@cleocode/cleo 2026.9.22 → 2026.9.23

package/dist/cli/index.js

@@ -1815,7 +1815,7 @@ var init_acceptance_gate_schema = __esm({
             message: "Result cannot precede input capture"
           });
         const executable = ["test", "command", "lint"].includes(result.kind);
-        if (executable && !binding.invocation)
+        if (executable && !binding.invocation && result.result !== "error")
           context.addIssue({
             code: "custom",
             path: ["binding", "invocation"],
@@ -6330,12 +6330,21 @@ var init_operations_registry = __esm({
         gateway: "query",
         domain: "tasks",
         operation: "history",
-        description: "Show task work history (time tracked per task)",
+        description: "Show task work history; with taskId, the task audit trail; with ranking, who changed its priority/severity/kind/depends and why (T12693)",
         tier: 1,
         idempotent: true,
         sessionRequired: false,
         requiredParams: [],
-        params: []
+        params: [
+          { name: "taskId", type: "string", required: false, description: "Task to show history for" },
+          { name: "limit", type: "number", required: false, description: "Maximum entries" },
+          {
+            name: "ranking",
+            type: "boolean",
+            required: false,
+            description: "Only ranking-input changes (actor, session, reason, before/after)"
+          }
+        ]
       },
       {
         gateway: "query",
@@ -8830,6 +8839,32 @@ var init_operations_registry = __esm({
         ],
         outputSchema: OUTPUT_CONTRACTS["tasks.assignee"]
       },
+      {
+        gateway: "mutate",
+        domain: "tasks",
+        operation: "ranking.revert",
+        description: "tasks.ranking.revert (mutate) \u2014 undo one recorded ranking change (priority/severity/kind/depends) as a new audited change (T12693, D11161)",
+        tier: 1,
+        idempotent: false,
+        sessionRequired: false,
+        requiredParams: ["entryId"],
+        params: [
+          {
+            name: "entryId",
+            type: "string",
+            required: true,
+            description: "ranking_changed audit row id (cleo history ranking <taskId>)",
+            cli: { positional: true }
+          },
+          { name: "reason", type: "string", required: false, description: "Why it is reverted" },
+          {
+            name: "force",
+            type: "boolean",
+            required: false,
+            description: "Revert even though a field changed again since"
+          }
+        ]
+      },
       {
         gateway: "mutate",
         domain: "tasks",
@@ -16866,7 +16901,10 @@ var init_evidence_atom_schema = __esm({
           ["commit", "note"],
           ["decision", "files"],
           ["decision", "note"],
-          ["pr", "files"]
+          ["pr", "files"],
+          // T12689: a deletion-only PR (no bytes to hash). Contextual validation
+          // accepts this only when every change the PR made is a deletion.
+          ["pr", "note"]
         ]
       },
       testsPassed: { oneOf: [["test-run"], ["tool"], ["ci"]] },
@@ -22280,7 +22318,7 @@ var init_collection_keys = __esm({
 
 // packages/contracts/src/decide.ts
 import { z as z24 } from "zod";
-var DECISION_QUESTION_TYPES, DECISION_OUTCOME_SOURCES, DECISION_REQUEST_LIMITS, decisionQuestionTypeSchema, decisionOutcomeSourceSchema, decisionInstructionsSchema, unitIntervalSchema, decisionStateSchema, noulDecisionQuestionSchema, choiceDecisionQuestionSchema, scoreDecisionQuestionSchema, decisionQuestionSchema, decisionRequestSchema, noulDecisionAnswerSchema, choiceDecisionAnswerSchema, scoreDecisionAnswerSchema, decisionAnswerSchema, decisionOutcomeSchema, decisionProviderConfigSchema;
+var DECISION_QUESTION_TYPES, DECISION_OUTCOME_SOURCES, DECISION_REQUEST_LIMITS, DECISION_PROVIDER_KINDS, LAYAHOST_BASE_URL, LAYAHOST_DEFAULT_MODEL, JEV_MINIMUM_CAPABILITIES, decisionQuestionTypeSchema, decisionOutcomeSourceSchema, decisionInstructionsSchema, unitIntervalSchema, decisionStateSchema, noulDecisionQuestionSchema, choiceDecisionQuestionSchema, scoreDecisionQuestionSchema, decisionQuestionSchema, decisionRequestSchema, noulDecisionAnswerSchema, choiceDecisionAnswerSchema, scoreDecisionAnswerSchema, decisionAnswerSchema, decisionOutcomeSchema, decisionProviderKindSchema, decisionProviderConfigSchema;
 var init_decide = __esm({
   "packages/contracts/src/decide.ts"() {
     "use strict";
@@ -22304,6 +22342,15 @@ var init_decide = __esm({
       /** Maximum number of levels on a `score` question's scale. */
       maxScoreLevels: 10
     };
+    DECISION_PROVIDER_KINDS = ["layahost", "jev"];
+    LAYAHOST_BASE_URL = "https://layahost.com";
+    LAYAHOST_DEFAULT_MODEL = "laya-auto";
+    JEV_MINIMUM_CAPABILITIES = {
+      wire: "jev-systemone/1",
+      maxQuestionsPerRequest: 32,
+      maxStateChars: 32e3,
+      reportsCost: "usd"
+    };
     decisionQuestionTypeSchema = z24.enum(DECISION_QUESTION_TYPES);
     decisionOutcomeSourceSchema = z24.enum(DECISION_OUTCOME_SOURCES);
     decisionInstructionsSchema = z24.union([z24.string(), z24.record(z24.string(), z24.json())]);
@@ -22341,6 +22388,8 @@ var init_decide = __esm({
     ]);
     decisionRequestSchema = z24.object({
       model: z24.string().min(1).optional(),
+      lang: z24.string().regex(/^[a-z]{2,3}(-[A-Za-z0-9]{2,8})?$/).optional(),
+      cache: z24.boolean().optional(),
       state: decisionStateSchema,
       questions: z24.record(z24.string().min(1), decisionQuestionSchema).refine(
         (questions) => {
@@ -22381,14 +22430,29 @@ var init_decide = __esm({
       requestId: z24.string().min(1).optional(),
       latencyMs: z24.number().nonnegative(),
       costUsd: z24.number().nonnegative().optional(),
+      costMicros: z24.number().int().nonnegative().optional(),
+      balanceMicros: z24.number().int().optional(),
+      checkpoint: z24.string().min(1).optional(),
       inputTokens: z24.number().int().nonnegative().optional()
     });
+    decisionProviderKindSchema = z24.enum(DECISION_PROVIDER_KINDS);
     decisionProviderConfigSchema = z24.object({
-      baseUrl: z24.url()
+      baseUrl: z24.url(),
+      provider: decisionProviderKindSchema.optional()
     });
   }
 });
 
+// packages/contracts/src/decide-sites.ts
+var DECISION_RUNGS, DECISION_SITE_MODES;
+var init_decide_sites = __esm({
+  "packages/contracts/src/decide-sites.ts"() {
+    "use strict";
+    DECISION_RUNGS = ["rule", "system-one", "generative", "agent", "owner"];
+    DECISION_SITE_MODES = ["off", "shadow", "on"];
+  }
+});
+
 // packages/contracts/src/task-id.ts
 function isTaskId(value) {
   return typeof value === "string" && TASK_ID_REGEX.test(value);
@@ -22468,8 +22532,11 @@ __export(src_exports, {
   DAEMON_IPC_PROTOCOL_VERSION: () => SUPERVISOR_IPC_PROTOCOL_VERSION,
   DB_INVENTORY: () => DB_INVENTORY,
   DECISION_OUTCOME_SOURCES: () => DECISION_OUTCOME_SOURCES,
+  DECISION_PROVIDER_KINDS: () => DECISION_PROVIDER_KINDS,
   DECISION_QUESTION_TYPES: () => DECISION_QUESTION_TYPES,
   DECISION_REQUEST_LIMITS: () => DECISION_REQUEST_LIMITS,
+  DECISION_RUNGS: () => DECISION_RUNGS,
+  DECISION_SITE_MODES: () => DECISION_SITE_MODES,
   DEFAULT_IDENTITY_FIELD: () => DEFAULT_IDENTITY_FIELD,
   DEFAULT_RESOURCE_RETRY_AFTER_MS: () => DEFAULT_RESOURCE_RETRY_AFTER_MS,
   DOCS_LIFECYCLE_STATUSES: () => DOCS_LIFECYCLE_STATUSES,
@@ -22527,7 +22594,10 @@ __export(src_exports, {
   INVARIANTS_REGISTRY: () => INVARIANTS_REGISTRY,
   ISOLATION_ENV_KEYS: () => ISOLATION_ENV_KEYS,
   ImpactSchema: () => ImpactSchema,
+  JEV_MINIMUM_CAPABILITIES: () => JEV_MINIMUM_CAPABILITIES,
   KIND_LIFECYCLE_REQUIREMENTS: () => KIND_LIFECYCLE_REQUIREMENTS,
+  LAYAHOST_BASE_URL: () => LAYAHOST_BASE_URL,
+  LAYAHOST_DEFAULT_MODEL: () => LAYAHOST_DEFAULT_MODEL,
   LEASE_IPC_MESSAGE_KINDS: () => LEASE_IPC_MESSAGE_KINDS,
   LEASE_IPC_PROTOCOL_VERSION: () => LEASE_IPC_PROTOCOL_VERSION,
   LEASE_IPC_REQUEST_KINDS: () => LEASE_IPC_REQUEST_KINDS,
@@ -22733,6 +22803,7 @@ __export(src_exports, {
   decisionOutcomeSchema: () => decisionOutcomeSchema,
   decisionOutcomeSourceSchema: () => decisionOutcomeSourceSchema,
   decisionProviderConfigSchema: () => decisionProviderConfigSchema,
+  decisionProviderKindSchema: () => decisionProviderKindSchema,
   decisionQuestionSchema: () => decisionQuestionSchema,
   decisionQuestionTypeSchema: () => decisionQuestionTypeSchema,
   decisionRequestSchema: () => decisionRequestSchema,
@@ -23011,6 +23082,7 @@ var init_src2 = __esm({
     init_caamp_markers();
     init_collection_keys();
     init_decide();
+    init_decide_sites();
     init_task_id();
   }
 });
@@ -25254,7 +25326,13 @@ var init_admin2 = __esm({
             return lafsError("E_INVALID_INPUT", "backupId is required", "backup.mutate");
           }
           try {
-            const data = restoreBackup(projectRoot, { backupId, force: params.force });
+            const data = restoreBackup(projectRoot, {
+              backupId,
+              force: params.force,
+              confirmOwnerStore: params.confirmOwnerStore,
+              // T12680: the invocation directory; core never falls back to it.
+              cwd: process.cwd()
+            });
             return lafsSuccess(data, "backup.mutate");
           } catch (err) {
             return lafsError(
@@ -25270,7 +25348,12 @@ var init_admin2 = __esm({
             return lafsError("E_INVALID_INPUT", "file is required", "backup.mutate");
           }
           try {
-            const data = await fileRestore(projectRoot, file, { dryRun: params.dryRun });
+            const data = await fileRestore(projectRoot, file, {
+              dryRun: params.dryRun,
+              confirmOwnerStore: params.confirmOwnerStore,
+              // T12680: the invocation directory; core never falls back to it.
+              cwd: process.cwd()
+            });
             return lafsSuccess(data, "backup.mutate");
           } catch (err) {
             return lafsError(
@@ -37587,8 +37670,8 @@ async function loadPlaybookByName(name) {
     return null;
   }
   try {
-    const { getProjectRoot: getProjectRoot72 } = await import("@cleocode/core/internal");
-    const projectRoot = __playbookRuntimeOverrides.projectRoot ?? getProjectRoot72();
+    const { getProjectRoot: getProjectRoot73 } = await import("@cleocode/core/internal");
+    const projectRoot = __playbookRuntimeOverrides.projectRoot ?? getProjectRoot73();
     const resolved = resolvePlaybook(name, {
       projectRoot,
       globalPlaybooksDir: __playbookRuntimeOverrides.globalPlaybooksDir,
@@ -37633,7 +37716,7 @@ async function buildDefaultDispatcher() {
   if (__playbookRuntimeOverrides.dispatcher) return __playbookRuntimeOverrides.dispatcher;
   const { orchestrateSpawnExecute: orchestrateSpawnExecute2 } = await import("@cleocode/runtime/gateway");
   const {
-    getProjectRoot: getProjectRoot72,
+    getProjectRoot: getProjectRoot73,
     createToolGuard,
     runSkillNodeOrSpawn,
     maybeCreatePiRunner,
@@ -37641,7 +37724,7 @@ async function buildDefaultDispatcher() {
     hasCantbookProfilePin,
     DEFAULT_DETERMINISTIC_DENIED_COMMANDS
   } = await import("@cleocode/core/internal");
-  const projectRoot = getProjectRoot72();
+  const projectRoot = getProjectRoot73();
   const tools = createToolGuard({
     allowedRoots: [projectRoot],
     deniedCommands: DEFAULT_DETERMINISTIC_DENIED_COMMANDS,
@@ -37734,12 +37817,12 @@ async function buildDefaultDeterministicRunner() {
     return void 0;
   }
   const {
-    getProjectRoot: getProjectRoot72,
+    getProjectRoot: getProjectRoot73,
     createToolGuard,
     createGuardedDeterministicRunner,
     DEFAULT_DETERMINISTIC_DENIED_COMMANDS
   } = await import("@cleocode/core/internal");
-  const projectRoot = getProjectRoot72();
+  const projectRoot = getProjectRoot73();
   const tools = createToolGuard({
     allowedRoots: [projectRoot],
     deniedCommands: DEFAULT_DETERMINISTIC_DENIED_COMMANDS,
@@ -37897,8 +37980,8 @@ var init_playbook2 = __esm({
             projectRoot = __playbookRuntimeOverrides.projectRoot;
           } else {
             try {
-              const { getProjectRoot: getProjectRoot72 } = await import("@cleocode/core/internal");
-              projectRoot = getProjectRoot72();
+              const { getProjectRoot: getProjectRoot73 } = await import("@cleocode/core/internal");
+              projectRoot = getProjectRoot73();
             } catch {
               projectRoot = void 0;
             }
@@ -37963,14 +38046,14 @@ var init_playbook2 = __esm({
         const deterministicRunner = await buildDefaultDeterministicRunner();
         let result;
         try {
-          const { getProjectRoot: getProjectRoot72 } = await import("@cleocode/core/internal");
+          const { getProjectRoot: getProjectRoot73 } = await import("@cleocode/core/internal");
           const opts = {
             db,
             playbook: parsed.definition,
             playbookHash: parsed.sourceHash,
             initialContext,
             dispatcher,
-            projectRoot: getProjectRoot72()
+            projectRoot: getProjectRoot73()
           };
           if (deterministicRunner !== void 0) opts.deterministicRunner = deterministicRunner;
           if (__playbookRuntimeOverrides.approvalSecret !== void 0) {
@@ -42167,6 +42250,8 @@ import {
   taskList,
   taskNext,
   taskPlan,
+  taskRankingHistory,
+  taskRankingRevert,
   taskReconcileScope,
   taskRelates as taskRelates2,
   taskRelatesAdd,
@@ -42444,6 +42529,12 @@ var init_tasks3 = __esm({
       },
       history: async (params) => {
         const projectRoot = getProjectRoot19();
+        if (params.taskId && params.ranking) {
+          return wrapCoreResult(
+            await taskRankingHistory(projectRoot, params.taskId, params.limit),
+            "history"
+          );
+        }
         if (params.taskId) {
           return wrapCoreResult(await taskHistory(projectRoot, params.taskId, params.limit), "history");
         }
@@ -42655,6 +42746,19 @@ var init_tasks3 = __esm({
           "relates.add"
         );
       },
+      "ranking.revert": async (params) => {
+        if (!params.entryId) {
+          return lafsError("E_INVALID_INPUT", "entryId is required", "ranking.revert");
+        }
+        return wrapCoreResult(
+          await taskRankingRevert(getProjectRoot19(), {
+            entryId: params.entryId,
+            ...params.reason !== void 0 ? { reason: params.reason } : {},
+            ...params.force ? { force: true } : {}
+          }),
+          "ranking.revert"
+        );
+      },
       "relates.add-batch": async (params) => {
         const projectRoot = getProjectRoot19();
         return wrapCoreResult(await taskRelatesAddBatch(projectRoot, params), "relates.add-batch");
@@ -42762,6 +42866,8 @@ var init_tasks3 = __esm({
       // OperationDef registered in @cleocode/contracts operations-registry.
       "relates.add-batch",
       "relates.remove",
+      // T12693 (D11161) — undo one audited ranking change.
+      "ranking.revert",
       "start",
       "stop",
       "sync.reconcile",
@@ -43056,6 +43162,7 @@ var init_tasks3 = __esm({
             "assignee",
             "relates.add",
             "relates.remove",
+            "ranking.revert",
             "start",
             "stop",
             "sync.reconcile",
@@ -45237,11 +45344,11 @@ var init_security = __esm({
 });
 
 // packages/cleo/src/dispatch/middleware/sanitizer.ts
-function createSanitizer(getProjectRoot72) {
+function createSanitizer(getProjectRoot73) {
   return async (req, next) => {
     if (req.params) {
       try {
-        const root = getProjectRoot72 ? getProjectRoot72() : void 0;
+        const root = getProjectRoot73 ? getProjectRoot73() : void 0;
         req.params = sanitizeParams(req.params, root, {
           domain: req.domain,
           operation: req.operation
@@ -45343,14 +45450,14 @@ var init_session_resolver = __esm({
 });
 
 // packages/cleo/src/dispatch/middleware/store-write-guard.ts
-function createStoreWriteGuard(getProjectRoot72) {
+function createStoreWriteGuard(getProjectRoot73) {
   return async (req, next) => {
     if (req.gateway !== "mutate" || ALLOWED_WHILE_READ_ONLY.has(`${req.domain}.${req.operation}`)) {
       return next();
     }
     let projectRoot;
     try {
-      projectRoot = getProjectRoot72();
+      projectRoot = getProjectRoot73();
     } catch {
       return next();
     }
@@ -50066,11 +50173,15 @@ var init_list2 = __esm({
 // packages/cleo/src/cli/lib/readline-wizard-io.ts
 import { stdin as input, stdout as output } from "node:process";
 import * as readline from "node:readline/promises";
+import { Writable } from "node:stream";
 import { WizardFatalError, WizardInterruptError } from "@cleocode/core/setup";
 function stripBracketedPaste(raw) {
   return raw.replace(/\x1b\[200~/g, "").replace(/\x1b\[201~/g, "").trim();
 }
-var SETUP_STDIN_CLOSED_CODE, StdinClosedError, ReadlineWizardIO;
+function streamIsTTY(stream) {
+  return "isTTY" in stream && stream.isTTY === true;
+}
+var SETUP_STDIN_CLOSED_CODE, StdinClosedError, SECRET_ECHO_REFUSED_MESSAGE, MutableOutput, ReadlineWizardIO;
 var init_readline_wizard_io = __esm({
   "packages/cleo/src/cli/lib/readline-wizard-io.ts"() {
     "use strict";
@@ -50090,6 +50201,38 @@ var init_readline_wizard_io = __esm({
         return err instanceof _StdinClosedError;
       }
     };
+    SECRET_ECHO_REFUSED_MESSAGE = 'Refusing to read a secret: stdin is a terminal but terminal mode is off, so the key would be echoed. Pipe it instead: printf %s "$KEY" | cleo decide config --provider layahost --key-stdin (or cleo llm add <provider> --api-key-stdin).';
+    MutableOutput = class extends Writable {
+      /** @param target - Stream that receives writes while unmuted. */
+      constructor(target) {
+        super();
+        this.target = target;
+        this.isTTY = "isTTY" in target && target.isTTY === true;
+      }
+      target;
+      /** When true, writes are dropped. */
+      muted = false;
+      /** Mirrors the wrapped stream: readline enables terminal mode (and echo) from it. */
+      isTTY;
+      /** Terminal width of the wrapped stream, when it reports one. */
+      get columns() {
+        return "columns" in this.target && typeof this.target.columns === "number" ? this.target.columns : void 0;
+      }
+      /** Forward a chunk unless muted. */
+      _write(chunk, encoding, callback) {
+        if (this.muted) {
+          callback();
+          return;
+        }
+        const done = () => callback();
+        if (typeof chunk === "string") this.target.write(chunk, encoding, done);
+        else this.target.write(chunk, done);
+      }
+      /** Write straight to the wrapped stream, bypassing the mute. */
+      writeUnmuted(text) {
+        this.target.write(text);
+      }
+    };
     ReadlineWizardIO = class {
       /**
        * Underlying readline interface.
@@ -50101,6 +50244,10 @@ var init_readline_wizard_io = __esm({
        * @internal
        */
       rl;
+      /** The stream readline echoes into; muted while a secret is typed. */
+      output;
+      /** Whether the input stream is a TTY (the terminal echoes unless readline owns it). */
+      inputIsTTY;
       /** AbortController aborted when stdin closes — surfaced as {@link StdinClosedError}. */
       eofController;
       /**
@@ -50116,11 +50263,22 @@ var init_readline_wizard_io = __esm({
        *
        * @param inStream - Input stream; defaults to `process.stdin`.
        * @param outStream - Output stream passed to readline for terminal-echo
-       *   purposes only; informational output goes to stderr.
+       *   purposes only; informational output goes to stderr. CLI commands pass
+       *   `process.stderr` so prompts never reach a redirected stdout.
+       * @param options - See {@link ReadlineWizardIOOptions}; terminal mode
+       *   defaults to the input stream's `isTTY`.
        */
-      constructor(inStream = input, outStream = output) {
+      constructor(inStream = input, outStream = output, options = {}) {
         this.eofController = new AbortController();
-        this.rl = readline.createInterface({ input: inStream, output: outStream });
+        this.output = new MutableOutput(outStream);
+        this.inputIsTTY = streamIsTTY(inStream);
+        this.rl = readline.createInterface({
+          input: inStream,
+          output: this.output,
+          terminal: options.terminal ?? this.inputIsTTY,
+          // No history: a secret must never be recallable with Up-arrow.
+          historySize: 0
+        });
         this.rl.on("close", () => {
           if (!this.eofController.signal.aborted) {
             this.eofController.abort(new StdinClosedError());
@@ -50171,6 +50329,48 @@ var init_readline_wizard_io = __esm({
           this.rethrowEof(err);
         }
       }
+      /**
+       * Ask for a secret without echoing it: the question is written, then the
+       * output stream is muted until the answer is submitted. Bracketed-paste
+       * markers are stripped like {@link prompt}. The answer is removed from
+       * readline's history afterwards.
+       *
+       * @param question - The question, e.g. `API key:`.
+       * @returns The trimmed answer; `''` when none was given.
+       * @throws Error with {@link SECRET_ECHO_REFUSED_MESSAGE} when stdin is a
+       *   terminal but terminal mode is off (the terminal would echo the key).
+       * @task T12714
+       */
+      async secret(question) {
+        if (this.inputIsTTY && !this.rl.terminal) throw new Error(SECRET_ECHO_REFUSED_MESSAGE);
+        this.output.writeUnmuted(`${question} `);
+        this.output.muted = true;
+        let raw;
+        try {
+          raw = await this.rl.question("", { signal: this.eofController.signal });
+          return stripBracketedPaste(raw);
+        } catch (err) {
+          return this.rethrowEof(err);
+        } finally {
+          this.output.muted = false;
+          this.output.writeUnmuted("\n");
+          if (raw !== void 0) this.scrubHistory(raw);
+        }
+      }
+      /**
+       * Remove every history entry equal to `line`. `history` is a runtime field
+       * of `readline.Interface` that `@types/node` does not declare, so it is
+       * read reflectively and checked before use.
+       *
+       * @param line - The exact line readline recorded.
+       */
+      scrubHistory(line) {
+        const history = Reflect.get(this.rl, "history");
+        if (!Array.isArray(history)) return;
+        for (let i = history.length - 1; i >= 0; i--) {
+          if (history[i] === line) history.splice(i, 1);
+        }
+      }
       async confirm(question, defaultValue) {
         const hint = defaultValue === void 0 ? "[y/n]" : defaultValue ? "[Y/n]" : "[y/N]";
         let raw;
@@ -50713,7 +50913,7 @@ async function resolveApiKey(args, io) {
     return args["api-key"];
   }
   if (process.stdin.isTTY) {
-    return (await io.prompt("API key:")).trim();
+    return (await io.secret("API key (input hidden):")).trim();
   }
   return "";
 }
@@ -52134,14 +52334,14 @@ var init_backup = __esm({
           return;
         }
         const { exportPortableBundle, PortableBundleError } = await import("@cleocode/core/store/portable-bundle.js");
-        const { getProjectRoot: getProjectRoot72 } = await import("@cleocode/core");
+        const { getProjectRoot: getProjectRoot73 } = await import("@cleocode/core");
         const passphrase = args.encrypt === true ? await resolvePassphrase() : void 0;
         if (args.encrypt === true && passphrase === void 0) return;
         const encSuffix = args.encrypt === true ? "enc." : "";
         try {
           const result = await exportPortableBundle({
             scope,
-            projectRoot: scope === "project" || scope === "all" ? getProjectRoot72() : void 0,
+            projectRoot: scope === "project" || scope === "all" ? getProjectRoot73() : void 0,
             outputPath: args.out ?? `./${args.name}.${encSuffix}cleobundle.tar.gz`,
             encrypt: args.encrypt === true,
             passphrase,
@@ -52186,12 +52386,12 @@ var init_backup = __esm({
           await portableImport(bundlePath, args.target, collectFlagValues(rawArgs, "map"), args.force);
           return;
         }
-        const { getProjectRoot: getProjectRoot72, getCleoHome: getCleoHome8, getCleoVersion } = await import("@cleocode/core");
+        const { getProjectRoot: getProjectRoot73, getCleoHome: getCleoHome8, getCleoVersion } = await import("@cleocode/core");
         const { BundleError, cleanupStaging, unpackBundle } = await import("@cleocode/core/store/backup-unpack.js");
         const { regenerateConfigJson, regenerateProjectContextJson, regenerateProjectInfoJson } = await import("@cleocode/core/store/regenerators.js");
         const { regenerateAndCompare } = await import("@cleocode/core/store/restore-json-merge.js");
         const { buildConflictReport, writeConflictReport } = await import("@cleocode/core/store/restore-conflict-report.js");
-        const projectRoot = getProjectRoot72();
+        const projectRoot = getProjectRoot73();
         if (args.force !== true) {
           const existing = checkForExistingData(projectRoot, getCleoHome8());
           if (existing.length > 0) {
@@ -54360,6 +54560,28 @@ var init_check3 = __esm({
             task: "T12124",
             script: "scripts/check-ct-cleo-thin.mjs",
             description: "ct-cleo SKILL.md does not grow (thin-pointer ratchet)"
+          },
+          {
+            // T12704: an ES module has no `require`. A bare `require()` throws
+            // under Node while vitest supplies one, so tests stay green and the
+            // shipped build fails, usually inside a swallowing `try`: the docs
+            // audit wrote nothing, two doctor checks never ran, and no
+            // .worktreeinclude glob ever copied.
+            id: "gate-34",
+            task: "T12704",
+            script: "scripts/lint-no-esm-bare-require.mjs",
+            description: "No bare require() in ESM package sources"
+          },
+          {
+            // T12663: every model call site is a registered decision site
+            // (spec system-one-integration §3.5, D11158): decide()/askSiteDecision
+            // name a registry id, LLM entry points live in registered files of a
+            // generative/agent rung, a System One site runs `on` only with go-live
+            // evidence, and chokepoint bypasses are baselined per file.
+            id: "gate-35",
+            task: "T12663",
+            script: "scripts/lint-model-call-sites.mjs",
+            description: "Every model call site is a registered decision site (ratchet)"
           }
         ];
         const scriptArgs = strict ? ["--strict"] : ["--check"];
@@ -57382,8 +57604,14 @@ import {
   clearDecideConfig,
   configureDecide,
   describeDecideCredentials,
-  probeDecideProvider
+  listDecisionSites,
+  parseDecisionProviderKind,
+  probeDecideProvider,
+  resetDecideBudget,
+  runDecideWizard,
+  SpendResetRefusedError
 } from "@cleocode/core/decide/index.js";
+import { WizardInterruptError as WizardInterruptError2 } from "@cleocode/core/setup";
 async function readSecretFromStdin() {
   if (process.stdin.isTTY) return "";
   process.stdin.setEncoding("utf-8");
@@ -57395,41 +57623,81 @@ function failValidation(message, operation, fix) {
   cliError(message, 6 /* VALIDATION_ERROR */, { name: "E_VALIDATION", fix }, { operation });
   process.exitCode = 6 /* VALIDATION_ERROR */;
 }
-var CONFIG_FIX, decideConfigCommand, decideStatusCommand, decideAskCommand, decideCommand;
+async function runConfigWizard(op) {
+  const io = new ReadlineWizardIO(process.stdin, process.stderr);
+  try {
+    cliOutput(await runDecideWizard(io), { command: "decide", operation: op });
+  } catch (err) {
+    if (err instanceof WizardInterruptError2) {
+      process.stderr.write("System One setup cancelled.\n");
+      process.exitCode = 130;
+      return;
+    }
+    failValidation(err instanceof Error ? err.message : "setup failed", op, CONFIG_FIX);
+  } finally {
+    io.close();
+  }
+}
+function oneOf(value, allowed) {
+  return allowed.find((a) => a === value);
+}
+var CONFIG_FIX, decideConfigCommand, decideStatusCommand, decideAskCommand, decideSitesCommand, decideBudgetResetCommand, decideBudgetCommand, decideCommand;
 var init_decide2 = __esm({
   "packages/cleo/src/cli/commands/decide.ts"() {
     "use strict";
     init_src2();
     init_define_cli_command();
+    init_readline_wizard_io();
     init_renderers();
-    CONFIG_FIX = 'printf %s "$KEY" | cleo decide config --url https://provider.example --key-stdin';
+    CONFIG_FIX = 'printf %s "$KEY" | cleo decide config --provider layahost --key-stdin';
     decideConfigCommand = defineCommand({
       meta: {
         name: "config",
-        description: "Store the decision provider API URL and key (0600 file in the CLEO home). Prefer --key-stdin so the key stays out of shell history. No flags shows the current settings (key masked)."
+        description: "Store the decision provider, API key and model (0600 file in the CLEO home), then probe it and detect its capabilities. --provider layahost (default) needs only the key; --provider jev needs --url. Prefer --key-stdin so the key stays out of shell history. No flags on a terminal runs the setup wizard (the key is typed hidden); no flags without a terminal shows the current settings (key masked)."
       },
       args: {
-        url: { type: "string", description: "Provider API base URL, e.g. https://layahost.com" },
+        provider: {
+          type: "string",
+          description: `Provider: ${DECISION_PROVIDER_KINDS.join("|")} (layahost: fixed URL, model laya-auto; jev: custom URL, required)`
+        },
+        url: {
+          type: "string",
+          description: "Provider API base URL: overrides the layahost default; required for jev"
+        },
         key: {
           type: "string",
           description: "API key. Visible in the process list (ps) and shell history; prefer --key-stdin"
         },
         "key-stdin": { type: "boolean", description: "Read the API key from stdin (recommended)" },
-        model: { type: "string", description: "Optional default model; omitted \u2192 provider listing" },
+        model: {
+          type: "string",
+          description: "Default model; omitted \u2192 the stored model, the preset (layahost: laya-auto) or the first listed (jev)"
+        },
         clear: { type: "boolean", description: "Remove the stored URL, key and model" }
       },
       async run({ args }) {
         const op = "decide.config";
         if (args.clear === true)
           return cliOutput(await clearDecideConfig(), { command: "decide", operation: op });
+        const provider = parseDecisionProviderKind(args.provider);
+        if (args.provider !== void 0 && provider === void 0) {
+          return failValidation(`unknown provider '${args.provider}'`, op, CONFIG_FIX);
+        }
         const apiKey = args["key-stdin"] === true ? await readSecretFromStdin() : args.key;
         if (args["key-stdin"] === true && !apiKey)
           return failValidation("--key-stdin set but stdin is empty or a TTY", op, CONFIG_FIX);
-        if (args.url === void 0 && apiKey === void 0 && args.model === void 0) {
+        const noSettings = provider === void 0 && args.url === void 0 && apiKey === void 0 && args.model === void 0;
+        if (noSettings && process.stdin.isTTY && process.stderr.isTTY) return runConfigWizard(op);
+        if (noSettings) {
           return cliOutput(describeDecideCredentials(), { command: "decide", operation: op });
         }
         try {
-          const result = await configureDecide({ baseUrl: args.url, apiKey, model: args.model });
+          const result = await configureDecide({
+            provider,
+            baseUrl: args.url,
+            apiKey,
+            model: args.model
+          });
           cliOutput(result, { command: "decide", operation: op });
         } catch (err) {
           failValidation(err instanceof Error ? err.message : "invalid settings", op, CONFIG_FIX);
@@ -57439,7 +57707,7 @@ var init_decide2 = __esm({
     decideStatusCommand = defineCommand({
       meta: {
         name: "status",
-        description: "Probe the decision provider (GET {url}/v1/models, short timeout): reachable, unauthorized, unconfigured or unreachable. Exits 1 unless reachable."
+        description: "Probe the decision provider (GET {url}/v1/models, short timeout): reachable, unauthorized, key_limit_reached (the key monthly limit), unconfigured or unreachable. Also reports the registered sites count, the provider capabilities and balance (GET /v1/usage, refreshed at most every 10 minutes) and month-to-date spend against decide.budget.monthlyMicros. Exits 1 unless reachable."
       },
       args: {
         "timeout-ms": { type: "string", description: "Probe timeout in ms (default 3000)" }
@@ -57467,15 +57735,95 @@ var init_decide2 = __esm({
         cliOutput(result, { command: "decide", operation: "decide.ask" });
       }
     });
+    decideSitesCommand = defineCommand({
+      meta: {
+        name: "sites",
+        description: "List the System One integration decision sites: rung, ladder, fallback, owner escalation, configured and effective mode, go-live evidence and last-7-day activity. A site that uses System One is effectively off while no provider is configured."
+      },
+      args: {
+        rung: {
+          type: "string",
+          description: `Only sites with this primary rung (${DECISION_RUNGS.join("|")})`
+        },
+        mode: {
+          type: "string",
+          description: `Only sites with this effective mode (${DECISION_SITE_MODES.join("|")})`
+        },
+        id: { type: "string", description: "Only the site with this id" },
+        evidence: { type: "boolean", description: "Only sites with recorded go-live evidence" }
+      },
+      async run({ args }) {
+        const op = "decide.sites";
+        const rung = oneOf(args.rung, DECISION_RUNGS);
+        if (args.rung !== void 0 && rung === void 0) {
+          return failValidation(
+            `unknown rung '${args.rung}'`,
+            op,
+            `--rung ${DECISION_RUNGS.join("|")}`
+          );
+        }
+        const mode = oneOf(args.mode, DECISION_SITE_MODES);
+        if (args.mode !== void 0 && mode === void 0) {
+          return failValidation(
+            `unknown mode '${args.mode}'`,
+            op,
+            `--mode ${DECISION_SITE_MODES.join("|")}`
+          );
+        }
+        const result = await listDecisionSites({
+          rung,
+          mode,
+          id: args.id,
+          evidenceOnly: args.evidence === true
+        });
+        cliOutput(result, { command: "decide", operation: op });
+      }
+    });
+    decideBudgetResetCommand = defineCommand({
+      meta: {
+        name: "reset",
+        description: "Repair a corrupt System One spend ledger (<cleoHome>/decide/spend.json): start a fresh one for this month, moving the old file aside as a receipt. Refuses a readable ledger unless --force; month-to-date spend is always kept when readable, so a reset never lifts a reached cap."
+      },
+      args: {
+        force: {
+          type: "boolean",
+          description: "Reset a ledger that is not corrupt (keeps month-to-date spend; clears in-flight reservations and the key-limit stop)"
+        }
+      },
+      async run({ args }) {
+        const op = "decide.budget.reset";
+        try {
+          const receipt = await resetDecideBudget(void 0, { force: args.force === true });
+          cliOutput(receipt, { command: "decide", operation: op });
+        } catch (err) {
+          if (!(err instanceof SpendResetRefusedError)) throw err;
+          failValidation(err.message, op, "cleo decide status");
+        }
+      }
+    });
+    decideBudgetCommand = defineCommand({
+      meta: {
+        name: "budget",
+        description: "System One monthly spend cap (decide.budget.monthlyMicros): budget reset"
+      },
+      subCommands: { reset: decideBudgetResetCommand },
+      async run({ cmd, rawArgs }) {
+        const firstArg = rawArgs?.find((a) => !a.startsWith("-"));
+        if (firstArg && cmd.subCommands && firstArg in cmd.subCommands) return;
+        await showUsage(cmd);
+      }
+    });
     decideCommand = defineCommand({
       meta: {
         name: "decide",
-        description: "Typed-decision (System One) provider: decide config (API URL + key), decide status (reachability probe), decide ask (one debug question). Unconfigured means heuristics answer."
+        description: "System One integration (typed decisions): decide config (provider + API key; wizard on a terminal), decide status (reachability probe), decide ask (one debug question), decide sites (the registered decision sites). Unconfigured means heuristics answer."
       },
       subCommands: {
         config: decideConfigCommand,
         status: decideStatusCommand,
-        ask: decideAskCommand
+        ask: decideAskCommand,
+        sites: decideSitesCommand,
+        budget: decideBudgetCommand
       },
       async run({ cmd, rawArgs }) {
         const firstArg = rawArgs?.find((a) => !a.startsWith("-"));
@@ -62769,6 +63117,80 @@ var init_doctor_malformed_ids = __esm({
   }
 });
 
+// packages/cleo/src/cli/commands/doctor-manifest-rows.ts
+var doctor_manifest_rows_exports = {};
+__export(doctor_manifest_rows_exports, {
+  doctorManifestRowsCommand: () => doctorManifestRowsCommand
+});
+import {
+  listMalformedManifestRows,
+  MANIFEST_ROW_APPLY_COMMAND,
+  MANIFEST_ROW_REPAIR_COMMAND,
+  repairMalformedManifestRows,
+  rollbackManifestRepair
+} from "@cleocode/core/memory/pipeline-manifest-sqlite.js";
+import { getProjectRoot as getProjectRoot46 } from "@cleocode/core/paths.js";
+var doctorManifestRowsCommand;
+var init_doctor_manifest_rows = __esm({
+  "packages/cleo/src/cli/commands/doctor-manifest-rows.ts"() {
+    "use strict";
+    init_define_cli_command();
+    init_renderers();
+    doctorManifestRowsCommand = defineCommand({
+      meta: {
+        name: "manifest-rows",
+        description: "List manifest rows whose metadata violates the stored field contract. --repair shows the plan (writes nothing); --repair --apply moves each bad field under _malformed (nothing lost) with a receipt; --rollback <receipt> undoes it."
+      },
+      args: {
+        repair: {
+          type: "boolean",
+          description: "Plan the repair of every malformed row; writes nothing"
+        },
+        apply: {
+          type: "boolean",
+          description: "Write the repair (writes a receipt first); implies --repair"
+        },
+        "dry-run": {
+          type: "boolean",
+          description: "Plan only (the default for --repair); overrides --apply"
+        },
+        rollback: { type: "string", description: "Undo a repair from its receipt file" },
+        json: { type: "boolean", description: "Output as JSON" },
+        human: { type: "boolean", description: "Force human-readable output" },
+        quiet: { type: "boolean", description: "Suppress non-essential output" }
+      },
+      async run({ args }) {
+        const projectRoot = getProjectRoot46();
+        if (typeof args.rollback === "string" && args.rollback !== "") {
+          const result = await rollbackManifestRepair(args.rollback, projectRoot);
+          cliOutput(result, { command: "doctor", operation: "doctor.manifest-rows.rollback" });
+          return;
+        }
+        if (args.repair === true || args.apply === true) {
+          const apply = args.apply === true && args["dry-run"] !== true;
+          const receipt = await repairMalformedManifestRows(projectRoot, { dryRun: !apply });
+          cliOutput(
+            apply ? receipt : { ...receipt, apply: receipt.changes.length > 0 ? MANIFEST_ROW_APPLY_COMMAND : null },
+            {
+              command: "doctor",
+              operation: apply ? "doctor.manifest-rows.apply" : "doctor.manifest-rows.plan"
+            }
+          );
+          return;
+        }
+        const rows = await listMalformedManifestRows(projectRoot);
+        cliOutput(
+          { rows, repair: rows.length > 0 ? MANIFEST_ROW_REPAIR_COMMAND : null },
+          { command: "doctor", operation: "doctor.manifest-rows.run" }
+        );
+        if (rows.length > 0 && (process.exitCode === void 0 || process.exitCode === 0)) {
+          process.exitCode = 1;
+        }
+      }
+    });
+  }
+});
+
 // packages/cleo/src/cli/commands/doctor-memory-guard.ts
 var doctor_memory_guard_exports = {};
 __export(doctor_memory_guard_exports, {
@@ -62838,7 +63260,7 @@ var doctor_nexus_residency_exports = {};
 __export(doctor_nexus_residency_exports, {
   doctorNexusResidencyCommand: () => doctorNexusResidencyCommand
 });
-import { getCleoHome as getCleoHome6, getProjectRoot as getProjectRoot46 } from "@cleocode/core";
+import { getCleoHome as getCleoHome6, getProjectRoot as getProjectRoot47 } from "@cleocode/core";
 import { scanNexusSchemaResidency } from "@cleocode/core/doctor/nexus-schema-residency.js";
 var doctorNexusResidencyCommand;
 var init_doctor_nexus_residency = __esm({
@@ -62857,7 +63279,7 @@ var init_doctor_nexus_residency = __esm({
         quiet: { type: "boolean", description: "Suppress non-essential output" }
       },
       async run() {
-        const result = scanNexusSchemaResidency(getProjectRoot46(), getCleoHome6());
+        const result = scanNexusSchemaResidency(getProjectRoot47(), getCleoHome6());
         cliOutput(result, {
           command: "doctor",
           operation: "doctor.nexus-residency.run"
@@ -62875,7 +63297,7 @@ var doctor_project_identity_exports = {};
 __export(doctor_project_identity_exports, {
   doctorProjectIdentityCommand: () => doctorProjectIdentityCommand
 });
-import { getProjectRoot as getProjectRoot47 } from "@cleocode/core";
+import { getProjectRoot as getProjectRoot48 } from "@cleocode/core";
 import {
   inspectProjectIdentity,
   resolveProjectIdentity
@@ -62899,7 +63321,7 @@ var init_doctor_project_identity = __esm({
         quiet: { type: "boolean", description: "Suppress non-essential output" }
       },
       async run({ args }) {
-        const projectRoot = getProjectRoot47();
+        const projectRoot = getProjectRoot48();
         if (!args.resolve) {
           const report = inspectProjectIdentity(projectRoot);
           cliOutput(report, { command: "doctor", operation: "doctor.project-identity.inspect" });
@@ -63409,7 +63831,7 @@ var doctor_repair_exports = {};
 __export(doctor_repair_exports, {
   doctorRepairCommand: () => doctorRepairCommand
 });
-import { getLogger as getLogger21, getProjectRoot as getProjectRoot48 } from "@cleocode/core";
+import { getLogger as getLogger21, getProjectRoot as getProjectRoot49 } from "@cleocode/core";
 import { repairMalformedDbs } from "@cleocode/core/store/repair-malformed-dbs.js";
 var doctorRepairCommand;
 var init_doctor_repair = __esm({
@@ -63453,7 +63875,7 @@ var init_doctor_repair = __esm({
           return;
         }
         const result = repairMalformedDbs({
-          projectRoot: getProjectRoot48(),
+          projectRoot: getProjectRoot49(),
           roles: roleArg.length > 0 ? [roleArg] : void 0,
           dryRun,
           logger: getLogger21("doctor-repair")
@@ -63652,7 +64074,7 @@ var doctor_superseded_store_exports = {};
 __export(doctor_superseded_store_exports, {
   doctorSupersededStoreCommand: () => doctorSupersededStoreCommand
 });
-import { getProjectRoot as getProjectRoot49 } from "@cleocode/core";
+import { getProjectRoot as getProjectRoot50 } from "@cleocode/core";
 import { scanSupersededStores } from "@cleocode/core/doctor/superseded-store.js";
 import { reconcileSupersededStores } from "@cleocode/core/store/exodus/index.js";
 var doctorSupersededStoreCommand;
@@ -63685,7 +64107,7 @@ var init_doctor_superseded_store = __esm({
       },
       async run({ args }) {
         if (args.reconcile === true) {
-          const receipt = await reconcileSupersededStores(getProjectRoot49(), {
+          const receipt = await reconcileSupersededStores(getProjectRoot50(), {
             dryRun: args["dry-run"] === true,
             additive: args.additive === true
           });
@@ -63707,7 +64129,7 @@ var init_doctor_superseded_store = __esm({
           );
           return;
         }
-        const result = scanSupersededStores(getProjectRoot49());
+        const result = scanSupersededStores(getProjectRoot50());
         cliOutput(result, {
           command: "doctor",
           operation: "doctor.superseded-store.run"
@@ -63805,7 +64227,7 @@ import {
   retryTwinCollapse
 } from "@cleocode/core/doctor/twin-collapse.js";
 import { CleoError as CleoError7 } from "@cleocode/core/errors";
-import { getProjectRoot as getProjectRoot50 } from "@cleocode/core/paths.js";
+import { getProjectRoot as getProjectRoot51 } from "@cleocode/core/paths.js";
 var doctorTwinCollapseCommand;
 var init_doctor_twin_collapse = __esm({
   "packages/cleo/src/cli/commands/doctor-twin-collapse.ts"() {
@@ -63827,7 +64249,7 @@ var init_doctor_twin_collapse = __esm({
         quiet: { type: "boolean", description: "Suppress non-essential output" }
       },
       async run({ args }) {
-        const projectRoot = getProjectRoot50();
+        const projectRoot = getProjectRoot51();
         if (args.retry === true) {
           try {
             const receipts = await retryTwinCollapse(projectRoot);
@@ -63863,7 +64285,7 @@ __export(doctor_worktree_stores_exports, {
   doctorWorktreeStoresCommand: () => doctorWorktreeStoresCommand
 });
 import { scanWorktreeStores } from "@cleocode/core/doctor/worktree-stores.js";
-import { getProjectRoot as getProjectRoot51, resolveStoreOwnerRoot } from "@cleocode/core/paths.js";
+import { getProjectRoot as getProjectRoot52, resolveStoreOwnerRoot } from "@cleocode/core/paths.js";
 var doctorWorktreeStoresCommand;
 var init_doctor_worktree_stores = __esm({
   "packages/cleo/src/cli/commands/doctor-worktree-stores.ts"() {
@@ -63885,7 +64307,7 @@ var init_doctor_worktree_stores = __esm({
         quiet: { type: "boolean", description: "Suppress non-essential output" }
       },
       async run({ args }) {
-        const projectRoot = resolveStoreOwnerRoot(getProjectRoot51());
+        const projectRoot = resolveStoreOwnerRoot(getProjectRoot52());
         const result = scanWorktreeStores(projectRoot, { skipCompare: args["skip-compare"] === true });
         cliOutput(result, {
           command: "doctor",
@@ -64037,7 +64459,7 @@ import {
   resumePreparedKnowledgeRepair,
   runKnowledgeDoctor as runKnowledgeDoctor2
 } from "@cleocode/core/doctor/knowledge.js";
-import { getProjectRoot as getProjectRoot52 } from "@cleocode/core/paths.js";
+import { getProjectRoot as getProjectRoot53 } from "@cleocode/core/paths.js";
 var doctorKnowledgeSubcommand;
 var init_doctor_knowledge = __esm({
   "packages/cleo/src/cli/commands/doctor-knowledge.ts"() {
@@ -64112,7 +64534,7 @@ var init_doctor_knowledge = __esm({
       },
       async run({ args }) {
         const startedAt = Date.now();
-        const root = getProjectRoot52();
+        const root = getProjectRoot53();
         let context;
         let pending;
         try {
@@ -64280,7 +64702,7 @@ import { join as join24 } from "node:path";
 import {
   ensureGlobalAgentRegistryDb,
   getGlobalAgentRegistryNativeDb,
-  getProjectRoot as getProjectRoot53,
+  getProjectRoot as getProjectRoot54,
   installAgentFromCant
 } from "@cleocode/core/internal";
 function sha256Hex(bytes) {
@@ -64468,7 +64890,7 @@ var init_migrate_agents_v2 = __esm({
         }
       },
       async run({ args }) {
-        const projectRoot = getProjectRoot53();
+        const projectRoot = getProjectRoot54();
         const verbose = args.quiet !== true;
         if (verbose) {
           humanInfo("Scanning .cleo/cant/agents/ and .cleo/agents/ for unregistered agents...");
@@ -64512,7 +64934,7 @@ __export(doctor_exports, {
 });
 import { mkdirSync as mkdirSync4, writeFileSync as writeFileSync5 } from "node:fs";
 import { join as join25 } from "node:path";
-import { getProjectRoot as getProjectRoot54, pushWarning as pushWarning5 } from "@cleocode/core";
+import { getProjectRoot as getProjectRoot55, pushWarning as pushWarning5 } from "@cleocode/core";
 import { renderInvariantAuditLines } from "@cleocode/core/doctor/invariant-audit-render.js";
 import {
   quarantineRogueCleoDir,
@@ -64639,6 +65061,7 @@ var init_doctor = __esm({
     init_doctor_legacy_backups();
     init_doctor_legacy_reaper();
     init_doctor_malformed_ids();
+    init_doctor_manifest_rows();
     init_doctor_memory_guard();
     init_doctor_nexus_residency();
     init_doctor_project_identity();
@@ -64672,6 +65095,8 @@ var init_doctor = __esm({
         "legacy-reaper": doctorLegacyReaperCommand,
         // T12128 — task ids that fail the write-path validator
         "malformed-ids": doctorMalformedIdsCommand,
+        // T12686 — manifest rows whose metadata violates the stored field contract (+ --repair/--rollback)
+        "manifest-rows": doctorManifestRowsCommand,
         // T12095 — pre-dual-scope store files still on disk under their old LIVE names
         "superseded-store": doctorSupersededStoreCommand,
         // T12535 — twin collapses (bare schema_meta / sticky_tags → prefixed twins): report + --retry
@@ -64910,7 +65335,7 @@ var init_doctor = __esm({
             const { join: pathJoin } = await import("node:path");
             const { existsSync: existsSync22 } = await import("node:fs");
             const { detectAndHealCoreWorktreeLeak } = await import("@cleocode/worktree");
-            const projectRoot = getProjectRoot54();
+            const projectRoot = getProjectRoot55();
             let gitRoot = projectRoot;
             try {
               gitRoot = execFile2("git", ["rev-parse", "--show-toplevel"], {
@@ -64962,7 +65387,7 @@ var init_doctor = __esm({
           }
           if (args.brain) {
             const { computeBrainHealthDashboard } = await import("@cleocode/core/memory/brain-health-dashboard.js");
-            const projectRoot = getProjectRoot54();
+            const projectRoot = getProjectRoot55();
             const dashboard = await computeBrainHealthDashboard(projectRoot);
             cliOutput(dashboard, { command: "doctor", operation: "doctor.brain" });
             if (dashboard.hasP0Failure) {
@@ -64971,7 +65396,7 @@ var init_doctor = __esm({
             return;
           }
           if (args["scan-test-fixtures-in-prod"]) {
-            const projectRoot = getProjectRoot54();
+            const projectRoot = getProjectRoot55();
             const matches = await scanTestFixturesInProd(projectRoot);
             const dryRun = args["dry-run"] !== false && args.quarantine !== true;
             const quarantined = !dryRun && matches.length > 0 ? await quarantineTestFixtures(projectRoot, matches) : void 0;
@@ -65059,7 +65484,7 @@ var init_doctor = __esm({
             progress.complete("Comprehensive diagnostics complete");
           } else if (args["scan-rogue-cleo-dirs"]) {
             progress.step(0, "Scanning for rogue .cleo/ directories");
-            const projectRoot = getProjectRoot54();
+            const projectRoot = getProjectRoot55();
             const reports = scanRogueCleoDirs(projectRoot);
             progress.complete(
               `Found ${reports.length} rogue .cleo/ director${reports.length === 1 ? "y" : "ies"}`
@@ -65068,7 +65493,7 @@ var init_doctor = __esm({
           } else if (args["quarantine-rogue-cleo-dirs"]) {
             const isDryRun = args["dry-run"] === true;
             progress.step(0, `${isDryRun ? "[DRY RUN] " : ""}Scanning for rogue .cleo/ directories`);
-            const projectRoot = getProjectRoot54();
+            const projectRoot = getProjectRoot55();
             const reports = scanRogueCleoDirs(projectRoot);
             if (reports.length === 0) {
               progress.complete("No rogue .cleo/ directories found \u2014 nothing to quarantine");
@@ -65122,7 +65547,7 @@ var init_doctor = __esm({
             const { detectAndRemoveLegacyGlobalFiles, detectAndRemoveStrayProjectNexus } = await import("@cleocode/core/store/cleanup-legacy.js");
             const { getCleoHome: getCleoHome8 } = await import("@cleocode/core");
             const cleoHome = getCleoHome8();
-            const projectRoot = getProjectRoot54();
+            const projectRoot = getProjectRoot55();
             const legacyResult = detectAndRemoveLegacyGlobalFiles(cleoHome);
             const strayResult = detectAndRemoveStrayProjectNexus(projectRoot);
             const isDryRun = args["dry-run"] === true;
@@ -65155,7 +65580,7 @@ var init_doctor = __esm({
           } else if (args["audit-worktree-orphans"]) {
             progress.step(0, "Comprehensive worktree anomaly audit (T9808 / council D009)");
             const { auditWorktreeOrphansComprehensive, scanWorktreeOrphansBudgeted } = await import("@cleocode/core/doctor/worktree-orphans.js");
-            const projectRoot = getProjectRoot54();
+            const projectRoot = getProjectRoot55();
             const timeoutSecs = args["timeout"] !== void 0 ? Number.parseInt(String(args["timeout"]), 10) : 30;
             const timeoutMs = Number.isFinite(timeoutSecs) && timeoutSecs > 0 ? timeoutSecs * 1e3 : 3e4;
             const maxEntriesPerLevel = args["max-entries-per-level"] !== void 0 ? Number.parseInt(String(args["max-entries-per-level"]), 10) : 500;
@@ -65212,7 +65637,7 @@ var init_doctor = __esm({
               `${isDryRun ? "[DRY RUN] " : ""}Scanning + pruning worktree-orphan .cleo/ directories`
             );
             const { pruneWorktreeOrphans, scanWorktreeOrphansBudgeted } = await import("@cleocode/core/doctor/worktree-orphans.js");
-            const projectRoot = getProjectRoot54();
+            const projectRoot = getProjectRoot55();
             const timeoutSecs = args["timeout"] !== void 0 ? Number.parseInt(String(args["timeout"]), 10) : 30;
             const timeoutMs = Number.isFinite(timeoutSecs) && timeoutSecs > 0 ? timeoutSecs * 1e3 : 3e4;
             const maxEntriesPerLevel = args["max-entries-per-level"] !== void 0 ? Number.parseInt(String(args["max-entries-per-level"]), 10) : 500;
@@ -65291,7 +65716,7 @@ var init_doctor = __esm({
               `${isDryRun ? "[DRY RUN] " : ""}Migrating .cleo/worktree-include \u2192 .worktreeinclude`
             );
             const { migrateWorktreeIncludeFile } = await import("@cleocode/core");
-            const projectRoot = getProjectRoot54();
+            const projectRoot = getProjectRoot55();
             const result = await migrateWorktreeIncludeFile(projectRoot, { dryRun: isDryRun });
             progress.complete(`Migration ${result.action}`);
             cliOutput(result, { command: "doctor", operation: "doctor.migrate-worktree-include" });
@@ -65310,7 +65735,7 @@ var init_doctor = __esm({
             const stepLabel = isFocusedAlias ? "Auditing Saga hierarchy for ADR-073 invariants" : "Walking central INVARIANTS_REGISTRY";
             progress.step(0, stepLabel);
             const { auditInvariantRegistry } = await import("@cleocode/core/doctor/invariant-audit.js");
-            const projectRoot = getProjectRoot54();
+            const projectRoot = getProjectRoot55();
             const result = await auditInvariantRegistry(projectRoot, { adrFilter });
             const operation = isFocusedAlias ? "doctor.audit-sagas" : "doctor.audit-invariants";
             const summary = `Invariant audit complete \u2014 ${result.totalCount} entries walked, ${result.errorCount} error / ${result.warningCount} warning / ${result.infoCount} info violation(s), ${result.notApplicableCount} not-applicable, ${result.documentedCount} documented`;
@@ -65332,7 +65757,7 @@ var init_doctor = __esm({
               { command: "doctor", operation: "admin.health" }
             );
             try {
-              const projectRoot = getProjectRoot54();
+              const projectRoot = getProjectRoot55();
               const conflicts = readMigrationConflicts(projectRoot);
               if (conflicts.length > 0) {
                 progress.complete(
@@ -65363,7 +65788,7 @@ var init_doctor = __esm({
               progress.complete("Health check complete");
             }
             try {
-              const projectRoot = getProjectRoot54();
+              const projectRoot = getProjectRoot55();
               const { auditSagaHierarchy } = await import("@cleocode/core/doctor/saga-audit.js");
               const sagaAudit = await auditSagaHierarchy(projectRoot);
               if (sagaAudit.sagas.length === 0) {
@@ -65478,8 +65903,8 @@ var init_done = __esm({
           process.exitCode = 2;
           return;
         }
-        const { getProjectRoot: getProjectRoot72 } = await import("@cleocode/core/paths.js");
-        const options = { projectRoot: getProjectRoot72(), ...parsed.options };
+        const { getProjectRoot: getProjectRoot73 } = await import("@cleocode/core/paths.js");
+        const options = { projectRoot: getProjectRoot73(), ...parsed.options };
         const requested = [
           ...new Set([args.taskId, ...args._ ?? []].map(String))
         ];
@@ -66824,7 +67249,7 @@ __export(gateway_exports, {
   gatewayOpenapiSubCommand: () => gatewayOpenapiSubCommand
 });
 import { resolve as resolve8 } from "node:path";
-import { generateOpenApi, getProjectRoot as getProjectRoot55 } from "@cleocode/core";
+import { generateOpenApi, getProjectRoot as getProjectRoot56 } from "@cleocode/core";
 var gatewayOpenapiSubCommand, gatewayCommand;
 var init_gateway = __esm({
   "packages/cleo/src/cli/commands/gateway.ts"() {
@@ -66856,7 +67281,7 @@ var init_gateway = __esm({
         const pathCount = Object.keys(doc.paths).length;
         if (typeof args.out === "string" && args.out.length > 0) {
           const { writeFileSync: writeFileSync8 } = await import("node:fs");
-          const target = resolve8(getProjectRoot55(), args.out);
+          const target = resolve8(getProjectRoot56(), args.out);
           writeFileSync8(target, json2, "utf8");
           cliOutput(
             { out: target, pathCount, version: doc.info.version, openapi: doc.openapi },
@@ -67317,7 +67742,7 @@ var go_exports = {};
 __export(go_exports, {
   goCommand: () => goCommand
 });
-import { getProjectRoot as getProjectRoot56, go } from "@cleocode/core";
+import { getProjectRoot as getProjectRoot57, go } from "@cleocode/core";
 var goCommand;
 var init_go = __esm({
   "packages/cleo/src/cli/commands/go.ts"() {
@@ -67343,7 +67768,7 @@ var init_go = __esm({
         }
       },
       async run({ args }) {
-        const projectRoot = getProjectRoot56();
+        const projectRoot = getProjectRoot57();
         const { getCurrentSessionId, resolveBoundSessionId } = await import("@cleocode/core/internal");
         let sessionId = getCurrentSessionId(projectRoot) ?? void 0;
         if (sessionId === void 0) {
@@ -67371,7 +67796,7 @@ var goal_exports = {};
 __export(goal_exports, {
   goalCommand: () => goalCommand
 });
-import { getProjectRoot as getProjectRoot57, goal } from "@cleocode/core";
+import { getProjectRoot as getProjectRoot58, goal } from "@cleocode/core";
 function resolveGoalKind(task) {
   if (typeof task === "string" && task.length > 0) {
     if (!isValidGoalTargetTaskId(task)) {
@@ -67418,7 +67843,7 @@ var init_goal2 = __esm({
         }
         const record = await goal.createGoal(
           { goalKind: kindResult.kind, intent, turnBudget: resolveTurnBudget(args.turns) },
-          getProjectRoot57()
+          getProjectRoot58()
         );
         cliOutput(record, { command: "goal set", operation: "goal.set" });
       }
@@ -67429,7 +67854,7 @@ var init_goal2 = __esm({
         description: "Show the current agent's active goal (per-agent scoped)."
       },
       async run() {
-        const record = await goal.getActiveGoal(getProjectRoot57());
+        const record = await goal.getActiveGoal(getProjectRoot58());
         cliOutput(record ?? { active: null }, { command: "goal status", operation: "goal.status" });
       }
     });
@@ -67451,7 +67876,7 @@ var init_goal2 = __esm({
           });
           return;
         }
-        const cwd = getProjectRoot57();
+        const cwd = getProjectRoot58();
         const parent = await goal.getActiveGoal(cwd);
         if (!parent) {
           cliError(
@@ -67499,7 +67924,7 @@ var init_goal2 = __esm({
           });
           return;
         }
-        const cwd = getProjectRoot57();
+        const cwd = getProjectRoot58();
         const result = await goal.advanceGoalWithPersist(goalId, { cwd });
         if (!result) {
           cliError(`Goal '${goalId}' not found.`, 4 /* NOT_FOUND */, { name: "E_NOT_FOUND" });
@@ -67524,7 +67949,7 @@ var init_goal2 = __esm({
           });
           return;
         }
-        const cwd = getProjectRoot57();
+        const cwd = getProjectRoot58();
         const active = await goal.getActiveGoal(cwd);
         if (!active) {
           cliError(
@@ -68454,7 +68879,7 @@ var history_exports = {};
 __export(history_exports, {
   historyCommand: () => historyCommand
 });
-var logCommand, workCommand2, historyCommand;
+var logCommand, workCommand2, rankingCommand, revertCommand, historyCommand;
 var init_history = __esm({
   "packages/cleo/src/cli/commands/history.ts"() {
     "use strict";
@@ -68502,11 +68927,60 @@ var init_history = __esm({
         await dispatchFromCli("query", "tasks", "history", {}, { command: "history" });
       }
     });
+    rankingCommand = defineCommand({
+      meta: {
+        name: "ranking",
+        description: "Who changed a task's priority, severity, kind or depends \u2014 actor, session, reason, before/after (D11161)"
+      },
+      args: {
+        taskId: { type: "positional", description: "Task ID", required: true },
+        limit: { type: "string", description: "Maximum entries (default 50)" }
+      },
+      async run({ args }) {
+        await dispatchFromCli(
+          "query",
+          "tasks",
+          "history",
+          {
+            taskId: String(args.taskId),
+            ranking: true,
+            ...args.limit !== void 0 ? { limit: Number.parseInt(String(args.limit), 10) } : {}
+          },
+          { command: "history" }
+        );
+      }
+    });
+    revertCommand = defineCommand({
+      meta: {
+        name: "revert",
+        description: "Undo one ranking change (an entry id from `cleo history ranking`); refused if a field changed again since, unless --force"
+      },
+      args: {
+        entryId: { type: "positional", description: "ranking_changed entry id", required: true },
+        reason: { type: "string", description: "Why it is reverted (recorded)" },
+        force: { type: "boolean", description: "Revert even though a field changed again since" }
+      },
+      async run({ args }) {
+        await dispatchFromCli(
+          "mutate",
+          "tasks",
+          "ranking.revert",
+          {
+            entryId: String(args.entryId),
+            ...args.reason !== void 0 ? { reason: String(args.reason) } : {},
+            ...args.force === true ? { force: true } : {}
+          },
+          { command: "history" }
+        );
+      }
+    });
     historyCommand = defineCommand({
       meta: { name: "history", description: "Completion timeline and productivity analytics" },
       subCommands: {
         log: logCommand,
-        work: workCommand2
+        work: workCommand2,
+        ranking: rankingCommand,
+        revert: revertCommand
       },
       async run({ cmd, rawArgs }) {
         const firstArg = rawArgs?.find((a) => !a.startsWith("-"));
@@ -68522,7 +68996,7 @@ var hygiene_exports = {};
 __export(hygiene_exports, {
   hygieneCommand: () => hygieneCommand
 });
-import { getProjectRoot as getProjectRoot58 } from "@cleocode/core";
+import { getProjectRoot as getProjectRoot59 } from "@cleocode/core";
 import { runSpawnReadinessHygieneCli } from "@cleocode/core/hygiene/validate-spawn-readiness.js";
 var hygieneCommand;
 var init_hygiene = __esm({
@@ -68551,7 +69025,7 @@ var init_hygiene = __esm({
             }
           },
           async run({ args }) {
-            const projectRoot = args["project-root"] || getProjectRoot58() || process.cwd();
+            const projectRoot = args["project-root"] || getProjectRoot59() || process.cwd();
             const worktreePath = args["worktree-path"];
             await runSpawnReadinessHygieneCli(projectRoot, worktreePath);
           }
@@ -69894,7 +70368,7 @@ var llm_cost_exports = {};
 __export(llm_cost_exports, {
   costCommand: () => costCommand
 });
-import { getProjectRoot as getProjectRoot59 } from "@cleocode/core/internal";
+import { getProjectRoot as getProjectRoot60 } from "@cleocode/core/internal";
 import { computeCost } from "@cleocode/core/llm/usage-pricing";
 function resolveSessionId(raw) {
   if (raw === "current") {
@@ -69967,7 +70441,7 @@ var init_llm_cost = __esm({
           process.exit(6);
         }
         const sessionId = resolveSessionId(rawSessionId);
-        const projectRoot = getProjectRoot59(process.cwd());
+        const projectRoot = getProjectRoot60(process.cwd());
         let breakdown;
         try {
           breakdown = await loadSessionCostBreakdown(projectRoot, sessionId);
@@ -71302,7 +71776,7 @@ var memory_exports = {};
 __export(memory_exports, {
   memoryCommand: () => memoryCommand
 });
-import { getProjectRoot as getProjectRoot60 } from "@cleocode/core";
+import { getProjectRoot as getProjectRoot61 } from "@cleocode/core";
 import {
   getBrainDb as getBrainDb2,
   getDreamStatus,
@@ -72260,7 +72734,7 @@ var init_memory3 = __esm({
       },
       args: {},
       async run() {
-        const root = getProjectRoot60();
+        const root = getProjectRoot61();
         try {
           const result = await runConsolidation(root);
           cliOutput(result, { command: "memory-consolidate", operation: "memory.consolidate" });
@@ -72284,7 +72758,7 @@ var init_memory3 = __esm({
         }
       },
       async run({ args }) {
-        const root = getProjectRoot60();
+        const root = getProjectRoot61();
         if (args.status) {
           try {
             const status = await getDreamStatus(root);
@@ -72321,7 +72795,7 @@ var init_memory3 = __esm({
         }
       },
       async run({ args }) {
-        const root = getProjectRoot60();
+        const root = getProjectRoot61();
         try {
           const { runObserver, runReflector } = await import("@cleocode/core/memory");
           const observerResult = await runObserver(root, args.session, {
@@ -72361,7 +72835,7 @@ var init_memory3 = __esm({
         }
       },
       async run({ args }) {
-        const root = getProjectRoot60();
+        const root = getProjectRoot61();
         await getBrainDb2(root);
         const { getBrainNativeDb: getBrainNativeDb3 } = await import("@cleocode/core/internal");
         const nativeDb = getBrainNativeDb3();
@@ -72399,7 +72873,7 @@ var init_memory3 = __esm({
       },
       async run({ args }) {
         const core2 = await import("@cleocode/core/internal");
-        const nexusDb = await core2.getNexusDb(getProjectRoot60());
+        const nexusDb = await core2.getNexusDb(getProjectRoot61());
         const result = args.restore ? await core2.restorePrunedTraits(
           nexusDb,
           String(args.restore),
@@ -72429,7 +72903,7 @@ var init_memory3 = __esm({
           return;
         }
         const core2 = await import("@cleocode/core/internal");
-        const nexusDb = await core2.getNexusDb(getProjectRoot60());
+        const nexusDb = await core2.getNexusDb(getProjectRoot61());
         const previous = await core2.setUserProfileTraitScope(nexusDb, String(args.key), scope);
         if (previous === null) {
           cliError(`No user-profile trait "${args.key}"`, "E_NOT_FOUND", { name: "E_NOT_FOUND" });
@@ -72453,7 +72927,7 @@ var init_memory3 = __esm({
         }
       },
       async run({ args }) {
-        const root = getProjectRoot60();
+        const root = getProjectRoot61();
         try {
           await getBrainDb2(root);
           const { totalDuplicateRows, groups } = await scanDuplicateEntries();
@@ -72499,7 +72973,7 @@ var init_memory3 = __esm({
       async run({ args }) {
         const sourceDir = args.from;
         const isDryRun = !!args["dry-run"];
-        const projectRoot = getProjectRoot60();
+        const projectRoot = getProjectRoot61();
         try {
           const result = await importMemoryFiles({
             sourceDir,
@@ -72650,7 +73124,7 @@ var init_memory3 = __esm({
       },
       args: {},
       async run() {
-        const root = getProjectRoot60();
+        const root = getProjectRoot61();
         try {
           await getBrainDb2(root);
           const result = await getTierStats(root);
@@ -72693,7 +73167,7 @@ var init_memory3 = __esm({
         }
       },
       async run({ args }) {
-        const root = getProjectRoot60();
+        const root = getProjectRoot61();
         const targetTier = args.to;
         const reason = args.reason;
         const validTiers = ["medium", "long"];
@@ -72759,7 +73233,7 @@ var init_memory3 = __esm({
         }
       },
       async run({ args }) {
-        const root = getProjectRoot60();
+        const root = getProjectRoot61();
         const targetTier = args.to;
         const reason = args.reason;
         const validTiers = ["short", "medium"];
@@ -73232,7 +73706,7 @@ var migrate_claude_mem_exports = {};
 __export(migrate_claude_mem_exports, {
   migrateClaudeMemCommand: () => migrateClaudeMemCommand
 });
-import { getProjectRoot as getProjectRoot61, migrateClaudeMem } from "@cleocode/core/internal";
+import { getProjectRoot as getProjectRoot62, migrateClaudeMem } from "@cleocode/core/internal";
 import { ingestLooseAgentOutputs, ingestRcasdDirectories } from "@cleocode/core/memory";
 import { getDb as getDb2 } from "@cleocode/core/store/sqlite";
 var storageCommand, claudeMemCommand, manifestIngestCommand, migrateClaudeMemCommand;
@@ -73295,7 +73769,7 @@ var init_migrate_claude_mem = __esm({
         }
       },
       async run({ args }) {
-        const root = getProjectRoot61();
+        const root = getProjectRoot62();
         try {
           const result = await migrateClaudeMem(root, {
             sourcePath: args.source,
@@ -73344,7 +73818,7 @@ var init_migrate_claude_mem = __esm({
         }
       },
       async run({ args }) {
-        const projectRoot = getProjectRoot61();
+        const projectRoot = getProjectRoot62();
         try {
           const db = await getDb2(projectRoot);
           const rcasdFlag = Boolean(args.rcasd);
@@ -73462,7 +73936,7 @@ __export(nexus_exports, {
 import { statSync as statSync2 } from "node:fs";
 import { appendFile as appendFile2, mkdir as mkdir5 } from "node:fs/promises";
 import path4 from "node:path";
-import { getProjectRoot as getProjectRoot62 } from "@cleocode/core";
+import { getProjectRoot as getProjectRoot63 } from "@cleocode/core";
 import { getSymbolImpact } from "@cleocode/core/nexus";
 import { runNexusAnalysis } from "@cleocode/core/nexus/analyze-orchestrator.js";
 import {
@@ -73633,7 +74107,7 @@ var init_nexus3 = __esm({
       async run({ args }) {
         applyJsonFlag2(args.json);
         const projectIdOverride = args["project-id"];
-        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot62();
+        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot63();
         const startTime = Date.now();
         if (args.path) {
           let isDir = false;
@@ -73693,7 +74167,7 @@ The code-intelligence graph is project-scoped (ADR-090 \xB7 T11648), so the coun
           process.exitCode = 2 /* INVALID_INPUT */;
           return;
         }
-        const currentRoot = getProjectRoot62();
+        const currentRoot = getProjectRoot63();
         if (args.path && path4.resolve(repoPath) !== path4.resolve(currentRoot)) {
           cliError(
             `nexus status cannot report on '${repoPath}' from this project.
@@ -74247,7 +74721,7 @@ The code-intelligence graph is project-scoped (ADR-090 \xB7 T11648): one store p
         applyJsonFlag2(args.json);
         const startTime = Date.now();
         const projectIdOverride = args["project-id"];
-        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot62();
+        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot63();
         const projectId = projectIdOverride ?? Buffer.from(repoPath).toString("base64url").slice(0, 32);
         const response = await dispatchRaw("query", "nexus", "clusters", { projectId, repoPath });
         const durationMs = Date.now() - startTime;
@@ -74291,7 +74765,7 @@ The code-intelligence graph is project-scoped (ADR-090 \xB7 T11648): one store p
         applyJsonFlag2(args.json);
         const startTime = Date.now();
         const projectIdOverride = args["project-id"];
-        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot62();
+        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot63();
         const projectId = projectIdOverride ?? Buffer.from(repoPath).toString("base64url").slice(0, 32);
         const response = await dispatchRaw("query", "nexus", "flows", { projectId, repoPath });
         const durationMs = Date.now() - startTime;
@@ -74334,7 +74808,7 @@ The code-intelligence graph is project-scoped (ADR-090 \xB7 T11648): one store p
         void appendDeprecationTelemetry("nexus.context", "cleo graph context");
         const startTime = Date.now();
         const projectIdOverride = args["project-id"];
-        const repoPath = getProjectRoot62();
+        const repoPath = getProjectRoot63();
         const projectId = projectIdOverride ?? Buffer.from(repoPath).toString("base64url").slice(0, 32);
         const limit = parseInt(args.limit, 10);
         const symbolName = args.symbol;
@@ -74397,7 +74871,7 @@ The code-intelligence graph is project-scoped (ADR-090 \xB7 T11648): one store p
         const startTime = Date.now();
         const whyFlag = !!args.why;
         const projectIdOverride = args["project-id"];
-        const repoPath = getProjectRoot62();
+        const repoPath = getProjectRoot63();
         const projectId = projectIdOverride ?? Buffer.from(repoPath).toString("base64url").slice(0, 32);
         const maxDepth = Math.min(parseInt(args.depth, 10), 5);
         const symbolName = args.symbol;
@@ -74501,7 +74975,7 @@ The code-intelligence graph is project-scoped (ADR-090 \xB7 T11648): one store p
         const projectIdOverride = args["project-id"];
         const full = !!args.full;
         const ctx = getFormatContext();
-        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot62();
+        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot63();
         if (args.incremental)
           humanWarn(
             "[nexus] --incremental is deprecated and has no effect: incremental is the default."
@@ -74631,7 +75105,7 @@ The code-intelligence graph is project-scoped (ADR-090 \xB7 T11648): one store p
       async run({ args }) {
         applyJsonFlag2(args.json);
         const startTime = Date.now();
-        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot62();
+        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot63();
         const name = args.name;
         const response = await dispatchRaw("mutate", "nexus", "projects.register", {
           path: repoPath,
@@ -75083,7 +75557,7 @@ The code-intelligence graph is project-scoped (ADR-090 \xB7 T11648): one store p
         applyJsonFlag2(args.json);
         const startTime = Date.now();
         const projectIdOverride = args["project-id"];
-        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot62();
+        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot63();
         const projectId = projectIdOverride ?? Buffer.from(repoPath).toString("base64url").slice(0, 32);
         const response = await dispatchRaw("mutate", "nexus", "refresh-bridge", {
           repoPath,
@@ -75189,7 +75663,7 @@ The code-intelligence graph is project-scoped (ADR-090 \xB7 T11648): one store p
       async run({ args }) {
         applyJsonFlag2(args.json);
         const startTime = Date.now();
-        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot62();
+        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot63();
         const projectIdOverride = args["project-id"];
         const beforeRef = args.before ?? "HEAD~1";
         const afterRef = args.after ?? "HEAD";
@@ -75307,7 +75781,7 @@ The code-intelligence graph is project-scoped (ADR-090 \xB7 T11648): one store p
         applyJsonFlag2(args.json);
         const startTime = Date.now();
         const projectIdOverride = args["project-id"];
-        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot62();
+        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot63();
         const projectId = projectIdOverride ?? Buffer.from(repoPath).toString("base64url").slice(0, 32);
         const response = await dispatchRaw("query", "nexus", "route-map", { projectId });
         const durationMs = Date.now() - startTime;
@@ -75363,7 +75837,7 @@ The code-intelligence graph is project-scoped (ADR-090 \xB7 T11648): one store p
         const startTime = Date.now();
         const routeSymbol = args.routeSymbol;
         const projectIdOverride = args["project-id"];
-        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot62();
+        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot63();
         const projectId = projectIdOverride ?? Buffer.from(repoPath).toString("base64url").slice(0, 32);
         const response = await dispatchRaw("query", "nexus", "shape-check", { routeSymbol, projectId });
         const durationMs = Date.now() - startTime;
@@ -75759,7 +76233,7 @@ The code-intelligence graph is project-scoped (ADR-090 \xB7 T11648): one store p
       async run({ args }) {
         applyJsonFlag2(args.json);
         const startTime = Date.now();
-        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot62();
+        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot63();
         const projectIdOverride = args["project-id"];
         const projectId = projectIdOverride ?? Buffer.from(repoPath).toString("base64url").slice(0, 32);
         const response = await dispatchRaw("mutate", "nexus", "contracts-sync", {
@@ -75869,7 +76343,7 @@ The code-intelligence graph is project-scoped (ADR-090 \xB7 T11648): one store p
       async run({ args }) {
         applyJsonFlag2(args.json);
         const startTime = Date.now();
-        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot62();
+        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot63();
         const projectId = Buffer.from(repoPath).toString("base64url").slice(0, 32);
         const response = await dispatchRaw("mutate", "nexus", "contracts-link-tasks", {
           projectId,
@@ -75953,7 +76427,7 @@ The code-intelligence graph is project-scoped (ADR-090 \xB7 T11648): one store p
         const isIncremental = !!args.incremental;
         try {
           const result = await runNexusWiki({
-            projectRoot: getProjectRoot62(),
+            projectRoot: getProjectRoot63(),
             outputDir,
             communityFilter,
             incremental: isIncremental
@@ -76303,7 +76777,7 @@ __export(orchestrate_exports, {
 });
 import { execFileSync as execFileSync5 } from "node:child_process";
 import { orchestration } from "@cleocode/core";
-import { BUILD_CONFIG as BUILD_CONFIG2, getProjectRoot as getProjectRoot63 } from "@cleocode/core/internal";
+import { BUILD_CONFIG as BUILD_CONFIG2, getProjectRoot as getProjectRoot64 } from "@cleocode/core/internal";
 function formatRollupTable(rollup) {
   const waves = "waves" in rollup ? rollup.waves : [rollup];
   const lines = [];
@@ -76446,7 +76920,7 @@ var init_orchestrate3 = __esm({
       },
       async run({ args }) {
         const rateWindowHours = args.window !== void 0 ? Number.parseFloat(String(args.window)) : void 0;
-        const metrics = await orchestration.collectOrchestrateDashboard(getProjectRoot63(), {
+        const metrics = await orchestration.collectOrchestrateDashboard(getProjectRoot64(), {
           ...rateWindowHours !== void 0 && Number.isFinite(rateWindowHours) && rateWindowHours > 0 ? { rateWindowHours } : {}
         });
         cliOutput(metrics, {
@@ -77896,7 +78370,7 @@ __export(project_exports, {
 import { resolve as resolve9 } from "node:path";
 import {
   CleoError as CleoError10,
-  getProjectRoot as getProjectRoot64,
+  getProjectRoot as getProjectRoot65,
   moveProject,
   projectLifecycle,
   renameProject,
@@ -77918,7 +78392,7 @@ function emitEngineFailure(error, operation) {
 }
 function resolveRootOrFail(operation) {
   try {
-    return getProjectRoot64();
+    return getProjectRoot65();
   } catch (err) {
     const code = err instanceof CleoError10 && typeof err.details?.["code"] === "string" ? err.details["code"] : "E_NOT_CLEO_PROJECT";
     emitEngineFailure(
@@ -78704,7 +79178,7 @@ var refresh_memory_exports = {};
 __export(refresh_memory_exports, {
   refreshMemoryCommand: () => refreshMemoryCommand
 });
-import { getProjectRoot as getProjectRoot65 } from "@cleocode/core";
+import { getProjectRoot as getProjectRoot66 } from "@cleocode/core";
 var refreshMemoryCommand;
 var init_refresh_memory = __esm({
   "packages/cleo/src/cli/commands/refresh-memory.ts"() {
@@ -78717,7 +79191,7 @@ var init_refresh_memory = __esm({
         description: "Regenerate .cleo/memory-bridge.md from brain.db"
       },
       async run() {
-        const projectDir = getProjectRoot65();
+        const projectDir = getProjectRoot66();
         const { writeMemoryBridge } = await import("@cleocode/core/internal");
         const result = await writeMemoryBridge(projectDir);
         if (result.written) {
@@ -80303,7 +80777,7 @@ import fs3 from "node:fs";
 import path5 from "node:path";
 import {
   CleoError as CleoError12,
-  getProjectRoot as getProjectRoot66,
+  getProjectRoot as getProjectRoot67,
   getTaskAccessor as getTaskAccessor3,
   parseConflictReport,
   setAtPath
@@ -80324,7 +80798,7 @@ var init_restore = __esm({
         description: "Apply manually-resolved conflicts from .cleo/restore-conflicts.md"
       },
       async run() {
-        const projectRoot = getProjectRoot66();
+        const projectRoot = getProjectRoot67();
         const reportPath = path5.join(projectRoot, CLEO_DIR_NAME3, RESTORE_CONFLICTS_MD);
         if (!fs3.existsSync(reportPath)) {
           humanLine("No pending restore conflicts. Nothing to finalize.");
@@ -80413,6 +80887,11 @@ var init_restore = __esm({
           type: "string",
           description: "Backup scope to restore from: project or global (default: project)",
           default: "project"
+        },
+        "confirm-owner-store": {
+          type: "boolean",
+          description: "From inside a git worktree: allow overwriting the owning project's LIVE store (refused without it)",
+          default: false
         }
       },
       async run({ args }) {
@@ -80423,7 +80902,8 @@ var init_restore = __esm({
             action: "restore.file",
             file: fileName,
             dryRun: args["dry-run"] || void 0,
-            scope
+            scope,
+            confirmOwnerStore: args["confirm-owner-store"] || void 0
           });
           if (!response.success) {
             const code = ExitCode[response.error?.code] ?? 1 /* GENERAL_ERROR */;
@@ -80687,7 +81167,7 @@ var init_restore = __esm({
 // packages/cleo/src/cli/commands/revert.ts
 var revert_exports = {};
 __export(revert_exports, {
-  revertCommand: () => revertCommand
+  revertCommand: () => revertCommand2
 });
 import { readFile as readFile8 } from "node:fs/promises";
 import { join as join29 } from "node:path";
@@ -80755,14 +81235,14 @@ async function loadOwnerPubkeys(projectRoot) {
     return /* @__PURE__ */ new Set();
   }
 }
-var OWNER_PUBKEYS_FILE, revertCommand;
+var OWNER_PUBKEYS_FILE, revertCommand2;
 var init_revert = __esm({
   "packages/cleo/src/cli/commands/revert.ts"() {
     "use strict";
     init_dist();
     init_renderers();
     OWNER_PUBKEYS_FILE = ".cleo/owner-pubkeys.json";
-    revertCommand = defineCommand({
+    revertCommand2 = defineCommand({
       meta: {
         name: "revert",
         description: "Owner kill-switch: squash-revert all sentient merge commits from a receipt ID"
@@ -81247,8 +81727,8 @@ var init_saga = __esm({
         }
       },
       async run({ args }) {
-        const { sagas: sagas2, getProjectRoot: getProjectRoot72 } = await import("@cleocode/core");
-        const projectRoot = getProjectRoot72();
+        const { sagas: sagas2, getProjectRoot: getProjectRoot73 } = await import("@cleocode/core");
+        const projectRoot = getProjectRoot73();
         const sagaId = typeof args.sagaId === "string" && args.sagaId.length > 0 ? args.sagaId : void 0;
         const result = await sagas2.sagaNext(projectRoot, { sagaId });
         cliOutput(result.success ? result.data : result, { command: "saga", operation: "saga.next" });
@@ -83079,7 +83559,7 @@ var sequence_exports = {};
 __export(sequence_exports, {
   sequenceCommand: () => sequenceCommand
 });
-import { getProjectRoot as getProjectRoot67 } from "@cleocode/core/internal";
+import { getProjectRoot as getProjectRoot68 } from "@cleocode/core/internal";
 var showCommand12, checkCommand7, repairCommand3, sequenceCommand;
 var init_sequence = __esm({
   "packages/cleo/src/cli/commands/sequence.ts"() {
@@ -83115,7 +83595,7 @@ var init_sequence = __esm({
       meta: { name: "repair", description: "Reset counter to max + 1 if behind" },
       async run() {
         const { repairSequence } = await import("@cleocode/core/internal");
-        const projectRoot = getProjectRoot67();
+        const projectRoot = getProjectRoot68();
         const repair = await repairSequence(projectRoot);
         const result = {
           repaired: repair.repaired,
@@ -83712,8 +84192,8 @@ var init_session4 = __esm({
         "audit-scope": { type: "string", description: "Audit log scope (global|local)" }
       },
       async run({ args }) {
-        const { detectSessionDrift, getProjectRoot: getProjectRoot72 } = await import("@cleocode/core");
-        const projectRoot = await getProjectRoot72();
+        const { detectSessionDrift, getProjectRoot: getProjectRoot73 } = await import("@cleocode/core");
+        const projectRoot = await getProjectRoot73();
         const scope = args["audit-scope"] === "local" ? "local" : "global";
         const report = await detectSessionDrift({ projectRoot, auditScope: scope });
         cliOutput(report, { command: "session drift", operation: "session.drift" });
@@ -83973,7 +84453,8 @@ import {
   createDefaultWizardRunner,
   mergeConfigJson,
   printWhoamiSummaryAndOfferTui,
-  WizardInterruptError as WizardInterruptError2
+  SetupConfigJsonError,
+  WizardInterruptError as WizardInterruptError3
 } from "@cleocode/core/setup";
 function buildWizardOptions(args) {
   const out = {};
@@ -84131,12 +84612,12 @@ var init_setup = __esm({
     setupCommand2 = defineCommand({
       meta: {
         name: "setup",
-        description: "Interactive setup wizard \u2014 runs all 8 sections in canonical order (identity \u2192 llm \u2192 sentient \u2192 harness \u2192 brain \u2192 project-conventions \u2192 integrations \u2192 verification). Use --section <name> for a single section, --non-interactive with section-specific flags to configure without prompts, --config-json for fully scripted setup, or --reset to reconfigure already-set sections."
+        description: "Interactive setup wizard \u2014 runs every section in canonical order (llm \u2192 system-one \u2192 models-roles \u2192 identity \u2192 sentient \u2192 project-conventions \u2192 harness \u2192 brain \u2192 integrations \u2192 telemetry \u2192 verification); system-one is optional. Use --section <name> for a single section, --non-interactive with section-specific flags to configure without prompts, --config-json for fully scripted setup, or --reset to reconfigure already-set sections."
       },
       args: {
         section: {
           type: "string",
-          description: "Run only one named section. Valid: llm | models-roles | identity | sentient | harness | brain | project-conventions | integrations | verification"
+          description: "Run only one named section. Valid: llm | system-one | models-roles | identity | sentient | harness | brain | project-conventions | integrations | telemetry | verification"
         },
         "non-interactive": {
           type: "boolean",
@@ -84216,20 +84697,24 @@ var init_setup = __esm({
         }
       },
       async run({ args }) {
-        const io = new ReadlineWizardIO();
+        const io = new ReadlineWizardIO(process.stdin, process.stderr);
         let result;
         try {
           result = await runSetup(args, io);
         } catch (err) {
           io.close();
-          if (err instanceof WizardInterruptError2 || err?.isWizardInterruptError) {
+          if (err instanceof WizardInterruptError3 || err?.isWizardInterruptError) {
             process.stderr.write("Setup interrupted. Run 'cleo setup' to continue.\n");
             process.exit(130);
           }
-          if (err instanceof WizardInterruptError2) {
+          if (err instanceof WizardInterruptError3) {
             process.stderr.write("Setup interrupted. Run 'cleo setup' to continue.\n");
             process.exit(130);
           }
+          if (err instanceof SetupConfigJsonError) {
+            cliError(err.message, 6, { name: err.codeName, fix: err.fix });
+            process.exit(6);
+          }
           if (StdinClosedError.is(err)) {
             cliError(err.message, 1, {
               name: err.codeName,
@@ -84433,7 +84918,8 @@ import {
   restoreBundledSkillQuarantine,
   runBundledSkillPrune,
   runDoctorAdopt,
-  runDoctorBridge
+  runDoctorBridge,
+  unkeepBundledSkill
 } from "@cleocode/core";
 function buildSkillsDoctorAdoptAdapters() {
   return {
@@ -84465,6 +84951,7 @@ var listCommand24, searchCommand4, findCommand8, validateCommand8, infoCommand,
 var init_skills2 = __esm({
   "packages/cleo/src/cli/commands/skills.ts"() {
     "use strict";
+    init_src2();
     init_dist();
     init_cli();
     init_subcommand_guard();
@@ -84942,15 +85429,31 @@ var init_skills2 = __esm({
     doctorRestoreCommand = defineCommand({
       meta: {
         name: "restore",
-        description: "List skill quarantines, or restore one by id (reverses cleo skills doctor prune)"
+        description: "List skill quarantines, or restore one by id (reverses cleo skills doctor prune). A restored skill is kept: prune never takes it again. --unkeep <name> hands it back to CLEO only when its files still hash exactly to the copy that was restored; a changed copy stays kept."
       },
       args: {
         id: { type: "positional", required: false, description: "Quarantine id (omit to list)" },
+        unkeep: {
+          type: "string",
+          description: "Kept skill name to hand back to CLEO (only if unchanged since it was restored)"
+        },
         json: { type: "boolean", description: "Output as JSON (default)" },
         human: { type: "boolean", description: "Output in human-readable format" }
       },
       async run({ args }) {
         try {
+          if (typeof args.unkeep === "string" && args.unkeep !== "") {
+            const outcome = await unkeepBundledSkill(args.unkeep);
+            if (!outcome.unkept) {
+              cliError(outcome.reason, 6 /* VALIDATION_ERROR */, {
+                name: "E_VALIDATION",
+                details: outcome
+              });
+              process.exit(6 /* VALIDATION_ERROR */);
+            }
+            cliOutput(outcome, { command: "skills doctor restore", operation: "skills.doctor.unkeep" });
+            return;
+          }
           const id = typeof args.id === "string" && args.id !== "" ? args.id : void 0;
           const result = await restoreBundledSkillQuarantine(id);
           cliOutput(result, { command: "skills doctor restore", operation: "skills.doctor.restore" });
@@ -86373,13 +86876,13 @@ var init_telemetry2 = __esm({
 // packages/cleo/src/cli/commands/templates/lib.ts
 import { readFileSync as readFileSync13 } from "node:fs";
 import { isAbsolute as isAbsolute3, resolve as resolve10 } from "node:path";
-import { getProjectRoot as getProjectRoot68 } from "@cleocode/core";
+import { getProjectRoot as getProjectRoot69 } from "@cleocode/core";
 import { resolveSourcePathAbsolute } from "@cleocode/core/templates/registry";
 function resolveProjectRoot6(raw) {
   if (typeof raw === "string" && raw.length > 0) {
     return isAbsolute3(raw) ? raw : resolve10(process.cwd(), raw);
   }
-  return getProjectRoot68();
+  return getProjectRoot69();
 }
 function readTemplateSource(entry) {
   const sourceAbsolute = resolveSourcePathAbsolute(entry);
@@ -87163,7 +87666,7 @@ __export(token_exports, {
   tokenCommand: () => tokenCommand
 });
 import { readFileSync as readFileSync17 } from "node:fs";
-import { getProjectRoot as getProjectRoot69, measureTokenExchange, recordTokenExchange as recordTokenExchange2 } from "@cleocode/core/internal";
+import { getProjectRoot as getProjectRoot70, measureTokenExchange, recordTokenExchange as recordTokenExchange2 } from "@cleocode/core/internal";
 function readPayload(args, textKey, fileKey) {
   const text = args[textKey];
   const file = args[fileKey];
@@ -87327,7 +87830,7 @@ var init_token = __esm({
           domain: args.domain,
           operation: args.operation
         };
-        const result = args.record ? await recordTokenExchange2(getProjectRoot69(), input2) : await measureTokenExchange(input2);
+        const result = args.record ? await recordTokenExchange2(getProjectRoot70(), input2) : await measureTokenExchange(input2);
         cliOutput(result, {
           command: "token",
           operation: args.record ? "admin.token.record" : "token.estimate"
@@ -87363,7 +87866,7 @@ __export(transcript_exports, {
 });
 import { homedir as homedir3 } from "node:os";
 import { join as join35 } from "node:path";
-import { getProjectRoot as getProjectRoot70 } from "@cleocode/core";
+import { getProjectRoot as getProjectRoot71 } from "@cleocode/core";
 import {
   parseDurationMs,
   pruneTranscripts,
@@ -87393,7 +87896,7 @@ var init_transcript = __esm({
       async run({ args }) {
         if (args.pending) {
           try {
-            const projectRoot = getProjectRoot70();
+            const projectRoot = getProjectRoot71();
             const { scanPendingTranscripts } = await import("@cleocode/core/memory/transcript-scanner.js");
             const pending = await scanPendingTranscripts(projectRoot);
             cliOutput(
@@ -87490,7 +87993,7 @@ var init_transcript = __esm({
       async run({ args }) {
         const tier = args.tier ?? "warm";
         const dryRun = args["dry-run"] ?? false;
-        const projectRoot = getProjectRoot70();
+        const projectRoot = getProjectRoot71();
         try {
           const { extractTranscript } = await import("@cleocode/core/memory/transcript-extractor.js");
           const { findSessionTranscriptPath, listAllTranscripts } = await import("@cleocode/core/memory/transcript-scanner.js");
@@ -87606,7 +88109,7 @@ var init_transcript = __esm({
         const dryRun = args["dry-run"] ?? false;
         const olderThanHours = args["older-than-hours"] ? Number.parseInt(args["older-than-hours"], 10) : 24;
         const limit = args.limit ? Number.parseInt(args.limit, 10) : void 0;
-        const projectRoot = getProjectRoot70();
+        const projectRoot = getProjectRoot71();
         try {
           const { extractTranscript } = await import("@cleocode/core/memory/transcript-extractor.js");
           const { listAllTranscripts } = await import("@cleocode/core/memory/transcript-scanner.js");
@@ -88985,7 +89488,7 @@ var init_update = __esm({
          */
         reason: {
           type: "string",
-          description: "Operator override reason for AC-immutability guard (required to mutate --acceptance once stage >= implementation; T1590)"
+          description: "Why this change is made. Recorded on the audit row of any priority/severity/kind/depends change (D11161; see `cleo history ranking <id>`), and required to mutate --acceptance once stage >= implementation (T1590)"
         },
         /**
          * Waiver for the critical-priority dependency declaration requirement.
@@ -89540,9 +90043,9 @@ var init_verify = __esm({
             return;
           }
           const { recordTaskDone } = await import("@cleocode/core/tasks/done-record.js");
-          const { getProjectRoot: getProjectRoot72 } = await import("@cleocode/core/paths.js");
+          const { getProjectRoot: getProjectRoot73 } = await import("@cleocode/core/paths.js");
           const r = await recordTaskDone(args.taskId, {
-            projectRoot: getProjectRoot72(),
+            projectRoot: getProjectRoot73(),
             ...parsed.options,
             ...args.agent ? { agent: args.agent } : {}
           });
@@ -89965,9 +90468,9 @@ var init_workgraph2 = __esm({
       },
       async run({ args }) {
         const { generatePlanningDoc } = await import("@cleocode/core/workgraph");
-        const { getProjectRoot: getProjectRoot72 } = await import("@cleocode/core");
+        const { getProjectRoot: getProjectRoot73 } = await import("@cleocode/core");
         const { cliOutput: cliOutput2 } = await Promise.resolve().then(() => (init_renderers(), renderers_exports));
-        const projectRoot = getProjectRoot72();
+        const projectRoot = getProjectRoot73();
         const audience = String(args.audience) === "agent" ? "agent" : "maintainer";
         const result = await generatePlanningDoc(projectRoot, {
           sagaId: String(args.sagaId),
@@ -89984,9 +90487,9 @@ var init_workgraph2 = __esm({
       async run() {
         const { validateWorkGraphStructure } = await import("@cleocode/core/workgraph");
         const { taskList: taskList2 } = await import("@cleocode/core/internal");
-        const { getProjectRoot: getProjectRoot72 } = await import("@cleocode/core");
+        const { getProjectRoot: getProjectRoot73 } = await import("@cleocode/core");
         const { cliOutput: cliOutput2 } = await Promise.resolve().then(() => (init_renderers(), renderers_exports));
-        const projectRoot = getProjectRoot72();
+        const projectRoot = getProjectRoot73();
         const listResult = await taskList2(projectRoot, { limit: 5e3 });
         const tasks = listResult.success ? listResult.data?.tasks ?? [] : [];
         const nodes = tasks.map((t) => ({
@@ -90005,9 +90508,9 @@ var init_workgraph2 = __esm({
         description: "One-shot saga-to-saga workgraph dashboard (tracking checklist)"
       },
       async run() {
-        const { sagas: sagas2, getProjectRoot: getProjectRoot72 } = await import("@cleocode/core");
+        const { sagas: sagas2, getProjectRoot: getProjectRoot73 } = await import("@cleocode/core");
         const { cliOutput: cliOutput2 } = await Promise.resolve().then(() => (init_renderers(), renderers_exports));
-        const projectRoot = getProjectRoot72();
+        const projectRoot = getProjectRoot73();
         const listResult = await sagas2.sagaList(projectRoot);
         if (!listResult.success) {
           cliOutput2(listResult, { command: "workgraph", operation: "workgraph.status" });
@@ -90073,7 +90576,7 @@ __export(worktree_exports, {
   worktreeCommand: () => worktreeCommand
 });
 import readline4 from "node:readline";
-import { getProjectRoot as getProjectRoot71, listWorktrees as listWorktrees2 } from "@cleocode/core/internal";
+import { getProjectRoot as getProjectRoot72, listWorktrees as listWorktrees2 } from "@cleocode/core/internal";
 async function promptYesNo2(question) {
   return new Promise((resolve13) => {
     const rl = readline4.createInterface({ input: process.stdin, output: process.stdout });
@@ -90178,7 +90681,7 @@ var init_worktree3 = __esm({
         const staleDays = staleDaysRaw !== void 0 ? Number.parseInt(staleDaysRaw, 10) : void 0;
         const idleDaysRaw = typeof args["idle-days"] === "string" ? args["idle-days"] : void 0;
         const idleDays = idleDaysRaw !== void 0 ? Number.parseInt(idleDaysRaw, 10) : void 0;
-        const projectRoot = getProjectRoot71();
+        const projectRoot = getProjectRoot72();
         const listResult = await listWorktrees2({
           projectRoot,
           ...staleDays !== void 0 && !Number.isNaN(staleDays) ? { staleDays } : {}
@@ -90699,7 +91202,7 @@ var COMMAND_MANIFEST = [
   {
     exportName: "decideCommand",
     name: "decide",
-    description: "Typed-decision (System One) provider: decide config (API URL + key), decide status (reachability probe), decide ask (one debug question). Unconfigured means heuristics answer.",
+    description: "System One integration (typed decisions): decide config (provider + API key; wizard on a terminal), decide status (reachability probe), decide ask (one debug question), decide sites (the registered decision sites). Unconfigured means heuristics answer.",
     load: async () => (await Promise.resolve().then(() => (init_decide2(), decide_exports))).decideCommand
   },
   {
@@ -90822,6 +91325,12 @@ var COMMAND_MANIFEST = [
     description: "Report task rows whose id is not a valid task identifier \u2014 rows that `cleo list` returns ",
     load: async () => (await Promise.resolve().then(() => (init_doctor_malformed_ids(), doctor_malformed_ids_exports))).doctorMalformedIdsCommand
   },
+  {
+    exportName: "doctorManifestRowsCommand",
+    name: "manifest-rows",
+    description: "List manifest rows whose metadata violates the stored field contract. --repair shows the plan (writes nothing); --repair --apply moves each bad field under _malformed (nothing lost) with a receipt; --rollback <receipt> undoes it.",
+    load: async () => (await Promise.resolve().then(() => (init_doctor_manifest_rows(), doctor_manifest_rows_exports))).doctorManifestRowsCommand
+  },
   {
     exportName: "doctorMemoryGuardCommand",
     name: "memory-guard",
@@ -91377,7 +91886,7 @@ var COMMAND_MANIFEST = [
   {
     exportName: "setupCommand",
     name: "setup",
-    description: "Interactive setup wizard \u2014 runs all 8 sections in canonical order (identity \u2192 llm \u2192 sentient \u2192 harness \u2192 brain \u2192 project-conventions \u2192 integrations \u2192 verification). Use --section <name> for a single section, --non-interactive with section-specific flags to configure without prompts, --config-json for fully scripted setup, or --reset to reconfigure already-set sections.",
+    description: "Interactive setup wizard \u2014 runs every section in canonical order (llm \u2192 system-one \u2192 models-roles \u2192 identity \u2192 sentient \u2192 project-conventions \u2192 harness \u2192 brain \u2192 integrations \u2192 telemetry \u2192 verification); system-one is optional. Use --section <name> for a single section, --non-interactive with section-specific flags to configure without prompts, --config-json for fully scripted setup, or --reset to reconfigure already-set sections.",
     load: async () => (await Promise.resolve().then(() => (init_setup(), setup_exports))).setupCommand
   },
   {
@@ -92113,7 +92622,7 @@ async function runStartupMaintenance() {
     detectAndRemoveStrayProjectNexus,
     getGlobalSalt,
     getLogger: getLogger22,
-    getProjectRoot: getProjectRoot72,
+    getProjectRoot: getProjectRoot73,
     isCleanupMarkerSet,
     migrateSignaldockToConduit,
     needsSignaldockToConduitMigration,
@@ -92122,7 +92631,7 @@ async function runStartupMaintenance() {
   } = await import("@cleocode/core/internal");
   let projectRootForCleanup = "";
   try {
-    projectRootForCleanup = getProjectRoot72();
+    projectRootForCleanup = getProjectRoot73();
   } catch {
   }
   if (!isCleanupMarkerSet(CLI_VERSION, projectRootForCleanup)) {
@@ -92142,7 +92651,7 @@ async function runStartupMaintenance() {
   const isInitInvocation = process.argv.slice(2).some((a) => a === "init");
   if (!isInitInvocation) {
     try {
-      const _projectRootForMigration = getProjectRoot72();
+      const _projectRootForMigration = getProjectRoot73();
       if (needsSignaldockToConduitMigration(_projectRootForMigration)) {
         const migrationResult = await migrateSignaldockToConduit(_projectRootForMigration);
         if (migrationResult.status === "failed") {