@cleocode/cleo 2026.5.131 → 2026.5.133

package/dist/cli/index.js

@@ -27495,6 +27495,70 @@ function iterationCapFor(node, runtimeDefault) {
   if (typeof cap === "number" && Number.isFinite(cap) && cap >= 0) return cap;
   return runtimeDefault;
 }
+function validateDecompositionTaskTree(nodeId, taskTree2) {
+  if (!Array.isArray(taskTree2)) {
+    return `ensures.schema[task_tree] on ${nodeId}: task_tree must be a non-empty array, got ${typeof taskTree2}`;
+  }
+  if (taskTree2.length === 0) {
+    return `ensures.schema[task_tree] on ${nodeId}: task_tree is an empty array \u2014 decomposition produced no tasks`;
+  }
+  const knownIds = /* @__PURE__ */ new Set();
+  for (const entry of taskTree2) {
+    if (typeof entry.id === "string") {
+      knownIds.add(entry.id);
+    }
+  }
+  for (let i = 0; i < taskTree2.length; i++) {
+    const entry = taskTree2[i];
+    if (typeof entry !== "object" || entry === null) {
+      return `ensures.schema[task_tree] on ${nodeId}: entry[${i}] must be an object, got ${entry === null ? "null" : typeof entry}`;
+    }
+    if (typeof entry.title !== "string" || entry.title.trim().length === 0) {
+      return `ensures.schema[task_tree] on ${nodeId}: entry[${i}].title must be a non-empty string`;
+    }
+    if (!Array.isArray(entry.acceptance) || entry.acceptance.length === 0) {
+      return `ensures.schema[task_tree] on ${nodeId}: entry[${i}] ("${entry.title}") must have a non-empty acceptance array`;
+    }
+    const hasValidAc = entry.acceptance.some(
+      (ac) => typeof ac === "string" && ac.trim().length > 0
+    );
+    if (!hasValidAc) {
+      return `ensures.schema[task_tree] on ${nodeId}: entry[${i}] ("${entry.title}") acceptance array contains no non-empty strings`;
+    }
+    if (Array.isArray(entry.depends) && knownIds.size > 0) {
+      for (const depId of entry.depends) {
+        if (typeof depId === "string" && /^T\d{3,}$/.test(depId) && !knownIds.has(depId)) {
+        }
+      }
+    }
+  }
+  return null;
+}
+function validateIvtrEvidenceOutput(nodeId, evidence) {
+  if (evidence === null || evidence === void 0) {
+    return `ensures.schema[evidence] on ${nodeId}: evidence must be present (non-null, non-undefined)`;
+  }
+  if (typeof evidence === "string") {
+    if (evidence.trim().length === 0) {
+      return `ensures.schema[evidence] on ${nodeId}: evidence string must not be empty`;
+    }
+    return null;
+  }
+  if (Array.isArray(evidence)) {
+    if (evidence.length === 0) {
+      return `ensures.schema[evidence] on ${nodeId}: evidence array must not be empty`;
+    }
+    return null;
+  }
+  if (typeof evidence === "object") {
+    const keys = Object.keys(evidence);
+    if (keys.length === 0) {
+      return `ensures.schema[evidence] on ${nodeId}: evidence object must have at least one key (got {})`;
+    }
+    return null;
+  }
+  return `ensures.schema[evidence] on ${nodeId}: evidence must be a string, array, or object (got ${typeof evidence})`;
+}
 async function runFromNode(args) {
   const {
     db,
@@ -27593,6 +27657,39 @@ async function runFromNode(args) {
           }
         }
       }
+      if (node.ensures?.schema) {
+        let schemaViolation = null;
+        if (node.ensures.schema === "task_tree") {
+          schemaViolation = validateDecompositionTaskTree(node.id, context["task_tree"]);
+        } else if (node.ensures.schema === "evidence") {
+          schemaViolation = validateIvtrEvidenceOutput(node.id, context["evidence"]);
+        }
+        if (schemaViolation !== null) {
+          auditContractViolation(
+            args.projectRoot,
+            run.runId,
+            node.id,
+            "ensures",
+            node.ensures.schema,
+            playbook.name
+          );
+          const handled = handleContractErrorHandler(
+            playbook,
+            "contract_violation",
+            schemaViolation
+          );
+          if (handled === "abort") {
+            failedNodeId = node.id;
+            lastError = schemaViolation;
+          } else {
+            context["__ensuresSchemaViolation"] = schemaViolation;
+            if (handled === "hitl_escalate") {
+              exceededNodeId = node.id;
+            }
+          }
+        }
+      }
+      if (failedNodeId !== void 0) break;
       const nextId = resolveNextNodeId(node.id, edgeIndex);
       if (nextId !== null) {
         const edge = resolveEdge(node.id, nextId, playbook.edges);
@@ -27908,6 +28005,8 @@ __export(src_exports, {
   resumePlaybook: () => resumePlaybook,
   updatePlaybookApproval: () => updatePlaybookApproval,
   updatePlaybookRun: () => updatePlaybookRun,
+  validateDecompositionTaskTree: () => validateDecompositionTaskTree,
+  validateIvtrEvidenceOutput: () => validateIvtrEvidenceOutput,
   validatePlaybookCompliance: () => validatePlaybookCompliance
 });
 var PLAYBOOKS_PACKAGE_VERSION;
@@ -27974,8 +28073,8 @@ async function loadPlaybookByName(name) {
     return null;
   }
   try {
-    const { getProjectRoot: getProjectRoot57 } = await import("@cleocode/core/internal");
-    const projectRoot = __playbookRuntimeOverrides.projectRoot ?? getProjectRoot57();
+    const { getProjectRoot: getProjectRoot58 } = await import("@cleocode/core/internal");
+    const projectRoot = __playbookRuntimeOverrides.projectRoot ?? getProjectRoot58();
     const resolved = resolvePlaybook(name, {
       projectRoot,
       globalPlaybooksDir: __playbookRuntimeOverrides.globalPlaybooksDir,
@@ -28019,8 +28118,8 @@ async function acquireDb() {
 async function buildDefaultDispatcher() {
   if (__playbookRuntimeOverrides.dispatcher) return __playbookRuntimeOverrides.dispatcher;
   const { orchestrateSpawnExecute: orchestrateSpawnExecute2 } = await import("@cleocode/runtime/gateway");
-  const { getProjectRoot: getProjectRoot57 } = await import("@cleocode/core/internal");
-  const projectRoot = getProjectRoot57();
+  const { getProjectRoot: getProjectRoot58 } = await import("@cleocode/core/internal");
+  const projectRoot = getProjectRoot58();
   return {
     async dispatch(input2) {
       try {
@@ -28210,8 +28309,8 @@ var init_playbook2 = __esm({
             projectRoot = __playbookRuntimeOverrides.projectRoot;
           } else {
             try {
-              const { getProjectRoot: getProjectRoot57 } = await import("@cleocode/core/internal");
-              projectRoot = getProjectRoot57();
+              const { getProjectRoot: getProjectRoot58 } = await import("@cleocode/core/internal");
+              projectRoot = getProjectRoot58();
             } catch {
               projectRoot = void 0;
             }
@@ -28275,14 +28374,14 @@ var init_playbook2 = __esm({
         const dispatcher = await buildDefaultDispatcher();
         let result;
         try {
-          const { getProjectRoot: getProjectRoot57 } = await import("@cleocode/core/internal");
+          const { getProjectRoot: getProjectRoot58 } = await import("@cleocode/core/internal");
           const opts = {
             db,
             playbook: parsed.definition,
             playbookHash: parsed.sourceHash,
             initialContext,
             dispatcher,
-            projectRoot: getProjectRoot57()
+            projectRoot: getProjectRoot58()
           };
           if (__playbookRuntimeOverrides.approvalSecret !== void 0) {
             opts.approvalSecret = __playbookRuntimeOverrides.approvalSecret;
@@ -28523,7 +28622,7 @@ async function orchestrateAnalyzeOp(params) {
   return orchestrateAnalyze(params.epicId, getProjectRoot11(), params.mode);
 }
 async function orchestrateClassifyOp(params) {
-  return orchestrateClassify(params.request, params.context, getProjectRoot11());
+  return orchestrateClassify(params.request, params.context, getProjectRoot11(), params.taskId);
 }
 function orchestrateFanoutStatusOp(params) {
   const entry = fanoutManifestStore.get(params.manifestEntryId);
@@ -28672,7 +28771,69 @@ async function orchestrateApproveOp(params) {
 async function orchestrateRejectOp(params) {
   return Promise.resolve({ success: true, data: params });
 }
-async function orchestrateClassify(request, context, projectRoot) {
+async function orchestrateClassify(request, context, projectRoot, taskId) {
+  if (taskId) {
+    try {
+      const { getDb: getDb3 } = await import("@cleocode/core/internal");
+      const { tasks } = await import("@cleocode/core/store/tasks-schema");
+      const { eq: eq2 } = await import("drizzle-orm");
+      const { classifyTask: classifyTask2 } = await import("@cleocode/core");
+      const db = await getDb3(projectRoot);
+      const row = await db.select().from(tasks).where(eq2(tasks.id, taskId)).get();
+      if (!row) {
+        return {
+          success: false,
+          error: {
+            code: "E_NOT_FOUND",
+            message: `Task ${taskId} not found`
+          }
+        };
+      }
+      const task = {
+        id: row.id,
+        title: row.title,
+        description: row.description ?? "",
+        status: row.status,
+        priority: row.priority ?? "medium",
+        type: row.type ?? void 0,
+        kind: row.kind ?? void 0,
+        size: row.size ?? void 0,
+        labels: (() => {
+          try {
+            const parsed = JSON.parse(row.labelsJson ?? "[]");
+            return Array.isArray(parsed) ? parsed : [];
+          } catch {
+            return [];
+          }
+        })(),
+        createdAt: row.createdAt
+      };
+      const result = classifyTask2(task);
+      return {
+        success: true,
+        data: {
+          team: result.agentId,
+          lead: result.role === "lead" ? result.agentId : null,
+          protocol: result.role,
+          stage: null,
+          confidence: result.confidence,
+          reasoning: result.warning ? `${result.reason} | warning: ${result.warning}` : result.reason
+        }
+      };
+    } catch (error) {
+      getLogger8("domain:orchestrate").error(
+        { operation: "classify", taskId, err: error },
+        error instanceof Error ? error.message : String(error)
+      );
+      return {
+        success: false,
+        error: {
+          code: "E_CLASSIFY_FAILED",
+          message: error instanceof Error ? error.message : String(error)
+        }
+      };
+    }
+  }
   try {
     const { getCleoCantWorkflowsDir } = await import("@cleocode/core/internal");
     const { readFileSync: readFileSync22, readdirSync: readdirSync3, existsSync: existsSync21 } = await import("node:fs");
@@ -28734,6 +28895,9 @@ async function orchestrateClassify(request, context, projectRoot) {
     }
     matches.sort((a, b) => b.score - a.score);
     const best = matches[0];
+    const allHintWords = best.consultWhen.toLowerCase().split(/\s+/).filter(Boolean);
+    const normalised = allHintWords.length > 0 ? Math.min(best.score / allHintWords.length, 1) : 0;
+    const confidence = best.score > 0 ? Math.max(normalised, 0.5) : 0.1;
     return {
       success: true,
       data: {
@@ -28741,7 +28905,7 @@ async function orchestrateClassify(request, context, projectRoot) {
         lead: null,
         protocol: "base-subagent",
         stage: best.stages[0] ?? null,
-        confidence: best.score > 0 ? 0.5 : 0.1,
+        confidence,
         reasoning: best.score > 0 ? `Matched team '${best.team}' via consult-when hint: "${best.consultWhen}"` : `No strong match found; defaulting to first registered team '${best.team}'`
       }
     };
@@ -34920,11 +35084,11 @@ var init_security = __esm({
 });
 
 // packages/cleo/src/dispatch/middleware/sanitizer.ts
-function createSanitizer(getProjectRoot57) {
+function createSanitizer(getProjectRoot58) {
   return async (req, next) => {
     if (req.params) {
       try {
-        const root = getProjectRoot57 ? getProjectRoot57() : void 0;
+        const root = getProjectRoot58 ? getProjectRoot58() : void 0;
         req.params = sanitizeParams(req.params, root, {
           domain: req.domain,
           operation: req.operation
@@ -40725,9 +40889,9 @@ var init_backup = __esm({
       async run({ args }) {
         const scope = args.scope;
         const { packBundle } = await import("@cleocode/core/store/backup-pack.js");
-        const { getProjectRoot: getProjectRoot57 } = await import("@cleocode/core");
+        const { getProjectRoot: getProjectRoot58 } = await import("@cleocode/core");
         const includesProject = scope === "project" || scope === "all";
-        const projectRoot = includesProject ? getProjectRoot57() : void 0;
+        const projectRoot = includesProject ? getProjectRoot58() : void 0;
         let passphrase;
         if (args.encrypt === true) {
           passphrase = process.env["CLEO_BACKUP_PASSPHRASE"];
@@ -40803,12 +40967,12 @@ var init_backup = __esm({
       },
       async run({ args }) {
         const bundlePath = args.bundle;
-        const { getProjectRoot: getProjectRoot57, getCleoHome: getCleoHome6, getCleoVersion } = await import("@cleocode/core");
+        const { getProjectRoot: getProjectRoot58, getCleoHome: getCleoHome6, getCleoVersion } = await import("@cleocode/core");
         const { BundleError, cleanupStaging, unpackBundle } = await import("@cleocode/core/store/backup-unpack.js");
         const { regenerateConfigJson, regenerateProjectContextJson, regenerateProjectInfoJson } = await import("@cleocode/core/store/regenerators.js");
         const { regenerateAndCompare } = await import("@cleocode/core/store/restore-json-merge.js");
         const { buildConflictReport, writeConflictReport } = await import("@cleocode/core/store/restore-conflict-report.js");
-        const projectRoot = getProjectRoot57();
+        const projectRoot = getProjectRoot58();
         if (args.force !== true) {
           const existing = checkForExistingData(projectRoot, getCleoHome6());
           if (existing.length > 0) {
@@ -43107,6 +43271,108 @@ var init_claim = __esm({
   }
 });
 
+// packages/cleo/src/cli/commands/classify.ts
+var classify_exports = {};
+__export(classify_exports, {
+  classifyCommand: () => classifyCommand
+});
+import { classifyReadiness, classifyTask, getProjectRoot as getProjectRoot31 } from "@cleocode/core";
+var classifyCommand;
+var init_classify = __esm({
+  "packages/cleo/src/cli/commands/classify.ts"() {
+    "use strict";
+    init_define_cli_command();
+    init_renderers();
+    classifyCommand = defineCommand({
+      meta: {
+        name: "classify",
+        description: "Classify a task: readiness verdict (proceed|grill) + persona routing (agent, confidence)"
+      },
+      args: {
+        taskId: {
+          type: "positional",
+          description: "Task ID to classify (e.g. T1234)",
+          required: true
+        }
+      },
+      async run({ args }) {
+        const taskId = args.taskId;
+        const projectRoot = getProjectRoot31();
+        const { getDb: getDb3 } = await import("@cleocode/core/store/sqlite.js");
+        const { tasks } = await import("@cleocode/core/store/tasks-schema");
+        const { eq: eq2 } = await import("drizzle-orm");
+        const db = await getDb3(projectRoot);
+        const row = await db.select().from(tasks).where(eq2(tasks.id, taskId)).get();
+        if (!row) {
+          cliOutput(
+            {
+              success: false,
+              error: { code: "E_NOT_FOUND", message: `Task ${taskId} not found` }
+            },
+            { command: "classify", operation: "classify.show" }
+          );
+          return;
+        }
+        const labels = (() => {
+          try {
+            const parsed = JSON.parse(row.labelsJson ?? "[]");
+            return Array.isArray(parsed) ? parsed : [];
+          } catch {
+            return [];
+          }
+        })();
+        const acceptance = (() => {
+          try {
+            const parsed = JSON.parse(row.acceptanceJson ?? "[]");
+            return Array.isArray(parsed) ? parsed : [];
+          } catch {
+            return [];
+          }
+        })();
+        const task = {
+          id: row.id,
+          title: row.title,
+          description: row.description ?? "",
+          status: row.status,
+          priority: row.priority ?? "medium",
+          type: row.type ?? void 0,
+          kind: row.kind ?? void 0,
+          size: row.size ?? void 0,
+          pipelineStage: row.pipelineStage ?? void 0,
+          blockedBy: row.blockedBy ?? void 0,
+          phase: row.phase ?? void 0,
+          scope: row.scope ?? void 0,
+          labels,
+          acceptance,
+          createdAt: row.createdAt
+        };
+        const readiness = classifyReadiness(task);
+        const routing = classifyTask(task);
+        cliOutput(
+          {
+            taskId: row.id,
+            title: row.title,
+            readiness: {
+              verdict: readiness.verdict,
+              reason: readiness.reason,
+              triggers: readiness.triggers
+            },
+            routing: {
+              agentId: routing.agentId,
+              role: routing.role,
+              confidence: routing.confidence,
+              reason: routing.reason,
+              usedFallback: routing.usedFallback,
+              warning: routing.warning
+            }
+          },
+          { command: "classify", operation: "classify.show" }
+        );
+      }
+    });
+  }
+});
+
 // packages/cleo/src/cli/commands/code.ts
 var code_exports = {};
 __export(code_exports, {
@@ -43939,7 +44205,7 @@ var init_conduit3 = __esm({
 });
 
 // packages/cleo/src/cli/commands/config/drift-check.ts
-import { getProjectRoot as getProjectRoot31 } from "@cleocode/core";
+import { getProjectRoot as getProjectRoot32 } from "@cleocode/core";
 import { checkDrift } from "@cleocode/core/config/registry";
 function parseDriftScope(raw) {
   const value = raw ?? "project";
@@ -43984,7 +44250,7 @@ var init_drift_check = __esm({
         }
         let driftResult;
         try {
-          const projectRoot = getProjectRoot31();
+          const projectRoot = getProjectRoot32();
           driftResult = await checkDrift(scope, projectRoot);
         } catch (err) {
           const message = err instanceof Error ? err.message : String(err);
@@ -44012,7 +44278,7 @@ var init_drift_check = __esm({
 });
 
 // packages/cleo/src/cli/commands/config/get.ts
-import { getProjectRoot as getProjectRoot32 } from "@cleocode/core";
+import { getProjectRoot as getProjectRoot33 } from "@cleocode/core";
 import { getConfigValue } from "@cleocode/core/config/registry";
 function parseResolveScope(raw) {
   const value = raw ?? "merged";
@@ -44070,7 +44336,7 @@ var init_get = __esm({
         }
         let value;
         try {
-          const projectRoot = getProjectRoot32();
+          const projectRoot = getProjectRoot33();
           value = await getConfigValue(key, { scope, projectRoot });
         } catch (err) {
           const message = err instanceof Error ? err.message : String(err);
@@ -44099,7 +44365,7 @@ var init_get = __esm({
 });
 
 // packages/cleo/src/cli/commands/config/set.ts
-import { getProjectRoot as getProjectRoot33, parseConfigValue, setConfigValue } from "@cleocode/core";
+import { getProjectRoot as getProjectRoot34, parseConfigValue, setConfigValue } from "@cleocode/core";
 import { validateConfig as validateConfig2 } from "@cleocode/core/config/registry";
 function parseWriteScope(raw) {
   const value = raw ?? "project";
@@ -44209,7 +44475,7 @@ var init_set = __esm({
         let written;
         let validate;
         try {
-          const projectRoot = getProjectRoot33();
+          const projectRoot = getProjectRoot34();
           written = await setConfigValue(key, coerced, projectRoot, {
             global: scope === "global"
           });
@@ -44241,7 +44507,7 @@ var init_set = __esm({
 });
 
 // packages/cleo/src/cli/commands/config/show.ts
-import { getProjectRoot as getProjectRoot34 } from "@cleocode/core";
+import { getProjectRoot as getProjectRoot35 } from "@cleocode/core";
 import {
   resolveCleoConfig
 } from "@cleocode/core/config/registry";
@@ -44287,7 +44553,7 @@ var init_show = __esm({
           return;
         }
         try {
-          const projectRoot = getProjectRoot34();
+          const projectRoot = getProjectRoot35();
           const config = await resolveCleoConfig({ scope, projectRoot });
           const result = { scope, config };
           cliOutput(result, {
@@ -44307,7 +44573,7 @@ var init_show = __esm({
 });
 
 // packages/cleo/src/cli/commands/config/validate.ts
-import { getProjectRoot as getProjectRoot35 } from "@cleocode/core";
+import { getProjectRoot as getProjectRoot36 } from "@cleocode/core";
 import { validateConfig as validateConfig3 } from "@cleocode/core/config/registry";
 function parseValidateScope(raw) {
   const value = raw ?? "project";
@@ -44352,7 +44618,7 @@ var init_validate2 = __esm({
         }
         let validate;
         try {
-          const projectRoot = getProjectRoot35();
+          const projectRoot = getProjectRoot36();
           validate = await validateConfig3(scope, projectRoot);
         } catch (err) {
           const message = err instanceof Error ? err.message : String(err);
@@ -45169,22 +45435,40 @@ var init_daemon2 = __esm({
         description: "Register the CLEO daemon as a user-level system service (systemd / launchd)"
       },
       args: {
+        saga: {
+          type: "string",
+          description: "Scope the daemon to tasks within a Saga (sets CLEO_SENTIENT_SAGA in service env)",
+          required: false
+        },
+        epic: {
+          type: "string",
+          description: "Scope the daemon to tasks directly under an Epic (sets CLEO_SENTIENT_EPIC in service env)",
+          required: false
+        },
         json: {
           type: "boolean",
           description: "Output result as JSON"
         }
       },
-      async run({ args: _args }) {
+      async run({ args }) {
         try {
           const scriptPath = resolveDaemonInstallerScript();
           const { installDaemonService } = await import(scriptPath);
-          await installDaemonService();
+          const scopeSagaId = typeof args.saga === "string" && args.saga.length > 0 ? args.saga : void 0;
+          const scopeEpicId = typeof args.epic === "string" && args.epic.length > 0 ? args.epic : void 0;
+          await installDaemonService({ scopeSagaId, scopeEpicId });
+          const scopeNote = scopeEpicId !== void 0 ? ` (scoped to epic ${scopeEpicId})` : scopeSagaId !== void 0 ? ` (scoped to saga ${scopeSagaId})` : "";
           cliOutput(
-            { platform: process.platform, message: "Daemon service installation complete." },
+            {
+              platform: process.platform,
+              scopeSagaId,
+              scopeEpicId,
+              message: `Daemon service installation complete${scopeNote}.`
+            },
             {
               command: "daemon",
               operation: "daemon.install",
-              message: "CLEO: Daemon service installation complete."
+              message: `CLEO: Daemon service installation complete${scopeNote}.`
             }
           );
         } catch (err) {
@@ -46875,7 +47159,7 @@ import { dirname as dirname7, join as join19, normalize, resolve as resolve4 } f
 import { fileURLToPath as fileURLToPath4 } from "node:url";
 import {
   createAttachmentStore as createAttachmentStore4,
-  getProjectRoot as getProjectRoot36,
+  getProjectRoot as getProjectRoot37,
   searchAllProjectDocs as searchAllProjectDocs2
 } from "@cleocode/core/internal";
 function getViewerAssetsDir() {
@@ -46935,7 +47219,7 @@ async function serveStatic(res, assetsDir, relPath) {
   }
 }
 function buildViewerHandler(opts = {}) {
-  const projectRoot = opts.projectRoot ?? getProjectRoot36();
+  const projectRoot = opts.projectRoot ?? getProjectRoot37();
   const assetsDir = getViewerAssetsDir();
   const store = createAttachmentStore4();
   return async (req, res) => {
@@ -47108,24 +47392,143 @@ var init_server = __esm({
   }
 });
 
-// packages/cleo/src/cli/commands/docs-viewer.ts
-import { spawn } from "node:child_process";
-import { open as fsOpen } from "node:fs/promises";
+// packages/cleo/src/cli/docs-viewer-subsystem.ts
+import { mkdir as mkdir2 } from "node:fs/promises";
 import { join as join20 } from "node:path";
-import { fileURLToPath as fileURLToPath5 } from "node:url";
-import { getCleoHome as getCleoHome3, getProjectRoot as getProjectRoot37 } from "@cleocode/core";
-function getCleoBinPath() {
-  const thisFile = fileURLToPath5(import.meta.url);
-  return join20(thisFile, "..", "..", "index.js");
+import { getCleoHome as getCleoHome3 } from "@cleocode/core";
+import { defineSubsystem } from "@cleocode/runtime/daemon";
+function getViewerPaths() {
+  const cleoHome = getCleoHome3();
+  return {
+    pidFile: viewerPidFilePath(),
+    logFile: join20(cleoHome, "viewer.log"),
+    logDir: cleoHome
+  };
+}
+function isViewerProcessRunning(pid) {
+  return isProcessAlive(pid);
 }
-async function waitForExit(pid, timeoutMs, intervalMs = 100) {
-  const deadline = Date.now() + timeoutMs;
-  while (Date.now() < deadline) {
-    if (!isProcessAlive(pid)) return true;
-    await new Promise((r) => setTimeout(r, intervalMs));
+async function getViewerStatus() {
+  const record = await readViewerPidFile();
+  if (!record) return { running: false, pid: null, port: null, host: null, url: null };
+  if (!isProcessAlive(record.pid)) {
+    await removeViewerPidFile();
+    return { running: false, pid: null, port: null, host: null, url: null };
   }
-  return !isProcessAlive(pid);
+  return {
+    running: true,
+    pid: record.pid,
+    port: record.port,
+    host: record.host,
+    url: `http://${record.host}:${record.port}`
+  };
 }
+function createDocsViewerSubsystem(opts = {}) {
+  const startPort = opts.startPort ?? VIEWER_DEFAULT_PORT;
+  const endPort = opts.endPort ?? VIEWER_DEFAULT_END_PORT;
+  const host = opts.host ?? VIEWER_DEFAULT_HOST;
+  const autoIncrement = !(opts.noAutoPort ?? false);
+  let live;
+  return defineSubsystem({
+    name: VIEWER_SUBSYSTEM_NAME,
+    async start() {
+      const { pidFile, logDir } = getViewerPaths();
+      const existing = await getViewerStatus();
+      if (existing.running && existing.pid !== null) {
+        const ctx2 = {
+          pid: existing.pid,
+          pidFile,
+          port: existing.port ?? startPort,
+          host: existing.host ?? host
+        };
+        live = ctx2;
+        return ctx2;
+      }
+      await mkdir2(logDir, { recursive: true });
+      const handle = await startViewer({
+        startPort,
+        endPort,
+        host,
+        autoIncrement
+      });
+      await writeViewerPidFile({
+        pid: process.pid,
+        port: handle.port,
+        host: handle.host,
+        projectRoot: process.cwd(),
+        startedAt: Date.now()
+      });
+      const ctx = {
+        pid: process.pid,
+        pidFile,
+        port: handle.port,
+        host: handle.host
+      };
+      live = ctx;
+      return ctx;
+    },
+    healthProbe() {
+      if (live === void 0) {
+        const stopped = "stopped";
+        return {
+          child_id: VIEWER_SUBSYSTEM_NAME,
+          pid: 0,
+          state: stopped,
+          restart_count: 0,
+          detail: "not started"
+        };
+      }
+      const alive = isViewerProcessRunning(live.pid);
+      const state = alive ? "running" : "stopped";
+      return {
+        child_id: VIEWER_SUBSYSTEM_NAME,
+        pid: alive ? live.pid : 0,
+        state,
+        restart_count: 0,
+        detail: alive ? `url=http://${live.host}:${live.port} pid=${live.pid}` : `pid=${live.pid} exited`
+      };
+    },
+    async shutdown(context) {
+      if (!isViewerProcessRunning(context.pid)) {
+        await removeViewerPidFile();
+        live = void 0;
+        return;
+      }
+      try {
+        process.kill(context.pid, "SIGTERM");
+      } catch {
+      }
+      for (let i = 0; i < SIGTERM_GRACE_ITERATIONS; i++) {
+        if (!isViewerProcessRunning(context.pid)) break;
+        await new Promise((resolve11) => setTimeout(resolve11, 500));
+      }
+      if (isViewerProcessRunning(context.pid)) {
+        try {
+          process.kill(context.pid, "SIGKILL");
+        } catch {
+        }
+      }
+      await removeViewerPidFile();
+      live = void 0;
+    }
+  });
+}
+var VIEWER_DEFAULT_PORT, VIEWER_DEFAULT_END_PORT, VIEWER_DEFAULT_HOST, VIEWER_SUBSYSTEM_NAME, SIGTERM_GRACE_ITERATIONS;
+var init_docs_viewer_subsystem = __esm({
+  "packages/cleo/src/cli/docs-viewer-subsystem.ts"() {
+    "use strict";
+    init_pidfile();
+    init_server();
+    VIEWER_DEFAULT_PORT = 7777;
+    VIEWER_DEFAULT_END_PORT = 7800;
+    VIEWER_DEFAULT_HOST = "127.0.0.1";
+    VIEWER_SUBSYSTEM_NAME = "cleo-docs-viewer";
+    SIGTERM_GRACE_ITERATIONS = 20;
+  }
+});
+
+// packages/cleo/src/cli/commands/docs-viewer.ts
+import { spawn } from "node:child_process";
 function openInBrowser(url) {
   try {
     let cmd;
@@ -47144,72 +47547,40 @@ function openInBrowser(url) {
   } catch {
   }
 }
-async function spawnDetachedServer(opts) {
-  const logFile = join20(getCleoHome3(), "viewer.log");
-  const handle = await fsOpen(logFile, "a").catch(() => null);
-  const stdio = handle ? ["ignore", handle.fd, handle.fd] : ["ignore", "ignore", "ignore"];
-  const args = [
-    getCleoBinPath(),
-    "docs",
-    "serve",
-    "--port",
-    String(opts.startPort),
-    "--end-port",
-    String(opts.endPort),
-    "--host",
-    opts.host
-  ];
-  if (opts.noAutoPort) args.push("--no-auto-port");
-  const child = spawn(process.execPath, args, {
-    detached: true,
-    stdio,
-    env: { ...process.env, [DETACHED_CHILD_ENV]: "1" },
-    cwd: getProjectRoot37()
-  });
-  child.unref();
-  if (handle) await handle.close();
-  return child;
-}
-var DETACHED_CHILD_ENV, serveCommand, openCommand, stopCommand4, viewerStatusCommand, runViewerStatus, viewerCommand, docsViewerSubcommands;
+var serveCommand, openCommand, stopCommand4, viewerStatusCommand, runViewerStatus, viewerCommand, docsViewerSubcommands;
 var init_docs_viewer = __esm({
   "packages/cleo/src/cli/commands/docs-viewer.ts"() {
     "use strict";
     init_src2();
     init_dist();
     init_pidfile();
-    init_server();
+    init_docs_viewer_subsystem();
     init_renderers();
-    DETACHED_CHILD_ENV = "CLEO_VIEWER_DETACHED_CHILD";
     serveCommand = defineCommand({
       meta: {
         name: "serve",
-        description: "[legacy] Run docs viewer \u2014 prefer `cleo docs viewer start`"
+        description: "Run docs viewer \u2014 prefer `cleo docs viewer start`"
       },
       args: {
         port: {
           type: "string",
           description: "Starting port (default 7777)",
-          default: "7777"
+          default: String(VIEWER_DEFAULT_PORT)
         },
         "end-port": {
           type: "string",
           description: "Last port to try when auto-incrementing (default 7800)",
-          default: "7800"
+          default: String(VIEWER_DEFAULT_END_PORT)
         },
         host: {
           type: "string",
           description: "Bind host (default 127.0.0.1)",
-          default: "127.0.0.1"
+          default: VIEWER_DEFAULT_HOST
         },
         "no-auto-port": {
           type: "boolean",
           description: "Disable auto-increment when start port is busy",
           default: false
-        },
-        detach: {
-          type: "boolean",
-          description: "Run in background; write pid to viewer.pid; exit immediately",
-          default: false
         }
       },
       async run({ args }) {
@@ -47217,8 +47588,6 @@ var init_docs_viewer = __esm({
         const endPort = Number.parseInt(String(args["end-port"]), 10);
         const host = String(args.host);
         const noAutoPort = Boolean(args["no-auto-port"]);
-        const detach = Boolean(args.detach);
-        const isDetachedChild = process.env[DETACHED_CHILD_ENV] === "1";
         if (!Number.isFinite(startPort) || startPort < 1 || startPort > 65535) {
           cliError(`invalid --port: ${args.port}`, 6 /* VALIDATION_ERROR */, { name: "E_VALIDATION" });
           return;
@@ -47229,79 +47598,25 @@ var init_docs_viewer = __esm({
           });
           return;
         }
-        if (detach && !isDetachedChild) {
-          const existing = await readViewerPidFile();
-          if (existing && isProcessAlive(existing.pid)) {
-            cliOutput(
-              {
-                running: true,
-                pid: existing.pid,
-                port: existing.port,
-                host: existing.host,
-                url: `http://${existing.host}:${existing.port}`,
-                pidFile: viewerPidFilePath()
-              },
-              {
-                command: "docs serve",
-                operation: "docs.serve",
-                message: `viewer already running on http://${existing.host}:${existing.port}`
-              }
-            );
-            return;
-          }
-          const child = await spawnDetachedServer({ startPort, endPort, host, noAutoPort });
-          if (!child.pid) {
-            cliError("failed to spawn detached viewer process", 1 /* GENERAL_ERROR */, {
-              name: "E_SPAWN_FAILED"
-            });
-            return;
-          }
-          let record2 = null;
-          const deadline = Date.now() + 1e4;
-          while (Date.now() < deadline) {
-            await new Promise((r) => setTimeout(r, 150));
-            record2 = await readViewerPidFile();
-            if (record2 && record2.pid === child.pid) break;
-            if (!isProcessAlive(child.pid)) {
-              cliError(
-                "detached viewer exited before binding (check ~/.local/share/cleo/viewer.log)",
-                1 /* GENERAL_ERROR */,
-                { name: "E_VIEWER_EXITED" }
-              );
-              return;
-            }
-          }
-          if (!record2 || record2.pid !== child.pid) {
-            cliError("timed out waiting for detached viewer to bind", 1 /* GENERAL_ERROR */, {
-              name: "E_VIEWER_TIMEOUT"
-            });
-            return;
-          }
+        try {
+          const subsystem = createDocsViewerSubsystem({ startPort, endPort, host, noAutoPort });
+          const ctx = await subsystem.start();
+          const { pidFile } = getViewerPaths();
           cliOutput(
             {
               running: true,
-              pid: record2.pid,
-              port: record2.port,
-              host: record2.host,
-              url: `http://${record2.host}:${record2.port}`,
-              pidFile: viewerPidFilePath()
+              pid: ctx.pid,
+              port: ctx.port,
+              host: ctx.host,
+              url: `http://${ctx.host}:${ctx.port}`,
+              pidFile
             },
             {
               command: "docs serve",
               operation: "docs.serve",
-              message: `viewer started on http://${record2.host}:${record2.port}`
+              message: `viewer started on http://${ctx.host}:${ctx.port}`
             }
           );
-          return;
-        }
-        let handle;
-        try {
-          handle = await startViewer({
-            startPort,
-            endPort,
-            host,
-            autoIncrement: !noAutoPort
-          });
         } catch (err) {
           const e = err;
           if (e.code === "E_NO_PORT" || e.code === "EADDRINUSE") {
@@ -47312,49 +47627,12 @@ var init_docs_viewer = __esm({
           }
           throw err;
         }
-        const record = {
-          pid: process.pid,
-          port: handle.port,
-          host: handle.host,
-          projectRoot: getProjectRoot37(),
-          startedAt: Date.now()
-        };
-        await writeViewerPidFile(record);
-        const url = `http://${handle.host}:${handle.port}`;
-        if (isDetachedChild) {
-        } else {
-          humanInfo(`viewer listening on ${url} (Ctrl+C to stop)`);
-          cliOutput(
-            {
-              running: true,
-              pid: record.pid,
-              port: record.port,
-              host: record.host,
-              url,
-              pidFile: viewerPidFilePath()
-            },
-            {
-              command: "docs serve",
-              operation: "docs.serve",
-              message: `viewer running on ${url}`
-            }
-          );
-        }
-        const shutdown = async (signal) => {
-          handle.server.close();
-          await removeViewerPidFile();
-          process.exit(signal === "SIGINT" ? 130 : 143);
-        };
-        process.on("SIGINT", () => void shutdown("SIGINT"));
-        process.on("SIGTERM", () => void shutdown("SIGTERM"));
-        await new Promise((res) => handle.server.on("close", res));
-        await removeViewerPidFile();
       }
     });
     openCommand = defineCommand({
       meta: {
         name: "open",
-        description: "[legacy] Open docs viewer in browser \u2014 prefer `cleo docs viewer open`"
+        description: "Open docs viewer in browser \u2014 prefer `cleo docs viewer open`"
       },
       args: {
         slug: {
@@ -47365,17 +47643,17 @@ var init_docs_viewer = __esm({
         port: {
           type: "string",
           description: "Starting port for the viewer (default 7777)",
-          default: "7777"
+          default: String(VIEWER_DEFAULT_PORT)
         },
         "end-port": {
           type: "string",
           description: "Last port to try (default 7800)",
-          default: "7800"
+          default: String(VIEWER_DEFAULT_END_PORT)
         },
         host: {
           type: "string",
           description: "Bind host (default 127.0.0.1)",
-          default: "127.0.0.1"
+          default: VIEWER_DEFAULT_HOST
         },
         "no-launch": {
           type: "boolean",
@@ -47385,49 +47663,30 @@ var init_docs_viewer = __esm({
       },
       async run({ args }) {
         const slug = args.slug ? String(args.slug) : void 0;
-        let record = await readViewerPidFile();
-        if (record && !isProcessAlive(record.pid)) {
-          await removeViewerPidFile();
-          record = null;
-        }
-        if (!record) {
+        let status = await getViewerStatus();
+        if (!status.running) {
           const startPort = Number.parseInt(String(args.port), 10);
           const endPort = Number.parseInt(String(args["end-port"]), 10);
           const host = String(args.host);
-          const child = await spawnDetachedServer({
-            startPort,
-            endPort,
-            host,
-            noAutoPort: false
-          });
-          if (!child.pid) {
-            cliError("failed to spawn detached viewer process", 1 /* GENERAL_ERROR */, {
-              name: "E_SPAWN_FAILED"
-            });
-            return;
-          }
-          const deadline = Date.now() + 1e4;
-          while (Date.now() < deadline) {
-            await new Promise((r) => setTimeout(r, 150));
-            record = await readViewerPidFile();
-            if (record && record.pid === child.pid) break;
-            if (!isProcessAlive(child.pid)) {
-              cliError(
-                "detached viewer exited before binding (check ~/.local/share/cleo/viewer.log)",
-                1 /* GENERAL_ERROR */,
-                { name: "E_VIEWER_EXITED" }
-              );
-              return;
-            }
-          }
-          if (!record) {
-            cliError("timed out waiting for viewer to bind", 1 /* GENERAL_ERROR */, {
-              name: "E_VIEWER_TIMEOUT"
+          try {
+            const subsystem = createDocsViewerSubsystem({ startPort, endPort, host });
+            await subsystem.start();
+            status = await getViewerStatus();
+          } catch (err) {
+            const e = err;
+            cliError(e.message ?? "failed to start docs viewer", 1 /* GENERAL_ERROR */, {
+              name: "E_VIEWER_START_FAILED"
             });
             return;
           }
         }
-        const url = slug ? `http://${record.host}:${record.port}/docs/${encodeURIComponent(slug)}` : `http://${record.host}:${record.port}/`;
+        if (!status.running || status.pid === null || status.port === null || status.host === null) {
+          cliError("timed out waiting for viewer to bind", 1 /* GENERAL_ERROR */, {
+            name: "E_VIEWER_TIMEOUT"
+          });
+          return;
+        }
+        const url = slug ? `http://${status.host}:${status.port}/docs/${encodeURIComponent(slug)}` : `http://${status.host}:${status.port}/`;
         if (!args["no-launch"]) {
           openInBrowser(url);
         }
@@ -47435,9 +47694,9 @@ var init_docs_viewer = __esm({
           {
             opened: true,
             slug: slug ?? null,
-            pid: record.pid,
-            port: record.port,
-            host: record.host,
+            pid: status.pid,
+            port: status.port,
+            host: status.host,
             url
           },
           {
@@ -47451,7 +47710,7 @@ var init_docs_viewer = __esm({
     stopCommand4 = defineCommand({
       meta: {
         name: "stop",
-        description: "[legacy] Stop the docs viewer \u2014 prefer `cleo docs viewer stop`"
+        description: "Stop the docs viewer \u2014 prefer `cleo docs viewer stop`"
       },
       args: {
         timeout: {
@@ -47485,38 +47744,29 @@ var init_docs_viewer = __esm({
           );
           return;
         }
-        try {
-          process.kill(record.pid, "SIGTERM");
-        } catch (err) {
-          const e = err;
-          if (e.code !== "ESRCH") {
-            cliError(
-              `failed to signal viewer pid ${record.pid}: ${e.message ?? e.code}`,
-              1 /* GENERAL_ERROR */,
-              { name: "E_SIGNAL_FAILED" }
-            );
-            return;
-          }
-        }
+        const { pidFile } = getViewerPaths();
+        const subsystem = createDocsViewerSubsystem({
+          startPort: record.port,
+          host: record.host
+        });
+        await subsystem.shutdown({
+          pid: record.pid,
+          pidFile,
+          port: record.port,
+          host: record.host
+        });
         const timeoutSec = Math.max(1, Number.parseInt(String(args.timeout), 10) || 10);
-        const exited = await waitForExit(record.pid, timeoutSec * 1e3);
-        if (!exited) {
-          try {
-            process.kill(record.pid, "SIGKILL");
-          } catch {
-          }
-        }
-        await removeViewerPidFile();
         cliOutput(
           {
             stopped: true,
             pid: record.pid,
-            graceful: exited
+            graceful: true,
+            timeoutSec
           },
           {
             command: "docs stop",
             operation: "docs.stop",
-            message: exited ? `viewer (pid ${record.pid}) stopped gracefully` : `viewer (pid ${record.pid}) force-killed after ${timeoutSec}s`
+            message: `viewer (pid ${record.pid}) stopped`
           }
         );
       }
@@ -47524,15 +47774,15 @@ var init_docs_viewer = __esm({
     viewerStatusCommand = defineCommand({
       meta: {
         name: "viewer-status",
-        description: "[legacy] Report viewer state \u2014 prefer `cleo docs viewer status`"
+        description: "Report viewer state \u2014 prefer `cleo docs viewer status`"
       },
       async run() {
         await runViewerStatus();
       }
     });
     runViewerStatus = async () => {
-      const record = await readViewerPidFile();
-      if (!record) {
+      const status = await getViewerStatus();
+      if (!status.running || status.pid === null) {
         cliOutput(
           { running: false, pidFile: viewerPidFilePath() },
           {
@@ -47543,40 +47793,19 @@ var init_docs_viewer = __esm({
         );
         return;
       }
-      const alive = isProcessAlive(record.pid);
-      if (!alive) {
-        await removeViewerPidFile();
-        cliOutput(
-          {
-            running: false,
-            reason: "stale pidfile",
-            pid: record.pid,
-            pidFile: viewerPidFilePath()
-          },
-          {
-            command: "docs viewer-status",
-            operation: "docs.viewer-status",
-            message: `stale pidfile removed (pid ${record.pid} not alive)`
-          }
-        );
-        return;
-      }
       cliOutput(
         {
           running: true,
-          pid: record.pid,
-          port: record.port,
-          host: record.host,
-          projectRoot: record.projectRoot,
-          startedAt: record.startedAt,
-          uptimeMs: Date.now() - record.startedAt,
-          url: `http://${record.host}:${record.port}`,
+          pid: status.pid,
+          port: status.port,
+          host: status.host,
+          url: status.url,
           pidFile: viewerPidFilePath()
         },
         {
           command: "docs viewer-status",
           operation: "docs.viewer-status",
-          message: `viewer running (pid ${record.pid})`
+          message: `viewer running (pid ${status.pid})`
         }
       );
     };
@@ -47613,7 +47842,7 @@ __export(docs_exports, {
   _llmOutputCommand: () => _llmOutputCommand,
   docsCommand: () => docsCommand
 });
-import { appendFile, mkdir as mkdir2, readdir, readFile as readFile4, writeFile as writeFile2 } from "node:fs/promises";
+import { appendFile, mkdir as mkdir3, readdir, readFile as readFile4, writeFile as writeFile2 } from "node:fs/promises";
 import { dirname as dirname8, isAbsolute as isAbsolute2, join as join21, resolve as resolve5 } from "node:path";
 import { pushWarning as pushWarning3 } from "@cleocode/core";
 import {
@@ -47955,7 +48184,7 @@ var init_docs3 = __esm({
                 })}
 `;
                 try {
-                  await mkdir2(join21(projectRoot, ".cleo", "audit"), { recursive: true });
+                  await mkdir3(join21(projectRoot, ".cleo", "audit"), { recursive: true });
                   await appendFile(
                     join21(projectRoot, ".cleo", "audit", "similar-bypass.jsonl"),
                     auditLine,
@@ -48287,7 +48516,7 @@ var init_docs3 = __esm({
           let writtenPath;
           if (typeof args.out === "string" && args.out.length > 0) {
             const outPath = isAbsolute2(args.out) ? args.out : resolve5(projectRoot, args.out);
-            await mkdir2(dirname8(outPath), { recursive: true });
+            await mkdir3(dirname8(outPath), { recursive: true });
             await writeFile2(outPath, result.content, "utf8");
             writtenPath = outPath;
           }
@@ -48359,7 +48588,7 @@ var init_docs3 = __esm({
           let writtenPath;
           if (typeof args.out === "string" && args.out.length > 0) {
             const outPath = isAbsolute2(args.out) ? args.out : resolve5(projectRoot, args.out);
-            await mkdir2(dirname8(outPath), { recursive: true });
+            await mkdir3(dirname8(outPath), { recursive: true });
             await writeFile2(outPath, result.content, "utf8");
             writtenPath = outPath;
           }
@@ -48436,7 +48665,7 @@ var init_docs3 = __esm({
           let writtenPath;
           if (typeof args.out === "string" && args.out.length > 0) {
             const outPath = isAbsolute2(args.out) ? args.out : resolve5(projectRoot, args.out);
-            await mkdir2(dirname8(outPath), { recursive: true });
+            await mkdir3(dirname8(outPath), { recursive: true });
             await writeFile2(outPath, result.content, "utf8");
             writtenPath = outPath;
           }
@@ -48662,7 +48891,7 @@ var init_docs3 = __esm({
           });
           if (typeof args.out === "string" && args.out.length > 0) {
             const outPath = isAbsolute2(args.out) ? args.out : resolve5(projectRoot, args.out);
-            await mkdir2(dirname8(outPath), { recursive: true });
+            await mkdir3(dirname8(outPath), { recursive: true });
             await writeFile2(outPath, result.merged, "utf8");
             humanInfo(`Wrote merged content to ${outPath}`);
           }
@@ -49434,7 +49663,7 @@ var init_docs3 = __esm({
           })}
 `;
           try {
-            await mkdir2(join21(projectRoot, ".cleo", "audit"), { recursive: true });
+            await mkdir3(join21(projectRoot, ".cleo", "audit"), { recursive: true });
             await appendFile(
               join21(projectRoot, ".cleo", "audit", "import-force-bypass.jsonl"),
               auditLine,
@@ -50899,9 +51128,18 @@ var init_doctor = __esm({
           type: "boolean",
           description: "Migrate <root>/.cleo/worktree-include (legacy) \u2192 <root>/.worktreeinclude (canonical, T9983). Combine with --dry-run to preview."
         },
+        /**
+         * T11489 — DHQ-037/019: detect and auto-heal a leaked `core.worktree` key
+         * in the shared `.git/config`. Reports E_WT_CONFIG_LEAK when found; heals
+         * automatically unless `--dry-run` is passed.
+         */
+        "check-worktree-config": {
+          type: "boolean",
+          description: "Detect and auto-heal a leaked core.worktree key in .git/config (T11489 / DHQ-037). Combine with --dry-run to report without healing."
+        },
         "dry-run": {
           type: "boolean",
-          description: "With --quarantine-rogue-cleo-dirs or --scan-stray-nexus-dbs: print what would be done without acting"
+          description: "With --quarantine-rogue-cleo-dirs, --scan-stray-nexus-dbs, or --check-worktree-config: print what would be done without acting"
         },
         /**
          * Show brain.db health dashboard (T1908 / BBTT-W2-4).
@@ -50951,6 +51189,61 @@ var init_doctor = __esm({
         const progress = createDoctorProgress(isHuman);
         progress.start();
         try {
+          if (args["check-worktree-config"]) {
+            const { execFileSync: execFile2 } = await import("node:child_process");
+            const { join: pathJoin } = await import("node:path");
+            const { existsSync: existsSync21 } = await import("node:fs");
+            const { detectAndHealCoreWorktreeLeak } = await import("@cleocode/worktree");
+            const projectRoot = getProjectRoot42();
+            let gitRoot = projectRoot;
+            try {
+              gitRoot = execFile2("git", ["rev-parse", "--show-toplevel"], {
+                cwd: projectRoot,
+                encoding: "utf-8",
+                stdio: ["pipe", "pipe", "pipe"]
+              }).trim();
+            } catch {
+            }
+            const isDryRun = args["dry-run"] === true;
+            progress.step(0, "Checking for leaked core.worktree in .git/config");
+            if (isDryRun) {
+              const gitConfigPath = pathJoin(gitRoot, ".git", "config");
+              let leakedValue;
+              if (existsSync21(gitConfigPath)) {
+                try {
+                  leakedValue = execFile2("git", ["config", "--file", gitConfigPath, "--get", "core.worktree"], {
+                    encoding: "utf-8",
+                    stdio: ["pipe", "pipe", "pipe"]
+                  }).trim() || void 0;
+                } catch {
+                }
+              }
+              const report = {
+                gitRoot,
+                gitConfigPath,
+                leakDetected: !!leakedValue,
+                leakedValue,
+                healed: false,
+                dryRun: true,
+                message: leakedValue ? `DRY-RUN: core.worktree="${leakedValue}" found \u2014 would unset` : "No core.worktree leak detected"
+              };
+              progress.complete(report.message);
+              cliOutput(report, { command: "doctor", operation: "doctor.check-worktree-config" });
+              if (leakedValue) process.exitCode = 2;
+            } else {
+              const result = detectAndHealCoreWorktreeLeak(gitRoot);
+              const report = {
+                gitRoot,
+                ...result,
+                dryRun: false,
+                message: result.leakDetected ? result.healed ? `E_WT_CONFIG_LEAK healed: removed core.worktree="${result.leakedValue}"` : `E_WT_CONFIG_LEAK detected but heal FAILED: ${result.healError}` : "No core.worktree leak detected"
+              };
+              progress.complete(report.message);
+              cliOutput(report, { command: "doctor", operation: "doctor.check-worktree-config" });
+              if (result.leakDetected && !result.healed) process.exitCode = 1;
+            }
+            return;
+          }
           if (args.brain) {
             const { computeBrainHealthDashboard } = await import("@cleocode/core/memory/brain-health-dashboard.js");
             const projectRoot = getProjectRoot42();
@@ -52522,12 +52815,54 @@ var init_gc = __esm({
   }
 });
 
+// packages/cleo/src/cli/commands/go.ts
+var go_exports = {};
+__export(go_exports, {
+  goCommand: () => goCommand
+});
+import { getProjectRoot as getProjectRoot43, go } from "@cleocode/core";
+var goCommand;
+var init_go = __esm({
+  "packages/cleo/src/cli/commands/go.ts"() {
+    "use strict";
+    init_define_cli_command();
+    init_renderers();
+    goCommand = defineCommand({
+      meta: {
+        name: "go",
+        description: "SG-AUTOPILOT: run one turn of briefing\u2192sagaNext\u2192ready\u2192stage-branch\u2192ivtr loop"
+      },
+      args: {
+        saga: {
+          type: "string",
+          description: "Optional saga task ID to scope the autopilot run (default: auto-select)",
+          required: false
+        },
+        headless: {
+          type: "boolean",
+          description: "Suppress interactive annotations; suitable for daemon / unattended use",
+          required: false
+        }
+      },
+      async run({ args }) {
+        const projectRoot = getProjectRoot43();
+        const result = await go.cleoGo({
+          sagaId: typeof args.saga === "string" && args.saga.length > 0 ? args.saga : void 0,
+          headless: args.headless === true,
+          projectRoot
+        });
+        cliOutput(result.success ? result.data : result, { command: "go", operation: "go.run" });
+      }
+    });
+  }
+});
+
 // packages/cleo/src/cli/commands/goal.ts
 var goal_exports = {};
 __export(goal_exports, {
   goalCommand: () => goalCommand
 });
-import { getProjectRoot as getProjectRoot43, goal } from "@cleocode/core";
+import { getProjectRoot as getProjectRoot44, goal } from "@cleocode/core";
 function resolveGoalKind(task) {
   if (typeof task === "string" && task.length > 0) {
     if (!isValidGoalTargetTaskId(task)) {
@@ -52541,7 +52876,7 @@ function resolveTurnBudget(turns) {
   const n = typeof turns === "string" ? Number.parseInt(turns, 10) : Number(turns);
   return Number.isInteger(n) && n > 0 ? n : DEFAULT_TURN_BUDGET;
 }
-var DEFAULT_TURN_BUDGET, setCommand, statusCommand9, subgoalCommand, appendCommand, goalCommand;
+var DEFAULT_TURN_BUDGET, setCommand, statusCommand9, subgoalCommand, advanceCommand2, appendCommand, goalCommand;
 var init_goal2 = __esm({
   "packages/cleo/src/cli/commands/goal.ts"() {
     "use strict";
@@ -52574,7 +52909,7 @@ var init_goal2 = __esm({
         }
         const record = await goal.createGoal(
           { goalKind: kindResult.kind, intent, turnBudget: resolveTurnBudget(args.turns) },
-          getProjectRoot43()
+          getProjectRoot44()
         );
         cliOutput(record, { command: "goal set", operation: "goal.set" });
       }
@@ -52585,7 +52920,7 @@ var init_goal2 = __esm({
         description: "Show the current agent's active goal (per-agent scoped)."
       },
       async run() {
-        const record = await goal.getActiveGoal(getProjectRoot43());
+        const record = await goal.getActiveGoal(getProjectRoot44());
         cliOutput(record ?? { active: null }, { command: "goal status", operation: "goal.status" });
       }
     });
@@ -52607,7 +52942,7 @@ var init_goal2 = __esm({
           });
           return;
         }
-        const cwd = getProjectRoot43();
+        const cwd = getProjectRoot44();
         const parent = await goal.getActiveGoal(cwd);
         if (!parent) {
           cliError(
@@ -52636,6 +52971,34 @@ var init_goal2 = __esm({
         cliOutput(record, { command: "goal subgoal", operation: "goal.subgoal" });
       }
     });
+    advanceCommand2 = defineCommand({
+      meta: {
+        name: "advance",
+        description: "Advance a goal one turn (load \u2192 judge \u2192 persist \u2192 continuation). Entry point for the Stop-hook loop."
+      },
+      args: {
+        goalId: {
+          type: "positional",
+          description: "The goal id (idempotency key) to advance"
+        }
+      },
+      async run({ args }) {
+        const goalId = String(args.goalId ?? "").trim();
+        if (goalId.length === 0) {
+          cliError("goal advance requires a <goalId>", 6 /* VALIDATION_ERROR */, {
+            name: "E_VALIDATION"
+          });
+          return;
+        }
+        const cwd = getProjectRoot44();
+        const result = await goal.advanceGoalWithPersist(goalId, { cwd });
+        if (!result) {
+          cliError(`Goal '${goalId}' not found.`, 4 /* NOT_FOUND */, { name: "E_NOT_FOUND" });
+          return;
+        }
+        cliOutput(result, { command: "goal advance", operation: "goal.advance" });
+      }
+    });
     appendCommand = defineCommand({
       meta: {
         name: "append",
@@ -52652,7 +53015,7 @@ var init_goal2 = __esm({
           });
           return;
         }
-        const cwd = getProjectRoot43();
+        const cwd = getProjectRoot44();
         const active = await goal.getActiveGoal(cwd);
         if (!active) {
           cliError(
@@ -52671,11 +53034,12 @@ var init_goal2 = __esm({
     goalCommand = defineCommand({
       meta: {
         name: "goal",
-        description: "DB-persisted, per-agent, evidence-gate-aware goal loop (set/status/subgoal/append)."
+        description: "DB-persisted, per-agent, evidence-gate-aware goal loop (set/status/advance/subgoal/append)."
       },
       subCommands: {
         set: setCommand,
         status: statusCommand9,
+        advance: advanceCommand2,
         subgoal: subgoalCommand,
         append: appendCommand
       },
@@ -53640,7 +54004,7 @@ var hygiene_exports = {};
 __export(hygiene_exports, {
   hygieneCommand: () => hygieneCommand
 });
-import { getProjectRoot as getProjectRoot44 } from "@cleocode/core";
+import { getProjectRoot as getProjectRoot45 } from "@cleocode/core";
 import { runSpawnReadinessHygieneCli } from "@cleocode/core/hygiene/validate-spawn-readiness.js";
 var hygieneCommand;
 var init_hygiene = __esm({
@@ -53669,7 +54033,7 @@ var init_hygiene = __esm({
             }
           },
           async run({ args }) {
-            const projectRoot = args["project-root"] || getProjectRoot44() || process.cwd();
+            const projectRoot = args["project-root"] || getProjectRoot45() || process.cwd();
             const worktreePath = args["worktree-path"];
             await runSpawnReadinessHygieneCli(projectRoot, worktreePath);
           }
@@ -53842,7 +54206,7 @@ __export(init_exports, {
 });
 import { existsSync as existsSync15, readFileSync as readFileSync14 } from "node:fs";
 import { join as join27 } from "node:path";
-import { fileURLToPath as fileURLToPath6 } from "node:url";
+import { fileURLToPath as fileURLToPath5 } from "node:url";
 import {
   CleoError as CleoError5,
   getWorkflowTemplatesDir as getCoreWorkflowTemplatesDir,
@@ -53853,7 +54217,7 @@ import {
 import { getTemplatesByKind } from "@cleocode/core/templates/registry";
 function getGitignoreTemplate() {
   try {
-    const thisFile = fileURLToPath6(import.meta.url);
+    const thisFile = fileURLToPath5(import.meta.url);
     const packageRoot = join27(thisFile, "..", "..", "..", "..");
     const localTemplatePath = join27(packageRoot, "templates", "cleo-gitignore");
     const monorepoTemplatePath = join27(packageRoot, "..", "..", "templates", "cleo-gitignore");
@@ -54831,7 +55195,7 @@ var llm_cost_exports = {};
 __export(llm_cost_exports, {
   costCommand: () => costCommand
 });
-import { getProjectRoot as getProjectRoot45 } from "@cleocode/core/internal";
+import { getProjectRoot as getProjectRoot46 } from "@cleocode/core/internal";
 import { computeCost } from "@cleocode/core/llm/usage-pricing";
 function resolveSessionId(raw) {
   if (raw === "current") {
@@ -54904,7 +55268,7 @@ var init_llm_cost = __esm({
           process.exit(6);
         }
         const sessionId = resolveSessionId(rawSessionId);
-        const projectRoot = getProjectRoot45(process.cwd());
+        const projectRoot = getProjectRoot46(process.cwd());
         let breakdown;
         try {
           breakdown = await loadSessionCostBreakdown(projectRoot, sessionId);
@@ -56451,7 +56815,7 @@ var memory_exports = {};
 __export(memory_exports, {
   memoryCommand: () => memoryCommand
 });
-import { getProjectRoot as getProjectRoot46 } from "@cleocode/core";
+import { getProjectRoot as getProjectRoot47 } from "@cleocode/core";
 import {
   getBrainDb as getBrainDb2,
   getDreamStatus,
@@ -57384,7 +57748,7 @@ var init_memory3 = __esm({
       },
       args: {},
       async run() {
-        const root = getProjectRoot46();
+        const root = getProjectRoot47();
         try {
           const result = await runConsolidation(root);
           cliOutput(result, { command: "memory-consolidate", operation: "memory.consolidate" });
@@ -57408,7 +57772,7 @@ var init_memory3 = __esm({
         }
       },
       async run({ args }) {
-        const root = getProjectRoot46();
+        const root = getProjectRoot47();
         if (args.status) {
           try {
             const status = await getDreamStatus(root);
@@ -57445,7 +57809,7 @@ var init_memory3 = __esm({
         }
       },
       async run({ args }) {
-        const root = getProjectRoot46();
+        const root = getProjectRoot47();
         try {
           const { runObserver, runReflector } = await import("@cleocode/core/memory");
           const observerResult = await runObserver(root, args.session, {
@@ -57485,7 +57849,7 @@ var init_memory3 = __esm({
         }
       },
       async run({ args }) {
-        const root = getProjectRoot46();
+        const root = getProjectRoot47();
         try {
           await getBrainDb2(root);
           const { totalDuplicateRows, groups } = await scanDuplicateEntries();
@@ -57531,7 +57895,7 @@ var init_memory3 = __esm({
       async run({ args }) {
         const sourceDir = args.from;
         const isDryRun = !!args["dry-run"];
-        const projectRoot = getProjectRoot46();
+        const projectRoot = getProjectRoot47();
         try {
           const result = await importMemoryFiles({
             sourceDir,
@@ -57682,7 +58046,7 @@ var init_memory3 = __esm({
       },
       args: {},
       async run() {
-        const root = getProjectRoot46();
+        const root = getProjectRoot47();
         try {
           await getBrainDb2(root);
           const result = await getTierStats(root);
@@ -57725,7 +58089,7 @@ var init_memory3 = __esm({
         }
       },
       async run({ args }) {
-        const root = getProjectRoot46();
+        const root = getProjectRoot47();
         const targetTier = args.to;
         const reason = args.reason;
         const validTiers = ["medium", "long"];
@@ -57791,7 +58155,7 @@ var init_memory3 = __esm({
         }
       },
       async run({ args }) {
-        const root = getProjectRoot46();
+        const root = getProjectRoot47();
         const targetTier = args.to;
         const reason = args.reason;
         const validTiers = ["short", "medium"];
@@ -58254,7 +58618,7 @@ var migrate_claude_mem_exports = {};
 __export(migrate_claude_mem_exports, {
   migrateClaudeMemCommand: () => migrateClaudeMemCommand
 });
-import { getProjectRoot as getProjectRoot47, migrateClaudeMem } from "@cleocode/core/internal";
+import { getProjectRoot as getProjectRoot48, migrateClaudeMem } from "@cleocode/core/internal";
 import { ingestLooseAgentOutputs, ingestRcasdDirectories } from "@cleocode/core/memory";
 import { getDb as getDb2 } from "@cleocode/core/store/sqlite";
 var storageCommand, claudeMemCommand, manifestIngestCommand, migrateClaudeMemCommand;
@@ -58317,7 +58681,7 @@ var init_migrate_claude_mem = __esm({
         }
       },
       async run({ args }) {
-        const root = getProjectRoot47();
+        const root = getProjectRoot48();
         try {
           const result = await migrateClaudeMem(root, {
             sourcePath: args.source,
@@ -58366,7 +58730,7 @@ var init_migrate_claude_mem = __esm({
         }
       },
       async run({ args }) {
-        const projectRoot = getProjectRoot47();
+        const projectRoot = getProjectRoot48();
         try {
           const db = await getDb2(projectRoot);
           const rcasdFlag = Boolean(args.rcasd);
@@ -58481,10 +58845,10 @@ var nexus_exports = {};
 __export(nexus_exports, {
   nexusCommand: () => nexusCommand
 });
-import { appendFile as appendFile2, mkdir as mkdir3 } from "node:fs/promises";
+import { appendFile as appendFile2, mkdir as mkdir4 } from "node:fs/promises";
 import { homedir as homedir5 } from "node:os";
 import path4 from "node:path";
-import { getProjectRoot as getProjectRoot48 } from "@cleocode/core";
+import { getProjectRoot as getProjectRoot49 } from "@cleocode/core";
 import { getSymbolImpact } from "@cleocode/core/nexus";
 import { runNexusAnalysis } from "@cleocode/core/nexus/analyze-orchestrator.js";
 import { exportNexusGraph } from "@cleocode/core/nexus/export.js";
@@ -58493,7 +58857,7 @@ async function appendDeprecationTelemetry(op, replacement) {
   try {
     const dateStr = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
     const dir = path4.join(homedir5(), ".local", "state", "cleo", "nexus-deprecation");
-    await mkdir3(dir, { recursive: true });
+    await mkdir4(dir, { recursive: true });
     const record = JSON.stringify({ ts: (/* @__PURE__ */ new Date()).toISOString(), op, replacement }) + "\n";
     await appendFile2(path4.join(dir, `${dateStr}.jsonl`), record, "utf8");
   } catch {
@@ -58599,7 +58963,7 @@ var init_nexus3 = __esm({
       async run({ args }) {
         applyJsonFlag2(args.json);
         const projectIdOverride = args["project-id"];
-        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot48();
+        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot49();
         const startTime = Date.now();
         try {
           const [{ getNexusDb, nexusSchema }, { getIndexStats }] = await Promise.all([
@@ -59114,7 +59478,7 @@ var init_nexus3 = __esm({
         applyJsonFlag2(args.json);
         const startTime = Date.now();
         const projectIdOverride = args["project-id"];
-        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot48();
+        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot49();
         const projectId = projectIdOverride ?? Buffer.from(repoPath).toString("base64url").slice(0, 32);
         const response = await dispatchRaw("query", "nexus", "clusters", { projectId, repoPath });
         const durationMs = Date.now() - startTime;
@@ -59158,7 +59522,7 @@ var init_nexus3 = __esm({
         applyJsonFlag2(args.json);
         const startTime = Date.now();
         const projectIdOverride = args["project-id"];
-        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot48();
+        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot49();
         const projectId = projectIdOverride ?? Buffer.from(repoPath).toString("base64url").slice(0, 32);
         const response = await dispatchRaw("query", "nexus", "flows", { projectId, repoPath });
         const durationMs = Date.now() - startTime;
@@ -59201,7 +59565,7 @@ var init_nexus3 = __esm({
         void appendDeprecationTelemetry("nexus.context", "cleo graph context");
         const startTime = Date.now();
         const projectIdOverride = args["project-id"];
-        const repoPath = getProjectRoot48();
+        const repoPath = getProjectRoot49();
         const projectId = projectIdOverride ?? Buffer.from(repoPath).toString("base64url").slice(0, 32);
         const limit = parseInt(args.limit, 10);
         const symbolName = args.symbol;
@@ -59264,7 +59628,7 @@ var init_nexus3 = __esm({
         const startTime = Date.now();
         const whyFlag = !!args.why;
         const projectIdOverride = args["project-id"];
-        const repoPath = getProjectRoot48();
+        const repoPath = getProjectRoot49();
         const projectId = projectIdOverride ?? Buffer.from(repoPath).toString("base64url").slice(0, 32);
         const maxDepth = Math.min(parseInt(args.depth, 10), 5);
         const symbolName = args.symbol;
@@ -59336,7 +59700,7 @@ var init_nexus3 = __esm({
         const projectIdOverride = args["project-id"];
         const isIncremental = !!args.incremental;
         const ctx = getFormatContext();
-        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot48();
+        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot49();
         humanInfo(`[nexus] Analyzing: ${repoPath}${isIncremental ? " (incremental)" : ""}`);
         if (!isIncremental) humanInfo("[nexus] Clearing existing index for project...");
         try {
@@ -59439,7 +59803,7 @@ var init_nexus3 = __esm({
       async run({ args }) {
         applyJsonFlag2(args.json);
         const startTime = Date.now();
-        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot48();
+        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot49();
         const name = args.name;
         const response = await dispatchRaw("mutate", "nexus", "projects.register", {
           path: repoPath,
@@ -59797,7 +60161,7 @@ var init_nexus3 = __esm({
         applyJsonFlag2(args.json);
         const startTime = Date.now();
         const projectIdOverride = args["project-id"];
-        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot48();
+        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot49();
         const projectId = projectIdOverride ?? Buffer.from(repoPath).toString("base64url").slice(0, 32);
         const response = await dispatchRaw("mutate", "nexus", "refresh-bridge", {
           repoPath,
@@ -59903,7 +60267,7 @@ var init_nexus3 = __esm({
       async run({ args }) {
         applyJsonFlag2(args.json);
         const startTime = Date.now();
-        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot48();
+        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot49();
         const projectIdOverride = args["project-id"];
         const beforeRef = args.before ?? "HEAD~1";
         const afterRef = args.after ?? "HEAD";
@@ -60021,7 +60385,7 @@ var init_nexus3 = __esm({
         applyJsonFlag2(args.json);
         const startTime = Date.now();
         const projectIdOverride = args["project-id"];
-        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot48();
+        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot49();
         const projectId = projectIdOverride ?? Buffer.from(repoPath).toString("base64url").slice(0, 32);
         const response = await dispatchRaw("query", "nexus", "route-map", { projectId });
         const durationMs = Date.now() - startTime;
@@ -60077,7 +60441,7 @@ var init_nexus3 = __esm({
         const startTime = Date.now();
         const routeSymbol = args.routeSymbol;
         const projectIdOverride = args["project-id"];
-        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot48();
+        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot49();
         const projectId = projectIdOverride ?? Buffer.from(repoPath).toString("base64url").slice(0, 32);
         const response = await dispatchRaw("query", "nexus", "shape-check", { routeSymbol, projectId });
         const durationMs = Date.now() - startTime;
@@ -60467,7 +60831,7 @@ var init_nexus3 = __esm({
       async run({ args }) {
         applyJsonFlag2(args.json);
         const startTime = Date.now();
-        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot48();
+        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot49();
         const projectIdOverride = args["project-id"];
         const projectId = projectIdOverride ?? Buffer.from(repoPath).toString("base64url").slice(0, 32);
         const response = await dispatchRaw("mutate", "nexus", "contracts-sync", {
@@ -60571,7 +60935,7 @@ var init_nexus3 = __esm({
       async run({ args }) {
         applyJsonFlag2(args.json);
         const startTime = Date.now();
-        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot48();
+        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot49();
         const projectId = Buffer.from(repoPath).toString("base64url").slice(0, 32);
         const response = await dispatchRaw("mutate", "nexus", "contracts-link-tasks", {
           projectId,
@@ -60652,7 +61016,7 @@ var init_nexus3 = __esm({
         const isIncremental = !!args.incremental;
         try {
           const result = await runNexusWiki({
-            projectRoot: getProjectRoot48(),
+            projectRoot: getProjectRoot49(),
             outputDir,
             communityFilter,
             incremental: isIncremental
@@ -61002,7 +61366,7 @@ __export(orchestrate_exports, {
 });
 import { execFileSync as execFileSync3 } from "node:child_process";
 import { orchestration } from "@cleocode/core";
-import { BUILD_CONFIG as BUILD_CONFIG2, getProjectRoot as getProjectRoot49 } from "@cleocode/core/internal";
+import { BUILD_CONFIG as BUILD_CONFIG2, getProjectRoot as getProjectRoot50 } from "@cleocode/core/internal";
 function formatRollupTable(rollup) {
   const waves = "waves" in rollup ? rollup.waves : [rollup];
   const lines = [];
@@ -61037,7 +61401,7 @@ function formatRollupTable(rollup) {
   }
   return lines.join("\n");
 }
-var rollupCommand, startCommand5, statusCommand12, dashboardCommand, analyzeCommand4, readyCommand, reportCommand, nextCommand2, wavesCommand2, planCommand, spawnCommand2, validateCommand6, contextCommand5, ivtrCommand, parallelCommand, tesseraListCommand, tesseraInstantiateCommand, tesseraCommand, unblockCommand, bootstrapCommand, classifyCommand, fanoutStatusCommand, handoffCommand, spawnExecuteCommand, fanoutCommand, pruneCommand, worktreeCompleteCommand, conduitStatusCommand, conduitPeekCommand, conduitStartCommand, conduitStopCommand, approveCommand, rejectCommand, pendingCommand, conduitSendCommand, orchestrateCommand;
+var rollupCommand, startCommand5, statusCommand12, dashboardCommand, analyzeCommand4, readyCommand, reportCommand, nextCommand2, wavesCommand2, planCommand, spawnCommand2, validateCommand6, contextCommand5, ivtrCommand, parallelCommand, tesseraListCommand, tesseraInstantiateCommand, tesseraCommand, unblockCommand, bootstrapCommand, classifyCommand2, fanoutStatusCommand, handoffCommand, spawnExecuteCommand, fanoutCommand, pruneCommand, worktreeCompleteCommand, conduitStatusCommand, conduitPeekCommand, conduitStartCommand, conduitStopCommand, approveCommand, rejectCommand, pendingCommand, conduitSendCommand, orchestrateCommand;
 var init_orchestrate3 = __esm({
   "packages/cleo/src/cli/commands/orchestrate.ts"() {
     "use strict";
@@ -61145,7 +61509,7 @@ var init_orchestrate3 = __esm({
       },
       async run({ args }) {
         const rateWindowHours = args.window !== void 0 ? Number.parseFloat(String(args.window)) : void 0;
-        const metrics = await orchestration.collectOrchestrateDashboard(getProjectRoot49(), {
+        const metrics = await orchestration.collectOrchestrateDashboard(getProjectRoot50(), {
           ...rateWindowHours !== void 0 && Number.isFinite(rateWindowHours) && rateWindowHours > 0 ? { rateWindowHours } : {}
         });
         cliOutput(metrics, {
@@ -61626,7 +61990,7 @@ var init_orchestrate3 = __esm({
         );
       }
     });
-    classifyCommand = defineCommand({
+    classifyCommand2 = defineCommand({
       meta: {
         name: "classify",
         description: "Classify a request using CANT prompt-based team routing"
@@ -61965,7 +62329,7 @@ var init_orchestrate3 = __esm({
         tessera: tesseraCommand,
         unblock: unblockCommand,
         bootstrap: bootstrapCommand,
-        classify: classifyCommand,
+        classify: classifyCommand2,
         "fanout-status": fanoutStatusCommand,
         handoff: handoffCommand,
         "spawn-execute": spawnExecuteCommand,
@@ -62168,7 +62532,7 @@ var phase_exports = {};
 __export(phase_exports, {
   phaseCommand: () => phaseCommand
 });
-var showCommand10, listCommand15, setCommand2, startCommand6, completeCommand3, advanceCommand2, renameCommand, deleteCommand2, phaseCommand;
+var showCommand10, listCommand15, setCommand2, startCommand6, completeCommand3, advanceCommand3, renameCommand, deleteCommand2, phaseCommand;
 var init_phase = __esm({
   "packages/cleo/src/cli/commands/phase.ts"() {
     "use strict";
@@ -62268,7 +62632,7 @@ var init_phase = __esm({
         );
       }
     });
-    advanceCommand2 = defineCommand({
+    advanceCommand3 = defineCommand({
       meta: { name: "advance", description: "Complete current phase and start next" },
       args: {
         force: {
@@ -62350,7 +62714,7 @@ var init_phase = __esm({
         set: setCommand2,
         start: startCommand6,
         complete: completeCommand3,
-        advance: advanceCommand2,
+        advance: advanceCommand3,
         rename: renameCommand,
         delete: deleteCommand2
       },
@@ -63350,7 +63714,7 @@ var refresh_memory_exports = {};
 __export(refresh_memory_exports, {
   refreshMemoryCommand: () => refreshMemoryCommand
 });
-import { getProjectRoot as getProjectRoot50 } from "@cleocode/core";
+import { getProjectRoot as getProjectRoot51 } from "@cleocode/core";
 var refreshMemoryCommand;
 var init_refresh_memory = __esm({
   "packages/cleo/src/cli/commands/refresh-memory.ts"() {
@@ -63363,7 +63727,7 @@ var init_refresh_memory = __esm({
         description: "Regenerate .cleo/memory-bridge.md from brain.db"
       },
       async run() {
-        const projectDir = getProjectRoot50();
+        const projectDir = getProjectRoot51();
         const { writeMemoryBridge } = await import("@cleocode/core/internal");
         const result = await writeMemoryBridge(projectDir);
         if (result.written) {
@@ -64890,7 +65254,7 @@ import fs3 from "node:fs";
 import path5 from "node:path";
 import {
   CleoError as CleoError8,
-  getProjectRoot as getProjectRoot51,
+  getProjectRoot as getProjectRoot52,
   getTaskAccessor as getTaskAccessor3,
   parseConflictReport,
   setAtPath
@@ -64911,7 +65275,7 @@ var init_restore = __esm({
         description: "Apply manually-resolved conflicts from .cleo/restore-conflicts.md"
       },
       async run() {
-        const projectRoot = getProjectRoot51();
+        const projectRoot = getProjectRoot52();
         const reportPath = path5.join(projectRoot, CLEO_DIR_NAME3, RESTORE_CONFLICTS_MD);
         if (!fs3.existsSync(reportPath)) {
           humanLine("No pending restore conflicts. Nothing to finalize.");
@@ -65609,7 +65973,7 @@ __export(saga_exports, {
   sagaCommand: () => sagaCommand
 });
 import { parseAcceptanceCriteria } from "@cleocode/core";
-var createCommand3, addCommand12, detachCommand2, listCommand22, membersCommand, repairCommand, reconcileCommand5, rollupCommand2, sagaCommand;
+var createCommand3, addCommand12, detachCommand2, listCommand22, membersCommand, repairCommand, reconcileCommand5, rollupCommand2, nextCommand3, sagaCommand;
 var init_saga = __esm({
   "packages/cleo/src/cli/commands/saga.ts"() {
     "use strict";
@@ -65820,6 +66184,26 @@ var init_saga = __esm({
         cliOutput(response.data ?? {}, { command: "saga", operation: "tasks.saga.rollup" });
       }
     });
+    nextCommand3 = defineCommand({
+      meta: {
+        name: "next",
+        description: "Return the next actionable Saga and its ready-frontier task IDs"
+      },
+      args: {
+        sagaId: {
+          type: "positional",
+          description: "Optional saga task ID. Omit to auto-select from canonical order.",
+          required: false
+        }
+      },
+      async run({ args }) {
+        const { sagas: sagas2, getProjectRoot: getProjectRoot58 } = await import("@cleocode/core");
+        const projectRoot = getProjectRoot58();
+        const sagaId = typeof args.sagaId === "string" && args.sagaId.length > 0 ? args.sagaId : void 0;
+        const result = await sagas2.sagaNext(projectRoot, { sagaId });
+        cliOutput(result.success ? result.data : result, { command: "saga", operation: "saga.next" });
+      }
+    });
     sagaCommand = defineCommand({
       meta: {
         name: "saga",
@@ -65833,7 +66217,8 @@ var init_saga = __esm({
         members: membersCommand,
         rollup: rollupCommand2,
         repair: repairCommand,
-        reconcile: reconcileCommand5
+        reconcile: reconcileCommand5,
+        next: nextCommand3
       },
       async run({ cmd, rawArgs }) {
         const firstArg = rawArgs?.find((a) => !a.startsWith("-"));
@@ -66075,7 +66460,7 @@ async function writeRuntimeVersionMetadata(mode, source, version) {
     `installed=${(/* @__PURE__ */ new Date()).toISOString()}`
   ];
   await import("node:fs/promises").then(
-    ({ writeFile: writeFile4, mkdir: mkdir5 }) => mkdir5(cleoHome, { recursive: true }).then(
+    ({ writeFile: writeFile4, mkdir: mkdir6 }) => mkdir6(cleoHome, { recursive: true }).then(
       () => writeFile4(join29(cleoHome, "VERSION"), `${lines.join("\n")}
 `, "utf-8")
     )
@@ -67555,7 +67940,7 @@ var sequence_exports = {};
 __export(sequence_exports, {
   sequenceCommand: () => sequenceCommand
 });
-import { getProjectRoot as getProjectRoot52 } from "@cleocode/core/internal";
+import { getProjectRoot as getProjectRoot53 } from "@cleocode/core/internal";
 var showCommand13, checkCommand7, repairCommand2, sequenceCommand;
 var init_sequence = __esm({
   "packages/cleo/src/cli/commands/sequence.ts"() {
@@ -67591,7 +67976,7 @@ var init_sequence = __esm({
       meta: { name: "repair", description: "Reset counter to max + 1 if behind" },
       async run() {
         const { repairSequence } = await import("@cleocode/core/internal");
-        const projectRoot = getProjectRoot52();
+        const projectRoot = getProjectRoot53();
         const repair = await repairSequence(projectRoot);
         const result = {
           repaired: repair.repaired,
@@ -68046,8 +68431,8 @@ var init_session4 = __esm({
         "audit-scope": { type: "string", description: "Audit log scope (global|local)" }
       },
       async run({ args }) {
-        const { detectSessionDrift, getProjectRoot: getProjectRoot57 } = await import("@cleocode/core");
-        const projectRoot = await getProjectRoot57();
+        const { detectSessionDrift, getProjectRoot: getProjectRoot58 } = await import("@cleocode/core");
+        const projectRoot = await getProjectRoot58();
         const scope = args["audit-scope"] === "local" ? "local" : "global";
         const report = await detectSessionDrift({ projectRoot, auditScope: scope });
         cliOutput(report, { command: "session drift", operation: "session.drift" });
@@ -70744,13 +71129,13 @@ var init_telemetry2 = __esm({
 // packages/cleo/src/cli/commands/templates/lib.ts
 import { readFileSync as readFileSync15 } from "node:fs";
 import { isAbsolute as isAbsolute3, resolve as resolve8 } from "node:path";
-import { getProjectRoot as getProjectRoot53 } from "@cleocode/core";
+import { getProjectRoot as getProjectRoot54 } from "@cleocode/core";
 import { resolveSourcePathAbsolute } from "@cleocode/core/templates/registry";
 function resolveProjectRoot6(raw) {
   if (typeof raw === "string" && raw.length > 0) {
     return isAbsolute3(raw) ? raw : resolve8(process.cwd(), raw);
   }
-  return getProjectRoot53();
+  return getProjectRoot54();
 }
 function readTemplateSource(entry) {
   const sourceAbsolute = resolveSourcePathAbsolute(entry);
@@ -71534,7 +71919,7 @@ __export(token_exports, {
   tokenCommand: () => tokenCommand
 });
 import { readFileSync as readFileSync19 } from "node:fs";
-import { getProjectRoot as getProjectRoot54, measureTokenExchange, recordTokenExchange as recordTokenExchange2 } from "@cleocode/core/internal";
+import { getProjectRoot as getProjectRoot55, measureTokenExchange, recordTokenExchange as recordTokenExchange2 } from "@cleocode/core/internal";
 function readPayload(args, textKey, fileKey) {
   const text = args[textKey];
   const file = args[fileKey];
@@ -71698,7 +72083,7 @@ var init_token = __esm({
           domain: args.domain,
           operation: args.operation
         };
-        const result = args.record ? await recordTokenExchange2(getProjectRoot54(), input2) : await measureTokenExchange(input2);
+        const result = args.record ? await recordTokenExchange2(getProjectRoot55(), input2) : await measureTokenExchange(input2);
         cliOutput(result, {
           command: "token",
           operation: args.record ? "admin.token.record" : "token.estimate"
@@ -71734,7 +72119,7 @@ __export(transcript_exports, {
 });
 import { homedir as homedir6 } from "node:os";
 import { join as join34 } from "node:path";
-import { getProjectRoot as getProjectRoot55 } from "@cleocode/core";
+import { getProjectRoot as getProjectRoot56 } from "@cleocode/core";
 import {
   parseDurationMs,
   pruneTranscripts,
@@ -71764,7 +72149,7 @@ var init_transcript = __esm({
       async run({ args }) {
         if (args.pending) {
           try {
-            const projectRoot = getProjectRoot55();
+            const projectRoot = getProjectRoot56();
             const { scanPendingTranscripts } = await import("@cleocode/core/memory/transcript-scanner.js");
             const pending = await scanPendingTranscripts(projectRoot);
             cliOutput(
@@ -71861,7 +72246,7 @@ var init_transcript = __esm({
       async run({ args }) {
         const tier = args.tier ?? "warm";
         const dryRun = args["dry-run"] ?? false;
-        const projectRoot = getProjectRoot55();
+        const projectRoot = getProjectRoot56();
         try {
           const { extractTranscript } = await import("@cleocode/core/memory/transcript-extractor.js");
           const { findSessionTranscriptPath, listAllTranscripts } = await import("@cleocode/core/memory/transcript-scanner.js");
@@ -71973,7 +72358,7 @@ var init_transcript = __esm({
         const dryRun = args["dry-run"] ?? false;
         const olderThanHours = args["older-than-hours"] ? Number.parseInt(args["older-than-hours"], 10) : 24;
         const limit = args.limit ? Number.parseInt(args.limit, 10) : void 0;
-        const projectRoot = getProjectRoot55();
+        const projectRoot = getProjectRoot56();
         try {
           const { extractTranscript } = await import("@cleocode/core/memory/transcript-extractor.js");
           const { listAllTranscripts } = await import("@cleocode/core/memory/transcript-scanner.js");
@@ -72919,15 +73304,12 @@ var init_verify = __esm({
   }
 });
 
-// packages/cleo/src/cli/commands/web.ts
-var web_exports = {};
-__export(web_exports, {
-  webCommand: () => webCommand
-});
+// packages/cleo/src/cli/web-subsystem.ts
 import { execFileSync as execFileSync4, spawn as spawn3 } from "node:child_process";
-import { mkdir as mkdir4, open, readFile as readFile8, rm, stat as stat2, writeFile as writeFile3 } from "node:fs/promises";
+import { mkdir as mkdir5, open, readFile as readFile8, rm, stat as stat2, writeFile as writeFile3 } from "node:fs/promises";
 import { join as join35 } from "node:path";
-import { CleoError as CleoError12, formatError as formatError5, getCleoHome as getCleoHome5 } from "@cleocode/core";
+import { getCleoHome as getCleoHome5 } from "@cleocode/core";
+import { defineSubsystem as defineSubsystem2 } from "@cleocode/runtime/daemon";
 function getWebPaths() {
   const cleoHome = getCleoHome5();
   return {
@@ -72937,7 +73319,7 @@ function getWebPaths() {
     logFile: join35(cleoHome, "logs", "web-server.log")
   };
 }
-function isProcessRunning(pid) {
+function isWebProcessRunning(pid) {
   try {
     process.kill(pid, 0);
     return true;
@@ -72945,20 +73327,20 @@ function isProcessRunning(pid) {
     return false;
   }
 }
-async function getStatus() {
+async function getWebStatus() {
   const { pidFile, configFile } = getWebPaths();
   try {
     const pidStr = (await readFile8(pidFile, "utf-8")).trim();
     const pid = Number.parseInt(pidStr, 10);
-    if (Number.isNaN(pid) || !isProcessRunning(pid)) {
+    if (Number.isNaN(pid) || !isWebProcessRunning(pid)) {
       return { running: false, pid: null, port: null, host: null, url: null };
     }
-    let port = DEFAULT_PORT;
-    let host = DEFAULT_HOST;
+    let port = WEB_DEFAULT_PORT;
+    let host = WEB_DEFAULT_HOST;
     try {
       const config = JSON.parse(await readFile8(configFile, "utf-8"));
-      port = config.port ?? DEFAULT_PORT;
-      host = config.host ?? DEFAULT_HOST;
+      port = config.port ?? WEB_DEFAULT_PORT;
+      host = config.host ?? WEB_DEFAULT_HOST;
     } catch {
     }
     return { running: true, pid, port, host, url: `http://${host}:${port}` };
@@ -72966,118 +73348,212 @@ async function getStatus() {
     return { running: false, pid: null, port: null, host: null, url: null };
   }
 }
-async function startWebServer(port, host) {
-  const { pidFile, configFile, logFile, logDir } = getWebPaths();
-  const status = await getStatus();
-  if (status.running) {
-    throw new CleoError12(1 /* GENERAL_ERROR */, `Server already running (PID: ${status.pid})`);
-  }
-  const projectRoot = process.env["CLEO_ROOT"] ?? process.cwd();
-  const studioDir = process.env["CLEO_STUDIO_DIR"] ?? join35(projectRoot, "packages", "studio", "build");
-  await mkdir4(logDir, { recursive: true });
-  await writeFile3(
-    configFile,
-    JSON.stringify({
-      port,
-      host,
-      startedAt: (/* @__PURE__ */ new Date()).toISOString()
-    })
-  );
-  const webIndexPath = join35(studioDir, "index.js");
-  try {
-    await stat2(webIndexPath);
-  } catch {
-    try {
-      execFileSync4("pnpm", ["--filter", "@cleocode/studio", "run", "build"], {
-        cwd: projectRoot,
-        stdio: "ignore"
-      });
-    } catch {
-      throw new CleoError12(
-        1 /* GENERAL_ERROR */,
-        `Studio build failed. Run: pnpm --filter @cleocode/studio run build
-Logs: ${logFile}`
+function createWebSubsystem(opts = {}) {
+  const port = opts.port ?? WEB_DEFAULT_PORT;
+  const host = opts.host ?? WEB_DEFAULT_HOST;
+  let live;
+  return defineSubsystem2({
+    name: WEB_SUBSYSTEM_NAME,
+    async start() {
+      const { pidFile, configFile, logFile, logDir } = getWebPaths();
+      const existing = await getWebStatus();
+      if (existing.running && existing.pid !== null) {
+        const ctx2 = {
+          pid: existing.pid,
+          pidFile,
+          logFile,
+          port: existing.port ?? port,
+          host: existing.host ?? host
+        };
+        live = ctx2;
+        return ctx2;
+      }
+      const projectRoot = process.env["CLEO_ROOT"] ?? process.cwd();
+      const studioDir = process.env["CLEO_STUDIO_DIR"] ?? join35(projectRoot, "packages", "studio", "build");
+      const webIndexPath = join35(studioDir, "index.js");
+      await mkdir5(logDir, { recursive: true });
+      await writeFile3(
+        configFile,
+        JSON.stringify({ port, host, startedAt: (/* @__PURE__ */ new Date()).toISOString() })
       );
-    }
-  }
-  const logFileHandle = await open(logFile, "a");
-  const serverProcess = spawn3("node", [webIndexPath], {
-    cwd: studioDir,
-    env: {
-      ...process.env,
-      HOST: host,
-      PORT: String(port),
-      // Pass CLEO paths through to the studio server
-      CLEO_ROOT: projectRoot
+      try {
+        await stat2(webIndexPath);
+      } catch {
+        try {
+          execFileSync4("pnpm", ["--filter", "@cleocode/studio", "run", "build"], {
+            cwd: projectRoot,
+            stdio: "ignore"
+          });
+        } catch {
+          throw new Error(
+            `Studio build failed. Run: pnpm --filter @cleocode/studio run build
+Logs: ${logFile}`
+          );
+        }
+      }
+      const logFileHandle = await open(logFile, "a");
+      const serverProcess = spawn3("node", [webIndexPath], {
+        cwd: studioDir,
+        env: {
+          ...process.env,
+          HOST: host,
+          PORT: String(port),
+          CLEO_ROOT: projectRoot
+        },
+        detached: true,
+        stdio: ["ignore", logFileHandle.fd, logFileHandle.fd]
+      });
+      serverProcess.unref();
+      const pidFileTmp = `${pidFile}.tmp`;
+      await writeFile3(pidFileTmp, String(serverProcess.pid));
+      await rm(pidFile, { force: true });
+      await writeFile3(pidFile, String(serverProcess.pid));
+      await rm(pidFileTmp, { force: true });
+      await logFileHandle.close();
+      let started = false;
+      for (let i = 0; i < STARTUP_POLL_ITERATIONS; i++) {
+        try {
+          const response = await fetch(`http://${host}:${port}/api/health`);
+          if (response.ok) {
+            started = true;
+            break;
+          }
+        } catch {
+        }
+        await new Promise((resolve11) => setTimeout(resolve11, 500));
+      }
+      if (!started) {
+        try {
+          process.kill(serverProcess.pid, "SIGTERM");
+        } catch {
+        }
+        await rm(pidFile, { force: true });
+        throw new Error("Studio web server failed to start within 15 seconds");
+      }
+      const ctx = {
+        pid: serverProcess.pid,
+        pidFile,
+        logFile,
+        port,
+        host
+      };
+      live = ctx;
+      return ctx;
     },
-    detached: true,
-    stdio: ["ignore", logFileHandle.fd, logFileHandle.fd]
-  });
-  serverProcess.unref();
-  const pidFileTmp = `${pidFile}.tmp`;
-  await writeFile3(pidFileTmp, String(serverProcess.pid));
-  await rm(pidFile, { force: true });
-  await writeFile3(pidFile, String(serverProcess.pid));
-  await rm(pidFileTmp, { force: true });
-  await logFileHandle.close();
-  const maxAttempts = 30;
-  let started = false;
-  for (let i = 0; i < maxAttempts; i++) {
-    try {
-      const response = await fetch(`http://${host}:${port}/api/health`);
-      if (response.ok) {
-        started = true;
-        break;
+    healthProbe() {
+      if (live === void 0) {
+        const stopped = "stopped";
+        return {
+          child_id: WEB_SUBSYSTEM_NAME,
+          pid: 0,
+          state: stopped,
+          restart_count: 0,
+          detail: "not started"
+        };
       }
-    } catch {
-    }
-    await new Promise((resolve11) => setTimeout(resolve11, 500));
-  }
-  if (!started) {
-    try {
-      process.kill(serverProcess.pid);
-    } catch {
-    }
-    await rm(pidFile, { force: true });
-    throw new CleoError12(1 /* GENERAL_ERROR */, "Server failed to start within 15 seconds");
-  }
-  cliOutput(
-    {
-      pid: serverProcess.pid,
-      port,
-      host,
-      url: `http://${host}:${port}`,
-      logFile
+      const alive = isWebProcessRunning(live.pid);
+      const state = alive ? "running" : "stopped";
+      return {
+        child_id: WEB_SUBSYSTEM_NAME,
+        pid: alive ? live.pid : 0,
+        state,
+        restart_count: 0,
+        detail: alive ? `url=http://${live.host}:${live.port} pid=${live.pid}` : `pid=${live.pid} exited`
+      };
     },
-    { command: "web", message: `CLEO Web UI running on port ${port}` }
-  );
+    async shutdown(context) {
+      const { pidFile } = context;
+      if (!isWebProcessRunning(context.pid)) {
+        await rm(pidFile, { force: true });
+        live = void 0;
+        return;
+      }
+      try {
+        if (process.platform === "win32") {
+          spawn3("taskkill", ["/PID", String(context.pid), "/T"], { stdio: "ignore" });
+        } else {
+          process.kill(context.pid, "SIGTERM");
+        }
+      } catch {
+      }
+      for (let i = 0; i < SIGTERM_GRACE_ITERATIONS2; i++) {
+        if (!isWebProcessRunning(context.pid)) break;
+        await new Promise((resolve11) => setTimeout(resolve11, 500));
+      }
+      if (isWebProcessRunning(context.pid)) {
+        try {
+          if (process.platform === "win32") {
+            spawn3("taskkill", ["/PID", String(context.pid), "/F", "/T"], { stdio: "ignore" });
+          } else {
+            process.kill(context.pid, "SIGKILL");
+          }
+        } catch {
+        }
+      }
+      await rm(pidFile, { force: true });
+      live = void 0;
+    }
+  });
 }
-var DEFAULT_PORT, DEFAULT_HOST, startCommand9, stopCommand6, restartCommand, statusCommand18, openCommand3, webCommand;
+var WEB_DEFAULT_PORT, WEB_DEFAULT_HOST, WEB_SUBSYSTEM_NAME, SIGTERM_GRACE_ITERATIONS2, STARTUP_POLL_ITERATIONS;
+var init_web_subsystem = __esm({
+  "packages/cleo/src/cli/web-subsystem.ts"() {
+    "use strict";
+    WEB_DEFAULT_PORT = 3456;
+    WEB_DEFAULT_HOST = "127.0.0.1";
+    WEB_SUBSYSTEM_NAME = "cleo-web";
+    SIGTERM_GRACE_ITERATIONS2 = 60;
+    STARTUP_POLL_ITERATIONS = 30;
+  }
+});
+
+// packages/cleo/src/cli/commands/web.ts
+var web_exports = {};
+__export(web_exports, {
+  webCommand: () => webCommand
+});
+import { spawn as spawn4 } from "node:child_process";
+import { rm as rm2 } from "node:fs/promises";
+import { CleoError as CleoError12, formatError as formatError5 } from "@cleocode/core";
+var startCommand9, stopCommand6, restartCommand, statusCommand18, openCommand3, webCommand;
 var init_web = __esm({
   "packages/cleo/src/cli/commands/web.ts"() {
     "use strict";
     init_src2();
     init_dist();
     init_renderers();
-    DEFAULT_PORT = 3456;
-    DEFAULT_HOST = "127.0.0.1";
+    init_web_subsystem();
     startCommand9 = defineCommand({
       meta: { name: "start", description: "Start the web server" },
       args: {
         port: {
           type: "string",
           description: "Server port",
-          default: String(DEFAULT_PORT)
+          default: String(WEB_DEFAULT_PORT)
         },
         host: {
           type: "string",
           description: "Server host",
-          default: DEFAULT_HOST
+          default: WEB_DEFAULT_HOST
         }
       },
       async run({ args }) {
         try {
-          await startWebServer(Number.parseInt(args.port, 10), args.host);
+          const port = Number.parseInt(args.port, 10);
+          const host = args.host;
+          const subsystem = createWebSubsystem({ port, host });
+          const ctx = await subsystem.start();
+          const { logFile } = getWebPaths();
+          cliOutput(
+            {
+              pid: ctx.pid,
+              port: ctx.port,
+              host: ctx.host,
+              url: `http://${ctx.host}:${ctx.port}`,
+              logFile
+            },
+            { command: "web", message: `CLEO Web UI running on port ${ctx.port}` }
+          );
         } catch (err) {
           if (err instanceof CleoError12) {
             console.error(formatError5(err));
@@ -73091,36 +73567,24 @@ var init_web = __esm({
       meta: { name: "stop", description: "Stop the web server" },
       async run() {
         try {
-          const { pidFile } = getWebPaths();
-          const status = await getStatus();
-          if (!status.running || !status.pid) {
-            await rm(pidFile, { force: true });
+          const { pidFile, logFile } = getWebPaths();
+          const status = await getWebStatus();
+          if (!status.running || status.pid === null) {
+            await rm2(pidFile, { force: true });
             cliOutput({ running: false }, { command: "web", message: "Server is not running" });
             return;
           }
-          try {
-            if (process.platform === "win32") {
-              spawn3("taskkill", ["/PID", String(status.pid), "/T"], { stdio: "ignore" });
-            } else {
-              process.kill(status.pid, "SIGTERM");
-            }
-          } catch {
-          }
-          for (let i = 0; i < 60; i++) {
-            if (!isProcessRunning(status.pid)) break;
-            await new Promise((resolve11) => setTimeout(resolve11, 500));
-          }
-          if (isProcessRunning(status.pid)) {
-            try {
-              if (process.platform === "win32") {
-                spawn3("taskkill", ["/PID", String(status.pid), "/F", "/T"], { stdio: "ignore" });
-              } else {
-                process.kill(status.pid, "SIGKILL");
-              }
-            } catch {
-            }
-          }
-          await rm(pidFile, { force: true });
+          const subsystem = createWebSubsystem({
+            port: status.port ?? WEB_DEFAULT_PORT,
+            host: status.host ?? WEB_DEFAULT_HOST
+          });
+          await subsystem.shutdown({
+            pid: status.pid,
+            pidFile,
+            logFile,
+            port: status.port ?? WEB_DEFAULT_PORT,
+            host: status.host ?? WEB_DEFAULT_HOST
+          });
           cliOutput({ stopped: true }, { command: "web", message: "CLEO Web UI stopped" });
         } catch (err) {
           if (err instanceof CleoError12) {
@@ -73137,44 +73601,45 @@ var init_web = __esm({
         port: {
           type: "string",
           description: "Server port",
-          default: String(DEFAULT_PORT)
+          default: String(WEB_DEFAULT_PORT)
         },
         host: {
           type: "string",
           description: "Server host",
-          default: DEFAULT_HOST
+          default: WEB_DEFAULT_HOST
         }
       },
       async run({ args }) {
         try {
-          const { pidFile } = getWebPaths();
-          const status = await getStatus();
-          if (status.running && status.pid) {
-            try {
-              if (process.platform === "win32") {
-                spawn3("taskkill", ["/PID", String(status.pid), "/T"], { stdio: "ignore" });
-              } else {
-                process.kill(status.pid, "SIGTERM");
-              }
-            } catch {
-            }
-            for (let i = 0; i < 60; i++) {
-              if (!isProcessRunning(status.pid)) break;
-              await new Promise((resolve11) => setTimeout(resolve11, 500));
-            }
-            if (isProcessRunning(status.pid)) {
-              try {
-                if (process.platform === "win32") {
-                  spawn3("taskkill", ["/PID", String(status.pid), "/F", "/T"], { stdio: "ignore" });
-                } else {
-                  process.kill(status.pid, "SIGKILL");
-                }
-              } catch {
-              }
-            }
-            await rm(pidFile, { force: true });
+          const port = Number.parseInt(args.port, 10);
+          const host = args.host;
+          const { pidFile, logFile } = getWebPaths();
+          const status = await getWebStatus();
+          if (status.running && status.pid !== null) {
+            const stopSubsystem = createWebSubsystem({
+              port: status.port ?? port,
+              host: status.host ?? host
+            });
+            await stopSubsystem.shutdown({
+              pid: status.pid,
+              pidFile,
+              logFile,
+              port: status.port ?? port,
+              host: status.host ?? host
+            });
           }
-          await startWebServer(Number.parseInt(args.port, 10), args.host);
+          const startSubsystem = createWebSubsystem({ port, host });
+          const ctx = await startSubsystem.start();
+          cliOutput(
+            {
+              pid: ctx.pid,
+              port: ctx.port,
+              host: ctx.host,
+              url: `http://${ctx.host}:${ctx.port}`,
+              logFile
+            },
+            { command: "web", message: `CLEO Web UI running on port ${ctx.port}` }
+          );
         } catch (err) {
           if (err instanceof CleoError12) {
             console.error(formatError5(err));
@@ -73188,7 +73653,7 @@ var init_web = __esm({
       meta: { name: "status", description: "Check server status" },
       async run() {
         try {
-          const status = await getStatus();
+          const status = await getWebStatus();
           cliOutput(status, { command: "web" });
         } catch (err) {
           if (err instanceof CleoError12) {
@@ -73203,7 +73668,7 @@ var init_web = __esm({
       meta: { name: "open", description: "Open browser to the UI" },
       async run() {
         try {
-          const status = await getStatus();
+          const status = await getWebStatus();
           if (!status.running || !status.url) {
             throw new CleoError12(
               1 /* GENERAL_ERROR */,
@@ -73214,11 +73679,11 @@ var init_web = __esm({
           const platform = process.platform;
           try {
             if (platform === "linux") {
-              spawn3("xdg-open", [url], { detached: true, stdio: "ignore" }).unref();
+              spawn4("xdg-open", [url], { detached: true, stdio: "ignore" }).unref();
             } else if (platform === "darwin") {
-              spawn3("open", [url], { detached: true, stdio: "ignore" }).unref();
+              spawn4("open", [url], { detached: true, stdio: "ignore" }).unref();
             } else if (platform === "win32") {
-              spawn3("cmd", ["/c", "start", "", url], { detached: true, stdio: "ignore" }).unref();
+              spawn4("cmd", ["/c", "start", "", url], { detached: true, stdio: "ignore" }).unref();
             }
           } catch {
           }
@@ -73257,7 +73722,7 @@ __export(workgraph_exports, {
 });
 import { readFileSync as readFileSync20 } from "node:fs";
 import { resolve as resolve10 } from "node:path";
-var validateCommand10, applyCommand, planCommand4, structureCommand, workgraphCommand;
+var validateCommand10, applyCommand, planCommand4, structureCommand, statusCommand19, workgraphCommand;
 var init_workgraph2 = __esm({
   "packages/cleo/src/cli/commands/workgraph.ts"() {
     "use strict";
@@ -73367,9 +73832,9 @@ var init_workgraph2 = __esm({
       },
       async run({ args }) {
         const { generatePlanningDoc } = await import("@cleocode/core/workgraph");
-        const { getProjectRoot: getProjectRoot57 } = await import("@cleocode/core");
+        const { getProjectRoot: getProjectRoot58 } = await import("@cleocode/core");
         const { cliOutput: cliOutput2 } = await Promise.resolve().then(() => (init_renderers(), renderers_exports));
-        const projectRoot = getProjectRoot57();
+        const projectRoot = getProjectRoot58();
         const audience = String(args.audience) === "agent" ? "agent" : "maintainer";
         const result = await generatePlanningDoc(projectRoot, {
           sagaId: String(args.sagaId),
@@ -73386,9 +73851,9 @@ var init_workgraph2 = __esm({
       async run() {
         const { validateWorkGraphStructure } = await import("@cleocode/core/workgraph");
         const { taskList: taskList2 } = await import("@cleocode/core/internal");
-        const { getProjectRoot: getProjectRoot57 } = await import("@cleocode/core");
+        const { getProjectRoot: getProjectRoot58 } = await import("@cleocode/core");
         const { cliOutput: cliOutput2 } = await Promise.resolve().then(() => (init_renderers(), renderers_exports));
-        const projectRoot = getProjectRoot57();
+        const projectRoot = getProjectRoot58();
         const listResult = await taskList2(projectRoot, { limit: 5e3 });
         const tasks = listResult.success ? listResult.data?.tasks ?? [] : [];
         const nodes = tasks.map((t) => ({
@@ -73401,16 +73866,64 @@ var init_workgraph2 = __esm({
         cliOutput2(result, { command: "workgraph", operation: "structure" });
       }
     });
+    statusCommand19 = defineCommand({
+      meta: {
+        name: "status",
+        description: "One-shot saga-to-saga workgraph dashboard (tracking checklist)"
+      },
+      async run() {
+        const { sagas: sagas2, getProjectRoot: getProjectRoot58 } = await import("@cleocode/core");
+        const { cliOutput: cliOutput2 } = await Promise.resolve().then(() => (init_renderers(), renderers_exports));
+        const projectRoot = getProjectRoot58();
+        const listResult = await sagas2.sagaList(projectRoot);
+        if (!listResult.success) {
+          cliOutput2(listResult, { command: "workgraph", operation: "workgraph.status" });
+          return;
+        }
+        const allSagas = listResult.data?.sagas ?? [];
+        const sagaMap = new Map(
+          allSagas.map((s) => [s.id, s])
+        );
+        const TERMINAL = /* @__PURE__ */ new Set(["done", "cancelled", "deleted", "archived", "completed"]);
+        const rows = [];
+        for (let i = 0; i < sagas2.CANONICAL_SAGA_ORDER.length; i++) {
+          const [id, label] = sagas2.CANONICAL_SAGA_ORDER[i];
+          const saga = sagaMap.get(id);
+          if (!saga) continue;
+          const status = saga.status ?? "pending";
+          const rollupResult = await sagas2.sagaRollup(projectRoot, { sagaId: id });
+          const rollup = rollupResult.success ? rollupResult.data : { total: 0, done: 0, completionPct: 0 };
+          rows.push({
+            rank: i + 1,
+            sagaId: id,
+            status,
+            completionPct: rollup.completionPct ?? 0,
+            done: rollup.done ?? 0,
+            total: rollup.total ?? 0,
+            label: TERMINAL.has(status) ? `${label} \u2713` : label
+          });
+        }
+        cliOutput2(
+          {
+            rows,
+            total: rows.length,
+            activeSagaCount: rows.filter((r) => !TERMINAL.has(r.status)).length
+          },
+          { command: "workgraph", operation: "workgraph.status" }
+        );
+      }
+    });
     workgraphCommand = defineCommand({
       meta: {
         name: "workgraph",
-        description: "PM-Core V2 WorkGraph operations \u2014 validate, apply, plan, structure"
+        description: "PM-Core V2 WorkGraph operations \u2014 validate, apply, plan, structure, status"
       },
       subCommands: {
         validate: validateCommand10,
         apply: applyCommand,
         plan: planCommand4,
-        structure: structureCommand
+        structure: structureCommand,
+        status: statusCommand19
       },
       async run({ cmd, rawArgs }) {
         const firstArg = rawArgs?.find((a) => !a.startsWith("-"));
@@ -73427,7 +73940,7 @@ __export(worktree_exports, {
   worktreeCommand: () => worktreeCommand
 });
 import readline4 from "node:readline";
-import { getProjectRoot as getProjectRoot56, listWorktrees as listWorktrees2 } from "@cleocode/core/internal";
+import { getProjectRoot as getProjectRoot57, listWorktrees as listWorktrees2 } from "@cleocode/core/internal";
 async function promptYesNo2(question) {
   return new Promise((resolve11) => {
     const rl = readline4.createInterface({ input: process.stdin, output: process.stdout });
@@ -73532,7 +74045,7 @@ var init_worktree3 = __esm({
         const staleDays = staleDaysRaw !== void 0 ? Number.parseInt(staleDaysRaw, 10) : void 0;
         const idleDaysRaw = typeof args["idle-days"] === "string" ? args["idle-days"] : void 0;
         const idleDays = idleDaysRaw !== void 0 ? Number.parseInt(idleDaysRaw, 10) : void 0;
-        const projectRoot = getProjectRoot56();
+        const projectRoot = getProjectRoot57();
         const listResult = await listWorktrees2({
           projectRoot,
           ...staleDays !== void 0 && !Number.isNaN(staleDays) ? { staleDays } : {}
@@ -73775,7 +74288,7 @@ init_field_context();
 init_format_context();
 import { readFileSync as readFileSync21 } from "node:fs";
 import { dirname as dirname11, join as join37 } from "node:path";
-import { fileURLToPath as fileURLToPath7 } from "node:url";
+import { fileURLToPath as fileURLToPath6 } from "node:url";
 import { enforceNodeVersion } from "@cleocode/paths";
 
 // packages/cleo/src/cli/generated/command-manifest.ts
@@ -73948,6 +74461,12 @@ var COMMAND_MANIFEST = [
     description: "Claim a task by assigning it to an agent",
     load: async () => (await Promise.resolve().then(() => (init_claim(), claim_exports))).claimCommand
   },
+  {
+    exportName: "classifyCommand",
+    name: "classify",
+    description: "Classify a task: readiness verdict (proceed|grill) + persona routing (agent, confidence)",
+    load: async () => (await Promise.resolve().then(() => (init_classify(), classify_exports))).classifyCommand
+  },
   {
     exportName: "unclaimCommand",
     name: "unclaim",
@@ -74176,10 +74695,16 @@ var COMMAND_MANIFEST = [
     description: "Transcript garbage collection: manual trigger and status",
     load: async () => (await Promise.resolve().then(() => (init_gc(), gc_exports))).gcCommand
   },
+  {
+    exportName: "goCommand",
+    name: "go",
+    description: "SG-AUTOPILOT: run one turn of briefing\u2192sagaNext\u2192ready\u2192stage-branch\u2192ivtr loop",
+    load: async () => (await Promise.resolve().then(() => (init_go(), go_exports))).goCommand
+  },
   {
     exportName: "goalCommand",
     name: "goal",
-    description: "DB-persisted, per-agent, evidence-gate-aware goal loop (set/status/subgoal/append).",
+    description: "DB-persisted, per-agent, evidence-gate-aware goal loop (set/status/advance/subgoal/append).",
     load: async () => (await Promise.resolve().then(() => (init_goal2(), goal_exports))).goalCommand
   },
   {
@@ -74659,7 +75184,7 @@ var COMMAND_MANIFEST = [
   {
     exportName: "workgraphCommand",
     name: "workgraph",
-    description: "PM-Core V2 WorkGraph operations \u2014 validate, apply, plan, structure",
+    description: "PM-Core V2 WorkGraph operations \u2014 validate, apply, plan, structure, status",
     load: async () => (await Promise.resolve().then(() => (init_workgraph2(), workgraph_exports))).workgraphCommand
   },
   {
@@ -74940,7 +75465,7 @@ async function resolveSubCommandForHelp(cmd, rawArgs) {
 init_summary_context();
 enforceNodeVersion();
 function getPackageVersion() {
-  const pkgPath = join37(dirname11(fileURLToPath7(import.meta.url)), "../../package.json");
+  const pkgPath = join37(dirname11(fileURLToPath6(import.meta.url)), "../../package.json");
   const pkg = JSON.parse(readFileSync21(pkgPath, "utf-8"));
   return pkg.version;
 }
@@ -75124,7 +75649,7 @@ async function runStartupMaintenance() {
     detectAndRemoveStrayProjectNexus,
     getGlobalSalt,
     getLogger: getLogger20,
-    getProjectRoot: getProjectRoot57,
+    getProjectRoot: getProjectRoot58,
     isCleanupMarkerSet,
     migrateSignaldockToConduit,
     needsSignaldockToConduitMigration,
@@ -75133,7 +75658,7 @@ async function runStartupMaintenance() {
   } = await import("@cleocode/core/internal");
   let projectRootForCleanup = "";
   try {
-    projectRootForCleanup = getProjectRoot57();
+    projectRootForCleanup = getProjectRoot58();
   } catch {
   }
   if (!isCleanupMarkerSet(CLI_VERSION, projectRootForCleanup)) {
@@ -75153,7 +75678,7 @@ async function runStartupMaintenance() {
   const isInitInvocation = process.argv.slice(2).some((a) => a === "init");
   if (!isInitInvocation) {
     try {
-      const _projectRootForMigration = getProjectRoot57();
+      const _projectRootForMigration = getProjectRoot58();
       if (needsSignaldockToConduitMigration(_projectRootForMigration)) {
         const migrationResult = migrateSignaldockToConduit(_projectRootForMigration);
         if (migrationResult.status === "failed") {