@cleocode/cleo 2026.5.121 → 2026.5.122

package/dist/cli/index.js

@@ -10600,6 +10600,7 @@ var init_exit_codes = __esm({
       ExitCode2[ExitCode2["LAFS_VIOLATION"] = 104] = "LAFS_VIOLATION";
       ExitCode2[ExitCode2["DECISION_VALIDATOR_FAILED"] = 106] = "DECISION_VALIDATOR_FAILED";
       ExitCode2[ExitCode2["LEAD_BYPASS_DETECTED"] = 107] = "LEAD_BYPASS_DETECTED";
+      ExitCode2[ExitCode2["AC_COVERAGE_INCOMPLETE"] = 108] = "AC_COVERAGE_INCOMPLETE";
       return ExitCode2;
     })(ExitCode || {});
   }
@@ -10627,7 +10628,7 @@ var init_errors = __esm({
 
 // packages/contracts/src/evidence-atom-schema.ts
 import { z as z6 } from "zod";
-var commitAtomSchema, filesAtomSchema, testRunAtomSchema, toolAtomSchema, urlAtomSchema, noteAtomSchema, decisionAtomSchema, prAtomSchema, locDropAtomSchema, callsiteCoverageAtomSchema, EvidenceAtomSchema, GATE_EVIDENCE_REQUIREMENTS, ATOM_EXAMPLES;
+var commitAtomSchema, filesAtomSchema, testRunAtomSchema, toolAtomSchema, urlAtomSchema, noteAtomSchema, decisionAtomSchema, prAtomSchema, locDropAtomSchema, callsiteCoverageAtomSchema, AC_UUID_REGEX, AC_ALIAS_REGEX, SATISFIES_TASK_ID_REGEX, SATISFIES_VERSION_PIN_REGEX, satisfiesAtomSchema, EvidenceAtomSchema, GATE_EVIDENCE_REQUIREMENTS, ATOM_EXAMPLES;
 var init_evidence_atom_schema = __esm({
   "packages/contracts/src/evidence-atom-schema.ts"() {
     "use strict";
@@ -10673,6 +10674,24 @@ var init_evidence_atom_schema = __esm({
       symbolName: z6.string().min(1, "callsite-coverage atom requires a non-empty symbolName"),
       relativeSourcePath: z6.string().min(1, "callsite-coverage atom requires a non-empty relativeSourcePath")
     });
+    AC_UUID_REGEX = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
+    AC_ALIAS_REGEX = /^AC[0-9]{1,4}$/;
+    SATISFIES_TASK_ID_REGEX = /^T[0-9]{1,7}$/;
+    SATISFIES_VERSION_PIN_REGEX = /^[0-9]{14}$/;
+    satisfiesAtomSchema = z6.object({
+      kind: z6.literal("satisfies"),
+      /** Target task ID — `T<1-7 digits>` per ADR-079-r2 §2.1. */
+      targetTaskId: z6.string().regex(SATISFIES_TASK_ID_REGEX, "satisfies atom targetTaskId must match /^T[0-9]{1,7}$/"),
+      /** Lowercase UUIDv4 — populated for the canonical form; undefined for alias form. */
+      targetAcId: z6.string().regex(AC_UUID_REGEX, "satisfies atom targetAcId must be a lowercase UUIDv4").optional(),
+      /** Positional alias `AC<1-4 digits>` — populated for alias form; undefined for UUID form. */
+      targetAcAlias: z6.string().regex(AC_ALIAS_REGEX, "satisfies atom targetAcAlias must match /^AC[0-9]{1,4}$/").optional(),
+      /** Optional `@<14-digit YYYYMMDDhhmmss>` pin captured at mint time. */
+      versionPin: z6.string().regex(
+        SATISFIES_VERSION_PIN_REGEX,
+        "satisfies atom versionPin must be 14 digits (YYYYMMDDhhmmss)"
+      ).optional()
+    });
     EvidenceAtomSchema = z6.discriminatedUnion("kind", [
       commitAtomSchema,
       filesAtomSchema,
@@ -10683,7 +10702,8 @@ var init_evidence_atom_schema = __esm({
       decisionAtomSchema,
       prAtomSchema,
       locDropAtomSchema,
-      callsiteCoverageAtomSchema
+      callsiteCoverageAtomSchema,
+      satisfiesAtomSchema
     ]);
     GATE_EVIDENCE_REQUIREMENTS = Object.freeze({
       implemented: {
@@ -10712,7 +10732,8 @@ var init_evidence_atom_schema = __esm({
       decision: "decision:D-arch-001",
       pr: "pr:357",
       "loc-drop": "loc-drop:<fromLines>:<toLines>",
-      "callsite-coverage": "callsite-coverage:<symbolName>:<relativeSourcePath>"
+      "callsite-coverage": "callsite-coverage:<symbolName>:<relativeSourcePath>",
+      satisfies: "satisfies:T1234#AC2"
     });
   }
 });
@@ -12528,6 +12549,52 @@ var init_manifest2 = __esm({
   }
 });
 
+// packages/contracts/src/validator/index.ts
+import { z as z14 } from "zod";
+var VALIDATOR_ID_REGEX, validatorFindingSchema, validatorAttestationSchema, validatorRejectionSchema, validatorVerdictSchema;
+var init_validator = __esm({
+  "packages/contracts/src/validator/index.ts"() {
+    "use strict";
+    VALIDATOR_ID_REGEX = /^validator-[a-z0-9][a-z0-9-]*$/;
+    validatorFindingSchema = z14.object({
+      acId: z14.string().min(1, "acId must be non-empty"),
+      status: z14.enum(["pass", "fail", "inconclusive"]),
+      reasoning: z14.string().min(1, "reasoning must be non-empty"),
+      evidenceRefs: z14.array(z14.string()).optional(),
+      checkedAt: z14.string().min(1, "checkedAt must be a non-empty ISO-8601 string")
+    });
+    validatorAttestationSchema = z14.object({
+      verdict: z14.literal("attest"),
+      taskId: z14.string().min(1),
+      validatorId: z14.string().regex(VALIDATOR_ID_REGEX, "validatorId must match the pattern validator-<discriminator>"),
+      findings: z14.array(validatorFindingSchema).min(1, "attestation must contain at least one finding").refine(
+        (findings) => findings.every((f) => f.status === "pass"),
+        'attestation requires every finding to have status="pass"'
+      ),
+      summary: z14.string().optional(),
+      attestedAt: z14.string().min(1),
+      schemaVersion: z14.literal("1")
+    });
+    validatorRejectionSchema = z14.object({
+      verdict: z14.literal("reject"),
+      taskId: z14.string().min(1),
+      validatorId: z14.string().regex(VALIDATOR_ID_REGEX, "validatorId must match the pattern validator-<discriminator>"),
+      findings: z14.array(validatorFindingSchema).min(1, "rejection must contain at least one finding").refine(
+        (findings) => findings.some((f) => f.status !== "pass"),
+        'rejection requires at least one finding with status "fail" or "inconclusive"'
+      ),
+      summary: z14.string().min(1, "rejection summary must be non-empty"),
+      remediationHints: z14.array(z14.string()).optional(),
+      rejectedAt: z14.string().min(1),
+      schemaVersion: z14.literal("1")
+    });
+    validatorVerdictSchema = z14.discriminatedUnion("verdict", [
+      validatorAttestationSchema,
+      validatorRejectionSchema
+    ]);
+  }
+});
+
 // packages/contracts/src/index.ts
 var init_src2 = __esm({
   "packages/contracts/src/index.ts"() {
@@ -12571,6 +12638,7 @@ var init_src2 = __esm({
     init_task_evidence();
     init_archive();
     init_manifest2();
+    init_validator();
   }
 });
 
@@ -15010,8 +15078,8 @@ var init_admin2 = __esm({
         const projectRoot = getProjectRoot2();
         const taskId = params.taskId;
         try {
-          const { getTaskAccessor: getTaskAccessor4, getLastHandoff, retrieveWithBudget } = await import("@cleocode/core/internal");
-          const accessor = await getTaskAccessor4(projectRoot);
+          const { getTaskAccessor: getTaskAccessor5, getLastHandoff, retrieveWithBudget } = await import("@cleocode/core/internal");
+          const accessor = await getTaskAccessor5(projectRoot);
           const task = await accessor.loadSingleTask(taskId);
           if (!task) {
             return lafsError("E_NOT_FOUND", `Task ${taskId} not found`, "context.pull");
@@ -26823,8 +26891,8 @@ async function loadPlaybookByName(name) {
     return null;
   }
   try {
-    const { getProjectRoot: getProjectRoot54 } = await import("@cleocode/core/internal");
-    const projectRoot = __playbookRuntimeOverrides.projectRoot ?? getProjectRoot54();
+    const { getProjectRoot: getProjectRoot56 } = await import("@cleocode/core/internal");
+    const projectRoot = __playbookRuntimeOverrides.projectRoot ?? getProjectRoot56();
     const resolved = resolvePlaybook(name, {
       projectRoot,
       globalPlaybooksDir: __playbookRuntimeOverrides.globalPlaybooksDir,
@@ -26868,8 +26936,8 @@ async function acquireDb() {
 async function buildDefaultDispatcher() {
   if (__playbookRuntimeOverrides.dispatcher) return __playbookRuntimeOverrides.dispatcher;
   const { orchestrateSpawnExecute: orchestrateSpawnExecute2 } = await Promise.resolve().then(() => (init_engine(), engine_exports));
-  const { getProjectRoot: getProjectRoot54 } = await import("@cleocode/core/internal");
-  const projectRoot = getProjectRoot54();
+  const { getProjectRoot: getProjectRoot56 } = await import("@cleocode/core/internal");
+  const projectRoot = getProjectRoot56();
   return {
     async dispatch(input2) {
       try {
@@ -27059,8 +27127,8 @@ var init_playbook2 = __esm({
             projectRoot = __playbookRuntimeOverrides.projectRoot;
           } else {
             try {
-              const { getProjectRoot: getProjectRoot54 } = await import("@cleocode/core/internal");
-              projectRoot = getProjectRoot54();
+              const { getProjectRoot: getProjectRoot56 } = await import("@cleocode/core/internal");
+              projectRoot = getProjectRoot56();
             } catch {
               projectRoot = void 0;
             }
@@ -27124,14 +27192,14 @@ var init_playbook2 = __esm({
         const dispatcher = await buildDefaultDispatcher();
         let result;
         try {
-          const { getProjectRoot: getProjectRoot54 } = await import("@cleocode/core/internal");
+          const { getProjectRoot: getProjectRoot56 } = await import("@cleocode/core/internal");
           const opts = {
             db,
             playbook: parsed.definition,
             playbookHash: parsed.sourceHash,
             initialContext,
             dispatcher,
-            projectRoot: getProjectRoot54()
+            projectRoot: getProjectRoot56()
           };
           if (__playbookRuntimeOverrides.approvalSecret !== void 0) {
             opts.approvalSecret = __playbookRuntimeOverrides.approvalSecret;
@@ -27667,8 +27735,8 @@ async function orchestrateAnalyzeParallelSafety(taskIds, projectRoot) {
       return !closureA.has(b) && !closureB.has(a);
     };
     var transitiveClose = transitiveClose2, parallelSafe = parallelSafe2;
-    const { getTaskAccessor: getTaskAccessor4 } = await import("@cleocode/core/internal");
-    const accessor = await getTaskAccessor4(projectRoot);
+    const { getTaskAccessor: getTaskAccessor5 } = await import("@cleocode/core/internal");
+    const accessor = await getTaskAccessor5(projectRoot);
     const result = await accessor.queryTasks({});
     const allTasks = result?.tasks ?? [];
     const depMap = /* @__PURE__ */ new Map();
@@ -30754,7 +30822,7 @@ var init_sticky2 = __esm({
 
 // packages/cleo/src/dispatch/domains/tasks.ts
 import { getLogger as getLogger15, getProjectRoot as getProjectRoot18, TASKS_SUGGESTED_NEXT_BUILDERS } from "@cleocode/core";
-import { createAttachmentStore as createAttachmentStore4 } from "@cleocode/core/internal";
+import { createAttachmentStore as createAttachmentStore4, getTaskAccessor as getTaskAccessor3 } from "@cleocode/core/internal";
 import {
   sagaAdd as coreSagaAdd,
   sagaCreate as coreSagaCreate,
@@ -30785,6 +30853,20 @@ async function fetchTaskAttachments(projectRoot, taskId) {
     return [];
   }
 }
+async function fetchTaskAcRows(projectRoot, taskId) {
+  try {
+    const accessor = await getTaskAccessor3(projectRoot);
+    const rows = await accessor.getAcRows(taskId);
+    return rows.map((row) => ({
+      id: row.id,
+      alias: `AC${row.ordinal}`,
+      ordinal: row.ordinal,
+      text: row.text
+    }));
+  } catch {
+    return [];
+  }
+}
 async function sagaCreate(params) {
   const title = typeof params.title === "string" ? params.title : "";
   const description = typeof params.description === "string" ? params.description : void 0;
@@ -30869,9 +30951,10 @@ var init_tasks2 = __esm({
         if (params.history) {
           return wrapCoreResult(await taskShowWithHistory(projectRoot, params.taskId, true), "show");
         }
-        const [coreResult, attachments] = await Promise.all([
+        const [coreResult, attachments, acRows] = await Promise.all([
           taskShow(projectRoot, params.taskId),
-          fetchTaskAttachments(projectRoot, params.taskId)
+          fetchTaskAttachments(projectRoot, params.taskId),
+          fetchTaskAcRows(projectRoot, params.taskId)
         ]);
         if (!coreResult.success) {
           return wrapCoreResult(coreResult, "show");
@@ -30879,7 +30962,8 @@ var init_tasks2 = __esm({
         const showResult = {
           task: coreResult.data.task,
           view: coreResult.data.view,
-          attachments
+          attachments,
+          ...acRows.length > 0 ? { acRows } : {}
         };
         return { success: true, data: showResult };
       },
@@ -31137,7 +31221,10 @@ var init_tasks2 = __esm({
         const result = await completeTaskStrict(projectRoot, params.taskId, {
           notes: params.notes,
           overrideReason: params.overrideReason,
-          acknowledgeRisk: params.acknowledgeRisk
+          acknowledgeRisk: params.acknowledgeRisk,
+          // T10509 — AC-coverage gate waiver path
+          waiveAc: params.waiveAc,
+          waiveReason: params.waiveReason
         });
         setImmediate(async () => {
           try {
@@ -32305,7 +32392,8 @@ import {
   getLogger as getLogger18,
   getProjectRoot as getProjectRoot21,
   listWorktrees,
-  pruneOrphanedWorktreesByStatus
+  pruneOrphanedWorktreesByStatus,
+  recoverPartialWorktree
 } from "@cleocode/core/internal";
 function coerceStatusFilter(value) {
   if (value === void 0 || value === null) return void 0;
@@ -32380,7 +32468,7 @@ var init_worktree2 = __esm({
        *
        * Supported operations:
        *  - `adopt` — register an externally-created worktree in the SSoT. Params:
-       *              `{ worktreePath, source?, taskId?, actor? }`. Returns an
+       *              `{ worktreePath, source?, taskId?, actor?, recover? }`. Returns an
        *              {@link AdoptWorktreeResult} envelope. (T9804)
        *  - `destroy` — explicitly destroy a single agent worktree. Params:
        *                `{ taskId, force?, deleteBranch?, reason? }`. Returns a
@@ -32416,14 +32504,44 @@ var init_worktree2 = __esm({
               const source = typeof rawSource === "string" && validSources.includes(rawSource) ? rawSource : void 0;
               const rawTaskId = params?.["taskId"];
               const taskId = rawTaskId === null ? null : typeof rawTaskId === "string" && rawTaskId.length > 0 ? rawTaskId : void 0;
+              const projectRoot = getProjectRoot21();
               const opts = {
-                projectRoot: getProjectRoot21(),
+                projectRoot,
                 worktreePath,
                 ...source !== void 0 ? { source } : {},
                 ...taskId !== void 0 ? { taskId } : {},
                 ...typeof params?.["actor"] === "string" && params["actor"].length > 0 ? { actor: params["actor"] } : {}
               };
               const result = await adoptWorktree(opts);
+              if (result.success && params?.["recover"] === true) {
+                const recovery = recoverPartialWorktree(
+                  projectRoot,
+                  worktreePath,
+                  result.data.taskId ?? taskId ?? "unknown"
+                );
+                const recoveredResult = recovery.success ? {
+                  success: true,
+                  data: {
+                    ...result.data,
+                    recovery
+                  }
+                } : {
+                  success: false,
+                  error: {
+                    code: "E_WORKTREE_RECOVERY_FAILED",
+                    message: recovery.error ?? "Partial worktree recovery failed.",
+                    fix: "Inspect the worktree, then rerun `cleo worktree adopt <path> --recover` after resolving the reported recovery error.",
+                    details: { adopt: result.data, recovery }
+                  }
+                };
+                return wrapResult(
+                  recoveredResult,
+                  "mutate",
+                  "worktree",
+                  operation,
+                  startTime
+                );
+              }
               return wrapResult(
                 result,
                 "mutate",
@@ -33105,11 +33223,11 @@ var init_security = __esm({
 });
 
 // packages/cleo/src/dispatch/middleware/sanitizer.ts
-function createSanitizer(getProjectRoot54) {
+function createSanitizer(getProjectRoot56) {
   return async (req, next) => {
     if (req.params) {
       try {
-        const root = getProjectRoot54 ? getProjectRoot54() : void 0;
+        const root = getProjectRoot56 ? getProjectRoot56() : void 0;
         req.params = sanitizeParams(req.params, root, {
           domain: req.domain,
           operation: req.operation
@@ -38727,9 +38845,9 @@ var init_backup = __esm({
       async run({ args }) {
         const scope = args.scope;
         const { packBundle } = await import("@cleocode/core/store/backup-pack.js");
-        const { getProjectRoot: getProjectRoot54 } = await import("@cleocode/core");
+        const { getProjectRoot: getProjectRoot56 } = await import("@cleocode/core");
         const includesProject = scope === "project" || scope === "all";
-        const projectRoot = includesProject ? getProjectRoot54() : void 0;
+        const projectRoot = includesProject ? getProjectRoot56() : void 0;
         let passphrase;
         if (args.encrypt === true) {
           passphrase = process.env["CLEO_BACKUP_PASSPHRASE"];
@@ -38805,12 +38923,12 @@ var init_backup = __esm({
       },
       async run({ args }) {
         const bundlePath = args.bundle;
-        const { getProjectRoot: getProjectRoot54, getCleoHome: getCleoHome6, getCleoVersion } = await import("@cleocode/core");
+        const { getProjectRoot: getProjectRoot56, getCleoHome: getCleoHome6, getCleoVersion } = await import("@cleocode/core");
         const { BundleError, cleanupStaging, unpackBundle } = await import("@cleocode/core/store/backup-unpack.js");
         const { regenerateConfigJson, regenerateProjectContextJson, regenerateProjectInfoJson } = await import("@cleocode/core/store/regenerators.js");
         const { regenerateAndCompare } = await import("@cleocode/core/store/restore-json-merge.js");
         const { buildConflictReport, writeConflictReport } = await import("@cleocode/core/store/restore-conflict-report.js");
-        const projectRoot = getProjectRoot54();
+        const projectRoot = getProjectRoot56();
         if (args.force !== true) {
           const existing = checkForExistingData(projectRoot, getCleoHome6());
           if (existing.length > 0) {
@@ -41275,6 +41393,15 @@ var init_complete = __esm({
         "override-reason": {
           type: "string",
           description: "Reason for bypassing E_EPIC_HAS_PENDING_CHILDREN guard (audited to .cleo/audit/premature-close.jsonl)"
+        },
+        // T10509 — AC-coverage gate (load-bearing IVTR closure)
+        "waive-ac": {
+          type: "string",
+          description: "Comma-separated AC tokens (UUIDs or AC<n> aliases) to waive from the AC-coverage gate. Requires --waive-reason. Audited to .cleo/audit/ac-waiver.jsonl."
+        },
+        "waive-reason": {
+          type: "string",
+          description: "Mandatory justification text for --waive-ac. Captured verbatim in the audit row."
         }
       },
       async run({ args }) {
@@ -41284,7 +41411,10 @@ var init_complete = __esm({
           changeset: args.changeset,
           verificationNote: args["verification-note"],
           acknowledgeRisk: args["acknowledge-risk"],
-          overrideReason: args["override-reason"]
+          overrideReason: args["override-reason"],
+          // T10509 — AC-coverage gate waiver path
+          waiveAc: args["waive-ac"],
+          waiveReason: args["waive-reason"]
         });
         if (!response.success) {
           handleRawError(response, { command: "complete", operation: "tasks.complete" });
@@ -47381,129 +47511,11 @@ var init_doctor_projects = __esm({
   }
 });
 
-// packages/cleo/src/cli/progress.ts
-import { stderr } from "node:process";
-function createSelfUpdateProgress(enabled) {
-  return new ProgressTracker({
-    enabled,
-    prefix: "CLEO",
-    steps: [
-      "Detecting installation type",
-      "Checking current version",
-      "Querying npm registry",
-      "Comparing versions",
-      "Running post-update checks",
-      "Finalizing"
-    ]
-  });
-}
-function createDoctorProgress(enabled) {
-  return new ProgressTracker({
-    enabled,
-    prefix: "CLEO Doctor",
-    steps: [
-      "Checking CLEO directory",
-      "Verifying tasks database",
-      "Checking configuration",
-      "Validating schemas",
-      "Running health checks"
-    ]
-  });
-}
-function createUpgradeProgress(enabled) {
-  return new ProgressTracker({
-    enabled,
-    prefix: "CLEO Upgrade",
-    steps: [
-      "Analyzing current state",
-      "Checking storage migration needs",
-      "Validating schemas",
-      "Applying fixes",
-      "Verifying results"
-    ]
-  });
-}
-var ProgressTracker;
-var init_progress = __esm({
-  "packages/cleo/src/cli/progress.ts"() {
-    "use strict";
-    init_format_context();
-    ProgressTracker = class {
-      enabled;
-      prefix;
-      currentStep = 0;
-      totalSteps;
-      steps;
-      constructor(options) {
-        this.enabled = options.enabled;
-        this.prefix = options.prefix ?? "CLEO";
-        this.steps = options.steps;
-        this.totalSteps = options.steps.length;
-      }
-      /**
-       * Start the progress tracker.
-       */
-      start() {
-        if (!this.enabled || isQuiet()) return;
-        this.currentStep = 0;
-        stderr.write(`
-${this.prefix}: Starting...
-`);
-      }
-      /**
-       * Update to a specific step.
-       */
-      step(index, message) {
-        if (!this.enabled || isQuiet()) return;
-        this.currentStep = index;
-        const stepName = this.steps[index] ?? message ?? "Working...";
-        const progress = `[${index + 1}/${this.totalSteps}]`;
-        stderr.write(`  ${progress} ${stepName}...
-`);
-      }
-      /**
-       * Move to next step.
-       */
-      next(message) {
-        this.step(this.currentStep + 1, message);
-      }
-      /**
-       * Mark as complete with optional summary.
-       *
-       * @remarks
-       * Writes to stderr (not stdout) so that progress messages never pollute
-       * the machine-readable JSON envelope on stdout. Stdout MUST contain exactly
-       * one JSON object per CLI invocation (ADR-039 / T927).
-       */
-      complete(summary) {
-        if (!this.enabled || isQuiet()) return;
-        if (summary) {
-          stderr.write(`
-${this.prefix}: \u2713 ${summary}
-
-`);
-        } else {
-          stderr.write(`
-${this.prefix}: \u2713 Complete
-
-`);
-        }
-      }
-      /**
-       * Report an error.
-       */
-      error(message) {
-        if (!this.enabled || isQuiet()) return;
-        stderr.write(`
-${this.prefix}: \u2717 ${message}
-
-`);
-      }
-    };
-  }
-});
-
 // packages/cleo/src/cli/commands/doctor-release-readiness.ts
+var doctor_release_readiness_exports = {};
+__export(doctor_release_readiness_exports, {
+  doctorReleaseReadinessCommand: () => doctorReleaseReadinessCommand
+});
 import { existsSync as existsSync13 } from "node:fs";
 import { join as join22, resolve as resolve6 } from "node:path";
 async function runCheck(name, cmd, args, cwd) {
@@ -47591,16 +47603,27 @@ var init_doctor_release_readiness = __esm({
             const pkg = JSON.parse(
               await import("node:fs").then((m) => m.readFileSync(packageJsonPath, "utf8"))
             );
-            const hasPublishConfig = typeof pkg.publishConfig === "object" && pkg.publishConfig !== null;
-            const accessPublic = hasPublishConfig && pkg.publishConfig.access === "public";
-            oidcCheck = {
-              name: "npm-oidc-sanity",
-              status: accessPublic ? "pass" : "fail",
-              exitCode: accessPublic ? 0 : 1,
-              durationMs: 0,
-              stdout: accessPublic ? "package.json has publishConfig.access=public" : "",
-              stderr: accessPublic ? "" : "package.json missing publishConfig.access=public \u2014 required for npm OIDC Trusted Publishing"
-            };
+            if (pkg.private === true) {
+              oidcCheck = {
+                name: "npm-oidc-sanity",
+                status: "pass",
+                exitCode: 0,
+                durationMs: 0,
+                stdout: "root package.json is private \u2014 skipping (per-package check applies at publish time)",
+                stderr: ""
+              };
+            } else {
+              const hasPublishConfig = typeof pkg.publishConfig === "object" && pkg.publishConfig !== null;
+              const accessPublic = hasPublishConfig && pkg.publishConfig.access === "public";
+              oidcCheck = {
+                name: "npm-oidc-sanity",
+                status: accessPublic ? "pass" : "fail",
+                exitCode: accessPublic ? 0 : 1,
+                durationMs: 0,
+                stdout: accessPublic ? "package.json has publishConfig.access=public" : "",
+                stderr: accessPublic ? "" : "package.json missing publishConfig.access=public \u2014 required for npm OIDC Trusted Publishing"
+              };
+            }
           } catch {
             oidcCheck = {
               name: "npm-oidc-sanity",
@@ -47751,6 +47774,128 @@ var init_doctor_release_readiness = __esm({
   }
 });
 
+// packages/cleo/src/cli/progress.ts
+import { stderr } from "node:process";
+function createSelfUpdateProgress(enabled) {
+  return new ProgressTracker({
+    enabled,
+    prefix: "CLEO",
+    steps: [
+      "Detecting installation type",
+      "Checking current version",
+      "Querying npm registry",
+      "Comparing versions",
+      "Running post-update checks",
+      "Finalizing"
+    ]
+  });
+}
+function createDoctorProgress(enabled) {
+  return new ProgressTracker({
+    enabled,
+    prefix: "CLEO Doctor",
+    steps: [
+      "Checking CLEO directory",
+      "Verifying tasks database",
+      "Checking configuration",
+      "Validating schemas",
+      "Running health checks"
+    ]
+  });
+}
+function createUpgradeProgress(enabled) {
+  return new ProgressTracker({
+    enabled,
+    prefix: "CLEO Upgrade",
+    steps: [
+      "Analyzing current state",
+      "Checking storage migration needs",
+      "Validating schemas",
+      "Applying fixes",
+      "Verifying results"
+    ]
+  });
+}
+var ProgressTracker;
+var init_progress = __esm({
+  "packages/cleo/src/cli/progress.ts"() {
+    "use strict";
+    init_format_context();
+    ProgressTracker = class {
+      enabled;
+      prefix;
+      currentStep = 0;
+      totalSteps;
+      steps;
+      constructor(options) {
+        this.enabled = options.enabled;
+        this.prefix = options.prefix ?? "CLEO";
+        this.steps = options.steps;
+        this.totalSteps = options.steps.length;
+      }
+      /**
+       * Start the progress tracker.
+       */
+      start() {
+        if (!this.enabled || isQuiet()) return;
+        this.currentStep = 0;
+        stderr.write(`
+${this.prefix}: Starting...
+`);
+      }
+      /**
+       * Update to a specific step.
+       */
+      step(index, message) {
+        if (!this.enabled || isQuiet()) return;
+        this.currentStep = index;
+        const stepName = this.steps[index] ?? message ?? "Working...";
+        const progress = `[${index + 1}/${this.totalSteps}]`;
+        stderr.write(`  ${progress} ${stepName}...
+`);
+      }
+      /**
+       * Move to next step.
+       */
+      next(message) {
+        this.step(this.currentStep + 1, message);
+      }
+      /**
+       * Mark as complete with optional summary.
+       *
+       * @remarks
+       * Writes to stderr (not stdout) so that progress messages never pollute
+       * the machine-readable JSON envelope on stdout. Stdout MUST contain exactly
+       * one JSON object per CLI invocation (ADR-039 / T927).
+       */
+      complete(summary) {
+        if (!this.enabled || isQuiet()) return;
+        if (summary) {
+          stderr.write(`
+${this.prefix}: \u2713 ${summary}
+
+`);
+        } else {
+          stderr.write(`
+${this.prefix}: \u2713 Complete
+
+`);
+        }
+      }
+      /**
+       * Report an error.
+       */
+      error(message) {
+        if (!this.enabled || isQuiet()) return;
+        stderr.write(`
+${this.prefix}: \u2717 ${message}
+
+`);
+      }
+    };
+  }
+});
+
 // packages/cleo/src/cli/commands/migrate-agents-v2.ts
 var migrate_agents_v2_exports = {};
 __export(migrate_agents_v2_exports, {
@@ -50821,6 +50966,50 @@ var init_history = __esm({
   }
 });
 
+// packages/cleo/src/cli/commands/hygiene.ts
+var hygiene_exports = {};
+__export(hygiene_exports, {
+  hygieneCommand: () => hygieneCommand
+});
+import { getProjectRoot as getProjectRoot43 } from "@cleocode/core";
+import { runSpawnReadinessHygieneCli } from "@cleocode/core/hygiene/validate-spawn-readiness.js";
+var hygieneCommand;
+var init_hygiene = __esm({
+  "packages/cleo/src/cli/commands/hygiene.ts"() {
+    "use strict";
+    init_dist();
+    hygieneCommand = defineCommand({
+      meta: {
+        name: "hygiene",
+        description: "Run spawn-readiness hygiene checks"
+      },
+      subCommands: {
+        "validate-spawn-readiness": defineCommand({
+          meta: {
+            name: "validate-spawn-readiness",
+            description: "Run all pre-spawn hygiene gates (changeset lint, changelog drift, worktree location)"
+          },
+          args: {
+            "project-root": {
+              type: "string",
+              description: "Project root directory (default: auto-detect)"
+            },
+            "worktree-path": {
+              type: "string",
+              description: "Expected worktree path for location validation"
+            }
+          },
+          async run({ args }) {
+            const projectRoot = args["project-root"] || getProjectRoot43() || process.cwd();
+            const worktreePath = args["worktree-path"];
+            await runSpawnReadinessHygieneCli(projectRoot, worktreePath);
+          }
+        })
+      }
+    });
+  }
+});
+
 // packages/cleo/src/cli/commands/import-tasks.ts
 var import_tasks_exports = {};
 __export(import_tasks_exports, {
@@ -51973,7 +52162,7 @@ var llm_cost_exports = {};
 __export(llm_cost_exports, {
   costCommand: () => costCommand
 });
-import { getProjectRoot as getProjectRoot43 } from "@cleocode/core/internal";
+import { getProjectRoot as getProjectRoot44 } from "@cleocode/core/internal";
 import { computeCost } from "@cleocode/core/llm/usage-pricing";
 function resolveSessionId(raw) {
   if (raw === "current") {
@@ -52046,7 +52235,7 @@ var init_llm_cost = __esm({
           process.exit(6);
         }
         const sessionId = resolveSessionId(rawSessionId);
-        const projectRoot = getProjectRoot43(process.cwd());
+        const projectRoot = getProjectRoot44(process.cwd());
         let breakdown;
         try {
           breakdown = await loadSessionCostBreakdown(projectRoot, sessionId);
@@ -53593,7 +53782,7 @@ var memory_exports = {};
 __export(memory_exports, {
   memoryCommand: () => memoryCommand
 });
-import { getProjectRoot as getProjectRoot44 } from "@cleocode/core";
+import { getProjectRoot as getProjectRoot45 } from "@cleocode/core";
 import {
   getBrainDb as getBrainDb2,
   getDreamStatus,
@@ -54517,7 +54706,7 @@ var init_memory3 = __esm({
       },
       args: {},
       async run() {
-        const root = getProjectRoot44();
+        const root = getProjectRoot45();
         try {
           const result = await runConsolidation(root);
           cliOutput(result, { command: "memory-consolidate", operation: "memory.consolidate" });
@@ -54541,7 +54730,7 @@ var init_memory3 = __esm({
         }
       },
       async run({ args }) {
-        const root = getProjectRoot44();
+        const root = getProjectRoot45();
         if (args.status) {
           try {
             const status = await getDreamStatus(root);
@@ -54578,7 +54767,7 @@ var init_memory3 = __esm({
         }
       },
       async run({ args }) {
-        const root = getProjectRoot44();
+        const root = getProjectRoot45();
         try {
           const { runObserver, runReflector } = await import("@cleocode/core/memory");
           const observerResult = await runObserver(root, args.session, {
@@ -54618,7 +54807,7 @@ var init_memory3 = __esm({
         }
       },
       async run({ args }) {
-        const root = getProjectRoot44();
+        const root = getProjectRoot45();
         try {
           await getBrainDb2(root);
           const { totalDuplicateRows, groups } = await scanDuplicateEntries();
@@ -54664,7 +54853,7 @@ var init_memory3 = __esm({
       async run({ args }) {
         const sourceDir = args.from;
         const isDryRun = !!args["dry-run"];
-        const projectRoot = getProjectRoot44();
+        const projectRoot = getProjectRoot45();
         try {
           const result = await importMemoryFiles({
             sourceDir,
@@ -54815,7 +55004,7 @@ var init_memory3 = __esm({
       },
       args: {},
       async run() {
-        const root = getProjectRoot44();
+        const root = getProjectRoot45();
         try {
           await getBrainDb2(root);
           const result = await getTierStats(root);
@@ -54858,7 +55047,7 @@ var init_memory3 = __esm({
         }
       },
       async run({ args }) {
-        const root = getProjectRoot44();
+        const root = getProjectRoot45();
         const targetTier = args.to;
         const reason = args.reason;
         const validTiers = ["medium", "long"];
@@ -54924,7 +55113,7 @@ var init_memory3 = __esm({
         }
       },
       async run({ args }) {
-        const root = getProjectRoot44();
+        const root = getProjectRoot45();
         const targetTier = args.to;
         const reason = args.reason;
         const validTiers = ["short", "medium"];
@@ -55384,7 +55573,7 @@ var migrate_claude_mem_exports = {};
 __export(migrate_claude_mem_exports, {
   migrateClaudeMemCommand: () => migrateClaudeMemCommand
 });
-import { getProjectRoot as getProjectRoot45, migrateClaudeMem } from "@cleocode/core/internal";
+import { getProjectRoot as getProjectRoot46, migrateClaudeMem } from "@cleocode/core/internal";
 import { ingestLooseAgentOutputs, ingestRcasdDirectories } from "@cleocode/core/memory";
 import { getDb as getDb2 } from "@cleocode/core/store/sqlite";
 var storageCommand, claudeMemCommand, manifestIngestCommand, migrateClaudeMemCommand;
@@ -55447,7 +55636,7 @@ var init_migrate_claude_mem = __esm({
         }
       },
       async run({ args }) {
-        const root = getProjectRoot45();
+        const root = getProjectRoot46();
         try {
           const result = await migrateClaudeMem(root, {
             sourcePath: args.source,
@@ -55496,7 +55685,7 @@ var init_migrate_claude_mem = __esm({
         }
       },
       async run({ args }) {
-        const projectRoot = getProjectRoot45();
+        const projectRoot = getProjectRoot46();
         try {
           const db = await getDb2(projectRoot);
           const rcasdFlag = Boolean(args.rcasd);
@@ -55600,7 +55789,7 @@ __export(nexus_exports, {
 import { appendFile as appendFile2, mkdir as mkdir3 } from "node:fs/promises";
 import { homedir as homedir5 } from "node:os";
 import path4 from "node:path";
-import { getProjectRoot as getProjectRoot46 } from "@cleocode/core";
+import { getProjectRoot as getProjectRoot47 } from "@cleocode/core";
 import { getSymbolImpact } from "@cleocode/core/nexus";
 import { runNexusAnalysis } from "@cleocode/core/nexus/analyze-orchestrator.js";
 import { exportNexusGraph } from "@cleocode/core/nexus/export.js";
@@ -55715,7 +55904,7 @@ var init_nexus3 = __esm({
       async run({ args }) {
         applyJsonFlag2(args.json);
         const projectIdOverride = args["project-id"];
-        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot46();
+        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot47();
         const startTime = Date.now();
         try {
           const [{ getNexusDb, nexusSchema }, { getIndexStats }] = await Promise.all([
@@ -56230,7 +56419,7 @@ var init_nexus3 = __esm({
         applyJsonFlag2(args.json);
         const startTime = Date.now();
         const projectIdOverride = args["project-id"];
-        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot46();
+        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot47();
         const projectId = projectIdOverride ?? Buffer.from(repoPath).toString("base64url").slice(0, 32);
         const response = await dispatchRaw("query", "nexus", "clusters", { projectId, repoPath });
         const durationMs = Date.now() - startTime;
@@ -56274,7 +56463,7 @@ var init_nexus3 = __esm({
         applyJsonFlag2(args.json);
         const startTime = Date.now();
         const projectIdOverride = args["project-id"];
-        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot46();
+        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot47();
         const projectId = projectIdOverride ?? Buffer.from(repoPath).toString("base64url").slice(0, 32);
         const response = await dispatchRaw("query", "nexus", "flows", { projectId, repoPath });
         const durationMs = Date.now() - startTime;
@@ -56317,7 +56506,7 @@ var init_nexus3 = __esm({
         void appendDeprecationTelemetry("nexus.context", "cleo graph context");
         const startTime = Date.now();
         const projectIdOverride = args["project-id"];
-        const repoPath = getProjectRoot46();
+        const repoPath = getProjectRoot47();
         const projectId = projectIdOverride ?? Buffer.from(repoPath).toString("base64url").slice(0, 32);
         const limit = parseInt(args.limit, 10);
         const symbolName = args.symbol;
@@ -56380,7 +56569,7 @@ var init_nexus3 = __esm({
         const startTime = Date.now();
         const whyFlag = !!args.why;
         const projectIdOverride = args["project-id"];
-        const repoPath = getProjectRoot46();
+        const repoPath = getProjectRoot47();
         const projectId = projectIdOverride ?? Buffer.from(repoPath).toString("base64url").slice(0, 32);
         const maxDepth = Math.min(parseInt(args.depth, 10), 5);
         const symbolName = args.symbol;
@@ -56452,7 +56641,7 @@ var init_nexus3 = __esm({
         const projectIdOverride = args["project-id"];
         const isIncremental = !!args.incremental;
         const ctx = getFormatContext();
-        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot46();
+        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot47();
         humanInfo(`[nexus] Analyzing: ${repoPath}${isIncremental ? " (incremental)" : ""}`);
         if (!isIncremental) humanInfo("[nexus] Clearing existing index for project...");
         try {
@@ -56555,7 +56744,7 @@ var init_nexus3 = __esm({
       async run({ args }) {
         applyJsonFlag2(args.json);
         const startTime = Date.now();
-        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot46();
+        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot47();
         const name = args.name;
         const response = await dispatchRaw("mutate", "nexus", "projects.register", {
           path: repoPath,
@@ -56913,7 +57102,7 @@ var init_nexus3 = __esm({
         applyJsonFlag2(args.json);
         const startTime = Date.now();
         const projectIdOverride = args["project-id"];
-        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot46();
+        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot47();
         const projectId = projectIdOverride ?? Buffer.from(repoPath).toString("base64url").slice(0, 32);
         const response = await dispatchRaw("mutate", "nexus", "refresh-bridge", {
           repoPath,
@@ -57019,7 +57208,7 @@ var init_nexus3 = __esm({
       async run({ args }) {
         applyJsonFlag2(args.json);
         const startTime = Date.now();
-        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot46();
+        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot47();
         const projectIdOverride = args["project-id"];
         const beforeRef = args.before ?? "HEAD~1";
         const afterRef = args.after ?? "HEAD";
@@ -57137,7 +57326,7 @@ var init_nexus3 = __esm({
         applyJsonFlag2(args.json);
         const startTime = Date.now();
         const projectIdOverride = args["project-id"];
-        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot46();
+        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot47();
         const projectId = projectIdOverride ?? Buffer.from(repoPath).toString("base64url").slice(0, 32);
         const response = await dispatchRaw("query", "nexus", "route-map", { projectId });
         const durationMs = Date.now() - startTime;
@@ -57193,7 +57382,7 @@ var init_nexus3 = __esm({
         const startTime = Date.now();
         const routeSymbol = args.routeSymbol;
         const projectIdOverride = args["project-id"];
-        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot46();
+        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot47();
         const projectId = projectIdOverride ?? Buffer.from(repoPath).toString("base64url").slice(0, 32);
         const response = await dispatchRaw("query", "nexus", "shape-check", { routeSymbol, projectId });
         const durationMs = Date.now() - startTime;
@@ -57583,7 +57772,7 @@ var init_nexus3 = __esm({
       async run({ args }) {
         applyJsonFlag2(args.json);
         const startTime = Date.now();
-        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot46();
+        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot47();
         const projectIdOverride = args["project-id"];
         const projectId = projectIdOverride ?? Buffer.from(repoPath).toString("base64url").slice(0, 32);
         const response = await dispatchRaw("mutate", "nexus", "contracts-sync", {
@@ -57687,7 +57876,7 @@ var init_nexus3 = __esm({
       async run({ args }) {
         applyJsonFlag2(args.json);
         const startTime = Date.now();
-        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot46();
+        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot47();
         const projectId = Buffer.from(repoPath).toString("base64url").slice(0, 32);
         const response = await dispatchRaw("mutate", "nexus", "contracts-link-tasks", {
           projectId,
@@ -57768,7 +57957,7 @@ var init_nexus3 = __esm({
         const isIncremental = !!args.incremental;
         try {
           const result = await runNexusWiki({
-            projectRoot: getProjectRoot46(),
+            projectRoot: getProjectRoot47(),
             outputDir,
             communityFilter,
             incremental: isIncremental
@@ -58118,7 +58307,7 @@ __export(orchestrate_exports, {
 });
 import { execFileSync as execFileSync3 } from "node:child_process";
 import { orchestration } from "@cleocode/core";
-import { BUILD_CONFIG as BUILD_CONFIG2 } from "@cleocode/core/internal";
+import { BUILD_CONFIG as BUILD_CONFIG2, getProjectRoot as getProjectRoot48 } from "@cleocode/core/internal";
 function formatRollupTable(rollup) {
   const waves = "waves" in rollup ? rollup.waves : [rollup];
   const lines = [];
@@ -58153,7 +58342,7 @@ function formatRollupTable(rollup) {
   }
   return lines.join("\n");
 }
-var rollupCommand, startCommand5, statusCommand11, analyzeCommand4, readyCommand, nextCommand2, wavesCommand2, planCommand, spawnCommand2, validateCommand6, contextCommand5, ivtrCommand, parallelCommand, tesseraListCommand, tesseraInstantiateCommand, tesseraCommand, unblockCommand, bootstrapCommand, classifyCommand, fanoutStatusCommand, handoffCommand, spawnExecuteCommand, fanoutCommand, pruneCommand, worktreeCompleteCommand, conduitStatusCommand, conduitPeekCommand, conduitStartCommand, conduitStopCommand, approveCommand, rejectCommand, pendingCommand, conduitSendCommand, orchestrateCommand;
+var rollupCommand, startCommand5, statusCommand11, dashboardCommand, analyzeCommand4, readyCommand, nextCommand2, wavesCommand2, planCommand, spawnCommand2, validateCommand6, contextCommand5, ivtrCommand, parallelCommand, tesseraListCommand, tesseraInstantiateCommand, tesseraCommand, unblockCommand, bootstrapCommand, classifyCommand, fanoutStatusCommand, handoffCommand, spawnExecuteCommand, fanoutCommand, pruneCommand, worktreeCompleteCommand, conduitStatusCommand, conduitPeekCommand, conduitStartCommand, conduitStopCommand, approveCommand, rejectCommand, pendingCommand, conduitSendCommand, orchestrateCommand;
 var init_orchestrate3 = __esm({
   "packages/cleo/src/cli/commands/orchestrate.ts"() {
     "use strict";
@@ -58248,6 +58437,28 @@ var init_orchestrate3 = __esm({
         );
       }
     });
+    dashboardCommand = defineCommand({
+      meta: {
+        name: "dashboard",
+        description: "Show queue depth, admin-merge rate, force-bypass rate, and active worktree count"
+      },
+      args: {
+        window: {
+          type: "string",
+          description: "Audit rate window in hours (default: 24)"
+        }
+      },
+      async run({ args }) {
+        const rateWindowHours = args.window !== void 0 ? Number.parseFloat(String(args.window)) : void 0;
+        const metrics = await orchestration.collectOrchestrateDashboard(getProjectRoot48(), {
+          ...rateWindowHours !== void 0 && Number.isFinite(rateWindowHours) && rateWindowHours > 0 ? { rateWindowHours } : {}
+        });
+        cliOutput(metrics, {
+          command: "orchestrate-dashboard",
+          operation: "orchestrate.dashboard"
+        });
+      }
+    });
     analyzeCommand4 = defineCommand({
       meta: { name: "analyze", description: "Analyze epic dependency structure" },
       args: {
@@ -59004,6 +59215,7 @@ var init_orchestrate3 = __esm({
       subCommands: {
         start: startCommand5,
         status: statusCommand11,
+        dashboard: dashboardCommand,
         "roll-up": rollupCommand,
         analyze: analyzeCommand4,
         ready: readyCommand,
@@ -60228,7 +60440,7 @@ var refresh_memory_exports = {};
 __export(refresh_memory_exports, {
   refreshMemoryCommand: () => refreshMemoryCommand
 });
-import { getProjectRoot as getProjectRoot47 } from "@cleocode/core";
+import { getProjectRoot as getProjectRoot49 } from "@cleocode/core";
 var refreshMemoryCommand;
 var init_refresh_memory = __esm({
   "packages/cleo/src/cli/commands/refresh-memory.ts"() {
@@ -60241,7 +60453,7 @@ var init_refresh_memory = __esm({
         description: "Regenerate .cleo/memory-bridge.md from brain.db"
       },
       async run() {
-        const projectDir = getProjectRoot47();
+        const projectDir = getProjectRoot49();
         const { writeMemoryBridge } = await import("@cleocode/core/internal");
         const result = await writeMemoryBridge(projectDir);
         if (result.written) {
@@ -60716,8 +60928,8 @@ var init_release3 = __esm({
       },
       async run({ args }) {
         if (args["skip-readiness"] !== true) {
-          const { runSpawnReadinessHygieneCli } = await import("@cleocode/core/hygiene/validate-spawn-readiness.js");
-          await runSpawnReadinessHygieneCli();
+          const { runSpawnReadinessHygieneCli: runSpawnReadinessHygieneCli2 } = await import("@cleocode/core/hygiene/validate-spawn-readiness.js");
+          await runSpawnReadinessHygieneCli2();
         }
         await dispatchFromCli(
           "mutate",
@@ -61682,8 +61894,8 @@ import fs3 from "node:fs";
 import path5 from "node:path";
 import {
   CleoError as CleoError7,
-  getProjectRoot as getProjectRoot48,
-  getTaskAccessor as getTaskAccessor3,
+  getProjectRoot as getProjectRoot50,
+  getTaskAccessor as getTaskAccessor4,
   parseConflictReport,
   setAtPath
 } from "@cleocode/core";
@@ -61703,7 +61915,7 @@ var init_restore = __esm({
         description: "Apply manually-resolved conflicts from .cleo/restore-conflicts.md"
       },
       async run() {
-        const projectRoot = getProjectRoot48();
+        const projectRoot = getProjectRoot50();
         const reportPath = path5.join(projectRoot, CLEO_DIR_NAME, RESTORE_CONFLICTS_MD);
         if (!fs3.existsSync(reportPath)) {
           humanLine("No pending restore conflicts. Nothing to finalize.");
@@ -61881,7 +62093,7 @@ var init_restore = __esm({
           if (!idPattern.test(taskId)) {
             throw new CleoError7(2 /* INVALID_INPUT */, `Invalid task ID: ${taskId}`);
           }
-          const accessor = await getTaskAccessor3();
+          const accessor = await getTaskAccessor4();
           const activeTask = await accessor.loadSingleTask(taskId);
           if (activeTask) {
             if (activeTask.status === "cancelled") {
@@ -64341,7 +64553,7 @@ var sequence_exports = {};
 __export(sequence_exports, {
   sequenceCommand: () => sequenceCommand
 });
-import { getProjectRoot as getProjectRoot49 } from "@cleocode/core/internal";
+import { getProjectRoot as getProjectRoot51 } from "@cleocode/core/internal";
 var showCommand12, checkCommand6, repairCommand2, sequenceCommand;
 var init_sequence = __esm({
   "packages/cleo/src/cli/commands/sequence.ts"() {
@@ -64377,7 +64589,7 @@ var init_sequence = __esm({
       meta: { name: "repair", description: "Reset counter to max + 1 if behind" },
       async run() {
         const { repairSequence } = await import("@cleocode/core/internal");
-        const projectRoot = getProjectRoot49();
+        const projectRoot = getProjectRoot51();
         const repair = await repairSequence(projectRoot);
         const result = {
           repaired: repair.repaired,
@@ -64832,8 +65044,8 @@ var init_session4 = __esm({
         "audit-scope": { type: "string", description: "Audit log scope (global|local)" }
       },
       async run({ args }) {
-        const { detectSessionDrift, getProjectRoot: getProjectRoot54 } = await import("@cleocode/core");
-        const projectRoot = await getProjectRoot54();
+        const { detectSessionDrift, getProjectRoot: getProjectRoot56 } = await import("@cleocode/core");
+        const projectRoot = await getProjectRoot56();
         const scope = args["audit-scope"] === "local" ? "local" : "global";
         const report = await detectSessionDrift({ projectRoot, auditScope: scope });
         cliOutput(report, { command: "session drift", operation: "session.drift" });
@@ -67488,13 +67700,13 @@ var init_telemetry2 = __esm({
 // packages/cleo/src/cli/commands/templates/lib.ts
 import { readFileSync as readFileSync15 } from "node:fs";
 import { isAbsolute as isAbsolute3, resolve as resolve7 } from "node:path";
-import { getProjectRoot as getProjectRoot50 } from "@cleocode/core";
+import { getProjectRoot as getProjectRoot52 } from "@cleocode/core";
 import { resolveSourcePathAbsolute } from "@cleocode/core/templates/registry";
 function resolveProjectRoot7(raw) {
   if (typeof raw === "string" && raw.length > 0) {
     return isAbsolute3(raw) ? raw : resolve7(process.cwd(), raw);
   }
-  return getProjectRoot50();
+  return getProjectRoot52();
 }
 function readTemplateSource(entry) {
   const sourceAbsolute = resolveSourcePathAbsolute(entry);
@@ -68278,7 +68490,7 @@ __export(token_exports, {
   tokenCommand: () => tokenCommand
 });
 import { readFileSync as readFileSync19 } from "node:fs";
-import { getProjectRoot as getProjectRoot51, measureTokenExchange, recordTokenExchange as recordTokenExchange2 } from "@cleocode/core/internal";
+import { getProjectRoot as getProjectRoot53, measureTokenExchange, recordTokenExchange as recordTokenExchange2 } from "@cleocode/core/internal";
 function readPayload(args, textKey, fileKey) {
   const text = args[textKey];
   const file = args[fileKey];
@@ -68442,7 +68654,7 @@ var init_token = __esm({
           domain: args.domain,
           operation: args.operation
         };
-        const result = args.record ? await recordTokenExchange2(getProjectRoot51(), input2) : await measureTokenExchange(input2);
+        const result = args.record ? await recordTokenExchange2(getProjectRoot53(), input2) : await measureTokenExchange(input2);
         cliOutput(result, {
           command: "token",
           operation: args.record ? "admin.token.record" : "token.estimate"
@@ -68478,7 +68690,7 @@ __export(transcript_exports, {
 });
 import { homedir as homedir6 } from "node:os";
 import { join as join34 } from "node:path";
-import { getProjectRoot as getProjectRoot52 } from "@cleocode/core";
+import { getProjectRoot as getProjectRoot54 } from "@cleocode/core";
 import {
   parseDurationMs,
   pruneTranscripts,
@@ -68508,7 +68720,7 @@ var init_transcript = __esm({
       async run({ args }) {
         if (args.pending) {
           try {
-            const projectRoot = getProjectRoot52();
+            const projectRoot = getProjectRoot54();
             const { scanPendingTranscripts } = await import("@cleocode/core/memory/transcript-scanner.js");
             const pending = await scanPendingTranscripts(projectRoot);
             cliOutput(
@@ -68605,7 +68817,7 @@ var init_transcript = __esm({
       async run({ args }) {
         const tier = args.tier ?? "warm";
         const dryRun = args["dry-run"] ?? false;
-        const projectRoot = getProjectRoot52();
+        const projectRoot = getProjectRoot54();
         try {
           const { extractTranscript } = await import("@cleocode/core/memory/transcript-extractor.js");
           const { findSessionTranscriptPath, listAllTranscripts } = await import("@cleocode/core/memory/transcript-scanner.js");
@@ -68717,7 +68929,7 @@ var init_transcript = __esm({
         const dryRun = args["dry-run"] ?? false;
         const olderThanHours = args["older-than-hours"] ? Number.parseInt(args["older-than-hours"], 10) : 24;
         const limit = args.limit ? Number.parseInt(args.limit, 10) : void 0;
-        const projectRoot = getProjectRoot52();
+        const projectRoot = getProjectRoot54();
         try {
           const { extractTranscript } = await import("@cleocode/core/memory/transcript-extractor.js");
           const { listAllTranscripts } = await import("@cleocode/core/memory/transcript-scanner.js");
@@ -70000,7 +70212,7 @@ __export(worktree_exports, {
   worktreeCommand: () => worktreeCommand
 });
 import readline4 from "node:readline";
-import { getProjectRoot as getProjectRoot53, listWorktrees as listWorktrees2 } from "@cleocode/core/internal";
+import { getProjectRoot as getProjectRoot55, listWorktrees as listWorktrees2 } from "@cleocode/core/internal";
 async function promptYesNo2(question) {
   return new Promise((resolve9) => {
     const rl = readline4.createInterface({ input: process.stdin, output: process.stdout });
@@ -70105,7 +70317,7 @@ var init_worktree3 = __esm({
         const staleDays = staleDaysRaw !== void 0 ? Number.parseInt(staleDaysRaw, 10) : void 0;
         const idleDaysRaw = typeof args["idle-days"] === "string" ? args["idle-days"] : void 0;
         const idleDays = idleDaysRaw !== void 0 ? Number.parseInt(idleDaysRaw, 10) : void 0;
-        const projectRoot = getProjectRoot53();
+        const projectRoot = getProjectRoot55();
         const listResult = await listWorktrees2({
           projectRoot,
           ...staleDays !== void 0 && !Number.isNaN(staleDays) ? { staleDays } : {}
@@ -70284,6 +70496,11 @@ var init_worktree3 = __esm({
         actor: {
           type: "string",
           description: "Override actor name written to the audit log."
+        },
+        recover: {
+          type: "boolean",
+          description: "After adopting, recover a partial ETIMEDOUT worktree by running pnpm install and clearing stale git locks.",
+          default: false
         }
       },
       async run({ args }) {
@@ -70305,7 +70522,8 @@ var init_worktree3 = __esm({
             worktreePath: rawPath,
             ...source !== void 0 ? { source } : {},
             ...rawTaskId !== void 0 ? { taskId: rawTaskId } : {},
-            ...rawActor !== void 0 ? { actor: rawActor } : {}
+            ...rawActor !== void 0 ? { actor: rawActor } : {},
+            recover: args["recover"] === true
           },
           { command: "worktree-adopt", operation: "worktree.adopt" }
         );
@@ -70658,6 +70876,12 @@ var COMMAND_MANIFEST = [
     description: "Probe every registered project (nexus.db) for DB + config health",
     load: async () => (await Promise.resolve().then(() => (init_doctor_projects(), doctor_projects_exports))).doctorProjectsCommand
   },
+  {
+    exportName: "doctorReleaseReadinessCommand",
+    name: "release-readiness",
+    description: "Pre-flight release readiness check \u2014 lint matrix + changelog + changeset + npm OIDC + tag-trigger sanity (T10458)",
+    load: async () => (await Promise.resolve().then(() => (init_doctor_release_readiness(), doctor_release_readiness_exports))).doctorReleaseReadinessCommand
+  },
   {
     exportName: "doctorCommand",
     name: "doctor",
@@ -70742,6 +70966,12 @@ var COMMAND_MANIFEST = [
     description: "Completion timeline and productivity analytics",
     load: async () => (await Promise.resolve().then(() => (init_history(), history_exports))).historyCommand
   },
+  {
+    exportName: "hygieneCommand",
+    name: "hygiene",
+    description: "Run spawn-readiness hygiene checks",
+    load: async () => (await Promise.resolve().then(() => (init_hygiene(), hygiene_exports))).hygieneCommand
+  },
   {
     exportName: "importTasksCommand",
     name: "import-tasks",
@@ -71657,7 +71887,7 @@ async function runStartupMaintenance() {
     detectAndRemoveStrayProjectNexus,
     getGlobalSalt,
     getLogger: getLogger21,
-    getProjectRoot: getProjectRoot54,
+    getProjectRoot: getProjectRoot56,
     isCleanupMarkerSet,
     migrateSignaldockToConduit,
     needsSignaldockToConduitMigration,
@@ -71666,7 +71896,7 @@ async function runStartupMaintenance() {
   } = await import("@cleocode/core/internal");
   let projectRootForCleanup = "";
   try {
-    projectRootForCleanup = getProjectRoot54();
+    projectRootForCleanup = getProjectRoot56();
   } catch {
   }
   if (!isCleanupMarkerSet(CLI_VERSION, projectRootForCleanup)) {
@@ -71686,7 +71916,7 @@ async function runStartupMaintenance() {
   const isInitInvocation = process.argv.slice(2).some((a) => a === "init");
   if (!isInitInvocation) {
     try {
-      const _projectRootForMigration = getProjectRoot54();
+      const _projectRootForMigration = getProjectRoot56();
       if (needsSignaldockToConduitMigration(_projectRootForMigration)) {
         const migrationResult = migrateSignaldockToConduit(_projectRootForMigration);
         if (migrationResult.status === "failed") {