@cleocode/cleo 2026.9.23 → 2026.9.24

package/dist/cli/index.js

@@ -2668,11 +2668,16 @@ function provisionIsolatedShell(options) {
   };
   const exportBlock = ISOLATION_ENV_KEYS.filter((k) => env[k] !== "").map((k) => `export ${k}=${shellQuote(env[k])}`).join("\n");
   const quotedPath = shellQuote(worktreePath);
+  const identityExports = IDENTITY_ENV_KEYS.filter((k) => env[k] !== "").map(
+    (k) => `${k}=${shellQuote(env[k])}`
+  );
+  const perCallLine = identityExports.length > 0 ? `cd ${quotedPath} && export ${identityExports.join(" ")} || exit 1` : `cd ${quotedPath} || exit 1`;
   const preamble = [
     "## Worktree Isolation (REQUIRED \u2014 do not skip)",
     "",
-    "# Step 1: Enter the worktree (exits immediately if path is missing)",
-    `cd ${quotedPath} || exit 1`,
+    "# Step 1: Enter the worktree and bind your session (exits if the path is missing).",
+    "# Repeat this line at the start of EVERY Bash call: cwd and env do not persist.",
+    perCallLine,
     "",
     "# Step 2: Verify working directory (guards against shell/symlink quirks)",
     'case "$PWD" in',
@@ -2698,7 +2703,7 @@ function provisionIsolatedShell(options) {
     envKeys: ISOLATION_ENV_KEYS,
     absolutePathRules
   };
-  return { cwd, env, preamble, boundaryContract };
+  return { cwd, env, preamble, perCallLine, boundaryContract };
 }
 function validateAbsolutePath(absolutePath, contract) {
   const { absolutePathRules } = contract;
@@ -2718,7 +2723,7 @@ function validateAbsolutePath(absolutePath, contract) {
     message: `E_BOUNDARY_VIOLATION: absolute path "${absolutePath}" is outside the permitted boundary. worktreeRoot="${contract.worktreeRoot}", allowedPrefixes=[${absolutePathRules.allowedPrefixes.map((p) => `"${p}"`).join(", ")}]. Use a path within the worktree or update AbsolutePathRules.allowedPrefixes.`
   };
 }
-var BRANCH_LOCK_ERROR_CODES, ISOLATION_ENV_KEYS;
+var BRANCH_LOCK_ERROR_CODES, ISOLATION_ENV_KEYS, IDENTITY_ENV_KEYS;
 var init_branch_lock = __esm({
   "packages/contracts/src/branch-lock.ts"() {
     "use strict";
@@ -2787,6 +2792,11 @@ var init_branch_lock = __esm({
       "CLEO_SESSION_ID",
       "CLEO_AGENT_ID"
     ];
+    IDENTITY_ENV_KEYS = [
+      "CLEO_SESSION_ID",
+      "CLEO_AGENT_ID",
+      "CLEO_AGENT_ROLE"
+    ];
   }
 });
 
@@ -4915,16 +4925,30 @@ var init_service = __esm({
 });
 
 // packages/contracts/src/operations/output-contracts-data.ts
-var tasksShowOutputContract, taskPopulationSchema, tasksListOutputContract, tasksFindOutputContract, TASK_MUTATION_DATA_SCHEMA, tasksAddOutputContract, tasksAddBatchOutputContract, tasksUpdateOutputContract, tasksCompleteOutputContract, tasksReorderRankOutputContract, tasksBulkMoveOutputContract, tasksAssigneeOutputContract, adminConfigGetOutputContract, adminConfigListOutputContract, adminConfigValidateOutputContract, adminConfigUnsetOutputContract, OUTPUT_CONTRACTS;
+var TASK_CLAIM_SCHEMA, tasksShowOutputContract, taskPopulationSchema, tasksListOutputContract, tasksFindOutputContract, TASK_MUTATION_DATA_SCHEMA, tasksAddOutputContract, tasksAddBatchOutputContract, tasksUpdateOutputContract, tasksCompleteOutputContract, tasksReorderRankOutputContract, tasksBulkMoveOutputContract, tasksAssigneeOutputContract, tasksStartOutputContract, tasksClaimOutputContract, tasksUnclaimOutputContract, adminConfigGetOutputContract, adminConfigListOutputContract, adminConfigValidateOutputContract, adminConfigUnsetOutputContract, OUTPUT_CONTRACTS;
 var init_output_contracts_data = __esm({
   "packages/contracts/src/operations/output-contracts-data.ts"() {
     "use strict";
     init_check();
     init_entities();
     init_service();
+    TASK_CLAIM_SCHEMA = {
+      type: "object",
+      description: "Agent claim lease (T12502): the holder session, its agent, and when the lease lapses unless renewed. Absent when unclaimed.",
+      required: ["sessionId", "agentId", "claimedAt", "leaseExpiresAt"],
+      properties: {
+        sessionId: { type: "string", description: "Session holding the lease." },
+        agentId: { type: ["string", "null"], description: "Agent identity of the holder." },
+        claimedAt: { type: "string", description: "When the lease was taken (ISO-8601 UTC)." },
+        leaseExpiresAt: {
+          type: "string",
+          description: "When the lease lapses unless renewed (ISO-8601 UTC)."
+        }
+      }
+    };
     tasksShowOutputContract = {
       operation: "tasks.show",
-      shapeNote: "The task record is nested under `task` \u2014 use /data/task/<field>, not /data/<field>. Mutation envelopes are FLAT by contrast (/data/created/0, /data/updated/0), which is the asymmetry that produced GH #1225/#1239/#1231. `view` may be null. `acRows` and `relations` are conditional. `description`, `acceptance` and `verification` are withheld by the default (MVI) projection but `--field` resolves them transparently (T12108) \u2014 no `--full` needed. Evidence is NOT a task field: it lives at /data/task/verification/evidence (keyed by gate), alongside /data/task/verification/gates. T12127 (GH #1231) \u2014 the previous wording advertised `/data/task/evidence`, which does not exist, in the very text shown to an agent whose pointer had just failed.",
+      shapeNote: "The task record is nested under `task` \u2014 use /data/task/<field>, not /data/<field>. Mutation envelopes are FLAT by contrast (/data/created/0, /data/updated/0), which is the asymmetry that produced GH #1225/#1239/#1231. `view` may be null. `acRows` and `relations` are conditional. The default (MVI) projection withholds each `acRows` UUID and names it once in `/data/_withheld` as `acRows/*/id` (T12523); cite a criterion by `alias` (AC1..n). `description`, `acceptance` and `verification` are withheld by the default (MVI) projection but `--field` resolves them transparently (T12108) \u2014 no `--full` needed. Evidence is NOT a task field: it lives at /data/task/verification/evidence (keyed by gate), alongside /data/task/verification/gates. T12127 (GH #1231) \u2014 the previous wording advertised `/data/task/evidence`, which does not exist, in the very text shown to an agent whose pointer had just failed.",
       dataSchema: {
         type: "object",
         required: ["task", "view", "attachments"],
@@ -4940,7 +4964,18 @@ var init_output_contracts_data = __esm({
               status: { type: "string" },
               priority: { type: "string" },
               type: { type: "string" },
-              parentId: { type: ["string", "null"] }
+              parentId: { type: ["string", "null"] },
+              // T12503: the optimistic-concurrency version agents pass to --if-match.
+              updatedAt: {
+                type: ["string", "null"],
+                description: "Task version for optimistic concurrency: pass it to `cleo update|complete --if-match`."
+              },
+              // T12502: the human assignee and the agent claim lease are separate.
+              assignee: {
+                type: ["string", "null"],
+                description: "Human / owner assignee. Separate from `claim`."
+              },
+              claim: TASK_CLAIM_SCHEMA
             }
           },
           view: {
@@ -4953,7 +4988,11 @@ var init_output_contracts_data = __esm({
           },
           acRows: {
             type: "array",
-            description: "Acceptance-criterion rows (id, alias AC<n>, ordinal, text). Optional."
+            description: "Acceptance-criterion rows (alias AC<n>, ordinal, text; the UUID id only with --full). Optional."
+          },
+          _withheld: {
+            type: "object",
+            description: "Fields the default projection withheld from list elements, e.g. `acRows/*/id` \u2192 UTF-8 byte total. Absent with --full."
           },
           relations: {
             type: "object",
@@ -4968,6 +5007,14 @@ var init_output_contracts_data = __esm({
         "/data/task/priority",
         "/data/task/type",
         "/data/task/parentId",
+        // T12503 — the optimistic-concurrency version for `--if-match`; withheld
+        // by the MVI projection, resolved from the full record by `--field`.
+        "/data/task/updatedAt",
+        // T12502 — the agent claim lease (withheld by MVI; resolved by --field).
+        "/data/task/assignee",
+        "/data/task/claim",
+        "/data/task/claim/sessionId",
+        "/data/task/claim/leaseExpiresAt",
         // T12127 (GH #1231) — withheld by the MVI projection but resolvable
         // through `--field` since T12108. They were absent from this list, so the
         // remediation an agent is shown on a failed pointer never mentioned the
@@ -5209,6 +5256,56 @@ var init_output_contracts_data = __esm({
       },
       fieldPointers: ["/data/taskId", "/data/assignee", "/data/assigned"]
     };
+    tasksStartOutputContract = {
+      operation: "tasks.start",
+      shapeNote: "The claim lease this start holds is at /data/claim (null when the caller is not bound to a session). Another session holding the task fails with E_TASK_CLAIMED (exit 35); error.details.holder names it.",
+      dataSchema: {
+        type: "object",
+        required: ["taskId", "previousTask"],
+        additionalProperties: true,
+        properties: {
+          taskId: { type: "string", description: "The task now active." },
+          previousTask: { type: ["string", "null"], description: "The task active before, if any." },
+          claim: { ...TASK_CLAIM_SCHEMA, type: ["object", "null"] }
+        }
+      },
+      fieldPointers: [
+        "/data/taskId",
+        "/data/previousTask",
+        "/data/claim",
+        "/data/claim/sessionId",
+        "/data/claim/leaseExpiresAt"
+      ]
+    };
+    tasksClaimOutputContract = {
+      operation: "tasks.claim",
+      shapeNote: "The lease now held by your session is at /data/claim; renew it with --renew. Another holder fails with E_TASK_CLAIMED (exit 35): --take-over (expired) or --force-claim (live).",
+      dataSchema: {
+        type: "object",
+        required: ["taskId", "agentId", "claim"],
+        additionalProperties: true,
+        properties: {
+          taskId: { type: "string", description: "The claimed task." },
+          agentId: { type: ["string", "null"], description: "Agent recorded with the lease." },
+          claim: TASK_CLAIM_SCHEMA
+        }
+      },
+      fieldPointers: ["/data/taskId", "/data/agentId", "/data/claim", "/data/claim/leaseExpiresAt"]
+    };
+    tasksUnclaimOutputContract = {
+      operation: "tasks.unclaim",
+      shapeNote: "/data/released is true when a lease was cleared, false when the task was unclaimed.",
+      dataSchema: {
+        type: "object",
+        required: ["taskId", "released"],
+        additionalProperties: true,
+        properties: {
+          taskId: { type: "string", description: "The released task." },
+          released: { type: "boolean", description: "Whether a lease was cleared." }
+        }
+      },
+      fieldPointers: ["/data/taskId", "/data/released"]
+    };
     adminConfigGetOutputContract = {
       operation: "admin.config.get",
       shapeNote: "The resolved value is at /data/value (may be null). /data/found is false when the key is absent.",
@@ -5315,6 +5412,10 @@ var init_output_contracts_data = __esm({
       "tasks.reorder-rank": tasksReorderRankOutputContract,
       "tasks.bulk-move": tasksBulkMoveOutputContract,
       "tasks.assignee": tasksAssigneeOutputContract,
+      // T12502 — leased task claims.
+      "tasks.start": tasksStartOutputContract,
+      "tasks.claim": tasksClaimOutputContract,
+      "tasks.unclaim": tasksUnclaimOutputContract,
       "admin.config.get": adminConfigGetOutputContract,
       "admin.config.list": adminConfigListOutputContract,
       "admin.config.validate": adminConfigValidateOutputContract,
@@ -8543,6 +8644,13 @@ var init_operations_registry = __esm({
             required: true,
             description: "taskId parameter",
             cli: { positional: true }
+          },
+          {
+            name: "expectedUpdatedAt",
+            type: "string",
+            required: false,
+            description: "Optimistic-concurrency guard: fail with E_CONFLICT unless the task updatedAt still equals this value",
+            cli: { flag: "if-match" }
           }
         ]
       },
@@ -9203,7 +9311,7 @@ var init_operations_registry = __esm({
         gateway: "mutate",
         domain: "tasks",
         operation: "start",
-        description: "tasks.start (mutate)",
+        description: "tasks.start (mutate) \u2014 start work and take the caller session's leased claim (E_TASK_CLAIMED when another session holds it)",
         tier: 0,
         idempotent: false,
         sessionRequired: false,
@@ -9215,6 +9323,20 @@ var init_operations_registry = __esm({
             required: true,
             description: "taskId parameter",
             cli: { positional: true }
+          },
+          {
+            name: "takeOver",
+            type: "boolean",
+            required: false,
+            description: "Take over another session's EXPIRED claim lease (audited)",
+            cli: { flag: "take-over" }
+          },
+          {
+            name: "forceClaim",
+            type: "boolean",
+            required: false,
+            description: "Take over another session's LIVE claim lease (audited)",
+            cli: { flag: "force-claim" }
           }
         ]
       },
@@ -9324,11 +9446,11 @@ var init_operations_registry = __esm({
         gateway: "mutate",
         domain: "tasks",
         operation: "claim",
-        description: "tasks.claim (mutate) \u2014 claim a task by assigning it to the current session",
+        description: "tasks.claim (mutate) \u2014 take, renew or override the caller session's leased claim on a task (never the human assignee)",
         tier: 0,
         idempotent: false,
         sessionRequired: true,
-        requiredParams: ["taskId", "agentId"],
+        requiredParams: ["taskId"],
         params: [
           {
             name: "taskId",
@@ -9339,8 +9461,26 @@ var init_operations_registry = __esm({
           {
             name: "agentId",
             type: "string",
-            required: true,
-            description: "Agent ID to assign the task to"
+            required: false,
+            description: "Agent ID recorded with the lease (default: the session's agent / CLEO_AGENT_ID)"
+          },
+          {
+            name: "renew",
+            type: "boolean",
+            required: false,
+            description: "Renew the caller's own lease"
+          },
+          {
+            name: "takeOver",
+            type: "boolean",
+            required: false,
+            description: "Take over another session's EXPIRED lease (audited)"
+          },
+          {
+            name: "forceClaim",
+            type: "boolean",
+            required: false,
+            description: "Take over another session's LIVE lease (audited)"
           }
         ]
       },
@@ -9348,7 +9488,7 @@ var init_operations_registry = __esm({
         gateway: "mutate",
         domain: "tasks",
         operation: "unclaim",
-        description: "tasks.unclaim (mutate) \u2014 unclaim a task by removing the current assignee",
+        description: "tasks.unclaim (mutate) \u2014 release the caller session's claim lease (never the human assignee)",
         tier: 0,
         idempotent: false,
         sessionRequired: true,
@@ -9359,6 +9499,12 @@ var init_operations_registry = __esm({
             type: "string",
             required: true,
             description: "Task ID to unclaim"
+          },
+          {
+            name: "forceClaim",
+            type: "boolean",
+            required: false,
+            description: "Release another session's lease (audited)"
           }
         ]
       },
@@ -9613,6 +9759,20 @@ var init_operations_registry = __esm({
             type: "boolean",
             required: false,
             description: "When true (default), adds toTaskId as a dependency on fromTaskId so it cannot complete before the pivot resolves"
+          },
+          {
+            name: "takeOver",
+            type: "boolean",
+            required: false,
+            description: "Take over another session's EXPIRED claim on toTaskId (audited)",
+            cli: { flag: "take-over" }
+          },
+          {
+            name: "forceClaim",
+            type: "boolean",
+            required: false,
+            description: "Take over another session's LIVE claim on toTaskId (audited)",
+            cli: { flag: "force-claim" }
           }
         ]
       },
@@ -12251,6 +12411,78 @@ var init_operations_registry = __esm({
         requiredParams: [],
         params: []
       },
+      {
+        gateway: "query",
+        domain: "nexus",
+        operation: "projects.fleet",
+        description: "nexus.projects.fleet (query) \u2014 fleet view: every project with its location on each device, last recorded git state (local, and remote as of the last fetch) and staleness; paged, counts first, read-only",
+        tier: 1,
+        idempotent: true,
+        sessionRequired: false,
+        requiredParams: [],
+        params: [
+          {
+            name: "device",
+            type: "string",
+            required: false,
+            description: "Only locations on this device (device id, hostname, or current)"
+          },
+          {
+            name: "missing",
+            type: "boolean",
+            required: false,
+            description: "Only projects with a missing location"
+          },
+          {
+            name: "dirty",
+            type: "boolean",
+            required: false,
+            description: "Only projects with a dirty location"
+          },
+          {
+            name: "behind",
+            type: "boolean",
+            required: false,
+            description: "Only projects with a location behind its upstream (as of the last fetch)"
+          },
+          {
+            name: "ahead",
+            type: "boolean",
+            required: false,
+            description: "Only projects with a location ahead of its upstream (as of the last fetch)"
+          },
+          {
+            name: "stale",
+            type: "boolean",
+            required: false,
+            description: "Only projects with a never-probed, old-probe or old-fetch location"
+          },
+          {
+            name: "errored",
+            type: "boolean",
+            required: false,
+            description: "Only projects whose last probe recorded an error"
+          },
+          {
+            name: "staleAfterMs",
+            type: "number",
+            required: false,
+            description: "Staleness window for probes, fetches and heartbeats (default 24h)"
+          },
+          {
+            name: "limit",
+            type: "number",
+            required: false,
+            description: "Page size in projects (default 50, max 500; 0 = all)"
+          },
+          {
+            name: "offset",
+            type: "number",
+            required: false,
+            description: "Projects skipped before the page"
+          }
+        ]
+      },
       {
         gateway: "mutate",
         domain: "nexus",
@@ -19198,9 +19430,11 @@ var init_memory = __esm({
 });
 
 // packages/contracts/src/operations/nexus.ts
+var NEXUS_FLEET_SCHEMA_VERSION;
 var init_nexus = __esm({
   "packages/contracts/src/operations/nexus.ts"() {
     "use strict";
+    NEXUS_FLEET_SCHEMA_VERSION = 1;
   }
 });
 
@@ -19454,6 +19688,7 @@ __export(operations_exports, {
   DOCS_PROJECTION_RECEIPT_SCHEMA: () => DOCS_PROJECTION_RECEIPT_SCHEMA,
   DOCS_TYPE_VALUES: () => DOCS_TYPE_VALUES,
   LLM_OUTPUT_MODES: () => LLM_OUTPUT_MODES,
+  NEXUS_FLEET_SCHEMA_VERSION: () => NEXUS_FLEET_SCHEMA_VERSION,
   RELEASE_SHARED_COMMAND_SURFACES: () => RELEASE_SHARED_COMMAND_SURFACES,
   RELEASE_SHARED_SURFACE_CONTRACT: () => RELEASE_SHARED_SURFACE_CONTRACT,
   RELEASE_SHARED_TEMPLATE_SURFACES: () => RELEASE_SHARED_TEMPLATE_SURFACES,
@@ -19955,6 +20190,14 @@ var init_nexus_scope_map = __esm({
         stores: ["nexus-registry"],
         requiresProject: false
       },
+      "projects.fleet": {
+        op: "projects.fleet",
+        description: "Fleet view: every project, where it lives on each device, and its last recorded git state (read-only).",
+        scope: "global",
+        effect: "read",
+        stores: ["nexus-registry"],
+        requiresProject: false
+      },
       "projects.register": {
         op: "projects.register",
         description: "Register a project (alias: register).",
@@ -20461,7 +20704,14 @@ var init_session2 = __esm({
       get length() {
         return this._sessions.length;
       }
-      /** Find the currently active session (if any). */
+      /**
+       * First `active` session in THIS collection — a scan over the rows the
+       * caller loaded, NOT the caller's own session (T12500). With several agents
+       * active it names an arbitrary one of them.
+       *
+       * @deprecated For "my session" use `resolveBoundSession` (mutations) or
+       *   `resolveSessionForRead` (reads, labels an unbound guess).
+       */
       findActive() {
         return this._sessions.find((s) => s.status === "active");
       }
@@ -22318,7 +22568,7 @@ var init_collection_keys = __esm({
 
 // packages/contracts/src/decide.ts
 import { z as z24 } from "zod";
-var DECISION_QUESTION_TYPES, DECISION_OUTCOME_SOURCES, DECISION_REQUEST_LIMITS, DECISION_PROVIDER_KINDS, LAYAHOST_BASE_URL, LAYAHOST_DEFAULT_MODEL, JEV_MINIMUM_CAPABILITIES, decisionQuestionTypeSchema, decisionOutcomeSourceSchema, decisionInstructionsSchema, unitIntervalSchema, decisionStateSchema, noulDecisionQuestionSchema, choiceDecisionQuestionSchema, scoreDecisionQuestionSchema, decisionQuestionSchema, decisionRequestSchema, noulDecisionAnswerSchema, choiceDecisionAnswerSchema, scoreDecisionAnswerSchema, decisionAnswerSchema, decisionOutcomeSchema, decisionProviderKindSchema, decisionProviderConfigSchema;
+var DECISION_QUESTION_TYPES, DECISION_OUTCOME_SOURCES, DECISION_REQUEST_LIMITS, DECISION_PROVIDER_KINDS, LAYAHOST_BASE_URL, JEV_DEFAULT_BASE_URL, LAYAHOST_DEFAULT_MODEL, DECIDE_PROFILE_NAME_PATTERN, DECIDE_DEFAULT_PROFILE_NAME, DECIDE_PROFILE_DEFAULT_URL, JEV_MINIMUM_CAPABILITIES, decisionQuestionTypeSchema, decisionOutcomeSourceSchema, decisionInstructionsSchema, unitIntervalSchema, decisionStateSchema, noulDecisionQuestionSchema, choiceDecisionQuestionSchema, scoreDecisionQuestionSchema, decisionQuestionSchema, decisionRequestSchema, noulDecisionAnswerSchema, choiceDecisionAnswerSchema, scoreDecisionAnswerSchema, decisionAnswerSchema, decisionOutcomeSchema, decisionProviderKindSchema, decisionProviderConfigSchema;
 var init_decide = __esm({
   "packages/contracts/src/decide.ts"() {
     "use strict";
@@ -22344,7 +22594,11 @@ var init_decide = __esm({
     };
     DECISION_PROVIDER_KINDS = ["layahost", "jev"];
     LAYAHOST_BASE_URL = "https://layahost.com";
+    JEV_DEFAULT_BASE_URL = "https://api.typesafe.ai";
     LAYAHOST_DEFAULT_MODEL = "laya-auto";
+    DECIDE_PROFILE_NAME_PATTERN = /^[a-z0-9](?:[a-z0-9-]{0,30}[a-z0-9])?$/;
+    DECIDE_DEFAULT_PROFILE_NAME = "default";
+    DECIDE_PROFILE_DEFAULT_URL = "default";
     JEV_MINIMUM_CAPABILITIES = {
       wire: "jev-systemone/1",
       maxQuestionsPerRequest: 32,
@@ -22453,6 +22707,49 @@ var init_decide_sites = __esm({
   }
 });
 
+// packages/contracts/src/nexus-account.ts
+import { z as z25 } from "zod";
+var NEXUS_DEFAULT_API_URL, NEXUS_CLI_CLIENT_ID, NEXUS_LOGIN_TARGET, NEXUS_ACCOUNT_ERROR_CODES, nexusAccountUserSchema, nexusAccountOrganizationSchema, nexusAccountMeSchema;
+var init_nexus_account = __esm({
+  "packages/contracts/src/nexus-account.ts"() {
+    "use strict";
+    NEXUS_DEFAULT_API_URL = "https://api.cleocode.dev";
+    NEXUS_CLI_CLIENT_ID = "cleo-cli";
+    NEXUS_LOGIN_TARGET = "nexus";
+    NEXUS_ACCOUNT_ERROR_CODES = [
+      "E_NEXUS_INVALID_API_URL",
+      "E_NEXUS_NOT_SIGNED_IN",
+      "E_NEXUS_SESSION_EXPIRED",
+      "E_NEXUS_DEVICE_CODE_START_FAILED",
+      "E_NEXUS_UNTRUSTED_VERIFICATION_URI",
+      "E_NEXUS_DEVICE_CODE_EXPIRED",
+      "E_NEXUS_ACCESS_DENIED",
+      "E_NEXUS_DEVICE_CODE_FAILED",
+      "E_NEXUS_REVOKE_FAILED",
+      "E_NEXUS_REQUEST_FAILED",
+      "E_NEXUS_NOT_A_PROJECT",
+      "E_NEXUS_INVALID_LABEL"
+    ];
+    nexusAccountUserSchema = z25.object({
+      id: z25.string(),
+      email: z25.string(),
+      name: z25.string().nullable().optional()
+    });
+    nexusAccountOrganizationSchema = z25.object({
+      id: z25.string(),
+      name: z25.string(),
+      slug: z25.string().nullable().optional(),
+      role: z25.string().optional(),
+      /** `true` for the personal organization created at sign-up. */
+      personal: z25.boolean().optional()
+    });
+    nexusAccountMeSchema = z25.object({
+      user: nexusAccountUserSchema,
+      organizations: z25.array(nexusAccountOrganizationSchema).default([])
+    });
+  }
+});
+
 // packages/contracts/src/task-id.ts
 function isTaskId(value) {
   return typeof value === "string" && TASK_ID_REGEX.test(value);
@@ -22531,6 +22828,9 @@ __export(src_exports, {
   ClassifierUnregisteredAgentError: () => ClassifierUnregisteredAgentError,
   DAEMON_IPC_PROTOCOL_VERSION: () => SUPERVISOR_IPC_PROTOCOL_VERSION,
   DB_INVENTORY: () => DB_INVENTORY,
+  DECIDE_DEFAULT_PROFILE_NAME: () => DECIDE_DEFAULT_PROFILE_NAME,
+  DECIDE_PROFILE_DEFAULT_URL: () => DECIDE_PROFILE_DEFAULT_URL,
+  DECIDE_PROFILE_NAME_PATTERN: () => DECIDE_PROFILE_NAME_PATTERN,
   DECISION_OUTCOME_SOURCES: () => DECISION_OUTCOME_SOURCES,
   DECISION_PROVIDER_KINDS: () => DECISION_PROVIDER_KINDS,
   DECISION_QUESTION_TYPES: () => DECISION_QUESTION_TYPES,
@@ -22594,6 +22894,7 @@ __export(src_exports, {
   INVARIANTS_REGISTRY: () => INVARIANTS_REGISTRY,
   ISOLATION_ENV_KEYS: () => ISOLATION_ENV_KEYS,
   ImpactSchema: () => ImpactSchema,
+  JEV_DEFAULT_BASE_URL: () => JEV_DEFAULT_BASE_URL,
   JEV_MINIMUM_CAPABILITIES: () => JEV_MINIMUM_CAPABILITIES,
   KIND_LIFECYCLE_REQUIREMENTS: () => KIND_LIFECYCLE_REQUIREMENTS,
   LAYAHOST_BASE_URL: () => LAYAHOST_BASE_URL,
@@ -22628,6 +22929,11 @@ __export(src_exports, {
   MIGRATION_ENUM_DRIFT_SAMPLE_LIMIT: () => MIGRATION_ENUM_DRIFT_SAMPLE_LIMIT,
   MonitorRequestSchema: () => MonitorRequestSchema,
   MonitorResponseSchema: () => MonitorResponseSchema,
+  NEXUS_ACCOUNT_ERROR_CODES: () => NEXUS_ACCOUNT_ERROR_CODES,
+  NEXUS_CLI_CLIENT_ID: () => NEXUS_CLI_CLIENT_ID,
+  NEXUS_DEFAULT_API_URL: () => NEXUS_DEFAULT_API_URL,
+  NEXUS_FLEET_SCHEMA_VERSION: () => NEXUS_FLEET_SCHEMA_VERSION,
+  NEXUS_LOGIN_TARGET: () => NEXUS_LOGIN_TARGET,
   NEXUS_SCOPE_MAP: () => NEXUS_SCOPE_MAP,
   OPEN_SYSTEM_KEY_PREFIXES: () => OPEN_SYSTEM_KEY_PREFIXES,
   OPERATIONS: () => OPERATIONS,
@@ -22905,6 +23211,9 @@ __export(src_exports, {
   modelShowOutputContract: () => modelShowOutputContract,
   modelsCatalogRowInsertSchema: () => modelsCatalogRowInsertSchema,
   modelsCatalogRowSelectSchema: () => modelsCatalogRowSelectSchema,
+  nexusAccountMeSchema: () => nexusAccountMeSchema,
+  nexusAccountOrganizationSchema: () => nexusAccountOrganizationSchema,
+  nexusAccountUserSchema: () => nexusAccountUserSchema,
   normalizeError: () => normalizeError,
   noteAtomSchema: () => noteAtomSchema,
   noulDecisionAnswerSchema: () => noulDecisionAnswerSchema,
@@ -23054,6 +23363,7 @@ var init_src2 = __esm({
     init_ensures_schema_registry();
     init_entities();
     init_operations();
+    init_nexus();
     init_nexus_scope_map();
     init_nexus_user_profile();
     init_output_contracts_data();
@@ -23083,6 +23393,7 @@ var init_src2 = __esm({
     init_collection_keys();
     init_decide();
     init_decide_sites();
+    init_nexus_account();
     init_task_id();
   }
 });
@@ -23597,6 +23908,10 @@ import {
   renderBrainQuality,
   renderBriefing,
   renderCurrent,
+  renderDecideAsk,
+  renderDecideConfig,
+  renderDecideProfiles,
+  renderDecideStatus,
   renderDoctor,
   renderGeneric,
   renderNext,
@@ -23619,6 +23934,7 @@ import {
   renderNexusImpactFull,
   renderNexusProjectsClean,
   renderNexusProjectsCleanPreview,
+  renderNexusProjectsFleet,
   renderNexusProjectsList,
   renderNexusProjectsRegister,
   renderNexusProjectsRemove,
@@ -24037,6 +24353,11 @@ var init_renderers = __esm({
       // Nexus subcommand renderers (T1720)
       "nexus-status": renderNexusStatus,
       "nexus-setup": renderNexusSetup,
+      // System One (T12733): human blocks for config / status / ask / profiles.
+      "decide-config": renderDecideConfig,
+      "decide-status": renderDecideStatus,
+      "decide-ask": renderDecideAsk,
+      "decide-profiles": renderDecideProfiles,
       "nexus-clusters": renderNexusClusters,
       "nexus-flows": renderNexusFlows,
       "nexus-context": renderNexusContextResult,
@@ -24047,6 +24368,7 @@ var init_renderers = __esm({
       "nexus-projects-remove": renderNexusProjectsRemove,
       "nexus-projects-scan": renderNexusProjectsScan,
       "nexus-projects-status": renderNexusProjectsStatus,
+      "nexus-projects-fleet": renderNexusProjectsFleet,
       "nexus-projects-clean": renderNexusProjectsClean,
       "nexus-projects-clean-preview": renderNexusProjectsCleanPreview,
       "nexus-refresh-bridge": renderNexusRefreshBridge,
@@ -29746,7 +30068,7 @@ async function buildFocusEnvelope(id, projectRoot) {
     ...brainContext != null ? { brainContext } : {},
     blockers,
     ...readyWave != null ? { readyWave } : {},
-    knowledgeHealth: compactKnowledgeHealth(knowledge.health),
+    knowledgeHealth: compactKnowledgeHealth(knowledge.health, "/coverage"),
     sourceDiagnostics,
     ...members != null ? { members } : {},
     ...attachedDocs != null ? { attachedDocs } : {},
@@ -32024,6 +32346,7 @@ import {
   nexusProfileUpsert,
   nexusProfileView,
   nexusProjectsClean,
+  nexusProjectsFleet,
   nexusProjectsList,
   nexusProjectsRegister,
   nexusProjectsRemove,
@@ -32549,6 +32872,21 @@ var init_nexus2 = __esm({
         }),
         "projects.status"
       ),
+      "projects.fleet": async (params) => wrapCoreResult(
+        await nexusProjectsFleet(getProjectRoot9(), {
+          device: typeof params.device === "string" ? params.device : void 0,
+          missing: params.missing === true,
+          dirty: params.dirty === true,
+          behind: params.behind === true,
+          ahead: params.ahead === true,
+          stale: params.stale === true,
+          errored: params.errored === true,
+          staleAfterMs: typeof params.staleAfterMs === "number" ? params.staleAfterMs : void 0,
+          limit: typeof params.limit === "number" ? params.limit : void 0,
+          offset: typeof params.offset === "number" ? params.offset : void 0
+        }),
+        "projects.fleet"
+      ),
       "refresh-bridge": async (params) => {
         const projectRoot = getProjectRoot9();
         const repoPath = params.repoPath ?? projectRoot;
@@ -32749,6 +33087,7 @@ var init_nexus2 = __esm({
       "flows",
       "context",
       "projects.list",
+      "projects.fleet",
       "diff",
       "query-cte",
       "hot-paths",
@@ -38236,7 +38575,7 @@ var init_playbook2 = __esm({
 });
 
 // packages/cleo/src/dispatch/domains/orchestrate.ts
-import { getLogger as getLogger8, getProjectRoot as getProjectRoot11, pivotTask } from "@cleocode/core/internal";
+import { CleoError, getLogger as getLogger8, getProjectRoot as getProjectRoot11, pivotTask } from "@cleocode/core/internal";
 import {
   CLEO_DIR_NAME as CLEO_DIR_NAME2,
   orchestrateAnalyze,
@@ -38397,7 +38736,9 @@ async function orchestratePivotOp(params) {
     const result = await pivotTask(params.fromTaskId, params.toTaskId, {
       reason: params.reason,
       blocksFrom: params.blocksFrom,
-      projectRoot: getProjectRoot11()
+      projectRoot: getProjectRoot11(),
+      takeOver: params.takeOver === true,
+      forceClaim: params.forceClaim === true
     });
     return { success: true, data: result };
   } catch (err) {
@@ -38408,9 +38749,18 @@ async function orchestratePivotOp(params) {
     else if (code === 4) errorCode = "E_NOT_FOUND";
     else if (code === 6) errorCode = "E_VALIDATION";
     else if (code === 38) errorCode = "E_NOT_ACTIVE";
+    else if (code === 35) errorCode = "E_TASK_CLAIMED";
+    else if (code === 24) errorCode = "E_SESSION_UNBOUND";
+    const cleo = err instanceof CleoError ? err : void 0;
     return {
       success: false,
-      error: { code: errorCode, message }
+      error: {
+        code: errorCode,
+        message,
+        ...typeof code === "number" && code !== 0 ? { exitCode: code } : {},
+        ...cleo?.fix ? { fix: cleo.fix } : {},
+        ...cleo?.details ? { details: cleo.details } : {}
+      }
     };
   }
 }
@@ -39371,7 +39721,9 @@ var init_orchestrate2 = __esm({
                 fromTaskId: params.fromTaskId,
                 toTaskId: params.toTaskId,
                 reason: params.reason,
-                blocksFrom: params.blocksFrom
+                blocksFrom: params.blocksFrom,
+                takeOver: params.takeOver === true,
+                forceClaim: params.forceClaim === true
               };
               return wrapResult(
                 await coreOps2.pivot(p),
@@ -42600,7 +42952,9 @@ var init_tasks3 = __esm({
           // T10538 — cancelled-child waiver (PM-Core V2 agent-trust)
           cancelledChildWaiverReason: params.cancelledChildWaiverReason,
           // T11954 (DHQ-071) — depends-edge waiver for stale/over-specified deps
-          waiveDependsReason: params.waiveDependsReason
+          waiveDependsReason: params.waiveDependsReason,
+          // T12503 — optimistic concurrency (--if-match)
+          expectedUpdatedAt: params.expectedUpdatedAt
         });
         setImmediate(async () => {
           try {
@@ -42775,7 +43129,13 @@ var init_tasks3 = __esm({
       },
       start: async (params) => {
         const projectRoot = getProjectRoot19();
-        return wrapCoreResult(await taskStart(projectRoot, params.taskId), "start");
+        return wrapCoreResult(
+          await taskStart(projectRoot, params.taskId, {
+            takeOver: params.takeOver === true,
+            forceClaim: params.forceClaim === true
+          }),
+          "start"
+        );
       },
       stop: async (_params) => {
         const projectRoot = getProjectRoot19();
@@ -42804,11 +43164,11 @@ var init_tasks3 = __esm({
       },
       claim: async (params) => {
         const projectRoot = getProjectRoot19();
-        return wrapCoreResult(await taskClaim(projectRoot, params.taskId, params.agentId), "claim");
+        return wrapCoreResult(await taskClaim(projectRoot, params), "claim");
       },
       unclaim: async (params) => {
         const projectRoot = getProjectRoot19();
-        return wrapCoreResult(await taskUnclaim(projectRoot, params.taskId), "unclaim");
+        return wrapCoreResult(await taskUnclaim(projectRoot, params), "unclaim");
       }
     });
     QUERY_OPS12 = /* @__PURE__ */ new Set([
@@ -44869,6 +45229,32 @@ var init_budget_enforcement = __esm({
   }
 });
 
+// packages/cleo/src/dispatch/middleware/claim-heartbeat.ts
+function createClaimHeartbeat(renew, budgetMs = CLAIM_HEARTBEAT_BUDGET_MS) {
+  return async (req, next) => {
+    const response = await next();
+    const sessionId = req.sessionId;
+    if (req.gateway === "mutate" && response.success && sessionId) {
+      const renewal = renew(req, sessionId).catch(() => void 0);
+      let timer;
+      const budget = new Promise((resolve13) => {
+        timer = setTimeout(resolve13, budgetMs);
+        timer.unref?.();
+      });
+      await Promise.race([renewal, budget]);
+      if (timer) clearTimeout(timer);
+    }
+    return response;
+  };
+}
+var CLAIM_HEARTBEAT_BUDGET_MS;
+var init_claim_heartbeat = __esm({
+  "packages/cleo/src/dispatch/middleware/claim-heartbeat.ts"() {
+    "use strict";
+    CLAIM_HEARTBEAT_BUDGET_MS = 250;
+  }
+});
+
 // packages/cleo/src/dispatch/middleware/field-filter.ts
 import { isMVILevel, applyFieldFilter as sdkApplyFieldFilter } from "@cleocode/lafs";
 function createFieldFilter() {
@@ -45462,7 +45848,10 @@ function createStoreWriteGuard(getProjectRoot73) {
       return next();
     }
     const { storeWriteBlock } = await import("@cleocode/core/store/store-write-guard.js");
-    const blocked = await storeWriteBlock(projectRoot);
+    const blocked = await storeWriteBlock(projectRoot, {
+      domain: req.domain,
+      operation: req.operation
+    });
     if (blocked === null) return next();
     return {
       success: false,
@@ -45535,6 +45924,7 @@ __export(cli_exports, {
   dispatchRaw: () => dispatchRaw,
   getCliDispatcher: () => getCliDispatcher,
   handleRawError: () => handleRawError,
+  heartbeatCliSession: () => heartbeatCliSession,
   lookupCliSession: () => lookupCliSession,
   maybeEmitDescribe: () => maybeEmitDescribe,
   resetCliDispatcher: () => resetCliDispatcher,
@@ -45599,6 +45989,10 @@ async function lookupCliSession() {
     return null;
   }
 }
+async function heartbeatCliSession(_req, sessionId) {
+  const { heartbeatProjectSession } = await import("@cleocode/core/internal");
+  await heartbeatProjectSession(getProjectRoot23(), sessionId);
+}
 async function warnUnboundMutation(req) {
   if (getFormatContext().quiet) return;
   const { hasActiveSession } = await import("@cleocode/core/internal");
@@ -45619,6 +46013,8 @@ function createCliDispatcher() {
       createStoreWriteGuard(() => getProjectRoot23()),
       createSessionResolver(lookupCliSession, warnUnboundMutation),
       // T4959: session identity first; T12500: warn when unbound
+      createClaimHeartbeat(heartbeatCliSession),
+      // T12502 · T12540: a bound session's mutation refreshes lastActivity + renews its leases
       createSanitizer(() => getProjectRoot23()),
       createFieldFilter(),
       // T9922 (Saga T9855 / E8.3): MVI record projection default for read ops.
@@ -45842,6 +46238,7 @@ var init_cli = __esm({
     init_domains();
     init_audit();
     init_budget_enforcement();
+    init_claim_heartbeat();
     init_field_filter();
     init_idempotency();
     init_mutate_minimal_envelope();
@@ -49706,7 +50103,7 @@ var attention_exports = {};
 __export(attention_exports, {
   attentionCommand: () => attentionCommand
 });
-import { CleoError } from "@cleocode/core";
+import { CleoError as CleoError2 } from "@cleocode/core";
 function parseTags(rawTag) {
   if (!rawTag) return void 0;
   const tags = rawTag.split(",").map((t) => t.trim()).filter(Boolean);
@@ -49758,7 +50155,7 @@ var init_attention3 = __esm({
             { command: "attention", operation: "attention.add" }
           );
         } catch (err) {
-          if (err instanceof CleoError) {
+          if (err instanceof CleoError2) {
             cliError(err.message, err.code, { name: "CleoError", fix: err.fix });
             process.exit(err.code);
           }
@@ -49814,7 +50211,7 @@ var init_attention3 = __esm({
           }
           cliOutput(data, { command: "attention show", operation: "attention.show" });
         } catch (err) {
-          if (err instanceof CleoError) {
+          if (err instanceof CleoError2) {
             cliError(err.message, err.code, { name: "CleoError", fix: err.fix });
             process.exit(err.code);
           }
@@ -50158,8 +50555,13 @@ var init_list2 = __esm({
         });
         const claudeCredsPath = join9(homedir(), ".claude", ".credentials.json");
         const hint = existsSync6(claudeCredsPath) && entries.every((e) => e.source !== "claude-code") ? "Hint: Claude Code OAuth detected at ~/.claude/.credentials.json but consent is off. Run `cleo auth consent --enable-claude-code` to seed it into the pool." : null;
+        const { getNexusAccountStatus } = await import(
+          /* webpackIgnore: true */
+          "@cleocode/core/cloud/nexus-auth.js"
+        );
+        const nexus = providerFilter === null || providerFilter === "nexus" ? await getNexusAccountStatus().catch(() => []) : [];
         cliOutput(
-          { entries, ...hint !== null ? { hint } : {} },
+          { entries, nexus, ...hint !== null ? { hint } : {} },
           {
             command: "auth-list",
             operation: "auth.list"
@@ -50170,6 +50572,116 @@ var init_list2 = __esm({
   }
 });
 
+// packages/cleo/src/cli/lib/device-code-prompt.ts
+function writeDeviceCodePrompt(info, serviceName) {
+  process.stderr.write("\n");
+  process.stderr.write(`  Visit:      ${info.verificationUriComplete ?? info.verificationUri}
+`);
+  process.stderr.write(`  Enter code: ${info.userCode}
+`);
+  process.stderr.write("\n");
+  process.stderr.write(
+    `  Waiting for ${serviceName} authorization (up to ${Math.round(info.expiresIn / 60)} min)...
+`
+  );
+}
+function writeDeviceCodePending(elapsed) {
+  process.stderr.write(`\r  Polling... ${elapsed}s elapsed`);
+}
+function writeDeviceCodeInterrupted() {
+  process.stderr.write("\n");
+}
+function writeDeviceCodeApproved(serviceName) {
+  process.stderr.write(`\r  ${serviceName} authorization approved.              
+
+`);
+}
+var init_device_code_prompt = __esm({
+  "packages/cleo/src/cli/lib/device-code-prompt.ts"() {
+    "use strict";
+  }
+});
+
+// packages/cleo/src/cli/lib/negated-flag.ts
+function negatedFlag(args, name) {
+  if (name.startsWith("no-")) {
+    throw new Error(
+      `negatedFlag: pass the positive flag name ('${name.slice(3)}'), not '${name}'.`
+    );
+  }
+  return args[name] === false || args[`no-${name}`] === true;
+}
+var init_negated_flag = __esm({
+  "packages/cleo/src/cli/lib/negated-flag.ts"() {
+    "use strict";
+  }
+});
+
+// packages/cleo/src/cli/lib/nexus-account-cli.ts
+function nexusApiUrlArg(args) {
+  const raw = args["api-url"];
+  return typeof raw === "string" && raw !== "" ? raw : void 0;
+}
+function failNexus(err, operation) {
+  const code = err instanceof Error && "code" in err && typeof err.code === "string" ? err.code : void 0;
+  const fix = err instanceof Error && "fix" in err && typeof err.fix === "string" ? err.fix : void 0;
+  const exitCode = code === "E_NEXUS_INVALID_API_URL" || code === "E_NEXUS_INVALID_LABEL" ? 6 : 1;
+  cliError(
+    err instanceof Error ? err.message : String(err),
+    exitCode,
+    { name: code ?? "E_NEXUS_REQUEST_FAILED", ...fix ? { fix } : {} },
+    { operation }
+  );
+  process.exit(exitCode);
+}
+function emitNexusResult(data, summary, command, operation) {
+  if (isHumanOutput()) humanLine(summary);
+  else cliOutput(data, { command, operation });
+}
+async function runNexusLogin(args, openBrowser2) {
+  const { loginToNexus } = await import(
+    /* webpackIgnore: true */
+    "@cleocode/core/cloud/nexus-auth.js"
+  );
+  const noBrowser = negatedFlag(args, "browser");
+  try {
+    const result = await loginToNexus({
+      apiUrl: nexusApiUrlArg(args),
+      onCode: (code) => {
+        writeDeviceCodePrompt(code, SERVICE_NAME);
+        if (!noBrowser) openBrowser2(code.verificationUriComplete ?? code.verificationUri);
+      },
+      onPending: writeDeviceCodePending
+    });
+    writeDeviceCodeApproved(SERVICE_NAME);
+    for (const warning of result.warnings) process.stderr.write(`warning: ${warning}
+`);
+    return result;
+  } catch (err) {
+    writeDeviceCodeInterrupted();
+    throw err;
+  }
+}
+function nexusLoginSummary(r) {
+  const who = r.user?.email ?? "your account";
+  const org = r.organization ? ` (${r.organization.name})` : "";
+  return `Signed in to ${r.apiUrl} as ${who}${org}.`;
+}
+var SERVICE_NAME, NEXUS_API_URL_ARG;
+var init_nexus_account_cli = __esm({
+  "packages/cleo/src/cli/lib/nexus-account-cli.ts"() {
+    "use strict";
+    init_renderers();
+    init_device_code_prompt();
+    init_negated_flag();
+    SERVICE_NAME = "Cleo Nexus";
+    NEXUS_API_URL_ARG = {
+      type: "string",
+      description: "Cleo Nexus API URL (default: $CLEO_NEXUS_API_URL, else https://api.cleocode.dev; staging: https://api.staging.cleocode.dev)."
+    };
+  }
+});
+
 // packages/cleo/src/cli/lib/readline-wizard-io.ts
 import { stdin as input, stdout as output } from "node:process";
 import * as readline from "node:readline/promises";
@@ -50181,7 +50693,7 @@ function stripBracketedPaste(raw) {
 function streamIsTTY(stream) {
   return "isTTY" in stream && stream.isTTY === true;
 }
-var SETUP_STDIN_CLOSED_CODE, StdinClosedError, SECRET_ECHO_REFUSED_MESSAGE, MutableOutput, ReadlineWizardIO;
+var SETUP_STDIN_CLOSED_CODE, StdinClosedError, SECRET_ECHO_REFUSED_MESSAGE, SECRET_MASK_CHAR, MutableOutput, ReadlineWizardIO;
 var init_readline_wizard_io = __esm({
   "packages/cleo/src/cli/lib/readline-wizard-io.ts"() {
     "use strict";
@@ -50202,6 +50714,7 @@ var init_readline_wizard_io = __esm({
       }
     };
     SECRET_ECHO_REFUSED_MESSAGE = 'Refusing to read a secret: stdin is a terminal but terminal mode is off, so the key would be echoed. Pipe it instead: printf %s "$KEY" | cleo decide config --provider layahost --key-stdin (or cleo llm add <provider> --api-key-stdin).';
+    SECRET_MASK_CHAR = "\u2022";
     MutableOutput = class extends Writable {
       /** @param target - Stream that receives writes while unmuted. */
       constructor(target) {
@@ -50248,6 +50761,8 @@ var init_readline_wizard_io = __esm({
       output;
       /** Whether the input stream is a TTY (the terminal echoes unless readline owns it). */
       inputIsTTY;
+      /** The input stream (its keypress events drive the secret mask). */
+      inStream;
       /** AbortController aborted when stdin closes — surfaced as {@link StdinClosedError}. */
       eofController;
       /**
@@ -50271,6 +50786,7 @@ var init_readline_wizard_io = __esm({
       constructor(inStream = input, outStream = output, options = {}) {
         this.eofController = new AbortController();
         this.output = new MutableOutput(outStream);
+        this.inStream = inStream;
         this.inputIsTTY = streamIsTTY(inStream);
         this.rl = readline.createInterface({
           input: inStream,
@@ -50345,6 +50861,7 @@ var init_readline_wizard_io = __esm({
         if (this.inputIsTTY && !this.rl.terminal) throw new Error(SECRET_ECHO_REFUSED_MESSAGE);
         this.output.writeUnmuted(`${question} `);
         this.output.muted = true;
+        const stopMask = this.echoMask();
         let raw;
         try {
           raw = await this.rl.question("", { signal: this.eofController.signal });
@@ -50352,11 +50869,37 @@ var init_readline_wizard_io = __esm({
         } catch (err) {
           return this.rethrowEof(err);
         } finally {
+          stopMask();
           this.output.muted = false;
           this.output.writeUnmuted("\n");
           if (raw !== void 0) this.scrubHistory(raw);
         }
       }
+      /**
+       * While a secret is typed (readline's echo muted), echo one
+       * {@link SECRET_MASK_CHAR} per character in the line and erase one per
+       * deleted character. Runs after readline's own keypress handler (registered
+       * first), so `rl.line` is already updated; only its LENGTH is read. The
+       * submitting key (Enter) is ignored, since readline clears the line then.
+       *
+       * @returns A function that stops the echo.
+       */
+      echoMask() {
+        if (!this.rl.terminal) return () => {
+        };
+        let shown = 0;
+        const onKeypress = (_str, key) => {
+          if (key?.name === "return" || key?.name === "enter") return;
+          const length = this.rl.line.length;
+          if (length > shown) this.output.writeUnmuted(SECRET_MASK_CHAR.repeat(length - shown));
+          else if (length < shown) this.output.writeUnmuted("\b \b".repeat(shown - length));
+          shown = length;
+        };
+        this.inStream.on("keypress", onKeypress);
+        return () => {
+          this.inStream.off("keypress", onKeypress);
+        };
+      }
       /**
        * Remove every history entry equal to `line`. `history` is a runtime field
        * of `readline.Interface` that `@types/node` does not declare, so it is
@@ -50687,27 +51230,12 @@ async function _runKimiCodeLogin(opts, meta) {
       meta
     );
   }
-  process.stderr.write("\n");
-  process.stderr.write(
-    `  Visit:      ${startResp.verificationUriComplete ?? startResp.verificationUri}
-`
-  );
-  process.stderr.write(`  Enter code: ${startResp.userCode}
-`);
-  process.stderr.write("\n");
-  process.stderr.write(
-    `  Waiting for Kimi Code authorization (up to ${Math.round(startResp.expiresIn / 60)} min)...
-`
-  );
+  writeDeviceCodePrompt(startResp, "Kimi Code");
   let tokenResp;
   try {
-    tokenResp = await pollForToken(cfg, startResp, {
-      onPending: (elapsed) => {
-        process.stderr.write(`\r  Polling... ${elapsed}s elapsed`);
-      }
-    });
+    tokenResp = await pollForToken(cfg, startResp, { onPending: writeDeviceCodePending });
   } catch (err) {
-    process.stderr.write("\n");
+    writeDeviceCodeInterrupted();
     if (err instanceof DeviceCodeTimeoutError) {
       return _errorResult("E_DEVICE_CODE_TIMEOUT", err.message, meta);
     }
@@ -50721,7 +51249,7 @@ async function _runKimiCodeLogin(opts, meta) {
       meta
     );
   }
-  process.stderr.write("\r  Kimi Code authorization approved.              \n\n");
+  writeDeviceCodeApproved("Kimi Code");
   const label = opts.label ?? "oauth-login";
   const expiresAt = typeof tokenResp.expiresIn === "number" ? Date.now() + tokenResp.expiresIn * 1e3 : void 0;
   try {
@@ -50777,15 +51305,22 @@ function _findFreePort() {
   });
 }
 function _tryOpenBrowser(url) {
-  const cmd = process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open";
+  if (UNSAFE_OPEN_URL.test(url)) return;
+  const [cmd, args] = process.platform === "darwin" ? ["open", [url]] : process.platform === "win32" ? ["rundll32", ["url.dll,FileProtocolHandler", url]] : ["xdg-open", [url]];
   try {
-    spawn(cmd, [url], { detached: true, stdio: "ignore" }).unref();
+    const child = spawn(cmd, args, { detached: true, stdio: "ignore", windowsHide: true });
+    child.on("error", () => {
+    });
+    child.unref();
   } catch {
   }
 }
+var UNSAFE_OPEN_URL;
 var init_llm_login = __esm({
   "packages/cleo/src/cli/commands/llm-login.ts"() {
     "use strict";
+    init_device_code_prompt();
+    UNSAFE_OPEN_URL = /^-|[\u0000-\u0020\u007f-\u009f\s]/;
   }
 });
 
@@ -50793,9 +51328,12 @@ var init_llm_login = __esm({
 var login_exports = {};
 __export(login_exports, {
   LOGIN_ARGS: () => LOGIN_ARGS,
+  NEXUS_PICKER_LABEL: () => NEXUS_PICKER_LABEL,
   emitLoginResult: () => emitLoginResult,
   loginCommand: () => loginCommand,
+  loginPickerOptions: () => loginPickerOptions,
   makeOAuthAcquirer: () => makeOAuthAcquirer,
+  runLoginCommand: () => runLoginCommand,
   runLoginFrontDoor: () => runLoginFrontDoor
 });
 async function providerRegistry() {
@@ -50920,6 +51458,55 @@ async function resolveApiKey(args, io) {
 function hasApiKeyFlag(args) {
   return args["api-key-stdin"] === true || typeof args["api-key"] === "string" && args["api-key"] !== "";
 }
+function loginPickerOptions(providerNames) {
+  return [NEXUS_PICKER_LABEL, ...[...providerNames].sort()];
+}
+async function resolveLoginTarget(args) {
+  const given = typeof args["provider"] === "string" ? args["provider"] : "";
+  if (given || !process.stdin.isTTY) return given || void 0;
+  const names = (await (await providerRegistry()).listProviders()).map((p) => p.name);
+  const io = new ReadlineWizardIO(process.stdin, process.stderr);
+  try {
+    const choice = await io.select("What do you want to log in to?", loginPickerOptions(names));
+    return choice === NEXUS_PICKER_LABEL ? NEXUS_LOGIN_TARGET : choice;
+  } finally {
+    io.close();
+  }
+}
+async function runLoginCommand(args, operation) {
+  let target;
+  try {
+    target = await resolveLoginTarget(args);
+  } catch (err) {
+    failLogin(err, operation);
+  }
+  if (target === NEXUS_LOGIN_TARGET) {
+    let nexus;
+    try {
+      nexus = await runNexusLogin(args, _tryOpenBrowser);
+    } catch (err) {
+      failNexus(err, operation);
+    }
+    emitNexusResult(nexus, nexusLoginSummary(nexus), "login", operation);
+    return;
+  }
+  let result;
+  try {
+    result = await runLoginFrontDoor(target ? { ...args, provider: target } : args);
+  } catch (err) {
+    failLogin(err, operation);
+  }
+  emitLoginResult(result, operation);
+}
+function failLogin(err, operation) {
+  cliError(
+    err instanceof Error ? err.message : String(err),
+    1,
+    { name: "E_LOGIN_FAILED" },
+    { operation }
+  );
+  process.exit(1);
+}
 function emitLoginResult(result, operation) {
   if (!result.validated) {
     emitLoginFailure(result, operation);
@@ -50943,22 +51530,30 @@ function emitLoginFailure(result, operation) {
   );
   process.exit(1);
 }
-var AUTH_METHODS, LOGIN_ARGS, loginCommand;
+var AUTH_METHODS, NEXUS_PICKER_LABEL, LOGIN_ARGS, loginCommand;
 var init_login = __esm({
   "packages/cleo/src/cli/commands/login.ts"() {
     "use strict";
     init_src2();
     init_define_cli_command();
+    init_nexus_account_cli();
     init_readline_wizard_io();
     init_renderers();
     init_llm_login();
     AUTH_METHODS = ["oauth", "api_key"];
+    NEXUS_PICKER_LABEL = "Cleo Nexus account";
     LOGIN_ARGS = {
       provider: {
         type: "positional",
-        description: "Provider to log in to (anthropic | openai | codex | gemini | kimi-code | \u2026).",
+        description: "What to log in to: 'nexus' (Cleo Nexus account) or an LLM provider (anthropic | openai | codex | gemini | kimi-code | \u2026).",
         required: false
       },
+      "api-url": NEXUS_API_URL_ARG,
+      browser: {
+        type: "boolean",
+        description: "Open the verification URL in a browser (nexus). --no-browser only prints it (SSH, containers).",
+        default: true
+      },
       auth: {
         type: "string",
         description: "Auth method: 'oauth' (browser) or 'api_key'. Inferred from the provider when omitted."
@@ -50994,23 +51589,11 @@ var init_login = __esm({
         // ONE quoted literal, no backticks: the manifest generator's DESC_RE
         // captures only the first plain string literal (concatenations + backticks
         // truncate the `cleo --help` text mid-sentence).
-        description: "Log in to an LLM provider and bind a usable profile in one step. Picks a provider + auth method (browser OAuth or API key), selects a model, binds it, and validates the binding. cleo auth login and cleo llm login resolve to this same flow. Prompts/URLs go to stderr; the result is a human line on a terminal or a JSON envelope when piped / --json."
+        description: "Log in to a Cleo Nexus account (cleo login nexus: device code, --api-url, --no-browser) or to an LLM provider, binding a usable profile in one step. The picker lists the Cleo Nexus account first, then the providers. For a provider it picks an auth method (browser OAuth or API key), selects a model, binds it, and validates the binding. cleo auth login and cleo llm login resolve to this same flow. Prompts/URLs go to stderr; the result is a human line on a terminal or a JSON envelope when piped / --json."
       },
       args: LOGIN_ARGS,
       async run({ args }) {
-        let result;
-        try {
-          result = await runLoginFrontDoor(args);
-        } catch (err) {
-          cliError(
-            err instanceof Error ? err.message : String(err),
-            1,
-            { name: "E_LOGIN_FAILED" },
-            { operation: "login.run" }
-          );
-          process.exit(1);
-        }
-        emitLoginResult(result, "login.run");
+        await runLoginCommand(args, "login.run");
       }
     });
   }
@@ -51022,28 +51605,15 @@ var init_login2 = __esm({
   "packages/cleo/src/cli/commands/auth/login.ts"() {
     "use strict";
     init_define_cli_command();
-    init_renderers();
     init_login();
     authLoginCommand = defineCommand({
       meta: {
         name: "login",
-        description: "Log in to an LLM provider and bind a usable profile (alias of `cleo login`). Picks a provider + auth method (browser OAuth or API key), selects a model, binds it, and validates the binding. Prompts/URLs go to stderr; the result is a human line on a terminal or a JSON envelope when piped/--json."
+        description: "Log in to a Cleo Nexus account (auth login nexus) or to an LLM provider and bind a usable profile (alias of `cleo login`). Picks a provider + auth method (browser OAuth or API key), selects a model, binds it, and validates the binding. Prompts/URLs go to stderr; the result is a human line on a terminal or a JSON envelope when piped/--json."
       },
       args: LOGIN_ARGS,
       async run({ args }) {
-        let result;
-        try {
-          result = await runLoginFrontDoor(args);
-        } catch (err) {
-          cliError(
-            err instanceof Error ? err.message : String(err),
-            1,
-            { name: "E_LOGIN_FAILED" },
-            { operation: "auth.login" }
-          );
-          process.exit(1);
-        }
-        emitLoginResult(result, "auth.login");
+        await runLoginCommand(args, "auth.login");
       }
     });
   }
@@ -51263,6 +51833,17 @@ var init_migrate_project_secrets = __esm({
 });
 
 // packages/cleo/src/cli/commands/auth/remove.ts
+function emitLlmCredentialRemoval(outcome, command, operation) {
+  if (!outcome.ok) {
+    cliError(outcome.message, outcome.exitCode, { name: outcome.code, fix: outcome.fix });
+    process.exit(outcome.exitCode);
+  }
+  for (const path6 of outcome.result.cleaned) process.stderr.write(`cleaned: ${path6}
+`);
+  for (const hint of outcome.result.hints) process.stderr.write(`hint: ${hint}
+`);
+  cliOutput(outcome.result, { command, operation });
+}
 var authRemoveCommand;
 var init_remove = __esm({
   "packages/cleo/src/cli/commands/auth/remove.ts"() {
@@ -51302,73 +51883,15 @@ var init_remove = __esm({
           cliError("label is required", 6, { name: "E_INVALID_INPUT" });
           process.exit(6);
         }
-        const { getCredentialPool: getCredentialPool2 } = await import(
-          /* webpackIgnore: true */
-          "@cleocode/core/llm/credential-pool.js"
-        );
-        const { REMOVAL_REGISTRY, addSuppression } = await import(
+        const { removeLlmCredential } = await import(
           /* webpackIgnore: true */
-          "@cleocode/core/llm/credential-removal.js"
+          "@cleocode/core/llm/credential-remove-entry.js"
         );
-        const { removeCredential } = await import(
-          /* webpackIgnore: true */
-          "@cleocode/core/llm/credentials-store.js"
+        emitLlmCredentialRemoval(
+          await removeLlmCredential(provider, label),
+          "auth-remove",
+          "auth.remove"
         );
-        const pool = getCredentialPool2();
-        const entries = await pool.list();
-        const entry = entries.find((c) => c.provider === provider && c.label === label);
-        if (!entry) {
-          cliError(`No credential found for provider='${provider}' label='${label}'`, 4, {
-            name: "E_NOT_FOUND",
-            fix: `Run 'cleo auth list' to see active credentials.`
-          });
-          process.exit(4);
-        }
-        const sourceId = entry.source ?? "manual";
-        const step = REMOVAL_REGISTRY.find(sourceId);
-        if (!step) {
-          cliError(
-            `No RemovalStep registered for source='${sourceId}' \u2014 cannot safely remove '${provider}/${label}'.`,
-            2,
-            {
-              name: "E_REMOVAL_NOT_REGISTERED",
-              fix: `Open an issue: a credential was seeded from an unknown source.`
-            }
-          );
-          process.exit(2);
-        }
-        const stepResult = await step.remove({ provider, label });
-        for (const path6 of stepResult.cleaned) {
-          process.stderr.write(`cleaned: ${path6}
-`);
-        }
-        for (const hint of stepResult.hints) {
-          process.stderr.write(`hint: ${hint}
-`);
-        }
-        let suppressed = false;
-        if (stepResult.suppress) {
-          addSuppression(provider, sourceId);
-          suppressed = true;
-        }
-        const removed = await removeCredential(
-          entry.provider,
-          // ModelTransport
-          label
-        );
-        const result = {
-          provider,
-          label,
-          source: sourceId,
-          removed,
-          cleaned: stepResult.cleaned,
-          hints: stepResult.hints,
-          suppressed
-        };
-        cliOutput(result, {
-          command: "auth-remove",
-          operation: "auth.remove"
-        });
       }
     });
   }
@@ -51830,21 +52353,6 @@ var init_backup_inspect = __esm({
   }
 });
 
-// packages/cleo/src/cli/lib/negated-flag.ts
-function negatedFlag(args, name) {
-  if (name.startsWith("no-")) {
-    throw new Error(
-      `negatedFlag: pass the positive flag name ('${name.slice(3)}'), not '${name}'.`
-    );
-  }
-  return args[name] === false || args[`no-${name}`] === true;
-}
-var init_negated_flag = __esm({
-  "packages/cleo/src/cli/lib/negated-flag.ts"() {
-    "use strict";
-  }
-});
-
 // packages/cleo/src/cli/commands/backup-recover.ts
 var backup_recover_exports = {};
 __export(backup_recover_exports, {
@@ -51873,7 +52381,10 @@ function executeRecover(role, args) {
       logger: getLogger20(`backup-recover-${role}`),
       dryRun,
       fromSnapshot: fromSnapshot.length > 0 ? fromSnapshot : void 0,
-      noDelta
+      noDelta,
+      // T12708: the invocation directory; core never falls back to it.
+      cwd: process.cwd(),
+      confirmOwnerStore: readBoolFlag(args, "confirm-owner-store")
     });
     cliOutput(result, {
       command: "backup",
@@ -51955,6 +52466,11 @@ var init_backup_recover = __esm({
           type: "boolean",
           description: "Bypass any safety prompts (currently a no-op; reserved)",
           default: false
+        },
+        "confirm-owner-store": {
+          type: "boolean",
+          description: "From inside a git worktree: allow overwriting the owning project's LIVE store (refused without it)",
+          default: false
         }
       },
       async run({ args }) {
@@ -51992,6 +52508,11 @@ var init_backup_recover = __esm({
           type: "boolean",
           description: "Bypass any safety prompts (currently a no-op; reserved)",
           default: false
+        },
+        "confirm-owner-store": {
+          type: "boolean",
+          description: "From inside a git worktree: allow overwriting the owning project's LIVE store (refused without it)",
+          default: false
         }
       },
       subCommands: {
@@ -52166,7 +52687,7 @@ function collectFlagValues(rawArgs, flag) {
   }
   return values;
 }
-async function portableImport(bundlePath, target, mapValues, force) {
+async function portableImport(bundlePath, target, mapValues, force, confirmOwnerStore) {
   const core2 = await import("@cleocode/core/store/portable-bundle-import.js");
   const { PortableBundleError } = await import("@cleocode/core/store/portable-bundle.js");
   try {
@@ -52180,7 +52701,10 @@ async function portableImport(bundlePath, target, mapValues, force) {
       maps: core2.parsePathMappings(mapValues),
       force: force === true,
       requireLossless: true,
-      registerProject: core2.registerRelocatedProject
+      registerProject: core2.registerRelocatedProject,
+      // T12708: the invocation directory; core never falls back to it.
+      cwd: process.cwd(),
+      confirmOwnerStore
     });
     cliOutput(result, { command: "backup", operation: "backup.import" });
   } catch (err) {
@@ -52377,13 +52901,25 @@ var init_backup = __esm({
         map: {
           type: "string",
           description: "Portable bundles: rewrite project paths <oldPrefix>=<newPrefix> (repeatable; longest prefix wins)"
+        },
+        "confirm-owner-store": {
+          type: "boolean",
+          description: "From inside a git worktree: allow overwriting the owning project's LIVE store (refused without it)",
+          default: false
         }
       },
       async run({ args, rawArgs }) {
         const bundlePath = args.bundle;
+        const confirmOwnerStore = args["confirm-owner-store"] === true;
         const { detectBundleFormat } = await import("@cleocode/core/store/portable-bundle-import.js");
         if (await detectBundleFormat(bundlePath) === "v2") {
-          await portableImport(bundlePath, args.target, collectFlagValues(rawArgs, "map"), args.force);
+          await portableImport(
+            bundlePath,
+            args.target,
+            collectFlagValues(rawArgs, "map"),
+            args.force,
+            confirmOwnerStore
+          );
           return;
         }
         const { getProjectRoot: getProjectRoot73, getCleoHome: getCleoHome8, getCleoVersion } = await import("@cleocode/core");
@@ -52392,6 +52928,16 @@ var init_backup = __esm({
         const { regenerateAndCompare } = await import("@cleocode/core/store/restore-json-merge.js");
         const { buildConflictReport, writeConflictReport } = await import("@cleocode/core/store/restore-conflict-report.js");
         const projectRoot = getProjectRoot73();
+        const { assertOwnerStoreRewriteConfirmed } = await import("@cleocode/core/store/worktree-isolation-guard.js");
+        try {
+          assertOwnerStoreRewriteConfirmed("backup import", path2.join(projectRoot, ".cleo"), {
+            cwd: process.cwd(),
+            confirmOwnerStore
+          });
+        } catch (err) {
+          reportBundleError(err, null, "E_IMPORT_FAILED");
+          return;
+        }
         if (args.force !== true) {
           const existing = checkForExistingData(projectRoot, getCleoHome8());
           if (existing.length > 0) {
@@ -54740,7 +55286,7 @@ __export(checkpoint_exports, {
   checkpointCommand: () => checkpointCommand
 });
 import {
-  CleoError as CleoError2,
+  CleoError as CleoError3,
   formatError as formatError3,
   getCleoDir,
   gitCheckpoint,
@@ -54780,7 +55326,7 @@ var init_checkpoint = __esm({
       async run({ args }) {
         try {
           if (!isGitRepo()) {
-            throw new CleoError2(1 /* GENERAL_ERROR */, ".cleo/.git not initialized. Run: cleo init");
+            throw new CleoError3(1 /* GENERAL_ERROR */, ".cleo/.git not initialized. Run: cleo init");
           }
           if (args.status) {
             const status = await gitCheckpointStatus();
@@ -54836,7 +55382,7 @@ var init_checkpoint = __esm({
             { command: "checkpoint", message: "Checkpoint complete" }
           );
         } catch (err) {
-          if (err instanceof CleoError2) {
+          if (err instanceof CleoError3) {
             cliError(formatError3(err), err.code, { name: "E_CHECKPOINT_FAILED" });
             process.exit(err.code);
           }
@@ -54860,30 +55406,63 @@ var init_claim = __esm({
     init_dist();
     init_cli();
     claimCommand = defineCommand({
-      meta: { name: "claim", description: "Claim a task by assigning it to an agent" },
+      meta: {
+        name: "claim",
+        description: "Take, renew (--renew) or override (--take-over expired, --force-claim live) your session's leased claim on a task"
+      },
       args: {
         taskId: { type: "positional", description: "Task ID to claim", required: true },
-        agent: { type: "string", description: "Agent ID to assign the task to", required: true }
+        agent: {
+          type: "string",
+          description: "Agent ID recorded with the lease (default: the session's agent / CLEO_AGENT_ID)"
+        },
+        renew: { type: "boolean", description: "Renew your own lease on the task" },
+        "take-over": {
+          type: "boolean",
+          description: "Take over another session's EXPIRED lease (audited)"
+        },
+        "force-claim": {
+          type: "boolean",
+          description: "Take over another session's LIVE lease (audited)"
+        }
       },
       async run({ args }) {
         await dispatchFromCli(
           "mutate",
           "tasks",
           "claim",
-          { taskId: args.taskId, agentId: args.agent },
+          {
+            taskId: args.taskId,
+            ...typeof args.agent === "string" && args.agent ? { agentId: args.agent } : {},
+            ...args.renew === true ? { renew: true } : {},
+            ...args["take-over"] === true ? { takeOver: true } : {},
+            ...args["force-claim"] === true ? { forceClaim: true } : {}
+          },
           { command: "claim", operation: "tasks.claim" }
         );
       }
     });
     unclaimCommand = defineCommand({
-      meta: { name: "unclaim", description: "Unclaim a task by removing its current assignee" },
-      args: { taskId: { type: "positional", description: "Task ID to unclaim", required: true } },
+      meta: {
+        name: "unclaim",
+        description: "Release your session's claim lease on a task (--force-claim: another session's)"
+      },
+      args: {
+        taskId: { type: "positional", description: "Task ID to unclaim", required: true },
+        "force-claim": {
+          type: "boolean",
+          description: "Release another session's lease (audited)"
+        }
+      },
       async run({ args }) {
         await dispatchFromCli(
           "mutate",
           "tasks",
           "unclaim",
-          { taskId: args.taskId },
+          {
+            taskId: args.taskId,
+            ...args["force-claim"] === true ? { forceClaim: true } : {}
+          },
           { command: "unclaim", operation: "tasks.unclaim" }
         );
       }
@@ -55178,7 +55757,9 @@ function completeDispatchParams(args) {
     // T10538 — cancelled-child waiver (PM-Core V2 agent-trust)
     cancelledChildWaiverReason: str3("waive-cancelled-children"),
     // T11954 (DHQ-071) — depends-edge waiver for stale/over-specified deps
-    waiveDependsReason: str3("waive-depends")
+    waiveDependsReason: str3("waive-depends"),
+    // T12503 — optimistic concurrency
+    expectedUpdatedAt: str3("if-match")
   };
 }
 var completeCommandArgs, completeCommand;
@@ -55232,6 +55813,11 @@ var init_complete = __esm({
       "waive-depends": {
         type: "string",
         description: "Reason for completing a task whose own work is done but whose depends edges point at not-yet-terminal tasks (stale/over-specified). Audited to .cleo/audit/depends-waiver.jsonl."
+      },
+      // T12503 — optimistic concurrency
+      "if-match": {
+        type: "string",
+        description: "Fail with E_CONFLICT unless the task updatedAt still equals this version (from cleo show). Guards against completing over a concurrent edit."
       }
     };
     completeCommand = defineCommand({
@@ -56316,7 +56902,7 @@ var config_exports = {};
 __export(config_exports, {
   configCommand: () => configCommand
 });
-import { CleoError as CleoError3, loadConfig as loadConfig2 } from "@cleocode/core";
+import { CleoError as CleoError4, loadConfig as loadConfig2 } from "@cleocode/core";
 var PRESET_DESCRIPTIONS, setPresetCommand, presetsCommand, listCommand6, configCommand;
 var init_config3 = __esm({
   "packages/cleo/src/cli/commands/config.ts"() {
@@ -56371,7 +56957,7 @@ var init_config3 = __esm({
           const resolved = await loadConfig2();
           cliOutput({ config: resolved }, { command: "config" });
         } catch (err) {
-          if (err instanceof CleoError3) {
+          if (err instanceof CleoError4) {
             cliError(`config list failed: ${err.message}`, err.code, { name: "E_CONFIG_LOAD" });
             process.exit(err.code);
           }
@@ -56865,7 +57451,7 @@ import { existsSync as existsSync10, statSync } from "node:fs";
 import { mkdir, open, readFile as readFile3, rm, stat, writeFile } from "node:fs/promises";
 import { dirname as dirname4, join as join15, resolve as resolve4 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
-import { CleoError as CleoError4, getCleoHome as getCleoHome2 } from "@cleocode/core";
+import { CleoError as CleoError5, getCleoHome as getCleoHome2 } from "@cleocode/core";
 import { defineSubsystem } from "@cleocode/runtime/daemon";
 function resolveStudioCheckout(moduleUrl) {
   try {
@@ -56972,7 +57558,7 @@ function createWebSubsystem(opts = {}, moduleUrl = import.meta.url) {
       const checkout = resolveStudioCheckout(moduleUrl);
       const studioDir = resolvedStudioDir ?? (checkout ? join15(checkout, "packages", "studio", "build") : void 0);
       if (!studioDir) {
-        throw new CleoError4(
+        throw new CleoError5(
           4 /* NOT_FOUND */,
           "Packaged Studio bundle is missing its index.js entry. Reinstall a complete CLEO package or set CLEO_STUDIO_DIR to a built Studio bundle."
         );
@@ -56987,7 +57573,7 @@ function createWebSubsystem(opts = {}, moduleUrl = import.meta.url) {
         await stat(webIndexPath);
       } catch {
         if (!checkout || studioDir !== join15(checkout, "packages", "studio", "build")) {
-          throw new CleoError4(4 /* NOT_FOUND */, `Studio entry is missing: ${webIndexPath}`);
+          throw new CleoError5(4 /* NOT_FOUND */, `Studio entry is missing: ${webIndexPath}`);
         }
         try {
           execFileSync3("pnpm", ["--filter", "@cleocode/studio", "run", "build"], {
@@ -57603,13 +58189,17 @@ import {
   askDecideDebug,
   clearDecideConfig,
   configureDecide,
+  DecideCredentialsError,
   describeDecideCredentials,
+  listDecideProfilesReport,
   listDecisionSites,
   parseDecisionProviderKind,
   probeDecideProvider,
+  removeDecideProfile,
   resetDecideBudget,
   runDecideWizard,
-  SpendResetRefusedError
+  SpendResetRefusedError,
+  useDecideProfile
 } from "@cleocode/core/decide/index.js";
 import { WizardInterruptError as WizardInterruptError2 } from "@cleocode/core/setup";
 async function readSecretFromStdin() {
@@ -57626,7 +58216,7 @@ function failValidation(message, operation, fix) {
 async function runConfigWizard(op) {
   const io = new ReadlineWizardIO(process.stdin, process.stderr);
   try {
-    cliOutput(await runDecideWizard(io), { command: "decide", operation: op });
+    cliOutput(await runDecideWizard(io), { command: "decide-config", operation: op });
   } catch (err) {
     if (err instanceof WizardInterruptError2) {
       process.stderr.write("System One setup cancelled.\n");
@@ -57641,7 +58231,13 @@ async function runConfigWizard(op) {
 function oneOf(value, allowed) {
   return allowed.find((a) => a === value);
 }
-var CONFIG_FIX, decideConfigCommand, decideStatusCommand, decideAskCommand, decideSitesCommand, decideBudgetResetCommand, decideBudgetCommand, decideCommand;
+function commaList(value) {
+  return value === void 0 ? void 0 : value.split(",").map((v) => v.trim()).filter(Boolean);
+}
+function numberFlag(value) {
+  return value === void 0 ? void 0 : Number(value);
+}
+var CONFIG_FIX, PROFILES_FIX, ASK_FIX, decideConfigCommand, decideUseCommand, decideProfilesCommand, decideStatusCommand, decideAskCommand, decideSitesCommand, decideBenchCommand, decideBudgetResetCommand, decideBudgetCommand, decideCommand;
 var init_decide2 = __esm({
   "packages/cleo/src/cli/commands/decide.ts"() {
     "use strict";
@@ -57650,19 +58246,21 @@ var init_decide2 = __esm({
     init_readline_wizard_io();
     init_renderers();
     CONFIG_FIX = 'printf %s "$KEY" | cleo decide config --provider layahost --key-stdin';
+    PROFILES_FIX = "cleo decide profiles";
+    ASK_FIX = 'cleo decide ask --state "<text>" --question "<yes/no question>"';
     decideConfigCommand = defineCommand({
       meta: {
         name: "config",
-        description: "Store the decision provider, API key and model (0600 file in the CLEO home), then probe it and detect its capabilities. --provider layahost (default) needs only the key; --provider jev needs --url. Prefer --key-stdin so the key stays out of shell history. No flags on a terminal runs the setup wizard (the key is typed hidden); no flags without a terminal shows the current settings (key masked)."
+        description: "Store a System One profile, <provider>/<name> (several per provider, each with its own key): API key, URL and model (0600 file in the CLEO home), then probe it and detect its capabilities. Each provider has a default URL (layahost https://layahost.com, jev https://api.typesafe.ai); --url overrides it. Other profiles are kept and exactly one is active. Prefer --key-stdin so the key stays out of shell history. No flags on a terminal runs the setup wizard (the key is masked); no flags without a terminal shows the active settings (key masked)."
       },
       args: {
         provider: {
           type: "string",
-          description: `Provider: ${DECISION_PROVIDER_KINDS.join("|")} (layahost: fixed URL, model laya-auto; jev: custom URL, required)`
+          description: `Provider: ${DECISION_PROVIDER_KINDS.join("|")} (layahost: model laya-auto; jev: model from the provider listing)`
         },
         url: {
           type: "string",
-          description: "Provider API base URL: overrides the layahost default; required for jev"
+          description: 'Override URL for the profile, or "default" for the provider default URL (resolved at call time)'
         },
         key: {
           type: "string",
@@ -57673,12 +58271,37 @@ var init_decide2 = __esm({
           type: "string",
           description: "Default model; omitted \u2192 the stored model, the preset (layahost: laya-auto) or the first listed (jev)"
         },
-        clear: { type: "boolean", description: "Remove the stored URL, key and model" }
+        profile: {
+          type: "string",
+          description: "Profile to add or update: <provider>/<name> or a name (a-z, 0-9, -); default: the active profile of that provider, else <provider>/default"
+        },
+        activate: {
+          type: "boolean",
+          description: "Make the profile active (default: only for the first profile or one already active)"
+        },
+        remove: {
+          type: "string",
+          description: "Remove this profile (<provider>/<name>); the active one needs --use"
+        },
+        use: {
+          type: "string",
+          description: "With --remove: the profile (<provider>/<name>) to activate instead"
+        },
+        clear: { type: "boolean", description: "Remove every profile (URLs, keys and models)" }
       },
       async run({ args }) {
         const op = "decide.config";
         if (args.clear === true)
-          return cliOutput(await clearDecideConfig(), { command: "decide", operation: op });
+          return cliOutput(await clearDecideConfig(), { command: "decide-config", operation: op });
+        if (args.remove !== void 0) {
+          try {
+            const result = await removeDecideProfile(args.remove, args.use);
+            return cliOutput(result, { command: "decide-config", operation: "decide.config.remove" });
+          } catch (err) {
+            if (!(err instanceof DecideCredentialsError)) throw err;
+            return failValidation(err.message, op, PROFILES_FIX);
+          }
+        }
         const provider = parseDecisionProviderKind(args.provider);
         if (args.provider !== void 0 && provider === void 0) {
           return failValidation(`unknown provider '${args.provider}'`, op, CONFIG_FIX);
@@ -57686,24 +58309,66 @@ var init_decide2 = __esm({
         const apiKey = args["key-stdin"] === true ? await readSecretFromStdin() : args.key;
         if (args["key-stdin"] === true && !apiKey)
           return failValidation("--key-stdin set but stdin is empty or a TTY", op, CONFIG_FIX);
-        const noSettings = provider === void 0 && args.url === void 0 && apiKey === void 0 && args.model === void 0;
+        const noSettings = provider === void 0 && args.url === void 0 && apiKey === void 0 && args.model === void 0 && args.profile === void 0 && args.activate === void 0;
         if (noSettings && process.stdin.isTTY && process.stderr.isTTY) return runConfigWizard(op);
         if (noSettings) {
-          return cliOutput(describeDecideCredentials(), { command: "decide", operation: op });
+          return cliOutput(describeDecideCredentials(), { command: "decide-config", operation: op });
         }
         try {
           const result = await configureDecide({
             provider,
             baseUrl: args.url,
             apiKey,
-            model: args.model
+            model: args.model,
+            profile: args.profile,
+            ...args.activate === true ? { activate: true } : {}
           });
-          cliOutput(result, { command: "decide", operation: op });
+          cliOutput(result, { command: "decide-config", operation: op });
         } catch (err) {
           failValidation(err instanceof Error ? err.message : "invalid settings", op, CONFIG_FIX);
         }
       }
     });
+    decideUseCommand = defineCommand({
+      meta: {
+        name: "use",
+        description: "Switch the active System One profile (<provider>/<name>, e.g. layahost/work; a bare provider means <provider>/default): everyday decisions use it from now on. Other profiles stay stored and can still be addressed by id."
+      },
+      args: {
+        profile: {
+          type: "positional",
+          description: "Profile to activate, <provider>/<name>",
+          required: true
+        }
+      },
+      async run({ args }) {
+        const op = "decide.use";
+        try {
+          cliOutput(await useDecideProfile(args.profile), {
+            command: "decide-profiles",
+            operation: op
+          });
+        } catch (err) {
+          if (!(err instanceof DecideCredentialsError)) throw err;
+          failValidation(err.message, op, PROFILES_FIX);
+        }
+      }
+    });
+    decideProfilesCommand = defineCommand({
+      meta: {
+        name: "profiles",
+        description: "List the stored System One profiles: the active one marked, keys masked. --probe also checks each profile (GET {url}/v1/models, in parallel)."
+      },
+      args: {
+        probe: { type: "boolean", description: "Probe each profile's reachability" },
+        "timeout-ms": { type: "string", description: "Probe timeout in ms (default 3000)" }
+      },
+      async run({ args }) {
+        const timeoutMs = args["timeout-ms"] ? Number(args["timeout-ms"]) : void 0;
+        const result = await listDecideProfilesReport({ probe: args.probe === true, timeoutMs });
+        cliOutput(result, { command: "decide-profiles", operation: "decide.profiles" });
+      }
+    });
     decideStatusCommand = defineCommand({
       meta: {
         name: "status",
@@ -57715,7 +58380,7 @@ var init_decide2 = __esm({
       async run({ args }) {
         const timeoutMs = args["timeout-ms"] ? Number(args["timeout-ms"]) : void 0;
         const result = await probeDecideProvider({ timeoutMs });
-        cliOutput(result, { command: "decide", operation: "decide.status" });
+        cliOutput(result, { command: "decide-status", operation: "decide.status" });
         if (result.state !== "reachable" && (process.exitCode ?? 0) === 0) process.exitCode = 1;
       }
     });
@@ -57725,14 +58390,32 @@ var init_decide2 = __esm({
         description: "Debug: ask one yes/no question about a state through the configured provider. Shows the typed answer, source (provider or fallback), latency and cost."
       },
       args: {
-        state: { type: "string", description: "The state (text) to judge", required: true },
-        noul: { type: "string", description: "The yes/no question", required: true },
-        "timeout-ms": { type: "string", description: "Deadline in ms (default 10000)" }
+        state: { type: "string", description: "The state (text) to judge" },
+        question: { type: "string", description: "The yes/no question" },
+        noul: { type: "string", description: "Alias of --question" },
+        "timeout-ms": { type: "string", description: "Deadline in ms (default 10000)" },
+        profile: {
+          type: "string",
+          description: "Ask through this profile, <provider>/<name> (default: the active one)"
+        }
       },
       async run({ args }) {
+        const question = args.question ?? args.noul;
+        if (!args.state || !question) {
+          return failValidation(
+            "cleo decide ask needs a state and a yes/no question",
+            "decide.ask",
+            ASK_FIX
+          );
+        }
         const timeoutMs = args["timeout-ms"] ? Number(args["timeout-ms"]) : void 0;
-        const result = await askDecideDebug({ state: args.state, question: args.noul, timeoutMs });
-        cliOutput(result, { command: "decide", operation: "decide.ask" });
+        const result = await askDecideDebug({
+          state: args.state,
+          question,
+          timeoutMs,
+          ...args.profile ? { profile: args.profile } : {}
+        });
+        cliOutput(result, { command: "decide-ask", operation: "decide.ask" });
       }
     });
     decideSitesCommand = defineCommand({
@@ -57779,6 +58462,61 @@ var init_decide2 = __esm({
         cliOutput(result, { command: "decide", operation: op });
       }
     });
+    decideBenchCommand = defineCommand({
+      meta: {
+        name: "bench",
+        description: "System One accuracy benchmark (T12495): build a labelled dataset from this project's own history (duplicate task pairs, explicitly typed observations, superseding decisions; redacted), write a stratified spot-check sample for the owner, then compare providers against each site's heuristic with batched calls (provider cache off, 30s or longer deadline): accuracy, precision, recall, F1, false-positive rate, p50/p95 latency, cost and fallbacks, mean and spread over --runs. A hard total cap (--max-usd, default 5) is checked before every batch; the run stops cleanly at it. Profiles resolve from CLEO_DECIDE_PROFILE_<NAME>_KEY/_URL/_MODEL or the stored provider kind. --sample-only never contacts a provider."
+      },
+      args: {
+        profiles: {
+          type: "string",
+          description: "Comma list of provider profiles to compare, e.g. layahost,jev"
+        },
+        sites: {
+          type: "string",
+          description: "Comma list: duplicateDetection,observationType,decisionContradiction (default all)"
+        },
+        "sample-only": {
+          type: "boolean",
+          description: "Build the dataset and the spot-check sample only (offline, no spend)"
+        },
+        corrections: {
+          type: "string",
+          description: 'Owner corrections file ({"corrections":[{"id","label"}|{"id","drop":true}]}) to apply'
+        },
+        "max-usd": { type: "string", description: "Hard total spend cap in USD (default 5)" },
+        runs: { type: "string", description: "Repeated runs for mean and spread (default 1)" },
+        out: { type: "string", description: "Output directory (default .cleo/decide-bench)" },
+        "batch-size": { type: "string", description: "Rows per batch call, 1-64 (default 16)" },
+        rebuild: {
+          type: "boolean",
+          description: "Rebuild the dataset from the stores (drops corrections)"
+        },
+        seed: { type: "string", description: "Seed for negatives and the sample (default 12495)" }
+      },
+      async run({ args }) {
+        const op = "decide.bench";
+        const { DecideBenchInputError, runDecideBenchOperation } = await import("@cleocode/core/decide/bench/index.js");
+        try {
+          const result = await runDecideBenchOperation({
+            profiles: commaList(args.profiles),
+            sites: commaList(args.sites),
+            sampleOnly: args["sample-only"] === true,
+            correctionsPath: args.corrections,
+            maxUsd: numberFlag(args["max-usd"]),
+            runs: numberFlag(args.runs),
+            outDir: args.out,
+            batchSize: numberFlag(args["batch-size"]),
+            rebuild: args.rebuild === true,
+            seed: numberFlag(args.seed)
+          });
+          cliOutput(result, { command: "decide", operation: op });
+        } catch (err) {
+          if (!(err instanceof DecideBenchInputError)) throw err;
+          failValidation(err.message, op, err.fix);
+        }
+      }
+    });
     decideBudgetResetCommand = defineCommand({
       meta: {
         name: "reset",
@@ -57816,14 +58554,17 @@ var init_decide2 = __esm({
     decideCommand = defineCommand({
       meta: {
         name: "decide",
-        description: "System One integration (typed decisions): decide config (provider + API key; wizard on a terminal), decide status (reachability probe), decide ask (one debug question), decide sites (the registered decision sites). Unconfigured means heuristics answer."
+        description: "System One integration (typed decisions): decide config (named provider profile + API key; wizard on a terminal), decide use (switch the active profile), decide profiles (list them), decide status (reachability probe), decide ask (one debug question), decide sites (the registered decision sites), decide bench (accuracy benchmark). Unconfigured means heuristics answer."
       },
       subCommands: {
         config: decideConfigCommand,
+        use: decideUseCommand,
+        profiles: decideProfilesCommand,
         status: decideStatusCommand,
         ask: decideAskCommand,
         sites: decideSitesCommand,
-        budget: decideBudgetCommand
+        budget: decideBudgetCommand,
+        bench: decideBenchCommand
       },
       async run({ cmd, rawArgs }) {
         const firstArg = rawArgs?.find((a) => !a.startsWith("-"));
@@ -59408,7 +60149,7 @@ var init_graph2 = __esm({
 });
 
 // packages/cleo/src/cli/commands/docs/set-alias.ts
-import { CleoError as CleoError5, getProjectRoot as getProjectRoot38, setDisplayAlias } from "@cleocode/core/internal";
+import { CleoError as CleoError6, getProjectRoot as getProjectRoot38, setDisplayAlias } from "@cleocode/core/internal";
 var setAliasCommand;
 var init_set_alias = __esm({
   "packages/cleo/src/cli/commands/docs/set-alias.ts"() {
@@ -59470,7 +60211,7 @@ var init_set_alias = __esm({
           const result = await setDisplayAlias(getProjectRoot38(), { slug, displayAlias });
           cliOutput(result, { command: "docs set-alias", operation: "docs.set-alias" });
         } catch (err) {
-          if (err instanceof CleoError5) {
+          if (err instanceof CleoError6) {
             cliError(err.message, err.code, {
               name: typeof err.details?.["code"] === "string" ? err.details["code"] : "E_DOCS_SET_ALIAS",
               ...err.fix ? { fix: err.fix } : {},
@@ -60288,7 +61029,7 @@ import { dirname as dirname8, isAbsolute as isAbsolute2, join as join21, resolve
 import { pushWarning as pushWarning3 } from "@cleocode/core";
 import { createDocsReadModel as createDocsReadModel2 } from "@cleocode/core/docs/docs-read-model";
 import {
-  CleoError as CleoError6,
+  CleoError as CleoError7,
   CounterMismatchError,
   checkSlugSimilarity,
   DEFAULT_SIMILARITY_MODE,
@@ -61981,7 +62722,7 @@ var init_docs3 = __esm({
           });
           if (args.strict && anyDrift) process.exit(2);
         } catch (err) {
-          if (err instanceof CleoError6) {
+          if (err instanceof CleoError7) {
             cliError(err.message, err.code, { name: "E_DOCS_CHECK_FAILED" });
             process.exit(err.code);
           }
@@ -62067,7 +62808,7 @@ var init_docs3 = __esm({
             process.exit(result.status === "error" ? 2 : 1);
           }
         } catch (err) {
-          if (err instanceof CleoError6) {
+          if (err instanceof CleoError7) {
             cliError(err.message, err.code, { name: "E_DOCS_SYNC_FAILED" });
             process.exit(err.code);
           }
@@ -62134,7 +62875,7 @@ var init_docs3 = __esm({
             );
           }
         } catch (err) {
-          if (err instanceof CleoError6) {
+          if (err instanceof CleoError7) {
             cliError(err.message, err.code, { name: "E_DOCS_GAP_CHECK_FAILED" });
             process.exit(err.code);
           }
@@ -62618,6 +63359,11 @@ var init_doctor_db_substrate = __esm({
           type: "boolean",
           description: "Disable auto-quarantine of corrupt DBs (leaves them in place; report-only mode)."
         },
+        "confirm-owner-store": {
+          type: "boolean",
+          description: "From inside a git worktree: allow quarantining the owning project's LIVE store (skipped without it)",
+          default: false
+        },
         json: { type: "boolean", description: "Output as JSON" },
         human: { type: "boolean", description: "Force human-readable output" },
         quiet: { type: "boolean", description: "Suppress non-essential output" }
@@ -62633,7 +63379,10 @@ var init_doctor_db_substrate = __esm({
         }
         const options = {
           ...parsedTimeoutMs !== void 0 ? { integrityCheckTimeoutMs: parsedTimeoutMs } : {},
-          autoQuarantine: !negatedFlag(args, "quarantine")
+          autoQuarantine: !negatedFlag(args, "quarantine"),
+          // T12708: the invocation directory; the quarantine guard checks it.
+          cwd: process.cwd(),
+          confirmOwnerStore: args["confirm-owner-store"] === true
         };
         const result = isFleet ? surveyFleetDbSubstrate(
           typeof args["fleet-root"] === "string" && args["fleet-root"].length > 0 ? args["fleet-root"] : await defaultFleetRoots(),
@@ -63300,6 +64049,7 @@ __export(doctor_project_identity_exports, {
 import { getProjectRoot as getProjectRoot48 } from "@cleocode/core";
 import {
   inspectProjectIdentity,
+  inspectProjectNameDrift,
   resolveProjectIdentity
 } from "@cleocode/core/doctor/project-identity.js";
 var doctorProjectIdentityCommand;
@@ -63311,7 +64061,7 @@ var init_doctor_project_identity = __esm({
     doctorProjectIdentityCommand = defineCommand({
       meta: {
         name: "project-identity",
-        description: "Check .cleo/project-id against project-info.json (missing / conflict / invalid / untracked) and print the exact remedy. --resolve applies it (a conflict is re-keyed to the tracked id through the alias table, losing no registry rows); add --dry-run to see the plan first."
+        description: "Check .cleo/project.json, its legacy .cleo/project-id mirror and the project-info.json cache (legacy / missing / conflict / invalid / untracked) plus registry-name drift, and print the exact remedy. --resolve applies it: it migrates a legacy project to .cleo/project.json (no id changes) and re-keys a conflict to the tracked id through the alias table, losing no registry rows; add --dry-run to see the plan first."
       },
       args: {
         resolve: { type: "boolean", description: "Apply the remedy for the reported state" },
@@ -63324,8 +64074,13 @@ var init_doctor_project_identity = __esm({
         const projectRoot = getProjectRoot48();
         if (!args.resolve) {
           const report = inspectProjectIdentity(projectRoot);
-          cliOutput(report, { command: "doctor", operation: "doctor.project-identity.inspect" });
-          if (report.state !== "ok" && (process.exitCode === void 0 || process.exitCode === 0))
+          const nameDrift = await inspectProjectNameDrift(projectRoot);
+          cliOutput(
+            { ...report, nameDrift },
+            { command: "doctor", operation: "doctor.project-identity.inspect" }
+          );
+          const drifted = nameDrift.state === "drift" || nameDrift.state === "taken";
+          if ((report.state !== "ok" || drifted) && (process.exitCode === void 0 || process.exitCode === 0))
             process.exitCode = 1;
           return;
         }
@@ -63855,6 +64610,11 @@ var init_doctor_repair = __esm({
           type: "boolean",
           description: "Detect + plan only \u2014 report what would be repaired without quarantining/restoring",
           default: false
+        },
+        "confirm-owner-store": {
+          type: "boolean",
+          description: "From inside a git worktree: allow overwriting the owning project's LIVE store (refused without it)",
+          default: false
         }
       },
       run({ args }) {
@@ -63878,7 +64638,10 @@ var init_doctor_repair = __esm({
           projectRoot: getProjectRoot49(),
           roles: roleArg.length > 0 ? [roleArg] : void 0,
           dryRun,
-          logger: getLogger21("doctor-repair")
+          logger: getLogger21("doctor-repair"),
+          // T12708: the invocation directory; core never falls back to it.
+          cwd: process.cwd(),
+          confirmOwnerStore: args["confirm-owner-store"] === true
         });
         for (const r of result.roles) {
           if (!r.healthy) {
@@ -64224,10 +64987,24 @@ __export(doctor_twin_collapse_exports, {
 });
 import {
   inspectProjectTwinCollapse,
-  retryTwinCollapse
+  recoverTwinCollapse,
+  retryTwinCollapse,
+  rollbackTwinCollapse
 } from "@cleocode/core/doctor/twin-collapse.js";
-import { CleoError as CleoError7 } from "@cleocode/core/errors";
+import { CleoError as CleoError8 } from "@cleocode/core/errors";
 import { getProjectRoot as getProjectRoot51 } from "@cleocode/core/paths.js";
+function reportTwinCollapseError(error, retry) {
+  if (retry && !(error instanceof CleoError8)) throw error;
+  const message = error instanceof Error ? error.message : String(error);
+  const named = /^(E_[A-Z_]+):/.exec(message)?.[1];
+  const code = named ?? (retry ? "E_TWIN_COLLAPSE_FAILED" : "E_TWIN_COLLAPSE_RECOVER");
+  cliError(message, code, {
+    name: error instanceof CleoError8 ? "CleoError" : "Error",
+    fix: error instanceof CleoError8 ? error.fix : void 0,
+    details: error instanceof CleoError8 ? error.details : void 0
+  });
+  process.exitCode = error instanceof CleoError8 ? error.code : 1;
+}
 var doctorTwinCollapseCommand;
 var init_doctor_twin_collapse = __esm({
   "packages/cleo/src/cli/commands/doctor-twin-collapse.ts"() {
@@ -64244,28 +65021,59 @@ var init_doctor_twin_collapse = __esm({
           type: "boolean",
           description: "Run the collapse once now (after clearing the reported cause)"
         },
+        recover: {
+          type: "boolean",
+          description: "Restore twin values a 2026.9.21 collapse dropped or replaced, from its pinned pre-collapse snapshot, into twin_collapse_archive:* (T12727). Combine with --dry-run"
+        },
+        "dry-run": {
+          type: "boolean",
+          description: "With --recover: print the plan, write nothing"
+        },
+        rollback: {
+          type: "string",
+          description: "Undo one --recover apply by its receipt id (twin_collapse_recovery:<recoveredAt>)"
+        },
+        "confirm-owner-store": {
+          type: "boolean",
+          description: "From a git worktree: allow --recover, --rollback or --retry to write the owning project's live store"
+        },
         json: { type: "boolean", description: "Output as JSON" },
         human: { type: "boolean", description: "Force human-readable output" },
         quiet: { type: "boolean", description: "Suppress non-essential output" }
       },
       async run({ args }) {
         const projectRoot = getProjectRoot51();
-        if (args.retry === true) {
-          try {
-            const receipts = await retryTwinCollapse(projectRoot);
+        const guard = { cwd: process.cwd(), confirmOwnerStore: args["confirm-owner-store"] === true };
+        try {
+          if (typeof args.rollback === "string" && args.rollback.length > 0) {
+            const result = await rollbackTwinCollapse(projectRoot, args.rollback, guard);
+            cliOutput(
+              { kind: "generic", ...result },
+              { command: "doctor", operation: "doctor.twin-collapse.rollback" }
+            );
+            return;
+          }
+          if (args.recover === true) {
+            const result = await recoverTwinCollapse(projectRoot, {
+              ...guard,
+              dryRun: args["dry-run"] === true
+            });
+            cliOutput(
+              { kind: "generic", ...result },
+              { command: "doctor", operation: "doctor.twin-collapse.recover" }
+            );
+            return;
+          }
+          if (args.retry === true) {
+            const receipts = await retryTwinCollapse(projectRoot, guard);
             cliOutput(
               { kind: "generic", receipts },
               { command: "doctor", operation: "doctor.twin-collapse.retry" }
             );
-          } catch (error) {
-            if (!(error instanceof CleoError7)) throw error;
-            cliError(error.message, "E_TWIN_COLLAPSE_FAILED", {
-              name: "CleoError",
-              fix: error.fix,
-              details: error.details
-            });
-            process.exitCode = error.code;
+            return;
           }
+        } catch (error) {
+          reportTwinCollapseError(error, args.retry === true);
           return;
         }
         const report = inspectProjectTwinCollapse(projectRoot);
@@ -65105,7 +65913,7 @@ var init_doctor = __esm({
         "worktree-stores": doctorWorktreeStoresCommand,
         // T12097 — machine-wide guard for test runs started OUTSIDE cleo verify
         "memory-guard": doctorMemoryGuardCommand,
-        // T12353 — tracked .cleo/project-id vs project-info.json (+ --resolve re-key)
+        // T12353 · T12716 — tracked .cleo/project.json / project-id vs project-info.json (+ --resolve migrate / re-key)
         "project-identity": doctorProjectIdentityCommand,
         // T12596 · T12598 — ~/.cleo, the global hub and every harness skill install must resolve
         "global-delivery": doctorGlobalDeliveryCommand,
@@ -65835,7 +66643,7 @@ async function batchEntry(taskId, result, args) {
     const { code, message, fix } = result.error;
     return { taskId, completed: false, error: code, message, next: fix };
   }
-  const params = completeDispatchParams({ ...args, taskId });
+  const params = completeDispatchParams({ ...args, taskId, "if-match": void 0 });
   const done = await dispatchRaw("mutate", "tasks", "complete", params);
   const recordedGates = result.data.recordedGates;
   if (done.success) return { taskId, recordedGates, completed: true };
@@ -65882,6 +66690,10 @@ var init_done = __esm({
       },
       args: {
         ...completeCommandArgs,
+        "if-match": {
+          type: "string",
+          description: "Refuse with E_CONFLICT, before recording any gate, unless the task updatedAt still equals this version (from cleo show). One task id only."
+        },
         plan: {
           type: "boolean",
           description: "Print the evidence plan instead: derived change set, required gates, tool runs (cache state), AC mapping, ordered blockers and runnable commands. Records and executes nothing."
@@ -65915,6 +66727,18 @@ var init_done = __esm({
           return;
         }
         const taskIds = requested;
+        const ifMatch = typeof args["if-match"] === "string" ? args["if-match"] : void 0;
+        if (ifMatch !== void 0 && taskIds.length > 1) {
+          cliError(
+            "--if-match applies to one task; it cannot be used with several task ids",
+            "E_INVALID_INPUT",
+            {
+              fix: "Pass one task id per call: cleo done <id> --if-match <updatedAt>"
+            }
+          );
+          process.exitCode = 2;
+          return;
+        }
         if (taskIds.length > 1) {
           await runBatchDone(taskIds, args, options, args.plan === true);
           return;
@@ -65930,7 +66754,10 @@ var init_done = __esm({
           return;
         }
         const { recordTaskDone } = await import("@cleocode/core/tasks/done-record.js");
-        const recorded = await recordTaskDone(args.taskId, options);
+        const recorded = await recordTaskDone(args.taskId, {
+          ...options,
+          ...ifMatch !== void 0 ? { expectedUpdatedAt: ifMatch } : {}
+        });
         if (!recorded.success) {
           cliError(recorded.error.message, recorded.error.code, {
             fix: recorded.error.fix,
@@ -65943,7 +66770,7 @@ var init_done = __esm({
           "mutate",
           "tasks",
           "complete",
-          completeDispatchParams(args)
+          completeDispatchParams({ ...args, "if-match": void 0 })
         );
         if (!completed.success) {
           const details = {
@@ -69204,7 +70031,7 @@ import { existsSync as existsSync16, readFileSync as readFileSync12 } from "node
 import { join as join28 } from "node:path";
 import { fileURLToPath as fileURLToPath5 } from "node:url";
 import {
-  CleoError as CleoError8,
+  CleoError as CleoError9,
   getWorkflowTemplatesDir as getCoreWorkflowTemplatesDir,
   initErrorCodeName,
   initProject as initProject2,
@@ -69408,7 +70235,7 @@ var init_init = __esm({
             { command: "init" }
           );
         } catch (err) {
-          if (err instanceof CleoError8) {
+          if (err instanceof CleoError9) {
             cliError(`init failed: ${err.message}`, err.code, {
               name: initErrorCodeName(err) ?? err.toLAFSError().code,
               ...err.fix !== void 0 ? { fix: err.fix } : {},
@@ -71106,19 +71933,7 @@ var init_llm3 = __esm({
       },
       args: LOGIN_ARGS,
       async run({ args }) {
-        let result;
-        try {
-          result = await runLoginFrontDoor(args);
-        } catch (err) {
-          cliError(
-            err instanceof Error ? err.message : String(err),
-            1,
-            { name: "E_LOGIN_FAILED" },
-            { operation: "llm.login" }
-          );
-          process.exit(1);
-        }
-        emitLoginResult(result, "llm.login");
+        await runLoginCommand(args, "llm.login");
       }
     });
     refreshCatalogCommand = defineCommand({
@@ -71408,6 +72223,72 @@ var init_log = __esm({
   }
 });
 
+// packages/cleo/src/cli/commands/logout.ts
+var logout_exports = {};
+__export(logout_exports, {
+  logoutCommand: () => logoutCommand,
+  nexusLogoutSummary: () => nexusLogoutSummary
+});
+function nexusLogoutSummary(r) {
+  if (!r.removedLocally) return `Not signed in to ${r.apiUrl}; nothing to do.`;
+  const server = r.revocation === "revoked" ? "session revoked" : r.revocation === "already-invalid" ? "session was already invalid" : "server-side revocation FAILED (the session ends when it expires)";
+  return `Signed out of ${r.apiUrl}: ${server}; local token deleted.`;
+}
+var logoutCommand;
+var init_logout = __esm({
+  "packages/cleo/src/cli/commands/logout.ts"() {
+    "use strict";
+    init_src2();
+    init_define_cli_command();
+    init_nexus_account_cli();
+    init_remove();
+    logoutCommand = defineCommand({
+      meta: {
+        name: "logout",
+        description: "Sign out. cleo logout [nexus] revokes the Cleo Nexus session server-side and deletes the stored token; cleo logout <provider> [label] removes an LLM credential exactly like cleo auth remove (the label may be omitted when the provider has one credential)."
+      },
+      args: {
+        target: {
+          type: "positional",
+          description: "'nexus' (default) or an LLM provider id (e.g. anthropic).",
+          required: false
+        },
+        label: {
+          type: "positional",
+          description: "LLM credential label (optional when the provider has one credential).",
+          required: false
+        },
+        "api-url": NEXUS_API_URL_ARG,
+        json: { type: "boolean", description: "Output as JSON envelope" }
+      },
+      async run({ args }) {
+        const a = args;
+        const target = typeof a["target"] === "string" && a["target"] ? a["target"] : NEXUS_LOGIN_TARGET;
+        if (target !== NEXUS_LOGIN_TARGET) {
+          const label = typeof a["label"] === "string" && a["label"] ? a["label"] : void 0;
+          const { removeLlmCredential } = await import(
+            /* webpackIgnore: true */
+            "@cleocode/core/llm/credential-remove-entry.js"
+          );
+          emitLlmCredentialRemoval(await removeLlmCredential(target, label), "logout", "logout.run");
+          return;
+        }
+        const { logoutFromNexus } = await import(
+          /* webpackIgnore: true */
+          "@cleocode/core/cloud/nexus-auth.js"
+        );
+        let result;
+        try {
+          result = await logoutFromNexus({ apiUrl: nexusApiUrlArg(a) });
+        } catch (err) {
+          failNexus(err, "logout.run");
+        }
+        emitNexusResult(result, nexusLogoutSummary(result), "logout", "logout.run");
+      }
+    });
+  }
+});
+
 // packages/cleo/src/cli/commands/manifest.ts
 var manifest_exports = {};
 __export(manifest_exports, {
@@ -73970,10 +74851,10 @@ function applyJsonFlag2(jsonFlag) {
     setFormatContext({ format: "json", source: "flag", quiet: false });
   }
 }
-function positiveIntFlag(value) {
+function intFlag(value, min) {
   if (value === void 0 || value === "") return void 0;
   const n = Number(value);
-  return Number.isInteger(n) && n > 0 ? n : null;
+  return Number.isInteger(n) && n >= min ? n : null;
 }
 var initCommand3, registerCommand2, unregisterCommand, listCommand13, statusCommand11, showCommand8, resolveCommand2, discoverCommand2, augmentCommand2, setupCommand, searchCommand3, depsCommand3, criticalPathCommand2, blockingCommand, orphansCommand2, syncCommand5, reconcileCommand2, graphCommand3, shareStatusCommand, transferPreviewCommand, transferCommand, permissionSetCommand, permissionCommand, shareExportCommand, shareImportCommand, shareCommand, clustersCommand2, flowsCommand2, contextCommand4, impactCommand3, analyzeCommand3, projectsListCommand, projectsRegisterCommand, projectsRemoveCommand, projectsScanCommand, projectsCleanCommand, projectsStatusCommand, projectsCommand, refreshBridgeCommand, exportCommand6, diffCommand2, queryCommand3, routeMapCommand2, shapeCheckCommand2, fullContextCommand, taskFootprintCommand, brainAnchorsCommand, whyCommand, impactFullCommand2, conduitScanCommand, taskSymbolsCommand, searchCodeCommand2, contractsSyncCommand, contractsShowCommand, contractsLinkTasksCommand, contractsCommand, groupCommand, wikiCommand2, hotPathsCommand2, hotNodesCommand2, coldSymbolsCommand2, sigilSyncCommand, sigilListCommand, sigilCommand, topEntriesCommand, nexusCommand;
 var init_nexus3 = __esm({
@@ -75460,66 +76341,133 @@ The code-intelligence graph is project-scoped (ADR-090 \xB7 T11648): one store p
     projectsStatusCommand = defineCommand({
       meta: {
         name: "status",
-        description: "Git state (branch, head, dirty/untracked, upstream, ahead/behind, last fetch) of every project location on this device; bounded and parallel, no network unless --fetch"
+        description: "Fleet view: every project, its location on each device, and its last recorded git state (branch, head, dirty, ahead/behind as of the last fetch) with staleness; paged, counts first. Reads recorded probes; --refresh re-probes this device (bounded), --fetch also fetches"
       },
       args: {
+        refresh: {
+          type: "boolean",
+          description: "Re-probe this device first (bounded concurrency, per-repo timeout; no network)"
+        },
         fetch: {
           type: "boolean",
-          description: "Run git fetch per location first (network). Off by default"
+          description: "Re-probe this device with git fetch per location first (network; implies --refresh)"
+        },
+        device: {
+          type: "string",
+          description: "Only locations on this device (device id, hostname, or current)"
+        },
+        missing: { type: "boolean", description: "Only projects with a missing location" },
+        dirty: { type: "boolean", description: "Only projects with uncommitted or untracked changes" },
+        behind: {
+          type: "boolean",
+          description: "Only projects behind their upstream (as of last fetch)"
+        },
+        ahead: {
+          type: "boolean",
+          description: "Only projects ahead of their upstream (as of last fetch)"
+        },
+        stale: {
+          type: "boolean",
+          description: "Only projects never probed, or probed/fetched longer ago than --stale-after-ms"
+        },
+        errored: { type: "boolean", description: "Only projects whose last probe recorded an error" },
+        limit: { type: "string", description: "Projects per page (default 50, max 500; 0 = all)" },
+        offset: { type: "string", description: "Projects skipped before the page (default 0)" },
+        concurrency: {
+          type: "string",
+          description: "With --refresh: locations probed at once (default 8, max 64)"
         },
-        concurrency: { type: "string", description: "Locations probed at once (default 8, max 64)" },
         "timeout-ms": {
           type: "string",
-          description: "Per-location git budget in ms (default 10000; 30000 with --fetch)"
+          description: "With --refresh: per-location git budget in ms (default 10000; 30000 with --fetch)"
         },
         "stale-after-ms": {
           type: "string",
-          description: "A last fetch older than this marks remote state stale (default 86400000)"
+          description: "Staleness window for probes, fetches and heartbeats (default 86400000)"
         },
         json: { type: "boolean", description: "Output as JSON (LAFS envelope format)" }
       },
       async run({ args }) {
         applyJsonFlag2(args.json);
         const startTime = Date.now();
-        const concurrency = positiveIntFlag(args.concurrency);
-        const timeoutMs = positiveIntFlag(args["timeout-ms"]);
-        const staleAfterMs = positiveIntFlag(args["stale-after-ms"]);
-        if (concurrency === null || timeoutMs === null || staleAfterMs === null) {
+        const concurrency = intFlag(args.concurrency, 1);
+        const timeoutMs = intFlag(args["timeout-ms"], 1);
+        const staleAfterMs = intFlag(args["stale-after-ms"], 1);
+        const limit = intFlag(args.limit, 0);
+        const offset = intFlag(args.offset, 0);
+        if ([concurrency, timeoutMs, staleAfterMs, limit, offset].includes(null)) {
           cliError(
-            "--concurrency, --timeout-ms and --stale-after-ms take positive integers",
+            "--concurrency, --timeout-ms and --stale-after-ms take positive integers; --limit and --offset take integers >= 0",
             6,
             { name: "E_VALIDATION" },
-            { operation: "nexus.projects.status", duration_ms: 0 }
+            { operation: "nexus.projects.fleet", duration_ms: 0 }
           );
           process.exitCode = 6;
           return;
         }
-        const response = await dispatchRaw("mutate", "nexus", "projects.status", {
-          fetch: args.fetch === true,
-          concurrency,
-          timeoutMs,
-          staleAfterMs
+        const fetch2 = args.fetch === true;
+        let refresh;
+        if (fetch2 || args.refresh === true) {
+          const probe = await dispatchRaw("mutate", "nexus", "projects.status", {
+            fetch: fetch2,
+            concurrency: concurrency ?? void 0,
+            timeoutMs: timeoutMs ?? void 0,
+            staleAfterMs: staleAfterMs ?? void 0
+          });
+          if (!probe.success) {
+            const probeExit = probe.error?.exitCode ?? 1;
+            cliError(
+              probe.error?.message ?? "Unknown error",
+              probeExit,
+              { name: probe.error?.code ?? "E_PROJECTS_STATUS_FAILED", details: probe.error?.details },
+              { operation: "nexus.projects.status", duration_ms: Date.now() - startTime }
+            );
+            process.exitCode = probeExit;
+            return;
+          }
+          const probed = probe.data;
+          refresh = {
+            deviceId: probed.deviceId,
+            count: probed.count,
+            fetched: probed.fetched,
+            durationMs: probed.durationMs,
+            summary: probed.summary
+          };
+        }
+        const response = await dispatchRaw("query", "nexus", "projects.fleet", {
+          device: typeof args.device === "string" ? args.device : void 0,
+          missing: args.missing === true,
+          dirty: args.dirty === true,
+          behind: args.behind === true,
+          ahead: args.ahead === true,
+          stale: args.stale === true,
+          errored: args.errored === true,
+          staleAfterMs: staleAfterMs ?? void 0,
+          limit: limit ?? void 0,
+          offset: offset ?? void 0
         });
         const durationMs = Date.now() - startTime;
         if (!response.success) {
+          const code = response.error?.code ?? "E_PROJECTS_FLEET_FAILED";
+          const exitCode = response.error?.exitCode ?? 1;
           cliError(
             response.error?.message ?? "Unknown error",
-            1,
-            {
-              name: response.error?.code ?? "E_PROJECTS_STATUS_FAILED",
-              details: response.error?.details
-            },
-            { operation: "nexus.projects.status", duration_ms: durationMs }
+            exitCode,
+            { name: code, details: response.error?.details },
+            { operation: "nexus.projects.fleet", duration_ms: durationMs }
           );
-          process.exitCode = 1;
+          process.exitCode = exitCode;
           return;
         }
-        cliOutput(response.data, {
-          command: "nexus-projects-status",
-          operation: "nexus.projects.status",
-          extensions: { duration_ms: durationMs },
-          responseMeta: response.meta
-        });
+        cliOutput(
+          { ...response.data, ...refresh ? { refresh } : {} },
+          {
+            command: "nexus-projects-fleet",
+            operation: "nexus.projects.fleet",
+            extensions: { duration_ms: durationMs },
+            responseMeta: response.meta
+          }
+        );
       }
     });
     projectsCommand = defineCommand({
@@ -77702,7 +78650,7 @@ __export(otel_exports, {
   otelCommand: () => otelCommand
 });
 import {
-  CleoError as CleoError9,
+  CleoError as CleoError10,
   clearOtelData,
   formatError as formatError4,
   getOtelSessions,
@@ -77724,7 +78672,7 @@ var init_otel = __esm({
           const result = await getOtelStatus();
           cliOutput(result, { command: "otel" });
         } catch (err) {
-          if (err instanceof CleoError9) {
+          if (err instanceof CleoError10) {
             cliError(formatError4(err), err.code, { name: "E_INTERNAL" });
             process.exit(err.code);
           }
@@ -77739,7 +78687,7 @@ var init_otel = __esm({
           const result = await getOtelSummary();
           cliOutput(result, { command: "otel" });
         } catch (err) {
-          if (err instanceof CleoError9) {
+          if (err instanceof CleoError10) {
             cliError(formatError4(err), err.code, { name: "E_INTERNAL" });
             process.exit(err.code);
           }
@@ -77767,7 +78715,7 @@ var init_otel = __esm({
           });
           cliOutput(result, { command: "otel" });
         } catch (err) {
-          if (err instanceof CleoError9) {
+          if (err instanceof CleoError10) {
             cliError(formatError4(err), err.code, { name: "E_INTERNAL" });
             process.exit(err.code);
           }
@@ -77795,7 +78743,7 @@ var init_otel = __esm({
           });
           cliOutput(result, { command: "otel" });
         } catch (err) {
-          if (err instanceof CleoError9) {
+          if (err instanceof CleoError10) {
             cliError(formatError4(err), err.code, { name: "E_INTERNAL" });
             process.exit(err.code);
           }
@@ -77823,7 +78771,7 @@ var init_otel = __esm({
           });
           cliOutput(result, { command: "otel" });
         } catch (err) {
-          if (err instanceof CleoError9) {
+          if (err instanceof CleoError10) {
             cliError(formatError4(err), err.code, { name: "E_INTERNAL" });
             process.exit(err.code);
           }
@@ -77838,7 +78786,7 @@ var init_otel = __esm({
           const result = await clearOtelData();
           cliOutput(result, { command: "otel" });
         } catch (err) {
-          if (err instanceof CleoError9) {
+          if (err instanceof CleoError10) {
             cliError(formatError4(err), err.code, { name: "E_INTERNAL" });
             process.exit(err.code);
           }
@@ -78104,6 +79052,14 @@ var init_pivot = __esm({
         "no-blocks-from": {
           type: "boolean",
           description: "Skip adding toTaskId as a dependency on fromTaskId (advisory pivot \u2014 default is to block)"
+        },
+        "take-over": {
+          type: "boolean",
+          description: "Take over another session's EXPIRED claim on toTaskId (audited)"
+        },
+        "force-claim": {
+          type: "boolean",
+          description: "Take over another session's LIVE claim on toTaskId (audited)"
         }
       },
       async run({ args }) {
@@ -78115,7 +79071,9 @@ var init_pivot = __esm({
             fromTaskId: args.fromTaskId,
             toTaskId: args.toTaskId,
             reason: args.reason,
-            blocksFrom: !negatedFlag(args, "blocks-from")
+            blocksFrom: !negatedFlag(args, "blocks-from"),
+            ...args["take-over"] === true ? { takeOver: true } : {},
+            ...args["force-claim"] === true ? { forceClaim: true } : {}
           },
           { command: "pivot" }
         );
@@ -78369,7 +79327,7 @@ __export(project_exports, {
 });
 import { resolve as resolve9 } from "node:path";
 import {
-  CleoError as CleoError10,
+  CleoError as CleoError11,
   getProjectRoot as getProjectRoot65,
   moveProject,
   projectLifecycle,
@@ -78394,13 +79352,13 @@ function resolveRootOrFail(operation) {
   try {
     return getProjectRoot65();
   } catch (err) {
-    const code = err instanceof CleoError10 && typeof err.details?.["code"] === "string" ? err.details["code"] : "E_NOT_CLEO_PROJECT";
+    const code = err instanceof CleoError11 && typeof err.details?.["code"] === "string" ? err.details["code"] : "E_NOT_CLEO_PROJECT";
     emitEngineFailure(
       {
         code,
         message: err.message,
-        exitCode: err instanceof CleoError10 ? err.code : 8 /* CONFIG_ERROR */,
-        fix: err instanceof CleoError10 ? err.fix : void 0
+        exitCode: err instanceof CleoError11 ? err.code : 8 /* CONFIG_ERROR */,
+        fix: err instanceof CleoError11 ? err.fix : void 0
       },
       operation
     );
@@ -78452,13 +79410,14 @@ function emitRelocation(data, operation) {
     { command: "project", operation }
   );
 }
-var moveSubCommand, rerootSubCommand, renameSubCommand, reregisterSubCommand, projectCommand;
+var moveSubCommand, rerootSubCommand, renameSubCommand, reregisterSubCommand, linkSubCommand, projectCommand;
 var init_project = __esm({
   "packages/cleo/src/cli/commands/project.ts"() {
     "use strict";
     init_src2();
     init_dist();
     init_format_context();
+    init_nexus_account_cli();
     init_renderers();
     moveSubCommand = defineCommand({
       meta: {
@@ -78525,7 +79484,10 @@ var init_project = __esm({
       }
     });
     renameSubCommand = defineCommand({
-      meta: { name: "rename", description: "Rename this project." },
+      meta: {
+        name: "rename",
+        description: "Rename this project: the committed .cleo/project.json name, the registry label, and a Cleo Nexus relink hint (the id never changes)."
+      },
       args: {
         newName: { type: "positional", description: "New project name.", required: true },
         "dry-run": { type: "boolean", description: "Validate without applying.", default: false },
@@ -78565,7 +79527,11 @@ var init_project = __esm({
               `Project ID:   ${r.projectId}`,
               `Old name:     ${r.oldName}`,
               `New name:     ${r.newName}`,
-              `Project hash: ${r.newProjectHash}`
+              `Project hash: ${r.newProjectHash}`,
+              ...r.recordedIn ? [`Recorded in:  .cleo/${r.recordedIn}`] : [],
+              ...r.registry ? [`Registry:     ${r.registry}`] : [],
+              ...r.nexusLabel ? [`Nexus label:  ${r.nexusLabel}`] : [],
+              ...r.hint ? [`Next:         ${r.hint}`] : []
             ]),
             { command: "project", operation: "project.rename" }
           );
@@ -78605,12 +79571,46 @@ var init_project = __esm({
         }
       }
     });
+    linkSubCommand = defineCommand({
+      meta: {
+        name: "link",
+        description: "Register this project with Cleo Nexus under its project id (.cleo/project-id) with its name as a plaintext label (--label overrides; never a filesystem path). Idempotent: re-linking after a rename updates the label. Requires cleo login nexus."
+      },
+      args: {
+        label: {
+          type: "string",
+          description: "Name shown in Nexus, sent in plaintext (default: the project name). A name, never a path."
+        },
+        "api-url": NEXUS_API_URL_ARG,
+        json: { type: "boolean", description: "Output raw JSON envelope.", default: false }
+      },
+      async run({ args }) {
+        const { linkProjectToNexus } = await import(
+          /* webpackIgnore: true */
+          "@cleocode/core/cloud/nexus-link.js"
+        );
+        let result;
+        try {
+          result = await linkProjectToNexus({
+            apiUrl: nexusApiUrlArg(args),
+            ...typeof args["label"] === "string" && args["label"] ? { label: args["label"] } : {}
+          });
+        } catch (err) {
+          failNexus(err, "project.link");
+        }
+        const { link } = result;
+        const verb = result.alreadyLinked ? "Already linked" : "Linked";
+        const summary = `${verb}: project ${link.localProjectId} as "${link.label ?? ""}" on ${link.apiUrl}.`;
+        emitNexusResult(result, summary, "project", "project.link");
+      }
+    });
     projectCommand = defineCommand({
       meta: {
         name: "project",
-        description: "Project lifecycle management (move, reroot, rename, re-register)."
+        description: "Project lifecycle management (move, reroot, rename, re-register, link)."
       },
       subCommands: {
+        link: linkSubCommand,
         move: moveSubCommand,
         reroot: rerootSubCommand,
         rename: renameSubCommand,
@@ -79956,7 +80956,7 @@ __export(remote_exports, {
 });
 import {
   addRemote,
-  CleoError as CleoError11,
+  CleoError as CleoError12,
   getRemoteSyncStatus as getRemoteGitStatus,
   listRemotes,
   pull,
@@ -79994,7 +80994,7 @@ var init_remote = __esm({
             { command: "remote", message: `Remote '${name}' added: ${args.url}` }
           );
         } catch (err) {
-          if (err instanceof CleoError11) {
+          if (err instanceof CleoError12) {
             cliError(err.message, err.code, { name: "CleoError", fix: err.fix });
             process.exit(err.code);
           }
@@ -80023,7 +81023,7 @@ var init_remote = __esm({
             { command: "remote", message: `Remote '${args.name}' removed` }
           );
         } catch (err) {
-          if (err instanceof CleoError11) {
+          if (err instanceof CleoError12) {
             cliError(err.message, err.code, { name: "CleoError", fix: err.fix });
             process.exit(err.code);
           }
@@ -80048,7 +81048,7 @@ var init_remote = __esm({
             }
           );
         } catch (err) {
-          if (err instanceof CleoError11) {
+          if (err instanceof CleoError12) {
             cliError(err.message, err.code, { name: "CleoError", fix: err.fix });
             process.exit(err.code);
           }
@@ -80088,7 +81088,7 @@ var init_remote = __esm({
           }
           cliOutput({ ...status }, { command: "remote", message });
         } catch (err) {
-          if (err instanceof CleoError11) {
+          if (err instanceof CleoError12) {
             cliError(err.message, err.code, { name: "CleoError", fix: err.fix });
             process.exit(err.code);
           }
@@ -80152,7 +81152,7 @@ var init_remote = __esm({
             { command: "push", message: result.message }
           );
         } catch (err) {
-          if (err instanceof CleoError11) {
+          if (err instanceof CleoError12) {
             cliError(err.message, err.code, { name: "CleoError", fix: err.fix });
             process.exit(err.code);
           }
@@ -80195,7 +81195,7 @@ var init_remote = __esm({
             { command: "pull", message: result.message }
           );
         } catch (err) {
-          if (err instanceof CleoError11) {
+          if (err instanceof CleoError12) {
             cliError(err.message, err.code, { name: "CleoError", fix: err.fix });
             process.exit(err.code);
           }
@@ -80776,7 +81776,7 @@ __export(restore_exports, {
 import fs3 from "node:fs";
 import path5 from "node:path";
 import {
-  CleoError as CleoError12,
+  CleoError as CleoError13,
   getProjectRoot as getProjectRoot67,
   getTaskAccessor as getTaskAccessor3,
   parseConflictReport,
@@ -80907,7 +81907,7 @@ var init_restore = __esm({
           });
           if (!response.success) {
             const code = ExitCode[response.error?.code] ?? 1 /* GENERAL_ERROR */;
-            throw new CleoError12(code, response.error?.message ?? "Backup restore failed");
+            throw new CleoError13(code, response.error?.message ?? "Backup restore failed");
           }
           const data = response.data;
           if (args["dry-run"]) {
@@ -80936,7 +81936,7 @@ var init_restore = __esm({
             { command: "restore", operation: "admin.backup.restore" }
           );
         } catch (err) {
-          if (err instanceof CleoError12) {
+          if (err instanceof CleoError13) {
             cliError(err.message, err.code, { name: "CleoError", fix: err.fix });
             process.exit(err.code);
           }
@@ -80980,7 +81980,7 @@ var init_restore = __esm({
           const taskId = args.taskId;
           const idPattern = /^T\d{3,}$/;
           if (!idPattern.test(taskId)) {
-            throw new CleoError12(2 /* INVALID_INPUT */, `Invalid task ID: ${taskId}`);
+            throw new CleoError13(2 /* INVALID_INPUT */, `Invalid task ID: ${taskId}`);
           }
           const accessor = await getTaskAccessor3();
           const activeTask = await accessor.loadSingleTask(taskId);
@@ -81007,7 +82007,7 @@ var init_restore = __esm({
               const response = await dispatchRaw("mutate", "tasks", "restore", { taskId });
               if (!response.success) {
                 const code = ExitCode[response.error?.code] ?? 1 /* GENERAL_ERROR */;
-                throw new CleoError12(code, response.error?.message ?? "Task restore failed");
+                throw new CleoError13(code, response.error?.message ?? "Task restore failed");
               }
               const resultData = response.data;
               cliOutput(
@@ -81049,7 +82049,7 @@ var init_restore = __esm({
               });
               if (!response.success) {
                 const code = ExitCode[response.error?.code] ?? 1 /* GENERAL_ERROR */;
-                throw new CleoError12(code, response.error?.message ?? "Task restore failed");
+                throw new CleoError13(code, response.error?.message ?? "Task restore failed");
               }
               const resultData = response.data;
               cliOutput(
@@ -81064,7 +82064,7 @@ var init_restore = __esm({
               );
               return;
             } else {
-              throw new CleoError12(
+              throw new CleoError13(
                 6 /* VALIDATION_ERROR */,
                 `Task ${taskId} is already active with status: ${activeTask.status}`
               );
@@ -81096,7 +82096,7 @@ var init_restore = __esm({
                 }
               }
             }
-            throw new CleoError12(
+            throw new CleoError13(
               4 /* NOT_FOUND */,
               `Task ${taskId} not found in active tasks or archive`,
               {
@@ -81114,7 +82114,7 @@ var init_restore = __esm({
             });
             if (!response.success) {
               const code = ExitCode[response.error?.code] ?? 1 /* GENERAL_ERROR */;
-              throw new CleoError12(code, response.error?.message ?? "Task unarchive failed");
+              throw new CleoError13(code, response.error?.message ?? "Task unarchive failed");
             }
             const resultData = response.data;
             cliOutput(
@@ -81128,7 +82128,7 @@ var init_restore = __esm({
               { command: "restore", operation: "tasks.restore" }
             );
           } catch {
-            throw new CleoError12(
+            throw new CleoError13(
               4 /* NOT_FOUND */,
               `Task ${taskId} not found in active tasks or archive`,
               {
@@ -81137,7 +82137,7 @@ var init_restore = __esm({
             );
           }
         } catch (err) {
-          if (err instanceof CleoError12) {
+          if (err instanceof CleoError13) {
             cliError(err.message, err.code, { name: "CleoError", fix: err.fix });
             process.exit(err.code);
           }
@@ -81947,7 +82947,7 @@ import * as readline3 from "node:readline";
 import { promisify } from "node:util";
 import {
   BUILD_CONFIG as BUILD_CONFIG3,
-  CleoError as CleoError13,
+  CleoError as CleoError14,
   checkAllRegisteredProjects as checkAllRegisteredProjects2,
   checkStorageMigration,
   getCleoHome as getCleoHome7,
@@ -82283,7 +83283,7 @@ var init_self_update = __esm({
           const currentVersion = isDev ? await getCurrentVersion() : await getNpmInstalledVersion() ?? await getCurrentVersion();
           const rawChannel = args.channel?.toLowerCase();
           if (rawChannel && rawChannel !== "stable" && rawChannel !== "beta") {
-            throw new CleoError13(
+            throw new CleoError14(
               6 /* VALIDATION_ERROR */,
               `Invalid --channel '${rawChannel}'. Expected stable|beta`
             );
@@ -82325,7 +83325,7 @@ var init_self_update = __esm({
             progress.step(2, "Querying npm registry");
             const latest2 = await getDistTagVersion(requestedChannel === "beta" ? "beta" : "latest");
             if (!latest2) {
-              throw new CleoError13(
+              throw new CleoError14(
                 5 /* DEPENDENCY_ERROR */,
                 "Failed to check latest version from GitHub"
               );
@@ -82355,7 +83355,7 @@ var init_self_update = __esm({
           progress.step(2, "Querying npm registry");
           const latest = args.version ?? await getDistTagVersion(requestedChannel === "beta" ? "beta" : "latest");
           if (!latest) {
-            throw new CleoError13(
+            throw new CleoError14(
               5 /* DEPENDENCY_ERROR */,
               "Failed to check latest version from GitHub"
             );
@@ -82400,7 +83400,7 @@ var init_self_update = __esm({
           });
           progress.complete(`Updated to ${latest}`);
         } catch (err) {
-          if (err instanceof CleoError13) {
+          if (err instanceof CleoError14) {
             progress.error(err.message);
             cliError(
               err.message,
@@ -84617,7 +85617,7 @@ var init_setup = __esm({
       args: {
         section: {
           type: "string",
-          description: "Run only one named section. Valid: llm | system-one | models-roles | identity | sentient | harness | brain | project-conventions | integrations | telemetry | verification"
+          description: "Run only one named section. Valid: llm | system-one | models-roles | identity | sentient | harness | brain | project-conventions | integrations | nexus-account | telemetry | verification"
         },
         "non-interactive": {
           type: "boolean",
@@ -85923,13 +86923,21 @@ var init_start = __esm({
     startCommand8 = defineCommand({
       meta: {
         name: "start",
-        description: "Start working on a task (sets it as the current task in the active session)"
+        description: "Start working on a task (sets it as the current task and takes your session's claim lease)"
       },
       args: {
         taskId: {
           type: "positional",
           description: "ID of the task to start",
           required: true
+        },
+        "take-over": {
+          type: "boolean",
+          description: "Take over another session's EXPIRED claim lease on the task (audited)"
+        },
+        "force-claim": {
+          type: "boolean",
+          description: "Take over another session's LIVE claim lease on the task (audited)"
         }
       },
       async run({ args }) {
@@ -85937,7 +86945,11 @@ var init_start = __esm({
           "mutate",
           "tasks",
           "start",
-          { taskId: args.taskId },
+          {
+            taskId: args.taskId,
+            ...args["take-over"] === true ? { takeOver: true } : {},
+            ...args["force-claim"] === true ? { forceClaim: true } : {}
+          },
           { command: "start" }
         );
       }
@@ -86102,6 +87114,12 @@ function renderStatusHuman(status) {
   );
   const killSwitchBadge = status.daemon.killSwitchActive ? `${RED}${BOLD}ACTIVE${NC}` : `${DIM}inactive${NC}`;
   lines.push(`  ${DIM}killSwitchActive:${NC} ${killSwitchBadge}`);
+  lines.push("");
+  lines.push(`${BOLD}Cleo Nexus account${NC}`);
+  for (const n of status.nexusAccount) {
+    const color = n.state === "signed-in" ? GREEN : n.state === "not-signed-in" ? DIM : YELLOW;
+    lines.push(`  ${DIM}${n.apiUrl}:${NC} ${color}${n.summary}${NC}`);
+  }
   return lines.join("\n");
 }
 function computeExitCode(status) {
@@ -86152,7 +87170,7 @@ var sticky_exports = {};
 __export(sticky_exports, {
   stickyCommand: () => stickyCommand
 });
-import { CleoError as CleoError14 } from "@cleocode/core";
+import { CleoError as CleoError15 } from "@cleocode/core";
 var addCommand12, listCommand25, showCommand15, convertCommand, archiveCommand4, purgeCommand2, stickyCommand;
 var init_sticky3 = __esm({
   "packages/cleo/src/cli/commands/sticky.ts"() {
@@ -86201,7 +87219,7 @@ var init_sticky3 = __esm({
             { command: "sticky", operation: "sticky.add" }
           );
         } catch (err) {
-          if (err instanceof CleoError14) {
+          if (err instanceof CleoError15) {
             cliError(err.message, err.code, { name: "CleoError", fix: err.fix });
             process.exit(err.code);
           }
@@ -86256,7 +87274,7 @@ var init_sticky3 = __esm({
           }
           cliOutput(data, { command: "sticky list", operation: "sticky.list", page: response.page });
         } catch (err) {
-          if (err instanceof CleoError14) {
+          if (err instanceof CleoError15) {
             cliError(err.message, err.code, { name: "CleoError", fix: err.fix });
             process.exit(err.code);
           }
@@ -86297,7 +87315,7 @@ var init_sticky3 = __esm({
           }
           cliOutput({ sticky: data }, { command: "sticky show", operation: "sticky.show" });
         } catch (err) {
-          if (err instanceof CleoError14) {
+          if (err instanceof CleoError15) {
             cliError(err.message, err.code, { name: "CleoError", fix: err.fix });
             process.exit(err.code);
           }
@@ -86375,7 +87393,7 @@ var init_sticky3 = __esm({
             operation: "sticky.convert"
           });
         } catch (err) {
-          if (err instanceof CleoError14) {
+          if (err instanceof CleoError15) {
             cliError(err.message, err.code, { name: "CleoError", fix: err.fix });
             process.exit(err.code);
           }
@@ -86402,7 +87420,7 @@ var init_sticky3 = __esm({
             { command: "sticky archive", operation: "sticky.archive" }
           );
         } catch (err) {
-          if (err instanceof CleoError14) {
+          if (err instanceof CleoError15) {
             cliError(err.message, err.code, { name: "CleoError", fix: err.fix });
             process.exit(err.code);
           }
@@ -86429,7 +87447,7 @@ var init_sticky3 = __esm({
             { command: "sticky purge", operation: "sticky.purge" }
           );
         } catch (err) {
-          if (err instanceof CleoError14) {
+          if (err instanceof CleoError15) {
             cliError(err.message, err.code, { name: "CleoError", fix: err.fix });
             process.exit(err.code);
           }
@@ -89513,6 +90531,10 @@ var init_update = __esm({
           type: "string",
           description: "Fail with E_CONFLICT unless the task updatedAt still equals this value (optimistic concurrency; T12503)"
         },
+        "if-match": {
+          type: "string",
+          description: "Fail with E_CONFLICT unless the task updatedAt still equals this version (from cleo show). Same as --expected-updated-at."
+        },
         "depends-waiver": {
           type: "string",
           description: "Non-empty justification to waive the dependency requirement for --priority critical. Stored verbatim in the transactional task update audit log. Rejected for non-critical updates. (gh-405 / T1856)"
@@ -89722,8 +90744,8 @@ var init_update = __esm({
         if (args.severity !== void 0) params["severity"] = args.severity;
         if (args.reason !== void 0) params["reason"] = args.reason;
         if (args["depends-waiver"] !== void 0) params["dependsWaiver"] = args["depends-waiver"];
-        if (args["expected-updated-at"] !== void 0)
-          params["expectedUpdatedAt"] = args["expected-updated-at"];
+        const ifMatch = args["if-match"] ?? args["expected-updated-at"];
+        if (ifMatch !== void 0) params["expectedUpdatedAt"] = ifMatch;
         await dispatchFromCli("mutate", "tasks", "update", params, { command: "update" });
       }
     });
@@ -89736,7 +90758,7 @@ __export(upgrade_exports, {
   upgradeCommand: () => upgradeCommand
 });
 import { resolve as resolve11 } from "node:path";
-import { CleoError as CleoError15, diagnoseUpgrade, runUpgrade as runUpgrade2, upgradeWorkflows as upgradeWorkflows2 } from "@cleocode/core/internal";
+import { CleoError as CleoError16, diagnoseUpgrade, runUpgrade as runUpgrade2, upgradeWorkflows as upgradeWorkflows2 } from "@cleocode/core/internal";
 var workflowsSubcommand, upgradeCommand;
 var init_upgrade3 = __esm({
   "packages/cleo/src/cli/commands/upgrade.ts"() {
@@ -89804,7 +90826,7 @@ var init_upgrade3 = __esm({
             process.exit(1);
           }
         } catch (err) {
-          if (err instanceof CleoError15) {
+          if (err instanceof CleoError16) {
             cliError(err.message, err.code, { name: "CleoError", fix: err.fix });
             process.exit(err.code);
           }
@@ -89930,7 +90952,7 @@ var init_upgrade3 = __esm({
           }
           progress.complete(isDryRun ? "Preview complete" : "Upgrade complete");
         } catch (err) {
-          if (err instanceof CleoError15) {
+          if (err instanceof CleoError16) {
             progress.error(err.message);
             cliError(
               err.message,
@@ -90110,7 +91132,7 @@ __export(web_exports, {
 });
 import { spawn as spawn4 } from "node:child_process";
 import { rm as rm2 } from "node:fs/promises";
-import { CleoError as CleoError16, formatError as formatError5 } from "@cleocode/core";
+import { CleoError as CleoError17, formatError as formatError5 } from "@cleocode/core";
 function buildStudioUrl(port, host) {
   return `http://${host}:${port}`;
 }
@@ -90167,7 +91189,7 @@ var init_web = __esm({
             { command: "web", message: `CLEO Web UI running on port ${ctx.port}` }
           );
         } catch (err) {
-          if (err instanceof CleoError16) {
+          if (err instanceof CleoError17) {
             console.error(formatError5(err));
             process.exit(err.code);
           }
@@ -90199,7 +91221,7 @@ var init_web = __esm({
           });
           cliOutput({ stopped: true }, { command: "web", message: "CLEO Web UI stopped" });
         } catch (err) {
-          if (err instanceof CleoError16) {
+          if (err instanceof CleoError17) {
             console.error(formatError5(err));
             process.exit(err.code);
           }
@@ -90253,7 +91275,7 @@ var init_web = __esm({
             { command: "web", message: `CLEO Web UI running on port ${ctx.port}` }
           );
         } catch (err) {
-          if (err instanceof CleoError16) {
+          if (err instanceof CleoError17) {
             console.error(formatError5(err));
             process.exit(err.code);
           }
@@ -90268,7 +91290,7 @@ var init_web = __esm({
           const status = await getWebStatus();
           cliOutput(status, { command: "web" });
         } catch (err) {
-          if (err instanceof CleoError16) {
+          if (err instanceof CleoError17) {
             console.error(formatError5(err));
             process.exit(err.code);
           }
@@ -90282,7 +91304,7 @@ var init_web = __esm({
         try {
           const status = await getWebStatus();
           if (!status.running || !status.url) {
-            throw new CleoError16(
+            throw new CleoError17(
               1 /* GENERAL_ERROR */,
               "Web server is not running. Start with: cleo web start"
             );
@@ -90291,7 +91313,7 @@ var init_web = __esm({
           openBrowser(url);
           cliOutput({ url }, { command: "web", message: `Open browser to: ${url}` });
         } catch (err) {
-          if (err instanceof CleoError16) {
+          if (err instanceof CleoError17) {
             console.error(formatError5(err));
             process.exit(err.code);
           }
@@ -91106,13 +92128,13 @@ var COMMAND_MANIFEST = [
   {
     exportName: "claimCommand",
     name: "claim",
-    description: "Claim a task by assigning it to an agent",
+    description: "Take, renew (--renew) or override (--take-over expired, --force-claim live) your session's leased claim on a task",
     load: async () => (await Promise.resolve().then(() => (init_claim(), claim_exports))).claimCommand
   },
   {
     exportName: "unclaimCommand",
     name: "unclaim",
-    description: "Unclaim a task by removing its current assignee",
+    description: "Release your session's claim lease on a task (--force-claim: another session's)",
     load: async () => (await Promise.resolve().then(() => (init_claim(), claim_exports))).unclaimCommand
   },
   {
@@ -91202,7 +92224,7 @@ var COMMAND_MANIFEST = [
   {
     exportName: "decideCommand",
     name: "decide",
-    description: "System One integration (typed decisions): decide config (provider + API key; wizard on a terminal), decide status (reachability probe), decide ask (one debug question), decide sites (the registered decision sites). Unconfigured means heuristics answer.",
+    description: "System One integration (typed decisions): decide config (named provider profile + API key; wizard on a terminal), decide use (switch the active profile), decide profiles (list them), decide status (reachability probe), decide ask (one debug question), decide sites (the registered decision sites), decide bench (accuracy benchmark). Unconfigured means heuristics answer.",
     load: async () => (await Promise.resolve().then(() => (init_decide2(), decide_exports))).decideCommand
   },
   {
@@ -91346,7 +92368,7 @@ var COMMAND_MANIFEST = [
   {
     exportName: "doctorProjectIdentityCommand",
     name: "project-identity",
-    description: "Check .cleo/project-id against project-info.json (missing / conflict / invalid / untracked) ",
+    description: "Check .cleo/project.json, its legacy .cleo/project-id mirror and the project-info.json cache ",
     load: async () => (await Promise.resolve().then(() => (init_doctor_project_identity(), doctor_project_identity_exports))).doctorProjectIdentityCommand
   },
   {
@@ -91628,9 +92650,15 @@ var COMMAND_MANIFEST = [
   {
     exportName: "loginCommand",
     name: "login",
-    description: "Log in to an LLM provider and bind a usable profile in one step. Picks a provider + auth method (browser OAuth or API key), selects a model, binds it, and validates the binding. cleo auth login and cleo llm login resolve to this same flow. Prompts/URLs go to stderr; the result is a human line on a terminal or a JSON envelope when piped / --json.",
+    description: "Log in to a Cleo Nexus account (cleo login nexus: device code, --api-url, --no-browser) or to an LLM provider, binding a usable profile in one step. The picker lists the Cleo Nexus account first, then the providers. For a provider it picks an auth method (browser OAuth or API key), selects a model, binds it, and validates the binding. cleo auth login and cleo llm login resolve to this same flow. Prompts/URLs go to stderr; the result is a human line on a terminal or a JSON envelope when piped / --json.",
     load: async () => (await Promise.resolve().then(() => (init_login(), login_exports))).loginCommand
   },
+  {
+    exportName: "logoutCommand",
+    name: "logout",
+    description: "Sign out. cleo logout [nexus] revokes the Cleo Nexus session server-side and deletes the stored token; cleo logout <provider> [label] removes an LLM credential exactly like cleo auth remove (the label may be omitted when the provider has one credential).",
+    load: async () => (await Promise.resolve().then(() => (init_logout(), logout_exports))).logoutCommand
+  },
   {
     exportName: "manifestCommand",
     name: "manifest",
@@ -91718,7 +92746,7 @@ var COMMAND_MANIFEST = [
   {
     exportName: "projectCommand",
     name: "project",
-    description: "Project lifecycle management (move, reroot, rename, re-register).",
+    description: "Project lifecycle management (move, reroot, rename, re-register, link).",
     load: async () => (await Promise.resolve().then(() => (init_project(), project_exports))).projectCommand
   },
   {
@@ -91916,7 +92944,7 @@ var COMMAND_MANIFEST = [
   {
     exportName: "startCommand",
     name: "start",
-    description: "Start working on a task (sets it as the current task in the active session)",
+    description: "Start working on a task (sets it as the current task and takes your session's claim lease)",
     load: async () => (await Promise.resolve().then(() => (init_start(), start_exports))).startCommand
   },
   {
@@ -92305,7 +93333,14 @@ var INTERACTIVE_COMMAND_PATHS = [
   ["init"],
   // The `cleo tui` cockpit (T11933) is a real-time keyboard-first terminal
   // client — human-default on a TTY, JSON when piped/non-TTY.
-  ["tui"]
+  ["tui"],
+  // System One setup and debugging (T12733): the wizard, the reachability
+  // probe, one debug question and the profile list are read by a person.
+  ["decide", "config"],
+  ["decide", "status"],
+  ["decide", "ask"],
+  ["decide", "profiles"],
+  ["decide", "use"]
 ];
 function isInteractiveInvocation(argv) {
   const positionals = argv.filter((token) => !token.startsWith("-"));
@@ -92555,9 +93590,10 @@ async function runMainWithLafsEnvelope(cmd, rawArgs, showUsage2) {
   const collector = new WarningCollector();
   await withWarningCollector(collector, async () => {
     const { recordProjectEncounter, setProjectMovedRefusal } = await import("@cleocode/core/internal");
-    if (rawArgs.find((a) => !a.startsWith("-")) === "doctor") setProjectMovedRefusal(false);
+    const isDoctor = rawArgs.find((a) => !a.startsWith("-")) === "doctor";
+    if (isDoctor) setProjectMovedRefusal(false);
     try {
-      const outcome = await recordProjectEncounter();
+      const outcome = await recordProjectEncounter(void 0, { markOpened: !isDoctor });
       if (process.env["CLEO_DEBUG"])
         process.stderr.write(`[cleo][debug] Project encounter: ${outcome}
 `);
@@ -92624,6 +93660,7 @@ async function runStartupMaintenance() {
     getLogger: getLogger22,
     getProjectRoot: getProjectRoot73,
     isCleanupMarkerSet,
+    isMissingProjectError,
     migrateSignaldockToConduit,
     needsSignaldockToConduitMigration,
     setCleanupMarker,
@@ -92663,7 +93700,8 @@ async function runStartupMaintenance() {
       }
     } catch (err) {
       const msg = err instanceof Error ? err.message : String(err);
-      if (msg.includes("E_NO_PROJECT") || msg.startsWith("Run cleo init")) {
+      if (isMissingProjectError(err)) {
+        _startupLog.debug({ error: msg }, "T310 migration startup check: no project, skipped");
       } else {
         _startupLog.warn(
           { error: msg },