  startTime
-                );
-              }
-              const ownerType = inferOwnerType(ownerId);
-              const store = createAttachmentStore();
-              const attachments = await store.listByOwner(ownerType, ownerId);
-              const backend = await resolveAttachmentBackend();
-              return {
-                meta: {
-                  ...dispatchMeta("query", "docs", operation, startTime),
-                  attachmentBackend: backend
-                },
-                success: true,
-                data: {
-                  ownerId,
-                  ownerType,
-                  count: attachments.length,
-                  attachments: attachments.map((m) => ({
-                    id: m.id,
-                    sha256: `${m.sha256.slice(0, 8)}\u2026`,
-                    kind: m.attachment.kind,
-                    mime: m.attachment.kind === "local-file" || m.attachment.kind === "blob" ? m.attachment.mime : m.attachment.mime ?? "\u2014",
-                    size: m.attachment.kind === "local-file" || m.attachment.kind === "blob" ? m.attachment.size : void 0,
-                    description: m.attachment.description,
-                    labels: m.attachment.labels,
-                    createdAt: m.createdAt,
-                    refCount: m.refCount
-                  }))
-                }
-              };
-            }
-            // ── docs.generate ────────────────────────────────────────────────
-            case "generate": {
-              const forId = params?.for;
-              if (!forId) {
-                return errorResult(
-                  "query",
-                  "docs",
-                  operation,
-                  "E_INVALID_INPUT",
-                  "--for <taskId|epicId> is required",
-                  startTime
-                );
-              }
-              const attach = params?.attach;
-              const cwd = getProjectRoot4();
-              const result = await generateDocsLlmsTxt({
-                ownerId: forId,
-                cwd
-              });
-              let attachmentId;
-              let attachmentSha256;
-              if (attach) {
-                const store = createAttachmentStore();
-                const ownerType = inferOwnerType(forId);
-                const contentBytes = Buffer.from(result.content, "utf-8");
-                const llmsTxtDescriptor = {
-                  kind: "llms-txt",
-                  source: "generated",
-                  content: result.content,
-                  description: `llms.txt for ${forId} (${result.attachmentCount} docs)`,
-                  labels: ["llms-txt", "generated"]
-                };
-                const meta = await store.put(
-                  contentBytes,
-                  llmsTxtDescriptor,
-                  ownerType,
-                  forId,
-                  "cleo-docs-generate",
-                  cwd
-                );
-                attachmentId = meta.id;
-                attachmentSha256 = meta.sha256;
-              }
-              return {
-                meta: dispatchMeta("query", "docs", operation, startTime),
-                success: true,
-                data: {
-                  forId,
-                  content: result.content,
-                  attachmentCount: result.attachmentCount,
-                  usedLlmtxtPackage: result.usedLlmtxtPackage,
-                  ...attachmentId !== void 0 ? {
-                    attached: true,
-                    attachmentId,
-                    attachmentSha256
-                  } : { attached: false }
-                }
-              };
-            }
-            // ── docs.fetch ───────────────────────────────────────────────────
-            case "fetch": {
-              const ref = params?.attachmentRef;
-              if (!ref) {
-                return errorResult(
-                  "query",
-                  "docs",
-                  operation,
-                  "E_INVALID_INPUT",
-                  "attachmentRef is required (attachment ID or SHA-256 hex)",
-                  startTime
-                );
-              }
-              const store = createAttachmentStore();
-              const isSha256 = /^[0-9a-f]{64}$/i.test(ref);
-              let result = null;
-              let metadata = await store.getMetadata(ref);
-              if (metadata) {
-                result = await store.get(metadata.sha256);
-              } else if (isSha256) {
-                result = await store.get(ref);
-                if (result) {
-                  metadata = result.metadata;
-                }
-              }
-              if (!result || !metadata) {
-                return errorResult(
-                  "query",
-                  "docs",
-                  operation,
-                  "E_NOT_FOUND",
-                  `Attachment not found: ${ref}`,
-                  startTime
-                );
-              }
-              const cwd = getProjectRoot4();
-              const cleoDir = getCleoDirAbsolute(cwd);
-              let storagePath;
-              if (metadata.attachment.kind === "local-file") {
-                storagePath = metadata.attachment.path;
-              } else if (metadata.attachment.kind === "blob") {
-                const prefix = metadata.sha256.slice(0, 2);
-                const rest = metadata.sha256.slice(2);
-                const extMap = {
-                  "text/markdown": ".md",
-                  "text/plain": ".txt",
-                  "application/json": ".json",
-                  "application/pdf": ".pdf"
-                };
-                const mime = metadata.attachment.kind === "blob" ? metadata.attachment.mime : "application/octet-stream";
-                const ext = extMap[mime] ?? ".bin";
-                storagePath = resolve2(cleoDir, "attachments", "sha256", prefix, `${rest}${ext}`);
-              }
-              const MAX_INLINE = 1024 * 1024;
-              const bytesBase64 = result.bytes.length <= MAX_INLINE ? result.bytes.toString("base64") : void 0;
-              const backend = await resolveAttachmentBackend();
-              return {
-                meta: {
-                  ...dispatchMeta("query", "docs", operation, startTime),
-                  attachmentBackend: backend
-                },
-                success: true,
-                data: {
-                  metadata,
-                  path: storagePath,
-                  sizeBytes: result.bytes.length,
-                  ...bytesBase64 !== void 0 ? { bytesBase64 } : {},
-                  inlined: bytesBase64 !== void 0
-                }
-              };
-            }
-            default:
-              return unsupportedOp("query", "docs", operation, startTime);
-          }
+          const envelope = await typedDispatch(
+            _docsTypedHandler,
+            operation,
+            params ?? {}
+          );
+          return docsEnvelopeToResponse(envelope, "query", operation, startTime);
         } catch (error) {
           return handleErrorResult("query", "docs", operation, error, startTime);
         }
@@ -18788,220 +19089,24 @@ var init_docs = __esm({
       // -----------------------------------------------------------------------
       // Mutate
       // -----------------------------------------------------------------------
+      /**
+       * Execute a state-modifying docs mutation operation.
+       *
+       * @param operation - The docs mutate op name (e.g. 'add', 'remove').
+       * @param params - Raw params from the dispatcher (narrowed internally).
+       */
       async mutate(operation, params) {
         const startTime = Date.now();
+        if (!MUTATE_OPS3.has(operation)) {
+          return unsupportedOp("mutate", "docs", operation, startTime);
+        }
         try {
-          switch (operation) {
-            // ── docs.add ─────────────────────────────────────────────────────
-            case "add": {
-              const ownerId = params?.ownerId;
-              if (!ownerId) {
-                return errorResult(
-                  "mutate",
-                  "docs",
-                  operation,
-                  "E_INVALID_INPUT",
-                  "ownerId is required",
-                  startTime
-                );
-              }
-              const filePath = params?.file;
-              const url = params?.url;
-              if (!filePath && !url) {
-                return errorResult(
-                  "mutate",
-                  "docs",
-                  operation,
-                  "E_INVALID_INPUT",
-                  "Provide either a file path (positional or --file) or --url",
-                  startTime
-                );
-              }
-              const description = params?.desc;
-              const labels = parseLabels(params?.labels);
-              const attachedBy = params?.attachedBy ?? "human";
-              const ownerType = inferOwnerType(ownerId);
-              const store = createAttachmentStore();
-              if (filePath) {
-                const absPath = resolve2(filePath);
-                let bytes;
-                try {
-                  bytes = await readFile(absPath);
-                } catch {
-                  return errorResult(
-                    "mutate",
-                    "docs",
-                    operation,
-                    "E_FILE_ERROR",
-                    `Cannot read file: ${absPath}`,
-                    startTime
-                  );
-                }
-                const mime = mimeFromPath(absPath);
-                const attachment = {
-                  kind: "local-file",
-                  path: absPath,
-                  mime,
-                  size: bytes.length,
-                  ...description ? { description } : {},
-                  ...labels ? { labels } : {}
-                };
-                const meta = await store.put(bytes, attachment, ownerType, ownerId, attachedBy);
-                let backend = "legacy";
-                try {
-                  const v2 = createAttachmentStoreV2(getProjectRoot4());
-                  const v2Result = await v2.put(ownerId, {
-                    name: absPath.split(/[\\/]/).pop() ?? meta.sha256.slice(0, 12),
-                    data: new Uint8Array(bytes),
-                    contentType: mime
-                  });
-                  backend = v2Result.backend;
-                } catch {
-                  backend = await resolveAttachmentBackend();
-                }
-                import("@cleocode/core/internal").then(
-                  ({ ensureLlmtxtNode }) => ensureLlmtxtNode(
-                    getProjectRoot4(),
-                    meta.sha256,
-                    `${ownerType}:${ownerId}`,
-                    absPath.split("/").pop() ?? meta.sha256.slice(0, 12)
-                  )
-                ).catch(() => {
-                });
-                return {
-                  meta: {
-                    ...dispatchMeta("mutate", "docs", operation, startTime),
-                    attachmentBackend: backend
-                  },
-                  success: true,
-                  data: {
-                    attachmentId: meta.id,
-                    sha256: meta.sha256,
-                    refCount: meta.refCount,
-                    kind: "local-file",
-                    ownerId,
-                    ownerType
-                  }
-                };
-              }
-              if (url) {
-                const attachment = {
-                  kind: "url",
-                  url,
-                  ...description ? { description } : {},
-                  ...labels ? { labels } : {}
-                };
-                const urlBytes = Buffer.from(url, "utf-8");
-                const meta = await store.put(urlBytes, attachment, ownerType, ownerId, attachedBy);
-                import("@cleocode/core/internal").then(
-                  ({ ensureLlmtxtNode }) => ensureLlmtxtNode(getProjectRoot4(), meta.sha256, `${ownerType}:${ownerId}`, url)
-                ).catch(() => {
-                });
-                const backend = "legacy";
-                return {
-                  meta: {
-                    ...dispatchMeta("mutate", "docs", operation, startTime),
-                    attachmentBackend: backend
-                  },
-                  success: true,
-                  data: {
-                    attachmentId: meta.id,
-                    sha256: meta.sha256,
-                    refCount: meta.refCount,
-                    kind: "url",
-                    url,
-                    ownerId,
-                    ownerType
-                  }
-                };
-              }
-              return errorResult(
-                "mutate",
-                "docs",
-                operation,
-                "E_INVALID_INPUT",
-                "Unreachable: no file or url",
-                startTime
-              );
-            }
-            // ── docs.remove ──────────────────────────────────────────────────
-            case "remove": {
-              const ref = params?.attachmentRef;
-              const fromOwner = params?.from;
-              if (!ref) {
-                return errorResult(
-                  "mutate",
-                  "docs",
-                  operation,
-                  "E_INVALID_INPUT",
-                  "attachmentRef is required (attachment ID or SHA-256 hex)",
-                  startTime
-                );
-              }
-              if (!fromOwner) {
-                return errorResult(
-                  "mutate",
-                  "docs",
-                  operation,
-                  "E_INVALID_INPUT",
-                  "--from <ownerId> is required",
-                  startTime
-                );
-              }
-              const store = createAttachmentStore();
-              const ownerType = inferOwnerType(fromOwner);
-              let attachmentId = ref;
-              if (/^[0-9a-f]{64}$/i.test(ref)) {
-                const result = await store.get(ref);
-                if (!result) {
-                  return errorResult(
-                    "mutate",
-                    "docs",
-                    operation,
-                    "E_NOT_FOUND",
-                    `No attachment found with SHA-256: ${ref}`,
-                    startTime
-                  );
-                }
-                attachmentId = result.metadata.id;
-              }
-              const derefResult = await store.deref(attachmentId, ownerType, fromOwner);
-              if (derefResult.status === "not-found") {
-                return errorResult(
-                  "mutate",
-                  "docs",
-                  operation,
-                  "E_NOT_FOUND",
-                  `Attachment ref not found: ${attachmentId} on owner ${fromOwner}`,
-                  startTime
-                );
-              }
-              const blobPurged = derefResult.status === "removed";
-              const refCountAfter = derefResult.status === "derefd" ? derefResult.refCountAfter : 0;
-              try {
-                const v2 = createAttachmentStoreV2(getProjectRoot4());
-                await v2.remove(attachmentId, fromOwner);
-              } catch {
-              }
-              const backend = await resolveAttachmentBackend();
-              return {
-                meta: {
-                  ...dispatchMeta("mutate", "docs", operation, startTime),
-                  attachmentBackend: backend
-                },
-                success: true,
-                data: {
-                  removed: blobPurged,
-                  attachmentId,
-                  from: fromOwner,
-                  refCountAfter,
-                  blobPurged
-                }
-              };
-            }
-            default:
-              return unsupportedOp("mutate", "docs", operation, startTime);
-          }
+          const envelope = await typedDispatch(
+            _docsTypedHandler,
+            operation,
+            params ?? {}
+          );
+          return docsEnvelopeToResponse(envelope, "mutate", operation, startTime);
         } catch (error) {
           return handleErrorResult("mutate", "docs", operation, error, startTime);
         }
@@ -19009,6 +19114,7 @@ var init_docs = __esm({
       // -----------------------------------------------------------------------
       // Supported operations
       // -----------------------------------------------------------------------
+      /** Declared operations for introspection and validation. */
       getSupportedOperations() {
         return {
           query: ["list", "fetch", "generate"],
@@ -19273,7 +19379,7 @@ var init_memory2 = __esm({
           switch (operation) {
             case "find": {
               const query = paramStringRequired(params, "query");
-              if (!query) {
+              if (!query)
                 return errorResult(
                   "query",
                   "memory",
@@ -19282,24 +19388,27 @@ var init_memory2 = __esm({
                   "query is required",
                   startTime
                 );
-              }
-              const result = await memoryFind(
-                {
-                  query,
-                  limit: paramNumber(params, "limit"),
-                  tables: paramStringArray(params, "tables"),
-                  dateStart: paramString(params, "dateStart"),
-                  dateEnd: paramString(params, "dateEnd"),
-                  // T418: optional agent filter for per-agent mental model retrieval
-                  agent: paramString(params, "agent")
-                },
-                projectRoot
+              return wrapResult(
+                await memoryFind(
+                  {
+                    query,
+                    limit: paramNumber(params, "limit"),
+                    tables: paramStringArray(params, "tables"),
+                    dateStart: paramString(params, "dateStart"),
+                    dateEnd: paramString(params, "dateEnd"),
+                    agent: paramString(params, "agent")
+                  },
+                  projectRoot
+                ),
+                "query",
+                "memory",
+                operation,
+                startTime
               );
-              return wrapResult(result, "query", "memory", operation, startTime);
             }
             case "timeline": {
               const anchor = paramStringRequired(params, "anchor");
-              if (!anchor) {
+              if (!anchor)
                 return errorResult(
                   "query",
                   "memory",
@@ -19308,20 +19417,24 @@ var init_memory2 = __esm({
                   "anchor is required",
                   startTime
                 );
-              }
-              const result = await memoryTimeline(
-                {
-                  anchor,
-                  depthBefore: paramNumber(params, "depthBefore"),
-                  depthAfter: paramNumber(params, "depthAfter")
-                },
-                projectRoot
+              return wrapResult(
+                await memoryTimeline(
+                  {
+                    anchor,
+                    depthBefore: paramNumber(params, "depthBefore"),
+                    depthAfter: paramNumber(params, "depthAfter")
+                  },
+                  projectRoot
+                ),
+                "query",
+                "memory",
+                operation,
+                startTime
               );
-              return wrapResult(result, "query", "memory", operation, startTime);
             }
             case "fetch": {
               const ids = paramStringArray(params, "ids");
-              if (!ids || ids.length === 0) {
+              if (!ids || ids.length === 0)
                 return errorResult(
                   "query",
                   "memory",
@@ -19330,9 +19443,13 @@ var init_memory2 = __esm({
                   "ids is required (non-empty array)",
                   startTime
                 );
-              }
-              const result = await memoryFetch({ ids }, projectRoot);
-              return wrapResult(result, "query", "memory", operation, startTime);
+              return wrapResult(
+                await memoryFetch({ ids }, projectRoot),
+                "query",
+                "memory",
+                operation,
+                startTime
+              );
             }
             case "decision.find": {
               const result = await memoryDecisionFind(
@@ -20786,6 +20903,10 @@ var init_memory2 = __esm({
                 return handleErrorResult("mutate", "memory", operation, rollbackErr, startTime);
               }
             }
+            // T1147 W7 — sweep mutate operations (approve, rollback) delegate to query handler
+            // which already handles all sweep sub-commands via a unified case block.
+            case "sweep":
+              return this.query(operation, params);
             default:
               return unsupportedOp("mutate", "memory", operation, startTime);
           }
@@ -20862,6 +20983,8 @@ var init_memory2 = __esm({
             "precompact-flush",
             // T1006 — write a diary-typed observation
             "diary.write",
+            // T1147 W7 — sweep mutate operations (approve, rollback)
+            "sweep",
             // T1003 — staged backfill operations
             "backfill.run",
             "backfill.approve",
@@ -21692,6 +21815,45 @@ import {
   getNexusNativeDb as getNexusNativeDb2,
   getProjectRoot as getProjectRoot7
 } from "@cleocode/core/internal";
+function nexusQueryEnvelopeToResponse(envelope, operation, startTime) {
+  const env = envelope;
+  let pageMetadata = env.page;
+  let resultData = env.data;
+  if (!pageMetadata && env.success && resultData && typeof resultData === "object") {
+    const dataObj = resultData;
+    if ("page" in dataObj && dataObj.page) {
+      pageMetadata = dataObj.page;
+      const { page: _removed, ...cleanData } = dataObj;
+      resultData = cleanData;
+    }
+  }
+  return wrapResult(
+    {
+      success: env.success,
+      data: resultData,
+      page: pageMetadata,
+      error: env.error ? { code: String(env.error.code), message: env.error.message } : void 0
+    },
+    "query",
+    "nexus",
+    operation,
+    startTime
+  );
+}
+function nexusMutateEnvelopeToResponse(envelope, operation, startTime) {
+  const env = envelope;
+  return wrapResult(
+    {
+      success: env.success,
+      data: env.data,
+      error: env.error ? { code: String(env.error.code), message: env.error.message } : void 0
+    },
+    "mutate",
+    "nexus",
+    operation,
+    startTime
+  );
+}
 async function handleTopEntries(operation, params, startTime) {
   const rawLimit = params?.limit;
   const limit = typeof rawLimit === "number" && Number.isFinite(rawLimit) && rawLimit > 0 ? Math.floor(rawLimit) : 20;
@@ -22038,7 +22200,7 @@ async function handleImpact(operation, params, startTime) {
     return handleErrorResult("query", "nexus", operation, dbErr, startTime);
   }
 }
-var _nexusTypedHandler, QUERY_OPS3, MUTATE_OPS3, NexusHandler, IMPACT_REVERSE_TYPES;
+var _nexusTypedHandler, QUERY_OPS4, MUTATE_OPS4, NexusHandler, IMPACT_REVERSE_TYPES;
 var init_nexus2 = __esm({
   "packages/cleo/src/dispatch/domains/nexus.ts"() {
     "use strict";
@@ -22354,7 +22516,7 @@ var init_nexus2 = __esm({
       },
       "sigil.sync": async (_params) => wrapCoreResult(await nexusSigilSync(), "sigil.sync")
     });
-    QUERY_OPS3 = /* @__PURE__ */ new Set([
+    QUERY_OPS4 = /* @__PURE__ */ new Set([
       "share.status",
       "status",
       "list",
@@ -22386,7 +22548,7 @@ var init_nexus2 = __esm({
       "profile.get",
       "sigil.list"
     ]);
-    MUTATE_OPS3 = /* @__PURE__ */ new Set([
+    MUTATE_OPS4 = /* @__PURE__ */ new Set([
       "share.snapshot.export",
       "share.snapshot.import",
       "init",
@@ -22415,7 +22577,7 @@ var init_nexus2 = __esm({
        */
       async query(operation, params) {
         const startTime = Date.now();
-        if (!QUERY_OPS3.has(operation)) {
+        if (!QUERY_OPS4.has(operation)) {
           return unsupportedOp("query", "nexus", operation, startTime);
         }
         if (operation === "top-entries") {
@@ -22430,29 +22592,7 @@ var init_nexus2 = __esm({
             operation,
             params ?? {}
           );
-          const env = envelope;
-          let pageMetadata = env.page;
-          let resultData = env.data;
-          if (!pageMetadata && env.success && resultData && typeof resultData === "object") {
-            const dataObj = resultData;
-            if ("page" in dataObj && dataObj.page) {
-              pageMetadata = dataObj.page;
-              const { page: _removed, ...cleanData } = dataObj;
-              resultData = cleanData;
-            }
-          }
-          return wrapResult(
-            {
-              success: env.success,
-              data: resultData,
-              page: pageMetadata,
-              error: env.error ? { code: String(env.error.code), message: env.error.message } : void 0
-            },
-            "query",
-            "nexus",
-            operation,
-            startTime
-          );
+          return nexusQueryEnvelopeToResponse(envelope, operation, startTime);
         } catch (error) {
           getLogger9("domain:nexus").error(
             { gateway: "query", domain: "nexus", operation, err: error },
@@ -22469,7 +22609,7 @@ var init_nexus2 = __esm({
        */
       async mutate(operation, params) {
         const startTime = Date.now();
-        if (!MUTATE_OPS3.has(operation)) {
+        if (!MUTATE_OPS4.has(operation)) {
           return unsupportedOp("mutate", "nexus", operation, startTime);
         }
         try {
@@ -22478,18 +22618,7 @@ var init_nexus2 = __esm({
             operation,
             params ?? {}
           );
-          const env = envelope;
-          return wrapResult(
-            {
-              success: env.success,
-              data: env.data,
-              error: env.error ? { code: String(env.error.code), message: env.error.message } : void 0
-            },
-            "mutate",
-            "nexus",
-            operation,
-            startTime
-          );
+          return nexusMutateEnvelopeToResponse(envelope, operation, startTime);
         } catch (error) {
           getLogger9("domain:nexus").error(
             { gateway: "mutate", domain: "nexus", operation, err: error },
@@ -22501,8 +22630,8 @@ var init_nexus2 = __esm({
       /** Declared operations for introspection and validation. */
       getSupportedOperations() {
         return {
-          query: Array.from(QUERY_OPS3),
-          mutate: Array.from(MUTATE_OPS3)
+          query: Array.from(QUERY_OPS4),
+          mutate: Array.from(MUTATE_OPS4)
         };
       }
     };
@@ -27407,7 +27536,7 @@ async function lookupApprovalByTokenForDispatch(token) {
   const db = await acquireDb();
   return getPlaybookApprovalByToken(db, token);
 }
-var __playbookRuntimeOverrides, _playbookTypedHandler, QUERY_OPS4, MUTATE_OPS4, PlaybookHandler;
+var __playbookRuntimeOverrides, _playbookTypedHandler, QUERY_OPS5, MUTATE_OPS5, PlaybookHandler;
 var init_playbook2 = __esm({
   "packages/cleo/src/dispatch/domains/playbook.ts"() {
     "use strict";
@@ -27673,15 +27802,15 @@ var init_playbook2 = __esm({
         }
       }
     });
-    QUERY_OPS4 = /* @__PURE__ */ new Set(["status", "list", "validate"]);
-    MUTATE_OPS4 = /* @__PURE__ */ new Set(["run", "resume"]);
+    QUERY_OPS5 = /* @__PURE__ */ new Set(["status", "list", "validate"]);
+    MUTATE_OPS5 = /* @__PURE__ */ new Set(["run", "resume"]);
     PlaybookHandler = class {
       /**
        * Query gateway — `status`, `list`, and `validate`.
        */
       async query(operation, params) {
         const startTime = Date.now();
-        if (!QUERY_OPS4.has(operation)) {
+        if (!QUERY_OPS5.has(operation)) {
           return unsupportedOp("query", "playbook", operation, startTime);
         }
         try {
@@ -27709,7 +27838,7 @@ var init_playbook2 = __esm({
        */
       async mutate(operation, params) {
         const startTime = Date.now();
-        if (!MUTATE_OPS4.has(operation)) {
+        if (!MUTATE_OPS5.has(operation)) {
           return unsupportedOp("mutate", "playbook", operation, startTime);
         }
         try {
@@ -28220,6 +28349,31 @@ async function handleWorktreeCleanup(projectRoot, taskIds, startTime) {
     return handleErrorResult("mutate", "orchestrate", "worktree.cleanup", error, startTime);
   }
 }
+async function handleWorktreePrune(projectRoot, taskId, startTime) {
+  try {
+    const { pruneWorktree, pruneOrphanedWorktrees } = await import("@cleocode/core/internal");
+    if (taskId) {
+      const result2 = pruneWorktree(taskId, projectRoot);
+      return {
+        meta: dispatchMeta("mutate", "orchestrate", "worktree.prune", startTime),
+        success: true,
+        data: result2
+      };
+    }
+    const result = pruneOrphanedWorktrees(projectRoot, void 0);
+    return {
+      meta: dispatchMeta("mutate", "orchestrate", "worktree.prune", startTime),
+      success: true,
+      data: { ...result, mode: "bulk" }
+    };
+  } catch (error) {
+    getLogger11("domain:orchestrate").error(
+      { operation: "worktree.prune", taskId, err: error },
+      error instanceof Error ? error.message : String(error)
+    );
+    return handleErrorResult("mutate", "orchestrate", "worktree.prune", error, startTime);
+  }
+}
 var ivtrHandler, OrchestrateHandler, FANOUT_MANIFEST_MAX_SIZE, fanoutManifestStore;
 var init_orchestrate2 = __esm({
   "packages/cleo/src/dispatch/domains/orchestrate.ts"() {
@@ -28287,9 +28441,10 @@ var init_orchestrate2 = __esm({
               const result = await orchestrateAnalyze(epicId, projectRoot, mode);
               return wrapResult(result, "query", "orchestrate", "analyze", startTime);
             }
+            // T408: prompt-based CANT team routing (ADR-030 §5: query, idempotent, advisory)
             case "classify": {
               const request = params?.request;
-              if (!request) {
+              if (!request)
                 return errorResult(
                   "query",
                   "orchestrate",
@@ -28298,10 +28453,13 @@ var init_orchestrate2 = __esm({
                   "request is required",
                   startTime
                 );
-              }
-              const context = params?.context;
-              const result = await orchestrateClassify(request, context, projectRoot);
-              return wrapResult(result, "query", "orchestrate", operation, startTime);
+              return wrapResult(
+                await orchestrateClassify(request, params?.context, projectRoot),
+                "query",
+                "orchestrate",
+                operation,
+                startTime
+              );
             }
             case "fanout.status": {
               const manifestEntryId = params?.manifestEntryId;
@@ -28594,6 +28752,11 @@ var init_orchestrate2 = __esm({
               const taskIds = params?.taskIds;
               return handleWorktreeCleanup(projectRoot, taskIds, startTime);
             }
+            // T1462 — Single-task worktree prune (used by `cleo orchestrate prune`)
+            case "worktree.prune": {
+              const taskId = params?.taskId;
+              return handleWorktreePrune(projectRoot, taskId, startTime);
+            }
             case "parallel": {
               return routeByParam(params, "action", {
                 start: async () => {
@@ -28650,9 +28813,10 @@ var init_orchestrate2 = __esm({
                 }
               });
             }
+            // T409: Promise.allSettled fanout wrapper (ADR-030 §5: not idempotent, concurrent)
             case "fanout": {
               const items = params?.items;
-              if (!items || !Array.isArray(items) || items.length === 0) {
+              if (!items || !Array.isArray(items) || items.length === 0)
                 return errorResult(
                   "mutate",
                   "orchestrate",
@@ -28661,9 +28825,13 @@ var init_orchestrate2 = __esm({
                   "items array is required and must be non-empty",
                   startTime
                 );
-              }
-              const result = await orchestrateFanout(items, projectRoot);
-              return wrapResult(result, "mutate", "orchestrate", operation, startTime);
+              return wrapResult(
+                await orchestrateFanout(items, projectRoot),
+                "mutate",
+                "orchestrate",
+                operation,
+                startTime
+              );
             }
             case "tessera.instantiate": {
               const templateId = params?.templateId;
@@ -28785,7 +28953,9 @@ var init_orchestrate2 = __esm({
             "reject",
             // T1118 L1 — Worktree lifecycle
             "worktree.complete",
-            "worktree.cleanup"
+            "worktree.cleanup",
+            // T1462 — Single-task worktree prune
+            "worktree.prune"
           ]
         };
       }
@@ -29003,6 +29173,44 @@ async function chainAdvanceOp(params) {
     getProjectRoot10()
   );
 }
+function pipelinePhaseListResponse(envelope, params, operation, startTime) {
+  const listData = envelope.data ?? {};
+  const phases = listData?.phases ?? [];
+  const total = listData?.summary?.total ?? phases.length;
+  const { limit, offset } = getListParams(params);
+  const page = paginate5(phases, limit, offset);
+  return {
+    meta: dispatchMeta("query", "pipeline", operation, startTime),
+    success: true,
+    data: { ...listData, phases: page.items, total, filtered: total },
+    page: page.page
+  };
+}
+function pipelineChainListResponse(envelope, params, operation, startTime) {
+  const rawData = envelope.data ?? { _chains: [] };
+  const chains = rawData._chains ?? [];
+  const { limit, offset } = getListParams(params);
+  const page = paginate5(chains, limit, offset);
+  return {
+    meta: dispatchMeta("query", "pipeline", operation, startTime),
+    success: true,
+    data: { chains: page.items, total: chains.length, filtered: chains.length },
+    page: page.page
+  };
+}
+function pipelineEnvelopeResponse(envelope, operation, startTime) {
+  const envelopeData = envelope.data;
+  const enginePage = envelopeData?._enginePage;
+  const responseData = envelopeData?._enginePage !== void 0 ? (({ _enginePage: _p, ...rest }) => rest)(
+    envelopeData
+  ) : envelopeData;
+  return {
+    meta: dispatchMeta("query", "pipeline", operation, startTime),
+    success: true,
+    data: responseData,
+    ...enginePage ? { page: enginePage } : {}
+  };
+}
 var coreOps, _pipelineTypedHandler, PipelineHandler;
 var init_pipeline3 = __esm({
   "packages/cleo/src/dispatch/domains/pipeline.ts"() {
@@ -29369,52 +29577,11 @@ var init_pipeline3 = __esm({
               }
             };
           }
-          if (operation === "phase.list") {
-            const rawData = envelope.data;
-            const listData = rawData;
-            const phases = listData?.phases ?? [];
-            const total = listData?.summary?.total ?? phases.length;
-            const { limit, offset } = getListParams(params);
-            const page = paginate5(phases, limit, offset);
-            return {
-              meta: dispatchMeta("query", "pipeline", operation, startTime),
-              success: true,
-              data: {
-                ...listData,
-                phases: page.items,
-                total,
-                filtered: total
-              },
-              page: page.page
-            };
-          }
-          if (operation === "chain.list") {
-            const rawData = envelope.data;
-            const chains = rawData._chains ?? [];
-            const { limit, offset } = getListParams(params);
-            const page = paginate5(chains, limit, offset);
-            return {
-              meta: dispatchMeta("query", "pipeline", operation, startTime),
-              success: true,
-              data: {
-                chains: page.items,
-                total: chains.length,
-                filtered: chains.length
-              },
-              page: page.page
-            };
-          }
-          const envelopeData = envelope.data;
-          const enginePage = envelopeData?._enginePage;
-          const responseData = envelopeData?._enginePage !== void 0 ? (({ _enginePage: _p, ...rest }) => rest)(
-            envelopeData
-          ) : envelopeData;
-          return {
-            meta: dispatchMeta("query", "pipeline", operation, startTime),
-            success: true,
-            data: responseData,
-            ...enginePage ? { page: enginePage } : {}
-          };
+          if (operation === "phase.list")
+            return pipelinePhaseListResponse(envelope, params, operation, startTime);
+          if (operation === "chain.list")
+            return pipelineChainListResponse(envelope, params, operation, startTime);
+          return pipelineEnvelopeResponse(envelope, operation, startTime);
         } catch (error) {
           getLogger12("domain:pipeline").error(
             { gateway: "query", domain: "pipeline", operation, err: error },
@@ -29549,12 +29716,10 @@ var init_release2 = __esm({
         const startTime = Date.now();
         try {
           switch (operation) {
-            // ------------------------------------------------------------------
             // release.gate — IVTR gate check (RELEASE-03)
-            // ------------------------------------------------------------------
             case "gate": {
               const epicId = params?.["epicId"];
-              if (!epicId) {
+              if (!epicId)
                 return errorResult(
                   "query",
                   "release",
@@ -29563,18 +29728,18 @@ var init_release2 = __esm({
                   "epicId is required",
                   startTime
                 );
-              }
-              const force = params?.["force"] === true;
-              const projectRoot = getProjectRoot11();
-              const result = await releaseGateCheck(epicId, force, projectRoot);
-              return wrapResult(result, "query", "release", operation, startTime);
+              return wrapResult(
+                await releaseGateCheck(epicId, params?.["force"] === true, getProjectRoot11()),
+                "query",
+                "release",
+                operation,
+                startTime
+              );
             }
-            // ------------------------------------------------------------------
             // release.ivtr-suggest — IVTR auto-suggest (RELEASE-07)
-            // ------------------------------------------------------------------
             case "ivtr-suggest": {
               const taskId = params?.["taskId"];
-              if (!taskId) {
+              if (!taskId)
                 return errorResult(
                   "query",
                   "release",
@@ -29583,10 +29748,13 @@ var init_release2 = __esm({
                   "taskId is required",
                   startTime
                 );
-              }
-              const projectRoot = getProjectRoot11();
-              const result = await releaseIvtrAutoSuggest(taskId, projectRoot);
-              return wrapResult(result, "query", "release", operation, startTime);
+              return wrapResult(
+                await releaseIvtrAutoSuggest(taskId, getProjectRoot11()),
+                "query",
+                "release",
+                operation,
+                startTime
+              );
             }
             default:
               return errorResult(
@@ -29622,13 +29790,10 @@ var init_release2 = __esm({
         const startTime = Date.now();
         try {
           switch (operation) {
-            // ------------------------------------------------------------------
-            // release.gate — IVTR gate check (RELEASE-03)
-            // Pre-ship guard: blocks release.ship when tasks are not IVTR released.
-            // ------------------------------------------------------------------
+            // release.gate — IVTR gate check (RELEASE-03, no DB writes)
             case "gate": {
               const epicId = params?.["epicId"];
-              if (!epicId) {
+              if (!epicId)
                 return errorResult(
                   "mutate",
                   "release",
@@ -29637,19 +29802,18 @@ var init_release2 = __esm({
                   "epicId is required",
                   startTime
                 );
-              }
-              const force = params?.["force"] === true;
-              const projectRoot = getProjectRoot11();
-              const result = await releaseGateCheck(epicId, force, projectRoot);
-              return wrapResult(result, "mutate", "release", operation, startTime);
+              return wrapResult(
+                await releaseGateCheck(epicId, params?.["force"] === true, getProjectRoot11()),
+                "mutate",
+                "release",
+                operation,
+                startTime
+              );
             }
-            // ------------------------------------------------------------------
-            // release.ivtr-suggest — IVTR auto-suggest (RELEASE-07)
-            // Triggered after ivtr.release succeeds; checks if all siblings are done.
-            // ------------------------------------------------------------------
+            // release.ivtr-suggest — IVTR auto-suggest (RELEASE-07, no DB writes)
             case "ivtr-suggest": {
               const taskId = params?.["taskId"];
-              if (!taskId) {
+              if (!taskId)
                 return errorResult(
                   "mutate",
                   "release",
@@ -29658,10 +29822,13 @@ var init_release2 = __esm({
                   "taskId is required",
                   startTime
                 );
-              }
-              const projectRoot = getProjectRoot11();
-              const result = await releaseIvtrAutoSuggest(taskId, projectRoot);
-              return wrapResult(result, "mutate", "release", operation, startTime);
+              return wrapResult(
+                await releaseIvtrAutoSuggest(taskId, getProjectRoot11()),
+                "mutate",
+                "release",
+                operation,
+                startTime
+              );
             }
             default:
               return errorResult(
@@ -29718,7 +29885,7 @@ function envelopeToEngineResult3(envelope) {
     }
   };
 }
-var coreOps2, _sentientTypedHandler, QUERY_OPS5, MUTATE_OPS5, SentientHandler;
+var coreOps2, _sentientTypedHandler, QUERY_OPS6, MUTATE_OPS6, SentientHandler;
 var init_sentient2 = __esm({
   "packages/cleo/src/dispatch/domains/sentient.ts"() {
     "use strict";
@@ -29838,8 +30005,8 @@ var init_sentient2 = __esm({
         }
       }
     });
-    QUERY_OPS5 = /* @__PURE__ */ new Set(["propose.list", "propose.diff", "allowlist.list"]);
-    MUTATE_OPS5 = /* @__PURE__ */ new Set([
+    QUERY_OPS6 = /* @__PURE__ */ new Set(["propose.list", "propose.diff", "allowlist.list"]);
+    MUTATE_OPS6 = /* @__PURE__ */ new Set([
       "propose.accept",
       "propose.reject",
       "propose.run",
@@ -29872,7 +30039,7 @@ var init_sentient2 = __esm({
        */
       async query(operation, params) {
         const startTime = Date.now();
-        if (!QUERY_OPS5.has(operation)) {
+        if (!QUERY_OPS6.has(operation)) {
           return unsupportedOp("query", "sentient", operation, startTime);
         }
         try {
@@ -29900,7 +30067,7 @@ var init_sentient2 = __esm({
        */
       async mutate(operation, params) {
         const startTime = Date.now();
-        if (!MUTATE_OPS5.has(operation)) {
+        if (!MUTATE_OPS6.has(operation)) {
           return unsupportedOp("mutate", "sentient", operation, startTime);
         }
         try {
@@ -30040,7 +30207,7 @@ async function storeSessionOwnerAuthToken(projectRoot, sessionId, token) {
   const db = await getDb(projectRoot);
   db.update(sessions).set({ ownerAuthToken: token }).where(eq(sessions.id, sessionId)).run();
 }
-var coreOps3, _sessionTypedHandler, QUERY_OPS6, MUTATE_OPS6, SessionHandler;
+var coreOps3, _sessionTypedHandler, QUERY_OPS7, MUTATE_OPS7, SessionHandler;
 var init_session3 = __esm({
   "packages/cleo/src/dispatch/domains/session.ts"() {
     "use strict";
@@ -30070,10 +30237,12 @@ var init_session3 = __esm({
       // Query ops
       // -------------------------------------------------------------------------
       // Engine guarantees data on success; fallback mirrors empty-state shape.
+      // overrideCount included per T1501 / P0-5.
       status: async (_params) => wrapCoreResult(await coreOps3.status(), "status", {
         hasActiveSession: false,
         session: null,
-        taskWork: null
+        taskWork: null,
+        overrideCount: 0
       }),
       list: async (params) => wrapCoreResult(await coreOps3.list(params), "list"),
       // session.show absorbs debrief.show via include param (T5615)
@@ -30254,7 +30423,7 @@ var init_session3 = __esm({
         return wrapCoreResult(result, "record.assumption");
       }
     });
-    QUERY_OPS6 = /* @__PURE__ */ new Set([
+    QUERY_OPS7 = /* @__PURE__ */ new Set([
       "status",
       "list",
       "show",
@@ -30264,7 +30433,7 @@ var init_session3 = __esm({
       "handoff.show",
       "briefing.show"
     ]);
-    MUTATE_OPS6 = /* @__PURE__ */ new Set([
+    MUTATE_OPS7 = /* @__PURE__ */ new Set([
       "start",
       "end",
       "resume",
@@ -30285,7 +30454,7 @@ var init_session3 = __esm({
        */
       async query(operation, params) {
         const startTime = Date.now();
-        if (!QUERY_OPS6.has(operation)) {
+        if (!QUERY_OPS7.has(operation)) {
           return unsupportedOp("query", "session", operation, startTime);
         }
         try {
@@ -30314,7 +30483,7 @@ var init_session3 = __esm({
        */
       async mutate(operation, params) {
         const startTime = Date.now();
-        if (!MUTATE_OPS6.has(operation)) {
+        if (!MUTATE_OPS7.has(operation)) {
           return unsupportedOp("mutate", "session", operation, startTime);
         }
         try {
@@ -30362,6 +30531,7 @@ var init_session3 = __esm({
 });
 
 // packages/cleo/src/dispatch/engines/sticky-engine.ts
+import { paginate as paginate6 } from "@cleocode/core";
 import {
   addSticky,
   archiveSticky,
@@ -30381,10 +30551,17 @@ async function stickyAdd(projectRoot, params) {
     return engineError("E_INTERNAL", String(error));
   }
 }
-async function stickyList(projectRoot, params = {}) {
+async function stickyListFiltered(projectRoot, filters, limit, offset) {
   try {
-    const stickies = await listStickies(params, projectRoot);
-    return { success: true, data: { stickies, total: stickies.length } };
+    const filteredStickies = await listStickies(filters, projectRoot);
+    const hasFilter = filters.status !== void 0 || filters.color !== void 0 || filters.priority !== void 0 || filters.tags !== void 0 && filters.tags.length > 0;
+    const total = hasFilter ? (await listStickies({}, projectRoot)).length : filteredStickies.length;
+    const page = paginate6(filteredStickies, limit, offset);
+    return {
+      success: true,
+      data: { stickies: page.items, total, filtered: filteredStickies.length },
+      page: page.page
+    };
   } catch (error) {
     return engineError("E_INTERNAL", String(error));
   }
@@ -30474,14 +30651,13 @@ var init_sticky_engine = __esm({
 });
 
 // packages/cleo/src/dispatch/domains/sticky.ts
-import { getLogger as getLogger15, getProjectRoot as getProjectRoot14, paginate as paginate6 } from "@cleocode/core";
+import { getLogger as getLogger15, getProjectRoot as getProjectRoot14 } from "@cleocode/core";
 var StickyHandler;
 var init_sticky = __esm({
   "packages/cleo/src/dispatch/domains/sticky.ts"() {
     "use strict";
     init_sticky_engine();
     init_base();
-    init_meta2();
     StickyHandler = class {
       // -----------------------------------------------------------------------
       // Query
@@ -30492,36 +30668,18 @@ var init_sticky = __esm({
         try {
           switch (operation) {
             case "list": {
-              const tags = params?.tags;
-              const filters = {
-                status: params?.status,
-                color: params?.color,
-                priority: params?.priority,
-                tags
-              };
-              const result = await stickyList(projectRoot, filters);
-              if (!result.success) {
-                return wrapResult(result, "query", "sticky", operation, startTime);
-              }
-              const filteredStickies = result.data?.stickies ?? [];
-              const hasFilter = filters.status !== void 0 || filters.color !== void 0 || filters.priority !== void 0 || tags !== void 0 && tags.length > 0;
-              const totalResult = hasFilter ? await stickyList(projectRoot, {}) : result;
-              if (!totalResult.success) {
-                return wrapResult(totalResult, "query", "sticky", operation, startTime);
-              }
-              const limit = params?.limit;
-              const offset = params?.offset;
-              const page = paginate6(filteredStickies, limit, offset);
-              return {
-                meta: dispatchMeta("query", "sticky", operation, startTime),
-                success: true,
-                data: {
-                  stickies: page.items,
-                  total: totalResult.data?.total ?? filteredStickies.length,
-                  filtered: filteredStickies.length
+              const result = await stickyListFiltered(
+                projectRoot,
+                {
+                  status: params?.status,
+                  color: params?.color,
+                  priority: params?.priority,
+                  tags: params?.tags
                 },
-                page: page.page
-              };
+                params?.limit,
+                params?.offset
+              );
+              return wrapResult(result, "query", "sticky", operation, startTime);
             }
             case "show": {
               const stickyId = params?.stickyId;
@@ -30707,7 +30865,7 @@ function envelopeToEngineResult5(envelope) {
     }
   };
 }
-var _tasksTypedHandler, QUERY_OPS7, MUTATE_OPS7, TasksHandler;
+var _tasksTypedHandler, QUERY_OPS8, MUTATE_OPS8, TasksHandler;
 var init_tasks3 = __esm({
   "packages/cleo/src/dispatch/domains/tasks.ts"() {
     "use strict";
@@ -31046,7 +31204,7 @@ var init_tasks3 = __esm({
         return wrapCoreResult(await taskUnclaim(projectRoot, params.taskId), "unclaim");
       }
     });
-    QUERY_OPS7 = /* @__PURE__ */ new Set([
+    QUERY_OPS8 = /* @__PURE__ */ new Set([
       "show",
       "list",
       "find",
@@ -31064,7 +31222,7 @@ var init_tasks3 = __esm({
       "label.list",
       "sync.links"
     ]);
-    MUTATE_OPS7 = /* @__PURE__ */ new Set([
+    MUTATE_OPS8 = /* @__PURE__ */ new Set([
       "add",
       "update",
       "complete",
@@ -31094,7 +31252,7 @@ var init_tasks3 = __esm({
        */
       async query(operation, params) {
         const startTime = Date.now();
-        if (!QUERY_OPS7.has(operation)) {
+        if (!QUERY_OPS8.has(operation)) {
           return unsupportedOp("query", "tasks", operation, startTime);
         }
         if (operation === "impact" && !params?.change) {
@@ -31133,7 +31291,7 @@ var init_tasks3 = __esm({
        */
       async mutate(operation, params) {
         const startTime = Date.now();
-        if (!MUTATE_OPS7.has(operation)) {
+        if (!MUTATE_OPS8.has(operation)) {
           return unsupportedOp("mutate", "tasks", operation, startTime);
         }
         try {
@@ -52305,6 +52463,29 @@ var fanoutCommand = defineCommand({
     );
   }
 });
+var pruneCommand = defineCommand({
+  meta: {
+    name: "prune",
+    description: "Remove stale agent worktrees (after task completion or crash)"
+  },
+  args: {
+    taskId: {
+      type: "positional",
+      description: "Task ID whose worktree should be pruned (omit for bulk prune)",
+      required: false
+    }
+  },
+  async run({ args }) {
+    const taskId = typeof args.taskId === "string" && args.taskId.length > 0 ? args.taskId : void 0;
+    await dispatchFromCli(
+      "mutate",
+      "orchestrate",
+      "worktree.prune",
+      { taskId },
+      { command: "orchestrate" }
+    );
+  }
+});
 var conduitStatusCommand = defineCommand({
   meta: { name: "conduit-status", description: "Get conduit messaging status" },
   async run() {
@@ -52486,6 +52667,7 @@ var orchestrateCommand = defineCommand({
     handoff: handoffCommand,
     "spawn-execute": spawnExecuteCommand,
     fanout: fanoutCommand,
+    prune: pruneCommand,
     "conduit-status": conduitStatusCommand,
     "conduit-peek": conduitPeekCommand,
     "conduit-start": conduitStartCommand,
@@ -58622,7 +58804,7 @@ var migrateCommand2 = defineCommand({
     }
   }
 });
-var pruneCommand = defineCommand({
+var pruneCommand2 = defineCommand({
   meta: {
     name: "prune",
     description: "Prune session transcripts older than the specified duration. Dry-run by default."
@@ -58749,7 +58931,7 @@ var transcriptCommand = defineCommand({
     scan: scanCommand,
     extract: extractCommand,
     migrate: migrateCommand2,
-    prune: pruneCommand
+    prune: pruneCommand2
   },
   async run({ cmd, rawArgs }) {
     const firstArg = rawArgs?.find((a) => !a.startsWith("-"));
@@ -59095,6 +59277,10 @@ var verifyCommand2 = defineCommand({
     explain: {
       type: "boolean",
       description: "Enrich read-only view with per-gate evidence breakdown, re-validation status, and blockers[] preventing `cleo complete` (T1013 / ADR-051)."
+    },
+    "shared-evidence": {
+      type: "boolean",
+      description: "Acknowledge that the same evidence atom is applied to >3 distinct tasks in this session (T1502 / ADR-059). Without this flag, such reuse triggers a warning; in strict mode (CLEO_STRICT_EVIDENCE=1) it is a hard reject."
     }
   },
   async run({ args, cmd }) {
@@ -59116,7 +59302,8 @@ var verifyCommand2 = defineCommand({
         agent: args.agent,
         all: args.all,
         reset: args.reset,
-        evidence: args.evidence
+        evidence: args.evidence,
+        sharedEvidence: args["shared-evidence"] ?? false
       },
       { command: "verify" }
     );