@cleocode/cleo 2026.5.78 → 2026.5.79

package/dist/cli/index.js

@@ -2573,6 +2573,192 @@ var init_peer = __esm({
   }
 });
 
+// packages/contracts/src/release/plan.ts
+import { z as z4 } from "zod";
+var RELEASE_CHANNEL, RELEASE_SCHEME, RELEASE_KIND, RELEASE_STATUS, GATE_STATUS, GATE_NAME, PLATFORM_TUPLE, PUBLISHER, TASK_KIND, IMPACT, RESOLVED_SOURCE, ReleaseChannelSchema, ReleaseSchemeSchema, ReleaseKindSchema, ReleaseStatusSchema, GateStatusSchema, GateNameSchema, PlatformTupleSchema, PublisherSchema, TaskKindSchema, ImpactSchema, ResolvedSourceSchema, Iso8601, NonEmptyString, ReleasePlanTaskSchema, ReleaseGateSchema, ReleasePlatformMatrixEntrySchema, ReleasePreflightSummarySchema, ReleasePlanChangelogSchema, ReleasePlanMetaSchema, ReleasePlanSchema;
+var init_plan = __esm({
+  "packages/contracts/src/release/plan.ts"() {
+    "use strict";
+    RELEASE_CHANNEL = ["latest", "beta", "alpha", "rc"];
+    RELEASE_SCHEME = ["calver", "semver", "calver-suffix"];
+    RELEASE_KIND = ["regular", "hotfix", "prerelease"];
+    RELEASE_STATUS = [
+      "planned",
+      "pr-opened",
+      "pr-merged",
+      "published",
+      "reconciled",
+      "rolled_back",
+      "failed",
+      "cancelled"
+    ];
+    GATE_STATUS = ["passed", "failed", "skipped", "unresolved"];
+    GATE_NAME = ["test", "build", "lint", "typecheck", "audit", "security-scan"];
+    PLATFORM_TUPLE = [
+      "linux-x64",
+      "linux-arm64",
+      "macos-x64",
+      "macos-arm64",
+      "windows-x64",
+      "any"
+    ];
+    PUBLISHER = ["npm", "cargo", "docker", "pypi", "github-release", "binary"];
+    TASK_KIND = [
+      "feat",
+      "fix",
+      "chore",
+      "docs",
+      "refactor",
+      "test",
+      "perf",
+      "revert",
+      "breaking",
+      "hotfix"
+    ];
+    IMPACT = ["major", "minor", "patch"];
+    RESOLVED_SOURCE = ["project-context", "language-default", "legacy-alias"];
+    ReleaseChannelSchema = z4.enum(RELEASE_CHANNEL);
+    ReleaseSchemeSchema = z4.enum(RELEASE_SCHEME);
+    ReleaseKindSchema = z4.enum(RELEASE_KIND);
+    ReleaseStatusSchema = z4.enum(RELEASE_STATUS);
+    GateStatusSchema = z4.enum(GATE_STATUS);
+    GateNameSchema = z4.enum(GATE_NAME);
+    PlatformTupleSchema = z4.enum(PLATFORM_TUPLE);
+    PublisherSchema = z4.enum(PUBLISHER);
+    TaskKindSchema = z4.enum(TASK_KIND);
+    ImpactSchema = z4.enum(IMPACT);
+    ResolvedSourceSchema = z4.enum(RESOLVED_SOURCE);
+    Iso8601 = z4.iso.datetime({ offset: true });
+    NonEmptyString = z4.string().min(1);
+    ReleasePlanTaskSchema = z4.object({
+      /** Task ID (e.g. "T10001"). Format intentionally loose so historical IDs validate. */
+      id: NonEmptyString,
+      /** Conventional-commit-aligned task classification. */
+      kind: TaskKindSchema,
+      /** SemVer impact classification. */
+      impact: ImpactSchema,
+      /** Human-readable changelog line for this task. */
+      userFacingSummary: z4.string(),
+      /**
+       * ADR-051 evidence atoms attesting the task's gate results. Format is
+       * `kind:value` (e.g. `commit:abc123`, `test-run:vitest.json`). The contract
+       * accepts empty arrays so legacy plans validate; `cleo release plan`
+       * enforces non-empty via R-301.
+       */
+      evidenceAtoms: z4.array(NonEmptyString),
+      /** IVTR phase at plan time — informational only per R-316. */
+      ivtrPhaseAtPlan: z4.string().optional(),
+      /** Epic this task rolls up to, locked at plan time per R-303. */
+      epicAncestor: NonEmptyString
+    });
+    ReleaseGateSchema = z4.object({
+      /** Canonical gate name. */
+      name: GateNameSchema,
+      /** ADR-051 atom string identifying the resolved tool (e.g. `tool:test`). */
+      atom: NonEmptyString,
+      /** Gate execution status at plan time. */
+      status: GateStatusSchema,
+      /** ISO-8601 timestamp the gate was last verified. */
+      lastVerifiedAt: Iso8601,
+      /** Resolved shell command (e.g. `pnpm run test`). Optional for unresolved gates. */
+      resolvedCommand: z4.string().optional(),
+      /** Provenance of the resolved command. Optional for unresolved gates. */
+      resolvedSource: ResolvedSourceSchema.optional()
+    });
+    ReleasePlatformMatrixEntrySchema = z4.object({
+      /** Target platform tuple. */
+      platform: PlatformTupleSchema,
+      /** Distribution backend. */
+      publisher: PublisherSchema,
+      /** Package identifier on the target backend (e.g. `@cleocode/cleo`). */
+      package: NonEmptyString,
+      /** Whether to run the GHA smoke job for this matrix entry. */
+      smoke: z4.boolean().default(true).optional()
+    });
+    ReleasePreflightSummarySchema = z4.object({
+      /** True if esbuild externals are out of sync with package.json. */
+      esbuildExternalsDrift: z4.boolean(),
+      /** True if `pnpm-lock.yaml` diverges from the workspace manifest. */
+      lockfileDrift: z4.boolean(),
+      /** True if all epic children are in terminal lifecycle states. */
+      epicCompletenessClean: z4.boolean(),
+      /** True if no task appears in multiple in-flight release plans. */
+      doubleListingClean: z4.boolean(),
+      /** Non-fatal preflight warnings (e.g. unresolved tools per R-024). */
+      preflightWarnings: z4.array(z4.string()).default([]).optional()
+    });
+    ReleasePlanChangelogSchema = z4.object({
+      /** `kind=feat` tasks. */
+      features: z4.array(NonEmptyString).default([]),
+      /** `kind=fix` or `kind=hotfix` tasks. */
+      fixes: z4.array(NonEmptyString).default([]),
+      /** `kind=chore`, `docs`, `refactor`, `test`, `perf` tasks. */
+      chores: z4.array(NonEmptyString).default([]),
+      /** `kind=breaking` or `kind=revert` tasks. */
+      breaking: z4.array(NonEmptyString).default([])
+    });
+    ReleasePlanMetaSchema = z4.object({
+      /** True if this is the project's first ever release. */
+      firstEverRelease: z4.boolean().optional(),
+      /** Canonical tool names that could not be resolved at plan time. */
+      unresolvedTools: z4.array(z4.string()).optional(),
+      /** Project archetype detected at plan time. */
+      archetype: z4.string().optional()
+    }).catchall(z4.unknown());
+    ReleasePlanSchema = z4.object({
+      /** Schema URL for this plan version. */
+      $schema: z4.string().optional(),
+      /** Requested version string (e.g. "v2026.6.0"). Includes the leading `v`. */
+      version: NonEmptyString,
+      /** Resolved version string after suffix application (e.g. "v2026.6.0.2"). */
+      resolvedVersion: NonEmptyString,
+      /** True if a `calver-suffix` was applied to disambiguate a same-day hotfix. */
+      suffixApplied: z4.boolean(),
+      /** Versioning scheme governing `version` / `resolvedVersion`. */
+      scheme: ReleaseSchemeSchema,
+      /** npm dist-tag channel for this release. */
+      channel: ReleaseChannelSchema,
+      /** Epic ID this release ships. */
+      epicId: NonEmptyString,
+      /** Release-kind classification. */
+      releaseKind: ReleaseKindSchema,
+      /** ISO-8601 timestamp the plan was written. */
+      createdAt: Iso8601,
+      /** Identifier of the actor that wrote the plan (agent name or operator). */
+      createdBy: NonEmptyString,
+      /**
+       * Version of the previous release on the same channel. MUST be `null` only
+       * for first-ever releases (R-300, enforced at the verb layer).
+       */
+      previousVersion: z4.string().nullable(),
+      /** Git tag of the previous release (typically `previousVersion` prefixed). */
+      previousTag: z4.string().nullable(),
+      /** ISO-8601 timestamp the previous release was published. */
+      previousShippedAt: Iso8601.nullable(),
+      /** Tasks rolled into this release. */
+      tasks: z4.array(ReleasePlanTaskSchema),
+      /** Bucketed changelog. */
+      changelog: ReleasePlanChangelogSchema,
+      /** Per-gate verification status. */
+      gates: z4.array(ReleaseGateSchema),
+      /** Platform / publisher matrix. */
+      platformMatrix: z4.array(ReleasePlatformMatrixEntrySchema),
+      /** Preflight summary from `cleo release plan`. */
+      preflightSummary: ReleasePreflightSummarySchema,
+      /** URL of the GHA workflow run (populated by `release-prepare.yml`). */
+      workflowRunUrl: z4.string().nullable(),
+      /** URL of the bump PR (populated by `cleo release open`). */
+      prUrl: z4.string().nullable(),
+      /** Merge commit SHA on `main` (populated by `release-publish.yml`). */
+      mergeCommitSha: z4.string().nullable(),
+      /** Current FSM state per R-302. */
+      status: ReleaseStatusSchema,
+      /** Informational / forward-compat metadata. */
+      meta: ReleasePlanMetaSchema.optional()
+    });
+  }
+});
+
 // packages/contracts/src/session.ts
 var init_session2 = __esm({
   "packages/contracts/src/session.ts"() {
@@ -2581,52 +2767,52 @@ var init_session2 = __esm({
 });
 
 // packages/contracts/src/session-journal.ts
-import { z as z4 } from "zod";
+import { z as z5 } from "zod";
 var SESSION_JOURNAL_SCHEMA_VERSION, sessionJournalDoctorSummarySchema, sessionJournalDebriefSummarySchema, sessionJournalEntrySchema;
 var init_session_journal = __esm({
   "packages/contracts/src/session-journal.ts"() {
     "use strict";
     SESSION_JOURNAL_SCHEMA_VERSION = "1.0";
-    sessionJournalDoctorSummarySchema = z4.object({
+    sessionJournalDoctorSummarySchema = z5.object({
       /** `true` when zero noise patterns were detected. */
-      isClean: z4.boolean(),
+      isClean: z5.boolean(),
       /** Total number of noise findings across all patterns. */
-      findingsCount: z4.number().int().nonnegative(),
+      findingsCount: z5.number().int().nonnegative(),
       /** Pattern names that were detected (empty when isClean). */
-      patterns: z4.array(z4.string()),
+      patterns: z5.array(z5.string()),
       /** Total brain entries scanned. `0` = empty or unavailable. */
-      totalScanned: z4.number().int().nonnegative()
+      totalScanned: z5.number().int().nonnegative()
     });
-    sessionJournalDebriefSummarySchema = z4.object({
+    sessionJournalDebriefSummarySchema = z5.object({
       /** First 200 characters of the session end note (if provided). */
-      noteExcerpt: z4.string().max(200).optional(),
+      noteExcerpt: z5.string().max(200).optional(),
       /** Number of tasks completed during the session. */
-      tasksCompletedCount: z4.number().int().nonnegative(),
+      tasksCompletedCount: z5.number().int().nonnegative(),
       /** Up to 5 task IDs (not titles) that were the focus of the session. */
-      tasksFocused: z4.array(z4.string()).max(5).optional()
+      tasksFocused: z5.array(z5.string()).max(5).optional()
     });
-    sessionJournalEntrySchema = z4.object({
+    sessionJournalEntrySchema = z5.object({
       // Identity
       /** Schema version for forward-compatibility. Always `'1.0'` in this release. */
-      schemaVersion: z4.literal(SESSION_JOURNAL_SCHEMA_VERSION),
+      schemaVersion: z5.literal(SESSION_JOURNAL_SCHEMA_VERSION),
       /** ISO 8601 timestamp when the entry was written. */
-      timestamp: z4.string(),
+      timestamp: z5.string(),
       /** CLEO session ID (e.g. `ses_20260424055456_ede571`). */
-      sessionId: z4.string(),
+      sessionId: z5.string(),
       /** Event type that triggered this journal entry. */
-      eventType: z4.enum(["session_start", "session_end", "observation", "decision", "error"]),
+      eventType: z5.enum(["session_start", "session_end", "observation", "decision", "error"]),
       // Session metadata (set on session_start / session_end)
       /** Agent identifier (e.g. `cleo-prime`, `claude-code`). */
-      agentIdentifier: z4.string().optional(),
+      agentIdentifier: z5.string().optional(),
       /** Provider adapter ID active for this session. */
-      providerId: z4.string().optional(),
+      providerId: z5.string().optional(),
       /** Session scope string (e.g. `'global'` or `'epic:T1263'`). */
-      scope: z4.string().optional(),
+      scope: z5.string().optional(),
       // Session-end fields
       /** Duration of the session in seconds (session_end only). */
-      duration: z4.number().int().nonnegative().optional(),
+      duration: z5.number().int().nonnegative().optional(),
       /** Task IDs (not titles) completed during the session. */
-      tasksCompleted: z4.array(z4.string()).optional(),
+      tasksCompleted: z5.array(z5.string()).optional(),
       // Doctor summary (T1262 absorbed)
       /** Compact result of `scanBrainNoise` run at session-end. */
       doctorSummary: sessionJournalDoctorSummarySchema.optional(),
@@ -2635,7 +2821,7 @@ var init_session_journal = __esm({
       debriefSummary: sessionJournalDebriefSummarySchema.optional(),
       // Optional hash chain
       /** SHA-256 hex of the previous entry's raw JSON string (for integrity chain). */
-      prevEntryHash: z4.string().optional()
+      prevEntryHash: z5.string().optional()
     });
   }
 });
@@ -2681,52 +2867,52 @@ var init_task = __esm({
 });
 
 // packages/contracts/src/task-evidence.ts
-import { z as z5 } from "zod";
+import { z as z6 } from "zod";
 var fileEvidenceSchema, logEvidenceSchema, screenshotEvidenceSchema, testOutputEvidenceSchema, commandOutputEvidenceSchema, taskEvidenceSchema;
 var init_task_evidence = __esm({
   "packages/contracts/src/task-evidence.ts"() {
     "use strict";
-    fileEvidenceSchema = z5.object({
-      kind: z5.literal("file"),
-      sha256: z5.string().length(64),
-      timestamp: z5.string().datetime(),
-      path: z5.string().min(1),
-      mime: z5.string().optional(),
-      description: z5.string().optional()
-    });
-    logEvidenceSchema = z5.object({
-      kind: z5.literal("log"),
-      sha256: z5.string().length(64),
-      timestamp: z5.string().datetime(),
-      source: z5.string().min(1),
-      description: z5.string().optional()
-    });
-    screenshotEvidenceSchema = z5.object({
-      kind: z5.literal("screenshot"),
-      sha256: z5.string().length(64),
-      timestamp: z5.string().datetime(),
-      mime: z5.enum(["image/png", "image/jpeg", "image/webp"]).optional(),
-      description: z5.string().optional()
-    });
-    testOutputEvidenceSchema = z5.object({
-      kind: z5.literal("test-output"),
-      sha256: z5.string().length(64),
-      timestamp: z5.string().datetime(),
-      passed: z5.number().int().nonnegative(),
-      failed: z5.number().int().nonnegative(),
-      skipped: z5.number().int().nonnegative(),
-      exitCode: z5.number().int(),
-      description: z5.string().optional()
-    });
-    commandOutputEvidenceSchema = z5.object({
-      kind: z5.literal("command-output"),
-      sha256: z5.string().length(64),
-      timestamp: z5.string().datetime(),
-      cmd: z5.string().min(1),
-      exitCode: z5.number().int(),
-      description: z5.string().optional()
-    });
-    taskEvidenceSchema = z5.discriminatedUnion("kind", [
+    fileEvidenceSchema = z6.object({
+      kind: z6.literal("file"),
+      sha256: z6.string().length(64),
+      timestamp: z6.string().datetime(),
+      path: z6.string().min(1),
+      mime: z6.string().optional(),
+      description: z6.string().optional()
+    });
+    logEvidenceSchema = z6.object({
+      kind: z6.literal("log"),
+      sha256: z6.string().length(64),
+      timestamp: z6.string().datetime(),
+      source: z6.string().min(1),
+      description: z6.string().optional()
+    });
+    screenshotEvidenceSchema = z6.object({
+      kind: z6.literal("screenshot"),
+      sha256: z6.string().length(64),
+      timestamp: z6.string().datetime(),
+      mime: z6.enum(["image/png", "image/jpeg", "image/webp"]).optional(),
+      description: z6.string().optional()
+    });
+    testOutputEvidenceSchema = z6.object({
+      kind: z6.literal("test-output"),
+      sha256: z6.string().length(64),
+      timestamp: z6.string().datetime(),
+      passed: z6.number().int().nonnegative(),
+      failed: z6.number().int().nonnegative(),
+      skipped: z6.number().int().nonnegative(),
+      exitCode: z6.number().int(),
+      description: z6.string().optional()
+    });
+    commandOutputEvidenceSchema = z6.object({
+      kind: z6.literal("command-output"),
+      sha256: z6.string().length(64),
+      timestamp: z6.string().datetime(),
+      cmd: z6.string().min(1),
+      exitCode: z6.number().int(),
+      description: z6.string().optional()
+    });
+    taskEvidenceSchema = z6.discriminatedUnion("kind", [
       fileEvidenceSchema,
       logEvidenceSchema,
       screenshotEvidenceSchema,
@@ -2737,12 +2923,12 @@ var init_task_evidence = __esm({
 });
 
 // packages/contracts/src/tasks/archive.ts
-import { z as z6 } from "zod";
+import { z as z7 } from "zod";
 var ArchiveReason, ARCHIVE_REASON_VALUES;
 var init_archive = __esm({
   "packages/contracts/src/tasks/archive.ts"() {
     "use strict";
-    ArchiveReason = z6.enum([
+    ArchiveReason = z7.enum([
       "verified",
       "reconciled",
       "superseded",
@@ -2773,6 +2959,7 @@ var init_src2 = __esm({
     init_nexus_scope_map();
     init_params();
     init_peer();
+    init_plan();
     init_session2();
     init_session_journal();
     init_status_registry();
@@ -8907,32 +9094,10 @@ var init_registry = __esm({
         requiredParams: [],
         params: []
       },
-      {
-        gateway: "mutate",
-        domain: "pipeline",
-        operation: "release.ship",
-        description: "Ship a release: validate gates \u2192 write CHANGELOG \u2192 git commit/tag/push \u2192 record provenance; absorbs prepare/changelog/commit/tag/push/gates.run via step param",
-        tier: 1,
-        idempotent: false,
-        sessionRequired: false,
-        requiredParams: ["version", "epicId"],
-        params: [
-          {
-            name: "version",
-            type: "string",
-            required: true,
-            description: "version parameter",
-            cli: { positional: true }
-          },
-          {
-            name: "epicId",
-            type: "string",
-            required: true,
-            description: "epicId parameter",
-            cli: { positional: true }
-          }
-        ]
-      },
+      // pipeline.release.ship removed in T9540 (Phase 6 of T9499) — the legacy
+      // `releaseShip` monolith was deleted. `cleo release ship` is still a
+      // deprecated CLI alias (R-420) but now forwards to `release.plan` +
+      // `release.open` (handled by the release domain), not the pipeline domain.
       {
         gateway: "mutate",
         domain: "pipeline",
@@ -11808,9 +11973,9 @@ var init_registry = __esm({
         gateway: "mutate",
         domain: "orchestrate",
         operation: "worktree.complete",
-        description: "orchestrate.worktree.complete (mutate) \u2014 merge (--no-ff) a task worktree branch into the project default branch (preserves agent commit SHAs per ADR-062) and clean up the worktree",
+        description: "orchestrate.worktree.complete (mutate) \u2014 merge (--no-ff) a task worktree branch into the project default branch (preserves agent commit SHAs per ADR-062) and clean up the worktree. T9548: idempotent (re-run on completed worktree = no-op).",
         tier: 2,
-        idempotent: false,
+        idempotent: true,
         sessionRequired: false,
         requiredParams: ["taskId"],
         params: [
@@ -11819,6 +11984,12 @@ var init_registry = __esm({
             type: "string",
             required: true,
             description: "Task ID whose worktree should be merged and cleaned up"
+          },
+          {
+            name: "resolve",
+            type: "string",
+            required: false,
+            description: 'T9548 conflict-recovery mode: "auto" (default \u2014 attempt git merge --no-ff) or "manual" (skip merge, mark worktree as manually-handled in audit log)'
           }
         ]
       },
@@ -12134,14 +12305,21 @@ var init_registry = __esm({
           }
         ]
       },
-      // release mutate: start (T1597 / ADR-063 canonical step 1)
+      // release.start / release.verify / release.publish removed in T9540
+      // (Phase 6 of T9499) — backing functions in
+      // `packages/core/src/release/pipeline.ts` (the legacy 4-step pipeline)
+      // were deleted. The canonical replacement surface is the SPEC-T9345
+      // 4-verb pipeline registered below: `release.plan`, `release.open`,
+      // `release.reconcile`, plus `cleo verify <task> --gate X --evidence …`
+      // for per-task gate verification (R-422 / ADR-051).
+      // release mutate: reconcile (T9526 / SPEC-T9345 §4.4 — v2 reconcile verb)
       {
         gateway: "mutate",
         domain: "release",
-        operation: "start",
-        description: "release.start (mutate) \u2014 Step 1 of 4: validate version, capture branch, persist release handle (T1597 / ADR-063)",
+        operation: "reconcile",
+        description: "release.reconcile (mutate) \u2014 v2 reconcile verb: backfill the 11 provenance tables from git log + gh api. Single SQLite TX, UPSERT-everywhere, idempotent (T9526 / SPEC-T9345 \xA74.4).",
         tier: 1,
-        idempotent: false,
+        idempotent: true,
         sessionRequired: false,
         requiredParams: ["version"],
         params: [
@@ -12149,70 +12327,90 @@ var init_registry = __esm({
             name: "version",
             type: "string",
             required: true,
-            description: "Version to release (e.g. 2026.5.4)",
-            cli: { positional: true }
+            description: "Version string whose tag has landed on main (e.g. v2026.6.0)"
           },
           {
-            name: "epicId",
-            type: "string",
+            name: "fromWorkflow",
+            type: "boolean",
             required: false,
-            description: "Epic ID this release ships"
+            description: "Indicates invocation from release-publish.yml (affects logging only)"
           },
           {
-            name: "branch",
-            type: "string",
+            name: "rollback",
+            type: "boolean",
             required: false,
-            description: "Override detected branch"
+            description: "Reconcile a rollback rather than a publish (deferred to T9528)"
           }
         ]
       },
-      // release query: verify (T1597 / ADR-063 canonical step 2)
-      {
-        gateway: "query",
-        domain: "release",
-        operation: "verify",
-        description: "release.verify (query) \u2014 Step 2 of 4: run gates + audit child tasks of the active release epic (T1597 / ADR-063)",
-        tier: 1,
-        idempotent: true,
-        sessionRequired: false,
-        requiredParams: [],
-        params: []
-      },
-      // release mutate: publish (T1597 / ADR-063 canonical step 3)
+      // ---------------------------------------------------------------------------
+      // Provenance domain — `cleo provenance` CLI surface (T9528 · Phase 2 of T9493)
+      // ---------------------------------------------------------------------------
+      // provenance mutate: backfill (T9528 / SPEC-T9345 §8.3)
       {
         gateway: "mutate",
-        domain: "release",
-        operation: "publish",
-        description: "release.publish (mutate) \u2014 Step 3 of 4: invoke project-context publish.command to publish the release artifact (T1597 / ADR-063)",
+        domain: "provenance",
+        operation: "backfill",
+        description: "provenance.backfill (mutate) \u2014 walk historical git tags from --since forward and populate the 11 provenance tables. UPSERT-everywhere, idempotent, restartable via .cleo/release/backfill-state.json (T9528 / SPEC-T9345 \xA78.3).",
         tier: 1,
-        idempotent: false,
+        idempotent: true,
         sessionRequired: false,
-        requiredParams: [],
+        requiredParams: ["since"],
         params: [
+          {
+            name: "since",
+            type: "string",
+            required: true,
+            description: "Lower-bound version (exclusive). Empty string = walk every reachable tag from the beginning of history."
+          },
+          {
+            name: "forceOverwrite",
+            type: "boolean",
+            required: false,
+            description: "UPDATE existing rows on conflict (audit-logged). Default: UPSERT only."
+          },
           {
             name: "dryRun",
             type: "boolean",
             required: false,
-            description: "Print command without executing"
+            description: "Enumerate the tag set and return the plan without writing to the DB"
+          },
+          {
+            name: "resetCheckpoint",
+            type: "boolean",
+            required: false,
+            description: "Clear .cleo/release/backfill-state.json before starting (do NOT resume)"
           }
         ]
       },
-      // release mutate: reconcile (T1597 / ADR-063 canonical step 4)
+      // provenance query: verify (T9529 / SPEC-T9345 §4.6)
       {
-        gateway: "mutate",
-        domain: "release",
-        operation: "reconcile",
-        description: "release.reconcile (mutate) \u2014 Step 4 of 4: run post-release invariants, auto-complete tasks for the active release (T1597 / ADR-063)",
+        gateway: "query",
+        domain: "provenance",
+        operation: "verify",
+        description: "provenance.verify (query) \u2014 READ-ONLY audit of the 11 provenance tables for a release. Checks FK integrity (release_commits, task_commits, pr_commits, pr_tasks, release_changes, release_artifacts), orphan rows, and ADR-051 evidence-atom staleness. Exit code 0 on pass, non-zero on any fail (T9529 / SPEC-T9345 \xA74.6).",
         tier: 1,
-        idempotent: false,
+        idempotent: true,
         sessionRequired: false,
         requiredParams: [],
         params: [
           {
-            name: "dryRun",
+            name: "version",
+            type: "string",
+            required: false,
+            description: "Release version to verify (e.g. v2026.6.0). Required unless --all is set."
+          },
+          {
+            name: "all",
             type: "boolean",
             required: false,
-            description: "Preview without mutations"
+            description: "Verify the most-recent N releases instead of a single version"
+          },
+          {
+            name: "limit",
+            type: "number",
+            required: false,
+            description: "How many releases to verify in --all mode (default 5)"
           }
         ]
       },
@@ -12448,6 +12646,59 @@ var init_registry = __esm({
             description: "Optional credential label to pin this role to a specific store entry"
           }
         ]
+      },
+      // ---------------------------------------------------------------------------
+      // Upgrade domain — `cleo upgrade workflows` (T9536 · Phase 4 of T9497)
+      // ---------------------------------------------------------------------------
+      // upgrade query: workflows — read-only drift detection.
+      {
+        gateway: "query",
+        domain: "upgrade",
+        operation: "workflows",
+        description: "upgrade.workflows (query) \u2014 re-render the four release-pipeline workflow templates and report drift against .github/workflows/release-*.yml. Read-only (forces dryRun). Honours .workflow-overrides.yml for operator-declared customizations (T9536).",
+        tier: 2,
+        idempotent: true,
+        sessionRequired: false,
+        requiredParams: [],
+        params: [
+          {
+            name: "includeRendered",
+            type: "boolean",
+            required: false,
+            description: "Include the freshly rendered YAML in the response (for diff display)"
+          }
+        ]
+      },
+      // upgrade mutate: workflows — re-render + optional re-write with --force.
+      {
+        gateway: "mutate",
+        domain: "upgrade",
+        operation: "workflows",
+        description: "upgrade.workflows (mutate) \u2014 re-render the four release-pipeline workflow templates; with force=true, overwrite drifted files and audit-log to .cleo/audit/upgrade-workflows.jsonl. .workflow-overrides.yml entries are preserved (operator-declared customization). hasDrift flag in the response drives the --check exit-code contract (T9536).",
+        tier: 2,
+        idempotent: true,
+        sessionRequired: false,
+        requiredParams: [],
+        params: [
+          {
+            name: "force",
+            type: "boolean",
+            required: false,
+            description: "Overwrite drifted files (excluding .workflow-overrides.yml keys)"
+          },
+          {
+            name: "dryRun",
+            type: "boolean",
+            required: false,
+            description: "Print the per-template diff without writing"
+          },
+          {
+            name: "includeRendered",
+            type: "boolean",
+            required: false,
+            description: "Include the freshly rendered YAML in the response (for diff display)"
+          }
+        ]
       }
     ];
     counts = getCounts();
@@ -12581,8 +12832,8 @@ var init_dispatcher = __esm({
                 projectRoot
               });
             }).catch((err) => {
-              const log5 = getLogger("dialectic-hook");
-              log5.warn({ err }, "dialectic-evaluator failed");
+              const log8 = getLogger("dialectic-hook");
+              log8.warn({ err }, "dialectic-evaluator failed");
             });
           });
         }
@@ -12723,8 +12974,6 @@ __export(engine_exports, {
   lifecycleReset: () => lifecycleReset,
   lifecycleSkip: () => lifecycleSkip,
   lifecycleStatus: () => lifecycleStatus,
-  loadActiveReleaseHandle: () => loadActiveReleaseHandle,
-  makeAdr061GateRunner: () => makeAdr061GateRunner,
   mapCodebase: () => mapCodebase,
   memoryBrainStats: () => memoryBrainStats,
   memoryContradictions: () => memoryContradictions,
@@ -12802,18 +13051,16 @@ __export(engine_exports, {
   releaseGatesRun: () => releaseGatesRun,
   releaseIvtrAutoSuggest: () => releaseIvtrAutoSuggest,
   releaseList: () => releaseList,
+  releaseOpen: () => releaseOpen,
+  releasePlan: () => releasePlan,
   releasePrStatus: () => releasePrStatus,
   releasePrepare: () => releasePrepare,
-  releasePublish: () => releasePublish,
   releasePush: () => releasePush,
-  releaseReconcile: () => releaseReconcile,
+  releaseReconcileV2: () => releaseReconcileV2,
   releaseRollback: () => releaseRollback,
   releaseRollbackFull: () => releaseRollbackFull,
-  releaseShip: () => releaseShip,
   releaseShow: () => releaseShow,
-  releaseStart: () => releaseStart,
   releaseTag: () => releaseTag,
-  releaseVerify: () => releaseVerify,
   sessionArchive: () => sessionArchive,
   sessionBriefing: () => sessionBriefing,
   sessionChainShow: () => sessionChainShow,
@@ -12954,8 +13201,6 @@ import {
   lifecycleReset,
   lifecycleSkip,
   lifecycleStatus,
-  loadActiveReleaseHandle,
-  makeAdr061GateRunner,
   mapCodebase,
   memoryBrainStats,
   memoryContradictions,
@@ -13032,18 +13277,16 @@ import {
   releaseGatesRun,
   releaseIvtrAutoSuggest,
   releaseList,
+  releaseOpen,
+  releasePlan,
   releasePrepare,
   releasePrStatus,
-  releasePublish,
   releasePush,
-  releaseReconcile,
+  releaseReconcileV2,
   releaseRollback,
   releaseRollbackFull,
-  releaseShip,
   releaseShow,
-  releaseStart,
   releaseTag,
-  releaseVerify,
   sessionArchive,
   sessionBriefing,
   sessionChainShow,
@@ -24594,8 +24837,8 @@ async function loadPlaybookByName(name) {
     return null;
   }
   try {
-    const { getProjectRoot: getProjectRoot34 } = await import("@cleocode/core/internal");
-    const projectRoot = __playbookRuntimeOverrides.projectRoot ?? getProjectRoot34();
+    const { getProjectRoot: getProjectRoot38 } = await import("@cleocode/core/internal");
+    const projectRoot = __playbookRuntimeOverrides.projectRoot ?? getProjectRoot38();
     const resolved = resolvePlaybook(name, {
       projectRoot,
       globalPlaybooksDir: __playbookRuntimeOverrides.globalPlaybooksDir,
@@ -24639,8 +24882,8 @@ async function acquireDb() {
 async function buildDefaultDispatcher() {
   if (__playbookRuntimeOverrides.dispatcher) return __playbookRuntimeOverrides.dispatcher;
   const { orchestrateSpawnExecute: orchestrateSpawnExecute2 } = await Promise.resolve().then(() => (init_engine(), engine_exports));
-  const { getProjectRoot: getProjectRoot34 } = await import("@cleocode/core/internal");
-  const projectRoot = getProjectRoot34();
+  const { getProjectRoot: getProjectRoot38 } = await import("@cleocode/core/internal");
+  const projectRoot = getProjectRoot38();
   return {
     async dispatch(input2) {
       try {
@@ -24830,8 +25073,8 @@ var init_playbook2 = __esm({
             projectRoot = __playbookRuntimeOverrides.projectRoot;
           } else {
             try {
-              const { getProjectRoot: getProjectRoot34 } = await import("@cleocode/core/internal");
-              projectRoot = getProjectRoot34();
+              const { getProjectRoot: getProjectRoot38 } = await import("@cleocode/core/internal");
+              projectRoot = getProjectRoot38();
             } catch {
               projectRoot = void 0;
             }
@@ -24895,14 +25138,14 @@ var init_playbook2 = __esm({
         const dispatcher = await buildDefaultDispatcher();
         let result;
         try {
-          const { getProjectRoot: getProjectRoot34 } = await import("@cleocode/core/internal");
+          const { getProjectRoot: getProjectRoot38 } = await import("@cleocode/core/internal");
           const opts = {
             db,
             playbook: parsed.definition,
             playbookHash: parsed.sourceHash,
             initialContext,
             dispatcher,
-            projectRoot: getProjectRoot34()
+            projectRoot: getProjectRoot38()
           };
           if (__playbookRuntimeOverrides.approvalSecret !== void 0) {
             opts.approvalSecret = __playbookRuntimeOverrides.approvalSecret;
@@ -25238,7 +25481,7 @@ async function orchestratePivotOp(params) {
   }
 }
 async function orchestrateWorktreeCompleteOp(params) {
-  return handleWorktreeComplete(params.taskId, getProjectRoot9());
+  return handleWorktreeComplete(params.taskId, getProjectRoot9(), params.resolve);
 }
 async function orchestrateWorktreeCleanupOp(params) {
   return handleWorktreeCleanup(getProjectRoot9(), params.taskIds);
@@ -25485,16 +25728,23 @@ async function orchestrateAnalyzeParallelSafety(taskIds, projectRoot) {
     };
   }
 }
-async function handleWorktreeComplete(taskId, projectRoot) {
+async function handleWorktreeComplete(taskId, projectRoot, resolve8) {
   try {
-    const { completeAgentWorktreeViaMerge } = await import("@cleocode/core/internal");
-    const result = completeAgentWorktreeViaMerge(taskId, projectRoot);
-    if (!result.merged && result.error) {
+    const { completeWorktreeForTask } = await import("@cleocode/core/internal");
+    const result = completeWorktreeForTask(taskId, projectRoot, {
+      resolve: resolve8 ?? "auto"
+    });
+    if (result.outcome === "conflict") {
       return {
         success: false,
         error: {
           code: "E_WORKTREE_COMPLETE_FAILED",
-          message: result.error
+          message: result.reason,
+          details: {
+            taskId: result.taskId,
+            integration: result.integration,
+            recovery: result.recovery
+          }
         }
       };
     }
@@ -26149,7 +26399,12 @@ var init_orchestrate2 = __esm({
                   "taskId is required",
                   startTime
                 );
-              const p = { taskId: params.taskId };
+              const rawResolve = params.resolve;
+              const resolve8 = rawResolve === "manual" ? "manual" : rawResolve === "auto" ? "auto" : void 0;
+              const p = {
+                taskId: params.taskId,
+                ...resolve8 !== void 0 ? { resolve: resolve8 } : {}
+              };
               return wrapResult(
                 await coreOps2["worktree.complete"](p),
                 "mutate",
@@ -26483,19 +26738,6 @@ async function releaseChannelShowOp(_params) {
 async function releaseChangelogSinceOp(params) {
   return releaseChangelogSince(params.sinceTag, getProjectRoot10());
 }
-async function releaseShipOp(params) {
-  return releaseShip(
-    {
-      version: params.version,
-      epicId: params.epicId,
-      remote: params.remote,
-      dryRun: params.dryRun,
-      bump: params.bump,
-      force: params.force
-    },
-    getProjectRoot10()
-  );
-}
 async function releasePrStatusOp(params) {
   return releasePrStatus(params.version, getProjectRoot10());
 }
@@ -26655,7 +26897,6 @@ var init_pipeline3 = __esm({
       "release.show": releaseShowOp,
       "release.channel.show": releaseChannelShowOp,
       "release.changelog.since": releaseChangelogSinceOp,
-      "release.ship": releaseShipOp,
       "release.pr-status": releasePrStatusOp,
       "release.cancel": releaseCancelOp,
       "release.rollback": releaseRollbackOp,
@@ -26802,13 +27043,12 @@ var init_pipeline3 = __esm({
       },
       // -------------------------------------------------------------------------
       // Release mutations
+      //
+      // T9540 removed `release.ship` from the pipeline domain — the
+      // `cleo release ship` CLI alias now forwards to `release.plan` +
+      // `release.open` (handled by the release domain), not the deleted
+      // `releaseShip` monolith.
       // -------------------------------------------------------------------------
-      "release.ship": async (params) => {
-        if (!params.version || !params.epicId) {
-          return lafsError("E_INVALID_INPUT", "version and epicId are required", "release.ship");
-        }
-        return wrapCoreResult(await coreOps3["release.ship"](params), "release.ship");
-      },
       // release.pr-status — T9095 query: poll CI checks for an in-progress release PR
       "release.pr-status": async (params) => {
         if (!params.version) {
@@ -27028,7 +27268,6 @@ var init_pipeline3 = __esm({
           "stage.reset",
           "stage.gate.pass",
           "stage.gate.fail",
-          "release.ship",
           "release.cancel",
           "release.rollback",
           "release.rollback.full",
@@ -27102,7 +27341,6 @@ var init_pipeline3 = __esm({
             "stage.reset",
             "stage.gate.pass",
             "stage.gate.fail",
-            "release.ship",
             "release.cancel",
             "release.rollback",
             "release.rollback.full",
@@ -27122,22 +27360,144 @@ var init_pipeline3 = __esm({
   }
 });
 
+// packages/cleo/src/dispatch/domains/provenance.ts
+import {
+  getLogger as getLogger11,
+  getProjectRoot as getProjectRoot11,
+  provenanceBackfill,
+  verifyProvenance
+} from "@cleocode/core/internal";
+var log2, ProvenanceHandler;
+var init_provenance = __esm({
+  "packages/cleo/src/dispatch/domains/provenance.ts"() {
+    "use strict";
+    init_base();
+    log2 = getLogger11("domain:provenance");
+    ProvenanceHandler = class {
+      // -----------------------------------------------------------------------
+      // Query
+      // -----------------------------------------------------------------------
+      /**
+       * Provenance query operations. Currently only `verify` is implemented.
+       *
+       * @param operation - The provenance query op name (`verify`).
+       * @param params    - The dispatch params object: `version`, `all`, `limit`.
+       */
+      async query(operation, params) {
+        const startTime = Date.now();
+        try {
+          switch (operation) {
+            // ------------------------------------------------------------------
+            // provenance.verify — T9529 / SPEC-T9345 §4.6
+            // ------------------------------------------------------------------
+            case "verify": {
+              const version = typeof params?.["version"] === "string" ? params["version"] : void 0;
+              const all = typeof params?.["all"] === "boolean" ? params["all"] : false;
+              const limit = typeof params?.["limit"] === "number" ? params["limit"] : void 0;
+              if (!version && !all) {
+                return errorResult(
+                  "query",
+                  "provenance",
+                  operation,
+                  "E_INVALID_INPUT",
+                  "verify requires either <version> or --all",
+                  startTime
+                );
+              }
+              const result = await verifyProvenance({
+                ...version ? { version } : {},
+                all,
+                ...limit !== void 0 ? { limit } : {},
+                projectRoot: getProjectRoot11()
+              });
+              return wrapResult(result, "query", "provenance", operation, startTime);
+            }
+            default:
+              return unsupportedOp("query", "provenance", operation, startTime);
+          }
+        } catch (err) {
+          log2.error({ err, operation }, "ProvenanceHandler query error");
+          return handleErrorResult("query", "provenance", operation, err, startTime);
+        }
+      }
+      // -----------------------------------------------------------------------
+      // Mutate
+      // -----------------------------------------------------------------------
+      /**
+       * Provenance mutate operations. Currently only `backfill` is implemented.
+       *
+       * @param operation - The provenance mutate op name (`backfill`).
+       * @param params    - The dispatch params object: `since`, `forceOverwrite`,
+       *                    `dryRun`, `resetCheckpoint`.
+       */
+      async mutate(operation, params) {
+        const startTime = Date.now();
+        try {
+          switch (operation) {
+            // ------------------------------------------------------------------
+            // provenance.backfill — T9528 / SPEC-T9345 §8.3
+            // ------------------------------------------------------------------
+            case "backfill": {
+              const since = typeof params?.["since"] === "string" ? params["since"] : void 0;
+              if (since === void 0) {
+                return errorResult(
+                  "mutate",
+                  "provenance",
+                  operation,
+                  "E_INVALID_INPUT",
+                  'since is required (use --since "" to walk every reachable tag)',
+                  startTime
+                );
+              }
+              const forceOverwrite = typeof params?.["forceOverwrite"] === "boolean" ? params["forceOverwrite"] : false;
+              const dryRun = typeof params?.["dryRun"] === "boolean" ? params["dryRun"] : false;
+              const resetCheckpoint = typeof params?.["resetCheckpoint"] === "boolean" ? params["resetCheckpoint"] : false;
+              const result = await provenanceBackfill({
+                since,
+                projectRoot: getProjectRoot11(),
+                forceOverwrite,
+                dryRun,
+                resetCheckpoint
+              });
+              return wrapResult(result, "mutate", "provenance", operation, startTime);
+            }
+            default:
+              return unsupportedOp("mutate", "provenance", operation, startTime);
+          }
+        } catch (err) {
+          log2.error({ err, operation }, "ProvenanceHandler mutate error");
+          return handleErrorResult("mutate", "provenance", operation, err, startTime);
+        }
+      }
+      // -----------------------------------------------------------------------
+      // getSupportedOperations
+      // -----------------------------------------------------------------------
+      /** Return declared operations for introspection and registry validation. */
+      getSupportedOperations() {
+        return {
+          query: ["verify"],
+          mutate: ["backfill"]
+        };
+      }
+    };
+  }
+});
+
 // packages/cleo/src/dispatch/domains/release.ts
-import { getLogger as getLogger11, getProjectRoot as getProjectRoot11 } from "@cleocode/core/internal";
+import { getLogger as getLogger12, getProjectRoot as getProjectRoot12 } from "@cleocode/core/internal";
 async function releaseGateOp(params) {
-  return releaseGateCheck(params.epicId, params.force ?? false, getProjectRoot11());
+  return releaseGateCheck(params.epicId, params.force ?? false, getProjectRoot12());
 }
 async function releaseIvtrSuggestOp(params) {
-  return releaseIvtrAutoSuggest(params.taskId, getProjectRoot11());
+  return releaseIvtrAutoSuggest(params.taskId, getProjectRoot12());
 }
-var log2, coreOps4, ReleaseHandler;
+var log3, coreOps4, ReleaseHandler;
 var init_release2 = __esm({
   "packages/cleo/src/dispatch/domains/release.ts"() {
     "use strict";
     init_engine();
     init_base();
-    init_meta2();
-    log2 = getLogger11("domain:release");
+    log3 = getLogger12("domain:release");
     coreOps4 = {
       gate: releaseGateOp,
       "ivtr-suggest": releaseIvtrSuggestOp
@@ -27152,7 +27512,10 @@ var init_release2 = __esm({
        * Supported operations:
        * - `gate`         — check IVTR phase state for all tasks in a release epic
        * - `ivtr-suggest` — check if all epic tasks are released and suggest `release ship`
-       * - `verify`       — Step 2 of 4: run gates + audit child tasks (T1597 / ADR-063)
+       *
+       * The legacy `verify` query (run gates + audit child tasks) was removed
+       * in T9540 — use `cleo verify <task> --gate X --evidence …` per
+       * SPEC-T9345 §12 R-422 / ADR-051.
        */
       async query(operation, params) {
         const startTime = Date.now();
@@ -27195,24 +27558,11 @@ var init_release2 = __esm({
                 startTime
               );
             }
-            // release.verify — Step 2 of 4: run gates + audit child tasks (T1597 / ADR-063)
-            case "verify": {
-              const projectRoot = getProjectRoot11();
-              const handle = loadActiveReleaseHandle(projectRoot);
-              const result = await releaseVerify(handle, {
-                runGate: makeAdr061GateRunner(projectRoot)
-              });
-              return {
-                success: true,
-                data: result,
-                meta: dispatchMeta("query", "release", operation, startTime)
-              };
-            }
             default:
               return unsupportedOp("query", "release", operation, startTime);
           }
         } catch (err) {
-          log2.error({ err, operation }, "ReleaseHandler query error");
+          log3.error({ err, operation }, "ReleaseHandler query error");
           return handleErrorResult("query", "release", operation, err, startTime);
         }
       }
@@ -27229,9 +27579,14 @@ var init_release2 = __esm({
        * Supported operations:
        * - `gate`         — same IVTR gate check as query.gate (no DB writes)
        * - `ivtr-suggest` — same auto-suggest as query.ivtr-suggest (no DB writes)
-       * - `start`        — Step 1 of 4: validate version, capture branch, persist handle
-       * - `publish`      — Step 3 of 4: invoke project-context publish.command
-       * - `reconcile`    — Step 4 of 4: run post-release invariants, auto-complete tasks
+       * - `plan`         — SPEC-T9345 §4.2 (T9525): build canonical Release Plan envelope
+       * - `open`         — SPEC-T9345 §4.3 (T9530): dispatch release-prepare workflow
+       * - `reconcile`    — SPEC-T9345 §4.4 (T9526 v2): backfill 11 provenance tables
+       *
+       * The legacy `start` / `publish` mutations (and the legacy v1
+       * `reconcile`) were removed in T9540 — their backing functions in
+       * `packages/core/src/release/pipeline.ts` were deleted as part of
+       * Phase 6 of T9499.
        */
       async mutate(operation, params) {
         const startTime = Date.now();
@@ -27274,10 +27629,11 @@ var init_release2 = __esm({
                 startTime
               );
             }
-            // release.start — Step 1 of 4 (T1597 / ADR-063)
-            case "start": {
+            // release.plan — SPEC-T9345 §4.2 (T9525): build canonical Release Plan envelope
+            case "plan": {
               const version = typeof params?.version === "string" ? params.version : void 0;
-              if (!version)
+              const epicId = typeof params?.epicId === "string" ? params.epicId : void 0;
+              if (!version) {
                 return errorResult(
                   "mutate",
                   "release",
@@ -27286,45 +27642,74 @@ var init_release2 = __esm({
                   "version is required",
                   startTime
                 );
-              const result = await releaseStart(version, {
-                epicId: typeof params?.epicId === "string" ? params.epicId : void 0,
-                branch: typeof params?.branch === "string" ? params.branch : void 0
-              });
-              return {
-                success: true,
-                data: result,
-                meta: dispatchMeta("mutate", "release", operation, startTime)
+              }
+              if (!epicId) {
+                return errorResult(
+                  "mutate",
+                  "release",
+                  operation,
+                  "E_INVALID_INPUT",
+                  "epicId is required",
+                  startTime
+                );
+              }
+              const typed = {
+                version,
+                epicId,
+                scheme: typeof params?.scheme === "string" ? params.scheme : void 0,
+                channel: typeof params?.channel === "string" ? params.channel : void 0,
+                hotfix: typeof params?.hotfix === "boolean" ? params.hotfix : false,
+                dryRun: typeof params?.dryRun === "boolean" ? params.dryRun : false,
+                projectRoot: getProjectRoot12()
               };
+              return wrapResult(await releasePlan(typed), "mutate", "release", operation, startTime);
             }
-            // release.publish — Step 3 of 4 (T1597 / ADR-063)
-            case "publish": {
-              const handle = loadActiveReleaseHandle(getProjectRoot11());
-              const result = await releasePublish(handle, {
-                dryRun: typeof params?.dryRun === "boolean" ? params.dryRun : false
-              });
-              return {
-                success: true,
-                data: result,
-                meta: dispatchMeta("mutate", "release", operation, startTime)
+            // release.open — SPEC-T9345 §4.3 (T9530): dispatch release-prepare workflow
+            case "open": {
+              const version = typeof params?.version === "string" ? params.version : void 0;
+              if (!version) {
+                return errorResult(
+                  "mutate",
+                  "release",
+                  operation,
+                  "E_INVALID_INPUT",
+                  "version is required",
+                  startTime
+                );
+              }
+              const typed = {
+                version,
+                workflow: typeof params?.workflow === "string" ? params.workflow : void 0,
+                watch: typeof params?.watch === "boolean" ? params.watch : false,
+                commitPlan: typeof params?.commitPlan === "boolean" ? params.commitPlan : false,
+                projectRoot: getProjectRoot12()
               };
+              return wrapResult(await releaseOpen(typed), "mutate", "release", operation, startTime);
             }
-            // release.reconcile — Step 4 of 4 (T1597 / ADR-063)
+            // release.reconcile — v2 reconcile verb (T9526 / SPEC-T9345 §4.4)
             case "reconcile": {
-              const handle = loadActiveReleaseHandle(getProjectRoot11());
-              const result = await releaseReconcile(handle, {
-                dryRun: typeof params?.dryRun === "boolean" ? params.dryRun : false
+              const version = typeof params?.version === "string" ? params.version : void 0;
+              if (!version)
+                return errorResult(
+                  "mutate",
+                  "release",
+                  operation,
+                  "E_INVALID_INPUT",
+                  "version is required",
+                  startTime
+                );
+              const result = await releaseReconcileV2(version, {
+                projectRoot: getProjectRoot12(),
+                fromWorkflow: typeof params?.fromWorkflow === "boolean" ? params.fromWorkflow : false,
+                rollback: typeof params?.rollback === "boolean" ? params.rollback : false
               });
-              return {
-                success: true,
-                data: result,
-                meta: dispatchMeta("mutate", "release", operation, startTime)
-              };
+              return wrapResult(result, "mutate", "release", operation, startTime);
             }
             default:
               return unsupportedOp("mutate", "release", operation, startTime);
           }
         } catch (err) {
-          log2.error({ err, operation }, "ReleaseHandler mutate error");
+          log3.error({ err, operation }, "ReleaseHandler mutate error");
           return handleErrorResult("mutate", "release", operation, err, startTime);
         }
       }
@@ -27334,8 +27719,8 @@ var init_release2 = __esm({
       /** Return declared operations for introspection and registry validation. */
       getSupportedOperations() {
         return {
-          query: ["gate", "ivtr-suggest", "verify"],
-          mutate: ["gate", "ivtr-suggest", "start", "publish", "reconcile"]
+          query: ["gate", "ivtr-suggest"],
+          mutate: ["gate", "ivtr-suggest", "reconcile", "plan", "open"]
         };
       }
     };
@@ -27343,7 +27728,7 @@ var init_release2 = __esm({
 });
 
 // packages/cleo/src/dispatch/domains/sentient.ts
-import { getProjectRoot as getProjectRoot12 } from "@cleocode/core";
+import { getProjectRoot as getProjectRoot13 } from "@cleocode/core";
 import {
   sentientAllowlistAdd,
   sentientAllowlistList,
@@ -27363,16 +27748,16 @@ var init_sentient2 = __esm({
     init_typed();
     init_base();
     coreOps5 = {
-      "propose.list": (params) => sentientProposeList(getProjectRoot12(), params),
-      "propose.diff": (params) => sentientProposeDiff(getProjectRoot12(), params),
-      "allowlist.list": (params) => sentientAllowlistList(getProjectRoot12(), params),
-      "propose.accept": (params) => sentientProposeAccept(getProjectRoot12(), params),
-      "propose.reject": (params) => sentientProposeReject(getProjectRoot12(), params),
-      "propose.run": (params) => sentientProposeRun(getProjectRoot12(), params),
-      "propose.enable": (params) => sentientProposeEnable(getProjectRoot12(), params),
-      "propose.disable": (params) => sentientProposeDisable(getProjectRoot12(), params),
-      "allowlist.add": (params) => sentientAllowlistAdd(getProjectRoot12(), params),
-      "allowlist.remove": (params) => sentientAllowlistRemove(getProjectRoot12(), params)
+      "propose.list": (params) => sentientProposeList(getProjectRoot13(), params),
+      "propose.diff": (params) => sentientProposeDiff(getProjectRoot13(), params),
+      "allowlist.list": (params) => sentientAllowlistList(getProjectRoot13(), params),
+      "propose.accept": (params) => sentientProposeAccept(getProjectRoot13(), params),
+      "propose.reject": (params) => sentientProposeReject(getProjectRoot13(), params),
+      "propose.run": (params) => sentientProposeRun(getProjectRoot13(), params),
+      "propose.enable": (params) => sentientProposeEnable(getProjectRoot13(), params),
+      "propose.disable": (params) => sentientProposeDisable(getProjectRoot13(), params),
+      "allowlist.add": (params) => sentientAllowlistAdd(getProjectRoot13(), params),
+      "allowlist.remove": (params) => sentientAllowlistRemove(getProjectRoot13(), params)
     };
     _sentientTypedHandler = defineTypedHandler("sentient", {
       // -------------------------------------------------------------------------
@@ -27602,28 +27987,28 @@ var init_session_context = __esm({
 });
 
 // packages/cleo/src/dispatch/domains/session.ts
-import { getDb, getLogger as getLogger12, getProjectRoot as getProjectRoot13, sessions } from "@cleocode/core/internal";
+import { getDb, getLogger as getLogger13, getProjectRoot as getProjectRoot14, sessions } from "@cleocode/core/internal";
 import { eq } from "drizzle-orm";
 async function sessionStatusOp() {
-  return sessionStatus(getProjectRoot13());
+  return sessionStatus(getProjectRoot14());
 }
 async function sessionListOp(params) {
-  return sessionList(getProjectRoot13(), params);
+  return sessionList(getProjectRoot14(), params);
 }
 async function sessionShowOp(params) {
   if (params.include === "debrief") {
-    return sessionDebriefShow(getProjectRoot13(), params.sessionId);
+    return sessionDebriefShow(getProjectRoot14(), params.sessionId);
   }
-  return sessionShow(getProjectRoot13(), params.sessionId);
+  return sessionShow(getProjectRoot14(), params.sessionId);
 }
 async function sessionFindOp(params) {
-  return sessionFind(getProjectRoot13(), params);
+  return sessionFind(getProjectRoot14(), params);
 }
 async function sessionDecisionLogOp(params) {
-  return sessionDecisionLog(getProjectRoot13(), params);
+  return sessionDecisionLog(getProjectRoot14(), params);
 }
 async function sessionContextDriftOp(params) {
-  return sessionContextDrift(getProjectRoot13(), params);
+  return sessionContextDrift(getProjectRoot14(), params);
 }
 async function sessionHandoffShowOp(params) {
   let scopeFilter;
@@ -27634,33 +28019,33 @@ async function sessionHandoffShowOp(params) {
       scopeFilter = { type: "epic", epicId: params.scope.replace("epic:", "") };
     }
   }
-  return sessionHandoff(getProjectRoot13(), scopeFilter);
+  return sessionHandoff(getProjectRoot14(), scopeFilter);
 }
 async function sessionBriefingShowOp(params) {
-  return sessionBriefing(getProjectRoot13(), params);
+  return sessionBriefing(getProjectRoot14(), params);
 }
 async function sessionStartOp(params) {
-  return sessionStart(getProjectRoot13(), params);
+  return sessionStart(getProjectRoot14(), params);
 }
 async function sessionEndOp(params) {
-  return sessionEnd(getProjectRoot13(), params.note, {
+  return sessionEnd(getProjectRoot14(), params.note, {
     sessionSummary: params.sessionSummary
   });
 }
 async function sessionResumeOp(params) {
-  return sessionResume(getProjectRoot13(), params.sessionId);
+  return sessionResume(getProjectRoot14(), params.sessionId);
 }
 async function sessionSuspendOp(params) {
-  return sessionSuspend(getProjectRoot13(), params.sessionId, params.reason);
+  return sessionSuspend(getProjectRoot14(), params.sessionId, params.reason);
 }
 async function sessionGcOp(params) {
-  return sessionGc(getProjectRoot13(), params.maxAgeDays);
+  return sessionGc(getProjectRoot14(), params.maxAgeDays);
 }
 async function sessionRecordDecisionOp(params) {
-  return sessionRecordDecision(getProjectRoot13(), params);
+  return sessionRecordDecision(getProjectRoot14(), params);
 }
 async function sessionRecordAssumptionOp(params) {
-  return sessionRecordAssumption(getProjectRoot13(), params);
+  return sessionRecordAssumption(getProjectRoot14(), params);
 }
 async function storeSessionOwnerAuthToken(projectRoot, sessionId, token) {
   const db = await getDb(projectRoot);
@@ -27749,7 +28134,7 @@ var init_session3 = __esm({
       // SSoT-EXEMPT: storeOwnerAuthToken (DB side-effect requiring post-create sessionId),
       // bindSession (process-scoped context, requires scope-string parsing) — ADR-058
       start: async (params) => {
-        const projectRoot = getProjectRoot13();
+        const projectRoot = getProjectRoot14();
         if (!params.scope) {
           return lafsError("E_INVALID_INPUT", "scope is required", "start");
         }
@@ -27770,7 +28155,7 @@ var init_session3 = __esm({
           try {
             await storeSessionOwnerAuthToken(projectRoot, sessionId, params.ownerAuthToken);
           } catch (err) {
-            getLogger12("domain:session").warn(
+            getLogger13("domain:session").warn(
               { sessionId, err },
               "Failed to store owner_auth_token \u2014 override auth will not be available"
             );
@@ -27788,7 +28173,7 @@ var init_session3 = __esm({
             gradeMode: params.grade ?? false
           });
         } catch {
-          getLogger12("domain:session").warn(
+          getLogger13("domain:session").warn(
             { sessionId },
             "Session context already bound, skipping bindSession"
           );
@@ -27798,7 +28183,7 @@ var init_session3 = __esm({
       // SSoT-EXEMPT: orchestrated post-op pipeline — sessionComputeDebrief, persistSessionMemory,
       // unbindSession (process-context teardown), refreshMemoryBridge — ADR-058
       end: async (params) => {
-        const projectRoot = getProjectRoot13();
+        const projectRoot = getProjectRoot14();
         const endResult = await coreOps6.end(params);
         if (!endResult.success) {
           return lafsError(
@@ -27924,7 +28309,7 @@ var init_session3 = __esm({
           );
           return wrapResult(envelopeToEngineResult(envelope), "query", "session", operation, startTime);
         } catch (error) {
-          getLogger12("domain:session").error(
+          getLogger13("domain:session").error(
             { gateway: "query", domain: "session", operation, err: error },
             error instanceof Error ? error.message : String(error)
           );
@@ -27959,7 +28344,7 @@ var init_session3 = __esm({
             startTime
           );
         } catch (error) {
-          getLogger12("domain:session").error(
+          getLogger13("domain:session").error(
             { gateway: "mutate", domain: "session", operation, err: error },
             error instanceof Error ? error.message : String(error)
           );
@@ -27990,7 +28375,7 @@ var init_session3 = __esm({
 });
 
 // packages/cleo/src/dispatch/domains/sticky.ts
-import { getLogger as getLogger13, getProjectRoot as getProjectRoot14 } from "@cleocode/core";
+import { getLogger as getLogger14, getProjectRoot as getProjectRoot15 } from "@cleocode/core";
 import {
   stickyAdd,
   stickyArchive,
@@ -28004,7 +28389,7 @@ import {
 } from "@cleocode/core/internal";
 async function stickyListOp(params) {
   return stickyListFiltered(
-    getProjectRoot14(),
+    getProjectRoot15(),
     {
       status: params.status,
       color: params.color,
@@ -28016,10 +28401,10 @@ async function stickyListOp(params) {
   );
 }
 async function stickyShowOp(params) {
-  return stickyShow(getProjectRoot14(), params.stickyId);
+  return stickyShow(getProjectRoot15(), params.stickyId);
 }
 async function stickyAddOp(params) {
-  return stickyAdd(getProjectRoot14(), {
+  return stickyAdd(getProjectRoot15(), {
     content: params.content,
     tags: params.tags,
     color: params.color,
@@ -28027,24 +28412,24 @@ async function stickyAddOp(params) {
   });
 }
 async function stickyArchiveOp(params) {
-  return stickyArchive(getProjectRoot14(), params.stickyId);
+  return stickyArchive(getProjectRoot15(), params.stickyId);
 }
 async function stickyPurgeOp(params) {
-  return stickyPurge(getProjectRoot14(), params.stickyId);
+  return stickyPurge(getProjectRoot15(), params.stickyId);
 }
 async function stickyConvertTaskOp(params) {
-  const result = await stickyConvertToTask(getProjectRoot14(), params.stickyId, params.title);
+  const result = await stickyConvertToTask(getProjectRoot15(), params.stickyId, params.title);
   if (!result.success) return { taskId: void 0 };
   return { taskId: result.data.taskId };
 }
 async function stickyConvertMemoryOp(params) {
-  const result = await stickyConvertToMemory(getProjectRoot14(), params.stickyId, params.memoryType);
+  const result = await stickyConvertToMemory(getProjectRoot15(), params.stickyId, params.memoryType);
   if (!result.success) return { memoryId: void 0 };
   return { memoryId: result.data.memoryId };
 }
 async function stickyConvertSessionNoteOp(params) {
   const result = await stickyConvertToSessionNote(
-    getProjectRoot14(),
+    getProjectRoot15(),
     params.stickyId,
     params.sessionId
   );
@@ -28052,7 +28437,7 @@ async function stickyConvertSessionNoteOp(params) {
   return { sessionId: result.data.sessionId };
 }
 async function stickyConvertTaskNoteOp(params) {
-  const result = await stickyConvertToTaskNote(getProjectRoot14(), params.stickyId, params.taskId);
+  const result = await stickyConvertToTaskNote(getProjectRoot15(), params.stickyId, params.taskId);
   if (!result.success) return { taskId: void 0 };
   return { taskId: result.data.taskId };
 }
@@ -28075,14 +28460,14 @@ function envelopeToDispatch(envelope, gateway, operation, startTime) {
     }
   };
 }
-var log3, stickyCoreOps, _stickyTypedHandler, QUERY_OPS9, MUTATE_OPS9, CONVERT_TARGET_TO_KEY, StickyHandler;
+var log4, stickyCoreOps, _stickyTypedHandler, QUERY_OPS9, MUTATE_OPS9, CONVERT_TARGET_TO_KEY, StickyHandler;
 var init_sticky2 = __esm({
   "packages/cleo/src/dispatch/domains/sticky.ts"() {
     "use strict";
     init_typed();
     init_base();
     init_meta2();
-    log3 = getLogger13("domain:sticky");
+    log4 = getLogger14("domain:sticky");
     stickyCoreOps = {
       list: stickyListOp,
       show: stickyShowOp,
@@ -28175,7 +28560,7 @@ var init_sticky2 = __esm({
           );
           return envelopeToDispatch(envelope, "query", operation, startTime);
         } catch (error) {
-          log3.error({ gateway: "query", domain: "sticky", operation, err: error }, String(error));
+          log4.error({ gateway: "query", domain: "sticky", operation, err: error }, String(error));
           return handleErrorResult("query", "sticky", operation, error, startTime);
         }
       }
@@ -28208,7 +28593,7 @@ var init_sticky2 = __esm({
           );
           return envelopeToDispatch(envelope, "mutate", operation, startTime);
         } catch (error) {
-          log3.error({ gateway: "mutate", domain: "sticky", operation, err: error }, String(error));
+          log4.error({ gateway: "mutate", domain: "sticky", operation, err: error }, String(error));
           return handleErrorResult("mutate", "sticky", operation, error, startTime);
         }
       }
@@ -28223,9 +28608,9 @@ var init_sticky2 = __esm({
 });
 
 // packages/cleo/src/dispatch/domains/tasks.ts
-import { getLogger as getLogger14, getProjectRoot as getProjectRoot15 } from "@cleocode/core";
+import { getLogger as getLogger15, getProjectRoot as getProjectRoot16 } from "@cleocode/core";
 async function sagaCreate(params) {
-  const projectRoot = getProjectRoot15();
+  const projectRoot = getProjectRoot16();
   const title = typeof params.title === "string" ? params.title : "";
   const description = typeof params.description === "string" ? params.description : void 0;
   const acceptance = Array.isArray(params.acceptance) ? params.acceptance : void 0;
@@ -28241,7 +28626,7 @@ async function sagaCreate(params) {
   );
 }
 async function sagaAdd(params) {
-  const projectRoot = getProjectRoot15();
+  const projectRoot = getProjectRoot16();
   const sagaId = typeof params.sagaId === "string" ? params.sagaId : "";
   const epicId = typeof params.epicId === "string" ? params.epicId : "";
   if (!sagaId || !epicId) {
@@ -28279,7 +28664,7 @@ async function sagaAdd(params) {
   return lafsSuccess({ sagaId, epicId, added: relResult.data?.added ?? true }, "saga.add");
 }
 async function sagaList() {
-  const projectRoot = getProjectRoot15();
+  const projectRoot = getProjectRoot16();
   const result = await taskList(projectRoot, { type: "epic", label: "saga" });
   if (!result.success) {
     return lafsError("E_GENERAL", result.error?.message ?? "Failed to list Sagas", "saga.list");
@@ -28292,7 +28677,7 @@ async function sagaList() {
   return lafsSuccess({ sagas: topLevel, total: topLevel.length }, "saga.list");
 }
 async function sagaMembers(params) {
-  const projectRoot = getProjectRoot15();
+  const projectRoot = getProjectRoot16();
   const sagaId = typeof params.sagaId === "string" ? params.sagaId : "";
   if (!sagaId) {
     return lafsError("E_INVALID_INPUT", "sagaId is required", "saga.members");
@@ -28317,7 +28702,7 @@ async function sagaMembers(params) {
   );
 }
 async function sagaRollup(params) {
-  const projectRoot = getProjectRoot15();
+  const projectRoot = getProjectRoot16();
   const sagaId = typeof params.sagaId === "string" ? params.sagaId : "";
   if (!sagaId) {
     return lafsError("E_INVALID_INPUT", "sagaId is required", "saga.rollup");
@@ -28369,7 +28754,7 @@ var init_tasks3 = __esm({
       // Query ops
       // -------------------------------------------------------------------------
       show: async (params) => {
-        const projectRoot = getProjectRoot15();
+        const projectRoot = getProjectRoot16();
         if (params.ivtrHistory) {
           return wrapCoreResult(await taskShowIvtrHistory(projectRoot, params.taskId), "show");
         }
@@ -28379,7 +28764,7 @@ var init_tasks3 = __esm({
         return wrapCoreResult(await taskShow(projectRoot, params.taskId), "show");
       },
       list: async (params) => {
-        const projectRoot = getProjectRoot15();
+        const projectRoot = getProjectRoot16();
         const result = await taskList(projectRoot, {
           parent: params.parent,
           status: params.status,
@@ -28405,7 +28790,7 @@ var init_tasks3 = __esm({
         return lafsSuccess(result.data, "list");
       },
       find: async (params) => {
-        const projectRoot = getProjectRoot15();
+        const projectRoot = getProjectRoot16();
         return wrapCoreResult(
           await taskFind(projectRoot, params.query, params.limit, {
             id: params.id,
@@ -28422,15 +28807,15 @@ var init_tasks3 = __esm({
         );
       },
       tree: async (params) => {
-        const projectRoot = getProjectRoot15();
+        const projectRoot = getProjectRoot16();
         return wrapCoreResult(await taskTree(projectRoot, params.taskId, params.withBlockers), "tree");
       },
       blockers: async (params) => {
-        const projectRoot = getProjectRoot15();
+        const projectRoot = getProjectRoot16();
         return wrapCoreResult(await taskBlockers(projectRoot, params), "blockers");
       },
       depends: async (params) => {
-        const projectRoot = getProjectRoot15();
+        const projectRoot = getProjectRoot16();
         if (params.action === "overview") {
           return wrapCoreResult(await taskDepsOverview(projectRoot), "depends");
         }
@@ -28450,14 +28835,14 @@ var init_tasks3 = __esm({
         );
       },
       "deps.validate": async (params) => {
-        const projectRoot = getProjectRoot15();
+        const projectRoot = getProjectRoot16();
         return wrapCoreResult(
           await taskDepsValidate(projectRoot, params.epicId, params.scope),
           "deps.validate"
         );
       },
       "deps.tree": async (params) => {
-        const projectRoot = getProjectRoot15();
+        const projectRoot = getProjectRoot16();
         if (!params.epicId) {
           return lafsError("E_INVALID_INPUT", "epicId is required for deps.tree", "deps.tree");
         }
@@ -28467,29 +28852,29 @@ var init_tasks3 = __esm({
         );
       },
       analyze: async (params) => {
-        const projectRoot = getProjectRoot15();
+        const projectRoot = getProjectRoot16();
         return wrapCoreResult(
           await taskAnalyze(projectRoot, params.taskId, { tierLimit: params.tierLimit }),
           "analyze"
         );
       },
       impact: async (params) => {
-        const projectRoot = getProjectRoot15();
+        const projectRoot = getProjectRoot16();
         return wrapCoreResult(
           await taskImpact(projectRoot, params.change, params.matchLimit),
           "impact"
         );
       },
       next: async (params) => {
-        const projectRoot = getProjectRoot15();
+        const projectRoot = getProjectRoot16();
         return wrapCoreResult(await taskNext(projectRoot, params), "next");
       },
       plan: async (_params) => {
-        const projectRoot = getProjectRoot15();
+        const projectRoot = getProjectRoot16();
         return wrapCoreResult(await taskPlan(projectRoot), "plan");
       },
       relates: async (params) => {
-        const projectRoot = getProjectRoot15();
+        const projectRoot = getProjectRoot16();
         if (params.mode) {
           return wrapCoreResult(
             await taskRelatesFind(projectRoot, params.taskId, {
@@ -28502,36 +28887,36 @@ var init_tasks3 = __esm({
         return wrapCoreResult(await taskRelates(projectRoot, params.taskId), "relates");
       },
       "complexity.estimate": async (params) => {
-        const projectRoot = getProjectRoot15();
+        const projectRoot = getProjectRoot16();
         return wrapCoreResult(
           await taskComplexityEstimate(projectRoot, { taskId: params.taskId }),
           "complexity.estimate"
         );
       },
       history: async (params) => {
-        const projectRoot = getProjectRoot15();
+        const projectRoot = getProjectRoot16();
         if (params.taskId) {
           return wrapCoreResult(await taskHistory(projectRoot, params.taskId, params.limit), "history");
         }
         return wrapCoreResult(await taskWorkHistory(projectRoot), "history");
       },
       current: async (_params) => {
-        const projectRoot = getProjectRoot15();
+        const projectRoot = getProjectRoot16();
         return wrapCoreResult(await taskCurrentGet(projectRoot), "current");
       },
       "label.list": async (_params) => {
-        const projectRoot = getProjectRoot15();
+        const projectRoot = getProjectRoot16();
         return wrapCoreResult(await taskLabelList(projectRoot), "label.list");
       },
       "sync.links": async (params) => {
-        const projectRoot = getProjectRoot15();
+        const projectRoot = getProjectRoot16();
         return wrapCoreResult(await taskSyncLinks(projectRoot, params), "sync.links");
       },
       // -------------------------------------------------------------------------
       // Mutate ops
       // -------------------------------------------------------------------------
       add: async (params) => {
-        const projectRoot = getProjectRoot15();
+        const projectRoot = getProjectRoot16();
         return wrapCoreResult(
           await addTaskWithSessionScope(projectRoot, {
             title: params.title,
@@ -28559,7 +28944,7 @@ var init_tasks3 = __esm({
         );
       },
       update: async (params) => {
-        const projectRoot = getProjectRoot15();
+        const projectRoot = getProjectRoot16();
         return wrapCoreResult(
           await taskUpdate(projectRoot, params.taskId, {
             title: params.title,
@@ -28602,7 +28987,7 @@ var init_tasks3 = __esm({
         );
       },
       complete: async (params) => {
-        const projectRoot = getProjectRoot15();
+        const projectRoot = getProjectRoot16();
         if (params.force !== void 0) {
           return lafsError(
             "E_FLAG_REMOVED",
@@ -28625,15 +29010,15 @@ var init_tasks3 = __esm({
         return wrapCoreResult(result, "complete");
       },
       cancel: async (params) => {
-        const projectRoot = getProjectRoot15();
+        const projectRoot = getProjectRoot16();
         return wrapCoreResult(await taskCancel(projectRoot, params.taskId, params.reason), "cancel");
       },
       delete: async (params) => {
-        const projectRoot = getProjectRoot15();
+        const projectRoot = getProjectRoot16();
         return wrapCoreResult(await taskDelete(projectRoot, params.taskId, params.force), "delete");
       },
       archive: async (params) => {
-        const projectRoot = getProjectRoot15();
+        const projectRoot = getProjectRoot16();
         return wrapCoreResult(
           await taskArchive(projectRoot, params.taskId, params.before, {
             taskIds: params.taskIds,
@@ -28644,7 +29029,7 @@ var init_tasks3 = __esm({
         );
       },
       restore: async (params) => {
-        const projectRoot = getProjectRoot15();
+        const projectRoot = getProjectRoot16();
         if (params.from === "done") {
           return wrapCoreResult(
             await taskReopen(projectRoot, params.taskId, {
@@ -28672,21 +29057,21 @@ var init_tasks3 = __esm({
         );
       },
       reparent: async (params) => {
-        const projectRoot = getProjectRoot15();
+        const projectRoot = getProjectRoot16();
         return wrapCoreResult(
           await taskReparent(projectRoot, params.taskId, params.newParentId ?? null),
           "reparent"
         );
       },
       reorder: async (params) => {
-        const projectRoot = getProjectRoot15();
+        const projectRoot = getProjectRoot16();
         return wrapCoreResult(
           await taskReorder(projectRoot, params.taskId, params.position),
           "reorder"
         );
       },
       "relates.add": async (params) => {
-        const projectRoot = getProjectRoot15();
+        const projectRoot = getProjectRoot16();
         const relatedId = params.relatedId ?? params.targetId;
         if (!relatedId) {
           return lafsError("E_INVALID_INPUT", "relatedId (or targetId) is required", "relates.add");
@@ -28697,7 +29082,7 @@ var init_tasks3 = __esm({
         );
       },
       "relates.remove": async (params) => {
-        const projectRoot = getProjectRoot15();
+        const projectRoot = getProjectRoot16();
         if (!params.relatedId) {
           return lafsError("E_INVALID_INPUT", "relatedId is required", "relates.remove");
         }
@@ -28707,15 +29092,15 @@ var init_tasks3 = __esm({
         );
       },
       start: async (params) => {
-        const projectRoot = getProjectRoot15();
+        const projectRoot = getProjectRoot16();
         return wrapCoreResult(await taskStart(projectRoot, params.taskId), "start");
       },
       stop: async (_params) => {
-        const projectRoot = getProjectRoot15();
+        const projectRoot = getProjectRoot16();
         return wrapCoreResult(await taskStop(projectRoot), "stop");
       },
       "sync.reconcile": async (params) => {
-        const projectRoot = getProjectRoot15();
+        const projectRoot = getProjectRoot16();
         return wrapCoreResult(
           await taskSyncReconcile(projectRoot, {
             providerId: params.providerId,
@@ -28729,18 +29114,18 @@ var init_tasks3 = __esm({
         );
       },
       "sync.links.remove": async (params) => {
-        const projectRoot = getProjectRoot15();
+        const projectRoot = getProjectRoot16();
         return wrapCoreResult(
           await taskSyncLinksRemove(projectRoot, params.providerId),
           "sync.links.remove"
         );
       },
       claim: async (params) => {
-        const projectRoot = getProjectRoot15();
+        const projectRoot = getProjectRoot16();
         return wrapCoreResult(await taskClaim(projectRoot, params.taskId, params.agentId), "claim");
       },
       unclaim: async (params) => {
-        const projectRoot = getProjectRoot15();
+        const projectRoot = getProjectRoot16();
         return wrapCoreResult(await taskUnclaim(projectRoot, params.taskId), "unclaim");
       }
     });
@@ -28829,7 +29214,7 @@ var init_tasks3 = __esm({
             return wrapResult(envelopeToEngineResult(envelope), "query", "tasks", operation, startTime);
           }
         } catch (error) {
-          getLogger14("domain:tasks").error(
+          getLogger15("domain:tasks").error(
             { gateway: "query", domain: "tasks", operation, err: error },
             error instanceof Error ? error.message : String(error)
           );
@@ -28843,7 +29228,7 @@ var init_tasks3 = __esm({
           );
           return wrapResult(envelopeToEngineResult(envelope), "query", "tasks", operation, startTime);
         } catch (error) {
-          getLogger14("domain:tasks").error(
+          getLogger15("domain:tasks").error(
             { gateway: "query", domain: "tasks", operation, err: error },
             error instanceof Error ? error.message : String(error)
           );
@@ -28886,7 +29271,7 @@ var init_tasks3 = __esm({
             );
           }
         } catch (error) {
-          getLogger14("domain:tasks").error(
+          getLogger15("domain:tasks").error(
             { gateway: "mutate", domain: "tasks", operation, err: error },
             error instanceof Error ? error.message : String(error)
           );
@@ -28900,7 +29285,7 @@ var init_tasks3 = __esm({
           );
           return wrapResult(envelopeToEngineResult(envelope), "mutate", "tasks", operation, startTime);
         } catch (error) {
-          getLogger14("domain:tasks").error(
+          getLogger15("domain:tasks").error(
             { gateway: "mutate", domain: "tasks", operation, err: error },
             error instanceof Error ? error.message : String(error)
           );
@@ -28966,7 +29351,7 @@ var init_tasks3 = __esm({
 });
 
 // packages/cleo/src/dispatch/domains/tools.ts
-import { getLogger as getLogger15, getProjectRoot as getProjectRoot16 } from "@cleocode/core";
+import { getLogger as getLogger16, getProjectRoot as getProjectRoot17 } from "@cleocode/core";
 import {
   codeOutline,
   codeParse,
@@ -29011,7 +29396,7 @@ var init_tools = __esm({
     init_routing();
     ToolsHandler = class {
       get projectRoot() {
-        return getProjectRoot16();
+        return getProjectRoot17();
       }
       // -----------------------------------------------------------------------
       // DomainHandler interface
@@ -29524,13 +29909,295 @@ var init_tools = __esm({
       // -----------------------------------------------------------------------
       handleError(gateway, domain, operation, error, startTime) {
         const message = error instanceof Error ? error.message : String(error);
-        getLogger15("domain:tools").error({ gateway, domain, operation, err: error }, message);
+        getLogger16("domain:tools").error({ gateway, domain, operation, err: error }, message);
         return handleErrorResult(gateway, domain, operation, error, startTime);
       }
     };
   }
 });
 
+// packages/cleo/src/dispatch/domains/upgrade.ts
+import { dirname as dirname3, resolve as resolve3 } from "node:path";
+import { fileURLToPath as fileURLToPath2 } from "node:url";
+import { getLogger as getLogger17, getProjectRoot as getProjectRoot18 } from "@cleocode/core";
+import { upgradeWorkflows } from "@cleocode/core/internal";
+function resolveTemplatesDir() {
+  const here = dirname3(fileURLToPath2(import.meta.url));
+  return resolve3(here, "..", "..", "..", "templates", "workflows");
+}
+function toDispatchData(result) {
+  return {
+    outcomes: result.outcomes.map((o) => ({
+      template: o.template,
+      targetPath: o.targetPath,
+      status: o.status,
+      overrideDeclared: o.overrideDeclared
+    })),
+    resolvedTools: result.resolvedTools,
+    hasDrift: result.hasDrift
+  };
+}
+var log5, UpgradeHandler;
+var init_upgrade = __esm({
+  "packages/cleo/src/dispatch/domains/upgrade.ts"() {
+    "use strict";
+    init_base();
+    init_meta2();
+    log5 = getLogger17("domain:upgrade");
+    UpgradeHandler = class {
+      /**
+       * Handle read-only upgrade queries.
+       *
+       * Supported operations:
+       *  - `workflows` — drift detection only; never writes to disk.
+       *                  Effectively forces `dryRun=true` at the query gateway.
+       */
+      async query(operation, params) {
+        const startTime = Date.now();
+        try {
+          switch (operation) {
+            case "workflows": {
+              const includeRendered = params?.["includeRendered"] === true;
+              const result = await upgradeWorkflows({
+                projectRoot: getProjectRoot18(),
+                templatesDir: resolveTemplatesDir(),
+                dryRun: true
+              });
+              const data = toDispatchData(result);
+              return {
+                meta: dispatchMeta("query", "upgrade", operation, startTime),
+                success: true,
+                data: includeRendered ? {
+                  ...data,
+                  rendered: result.outcomes.map((o) => ({
+                    template: o.template,
+                    rendered: o.rendered
+                  }))
+                } : data
+              };
+            }
+            default:
+              return unsupportedOp("query", "upgrade", operation, startTime);
+          }
+        } catch (err) {
+          log5.error({ err, operation }, "UpgradeHandler query error");
+          return handleErrorResult("query", "upgrade", operation, err, startTime);
+        }
+      }
+      /**
+       * Handle upgrade mutations.
+       *
+       * Supported operations:
+       *  - `workflows` — re-render + (optionally) re-write drifted files.
+       *                  Params: `{ force?, dryRun? }`. Returns the per-template
+       *                  outcomes plus the `hasDrift` flag the CLI uses to drive
+       *                  the `--check` exit-code contract.
+       */
+      async mutate(operation, params) {
+        const startTime = Date.now();
+        try {
+          switch (operation) {
+            case "workflows": {
+              const force = params?.["force"] === true;
+              const dryRun = params?.["dryRun"] === true;
+              const includeRendered = params?.["includeRendered"] === true;
+              const result = await upgradeWorkflows({
+                projectRoot: getProjectRoot18(),
+                templatesDir: resolveTemplatesDir(),
+                force,
+                dryRun
+              });
+              const data = toDispatchData(result);
+              return {
+                meta: dispatchMeta("mutate", "upgrade", operation, startTime),
+                success: true,
+                data: includeRendered ? {
+                  ...data,
+                  rendered: result.outcomes.map((o) => ({
+                    template: o.template,
+                    rendered: o.rendered
+                  }))
+                } : data
+              };
+            }
+            default:
+              return unsupportedOp("mutate", "upgrade", operation, startTime);
+          }
+        } catch (err) {
+          log5.error({ err, operation }, "UpgradeHandler mutate error");
+          return handleErrorResult("mutate", "upgrade", operation, err, startTime);
+        }
+      }
+      /** Declared operations for introspection and validation. */
+      getSupportedOperations() {
+        return {
+          query: ["workflows"],
+          mutate: ["workflows"]
+        };
+      }
+    };
+  }
+});
+
+// packages/cleo/src/dispatch/domains/worktree.ts
+import {
+  forceUnlockWorktree,
+  getLogger as getLogger18,
+  getProjectRoot as getProjectRoot19,
+  listWorktrees,
+  pruneOrphanedWorktreesByStatus
+} from "@cleocode/core/internal";
+function coerceStatusFilter(value) {
+  if (value === void 0 || value === null) return void 0;
+  const raw = Array.isArray(value) ? value.filter((v) => typeof v === "string") : typeof value === "string" ? value.split(",").map((s) => s.trim()) : [];
+  const out = raw.filter(
+    (s) => ALL_CATEGORIES.includes(s)
+  );
+  return out.length > 0 ? out : void 0;
+}
+function coerceStringList(value) {
+  if (value === void 0 || value === null) return void 0;
+  if (Array.isArray(value)) {
+    const out = value.filter((v) => typeof v === "string");
+    return out.length > 0 ? out : void 0;
+  }
+  if (typeof value === "string") {
+    const parts = value.split(",").map((s) => s.trim()).filter((s) => s.length > 0);
+    return parts.length > 0 ? parts : void 0;
+  }
+  return void 0;
+}
+var log6, ALL_CATEGORIES, WorktreeHandler;
+var init_worktree2 = __esm({
+  "packages/cleo/src/dispatch/domains/worktree.ts"() {
+    "use strict";
+    init_base();
+    log6 = getLogger18("domain:worktree");
+    ALL_CATEGORIES = [
+      "active",
+      "stale",
+      "merged",
+      "orphan",
+      "locked"
+    ];
+    WorktreeHandler = class {
+      /**
+       * Handle read-only worktree queries.
+       *
+       * Supported operations:
+       *  - `list` — return a structured listing of every worktree with status
+       *             classification. Params: `{ statusFilter?, staleDays? }`.
+       */
+      async query(operation, params) {
+        const startTime = Date.now();
+        try {
+          switch (operation) {
+            case "list": {
+              const opts = {
+                projectRoot: getProjectRoot19(),
+                statusFilter: coerceStatusFilter(params?.["statusFilter"]),
+                staleDays: typeof params?.["staleDays"] === "number" ? params["staleDays"] : void 0
+              };
+              const result = await listWorktrees(opts);
+              return wrapResult(
+                result,
+                "query",
+                "worktree",
+                operation,
+                startTime
+              );
+            }
+            default:
+              return unsupportedOp("query", "worktree", operation, startTime);
+          }
+        } catch (err) {
+          log6.error({ err, operation }, "WorktreeHandler query error");
+          return handleErrorResult("query", "worktree", operation, err, startTime);
+        }
+      }
+      /**
+       * Handle worktree mutations.
+       *
+       * Supported operations:
+       *  - `prune` — remove orphan/merged worktrees. Params:
+       *              `{ dryRun?, staleDays?, paths?, actor? }`. Returns a
+       *              {@link PruneOrphanedWorktreesResult} envelope.
+       *  - `forceUnlock` — clear wedge state for a single worktree. Params:
+       *              `{ taskId, actor? }`. Returns a {@link ForceUnlockWorktreeResult}.
+       *
+       * @task T9547
+       */
+      async mutate(operation, params) {
+        const startTime = Date.now();
+        try {
+          switch (operation) {
+            case "prune": {
+              const opts = {
+                projectRoot: getProjectRoot19(),
+                dryRun: params?.["dryRun"] === true,
+                ...typeof params?.["staleDays"] === "number" ? { staleDays: params["staleDays"] } : {},
+                ...coerceStringList(params?.["paths"]) !== void 0 ? { paths: coerceStringList(params?.["paths"]) } : {},
+                ...typeof params?.["actor"] === "string" && params["actor"].length > 0 ? { actor: params["actor"] } : {}
+              };
+              const result = await pruneOrphanedWorktreesByStatus(opts);
+              return wrapResult(
+                result,
+                "mutate",
+                "worktree",
+                operation,
+                startTime
+              );
+            }
+            case "forceUnlock": {
+              const taskId = params?.["taskId"];
+              if (typeof taskId !== "string" || taskId.length === 0) {
+                return errorResult(
+                  "mutate",
+                  "worktree",
+                  operation,
+                  "E_VALIDATION",
+                  "Missing required param: taskId (pass --task-id T####).",
+                  startTime
+                );
+              }
+              const opts = {
+                projectRoot: getProjectRoot19(),
+                taskId,
+                ...typeof params?.["actor"] === "string" && params["actor"].length > 0 ? { actor: params["actor"] } : {}
+              };
+              const result = await forceUnlockWorktree(opts);
+              return wrapResult(
+                result,
+                "mutate",
+                "worktree",
+                operation,
+                startTime
+              );
+            }
+            default:
+              return unsupportedOp("mutate", "worktree", operation, startTime);
+          }
+        } catch (err) {
+          log6.error({ err, operation }, "WorktreeHandler mutate error");
+          return handleErrorResult("mutate", "worktree", operation, err, startTime);
+        }
+      }
+      /**
+       * Declare the operations this domain supports — feeds dispatch introspection
+       * and the `cleo --help` rendering pipeline.
+       *
+       * @returns Query/mutate operation lists.
+       */
+      getSupportedOperations() {
+        return {
+          query: ["list"],
+          mutate: ["prune", "forceUnlock"]
+        };
+      }
+    };
+  }
+});
+
 // packages/cleo/src/dispatch/domains/index.ts
 function createDomainHandlers() {
   const handlers = /* @__PURE__ */ new Map();
@@ -29551,7 +30218,10 @@ function createDomainHandlers() {
   handlers.set("conduit", new ConduitHandler());
   handlers.set("sentient", new SentientHandler());
   handlers.set("release", new ReleaseHandler());
+  handlers.set("provenance", new ProvenanceHandler());
   handlers.set("llm", new LlmHandler());
+  handlers.set("worktree", new WorktreeHandler());
+  handlers.set("upgrade", new UpgradeHandler());
   return handlers;
 }
 var init_domains = __esm({
@@ -29569,12 +30239,15 @@ var init_domains = __esm({
     init_orchestrate2();
     init_pipeline3();
     init_playbook2();
+    init_provenance();
     init_release2();
     init_sentient2();
     init_session3();
     init_sticky2();
     init_tasks3();
     init_tools();
+    init_upgrade();
+    init_worktree2();
   }
 });
 
@@ -29814,7 +30487,7 @@ var init_config = __esm({
 });
 
 // packages/cleo/src/dispatch/middleware/audit.ts
-import { getLogger as getLogger16, getProjectInfoSync } from "@cleocode/core/internal";
+import { getLogger as getLogger19, getProjectInfoSync } from "@cleocode/core/internal";
 import { queryAudit } from "@cleocode/core/internal";
 function resolveProjectHash() {
   if (cachedProjectHash !== void 0) return cachedProjectHash;
@@ -29868,7 +30541,7 @@ async function writeToSqlite(entry, requestId) {
     };
     const parsed = AuditLogInsertSchema.safeParse(payload);
     if (!parsed.success) {
-      log4.warn(
+      log7.warn(
         { issues: parsed.error.issues },
         "Audit payload failed Zod validation; skipping insert"
       );
@@ -29877,7 +30550,7 @@ async function writeToSqlite(entry, requestId) {
     const db = await getDb3(process.cwd());
     await db.insert(auditLog).values(parsed.data).run();
   } catch (err) {
-    log4.warn({ err }, "Failed to write audit entry to SQLite");
+    log7.warn({ err }, "Failed to write audit entry to SQLite");
   }
 }
 function createAudit() {
@@ -29908,7 +30581,7 @@ function createAudit() {
       },
       error: response.error?.message
     };
-    log4.info(
+    log7.info(
       {
         domain: entry.domain,
         operation: entry.operation,
@@ -29925,18 +30598,18 @@ function createAudit() {
       await writeToSqlite(entry, req.requestId);
     } else {
       writeToSqlite(entry, req.requestId).catch((err) => {
-        log4.error({ err }, "Failed to persist audit entry to SQLite");
+        log7.error({ err }, "Failed to persist audit entry to SQLite");
       });
     }
     return response;
   };
 }
-var log4, cachedProjectHash;
+var log7, cachedProjectHash;
 var init_audit = __esm({
   "packages/cleo/src/dispatch/middleware/audit.ts"() {
     "use strict";
     init_config();
-    log4 = getLogger16("audit");
+    log7 = getLogger19("audit");
   }
 });
 
@@ -30011,11 +30684,11 @@ var init_security = __esm({
 });
 
 // packages/cleo/src/dispatch/middleware/sanitizer.ts
-function createSanitizer(getProjectRoot34) {
+function createSanitizer(getProjectRoot38) {
   return async (req, next) => {
     if (req.params) {
       try {
-        const root = getProjectRoot34 ? getProjectRoot34() : void 0;
+        const root = getProjectRoot38 ? getProjectRoot38() : void 0;
         req.params = sanitizeParams(req.params, root, {
           domain: req.domain,
           operation: req.operation
@@ -30137,10 +30810,10 @@ __export(cli_exports, {
 import { randomUUID as randomUUID5 } from "node:crypto";
 import { existsSync as existsSync4 } from "node:fs";
 import { createRequire } from "node:module";
-import { dirname as dirname3, join as join6 } from "node:path";
-import { fileURLToPath as fileURLToPath2 } from "node:url";
+import { dirname as dirname4, join as join6 } from "node:path";
+import { fileURLToPath as fileURLToPath3 } from "node:url";
 import { catalog, registerSkillLibraryFromPath } from "@cleocode/caamp";
-import { autoRecordDispatchTokenUsage, getProjectRoot as getProjectRoot17, hooks } from "@cleocode/core/internal";
+import { autoRecordDispatchTokenUsage, getProjectRoot as getProjectRoot20, hooks } from "@cleocode/core/internal";
 function ensureCaampLibrary() {
   if (catalog.isCatalogAvailable()) return;
   try {
@@ -30148,15 +30821,15 @@ function ensureCaampLibrary() {
     try {
       const req = createRequire(import.meta.url);
       const skillsPkgJson = req.resolve("@cleocode/skills/package.json");
-      const candidate = dirname3(skillsPkgJson);
+      const candidate = dirname4(skillsPkgJson);
       if (existsSync4(join6(candidate, "skills.json"))) {
         skillsRoot = candidate;
       }
     } catch {
     }
     if (!skillsRoot) {
-      const thisFile = fileURLToPath2(import.meta.url);
-      const packageRoot = join6(dirname3(thisFile), "..", "..", "..", "..", "..");
+      const thisFile = fileURLToPath3(import.meta.url);
+      const packageRoot = join6(dirname4(thisFile), "..", "..", "..", "..", "..");
       const candidate = join6(packageRoot, "packages", "skills");
       if (existsSync4(join6(candidate, "skills.json"))) {
         skillsRoot = candidate;
@@ -30191,7 +30864,7 @@ function createCliDispatcher() {
     middlewares: [
       createSessionResolver(lookupCliSession),
       // T4959: session identity first
-      createSanitizer(() => getProjectRoot17()),
+      createSanitizer(() => getProjectRoot20()),
       createFieldFilter(),
       createAudit(),
       // T4959: CLI now gets audit trail
@@ -30205,7 +30878,7 @@ function resetCliDispatcher() {
 }
 async function dispatchFromCli(gateway, domain, operation, params, outputOpts) {
   const dispatcher = getCliDispatcher();
-  const projectRoot = getProjectRoot17();
+  const projectRoot = getProjectRoot20();
   const dispatchStart = Date.now();
   hooks.dispatch("PromptSubmit", projectRoot, {
     timestamp: (/* @__PURE__ */ new Date()).toISOString(),
@@ -30250,7 +30923,7 @@ async function dispatchFromCli(gateway, domain, operation, params, outputOpts) {
       operation,
       sessionId: response.meta.sessionId,
       requestId: response.meta.requestId,
-      cwd: getProjectRoot17()
+      cwd: getProjectRoot20()
     });
     const opts = {
       command: outputOpts?.command ?? operation,
@@ -30312,7 +30985,7 @@ function handleRawError(response, _opts) {
 }
 async function dispatchRaw(gateway, domain, operation, params) {
   const dispatcher = getCliDispatcher();
-  const projectRoot = getProjectRoot17();
+  const projectRoot = getProjectRoot20();
   const dispatchStart = Date.now();
   hooks.dispatch("PromptSubmit", projectRoot, {
     timestamp: (/* @__PURE__ */ new Date()).toISOString(),
@@ -30707,7 +31380,7 @@ __export(add_exports, {
 });
 import {
   appendSignedSeverityAttestation,
-  getProjectRoot as getProjectRoot18,
+  getProjectRoot as getProjectRoot21,
   inferTaskAddParams
 } from "@cleocode/core";
 var addCommand;
@@ -30935,7 +31608,7 @@ var init_add = __esm({
           return;
         }
         if (args["depends-waiver"] !== void 0) params["dependsWaiver"] = args["depends-waiver"];
-        const inferred = await inferTaskAddParams(getProjectRoot18(), {
+        const inferred = await inferTaskAddParams(getProjectRoot21(), {
           title: args.title,
           description: args.description ?? args.desc,
           filesInfer: args["files-infer"],
@@ -33568,9 +34241,9 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
         let tempDir = null;
         try {
           const { existsSync: existsSync16, mkdirSync: mkdirSync7, statSync, readdirSync: readdirSync4, copyFileSync } = await import("node:fs");
-          const { join: join28, basename, resolve: resolve5, extname } = await import("node:path");
+          const { join: join28, basename, resolve: resolve8, extname } = await import("node:path");
           const { tmpdir: tmpdir2 } = await import("node:os");
-          const resolvedPath = resolve5(args.path);
+          const resolvedPath = resolve8(args.path);
           if (!existsSync16(resolvedPath)) {
             cliOutput(
               {
@@ -33787,9 +34460,9 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
       async run({ args }) {
         try {
           const { existsSync: existsSync16, statSync } = await import("node:fs");
-          const { resolve: resolve5, basename, dirname: dirname9 } = await import("node:path");
+          const { resolve: resolve8, basename, dirname: dirname11 } = await import("node:path");
           const { execFileSync: execFileSync5 } = await import("node:child_process");
-          const resolvedDir = resolve5(args.dir);
+          const resolvedDir = resolve8(args.dir);
           if (!existsSync16(resolvedDir) || !statSync(resolvedDir).isDirectory()) {
             cliOutput(
               {
@@ -33822,8 +34495,8 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
           }
           const agentName = basename(resolvedDir);
           const archiveName = `${agentName}.cantz`;
-          const archivePath = resolve5(archiveName);
-          const parentDir = dirname9(resolvedDir);
+          const archivePath = resolve8(archiveName);
+          const parentDir = dirname11(resolvedDir);
           try {
             execFileSync5("zip", ["-r", archivePath, agentName], {
               cwd: parentDir,
@@ -34134,8 +34807,8 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
       async run({ args }) {
         try {
           const { existsSync: existsSync16, readFileSync: readFileSync18, mkdirSync: mkdirSync7 } = await import("node:fs");
-          const { resolve: resolve5, join: join28 } = await import("node:path");
-          const specPath = resolve5(args.spec);
+          const { resolve: resolve8, join: join28 } = await import("node:path");
+          const specPath = resolve8(args.spec);
           if (!existsSync16(specPath)) {
             cliError(`spec file not found: ${specPath}`, 4, { name: "E_NOT_FOUND" });
             process.exitCode = 4;
@@ -34143,7 +34816,7 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
           }
           const specContent = readFileSync18(specPath, "utf-8");
           const projectRoot = process.cwd();
-          const outputDir = args["output-dir"] ? resolve5(args["output-dir"]) : join28(projectRoot, ".cleo", "cant", "agents");
+          const outputDir = args["output-dir"] ? resolve8(args["output-dir"]) : join28(projectRoot, ".cleo", "cant", "agents");
           mkdirSync7(outputDir, { recursive: true });
           if (args["dry-run"]) {
             cliOutput(
@@ -34541,7 +35214,7 @@ var audit_exports = {};
 __export(audit_exports, {
   auditCommand: () => auditCommand
 });
-import { getProjectRoot as getProjectRoot19, reconstructLineage } from "@cleocode/core/internal";
+import { getProjectRoot as getProjectRoot22, reconstructLineage } from "@cleocode/core/internal";
 var reconstructCommand, auditCommand;
 var init_audit2 = __esm({
   "packages/cleo/src/cli/commands/audit.ts"() {
@@ -34585,7 +35258,7 @@ var init_audit2 = __esm({
           repoRoot = args["repo-root"];
         } else {
           try {
-            repoRoot = getProjectRoot19(process.cwd()) ?? process.cwd();
+            repoRoot = getProjectRoot22(process.cwd()) ?? process.cwd();
           } catch {
             repoRoot = process.cwd();
           }
@@ -34740,8 +35413,8 @@ function detectAuthType(provider, token) {
 async function promptYesNo(question) {
   const rl = createInterface({ input: process.stdin, output: process.stderr });
   try {
-    const answer = await new Promise((resolve5) => {
-      rl.question(question, (a) => resolve5(a));
+    const answer = await new Promise((resolve8) => {
+      rl.question(question, (a) => resolve8(a));
     });
     const clean = answer.trim().toLowerCase();
     return clean === "y" || clean === "yes";
@@ -35053,7 +35726,7 @@ var backfill_exports = {};
 __export(backfill_exports, {
   backfillCommand: () => backfillCommand
 });
-import { backfillTasks, getProjectRoot as getProjectRoot20, populateEmbeddings } from "@cleocode/core/internal";
+import { backfillTasks, getProjectRoot as getProjectRoot23, populateEmbeddings } from "@cleocode/core/internal";
 var backfillCommand;
 var init_backfill = __esm({
   "packages/cleo/src/cli/commands/backfill.ts"() {
@@ -35087,7 +35760,7 @@ var init_backfill = __esm({
         }
       },
       async run({ args }) {
-        const root = getProjectRoot20();
+        const root = getProjectRoot23();
         if (args.embeddings) {
           try {
             let lastLine = "";
@@ -35466,12 +36139,12 @@ async function promptPassphrase() {
       "Cannot prompt for passphrase: stdin is not a TTY. Set the CLEO_BACKUP_PASSPHRASE environment variable for non-interactive use."
     );
   }
-  return new Promise((resolve5) => {
+  return new Promise((resolve8) => {
     process.stdout.write("Passphrase: ");
     const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
     rl.question("", (answer) => {
       rl.close();
-      resolve5(answer.trim());
+      resolve8(answer.trim());
     });
   });
 }
@@ -35604,9 +36277,9 @@ var init_backup = __esm({
       },
       async run({ args }) {
         const scope = args.scope;
-        const { packBundle, getProjectRoot: getProjectRoot34 } = await import("@cleocode/core/internal");
+        const { packBundle, getProjectRoot: getProjectRoot38 } = await import("@cleocode/core/internal");
         const includesProject = scope === "project" || scope === "all";
-        const projectRoot = includesProject ? getProjectRoot34() : void 0;
+        const projectRoot = includesProject ? getProjectRoot38() : void 0;
         let passphrase;
         if (args.encrypt === true) {
           passphrase = process.env["CLEO_BACKUP_PASSPHRASE"];
@@ -35907,7 +36580,7 @@ import {
   exportBrainAsJson,
   getMemoryQualityReport,
   getPlasticityStats,
-  getProjectRoot as getProjectRoot21,
+  getProjectRoot as getProjectRoot24,
   purgeBrainNoise,
   runBrainMaintenance
 } from "@cleocode/core/internal";
@@ -35946,7 +36619,7 @@ var init_brain2 = __esm({
         json: { type: "boolean", description: "Output results as JSON" }
       },
       async run({ args }) {
-        const root = getProjectRoot21();
+        const root = getProjectRoot24();
         try {
           const result = await runBrainMaintenance(root, {
             skipDecay: !!args["skip-decay"],
@@ -36017,7 +36690,7 @@ var init_brain2 = __esm({
         json: { type: "boolean", description: "Output results as JSON" }
       },
       async run({ args: _args }) {
-        const root = getProjectRoot21();
+        const root = getProjectRoot24();
         try {
           const result = await backfillBrainGraph(root);
           cliOutput(
@@ -36058,7 +36731,7 @@ var init_brain2 = __esm({
         json: { type: "boolean", description: "Output results as JSON" }
       },
       async run({ args: _args }) {
-        const root = getProjectRoot21();
+        const root = getProjectRoot24();
         try {
           const result = await purgeBrainNoise(root);
           cliOutput(
@@ -36104,7 +36777,7 @@ var init_brain2 = __esm({
         json: { type: "boolean", description: "Output results as JSON" }
       },
       async run({ args }) {
-        const root = getProjectRoot21();
+        const root = getProjectRoot24();
         const limit = Number.parseInt(args.limit, 10) || 20;
         try {
           const stats = await getPlasticityStats(root, limit);
@@ -36154,7 +36827,7 @@ var init_brain2 = __esm({
         json: { type: "boolean", description: "Output results as JSON" }
       },
       async run({ args: _args }) {
-        const root = getProjectRoot21();
+        const root = getProjectRoot24();
         try {
           const report = await getMemoryQualityReport(root);
           cliOutput(
@@ -36203,7 +36876,7 @@ var init_brain2 = __esm({
         }
       },
       async run({ args }) {
-        const root = getProjectRoot21();
+        const root = getProjectRoot24();
         const format = args.format ?? "gexf";
         if (format !== "gexf" && format !== "json") {
           cliError(`Invalid format: ${format}. Use 'gexf' or 'json'.`, "E_VALIDATION", {
@@ -36611,9 +37284,9 @@ __export(cant_exports, {
   cantCommand: () => cantCommand
 });
 import { existsSync as existsSync8, mkdirSync as mkdirSync2, readFileSync as readFileSync9, writeFileSync as writeFileSync3 } from "node:fs";
-import { dirname as dirname4, isAbsolute, join as join10, resolve as resolve3 } from "node:path";
+import { dirname as dirname5, isAbsolute, join as join10, resolve as resolve4 } from "node:path";
 function resolveFilePath(file) {
-  return isAbsolute(file) ? file : resolve3(process.cwd(), file);
+  return isAbsolute(file) ? file : resolve4(process.cwd(), file);
 }
 function ensureExists(filePath, operation) {
   if (existsSync8(filePath)) return true;
@@ -36777,7 +37450,7 @@ var init_cant = __esm({
             let written = 0;
             for (const outputFile of result.outputFiles) {
               const outputPath = isAbsolute(outputFile.path) ? outputFile.path : join10(projectRoot, outputFile.path);
-              mkdirSync2(dirname4(outputPath), { recursive: true });
+              mkdirSync2(dirname5(outputPath), { recursive: true });
               writeFileSync3(outputPath, outputFile.content, "utf-8");
               written++;
             }
@@ -38774,7 +39447,7 @@ __export(daemon_exports, {
 import { existsSync as existsSync9 } from "node:fs";
 import { homedir as homedir4 } from "node:os";
 import { join as join11 } from "node:path";
-import { fileURLToPath as fileURLToPath3 } from "node:url";
+import { fileURLToPath as fileURLToPath4 } from "node:url";
 import { getGCDaemonStatus, spawnGCDaemon, stopGCDaemon } from "@cleocode/core/gc/daemon.js";
 import {
   bootstrapDaemon as bootstrapSentientDaemon,
@@ -38837,7 +39510,7 @@ async function showDaemonStatus(cleoDir, projectRoot) {
   }
 }
 function resolveDaemonInstallerScript() {
-  const filePath = fileURLToPath3(import.meta.url);
+  const filePath = fileURLToPath4(import.meta.url);
   const candidate1 = join11(filePath, "..", "..", "..", "scripts", "install-daemon-service.mjs");
   if (existsSync9(candidate1)) return candidate1;
   const candidate2 = join11(
@@ -39548,14 +40221,14 @@ __export(detect_drift_exports, {
   detectDriftCommand: () => detectDriftCommand
 });
 import { existsSync as existsSync10, readdirSync, readFileSync as readFileSync11 } from "node:fs";
-import { dirname as dirname5, join as join12 } from "node:path";
+import { dirname as dirname6, join as join12 } from "node:path";
 function findProjectRoot() {
   let currentDir = process.cwd();
   while (currentDir !== "/") {
     if (existsSync10(join12(currentDir, "package.json"))) {
       return currentDir;
     }
-    const parent = dirname5(currentDir);
+    const parent = dirname6(currentDir);
     if (parent === currentDir) break;
     currentDir = parent;
   }
@@ -40073,14 +40746,14 @@ __export(docs_exports, {
   docsCommand: () => docsCommand
 });
 import { mkdir, readdir, readFile as readFile2, writeFile } from "node:fs/promises";
-import { dirname as dirname6, isAbsolute as isAbsolute2, join as join13, resolve as resolve4 } from "node:path";
+import { dirname as dirname7, isAbsolute as isAbsolute2, join as join13, resolve as resolve5 } from "node:path";
 import {
   buildDocsGraph,
   CleoError as CleoError3,
   exportDocument,
   formatError as formatError5,
   getAgentOutputsAbsolute,
-  getProjectRoot as getProjectRoot22,
+  getProjectRoot as getProjectRoot25,
   listDocVersions,
   mergeDocs,
   publishDocs,
@@ -40376,7 +41049,7 @@ var init_docs3 = __esm({
         const taskId = String(args.task);
         const includeAttachments = args["include-attachments"] !== false;
         const includeMemoryRefs = args["include-memory-refs"] === true;
-        const projectRoot = getProjectRoot22();
+        const projectRoot = getProjectRoot25();
         try {
           const result = await exportDocument({
             taskId,
@@ -40386,8 +41059,8 @@ var init_docs3 = __esm({
           });
           let writtenPath;
           if (typeof args.out === "string" && args.out.length > 0) {
-            const outPath = isAbsolute2(args.out) ? args.out : resolve4(projectRoot, args.out);
-            await mkdir(dirname6(outPath), { recursive: true });
+            const outPath = isAbsolute2(args.out) ? args.out : resolve5(projectRoot, args.out);
+            await mkdir(dirname7(outPath), { recursive: true });
             await writeFile(outPath, result.markdown, "utf8");
             writtenPath = outPath;
           }
@@ -40439,7 +41112,7 @@ var init_docs3 = __esm({
         }
       },
       async run({ args }) {
-        const projectRoot = getProjectRoot22();
+        const projectRoot = getProjectRoot25();
         try {
           const result = await searchDocs2(String(args.query), {
             ownerId: args.owner ?? void 0,
@@ -40491,7 +41164,7 @@ var init_docs3 = __esm({
         }
       },
       async run({ args }) {
-        const projectRoot = getProjectRoot22();
+        const projectRoot = getProjectRoot25();
         const rawStrategy = args.strategy ?? "three-way";
         const strategy = rawStrategy === "cherry-pick" || rawStrategy === "multi-diff" ? rawStrategy : "three-way";
         try {
@@ -40500,8 +41173,8 @@ var init_docs3 = __esm({
             base: args.base ?? void 0
           });
           if (typeof args.out === "string" && args.out.length > 0) {
-            const outPath = isAbsolute2(args.out) ? args.out : resolve4(projectRoot, args.out);
-            await mkdir(dirname6(outPath), { recursive: true });
+            const outPath = isAbsolute2(args.out) ? args.out : resolve5(projectRoot, args.out);
+            await mkdir(dirname7(outPath), { recursive: true });
             await writeFile(outPath, result.merged, "utf8");
             humanInfo(`Wrote merged content to ${outPath}`);
           }
@@ -40541,7 +41214,7 @@ var init_docs3 = __esm({
         }
       },
       async run({ args }) {
-        const projectRoot = getProjectRoot22();
+        const projectRoot = getProjectRoot25();
         const fmt = args.format ?? "mermaid";
         try {
           const result = await buildDocsGraph({ ownerId: String(args.for), projectRoot });
@@ -40571,8 +41244,8 @@ var init_docs3 = __esm({
             output2 = lines.join("\n");
           }
           if (typeof args.out === "string" && args.out.length > 0) {
-            const outPath = isAbsolute2(args.out) ? args.out : resolve4(projectRoot, args.out);
-            await mkdir(dirname6(outPath), { recursive: true });
+            const outPath = isAbsolute2(args.out) ? args.out : resolve5(projectRoot, args.out);
+            await mkdir(dirname7(outPath), { recursive: true });
             await writeFile(outPath, output2, "utf8");
             humanInfo(`Wrote graph to ${outPath}`);
           }
@@ -40611,7 +41284,7 @@ var init_docs3 = __esm({
         }
       },
       async run({ args }) {
-        const projectRoot = getProjectRoot22();
+        const projectRoot = getProjectRoot25();
         try {
           const result = await rankDocs({
             ownerId: String(args.for),
@@ -40650,7 +41323,7 @@ var init_docs3 = __esm({
         }
       },
       async run({ args }) {
-        const projectRoot = getProjectRoot22();
+        const projectRoot = getProjectRoot25();
         try {
           const result = await listDocVersions({
             ownerId: String(args.for),
@@ -40694,7 +41367,7 @@ var init_docs3 = __esm({
         }
       },
       async run({ args }) {
-        const projectRoot = getProjectRoot22();
+        const projectRoot = getProjectRoot25();
         try {
           const result = await publishDocs({
             ownerId: String(args.for),
@@ -41099,7 +41772,7 @@ __export(migrate_agents_v2_exports, {
 import { createHash as createHash2 } from "node:crypto";
 import { appendFileSync as appendFileSync2, existsSync as existsSync11, mkdirSync as mkdirSync3, readdirSync as readdirSync2, readFileSync as readFileSync12 } from "node:fs";
 import { join as join14 } from "node:path";
-import { getProjectRoot as getProjectRoot23, installAgentFromCant } from "@cleocode/core/internal";
+import { getProjectRoot as getProjectRoot26, installAgentFromCant } from "@cleocode/core/internal";
 import { openCleoDb } from "@cleocode/core/store/open-cleo-db";
 function sha256Hex(bytes) {
   return createHash2("sha256").update(bytes).digest("hex");
@@ -41286,7 +41959,7 @@ var init_migrate_agents_v2 = __esm({
         }
       },
       async run({ args }) {
-        const projectRoot = getProjectRoot23();
+        const projectRoot = getProjectRoot26();
         const verbose = args.quiet !== true;
         if (verbose) {
           humanInfo("Scanning .cleo/cant/agents/ and .cleo/agents/ for unregistered agents...");
@@ -41330,7 +42003,7 @@ __export(doctor_exports, {
 });
 import { mkdirSync as mkdirSync4, writeFileSync as writeFileSync4 } from "node:fs";
 import { join as join15 } from "node:path";
-import { getProjectRoot as getProjectRoot24, quarantineRogueCleoDir, scanRogueCleoDirs } from "@cleocode/core/internal";
+import { getProjectRoot as getProjectRoot27, quarantineRogueCleoDir, scanRogueCleoDirs } from "@cleocode/core/internal";
 async function scanTestFixturesInProd(projectRoot) {
   const { getDb: getDb3, getNativeDb } = await import("@cleocode/core/internal");
   await getDb3(projectRoot);
@@ -41552,7 +42225,7 @@ var init_doctor = __esm({
         try {
           if (args.brain) {
             const { computeBrainHealthDashboard } = await import("@cleocode/core/internal");
-            const projectRoot = getProjectRoot24();
+            const projectRoot = getProjectRoot27();
             const dashboard = await computeBrainHealthDashboard(projectRoot);
             cliOutput(dashboard, { command: "doctor", operation: "doctor.brain" });
             if (dashboard.hasP0Failure) {
@@ -41561,7 +42234,7 @@ var init_doctor = __esm({
             return;
           }
           if (args["scan-test-fixtures-in-prod"]) {
-            const projectRoot = getProjectRoot24();
+            const projectRoot = getProjectRoot27();
             const matches = await scanTestFixturesInProd(projectRoot);
             const dryRun = args["dry-run"] !== false && args.quarantine !== true;
             const quarantined = !dryRun && matches.length > 0 ? await quarantineTestFixtures(projectRoot, matches) : void 0;
@@ -41649,7 +42322,7 @@ var init_doctor = __esm({
             progress.complete("Comprehensive diagnostics complete");
           } else if (args["scan-rogue-cleo-dirs"]) {
             progress.step(0, "Scanning for rogue .cleo/ directories");
-            const projectRoot = getProjectRoot24();
+            const projectRoot = getProjectRoot27();
             const reports = scanRogueCleoDirs(projectRoot);
             progress.complete(
               `Found ${reports.length} rogue .cleo/ director${reports.length === 1 ? "y" : "ies"}`
@@ -41658,7 +42331,7 @@ var init_doctor = __esm({
           } else if (args["quarantine-rogue-cleo-dirs"]) {
             const isDryRun = args["dry-run"] === true;
             progress.step(0, `${isDryRun ? "[DRY RUN] " : ""}Scanning for rogue .cleo/ directories`);
-            const projectRoot = getProjectRoot24();
+            const projectRoot = getProjectRoot27();
             const reports = scanRogueCleoDirs(projectRoot);
             if (reports.length === 0) {
               progress.complete("No rogue .cleo/ directories found \u2014 nothing to quarantine");
@@ -41712,7 +42385,7 @@ var init_doctor = __esm({
             const { detectAndRemoveLegacyGlobalFiles, detectAndRemoveStrayProjectNexus } = await import("@cleocode/core/internal");
             const { getCleoHome: getCleoHome3 } = await import("@cleocode/core/internal");
             const cleoHome = getCleoHome3();
-            const projectRoot = getProjectRoot24();
+            const projectRoot = getProjectRoot27();
             const legacyResult = detectAndRemoveLegacyGlobalFiles(cleoHome);
             const strayResult = detectAndRemoveStrayProjectNexus(projectRoot);
             const isDryRun = args["dry-run"] === true;
@@ -41761,7 +42434,7 @@ var init_doctor = __esm({
               { command: "doctor", operation: "admin.health" }
             );
             try {
-              const projectRoot = getProjectRoot24();
+              const projectRoot = getProjectRoot27();
               const conflicts = readMigrationConflicts(projectRoot);
               if (conflicts.length > 0) {
                 progress.complete(
@@ -42705,8 +43378,8 @@ __export(generate_changelog_exports, {
 });
 import { execFileSync as execFileSync2 } from "node:child_process";
 import { existsSync as existsSync12, mkdirSync as mkdirSync5, readFileSync as readFileSync13, writeFileSync as writeFileSync5 } from "node:fs";
-import { dirname as dirname7, join as join18 } from "node:path";
-import { CleoError as CleoError4, formatError as formatError6, getConfigPath, getProjectRoot as getProjectRoot25 } from "@cleocode/core";
+import { dirname as dirname8, join as join18 } from "node:path";
+import { CleoError as CleoError4, formatError as formatError6, getConfigPath, getProjectRoot as getProjectRoot28 } from "@cleocode/core";
 function getChangelogSource(cwd) {
   const configPath = getConfigPath(cwd);
   try {
@@ -42737,7 +43410,7 @@ function getDefaultOutputPath(platform) {
   }
 }
 function getGitHubRepoSlug(cwd) {
-  const projectRoot = getProjectRoot25(cwd);
+  const projectRoot = getProjectRoot28(cwd);
   try {
     const remoteUrl = execFileSync2("git", ["remote", "get-url", "origin"], {
       cwd: projectRoot,
@@ -42870,7 +43543,7 @@ var init_generate_changelog = __esm({
           const targetPlatform = args.platform;
           const dryRun = args["dry-run"] === true;
           const sourceFile = getChangelogSource();
-          const sourcePath = join18(getProjectRoot25(), sourceFile);
+          const sourcePath = join18(getProjectRoot28(), sourceFile);
           if (!existsSync12(sourcePath)) {
             throw new CleoError4(4 /* NOT_FOUND */, `Changelog source not found: ${sourcePath}`);
           }
@@ -42883,8 +43556,8 @@ var init_generate_changelog = __esm({
             const outputPath = platformConfig?.path ?? getDefaultOutputPath(targetPlatform);
             const content = generateForPlatform(targetPlatform, sourceContent, repoSlug, limit);
             if (!dryRun) {
-              const fullPath = join18(getProjectRoot25(), outputPath);
-              mkdirSync5(dirname7(fullPath), { recursive: true });
+              const fullPath = join18(getProjectRoot28(), outputPath);
+              mkdirSync5(dirname8(fullPath), { recursive: true });
               writeFileSync5(fullPath, content, "utf-8");
             }
             results.push({ platform: targetPlatform, path: outputPath, written: !dryRun });
@@ -42904,8 +43577,8 @@ var init_generate_changelog = __esm({
                 limit
               );
               if (!dryRun) {
-                const fullPath = join18(getProjectRoot25(), platformConfig.path);
-                mkdirSync5(dirname7(fullPath), { recursive: true });
+                const fullPath = join18(getProjectRoot28(), platformConfig.path);
+                mkdirSync5(dirname8(fullPath), { recursive: true });
                 writeFileSync5(fullPath, content, "utf-8");
               }
               results.push({
@@ -44041,15 +44714,21 @@ var init_import = __esm({
 var init_exports = {};
 __export(init_exports, {
   getGitignoreTemplate: () => getGitignoreTemplate,
+  getWorkflowTemplatesDir: () => getWorkflowTemplatesDir,
   initCommand: () => initCommand2
 });
 import { existsSync as existsSync13, readFileSync as readFileSync14 } from "node:fs";
-import { join as join19 } from "node:path";
-import { fileURLToPath as fileURLToPath4 } from "node:url";
-import { CleoError as CleoError5, formatError as formatError7, initProject as initProject2 } from "@cleocode/core";
+import { dirname as dirname9, join as join19, resolve as resolve6 } from "node:path";
+import { fileURLToPath as fileURLToPath5 } from "node:url";
+import {
+  CleoError as CleoError5,
+  formatError as formatError7,
+  initProject as initProject2,
+  scaffoldWorkflows
+} from "@cleocode/core";
 function getGitignoreTemplate() {
   try {
-    const thisFile = fileURLToPath4(import.meta.url);
+    const thisFile = fileURLToPath5(import.meta.url);
     const packageRoot = join19(thisFile, "..", "..", "..", "..");
     const localTemplatePath = join19(packageRoot, "templates", "cleo-gitignore");
     const monorepoTemplatePath = join19(packageRoot, "..", "..", "templates", "cleo-gitignore");
@@ -44061,6 +44740,11 @@ function getGitignoreTemplate() {
   }
   return "# CLEO Project Data - Selective Git Tracking\nagent-outputs/\n";
 }
+function getWorkflowTemplatesDir() {
+  const thisFile = fileURLToPath5(import.meta.url);
+  const packageRoot = resolve6(dirname9(thisFile), "..", "..", "..", "..");
+  return join19(packageRoot, "templates", "workflows");
+}
 var initCommand2;
 var init_init = __esm({
   "packages/cleo/src/cli/commands/init.ts"() {
@@ -44098,10 +44782,43 @@ var init_init = __esm({
           type: "boolean",
           description: "Install canonical CleoOS seed agent personas (.cant)",
           default: false
+        },
+        workflows: {
+          type: "boolean",
+          description: "Scaffold the release-prepare.yml workflow into .github/workflows/ (T9531).",
+          default: false
+        },
+        "dry-run": {
+          type: "boolean",
+          description: "With --workflows: print the rendered YAML without writing.",
+          default: false
         }
       },
       async run({ args }) {
         try {
+          if (args.workflows) {
+            const projectRoot = process.cwd();
+            const templatesDir = getWorkflowTemplatesDir();
+            const result2 = await scaffoldWorkflows({
+              projectRoot,
+              templatesDir,
+              dryRun: !!args["dry-run"],
+              force: !!args.force
+            });
+            cliOutput(
+              {
+                scaffolded: result2.outcomes.map((o) => ({
+                  template: o.template,
+                  targetPath: o.targetPath,
+                  status: o.status
+                })),
+                resolvedTools: result2.resolvedTools,
+                ...args["dry-run"] ? { rendered: result2.outcomes.map((o) => o.rendered) } : {}
+              },
+              { command: "init" }
+            );
+            return;
+          }
           const initOpts = {
             name: args.name || args.projectName || void 0,
             force: !!args.force,
@@ -44941,7 +45658,7 @@ var llm_cost_exports = {};
 __export(llm_cost_exports, {
   costCommand: () => costCommand
 });
-import { getProjectRoot as getProjectRoot26 } from "@cleocode/core/internal";
+import { getProjectRoot as getProjectRoot29 } from "@cleocode/core/internal";
 import { computeCost } from "@cleocode/core/llm/usage-pricing";
 function resolveSessionId(raw) {
   if (raw === "current") {
@@ -45014,7 +45731,7 @@ var init_llm_cost = __esm({
           process.exit(6);
         }
         const sessionId = resolveSessionId(rawSessionId);
-        const projectRoot = getProjectRoot26(process.cwd());
+        const projectRoot = getProjectRoot29(process.cwd());
         let breakdown;
         try {
           breakdown = await loadSessionCostBreakdown(projectRoot, sessionId);
@@ -45370,7 +46087,7 @@ async function _headlessPkceFlow(provider, authUrl) {
     `  After approving, paste the full redirect URL (http://localhost?code=\u2026&state=\u2026):
   `
   );
-  return new Promise((resolve5, reject) => {
+  return new Promise((resolve8, reject) => {
     let buf = "";
     process.stdin.setEncoding("utf8");
     process.stdin.once("data", (chunk) => {
@@ -45382,7 +46099,7 @@ async function _headlessPkceFlow(provider, authUrl) {
           reject(new Error('Redirect URL is missing the "code" parameter'));
           return;
         }
-        resolve5(code);
+        resolve8(code);
       } catch {
         reject(new Error(`Invalid redirect URL: ${buf}`));
       }
@@ -45390,7 +46107,7 @@ async function _headlessPkceFlow(provider, authUrl) {
   });
 }
 async function _localCallbackPkceFlow(provider, authUrl, expectedState, port) {
-  return new Promise((resolve5) => {
+  return new Promise((resolve8) => {
     const server = createServer((req, res) => {
       const url = new URL(req.url ?? "/", `http://localhost:${port}`);
       const code = url.searchParams.get("code");
@@ -45400,7 +46117,7 @@ async function _localCallbackPkceFlow(provider, authUrl, expectedState, port) {
       if (error) {
         res.end(`<h1>Authorization failed</h1><p>${error}</p><p>You may close this tab.</p>`);
         server.close();
-        resolve5({
+        resolve8({
           error: {
             code: "E_PKCE_AUTH_DENIED",
             codeName: "E_PKCE_AUTH_DENIED",
@@ -45412,7 +46129,7 @@ async function _localCallbackPkceFlow(provider, authUrl, expectedState, port) {
       if (!code || state !== expectedState) {
         res.end("<h1>Invalid callback</h1><p>You may close this tab.</p>");
         server.close();
-        resolve5({
+        resolve8({
           error: {
             code: "E_PKCE_INVALID_CALLBACK",
             codeName: "E_PKCE_INVALID_CALLBACK",
@@ -45423,7 +46140,7 @@ async function _localCallbackPkceFlow(provider, authUrl, expectedState, port) {
       }
       res.end("<h1>Authorized</h1><p>You may close this tab and return to your terminal.</p>");
       server.close();
-      resolve5({ code });
+      resolve8({ code });
     });
     server.listen(port, "localhost", () => {
       process.stderr.write("\n");
@@ -45556,7 +46273,7 @@ function _generateState() {
   return Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
 }
 function _findFreePort() {
-  return new Promise((resolve5, reject) => {
+  return new Promise((resolve8, reject) => {
     const srv = createServer();
     srv.listen(0, "localhost", () => {
       const addr = srv.address();
@@ -45566,7 +46283,7 @@ function _findFreePort() {
         return;
       }
       const port = addr.port;
-      srv.close(() => resolve5(port));
+      srv.close(() => resolve8(port));
     });
     srv.on("error", reject);
   });
@@ -46159,14 +46876,14 @@ async function readStdin() {
   if (process.stdin.isTTY) {
     return "";
   }
-  return new Promise((resolve5, reject) => {
+  return new Promise((resolve8, reject) => {
     let data = "";
     process.stdin.setEncoding("utf-8");
     process.stdin.on("data", (chunk) => {
       data += chunk;
     });
     process.stdin.on("end", () => {
-      resolve5(data.trim());
+      resolve8(data.trim());
     });
     process.stdin.on("error", reject);
   });
@@ -46525,7 +47242,7 @@ import {
   getBrainDb as getBrainDb2,
   getBrainNativeDb as getBrainNativeDb3,
   getDreamStatus,
-  getProjectRoot as getProjectRoot27,
+  getProjectRoot as getProjectRoot30,
   runConsolidation,
   triggerManualDream
 } from "@cleocode/core/internal";
@@ -47486,7 +48203,7 @@ var init_memory3 = __esm({
       },
       args: {},
       async run() {
-        const root = getProjectRoot27();
+        const root = getProjectRoot30();
         try {
           const result = await runConsolidation(root);
           cliOutput(result, { command: "memory-consolidate", operation: "memory.consolidate" });
@@ -47510,7 +48227,7 @@ var init_memory3 = __esm({
         }
       },
       async run({ args }) {
-        const root = getProjectRoot27();
+        const root = getProjectRoot30();
         if (args.status) {
           try {
             const status = await getDreamStatus(root);
@@ -47547,7 +48264,7 @@ var init_memory3 = __esm({
         }
       },
       async run({ args }) {
-        const root = getProjectRoot27();
+        const root = getProjectRoot30();
         try {
           const { runObserver, runReflector } = await import("@cleocode/core/internal");
           const observerResult = await runObserver(root, args.session, {
@@ -47587,7 +48304,7 @@ var init_memory3 = __esm({
         }
       },
       async run({ args }) {
-        const root = getProjectRoot27();
+        const root = getProjectRoot30();
         try {
           const { getBrainDb: getBrainDbInner, getBrainNativeDb: getBrainNativeDbInner } = await import("@cleocode/core/internal");
           await getBrainDbInner(root);
@@ -47685,7 +48402,7 @@ var init_memory3 = __esm({
       async run({ args }) {
         const sourceDir = args.from ?? join20(homedir6(), ".claude", "projects", "-mnt-projects-cleocode", "memory");
         const isDryRun = !!args["dry-run"];
-        const projectRoot = getProjectRoot27();
+        const projectRoot = getProjectRoot30();
         const stateFile = join20(projectRoot, CLEO_DIR_NAME, MIGRATE_MEMORY_HASHES_JSON);
         if (!existsSync14(sourceDir)) {
           cliError(`Source directory not found: ${sourceDir}`, "E_NOT_FOUND", { name: "E_NOT_FOUND" });
@@ -47898,7 +48615,7 @@ var init_memory3 = __esm({
       },
       args: {},
       async run() {
-        const root = getProjectRoot27();
+        const root = getProjectRoot30();
         try {
           await getBrainDb2(root);
           const nativeDb = getBrainNativeDb3();
@@ -47997,7 +48714,7 @@ var init_memory3 = __esm({
         }
       },
       async run({ args }) {
-        const root = getProjectRoot27();
+        const root = getProjectRoot30();
         const targetTier = args.to;
         const reason = args.reason;
         const validTiers = ["medium", "long"];
@@ -48101,7 +48818,7 @@ var init_memory3 = __esm({
         }
       },
       async run({ args }) {
-        const root = getProjectRoot27();
+        const root = getProjectRoot30();
         const targetTier = args.to;
         const reason = args.reason;
         const validTiers = ["short", "medium"];
@@ -48488,8 +49205,8 @@ data: ${JSON.stringify(event)}
             cursor = data.nextCursor;
           }
           if (!running) break;
-          await new Promise((resolve5) => {
-            const timer = setTimeout(resolve5, intervalMs);
+          await new Promise((resolve8) => {
+            const timer = setTimeout(resolve8, intervalMs);
             timer.unref?.();
           });
         }
@@ -48615,7 +49332,7 @@ var migrate_claude_mem_exports = {};
 __export(migrate_claude_mem_exports, {
   migrateClaudeMemCommand: () => migrateClaudeMemCommand
 });
-import { getProjectRoot as getProjectRoot28, migrateClaudeMem } from "@cleocode/core/internal";
+import { getProjectRoot as getProjectRoot31, migrateClaudeMem } from "@cleocode/core/internal";
 import { ingestLooseAgentOutputs, ingestRcasdDirectories } from "@cleocode/core/memory";
 import { getDb as getDb2 } from "@cleocode/core/store/sqlite";
 var storageCommand, claudeMemCommand, manifestIngestCommand, migrateClaudeMemCommand;
@@ -48678,7 +49395,7 @@ var init_migrate_claude_mem = __esm({
         }
       },
       async run({ args }) {
-        const root = getProjectRoot28();
+        const root = getProjectRoot31();
         try {
           const result = await migrateClaudeMem(root, {
             sourcePath: args.source,
@@ -48727,7 +49444,7 @@ var init_migrate_claude_mem = __esm({
         }
       },
       async run({ args }) {
-        const projectRoot = getProjectRoot28();
+        const projectRoot = getProjectRoot31();
         try {
           const db = await getDb2(projectRoot);
           const rcasdFlag = Boolean(args.rcasd);
@@ -49682,7 +50399,7 @@ var init_nexus4 = __esm({
         const repoPath = args.path ? path4.resolve(args.path) : process.cwd();
         humanInfo(`[nexus] Analyzing: ${repoPath}${isIncremental ? " (incremental)" : ""}`);
         try {
-          const [{ getNexusDb, nexusSchema }, { runPipeline }, { getProjectRoot: getProjectRoot34 }, { eq: eq2 }] = await Promise.all([
+          const [{ getNexusDb, nexusSchema }, { runPipeline }, { getProjectRoot: getProjectRoot38 }, { eq: eq2 }] = await Promise.all([
             import("@cleocode/core/store/nexus-sqlite"),
             import("@cleocode/nexus/pipeline"),
             import("@cleocode/core/internal"),
@@ -49762,7 +50479,7 @@ var init_nexus4 = __esm({
               extensions: { duration_ms: durationMs }
             }
           );
-          void getProjectRoot34;
+          void getProjectRoot38;
         } catch (err) {
           const msg = err instanceof Error ? err.message : String(err);
           cliError(
@@ -50089,13 +50806,13 @@ var init_nexus4 = __esm({
           if (!skipPrompt) {
             const { createInterface: createInterface4 } = await import("node:readline");
             const rl = createInterface4({ input: process.stdin, output: process.stdout });
-            const confirmed = await new Promise((resolve5) => {
+            const confirmed = await new Promise((resolve8) => {
               rl.question(
                 `
 [nexus] Delete ${matchCount} project(s) from the registry? [y/N] `,
                 (answer) => {
                   rl.close();
-                  resolve5(answer.trim().toLowerCase() === "y");
+                  resolve8(answer.trim().toLowerCase() === "y");
                 }
               );
             });
@@ -52098,23 +52815,29 @@ var init_orchestrate3 = __esm({
     worktreeCompleteCommand = defineCommand({
       meta: {
         name: "worktree-complete",
-        description: "Integrate subagent worktree into default branch via canonical git merge --no-ff (ADR-062)"
+        description: "Integrate subagent worktree into default branch via canonical git merge --no-ff (ADR-062). T9548: idempotent \u2014 re-running on a completed worktree is a no-op."
       },
       args: {
         taskId: {
           type: "positional",
           description: "Task ID whose worktree branch should be merged (e.g. T1625)",
           required: true
+        },
+        resolve: {
+          type: "string",
+          description: 'T9548 conflict-recovery mode: "auto" (default \u2014 attempt merge) or "manual" (skip merge, mark worktree as manually-handled in audit log)',
+          default: "auto"
         }
       },
       async run({ args }) {
-        await dispatchFromCli(
-          "mutate",
-          "orchestrate",
-          "worktree.complete",
-          { taskId: args.taskId },
-          { command: "orchestrate" }
-        );
+        const resolveArg = typeof args.resolve === "string" ? args.resolve : void 0;
+        const params = { taskId: args.taskId };
+        if (resolveArg === "manual") {
+          params.resolve = "manual";
+        }
+        await dispatchFromCli("mutate", "orchestrate", "worktree.complete", params, {
+          command: "orchestrate"
+        });
       }
     });
     conduitStatusCommand = defineCommand({
@@ -52753,7 +53476,7 @@ __export(plan_exports, {
   planCommand: () => planCommand2
 });
 var planCommand2;
-var init_plan = __esm({
+var init_plan2 = __esm({
   "packages/cleo/src/cli/commands/plan.ts"() {
     "use strict";
     init_dist();
@@ -53018,6 +53741,114 @@ var init_promote = __esm({
   }
 });
 
+// packages/cleo/src/cli/commands/provenance.ts
+var provenance_exports = {};
+__export(provenance_exports, {
+  provenanceCommand: () => provenanceCommand
+});
+var backfillCommand3, verifyCommand2, provenanceCommand;
+var init_provenance2 = __esm({
+  "packages/cleo/src/cli/commands/provenance.ts"() {
+    "use strict";
+    init_dist();
+    init_cli();
+    backfillCommand3 = defineCommand({
+      meta: {
+        name: "backfill",
+        description: "Walk historical git tags from --since and populate the 11 provenance tables"
+      },
+      args: {
+        since: {
+          type: "string",
+          description: "Lower-bound version (exclusive). Tags newer than this are reconciled. Empty string = all tags.",
+          required: true
+        },
+        "force-overwrite": {
+          type: "boolean",
+          description: "UPDATE existing rows on conflict (audit-logged). Default: UPSERT-on-insert only."
+        },
+        "dry-run": {
+          type: "boolean",
+          description: "Enumerate the tag set + return the plan without writing to the DB"
+        },
+        "reset-checkpoint": {
+          type: "boolean",
+          description: "Clear the existing .cleo/release/backfill-state.json before starting (do NOT resume)"
+        },
+        json: { type: "boolean", description: "Emit LAFS envelope" }
+      },
+      async run({ args }) {
+        await dispatchFromCli(
+          "mutate",
+          "provenance",
+          "provenance.backfill",
+          {
+            since: args.since,
+            forceOverwrite: args["force-overwrite"] === true,
+            dryRun: args["dry-run"] === true,
+            resetCheckpoint: args["reset-checkpoint"] === true
+          },
+          { command: "provenance" }
+        );
+      }
+    });
+    verifyCommand2 = defineCommand({
+      meta: {
+        name: "verify",
+        description: "Audit the 11 provenance tables for a release (FK integrity, orphans, evidence staleness)"
+      },
+      args: {
+        version: {
+          type: "positional",
+          description: "Release version to verify (e.g. v2026.6.0). Optional when --all is set.",
+          required: false
+        },
+        all: {
+          type: "boolean",
+          description: "Verify the most-recent N releases instead of a single version"
+        },
+        limit: {
+          type: "string",
+          description: "How many releases to verify in --all mode (default 5)"
+        },
+        json: { type: "boolean", description: "Emit LAFS envelope" }
+      },
+      async run({ args }) {
+        const version = typeof args.version === "string" ? args.version : void 0;
+        const all = args.all === true;
+        const limitArg = typeof args.limit === "string" ? args.limit : void 0;
+        const limit = limitArg ? Number.parseInt(limitArg, 10) : void 0;
+        await dispatchFromCli(
+          "query",
+          "provenance",
+          "provenance.verify",
+          {
+            ...version ? { version } : {},
+            all,
+            ...limit && Number.isFinite(limit) ? { limit } : {}
+          },
+          { command: "provenance" }
+        );
+      }
+    });
+    provenanceCommand = defineCommand({
+      meta: {
+        name: "provenance",
+        description: "Provenance-graph maintenance: backfill, verify, repair"
+      },
+      subCommands: {
+        backfill: backfillCommand3,
+        verify: verifyCommand2
+      },
+      async run({ cmd, rawArgs }) {
+        const firstArg = rawArgs?.find((a) => !a.startsWith("-"));
+        if (firstArg && cmd.subCommands && firstArg in cmd.subCommands) return;
+        await showUsage(cmd);
+      }
+    });
+  }
+});
+
 // packages/cleo/src/cli/commands/provider.ts
 var provider_exports = {};
 __export(provider_exports, {
@@ -53396,7 +54227,7 @@ var refresh_memory_exports = {};
 __export(refresh_memory_exports, {
   refreshMemoryCommand: () => refreshMemoryCommand
 });
-import { getProjectRoot as getProjectRoot29 } from "@cleocode/core";
+import { getProjectRoot as getProjectRoot32 } from "@cleocode/core";
 var refreshMemoryCommand;
 var init_refresh_memory = __esm({
   "packages/cleo/src/cli/commands/refresh-memory.ts"() {
@@ -53409,7 +54240,7 @@ var init_refresh_memory = __esm({
         description: "Regenerate .cleo/memory-bridge.md from brain.db"
       },
       async run() {
-        const projectDir = getProjectRoot29();
+        const projectDir = getProjectRoot32();
         const { writeMemoryBridge } = await import("@cleocode/core/internal");
         const result = await writeMemoryBridge(projectDir);
         if (result.written) {
@@ -53588,20 +54419,22 @@ var init_relates = __esm({
 // packages/cleo/src/cli/commands/release.ts
 var release_exports = {};
 __export(release_exports, {
+  SHIP_DEPRECATION_NOTICE: () => SHIP_DEPRECATION_NOTICE,
   releaseCommand: () => releaseCommand
 });
 import { release as release2 } from "@cleocode/core";
-var shipCommand, listCommand17, showCommand10, cancelCommand2, changelogCommand, rollbackCommand, rollbackFullCommand, prStatusCommand, channelCommand, startCommand7, verifyCommand2, publishCommand3, reconcileCommand4, releaseCommand;
+var SHIP_DEPRECATION_NOTICE, shipCommand, listCommand17, showCommand10, cancelCommand2, changelogCommand, rollbackCommand, rollbackFullCommand, prStatusCommand, channelCommand, planCommand3, openCommand, reconcileCommand4, releaseCommand;
 var init_release3 = __esm({
   "packages/cleo/src/cli/commands/release.ts"() {
     "use strict";
     init_dist();
     init_cli();
     init_renderers();
+    SHIP_DEPRECATION_NOTICE = "[DEPRECATED] `cleo release ship` is a deprecated alias and will be removed no earlier than the third release cycle after T9498. Use `cleo release plan <version> --epic <id>` followed by `cleo release open <version>`; publish runs via GHA workflow. Docs: T9345-CHILD-1.";
     shipCommand = defineCommand({
       meta: {
         name: "ship",
-        description: "Ship a release: gates \u2192 changelog \u2192 commit \u2192 tag \u2192 push"
+        description: "[DEPRECATED] Forwards to `release plan` + `release open`"
       },
       args: {
         version: {
@@ -53611,45 +54444,37 @@ var init_release3 = __esm({
         },
         epic: {
           type: "string",
-          description: "Epic task ID for commit message (e.g. T5576)",
+          description: "Epic task ID (forwarded to release plan / release open)",
           required: true
         },
         "dry-run": {
           type: "boolean",
-          description: "Preview all actions without writing anything"
-        },
-        push: {
-          type: "boolean",
-          description: "Push commit and tag (default: true)",
-          default: true
-        },
-        bump: {
-          type: "boolean",
-          description: "Bump version files (default: true)",
-          default: true
-        },
-        remote: {
-          type: "string",
-          description: "Git remote to push to (default: origin)"
-        },
-        force: {
-          type: "boolean",
-          description: "Bypass IVTR gate check with owner warning (breaks accountability chain)"
+          description: "Preview all actions without writing anything (plan dry-run only)"
         }
       },
       async run({ args }) {
+        process.stderr.write(`${SHIP_DEPRECATION_NOTICE}
+`);
         await dispatchFromCli(
           "mutate",
-          "pipeline",
-          "release.ship",
+          "release",
+          "release.plan",
           {
             version: args.version,
             epicId: args.epic,
-            dryRun: args["dry-run"],
-            push: args.push !== false,
-            bump: args.bump !== false,
-            remote: args.remote,
-            force: args.force
+            dryRun: args["dry-run"] === true
+          },
+          { command: "release" }
+        );
+        if (args["dry-run"] === true) {
+          return;
+        }
+        await dispatchFromCli(
+          "mutate",
+          "release",
+          "release.open",
+          {
+            version: args.version
           },
           { command: "release" }
         );
@@ -53818,75 +54643,148 @@ var init_release3 = __esm({
         await dispatchFromCli("query", "pipeline", "release.channel.show", {}, { command: "release" });
       }
     });
-    startCommand7 = defineCommand({
+    planCommand3 = defineCommand({
       meta: {
-        name: "start",
-        description: "Begin a release (validates version, captures branch, persists handle)"
+        name: "plan",
+        description: "Build the canonical Release Plan envelope and persist status=planned (T9525)"
       },
       args: {
-        version: { type: "positional", description: "Version to release", required: true },
-        epic: { type: "string", description: "Epic ID this release ships" },
-        branch: { type: "string", description: "Override detected branch" }
+        version: {
+          type: "positional",
+          description: "Candidate release version (e.g. v2026.6.0 or 2026.6.0)",
+          required: true
+        },
+        epic: {
+          type: "string",
+          description: "Epic task ID whose children are candidates for inclusion",
+          required: true
+        },
+        scheme: {
+          type: "string",
+          description: "Versioning scheme: calver | semver | calver-suffix"
+        },
+        channel: {
+          type: "string",
+          description: "Release channel: latest | beta | alpha | rc"
+        },
+        hotfix: {
+          type: "boolean",
+          description: "Mark plan as release_kind=hotfix"
+        },
+        "dry-run": {
+          type: "boolean",
+          description: "Compute plan + envelope without writing the plan file or DB row"
+        }
       },
       async run({ args }) {
-        const handle = await release2.releaseStart(args.version, {
-          epicId: args.epic,
-          branch: args.branch
-        });
-        cliOutput(handle, { command: "release", operation: "release.start" });
-      }
-    });
-    verifyCommand2 = defineCommand({
-      meta: { name: "verify", description: "Verify release gates + child task gate state" },
-      async run() {
-        const projectRoot = process.cwd();
-        const handle = release2.loadActiveReleaseHandle(projectRoot);
-        const result = await release2.releaseVerify(handle, {
-          runGate: release2.makeAdr061GateRunner(projectRoot)
-        });
-        cliOutput(result, { command: "release", operation: "release.verify" });
-        if (!result.passed) process.exit(1);
+        await dispatchFromCli(
+          "mutate",
+          "release",
+          "release.plan",
+          {
+            version: args.version,
+            epicId: args.epic,
+            scheme: args.scheme,
+            channel: args.channel,
+            hotfix: args.hotfix === true,
+            dryRun: args["dry-run"] === true
+          },
+          { command: "release" }
+        );
       }
     });
-    publishCommand3 = defineCommand({
-      meta: { name: "publish", description: "Publish release artifact (project-context driven)" },
-      args: { "dry-run": { type: "boolean", description: "Print command without executing" } },
+    openCommand = defineCommand({
+      meta: {
+        name: "open",
+        description: "Dispatch release-prepare workflow + transition releases.status to pr-opened"
+      },
+      args: {
+        version: {
+          type: "positional",
+          description: "Release version (e.g. v2026.6.0)",
+          required: true
+        },
+        workflow: {
+          type: "string",
+          description: "Workflow file to dispatch (default: release-prepare.yml)"
+        },
+        watch: {
+          type: "boolean",
+          description: "Poll gh run watch until the run reaches a terminal state"
+        },
+        "commit-plan": {
+          type: "boolean",
+          description: "Commit the plan file to the active branch before dispatching"
+        }
+      },
       async run({ args }) {
-        const result = await release2.releasePublish(release2.loadActiveReleaseHandle(process.cwd()), {
-          dryRun: args["dry-run"] === true
-        });
-        cliOutput(result, { command: "release", operation: "release.publish" });
-        if (!result.success) process.exit(1);
+        await dispatchFromCli(
+          "mutate",
+          "release",
+          "release.open",
+          {
+            version: args.version,
+            workflow: args.workflow,
+            watch: args.watch === true,
+            commitPlan: args["commit-plan"] === true
+          },
+          { command: "release" }
+        );
       }
     });
     reconcileCommand4 = defineCommand({
-      meta: { name: "reconcile", description: "Run post-release invariants for the active release" },
-      args: { "dry-run": { type: "boolean", description: "Preview without mutations" } },
+      meta: {
+        name: "reconcile",
+        description: "Reconcile a published release: backfill the 11 provenance tables"
+      },
+      args: {
+        version: {
+          type: "positional",
+          description: "Version string (e.g. v2026.6.0)",
+          required: true
+        },
+        "from-workflow": {
+          type: "boolean",
+          description: "Indicates invocation from release-publish.yml (affects logging only)"
+        },
+        rollback: {
+          type: "boolean",
+          description: "Reconcile a rollback rather than a publish (deferred to T9528)"
+        },
+        json: { type: "boolean", description: "Emit LAFS envelope" }
+      },
       async run({ args }) {
-        const result = await release2.releaseReconcile(release2.loadActiveReleaseHandle(process.cwd()), {
-          dryRun: args["dry-run"] === true
+        const result = await release2.releaseReconcileV2(args.version, {
+          fromWorkflow: args["from-workflow"] === true,
+          rollback: args.rollback === true
         });
         cliOutput(result, { command: "release", operation: "release.reconcile" });
         if (!result.success) process.exit(1);
       }
     });
     releaseCommand = defineCommand({
-      meta: { name: "release", description: "Release lifecycle management" },
+      meta: {
+        name: "release",
+        description: "Release lifecycle management \u2014 4-verb pipeline: plan \u2192 open \u2192 reconcile / rollback. Deprecated: ship (forwards to plan + open; see SPEC-T9345 \xA712)."
+      },
       subCommands: {
-        ship: shipCommand,
+        // Canonical SPEC-T9345 4-verb pipeline — list these first so `--help`
+        // surfaces them as the documented default (T9538 / R-420).
+        plan: planCommand3,
+        open: openCommand,
+        reconcile: reconcileCommand4,
+        rollback: rollbackCommand,
+        // Read-only helpers — not deprecated.
         list: listCommand17,
         show: showCommand10,
         cancel: cancelCommand2,
         changelog: changelogCommand,
-        rollback: rollbackCommand,
-        "rollback-full": rollbackFullCommand,
-        channel: channelCommand,
         "pr-status": prStatusCommand,
-        // Canonical 4-step pipeline (T1597 / ADR-063)
-        start: startCommand7,
-        verify: verifyCommand2,
-        publish: publishCommand3,
-        reconcile: reconcileCommand4
+        channel: channelCommand,
+        "rollback-full": rollbackFullCommand,
+        // Deprecated verbs (kept for the migration window — SPEC-T9345 §12).
+        // R-420: ship → plan + open
+        ship: shipCommand
       },
       async run({ cmd, rawArgs }) {
         const firstArg = rawArgs?.find((a) => !a.startsWith("-"));
@@ -54723,7 +55621,7 @@ __export(restore_exports, {
 import fs3 from "node:fs";
 import path5 from "node:path";
 import { CleoError as CleoError8, getTaskAccessor as getTaskAccessor3 } from "@cleocode/core";
-import { getProjectRoot as getProjectRoot30 } from "@cleocode/core/internal";
+import { getProjectRoot as getProjectRoot33 } from "@cleocode/core/internal";
 function parseMarkdownValue(raw) {
   const trimmed = raw.trim();
   if (trimmed === "_(not present)_" || trimmed === "") return void 0;
@@ -54843,7 +55741,7 @@ var init_restore = __esm({
         description: "Apply manually-resolved conflicts from .cleo/restore-conflicts.md"
       },
       async run() {
-        const projectRoot = getProjectRoot30();
+        const projectRoot = getProjectRoot33();
         const reportPath = path5.join(projectRoot, CLEO_DIR_NAME, RESTORE_CONFLICTS_MD);
         if (!fs3.existsSync(reportPath)) {
           humanLine("No pending restore conflicts. Nothing to finalize.");
@@ -55888,11 +56786,11 @@ async function runPostUpdateDiagnostics(opts) {
         input: process.stdin,
         output: process.stdout
       });
-      shouldMigrate = await new Promise((resolve5) => {
+      shouldMigrate = await new Promise((resolve8) => {
         rl.question("  Do you want to run the upgrade now? [Y/n] ", (answer) => {
           rl.close();
           const clean = answer.trim().toLowerCase();
-          resolve5(clean === "" || clean === "y" || clean === "yes");
+          resolve8(clean === "" || clean === "y" || clean === "yes");
         });
       });
     }
@@ -56965,7 +57863,7 @@ var sequence_exports = {};
 __export(sequence_exports, {
   sequenceCommand: () => sequenceCommand
 });
-import { getProjectRoot as getProjectRoot31 } from "@cleocode/core/internal";
+import { getProjectRoot as getProjectRoot34 } from "@cleocode/core/internal";
 var showCommand12, checkCommand6, repairCommand, sequenceCommand;
 var init_sequence = __esm({
   "packages/cleo/src/cli/commands/sequence.ts"() {
@@ -57001,7 +57899,7 @@ var init_sequence = __esm({
       meta: { name: "repair", description: "Reset counter to max + 1 if behind" },
       async run() {
         const { repairSequence } = await import("@cleocode/core/internal");
-        const projectRoot = getProjectRoot31();
+        const projectRoot = getProjectRoot34();
         const repair = await repairSequence(projectRoot);
         const result = {
           repaired: repair.repaired,
@@ -57055,7 +57953,7 @@ async function promptOwnerAuthPassword(sessionName) {
     terminal: true
   });
   process.stderr.write(`[cleo] Enter owner-auth password for session "${sessionName}": `);
-  const password = await new Promise((resolve5) => {
+  const password = await new Promise((resolve8) => {
     if (process.stdin.setRawMode) {
       process.stdin.setRawMode(
         true
@@ -57073,10 +57971,10 @@ async function promptOwnerAuthPassword(sessionName) {
           );
         }
         process.stderr.write("\n");
-        resolve5(pw);
+        resolve8(pw);
       } else if (ch === "") {
         process.stderr.write("\n[cleo] Cancelled.\n");
-        resolve5("");
+        resolve8("");
       } else if (ch === "\x7F" || ch === "\b") {
         pw = pw.slice(0, -1);
       } else {
@@ -57090,7 +57988,7 @@ async function promptOwnerAuthPassword(sessionName) {
   const token = deriveOwnerAuthToken(sessionName, password);
   return token;
 }
-var startCommand8, endCommand, handoffCommand2, statusCommand12, resumeCommand2, findCommand6, listCommand21, gcCommand2, showCommand13, driftCommand, contextDriftCommand, suspendCommand, recordAssumptionCommand, recordDecisionCommand, decisionLogCommand, sessionCommand;
+var startCommand7, endCommand, handoffCommand2, statusCommand12, resumeCommand2, findCommand6, listCommand21, gcCommand2, showCommand13, driftCommand, contextDriftCommand, suspendCommand, recordAssumptionCommand, recordDecisionCommand, decisionLogCommand, sessionCommand;
 var init_session4 = __esm({
   "packages/cleo/src/cli/commands/session.ts"() {
     "use strict";
@@ -57098,7 +57996,7 @@ var init_session4 = __esm({
     init_dist();
     init_cli();
     init_renderers();
-    startCommand8 = defineCommand({
+    startCommand7 = defineCommand({
       meta: { name: "start", description: "Start a new session" },
       args: {
         scope: {
@@ -57444,8 +58342,8 @@ var init_session4 = __esm({
         "audit-scope": { type: "string", description: "Audit log scope (global|local)" }
       },
       async run({ args }) {
-        const { detectSessionDrift, getProjectRoot: getProjectRoot34 } = await import("@cleocode/core");
-        const projectRoot = await getProjectRoot34();
+        const { detectSessionDrift, getProjectRoot: getProjectRoot38 } = await import("@cleocode/core");
+        const projectRoot = await getProjectRoot38();
         const scope = args["audit-scope"] === "local" ? "local" : "global";
         const report = await detectSessionDrift({ projectRoot, auditScope: scope });
         cliOutput(report, { command: "session drift", operation: "session.drift" });
@@ -57614,7 +58512,7 @@ var init_session4 = __esm({
     sessionCommand = defineCommand({
       meta: { name: "session", description: "Manage work sessions" },
       subCommands: {
-        start: startCommand8,
+        start: startCommand7,
         end: endCommand,
         stop: endCommand,
         handoff: handoffCommand2,
@@ -58358,15 +59256,15 @@ var init_snapshot = __esm({
 // packages/cleo/src/cli/commands/start.ts
 var start_exports = {};
 __export(start_exports, {
-  startCommand: () => startCommand9
+  startCommand: () => startCommand8
 });
-var startCommand9;
+var startCommand8;
 var init_start = __esm({
   "packages/cleo/src/cli/commands/start.ts"() {
     "use strict";
     init_dist();
     init_cli();
-    startCommand9 = defineCommand({
+    startCommand8 = defineCommand({
       meta: {
         name: "start",
         description: "Start working on a task (sets it as the current task in the active session)"
@@ -59306,7 +60204,7 @@ __export(token_exports, {
   tokenCommand: () => tokenCommand
 });
 import { readFileSync as readFileSync16 } from "node:fs";
-import { getProjectRoot as getProjectRoot32, measureTokenExchange, recordTokenExchange as recordTokenExchange2 } from "@cleocode/core/internal";
+import { getProjectRoot as getProjectRoot35, measureTokenExchange, recordTokenExchange as recordTokenExchange2 } from "@cleocode/core/internal";
 function readPayload(args, textKey, fileKey) {
   const text = args[textKey];
   const file = args[fileKey];
@@ -59470,7 +60368,7 @@ var init_token = __esm({
           domain: args.domain,
           operation: args.operation
         };
-        const result = args.record ? await recordTokenExchange2(getProjectRoot32(), input2) : await measureTokenExchange(input2);
+        const result = args.record ? await recordTokenExchange2(getProjectRoot35(), input2) : await measureTokenExchange(input2);
         cliOutput(result, {
           command: "token",
           operation: args.record ? "admin.token.record" : "token.estimate"
@@ -59506,7 +60404,7 @@ __export(transcript_exports, {
 });
 import { homedir as homedir8 } from "node:os";
 import { join as join24 } from "node:path";
-import { getProjectRoot as getProjectRoot33 } from "@cleocode/core";
+import { getProjectRoot as getProjectRoot36 } from "@cleocode/core";
 import {
   parseDurationMs,
   pruneTranscripts,
@@ -59536,7 +60434,7 @@ var init_transcript = __esm({
       async run({ args }) {
         if (args.pending) {
           try {
-            const projectRoot = getProjectRoot33();
+            const projectRoot = getProjectRoot36();
             const { scanPendingTranscripts } = await import("@cleocode/core/memory/transcript-scanner.js");
             const pending = await scanPendingTranscripts(projectRoot);
             cliOutput(
@@ -59633,7 +60531,7 @@ var init_transcript = __esm({
       async run({ args }) {
         const tier = args.tier ?? "warm";
         const dryRun = args["dry-run"] ?? false;
-        const projectRoot = getProjectRoot33();
+        const projectRoot = getProjectRoot36();
         try {
           const { extractTranscript } = await import("@cleocode/core/memory/transcript-extractor.js");
           const { findSessionTranscriptPath, listAllTranscripts } = await import("@cleocode/core/memory/transcript-scanner.js");
@@ -59745,7 +60643,7 @@ var init_transcript = __esm({
         const dryRun = args["dry-run"] ?? false;
         const olderThanHours = args["older-than-hours"] ? Number.parseInt(args["older-than-hours"], 10) : 24;
         const limit = args.limit ? Number.parseInt(args.limit, 10) : void 0;
-        const projectRoot = getProjectRoot33();
+        const projectRoot = getProjectRoot36();
         try {
           const { extractTranscript } = await import("@cleocode/core/memory/transcript-extractor.js");
           const { listAllTranscripts } = await import("@cleocode/core/memory/transcript-scanner.js");
@@ -60229,19 +61127,90 @@ var upgrade_exports = {};
 __export(upgrade_exports, {
   upgradeCommand: () => upgradeCommand
 });
-import { CleoError as CleoError11, diagnoseUpgrade, runUpgrade as runUpgrade2 } from "@cleocode/core/internal";
-var upgradeCommand;
-var init_upgrade = __esm({
+import { resolve as resolve7 } from "node:path";
+import { CleoError as CleoError11, diagnoseUpgrade, runUpgrade as runUpgrade2, upgradeWorkflows as upgradeWorkflows2 } from "@cleocode/core/internal";
+var workflowsSubcommand, upgradeCommand;
+var init_upgrade2 = __esm({
   "packages/cleo/src/cli/commands/upgrade.ts"() {
     "use strict";
     init_dist();
     init_progress();
     init_renderers();
+    init_init();
+    workflowsSubcommand = defineCommand({
+      meta: {
+        name: "workflows",
+        description: "Re-render the four release-pipeline workflow templates and report drift (T9536)."
+      },
+      args: {
+        "dry-run": {
+          type: "boolean",
+          description: "Print the per-template diff without writing.",
+          default: false
+        },
+        check: {
+          type: "boolean",
+          description: "Exit 1 if drift is detected. Implies --dry-run for write semantics.",
+          default: false
+        },
+        force: {
+          type: "boolean",
+          description: "Overwrite drifted files (excluding `.workflow-overrides.yml` keys).",
+          default: false
+        },
+        json: { type: "boolean", description: "Output as JSON" },
+        human: { type: "boolean", description: "Force human-readable output" },
+        quiet: { type: "boolean", description: "Suppress non-essential output" }
+      },
+      async run({ args }) {
+        try {
+          const dryRun = args["dry-run"] === true || args.check === true;
+          const force = args.force === true && !dryRun;
+          const result = await upgradeWorkflows2({
+            projectRoot: resolve7(process.cwd()),
+            templatesDir: getWorkflowTemplatesDir(),
+            dryRun,
+            force
+          });
+          cliOutput(
+            {
+              outcomes: result.outcomes.map((o) => ({
+                template: o.template,
+                targetPath: o.targetPath,
+                status: o.status,
+                overrideDeclared: o.overrideDeclared
+              })),
+              resolvedTools: result.resolvedTools,
+              hasDrift: result.hasDrift,
+              ...dryRun ? {
+                rendered: result.outcomes.map((o) => ({
+                  template: o.template,
+                  rendered: o.rendered
+                }))
+              } : {}
+            },
+            { command: "upgrade", operation: "upgrade.workflows" }
+          );
+          if (args.check === true && result.hasDrift) {
+            process.exit(1);
+          }
+        } catch (err) {
+          if (err instanceof CleoError11) {
+            cliError(err.message, err.code, { name: "CleoError", fix: err.fix });
+            process.exit(err.code);
+          }
+          throw err;
+        }
+      }
+    });
     upgradeCommand = defineCommand({
       meta: {
         name: "upgrade",
         description: "Unified project maintenance (storage migration, schema repair, structural fixes, doc refresh)"
       },
+      subCommands: {
+        workflows: workflowsSubcommand
+      },
       args: {
         status: {
           type: "boolean",
@@ -60289,7 +61258,9 @@ var init_upgrade = __esm({
           description: "Suppress non-essential output"
         }
       },
-      async run({ args }) {
+      async run({ args, cmd, rawArgs }) {
+        const firstPositional = rawArgs?.find((a) => !a.startsWith("-"));
+        if (firstPositional && cmd.subCommands && firstPositional in cmd.subCommands) return;
         const isHuman = args.human === true || !!process.stdout.isTTY && args.json !== true;
         const progress = createUpgradeProgress(isHuman);
         try {
@@ -60562,7 +61533,7 @@ Logs: ${logFile}`
       }
     } catch {
     }
-    await new Promise((resolve5) => setTimeout(resolve5, 500));
+    await new Promise((resolve8) => setTimeout(resolve8, 500));
   }
   if (!started) {
     try {
@@ -60583,7 +61554,7 @@ Logs: ${logFile}`
     { command: "web", message: `CLEO Web UI running on port ${port}` }
   );
 }
-var DEFAULT_PORT, DEFAULT_HOST, startCommand10, stopCommand5, restartCommand, statusCommand15, openCommand, webCommand;
+var DEFAULT_PORT, DEFAULT_HOST, startCommand9, stopCommand5, restartCommand, statusCommand15, openCommand2, webCommand;
 var init_web = __esm({
   "packages/cleo/src/cli/commands/web.ts"() {
     "use strict";
@@ -60592,7 +61563,7 @@ var init_web = __esm({
     init_renderers();
     DEFAULT_PORT = 3456;
     DEFAULT_HOST = "127.0.0.1";
-    startCommand10 = defineCommand({
+    startCommand9 = defineCommand({
       meta: { name: "start", description: "Start the web server" },
       args: {
         port: {
@@ -60639,7 +61610,7 @@ var init_web = __esm({
           }
           for (let i = 0; i < 60; i++) {
             if (!isProcessRunning(status.pid)) break;
-            await new Promise((resolve5) => setTimeout(resolve5, 500));
+            await new Promise((resolve8) => setTimeout(resolve8, 500));
           }
           if (isProcessRunning(status.pid)) {
             try {
@@ -60691,7 +61662,7 @@ var init_web = __esm({
             }
             for (let i = 0; i < 60; i++) {
               if (!isProcessRunning(status.pid)) break;
-              await new Promise((resolve5) => setTimeout(resolve5, 500));
+              await new Promise((resolve8) => setTimeout(resolve8, 500));
             }
             if (isProcessRunning(status.pid)) {
               try {
@@ -60730,7 +61701,7 @@ var init_web = __esm({
         }
       }
     });
-    openCommand = defineCommand({
+    openCommand2 = defineCommand({
       meta: { name: "open", description: "Open browser to the UI" },
       async run() {
         try {
@@ -60766,11 +61737,11 @@ var init_web = __esm({
     webCommand = defineCommand({
       meta: { name: "web", description: "Manage CLEO Web UI server" },
       subCommands: {
-        start: startCommand10,
+        start: startCommand9,
         stop: stopCommand5,
         restart: restartCommand,
         status: statusCommand15,
-        open: openCommand
+        open: openCommand2
       },
       async run({ cmd, rawArgs }) {
         const firstArg = rawArgs?.find((a) => !a.startsWith("-"));
@@ -60781,13 +61752,242 @@ var init_web = __esm({
   }
 });
 
+// packages/cleo/src/cli/commands/worktree.ts
+var worktree_exports = {};
+__export(worktree_exports, {
+  worktreeCommand: () => worktreeCommand
+});
+import readline4 from "node:readline";
+import { getProjectRoot as getProjectRoot37, listWorktrees as listWorktrees2 } from "@cleocode/core/internal";
+async function promptYesNo2(question) {
+  return new Promise((resolve8) => {
+    const rl = readline4.createInterface({ input: process.stdin, output: process.stdout });
+    rl.question(`${question} [y/N]: `, (answer) => {
+      rl.close();
+      const trimmed = answer.trim().toLowerCase();
+      resolve8(trimmed === "y" || trimmed === "yes");
+    });
+  });
+}
+function renderOrphanPreamble(wt) {
+  return [
+    "Orphaned worktree found:",
+    `  Path: ${wt.path}`,
+    `  Branch: ${wt.branch}${wt.isMerged ? " (merged to main)" : ""}`,
+    `  Task status: ${wt.owningTaskStatus ?? "(missing)"}`,
+    `  Last activity: ${wt.lastActivity}`,
+    ""
+  ].join("\n");
+}
+var VALID_STATUS_VALUES, listCommand25, pruneCommand3, forceUnlockCommand, worktreeCommand;
+var init_worktree3 = __esm({
+  "packages/cleo/src/cli/commands/worktree.ts"() {
+    "use strict";
+    init_dist();
+    init_cli();
+    init_renderers();
+    VALID_STATUS_VALUES = ["active", "stale", "merged", "orphan", "locked"];
+    listCommand25 = defineCommand({
+      meta: {
+        name: "list",
+        description: "List worktrees attached to this project with status classification (active|stale|merged|orphan|locked)."
+      },
+      args: {
+        status: {
+          type: "string",
+          description: `Filter by status category (single value or comma-separated list of ${VALID_STATUS_VALUES.join("|")}).`
+        },
+        days: {
+          type: "string",
+          description: "Staleness threshold in days for the isStale classifier (default: 7)."
+        }
+      },
+      async run({ args }) {
+        const statusFilter = typeof args["status"] === "string" && args["status"].length > 0 ? args["status"] : void 0;
+        const staleDaysRaw = typeof args["days"] === "string" ? args["days"] : void 0;
+        const staleDays = staleDaysRaw !== void 0 ? Number.parseInt(staleDaysRaw, 10) : void 0;
+        await dispatchFromCli(
+          "query",
+          "worktree",
+          "list",
+          {
+            ...statusFilter !== void 0 ? { statusFilter } : {},
+            ...staleDays !== void 0 && !Number.isNaN(staleDays) ? { staleDays } : {}
+          },
+          { command: "worktree-list", operation: "worktree.list" }
+        );
+      }
+    });
+    pruneCommand3 = defineCommand({
+      meta: {
+        name: "prune",
+        description: "Remove orphan/merged worktrees with per-orphan Y/N confirmation."
+      },
+      args: {
+        orphaned: {
+          type: "boolean",
+          description: "Prune worktrees classified as orphan or merged (required).",
+          default: false
+        },
+        yes: {
+          type: "boolean",
+          description: "Skip per-orphan confirmation. Required on non-TTY (CI / pipe) input.",
+          default: false
+        },
+        "dry-run": {
+          type: "boolean",
+          description: "Show what would be pruned without acting. No audit-log entries written.",
+          default: false
+        },
+        days: {
+          type: "string",
+          description: "Override staleness threshold passed through to the listing (default: 7)."
+        }
+      },
+      async run({ args }) {
+        if (args["orphaned"] !== true) {
+          cliError(
+            "cleo worktree prune requires --orphaned (other categories are reserved for future flags).",
+            2
+          );
+          process.exit(2);
+          return;
+        }
+        const dryRun = args["dry-run"] === true;
+        const yes = args["yes"] === true;
+        const staleDaysRaw = typeof args["days"] === "string" ? args["days"] : void 0;
+        const staleDays = staleDaysRaw !== void 0 ? Number.parseInt(staleDaysRaw, 10) : void 0;
+        const projectRoot = getProjectRoot37();
+        const listResult = await listWorktrees2({
+          projectRoot,
+          ...staleDays !== void 0 && !Number.isNaN(staleDays) ? { staleDays } : {}
+        });
+        if (!listResult.success) {
+          cliError(`Failed to enumerate worktrees: ${listResult.error.message}`, 1);
+          process.exit(1);
+          return;
+        }
+        const candidates = listResult.data.worktrees.filter(
+          (w) => w.statusCategory === "orphan" || w.statusCategory === "merged"
+        );
+        if (candidates.length === 0) {
+          cliOutput(
+            {
+              prunedCount: 0,
+              skippedCount: 0,
+              outcomes: [],
+              errors: [],
+              dryRun,
+              message: "No orphan or merged worktrees found."
+            },
+            { command: "worktree-prune", operation: "worktree.prune" }
+          );
+          return;
+        }
+        const isTty = process.stdin.isTTY === true;
+        if (!isTty && !yes && !dryRun) {
+          cliError(
+            "cleo worktree prune is interactive \u2014 re-run with --yes or --dry-run on non-TTY input.",
+            2
+          );
+          process.exit(2);
+          return;
+        }
+        let confirmedPaths;
+        let skippedByUser = 0;
+        if (dryRun || yes) {
+          confirmedPaths = candidates.map((w) => w.path);
+        } else {
+          confirmedPaths = [];
+          for (const wt of candidates) {
+            process.stdout.write(renderOrphanPreamble(wt));
+            const accepted = await promptYesNo2("Prune this worktree?");
+            if (accepted) {
+              confirmedPaths.push(wt.path);
+            } else {
+              skippedByUser += 1;
+            }
+          }
+        }
+        if (confirmedPaths.length === 0) {
+          cliOutput(
+            {
+              prunedCount: 0,
+              skippedCount: skippedByUser,
+              outcomes: [],
+              errors: [],
+              dryRun,
+              message: skippedByUser > 0 ? `Skipped ${skippedByUser} orphan(s) on user request.` : "No-op."
+            },
+            { command: "worktree-prune", operation: "worktree.prune" }
+          );
+          return;
+        }
+        await dispatchFromCli(
+          "mutate",
+          "worktree",
+          "prune",
+          {
+            dryRun,
+            paths: confirmedPaths,
+            ...staleDays !== void 0 && !Number.isNaN(staleDays) ? { staleDays } : {}
+          },
+          { command: "worktree-prune", operation: "worktree.prune" }
+        );
+      }
+    });
+    forceUnlockCommand = defineCommand({
+      meta: {
+        name: "force-unlock",
+        description: "Clear wedged lock state (.git/index.lock + git worktree unlock) for a task."
+      },
+      args: {
+        taskId: {
+          type: "positional",
+          description: "The task ID whose worktree should be force-unlocked (e.g. T9547).",
+          required: true
+        }
+      },
+      async run({ args }) {
+        const rawTaskId = typeof args["taskId"] === "string" ? args["taskId"] : "";
+        if (rawTaskId.length === 0) {
+          cliError("Missing required positional: <taskId>.", 2);
+          process.exit(2);
+          return;
+        }
+        await dispatchFromCli(
+          "mutate",
+          "worktree",
+          "forceUnlock",
+          { taskId: rawTaskId },
+          { command: "worktree-force-unlock", operation: "worktree.forceUnlock" }
+        );
+      }
+    });
+    worktreeCommand = defineCommand({
+      meta: {
+        name: "worktree",
+        description: "Inspect and manage CLEO-attached git worktrees. See `cleo worktree <subcommand> --help` for details."
+      },
+      subCommands: {
+        list: listCommand25,
+        prune: pruneCommand3,
+        "force-unlock": forceUnlockCommand
+      },
+      async run() {
+        await showUsage(worktreeCommand);
+      }
+    });
+  }
+});
+
 // packages/cleo/src/cli/index.ts
 init_dist();
 init_field_context();
 init_format_context();
 import { readFileSync as readFileSync17 } from "node:fs";
-import { dirname as dirname8, join as join27 } from "node:path";
-import { fileURLToPath as fileURLToPath5 } from "node:url";
+import { dirname as dirname10, join as join27 } from "node:path";
+import { fileURLToPath as fileURLToPath6 } from "node:url";
 
 // packages/cleo/src/cli/generated/command-manifest.ts
 var COMMAND_MANIFEST = [
@@ -61311,7 +62511,7 @@ var COMMAND_MANIFEST = [
     exportName: "planCommand",
     name: "plan",
     description: "Task prioritization view: in-progress epics, ready tasks, blocked tasks, open bugs with scoring. Use when deciding what to work on next.",
-    load: async () => (await Promise.resolve().then(() => (init_plan(), plan_exports))).planCommand
+    load: async () => (await Promise.resolve().then(() => (init_plan2(), plan_exports))).planCommand
   },
   {
     exportName: "playbookCommand",
@@ -61325,6 +62525,12 @@ var COMMAND_MANIFEST = [
     description: "Remove parent from task, making it root-level",
     load: async () => (await Promise.resolve().then(() => (init_promote(), promote_exports))).promoteCommand
   },
+  {
+    exportName: "provenanceCommand",
+    name: "provenance",
+    description: "Provenance-graph maintenance: backfill, verify, repair",
+    load: async () => (await Promise.resolve().then(() => (init_provenance2(), provenance_exports))).provenanceCommand
+  },
   {
     exportName: "providerCommand",
     name: "provider",
@@ -61557,7 +62763,7 @@ var COMMAND_MANIFEST = [
     exportName: "upgradeCommand",
     name: "upgrade",
     description: "Unified project maintenance (storage migration, schema repair, structural fixes, doc refresh)",
-    load: async () => (await Promise.resolve().then(() => (init_upgrade(), upgrade_exports))).upgradeCommand
+    load: async () => (await Promise.resolve().then(() => (init_upgrade2(), upgrade_exports))).upgradeCommand
   },
   {
     exportName: "verifyCommand",
@@ -61570,6 +62776,12 @@ var COMMAND_MANIFEST = [
     name: "web",
     description: "Manage CLEO Web UI server",
     load: async () => (await Promise.resolve().then(() => (init_web(), web_exports))).webCommand
+  },
+  {
+    exportName: "worktreeCommand",
+    name: "worktree",
+    description: "Inspect CLEO-managed git worktrees attached to this project. ",
+    load: async () => (await Promise.resolve().then(() => (init_worktree3(), worktree_exports))).worktreeCommand
   }
 ];
 
@@ -61893,7 +63105,7 @@ async function detectFirstRun() {
   return true;
 }
 function waitForEnterOrTimeout(timeoutMs) {
-  return new Promise((resolve5) => {
+  return new Promise((resolve8) => {
     let resolved = false;
     const finish = () => {
       if (resolved) return;
@@ -61905,7 +63117,7 @@ function waitForEnterOrTimeout(timeoutMs) {
         process.stdin.pause();
       } catch {
       }
-      resolve5();
+      resolve8();
     };
     const onData = (chunk) => {
       const s = typeof chunk === "string" ? chunk : chunk.toString("utf8");
@@ -61970,7 +63182,7 @@ Or via NodeSource: https://github.com/nodesource/distributions
   }
 }
 function getPackageVersion() {
-  const pkgPath = join27(dirname8(fileURLToPath5(import.meta.url)), "../../package.json");
+  const pkgPath = join27(dirname10(fileURLToPath6(import.meta.url)), "../../package.json");
   const pkg = JSON.parse(readFileSync17(pkgPath, "utf-8"));
   return pkg.version;
 }
@@ -62073,8 +63285,8 @@ async function runStartupMaintenance() {
     detectAndRemoveLegacyGlobalFiles,
     detectAndRemoveStrayProjectNexus,
     getGlobalSalt,
-    getLogger: getLogger17,
-    getProjectRoot: getProjectRoot34,
+    getLogger: getLogger20,
+    getProjectRoot: getProjectRoot38,
     isCleanupMarkerSet,
     migrateSignaldockToConduit,
     needsSignaldockToConduitMigration,
@@ -62083,7 +63295,7 @@ async function runStartupMaintenance() {
   } = await import("@cleocode/core/internal");
   let projectRootForCleanup = "";
   try {
-    projectRootForCleanup = getProjectRoot34();
+    projectRootForCleanup = getProjectRoot38();
   } catch {
   }
   if (!isCleanupMarkerSet(CLI_VERSION, projectRootForCleanup)) {
@@ -62099,11 +63311,11 @@ async function runStartupMaintenance() {
     }
     setCleanupMarker(CLI_VERSION, projectRootForCleanup);
   }
-  const _startupLog = getLogger17("cli-startup");
+  const _startupLog = getLogger20("cli-startup");
   const isInitInvocation = process.argv.slice(2).some((a) => a === "init");
   if (!isInitInvocation) {
     try {
-      const _projectRootForMigration = getProjectRoot34();
+      const _projectRootForMigration = getProjectRoot38();
       if (needsSignaldockToConduitMigration(_projectRootForMigration)) {
         const migrationResult = migrateSignaldockToConduit(_projectRootForMigration);
         if (migrationResult.status === "failed") {