@cleocode/cleo 2026.5.114 → 2026.5.121

package/dist/cli/index.js

@@ -1388,6 +1388,40 @@ var init_animation_bridge = __esm({
   }
 });
 
+// packages/cleo/src/cli/output-context.ts
+function setOutputMode(mode) {
+  currentMode = mode;
+}
+function getOutputMode() {
+  return currentMode;
+}
+function isOutputMode(value) {
+  return OUTPUT_MODES.includes(value);
+}
+var OUTPUT_MODES, currentMode;
+var init_output_context = __esm({
+  "packages/cleo/src/cli/output-context.ts"() {
+    "use strict";
+    OUTPUT_MODES = ["envelope", "id", "table", "count", "silent"];
+    currentMode = "envelope";
+  }
+});
+
+// packages/cleo/src/cli/summary-context.ts
+function setSummaryMode(on) {
+  currentSummary = on;
+}
+function getSummaryMode() {
+  return currentSummary;
+}
+var currentSummary;
+var init_summary_context = __esm({
+  "packages/cleo/src/cli/summary-context.ts"() {
+    "use strict";
+    currentSummary = false;
+  }
+});
+
 // packages/contracts/src/acceptance-gate-schema.ts
 import { z } from "zod";
 var gateBaseSchema, fileAssertionSchema, testGateSchema, fileGateSchema, commandGateSchema, lintGateSchema, httpGateSchema, manualGateSchema, acceptanceGateSchema, gateResultDetailsSchema, acceptanceGateResultSchema, acceptanceItemSchema, acceptanceArraySchema;
@@ -1696,7 +1730,7 @@ var init_branch_lock = __esm({
 
 // packages/contracts/src/changesets.ts
 import { z as z3 } from "zod";
-var CHANGESET_KINDS, TASK_ID_RE, ChangesetEntrySchema;
+var CHANGESET_KINDS, CHANGESET_RELEASE_NOTE_SECTIONS, CHANGESET_RELEASE_NOTE_AUDIENCES, CHANGESET_RELEASE_NOTE_SCOPES, nonEmptyReleaseNoteText, nonEmptyReleaseNoteList, ChangesetReleaseNotesMetadataSchema, TASK_ID_RE, ChangesetEntrySchema;
 var init_changesets = __esm({
   "packages/contracts/src/changesets.ts"() {
     "use strict";
@@ -1710,10 +1744,60 @@ var init_changesets = __esm({
       "chore",
       "breaking"
     ];
+    CHANGESET_RELEASE_NOTE_SECTIONS = [
+      "added",
+      "changed",
+      "fixed",
+      "deprecated",
+      "removed",
+      "security",
+      "breaking"
+    ];
+    CHANGESET_RELEASE_NOTE_AUDIENCES = [
+      "users",
+      "operators",
+      "developers",
+      "maintainers"
+    ];
+    CHANGESET_RELEASE_NOTE_SCOPES = [
+      "project",
+      "package",
+      "component",
+      "docs",
+      "ops",
+      "security"
+    ];
+    nonEmptyReleaseNoteText = z3.string().min(1, "release-note metadata text must be non-empty");
+    nonEmptyReleaseNoteList = z3.array(nonEmptyReleaseNoteText).min(1, "release-note metadata list must contain at least one item");
+    ChangesetReleaseNotesMetadataSchema = z3.object({
+      /** Keep-a-Changelog style section/category override. */
+      section: z3.enum(CHANGESET_RELEASE_NOTE_SECTIONS).optional(),
+      /** Intended readers for the note. */
+      audience: z3.array(z3.enum(CHANGESET_RELEASE_NOTE_AUDIENCES)).min(1).optional(),
+      /** Release-note scope. */
+      scope: z3.enum(CHANGESET_RELEASE_NOTE_SCOPES).optional(),
+      /** Package/project/component targets affected by this entry. */
+      targets: nonEmptyReleaseNoteList.optional(),
+      /** User- or operator-visible impact statement. */
+      impact: nonEmptyReleaseNoteText.optional(),
+      /** Deterministic migration/action text, separate from breaking changes. */
+      migration: nonEmptyReleaseNoteText.optional(),
+      /** Deprecation detail for Deprecated sections. */
+      deprecation: nonEmptyReleaseNoteText.optional(),
+      /** Security detail for Security sections. */
+      security: nonEmptyReleaseNoteText.optional(),
+      /** Operator-facing rollout/verification note. */
+      operatorNotes: nonEmptyReleaseNoteText.optional(),
+      /** Explicit inclusion toggle for future release-scope filters. */
+      includeInChangelog: z3.boolean().optional()
+    }).strict();
     TASK_ID_RE = /^(T\d+(-[A-Z][A-Za-z0-9]*)?|E-\d+(-[A-Z][A-Za-z0-9]*)?)$/;
     ChangesetEntrySchema = z3.object({
-      /** Filename slug (without the `.md` extension). */
-      id: z3.string().min(1, "id must be non-empty").regex(/^[a-z0-9][a-z0-9-]*$/, "id must be kebab-case (lowercase, digits, hyphens)"),
+      /** Filename identifier (without the `.md` extension); lowercase kebab-case for new files, legacy uppercase task IDs accepted. */
+      id: z3.string().min(1, "id must be non-empty").regex(
+        /^[A-Za-z0-9][A-Za-z0-9-]*$/,
+        "id must contain only ASCII letters, digits, and hyphens"
+      ),
       /** One or more CLEO task IDs this change is anchored to. */
       tasks: z3.array(z3.string().regex(TASK_ID_RE, "task ID must match T#### or E-#### format")).min(1, "tasks must contain at least one task ID"),
       /** Type of change. */
@@ -1725,7 +1809,9 @@ var init_changesets = __esm({
       /** Markdown body — longer-form explanation. */
       notes: z3.string().optional(),
       /** Migration note. Required iff `kind === 'breaking'`. */
-      breaking: z3.string().optional()
+      breaking: z3.string().optional(),
+      /** Structured author-provided metadata for deterministic release notes. */
+      releaseNotes: ChangesetReleaseNotesMetadataSchema.optional()
     }).refine((entry) => entry.kind !== "breaking" || (entry.breaking?.length ?? 0) > 0, {
       message: "breaking entries must include a non-empty `breaking` migration note",
       path: ["breaking"]
@@ -4248,6 +4334,39 @@ var init_operations_registry = __esm({
           }
         ]
       },
+      {
+        gateway: "mutate",
+        domain: "tasks",
+        operation: "relates.remove",
+        description: "tasks.relates.remove (mutate) \u2014 delete a relation between two tasks. Pass `type` to scope deletion to a single relation kind; omit to remove any type.",
+        tier: 1,
+        idempotent: true,
+        sessionRequired: false,
+        requiredParams: ["taskId", "relatedId"],
+        params: [
+          {
+            name: "taskId",
+            type: "string",
+            required: true,
+            description: "Source task ID",
+            cli: { positional: true }
+          },
+          {
+            name: "relatedId",
+            type: "string",
+            required: true,
+            description: "Target task ID to remove the relation to",
+            cli: { positional: true }
+          },
+          {
+            name: "type",
+            type: "string",
+            required: false,
+            description: "Optional relation type (blocks|related|duplicates|absorbs|fixes|extends|supersedes). Omit to remove any type.",
+            cli: { flag: "type" }
+          }
+        ]
+      },
       // === saga sub-domain (ADR-073 — above-epic grouping tier) ===
       {
         gateway: "mutate",
@@ -8533,6 +8652,39 @@ var init_operations_registry = __esm({
           }
         ]
       },
+      // ── docs.supersede (T10162) ──────────────────────────────────────────────
+      {
+        gateway: "mutate",
+        domain: "docs",
+        operation: "supersede",
+        description: "docs.supersede (mutate) \u2014 atomically flip an older doc to `superseded` and link both rows via the supersedes/superseded_by self-FK pointers (T10162 \xB7 Saga T9855)",
+        tier: 1,
+        idempotent: true,
+        sessionRequired: false,
+        requiredParams: ["oldSlug", "newSlug"],
+        params: [
+          {
+            name: "oldSlug",
+            type: "string",
+            required: true,
+            description: "Slug of the doc being replaced",
+            cli: { positional: true }
+          },
+          {
+            name: "newSlug",
+            type: "string",
+            required: true,
+            description: "Slug of the doc that replaces oldSlug",
+            cli: { positional: true }
+          },
+          {
+            name: "reason",
+            type: "string",
+            required: false,
+            description: "Optional human-readable reason carried back on the response"
+          }
+        ]
+      },
       // ── docs.generate (T798) ─────────────────────────────────────────────────
       {
         gateway: "query",
@@ -8558,6 +8710,55 @@ var init_operations_registry = __esm({
           }
         ]
       },
+      // ── docs.update (T10161 — Epic T10157 / Saga T9855) ──────────────────────
+      {
+        gateway: "mutate",
+        domain: "docs",
+        operation: "update",
+        description: "docs.update (mutate) \u2014 replace blob content for an existing slug while preserving the slug. New sha256 + new attachment row; the old row stays reachable by ID for history. NO supersession edge (use `cleo docs supersede` for that). Audit log entry appended to .cleo/audit/docs-versioning.jsonl (squashed within a 5-min window).",
+        tier: 1,
+        idempotent: false,
+        sessionRequired: false,
+        requiredParams: ["slug"],
+        params: [
+          {
+            name: "slug",
+            type: "string",
+            required: true,
+            description: "Slug of the existing attachment to update"
+          },
+          {
+            name: "file",
+            type: "string",
+            required: false,
+            description: "Path to a local file containing the new content"
+          },
+          {
+            name: "content",
+            type: "string",
+            required: false,
+            description: "Inline UTF-8 content (mutually exclusive with file)"
+          },
+          {
+            name: "message",
+            type: "string",
+            required: false,
+            description: "One-line summary describing the change (recorded in the audit log)"
+          },
+          {
+            name: "status",
+            type: "string",
+            required: false,
+            description: 'Override the new lifecycle status. Defaults to "draft" on every update. Valid: draft|proposed|accepted|superseded|archived|deprecated.'
+          },
+          {
+            name: "attachedBy",
+            type: "string",
+            required: false,
+            description: 'Agent identity that performed the update (defaults to "human")'
+          }
+        ]
+      },
       // ── playbook.* HITL CLI surface (T935) ───────────────────────────────────
       {
         gateway: "mutate",
@@ -9218,6 +9419,35 @@ var init_operations_registry = __esm({
           }
         ]
       },
+      // release query: validate-changelog (T9937 / Saga T9862 — canonical CHANGELOG
+      // header validator that replaces the brittle inline grep step in
+      // .github/workflows/release.yml). Read-only — exposed only under the query
+      // gateway because no DB or filesystem mutation occurs.
+      {
+        gateway: "query",
+        domain: "release",
+        operation: "validate-changelog",
+        description: "release.validate-changelog (query) \u2014 validate that CHANGELOG.md contains the canonical `## [VERSION]` header per ADR-028 \xA72.5. Replaces the brittle inline grep in .github/workflows/release.yml (T9937 / Saga T9862).",
+        tier: 1,
+        idempotent: true,
+        sessionRequired: false,
+        requiredParams: ["version"],
+        params: [
+          {
+            name: "version",
+            type: "string",
+            required: true,
+            description: "Release version (accepts v2026.5.94 or 2026.5.94)",
+            cli: { positional: true }
+          },
+          {
+            name: "changelogPath",
+            type: "string",
+            required: false,
+            description: "Override the CHANGELOG file path (default: <projectRoot>/CHANGELOG.md)"
+          }
+        ]
+      },
       // ---------------------------------------------------------------------------
       // Provenance domain — `cleo provenance` CLI surface (T9528 · Phase 2 of T9493)
       // ---------------------------------------------------------------------------
@@ -10397,7 +10627,7 @@ var init_errors = __esm({
 
 // packages/contracts/src/evidence-atom-schema.ts
 import { z as z6 } from "zod";
-var commitAtomSchema, filesAtomSchema, testRunAtomSchema, toolAtomSchema, urlAtomSchema, noteAtomSchema, decisionAtomSchema, prAtomSchema, locDropAtomSchema, callsiteCoverageAtomSchema, EvidenceAtomSchema, GATE_EVIDENCE_REQUIREMENTS;
+var commitAtomSchema, filesAtomSchema, testRunAtomSchema, toolAtomSchema, urlAtomSchema, noteAtomSchema, decisionAtomSchema, prAtomSchema, locDropAtomSchema, callsiteCoverageAtomSchema, EvidenceAtomSchema, GATE_EVIDENCE_REQUIREMENTS, ATOM_EXAMPLES;
 var init_evidence_atom_schema = __esm({
   "packages/contracts/src/evidence-atom-schema.ts"() {
     "use strict";
@@ -10472,6 +10702,18 @@ var init_evidence_atom_schema = __esm({
       cleanupDone: { oneOf: [["note"]] },
       nexusImpact: { oneOf: [["tool"], ["note"]] }
     });
+    ATOM_EXAMPLES = Object.freeze({
+      commit: "commit:<sha>",
+      files: "files:path/a.ts,path/b.ts",
+      "test-run": "test-run:/tmp/vitest-out.json",
+      tool: "tool:test",
+      url: "url:https://example.com/docs",
+      note: "note:<short description>",
+      decision: "decision:D-arch-001",
+      pr: "pr:357",
+      "loc-drop": "loc-drop:<fromLines>:<toLines>",
+      "callsite-coverage": "callsite-coverage:<symbolName>:<relativeSourcePath>"
+    });
   }
 });
 
@@ -12520,6 +12762,174 @@ var init_normalizer = __esm({
   }
 });
 
+// packages/cleo/src/cli/renderers/output-mode.ts
+function extractIds(data) {
+  if (data === null || typeof data !== "object") return [];
+  const rec = data;
+  const task = rec["task"];
+  if (task && typeof task === "object") {
+    const id2 = task["id"];
+    if (typeof id2 === "string") return [id2];
+  }
+  const tasks = rec["tasks"];
+  if (Array.isArray(tasks)) {
+    return tasks.map((t) => t && typeof t === "object" ? t["id"] : void 0).filter((id2) => typeof id2 === "string");
+  }
+  const items = rec["items"];
+  if (Array.isArray(items)) {
+    return items.map((t) => t && typeof t === "object" ? t["id"] : void 0).filter((id2) => typeof id2 === "string");
+  }
+  const id = rec["id"];
+  if (typeof id === "string") return [id];
+  return [];
+}
+function extractCount(data) {
+  if (data === null || typeof data !== "object") return 0;
+  const rec = data;
+  const total = rec["total"];
+  if (typeof total === "number" && Number.isFinite(total)) return total;
+  const tasks = rec["tasks"];
+  if (Array.isArray(tasks)) return tasks.length;
+  const items = rec["items"];
+  if (Array.isArray(items)) return items.length;
+  if (rec["task"] && typeof rec["task"] === "object") return 1;
+  if (typeof rec["id"] === "string") return 1;
+  return 0;
+}
+function truncate(value, max) {
+  if (value.length <= max) return value;
+  return value.slice(0, Math.max(0, max - 1)) + "\u2026";
+}
+function renderTableList(tasks) {
+  if (tasks.length === 0) return "No rows.";
+  const COL_TITLE_MAX = 60;
+  const rows = tasks.map((t) => ({
+    id: typeof t["id"] === "string" ? t["id"] : "",
+    status: typeof t["status"] === "string" ? t["status"] : "",
+    priority: typeof t["priority"] === "string" ? t["priority"] : "",
+    title: truncate(typeof t["title"] === "string" ? t["title"] : "", COL_TITLE_MAX)
+  }));
+  const widths = {
+    id: Math.max(2, ...rows.map((r) => r.id.length)),
+    status: Math.max(6, ...rows.map((r) => r.status.length)),
+    priority: Math.max(8, ...rows.map((r) => r.priority.length)),
+    title: Math.max(5, ...rows.map((r) => r.title.length))
+  };
+  const pad = (s, w) => s + " ".repeat(Math.max(0, w - s.length));
+  const header = `${pad("id", widths.id)}  ${pad("status", widths.status)}  ${pad(
+    "priority",
+    widths.priority
+  )}  ${pad("title", widths.title)}`;
+  const sep2 = `${"-".repeat(widths.id)}  ${"-".repeat(widths.status)}  ${"-".repeat(
+    widths.priority
+  )}  ${"-".repeat(widths.title)}`;
+  const body = rows.map(
+    (r) => `${pad(r.id, widths.id)}  ${pad(r.status, widths.status)}  ${pad(
+      r.priority,
+      widths.priority
+    )}  ${pad(r.title, widths.title)}`
+  ).join("\n");
+  return `${header}
+${sep2}
+${body}`;
+}
+function renderTableGeneric(data) {
+  const entries = Object.entries(data);
+  if (entries.length === 0) return "(empty)";
+  const rows = entries.map(([k, v]) => ({
+    field: k,
+    value: v === null || v === void 0 ? "" : typeof v === "object" ? JSON.stringify(v) : String(v)
+  }));
+  const VAL_MAX = 80;
+  for (const r of rows) r.value = truncate(r.value, VAL_MAX);
+  const widths = {
+    field: Math.max(5, ...rows.map((r) => r.field.length)),
+    value: Math.max(5, ...rows.map((r) => r.value.length))
+  };
+  const pad = (s, w) => s + " ".repeat(Math.max(0, w - s.length));
+  const header = `${pad("field", widths.field)}  ${pad("value", widths.value)}`;
+  const sep2 = `${"-".repeat(widths.field)}  ${"-".repeat(widths.value)}`;
+  const body = rows.map((r) => `${pad(r.field, widths.field)}  ${pad(r.value, widths.value)}`).join("\n");
+  return `${header}
+${sep2}
+${body}`;
+}
+function renderSummary2(data) {
+  if (data === null || typeof data !== "object") {
+    return { text: "" };
+  }
+  const rec = data;
+  const tasks = rec["tasks"];
+  if (Array.isArray(tasks)) {
+    return { text: renderSummaryList(tasks) };
+  }
+  const items = rec["items"];
+  if (Array.isArray(items)) {
+    return { text: renderSummaryList(items) };
+  }
+  const task = rec["task"];
+  if (task && typeof task === "object") {
+    return { text: renderSummaryRow(task) };
+  }
+  if (typeof rec["id"] === "string") {
+    return { text: renderSummaryRow(rec) };
+  }
+  return { text: "" };
+}
+function renderSummaryRow(record) {
+  const id = typeof record["id"] === "string" ? record["id"] : "";
+  const status = typeof record["status"] === "string" ? record["status"] : "";
+  const title = truncate(typeof record["title"] === "string" ? record["title"] : "", 60);
+  return `${id} [${status}] ${title}`;
+}
+function renderSummaryList(rows) {
+  if (rows.length === 0) return "No rows.";
+  const lines = [];
+  for (const row of rows) {
+    if (!row || typeof row !== "object") continue;
+    const rec = row;
+    if (typeof rec["id"] !== "string") continue;
+    lines.push(renderSummaryRow(rec));
+  }
+  return lines.length === 0 ? "No rows." : lines.join("\n");
+}
+function renderOutputMode(mode, data) {
+  switch (mode) {
+    case "id": {
+      const ids = extractIds(data);
+      return { text: ids.length === 0 ? "" : ids.join("\n") };
+    }
+    case "count": {
+      return { text: String(extractCount(data)) };
+    }
+    case "table": {
+      if (data && typeof data === "object") {
+        const rec = data;
+        const tasks = rec["tasks"];
+        if (Array.isArray(tasks)) {
+          return { text: renderTableList(tasks) };
+        }
+        const items = rec["items"];
+        if (Array.isArray(items)) {
+          return { text: renderTableList(items) };
+        }
+        return { text: renderTableGeneric(rec) };
+      }
+      return { text: data === null || data === void 0 ? "(empty)" : String(data) };
+    }
+    case "silent": {
+      return { text: null };
+    }
+    case "envelope":
+      throw new Error("renderOutputMode: envelope mode must be handled by caller");
+  }
+}
+var init_output_mode = __esm({
+  "packages/cleo/src/cli/renderers/output-mode.ts"() {
+    "use strict";
+  }
+});
+
 // packages/cleo/src/cli/renderers/index.ts
 var renderers_exports = {};
 __export(renderers_exports, {
@@ -12535,7 +12945,9 @@ __export(renderers_exports, {
 import { randomUUID } from "node:crypto";
 import {
   drainWarnings,
+  extractByJsonPointer,
   formatSuccess,
+  isJsonPointer,
   metaFooter,
   pagerFooter,
   renderAuditReconstruct,
@@ -12593,7 +13005,8 @@ import {
   renderStop,
   renderTree as renderTree2,
   renderVersion,
-  renderWaves
+  renderWaves,
+  serializePointerValue
 } from "@cleocode/core";
 import { applyFieldFilter, extractFieldFromResult } from "@cleocode/lafs";
 import {
@@ -12615,11 +13028,60 @@ function pickDecoratorMetaExtensionsLocal(responseMeta) {
   const out = {};
   if (responseMeta["_nexus"] !== void 0) out["_nexus"] = responseMeta["_nexus"];
   if (responseMeta["deprecated"] !== void 0) out["deprecated"] = responseMeta["deprecated"];
+  if (responseMeta["suggestedNext"] !== void 0) {
+    out["suggestedNext"] = responseMeta["suggestedNext"];
+  }
+  if (responseMeta["projection"] !== void 0) {
+    out["projection"] = responseMeta["projection"];
+  }
   return out;
 }
+function buildEnvelopeForPointer(data, opts) {
+  const decoratorExt = pickDecoratorMetaExtensionsLocal(opts.responseMeta);
+  const meta = {
+    ...decoratorExt,
+    ...opts.extensions ?? {},
+    operation: opts.operation ?? "cli.output"
+  };
+  if (opts.message) meta["message"] = opts.message;
+  const envelope = {
+    success: true,
+    data,
+    meta
+  };
+  if (opts.page) envelope["page"] = opts.page;
+  return envelope;
+}
 function cliOutput(data, opts) {
   const ctx = getFormatContext();
   const fieldCtx = getFieldContext();
+  const outputMode = getOutputMode();
+  const summary = getSummaryMode();
+  if (outputMode !== "envelope" && !fieldCtx.field) {
+    const out = renderOutputMode(outputMode, data);
+    if (out.text !== null && out.text.length > 0) {
+      process.stdout.write(out.text + "\n");
+    }
+    return;
+  }
+  if (summary && !fieldCtx.field) {
+    const out = renderSummary2(data);
+    if (out.text !== null && out.text.length > 0) {
+      process.stdout.write(out.text + "\n");
+    }
+    return;
+  }
+  if (fieldCtx.field && isJsonPointer(fieldCtx.field)) {
+    const envelope = buildEnvelopeForPointer(data, opts);
+    const value = extractByJsonPointer(envelope, fieldCtx.field);
+    if (value === void 0) {
+      cliError(`Pointer "${fieldCtx.field}" did not resolve`, 4, { name: "E_FIELD_NOT_FOUND" });
+      process.exit(4);
+    }
+    process.stdout.write(`${serializePointerValue(value)}
+`);
+    return;
+  }
   if (ctx.format === "human") {
     let dataToRender = data;
     let fieldExtracted = false;
@@ -12769,6 +13231,12 @@ function isHumanOutput() {
 }
 function cliError(message, code, details, meta) {
   const ctx = getFormatContext();
+  const outputMode = getOutputMode();
+  if (outputMode === "silent") {
+    process.stderr.write(`Error: ${message}${code ? ` (${code})` : ""}
+`);
+    return;
+  }
   if (ctx.format === "human") {
     process.stderr.write(`Error: ${message}${code ? ` (${code})` : ""}
 `);
@@ -12811,8 +13279,11 @@ var init_renderers = __esm({
     "use strict";
     init_field_context();
     init_format_context();
+    init_output_context();
+    init_summary_context();
     init_lafs_validator();
     init_normalizer();
+    init_output_mode();
     renderers = {
       // Task CRUD
       show: renderShow,
@@ -13429,6 +13900,7 @@ __export(engine_exports, {
   taskWorkHistory: () => taskWorkHistory,
   tasksAddBatchOp: () => tasksAddBatchOp,
   validateBatchValidate: () => coreBatchValidate,
+  validateChangelog: () => validateChangelog,
   validateCoherenceCheck: () => coreCoherenceCheck,
   validateComplianceRecord: () => coreComplianceRecord,
   validateComplianceSummary: () => coreComplianceSummary,
@@ -13654,6 +14126,7 @@ import {
   taskUnclaim,
   taskUpdate,
   taskWorkHistory,
+  validateChangelog,
   validateGateVerify,
   validateProtocolArchitectureDecision,
   validateProtocolArtifactPublish,
@@ -17005,18 +17478,25 @@ import { resolve as resolve2 } from "node:path";
 import { pushWarning } from "@cleocode/core";
 import {
   AUTO_TOKEN,
+  allocateAdrSlug,
   allocateAutoSlugForDispatch,
+  consumeReservedSlug,
   createAttachmentStore,
   createAttachmentStoreV2,
   generateDocsLlmsTxt,
   getCleoDirAbsolute,
   getProjectRoot as getProjectRoot5,
+  isLifecycleStatus,
   memoryObserve as memoryObserve2,
   parseChangesetFrontmatter,
   releaseReservedSlug,
   reserveSlugForDispatch,
   resolveAttachmentBackend,
   SlugCollisionError,
+  SUPERSEDE_NOT_FOUND_CODE,
+  SUPERSEDE_SAME_SLUG_CODE,
+  supersedeDoc,
+  updateDocBySlug,
   validateDocBody,
   writeChangesetEntry
 } from "@cleocode/core/internal";
@@ -17494,6 +17974,7 @@ var init_docs2 = __esm({
           labels: rawLabels,
           attachedBy: rawAttachedBy,
           slug: rawSlug,
+          title: rawTitle,
           type: rawType,
           strict: strictMode
         } = params;
@@ -17601,6 +18082,19 @@ var init_docs2 = __esm({
             if (err.code === "E_FILE_WRITE_FAILED") {
               return lafsError("E_FILE_ERROR", err.message, "add");
             }
+            if (err.code === "E_SLUG_RESERVED") {
+              return {
+                success: false,
+                error: {
+                  code: "E_SLUG_RESERVED",
+                  message: err.message,
+                  details: {
+                    suggestions: err.suggestions,
+                    aliases: err.aliases
+                  }
+                }
+              };
+            }
             return lafsError("E_SSOT_WRITE_FAILED", err.message, "add");
           }
           const changesetPayload = {
@@ -17633,14 +18127,31 @@ var init_docs2 = __esm({
             "add"
           );
         }
+        let adrNumber;
+        if (type2 === "adr" && slug === void 0) {
+          if (typeof rawTitle !== "string" || rawTitle.trim().length === 0) {
+            return lafsError(
+              "E_VALIDATION",
+              "title is required when type=adr and slug is omitted \u2014 the allocator needs a title to assemble adr-NNN-<kebab-title>",
+              "add"
+            );
+          }
+          const allocation = await allocateAdrSlug(getProjectRoot5(), { title: rawTitle });
+          if (!allocation.ok) {
+            return lafsError(allocation.code, allocation.message, "add");
+          }
+          slug = allocation.slug;
+          adrNumber = allocation.number;
+        }
         if (type2 !== void 0 && slug !== void 0) {
           const patternCheck = getDocKindRegistry().validateSlug(type2, slug);
           if (!patternCheck.ok) {
+            if (adrNumber !== void 0) releaseReservedSlug(slug);
             const exampleHint = patternCheck.example ? ` (example: ${patternCheck.example})` : "";
             return lafsError("E_SLUG_PATTERN_MISMATCH", `${patternCheck.error}${exampleHint}`, "add");
           }
         }
-        if (slug !== void 0) {
+        if (slug !== void 0 && adrNumber === void 0) {
           const reservation = await reserveSlugForDispatch(getProjectRoot5(), {
             kind: type2 ?? "",
             slug
@@ -17741,6 +18252,7 @@ var init_docs2 = __esm({
             }
             throw err;
           }
+          if (adrNumber !== void 0 && slug !== void 0) consumeReservedSlug(slug);
           let backend = "legacy";
           try {
             const v2 = createAttachmentStoreV2(getProjectRoot5());
@@ -17782,7 +18294,8 @@ var init_docs2 = __esm({
               // Cast: core returns 'llmtxt'|'legacy'; contracts uses 'legacy'|'llmstxt-v2' (T1529)
               attachmentBackend: backend,
               ...slug !== void 0 ? { slug } : {},
-              ...type2 !== void 0 ? { type: type2 } : {}
+              ...type2 !== void 0 ? { type: type2 } : {},
+              ...adrNumber !== void 0 ? { adrNumber } : {}
             },
             "add"
           );
@@ -17823,6 +18336,7 @@ var init_docs2 = __esm({
             }
             throw err;
           }
+          if (adrNumber !== void 0 && slug !== void 0) consumeReservedSlug(slug);
           import("@cleocode/core/internal").then(
             ({ ensureLlmtxtNode }) => ensureLlmtxtNode(getProjectRoot5(), meta.sha256, `${ownerType}:${ownerId}`, url)
           ).catch(() => {
@@ -17849,7 +18363,8 @@ var init_docs2 = __esm({
               // Cast: core returns 'llmtxt'|'legacy'; contracts uses 'legacy'|'llmstxt-v2' (T1529)
               attachmentBackend: backend,
               ...slug !== void 0 ? { slug } : {},
-              ...type2 !== void 0 ? { type: type2 } : {}
+              ...type2 !== void 0 ? { type: type2 } : {},
+              ...adrNumber !== void 0 ? { adrNumber } : {}
             },
             "add"
           );
@@ -17907,10 +18422,90 @@ var init_docs2 = __esm({
           },
           "remove"
         );
+      },
+      // ── docs.update (T10161 — E12.C4 / Saga T9855) ─────────────────────────────
+      update: async (params) => {
+        const { slug: rawSlug, file: filePath, content: inlineContent, status: rawStatus } = params;
+        if (typeof rawSlug !== "string" || rawSlug.length === 0) {
+          return lafsError("E_INVALID_INPUT", "slug is required", "update");
+        }
+        const hasFile = typeof filePath === "string" && filePath.length > 0;
+        const hasContent = typeof inlineContent === "string";
+        if (hasFile === hasContent) {
+          return lafsError(
+            "E_INVALID_INPUT",
+            "Provide exactly one of --file <path> or --content <text>",
+            "update",
+            'Use `cleo docs update <slug> --file ./new.md` OR `cleo docs update <slug> --content "..."`.'
+          );
+        }
+        if (rawStatus !== void 0 && !isLifecycleStatus(rawStatus)) {
+          return lafsError(
+            "E_INVALID_INPUT",
+            `status must be one of: draft|proposed|accepted|superseded|archived|deprecated \u2014 got '${String(rawStatus)}'`,
+            "update"
+          );
+        }
+        const projectRoot = getProjectRoot5();
+        const resolvedParams = hasFile ? { ...params, file: resolve2(filePath) } : params;
+        const outcome = await updateDocBySlug(projectRoot, resolvedParams);
+        if (!outcome.ok) {
+          return lafsError(outcome.error.code, outcome.error.message, "update");
+        }
+        return lafsSuccess(
+          {
+            slug: outcome.result.slug,
+            ...outcome.result.type !== null ? { type: outcome.result.type } : {},
+            attachmentId: outcome.result.attachmentId,
+            previousAttachmentId: outcome.result.previousAttachmentId,
+            sha256: outcome.result.sha256,
+            previousSha256: outcome.result.previousSha256,
+            changed: outcome.result.changed,
+            lifecycleStatus: outcome.result.lifecycleStatus,
+            updatedAt: outcome.result.updatedAt,
+            version: outcome.result.version,
+            squashed: outcome.result.squashed
+          },
+          "update"
+        );
+      },
+      // ── docs.supersede ─────────────────────────────────────────────────────────
+      supersede: async (params) => {
+        const { oldSlug, newSlug, reason } = params;
+        if (typeof oldSlug !== "string" || oldSlug.length === 0) {
+          return lafsError("E_INVALID_INPUT", "<oldSlug> is required", "supersede");
+        }
+        if (typeof newSlug !== "string" || newSlug.length === 0) {
+          return lafsError("E_INVALID_INPUT", "<newSlug> is required", "supersede");
+        }
+        try {
+          const result = await supersedeDoc(getProjectRoot5(), {
+            oldSlug,
+            newSlug,
+            ...typeof reason === "string" && reason.length > 0 ? { reason } : {}
+          });
+          const payload = {
+            oldSlug: result.oldSlug,
+            newSlug: result.newSlug,
+            oldAttachmentId: result.oldAttachmentId,
+            newAttachmentId: result.newAttachmentId,
+            supersededAt: result.supersededAt,
+            edgeId: result.edgeId,
+            ...result.reason !== void 0 ? { reason: result.reason } : {}
+          };
+          return lafsSuccess(payload, "supersede");
+        } catch (err) {
+          const code = err && typeof err === "object" && "code" in err && typeof err.code === "number" ? (
+            // Map ExitCode (number) → stable LAFS string code expected by callers.
+            err.code === 4 ? SUPERSEDE_NOT_FOUND_CODE : err.code === 6 ? SUPERSEDE_SAME_SLUG_CODE : "E_INTERNAL"
+          ) : "E_INTERNAL";
+          const message = err instanceof Error ? err.message : "supersede failed";
+          return lafsError(code, message, "supersede");
+        }
       }
     });
     QUERY_OPS3 = /* @__PURE__ */ new Set(["list", "fetch", "generate"]);
-    MUTATE_OPS3 = /* @__PURE__ */ new Set(["add", "remove"]);
+    MUTATE_OPS3 = /* @__PURE__ */ new Set(["add", "remove", "update", "supersede"]);
     DocsHandler = class {
       // -----------------------------------------------------------------------
       // Query
@@ -17969,7 +18564,7 @@ var init_docs2 = __esm({
       getSupportedOperations() {
         return {
           query: ["list", "fetch", "generate"],
-          mutate: ["add", "remove"]
+          mutate: ["add", "remove", "update", "supersede"]
         };
       }
     };
@@ -20430,6 +21025,9 @@ function pickDecoratorMetaExtensions(responseMeta) {
   const out = {};
   if (responseMeta["_nexus"] !== void 0) out["_nexus"] = responseMeta["_nexus"];
   if (responseMeta["deprecated"] !== void 0) out["deprecated"] = responseMeta["deprecated"];
+  if (responseMeta["suggestedNext"] !== void 0) {
+    out["suggestedNext"] = responseMeta["suggestedNext"];
+  }
   return out;
 }
 function buildNexusMetaExtensions(operation, params = {}) {
@@ -26817,7 +27415,8 @@ async function orchestrateSpawnOp(params) {
     getProjectRoot11(),
     params.tier,
     params.noWorktree,
-    params.spawnScope
+    params.spawnScope,
+    params.atomicityScope
   );
 }
 async function orchestrateHandoffOp(params) {
@@ -26897,16 +27496,16 @@ async function orchestrateRejectOp(params) {
 async function orchestrateClassify(request, context, projectRoot) {
   try {
     const { getCleoCantWorkflowsDir } = await import("@cleocode/core/internal");
-    const { readFileSync: readFileSync21, readdirSync: readdirSync3, existsSync: existsSync19 } = await import("node:fs");
-    const { join: join37 } = await import("node:path");
+    const { readFileSync: readFileSync21, readdirSync: readdirSync3, existsSync: existsSync20 } = await import("node:fs");
+    const { join: join38 } = await import("node:path");
     const workflowsDir = getCleoCantWorkflowsDir();
     const combined = `${request} ${context ?? ""}`.toLowerCase();
     const matches = [];
-    if (existsSync19(workflowsDir)) {
+    if (existsSync20(workflowsDir)) {
       const files = readdirSync3(workflowsDir).filter((f) => f.endsWith(".cant"));
       for (const file of files) {
         try {
-          const src = readFileSync21(join37(workflowsDir, file), "utf-8");
+          const src = readFileSync21(join38(workflowsDir, file), "utf-8");
           const teamMatch = /^team\s+(\S+):/m.exec(src);
           if (!teamMatch) continue;
           const teamName = teamMatch[1];
@@ -26921,12 +27520,12 @@ async function orchestrateClassify(request, context, projectRoot) {
         }
       }
     }
-    const localCantDir = join37(projectRoot, CLEO_DIR_NAME, WORKFLOWS_SUBDIR);
-    if (existsSync19(localCantDir)) {
+    const localCantDir = join38(projectRoot, CLEO_DIR_NAME, WORKFLOWS_SUBDIR);
+    if (existsSync20(localCantDir)) {
       const files = readdirSync3(localCantDir).filter((f) => f.endsWith(".cant"));
       for (const file of files) {
         try {
-          const src = readFileSync21(join37(localCantDir, file), "utf-8");
+          const src = readFileSync21(join38(localCantDir, file), "utf-8");
           const teamMatch = /^team\s+(\S+):/m.exec(src);
           if (!teamMatch) continue;
           const teamName = teamMatch[1];
@@ -27118,11 +27717,11 @@ async function orchestrateAnalyzeParallelSafety(taskIds, projectRoot) {
     };
   }
 }
-async function handleWorktreeComplete(taskId, projectRoot, resolve8) {
+async function handleWorktreeComplete(taskId, projectRoot, resolve9) {
   try {
     const { completeWorktreeForTask } = await import("@cleocode/core/internal");
     const result = completeWorktreeForTask(taskId, projectRoot, {
-      resolve: resolve8 ?? "auto"
+      resolve: resolve9 ?? "auto"
     });
     if (result.outcome === "conflict") {
       return {
@@ -27654,12 +28253,15 @@ var init_orchestrate2 = __esm({
                 );
               const tierRaw = params.tier;
               const tier = tierRaw === 0 || tierRaw === 1 || tierRaw === 2 ? tierRaw : void 0;
+              const atomicityScopeRaw = params.atomicityScope;
+              const atomicityScope = atomicityScopeRaw === "orchestrator-defer" ? "orchestrator-defer" : void 0;
               const p = {
                 taskId: params.taskId,
                 protocolType: params.protocolType,
                 tier,
                 noWorktree: params.noWorktree,
-                spawnScope: params.spawnScope
+                spawnScope: params.spawnScope,
+                ...atomicityScope ? { atomicityScope } : {}
               };
               return wrapResult(await coreOps2.spawn(p), "mutate", "orchestrate", operation, startTime);
             }
@@ -27799,10 +28401,10 @@ var init_orchestrate2 = __esm({
                   startTime
                 );
               const rawResolve = params.resolve;
-              const resolve8 = rawResolve === "manual" ? "manual" : rawResolve === "auto" ? "auto" : void 0;
+              const resolve9 = rawResolve === "manual" ? "manual" : rawResolve === "auto" ? "auto" : void 0;
               const p = {
                 taskId: params.taskId,
-                ...resolve8 !== void 0 ? { resolve: resolve8 } : {}
+                ...resolve9 !== void 0 ? { resolve: resolve9 } : {}
               };
               return wrapResult(
                 await coreOps2["worktree.complete"](p),
@@ -28943,6 +29545,65 @@ var init_release2 = __esm({
                 startTime
               );
             }
+            // release.validate-changelog — canonical CHANGELOG.md header validator
+            // (T9937 / Saga T9862). Replaces the brittle `grep -qF "## [VERSION]"`
+            // step in .github/workflows/release.yml. Read-only.
+            //
+            // The core verb returns a plain `ValidateChangelogResult` envelope
+            // (NOT an EngineResult discriminated union) so direct SDK consumers
+            // can branch on `result.valid`. At the dispatch boundary we translate
+            // `valid=false` into `E_CHANGELOG_MISSING_SECTION` so the CLI emits a
+            // non-zero exit code — exactly the behaviour CI workflows depend on
+            // (the legacy `grep -qF "## [VERSION]" || exit 1` had the same
+            // contract).
+            case "validate-changelog": {
+              const version = typeof params?.version === "string" ? params.version : void 0;
+              if (!version)
+                return errorResult(
+                  "query",
+                  "release",
+                  operation,
+                  "E_INVALID_INPUT",
+                  "version is required",
+                  startTime
+                );
+              const typed = {
+                version,
+                projectRoot: getProjectRoot14(),
+                ...typeof params?.changelogPath === "string" ? { changelogPath: params.changelogPath } : {}
+              };
+              const validation = await validateChangelog(typed);
+              if (validation.valid) {
+                return wrapResult(
+                  { success: true, data: validation },
+                  "query",
+                  "release",
+                  operation,
+                  startTime
+                );
+              }
+              return wrapResult(
+                {
+                  success: false,
+                  error: {
+                    code: "E_CHANGELOG_MISSING_SECTION",
+                    message: validation.reason ?? `CHANGELOG.md missing canonical header for v${validation.normalizedVersion}`,
+                    details: {
+                      version: validation.version,
+                      normalizedVersion: validation.normalizedVersion,
+                      changelogPath: validation.changelogPath,
+                      headerFound: validation.headerFound
+                    },
+                    fix: `Run \`cleo release plan v${validation.normalizedVersion}\` locally to write the section, then re-push.`,
+                    exitCode: 1
+                  }
+                },
+                "query",
+                "release",
+                operation,
+                startTime
+              );
+            }
             default:
               return unsupportedOp("query", "release", operation, startTime);
           }
@@ -29110,7 +29771,7 @@ var init_release2 = __esm({
       /** Return declared operations for introspection and registry validation. */
       getSupportedOperations() {
         return {
-          query: ["gate", "ivtr-suggest"],
+          query: ["gate", "ivtr-suggest", "validate-changelog"],
           mutate: ["gate", "ivtr-suggest", "reconcile", "plan", "open"]
         };
       }
@@ -30092,7 +30753,7 @@ var init_sticky2 = __esm({
 });
 
 // packages/cleo/src/dispatch/domains/tasks.ts
-import { getLogger as getLogger15, getProjectRoot as getProjectRoot18 } from "@cleocode/core";
+import { getLogger as getLogger15, getProjectRoot as getProjectRoot18, TASKS_SUGGESTED_NEXT_BUILDERS } from "@cleocode/core";
 import { createAttachmentStore as createAttachmentStore4 } from "@cleocode/core/internal";
 import {
   sagaAdd as coreSagaAdd,
@@ -30170,6 +30831,25 @@ async function sagaReconcile(params) {
     "saga.reconcile"
   );
 }
+function stampSuggestedNext(response, operation, params) {
+  if (!response.success) return response;
+  const builder = TASKS_SUGGESTED_NEXT_BUILDERS[operation];
+  if (!builder) return response;
+  let suggestions;
+  try {
+    suggestions = builder(params, response.data);
+  } catch {
+    return response;
+  }
+  if (suggestions.length === 0) return response;
+  return {
+    ...response,
+    meta: {
+      ...response.meta,
+      suggestedNext: suggestions
+    }
+  };
+}
 var _tasksTypedHandler, QUERY_OPS11, MUTATE_OPS10, TasksHandler;
 var init_tasks2 = __esm({
   "packages/cleo/src/dispatch/domains/tasks.ts"() {
@@ -30241,7 +30921,15 @@ var init_tasks2 = __esm({
             fields: params.fields,
             verbose: params.verbose,
             // T944/T9072: kind filter
-            kind: params.kind
+            kind: params.kind,
+            // T9905: unified urgency surface
+            urgent: params.urgent,
+            // T9904: label filter — `cleo find --label <name>` (closes GH#393).
+            label: params.label,
+            // T10108: parent filter — `cleo find --parent <id>`. Saga-aware via
+            // resolveSagaMemberIds (ADR-073 §1) so saga members surface through
+            // the same routing as `cleo list --parent`.
+            parent: params.parent
           }),
           "find"
         );
@@ -30684,7 +31372,14 @@ var init_tasks2 = __esm({
             operation,
             params ?? {}
           );
-          return wrapResult(envelopeToEngineResult(envelope), "query", "tasks", operation, startTime);
+          const response = wrapResult(
+            envelopeToEngineResult(envelope),
+            "query",
+            "tasks",
+            operation,
+            startTime
+          );
+          return stampSuggestedNext(response, operation, params ?? {});
         } catch (error) {
           getLogger15("domain:tasks").error(
             { gateway: "query", domain: "tasks", operation, err: error },
@@ -30771,7 +31466,14 @@ var init_tasks2 = __esm({
             operation,
             params ?? {}
           );
-          return wrapResult(envelopeToEngineResult(envelope), "mutate", "tasks", operation, startTime);
+          const response = wrapResult(
+            envelopeToEngineResult(envelope),
+            "mutate",
+            "tasks",
+            operation,
+            startTime
+          );
+          return stampSuggestedNext(response, operation, params ?? {});
         } catch (error) {
           getLogger15("domain:tasks").error(
             { gateway: "mutate", domain: "tasks", operation, err: error },
@@ -32296,6 +32998,88 @@ var init_field_filter = __esm({
   }
 });
 
+// packages/cleo/src/cli/projection-context.ts
+function setProjectionOptOut(optOut) {
+  currentOptOut = optOut;
+}
+function getProjectionOptOut() {
+  return currentOptOut;
+}
+var currentOptOut;
+var init_projection_context = __esm({
+  "packages/cleo/src/cli/projection-context.ts"() {
+    "use strict";
+    currentOptOut = false;
+  }
+});
+
+// packages/cleo/src/dispatch/middleware/mutate-minimal-envelope.ts
+import {
+  applyMutateProjection,
+  MUTATE_PROJECTION_PLANS,
+  resolveProjectionMode
+} from "@cleocode/core";
+function resolveModeFor(req) {
+  const override = req.params?.["_projection"];
+  if (override === "full" || override === "mvi") return override;
+  return resolveProjectionMode(getProjectionOptOut() || void 0);
+}
+function createMutateMinimalEnvelope() {
+  return async (req, next) => {
+    const mode = resolveModeFor(req);
+    const opKey = `${req.domain}.${req.operation}`;
+    const hasPlan = MUTATE_PROJECTION_PLANS[opKey] !== void 0;
+    const response = await next();
+    if (!hasPlan) return response;
+    if (response.success && response.data !== void 0) {
+      response.data = applyMutateProjection(response.data, opKey, mode);
+    }
+    response.meta.mutateProjection = mode;
+    return response;
+  };
+}
+var init_mutate_minimal_envelope = __esm({
+  "packages/cleo/src/dispatch/middleware/mutate-minimal-envelope.ts"() {
+    "use strict";
+    init_projection_context();
+  }
+});
+
+// packages/cleo/src/dispatch/middleware/mvi-record-projection.ts
+import {
+  applyProjectionPlan,
+  PROJECTION_PLANS,
+  resolveProjectionMode as resolveProjectionMode2
+} from "@cleocode/core";
+function resolveModeFor2(req) {
+  const override = req.params?.["_projection"];
+  if (override === "full" || override === "mvi") return override;
+  return resolveProjectionMode2(getProjectionOptOut() || void 0);
+}
+function createMviRecordProjection() {
+  return async (req, next) => {
+    const mode = resolveModeFor2(req);
+    if (req.params && "_projection" in req.params) {
+      delete req.params["_projection"];
+    }
+    const opKey = `${req.domain}.${req.operation}`;
+    const hasPlan = PROJECTION_PLANS[opKey] !== void 0;
+    const response = await next();
+    if (!hasPlan) return response;
+    if (response.success && response.data !== void 0) {
+      response.data = applyProjectionPlan(response.data, opKey, mode);
+    }
+    response.meta.projection = mode;
+    return response;
+  };
+}
+var init_mvi_record_projection = __esm({
+  "packages/cleo/src/dispatch/middleware/mvi-record-projection.ts"() {
+    "use strict";
+    init_projection_context();
+  }
+});
+
 // packages/cleo/src/dispatch/lib/security.ts
 import {
   ALL_VALID_STATUSES,
@@ -32503,6 +33287,15 @@ function createCliDispatcher() {
       // T4959: session identity first
       createSanitizer(() => getProjectRoot22()),
       createFieldFilter(),
+      // T9922 (Saga T9855 / E8.3): MVI record projection default for read ops.
+      // Runs AFTER the domain handler returns so it can trim the data payload
+      // before audit + telemetry record byte sizes. Sits before audit so the
+      // audit trail captures the projected (final) bytes.
+      createMviRecordProjection(),
+      // T9931 (Saga T9855 / E9.4): minimal envelopes for mutate ops. Mirror
+      // policy to the read-side projection — sits in the same pre-audit slot
+      // so audit/telemetry record the trimmed bytes.
+      createMutateMinimalEnvelope(),
       createAudit(),
       // T4959: CLI now gets audit trail
       createTelemetry()
@@ -32669,6 +33462,8 @@ var init_cli = __esm({
     init_domains();
     init_audit();
     init_field_filter();
+    init_mutate_minimal_envelope();
+    init_mvi_record_projection();
     init_sanitizer();
     init_session_resolver();
     init_telemetry();
@@ -32864,26 +33659,26 @@ function wrapParseError(rawInput, parseErr, sourceLabel) {
   const snippet2 = rawInput.length > PARSE_ERROR_SNIPPET_MAX_LENGTH ? `${rawInput.slice(0, PARSE_ERROR_SNIPPET_MAX_LENGTH)}\u2026` : rawInput;
   return new Error(`Invalid JSON in ${sourceLabel}: ${parseErr.message} (got: ${snippet2})`);
 }
-function readStdinJson(stdin) {
-  return new Promise((resolve8, reject) => {
+function readStdinJson(stdin2) {
+  return new Promise((resolve9, reject) => {
     const chunks = [];
-    stdin.on("data", (chunk) => {
+    stdin2.on("data", (chunk) => {
       chunks.push(typeof chunk === "string" ? Buffer.from(chunk) : chunk);
     });
-    stdin.on("error", (err) => {
+    stdin2.on("error", (err) => {
       reject(err);
     });
-    stdin.on("end", () => {
+    stdin2.on("end", () => {
       const raw = Buffer.concat(chunks).toString("utf8");
       try {
-        resolve8(JSON.parse(raw));
+        resolve9(JSON.parse(raw));
       } catch (err) {
         reject(wrapParseError(raw, err, "stdin"));
       }
     });
   });
 }
-async function collectMutateInput(args, stdin) {
+async function collectMutateInput(args, stdin2) {
   if (typeof args.params === "string" && args.params.length > 0) {
     try {
       return JSON.parse(args.params);
@@ -32899,8 +33694,8 @@ async function collectMutateInput(args, stdin) {
       throw wrapParseError(raw, err, `--file ${args.file}`);
     }
   }
-  if (stdin.isTTY !== true) {
-    return readStdinJson(stdin);
+  if (stdin2.isTTY !== true) {
+    return readStdinJson(stdin2);
   }
   if (args.positional !== void 0 && args.positional.length > 0) {
     return args.positional;
@@ -34105,12 +34900,12 @@ var init_agent = __esm({
             transportConfig: {},
             isActive: true
           });
-          const { existsSync: existsSync19, mkdirSync: mkdirSync7, writeFileSync: writeFileSync7 } = await import("node:fs");
-          const { join: join37 } = await import("node:path");
-          const cantDir = join37(CLEO_DIR_NAME, AGENTS_SUBDIR);
-          const cantPath = join37(cantDir, `${agentId}.cant`);
+          const { existsSync: existsSync20, mkdirSync: mkdirSync7, writeFileSync: writeFileSync7 } = await import("node:fs");
+          const { join: join38 } = await import("node:path");
+          const cantDir = join38(CLEO_DIR_NAME, AGENTS_SUBDIR);
+          const cantPath = join38(cantDir, `${agentId}.cant`);
           let cantScaffolded = false;
-          if (!existsSync19(cantPath)) {
+          if (!existsSync20(cantPath)) {
             mkdirSync7(cantDir, { recursive: true });
             const role = classification ?? "specialist";
             const cantContent = `---
@@ -34170,7 +34965,7 @@ agent ${agentId}:
               data: {
                 agentId: credential.agentId,
                 displayName: credential.displayName,
-                cantFile: cantScaffolded ? cantPath : existsSync19(cantPath) ? cantPath : null,
+                cantFile: cantScaffolded ? cantPath : existsSync20(cantPath) ? cantPath : null,
                 cantScaffolded
               }
             },
@@ -34289,8 +35084,8 @@ agent ${agentId}:
         try {
           const { AgentRegistryAccessor } = await import("@cleocode/core/agents");
           const { createRuntime } = await import("@cleocode/runtime");
-          const { existsSync: existsSync19, readFileSync: readFileSync21 } = await import("node:fs");
-          const { join: join37 } = await import("node:path");
+          const { existsSync: existsSync20, readFileSync: readFileSync21 } = await import("node:fs");
+          const { join: join38 } = await import("node:path");
           await openCleoDb("tasks");
           const registry = new AgentRegistryAccessor(getProjectRoot24());
           const credential = await registry.get(args.agentId);
@@ -34310,8 +35105,8 @@ agent ${agentId}:
           }
           let profile = null;
           let cantValidation = null;
-          const cantPath = args.cant ?? join37(CLEO_DIR_NAME, AGENTS_SUBDIR, `${args.agentId}.cant`);
-          if (existsSync19(cantPath)) {
+          const cantPath = args.cant ?? join38(CLEO_DIR_NAME, AGENTS_SUBDIR, `${args.agentId}.cant`);
+          if (existsSync20(cantPath)) {
             profile = readFileSync21(cantPath, "utf-8");
             try {
               const cantModule = await import("@cleocode/cant");
@@ -34835,8 +35630,8 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
         try {
           const { AgentRegistryAccessor } = await import("@cleocode/core/agents");
           const { createRuntime } = await import("@cleocode/runtime");
-          const { existsSync: existsSync19 } = await import("node:fs");
-          const { join: join37 } = await import("node:path");
+          const { existsSync: existsSync20 } = await import("node:fs");
+          const { join: join38 } = await import("node:path");
           await openCleoDb("tasks");
           const registry = new AgentRegistryAccessor(getProjectRoot24());
           const credential = await registry.get(args.agentId);
@@ -34853,8 +35648,8 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
           }
           await registry.update(args.agentId, { isActive: true });
           await registry.markUsed(args.agentId);
-          const cantPath = join37(CLEO_DIR_NAME, AGENTS_SUBDIR, `${args.agentId}.cant`);
-          const hasProfile = existsSync19(cantPath);
+          const cantPath = join38(CLEO_DIR_NAME, AGENTS_SUBDIR, `${args.agentId}.cant`);
+          const hasProfile = existsSync20(cantPath);
           const runtime = await createRuntime(registry, {
             agentId: args.agentId,
             pollIntervalMs: 5e3,
@@ -35650,10 +36445,10 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
       async run({ args }) {
         let tempDir = null;
         try {
-          const { existsSync: existsSync19 } = await import("node:fs");
-          const { basename, resolve: resolve8 } = await import("node:path");
-          const resolvedPath = resolve8(args.path);
-          if (!existsSync19(resolvedPath)) {
+          const { existsSync: existsSync20 } = await import("node:fs");
+          const { basename, resolve: resolve9 } = await import("node:path");
+          const resolvedPath = resolve9(args.path);
+          if (!existsSync20(resolvedPath)) {
             cliOutput(
               {
                 success: false,
@@ -35778,11 +36573,11 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
       },
       async run({ args }) {
         try {
-          const { existsSync: existsSync19, statSync } = await import("node:fs");
-          const { resolve: resolve8, basename, dirname: dirname12 } = await import("node:path");
-          const { execFileSync: execFileSync4 } = await import("node:child_process");
-          const resolvedDir = resolve8(args.dir);
-          if (!existsSync19(resolvedDir) || !statSync(resolvedDir).isDirectory()) {
+          const { existsSync: existsSync20, statSync } = await import("node:fs");
+          const { resolve: resolve9, basename, dirname: dirname12 } = await import("node:path");
+          const { execFileSync: execFileSync5 } = await import("node:child_process");
+          const resolvedDir = resolve9(args.dir);
+          if (!existsSync20(resolvedDir) || !statSync(resolvedDir).isDirectory()) {
             cliOutput(
               {
                 success: false,
@@ -35796,9 +36591,9 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
             process.exitCode = 4;
             return;
           }
-          const { join: join37 } = await import("node:path");
-          const personaPath = join37(resolvedDir, "persona.cant");
-          if (!existsSync19(personaPath)) {
+          const { join: join38 } = await import("node:path");
+          const personaPath = join38(resolvedDir, "persona.cant");
+          if (!existsSync20(personaPath)) {
             cliOutput(
               {
                 success: false,
@@ -35814,10 +36609,10 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
           }
           const agentName = basename(resolvedDir);
           const archiveName = `${agentName}.cantz`;
-          const archivePath = resolve8(archiveName);
+          const archivePath = resolve9(archiveName);
           const parentDir = dirname12(resolvedDir);
           try {
-            execFileSync4("zip", ["-r", archivePath, agentName], {
+            execFileSync5("zip", ["-r", archivePath, agentName], {
               cwd: parentDir,
               encoding: "utf-8",
               timeout: 3e4
@@ -35845,7 +36640,7 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
               if (entry.isFile()) {
                 fileCount++;
               } else if (entry.isDirectory()) {
-                countFiles(join37(dirPath, entry.name));
+                countFiles(join38(dirPath, entry.name));
               }
             }
           };
@@ -36093,17 +36888,17 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
       },
       async run({ args }) {
         try {
-          const { existsSync: existsSync19, readFileSync: readFileSync21, mkdirSync: mkdirSync7 } = await import("node:fs");
-          const { resolve: resolve8, join: join37 } = await import("node:path");
-          const specPath = resolve8(args.spec);
-          if (!existsSync19(specPath)) {
+          const { existsSync: existsSync20, readFileSync: readFileSync21, mkdirSync: mkdirSync7 } = await import("node:fs");
+          const { resolve: resolve9, join: join38 } = await import("node:path");
+          const specPath = resolve9(args.spec);
+          if (!existsSync20(specPath)) {
             cliError(`spec file not found: ${specPath}`, 4, { name: "E_NOT_FOUND" });
             process.exitCode = 4;
             return;
           }
           const specContent = readFileSync21(specPath, "utf-8");
           const projectRoot = getProjectRoot24();
-          const outputDir = args["output-dir"] ? resolve8(args["output-dir"]) : join37(projectRoot, ".cleo", "cant", "agents");
+          const outputDir = args["output-dir"] ? resolve9(args["output-dir"]) : join38(projectRoot, ".cleo", "cant", "agents");
           mkdirSync7(outputDir, { recursive: true });
           if (args["dry-run"]) {
             cliOutput(
@@ -36854,8 +37649,8 @@ function detectAuthType(provider, token) {
 async function promptYesNo(question) {
   const rl = createInterface({ input: process.stdin, output: process.stderr });
   try {
-    const answer = await new Promise((resolve8) => {
-      rl.question(question, (a) => resolve8(a));
+    const answer = await new Promise((resolve9) => {
+      rl.question(question, (a) => resolve9(a));
     });
     const clean = answer.trim().toLowerCase();
     return clean === "y" || clean === "yes";
@@ -37791,12 +38586,12 @@ async function promptPassphrase() {
       "Cannot prompt for passphrase: stdin is not a TTY. Set the CLEO_BACKUP_PASSPHRASE environment variable for non-interactive use."
     );
   }
-  return new Promise((resolve8) => {
+  return new Promise((resolve9) => {
     process.stdout.write("Passphrase: ");
     const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
     rl.question("", (answer) => {
       rl.close();
-      resolve8(answer.trim());
+      resolve9(answer.trim());
     });
   });
 }
@@ -38906,11 +39701,11 @@ var init_caamp = __esm({
         }
         if (args["dry-run"]) {
           const { parseCaampBlocks } = await import("@cleocode/caamp");
-          const { existsSync: existsSync19 } = await import("node:fs");
+          const { existsSync: existsSync20 } = await import("node:fs");
           const { readFile: readFile8 } = await import("node:fs/promises");
           const dryResults = [];
           for (const filePath of filePaths) {
-            if (!existsSync19(filePath)) {
+            if (!existsSync20(filePath)) {
               dryResults.push({ filePath, exists: false, blockCount: 0, wouldRemove: 0 });
               continue;
             }
@@ -39480,7 +40275,7 @@ var init_changeset = __esm({
         });
         if (!outcome.ok) {
           const err = outcome.error;
-          const hint = err.code === "E_SLUG_PATTERN_MISMATCH" && err.example ? `example slug: ${err.example}` : void 0;
+          const hint = err.code === "E_SLUG_PATTERN_MISMATCH" && err.example ? `example slug: ${err.example}` : err.code === "E_SLUG_RESERVED" ? `try: ${err.suggestions.join(", ")}` : void 0;
           cliError(err.message, 6 /* VALIDATION_ERROR */, {
             name: err.code,
             ...hint ? { fix: hint } : {}
@@ -39965,11 +40760,11 @@ var init_check2 = __esm({
       },
       async run({ args }) {
         const { spawnSync } = await import("node:child_process");
-        const { existsSync: existsSync19 } = await import("node:fs");
-        const { join: join37, resolve: resolve8 } = await import("node:path");
+        const { existsSync: existsSync20 } = await import("node:fs");
+        const { join: join38, resolve: resolve9 } = await import("node:path");
         const strict = Boolean(args.strict);
         const jsonOnly = Boolean(args.json);
-        const repoRoot = resolve8(process.cwd());
+        const repoRoot = resolve9(process.cwd());
         const gates = [
           {
             id: "gate-1",
@@ -40006,8 +40801,8 @@ var init_check2 = __esm({
         const results = [];
         let anyFailed = false;
         for (const gate of gates) {
-          const scriptPath = join37(repoRoot, gate.script);
-          if (!existsSync19(scriptPath)) {
+          const scriptPath = join38(repoRoot, gate.script);
+          if (!existsSync20(scriptPath)) {
             results.push({
               id: gate.id,
               task: gate.task,
@@ -40322,9 +41117,9 @@ var init_code = __esm({
           async run({ args }) {
             await requireTreeSitter();
             const { smartOutline } = await import("@cleocode/core/internal");
-            const { join: join37 } = await import("node:path");
+            const { join: join38 } = await import("node:path");
             const root = process.cwd();
-            const absPath = args.file.startsWith("/") ? args.file : join37(root, args.file);
+            const absPath = args.file.startsWith("/") ? args.file : join38(root, args.file);
             const result = smartOutline(absPath, root);
             if (result.errors.length > 0 && result.symbols.length === 0) {
               cliError(result.errors.join(", "), 1, { name: "E_OUTLINE_FAILED" });
@@ -40415,9 +41210,9 @@ var init_code = __esm({
           async run({ args }) {
             await requireTreeSitter();
             const { smartUnfold } = await import("@cleocode/core/internal");
-            const { join: join37 } = await import("node:path");
+            const { join: join38 } = await import("node:path");
             const root = process.cwd();
-            const absPath = args.file.startsWith("/") ? args.file : join37(root, args.file);
+            const absPath = args.file.startsWith("/") ? args.file : join38(root, args.file);
             const result = smartUnfold(absPath, args.symbol, root);
             if (!result.found) {
               const errs = result.errors.length > 0 ? `: ${result.errors.join(", ")}` : "";
@@ -43786,6 +44581,94 @@ var init_strict_args = __esm({
   }
 });
 
+// packages/cleo/src/cli/commands/docs/graph.ts
+import {
+  buildDocProvenanceGraph,
+  DocProvenanceRootNotFoundError,
+  renderProvenanceGraphAsDot
+} from "@cleocode/core/internal";
+function parseDepth(raw) {
+  if (raw === void 0 || raw === null || raw === "") return 2;
+  const parsed = Number.parseInt(String(raw), 10);
+  if (!Number.isInteger(parsed) || parsed < 0) {
+    cliError(
+      `--depth must be a non-negative integer (got '${String(raw)}')`,
+      6 /* VALIDATION_ERROR */,
+      { name: "E_VALIDATION" }
+    );
+    process.exit(6 /* VALIDATION_ERROR */);
+  }
+  return parsed;
+}
+function parseFormat(raw) {
+  if (raw === void 0 || raw === null || raw === "") return "json";
+  const candidate = String(raw);
+  if (candidate !== "json" && candidate !== "dot") {
+    cliError(`--format must be one of: json|dot \u2014 got '${candidate}'`, 6 /* VALIDATION_ERROR */, {
+      name: "E_VALIDATION"
+    });
+    process.exit(6 /* VALIDATION_ERROR */);
+  }
+  return candidate;
+}
+var graphCommand;
+var init_graph2 = __esm({
+  "packages/cleo/src/cli/commands/docs/graph.ts"() {
+    "use strict";
+    init_src2();
+    init_define_cli_command();
+    init_renderers();
+    graphCommand = defineCommand({
+      meta: {
+        name: "graph",
+        description: "Traverse the docs provenance graph from a root (slug or task ID) and return a typed DocProvenanceResponse envelope. Walks supersedes/superseded-by chains plus cross-entity edges to owning + related tasks. Default depth=2. Pass --format dot for Graphviz output (still wrapped in the envelope under data.dot)."
+      },
+      args: {
+        root: {
+          type: "string",
+          description: "Root identifier \u2014 a canonical doc slug (e.g. adr-078-docs-provenance) or a CLEO task ID (T####). Required.",
+          required: true
+        },
+        depth: {
+          type: "string",
+          description: "Maximum BFS hops from the root (default: 2; minimum: 0)."
+        },
+        format: {
+          type: "string",
+          description: "Output format: json (default) | dot."
+        }
+      },
+      async run({ args }) {
+        const root = String(args.root);
+        const depth = parseDepth(args.depth);
+        const format = parseFormat(args.format);
+        try {
+          const graph = await buildDocProvenanceGraph({ root, depth });
+          const payload = { ...graph };
+          if (format === "dot") {
+            payload["dot"] = renderProvenanceGraphAsDot(graph);
+          }
+          cliOutput(payload, { command: "docs graph", operation: "docs.graph" });
+        } catch (err) {
+          if (err instanceof DocProvenanceRootNotFoundError) {
+            cliError(err.message, 4 /* NOT_FOUND */, {
+              name: "E_DOC_PROVENANCE_ROOT_NOT_FOUND",
+              fix: "Verify the root with `cleo docs list --project --type adr` (or your kind) and pass an existing slug or task ID. Slugs and task IDs are matched against attachments.slug and attachment_refs.owner_id respectively.",
+              details: { root }
+            });
+            process.exit(4 /* NOT_FOUND */);
+          }
+          const message = err instanceof Error ? err.message : String(err);
+          cliError(`docs graph failed: ${message}`, 1 /* GENERAL_ERROR */, {
+            name: "E_DOCS_GRAPH_FAILED"
+          });
+          process.exit(1 /* GENERAL_ERROR */);
+        }
+      }
+    });
+  }
+});
+
 // packages/cleo/src/viewer/pidfile.ts
 import { mkdir, readFile as readFile3, unlink, writeFile } from "node:fs/promises";
 import { dirname as dirname6, join as join18 } from "node:path";
@@ -44614,7 +45497,6 @@ __export(docs_exports, {
 import { appendFile, mkdir as mkdir2, readdir, readFile as readFile4, writeFile as writeFile2 } from "node:fs/promises";
 import { dirname as dirname8, isAbsolute as isAbsolute2, join as join21, resolve as resolve5 } from "node:path";
 import {
-  buildDocsGraph,
   CleoError as CleoError3,
   CounterMismatchError,
   checkSlugSimilarity,
@@ -44623,6 +45505,7 @@ import {
   DEFAULT_SIMILARITY_THRESHOLD,
   detectStrayCleoDb as detectStrayCleoDb2,
   exportDocument,
+  findSimilarDocs,
   getAgentOutputsAbsolute,
   getProjectRoot as getProjectRoot38,
   listDocVersions,
@@ -44728,7 +45611,7 @@ function loadCliRegistry(projectRoot) {
     throw err;
   }
 }
-var addCommand5, listCommand8, fetchCommand, removeCommand2, generateCommand, exportCommand4, searchCommand, mergeCommand, graphCommand, rankCommand, versionsCommand, publishCommand2, publishPrCommand, syncCommand3, statusCommand7, gapCheckCommand, importCommand2, schemaCommand, listTypesCommand, docsCommand;
+var addCommand5, listCommand8, fetchCommand, removeCommand2, supersedeCommandArgs, supersedeCommand, generateCommand, exportCommand4, searchCommand, findCommand3, mergeCommand, rankCommand, updateCommand, versionsCommand, publishCommand2, publishPrCommand, syncCommand3, statusCommand7, gapCheckCommand, importCommand2, schemaCommand, listTypesCommand, docsCommand;
 var init_docs3 = __esm({
   "packages/cleo/src/cli/commands/docs.ts"() {
     "use strict";
@@ -44738,11 +45621,12 @@ var init_docs3 = __esm({
     init_canon_docs();
     init_strict_args();
     init_renderers();
+    init_graph2();
     init_docs_viewer();
     addCommand5 = defineCommand({
       meta: {
         name: "add",
-        description: 'Attach a local file or remote URL to a CLEO entity (task, session, observation). Owner type is inferred from the ID prefix: T### \u2192 task, ses_* \u2192 session, O-* \u2192 observation. Use --slug to set a human-friendly alias (unique per project) (T9636).\n\nPositional arguments:\n  <owner-id>             Owner entity ID (T###, ses_*, O-*) \u2014 required\n  [file]                 Local file path to attach \u2014 optional when --url is set\n\nNamed arguments:\n  --url <url>            Remote URL to attach (instead of a local file)\n  --desc <text>          Free-text description of this attachment\n  --labels <csv>         Comma-separated labels (e.g. rfc,spec)\n  --attached-by <name>   Agent identity that created the attachment (default: "human")\n  --slug <kebab>         Human-friendly alias, unique per project (T9636)\n  --type <kind>          Taxonomy classification \u2014 run `cleo docs list-types` for kinds\n  --allow-similar        Bypass the slug-similarity warn \u2014 every bypass is audited\n                         to .cleo/audit/similar-bypass.jsonl (T10361)\n  --strict               Enforce body-schema (requiredSections) \u2014 fail with\n                         E_DOC_SCHEMA_MISMATCH instead of warning (T10160)\n\nValidation behaviors:\n  \u2022 Unknown flags \u2192 E_UNKNOWN_FLAG with did-you-mean suggestions (T10359)\n  \u2022 Slug collision \u2192 E_SLUG_RESERVED + 3 alternative slugs (T10386)\n  \u2022 Near-duplicate slug \u2192 W_SLUG_SIMILAR warning unless --allow-similar (T10361)\n  \u2022 TODO(T10360): --type adr will auto-allocate adr-NNN-<title> from a --title flag.'
+        description: 'Attach a local file or remote URL to a CLEO entity (task, session, observation). Owner type is inferred from the ID prefix: T### \u2192 task, ses_* \u2192 session, O-* \u2192 observation. Use --slug to set a human-friendly alias (unique per project) (T9636).\n\nPositional arguments:\n  <owner-id>             Owner entity ID (T###, ses_*, O-*) \u2014 required\n  [file]                 Local file path to attach \u2014 optional when --url is set\n\nNamed arguments:\n  --url <url>            Remote URL to attach (instead of a local file)\n  --desc <text>          Free-text description of this attachment\n  --labels <csv>         Comma-separated labels (e.g. rfc,spec)\n  --attached-by <name>   Agent identity that created the attachment (default: "human")\n  --slug <kebab>         Human-friendly alias, unique per project (T9636)\n  --title <text>         Human-readable title \u2014 REQUIRED for --type adr when --slug is omitted (T10360)\n  --type <kind>          Taxonomy classification \u2014 run `cleo docs list-types` for kinds\n  --allow-similar        Bypass the slug-similarity warn \u2014 every bypass is audited\n                         to .cleo/audit/similar-bypass.jsonl (T10361)\n  --strict               Enforce body-schema (requiredSections) \u2014 fail with\n                         E_DOC_SCHEMA_MISMATCH instead of warning (T10160)\n\nValidation behaviors:\n  \u2022 Unknown flags \u2192 E_UNKNOWN_FLAG with did-you-mean suggestions (T10359)\n  \u2022 Slug collision \u2192 E_SLUG_RESERVED + 3 alternative slugs (T10386)\n  \u2022 Near-duplicate slug \u2192 W_SLUG_SIMILAR warning unless --allow-similar (T10361)\n  \u2022 For --type adr without --slug, slug auto-allocates as `adr-NNN-<kebab-title>` via the\n    central allocator (T10360 \u2014 closes T10153). --title is required in this case.'
       },
       args: {
         "owner-id": {
@@ -44775,6 +45659,10 @@ var init_docs3 = __esm({
           type: "string",
           description: "Human-friendly kebab-case alias for the attachment, unique per project (T9636). Collision returns E_SLUG_RESERVED with 3 alternative suggestions (legacy E_SLUG_TAKEN aliased under details.aliases for one release \u2014 T10386)."
         },
+        title: {
+          type: "string",
+          description: "Human-readable title used to derive the kebab-slug tail when auto-allocating an ADR slug. REQUIRED when --type adr is set AND --slug is omitted. Slugified via the shared kebabize helper (lowercase, hyphen-separated, diacritics stripped) (T10360)."
+        },
         type: {
           type: "string",
           description: "Taxonomy classification \u2014 run `cleo docs list-types` to enumerate registered kinds (T9637 / T9788)"
@@ -44814,6 +45702,17 @@ var init_docs3 = __esm({
           });
           process.exit(6);
         }
+        if (args.type === "adr" && !args.slug && !args.title) {
+          cliError(
+            "--title <text> is required when --type adr is used without --slug \u2014 the allocator needs a title to assemble adr-NNN-<kebab-title>",
+            6,
+            {
+              name: "E_VALIDATION",
+              fix: 'Re-run with --title "Adopt Drizzle v1 beta" (or pass --slug adr-042-explicit-name to bypass auto-allocation).'
+            }
+          );
+          process.exit(6);
+        }
         let resolvedFile;
         if (fileArg) {
           const routing = resolveWorktreeRouting2();
@@ -44926,6 +45825,7 @@ var init_docs3 = __esm({
             ...args.labels ? { labels: args.labels } : {},
             ...args["attached-by"] ? { attachedBy: args["attached-by"] } : {},
             ...args.slug ? { slug: args.slug } : {},
+            ...args.title ? { title: args.title } : {},
             ...args.type ? { type: args.type } : {},
             ...args.strict === true ? { strict: true } : {}
           },
@@ -44966,6 +45866,15 @@ var init_docs3 = __esm({
         orderBy: {
           type: "string",
           description: "Sort key: newest (default \u2014 most recent first), sha (ascending hex), slug (alphabetical, slug-less rows last) (T9792)."
+        },
+        // T9922 — MVI record projection opt-out flags (surfaced for --help).
+        verbose: {
+          type: "boolean",
+          description: "Return full attachment records instead of the MVI projection (id + slug + type + kind + sha + size + createdAt). T9922."
+        },
+        full: {
+          type: "boolean",
+          description: "Alias for --verbose. T9922."
         }
       },
       async run({ args }) {
@@ -45032,6 +45941,15 @@ var init_docs3 = __esm({
           type: "positional",
           description: "Attachment ID (att_*) or SHA-256 hex",
           required: true
+        },
+        // T9922 — MVI record projection opt-out flags (surfaced for --help).
+        verbose: {
+          type: "boolean",
+          description: "Return the full attachment metadata block instead of the MVI projection. The byte payload is always returned. T9922."
+        },
+        full: {
+          type: "boolean",
+          description: "Alias for --verbose. T9922."
         }
       },
       async run({ args }) {
@@ -45075,6 +45993,54 @@ var init_docs3 = __esm({
         );
       }
     });
+    supersedeCommandArgs = {
+      oldSlug: {
+        type: "positional",
+        description: "Slug of the doc being replaced",
+        required: true
+      },
+      newSlug: {
+        type: "positional",
+        description: "Slug of the doc that replaces oldSlug",
+        required: true
+      },
+      reason: {
+        type: "string",
+        description: "Optional human-readable reason carried back on the response envelope"
+      }
+    };
+    supersedeCommand = defineCommand({
+      meta: {
+        name: "supersede",
+        description: "Atomically supersede an older doc with a newer one: flips lifecycle_status to 'superseded' on the old row and links both rows via the supersedes/superseded_by FK pointers. All writes commit in a single SQLite transaction."
+      },
+      args: supersedeCommandArgs,
+      async run({ args, rawArgs }) {
+        try {
+          assertKnownFlags(rawArgs, supersedeCommandArgs, "docs supersede");
+        } catch (err) {
+          if (err instanceof UnknownFlagError) {
+            cliError(err.message, 6 /* VALIDATION_ERROR */, { name: "E_VALIDATION" });
+            process.exit(6 /* VALIDATION_ERROR */);
+          }
+          throw err;
+        }
+        const oldSlug = args.oldSlug;
+        const newSlug = args.newSlug;
+        const reason = typeof args.reason === "string" && args.reason.length > 0 ? args.reason : void 0;
+        await dispatchFromCli(
+          "mutate",
+          "docs",
+          "supersede",
+          {
+            oldSlug,
+            newSlug,
+            ...reason !== void 0 ? { reason } : {}
+          },
+          { command: "docs supersede" }
+        );
+      }
+    });
     generateCommand = defineCommand({
       meta: {
         name: "generate",
@@ -45226,6 +46192,102 @@ var init_docs3 = __esm({
         }
       }
     });
+    findCommand3 = defineCommand({
+      meta: {
+        name: "find",
+        description: "Find docs similar to a seed slug via llmtxt/similarity.rankBySimilarity. Pass --similar <slug>; results default to the same DocKind as the seed. Use --all-kinds to rank cross-kind, --threshold to set the minimum cosine score, and --limit to cap the number of returned hits.\n\nNamed arguments:\n  --similar <slug>       Slug of the seed doc to anchor similarity against (required for now)\n  --limit <n>            Maximum number of hits to return (default 10)\n  --threshold <0..1>     Minimum cosine score, hits below are dropped (default 0.5)\n  --all-kinds            Disable the same-kind filter and rank cross-kind\n  --json                 Emit LAFS JSON envelope (default for non-TTY)"
+      },
+      args: {
+        similar: {
+          type: "string",
+          description: "Slug of the seed doc to anchor similarity against"
+        },
+        limit: {
+          type: "string",
+          description: "Maximum number of hits to return (default: 10)"
+        },
+        threshold: {
+          type: "string",
+          description: "Minimum cosine similarity score in [0, 1] (default: 0.5)"
+        },
+        "all-kinds": {
+          type: "boolean",
+          description: "Disable the same-kind filter and rank across every DocKind"
+        },
+        json: {
+          type: "boolean",
+          description: "Emit LAFS JSON envelope instead of human-readable output"
+        }
+      },
+      async run({ args, rawArgs }) {
+        try {
+          assertKnownFlags(rawArgs, findCommand3.args, "docs find");
+        } catch (err) {
+          if (err instanceof UnknownFlagError) {
+            cliError(err.message, 6 /* VALIDATION_ERROR */, {
+              name: err.code,
+              fix: err.fix,
+              alternatives: err.suggestions.map((s) => ({ action: s, command: s })),
+              details: { flag: err.flag, knownFlags: err.knownFlags }
+            });
+            process.exit(6 /* VALIDATION_ERROR */);
+          }
+          throw err;
+        }
+        const similarSlug = typeof args.similar === "string" ? args.similar.trim() : "";
+        if (similarSlug.length === 0) {
+          cliError("--similar <slug> is required", 6 /* VALIDATION_ERROR */, {
+            name: "E_VALIDATION",
+            fix: "Example: `cleo docs find --similar adr-073-above-epic-naming --limit 5`."
+          });
+          process.exit(6 /* VALIDATION_ERROR */);
+        }
+        let limit;
+        if (typeof args.limit === "string") {
+          const parsed = Number.parseInt(args.limit, 10);
+          if (!Number.isFinite(parsed) || parsed <= 0) {
+            cliError(
+              `--limit must be a positive integer (got "${args.limit}")`,
+              6 /* VALIDATION_ERROR */,
+              {
+                name: "E_VALIDATION"
+              }
+            );
+            process.exit(6 /* VALIDATION_ERROR */);
+          }
+          limit = parsed;
+        }
+        let threshold;
+        if (typeof args.threshold === "string") {
+          const parsed = Number.parseFloat(args.threshold);
+          if (!Number.isFinite(parsed) || parsed < 0 || parsed > 1) {
+            cliError(
+              `--threshold must be a number in [0, 1] (got "${args.threshold}")`,
+              6 /* VALIDATION_ERROR */,
+              { name: "E_VALIDATION" }
+            );
+            process.exit(6 /* VALIDATION_ERROR */);
+          }
+          threshold = parsed;
+        }
+        const allKinds = args["all-kinds"] === true;
+        const projectRoot = getProjectRoot38();
+        try {
+          const result = await findSimilarDocs(similarSlug, {
+            ...limit !== void 0 ? { limit } : {},
+            ...threshold !== void 0 ? { threshold } : {},
+            allKinds,
+            projectRoot
+          });
+          cliOutput(result, { command: "docs find", operation: "docs.find" });
+        } catch (err) {
+          const code = err instanceof Error && typeof err.code === "string" ? err.code : "E_DOCS_FIND_FAILED";
+          const message = err instanceof Error ? err.message : String(err);
+          cliError(`docs find failed: ${message}`, 1 /* GENERAL_ERROR */, { name: code });
+          process.exit(1 /* GENERAL_ERROR */);
+        }
+      }
+    });
     mergeCommand = defineCommand({
       meta: {
         name: "merge",
@@ -45284,10 +46346,10 @@ var init_docs3 = __esm({
         }
       }
     });
-    graphCommand = defineCommand({
+    rankCommand = defineCommand({
       meta: {
-        name: "graph",
-        description: "Build a document relationship graph for an entity using llmtxt/graph.buildGraph. Output formats: mermaid (default), dot, json."
+        name: "rank",
+        description: "Rank attachments for an entity by relevance using llmtxt/similarity.rankBySimilarity. Pass --query to use a custom query; otherwise the entity ID anchors the ranking."
       },
       args: {
         for: {
@@ -45295,13 +46357,9 @@ var init_docs3 = __esm({
           description: "Owner entity ID (T###, ses_*, O-*)",
           required: true
         },
-        format: {
-          type: "string",
-          description: "Output format: mermaid | dot | json (default: mermaid)"
-        },
-        out: {
+        query: {
           type: "string",
-          description: "Write graph to this file path"
+          description: "Optional free-text query to rank against (default: owner ID)"
         },
         json: {
           type: "boolean",
@@ -45310,89 +46368,105 @@ var init_docs3 = __esm({
       },
       async run({ args }) {
         const projectRoot = getProjectRoot38();
-        const fmt = args.format ?? "mermaid";
         try {
-          const result = await buildDocsGraph({ ownerId: String(args.for), projectRoot });
-          let output2;
-          if (fmt === "dot") {
-            const dotLines = ["digraph docs {"];
-            for (const node of result.nodes) {
-              dotLines.push(`  "${node.id}" [label="${node.label}"];`);
-            }
-            for (const edge of result.edges) {
-              dotLines.push(`  "${edge.source}" -> "${edge.target}" [label="${edge.relation}"];`);
-            }
-            dotLines.push("}");
-            output2 = dotLines.join("\n");
-          } else if (fmt === "json") {
-            output2 = JSON.stringify(result, null, 2);
-          } else {
-            const lines = ["graph LR"];
-            for (const edge of result.edges) {
-              lines.push(`  ${edge.source} -->|${edge.relation}| ${edge.target}`);
-            }
-            if (result.edges.length === 0) {
-              for (const node of result.nodes) {
-                lines.push(`  ${node.id}["${node.label}"]`);
-              }
-            }
-            output2 = lines.join("\n");
-          }
-          if (typeof args.out === "string" && args.out.length > 0) {
-            const outPath = isAbsolute2(args.out) ? args.out : resolve5(projectRoot, args.out);
-            await mkdir2(dirname8(outPath), { recursive: true });
-            await writeFile2(outPath, output2, "utf8");
-            humanInfo(`Wrote graph to ${outPath}`);
-          }
-          cliOutput(
-            { format: fmt, nodeCount: result.nodes.length, edgeCount: result.edges.length, output: output2 },
-            { command: "docs graph", operation: "docs.graph" }
-          );
+          const result = await rankDocs({
+            ownerId: String(args.for),
+            query: args.query ?? void 0,
+            projectRoot
+          });
+          cliOutput(result, { command: "docs rank", operation: "docs.rank" });
         } catch (err) {
           const message = err instanceof Error ? err.message : String(err);
-          cliError(`docs graph failed: ${message}`, 1 /* GENERAL_ERROR */, {
-            name: "E_DOCS_GRAPH_FAILED"
+          cliError(`docs rank failed: ${message}`, 1 /* GENERAL_ERROR */, {
+            name: "E_DOCS_RANK_FAILED"
           });
           process.exit(1 /* GENERAL_ERROR */);
         }
       }
     });
-    rankCommand = defineCommand({
+    updateCommand = defineCommand({
       meta: {
-        name: "rank",
-        description: "Rank attachments for an entity by relevance using llmtxt/similarity.rankBySimilarity. Pass --query to use a custom query; otherwise the entity ID anchors the ranking."
+        name: "update",
+        description: 'Replace blob content for an existing slug while preserving the slug. Pass --file <path> OR --content <text> (exactly one). Defaults --status to "draft" on every update so explicit `accepted` docs get back-pressured to draft on edit. Audit log entry appended to .cleo/audit/docs-versioning.jsonl (squashed within 5 min).\n\nPositional arguments:\n  <slug>                 Slug of the attachment to update (required)\n\nNamed arguments:\n  --file <path>          Local file containing the new content\n  --content <text>       Inline UTF-8 content (mutually exclusive with --file)\n  --message <text>       One-line summary of the change (audit log)\n  --status <status>      Override lifecycle status \u2014 default "draft"\n  --attached-by <name>   Agent identity for this revision (default "human")'
       },
       args: {
-        for: {
-          type: "string",
-          description: "Owner entity ID (T###, ses_*, O-*)",
+        slug: {
+          type: "positional",
+          description: "Slug of the attachment to update",
           required: true
         },
-        query: {
+        file: {
           type: "string",
-          description: "Optional free-text query to rank against (default: owner ID)"
+          description: "Local file containing the new content"
         },
-        json: {
-          type: "boolean",
-          description: "Emit LAFS JSON envelope"
+        content: {
+          type: "string",
+          description: "Inline UTF-8 content (mutually exclusive with --file)"
+        },
+        message: {
+          type: "string",
+          description: "One-line summary of the change (recorded in the audit log)"
+        },
+        status: {
+          type: "string",
+          description: "Lifecycle status to set on the new row. Valid: draft|proposed|accepted|superseded|archived|deprecated. Default: draft."
+        },
+        "attached-by": {
+          type: "string",
+          description: 'Agent identity that performed the update (default: "human")'
         }
       },
-      async run({ args }) {
-        const projectRoot = getProjectRoot38();
+      async run({ args, rawArgs }) {
         try {
-          const result = await rankDocs({
-            ownerId: String(args.for),
-            query: args.query ?? void 0,
-            projectRoot
-          });
-          cliOutput(result, { command: "docs rank", operation: "docs.rank" });
+          assertKnownFlags(rawArgs, updateCommand.args, "docs update");
         } catch (err) {
-          const message = err instanceof Error ? err.message : String(err);
-          cliError(`docs rank failed: ${message}`, 1 /* GENERAL_ERROR */, {
-            name: "E_DOCS_RANK_FAILED"
+          if (err instanceof UnknownFlagError) {
+            cliError(err.message, 6 /* VALIDATION_ERROR */, {
+              name: err.code,
+              fix: err.fix,
+              alternatives: err.suggestions.map((s) => ({ action: s, command: s })),
+              details: { flag: err.flag, knownFlags: err.knownFlags }
+            });
+            process.exit(6 /* VALIDATION_ERROR */);
+          }
+          throw err;
+        }
+        const slug = String(args.slug);
+        const filePath = typeof args.file === "string" ? args.file : void 0;
+        const inlineContent = typeof args.content === "string" ? args.content : void 0;
+        if (filePath !== void 0 && inlineContent !== void 0) {
+          cliError("--file and --content are mutually exclusive", 6 /* VALIDATION_ERROR */, {
+            name: "E_VALIDATION",
+            fix: "Use `cleo docs update <slug> --file <path>` OR `--content <text>` (not both)."
           });
-          process.exit(1 /* GENERAL_ERROR */);
+          process.exit(6 /* VALIDATION_ERROR */);
+        }
+        if (filePath === void 0 && inlineContent === void 0) {
+          cliError("provide --file <path> OR --content <text>", 6 /* VALIDATION_ERROR */, {
+            name: "E_VALIDATION",
+            fix: 'Example: `cleo docs update my-doc --file ./new.md` OR `cleo docs update my-doc --content "..."`.'
+          });
+          process.exit(6 /* VALIDATION_ERROR */);
         }
+        let resolvedFile;
+        if (filePath !== void 0) {
+          const routing = resolveWorktreeRouting2();
+          resolvedFile = resolveWorktreeFilePath(filePath, routing);
+        }
+        await dispatchFromCli(
+          "mutate",
+          "docs",
+          "update",
+          {
+            slug,
+            ...resolvedFile !== void 0 ? { file: resolvedFile } : {},
+            ...inlineContent !== void 0 ? { content: inlineContent } : {},
+            ...typeof args.message === "string" ? { message: args.message } : {},
+            ...typeof args.status === "string" ? { status: args.status } : {},
+            ...typeof args["attached-by"] === "string" ? { attachedBy: args["attached-by"] } : {}
+          },
+          { command: "docs update" }
+        );
       }
     });
     versionsCommand = defineCommand({
@@ -45901,13 +46975,17 @@ var init_docs3 = __esm({
       },
       subCommands: {
         add: addCommand5,
+        update: updateCommand,
         list: listCommand8,
         fetch: fetchCommand,
         remove: removeCommand2,
+        supersede: supersedeCommand,
         generate: generateCommand,
         export: exportCommand4,
+        find: findCommand3,
         search: searchCommand,
         merge: mergeCommand,
+        // T10164 — DocProvenanceResponse-typed graph (`--root <slug>|<taskId>`).
         graph: graphCommand,
         rank: rankCommand,
         versions: versionsCommand,
@@ -46349,6 +47427,7 @@ var ProgressTracker;
 var init_progress = __esm({
   "packages/cleo/src/cli/progress.ts"() {
     "use strict";
+    init_format_context();
     ProgressTracker = class {
       enabled;
       prefix;
@@ -46365,7 +47444,7 @@ var init_progress = __esm({
        * Start the progress tracker.
        */
       start() {
-        if (!this.enabled) return;
+        if (!this.enabled || isQuiet()) return;
         this.currentStep = 0;
         stderr.write(`
 ${this.prefix}: Starting...
@@ -46375,7 +47454,7 @@ ${this.prefix}: Starting...
        * Update to a specific step.
        */
       step(index, message) {
-        if (!this.enabled) return;
+        if (!this.enabled || isQuiet()) return;
         this.currentStep = index;
         const stepName = this.steps[index] ?? message ?? "Working...";
         const progress = `[${index + 1}/${this.totalSteps}]`;
@@ -46397,7 +47476,7 @@ ${this.prefix}: Starting...
        * one JSON object per CLI invocation (ADR-039 / T927).
        */
       complete(summary) {
-        if (!this.enabled) return;
+        if (!this.enabled || isQuiet()) return;
         if (summary) {
           stderr.write(`
 ${this.prefix}: \u2713 ${summary}
@@ -46414,7 +47493,7 @@ ${this.prefix}: \u2713 Complete
        * Report an error.
        */
       error(message) {
-        if (!this.enabled) return;
+        if (!this.enabled || isQuiet()) return;
         stderr.write(`
 ${this.prefix}: \u2717 ${message}
 
@@ -46424,6 +47503,254 @@ ${this.prefix}: \u2717 ${message}
   }
 });
 
+// packages/cleo/src/cli/commands/doctor-release-readiness.ts
+import { existsSync as existsSync13 } from "node:fs";
+import { join as join22, resolve as resolve6 } from "node:path";
+async function runCheck(name, cmd, args, cwd) {
+  const { spawnSync } = await import("node:child_process");
+  const start = Date.now();
+  const result = spawnSync(cmd, args, {
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "pipe"],
+    cwd
+  });
+  const durationMs = Date.now() - start;
+  const passed = result.status === 0;
+  return {
+    name,
+    status: passed ? "pass" : "fail",
+    exitCode: result.status,
+    durationMs,
+    stdout: (result.stdout ?? "").trim(),
+    stderr: (result.stderr ?? "").trim()
+  };
+}
+var doctorReleaseReadinessCommand;
+var init_doctor_release_readiness = __esm({
+  "packages/cleo/src/cli/commands/doctor-release-readiness.ts"() {
+    "use strict";
+    init_define_cli_command();
+    init_renderers();
+    doctorReleaseReadinessCommand = defineCommand({
+      meta: {
+        name: "release-readiness",
+        description: "Pre-flight release readiness check \u2014 lint matrix + changelog + changeset + npm OIDC + tag-trigger sanity (T10458)"
+      },
+      args: {
+        json: { type: "boolean", description: "Output as JSON" },
+        human: { type: "boolean", description: "Force human-readable output" },
+        quiet: { type: "boolean", description: "Suppress non-essential output" }
+      },
+      async run({ args }) {
+        const isHuman = args.human === true || !!process.stdout.isTTY && args.json !== true;
+        const repoRoot = resolve6(process.cwd());
+        const startTotal = Date.now();
+        const checks = [];
+        const biomePath = join22(repoRoot, "node_modules", ".bin", "biome");
+        const biomeAvailable = existsSync13(biomePath);
+        if (biomeAvailable) {
+          checks.push(await runCheck("biome-lint", biomePath, ["ci", "."], repoRoot));
+        } else {
+          checks.push({
+            name: "biome-lint",
+            status: "skip",
+            exitCode: null,
+            durationMs: 0,
+            stdout: "",
+            stderr: "biome not found in node_modules/.bin \u2014 skipping"
+          });
+        }
+        const changesetLintScript = join22(repoRoot, "scripts", "lint-changesets.mjs");
+        if (existsSync13(changesetLintScript)) {
+          checks.push(await runCheck("changeset-lint", "node", [changesetLintScript], repoRoot));
+        } else {
+          checks.push({
+            name: "changeset-lint",
+            status: "skip",
+            exitCode: null,
+            durationMs: 0,
+            stdout: "",
+            stderr: "scripts/lint-changesets.mjs not found \u2014 skipping"
+          });
+        }
+        const changelogPath = join22(repoRoot, "CHANGELOG.md");
+        const changelogExists = existsSync13(changelogPath);
+        const changelogCheck = {
+          name: "changelog-exists",
+          status: changelogExists ? "pass" : "fail",
+          exitCode: changelogExists ? 0 : 1,
+          durationMs: 0,
+          stdout: changelogExists ? `Found ${changelogPath}` : "",
+          stderr: changelogExists ? "" : `CHANGELOG.md not found at ${changelogPath}`
+        };
+        checks.push(changelogCheck);
+        const packageJsonPath = join22(repoRoot, "package.json");
+        let oidcCheck;
+        if (existsSync13(packageJsonPath)) {
+          try {
+            const pkg = JSON.parse(
+              await import("node:fs").then((m) => m.readFileSync(packageJsonPath, "utf8"))
+            );
+            const hasPublishConfig = typeof pkg.publishConfig === "object" && pkg.publishConfig !== null;
+            const accessPublic = hasPublishConfig && pkg.publishConfig.access === "public";
+            oidcCheck = {
+              name: "npm-oidc-sanity",
+              status: accessPublic ? "pass" : "fail",
+              exitCode: accessPublic ? 0 : 1,
+              durationMs: 0,
+              stdout: accessPublic ? "package.json has publishConfig.access=public" : "",
+              stderr: accessPublic ? "" : "package.json missing publishConfig.access=public \u2014 required for npm OIDC Trusted Publishing"
+            };
+          } catch {
+            oidcCheck = {
+              name: "npm-oidc-sanity",
+              status: "fail",
+              exitCode: 1,
+              durationMs: 0,
+              stdout: "",
+              stderr: "Failed to parse package.json"
+            };
+          }
+        } else {
+          oidcCheck = {
+            name: "npm-oidc-sanity",
+            status: "fail",
+            exitCode: 1,
+            durationMs: 0,
+            stdout: "",
+            stderr: "package.json not found"
+          };
+        }
+        checks.push(oidcCheck);
+        const tagWorkflowPath = join22(repoRoot, ".github", "workflows", "auto-tag-on-release-merge.yml");
+        const tagWorkflowExists = existsSync13(tagWorkflowPath);
+        let tagTriggerCheck;
+        if (tagWorkflowExists) {
+          try {
+            const content = await import("node:fs").then(
+              (m) => m.readFileSync(tagWorkflowPath, "utf8")
+            );
+            const hasName = content.includes("name:");
+            const hasOnTrigger = content.includes("on:") || content.includes("pull_request:");
+            const valid = hasName && hasOnTrigger;
+            tagTriggerCheck = {
+              name: "tag-trigger-sanity",
+              status: valid ? "pass" : "fail",
+              exitCode: valid ? 0 : 1,
+              durationMs: 0,
+              stdout: valid ? `Valid workflow at ${tagWorkflowPath}` : "",
+              stderr: valid ? "" : "auto-tag-on-release-merge.yml appears malformed"
+            };
+          } catch {
+            tagTriggerCheck = {
+              name: "tag-trigger-sanity",
+              status: "fail",
+              exitCode: 1,
+              durationMs: 0,
+              stdout: "",
+              stderr: "Failed to read auto-tag-on-release-merge.yml"
+            };
+          }
+        } else {
+          tagTriggerCheck = {
+            name: "tag-trigger-sanity",
+            status: "fail",
+            exitCode: 1,
+            durationMs: 0,
+            stdout: "",
+            stderr: `.github/workflows/auto-tag-on-release-merge.yml not found`
+          };
+        }
+        checks.push(tagTriggerCheck);
+        const tsconfigPath = join22(repoRoot, "tsconfig.json");
+        if (existsSync13(tsconfigPath)) {
+          const tscPath = join22(repoRoot, "node_modules", ".bin", "tsc");
+          if (existsSync13(tscPath)) {
+            checks.push(await runCheck("typecheck", tscPath, ["--noEmit"], repoRoot));
+          } else {
+            checks.push({
+              name: "typecheck",
+              status: "skip",
+              exitCode: null,
+              durationMs: 0,
+              stdout: "",
+              stderr: "tsc not found in node_modules/.bin \u2014 skipping"
+            });
+          }
+        } else {
+          checks.push({
+            name: "typecheck",
+            status: "skip",
+            exitCode: null,
+            durationMs: 0,
+            stdout: "",
+            stderr: "tsconfig.json not found \u2014 skipping"
+          });
+        }
+        const fastLintScripts = [
+          { name: "contracts-dep-lint", script: "scripts/lint-contracts-dep.mjs" },
+          { name: "format-error-lint", script: "scripts/lint-format-error-misuse.mjs" },
+          { name: "json-stream-lint", script: "scripts/lint-json-stream-hygiene.mjs" }
+        ];
+        for (const lint of fastLintScripts) {
+          const scriptPath = join22(repoRoot, lint.script);
+          if (existsSync13(scriptPath)) {
+            checks.push(await runCheck(lint.name, "node", [scriptPath], repoRoot));
+          } else {
+            checks.push({
+              name: lint.name,
+              status: "skip",
+              exitCode: null,
+              durationMs: 0,
+              stdout: "",
+              stderr: `${lint.script} not found \u2014 skipping`
+            });
+          }
+        }
+        const passCount = checks.filter((c) => c.status === "pass").length;
+        const failCount = checks.filter((c) => c.status === "fail").length;
+        const skipCount = checks.filter((c) => c.status === "skip").length;
+        const totalDurationMs = Date.now() - startTotal;
+        const ready = failCount === 0;
+        const result = {
+          ready,
+          checks,
+          summary: {
+            pass: passCount,
+            fail: failCount,
+            skip: skipCount,
+            total: checks.length,
+            durationMs: totalDurationMs
+          }
+        };
+        if (isHuman && args.json !== true) {
+          humanLine("\nRelease Readiness Check (T10458)\n");
+          humanLine(`${"\u2500".repeat(60)}`);
+          for (const c of checks) {
+            const icon = c.status === "pass" ? "PASS" : c.status === "fail" ? "FAIL" : "SKIP";
+            humanLine(`  [${icon}] ${c.name} (${c.durationMs}ms)`);
+            if (c.status === "fail" && c.stderr) {
+              const lines = c.stderr.split("\n").slice(0, 3);
+              for (const line of lines) {
+                humanLine(`         ${line}`);
+              }
+            }
+          }
+          humanLine(`${"\u2500".repeat(60)}`);
+          humanLine(`  Result: ${passCount} passed, ${failCount} failed, ${skipCount} skipped`);
+          humanLine(`  Total time: ${totalDurationMs}ms`);
+          humanLine(`  Ready: ${ready ? "YES" : "NO"}
+`);
+        }
+        cliOutput(result, { command: "doctor", operation: "doctor.release-readiness" });
+        if (!ready) {
+          process.exitCode = 1;
+        }
+      }
+    });
+  }
+});
+
 // packages/cleo/src/cli/commands/migrate-agents-v2.ts
 var migrate_agents_v2_exports = {};
 __export(migrate_agents_v2_exports, {
@@ -46434,8 +47761,8 @@ __export(migrate_agents_v2_exports, {
   walkAgentsDir: () => walkAgentsDir
 });
 import { createHash as createHash2 } from "node:crypto";
-import { appendFileSync as appendFileSync2, existsSync as existsSync13, mkdirSync as mkdirSync3, readdirSync as readdirSync2, readFileSync as readFileSync13 } from "node:fs";
-import { join as join22 } from "node:path";
+import { appendFileSync as appendFileSync2, existsSync as existsSync14, mkdirSync as mkdirSync3, readdirSync as readdirSync2, readFileSync as readFileSync13 } from "node:fs";
+import { join as join23 } from "node:path";
 import { getProjectRoot as getProjectRoot41, installAgentFromCant } from "@cleocode/core/internal";
 import { openCleoDb as openCleoDb2 } from "@cleocode/core/store/open-cleo-db";
 function sha256Hex(bytes) {
@@ -46455,15 +47782,15 @@ function extractAgentName(source) {
   return headerMatch[1] ?? null;
 }
 function appendAuditLog(projectRoot, entry) {
-  const auditPath = join22(projectRoot, AUDIT_LOG_RELATIVE);
-  const auditDir = join22(auditPath, "..");
-  if (!existsSync13(auditDir)) {
+  const auditPath = join23(projectRoot, AUDIT_LOG_RELATIVE);
+  const auditDir = join23(auditPath, "..");
+  if (!existsSync14(auditDir)) {
     mkdirSync3(auditDir, { recursive: true });
   }
   appendFileSync2(auditPath, JSON.stringify(entry) + "\n", "utf8");
 }
 function walkAgentsDir(db, scanDir, projectRoot, summary, verbose) {
-  if (!existsSync13(scanDir)) return;
+  if (!existsSync14(scanDir)) return;
   let files;
   try {
     files = readdirSync2(scanDir).filter((f) => f.endsWith(".cant"));
@@ -46474,7 +47801,7 @@ function walkAgentsDir(db, scanDir, projectRoot, summary, verbose) {
     return;
   }
   for (const filename of files) {
-    const cantPath = join22(scanDir, filename);
+    const cantPath = join23(scanDir, filename);
     const relPath = cantPath.replace(`${projectRoot}/`, "");
     let sourceBytes;
     let sourceText;
@@ -46571,9 +47898,9 @@ async function runMigrateAgentsV2(projectRoot, verbose = true) {
   const { db: _sdDb } = await openCleoDb2("signaldock");
   const db = _sdDb;
   try {
-    const canonicalDir = join22(projectRoot, ".cleo", "cant", "agents");
+    const canonicalDir = join23(projectRoot, ".cleo", "cant", "agents");
     walkAgentsDir(db, canonicalDir, projectRoot, summary, verbose);
-    const legacyDir = join22(projectRoot, ".cleo", "agents");
+    const legacyDir = join23(projectRoot, ".cleo", "agents");
     walkAgentsDir(db, legacyDir, projectRoot, summary, verbose);
   } finally {
     db.close();
@@ -46581,8 +47908,8 @@ async function runMigrateAgentsV2(projectRoot, verbose = true) {
   return summary;
 }
 function readMigrationConflicts(projectRoot) {
-  const auditPath = join22(projectRoot, AUDIT_LOG_RELATIVE);
-  if (!existsSync13(auditPath)) return [];
+  const auditPath = join23(projectRoot, AUDIT_LOG_RELATIVE);
+  if (!existsSync14(auditPath)) return [];
   let raw;
   try {
     raw = readFileSync13(auditPath, "utf8");
@@ -46666,7 +47993,7 @@ __export(doctor_exports, {
   doctorCommand: () => doctorCommand2
 });
 import { mkdirSync as mkdirSync4, writeFileSync as writeFileSync4 } from "node:fs";
-import { join as join23 } from "node:path";
+import { join as join24 } from "node:path";
 import { getProjectRoot as getProjectRoot42, pushWarning as pushWarning4 } from "@cleocode/core";
 import { renderInvariantAuditLines } from "@cleocode/core/doctor/invariant-audit-render.js";
 import {
@@ -46706,8 +48033,8 @@ async function scanTestFixturesInProd(projectRoot) {
 }
 async function quarantineTestFixtures(projectRoot, matches) {
   if (matches.length === 0) return 0;
-  const cleoDir = join23(projectRoot, ".cleo");
-  const quarantineDir = join23(
+  const cleoDir = join24(projectRoot, ".cleo");
+  const quarantineDir = join24(
     cleoDir,
     "quarantine",
     `fixture-scan-${(/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-")}`
@@ -46715,7 +48042,7 @@ async function quarantineTestFixtures(projectRoot, matches) {
   mkdirSync4(quarantineDir, { recursive: true });
   const manifest = matches.map((m) => ({ ...m, quarantinedAt: (/* @__PURE__ */ new Date()).toISOString() }));
   writeFileSync4(
-    join23(quarantineDir, "manifest.jsonl"),
+    join24(quarantineDir, "manifest.jsonl"),
     manifest.map((m) => JSON.stringify(m)).join("\n") + "\n"
   );
   const { getNativeDb } = await import("@cleocode/core/store/sqlite.js");
@@ -46786,6 +48113,7 @@ var init_doctor = __esm({
     init_doctor_db_substrate();
     init_doctor_legacy_backups();
     init_doctor_projects();
+    init_doctor_release_readiness();
     init_migrate_agents_v2();
     FIXTURE_ID_PATTERNS = [/^E\d+$/, /^T\d+EP$/];
     FIXTURE_TITLE_KEYWORDS = [
@@ -46800,7 +48128,9 @@ var init_doctor = __esm({
         // T10307 / Saga T10281 / Epic T10282 — DB-substrate walker
         "db-substrate": doctorDbSubstrateCommand,
         // T10309 / Saga T10281 / Epic T10282 — Legacy-backup walker
-        "legacy-backups": doctorLegacyBackupsCommand
+        "legacy-backups": doctorLegacyBackupsCommand,
+        // T10458 / Saga T10431 / Epic T10436 — Release-readiness preflight
+        "release-readiness": doctorReleaseReadinessCommand
       },
       args: {
         detailed: {
@@ -47289,8 +48619,8 @@ var init_doctor = __esm({
               );
               return;
             }
-            const archiveDir = join23(projectRoot, ".cleo", "backups");
-            const auditLogPath = join23(projectRoot, ".cleo", "audit", "worktree-prune.jsonl");
+            const archiveDir = join24(projectRoot, ".cleo", "backups");
+            const auditLogPath = join24(projectRoot, ".cleo", "audit", "worktree-prune.jsonl");
             const result = await pruneWorktreeOrphans(orphans, {
               archiveDir,
               auditLogPath,
@@ -47454,7 +48784,7 @@ __export(event_exports, {
   orchestratorCommand: () => orchestratorCommand
 });
 import { readdir as readdir2 } from "node:fs/promises";
-import { join as join24 } from "node:path";
+import { join as join25 } from "node:path";
 import { cwd as processCwd } from "node:process";
 import { appendEvent } from "@cleocode/core/events/event-bus.js";
 function resolveProjectRoot3(arg) {
@@ -47577,7 +48907,7 @@ var init_event = __esm({
         const agentIdFilter = args.agent;
         const showAll = args.all === true;
         const lines = parseInt(args.lines ?? "20", 10);
-        const eventsDir = join24(projectRoot, ".cleo", "agent-events");
+        const eventsDir = join25(projectRoot, ".cleo", "agent-events");
         try {
           let files = [];
           try {
@@ -47615,7 +48945,7 @@ var init_event = __esm({
           for (const file of filesToTail) {
             const agentId = file.replace(".jsonl", "");
             const { readFileSync: readFileSync21 } = await import("node:fs");
-            const content = readFileSync21(join24(eventsDir, file), "utf-8");
+            const content = readFileSync21(join25(eventsDir, file), "utf-8");
             const eventLines = content.trim().split("\n").filter(Boolean);
             const tail = eventLines.slice(-lines);
             if (jsonMode) {
@@ -47685,7 +49015,7 @@ var init_event = __esm({
         const epicFilter = args.epic;
         const follow = args.follow === true;
         const lines = parseInt(args.lines ?? "50", 10);
-        const eventsDir = join24(projectRoot, ".cleo", "agent-events");
+        const eventsDir = join25(projectRoot, ".cleo", "agent-events");
         let files = [];
         try {
           const entries = await readdir2(eventsDir);
@@ -47711,7 +49041,7 @@ var init_event = __esm({
           const agentId = file.replace(".jsonl", "");
           try {
             const { readFileSync: readFileSync21 } = await import("node:fs");
-            const content = readFileSync21(join24(eventsDir, file), "utf-8");
+            const content = readFileSync21(join25(eventsDir, file), "utf-8");
             const eventLines = content.trim().split("\n").filter(Boolean);
             const tail = eventLines.slice(-lines);
             if (jsonMode) {
@@ -48129,10 +49459,10 @@ var init_federation = __esm({
 // packages/cleo/src/cli/commands/find.ts
 var find_exports = {};
 __export(find_exports, {
-  findCommand: () => findCommand3
+  findCommand: () => findCommand4
 });
 import { createPage } from "@cleocode/core";
-var findCommand3;
+var findCommand4;
 var init_find = __esm({
   "packages/cleo/src/cli/commands/find.ts"() {
     "use strict";
@@ -48140,7 +49470,7 @@ var init_find = __esm({
     init_dist();
     init_cli();
     init_renderers();
-    findCommand3 = defineCommand({
+    findCommand4 = defineCommand({
       meta: { name: "find", description: "Fuzzy search tasks by title/description" },
       args: {
         query: {
@@ -48159,7 +49489,16 @@ var init_find = __esm({
         limit: { type: "string", description: "Max results (default: 20)" },
         offset: { type: "string", description: "Skip first N results" },
         fields: { type: "string", description: "Comma-separated additional fields to include" },
-        verbose: { type: "boolean", description: "Include all task fields", alias: "v" },
+        verbose: {
+          type: "boolean",
+          description: "Return full task records instead of the MVI projection (id + title + status + key metadata). T9922.",
+          alias: "v"
+        },
+        // T9922 — MVI record projection opt-out alias (surfaced for --help).
+        full: {
+          type: "boolean",
+          description: "Alias for --verbose. T9922."
+        },
         /**
          * Filter by task kind axis (T944/T9072).
          * Values: work | research | experiment | bug | spike | release
@@ -48167,6 +49506,47 @@ var init_find = __esm({
         kind: {
           type: "string",
           description: "Filter by kind axis (work|research|experiment|bug|spike|release) \u2014 T944"
+        },
+        /**
+         * Unified urgency surface (T9905).
+         *
+         * Selects tasks where
+         *   priority IN ('critical','high') OR severity IN ('P0','P1')
+         *
+         * Combines the two orthogonal urgency axes (priority + severity) into a
+         * single filter so agents don't have to query each axis separately.
+         */
+        urgent: {
+          type: "boolean",
+          description: "Surface urgent work across both axes: priority IN (critical,high) OR severity IN (P0,P1) (T9905)",
+          alias: "u"
+        },
+        /**
+         * Filter by label — `cleo find --label <name>` returns every task
+         * whose `labels[]` includes the given value. Closes GH#393 and gives
+         * `find` parity with the positional `cleo labels <name>` surface.
+         * @task T9904
+         */
+        label: {
+          type: "string",
+          description: "Filter by label \u2014 return tasks whose labels[] includes this value (T9904)"
+        },
+        /**
+         * Filter by parent task ID — `cleo find --parent <id>` returns only
+         * tasks whose `parentId` matches. Mirrors the `--parent` axis on
+         * `cleo list`. When the parent target is a Saga (Epic with
+         * `label='saga'`), routing goes through `task_relations.type='groups'`
+         * member IDs (ADR-073 §1) — same path as `cleo list --parent`.
+         *
+         * Closes T10108 — pre-fix the flag was missing entirely AND empty-string
+         * queries bypassed every filter via `fuzzyScore('', '<title>')===80`.
+         *
+         * @task T10108
+         * @saga T9862
+         */
+        parent: {
+          type: "string",
+          description: "Filter by parent task ID \u2014 Saga-aware via task_relations groups (ADR-073 \xA71) (T10108)"
         }
       },
       async run({ args }) {
@@ -48184,6 +49564,9 @@ var init_find = __esm({
         if (args.fields !== void 0) params["fields"] = args.fields;
         if (args.verbose !== void 0) params["verbose"] = args.verbose;
         if (args.kind !== void 0) params["kind"] = args.kind;
+        if (args.urgent !== void 0) params["urgent"] = args.urgent;
+        if (args.label !== void 0) params["label"] = args.label;
+        if (args.parent !== void 0) params["parent"] = args.parent;
         const response = await dispatchRaw("query", "tasks", "find", params);
         if (!response.success) {
           handleRawError(response, { command: "find", operation: "tasks.find" });
@@ -48250,7 +49633,7 @@ __export(gc_exports, {
   gcCommand: () => gcCommand
 });
 import { homedir as homedir4, tmpdir } from "node:os";
-import { join as join25 } from "node:path";
+import { join as join26 } from "node:path";
 import { pruneOrphanTempDirs, pruneOrphanWorktrees } from "@cleocode/core/gc/cleanup.js";
 import { runGC } from "@cleocode/core/gc/runner.js";
 import { readGCState } from "@cleocode/core/gc/state.js";
@@ -48333,7 +49716,7 @@ var init_gc = __esm({
       },
       async run({ args }) {
         const cleoDir = resolveLegacyCleoDir3(args["cleo-dir"]);
-        const statePath = join25(cleoDir, "gc-state.json");
+        const statePath = join26(cleoDir, "gc-state.json");
         try {
           const state = await readGCState(statePath);
           const diskStr = state.lastDiskUsedPct !== null ? `${state.lastDiskUsedPct.toFixed(1)}%` : "unknown";
@@ -48386,8 +49769,8 @@ var init_gc = __esm({
         }
       },
       async run({ args }) {
-        const xdgData = process.env["XDG_DATA_HOME"] ?? join25(homedir4(), ".local", "share");
-        const worktreesRoot = args["worktrees-root"] ?? join25(xdgData, "cleo", "worktrees");
+        const xdgData = process.env["XDG_DATA_HOME"] ?? join26(homedir4(), ".local", "share");
+        const worktreesRoot = args["worktrees-root"] ?? join26(xdgData, "cleo", "worktrees");
         const projectHash = args["project-hash"];
         const dryRun = args["dry-run"];
         const preserveRaw = args["preserve-tasks"];
@@ -48540,7 +49923,7 @@ function applyJsonFlag(jsonFlag) {
   }
 }
 var statusCommand9, resolveCommand, depsCommand2, rawCommand, discoverCommand, searchCommand2, augmentCommand, contextCommand2, impactCommand2, impactFullCommand, clustersCommand, flowsCommand, diffCommand, routeMapCommand, shapeCheckCommand, searchCodeCommand, wikiCommand, hotPathsCommand, hotNodesCommand, coldSymbolsCommand, orphansCommand, queryCommand, initCommand, syncCommand4, reconcileCommand, livingFullContextCommand, livingTaskFootprintCommand, livingBrainAnchorsCommand, livingWhyCommand, livingConduitScanCommand, livingCommand, graphCommand2;
-var init_graph2 = __esm({
+var init_graph3 = __esm({
   "packages/cleo/src/cli/commands/graph.ts"() {
     "use strict";
     init_dist();
@@ -49599,24 +50982,25 @@ __export(init_exports, {
   getWorkflowTemplatesDir: () => getWorkflowTemplatesDir2,
   initCommand: () => initCommand2
 });
-import { existsSync as existsSync14, readFileSync as readFileSync14 } from "node:fs";
-import { join as join26 } from "node:path";
+import { existsSync as existsSync15, readFileSync as readFileSync14 } from "node:fs";
+import { join as join27 } from "node:path";
 import { fileURLToPath as fileURLToPath6 } from "node:url";
 import {
   CleoError as CleoError4,
-  formatError as formatError4,
   getWorkflowTemplatesDir as getCoreWorkflowTemplatesDir,
   initProject as initProject2,
+  pushWarning as pushWarning5,
   scaffoldWorkflows
 } from "@cleocode/core";
+import { getTemplatesByKind } from "@cleocode/core/templates/registry";
 function getGitignoreTemplate() {
   try {
     const thisFile = fileURLToPath6(import.meta.url);
-    const packageRoot = join26(thisFile, "..", "..", "..", "..");
-    const localTemplatePath = join26(packageRoot, "templates", "cleo-gitignore");
-    const monorepoTemplatePath = join26(packageRoot, "..", "..", "templates", "cleo-gitignore");
-    const templatePath = existsSync14(localTemplatePath) ? localTemplatePath : monorepoTemplatePath;
-    if (existsSync14(templatePath)) {
+    const packageRoot = join27(thisFile, "..", "..", "..", "..");
+    const localTemplatePath = join27(packageRoot, "templates", "cleo-gitignore");
+    const monorepoTemplatePath = join27(packageRoot, "..", "..", "templates", "cleo-gitignore");
+    const templatePath = existsSync15(localTemplatePath) ? localTemplatePath : monorepoTemplatePath;
+    if (existsSync15(templatePath)) {
       return readFileSync14(templatePath, "utf-8");
     }
   } catch {
@@ -49626,6 +51010,9 @@ function getGitignoreTemplate() {
 function getWorkflowTemplatesDir2() {
   return getCoreWorkflowTemplatesDir();
 }
+function isWorkflowName(id) {
+  return id === "release-prepare" || id === "release-publish" || id === "release-fanout" || id === "release-rollback";
+}
 var initCommand2;
 var init_init = __esm({
   "packages/cleo/src/cli/commands/init.ts"() {
@@ -49666,7 +51053,11 @@ var init_init = __esm({
         },
         workflows: {
           type: "boolean",
-          description: "Scaffold the release-prepare.yml workflow into .github/workflows/ (T9531).",
+          /**
+           * @deprecated Use `cleo templates install --kind workflow` instead
+           * (T9886 / Saga T9855). Removal target: v2026.7.0. T9888.
+           */
+          description: "[DEPRECATED \u2014 use `cleo templates install --kind workflow`] Scaffold release workflows into .github/workflows/. Will be removed in v2026.7.0.",
           default: false
         },
         "dry-run": {
@@ -49678,11 +51069,23 @@ var init_init = __esm({
       async run({ args }) {
         try {
           if (args.workflows) {
+            pushWarning5({
+              code: "W_INIT_WORKFLOWS_DEPRECATED",
+              message: "[deprecated] cleo init --workflows: use `cleo templates install --kind workflow` instead. This alias will be removed in v2026.7.0.",
+              severity: "warn",
+              deprecated: "cleo init --workflows",
+              replacement: "cleo templates install --kind workflow",
+              removeBy: "v2026.7.0",
+              context: { task: "T9888", saga: "T9855" }
+            });
             const projectRoot = process.cwd();
             const templatesDir = getWorkflowTemplatesDir2();
+            const workflowEntries = getTemplatesByKind("workflow");
+            const templates2 = workflowEntries.map((entry) => entry.id).filter((id) => isWorkflowName(id));
             const result2 = await scaffoldWorkflows({
               projectRoot,
               templatesDir,
+              ...templates2.length > 0 ? { templates: templates2 } : {},
               dryRun: !!args["dry-run"],
               force: !!args.force
             });
@@ -49724,7 +51127,7 @@ var init_init = __esm({
           );
         } catch (err) {
           if (err instanceof CleoError4) {
-            cliError(formatError4(err), err.code, { name: "E_INTERNAL" });
+            cliError(`init failed: ${err.message}`, err.code, { name: "E_INTERNAL" });
             process.exit(err.code);
           }
           throw err;
@@ -50209,7 +51612,17 @@ var init_labels = __esm({
     labelsCommand = defineCommand({
       meta: {
         name: "labels",
-        description: "List all labels with counts or show tasks with specific label"
+        description: "List all labels (no args), or show tasks for a label (cleo labels <name>)"
+      },
+      args: {
+        // Optional positional — when present, dispatches to tasks.list with the
+        // label filter; when absent, falls through to the legacy label.list path.
+        // Required:false keeps the bare `cleo labels` invocation working.
+        name: {
+          type: "positional",
+          description: "Label name to filter tasks by (omit to list all labels)",
+          required: false
+        }
       },
       subCommands: {
         list: listCommand10,
@@ -50217,9 +51630,16 @@ var init_labels = __esm({
         stats: statsCommand2
       },
       async run(ctx) {
-        if (!ctx.rawArgs.some((a) => ["list", "show", "stats"].includes(a))) {
-          await dispatchFromCli("query", "tasks", "label.list", {}, { command: "labels" });
+        const rawArgs = ctx.rawArgs ?? [];
+        if (rawArgs.some((a) => ["list", "show", "stats"].includes(a))) {
+          return;
         }
+        const name = ctx.args.name;
+        if (typeof name === "string" && name.length > 0) {
+          await dispatchFromCli("query", "tasks", "list", { label: name }, { command: "labels" });
+          return;
+        }
+        await dispatchFromCli("query", "tasks", "label.list", {}, { command: "labels" });
       }
     });
   }
@@ -50495,6 +51915,20 @@ var init_list3 = __esm({
       "parent-id": {
         type: "string",
         description: "Alias for --parent (legacy parentId compatibility)"
+      },
+      // T9922 — MVI record projection opt-out flags (surfaced for --help).
+      verbose: {
+        type: "boolean",
+        description: "Return full task records instead of the MVI projection (id + title + status + key metadata). T9922."
+      },
+      full: {
+        type: "boolean",
+        description: "Alias for --verbose. T9922."
+      },
+      // T9932 — 1-line-per-record summary render. Global flag; parsed by cli/index.ts.
+      summary: {
+        type: "boolean",
+        description: 'Render each task as a single line "<id> [<status>] <title-truncated-60>". Composes with --output: --output {id|table|count|silent} wins. T9932.'
       }
     };
     listCommand11 = defineCommand({
@@ -50727,7 +52161,7 @@ async function resolveDefaultModel(provider) {
   return profile?.defaultModel ?? IMPLICIT_FALLBACK_MODEL;
 }
 async function runLlmStream(opts) {
-  const stdout = opts.stdout ?? process.stdout;
+  const stdout2 = opts.stdout ?? process.stdout;
   const stderr2 = opts.stderr ?? process.stderr;
   const session = opts._sessionOverride ?? await buildSession(opts.provider, opts.model ?? await resolveDefaultModel(opts.provider));
   const sendOpts = {
@@ -50738,7 +52172,7 @@ async function runLlmStream(opts) {
   const stream = session.stream(messages, sendOpts);
   for await (const delta of stream) {
     if (delta.text) {
-      stdout.write(delta.text);
+      stdout2.write(delta.text);
     }
     if (delta.reasoning && opts.showThink) {
       stderr2.write(delta.reasoning);
@@ -50983,7 +52417,7 @@ async function _headlessPkceFlow(provider, authUrl) {
     `  After approving, paste the full redirect URL (http://localhost?code=\u2026&state=\u2026):
   `
   );
-  return new Promise((resolve8, reject) => {
+  return new Promise((resolve9, reject) => {
     let buf = "";
     process.stdin.setEncoding("utf8");
     process.stdin.once("data", (chunk) => {
@@ -50995,7 +52429,7 @@ async function _headlessPkceFlow(provider, authUrl) {
           reject(new Error('Redirect URL is missing the "code" parameter'));
           return;
         }
-        resolve8(code);
+        resolve9(code);
       } catch {
         reject(new Error(`Invalid redirect URL: ${buf}`));
       }
@@ -51003,7 +52437,7 @@ async function _headlessPkceFlow(provider, authUrl) {
   });
 }
 async function _localCallbackPkceFlow(provider, authUrl, expectedState, port) {
-  return new Promise((resolve8) => {
+  return new Promise((resolve9) => {
     const server = createServer2((req, res) => {
       const url = new URL(req.url ?? "/", `http://localhost:${port}`);
       const code = url.searchParams.get("code");
@@ -51013,7 +52447,7 @@ async function _localCallbackPkceFlow(provider, authUrl, expectedState, port) {
       if (error) {
         res.end(`<h1>Authorization failed</h1><p>${error}</p><p>You may close this tab.</p>`);
         server.close();
-        resolve8({
+        resolve9({
           error: {
             code: "E_PKCE_AUTH_DENIED",
             codeName: "E_PKCE_AUTH_DENIED",
@@ -51025,7 +52459,7 @@ async function _localCallbackPkceFlow(provider, authUrl, expectedState, port) {
       if (!code || state !== expectedState) {
         res.end("<h1>Invalid callback</h1><p>You may close this tab.</p>");
         server.close();
-        resolve8({
+        resolve9({
           error: {
             code: "E_PKCE_INVALID_CALLBACK",
             codeName: "E_PKCE_INVALID_CALLBACK",
@@ -51036,7 +52470,7 @@ async function _localCallbackPkceFlow(provider, authUrl, expectedState, port) {
       }
       res.end("<h1>Authorized</h1><p>You may close this tab and return to your terminal.</p>");
       server.close();
-      resolve8({ code });
+      resolve9({ code });
     });
     server.listen(port, "localhost", () => {
       process.stderr.write("\n");
@@ -51169,7 +52603,7 @@ function _generateState() {
   return Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
 }
 function _findFreePort() {
-  return new Promise((resolve8, reject) => {
+  return new Promise((resolve9, reject) => {
     const srv = createServer2();
     srv.listen(0, "localhost", () => {
       const addr = srv.address();
@@ -51179,7 +52613,7 @@ function _findFreePort() {
         return;
       }
       const port = addr.port;
-      srv.close(() => resolve8(port));
+      srv.close(() => resolve9(port));
     });
     srv.on("error", reject);
   });
@@ -51253,7 +52687,7 @@ var llm_exports = {};
 __export(llm_exports, {
   llmCommand: () => llmCommand
 });
-import { pushWarning as pushWarning5 } from "@cleocode/core";
+import { pushWarning as pushWarning6 } from "@cleocode/core";
 async function getListProviders() {
   const { listProviders } = await import(
     /* webpackIgnore: true */
@@ -51384,7 +52818,7 @@ var init_llm3 = __esm({
           apiKey = envValue;
           source = "env";
         } else if (typeof a["api-key"] === "string" && a["api-key"]) {
-          pushWarning5({
+          pushWarning6({
             code: "W_DEPRECATED_FLAG",
             message: API_KEY_FLAG_DEPRECATION,
             deprecated: "--api-key=<value>",
@@ -51801,19 +53235,19 @@ async function readStdin() {
   if (process.stdin.isTTY) {
     return "";
   }
-  return new Promise((resolve8, reject) => {
+  return new Promise((resolve9, reject) => {
     let data = "";
     process.stdin.setEncoding("utf-8");
     process.stdin.on("data", (chunk) => {
       data += chunk;
     });
     process.stdin.on("end", () => {
-      resolve8(data.trim());
+      resolve9(data.trim());
     });
     process.stdin.on("error", reject);
   });
 }
-var showCommand7, listCommand13, findCommand4, statsCommand3, appendCommand, archiveCommand2, manifestCommand;
+var showCommand7, listCommand13, findCommand5, statsCommand3, appendCommand, archiveCommand2, manifestCommand;
 var init_manifest3 = __esm({
   "packages/cleo/src/cli/commands/manifest.ts"() {
     "use strict";
@@ -51899,7 +53333,7 @@ var init_manifest3 = __esm({
         );
       }
     });
-    findCommand4 = defineCommand({
+    findCommand5 = defineCommand({
       meta: {
         name: "find",
         description: "Full-text search manifest entries"
@@ -52108,7 +53542,7 @@ var init_manifest3 = __esm({
       subCommands: {
         show: showCommand7,
         list: listCommand13,
-        find: findCommand4,
+        find: findCommand5,
         stats: statsCommand3,
         append: appendCommand,
         archive: archiveCommand2
@@ -52188,7 +53622,7 @@ function makeMemorySubcommand(opts) {
     }
   });
 }
-var storeCommand, findCommand5, statsCommand4, observeCommand, timelineCommand, fetchCommand2, decisionFindCommand, decisionStoreCommand, linkCommand, traceCommand, relatedCommand, contextCommand3, graphStatsCommand, graphShowCommand, graphNeighborsCommand, graphAddCommand, graphRemoveCommand, reasonWhyCommand, reasonSimilarCommand, searchHybridCommand, codeLinksCommand, codeAutoLinkCommand, codeMemoriesForCodeCommand, codeForMemoryCommand, consolidateCommand, dreamCommand, reflectCommand, dedupScanCommand, importCommand4, doctorCommand3, llmStatusCommand, verifyCommand, pendingVerifyCommand, tierStatsCommand, tierPromoteCommand, tierDemoteCommand, precompactFlushCommand, backfillRunCommand, backfillApproveCommand, backfillRollbackCommand, backfillCommand2, digestCommand, recentCommand, diaryReadCommand, diaryWriteCommand, diaryCommand, watchCommand2, tierCommand, sweepCommand, memoryCommand;
+var storeCommand, findCommand6, statsCommand4, observeCommand, timelineCommand, fetchCommand2, decisionFindCommand, decisionStoreCommand, linkCommand, traceCommand, relatedCommand, contextCommand3, graphStatsCommand, graphShowCommand, graphNeighborsCommand, graphAddCommand, graphRemoveCommand, reasonWhyCommand, reasonSimilarCommand, searchHybridCommand, codeLinksCommand, codeAutoLinkCommand, codeMemoriesForCodeCommand, codeForMemoryCommand, consolidateCommand, dreamCommand, reflectCommand, dedupScanCommand, importCommand4, doctorCommand3, llmStatusCommand, verifyCommand, pendingVerifyCommand, tierStatsCommand, tierPromoteCommand, tierDemoteCommand, precompactFlushCommand, backfillRunCommand, backfillApproveCommand, backfillRollbackCommand, backfillCommand2, digestCommand, recentCommand, diaryReadCommand, diaryWriteCommand, diaryCommand, watchCommand2, tierCommand, sweepCommand, memoryCommand;
 var init_memory3 = __esm({
   "packages/cleo/src/cli/commands/memory.ts"() {
     "use strict";
@@ -52280,7 +53714,7 @@ var init_memory3 = __esm({
         }
       }
     });
-    findCommand5 = defineCommand({
+    findCommand6 = defineCommand({
       meta: {
         name: "find",
         description: "Search BRAIN memory (all tables, or filter by --type pattern|learning)"
@@ -53893,7 +55327,7 @@ data: ${JSON.stringify({ ts: item.ts })}
       meta: { name: "memory", description: "BRAIN memory operations (patterns, learnings)" },
       subCommands: {
         store: storeCommand,
-        find: findCommand5,
+        find: findCommand6,
         stats: statsCommand4,
         observe: observeCommand,
         timeline: timelineCommand,
@@ -55375,15 +56809,15 @@ var init_nexus3 = __esm({
             return;
           }
           if (!skipPrompt) {
-            const { createInterface: createInterface4 } = await import("node:readline");
-            const rl = createInterface4({ input: process.stdin, output: process.stdout });
-            const confirmed = await new Promise((resolve8) => {
+            const { createInterface: createInterface5 } = await import("node:readline");
+            const rl = createInterface5({ input: process.stdin, output: process.stdout });
+            const confirmed = await new Promise((resolve9) => {
               rl.question(
                 `
 [nexus] Delete ${matchCount} project(s) from the registry? [y/N] `,
                 (answer) => {
                   rl.close();
-                  resolve8(answer.trim().toLowerCase() === "y");
+                  resolve9(answer.trim().toLowerCase() === "y");
                 }
               );
             });
@@ -56682,7 +58116,9 @@ __export(orchestrate_exports, {
   formatRollupTable: () => formatRollupTable,
   orchestrateCommand: () => orchestrateCommand
 });
+import { execFileSync as execFileSync3 } from "node:child_process";
 import { orchestration } from "@cleocode/core";
+import { BUILD_CONFIG as BUILD_CONFIG2 } from "@cleocode/core/internal";
 function formatRollupTable(rollup) {
   const waves = "waves" in rollup ? rollup.waves : [rollup];
   const lines = [];
@@ -56775,9 +58211,34 @@ var init_orchestrate3 = __esm({
         epic: {
           type: "string",
           description: "Epic ID to scope status to"
+        },
+        "merge-queue": {
+          type: "boolean",
+          description: "Show GitHub merge queue depth instead of epic status (T10445)"
         }
       },
       async run({ args }) {
+        if (args["merge-queue"]) {
+          const repo = BUILD_CONFIG2.repository.fullName;
+          let queueDepth = 0;
+          let estimatedWaitMinutes = 0;
+          let blocked = false;
+          let note = "merge queue not enabled";
+          try {
+            const raw = execFileSync3(
+              "gh",
+              ["api", `repos/${repo}/merge-queue`, "--jq", ".entries | length"],
+              { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"], timeout: 15e3 }
+            );
+            queueDepth = Number(raw.trim()) || 0;
+            estimatedWaitMinutes = queueDepth * 5;
+            blocked = queueDepth > 10;
+            note = queueDepth > 0 ? "active" : "empty";
+          } catch {
+          }
+          cliOutput({ queueDepth, estimatedWaitMinutes, blocked, note }, { command: "orchestrate" });
+          return;
+        }
         await dispatchFromCli(
           "query",
           "orchestrate",
@@ -56947,6 +58408,10 @@ var init_orchestrate3 = __esm({
         scope: {
           type: "string",
           description: "T9807 sparse-checkout scope: directory prefix to check out in the worktree (cone mode). Example: --scope packages/cleo creates a worktree with only that subtree checked out. Reduces disk usage and checkout time for tasks scoped to a single package."
+        },
+        "orchestrator-defer": {
+          type: "boolean",
+          description: "T9214 atomicity waiver: defer worker file-scope declaration to commit time. Tier-1+ orchestrators only \u2014 records auditable atomicity_waiver in the spawn manifest. Bypasses E_ATOMICITY_NO_SCOPE for worker tasks without explicit AC.files."
         }
       },
       async run({ args }) {
@@ -56957,6 +58422,7 @@ var init_orchestrate3 = __esm({
             tier = parsed;
           }
         }
+        const atomicityScope = args["orchestrator-defer"] ? "orchestrator-defer" : void 0;
         await dispatchFromCli(
           "mutate",
           "orchestrate",
@@ -56966,7 +58432,8 @@ var init_orchestrate3 = __esm({
             protocolType: args.protocol,
             tier,
             noWorktree: args["no-worktree"] === true,
-            ...args.scope ? { spawnScope: args.scope } : {}
+            ...args.scope ? { spawnScope: args.scope } : {},
+            ...atomicityScope ? { atomicityScope } : {}
           },
           { command: "orchestrate" }
         );
@@ -57585,7 +59052,7 @@ __export(otel_exports, {
 import {
   CleoError as CleoError5,
   clearOtelData,
-  formatError as formatError5,
+  formatError as formatError4,
   getOtelSessions,
   getOtelSpawns,
   getOtelStatus,
@@ -57606,7 +59073,7 @@ var init_otel = __esm({
           cliOutput(result, { command: "otel" });
         } catch (err) {
           if (err instanceof CleoError5) {
-            cliError(formatError5(err), err.code, { name: "E_INTERNAL" });
+            cliError(formatError4(err), err.code, { name: "E_INTERNAL" });
             process.exit(err.code);
           }
           throw err;
@@ -57621,7 +59088,7 @@ var init_otel = __esm({
           cliOutput(result, { command: "otel" });
         } catch (err) {
           if (err instanceof CleoError5) {
-            cliError(formatError5(err), err.code, { name: "E_INTERNAL" });
+            cliError(formatError4(err), err.code, { name: "E_INTERNAL" });
             process.exit(err.code);
           }
           throw err;
@@ -57649,7 +59116,7 @@ var init_otel = __esm({
           cliOutput(result, { command: "otel" });
         } catch (err) {
           if (err instanceof CleoError5) {
-            cliError(formatError5(err), err.code, { name: "E_INTERNAL" });
+            cliError(formatError4(err), err.code, { name: "E_INTERNAL" });
             process.exit(err.code);
           }
           throw err;
@@ -57677,7 +59144,7 @@ var init_otel = __esm({
           cliOutput(result, { command: "otel" });
         } catch (err) {
           if (err instanceof CleoError5) {
-            cliError(formatError5(err), err.code, { name: "E_INTERNAL" });
+            cliError(formatError4(err), err.code, { name: "E_INTERNAL" });
             process.exit(err.code);
           }
           throw err;
@@ -57705,7 +59172,7 @@ var init_otel = __esm({
           cliOutput(result, { command: "otel" });
         } catch (err) {
           if (err instanceof CleoError5) {
-            cliError(formatError5(err), err.code, { name: "E_INTERNAL" });
+            cliError(formatError4(err), err.code, { name: "E_INTERNAL" });
             process.exit(err.code);
           }
           throw err;
@@ -57720,7 +59187,7 @@ var init_otel = __esm({
           cliOutput(result, { command: "otel" });
         } catch (err) {
           if (err instanceof CleoError5) {
-            cliError(formatError5(err), err.code, { name: "E_INTERNAL" });
+            cliError(formatError4(err), err.code, { name: "E_INTERNAL" });
             process.exit(err.code);
           }
           throw err;
@@ -59022,7 +60489,7 @@ __export(release_exports, {
   releaseCommand: () => releaseCommand
 });
 import { release as release3 } from "@cleocode/core";
-var listCommand19, showCommand10, cancelCommand2, rollbackCommand, rollbackFullCommand, prStatusCommand, channelCommand, planCommand3, openCommand2, reconcileCommand4, releaseCommand;
+var listCommand19, showCommand10, cancelCommand2, rollbackCommand, rollbackFullCommand, prStatusCommand, channelCommand, validateChangelogCommand, planCommand3, openCommand2, reconcileCommand4, releaseCommand;
 var init_release3 = __esm({
   "packages/cleo/src/cli/commands/release.ts"() {
     "use strict";
@@ -59171,6 +60638,36 @@ var init_release3 = __esm({
         await dispatchFromCli("query", "pipeline", "release.channel.show", {}, { command: "release" });
       }
     });
+    validateChangelogCommand = defineCommand({
+      meta: {
+        name: "validate-changelog",
+        description: "Validate that CHANGELOG.md contains the canonical `## [VERSION]` header (T9937)"
+      },
+      args: {
+        version: {
+          type: "positional",
+          description: "Release version (accepts v2026.5.94 or 2026.5.94)",
+          required: true
+        },
+        path: {
+          type: "string",
+          description: "Override the CHANGELOG file path (default: <projectRoot>/CHANGELOG.md)",
+          required: false
+        }
+      },
+      async run({ args }) {
+        await dispatchFromCli(
+          "query",
+          "release",
+          "validate-changelog",
+          {
+            version: args.version,
+            ...typeof args.path === "string" && args.path.length > 0 ? { changelogPath: args.path } : {}
+          },
+          { command: "release" }
+        );
+      }
+    });
     planCommand3 = defineCommand({
       meta: {
         name: "plan",
@@ -59211,9 +60708,17 @@ var init_release3 = __esm({
         "no-changelog": {
           type: "boolean",
           description: "Skip CHANGELOG.md auto-write (default: write/replace the ## [<version>] section). (T9838)"
+        },
+        "skip-readiness": {
+          type: "boolean",
+          description: "Skip the release-readiness preflight check (default: run check). Use only in emergency. (T10459)"
         }
       },
       async run({ args }) {
+        if (args["skip-readiness"] !== true) {
+          const { runSpawnReadinessHygieneCli } = await import("@cleocode/core/hygiene/validate-spawn-readiness.js");
+          await runSpawnReadinessHygieneCli();
+        }
         await dispatchFromCli(
           "mutate",
           "release",
@@ -59334,7 +60839,9 @@ var init_release3 = __esm({
         cancel: cancelCommand2,
         "pr-status": prStatusCommand,
         channel: channelCommand,
-        "rollback-full": rollbackFullCommand
+        "rollback-full": rollbackFullCommand,
+        // T9937 — canonical CHANGELOG.md header validator (Saga T9862).
+        "validate-changelog": validateChangelogCommand
       },
       async run({ cmd, rawArgs }) {
         const firstArg = rawArgs?.find((a) => !a.startsWith("-"));
@@ -59829,7 +61336,7 @@ __export(research_exports, {
 function generateResearchId() {
   return `res_${Date.now()}`;
 }
-var addCommand10, showCommand11, listCommand21, pendingCommand2, linkCommand2, updateCommand, statsCommand5, linksCommand, archiveCommand3, manifestCommand2, researchCommand;
+var addCommand10, showCommand11, listCommand21, pendingCommand2, linkCommand2, updateCommand2, statsCommand5, linksCommand, archiveCommand3, manifestCommand2, researchCommand;
 var init_research2 = __esm({
   "packages/cleo/src/cli/commands/research.ts"() {
     "use strict";
@@ -59996,7 +61503,7 @@ var init_research2 = __esm({
         );
       }
     });
-    updateCommand = defineCommand({
+    updateCommand2 = defineCommand({
       meta: { name: "update", description: "Update research findings" },
       args: {
         id: {
@@ -60150,7 +61657,7 @@ var init_research2 = __esm({
         list: listCommand21,
         pending: pendingCommand2,
         link: linkCommand2,
-        update: updateCommand,
+        update: updateCommand2,
         stats: statsCommand5,
         links: linksCommand,
         archive: archiveCommand3,
@@ -60562,7 +62069,7 @@ __export(revert_exports, {
   revertCommand: () => revertCommand
 });
 import { readFile as readFile5 } from "node:fs/promises";
-import { join as join27 } from "node:path";
+import { join as join28 } from "node:path";
 import { cwd as processCwd2 } from "node:process";
 import { E_RECEIPT_NOT_FOUND } from "@cleocode/core/sentient/chain-walker.js";
 import { SENTIENT_STATE_FILE } from "@cleocode/core/sentient/daemon.js";
@@ -60615,7 +62122,7 @@ async function loadOwnerAttestation(attestationFilePath) {
   return obj;
 }
 async function loadOwnerPubkeys(projectRoot) {
-  const path6 = join27(projectRoot, OWNER_PUBKEYS_FILE);
+  const path6 = join28(projectRoot, OWNER_PUBKEYS_FILE);
   try {
     const raw = await readFile5(path6, "utf-8");
     const parsed = JSON.parse(raw);
@@ -60699,7 +62206,7 @@ var init_revert = __esm({
         if (attestation && allowedPubkeys.size > 0 && !allowedPubkeys.has(attestation.ownerPubkey)) {
           emitFailure2(
             E_OWNER_ATTESTATION_REQUIRED,
-            `Attestation pubkey "${attestation.ownerPubkey}" is not in the owner allowlist at ${join27(projectRoot, OWNER_PUBKEYS_FILE)}`,
+            `Attestation pubkey "${attestation.ownerPubkey}" is not in the owner allowlist at ${join28(projectRoot, OWNER_PUBKEYS_FILE)}`,
             jsonMode
           );
         }
@@ -60752,7 +62259,7 @@ ${lines}`
             identity,
             includeHuman
           });
-          const statePath = join27(projectRoot, SENTIENT_STATE_FILE);
+          const statePath = join28(projectRoot, SENTIENT_STATE_FILE);
           const state = await readSentientState(statePath);
           emitSuccess(
             {
@@ -61286,11 +62793,11 @@ __export(self_update_exports, {
 });
 import { execFile } from "node:child_process";
 import { readFile as readFile6 } from "node:fs/promises";
-import { join as join28 } from "node:path";
+import { join as join29 } from "node:path";
 import * as readline2 from "node:readline";
 import { promisify } from "node:util";
 import {
-  BUILD_CONFIG as BUILD_CONFIG2,
+  BUILD_CONFIG as BUILD_CONFIG3,
   CleoError as CleoError8,
   checkAllRegisteredProjects as checkAllRegisteredProjects2,
   checkStorageMigration,
@@ -61301,7 +62808,7 @@ import {
 async function getCurrentVersion() {
   const cleoHome = getCleoHome4();
   try {
-    const content = await readFile6(join28(cleoHome, "VERSION"), "utf-8");
+    const content = await readFile6(join29(cleoHome, "VERSION"), "utf-8");
     return (content.split("\n")[0] ?? "unknown").trim();
   } catch {
     return "unknown";
@@ -61309,14 +62816,14 @@ async function getCurrentVersion() {
 }
 async function getNpmInstalledVersion() {
   try {
-    const { stdout } = await execAsync("npm", [
+    const { stdout: stdout2 } = await execAsync("npm", [
       "ls",
       "-g",
       "@cleocode/cleo",
       "--depth=0",
       "--json"
     ]);
-    const data = JSON.parse(stdout);
+    const data = JSON.parse(stdout2);
     return data.dependencies?.["@cleocode/cleo"]?.version ?? null;
   } catch {
     return null;
@@ -61324,19 +62831,19 @@ async function getNpmInstalledVersion() {
 }
 async function getDistTagVersion(tag) {
   try {
-    const { stdout } = await execAsync("npm", ["view", `@cleocode/cleo@${tag}`, "version"]);
-    const v = stdout.trim();
+    const { stdout: stdout2 } = await execAsync("npm", ["view", `@cleocode/cleo@${tag}`, "version"]);
+    const v = stdout2.trim();
     return v || null;
   } catch {
     if (tag === "latest") {
       try {
-        const { stdout } = await execAsync("curl", [
+        const { stdout: stdout2 } = await execAsync("curl", [
           "-sL",
           "--max-time",
           "10",
           `https://api.github.com/repos/${GITHUB_REPO}/releases/latest`
         ]);
-        const data = JSON.parse(stdout);
+        const data = JSON.parse(stdout2);
         return data.tag_name?.replace(/^v/, "") ?? null;
       } catch {
         return null;
@@ -61355,7 +62862,7 @@ async function writeRuntimeVersionMetadata(mode, source, version) {
   ];
   await import("node:fs/promises").then(
     ({ writeFile: writeFile4, mkdir: mkdir5 }) => mkdir5(cleoHome, { recursive: true }).then(
-      () => writeFile4(join28(cleoHome, "VERSION"), `${lines.join("\n")}
+      () => writeFile4(join29(cleoHome, "VERSION"), `${lines.join("\n")}
 `, "utf-8")
     )
   );
@@ -61393,11 +62900,11 @@ async function runPostUpdateDiagnostics(opts) {
         input: process.stdin,
         output: process.stdout
       });
-      shouldMigrate = await new Promise((resolve8) => {
+      shouldMigrate = await new Promise((resolve9) => {
         rl.question("  Do you want to run the upgrade now? [Y/n] ", (answer) => {
           rl.close();
           const clean = answer.trim().toLowerCase();
-          resolve8(clean === "" || clean === "y" || clean === "yes");
+          resolve9(clean === "" || clean === "y" || clean === "yes");
         });
       });
     }
@@ -61537,7 +63044,7 @@ var init_self_update = __esm({
     init_progress();
     init_renderers();
     execAsync = promisify(execFile);
-    GITHUB_REPO = BUILD_CONFIG2.repository.fullName;
+    GITHUB_REPO = BUILD_CONFIG3.repository.fullName;
     selfUpdateCommand = defineCommand({
       meta: {
         name: "self-update",
@@ -61764,10 +63271,13 @@ var init_self_update = __esm({
 // packages/cleo/src/cli/commands/sentient.ts
 var sentient_exports = {};
 __export(sentient_exports, {
+  __setPromptAcceptExecutionForTest: () => __setPromptAcceptExecutionForTest,
+  promptAcceptExecution: () => promptAcceptExecution,
   sentientCommand: () => sentientCommand
 });
-import { join as join29 } from "node:path";
-import { cwd as processCwd3 } from "node:process";
+import { join as join30 } from "node:path";
+import { cwd as processCwd3, stdin, stdout } from "node:process";
+import { createInterface as createInterface3 } from "node:readline/promises";
 import {
   getSentientDaemonStatus as getSentientDaemonStatus2,
   monitorWorkers,
@@ -61778,6 +63288,12 @@ import {
   stopSentientDaemon,
   WORKER_BUDGET_MS
 } from "@cleocode/core/sentient/daemon.js";
+import {
+  appendSentientExecuteAudit,
+  executeFixAction,
+  extractFixActionFromNotesJson,
+  parseFixAction
+} from "@cleocode/core/sentient/execute-action.js";
 import { safeRunProposeTick } from "@cleocode/core/sentient/propose-tick.js";
 import { patchSentientState, readSentientState as readSentientState2 } from "@cleocode/core/sentient/state.js";
 import { safeRunTick } from "@cleocode/core/sentient/tick.js";
@@ -61797,7 +63313,14 @@ function emitFailure3(code, message, _jsonMode, operation) {
   cliError(message, code, { name: code }, operation ? { operation } : void 0);
   process.exit(1);
 }
-var projectArgs2, startSub, stopSub, statusSub, resumeSub, tickSub, proposeListSub, proposeAcceptSub, proposeRejectSub, proposeDiffSub, proposeRunSub, proposeEnableSub, proposeDisableSub, proposeSub, baselineCaptureSub, baselineSub, allowlistListSub, allowlistAddSub, allowlistRemoveSub, allowlistSub, monitorSub, reviewStatusListSub, reviewStatusShowSub, reviewStatusAcceptSub, reviewStatusRejectSub, reviewStatusSub, sentientCommand;
+function __setPromptAcceptExecutionForTest(next) {
+  const prev = promptAcceptExecution;
+  promptAcceptExecution = next;
+  return () => {
+    promptAcceptExecution = prev;
+  };
+}
+var projectArgs2, startSub, stopSub, statusSub, resumeSub, tickSub, proposeListSub, promptAcceptExecution, proposeAcceptSub, proposeRejectSub, proposeDiffSub, proposeRunSub, proposeEnableSub, proposeDisableSub, proposeSub, baselineCaptureSub, baselineSub, allowlistListSub, allowlistAddSub, allowlistRemoveSub, allowlistSub, monitorSub, reviewStatusListSub, reviewStatusShowSub, reviewStatusAcceptSub, reviewStatusRejectSub, reviewStatusSub, sentientCommand;
 var init_sentient3 = __esm({
   "packages/cleo/src/cli/commands/sentient.ts"() {
     "use strict";
@@ -61841,7 +63364,7 @@ var init_sentient3 = __esm({
             return;
           }
           if (dryRun) {
-            const statePath2 = join29(projectRoot, SENTIENT_STATE_FILE2);
+            const statePath2 = join30(projectRoot, SENTIENT_STATE_FILE2);
             const outcome = await safeRunTick({ projectRoot, statePath: statePath2, dryRun: true });
             emitSuccess2(
               { dryRun: true, outcome },
@@ -61957,7 +63480,7 @@ Logs:  ${logPath}`
         const jsonMode = args.json === true;
         const dryRun = args["dry-run"] === true;
         try {
-          const statePath = join29(projectRoot, SENTIENT_STATE_FILE2);
+          const statePath = join30(projectRoot, SENTIENT_STATE_FILE2);
           const outcome = await safeRunTick({ projectRoot, statePath, dryRun });
           emitSuccess2(
             { outcome, dryRun },
@@ -61995,19 +63518,42 @@ Logs:  ${logPath}`
         }
       }
     });
+    promptAcceptExecution = async (fixAction) => {
+      const rl = createInterface3({ input: stdin, output: stdout });
+      try {
+        stdout.write(`[sentient] Proposal accepted. fixAction:
+  $ ${fixAction}
+`);
+        const answer = await rl.question("Execute now? [y/N] ");
+        const normalised = answer.trim().toLowerCase();
+        return normalised === "y" || normalised === "yes";
+      } finally {
+        rl.close();
+      }
+    };
     proposeAcceptSub = defineCommand({
       meta: {
         name: "accept",
-        description: "Accept a proposal \u2014 transition proposed \u2192 pending"
+        description: "Accept a proposal \u2014 transition proposed \u2192 pending, optionally execute its fixAction"
       },
       args: {
         ...projectArgs2,
-        id: { type: "positional", description: "Proposal task ID", required: true }
+        id: { type: "positional", description: "Proposal task ID", required: true },
+        execute: {
+          type: "boolean",
+          description: "Execute proposal.fixAction without prompting"
+        },
+        "no-execute": {
+          type: "boolean",
+          description: "Skip fixAction execution even if the proposal carries one"
+        }
       },
       async run({ args }) {
         const projectRoot = resolveProjectRoot6(args.project);
         const jsonMode = args.json === true;
         const id = args.id;
+        const forceExecute = args.execute === true;
+        const skipExecute = args["no-execute"] === true;
         try {
           const { getDb: getDb3 } = await import("@cleocode/core/store/sqlite.js");
           const { tasks } = await import("@cleocode/core/store/tasks-schema");
@@ -62026,7 +63572,7 @@ Logs:  ${logPath}`
             return;
           }
           await db.update(tasks).set({ status: "pending", updatedAt: now }).where(eq2(tasks.id, id)).run();
-          const statePath = join29(projectRoot, SENTIENT_STATE_FILE2);
+          const statePath = join30(projectRoot, SENTIENT_STATE_FILE2);
           const state = await readSentientState2(statePath);
           await patchSentientState(statePath, {
             tier2Stats: {
@@ -62034,10 +63580,54 @@ Logs:  ${logPath}`
               proposalsAccepted: state.tier2Stats.proposalsAccepted + 1
             }
           });
+          const fixAction = extractFixActionFromNotesJson(existing.notesJson ?? null);
+          let shouldExecute = false;
+          if (fixAction && !skipExecute) {
+            if (forceExecute) {
+              shouldExecute = true;
+            } else {
+              shouldExecute = await promptAcceptExecution(fixAction);
+            }
+          }
+          if (!shouldExecute) {
+            emitSuccess2(
+              {
+                id,
+                status: "pending",
+                acceptedAt: now,
+                executed: false,
+                fixAction: fixAction ?? null
+              },
+              jsonMode,
+              `Proposal ${id} accepted \u2192 pending`
+            );
+            return;
+          }
+          const parsed = parseFixAction(fixAction);
+          if (!parsed.ok) {
+            emitFailure3(parsed.code, parsed.reason, jsonMode);
+            return;
+          }
+          const result = await executeFixAction(parsed, { cwd: projectRoot });
+          await appendSentientExecuteAudit(projectRoot, {
+            proposalId: id,
+            fixAction,
+            exitCode: result.exitCode,
+            durationMs: result.durationMs,
+            timestamp: (/* @__PURE__ */ new Date()).toISOString()
+          });
           emitSuccess2(
-            { id, status: "pending", acceptedAt: now },
+            {
+              id,
+              status: "pending",
+              acceptedAt: now,
+              executed: true,
+              exitCode: result.exitCode,
+              stderrSnippet: result.stderrSnippet,
+              fixAction
+            },
             jsonMode,
-            `Proposal ${id} accepted \u2192 pending`
+            `Proposal ${id} accepted \u2192 pending (fixAction exit=${result.exitCode})`
           );
         } catch (err) {
           const message = err instanceof Error ? err.message : String(err);
@@ -62078,7 +63668,7 @@ Logs:  ${logPath}`
             return;
           }
           await db.update(tasks).set({ status: "cancelled", cancellationReason: reason, cancelledAt: now, updatedAt: now }).where(eq2(tasks.id, id)).run();
-          const statePath = join29(projectRoot, SENTIENT_STATE_FILE2);
+          const statePath = join30(projectRoot, SENTIENT_STATE_FILE2);
           const state = await readSentientState2(statePath);
           await patchSentientState(statePath, {
             tier2Stats: {
@@ -62123,7 +63713,7 @@ Logs:  ${logPath}`
         const projectRoot = resolveProjectRoot6(args.project);
         const jsonMode = args.json === true;
         try {
-          const statePath = join29(projectRoot, SENTIENT_STATE_FILE2);
+          const statePath = join30(projectRoot, SENTIENT_STATE_FILE2);
           const outcome = await safeRunProposeTick({ projectRoot, statePath });
           emitSuccess2(
             { outcome },
@@ -62143,7 +63733,7 @@ Logs:  ${logPath}`
         const projectRoot = resolveProjectRoot6(args.project);
         const jsonMode = args.json === true;
         try {
-          const statePath = join29(projectRoot, SENTIENT_STATE_FILE2);
+          const statePath = join30(projectRoot, SENTIENT_STATE_FILE2);
           const updated = await patchSentientState(statePath, { tier2Enabled: true });
           emitSuccess2({ tier2Enabled: updated.tier2Enabled }, jsonMode, "Tier-2 proposals enabled");
         } catch (err) {
@@ -62162,7 +63752,7 @@ Logs:  ${logPath}`
         const projectRoot = resolveProjectRoot6(args.project);
         const jsonMode = args.json === true;
         try {
-          const statePath = join29(projectRoot, SENTIENT_STATE_FILE2);
+          const statePath = join30(projectRoot, SENTIENT_STATE_FILE2);
           const updated = await patchSentientState(statePath, { tier2Enabled: false });
           emitSuccess2({ tier2Enabled: updated.tier2Enabled }, jsonMode, "Tier-2 proposals disabled");
         } catch (err) {
@@ -62193,7 +63783,7 @@ Logs:  ${logPath}`
         const projectRoot = resolveProjectRoot6(args.project);
         const jsonMode = args.json === true;
         try {
-          const statePath = join29(projectRoot, SENTIENT_STATE_FILE2);
+          const statePath = join30(projectRoot, SENTIENT_STATE_FILE2);
           const state = await readSentientState2(statePath);
           emitSuccess2(
             {
@@ -62833,15 +64423,15 @@ async function promptOwnerAuthPassword(sessionName) {
     );
     return null;
   }
-  const { createInterface: createInterface4 } = await import("node:readline");
+  const { createInterface: createInterface5 } = await import("node:readline");
   const { deriveOwnerAuthToken } = await import("@cleocode/core/internal");
-  const rl = createInterface4({
+  const rl = createInterface5({
     input: process.stdin,
     output: process.stderr,
     terminal: true
   });
   process.stderr.write(`[cleo] Enter owner-auth password for session "${sessionName}": `);
-  const password = await new Promise((resolve8) => {
+  const password = await new Promise((resolve9) => {
     if (process.stdin.setRawMode) {
       process.stdin.setRawMode(
         true
@@ -62859,10 +64449,10 @@ async function promptOwnerAuthPassword(sessionName) {
           );
         }
         process.stderr.write("\n");
-        resolve8(pw);
+        resolve9(pw);
       } else if (ch === "") {
         process.stderr.write("\n[cleo] Cancelled.\n");
-        resolve8("");
+        resolve9("");
       } else if (ch === "\x7F" || ch === "\b") {
         pw = pw.slice(0, -1);
       } else {
@@ -62876,7 +64466,7 @@ async function promptOwnerAuthPassword(sessionName) {
   const token = deriveOwnerAuthToken(sessionName, password);
   return token;
 }
-var startCommand7, endCommand, handoffCommand2, statusCommand14, resumeCommand2, findCommand6, listCommand23, gcCommand2, showCommand13, driftCommand, contextDriftCommand, suspendCommand, recordAssumptionCommand, recordDecisionCommand, decisionLogCommand, adoptCommand, lintCommand, sessionCommand;
+var startCommand7, endCommand, handoffCommand2, statusCommand14, resumeCommand2, findCommand7, listCommand23, gcCommand2, showCommand13, driftCommand, contextDriftCommand, suspendCommand, recordAssumptionCommand, recordDecisionCommand, decisionLogCommand, adoptCommand, lintCommand, sessionCommand;
 var init_session4 = __esm({
   "packages/cleo/src/cli/commands/session.ts"() {
     "use strict";
@@ -63106,7 +64696,7 @@ var init_session4 = __esm({
         );
       }
     });
-    findCommand6 = defineCommand({
+    findCommand7 = defineCommand({
       meta: {
         name: "find",
         description: "Find sessions (lightweight discovery \u2014 minimal fields, low context cost)"
@@ -63469,7 +65059,7 @@ var init_session4 = __esm({
         handoff: handoffCommand2,
         status: statusCommand14,
         resume: resumeCommand2,
-        find: findCommand6,
+        find: findCommand7,
         list: listCommand23,
         gc: gcCommand2,
         show: showCommand13,
@@ -63954,9 +65544,27 @@ var init_show2 = __esm({
     showCommand14 = defineCommand({
       meta: {
         name: "show",
-        description: "Show full task details by ID (returns complete task record with metadata, verification, lifecycle)"
+        description: "Show task details by ID. MVI-projected (id + title + status + key metadata) by default; pass --verbose / --full to receive the complete record with description, acceptance, verification, evidence, etc. (T9922)"
+      },
+      args: {
+        ...paramsToCittyArgs(getOperationParams("query", "tasks", "show")),
+        // T9922 — MVI record projection opt-out flags. The global parser in
+        // cli/index.ts reads these too; the declarations here surface them in
+        // `cleo show --help` and document the contract for agents.
+        verbose: {
+          type: "boolean",
+          description: "Return the full task record (description, acceptance, verification, evidence) instead of the MVI projection. T9922."
+        },
+        full: {
+          type: "boolean",
+          description: "Alias for --verbose. T9922."
+        },
+        // T9932 — 1-line summary render. Global flag; parsed by cli/index.ts.
+        summary: {
+          type: "boolean",
+          description: 'Render the task as a single line "<id> [<status>] <title-truncated-60>". Composes with --output: --output {id|table|count|silent} wins. T9932.'
+        }
       },
-      args: paramsToCittyArgs(getOperationParams("query", "tasks", "show")),
       async run({ args }) {
         await dispatchFromCli(
           "query",
@@ -64078,7 +65686,7 @@ function buildSkillsDoctorAdoptAdapters() {
     }
   };
 }
-var listCommand24, searchCommand4, findCommand7, validateCommand8, infoCommand, installCommand3, uninstallCommand2, enableCommand2, disableCommand2, refreshCommand, dispatchCommand, catalogCommand, precedenceCommand, depsCommand4, doctorBridgeCommand, doctorAdoptOrphansCommand, statsCommand6, importHermesCommand, migrateCommand2, pruneTelemetryCommand, spawnProvidersCommand, doctorDiagnoseCommand, doctorCommand4, proposePatchCommand, skillsCommand2;
+var listCommand24, searchCommand4, findCommand8, validateCommand8, infoCommand, installCommand3, uninstallCommand2, enableCommand2, disableCommand2, refreshCommand, dispatchCommand, catalogCommand, precedenceCommand, depsCommand4, doctorBridgeCommand, doctorAdoptOrphansCommand, statsCommand6, importHermesCommand, migrateCommand2, pruneTelemetryCommand, spawnProvidersCommand, doctorDiagnoseCommand, doctorCommand4, proposePatchCommand, skillsCommand2;
 var init_skills2 = __esm({
   "packages/cleo/src/cli/commands/skills.ts"() {
     "use strict";
@@ -64136,7 +65744,7 @@ var init_skills2 = __esm({
         );
       }
     });
-    findCommand7 = defineCommand({
+    findCommand8 = defineCommand({
       meta: {
         name: "find",
         description: "Federated skill search across local, canonical, and federation peers"
@@ -64821,7 +66429,7 @@ var init_skills2 = __esm({
       subCommands: {
         list: listCommand24,
         search: searchCommand4,
-        find: findCommand7,
+        find: findCommand8,
         validate: validateCommand8,
         info: infoCommand,
         install: installCommand3,
@@ -65879,12 +67487,12 @@ var init_telemetry2 = __esm({
 
 // packages/cleo/src/cli/commands/templates/lib.ts
 import { readFileSync as readFileSync15 } from "node:fs";
-import { isAbsolute as isAbsolute3, resolve as resolve6 } from "node:path";
+import { isAbsolute as isAbsolute3, resolve as resolve7 } from "node:path";
 import { getProjectRoot as getProjectRoot50 } from "@cleocode/core";
 import { resolveSourcePathAbsolute } from "@cleocode/core/templates/registry";
 function resolveProjectRoot7(raw) {
   if (typeof raw === "string" && raw.length > 0) {
-    return isAbsolute3(raw) ? raw : resolve6(process.cwd(), raw);
+    return isAbsolute3(raw) ? raw : resolve7(process.cwd(), raw);
   }
   return getProjectRoot50();
 }
@@ -65905,8 +67513,8 @@ var init_lib = __esm({
 });
 
 // packages/cleo/src/cli/commands/templates/diff.ts
-import { existsSync as existsSync15, readFileSync as readFileSync16 } from "node:fs";
-import { join as join30 } from "node:path";
+import { existsSync as existsSync16, readFileSync as readFileSync16 } from "node:fs";
+import { join as join31 } from "node:path";
 import { getTemplateById } from "@cleocode/core/templates/registry";
 function unifiedDiff(a, b) {
   const aLines = a.length === 0 ? [] : a.split("\n");
@@ -65976,7 +67584,7 @@ var init_diff = __esm({
         let rendered;
         try {
           projectRoot = resolveProjectRoot7(args["project"]);
-          installPath = join30(projectRoot, entry.installPath);
+          installPath = join31(projectRoot, entry.installPath);
           const source = readTemplateSource(entry);
           rendered = applySubstitution(entry, source).rendered;
         } catch (err) {
@@ -65987,7 +67595,7 @@ var init_diff = __esm({
           process.exit(1 /* GENERAL_ERROR */);
           return;
         }
-        if (!existsSync15(installPath)) {
+        if (!existsSync16(installPath)) {
           const missingResult = {
             id,
             installPath,
@@ -66026,8 +67634,8 @@ ${unifiedDiff("", rendered)}`
 });
 
 // packages/cleo/src/cli/commands/templates/install.ts
-import { existsSync as existsSync16, mkdirSync as mkdirSync5, readFileSync as readFileSync17, writeFileSync as writeFileSync5 } from "node:fs";
-import { dirname as dirname9, join as join31 } from "node:path";
+import { existsSync as existsSync17, mkdirSync as mkdirSync5, readFileSync as readFileSync17, writeFileSync as writeFileSync5 } from "node:fs";
+import { dirname as dirname9, join as join32 } from "node:path";
 import { getTemplateById as getTemplateById2 } from "@cleocode/core/templates/registry";
 var templatesInstallCommand;
 var init_install = __esm({
@@ -66081,7 +67689,7 @@ var init_install = __esm({
         let substituted;
         try {
           projectRoot = resolveProjectRoot7(args["project"]);
-          installPath = join31(projectRoot, entry.installPath);
+          installPath = join32(projectRoot, entry.installPath);
           const source = readTemplateSource(entry);
           const sub = applySubstitution(entry, source);
           rendered = sub.rendered;
@@ -66094,7 +67702,7 @@ var init_install = __esm({
           process.exit(1 /* GENERAL_ERROR */);
           return;
         }
-        if (existsSync16(installPath)) {
+        if (existsSync17(installPath)) {
           const current = readFileSync17(installPath, "utf8");
           if (current === rendered) {
             const noopResult = {
@@ -66139,7 +67747,7 @@ var init_install = __esm({
 });
 
 // packages/cleo/src/cli/commands/templates/list.ts
-import { getTemplateManifest, getTemplatesByKind } from "@cleocode/core/templates/registry";
+import { getTemplateManifest, getTemplatesByKind as getTemplatesByKind2 } from "@cleocode/core/templates/registry";
 function parseTemplateKind(raw) {
   if (raw === void 0 || raw === "") return null;
   return TEMPLATE_KINDS.includes(raw) ? raw : null;
@@ -66178,7 +67786,7 @@ var init_list4 = __esm({
           process.exit(2 /* INVALID_INPUT */);
           return;
         }
-        const entries = kind === null ? getTemplateManifest() : getTemplatesByKind(kind);
+        const entries = kind === null ? getTemplateManifest() : getTemplatesByKind2(kind);
         const result = { kind, entries };
         cliOutput(result, {
           command: "templates-list",
@@ -66243,8 +67851,8 @@ var init_show3 = __esm({
 });
 
 // packages/cleo/src/cli/commands/templates/upgrade.ts
-import { existsSync as existsSync17, mkdirSync as mkdirSync6, readFileSync as readFileSync18, writeFileSync as writeFileSync6 } from "node:fs";
-import { dirname as dirname10, join as join32 } from "node:path";
+import { existsSync as existsSync18, mkdirSync as mkdirSync6, readFileSync as readFileSync18, writeFileSync as writeFileSync6 } from "node:fs";
+import { dirname as dirname10, join as join33 } from "node:path";
 import { getTemplateById as getTemplateById4 } from "@cleocode/core/templates/registry";
 var templatesUpgradeCommand;
 var init_upgrade2 = __esm({
@@ -66306,7 +67914,7 @@ var init_upgrade2 = __esm({
         let rendered;
         try {
           projectRoot = resolveProjectRoot7(args["project"]);
-          installPath = join32(projectRoot, entry.installPath);
+          installPath = join33(projectRoot, entry.installPath);
           const source = readTemplateSource(entry);
           rendered = applySubstitution(entry, source).rendered;
         } catch (err) {
@@ -66319,7 +67927,7 @@ var init_upgrade2 = __esm({
         }
         const previewOnly = args["diff"] === true;
         const accept = args["accept"] === true;
-        const current = existsSync17(installPath) ? readFileSync18(installPath, "utf8") : null;
+        const current = existsSync18(installPath) ? readFileSync18(installPath, "utf8") : null;
         const diffBody = current === null ? "" : current === rendered ? "" : unifiedDiff(current, rendered);
         let outcome;
         let reason;
@@ -66869,7 +68477,7 @@ __export(transcript_exports, {
   transcriptCommand: () => transcriptCommand
 });
 import { homedir as homedir6 } from "node:os";
-import { join as join33 } from "node:path";
+import { join as join34 } from "node:path";
 import { getProjectRoot as getProjectRoot52 } from "@cleocode/core";
 import {
   parseDurationMs,
@@ -66923,7 +68531,7 @@ var init_transcript = __esm({
           }
           return;
         }
-        const projectsDir = args["projects-dir"] ?? join33(homedir6(), ".claude", "projects");
+        const projectsDir = args["projects-dir"] ?? join34(homedir6(), ".claude", "projects");
         try {
           const result = await scanTranscripts(projectsDir);
           cliOutput(
@@ -67229,7 +68837,7 @@ var init_transcript = __esm({
           process.exit(2);
           return;
         }
-        const projectsDir = args["projects-dir"] ?? join33(homedir6(), ".claude", "projects");
+        const projectsDir = args["projects-dir"] ?? join34(homedir6(), ".claude", "projects");
         try {
           const pruneResult = await pruneTranscripts({
             olderThanMs,
@@ -67286,7 +68894,7 @@ var init_transcript = __esm({
 // packages/cleo/src/cli/commands/update.ts
 var update_exports = {};
 __export(update_exports, {
-  updateCommand: () => updateCommand2
+  updateCommand: () => updateCommand3
 });
 import {
   appendSignedSeverityAttestation as appendSignedSeverityAttestation2,
@@ -67297,7 +68905,7 @@ import {
   TASK_PIPELINE_STAGES,
   validateOperationInput as validateOperationInput3
 } from "@cleocode/core";
-var updateCommand2;
+var updateCommand3;
 var init_update = __esm({
   "packages/cleo/src/cli/commands/update.ts"() {
     "use strict";
@@ -67306,7 +68914,7 @@ var init_update = __esm({
     init_cli();
     init_collect_input();
     init_renderers();
-    updateCommand2 = defineCommand({
+    updateCommand3 = defineCommand({
       meta: {
         name: "update",
         description: "Update a task. Safe under concurrent invocation \u2014 retries on SQLITE_BUSY up to 4 attempts (gh#391)."
@@ -67350,7 +68958,7 @@ var init_update = __esm({
         },
         priority: {
           type: "string",
-          description: "New priority (critical|high|medium|low)",
+          description: "New priority (critical|high|medium|low). Orthogonal to --severity \u2014 see `cleo find --urgent` for the unified surface (T9905).",
           alias: "p"
         },
         type: {
@@ -67474,7 +69082,7 @@ var init_update = __esm({
          */
         severity: {
           type: "string",
-          description: "Severity level (P0|P1|P2|P3) \u2014 valid for any --role (T9073). Orthogonal to priority. Appends signed attestation."
+          description: "Severity level (P0|P1|P2|P3) \u2014 valid for any --kind (T9073). Orthogonal to --priority \u2014 does NOT auto-map (a P0 with priority=medium stays medium). Use `cleo find --urgent` for the unified surface (T9905). Appends signed attestation."
         },
         /**
          * Operator-supplied justification required to override the
@@ -67761,7 +69369,7 @@ var upgrade_exports = {};
 __export(upgrade_exports, {
   upgradeCommand: () => upgradeCommand
 });
-import { resolve as resolve7 } from "node:path";
+import { resolve as resolve8 } from "node:path";
 import { CleoError as CleoError10, diagnoseUpgrade, runUpgrade as runUpgrade2, upgradeWorkflows as upgradeWorkflows2 } from "@cleocode/core/internal";
 var workflowsSubcommand, upgradeCommand;
 var init_upgrade3 = __esm({
@@ -67801,7 +69409,7 @@ var init_upgrade3 = __esm({
           const dryRun = args["dry-run"] === true || args.check === true;
           const force = args.force === true && !dryRun;
           const result = await upgradeWorkflows2({
-            projectRoot: resolve7(process.cwd()),
+            projectRoot: resolve8(process.cwd()),
             templatesDir: getWorkflowTemplatesDir2(),
             dryRun,
             force
@@ -68060,17 +69668,17 @@ var web_exports = {};
 __export(web_exports, {
   webCommand: () => webCommand
 });
-import { execFileSync as execFileSync3, spawn as spawn3 } from "node:child_process";
+import { execFileSync as execFileSync4, spawn as spawn3 } from "node:child_process";
 import { mkdir as mkdir4, open, readFile as readFile7, rm, stat as stat2, writeFile as writeFile3 } from "node:fs/promises";
-import { join as join34 } from "node:path";
-import { CleoError as CleoError11, formatError as formatError6, getCleoHome as getCleoHome5 } from "@cleocode/core";
+import { join as join35 } from "node:path";
+import { CleoError as CleoError11, formatError as formatError5, getCleoHome as getCleoHome5 } from "@cleocode/core";
 function getWebPaths() {
   const cleoHome = getCleoHome5();
   return {
-    pidFile: join34(cleoHome, "web-server.pid"),
-    configFile: join34(cleoHome, "web-server.json"),
-    logDir: join34(cleoHome, "logs"),
-    logFile: join34(cleoHome, "logs", "web-server.log")
+    pidFile: join35(cleoHome, "web-server.pid"),
+    configFile: join35(cleoHome, "web-server.json"),
+    logDir: join35(cleoHome, "logs"),
+    logFile: join35(cleoHome, "logs", "web-server.log")
   };
 }
 function isProcessRunning(pid) {
@@ -68109,7 +69717,7 @@ async function startWebServer(port, host) {
     throw new CleoError11(1 /* GENERAL_ERROR */, `Server already running (PID: ${status.pid})`);
   }
   const projectRoot = process.env["CLEO_ROOT"] ?? process.cwd();
-  const studioDir = process.env["CLEO_STUDIO_DIR"] ?? join34(projectRoot, "packages", "studio", "build");
+  const studioDir = process.env["CLEO_STUDIO_DIR"] ?? join35(projectRoot, "packages", "studio", "build");
   await mkdir4(logDir, { recursive: true });
   await writeFile3(
     configFile,
@@ -68119,12 +69727,12 @@ async function startWebServer(port, host) {
       startedAt: (/* @__PURE__ */ new Date()).toISOString()
     })
   );
-  const webIndexPath = join34(studioDir, "index.js");
+  const webIndexPath = join35(studioDir, "index.js");
   try {
     await stat2(webIndexPath);
   } catch {
     try {
-      execFileSync3("pnpm", ["--filter", "@cleocode/studio", "run", "build"], {
+      execFileSync4("pnpm", ["--filter", "@cleocode/studio", "run", "build"], {
         cwd: projectRoot,
         stdio: "ignore"
       });
@@ -68167,7 +69775,7 @@ Logs: ${logFile}`
       }
     } catch {
     }
-    await new Promise((resolve8) => setTimeout(resolve8, 500));
+    await new Promise((resolve9) => setTimeout(resolve9, 500));
   }
   if (!started) {
     try {
@@ -68216,7 +69824,7 @@ var init_web = __esm({
           await startWebServer(Number.parseInt(args.port, 10), args.host);
         } catch (err) {
           if (err instanceof CleoError11) {
-            console.error(formatError6(err));
+            console.error(formatError5(err));
             process.exit(err.code);
           }
           throw err;
@@ -68244,7 +69852,7 @@ var init_web = __esm({
           }
           for (let i = 0; i < 60; i++) {
             if (!isProcessRunning(status.pid)) break;
-            await new Promise((resolve8) => setTimeout(resolve8, 500));
+            await new Promise((resolve9) => setTimeout(resolve9, 500));
           }
           if (isProcessRunning(status.pid)) {
             try {
@@ -68260,7 +69868,7 @@ var init_web = __esm({
           cliOutput({ stopped: true }, { command: "web", message: "CLEO Web UI stopped" });
         } catch (err) {
           if (err instanceof CleoError11) {
-            console.error(formatError6(err));
+            console.error(formatError5(err));
             process.exit(err.code);
           }
           throw err;
@@ -68296,7 +69904,7 @@ var init_web = __esm({
             }
             for (let i = 0; i < 60; i++) {
               if (!isProcessRunning(status.pid)) break;
-              await new Promise((resolve8) => setTimeout(resolve8, 500));
+              await new Promise((resolve9) => setTimeout(resolve9, 500));
             }
             if (isProcessRunning(status.pid)) {
               try {
@@ -68313,7 +69921,7 @@ var init_web = __esm({
           await startWebServer(Number.parseInt(args.port, 10), args.host);
         } catch (err) {
           if (err instanceof CleoError11) {
-            console.error(formatError6(err));
+            console.error(formatError5(err));
             process.exit(err.code);
           }
           throw err;
@@ -68328,7 +69936,7 @@ var init_web = __esm({
           cliOutput(status, { command: "web" });
         } catch (err) {
           if (err instanceof CleoError11) {
-            console.error(formatError6(err));
+            console.error(formatError5(err));
             process.exit(err.code);
           }
           throw err;
@@ -68361,7 +69969,7 @@ var init_web = __esm({
           cliOutput({ url }, { command: "web", message: `Open browser to: ${url}` });
         } catch (err) {
           if (err instanceof CleoError11) {
-            console.error(formatError6(err));
+            console.error(formatError5(err));
             process.exit(err.code);
           }
           throw err;
@@ -68394,12 +70002,12 @@ __export(worktree_exports, {
 import readline4 from "node:readline";
 import { getProjectRoot as getProjectRoot53, listWorktrees as listWorktrees2 } from "@cleocode/core/internal";
 async function promptYesNo2(question) {
-  return new Promise((resolve8) => {
+  return new Promise((resolve9) => {
     const rl = readline4.createInterface({ input: process.stdin, output: process.stdout });
     rl.question(`${question} [y/N]: `, (answer) => {
       rl.close();
       const trimmed = answer.trim().toLowerCase();
-      resolve8(trimmed === "y" || trimmed === "yes");
+      resolve9(trimmed === "y" || trimmed === "yes");
     });
   });
 }
@@ -68733,7 +70341,7 @@ init_dist();
 init_field_context();
 init_format_context();
 import { readFileSync as readFileSync20 } from "node:fs";
-import { dirname as dirname11, join as join36 } from "node:path";
+import { dirname as dirname11, join as join37 } from "node:path";
 import { fileURLToPath as fileURLToPath7 } from "node:url";
 
 // packages/cleo/src/cli/generated/command-manifest.ts
@@ -69126,7 +70734,7 @@ var COMMAND_MANIFEST = [
     exportName: "graphCommand",
     name: "graph",
     description: "Project-scoped code intelligence: symbol graph, impact analysis, clusters, flows",
-    load: async () => (await Promise.resolve().then(() => (init_graph2(), graph_exports))).graphCommand
+    load: async () => (await Promise.resolve().then(() => (init_graph3(), graph_exports))).graphCommand
   },
   {
     exportName: "historyCommand",
@@ -69179,7 +70787,7 @@ var COMMAND_MANIFEST = [
   {
     exportName: "labelsCommand",
     name: "labels",
-    description: "List all labels with counts or show tasks with specific label",
+    description: "List all labels (no args), or show tasks for a label (cleo labels <name>)",
     load: async () => (await Promise.resolve().then(() => (init_labels(), labels_exports))).labelsCommand
   },
   {
@@ -69461,7 +71069,7 @@ var COMMAND_MANIFEST = [
   {
     exportName: "showCommand",
     name: "show",
-    description: "Show full task details by ID (returns complete task record with metadata, verification, lifecycle)",
+    description: "Show task details by ID. MVI-projected (id + title + status + key metadata) by default; pass --verbose / --full to receive the complete record with description, acceptance, verification, evidence, etc. (T9922)",
     load: async () => (await Promise.resolve().then(() => (init_show2(), show_exports))).showCommand
   },
   {
@@ -69747,14 +71355,14 @@ function lazyCommand(meta, loader2) {
 init_did_you_mean();
 
 // packages/cleo/src/cli/lib/first-run-detection.ts
-import { existsSync as existsSync18 } from "node:fs";
-import { join as join35 } from "node:path";
+import { existsSync as existsSync19 } from "node:fs";
+import { join as join36 } from "node:path";
 async function detectFirstRun() {
   const envKey = process.env["ANTHROPIC_API_KEY"];
   if (typeof envKey === "string" && envKey.length > 0) return false;
   const { getCleoPlatformPaths } = await import("@cleocode/paths");
-  const configPath = join35(getCleoPlatformPaths().config, "config.json");
-  if (existsSync18(configPath)) return false;
+  const configPath = join36(getCleoPlatformPaths().config, "config.json");
+  if (existsSync19(configPath)) return false;
   try {
     const { getCredentialPool } = await import("@cleocode/core/llm/credential-pool.js");
     const pool = getCredentialPool();
@@ -69765,7 +71373,7 @@ async function detectFirstRun() {
   return true;
 }
 function waitForEnterOrTimeout(timeoutMs) {
-  return new Promise((resolve8) => {
+  return new Promise((resolve9) => {
     let resolved = false;
     const finish = () => {
       if (resolved) return;
@@ -69777,7 +71385,7 @@ function waitForEnterOrTimeout(timeoutMs) {
         process.stdin.pause();
       } catch {
       }
-      resolve8();
+      resolve9();
     };
     const onData = (chunk) => {
       const s = typeof chunk === "string" ? chunk : chunk.toString("utf8");
@@ -69819,6 +71427,10 @@ function resolveFormat(opts, defaults) {
   return resolveOutputFormat(input2);
 }
 
+// packages/cleo/src/cli/index.ts
+init_output_context();
+init_projection_context();
+
 // packages/cleo/src/cli/resolve-subcommand.ts
 async function resolveLazyValue(input2) {
   if (typeof input2 === "function") {
@@ -69846,6 +71458,7 @@ async function resolveSubCommandForHelp(cmd, rawArgs) {
 }
 
 // packages/cleo/src/cli/index.ts
+init_summary_context();
 {
   const [major] = process.versions.node.split(".").map(Number);
   if (typeof major !== "number" || major < 24) {
@@ -69868,7 +71481,7 @@ Or via NodeSource: https://github.com/nodesource/distributions
   }
 }
 function getPackageVersion() {
-  const pkgPath = join36(dirname11(fileURLToPath7(import.meta.url)), "../../package.json");
+  const pkgPath = join37(dirname11(fileURLToPath7(import.meta.url)), "../../package.json");
   const pkg = JSON.parse(readFileSync20(pkgPath, "utf-8"));
   return pkg.version;
 }
@@ -69904,6 +71517,9 @@ alias("pipeline", "phaseCommand");
 async function startCli() {
   const argv = process.argv.slice(2);
   const rawOpts = {};
+  let verboseFlag = false;
+  let outputModeRaw;
+  let summaryFlag = false;
   for (let i = 0; i < argv.length; i++) {
     const arg = argv[i];
     if (arg === "--json") rawOpts["json"] = true;
@@ -69912,6 +71528,9 @@ async function startCli() {
     else if (arg === "--field" && i + 1 < argv.length) rawOpts["field"] = argv[++i];
     else if (arg === "--fields" && i + 1 < argv.length) rawOpts["fields"] = argv[++i];
     else if (arg === "--mvi" && i + 1 < argv.length) rawOpts["mvi"] = argv[++i];
+    else if (arg === "--verbose" || arg === "--full") verboseFlag = true;
+    else if (arg === "--output" && i + 1 < argv.length) outputModeRaw = argv[++i];
+    else if (arg === "--summary") summaryFlag = true;
   }
   const formatResolution = resolveFormat(rawOpts);
   setFormatContext(formatResolution);
@@ -69920,6 +71539,19 @@ async function startCli() {
     fieldResolution.mvi = "minimal";
   }
   setFieldContext(fieldResolution);
+  setProjectionOptOut(verboseFlag || formatResolution.format === "human");
+  if (outputModeRaw !== void 0) {
+    if (!isOutputMode(outputModeRaw)) {
+      process.stderr.write(
+        `Error: invalid --output mode "${outputModeRaw}"
+Valid modes: envelope, id, table, count, silent
+`
+      );
+      process.exit(2);
+    }
+    setOutputMode(outputModeRaw);
+  }
+  setSummaryMode(summaryFlag);
   const isHelpOrVersion = argv.length === 0 || argv[0] === "--help" || argv[0] === "-h" || argv[0] === "--version" || argv[0] === "-V" || argv[0] === "help";
   if (argv[0] === "--version" || argv[0] === "-V") {
     const { cliOutput: cliOutput2 } = await Promise.resolve().then(() => (init_renderers(), renderers_exports));
@@ -69927,6 +71559,10 @@ async function startCli() {
     return;
   }
   if (!isHelpOrVersion) {
+    if (rawOpts["quiet"] === true) {
+      const { setLoggerQuiet } = await import("@cleocode/core/internal");
+      setLoggerQuiet(true);
+    }
     await runStartupMaintenance();
   }
   if (!isHelpOrVersion) {