@cleocode/cleo 2026.5.120 → 2026.5.122

package/dist/cli/index.js

@@ -1730,7 +1730,7 @@ var init_branch_lock = __esm({
 
 // packages/contracts/src/changesets.ts
 import { z as z3 } from "zod";
-var CHANGESET_KINDS, TASK_ID_RE, ChangesetEntrySchema;
+var CHANGESET_KINDS, CHANGESET_RELEASE_NOTE_SECTIONS, CHANGESET_RELEASE_NOTE_AUDIENCES, CHANGESET_RELEASE_NOTE_SCOPES, nonEmptyReleaseNoteText, nonEmptyReleaseNoteList, ChangesetReleaseNotesMetadataSchema, TASK_ID_RE, ChangesetEntrySchema;
 var init_changesets = __esm({
   "packages/contracts/src/changesets.ts"() {
     "use strict";
@@ -1744,10 +1744,60 @@ var init_changesets = __esm({
       "chore",
       "breaking"
     ];
+    CHANGESET_RELEASE_NOTE_SECTIONS = [
+      "added",
+      "changed",
+      "fixed",
+      "deprecated",
+      "removed",
+      "security",
+      "breaking"
+    ];
+    CHANGESET_RELEASE_NOTE_AUDIENCES = [
+      "users",
+      "operators",
+      "developers",
+      "maintainers"
+    ];
+    CHANGESET_RELEASE_NOTE_SCOPES = [
+      "project",
+      "package",
+      "component",
+      "docs",
+      "ops",
+      "security"
+    ];
+    nonEmptyReleaseNoteText = z3.string().min(1, "release-note metadata text must be non-empty");
+    nonEmptyReleaseNoteList = z3.array(nonEmptyReleaseNoteText).min(1, "release-note metadata list must contain at least one item");
+    ChangesetReleaseNotesMetadataSchema = z3.object({
+      /** Keep-a-Changelog style section/category override. */
+      section: z3.enum(CHANGESET_RELEASE_NOTE_SECTIONS).optional(),
+      /** Intended readers for the note. */
+      audience: z3.array(z3.enum(CHANGESET_RELEASE_NOTE_AUDIENCES)).min(1).optional(),
+      /** Release-note scope. */
+      scope: z3.enum(CHANGESET_RELEASE_NOTE_SCOPES).optional(),
+      /** Package/project/component targets affected by this entry. */
+      targets: nonEmptyReleaseNoteList.optional(),
+      /** User- or operator-visible impact statement. */
+      impact: nonEmptyReleaseNoteText.optional(),
+      /** Deterministic migration/action text, separate from breaking changes. */
+      migration: nonEmptyReleaseNoteText.optional(),
+      /** Deprecation detail for Deprecated sections. */
+      deprecation: nonEmptyReleaseNoteText.optional(),
+      /** Security detail for Security sections. */
+      security: nonEmptyReleaseNoteText.optional(),
+      /** Operator-facing rollout/verification note. */
+      operatorNotes: nonEmptyReleaseNoteText.optional(),
+      /** Explicit inclusion toggle for future release-scope filters. */
+      includeInChangelog: z3.boolean().optional()
+    }).strict();
     TASK_ID_RE = /^(T\d+(-[A-Z][A-Za-z0-9]*)?|E-\d+(-[A-Z][A-Za-z0-9]*)?)$/;
     ChangesetEntrySchema = z3.object({
-      /** Filename slug (without the `.md` extension). */
-      id: z3.string().min(1, "id must be non-empty").regex(/^[a-z0-9][a-z0-9-]*$/, "id must be kebab-case (lowercase, digits, hyphens)"),
+      /** Filename identifier (without the `.md` extension); lowercase kebab-case for new files, legacy uppercase task IDs accepted. */
+      id: z3.string().min(1, "id must be non-empty").regex(
+        /^[A-Za-z0-9][A-Za-z0-9-]*$/,
+        "id must contain only ASCII letters, digits, and hyphens"
+      ),
       /** One or more CLEO task IDs this change is anchored to. */
       tasks: z3.array(z3.string().regex(TASK_ID_RE, "task ID must match T#### or E-#### format")).min(1, "tasks must contain at least one task ID"),
       /** Type of change. */
@@ -1759,7 +1809,9 @@ var init_changesets = __esm({
       /** Markdown body — longer-form explanation. */
       notes: z3.string().optional(),
       /** Migration note. Required iff `kind === 'breaking'`. */
-      breaking: z3.string().optional()
+      breaking: z3.string().optional(),
+      /** Structured author-provided metadata for deterministic release notes. */
+      releaseNotes: ChangesetReleaseNotesMetadataSchema.optional()
     }).refine((entry) => entry.kind !== "breaking" || (entry.breaking?.length ?? 0) > 0, {
       message: "breaking entries must include a non-empty `breaking` migration note",
       path: ["breaking"]
@@ -9367,6 +9419,35 @@ var init_operations_registry = __esm({
           }
         ]
       },
+      // release query: validate-changelog (T9937 / Saga T9862 — canonical CHANGELOG
+      // header validator that replaces the brittle inline grep step in
+      // .github/workflows/release.yml). Read-only — exposed only under the query
+      // gateway because no DB or filesystem mutation occurs.
+      {
+        gateway: "query",
+        domain: "release",
+        operation: "validate-changelog",
+        description: "release.validate-changelog (query) \u2014 validate that CHANGELOG.md contains the canonical `## [VERSION]` header per ADR-028 \xA72.5. Replaces the brittle inline grep in .github/workflows/release.yml (T9937 / Saga T9862).",
+        tier: 1,
+        idempotent: true,
+        sessionRequired: false,
+        requiredParams: ["version"],
+        params: [
+          {
+            name: "version",
+            type: "string",
+            required: true,
+            description: "Release version (accepts v2026.5.94 or 2026.5.94)",
+            cli: { positional: true }
+          },
+          {
+            name: "changelogPath",
+            type: "string",
+            required: false,
+            description: "Override the CHANGELOG file path (default: <projectRoot>/CHANGELOG.md)"
+          }
+        ]
+      },
       // ---------------------------------------------------------------------------
       // Provenance domain — `cleo provenance` CLI surface (T9528 · Phase 2 of T9493)
       // ---------------------------------------------------------------------------
@@ -10519,6 +10600,7 @@ var init_exit_codes = __esm({
       ExitCode2[ExitCode2["LAFS_VIOLATION"] = 104] = "LAFS_VIOLATION";
       ExitCode2[ExitCode2["DECISION_VALIDATOR_FAILED"] = 106] = "DECISION_VALIDATOR_FAILED";
       ExitCode2[ExitCode2["LEAD_BYPASS_DETECTED"] = 107] = "LEAD_BYPASS_DETECTED";
+      ExitCode2[ExitCode2["AC_COVERAGE_INCOMPLETE"] = 108] = "AC_COVERAGE_INCOMPLETE";
       return ExitCode2;
     })(ExitCode || {});
   }
@@ -10546,7 +10628,7 @@ var init_errors = __esm({
 
 // packages/contracts/src/evidence-atom-schema.ts
 import { z as z6 } from "zod";
-var commitAtomSchema, filesAtomSchema, testRunAtomSchema, toolAtomSchema, urlAtomSchema, noteAtomSchema, decisionAtomSchema, prAtomSchema, locDropAtomSchema, callsiteCoverageAtomSchema, EvidenceAtomSchema, GATE_EVIDENCE_REQUIREMENTS;
+var commitAtomSchema, filesAtomSchema, testRunAtomSchema, toolAtomSchema, urlAtomSchema, noteAtomSchema, decisionAtomSchema, prAtomSchema, locDropAtomSchema, callsiteCoverageAtomSchema, AC_UUID_REGEX, AC_ALIAS_REGEX, SATISFIES_TASK_ID_REGEX, SATISFIES_VERSION_PIN_REGEX, satisfiesAtomSchema, EvidenceAtomSchema, GATE_EVIDENCE_REQUIREMENTS, ATOM_EXAMPLES;
 var init_evidence_atom_schema = __esm({
   "packages/contracts/src/evidence-atom-schema.ts"() {
     "use strict";
@@ -10592,6 +10674,24 @@ var init_evidence_atom_schema = __esm({
       symbolName: z6.string().min(1, "callsite-coverage atom requires a non-empty symbolName"),
       relativeSourcePath: z6.string().min(1, "callsite-coverage atom requires a non-empty relativeSourcePath")
     });
+    AC_UUID_REGEX = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
+    AC_ALIAS_REGEX = /^AC[0-9]{1,4}$/;
+    SATISFIES_TASK_ID_REGEX = /^T[0-9]{1,7}$/;
+    SATISFIES_VERSION_PIN_REGEX = /^[0-9]{14}$/;
+    satisfiesAtomSchema = z6.object({
+      kind: z6.literal("satisfies"),
+      /** Target task ID — `T<1-7 digits>` per ADR-079-r2 §2.1. */
+      targetTaskId: z6.string().regex(SATISFIES_TASK_ID_REGEX, "satisfies atom targetTaskId must match /^T[0-9]{1,7}$/"),
+      /** Lowercase UUIDv4 — populated for the canonical form; undefined for alias form. */
+      targetAcId: z6.string().regex(AC_UUID_REGEX, "satisfies atom targetAcId must be a lowercase UUIDv4").optional(),
+      /** Positional alias `AC<1-4 digits>` — populated for alias form; undefined for UUID form. */
+      targetAcAlias: z6.string().regex(AC_ALIAS_REGEX, "satisfies atom targetAcAlias must match /^AC[0-9]{1,4}$/").optional(),
+      /** Optional `@<14-digit YYYYMMDDhhmmss>` pin captured at mint time. */
+      versionPin: z6.string().regex(
+        SATISFIES_VERSION_PIN_REGEX,
+        "satisfies atom versionPin must be 14 digits (YYYYMMDDhhmmss)"
+      ).optional()
+    });
     EvidenceAtomSchema = z6.discriminatedUnion("kind", [
       commitAtomSchema,
       filesAtomSchema,
@@ -10602,7 +10702,8 @@ var init_evidence_atom_schema = __esm({
       decisionAtomSchema,
       prAtomSchema,
       locDropAtomSchema,
-      callsiteCoverageAtomSchema
+      callsiteCoverageAtomSchema,
+      satisfiesAtomSchema
     ]);
     GATE_EVIDENCE_REQUIREMENTS = Object.freeze({
       implemented: {
@@ -10621,6 +10722,19 @@ var init_evidence_atom_schema = __esm({
       cleanupDone: { oneOf: [["note"]] },
       nexusImpact: { oneOf: [["tool"], ["note"]] }
     });
+    ATOM_EXAMPLES = Object.freeze({
+      commit: "commit:<sha>",
+      files: "files:path/a.ts,path/b.ts",
+      "test-run": "test-run:/tmp/vitest-out.json",
+      tool: "tool:test",
+      url: "url:https://example.com/docs",
+      note: "note:<short description>",
+      decision: "decision:D-arch-001",
+      pr: "pr:357",
+      "loc-drop": "loc-drop:<fromLines>:<toLines>",
+      "callsite-coverage": "callsite-coverage:<symbolName>:<relativeSourcePath>",
+      satisfies: "satisfies:T1234#AC2"
+    });
   }
 });
 
@@ -12435,6 +12549,52 @@ var init_manifest2 = __esm({
   }
 });
 
+// packages/contracts/src/validator/index.ts
+import { z as z14 } from "zod";
+var VALIDATOR_ID_REGEX, validatorFindingSchema, validatorAttestationSchema, validatorRejectionSchema, validatorVerdictSchema;
+var init_validator = __esm({
+  "packages/contracts/src/validator/index.ts"() {
+    "use strict";
+    VALIDATOR_ID_REGEX = /^validator-[a-z0-9][a-z0-9-]*$/;
+    validatorFindingSchema = z14.object({
+      acId: z14.string().min(1, "acId must be non-empty"),
+      status: z14.enum(["pass", "fail", "inconclusive"]),
+      reasoning: z14.string().min(1, "reasoning must be non-empty"),
+      evidenceRefs: z14.array(z14.string()).optional(),
+      checkedAt: z14.string().min(1, "checkedAt must be a non-empty ISO-8601 string")
+    });
+    validatorAttestationSchema = z14.object({
+      verdict: z14.literal("attest"),
+      taskId: z14.string().min(1),
+      validatorId: z14.string().regex(VALIDATOR_ID_REGEX, "validatorId must match the pattern validator-<discriminator>"),
+      findings: z14.array(validatorFindingSchema).min(1, "attestation must contain at least one finding").refine(
+        (findings) => findings.every((f) => f.status === "pass"),
+        'attestation requires every finding to have status="pass"'
+      ),
+      summary: z14.string().optional(),
+      attestedAt: z14.string().min(1),
+      schemaVersion: z14.literal("1")
+    });
+    validatorRejectionSchema = z14.object({
+      verdict: z14.literal("reject"),
+      taskId: z14.string().min(1),
+      validatorId: z14.string().regex(VALIDATOR_ID_REGEX, "validatorId must match the pattern validator-<discriminator>"),
+      findings: z14.array(validatorFindingSchema).min(1, "rejection must contain at least one finding").refine(
+        (findings) => findings.some((f) => f.status !== "pass"),
+        'rejection requires at least one finding with status "fail" or "inconclusive"'
+      ),
+      summary: z14.string().min(1, "rejection summary must be non-empty"),
+      remediationHints: z14.array(z14.string()).optional(),
+      rejectedAt: z14.string().min(1),
+      schemaVersion: z14.literal("1")
+    });
+    validatorVerdictSchema = z14.discriminatedUnion("verdict", [
+      validatorAttestationSchema,
+      validatorRejectionSchema
+    ]);
+  }
+});
+
 // packages/contracts/src/index.ts
 var init_src2 = __esm({
   "packages/contracts/src/index.ts"() {
@@ -12478,6 +12638,7 @@ var init_src2 = __esm({
     init_task_evidence();
     init_archive();
     init_manifest2();
+    init_validator();
   }
 });
 
@@ -13807,6 +13968,7 @@ __export(engine_exports, {
   taskWorkHistory: () => taskWorkHistory,
   tasksAddBatchOp: () => tasksAddBatchOp,
   validateBatchValidate: () => coreBatchValidate,
+  validateChangelog: () => validateChangelog,
   validateCoherenceCheck: () => coreCoherenceCheck,
   validateComplianceRecord: () => coreComplianceRecord,
   validateComplianceSummary: () => coreComplianceSummary,
@@ -14032,6 +14194,7 @@ import {
   taskUnclaim,
   taskUpdate,
   taskWorkHistory,
+  validateChangelog,
   validateGateVerify,
   validateProtocolArchitectureDecision,
   validateProtocolArtifactPublish,
@@ -14915,8 +15078,8 @@ var init_admin2 = __esm({
         const projectRoot = getProjectRoot2();
         const taskId = params.taskId;
         try {
-          const { getTaskAccessor: getTaskAccessor4, getLastHandoff, retrieveWithBudget } = await import("@cleocode/core/internal");
-          const accessor = await getTaskAccessor4(projectRoot);
+          const { getTaskAccessor: getTaskAccessor5, getLastHandoff, retrieveWithBudget } = await import("@cleocode/core/internal");
+          const accessor = await getTaskAccessor5(projectRoot);
           const task = await accessor.loadSingleTask(taskId);
           if (!task) {
             return lafsError("E_NOT_FOUND", `Task ${taskId} not found`, "context.pull");
@@ -26728,8 +26891,8 @@ async function loadPlaybookByName(name) {
     return null;
   }
   try {
-    const { getProjectRoot: getProjectRoot54 } = await import("@cleocode/core/internal");
-    const projectRoot = __playbookRuntimeOverrides.projectRoot ?? getProjectRoot54();
+    const { getProjectRoot: getProjectRoot56 } = await import("@cleocode/core/internal");
+    const projectRoot = __playbookRuntimeOverrides.projectRoot ?? getProjectRoot56();
     const resolved = resolvePlaybook(name, {
       projectRoot,
       globalPlaybooksDir: __playbookRuntimeOverrides.globalPlaybooksDir,
@@ -26773,8 +26936,8 @@ async function acquireDb() {
 async function buildDefaultDispatcher() {
   if (__playbookRuntimeOverrides.dispatcher) return __playbookRuntimeOverrides.dispatcher;
   const { orchestrateSpawnExecute: orchestrateSpawnExecute2 } = await Promise.resolve().then(() => (init_engine(), engine_exports));
-  const { getProjectRoot: getProjectRoot54 } = await import("@cleocode/core/internal");
-  const projectRoot = getProjectRoot54();
+  const { getProjectRoot: getProjectRoot56 } = await import("@cleocode/core/internal");
+  const projectRoot = getProjectRoot56();
   return {
     async dispatch(input2) {
       try {
@@ -26964,8 +27127,8 @@ var init_playbook2 = __esm({
             projectRoot = __playbookRuntimeOverrides.projectRoot;
           } else {
             try {
-              const { getProjectRoot: getProjectRoot54 } = await import("@cleocode/core/internal");
-              projectRoot = getProjectRoot54();
+              const { getProjectRoot: getProjectRoot56 } = await import("@cleocode/core/internal");
+              projectRoot = getProjectRoot56();
             } catch {
               projectRoot = void 0;
             }
@@ -27029,14 +27192,14 @@ var init_playbook2 = __esm({
         const dispatcher = await buildDefaultDispatcher();
         let result;
         try {
-          const { getProjectRoot: getProjectRoot54 } = await import("@cleocode/core/internal");
+          const { getProjectRoot: getProjectRoot56 } = await import("@cleocode/core/internal");
           const opts = {
             db,
             playbook: parsed.definition,
             playbookHash: parsed.sourceHash,
             initialContext,
             dispatcher,
-            projectRoot: getProjectRoot54()
+            projectRoot: getProjectRoot56()
           };
           if (__playbookRuntimeOverrides.approvalSecret !== void 0) {
             opts.approvalSecret = __playbookRuntimeOverrides.approvalSecret;
@@ -27401,16 +27564,16 @@ async function orchestrateRejectOp(params) {
 async function orchestrateClassify(request, context, projectRoot) {
   try {
     const { getCleoCantWorkflowsDir } = await import("@cleocode/core/internal");
-    const { readFileSync: readFileSync21, readdirSync: readdirSync3, existsSync: existsSync19 } = await import("node:fs");
-    const { join: join37 } = await import("node:path");
+    const { readFileSync: readFileSync21, readdirSync: readdirSync3, existsSync: existsSync20 } = await import("node:fs");
+    const { join: join38 } = await import("node:path");
     const workflowsDir = getCleoCantWorkflowsDir();
     const combined = `${request} ${context ?? ""}`.toLowerCase();
     const matches = [];
-    if (existsSync19(workflowsDir)) {
+    if (existsSync20(workflowsDir)) {
       const files = readdirSync3(workflowsDir).filter((f) => f.endsWith(".cant"));
       for (const file of files) {
         try {
-          const src = readFileSync21(join37(workflowsDir, file), "utf-8");
+          const src = readFileSync21(join38(workflowsDir, file), "utf-8");
           const teamMatch = /^team\s+(\S+):/m.exec(src);
           if (!teamMatch) continue;
           const teamName = teamMatch[1];
@@ -27425,12 +27588,12 @@ async function orchestrateClassify(request, context, projectRoot) {
         }
       }
     }
-    const localCantDir = join37(projectRoot, CLEO_DIR_NAME, WORKFLOWS_SUBDIR);
-    if (existsSync19(localCantDir)) {
+    const localCantDir = join38(projectRoot, CLEO_DIR_NAME, WORKFLOWS_SUBDIR);
+    if (existsSync20(localCantDir)) {
       const files = readdirSync3(localCantDir).filter((f) => f.endsWith(".cant"));
       for (const file of files) {
         try {
-          const src = readFileSync21(join37(localCantDir, file), "utf-8");
+          const src = readFileSync21(join38(localCantDir, file), "utf-8");
           const teamMatch = /^team\s+(\S+):/m.exec(src);
           if (!teamMatch) continue;
           const teamName = teamMatch[1];
@@ -27572,8 +27735,8 @@ async function orchestrateAnalyzeParallelSafety(taskIds, projectRoot) {
       return !closureA.has(b) && !closureB.has(a);
     };
     var transitiveClose = transitiveClose2, parallelSafe = parallelSafe2;
-    const { getTaskAccessor: getTaskAccessor4 } = await import("@cleocode/core/internal");
-    const accessor = await getTaskAccessor4(projectRoot);
+    const { getTaskAccessor: getTaskAccessor5 } = await import("@cleocode/core/internal");
+    const accessor = await getTaskAccessor5(projectRoot);
     const result = await accessor.queryTasks({});
     const allTasks = result?.tasks ?? [];
     const depMap = /* @__PURE__ */ new Map();
@@ -27622,11 +27785,11 @@ async function orchestrateAnalyzeParallelSafety(taskIds, projectRoot) {
     };
   }
 }
-async function handleWorktreeComplete(taskId, projectRoot, resolve8) {
+async function handleWorktreeComplete(taskId, projectRoot, resolve9) {
   try {
     const { completeWorktreeForTask } = await import("@cleocode/core/internal");
     const result = completeWorktreeForTask(taskId, projectRoot, {
-      resolve: resolve8 ?? "auto"
+      resolve: resolve9 ?? "auto"
     });
     if (result.outcome === "conflict") {
       return {
@@ -28306,10 +28469,10 @@ var init_orchestrate2 = __esm({
                   startTime
                 );
               const rawResolve = params.resolve;
-              const resolve8 = rawResolve === "manual" ? "manual" : rawResolve === "auto" ? "auto" : void 0;
+              const resolve9 = rawResolve === "manual" ? "manual" : rawResolve === "auto" ? "auto" : void 0;
               const p = {
                 taskId: params.taskId,
-                ...resolve8 !== void 0 ? { resolve: resolve8 } : {}
+                ...resolve9 !== void 0 ? { resolve: resolve9 } : {}
               };
               return wrapResult(
                 await coreOps2["worktree.complete"](p),
@@ -29450,6 +29613,65 @@ var init_release2 = __esm({
                 startTime
               );
             }
+            // release.validate-changelog — canonical CHANGELOG.md header validator
+            // (T9937 / Saga T9862). Replaces the brittle `grep -qF "## [VERSION]"`
+            // step in .github/workflows/release.yml. Read-only.
+            //
+            // The core verb returns a plain `ValidateChangelogResult` envelope
+            // (NOT an EngineResult discriminated union) so direct SDK consumers
+            // can branch on `result.valid`. At the dispatch boundary we translate
+            // `valid=false` into `E_CHANGELOG_MISSING_SECTION` so the CLI emits a
+            // non-zero exit code — exactly the behaviour CI workflows depend on
+            // (the legacy `grep -qF "## [VERSION]" || exit 1` had the same
+            // contract).
+            case "validate-changelog": {
+              const version = typeof params?.version === "string" ? params.version : void 0;
+              if (!version)
+                return errorResult(
+                  "query",
+                  "release",
+                  operation,
+                  "E_INVALID_INPUT",
+                  "version is required",
+                  startTime
+                );
+              const typed = {
+                version,
+                projectRoot: getProjectRoot14(),
+                ...typeof params?.changelogPath === "string" ? { changelogPath: params.changelogPath } : {}
+              };
+              const validation = await validateChangelog(typed);
+              if (validation.valid) {
+                return wrapResult(
+                  { success: true, data: validation },
+                  "query",
+                  "release",
+                  operation,
+                  startTime
+                );
+              }
+              return wrapResult(
+                {
+                  success: false,
+                  error: {
+                    code: "E_CHANGELOG_MISSING_SECTION",
+                    message: validation.reason ?? `CHANGELOG.md missing canonical header for v${validation.normalizedVersion}`,
+                    details: {
+                      version: validation.version,
+                      normalizedVersion: validation.normalizedVersion,
+                      changelogPath: validation.changelogPath,
+                      headerFound: validation.headerFound
+                    },
+                    fix: `Run \`cleo release plan v${validation.normalizedVersion}\` locally to write the section, then re-push.`,
+                    exitCode: 1
+                  }
+                },
+                "query",
+                "release",
+                operation,
+                startTime
+              );
+            }
             default:
               return unsupportedOp("query", "release", operation, startTime);
           }
@@ -29617,7 +29839,7 @@ var init_release2 = __esm({
       /** Return declared operations for introspection and registry validation. */
       getSupportedOperations() {
         return {
-          query: ["gate", "ivtr-suggest"],
+          query: ["gate", "ivtr-suggest", "validate-changelog"],
           mutate: ["gate", "ivtr-suggest", "reconcile", "plan", "open"]
         };
       }
@@ -30600,7 +30822,7 @@ var init_sticky2 = __esm({
 
 // packages/cleo/src/dispatch/domains/tasks.ts
 import { getLogger as getLogger15, getProjectRoot as getProjectRoot18, TASKS_SUGGESTED_NEXT_BUILDERS } from "@cleocode/core";
-import { createAttachmentStore as createAttachmentStore4 } from "@cleocode/core/internal";
+import { createAttachmentStore as createAttachmentStore4, getTaskAccessor as getTaskAccessor3 } from "@cleocode/core/internal";
 import {
   sagaAdd as coreSagaAdd,
   sagaCreate as coreSagaCreate,
@@ -30631,6 +30853,20 @@ async function fetchTaskAttachments(projectRoot, taskId) {
     return [];
   }
 }
+async function fetchTaskAcRows(projectRoot, taskId) {
+  try {
+    const accessor = await getTaskAccessor3(projectRoot);
+    const rows = await accessor.getAcRows(taskId);
+    return rows.map((row) => ({
+      id: row.id,
+      alias: `AC${row.ordinal}`,
+      ordinal: row.ordinal,
+      text: row.text
+    }));
+  } catch {
+    return [];
+  }
+}
 async function sagaCreate(params) {
   const title = typeof params.title === "string" ? params.title : "";
   const description = typeof params.description === "string" ? params.description : void 0;
@@ -30715,9 +30951,10 @@ var init_tasks2 = __esm({
         if (params.history) {
           return wrapCoreResult(await taskShowWithHistory(projectRoot, params.taskId, true), "show");
         }
-        const [coreResult, attachments] = await Promise.all([
+        const [coreResult, attachments, acRows] = await Promise.all([
           taskShow(projectRoot, params.taskId),
-          fetchTaskAttachments(projectRoot, params.taskId)
+          fetchTaskAttachments(projectRoot, params.taskId),
+          fetchTaskAcRows(projectRoot, params.taskId)
         ]);
         if (!coreResult.success) {
           return wrapCoreResult(coreResult, "show");
@@ -30725,7 +30962,8 @@ var init_tasks2 = __esm({
         const showResult = {
           task: coreResult.data.task,
           view: coreResult.data.view,
-          attachments
+          attachments,
+          ...acRows.length > 0 ? { acRows } : {}
         };
         return { success: true, data: showResult };
       },
@@ -30769,7 +31007,13 @@ var init_tasks2 = __esm({
             // T944/T9072: kind filter
             kind: params.kind,
             // T9905: unified urgency surface
-            urgent: params.urgent
+            urgent: params.urgent,
+            // T9904: label filter — `cleo find --label <name>` (closes GH#393).
+            label: params.label,
+            // T10108: parent filter — `cleo find --parent <id>`. Saga-aware via
+            // resolveSagaMemberIds (ADR-073 §1) so saga members surface through
+            // the same routing as `cleo list --parent`.
+            parent: params.parent
           }),
           "find"
         );
@@ -30977,7 +31221,10 @@ var init_tasks2 = __esm({
         const result = await completeTaskStrict(projectRoot, params.taskId, {
           notes: params.notes,
           overrideReason: params.overrideReason,
-          acknowledgeRisk: params.acknowledgeRisk
+          acknowledgeRisk: params.acknowledgeRisk,
+          // T10509 — AC-coverage gate waiver path
+          waiveAc: params.waiveAc,
+          waiveReason: params.waiveReason
         });
         setImmediate(async () => {
           try {
@@ -32145,7 +32392,8 @@ import {
   getLogger as getLogger18,
   getProjectRoot as getProjectRoot21,
   listWorktrees,
-  pruneOrphanedWorktreesByStatus
+  pruneOrphanedWorktreesByStatus,
+  recoverPartialWorktree
 } from "@cleocode/core/internal";
 function coerceStatusFilter(value) {
   if (value === void 0 || value === null) return void 0;
@@ -32220,7 +32468,7 @@ var init_worktree2 = __esm({
        *
        * Supported operations:
        *  - `adopt` — register an externally-created worktree in the SSoT. Params:
-       *              `{ worktreePath, source?, taskId?, actor? }`. Returns an
+       *              `{ worktreePath, source?, taskId?, actor?, recover? }`. Returns an
        *              {@link AdoptWorktreeResult} envelope. (T9804)
        *  - `destroy` — explicitly destroy a single agent worktree. Params:
        *                `{ taskId, force?, deleteBranch?, reason? }`. Returns a
@@ -32256,14 +32504,44 @@ var init_worktree2 = __esm({
               const source = typeof rawSource === "string" && validSources.includes(rawSource) ? rawSource : void 0;
               const rawTaskId = params?.["taskId"];
               const taskId = rawTaskId === null ? null : typeof rawTaskId === "string" && rawTaskId.length > 0 ? rawTaskId : void 0;
+              const projectRoot = getProjectRoot21();
               const opts = {
-                projectRoot: getProjectRoot21(),
+                projectRoot,
                 worktreePath,
                 ...source !== void 0 ? { source } : {},
                 ...taskId !== void 0 ? { taskId } : {},
                 ...typeof params?.["actor"] === "string" && params["actor"].length > 0 ? { actor: params["actor"] } : {}
               };
               const result = await adoptWorktree(opts);
+              if (result.success && params?.["recover"] === true) {
+                const recovery = recoverPartialWorktree(
+                  projectRoot,
+                  worktreePath,
+                  result.data.taskId ?? taskId ?? "unknown"
+                );
+                const recoveredResult = recovery.success ? {
+                  success: true,
+                  data: {
+                    ...result.data,
+                    recovery
+                  }
+                } : {
+                  success: false,
+                  error: {
+                    code: "E_WORKTREE_RECOVERY_FAILED",
+                    message: recovery.error ?? "Partial worktree recovery failed.",
+                    fix: "Inspect the worktree, then rerun `cleo worktree adopt <path> --recover` after resolving the reported recovery error.",
+                    details: { adopt: result.data, recovery }
+                  }
+                };
+                return wrapResult(
+                  recoveredResult,
+                  "mutate",
+                  "worktree",
+                  operation,
+                  startTime
+                );
+              }
               return wrapResult(
                 result,
                 "mutate",
@@ -32945,11 +33223,11 @@ var init_security = __esm({
 });
 
 // packages/cleo/src/dispatch/middleware/sanitizer.ts
-function createSanitizer(getProjectRoot54) {
+function createSanitizer(getProjectRoot56) {
   return async (req, next) => {
     if (req.params) {
       try {
-        const root = getProjectRoot54 ? getProjectRoot54() : void 0;
+        const root = getProjectRoot56 ? getProjectRoot56() : void 0;
         req.params = sanitizeParams(req.params, root, {
           domain: req.domain,
           operation: req.operation
@@ -33500,7 +33778,7 @@ function wrapParseError(rawInput, parseErr, sourceLabel) {
   return new Error(`Invalid JSON in ${sourceLabel}: ${parseErr.message} (got: ${snippet2})`);
 }
 function readStdinJson(stdin2) {
-  return new Promise((resolve8, reject) => {
+  return new Promise((resolve9, reject) => {
     const chunks = [];
     stdin2.on("data", (chunk) => {
       chunks.push(typeof chunk === "string" ? Buffer.from(chunk) : chunk);
@@ -33511,7 +33789,7 @@ function readStdinJson(stdin2) {
     stdin2.on("end", () => {
       const raw = Buffer.concat(chunks).toString("utf8");
       try {
-        resolve8(JSON.parse(raw));
+        resolve9(JSON.parse(raw));
       } catch (err) {
         reject(wrapParseError(raw, err, "stdin"));
       }
@@ -34740,12 +35018,12 @@ var init_agent = __esm({
             transportConfig: {},
             isActive: true
           });
-          const { existsSync: existsSync19, mkdirSync: mkdirSync7, writeFileSync: writeFileSync7 } = await import("node:fs");
-          const { join: join37 } = await import("node:path");
-          const cantDir = join37(CLEO_DIR_NAME, AGENTS_SUBDIR);
-          const cantPath = join37(cantDir, `${agentId}.cant`);
+          const { existsSync: existsSync20, mkdirSync: mkdirSync7, writeFileSync: writeFileSync7 } = await import("node:fs");
+          const { join: join38 } = await import("node:path");
+          const cantDir = join38(CLEO_DIR_NAME, AGENTS_SUBDIR);
+          const cantPath = join38(cantDir, `${agentId}.cant`);
           let cantScaffolded = false;
-          if (!existsSync19(cantPath)) {
+          if (!existsSync20(cantPath)) {
             mkdirSync7(cantDir, { recursive: true });
             const role = classification ?? "specialist";
             const cantContent = `---
@@ -34805,7 +35083,7 @@ agent ${agentId}:
               data: {
                 agentId: credential.agentId,
                 displayName: credential.displayName,
-                cantFile: cantScaffolded ? cantPath : existsSync19(cantPath) ? cantPath : null,
+                cantFile: cantScaffolded ? cantPath : existsSync20(cantPath) ? cantPath : null,
                 cantScaffolded
               }
             },
@@ -34924,8 +35202,8 @@ agent ${agentId}:
         try {
           const { AgentRegistryAccessor } = await import("@cleocode/core/agents");
           const { createRuntime } = await import("@cleocode/runtime");
-          const { existsSync: existsSync19, readFileSync: readFileSync21 } = await import("node:fs");
-          const { join: join37 } = await import("node:path");
+          const { existsSync: existsSync20, readFileSync: readFileSync21 } = await import("node:fs");
+          const { join: join38 } = await import("node:path");
           await openCleoDb("tasks");
           const registry = new AgentRegistryAccessor(getProjectRoot24());
           const credential = await registry.get(args.agentId);
@@ -34945,8 +35223,8 @@ agent ${agentId}:
           }
           let profile = null;
           let cantValidation = null;
-          const cantPath = args.cant ?? join37(CLEO_DIR_NAME, AGENTS_SUBDIR, `${args.agentId}.cant`);
-          if (existsSync19(cantPath)) {
+          const cantPath = args.cant ?? join38(CLEO_DIR_NAME, AGENTS_SUBDIR, `${args.agentId}.cant`);
+          if (existsSync20(cantPath)) {
             profile = readFileSync21(cantPath, "utf-8");
             try {
               const cantModule = await import("@cleocode/cant");
@@ -35470,8 +35748,8 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
         try {
           const { AgentRegistryAccessor } = await import("@cleocode/core/agents");
           const { createRuntime } = await import("@cleocode/runtime");
-          const { existsSync: existsSync19 } = await import("node:fs");
-          const { join: join37 } = await import("node:path");
+          const { existsSync: existsSync20 } = await import("node:fs");
+          const { join: join38 } = await import("node:path");
           await openCleoDb("tasks");
           const registry = new AgentRegistryAccessor(getProjectRoot24());
           const credential = await registry.get(args.agentId);
@@ -35488,8 +35766,8 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
           }
           await registry.update(args.agentId, { isActive: true });
           await registry.markUsed(args.agentId);
-          const cantPath = join37(CLEO_DIR_NAME, AGENTS_SUBDIR, `${args.agentId}.cant`);
-          const hasProfile = existsSync19(cantPath);
+          const cantPath = join38(CLEO_DIR_NAME, AGENTS_SUBDIR, `${args.agentId}.cant`);
+          const hasProfile = existsSync20(cantPath);
           const runtime = await createRuntime(registry, {
             agentId: args.agentId,
             pollIntervalMs: 5e3,
@@ -36285,10 +36563,10 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
       async run({ args }) {
         let tempDir = null;
         try {
-          const { existsSync: existsSync19 } = await import("node:fs");
-          const { basename, resolve: resolve8 } = await import("node:path");
-          const resolvedPath = resolve8(args.path);
-          if (!existsSync19(resolvedPath)) {
+          const { existsSync: existsSync20 } = await import("node:fs");
+          const { basename, resolve: resolve9 } = await import("node:path");
+          const resolvedPath = resolve9(args.path);
+          if (!existsSync20(resolvedPath)) {
             cliOutput(
               {
                 success: false,
@@ -36413,11 +36691,11 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
       },
       async run({ args }) {
         try {
-          const { existsSync: existsSync19, statSync } = await import("node:fs");
-          const { resolve: resolve8, basename, dirname: dirname12 } = await import("node:path");
+          const { existsSync: existsSync20, statSync } = await import("node:fs");
+          const { resolve: resolve9, basename, dirname: dirname12 } = await import("node:path");
           const { execFileSync: execFileSync5 } = await import("node:child_process");
-          const resolvedDir = resolve8(args.dir);
-          if (!existsSync19(resolvedDir) || !statSync(resolvedDir).isDirectory()) {
+          const resolvedDir = resolve9(args.dir);
+          if (!existsSync20(resolvedDir) || !statSync(resolvedDir).isDirectory()) {
             cliOutput(
               {
                 success: false,
@@ -36431,9 +36709,9 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
             process.exitCode = 4;
             return;
           }
-          const { join: join37 } = await import("node:path");
-          const personaPath = join37(resolvedDir, "persona.cant");
-          if (!existsSync19(personaPath)) {
+          const { join: join38 } = await import("node:path");
+          const personaPath = join38(resolvedDir, "persona.cant");
+          if (!existsSync20(personaPath)) {
             cliOutput(
               {
                 success: false,
@@ -36449,7 +36727,7 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
           }
           const agentName = basename(resolvedDir);
           const archiveName = `${agentName}.cantz`;
-          const archivePath = resolve8(archiveName);
+          const archivePath = resolve9(archiveName);
           const parentDir = dirname12(resolvedDir);
           try {
             execFileSync5("zip", ["-r", archivePath, agentName], {
@@ -36480,7 +36758,7 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
               if (entry.isFile()) {
                 fileCount++;
               } else if (entry.isDirectory()) {
-                countFiles(join37(dirPath, entry.name));
+                countFiles(join38(dirPath, entry.name));
               }
             }
           };
@@ -36728,17 +37006,17 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
       },
       async run({ args }) {
         try {
-          const { existsSync: existsSync19, readFileSync: readFileSync21, mkdirSync: mkdirSync7 } = await import("node:fs");
-          const { resolve: resolve8, join: join37 } = await import("node:path");
-          const specPath = resolve8(args.spec);
-          if (!existsSync19(specPath)) {
+          const { existsSync: existsSync20, readFileSync: readFileSync21, mkdirSync: mkdirSync7 } = await import("node:fs");
+          const { resolve: resolve9, join: join38 } = await import("node:path");
+          const specPath = resolve9(args.spec);
+          if (!existsSync20(specPath)) {
             cliError(`spec file not found: ${specPath}`, 4, { name: "E_NOT_FOUND" });
             process.exitCode = 4;
             return;
           }
           const specContent = readFileSync21(specPath, "utf-8");
           const projectRoot = getProjectRoot24();
-          const outputDir = args["output-dir"] ? resolve8(args["output-dir"]) : join37(projectRoot, ".cleo", "cant", "agents");
+          const outputDir = args["output-dir"] ? resolve9(args["output-dir"]) : join38(projectRoot, ".cleo", "cant", "agents");
           mkdirSync7(outputDir, { recursive: true });
           if (args["dry-run"]) {
             cliOutput(
@@ -37489,8 +37767,8 @@ function detectAuthType(provider, token) {
 async function promptYesNo(question) {
   const rl = createInterface({ input: process.stdin, output: process.stderr });
   try {
-    const answer = await new Promise((resolve8) => {
-      rl.question(question, (a) => resolve8(a));
+    const answer = await new Promise((resolve9) => {
+      rl.question(question, (a) => resolve9(a));
     });
     const clean = answer.trim().toLowerCase();
     return clean === "y" || clean === "yes";
@@ -38426,12 +38704,12 @@ async function promptPassphrase() {
       "Cannot prompt for passphrase: stdin is not a TTY. Set the CLEO_BACKUP_PASSPHRASE environment variable for non-interactive use."
     );
   }
-  return new Promise((resolve8) => {
+  return new Promise((resolve9) => {
     process.stdout.write("Passphrase: ");
     const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
     rl.question("", (answer) => {
       rl.close();
-      resolve8(answer.trim());
+      resolve9(answer.trim());
     });
   });
 }
@@ -38567,9 +38845,9 @@ var init_backup = __esm({
       async run({ args }) {
         const scope = args.scope;
         const { packBundle } = await import("@cleocode/core/store/backup-pack.js");
-        const { getProjectRoot: getProjectRoot54 } = await import("@cleocode/core");
+        const { getProjectRoot: getProjectRoot56 } = await import("@cleocode/core");
         const includesProject = scope === "project" || scope === "all";
-        const projectRoot = includesProject ? getProjectRoot54() : void 0;
+        const projectRoot = includesProject ? getProjectRoot56() : void 0;
         let passphrase;
         if (args.encrypt === true) {
           passphrase = process.env["CLEO_BACKUP_PASSPHRASE"];
@@ -38645,12 +38923,12 @@ var init_backup = __esm({
       },
       async run({ args }) {
         const bundlePath = args.bundle;
-        const { getProjectRoot: getProjectRoot54, getCleoHome: getCleoHome6, getCleoVersion } = await import("@cleocode/core");
+        const { getProjectRoot: getProjectRoot56, getCleoHome: getCleoHome6, getCleoVersion } = await import("@cleocode/core");
         const { BundleError, cleanupStaging, unpackBundle } = await import("@cleocode/core/store/backup-unpack.js");
         const { regenerateConfigJson, regenerateProjectContextJson, regenerateProjectInfoJson } = await import("@cleocode/core/store/regenerators.js");
         const { regenerateAndCompare } = await import("@cleocode/core/store/restore-json-merge.js");
         const { buildConflictReport, writeConflictReport } = await import("@cleocode/core/store/restore-conflict-report.js");
-        const projectRoot = getProjectRoot54();
+        const projectRoot = getProjectRoot56();
         if (args.force !== true) {
           const existing = checkForExistingData(projectRoot, getCleoHome6());
           if (existing.length > 0) {
@@ -39541,11 +39819,11 @@ var init_caamp = __esm({
         }
         if (args["dry-run"]) {
           const { parseCaampBlocks } = await import("@cleocode/caamp");
-          const { existsSync: existsSync19 } = await import("node:fs");
+          const { existsSync: existsSync20 } = await import("node:fs");
           const { readFile: readFile8 } = await import("node:fs/promises");
           const dryResults = [];
           for (const filePath of filePaths) {
-            if (!existsSync19(filePath)) {
+            if (!existsSync20(filePath)) {
               dryResults.push({ filePath, exists: false, blockCount: 0, wouldRemove: 0 });
               continue;
             }
@@ -40600,11 +40878,11 @@ var init_check2 = __esm({
       },
       async run({ args }) {
         const { spawnSync } = await import("node:child_process");
-        const { existsSync: existsSync19 } = await import("node:fs");
-        const { join: join37, resolve: resolve8 } = await import("node:path");
+        const { existsSync: existsSync20 } = await import("node:fs");
+        const { join: join38, resolve: resolve9 } = await import("node:path");
         const strict = Boolean(args.strict);
         const jsonOnly = Boolean(args.json);
-        const repoRoot = resolve8(process.cwd());
+        const repoRoot = resolve9(process.cwd());
         const gates = [
           {
             id: "gate-1",
@@ -40641,8 +40919,8 @@ var init_check2 = __esm({
         const results = [];
         let anyFailed = false;
         for (const gate of gates) {
-          const scriptPath = join37(repoRoot, gate.script);
-          if (!existsSync19(scriptPath)) {
+          const scriptPath = join38(repoRoot, gate.script);
+          if (!existsSync20(scriptPath)) {
             results.push({
               id: gate.id,
               task: gate.task,
@@ -40957,9 +41235,9 @@ var init_code = __esm({
           async run({ args }) {
             await requireTreeSitter();
             const { smartOutline } = await import("@cleocode/core/internal");
-            const { join: join37 } = await import("node:path");
+            const { join: join38 } = await import("node:path");
             const root = process.cwd();
-            const absPath = args.file.startsWith("/") ? args.file : join37(root, args.file);
+            const absPath = args.file.startsWith("/") ? args.file : join38(root, args.file);
             const result = smartOutline(absPath, root);
             if (result.errors.length > 0 && result.symbols.length === 0) {
               cliError(result.errors.join(", "), 1, { name: "E_OUTLINE_FAILED" });
@@ -41050,9 +41328,9 @@ var init_code = __esm({
           async run({ args }) {
             await requireTreeSitter();
             const { smartUnfold } = await import("@cleocode/core/internal");
-            const { join: join37 } = await import("node:path");
+            const { join: join38 } = await import("node:path");
             const root = process.cwd();
-            const absPath = args.file.startsWith("/") ? args.file : join37(root, args.file);
+            const absPath = args.file.startsWith("/") ? args.file : join38(root, args.file);
             const result = smartUnfold(absPath, args.symbol, root);
             if (!result.found) {
               const errs = result.errors.length > 0 ? `: ${result.errors.join(", ")}` : "";
@@ -41115,6 +41393,15 @@ var init_complete = __esm({
         "override-reason": {
           type: "string",
           description: "Reason for bypassing E_EPIC_HAS_PENDING_CHILDREN guard (audited to .cleo/audit/premature-close.jsonl)"
+        },
+        // T10509 — AC-coverage gate (load-bearing IVTR closure)
+        "waive-ac": {
+          type: "string",
+          description: "Comma-separated AC tokens (UUIDs or AC<n> aliases) to waive from the AC-coverage gate. Requires --waive-reason. Audited to .cleo/audit/ac-waiver.jsonl."
+        },
+        "waive-reason": {
+          type: "string",
+          description: "Mandatory justification text for --waive-ac. Captured verbatim in the audit row."
         }
       },
       async run({ args }) {
@@ -41124,7 +41411,10 @@ var init_complete = __esm({
           changeset: args.changeset,
           verificationNote: args["verification-note"],
           acknowledgeRisk: args["acknowledge-risk"],
-          overrideReason: args["override-reason"]
+          overrideReason: args["override-reason"],
+          // T10509 — AC-coverage gate waiver path
+          waiveAc: args["waive-ac"],
+          waiveReason: args["waive-reason"]
         });
         if (!response.success) {
           handleRawError(response, { command: "complete", operation: "tasks.complete" });
@@ -47221,6 +47511,269 @@ var init_doctor_projects = __esm({
   }
 });
 
+// packages/cleo/src/cli/commands/doctor-release-readiness.ts
+var doctor_release_readiness_exports = {};
+__export(doctor_release_readiness_exports, {
+  doctorReleaseReadinessCommand: () => doctorReleaseReadinessCommand
+});
+import { existsSync as existsSync13 } from "node:fs";
+import { join as join22, resolve as resolve6 } from "node:path";
+async function runCheck(name, cmd, args, cwd) {
+  const { spawnSync } = await import("node:child_process");
+  const start = Date.now();
+  const result = spawnSync(cmd, args, {
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "pipe"],
+    cwd
+  });
+  const durationMs = Date.now() - start;
+  const passed = result.status === 0;
+  return {
+    name,
+    status: passed ? "pass" : "fail",
+    exitCode: result.status,
+    durationMs,
+    stdout: (result.stdout ?? "").trim(),
+    stderr: (result.stderr ?? "").trim()
+  };
+}
+var doctorReleaseReadinessCommand;
+var init_doctor_release_readiness = __esm({
+  "packages/cleo/src/cli/commands/doctor-release-readiness.ts"() {
+    "use strict";
+    init_define_cli_command();
+    init_renderers();
+    doctorReleaseReadinessCommand = defineCommand({
+      meta: {
+        name: "release-readiness",
+        description: "Pre-flight release readiness check \u2014 lint matrix + changelog + changeset + npm OIDC + tag-trigger sanity (T10458)"
+      },
+      args: {
+        json: { type: "boolean", description: "Output as JSON" },
+        human: { type: "boolean", description: "Force human-readable output" },
+        quiet: { type: "boolean", description: "Suppress non-essential output" }
+      },
+      async run({ args }) {
+        const isHuman = args.human === true || !!process.stdout.isTTY && args.json !== true;
+        const repoRoot = resolve6(process.cwd());
+        const startTotal = Date.now();
+        const checks = [];
+        const biomePath = join22(repoRoot, "node_modules", ".bin", "biome");
+        const biomeAvailable = existsSync13(biomePath);
+        if (biomeAvailable) {
+          checks.push(await runCheck("biome-lint", biomePath, ["ci", "."], repoRoot));
+        } else {
+          checks.push({
+            name: "biome-lint",
+            status: "skip",
+            exitCode: null,
+            durationMs: 0,
+            stdout: "",
+            stderr: "biome not found in node_modules/.bin \u2014 skipping"
+          });
+        }
+        const changesetLintScript = join22(repoRoot, "scripts", "lint-changesets.mjs");
+        if (existsSync13(changesetLintScript)) {
+          checks.push(await runCheck("changeset-lint", "node", [changesetLintScript], repoRoot));
+        } else {
+          checks.push({
+            name: "changeset-lint",
+            status: "skip",
+            exitCode: null,
+            durationMs: 0,
+            stdout: "",
+            stderr: "scripts/lint-changesets.mjs not found \u2014 skipping"
+          });
+        }
+        const changelogPath = join22(repoRoot, "CHANGELOG.md");
+        const changelogExists = existsSync13(changelogPath);
+        const changelogCheck = {
+          name: "changelog-exists",
+          status: changelogExists ? "pass" : "fail",
+          exitCode: changelogExists ? 0 : 1,
+          durationMs: 0,
+          stdout: changelogExists ? `Found ${changelogPath}` : "",
+          stderr: changelogExists ? "" : `CHANGELOG.md not found at ${changelogPath}`
+        };
+        checks.push(changelogCheck);
+        const packageJsonPath = join22(repoRoot, "package.json");
+        let oidcCheck;
+        if (existsSync13(packageJsonPath)) {
+          try {
+            const pkg = JSON.parse(
+              await import("node:fs").then((m) => m.readFileSync(packageJsonPath, "utf8"))
+            );
+            if (pkg.private === true) {
+              oidcCheck = {
+                name: "npm-oidc-sanity",
+                status: "pass",
+                exitCode: 0,
+                durationMs: 0,
+                stdout: "root package.json is private \u2014 skipping (per-package check applies at publish time)",
+                stderr: ""
+              };
+            } else {
+              const hasPublishConfig = typeof pkg.publishConfig === "object" && pkg.publishConfig !== null;
+              const accessPublic = hasPublishConfig && pkg.publishConfig.access === "public";
+              oidcCheck = {
+                name: "npm-oidc-sanity",
+                status: accessPublic ? "pass" : "fail",
+                exitCode: accessPublic ? 0 : 1,
+                durationMs: 0,
+                stdout: accessPublic ? "package.json has publishConfig.access=public" : "",
+                stderr: accessPublic ? "" : "package.json missing publishConfig.access=public \u2014 required for npm OIDC Trusted Publishing"
+              };
+            }
+          } catch {
+            oidcCheck = {
+              name: "npm-oidc-sanity",
+              status: "fail",
+              exitCode: 1,
+              durationMs: 0,
+              stdout: "",
+              stderr: "Failed to parse package.json"
+            };
+          }
+        } else {
+          oidcCheck = {
+            name: "npm-oidc-sanity",
+            status: "fail",
+            exitCode: 1,
+            durationMs: 0,
+            stdout: "",
+            stderr: "package.json not found"
+          };
+        }
+        checks.push(oidcCheck);
+        const tagWorkflowPath = join22(repoRoot, ".github", "workflows", "auto-tag-on-release-merge.yml");
+        const tagWorkflowExists = existsSync13(tagWorkflowPath);
+        let tagTriggerCheck;
+        if (tagWorkflowExists) {
+          try {
+            const content = await import("node:fs").then(
+              (m) => m.readFileSync(tagWorkflowPath, "utf8")
+            );
+            const hasName = content.includes("name:");
+            const hasOnTrigger = content.includes("on:") || content.includes("pull_request:");
+            const valid = hasName && hasOnTrigger;
+            tagTriggerCheck = {
+              name: "tag-trigger-sanity",
+              status: valid ? "pass" : "fail",
+              exitCode: valid ? 0 : 1,
+              durationMs: 0,
+              stdout: valid ? `Valid workflow at ${tagWorkflowPath}` : "",
+              stderr: valid ? "" : "auto-tag-on-release-merge.yml appears malformed"
+            };
+          } catch {
+            tagTriggerCheck = {
+              name: "tag-trigger-sanity",
+              status: "fail",
+              exitCode: 1,
+              durationMs: 0,
+              stdout: "",
+              stderr: "Failed to read auto-tag-on-release-merge.yml"
+            };
+          }
+        } else {
+          tagTriggerCheck = {
+            name: "tag-trigger-sanity",
+            status: "fail",
+            exitCode: 1,
+            durationMs: 0,
+            stdout: "",
+            stderr: `.github/workflows/auto-tag-on-release-merge.yml not found`
+          };
+        }
+        checks.push(tagTriggerCheck);
+        const tsconfigPath = join22(repoRoot, "tsconfig.json");
+        if (existsSync13(tsconfigPath)) {
+          const tscPath = join22(repoRoot, "node_modules", ".bin", "tsc");
+          if (existsSync13(tscPath)) {
+            checks.push(await runCheck("typecheck", tscPath, ["--noEmit"], repoRoot));
+          } else {
+            checks.push({
+              name: "typecheck",
+              status: "skip",
+              exitCode: null,
+              durationMs: 0,
+              stdout: "",
+              stderr: "tsc not found in node_modules/.bin \u2014 skipping"
+            });
+          }
+        } else {
+          checks.push({
+            name: "typecheck",
+            status: "skip",
+            exitCode: null,
+            durationMs: 0,
+            stdout: "",
+            stderr: "tsconfig.json not found \u2014 skipping"
+          });
+        }
+        const fastLintScripts = [
+          { name: "contracts-dep-lint", script: "scripts/lint-contracts-dep.mjs" },
+          { name: "format-error-lint", script: "scripts/lint-format-error-misuse.mjs" },
+          { name: "json-stream-lint", script: "scripts/lint-json-stream-hygiene.mjs" }
+        ];
+        for (const lint of fastLintScripts) {
+          const scriptPath = join22(repoRoot, lint.script);
+          if (existsSync13(scriptPath)) {
+            checks.push(await runCheck(lint.name, "node", [scriptPath], repoRoot));
+          } else {
+            checks.push({
+              name: lint.name,
+              status: "skip",
+              exitCode: null,
+              durationMs: 0,
+              stdout: "",
+              stderr: `${lint.script} not found \u2014 skipping`
+            });
+          }
+        }
+        const passCount = checks.filter((c) => c.status === "pass").length;
+        const failCount = checks.filter((c) => c.status === "fail").length;
+        const skipCount = checks.filter((c) => c.status === "skip").length;
+        const totalDurationMs = Date.now() - startTotal;
+        const ready = failCount === 0;
+        const result = {
+          ready,
+          checks,
+          summary: {
+            pass: passCount,
+            fail: failCount,
+            skip: skipCount,
+            total: checks.length,
+            durationMs: totalDurationMs
+          }
+        };
+        if (isHuman && args.json !== true) {
+          humanLine("\nRelease Readiness Check (T10458)\n");
+          humanLine(`${"\u2500".repeat(60)}`);
+          for (const c of checks) {
+            const icon = c.status === "pass" ? "PASS" : c.status === "fail" ? "FAIL" : "SKIP";
+            humanLine(`  [${icon}] ${c.name} (${c.durationMs}ms)`);
+            if (c.status === "fail" && c.stderr) {
+              const lines = c.stderr.split("\n").slice(0, 3);
+              for (const line of lines) {
+                humanLine(`         ${line}`);
+              }
+            }
+          }
+          humanLine(`${"\u2500".repeat(60)}`);
+          humanLine(`  Result: ${passCount} passed, ${failCount} failed, ${skipCount} skipped`);
+          humanLine(`  Total time: ${totalDurationMs}ms`);
+          humanLine(`  Ready: ${ready ? "YES" : "NO"}
+`);
+        }
+        cliOutput(result, { command: "doctor", operation: "doctor.release-readiness" });
+        if (!ready) {
+          process.exitCode = 1;
+        }
+      }
+    });
+  }
+});
+
 // packages/cleo/src/cli/progress.ts
 import { stderr } from "node:process";
 function createSelfUpdateProgress(enabled) {
@@ -47353,8 +47906,8 @@ __export(migrate_agents_v2_exports, {
   walkAgentsDir: () => walkAgentsDir
 });
 import { createHash as createHash2 } from "node:crypto";
-import { appendFileSync as appendFileSync2, existsSync as existsSync13, mkdirSync as mkdirSync3, readdirSync as readdirSync2, readFileSync as readFileSync13 } from "node:fs";
-import { join as join22 } from "node:path";
+import { appendFileSync as appendFileSync2, existsSync as existsSync14, mkdirSync as mkdirSync3, readdirSync as readdirSync2, readFileSync as readFileSync13 } from "node:fs";
+import { join as join23 } from "node:path";
 import { getProjectRoot as getProjectRoot41, installAgentFromCant } from "@cleocode/core/internal";
 import { openCleoDb as openCleoDb2 } from "@cleocode/core/store/open-cleo-db";
 function sha256Hex(bytes) {
@@ -47374,15 +47927,15 @@ function extractAgentName(source) {
   return headerMatch[1] ?? null;
 }
 function appendAuditLog(projectRoot, entry) {
-  const auditPath = join22(projectRoot, AUDIT_LOG_RELATIVE);
-  const auditDir = join22(auditPath, "..");
-  if (!existsSync13(auditDir)) {
+  const auditPath = join23(projectRoot, AUDIT_LOG_RELATIVE);
+  const auditDir = join23(auditPath, "..");
+  if (!existsSync14(auditDir)) {
     mkdirSync3(auditDir, { recursive: true });
   }
   appendFileSync2(auditPath, JSON.stringify(entry) + "\n", "utf8");
 }
 function walkAgentsDir(db, scanDir, projectRoot, summary, verbose) {
-  if (!existsSync13(scanDir)) return;
+  if (!existsSync14(scanDir)) return;
   let files;
   try {
     files = readdirSync2(scanDir).filter((f) => f.endsWith(".cant"));
@@ -47393,7 +47946,7 @@ function walkAgentsDir(db, scanDir, projectRoot, summary, verbose) {
     return;
   }
   for (const filename of files) {
-    const cantPath = join22(scanDir, filename);
+    const cantPath = join23(scanDir, filename);
     const relPath = cantPath.replace(`${projectRoot}/`, "");
     let sourceBytes;
     let sourceText;
@@ -47490,9 +48043,9 @@ async function runMigrateAgentsV2(projectRoot, verbose = true) {
   const { db: _sdDb } = await openCleoDb2("signaldock");
   const db = _sdDb;
   try {
-    const canonicalDir = join22(projectRoot, ".cleo", "cant", "agents");
+    const canonicalDir = join23(projectRoot, ".cleo", "cant", "agents");
     walkAgentsDir(db, canonicalDir, projectRoot, summary, verbose);
-    const legacyDir = join22(projectRoot, ".cleo", "agents");
+    const legacyDir = join23(projectRoot, ".cleo", "agents");
     walkAgentsDir(db, legacyDir, projectRoot, summary, verbose);
   } finally {
     db.close();
@@ -47500,8 +48053,8 @@ async function runMigrateAgentsV2(projectRoot, verbose = true) {
   return summary;
 }
 function readMigrationConflicts(projectRoot) {
-  const auditPath = join22(projectRoot, AUDIT_LOG_RELATIVE);
-  if (!existsSync13(auditPath)) return [];
+  const auditPath = join23(projectRoot, AUDIT_LOG_RELATIVE);
+  if (!existsSync14(auditPath)) return [];
   let raw;
   try {
     raw = readFileSync13(auditPath, "utf8");
@@ -47585,7 +48138,7 @@ __export(doctor_exports, {
   doctorCommand: () => doctorCommand2
 });
 import { mkdirSync as mkdirSync4, writeFileSync as writeFileSync4 } from "node:fs";
-import { join as join23 } from "node:path";
+import { join as join24 } from "node:path";
 import { getProjectRoot as getProjectRoot42, pushWarning as pushWarning4 } from "@cleocode/core";
 import { renderInvariantAuditLines } from "@cleocode/core/doctor/invariant-audit-render.js";
 import {
@@ -47625,8 +48178,8 @@ async function scanTestFixturesInProd(projectRoot) {
 }
 async function quarantineTestFixtures(projectRoot, matches) {
   if (matches.length === 0) return 0;
-  const cleoDir = join23(projectRoot, ".cleo");
-  const quarantineDir = join23(
+  const cleoDir = join24(projectRoot, ".cleo");
+  const quarantineDir = join24(
     cleoDir,
     "quarantine",
     `fixture-scan-${(/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-")}`
@@ -47634,7 +48187,7 @@ async function quarantineTestFixtures(projectRoot, matches) {
   mkdirSync4(quarantineDir, { recursive: true });
   const manifest = matches.map((m) => ({ ...m, quarantinedAt: (/* @__PURE__ */ new Date()).toISOString() }));
   writeFileSync4(
-    join23(quarantineDir, "manifest.jsonl"),
+    join24(quarantineDir, "manifest.jsonl"),
     manifest.map((m) => JSON.stringify(m)).join("\n") + "\n"
   );
   const { getNativeDb } = await import("@cleocode/core/store/sqlite.js");
@@ -47705,6 +48258,7 @@ var init_doctor = __esm({
     init_doctor_db_substrate();
     init_doctor_legacy_backups();
     init_doctor_projects();
+    init_doctor_release_readiness();
     init_migrate_agents_v2();
     FIXTURE_ID_PATTERNS = [/^E\d+$/, /^T\d+EP$/];
     FIXTURE_TITLE_KEYWORDS = [
@@ -47719,7 +48273,9 @@ var init_doctor = __esm({
         // T10307 / Saga T10281 / Epic T10282 — DB-substrate walker
         "db-substrate": doctorDbSubstrateCommand,
         // T10309 / Saga T10281 / Epic T10282 — Legacy-backup walker
-        "legacy-backups": doctorLegacyBackupsCommand
+        "legacy-backups": doctorLegacyBackupsCommand,
+        // T10458 / Saga T10431 / Epic T10436 — Release-readiness preflight
+        "release-readiness": doctorReleaseReadinessCommand
       },
       args: {
         detailed: {
@@ -48208,8 +48764,8 @@ var init_doctor = __esm({
               );
               return;
             }
-            const archiveDir = join23(projectRoot, ".cleo", "backups");
-            const auditLogPath = join23(projectRoot, ".cleo", "audit", "worktree-prune.jsonl");
+            const archiveDir = join24(projectRoot, ".cleo", "backups");
+            const auditLogPath = join24(projectRoot, ".cleo", "audit", "worktree-prune.jsonl");
             const result = await pruneWorktreeOrphans(orphans, {
               archiveDir,
               auditLogPath,
@@ -48373,7 +48929,7 @@ __export(event_exports, {
   orchestratorCommand: () => orchestratorCommand
 });
 import { readdir as readdir2 } from "node:fs/promises";
-import { join as join24 } from "node:path";
+import { join as join25 } from "node:path";
 import { cwd as processCwd } from "node:process";
 import { appendEvent } from "@cleocode/core/events/event-bus.js";
 function resolveProjectRoot3(arg) {
@@ -48496,7 +49052,7 @@ var init_event = __esm({
         const agentIdFilter = args.agent;
         const showAll = args.all === true;
         const lines = parseInt(args.lines ?? "20", 10);
-        const eventsDir = join24(projectRoot, ".cleo", "agent-events");
+        const eventsDir = join25(projectRoot, ".cleo", "agent-events");
         try {
           let files = [];
           try {
@@ -48534,7 +49090,7 @@ var init_event = __esm({
           for (const file of filesToTail) {
             const agentId = file.replace(".jsonl", "");
             const { readFileSync: readFileSync21 } = await import("node:fs");
-            const content = readFileSync21(join24(eventsDir, file), "utf-8");
+            const content = readFileSync21(join25(eventsDir, file), "utf-8");
             const eventLines = content.trim().split("\n").filter(Boolean);
             const tail = eventLines.slice(-lines);
             if (jsonMode) {
@@ -48604,7 +49160,7 @@ var init_event = __esm({
         const epicFilter = args.epic;
         const follow = args.follow === true;
         const lines = parseInt(args.lines ?? "50", 10);
-        const eventsDir = join24(projectRoot, ".cleo", "agent-events");
+        const eventsDir = join25(projectRoot, ".cleo", "agent-events");
         let files = [];
         try {
           const entries = await readdir2(eventsDir);
@@ -48630,7 +49186,7 @@ var init_event = __esm({
           const agentId = file.replace(".jsonl", "");
           try {
             const { readFileSync: readFileSync21 } = await import("node:fs");
-            const content = readFileSync21(join24(eventsDir, file), "utf-8");
+            const content = readFileSync21(join25(eventsDir, file), "utf-8");
             const eventLines = content.trim().split("\n").filter(Boolean);
             const tail = eventLines.slice(-lines);
             if (jsonMode) {
@@ -49109,6 +49665,33 @@ var init_find = __esm({
           type: "boolean",
           description: "Surface urgent work across both axes: priority IN (critical,high) OR severity IN (P0,P1) (T9905)",
           alias: "u"
+        },
+        /**
+         * Filter by label — `cleo find --label <name>` returns every task
+         * whose `labels[]` includes the given value. Closes GH#393 and gives
+         * `find` parity with the positional `cleo labels <name>` surface.
+         * @task T9904
+         */
+        label: {
+          type: "string",
+          description: "Filter by label \u2014 return tasks whose labels[] includes this value (T9904)"
+        },
+        /**
+         * Filter by parent task ID — `cleo find --parent <id>` returns only
+         * tasks whose `parentId` matches. Mirrors the `--parent` axis on
+         * `cleo list`. When the parent target is a Saga (Epic with
+         * `label='saga'`), routing goes through `task_relations.type='groups'`
+         * member IDs (ADR-073 §1) — same path as `cleo list --parent`.
+         *
+         * Closes T10108 — pre-fix the flag was missing entirely AND empty-string
+         * queries bypassed every filter via `fuzzyScore('', '<title>')===80`.
+         *
+         * @task T10108
+         * @saga T9862
+         */
+        parent: {
+          type: "string",
+          description: "Filter by parent task ID \u2014 Saga-aware via task_relations groups (ADR-073 \xA71) (T10108)"
         }
       },
       async run({ args }) {
@@ -49127,6 +49710,8 @@ var init_find = __esm({
         if (args.verbose !== void 0) params["verbose"] = args.verbose;
         if (args.kind !== void 0) params["kind"] = args.kind;
         if (args.urgent !== void 0) params["urgent"] = args.urgent;
+        if (args.label !== void 0) params["label"] = args.label;
+        if (args.parent !== void 0) params["parent"] = args.parent;
         const response = await dispatchRaw("query", "tasks", "find", params);
         if (!response.success) {
           handleRawError(response, { command: "find", operation: "tasks.find" });
@@ -49193,7 +49778,7 @@ __export(gc_exports, {
   gcCommand: () => gcCommand
 });
 import { homedir as homedir4, tmpdir } from "node:os";
-import { join as join25 } from "node:path";
+import { join as join26 } from "node:path";
 import { pruneOrphanTempDirs, pruneOrphanWorktrees } from "@cleocode/core/gc/cleanup.js";
 import { runGC } from "@cleocode/core/gc/runner.js";
 import { readGCState } from "@cleocode/core/gc/state.js";
@@ -49276,7 +49861,7 @@ var init_gc = __esm({
       },
       async run({ args }) {
         const cleoDir = resolveLegacyCleoDir3(args["cleo-dir"]);
-        const statePath = join25(cleoDir, "gc-state.json");
+        const statePath = join26(cleoDir, "gc-state.json");
         try {
           const state = await readGCState(statePath);
           const diskStr = state.lastDiskUsedPct !== null ? `${state.lastDiskUsedPct.toFixed(1)}%` : "unknown";
@@ -49329,8 +49914,8 @@ var init_gc = __esm({
         }
       },
       async run({ args }) {
-        const xdgData = process.env["XDG_DATA_HOME"] ?? join25(homedir4(), ".local", "share");
-        const worktreesRoot = args["worktrees-root"] ?? join25(xdgData, "cleo", "worktrees");
+        const xdgData = process.env["XDG_DATA_HOME"] ?? join26(homedir4(), ".local", "share");
+        const worktreesRoot = args["worktrees-root"] ?? join26(xdgData, "cleo", "worktrees");
         const projectHash = args["project-hash"];
         const dryRun = args["dry-run"];
         const preserveRaw = args["preserve-tasks"];
@@ -50381,6 +50966,50 @@ var init_history = __esm({
   }
 });
 
+// packages/cleo/src/cli/commands/hygiene.ts
+var hygiene_exports = {};
+__export(hygiene_exports, {
+  hygieneCommand: () => hygieneCommand
+});
+import { getProjectRoot as getProjectRoot43 } from "@cleocode/core";
+import { runSpawnReadinessHygieneCli } from "@cleocode/core/hygiene/validate-spawn-readiness.js";
+var hygieneCommand;
+var init_hygiene = __esm({
+  "packages/cleo/src/cli/commands/hygiene.ts"() {
+    "use strict";
+    init_dist();
+    hygieneCommand = defineCommand({
+      meta: {
+        name: "hygiene",
+        description: "Run spawn-readiness hygiene checks"
+      },
+      subCommands: {
+        "validate-spawn-readiness": defineCommand({
+          meta: {
+            name: "validate-spawn-readiness",
+            description: "Run all pre-spawn hygiene gates (changeset lint, changelog drift, worktree location)"
+          },
+          args: {
+            "project-root": {
+              type: "string",
+              description: "Project root directory (default: auto-detect)"
+            },
+            "worktree-path": {
+              type: "string",
+              description: "Expected worktree path for location validation"
+            }
+          },
+          async run({ args }) {
+            const projectRoot = args["project-root"] || getProjectRoot43() || process.cwd();
+            const worktreePath = args["worktree-path"];
+            await runSpawnReadinessHygieneCli(projectRoot, worktreePath);
+          }
+        })
+      }
+    });
+  }
+});
+
 // packages/cleo/src/cli/commands/import-tasks.ts
 var import_tasks_exports = {};
 __export(import_tasks_exports, {
@@ -50542,8 +51171,8 @@ __export(init_exports, {
   getWorkflowTemplatesDir: () => getWorkflowTemplatesDir2,
   initCommand: () => initCommand2
 });
-import { existsSync as existsSync14, readFileSync as readFileSync14 } from "node:fs";
-import { join as join26 } from "node:path";
+import { existsSync as existsSync15, readFileSync as readFileSync14 } from "node:fs";
+import { join as join27 } from "node:path";
 import { fileURLToPath as fileURLToPath6 } from "node:url";
 import {
   CleoError as CleoError4,
@@ -50556,11 +51185,11 @@ import { getTemplatesByKind } from "@cleocode/core/templates/registry";
 function getGitignoreTemplate() {
   try {
     const thisFile = fileURLToPath6(import.meta.url);
-    const packageRoot = join26(thisFile, "..", "..", "..", "..");
-    const localTemplatePath = join26(packageRoot, "templates", "cleo-gitignore");
-    const monorepoTemplatePath = join26(packageRoot, "..", "..", "templates", "cleo-gitignore");
-    const templatePath = existsSync14(localTemplatePath) ? localTemplatePath : monorepoTemplatePath;
-    if (existsSync14(templatePath)) {
+    const packageRoot = join27(thisFile, "..", "..", "..", "..");
+    const localTemplatePath = join27(packageRoot, "templates", "cleo-gitignore");
+    const monorepoTemplatePath = join27(packageRoot, "..", "..", "templates", "cleo-gitignore");
+    const templatePath = existsSync15(localTemplatePath) ? localTemplatePath : monorepoTemplatePath;
+    if (existsSync15(templatePath)) {
       return readFileSync14(templatePath, "utf-8");
     }
   } catch {
@@ -51172,7 +51801,17 @@ var init_labels = __esm({
     labelsCommand = defineCommand({
       meta: {
         name: "labels",
-        description: "List all labels with counts or show tasks with specific label"
+        description: "List all labels (no args), or show tasks for a label (cleo labels <name>)"
+      },
+      args: {
+        // Optional positional — when present, dispatches to tasks.list with the
+        // label filter; when absent, falls through to the legacy label.list path.
+        // Required:false keeps the bare `cleo labels` invocation working.
+        name: {
+          type: "positional",
+          description: "Label name to filter tasks by (omit to list all labels)",
+          required: false
+        }
       },
       subCommands: {
         list: listCommand10,
@@ -51180,9 +51819,16 @@ var init_labels = __esm({
         stats: statsCommand2
       },
       async run(ctx) {
-        if (!ctx.rawArgs.some((a) => ["list", "show", "stats"].includes(a))) {
-          await dispatchFromCli("query", "tasks", "label.list", {}, { command: "labels" });
+        const rawArgs = ctx.rawArgs ?? [];
+        if (rawArgs.some((a) => ["list", "show", "stats"].includes(a))) {
+          return;
+        }
+        const name = ctx.args.name;
+        if (typeof name === "string" && name.length > 0) {
+          await dispatchFromCli("query", "tasks", "list", { label: name }, { command: "labels" });
+          return;
         }
+        await dispatchFromCli("query", "tasks", "label.list", {}, { command: "labels" });
       }
     });
   }
@@ -51516,7 +52162,7 @@ var llm_cost_exports = {};
 __export(llm_cost_exports, {
   costCommand: () => costCommand
 });
-import { getProjectRoot as getProjectRoot43 } from "@cleocode/core/internal";
+import { getProjectRoot as getProjectRoot44 } from "@cleocode/core/internal";
 import { computeCost } from "@cleocode/core/llm/usage-pricing";
 function resolveSessionId(raw) {
   if (raw === "current") {
@@ -51589,7 +52235,7 @@ var init_llm_cost = __esm({
           process.exit(6);
         }
         const sessionId = resolveSessionId(rawSessionId);
-        const projectRoot = getProjectRoot43(process.cwd());
+        const projectRoot = getProjectRoot44(process.cwd());
         let breakdown;
         try {
           breakdown = await loadSessionCostBreakdown(projectRoot, sessionId);
@@ -51960,7 +52606,7 @@ async function _headlessPkceFlow(provider, authUrl) {
     `  After approving, paste the full redirect URL (http://localhost?code=\u2026&state=\u2026):
   `
   );
-  return new Promise((resolve8, reject) => {
+  return new Promise((resolve9, reject) => {
     let buf = "";
     process.stdin.setEncoding("utf8");
     process.stdin.once("data", (chunk) => {
@@ -51972,7 +52618,7 @@ async function _headlessPkceFlow(provider, authUrl) {
           reject(new Error('Redirect URL is missing the "code" parameter'));
           return;
         }
-        resolve8(code);
+        resolve9(code);
       } catch {
         reject(new Error(`Invalid redirect URL: ${buf}`));
       }
@@ -51980,7 +52626,7 @@ async function _headlessPkceFlow(provider, authUrl) {
   });
 }
 async function _localCallbackPkceFlow(provider, authUrl, expectedState, port) {
-  return new Promise((resolve8) => {
+  return new Promise((resolve9) => {
     const server = createServer2((req, res) => {
       const url = new URL(req.url ?? "/", `http://localhost:${port}`);
       const code = url.searchParams.get("code");
@@ -51990,7 +52636,7 @@ async function _localCallbackPkceFlow(provider, authUrl, expectedState, port) {
       if (error) {
         res.end(`<h1>Authorization failed</h1><p>${error}</p><p>You may close this tab.</p>`);
         server.close();
-        resolve8({
+        resolve9({
           error: {
             code: "E_PKCE_AUTH_DENIED",
             codeName: "E_PKCE_AUTH_DENIED",
@@ -52002,7 +52648,7 @@ async function _localCallbackPkceFlow(provider, authUrl, expectedState, port) {
       if (!code || state !== expectedState) {
         res.end("<h1>Invalid callback</h1><p>You may close this tab.</p>");
         server.close();
-        resolve8({
+        resolve9({
           error: {
             code: "E_PKCE_INVALID_CALLBACK",
             codeName: "E_PKCE_INVALID_CALLBACK",
@@ -52013,7 +52659,7 @@ async function _localCallbackPkceFlow(provider, authUrl, expectedState, port) {
       }
       res.end("<h1>Authorized</h1><p>You may close this tab and return to your terminal.</p>");
       server.close();
-      resolve8({ code });
+      resolve9({ code });
     });
     server.listen(port, "localhost", () => {
       process.stderr.write("\n");
@@ -52146,7 +52792,7 @@ function _generateState() {
   return Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
 }
 function _findFreePort() {
-  return new Promise((resolve8, reject) => {
+  return new Promise((resolve9, reject) => {
     const srv = createServer2();
     srv.listen(0, "localhost", () => {
       const addr = srv.address();
@@ -52156,7 +52802,7 @@ function _findFreePort() {
         return;
       }
       const port = addr.port;
-      srv.close(() => resolve8(port));
+      srv.close(() => resolve9(port));
     });
     srv.on("error", reject);
   });
@@ -52778,14 +53424,14 @@ async function readStdin() {
   if (process.stdin.isTTY) {
     return "";
   }
-  return new Promise((resolve8, reject) => {
+  return new Promise((resolve9, reject) => {
     let data = "";
     process.stdin.setEncoding("utf-8");
     process.stdin.on("data", (chunk) => {
       data += chunk;
     });
     process.stdin.on("end", () => {
-      resolve8(data.trim());
+      resolve9(data.trim());
     });
     process.stdin.on("error", reject);
   });
@@ -53136,7 +53782,7 @@ var memory_exports = {};
 __export(memory_exports, {
   memoryCommand: () => memoryCommand
 });
-import { getProjectRoot as getProjectRoot44 } from "@cleocode/core";
+import { getProjectRoot as getProjectRoot45 } from "@cleocode/core";
 import {
   getBrainDb as getBrainDb2,
   getDreamStatus,
@@ -54060,7 +54706,7 @@ var init_memory3 = __esm({
       },
       args: {},
       async run() {
-        const root = getProjectRoot44();
+        const root = getProjectRoot45();
         try {
           const result = await runConsolidation(root);
           cliOutput(result, { command: "memory-consolidate", operation: "memory.consolidate" });
@@ -54084,7 +54730,7 @@ var init_memory3 = __esm({
         }
       },
       async run({ args }) {
-        const root = getProjectRoot44();
+        const root = getProjectRoot45();
         if (args.status) {
           try {
             const status = await getDreamStatus(root);
@@ -54121,7 +54767,7 @@ var init_memory3 = __esm({
         }
       },
       async run({ args }) {
-        const root = getProjectRoot44();
+        const root = getProjectRoot45();
         try {
           const { runObserver, runReflector } = await import("@cleocode/core/memory");
           const observerResult = await runObserver(root, args.session, {
@@ -54161,7 +54807,7 @@ var init_memory3 = __esm({
         }
       },
       async run({ args }) {
-        const root = getProjectRoot44();
+        const root = getProjectRoot45();
         try {
           await getBrainDb2(root);
           const { totalDuplicateRows, groups } = await scanDuplicateEntries();
@@ -54207,7 +54853,7 @@ var init_memory3 = __esm({
       async run({ args }) {
         const sourceDir = args.from;
         const isDryRun = !!args["dry-run"];
-        const projectRoot = getProjectRoot44();
+        const projectRoot = getProjectRoot45();
         try {
           const result = await importMemoryFiles({
             sourceDir,
@@ -54358,7 +55004,7 @@ var init_memory3 = __esm({
       },
       args: {},
       async run() {
-        const root = getProjectRoot44();
+        const root = getProjectRoot45();
         try {
           await getBrainDb2(root);
           const result = await getTierStats(root);
@@ -54401,7 +55047,7 @@ var init_memory3 = __esm({
         }
       },
       async run({ args }) {
-        const root = getProjectRoot44();
+        const root = getProjectRoot45();
         const targetTier = args.to;
         const reason = args.reason;
         const validTiers = ["medium", "long"];
@@ -54467,7 +55113,7 @@ var init_memory3 = __esm({
         }
       },
       async run({ args }) {
-        const root = getProjectRoot44();
+        const root = getProjectRoot45();
         const targetTier = args.to;
         const reason = args.reason;
         const validTiers = ["short", "medium"];
@@ -54927,7 +55573,7 @@ var migrate_claude_mem_exports = {};
 __export(migrate_claude_mem_exports, {
   migrateClaudeMemCommand: () => migrateClaudeMemCommand
 });
-import { getProjectRoot as getProjectRoot45, migrateClaudeMem } from "@cleocode/core/internal";
+import { getProjectRoot as getProjectRoot46, migrateClaudeMem } from "@cleocode/core/internal";
 import { ingestLooseAgentOutputs, ingestRcasdDirectories } from "@cleocode/core/memory";
 import { getDb as getDb2 } from "@cleocode/core/store/sqlite";
 var storageCommand, claudeMemCommand, manifestIngestCommand, migrateClaudeMemCommand;
@@ -54990,7 +55636,7 @@ var init_migrate_claude_mem = __esm({
         }
       },
       async run({ args }) {
-        const root = getProjectRoot45();
+        const root = getProjectRoot46();
         try {
           const result = await migrateClaudeMem(root, {
             sourcePath: args.source,
@@ -55039,7 +55685,7 @@ var init_migrate_claude_mem = __esm({
         }
       },
       async run({ args }) {
-        const projectRoot = getProjectRoot45();
+        const projectRoot = getProjectRoot46();
         try {
           const db = await getDb2(projectRoot);
           const rcasdFlag = Boolean(args.rcasd);
@@ -55143,7 +55789,7 @@ __export(nexus_exports, {
 import { appendFile as appendFile2, mkdir as mkdir3 } from "node:fs/promises";
 import { homedir as homedir5 } from "node:os";
 import path4 from "node:path";
-import { getProjectRoot as getProjectRoot46 } from "@cleocode/core";
+import { getProjectRoot as getProjectRoot47 } from "@cleocode/core";
 import { getSymbolImpact } from "@cleocode/core/nexus";
 import { runNexusAnalysis } from "@cleocode/core/nexus/analyze-orchestrator.js";
 import { exportNexusGraph } from "@cleocode/core/nexus/export.js";
@@ -55258,7 +55904,7 @@ var init_nexus3 = __esm({
       async run({ args }) {
         applyJsonFlag2(args.json);
         const projectIdOverride = args["project-id"];
-        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot46();
+        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot47();
         const startTime = Date.now();
         try {
           const [{ getNexusDb, nexusSchema }, { getIndexStats }] = await Promise.all([
@@ -55773,7 +56419,7 @@ var init_nexus3 = __esm({
         applyJsonFlag2(args.json);
         const startTime = Date.now();
         const projectIdOverride = args["project-id"];
-        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot46();
+        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot47();
         const projectId = projectIdOverride ?? Buffer.from(repoPath).toString("base64url").slice(0, 32);
         const response = await dispatchRaw("query", "nexus", "clusters", { projectId, repoPath });
         const durationMs = Date.now() - startTime;
@@ -55817,7 +56463,7 @@ var init_nexus3 = __esm({
         applyJsonFlag2(args.json);
         const startTime = Date.now();
         const projectIdOverride = args["project-id"];
-        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot46();
+        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot47();
         const projectId = projectIdOverride ?? Buffer.from(repoPath).toString("base64url").slice(0, 32);
         const response = await dispatchRaw("query", "nexus", "flows", { projectId, repoPath });
         const durationMs = Date.now() - startTime;
@@ -55860,7 +56506,7 @@ var init_nexus3 = __esm({
         void appendDeprecationTelemetry("nexus.context", "cleo graph context");
         const startTime = Date.now();
         const projectIdOverride = args["project-id"];
-        const repoPath = getProjectRoot46();
+        const repoPath = getProjectRoot47();
         const projectId = projectIdOverride ?? Buffer.from(repoPath).toString("base64url").slice(0, 32);
         const limit = parseInt(args.limit, 10);
         const symbolName = args.symbol;
@@ -55923,7 +56569,7 @@ var init_nexus3 = __esm({
         const startTime = Date.now();
         const whyFlag = !!args.why;
         const projectIdOverride = args["project-id"];
-        const repoPath = getProjectRoot46();
+        const repoPath = getProjectRoot47();
         const projectId = projectIdOverride ?? Buffer.from(repoPath).toString("base64url").slice(0, 32);
         const maxDepth = Math.min(parseInt(args.depth, 10), 5);
         const symbolName = args.symbol;
@@ -55995,7 +56641,7 @@ var init_nexus3 = __esm({
         const projectIdOverride = args["project-id"];
         const isIncremental = !!args.incremental;
         const ctx = getFormatContext();
-        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot46();
+        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot47();
         humanInfo(`[nexus] Analyzing: ${repoPath}${isIncremental ? " (incremental)" : ""}`);
         if (!isIncremental) humanInfo("[nexus] Clearing existing index for project...");
         try {
@@ -56098,7 +56744,7 @@ var init_nexus3 = __esm({
       async run({ args }) {
         applyJsonFlag2(args.json);
         const startTime = Date.now();
-        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot46();
+        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot47();
         const name = args.name;
         const response = await dispatchRaw("mutate", "nexus", "projects.register", {
           path: repoPath,
@@ -56354,13 +57000,13 @@ var init_nexus3 = __esm({
           if (!skipPrompt) {
             const { createInterface: createInterface5 } = await import("node:readline");
             const rl = createInterface5({ input: process.stdin, output: process.stdout });
-            const confirmed = await new Promise((resolve8) => {
+            const confirmed = await new Promise((resolve9) => {
               rl.question(
                 `
 [nexus] Delete ${matchCount} project(s) from the registry? [y/N] `,
                 (answer) => {
                   rl.close();
-                  resolve8(answer.trim().toLowerCase() === "y");
+                  resolve9(answer.trim().toLowerCase() === "y");
                 }
               );
             });
@@ -56456,7 +57102,7 @@ var init_nexus3 = __esm({
         applyJsonFlag2(args.json);
         const startTime = Date.now();
         const projectIdOverride = args["project-id"];
-        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot46();
+        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot47();
         const projectId = projectIdOverride ?? Buffer.from(repoPath).toString("base64url").slice(0, 32);
         const response = await dispatchRaw("mutate", "nexus", "refresh-bridge", {
           repoPath,
@@ -56562,7 +57208,7 @@ var init_nexus3 = __esm({
       async run({ args }) {
         applyJsonFlag2(args.json);
         const startTime = Date.now();
-        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot46();
+        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot47();
         const projectIdOverride = args["project-id"];
         const beforeRef = args.before ?? "HEAD~1";
         const afterRef = args.after ?? "HEAD";
@@ -56680,7 +57326,7 @@ var init_nexus3 = __esm({
         applyJsonFlag2(args.json);
         const startTime = Date.now();
         const projectIdOverride = args["project-id"];
-        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot46();
+        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot47();
         const projectId = projectIdOverride ?? Buffer.from(repoPath).toString("base64url").slice(0, 32);
         const response = await dispatchRaw("query", "nexus", "route-map", { projectId });
         const durationMs = Date.now() - startTime;
@@ -56736,7 +57382,7 @@ var init_nexus3 = __esm({
         const startTime = Date.now();
         const routeSymbol = args.routeSymbol;
         const projectIdOverride = args["project-id"];
-        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot46();
+        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot47();
         const projectId = projectIdOverride ?? Buffer.from(repoPath).toString("base64url").slice(0, 32);
         const response = await dispatchRaw("query", "nexus", "shape-check", { routeSymbol, projectId });
         const durationMs = Date.now() - startTime;
@@ -57126,7 +57772,7 @@ var init_nexus3 = __esm({
       async run({ args }) {
         applyJsonFlag2(args.json);
         const startTime = Date.now();
-        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot46();
+        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot47();
         const projectIdOverride = args["project-id"];
         const projectId = projectIdOverride ?? Buffer.from(repoPath).toString("base64url").slice(0, 32);
         const response = await dispatchRaw("mutate", "nexus", "contracts-sync", {
@@ -57230,7 +57876,7 @@ var init_nexus3 = __esm({
       async run({ args }) {
         applyJsonFlag2(args.json);
         const startTime = Date.now();
-        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot46();
+        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot47();
         const projectId = Buffer.from(repoPath).toString("base64url").slice(0, 32);
         const response = await dispatchRaw("mutate", "nexus", "contracts-link-tasks", {
           projectId,
@@ -57311,7 +57957,7 @@ var init_nexus3 = __esm({
         const isIncremental = !!args.incremental;
         try {
           const result = await runNexusWiki({
-            projectRoot: getProjectRoot46(),
+            projectRoot: getProjectRoot47(),
             outputDir,
             communityFilter,
             incremental: isIncremental
@@ -57661,7 +58307,7 @@ __export(orchestrate_exports, {
 });
 import { execFileSync as execFileSync3 } from "node:child_process";
 import { orchestration } from "@cleocode/core";
-import { BUILD_CONFIG as BUILD_CONFIG2 } from "@cleocode/core/internal";
+import { BUILD_CONFIG as BUILD_CONFIG2, getProjectRoot as getProjectRoot48 } from "@cleocode/core/internal";
 function formatRollupTable(rollup) {
   const waves = "waves" in rollup ? rollup.waves : [rollup];
   const lines = [];
@@ -57696,7 +58342,7 @@ function formatRollupTable(rollup) {
   }
   return lines.join("\n");
 }
-var rollupCommand, startCommand5, statusCommand11, analyzeCommand4, readyCommand, nextCommand2, wavesCommand2, planCommand, spawnCommand2, validateCommand6, contextCommand5, ivtrCommand, parallelCommand, tesseraListCommand, tesseraInstantiateCommand, tesseraCommand, unblockCommand, bootstrapCommand, classifyCommand, fanoutStatusCommand, handoffCommand, spawnExecuteCommand, fanoutCommand, pruneCommand, worktreeCompleteCommand, conduitStatusCommand, conduitPeekCommand, conduitStartCommand, conduitStopCommand, approveCommand, rejectCommand, pendingCommand, conduitSendCommand, orchestrateCommand;
+var rollupCommand, startCommand5, statusCommand11, dashboardCommand, analyzeCommand4, readyCommand, nextCommand2, wavesCommand2, planCommand, spawnCommand2, validateCommand6, contextCommand5, ivtrCommand, parallelCommand, tesseraListCommand, tesseraInstantiateCommand, tesseraCommand, unblockCommand, bootstrapCommand, classifyCommand, fanoutStatusCommand, handoffCommand, spawnExecuteCommand, fanoutCommand, pruneCommand, worktreeCompleteCommand, conduitStatusCommand, conduitPeekCommand, conduitStartCommand, conduitStopCommand, approveCommand, rejectCommand, pendingCommand, conduitSendCommand, orchestrateCommand;
 var init_orchestrate3 = __esm({
   "packages/cleo/src/cli/commands/orchestrate.ts"() {
     "use strict";
@@ -57791,6 +58437,28 @@ var init_orchestrate3 = __esm({
         );
       }
     });
+    dashboardCommand = defineCommand({
+      meta: {
+        name: "dashboard",
+        description: "Show queue depth, admin-merge rate, force-bypass rate, and active worktree count"
+      },
+      args: {
+        window: {
+          type: "string",
+          description: "Audit rate window in hours (default: 24)"
+        }
+      },
+      async run({ args }) {
+        const rateWindowHours = args.window !== void 0 ? Number.parseFloat(String(args.window)) : void 0;
+        const metrics = await orchestration.collectOrchestrateDashboard(getProjectRoot48(), {
+          ...rateWindowHours !== void 0 && Number.isFinite(rateWindowHours) && rateWindowHours > 0 ? { rateWindowHours } : {}
+        });
+        cliOutput(metrics, {
+          command: "orchestrate-dashboard",
+          operation: "orchestrate.dashboard"
+        });
+      }
+    });
     analyzeCommand4 = defineCommand({
       meta: { name: "analyze", description: "Analyze epic dependency structure" },
       args: {
@@ -58547,6 +59215,7 @@ var init_orchestrate3 = __esm({
       subCommands: {
         start: startCommand5,
         status: statusCommand11,
+        dashboard: dashboardCommand,
         "roll-up": rollupCommand,
         analyze: analyzeCommand4,
         ready: readyCommand,
@@ -59771,7 +60440,7 @@ var refresh_memory_exports = {};
 __export(refresh_memory_exports, {
   refreshMemoryCommand: () => refreshMemoryCommand
 });
-import { getProjectRoot as getProjectRoot47 } from "@cleocode/core";
+import { getProjectRoot as getProjectRoot49 } from "@cleocode/core";
 var refreshMemoryCommand;
 var init_refresh_memory = __esm({
   "packages/cleo/src/cli/commands/refresh-memory.ts"() {
@@ -59784,7 +60453,7 @@ var init_refresh_memory = __esm({
         description: "Regenerate .cleo/memory-bridge.md from brain.db"
       },
       async run() {
-        const projectDir = getProjectRoot47();
+        const projectDir = getProjectRoot49();
         const { writeMemoryBridge } = await import("@cleocode/core/internal");
         const result = await writeMemoryBridge(projectDir);
         if (result.written) {
@@ -60032,7 +60701,7 @@ __export(release_exports, {
   releaseCommand: () => releaseCommand
 });
 import { release as release3 } from "@cleocode/core";
-var listCommand19, showCommand10, cancelCommand2, rollbackCommand, rollbackFullCommand, prStatusCommand, channelCommand, planCommand3, openCommand2, reconcileCommand4, releaseCommand;
+var listCommand19, showCommand10, cancelCommand2, rollbackCommand, rollbackFullCommand, prStatusCommand, channelCommand, validateChangelogCommand, planCommand3, openCommand2, reconcileCommand4, releaseCommand;
 var init_release3 = __esm({
   "packages/cleo/src/cli/commands/release.ts"() {
     "use strict";
@@ -60181,6 +60850,36 @@ var init_release3 = __esm({
         await dispatchFromCli("query", "pipeline", "release.channel.show", {}, { command: "release" });
       }
     });
+    validateChangelogCommand = defineCommand({
+      meta: {
+        name: "validate-changelog",
+        description: "Validate that CHANGELOG.md contains the canonical `## [VERSION]` header (T9937)"
+      },
+      args: {
+        version: {
+          type: "positional",
+          description: "Release version (accepts v2026.5.94 or 2026.5.94)",
+          required: true
+        },
+        path: {
+          type: "string",
+          description: "Override the CHANGELOG file path (default: <projectRoot>/CHANGELOG.md)",
+          required: false
+        }
+      },
+      async run({ args }) {
+        await dispatchFromCli(
+          "query",
+          "release",
+          "validate-changelog",
+          {
+            version: args.version,
+            ...typeof args.path === "string" && args.path.length > 0 ? { changelogPath: args.path } : {}
+          },
+          { command: "release" }
+        );
+      }
+    });
     planCommand3 = defineCommand({
       meta: {
         name: "plan",
@@ -60221,9 +60920,17 @@ var init_release3 = __esm({
         "no-changelog": {
           type: "boolean",
           description: "Skip CHANGELOG.md auto-write (default: write/replace the ## [<version>] section). (T9838)"
+        },
+        "skip-readiness": {
+          type: "boolean",
+          description: "Skip the release-readiness preflight check (default: run check). Use only in emergency. (T10459)"
         }
       },
       async run({ args }) {
+        if (args["skip-readiness"] !== true) {
+          const { runSpawnReadinessHygieneCli: runSpawnReadinessHygieneCli2 } = await import("@cleocode/core/hygiene/validate-spawn-readiness.js");
+          await runSpawnReadinessHygieneCli2();
+        }
         await dispatchFromCli(
           "mutate",
           "release",
@@ -60344,7 +61051,9 @@ var init_release3 = __esm({
         cancel: cancelCommand2,
         "pr-status": prStatusCommand,
         channel: channelCommand,
-        "rollback-full": rollbackFullCommand
+        "rollback-full": rollbackFullCommand,
+        // T9937 — canonical CHANGELOG.md header validator (Saga T9862).
+        "validate-changelog": validateChangelogCommand
       },
       async run({ cmd, rawArgs }) {
         const firstArg = rawArgs?.find((a) => !a.startsWith("-"));
@@ -61185,8 +61894,8 @@ import fs3 from "node:fs";
 import path5 from "node:path";
 import {
   CleoError as CleoError7,
-  getProjectRoot as getProjectRoot48,
-  getTaskAccessor as getTaskAccessor3,
+  getProjectRoot as getProjectRoot50,
+  getTaskAccessor as getTaskAccessor4,
   parseConflictReport,
   setAtPath
 } from "@cleocode/core";
@@ -61206,7 +61915,7 @@ var init_restore = __esm({
         description: "Apply manually-resolved conflicts from .cleo/restore-conflicts.md"
       },
       async run() {
-        const projectRoot = getProjectRoot48();
+        const projectRoot = getProjectRoot50();
         const reportPath = path5.join(projectRoot, CLEO_DIR_NAME, RESTORE_CONFLICTS_MD);
         if (!fs3.existsSync(reportPath)) {
           humanLine("No pending restore conflicts. Nothing to finalize.");
@@ -61384,7 +62093,7 @@ var init_restore = __esm({
           if (!idPattern.test(taskId)) {
             throw new CleoError7(2 /* INVALID_INPUT */, `Invalid task ID: ${taskId}`);
           }
-          const accessor = await getTaskAccessor3();
+          const accessor = await getTaskAccessor4();
           const activeTask = await accessor.loadSingleTask(taskId);
           if (activeTask) {
             if (activeTask.status === "cancelled") {
@@ -61572,7 +62281,7 @@ __export(revert_exports, {
   revertCommand: () => revertCommand
 });
 import { readFile as readFile5 } from "node:fs/promises";
-import { join as join27 } from "node:path";
+import { join as join28 } from "node:path";
 import { cwd as processCwd2 } from "node:process";
 import { E_RECEIPT_NOT_FOUND } from "@cleocode/core/sentient/chain-walker.js";
 import { SENTIENT_STATE_FILE } from "@cleocode/core/sentient/daemon.js";
@@ -61625,7 +62334,7 @@ async function loadOwnerAttestation(attestationFilePath) {
   return obj;
 }
 async function loadOwnerPubkeys(projectRoot) {
-  const path6 = join27(projectRoot, OWNER_PUBKEYS_FILE);
+  const path6 = join28(projectRoot, OWNER_PUBKEYS_FILE);
   try {
     const raw = await readFile5(path6, "utf-8");
     const parsed = JSON.parse(raw);
@@ -61709,7 +62418,7 @@ var init_revert = __esm({
         if (attestation && allowedPubkeys.size > 0 && !allowedPubkeys.has(attestation.ownerPubkey)) {
           emitFailure2(
             E_OWNER_ATTESTATION_REQUIRED,
-            `Attestation pubkey "${attestation.ownerPubkey}" is not in the owner allowlist at ${join27(projectRoot, OWNER_PUBKEYS_FILE)}`,
+            `Attestation pubkey "${attestation.ownerPubkey}" is not in the owner allowlist at ${join28(projectRoot, OWNER_PUBKEYS_FILE)}`,
             jsonMode
           );
         }
@@ -61762,7 +62471,7 @@ ${lines}`
             identity,
             includeHuman
           });
-          const statePath = join27(projectRoot, SENTIENT_STATE_FILE);
+          const statePath = join28(projectRoot, SENTIENT_STATE_FILE);
           const state = await readSentientState(statePath);
           emitSuccess(
             {
@@ -62296,7 +63005,7 @@ __export(self_update_exports, {
 });
 import { execFile } from "node:child_process";
 import { readFile as readFile6 } from "node:fs/promises";
-import { join as join28 } from "node:path";
+import { join as join29 } from "node:path";
 import * as readline2 from "node:readline";
 import { promisify } from "node:util";
 import {
@@ -62311,7 +63020,7 @@ import {
 async function getCurrentVersion() {
   const cleoHome = getCleoHome4();
   try {
-    const content = await readFile6(join28(cleoHome, "VERSION"), "utf-8");
+    const content = await readFile6(join29(cleoHome, "VERSION"), "utf-8");
     return (content.split("\n")[0] ?? "unknown").trim();
   } catch {
     return "unknown";
@@ -62365,7 +63074,7 @@ async function writeRuntimeVersionMetadata(mode, source, version) {
   ];
   await import("node:fs/promises").then(
     ({ writeFile: writeFile4, mkdir: mkdir5 }) => mkdir5(cleoHome, { recursive: true }).then(
-      () => writeFile4(join28(cleoHome, "VERSION"), `${lines.join("\n")}
+      () => writeFile4(join29(cleoHome, "VERSION"), `${lines.join("\n")}
 `, "utf-8")
     )
   );
@@ -62403,11 +63112,11 @@ async function runPostUpdateDiagnostics(opts) {
         input: process.stdin,
         output: process.stdout
       });
-      shouldMigrate = await new Promise((resolve8) => {
+      shouldMigrate = await new Promise((resolve9) => {
         rl.question("  Do you want to run the upgrade now? [Y/n] ", (answer) => {
           rl.close();
           const clean = answer.trim().toLowerCase();
-          resolve8(clean === "" || clean === "y" || clean === "yes");
+          resolve9(clean === "" || clean === "y" || clean === "yes");
         });
       });
     }
@@ -62778,7 +63487,7 @@ __export(sentient_exports, {
   promptAcceptExecution: () => promptAcceptExecution,
   sentientCommand: () => sentientCommand
 });
-import { join as join29 } from "node:path";
+import { join as join30 } from "node:path";
 import { cwd as processCwd3, stdin, stdout } from "node:process";
 import { createInterface as createInterface3 } from "node:readline/promises";
 import {
@@ -62867,7 +63576,7 @@ var init_sentient3 = __esm({
             return;
           }
           if (dryRun) {
-            const statePath2 = join29(projectRoot, SENTIENT_STATE_FILE2);
+            const statePath2 = join30(projectRoot, SENTIENT_STATE_FILE2);
             const outcome = await safeRunTick({ projectRoot, statePath: statePath2, dryRun: true });
             emitSuccess2(
               { dryRun: true, outcome },
@@ -62983,7 +63692,7 @@ Logs:  ${logPath}`
         const jsonMode = args.json === true;
         const dryRun = args["dry-run"] === true;
         try {
-          const statePath = join29(projectRoot, SENTIENT_STATE_FILE2);
+          const statePath = join30(projectRoot, SENTIENT_STATE_FILE2);
           const outcome = await safeRunTick({ projectRoot, statePath, dryRun });
           emitSuccess2(
             { outcome, dryRun },
@@ -63075,7 +63784,7 @@ Logs:  ${logPath}`
             return;
           }
           await db.update(tasks).set({ status: "pending", updatedAt: now }).where(eq2(tasks.id, id)).run();
-          const statePath = join29(projectRoot, SENTIENT_STATE_FILE2);
+          const statePath = join30(projectRoot, SENTIENT_STATE_FILE2);
           const state = await readSentientState2(statePath);
           await patchSentientState(statePath, {
             tier2Stats: {
@@ -63171,7 +63880,7 @@ Logs:  ${logPath}`
             return;
           }
           await db.update(tasks).set({ status: "cancelled", cancellationReason: reason, cancelledAt: now, updatedAt: now }).where(eq2(tasks.id, id)).run();
-          const statePath = join29(projectRoot, SENTIENT_STATE_FILE2);
+          const statePath = join30(projectRoot, SENTIENT_STATE_FILE2);
           const state = await readSentientState2(statePath);
           await patchSentientState(statePath, {
             tier2Stats: {
@@ -63216,7 +63925,7 @@ Logs:  ${logPath}`
         const projectRoot = resolveProjectRoot6(args.project);
         const jsonMode = args.json === true;
         try {
-          const statePath = join29(projectRoot, SENTIENT_STATE_FILE2);
+          const statePath = join30(projectRoot, SENTIENT_STATE_FILE2);
           const outcome = await safeRunProposeTick({ projectRoot, statePath });
           emitSuccess2(
             { outcome },
@@ -63236,7 +63945,7 @@ Logs:  ${logPath}`
         const projectRoot = resolveProjectRoot6(args.project);
         const jsonMode = args.json === true;
         try {
-          const statePath = join29(projectRoot, SENTIENT_STATE_FILE2);
+          const statePath = join30(projectRoot, SENTIENT_STATE_FILE2);
           const updated = await patchSentientState(statePath, { tier2Enabled: true });
           emitSuccess2({ tier2Enabled: updated.tier2Enabled }, jsonMode, "Tier-2 proposals enabled");
         } catch (err) {
@@ -63255,7 +63964,7 @@ Logs:  ${logPath}`
         const projectRoot = resolveProjectRoot6(args.project);
         const jsonMode = args.json === true;
         try {
-          const statePath = join29(projectRoot, SENTIENT_STATE_FILE2);
+          const statePath = join30(projectRoot, SENTIENT_STATE_FILE2);
           const updated = await patchSentientState(statePath, { tier2Enabled: false });
           emitSuccess2({ tier2Enabled: updated.tier2Enabled }, jsonMode, "Tier-2 proposals disabled");
         } catch (err) {
@@ -63286,7 +63995,7 @@ Logs:  ${logPath}`
         const projectRoot = resolveProjectRoot6(args.project);
         const jsonMode = args.json === true;
         try {
-          const statePath = join29(projectRoot, SENTIENT_STATE_FILE2);
+          const statePath = join30(projectRoot, SENTIENT_STATE_FILE2);
           const state = await readSentientState2(statePath);
           emitSuccess2(
             {
@@ -63844,7 +64553,7 @@ var sequence_exports = {};
 __export(sequence_exports, {
   sequenceCommand: () => sequenceCommand
 });
-import { getProjectRoot as getProjectRoot49 } from "@cleocode/core/internal";
+import { getProjectRoot as getProjectRoot51 } from "@cleocode/core/internal";
 var showCommand12, checkCommand6, repairCommand2, sequenceCommand;
 var init_sequence = __esm({
   "packages/cleo/src/cli/commands/sequence.ts"() {
@@ -63880,7 +64589,7 @@ var init_sequence = __esm({
       meta: { name: "repair", description: "Reset counter to max + 1 if behind" },
       async run() {
         const { repairSequence } = await import("@cleocode/core/internal");
-        const projectRoot = getProjectRoot49();
+        const projectRoot = getProjectRoot51();
         const repair = await repairSequence(projectRoot);
         const result = {
           repaired: repair.repaired,
@@ -63934,7 +64643,7 @@ async function promptOwnerAuthPassword(sessionName) {
     terminal: true
   });
   process.stderr.write(`[cleo] Enter owner-auth password for session "${sessionName}": `);
-  const password = await new Promise((resolve8) => {
+  const password = await new Promise((resolve9) => {
     if (process.stdin.setRawMode) {
       process.stdin.setRawMode(
         true
@@ -63952,10 +64661,10 @@ async function promptOwnerAuthPassword(sessionName) {
           );
         }
         process.stderr.write("\n");
-        resolve8(pw);
+        resolve9(pw);
       } else if (ch === "") {
         process.stderr.write("\n[cleo] Cancelled.\n");
-        resolve8("");
+        resolve9("");
       } else if (ch === "\x7F" || ch === "\b") {
         pw = pw.slice(0, -1);
       } else {
@@ -64335,8 +65044,8 @@ var init_session4 = __esm({
         "audit-scope": { type: "string", description: "Audit log scope (global|local)" }
       },
       async run({ args }) {
-        const { detectSessionDrift, getProjectRoot: getProjectRoot54 } = await import("@cleocode/core");
-        const projectRoot = await getProjectRoot54();
+        const { detectSessionDrift, getProjectRoot: getProjectRoot56 } = await import("@cleocode/core");
+        const projectRoot = await getProjectRoot56();
         const scope = args["audit-scope"] === "local" ? "local" : "global";
         const report = await detectSessionDrift({ projectRoot, auditScope: scope });
         cliOutput(report, { command: "session drift", operation: "session.drift" });
@@ -66990,14 +67699,14 @@ var init_telemetry2 = __esm({
 
 // packages/cleo/src/cli/commands/templates/lib.ts
 import { readFileSync as readFileSync15 } from "node:fs";
-import { isAbsolute as isAbsolute3, resolve as resolve6 } from "node:path";
-import { getProjectRoot as getProjectRoot50 } from "@cleocode/core";
+import { isAbsolute as isAbsolute3, resolve as resolve7 } from "node:path";
+import { getProjectRoot as getProjectRoot52 } from "@cleocode/core";
 import { resolveSourcePathAbsolute } from "@cleocode/core/templates/registry";
 function resolveProjectRoot7(raw) {
   if (typeof raw === "string" && raw.length > 0) {
-    return isAbsolute3(raw) ? raw : resolve6(process.cwd(), raw);
+    return isAbsolute3(raw) ? raw : resolve7(process.cwd(), raw);
   }
-  return getProjectRoot50();
+  return getProjectRoot52();
 }
 function readTemplateSource(entry) {
   const sourceAbsolute = resolveSourcePathAbsolute(entry);
@@ -67016,8 +67725,8 @@ var init_lib = __esm({
 });
 
 // packages/cleo/src/cli/commands/templates/diff.ts
-import { existsSync as existsSync15, readFileSync as readFileSync16 } from "node:fs";
-import { join as join30 } from "node:path";
+import { existsSync as existsSync16, readFileSync as readFileSync16 } from "node:fs";
+import { join as join31 } from "node:path";
 import { getTemplateById } from "@cleocode/core/templates/registry";
 function unifiedDiff(a, b) {
   const aLines = a.length === 0 ? [] : a.split("\n");
@@ -67087,7 +67796,7 @@ var init_diff = __esm({
         let rendered;
         try {
           projectRoot = resolveProjectRoot7(args["project"]);
-          installPath = join30(projectRoot, entry.installPath);
+          installPath = join31(projectRoot, entry.installPath);
           const source = readTemplateSource(entry);
           rendered = applySubstitution(entry, source).rendered;
         } catch (err) {
@@ -67098,7 +67807,7 @@ var init_diff = __esm({
           process.exit(1 /* GENERAL_ERROR */);
           return;
         }
-        if (!existsSync15(installPath)) {
+        if (!existsSync16(installPath)) {
           const missingResult = {
             id,
             installPath,
@@ -67137,8 +67846,8 @@ ${unifiedDiff("", rendered)}`
 });
 
 // packages/cleo/src/cli/commands/templates/install.ts
-import { existsSync as existsSync16, mkdirSync as mkdirSync5, readFileSync as readFileSync17, writeFileSync as writeFileSync5 } from "node:fs";
-import { dirname as dirname9, join as join31 } from "node:path";
+import { existsSync as existsSync17, mkdirSync as mkdirSync5, readFileSync as readFileSync17, writeFileSync as writeFileSync5 } from "node:fs";
+import { dirname as dirname9, join as join32 } from "node:path";
 import { getTemplateById as getTemplateById2 } from "@cleocode/core/templates/registry";
 var templatesInstallCommand;
 var init_install = __esm({
@@ -67192,7 +67901,7 @@ var init_install = __esm({
         let substituted;
         try {
           projectRoot = resolveProjectRoot7(args["project"]);
-          installPath = join31(projectRoot, entry.installPath);
+          installPath = join32(projectRoot, entry.installPath);
           const source = readTemplateSource(entry);
           const sub = applySubstitution(entry, source);
           rendered = sub.rendered;
@@ -67205,7 +67914,7 @@ var init_install = __esm({
           process.exit(1 /* GENERAL_ERROR */);
           return;
         }
-        if (existsSync16(installPath)) {
+        if (existsSync17(installPath)) {
           const current = readFileSync17(installPath, "utf8");
           if (current === rendered) {
             const noopResult = {
@@ -67354,8 +68063,8 @@ var init_show3 = __esm({
 });
 
 // packages/cleo/src/cli/commands/templates/upgrade.ts
-import { existsSync as existsSync17, mkdirSync as mkdirSync6, readFileSync as readFileSync18, writeFileSync as writeFileSync6 } from "node:fs";
-import { dirname as dirname10, join as join32 } from "node:path";
+import { existsSync as existsSync18, mkdirSync as mkdirSync6, readFileSync as readFileSync18, writeFileSync as writeFileSync6 } from "node:fs";
+import { dirname as dirname10, join as join33 } from "node:path";
 import { getTemplateById as getTemplateById4 } from "@cleocode/core/templates/registry";
 var templatesUpgradeCommand;
 var init_upgrade2 = __esm({
@@ -67417,7 +68126,7 @@ var init_upgrade2 = __esm({
         let rendered;
         try {
           projectRoot = resolveProjectRoot7(args["project"]);
-          installPath = join32(projectRoot, entry.installPath);
+          installPath = join33(projectRoot, entry.installPath);
           const source = readTemplateSource(entry);
           rendered = applySubstitution(entry, source).rendered;
         } catch (err) {
@@ -67430,7 +68139,7 @@ var init_upgrade2 = __esm({
         }
         const previewOnly = args["diff"] === true;
         const accept = args["accept"] === true;
-        const current = existsSync17(installPath) ? readFileSync18(installPath, "utf8") : null;
+        const current = existsSync18(installPath) ? readFileSync18(installPath, "utf8") : null;
         const diffBody = current === null ? "" : current === rendered ? "" : unifiedDiff(current, rendered);
         let outcome;
         let reason;
@@ -67781,7 +68490,7 @@ __export(token_exports, {
   tokenCommand: () => tokenCommand
 });
 import { readFileSync as readFileSync19 } from "node:fs";
-import { getProjectRoot as getProjectRoot51, measureTokenExchange, recordTokenExchange as recordTokenExchange2 } from "@cleocode/core/internal";
+import { getProjectRoot as getProjectRoot53, measureTokenExchange, recordTokenExchange as recordTokenExchange2 } from "@cleocode/core/internal";
 function readPayload(args, textKey, fileKey) {
   const text = args[textKey];
   const file = args[fileKey];
@@ -67945,7 +68654,7 @@ var init_token = __esm({
           domain: args.domain,
           operation: args.operation
         };
-        const result = args.record ? await recordTokenExchange2(getProjectRoot51(), input2) : await measureTokenExchange(input2);
+        const result = args.record ? await recordTokenExchange2(getProjectRoot53(), input2) : await measureTokenExchange(input2);
         cliOutput(result, {
           command: "token",
           operation: args.record ? "admin.token.record" : "token.estimate"
@@ -67980,8 +68689,8 @@ __export(transcript_exports, {
   transcriptCommand: () => transcriptCommand
 });
 import { homedir as homedir6 } from "node:os";
-import { join as join33 } from "node:path";
-import { getProjectRoot as getProjectRoot52 } from "@cleocode/core";
+import { join as join34 } from "node:path";
+import { getProjectRoot as getProjectRoot54 } from "@cleocode/core";
 import {
   parseDurationMs,
   pruneTranscripts,
@@ -68011,7 +68720,7 @@ var init_transcript = __esm({
       async run({ args }) {
         if (args.pending) {
           try {
-            const projectRoot = getProjectRoot52();
+            const projectRoot = getProjectRoot54();
             const { scanPendingTranscripts } = await import("@cleocode/core/memory/transcript-scanner.js");
             const pending = await scanPendingTranscripts(projectRoot);
             cliOutput(
@@ -68034,7 +68743,7 @@ var init_transcript = __esm({
           }
           return;
         }
-        const projectsDir = args["projects-dir"] ?? join33(homedir6(), ".claude", "projects");
+        const projectsDir = args["projects-dir"] ?? join34(homedir6(), ".claude", "projects");
         try {
           const result = await scanTranscripts(projectsDir);
           cliOutput(
@@ -68108,7 +68817,7 @@ var init_transcript = __esm({
       async run({ args }) {
         const tier = args.tier ?? "warm";
         const dryRun = args["dry-run"] ?? false;
-        const projectRoot = getProjectRoot52();
+        const projectRoot = getProjectRoot54();
         try {
           const { extractTranscript } = await import("@cleocode/core/memory/transcript-extractor.js");
           const { findSessionTranscriptPath, listAllTranscripts } = await import("@cleocode/core/memory/transcript-scanner.js");
@@ -68220,7 +68929,7 @@ var init_transcript = __esm({
         const dryRun = args["dry-run"] ?? false;
         const olderThanHours = args["older-than-hours"] ? Number.parseInt(args["older-than-hours"], 10) : 24;
         const limit = args.limit ? Number.parseInt(args.limit, 10) : void 0;
-        const projectRoot = getProjectRoot52();
+        const projectRoot = getProjectRoot54();
         try {
           const { extractTranscript } = await import("@cleocode/core/memory/transcript-extractor.js");
           const { listAllTranscripts } = await import("@cleocode/core/memory/transcript-scanner.js");
@@ -68340,7 +69049,7 @@ var init_transcript = __esm({
           process.exit(2);
           return;
         }
-        const projectsDir = args["projects-dir"] ?? join33(homedir6(), ".claude", "projects");
+        const projectsDir = args["projects-dir"] ?? join34(homedir6(), ".claude", "projects");
         try {
           const pruneResult = await pruneTranscripts({
             olderThanMs,
@@ -68872,7 +69581,7 @@ var upgrade_exports = {};
 __export(upgrade_exports, {
   upgradeCommand: () => upgradeCommand
 });
-import { resolve as resolve7 } from "node:path";
+import { resolve as resolve8 } from "node:path";
 import { CleoError as CleoError10, diagnoseUpgrade, runUpgrade as runUpgrade2, upgradeWorkflows as upgradeWorkflows2 } from "@cleocode/core/internal";
 var workflowsSubcommand, upgradeCommand;
 var init_upgrade3 = __esm({
@@ -68912,7 +69621,7 @@ var init_upgrade3 = __esm({
           const dryRun = args["dry-run"] === true || args.check === true;
           const force = args.force === true && !dryRun;
           const result = await upgradeWorkflows2({
-            projectRoot: resolve7(process.cwd()),
+            projectRoot: resolve8(process.cwd()),
             templatesDir: getWorkflowTemplatesDir2(),
             dryRun,
             force
@@ -69173,15 +69882,15 @@ __export(web_exports, {
 });
 import { execFileSync as execFileSync4, spawn as spawn3 } from "node:child_process";
 import { mkdir as mkdir4, open, readFile as readFile7, rm, stat as stat2, writeFile as writeFile3 } from "node:fs/promises";
-import { join as join34 } from "node:path";
+import { join as join35 } from "node:path";
 import { CleoError as CleoError11, formatError as formatError5, getCleoHome as getCleoHome5 } from "@cleocode/core";
 function getWebPaths() {
   const cleoHome = getCleoHome5();
   return {
-    pidFile: join34(cleoHome, "web-server.pid"),
-    configFile: join34(cleoHome, "web-server.json"),
-    logDir: join34(cleoHome, "logs"),
-    logFile: join34(cleoHome, "logs", "web-server.log")
+    pidFile: join35(cleoHome, "web-server.pid"),
+    configFile: join35(cleoHome, "web-server.json"),
+    logDir: join35(cleoHome, "logs"),
+    logFile: join35(cleoHome, "logs", "web-server.log")
   };
 }
 function isProcessRunning(pid) {
@@ -69220,7 +69929,7 @@ async function startWebServer(port, host) {
     throw new CleoError11(1 /* GENERAL_ERROR */, `Server already running (PID: ${status.pid})`);
   }
   const projectRoot = process.env["CLEO_ROOT"] ?? process.cwd();
-  const studioDir = process.env["CLEO_STUDIO_DIR"] ?? join34(projectRoot, "packages", "studio", "build");
+  const studioDir = process.env["CLEO_STUDIO_DIR"] ?? join35(projectRoot, "packages", "studio", "build");
   await mkdir4(logDir, { recursive: true });
   await writeFile3(
     configFile,
@@ -69230,7 +69939,7 @@ async function startWebServer(port, host) {
       startedAt: (/* @__PURE__ */ new Date()).toISOString()
     })
   );
-  const webIndexPath = join34(studioDir, "index.js");
+  const webIndexPath = join35(studioDir, "index.js");
   try {
     await stat2(webIndexPath);
   } catch {
@@ -69278,7 +69987,7 @@ Logs: ${logFile}`
       }
     } catch {
     }
-    await new Promise((resolve8) => setTimeout(resolve8, 500));
+    await new Promise((resolve9) => setTimeout(resolve9, 500));
   }
   if (!started) {
     try {
@@ -69355,7 +70064,7 @@ var init_web = __esm({
           }
           for (let i = 0; i < 60; i++) {
             if (!isProcessRunning(status.pid)) break;
-            await new Promise((resolve8) => setTimeout(resolve8, 500));
+            await new Promise((resolve9) => setTimeout(resolve9, 500));
           }
           if (isProcessRunning(status.pid)) {
             try {
@@ -69407,7 +70116,7 @@ var init_web = __esm({
             }
             for (let i = 0; i < 60; i++) {
               if (!isProcessRunning(status.pid)) break;
-              await new Promise((resolve8) => setTimeout(resolve8, 500));
+              await new Promise((resolve9) => setTimeout(resolve9, 500));
             }
             if (isProcessRunning(status.pid)) {
               try {
@@ -69503,14 +70212,14 @@ __export(worktree_exports, {
   worktreeCommand: () => worktreeCommand
 });
 import readline4 from "node:readline";
-import { getProjectRoot as getProjectRoot53, listWorktrees as listWorktrees2 } from "@cleocode/core/internal";
+import { getProjectRoot as getProjectRoot55, listWorktrees as listWorktrees2 } from "@cleocode/core/internal";
 async function promptYesNo2(question) {
-  return new Promise((resolve8) => {
+  return new Promise((resolve9) => {
     const rl = readline4.createInterface({ input: process.stdin, output: process.stdout });
     rl.question(`${question} [y/N]: `, (answer) => {
       rl.close();
       const trimmed = answer.trim().toLowerCase();
-      resolve8(trimmed === "y" || trimmed === "yes");
+      resolve9(trimmed === "y" || trimmed === "yes");
     });
   });
 }
@@ -69608,7 +70317,7 @@ var init_worktree3 = __esm({
         const staleDays = staleDaysRaw !== void 0 ? Number.parseInt(staleDaysRaw, 10) : void 0;
         const idleDaysRaw = typeof args["idle-days"] === "string" ? args["idle-days"] : void 0;
         const idleDays = idleDaysRaw !== void 0 ? Number.parseInt(idleDaysRaw, 10) : void 0;
-        const projectRoot = getProjectRoot53();
+        const projectRoot = getProjectRoot55();
         const listResult = await listWorktrees2({
           projectRoot,
           ...staleDays !== void 0 && !Number.isNaN(staleDays) ? { staleDays } : {}
@@ -69787,6 +70496,11 @@ var init_worktree3 = __esm({
         actor: {
           type: "string",
           description: "Override actor name written to the audit log."
+        },
+        recover: {
+          type: "boolean",
+          description: "After adopting, recover a partial ETIMEDOUT worktree by running pnpm install and clearing stale git locks.",
+          default: false
         }
       },
       async run({ args }) {
@@ -69808,7 +70522,8 @@ var init_worktree3 = __esm({
             worktreePath: rawPath,
             ...source !== void 0 ? { source } : {},
             ...rawTaskId !== void 0 ? { taskId: rawTaskId } : {},
-            ...rawActor !== void 0 ? { actor: rawActor } : {}
+            ...rawActor !== void 0 ? { actor: rawActor } : {},
+            recover: args["recover"] === true
           },
           { command: "worktree-adopt", operation: "worktree.adopt" }
         );
@@ -69844,7 +70559,7 @@ init_dist();
 init_field_context();
 init_format_context();
 import { readFileSync as readFileSync20 } from "node:fs";
-import { dirname as dirname11, join as join36 } from "node:path";
+import { dirname as dirname11, join as join37 } from "node:path";
 import { fileURLToPath as fileURLToPath7 } from "node:url";
 
 // packages/cleo/src/cli/generated/command-manifest.ts
@@ -70161,6 +70876,12 @@ var COMMAND_MANIFEST = [
     description: "Probe every registered project (nexus.db) for DB + config health",
     load: async () => (await Promise.resolve().then(() => (init_doctor_projects(), doctor_projects_exports))).doctorProjectsCommand
   },
+  {
+    exportName: "doctorReleaseReadinessCommand",
+    name: "release-readiness",
+    description: "Pre-flight release readiness check \u2014 lint matrix + changelog + changeset + npm OIDC + tag-trigger sanity (T10458)",
+    load: async () => (await Promise.resolve().then(() => (init_doctor_release_readiness(), doctor_release_readiness_exports))).doctorReleaseReadinessCommand
+  },
   {
     exportName: "doctorCommand",
     name: "doctor",
@@ -70245,6 +70966,12 @@ var COMMAND_MANIFEST = [
     description: "Completion timeline and productivity analytics",
     load: async () => (await Promise.resolve().then(() => (init_history(), history_exports))).historyCommand
   },
+  {
+    exportName: "hygieneCommand",
+    name: "hygiene",
+    description: "Run spawn-readiness hygiene checks",
+    load: async () => (await Promise.resolve().then(() => (init_hygiene(), hygiene_exports))).hygieneCommand
+  },
   {
     exportName: "importTasksCommand",
     name: "import-tasks",
@@ -70290,7 +71017,7 @@ var COMMAND_MANIFEST = [
   {
     exportName: "labelsCommand",
     name: "labels",
-    description: "List all labels with counts or show tasks with specific label",
+    description: "List all labels (no args), or show tasks for a label (cleo labels <name>)",
     load: async () => (await Promise.resolve().then(() => (init_labels(), labels_exports))).labelsCommand
   },
   {
@@ -70858,14 +71585,14 @@ function lazyCommand(meta, loader2) {
 init_did_you_mean();
 
 // packages/cleo/src/cli/lib/first-run-detection.ts
-import { existsSync as existsSync18 } from "node:fs";
-import { join as join35 } from "node:path";
+import { existsSync as existsSync19 } from "node:fs";
+import { join as join36 } from "node:path";
 async function detectFirstRun() {
   const envKey = process.env["ANTHROPIC_API_KEY"];
   if (typeof envKey === "string" && envKey.length > 0) return false;
   const { getCleoPlatformPaths } = await import("@cleocode/paths");
-  const configPath = join35(getCleoPlatformPaths().config, "config.json");
-  if (existsSync18(configPath)) return false;
+  const configPath = join36(getCleoPlatformPaths().config, "config.json");
+  if (existsSync19(configPath)) return false;
   try {
     const { getCredentialPool } = await import("@cleocode/core/llm/credential-pool.js");
     const pool = getCredentialPool();
@@ -70876,7 +71603,7 @@ async function detectFirstRun() {
   return true;
 }
 function waitForEnterOrTimeout(timeoutMs) {
-  return new Promise((resolve8) => {
+  return new Promise((resolve9) => {
     let resolved = false;
     const finish = () => {
       if (resolved) return;
@@ -70888,7 +71615,7 @@ function waitForEnterOrTimeout(timeoutMs) {
         process.stdin.pause();
       } catch {
       }
-      resolve8();
+      resolve9();
     };
     const onData = (chunk) => {
       const s = typeof chunk === "string" ? chunk : chunk.toString("utf8");
@@ -70984,7 +71711,7 @@ Or via NodeSource: https://github.com/nodesource/distributions
   }
 }
 function getPackageVersion() {
-  const pkgPath = join36(dirname11(fileURLToPath7(import.meta.url)), "../../package.json");
+  const pkgPath = join37(dirname11(fileURLToPath7(import.meta.url)), "../../package.json");
   const pkg = JSON.parse(readFileSync20(pkgPath, "utf-8"));
   return pkg.version;
 }
@@ -71160,7 +71887,7 @@ async function runStartupMaintenance() {
     detectAndRemoveStrayProjectNexus,
     getGlobalSalt,
     getLogger: getLogger21,
-    getProjectRoot: getProjectRoot54,
+    getProjectRoot: getProjectRoot56,
     isCleanupMarkerSet,
     migrateSignaldockToConduit,
     needsSignaldockToConduitMigration,
@@ -71169,7 +71896,7 @@ async function runStartupMaintenance() {
   } = await import("@cleocode/core/internal");
   let projectRootForCleanup = "";
   try {
-    projectRootForCleanup = getProjectRoot54();
+    projectRootForCleanup = getProjectRoot56();
   } catch {
   }
   if (!isCleanupMarkerSet(CLI_VERSION, projectRootForCleanup)) {
@@ -71189,7 +71916,7 @@ async function runStartupMaintenance() {
   const isInitInvocation = process.argv.slice(2).some((a) => a === "init");
   if (!isInitInvocation) {
     try {
-      const _projectRootForMigration = getProjectRoot54();
+      const _projectRootForMigration = getProjectRoot56();
       if (needsSignaldockToConduitMigration(_projectRootForMigration)) {
         const migrationResult = migrateSignaldockToConduit(_projectRootForMigration);
         if (migrationResult.status === "failed") {