@cleocode/cleo 2026.9.24 → 2026.9.25

package/dist/cli/index.js

@@ -1234,6 +1234,7 @@ var init_tree = __esm({
 // packages/animations/src/render/index.ts
 var init_render = __esm({
   "packages/animations/src/render/index.ts"() {
+    "use strict";
     init_legend();
     init_tree();
   }
@@ -1351,7 +1352,6 @@ var init_spinner_handle = __esm({
 var init_src = __esm({
   "packages/animations/src/index.ts"() {
     init_animate_context();
-    init_render();
     init_spinner_handle();
   }
 });
@@ -31247,29 +31247,25 @@ var init_memory2 = __esm({
                 }
                 bindArgs.push(limitVal);
                 const whereClause = clauses.join(" AND ");
-                let rows = [];
-                try {
-                  const rawRows = nativeDb.prepare(
-                    `SELECT id, title, text, type, source_session_id, memory_tier, created_at
-                   FROM brain_observations
-                   WHERE ${whereClause}
-                   ORDER BY created_at DESC
-                   LIMIT ?`
-                  ).all(...bindArgs);
-                  rows = rawRows.map((raw) => {
-                    const r = raw;
-                    return {
-                      id: String(r["id"] ?? ""),
-                      title: r["title"] != null ? String(r["title"]) : null,
-                      text: String(r["text"] ?? ""),
-                      type: r["type"] != null ? String(r["type"]) : null,
-                      source_session_id: r["source_session_id"] != null ? String(r["source_session_id"]) : null,
-                      memory_tier: r["memory_tier"] != null ? String(r["memory_tier"]) : null,
-                      created_at: String(r["created_at"] ?? "")
-                    };
-                  });
-                } catch {
-                }
+                const rawRows = nativeDb.prepare(
+                  `SELECT id, title, narrative AS text, type, source_session_id, memory_tier, created_at
+                 FROM brain_observations
+                 WHERE ${whereClause}
+                 ORDER BY created_at DESC
+                 LIMIT ?`
+                ).all(...bindArgs);
+                const rows = rawRows.map((raw) => {
+                  const r = raw;
+                  return {
+                    id: String(r["id"] ?? ""),
+                    title: r["title"] != null ? String(r["title"]) : null,
+                    text: String(r["text"] ?? ""),
+                    type: r["type"] != null ? String(r["type"]) : null,
+                    source_session_id: r["source_session_id"] != null ? String(r["source_session_id"]) : null,
+                    memory_tier: r["memory_tier"] != null ? String(r["memory_tier"]) : null,
+                    created_at: String(r["created_at"] ?? "")
+                  };
+                });
                 return wrapResult(
                   {
                     success: true,
@@ -31305,29 +31301,25 @@ var init_memory2 = __esm({
                     startTime
                   );
                 }
-                let rows = [];
-                try {
-                  const rawRows = nativeDb.prepare(
-                    `SELECT id, title, text, source_session_id, memory_tier, created_at
-                   FROM brain_observations
-                   WHERE type = 'diary'
-                     AND invalid_at IS NULL
-                   ORDER BY created_at DESC
-                   LIMIT ?`
-                  ).all(limitVal);
-                  rows = rawRows.map((raw) => {
-                    const r = raw;
-                    return {
-                      id: String(r["id"] ?? ""),
-                      title: r["title"] != null ? String(r["title"]) : null,
-                      text: String(r["text"] ?? ""),
-                      source_session_id: r["source_session_id"] != null ? String(r["source_session_id"]) : null,
-                      memory_tier: r["memory_tier"] != null ? String(r["memory_tier"]) : null,
-                      created_at: String(r["created_at"] ?? "")
-                    };
-                  });
-                } catch {
-                }
+                const rawRows = nativeDb.prepare(
+                  `SELECT id, title, narrative AS text, source_session_id, memory_tier, created_at
+                 FROM brain_observations
+                 WHERE type = 'diary'
+                   AND invalid_at IS NULL
+                 ORDER BY created_at DESC
+                 LIMIT ?`
+                ).all(limitVal);
+                const rows = rawRows.map((raw) => {
+                  const r = raw;
+                  return {
+                    id: String(r["id"] ?? ""),
+                    title: r["title"] != null ? String(r["title"]) : null,
+                    text: String(r["text"] ?? ""),
+                    source_session_id: r["source_session_id"] != null ? String(r["source_session_id"]) : null,
+                    memory_tier: r["memory_tier"] != null ? String(r["memory_tier"]) : null,
+                    created_at: String(r["created_at"] ?? "")
+                  };
+                });
                 return wrapResult(
                   {
                     success: true,
@@ -31373,28 +31365,24 @@ var init_memory2 = __esm({
                   bindArgs.push(cursorParam);
                 }
                 bindArgs.push(limitVal);
-                let rows = [];
-                try {
-                  const rawRows = nativeDb.prepare(
-                    `SELECT id, title, text, type, memory_tier, created_at
-                   FROM brain_observations
-                   WHERE ${clauses.join(" AND ")}
-                   ORDER BY created_at ASC
-                   LIMIT ?`
-                  ).all(...bindArgs);
-                  rows = rawRows.map((raw) => {
-                    const r = raw;
-                    return {
-                      id: String(r["id"] ?? ""),
-                      title: r["title"] != null ? String(r["title"]) : null,
-                      text: String(r["text"] ?? ""),
-                      type: r["type"] != null ? String(r["type"]) : null,
-                      memory_tier: r["memory_tier"] != null ? String(r["memory_tier"]) : null,
-                      created_at: String(r["created_at"] ?? "")
-                    };
-                  });
-                } catch {
-                }
+                const rawRows = nativeDb.prepare(
+                  `SELECT id, title, narrative AS text, type, memory_tier, created_at
+                 FROM brain_observations
+                 WHERE ${clauses.join(" AND ")}
+                 ORDER BY created_at ASC
+                 LIMIT ?`
+                ).all(...bindArgs);
+                const rows = rawRows.map((raw) => {
+                  const r = raw;
+                  return {
+                    id: String(r["id"] ?? ""),
+                    title: r["title"] != null ? String(r["title"]) : null,
+                    text: String(r["text"] ?? ""),
+                    type: r["type"] != null ? String(r["type"]) : null,
+                    memory_tier: r["memory_tier"] != null ? String(r["memory_tier"]) : null,
+                    created_at: String(r["created_at"] ?? "")
+                  };
+                });
                 const nextCursor = rows.length > 0 ? rows[rows.length - 1].created_at : cursorParam ?? null;
                 return wrapResult(
                   {
@@ -38009,8 +37997,8 @@ async function loadPlaybookByName(name) {
     return null;
   }
   try {
-    const { getProjectRoot: getProjectRoot73 } = await import("@cleocode/core/internal");
-    const projectRoot = __playbookRuntimeOverrides.projectRoot ?? getProjectRoot73();
+    const { getProjectRoot: getProjectRoot74 } = await import("@cleocode/core/internal");
+    const projectRoot = __playbookRuntimeOverrides.projectRoot ?? getProjectRoot74();
     const resolved = resolvePlaybook(name, {
       projectRoot,
       globalPlaybooksDir: __playbookRuntimeOverrides.globalPlaybooksDir,
@@ -38055,7 +38043,7 @@ async function buildDefaultDispatcher() {
   if (__playbookRuntimeOverrides.dispatcher) return __playbookRuntimeOverrides.dispatcher;
   const { orchestrateSpawnExecute: orchestrateSpawnExecute2 } = await import("@cleocode/runtime/gateway");
   const {
-    getProjectRoot: getProjectRoot73,
+    getProjectRoot: getProjectRoot74,
     createToolGuard,
     runSkillNodeOrSpawn,
     maybeCreatePiRunner,
@@ -38063,7 +38051,7 @@ async function buildDefaultDispatcher() {
     hasCantbookProfilePin,
     DEFAULT_DETERMINISTIC_DENIED_COMMANDS
   } = await import("@cleocode/core/internal");
-  const projectRoot = getProjectRoot73();
+  const projectRoot = getProjectRoot74();
   const tools = createToolGuard({
     allowedRoots: [projectRoot],
     deniedCommands: DEFAULT_DETERMINISTIC_DENIED_COMMANDS,
@@ -38156,12 +38144,12 @@ async function buildDefaultDeterministicRunner() {
     return void 0;
   }
   const {
-    getProjectRoot: getProjectRoot73,
+    getProjectRoot: getProjectRoot74,
     createToolGuard,
     createGuardedDeterministicRunner,
     DEFAULT_DETERMINISTIC_DENIED_COMMANDS
   } = await import("@cleocode/core/internal");
-  const projectRoot = getProjectRoot73();
+  const projectRoot = getProjectRoot74();
   const tools = createToolGuard({
     allowedRoots: [projectRoot],
     deniedCommands: DEFAULT_DETERMINISTIC_DENIED_COMMANDS,
@@ -38319,8 +38307,8 @@ var init_playbook2 = __esm({
             projectRoot = __playbookRuntimeOverrides.projectRoot;
           } else {
             try {
-              const { getProjectRoot: getProjectRoot73 } = await import("@cleocode/core/internal");
-              projectRoot = getProjectRoot73();
+              const { getProjectRoot: getProjectRoot74 } = await import("@cleocode/core/internal");
+              projectRoot = getProjectRoot74();
             } catch {
               projectRoot = void 0;
             }
@@ -38385,14 +38373,14 @@ var init_playbook2 = __esm({
         const deterministicRunner = await buildDefaultDeterministicRunner();
         let result;
         try {
-          const { getProjectRoot: getProjectRoot73 } = await import("@cleocode/core/internal");
+          const { getProjectRoot: getProjectRoot74 } = await import("@cleocode/core/internal");
           const opts = {
             db,
             playbook: parsed.definition,
             playbookHash: parsed.sourceHash,
             initialContext,
             dispatcher,
-            projectRoot: getProjectRoot73()
+            projectRoot: getProjectRoot74()
           };
           if (deterministicRunner !== void 0) opts.deterministicRunner = deterministicRunner;
           if (__playbookRuntimeOverrides.approvalSecret !== void 0) {
@@ -40089,7 +40077,7 @@ async function manifestStatsOp(params) {
   return pipelineManifestStats(params.epicId, getProjectRoot12());
 }
 async function manifestAppendOp(params) {
-  return pipelineManifestAppend(params.entry, getProjectRoot12());
+  return pipelineManifestAppend(params.entry, getProjectRoot12(), { requireExistingTasks: true });
 }
 async function manifestArchiveOp(params) {
   return pipelineManifestArchive(params.beforeDate, getProjectRoot12());
@@ -45730,11 +45718,11 @@ var init_security = __esm({
 });
 
 // packages/cleo/src/dispatch/middleware/sanitizer.ts
-function createSanitizer(getProjectRoot73) {
+function createSanitizer(getProjectRoot74) {
   return async (req, next) => {
     if (req.params) {
       try {
-        const root = getProjectRoot73 ? getProjectRoot73() : void 0;
+        const root = getProjectRoot74 ? getProjectRoot74() : void 0;
         req.params = sanitizeParams(req.params, root, {
           domain: req.domain,
           operation: req.operation
@@ -45836,14 +45824,14 @@ var init_session_resolver = __esm({
 });
 
 // packages/cleo/src/dispatch/middleware/store-write-guard.ts
-function createStoreWriteGuard(getProjectRoot73) {
+function createStoreWriteGuard(getProjectRoot74) {
   return async (req, next) => {
     if (req.gateway !== "mutate" || ALLOWED_WHILE_READ_ONLY.has(`${req.domain}.${req.operation}`)) {
       return next();
     }
     let projectRoot;
     try {
-      projectRoot = getProjectRoot73();
+      projectRoot = getProjectRoot74();
     } catch {
       return next();
     }
@@ -52858,14 +52846,14 @@ var init_backup = __esm({
           return;
         }
         const { exportPortableBundle, PortableBundleError } = await import("@cleocode/core/store/portable-bundle.js");
-        const { getProjectRoot: getProjectRoot73 } = await import("@cleocode/core");
+        const { getProjectRoot: getProjectRoot74 } = await import("@cleocode/core");
         const passphrase = args.encrypt === true ? await resolvePassphrase() : void 0;
         if (args.encrypt === true && passphrase === void 0) return;
         const encSuffix = args.encrypt === true ? "enc." : "";
         try {
           const result = await exportPortableBundle({
             scope,
-            projectRoot: scope === "project" || scope === "all" ? getProjectRoot73() : void 0,
+            projectRoot: scope === "project" || scope === "all" ? getProjectRoot74() : void 0,
             outputPath: args.out ?? `./${args.name}.${encSuffix}cleobundle.tar.gz`,
             encrypt: args.encrypt === true,
             passphrase,
@@ -52922,12 +52910,12 @@ var init_backup = __esm({
           );
           return;
         }
-        const { getProjectRoot: getProjectRoot73, getCleoHome: getCleoHome8, getCleoVersion } = await import("@cleocode/core");
+        const { getProjectRoot: getProjectRoot74, getCleoHome: getCleoHome8, getCleoVersion } = await import("@cleocode/core");
         const { BundleError, cleanupStaging, unpackBundle } = await import("@cleocode/core/store/backup-unpack.js");
         const { regenerateConfigJson, regenerateProjectContextJson, regenerateProjectInfoJson } = await import("@cleocode/core/store/regenerators.js");
         const { regenerateAndCompare } = await import("@cleocode/core/store/restore-json-merge.js");
         const { buildConflictReport, writeConflictReport } = await import("@cleocode/core/store/restore-conflict-report.js");
-        const projectRoot = getProjectRoot73();
+        const projectRoot = getProjectRoot74();
         const { assertOwnerStoreRewriteConfirmed } = await import("@cleocode/core/store/worktree-isolation-guard.js");
         try {
           assertOwnerStoreRewriteConfirmed("backup import", path2.join(projectRoot, ".cleo"), {
@@ -58465,12 +58453,12 @@ var init_decide2 = __esm({
     decideBenchCommand = defineCommand({
       meta: {
         name: "bench",
-        description: "System One accuracy benchmark (T12495): build a labelled dataset from this project's own history (duplicate task pairs, explicitly typed observations, superseding decisions; redacted), write a stratified spot-check sample for the owner, then compare providers against each site's heuristic with batched calls (provider cache off, 30s or longer deadline): accuracy, precision, recall, F1, false-positive rate, p50/p95 latency, cost and fallbacks, mean and spread over --runs. A hard total cap (--max-usd, default 5) is checked before every batch; the run stops cleanly at it. Profiles resolve from CLEO_DECIDE_PROFILE_<NAME>_KEY/_URL/_MODEL or the stored provider kind. --sample-only never contacts a provider."
+        description: "System One accuracy benchmark (T12495): build a labelled dataset from this project's own history (duplicate task pairs, explicitly typed observations, superseding decisions; redacted), write a stratified spot-check sample for the owner, then compare providers against each site's heuristic with batched calls (provider cache off, 30s or longer deadline): accuracy, precision, recall, F1, false-positive rate, p50/p95 latency, cost and fallbacks, mean and spread over --runs. A hard total cap (--max-usd, default 5) is checked before every batch; the run stops cleanly at it. Each --profiles entry is a System One profile (cleo decide profiles): an id <provider>/<name> (e.g. layahost/work), or a bare provider meaning its active profile, else <provider>/default; a default URL resolves to the provider preset. A name no profile holds falls back to CLEO_DECIDE_PROFILE_<NAME>_KEY (plus _URL, _MODEL, _PROVIDER) for a one-off key. An unknown name fails listing the stored profiles (keys masked). --sample-only never contacts a provider."
       },
       args: {
         profiles: {
           type: "string",
-          description: "Comma list of provider profiles to compare, e.g. layahost,jev"
+          description: "Comma list of profiles to compare: <provider>/<name> ids or bare providers, e.g. layahost/work,jev"
         },
         sites: {
           type: "string",
@@ -63120,12 +63108,74 @@ var init_docs3 = __esm({
   }
 });
 
+// packages/cleo/src/cli/commands/doctor-ac-bindings.ts
+var doctor_ac_bindings_exports = {};
+__export(doctor_ac_bindings_exports, {
+  doctorAcBindingsCommand: () => doctorAcBindingsCommand
+});
+import { scanOrphanAcBindings } from "@cleocode/core/doctor/orphan-ac-bindings.js";
+import { getProjectRoot as getProjectRoot41 } from "@cleocode/core/paths.js";
+var doctorAcBindingsCommand;
+var init_doctor_ac_bindings = __esm({
+  "packages/cleo/src/cli/commands/doctor-ac-bindings.ts"() {
+    "use strict";
+    init_src2();
+    init_define_cli_command();
+    init_renderers();
+    doctorAcBindingsCommand = defineCommand({
+      meta: {
+        name: "ac-bindings",
+        description: "Report evidence bindings whose acceptance criterion no longer exists (dangling tasks_evidence_ac_bindings rows). Read-only unless --fix is given; --fix removes them, recording each removed row in the task audit log (ac.bindings.pruned)."
+      },
+      args: {
+        fix: {
+          type: "boolean",
+          description: "Delete the orphan bindings in one transaction, after writing each row to the task audit log so binding history (alias-drift detection) is kept."
+        },
+        limit: {
+          type: "string",
+          description: "Maximum orphan rows echoed in the report (default 50; counts are exact)"
+        },
+        json: { type: "boolean", description: "Output as JSON" },
+        human: { type: "boolean", description: "Force human-readable output" },
+        quiet: { type: "boolean", description: "Suppress non-essential output" }
+      },
+      async run({ args }) {
+        let limit;
+        if (typeof args.limit === "string") {
+          if (!/^\d+$/.test(args.limit.trim())) {
+            cliError(
+              `--limit must be a non-negative integer (got '${args.limit}')`,
+              6 /* VALIDATION_ERROR */,
+              { name: "E_VALIDATION" }
+            );
+            return;
+          }
+          limit = Number.parseInt(args.limit, 10);
+        }
+        const report = await scanOrphanAcBindings(getProjectRoot41(), {
+          fix: args.fix === true,
+          limit
+        });
+        cliOutput(report, {
+          command: "doctor",
+          operation: "doctor.ac-bindings.run"
+        });
+        const unresolved = report.orphanCount > report.removed;
+        if (unresolved && (process.exitCode === void 0 || process.exitCode === 0)) {
+          process.exitCode = 1;
+        }
+      }
+    });
+  }
+});
+
 // packages/cleo/src/cli/commands/doctor-acceptance-drift.ts
 var doctor_acceptance_drift_exports = {};
 __export(doctor_acceptance_drift_exports, {
   doctorAcceptanceDriftCommand: () => doctorAcceptanceDriftCommand
 });
-import { getProjectRoot as getProjectRoot41 } from "@cleocode/core";
+import { getProjectRoot as getProjectRoot42 } from "@cleocode/core";
 import {
   scanAcceptanceDrift,
   writeAcceptanceDriftBaseline
@@ -63155,7 +63205,7 @@ var init_doctor_acceptance_drift = __esm({
         quiet: { type: "boolean", description: "Suppress non-essential output" }
       },
       async run(ctx) {
-        const result = scanAcceptanceDrift(getProjectRoot41());
+        const result = scanAcceptanceDrift(getProjectRoot42());
         cliOutput(result, {
           command: "doctor",
           operation: "doctor.acceptance-drift.run"
@@ -63179,7 +63229,7 @@ __export(doctor_credentials_exports, {
   doctorCredentialsCommand: () => doctorCredentialsCommand
 });
 import { join as join22 } from "node:path";
-import { getCleoHome as getCleoHome5, getProjectRoot as getProjectRoot42 } from "@cleocode/core/paths.js";
+import { getCleoHome as getCleoHome5, getProjectRoot as getProjectRoot43 } from "@cleocode/core/paths.js";
 import {
   auditAgentRegistryKeys,
   migrateProjectCredentialsAtRoot
@@ -63206,7 +63256,7 @@ var init_doctor_credentials = __esm({
       },
       async run({ args }) {
         const dryRun = args.fix !== true;
-        const result = await migrateProjectCredentialsAtRoot(getProjectRoot42(), { dryRun });
+        const result = await migrateProjectCredentialsAtRoot(getProjectRoot43(), { dryRun });
         const agents = await auditAgentRegistryKeys(join22(getCleoHome5(), "cleo.db"), { dryRun });
         cliOutput(
           {
@@ -63241,12 +63291,26 @@ __export(doctor_db_substrate_exports, {
   doctorDbSubstrateCommand: () => doctorDbSubstrateCommand
 });
 import { dirname as dirname9 } from "node:path";
-import { getProjectRoot as getProjectRoot43, pushWarning as pushWarning4 } from "@cleocode/core";
+import { getProjectRoot as getProjectRoot44, pushWarning as pushWarning4 } from "@cleocode/core";
 import { surveyDbSubstrate, surveyFleetDbSubstrate } from "@cleocode/core/doctor/db-substrate.js";
+import { NexusRegistryReadError } from "@cleocode/core/nexus/registry-errors.js";
 import { listRegistryParentRoots } from "@cleocode/core/nexus/registry-roots.js";
 async function defaultFleetRoots() {
   const roots = await listRegistryParentRoots();
-  return roots.length > 0 ? roots : [dirname9(getProjectRoot43())];
+  return roots.length > 0 ? roots : [dirname9(getProjectRoot44())];
+}
+function reportRegistryReadError(error) {
+  cliError(
+    error.message,
+    error.code,
+    {
+      name: error.codeName,
+      fix: `Pass \`--fleet-root <dir>\` to survey without the registry. ${error.fix ?? ""}`.trim(),
+      details: error.details
+    },
+    { operation: "doctor.db-substrate.run" }
+  );
+  process.exitCode = error.code;
 }
 function pushSubstrateWarnings(result) {
   for (const warning of result.warnings) {
@@ -63384,10 +63448,21 @@ var init_doctor_db_substrate = __esm({
           cwd: process.cwd(),
           confirmOwnerStore: args["confirm-owner-store"] === true
         };
-        const result = isFleet ? surveyFleetDbSubstrate(
-          typeof args["fleet-root"] === "string" && args["fleet-root"].length > 0 ? args["fleet-root"] : await defaultFleetRoots(),
-          options
-        ) : surveyDbSubstrate(getProjectRoot43(), options);
+        let fleetRoots;
+        if (isFleet) {
+          if (typeof args["fleet-root"] === "string" && args["fleet-root"].length > 0) {
+            fleetRoots = args["fleet-root"];
+          } else {
+            try {
+              fleetRoots = await defaultFleetRoots();
+            } catch (error) {
+              if (!(error instanceof NexusRegistryReadError)) throw error;
+              reportRegistryReadError(error);
+              return;
+            }
+          }
+        }
+        const result = fleetRoots !== void 0 ? surveyFleetDbSubstrate(fleetRoots, options) : surveyDbSubstrate(getProjectRoot44(), options);
         pushSubstrateWarnings(result);
         pushPerDbWarnings(result);
         cliOutput(result, {
@@ -63719,7 +63794,7 @@ var doctor_legacy_backups_exports = {};
 __export(doctor_legacy_backups_exports, {
   doctorLegacyBackupsCommand: () => doctorLegacyBackupsCommand
 });
-import { getProjectRoot as getProjectRoot44 } from "@cleocode/core";
+import { getProjectRoot as getProjectRoot45 } from "@cleocode/core";
 import { pruneLegacyBackups, scanLegacyBackups } from "@cleocode/core/doctor/legacy-backups.js";
 function parsePositiveInt(raw, fallback) {
   if (raw === void 0 || raw === null) return fallback;
@@ -63763,7 +63838,7 @@ var init_doctor_legacy_backups = __esm({
       async run({ args }) {
         const softRetentionDays = parsePositiveInt(args["soft-retention-days"], 30);
         const hardRetentionDays = parsePositiveInt(args["hard-retention-days"], 90);
-        const projectRoot = getProjectRoot44();
+        const projectRoot = getProjectRoot45();
         let result;
         if (args.prune === true) {
           const dryRun = args["dry-run"] !== false;
@@ -63829,7 +63904,7 @@ var doctor_malformed_ids_exports = {};
 __export(doctor_malformed_ids_exports, {
   doctorMalformedIdsCommand: () => doctorMalformedIdsCommand
 });
-import { getProjectRoot as getProjectRoot45 } from "@cleocode/core";
+import { getProjectRoot as getProjectRoot46 } from "@cleocode/core";
 import { scanMalformedTaskIds } from "@cleocode/core/doctor/malformed-task-ids.js";
 var doctorMalformedIdsCommand;
 var init_doctor_malformed_ids = __esm({
@@ -63852,7 +63927,7 @@ var init_doctor_malformed_ids = __esm({
         quiet: { type: "boolean", description: "Suppress non-essential output" }
       },
       async run({ args }) {
-        const report = await scanMalformedTaskIds(getProjectRoot45(), { fix: args.fix === true });
+        const report = await scanMalformedTaskIds(getProjectRoot46(), { fix: args.fix === true });
         cliOutput(report, {
           command: "doctor",
           operation: "doctor.malformed-ids.run"
@@ -63873,12 +63948,13 @@ __export(doctor_manifest_rows_exports, {
 });
 import {
   listMalformedManifestRows,
+  listManifestIdentityProblems,
   MANIFEST_ROW_APPLY_COMMAND,
   MANIFEST_ROW_REPAIR_COMMAND,
   repairMalformedManifestRows,
   rollbackManifestRepair
 } from "@cleocode/core/memory/pipeline-manifest-sqlite.js";
-import { getProjectRoot as getProjectRoot46 } from "@cleocode/core/paths.js";
+import { getProjectRoot as getProjectRoot47 } from "@cleocode/core/paths.js";
 var doctorManifestRowsCommand;
 var init_doctor_manifest_rows = __esm({
   "packages/cleo/src/cli/commands/doctor-manifest-rows.ts"() {
@@ -63888,7 +63964,7 @@ var init_doctor_manifest_rows = __esm({
     doctorManifestRowsCommand = defineCommand({
       meta: {
         name: "manifest-rows",
-        description: "List manifest rows whose metadata violates the stored field contract. --repair shows the plan (writes nothing); --repair --apply moves each bad field under _malformed (nothing lost) with a receipt; --rollback <receipt> undoes it."
+        description: "List manifest rows whose metadata violates the stored field contract, and (read-only) rows with an invalid id, linked task id or file reference. --repair shows the plan (writes nothing); --repair --apply moves each bad field under _malformed (nothing lost) with a receipt; --rollback <receipt> undoes it."
       },
       args: {
         repair: {
@@ -63909,7 +63985,7 @@ var init_doctor_manifest_rows = __esm({
         quiet: { type: "boolean", description: "Suppress non-essential output" }
       },
       async run({ args }) {
-        const projectRoot = getProjectRoot46();
+        const projectRoot = getProjectRoot47();
         if (typeof args.rollback === "string" && args.rollback !== "") {
           const result = await rollbackManifestRepair(args.rollback, projectRoot);
           cliOutput(result, { command: "doctor", operation: "doctor.manifest-rows.rollback" });
@@ -63928,11 +64004,13 @@ var init_doctor_manifest_rows = __esm({
           return;
         }
         const rows = await listMalformedManifestRows(projectRoot);
+        const identity = await listManifestIdentityProblems(projectRoot);
         cliOutput(
-          { rows, repair: rows.length > 0 ? MANIFEST_ROW_REPAIR_COMMAND : null },
+          { rows, repair: rows.length > 0 ? MANIFEST_ROW_REPAIR_COMMAND : null, identity },
           { command: "doctor", operation: "doctor.manifest-rows.run" }
         );
-        if (rows.length > 0 && (process.exitCode === void 0 || process.exitCode === 0)) {
+        const invalidIdentity = identity.some((r) => r.issues.some((i) => i.code === "E_VALIDATION"));
+        if ((rows.length > 0 || invalidIdentity) && (process.exitCode === void 0 || process.exitCode === 0)) {
           process.exitCode = 1;
         }
       }
@@ -64009,7 +64087,7 @@ var doctor_nexus_residency_exports = {};
 __export(doctor_nexus_residency_exports, {
   doctorNexusResidencyCommand: () => doctorNexusResidencyCommand
 });
-import { getCleoHome as getCleoHome6, getProjectRoot as getProjectRoot47 } from "@cleocode/core";
+import { getCleoHome as getCleoHome6, getProjectRoot as getProjectRoot48 } from "@cleocode/core";
 import { scanNexusSchemaResidency } from "@cleocode/core/doctor/nexus-schema-residency.js";
 var doctorNexusResidencyCommand;
 var init_doctor_nexus_residency = __esm({
@@ -64028,7 +64106,7 @@ var init_doctor_nexus_residency = __esm({
         quiet: { type: "boolean", description: "Suppress non-essential output" }
       },
       async run() {
-        const result = scanNexusSchemaResidency(getProjectRoot47(), getCleoHome6());
+        const result = scanNexusSchemaResidency(getProjectRoot48(), getCleoHome6());
         cliOutput(result, {
           command: "doctor",
           operation: "doctor.nexus-residency.run"
@@ -64046,7 +64124,7 @@ var doctor_project_identity_exports = {};
 __export(doctor_project_identity_exports, {
   doctorProjectIdentityCommand: () => doctorProjectIdentityCommand
 });
-import { getProjectRoot as getProjectRoot48 } from "@cleocode/core";
+import { getProjectRoot as getProjectRoot49 } from "@cleocode/core";
 import {
   inspectProjectIdentity,
   inspectProjectNameDrift,
@@ -64071,7 +64149,7 @@ var init_doctor_project_identity = __esm({
         quiet: { type: "boolean", description: "Suppress non-essential output" }
       },
       async run({ args }) {
-        const projectRoot = getProjectRoot48();
+        const projectRoot = getProjectRoot49();
         if (!args.resolve) {
           const report = inspectProjectIdentity(projectRoot);
           const nameDrift = await inspectProjectNameDrift(projectRoot);
@@ -64104,6 +64182,7 @@ import {
   RegistryRepairError,
   rollbackProjectRegistryRepair
 } from "@cleocode/core/doctor/projects.js";
+import { NexusRegistryReadError as NexusRegistryReadError2 } from "@cleocode/core/nexus/registry-errors.js";
 var positiveInt, doctorRegistryCommand;
 var init_doctor_projects_registry = __esm({
   "packages/cleo/src/cli/commands/doctor-projects-registry.ts"() {
@@ -64157,6 +64236,16 @@ var init_doctor_projects_registry = __esm({
           if ((report.findings.some((f) => f.kind !== "other-device") || report.ambiguousAliases.length > 0) && (process.exitCode ?? 0) === 0)
             process.exitCode = 1;
         } catch (error) {
+          if (error instanceof NexusRegistryReadError2) {
+            cliError(
+              error.message,
+              error.code,
+              { name: error.codeName, fix: error.fix, details: error.details },
+              { operation }
+            );
+            process.exitCode = error.code;
+            return;
+          }
           const code = error instanceof RegistryRepairError ? error.code : "E_DOCTOR_PROJECTS_FAILED";
           const exitCode = code === "E_NOT_FOUND" ? 4 : 1;
           cliError(
@@ -64198,6 +64287,17 @@ function deriveExitCode(summary, ignoreUnreachable) {
   return 0;
 }
 function printDoctorProjectsReport(report, opts, nameLookup) {
+  if (report.registryError) {
+    const { registryError } = report;
+    cliError(
+      registryError.message,
+      registryError.exitCode,
+      { name: registryError.code, fix: registryError.fix, details: { report } },
+      { operation: "doctor.projects" }
+    );
+    process.exitCode = registryError.exitCode;
+    return;
+  }
   const { summary } = report;
   const exitCode = deriveExitCode(summary, opts.ignoreUnreachable === true);
   process.exitCode = exitCode;
@@ -64250,13 +64350,15 @@ async function runDoctorProjects(opts = {}) {
     includeGlobal: opts.skipGlobal !== true
   });
   const nameLookup = /* @__PURE__ */ new Map();
-  try {
-    const { nexusList } = await import("@cleocode/core/internal");
-    const rows = await nexusList();
-    for (const row of rows) {
-      nameLookup.set(row.hash, row.name);
+  if (!report.registryError) {
+    try {
+      const { nexusList } = await import("@cleocode/core/internal");
+      const rows = await nexusList();
+      for (const row of rows) {
+        nameLookup.set(row.hash, row.name);
+      }
+    } catch {
     }
-  } catch {
   }
   printDoctorProjectsReport(report, opts, nameLookup);
   return report;
@@ -64586,7 +64688,7 @@ var doctor_repair_exports = {};
 __export(doctor_repair_exports, {
   doctorRepairCommand: () => doctorRepairCommand
 });
-import { getLogger as getLogger21, getProjectRoot as getProjectRoot49 } from "@cleocode/core";
+import { getLogger as getLogger21, getProjectRoot as getProjectRoot50 } from "@cleocode/core";
 import { repairMalformedDbs } from "@cleocode/core/store/repair-malformed-dbs.js";
 var doctorRepairCommand;
 var init_doctor_repair = __esm({
@@ -64635,7 +64737,7 @@ var init_doctor_repair = __esm({
           return;
         }
         const result = repairMalformedDbs({
-          projectRoot: getProjectRoot49(),
+          projectRoot: getProjectRoot50(),
           roles: roleArg.length > 0 ? [roleArg] : void 0,
           dryRun,
           logger: getLogger21("doctor-repair"),
@@ -64837,7 +64939,7 @@ var doctor_superseded_store_exports = {};
 __export(doctor_superseded_store_exports, {
   doctorSupersededStoreCommand: () => doctorSupersededStoreCommand
 });
-import { getProjectRoot as getProjectRoot50 } from "@cleocode/core";
+import { getProjectRoot as getProjectRoot51 } from "@cleocode/core";
 import { scanSupersededStores } from "@cleocode/core/doctor/superseded-store.js";
 import { reconcileSupersededStores } from "@cleocode/core/store/exodus/index.js";
 var doctorSupersededStoreCommand;
@@ -64870,7 +64972,7 @@ var init_doctor_superseded_store = __esm({
       },
       async run({ args }) {
         if (args.reconcile === true) {
-          const receipt = await reconcileSupersededStores(getProjectRoot50(), {
+          const receipt = await reconcileSupersededStores(getProjectRoot51(), {
             dryRun: args["dry-run"] === true,
             additive: args.additive === true
           });
@@ -64892,7 +64994,7 @@ var init_doctor_superseded_store = __esm({
           );
           return;
         }
-        const result = scanSupersededStores(getProjectRoot50());
+        const result = scanSupersededStores(getProjectRoot51());
         cliOutput(result, {
           command: "doctor",
           operation: "doctor.superseded-store.run"
@@ -64988,11 +65090,12 @@ __export(doctor_twin_collapse_exports, {
 import {
   inspectProjectTwinCollapse,
   recoverTwinCollapse,
+  releaseProjectTwinCollapseSnapshot,
   retryTwinCollapse,
   rollbackTwinCollapse
 } from "@cleocode/core/doctor/twin-collapse.js";
 import { CleoError as CleoError8 } from "@cleocode/core/errors";
-import { getProjectRoot as getProjectRoot51 } from "@cleocode/core/paths.js";
+import { getProjectRoot as getProjectRoot52 } from "@cleocode/core/paths.js";
 function reportTwinCollapseError(error, retry) {
   if (retry && !(error instanceof CleoError8)) throw error;
   const message = error instanceof Error ? error.message : String(error);
@@ -65005,6 +65108,15 @@ function reportTwinCollapseError(error, retry) {
   });
   process.exitCode = error instanceof CleoError8 ? error.code : 1;
 }
+function twinCollapseActions(args) {
+  const named = (key) => typeof args[key] === "string" && args[key].length > 0;
+  return [
+    args.recover === true ? "--recover" : "",
+    named("release-snapshot") ? "--release-snapshot" : "",
+    named("rollback") ? "--rollback" : "",
+    args.retry === true ? "--retry" : ""
+  ].filter(Boolean);
+}
 var doctorTwinCollapseCommand;
 var init_doctor_twin_collapse = __esm({
   "packages/cleo/src/cli/commands/doctor-twin-collapse.ts"() {
@@ -65014,7 +65126,7 @@ var init_doctor_twin_collapse = __esm({
     doctorTwinCollapseCommand = defineCommand({
       meta: {
         name: "twin-collapse",
-        description: "Report the twin collapses (bare schema_meta / sticky_tags kept in step with their prefixed twins): state, last failure, snapshot path and space needed. --retry re-runs them."
+        description: "Report the twin collapses (bare schema_meta / sticky_tags kept in step with their prefixed twins): state, last failure, snapshot path and space needed. --retry re-runs them; --recover restores what 2026.9.21 dropped; --release-snapshot lets a checked snapshot rotate."
       },
       args: {
         retry: {
@@ -65029,10 +65141,22 @@ var init_doctor_twin_collapse = __esm({
           type: "boolean",
           description: "With --recover: print the plan, write nothing"
         },
+        "pin-snapshot": {
+          type: "boolean",
+          description: "With --recover: pin an unpinned pre-collapse snapshot (its .meta.json sidecar only) before applying"
+        },
         rollback: {
           type: "string",
           description: "Undo one --recover apply by its receipt id (twin_collapse_recovery:<recoveredAt>)"
         },
+        "release-snapshot": {
+          type: "string",
+          description: "Release a pre-collapse snapshot (backup id, e.g. migration-20260928-153200) after a verified recovery or a no-recovery-needed check, so it rotates normally. Needs --confirm; --dry-run shows the bytes reclaimed"
+        },
+        confirm: {
+          type: "boolean",
+          description: "With --release-snapshot: the owner's decision to release (obtained by the calling agent; the CLI never prompts)"
+        },
         "confirm-owner-store": {
           type: "boolean",
           description: "From a git worktree: allow --recover, --rollback or --retry to write the owning project's live store"
@@ -65042,8 +65166,18 @@ var init_doctor_twin_collapse = __esm({
         quiet: { type: "boolean", description: "Suppress non-essential output" }
       },
       async run({ args }) {
-        const projectRoot = getProjectRoot51();
+        const projectRoot = getProjectRoot52();
         const guard = { cwd: process.cwd(), confirmOwnerStore: args["confirm-owner-store"] === true };
+        const actions = twinCollapseActions(args);
+        if (actions.length > 1) {
+          cliError(
+            `E_INVALID_INPUT: ${actions.join(" and ")} are separate actions; run them one at a time (--recover before --release-snapshot)`,
+            "E_INVALID_INPUT",
+            { name: "Error", fix: "cleo doctor twin-collapse --recover --dry-run" }
+          );
+          process.exitCode = 2;
+          return;
+        }
         try {
           if (typeof args.rollback === "string" && args.rollback.length > 0) {
             const result = await rollbackTwinCollapse(projectRoot, args.rollback, guard);
@@ -65053,10 +65187,27 @@ var init_doctor_twin_collapse = __esm({
             );
             return;
           }
+          if (typeof args["release-snapshot"] === "string" && args["release-snapshot"].length > 0) {
+            const result = await releaseProjectTwinCollapseSnapshot(
+              projectRoot,
+              args["release-snapshot"],
+              {
+                ...guard,
+                dryRun: args["dry-run"] === true,
+                confirm: args.confirm === true
+              }
+            );
+            cliOutput(
+              { kind: "generic", ...result },
+              { command: "doctor", operation: "doctor.twin-collapse.release-snapshot" }
+            );
+            return;
+          }
           if (args.recover === true) {
             const result = await recoverTwinCollapse(projectRoot, {
               ...guard,
-              dryRun: args["dry-run"] === true
+              dryRun: args["dry-run"] === true,
+              pinSnapshot: args["pin-snapshot"] === true
             });
             cliOutput(
               { kind: "generic", ...result },
@@ -65093,7 +65244,7 @@ __export(doctor_worktree_stores_exports, {
   doctorWorktreeStoresCommand: () => doctorWorktreeStoresCommand
 });
 import { scanWorktreeStores } from "@cleocode/core/doctor/worktree-stores.js";
-import { getProjectRoot as getProjectRoot52, resolveStoreOwnerRoot } from "@cleocode/core/paths.js";
+import { getProjectRoot as getProjectRoot53, resolveStoreOwnerRoot } from "@cleocode/core/paths.js";
 var doctorWorktreeStoresCommand;
 var init_doctor_worktree_stores = __esm({
   "packages/cleo/src/cli/commands/doctor-worktree-stores.ts"() {
@@ -65115,7 +65266,7 @@ var init_doctor_worktree_stores = __esm({
         quiet: { type: "boolean", description: "Suppress non-essential output" }
       },
       async run({ args }) {
-        const projectRoot = resolveStoreOwnerRoot(getProjectRoot52());
+        const projectRoot = resolveStoreOwnerRoot(getProjectRoot53());
         const result = scanWorktreeStores(projectRoot, { skipCompare: args["skip-compare"] === true });
         cliOutput(result, {
           command: "doctor",
@@ -65267,7 +65418,7 @@ import {
   resumePreparedKnowledgeRepair,
   runKnowledgeDoctor as runKnowledgeDoctor2
 } from "@cleocode/core/doctor/knowledge.js";
-import { getProjectRoot as getProjectRoot53 } from "@cleocode/core/paths.js";
+import { getProjectRoot as getProjectRoot54 } from "@cleocode/core/paths.js";
 var doctorKnowledgeSubcommand;
 var init_doctor_knowledge = __esm({
   "packages/cleo/src/cli/commands/doctor-knowledge.ts"() {
@@ -65342,7 +65493,7 @@ var init_doctor_knowledge = __esm({
       },
       async run({ args }) {
         const startedAt = Date.now();
-        const root = getProjectRoot53();
+        const root = getProjectRoot54();
         let context;
         let pending;
         try {
@@ -65510,7 +65661,7 @@ import { join as join24 } from "node:path";
 import {
   ensureGlobalAgentRegistryDb,
   getGlobalAgentRegistryNativeDb,
-  getProjectRoot as getProjectRoot54,
+  getProjectRoot as getProjectRoot55,
   installAgentFromCant
 } from "@cleocode/core/internal";
 function sha256Hex(bytes) {
@@ -65698,7 +65849,7 @@ var init_migrate_agents_v2 = __esm({
         }
       },
       async run({ args }) {
-        const projectRoot = getProjectRoot54();
+        const projectRoot = getProjectRoot55();
         const verbose = args.quiet !== true;
         if (verbose) {
           humanInfo("Scanning .cleo/cant/agents/ and .cleo/agents/ for unregistered agents...");
@@ -65742,7 +65893,7 @@ __export(doctor_exports, {
 });
 import { mkdirSync as mkdirSync4, writeFileSync as writeFileSync5 } from "node:fs";
 import { join as join25 } from "node:path";
-import { getProjectRoot as getProjectRoot55, pushWarning as pushWarning5 } from "@cleocode/core";
+import { getProjectRoot as getProjectRoot56, pushWarning as pushWarning5 } from "@cleocode/core";
 import { renderInvariantAuditLines } from "@cleocode/core/doctor/invariant-audit-render.js";
 import {
   quarantineRogueCleoDir,
@@ -65858,6 +66009,7 @@ var init_doctor = __esm({
     init_subcommand_guard();
     init_progress();
     init_renderers();
+    init_doctor_ac_bindings();
     init_doctor_acceptance_drift();
     init_doctor_credentials();
     init_doctor_db_substrate();
@@ -65925,6 +66077,8 @@ var init_doctor = __esm({
         "split-brain": doctorSplitBrainCommand,
         // T12157 — the two acceptance stores (json column vs text+child rows) must agree
         "acceptance-drift": doctorAcceptanceDriftCommand,
+        // T12790 — evidence bindings whose AC row is gone (no FK): report + --fix (audited)
+        "ac-bindings": doctorAcBindingsCommand,
         // T12158 — tables nexus resolves by bare name must actually live where it assumes
         "nexus-residency": doctorNexusResidencyCommand,
         // T12113 (gh#1222) — evidence-tool semaphore holders + orphan reaping
@@ -66143,7 +66297,7 @@ var init_doctor = __esm({
             const { join: pathJoin } = await import("node:path");
             const { existsSync: existsSync22 } = await import("node:fs");
             const { detectAndHealCoreWorktreeLeak } = await import("@cleocode/worktree");
-            const projectRoot = getProjectRoot55();
+            const projectRoot = getProjectRoot56();
             let gitRoot = projectRoot;
             try {
               gitRoot = execFile2("git", ["rev-parse", "--show-toplevel"], {
@@ -66195,7 +66349,7 @@ var init_doctor = __esm({
           }
           if (args.brain) {
             const { computeBrainHealthDashboard } = await import("@cleocode/core/memory/brain-health-dashboard.js");
-            const projectRoot = getProjectRoot55();
+            const projectRoot = getProjectRoot56();
             const dashboard = await computeBrainHealthDashboard(projectRoot);
             cliOutput(dashboard, { command: "doctor", operation: "doctor.brain" });
             if (dashboard.hasP0Failure) {
@@ -66204,7 +66358,7 @@ var init_doctor = __esm({
             return;
           }
           if (args["scan-test-fixtures-in-prod"]) {
-            const projectRoot = getProjectRoot55();
+            const projectRoot = getProjectRoot56();
             const matches = await scanTestFixturesInProd(projectRoot);
             const dryRun = args["dry-run"] !== false && args.quarantine !== true;
             const quarantined = !dryRun && matches.length > 0 ? await quarantineTestFixtures(projectRoot, matches) : void 0;
@@ -66292,7 +66446,7 @@ var init_doctor = __esm({
             progress.complete("Comprehensive diagnostics complete");
           } else if (args["scan-rogue-cleo-dirs"]) {
             progress.step(0, "Scanning for rogue .cleo/ directories");
-            const projectRoot = getProjectRoot55();
+            const projectRoot = getProjectRoot56();
             const reports = scanRogueCleoDirs(projectRoot);
             progress.complete(
               `Found ${reports.length} rogue .cleo/ director${reports.length === 1 ? "y" : "ies"}`
@@ -66301,7 +66455,7 @@ var init_doctor = __esm({
           } else if (args["quarantine-rogue-cleo-dirs"]) {
             const isDryRun = args["dry-run"] === true;
             progress.step(0, `${isDryRun ? "[DRY RUN] " : ""}Scanning for rogue .cleo/ directories`);
-            const projectRoot = getProjectRoot55();
+            const projectRoot = getProjectRoot56();
             const reports = scanRogueCleoDirs(projectRoot);
             if (reports.length === 0) {
               progress.complete("No rogue .cleo/ directories found \u2014 nothing to quarantine");
@@ -66355,7 +66509,7 @@ var init_doctor = __esm({
             const { detectAndRemoveLegacyGlobalFiles, detectAndRemoveStrayProjectNexus } = await import("@cleocode/core/store/cleanup-legacy.js");
             const { getCleoHome: getCleoHome8 } = await import("@cleocode/core");
             const cleoHome = getCleoHome8();
-            const projectRoot = getProjectRoot55();
+            const projectRoot = getProjectRoot56();
             const legacyResult = detectAndRemoveLegacyGlobalFiles(cleoHome);
             const strayResult = detectAndRemoveStrayProjectNexus(projectRoot);
             const isDryRun = args["dry-run"] === true;
@@ -66388,7 +66542,7 @@ var init_doctor = __esm({
           } else if (args["audit-worktree-orphans"]) {
             progress.step(0, "Comprehensive worktree anomaly audit (T9808 / council D009)");
             const { auditWorktreeOrphansComprehensive, scanWorktreeOrphansBudgeted } = await import("@cleocode/core/doctor/worktree-orphans.js");
-            const projectRoot = getProjectRoot55();
+            const projectRoot = getProjectRoot56();
             const timeoutSecs = args["timeout"] !== void 0 ? Number.parseInt(String(args["timeout"]), 10) : 30;
             const timeoutMs = Number.isFinite(timeoutSecs) && timeoutSecs > 0 ? timeoutSecs * 1e3 : 3e4;
             const maxEntriesPerLevel = args["max-entries-per-level"] !== void 0 ? Number.parseInt(String(args["max-entries-per-level"]), 10) : 500;
@@ -66445,7 +66599,7 @@ var init_doctor = __esm({
               `${isDryRun ? "[DRY RUN] " : ""}Scanning + pruning worktree-orphan .cleo/ directories`
             );
             const { pruneWorktreeOrphans, scanWorktreeOrphansBudgeted } = await import("@cleocode/core/doctor/worktree-orphans.js");
-            const projectRoot = getProjectRoot55();
+            const projectRoot = getProjectRoot56();
             const timeoutSecs = args["timeout"] !== void 0 ? Number.parseInt(String(args["timeout"]), 10) : 30;
             const timeoutMs = Number.isFinite(timeoutSecs) && timeoutSecs > 0 ? timeoutSecs * 1e3 : 3e4;
             const maxEntriesPerLevel = args["max-entries-per-level"] !== void 0 ? Number.parseInt(String(args["max-entries-per-level"]), 10) : 500;
@@ -66524,7 +66678,7 @@ var init_doctor = __esm({
               `${isDryRun ? "[DRY RUN] " : ""}Migrating .cleo/worktree-include \u2192 .worktreeinclude`
             );
             const { migrateWorktreeIncludeFile } = await import("@cleocode/core");
-            const projectRoot = getProjectRoot55();
+            const projectRoot = getProjectRoot56();
             const result = await migrateWorktreeIncludeFile(projectRoot, { dryRun: isDryRun });
             progress.complete(`Migration ${result.action}`);
             cliOutput(result, { command: "doctor", operation: "doctor.migrate-worktree-include" });
@@ -66543,7 +66697,7 @@ var init_doctor = __esm({
             const stepLabel = isFocusedAlias ? "Auditing Saga hierarchy for ADR-073 invariants" : "Walking central INVARIANTS_REGISTRY";
             progress.step(0, stepLabel);
             const { auditInvariantRegistry } = await import("@cleocode/core/doctor/invariant-audit.js");
-            const projectRoot = getProjectRoot55();
+            const projectRoot = getProjectRoot56();
             const result = await auditInvariantRegistry(projectRoot, { adrFilter });
             const operation = isFocusedAlias ? "doctor.audit-sagas" : "doctor.audit-invariants";
             const summary = `Invariant audit complete \u2014 ${result.totalCount} entries walked, ${result.errorCount} error / ${result.warningCount} warning / ${result.infoCount} info violation(s), ${result.notApplicableCount} not-applicable, ${result.documentedCount} documented`;
@@ -66565,7 +66719,7 @@ var init_doctor = __esm({
               { command: "doctor", operation: "admin.health" }
             );
             try {
-              const projectRoot = getProjectRoot55();
+              const projectRoot = getProjectRoot56();
               const conflicts = readMigrationConflicts(projectRoot);
               if (conflicts.length > 0) {
                 progress.complete(
@@ -66596,7 +66750,7 @@ var init_doctor = __esm({
               progress.complete("Health check complete");
             }
             try {
-              const projectRoot = getProjectRoot55();
+              const projectRoot = getProjectRoot56();
               const { auditSagaHierarchy } = await import("@cleocode/core/doctor/saga-audit.js");
               const sagaAudit = await auditSagaHierarchy(projectRoot);
               if (sagaAudit.sagas.length === 0) {
@@ -66715,8 +66869,8 @@ var init_done = __esm({
           process.exitCode = 2;
           return;
         }
-        const { getProjectRoot: getProjectRoot73 } = await import("@cleocode/core/paths.js");
-        const options = { projectRoot: getProjectRoot73(), ...parsed.options };
+        const { getProjectRoot: getProjectRoot74 } = await import("@cleocode/core/paths.js");
+        const options = { projectRoot: getProjectRoot74(), ...parsed.options };
         const requested = [
           ...new Set([args.taskId, ...args._ ?? []].map(String))
         ];
@@ -68076,7 +68230,7 @@ __export(gateway_exports, {
   gatewayOpenapiSubCommand: () => gatewayOpenapiSubCommand
 });
 import { resolve as resolve8 } from "node:path";
-import { generateOpenApi, getProjectRoot as getProjectRoot56 } from "@cleocode/core";
+import { generateOpenApi, getProjectRoot as getProjectRoot57 } from "@cleocode/core";
 var gatewayOpenapiSubCommand, gatewayCommand;
 var init_gateway = __esm({
   "packages/cleo/src/cli/commands/gateway.ts"() {
@@ -68108,7 +68262,7 @@ var init_gateway = __esm({
         const pathCount = Object.keys(doc.paths).length;
         if (typeof args.out === "string" && args.out.length > 0) {
           const { writeFileSync: writeFileSync8 } = await import("node:fs");
-          const target = resolve8(getProjectRoot56(), args.out);
+          const target = resolve8(getProjectRoot57(), args.out);
           writeFileSync8(target, json2, "utf8");
           cliOutput(
             { out: target, pathCount, version: doc.info.version, openapi: doc.openapi },
@@ -68569,7 +68723,7 @@ var go_exports = {};
 __export(go_exports, {
   goCommand: () => goCommand
 });
-import { getProjectRoot as getProjectRoot57, go } from "@cleocode/core";
+import { getProjectRoot as getProjectRoot58, go } from "@cleocode/core";
 var goCommand;
 var init_go = __esm({
   "packages/cleo/src/cli/commands/go.ts"() {
@@ -68595,7 +68749,7 @@ var init_go = __esm({
         }
       },
       async run({ args }) {
-        const projectRoot = getProjectRoot57();
+        const projectRoot = getProjectRoot58();
         const { getCurrentSessionId, resolveBoundSessionId } = await import("@cleocode/core/internal");
         let sessionId = getCurrentSessionId(projectRoot) ?? void 0;
         if (sessionId === void 0) {
@@ -68623,7 +68777,7 @@ var goal_exports = {};
 __export(goal_exports, {
   goalCommand: () => goalCommand
 });
-import { getProjectRoot as getProjectRoot58, goal } from "@cleocode/core";
+import { getProjectRoot as getProjectRoot59, goal } from "@cleocode/core";
 function resolveGoalKind(task) {
   if (typeof task === "string" && task.length > 0) {
     if (!isValidGoalTargetTaskId(task)) {
@@ -68670,7 +68824,7 @@ var init_goal2 = __esm({
         }
         const record = await goal.createGoal(
           { goalKind: kindResult.kind, intent, turnBudget: resolveTurnBudget(args.turns) },
-          getProjectRoot58()
+          getProjectRoot59()
         );
         cliOutput(record, { command: "goal set", operation: "goal.set" });
       }
@@ -68681,7 +68835,7 @@ var init_goal2 = __esm({
         description: "Show the current agent's active goal (per-agent scoped)."
       },
       async run() {
-        const record = await goal.getActiveGoal(getProjectRoot58());
+        const record = await goal.getActiveGoal(getProjectRoot59());
         cliOutput(record ?? { active: null }, { command: "goal status", operation: "goal.status" });
       }
     });
@@ -68703,7 +68857,7 @@ var init_goal2 = __esm({
           });
           return;
         }
-        const cwd = getProjectRoot58();
+        const cwd = getProjectRoot59();
         const parent = await goal.getActiveGoal(cwd);
         if (!parent) {
           cliError(
@@ -68751,7 +68905,7 @@ var init_goal2 = __esm({
           });
           return;
         }
-        const cwd = getProjectRoot58();
+        const cwd = getProjectRoot59();
         const result = await goal.advanceGoalWithPersist(goalId, { cwd });
         if (!result) {
           cliError(`Goal '${goalId}' not found.`, 4 /* NOT_FOUND */, { name: "E_NOT_FOUND" });
@@ -68776,7 +68930,7 @@ var init_goal2 = __esm({
           });
           return;
         }
-        const cwd = getProjectRoot58();
+        const cwd = getProjectRoot59();
         const active = await goal.getActiveGoal(cwd);
         if (!active) {
           cliError(
@@ -69823,7 +69977,7 @@ var hygiene_exports = {};
 __export(hygiene_exports, {
   hygieneCommand: () => hygieneCommand
 });
-import { getProjectRoot as getProjectRoot59 } from "@cleocode/core";
+import { getProjectRoot as getProjectRoot60 } from "@cleocode/core";
 import { runSpawnReadinessHygieneCli } from "@cleocode/core/hygiene/validate-spawn-readiness.js";
 var hygieneCommand;
 var init_hygiene = __esm({
@@ -69852,7 +70006,7 @@ var init_hygiene = __esm({
             }
           },
           async run({ args }) {
-            const projectRoot = args["project-root"] || getProjectRoot59() || process.cwd();
+            const projectRoot = args["project-root"] || getProjectRoot60() || process.cwd();
             const worktreePath = args["worktree-path"];
             await runSpawnReadinessHygieneCli(projectRoot, worktreePath);
           }
@@ -71195,7 +71349,7 @@ var llm_cost_exports = {};
 __export(llm_cost_exports, {
   costCommand: () => costCommand
 });
-import { getProjectRoot as getProjectRoot60 } from "@cleocode/core/internal";
+import { getProjectRoot as getProjectRoot61 } from "@cleocode/core/internal";
 import { computeCost } from "@cleocode/core/llm/usage-pricing";
 function resolveSessionId(raw) {
   if (raw === "current") {
@@ -71268,7 +71422,7 @@ var init_llm_cost = __esm({
           process.exit(6);
         }
         const sessionId = resolveSessionId(rawSessionId);
-        const projectRoot = getProjectRoot60(process.cwd());
+        const projectRoot = getProjectRoot61(process.cwd());
         let breakdown;
         try {
           breakdown = await loadSessionCostBreakdown(projectRoot, sessionId);
@@ -72657,7 +72811,7 @@ var memory_exports = {};
 __export(memory_exports, {
   memoryCommand: () => memoryCommand
 });
-import { getProjectRoot as getProjectRoot61 } from "@cleocode/core";
+import { getProjectRoot as getProjectRoot62 } from "@cleocode/core";
 import {
   getBrainDb as getBrainDb2,
   getDreamStatus,
@@ -73615,7 +73769,7 @@ var init_memory3 = __esm({
       },
       args: {},
       async run() {
-        const root = getProjectRoot61();
+        const root = getProjectRoot62();
         try {
           const result = await runConsolidation(root);
           cliOutput(result, { command: "memory-consolidate", operation: "memory.consolidate" });
@@ -73639,7 +73793,7 @@ var init_memory3 = __esm({
         }
       },
       async run({ args }) {
-        const root = getProjectRoot61();
+        const root = getProjectRoot62();
         if (args.status) {
           try {
             const status = await getDreamStatus(root);
@@ -73676,7 +73830,7 @@ var init_memory3 = __esm({
         }
       },
       async run({ args }) {
-        const root = getProjectRoot61();
+        const root = getProjectRoot62();
         try {
           const { runObserver, runReflector } = await import("@cleocode/core/memory");
           const observerResult = await runObserver(root, args.session, {
@@ -73716,7 +73870,7 @@ var init_memory3 = __esm({
         }
       },
       async run({ args }) {
-        const root = getProjectRoot61();
+        const root = getProjectRoot62();
         await getBrainDb2(root);
         const { getBrainNativeDb: getBrainNativeDb3 } = await import("@cleocode/core/internal");
         const nativeDb = getBrainNativeDb3();
@@ -73754,7 +73908,7 @@ var init_memory3 = __esm({
       },
       async run({ args }) {
         const core2 = await import("@cleocode/core/internal");
-        const nexusDb = await core2.getNexusDb(getProjectRoot61());
+        const nexusDb = await core2.getNexusDb(getProjectRoot62());
         const result = args.restore ? await core2.restorePrunedTraits(
           nexusDb,
           String(args.restore),
@@ -73784,7 +73938,7 @@ var init_memory3 = __esm({
           return;
         }
         const core2 = await import("@cleocode/core/internal");
-        const nexusDb = await core2.getNexusDb(getProjectRoot61());
+        const nexusDb = await core2.getNexusDb(getProjectRoot62());
         const previous = await core2.setUserProfileTraitScope(nexusDb, String(args.key), scope);
         if (previous === null) {
           cliError(`No user-profile trait "${args.key}"`, "E_NOT_FOUND", { name: "E_NOT_FOUND" });
@@ -73808,7 +73962,7 @@ var init_memory3 = __esm({
         }
       },
       async run({ args }) {
-        const root = getProjectRoot61();
+        const root = getProjectRoot62();
         try {
           await getBrainDb2(root);
           const { totalDuplicateRows, groups } = await scanDuplicateEntries();
@@ -73854,7 +74008,7 @@ var init_memory3 = __esm({
       async run({ args }) {
         const sourceDir = args.from;
         const isDryRun = !!args["dry-run"];
-        const projectRoot = getProjectRoot61();
+        const projectRoot = getProjectRoot62();
         try {
           const result = await importMemoryFiles({
             sourceDir,
@@ -74005,7 +74159,7 @@ var init_memory3 = __esm({
       },
       args: {},
       async run() {
-        const root = getProjectRoot61();
+        const root = getProjectRoot62();
         try {
           await getBrainDb2(root);
           const result = await getTierStats(root);
@@ -74048,7 +74202,7 @@ var init_memory3 = __esm({
         }
       },
       async run({ args }) {
-        const root = getProjectRoot61();
+        const root = getProjectRoot62();
         const targetTier = args.to;
         const reason = args.reason;
         const validTiers = ["medium", "long"];
@@ -74114,7 +74268,7 @@ var init_memory3 = __esm({
         }
       },
       async run({ args }) {
-        const root = getProjectRoot61();
+        const root = getProjectRoot62();
         const targetTier = args.to;
         const reason = args.reason;
         const validTiers = ["short", "medium"];
@@ -74587,7 +74741,7 @@ var migrate_claude_mem_exports = {};
 __export(migrate_claude_mem_exports, {
   migrateClaudeMemCommand: () => migrateClaudeMemCommand
 });
-import { getProjectRoot as getProjectRoot62, migrateClaudeMem } from "@cleocode/core/internal";
+import { getProjectRoot as getProjectRoot63, migrateClaudeMem } from "@cleocode/core/internal";
 import { ingestLooseAgentOutputs, ingestRcasdDirectories } from "@cleocode/core/memory";
 import { getDb as getDb2 } from "@cleocode/core/store/sqlite";
 var storageCommand, claudeMemCommand, manifestIngestCommand, migrateClaudeMemCommand;
@@ -74650,7 +74804,7 @@ var init_migrate_claude_mem = __esm({
         }
       },
       async run({ args }) {
-        const root = getProjectRoot62();
+        const root = getProjectRoot63();
         try {
           const result = await migrateClaudeMem(root, {
             sourcePath: args.source,
@@ -74699,7 +74853,7 @@ var init_migrate_claude_mem = __esm({
         }
       },
       async run({ args }) {
-        const projectRoot = getProjectRoot62();
+        const projectRoot = getProjectRoot63();
         try {
           const db = await getDb2(projectRoot);
           const rcasdFlag = Boolean(args.rcasd);
@@ -74817,7 +74971,7 @@ __export(nexus_exports, {
 import { statSync as statSync2 } from "node:fs";
 import { appendFile as appendFile2, mkdir as mkdir5 } from "node:fs/promises";
 import path4 from "node:path";
-import { getProjectRoot as getProjectRoot63 } from "@cleocode/core";
+import { getProjectRoot as getProjectRoot64 } from "@cleocode/core";
 import { getSymbolImpact } from "@cleocode/core/nexus";
 import { runNexusAnalysis } from "@cleocode/core/nexus/analyze-orchestrator.js";
 import {
@@ -74988,7 +75142,7 @@ var init_nexus3 = __esm({
       async run({ args }) {
         applyJsonFlag2(args.json);
         const projectIdOverride = args["project-id"];
-        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot63();
+        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot64();
         const startTime = Date.now();
         if (args.path) {
           let isDir = false;
@@ -75048,7 +75202,7 @@ The code-intelligence graph is project-scoped (ADR-090 \xB7 T11648), so the coun
           process.exitCode = 2 /* INVALID_INPUT */;
           return;
         }
-        const currentRoot = getProjectRoot63();
+        const currentRoot = getProjectRoot64();
         if (args.path && path4.resolve(repoPath) !== path4.resolve(currentRoot)) {
           cliError(
             `nexus status cannot report on '${repoPath}' from this project.
@@ -75602,7 +75756,7 @@ The code-intelligence graph is project-scoped (ADR-090 \xB7 T11648): one store p
         applyJsonFlag2(args.json);
         const startTime = Date.now();
         const projectIdOverride = args["project-id"];
-        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot63();
+        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot64();
         const projectId = projectIdOverride ?? Buffer.from(repoPath).toString("base64url").slice(0, 32);
         const response = await dispatchRaw("query", "nexus", "clusters", { projectId, repoPath });
         const durationMs = Date.now() - startTime;
@@ -75646,7 +75800,7 @@ The code-intelligence graph is project-scoped (ADR-090 \xB7 T11648): one store p
         applyJsonFlag2(args.json);
         const startTime = Date.now();
         const projectIdOverride = args["project-id"];
-        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot63();
+        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot64();
         const projectId = projectIdOverride ?? Buffer.from(repoPath).toString("base64url").slice(0, 32);
         const response = await dispatchRaw("query", "nexus", "flows", { projectId, repoPath });
         const durationMs = Date.now() - startTime;
@@ -75689,7 +75843,7 @@ The code-intelligence graph is project-scoped (ADR-090 \xB7 T11648): one store p
         void appendDeprecationTelemetry("nexus.context", "cleo graph context");
         const startTime = Date.now();
         const projectIdOverride = args["project-id"];
-        const repoPath = getProjectRoot63();
+        const repoPath = getProjectRoot64();
         const projectId = projectIdOverride ?? Buffer.from(repoPath).toString("base64url").slice(0, 32);
         const limit = parseInt(args.limit, 10);
         const symbolName = args.symbol;
@@ -75752,7 +75906,7 @@ The code-intelligence graph is project-scoped (ADR-090 \xB7 T11648): one store p
         const startTime = Date.now();
         const whyFlag = !!args.why;
         const projectIdOverride = args["project-id"];
-        const repoPath = getProjectRoot63();
+        const repoPath = getProjectRoot64();
         const projectId = projectIdOverride ?? Buffer.from(repoPath).toString("base64url").slice(0, 32);
         const maxDepth = Math.min(parseInt(args.depth, 10), 5);
         const symbolName = args.symbol;
@@ -75856,7 +76010,7 @@ The code-intelligence graph is project-scoped (ADR-090 \xB7 T11648): one store p
         const projectIdOverride = args["project-id"];
         const full = !!args.full;
         const ctx = getFormatContext();
-        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot63();
+        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot64();
         if (args.incremental)
           humanWarn(
             "[nexus] --incremental is deprecated and has no effect: incremental is the default."
@@ -75986,7 +76140,7 @@ The code-intelligence graph is project-scoped (ADR-090 \xB7 T11648): one store p
       async run({ args }) {
         applyJsonFlag2(args.json);
         const startTime = Date.now();
-        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot63();
+        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot64();
         const name = args.name;
         const response = await dispatchRaw("mutate", "nexus", "projects.register", {
           path: repoPath,
@@ -76505,7 +76659,7 @@ The code-intelligence graph is project-scoped (ADR-090 \xB7 T11648): one store p
         applyJsonFlag2(args.json);
         const startTime = Date.now();
         const projectIdOverride = args["project-id"];
-        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot63();
+        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot64();
         const projectId = projectIdOverride ?? Buffer.from(repoPath).toString("base64url").slice(0, 32);
         const response = await dispatchRaw("mutate", "nexus", "refresh-bridge", {
           repoPath,
@@ -76611,7 +76765,7 @@ The code-intelligence graph is project-scoped (ADR-090 \xB7 T11648): one store p
       async run({ args }) {
         applyJsonFlag2(args.json);
         const startTime = Date.now();
-        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot63();
+        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot64();
         const projectIdOverride = args["project-id"];
         const beforeRef = args.before ?? "HEAD~1";
         const afterRef = args.after ?? "HEAD";
@@ -76729,7 +76883,7 @@ The code-intelligence graph is project-scoped (ADR-090 \xB7 T11648): one store p
         applyJsonFlag2(args.json);
         const startTime = Date.now();
         const projectIdOverride = args["project-id"];
-        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot63();
+        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot64();
         const projectId = projectIdOverride ?? Buffer.from(repoPath).toString("base64url").slice(0, 32);
         const response = await dispatchRaw("query", "nexus", "route-map", { projectId });
         const durationMs = Date.now() - startTime;
@@ -76785,7 +76939,7 @@ The code-intelligence graph is project-scoped (ADR-090 \xB7 T11648): one store p
         const startTime = Date.now();
         const routeSymbol = args.routeSymbol;
         const projectIdOverride = args["project-id"];
-        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot63();
+        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot64();
         const projectId = projectIdOverride ?? Buffer.from(repoPath).toString("base64url").slice(0, 32);
         const response = await dispatchRaw("query", "nexus", "shape-check", { routeSymbol, projectId });
         const durationMs = Date.now() - startTime;
@@ -77181,7 +77335,7 @@ The code-intelligence graph is project-scoped (ADR-090 \xB7 T11648): one store p
       async run({ args }) {
         applyJsonFlag2(args.json);
         const startTime = Date.now();
-        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot63();
+        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot64();
         const projectIdOverride = args["project-id"];
         const projectId = projectIdOverride ?? Buffer.from(repoPath).toString("base64url").slice(0, 32);
         const response = await dispatchRaw("mutate", "nexus", "contracts-sync", {
@@ -77291,7 +77445,7 @@ The code-intelligence graph is project-scoped (ADR-090 \xB7 T11648): one store p
       async run({ args }) {
         applyJsonFlag2(args.json);
         const startTime = Date.now();
-        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot63();
+        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot64();
         const projectId = Buffer.from(repoPath).toString("base64url").slice(0, 32);
         const response = await dispatchRaw("mutate", "nexus", "contracts-link-tasks", {
           projectId,
@@ -77375,7 +77529,7 @@ The code-intelligence graph is project-scoped (ADR-090 \xB7 T11648): one store p
         const isIncremental = !!args.incremental;
         try {
           const result = await runNexusWiki({
-            projectRoot: getProjectRoot63(),
+            projectRoot: getProjectRoot64(),
             outputDir,
             communityFilter,
             incremental: isIncremental
@@ -77725,7 +77879,7 @@ __export(orchestrate_exports, {
 });
 import { execFileSync as execFileSync5 } from "node:child_process";
 import { orchestration } from "@cleocode/core";
-import { BUILD_CONFIG as BUILD_CONFIG2, getProjectRoot as getProjectRoot64 } from "@cleocode/core/internal";
+import { BUILD_CONFIG as BUILD_CONFIG2, getProjectRoot as getProjectRoot65 } from "@cleocode/core/internal";
 function formatRollupTable(rollup) {
   const waves = "waves" in rollup ? rollup.waves : [rollup];
   const lines = [];
@@ -77868,7 +78022,7 @@ var init_orchestrate3 = __esm({
       },
       async run({ args }) {
         const rateWindowHours = args.window !== void 0 ? Number.parseFloat(String(args.window)) : void 0;
-        const metrics = await orchestration.collectOrchestrateDashboard(getProjectRoot64(), {
+        const metrics = await orchestration.collectOrchestrateDashboard(getProjectRoot65(), {
           ...rateWindowHours !== void 0 && Number.isFinite(rateWindowHours) && rateWindowHours > 0 ? { rateWindowHours } : {}
         });
         cliOutput(metrics, {
@@ -79328,7 +79482,7 @@ __export(project_exports, {
 import { resolve as resolve9 } from "node:path";
 import {
   CleoError as CleoError11,
-  getProjectRoot as getProjectRoot65,
+  getProjectRoot as getProjectRoot66,
   moveProject,
   projectLifecycle,
   renameProject,
@@ -79350,7 +79504,7 @@ function emitEngineFailure(error, operation) {
 }
 function resolveRootOrFail(operation) {
   try {
-    return getProjectRoot65();
+    return getProjectRoot66();
   } catch (err) {
     const code = err instanceof CleoError11 && typeof err.details?.["code"] === "string" ? err.details["code"] : "E_NOT_CLEO_PROJECT";
     emitEngineFailure(
@@ -80178,7 +80332,7 @@ var refresh_memory_exports = {};
 __export(refresh_memory_exports, {
   refreshMemoryCommand: () => refreshMemoryCommand
 });
-import { getProjectRoot as getProjectRoot66 } from "@cleocode/core";
+import { getProjectRoot as getProjectRoot67 } from "@cleocode/core";
 var refreshMemoryCommand;
 var init_refresh_memory = __esm({
   "packages/cleo/src/cli/commands/refresh-memory.ts"() {
@@ -80191,7 +80345,7 @@ var init_refresh_memory = __esm({
         description: "Regenerate .cleo/memory-bridge.md from brain.db"
       },
       async run() {
-        const projectDir = getProjectRoot66();
+        const projectDir = getProjectRoot67();
         const { writeMemoryBridge } = await import("@cleocode/core/internal");
         const result = await writeMemoryBridge(projectDir);
         if (result.written) {
@@ -81777,7 +81931,7 @@ import fs3 from "node:fs";
 import path5 from "node:path";
 import {
   CleoError as CleoError13,
-  getProjectRoot as getProjectRoot67,
+  getProjectRoot as getProjectRoot68,
   getTaskAccessor as getTaskAccessor3,
   parseConflictReport,
   setAtPath
@@ -81798,7 +81952,7 @@ var init_restore = __esm({
         description: "Apply manually-resolved conflicts from .cleo/restore-conflicts.md"
       },
       async run() {
-        const projectRoot = getProjectRoot67();
+        const projectRoot = getProjectRoot68();
         const reportPath = path5.join(projectRoot, CLEO_DIR_NAME3, RESTORE_CONFLICTS_MD);
         if (!fs3.existsSync(reportPath)) {
           humanLine("No pending restore conflicts. Nothing to finalize.");
@@ -82727,8 +82881,8 @@ var init_saga = __esm({
         }
       },
       async run({ args }) {
-        const { sagas: sagas2, getProjectRoot: getProjectRoot73 } = await import("@cleocode/core");
-        const projectRoot = getProjectRoot73();
+        const { sagas: sagas2, getProjectRoot: getProjectRoot74 } = await import("@cleocode/core");
+        const projectRoot = getProjectRoot74();
         const sagaId = typeof args.sagaId === "string" && args.sagaId.length > 0 ? args.sagaId : void 0;
         const result = await sagas2.sagaNext(projectRoot, { sagaId });
         cliOutput(result.success ? result.data : result, { command: "saga", operation: "saga.next" });
@@ -84559,7 +84713,7 @@ var sequence_exports = {};
 __export(sequence_exports, {
   sequenceCommand: () => sequenceCommand
 });
-import { getProjectRoot as getProjectRoot68 } from "@cleocode/core/internal";
+import { getProjectRoot as getProjectRoot69 } from "@cleocode/core/internal";
 var showCommand12, checkCommand7, repairCommand3, sequenceCommand;
 var init_sequence = __esm({
   "packages/cleo/src/cli/commands/sequence.ts"() {
@@ -84595,7 +84749,7 @@ var init_sequence = __esm({
       meta: { name: "repair", description: "Reset counter to max + 1 if behind" },
       async run() {
         const { repairSequence } = await import("@cleocode/core/internal");
-        const projectRoot = getProjectRoot68();
+        const projectRoot = getProjectRoot69();
         const repair = await repairSequence(projectRoot);
         const result = {
           repaired: repair.repaired,
@@ -85192,8 +85346,8 @@ var init_session4 = __esm({
         "audit-scope": { type: "string", description: "Audit log scope (global|local)" }
       },
       async run({ args }) {
-        const { detectSessionDrift, getProjectRoot: getProjectRoot73 } = await import("@cleocode/core");
-        const projectRoot = await getProjectRoot73();
+        const { detectSessionDrift, getProjectRoot: getProjectRoot74 } = await import("@cleocode/core");
+        const projectRoot = await getProjectRoot74();
         const scope = args["audit-scope"] === "local" ? "local" : "global";
         const report = await detectSessionDrift({ projectRoot, auditScope: scope });
         cliOutput(report, { command: "session drift", operation: "session.drift" });
@@ -87894,13 +88048,13 @@ var init_telemetry2 = __esm({
 // packages/cleo/src/cli/commands/templates/lib.ts
 import { readFileSync as readFileSync13 } from "node:fs";
 import { isAbsolute as isAbsolute3, resolve as resolve10 } from "node:path";
-import { getProjectRoot as getProjectRoot69 } from "@cleocode/core";
+import { getProjectRoot as getProjectRoot70 } from "@cleocode/core";
 import { resolveSourcePathAbsolute } from "@cleocode/core/templates/registry";
 function resolveProjectRoot6(raw) {
   if (typeof raw === "string" && raw.length > 0) {
     return isAbsolute3(raw) ? raw : resolve10(process.cwd(), raw);
   }
-  return getProjectRoot69();
+  return getProjectRoot70();
 }
 function readTemplateSource(entry) {
   const sourceAbsolute = resolveSourcePathAbsolute(entry);
@@ -88684,7 +88838,7 @@ __export(token_exports, {
   tokenCommand: () => tokenCommand
 });
 import { readFileSync as readFileSync17 } from "node:fs";
-import { getProjectRoot as getProjectRoot70, measureTokenExchange, recordTokenExchange as recordTokenExchange2 } from "@cleocode/core/internal";
+import { getProjectRoot as getProjectRoot71, measureTokenExchange, recordTokenExchange as recordTokenExchange2 } from "@cleocode/core/internal";
 function readPayload(args, textKey, fileKey) {
   const text = args[textKey];
   const file = args[fileKey];
@@ -88848,7 +89002,7 @@ var init_token = __esm({
           domain: args.domain,
           operation: args.operation
         };
-        const result = args.record ? await recordTokenExchange2(getProjectRoot70(), input2) : await measureTokenExchange(input2);
+        const result = args.record ? await recordTokenExchange2(getProjectRoot71(), input2) : await measureTokenExchange(input2);
         cliOutput(result, {
           command: "token",
           operation: args.record ? "admin.token.record" : "token.estimate"
@@ -88884,7 +89038,7 @@ __export(transcript_exports, {
 });
 import { homedir as homedir3 } from "node:os";
 import { join as join35 } from "node:path";
-import { getProjectRoot as getProjectRoot71 } from "@cleocode/core";
+import { getProjectRoot as getProjectRoot72 } from "@cleocode/core";
 import {
   parseDurationMs,
   pruneTranscripts,
@@ -88914,7 +89068,7 @@ var init_transcript = __esm({
       async run({ args }) {
         if (args.pending) {
           try {
-            const projectRoot = getProjectRoot71();
+            const projectRoot = getProjectRoot72();
             const { scanPendingTranscripts } = await import("@cleocode/core/memory/transcript-scanner.js");
             const pending = await scanPendingTranscripts(projectRoot);
             cliOutput(
@@ -89011,7 +89165,7 @@ var init_transcript = __esm({
       async run({ args }) {
         const tier = args.tier ?? "warm";
         const dryRun = args["dry-run"] ?? false;
-        const projectRoot = getProjectRoot71();
+        const projectRoot = getProjectRoot72();
         try {
           const { extractTranscript } = await import("@cleocode/core/memory/transcript-extractor.js");
           const { findSessionTranscriptPath, listAllTranscripts } = await import("@cleocode/core/memory/transcript-scanner.js");
@@ -89127,7 +89281,7 @@ var init_transcript = __esm({
         const dryRun = args["dry-run"] ?? false;
         const olderThanHours = args["older-than-hours"] ? Number.parseInt(args["older-than-hours"], 10) : 24;
         const limit = args.limit ? Number.parseInt(args.limit, 10) : void 0;
-        const projectRoot = getProjectRoot71();
+        const projectRoot = getProjectRoot72();
         try {
           const { extractTranscript } = await import("@cleocode/core/memory/transcript-extractor.js");
           const { listAllTranscripts } = await import("@cleocode/core/memory/transcript-scanner.js");
@@ -91065,9 +91219,9 @@ var init_verify = __esm({
             return;
           }
           const { recordTaskDone } = await import("@cleocode/core/tasks/done-record.js");
-          const { getProjectRoot: getProjectRoot73 } = await import("@cleocode/core/paths.js");
+          const { getProjectRoot: getProjectRoot74 } = await import("@cleocode/core/paths.js");
           const r = await recordTaskDone(args.taskId, {
-            projectRoot: getProjectRoot73(),
+            projectRoot: getProjectRoot74(),
             ...parsed.options,
             ...args.agent ? { agent: args.agent } : {}
           });
@@ -91490,9 +91644,9 @@ var init_workgraph2 = __esm({
       },
       async run({ args }) {
         const { generatePlanningDoc } = await import("@cleocode/core/workgraph");
-        const { getProjectRoot: getProjectRoot73 } = await import("@cleocode/core");
+        const { getProjectRoot: getProjectRoot74 } = await import("@cleocode/core");
         const { cliOutput: cliOutput2 } = await Promise.resolve().then(() => (init_renderers(), renderers_exports));
-        const projectRoot = getProjectRoot73();
+        const projectRoot = getProjectRoot74();
         const audience = String(args.audience) === "agent" ? "agent" : "maintainer";
         const result = await generatePlanningDoc(projectRoot, {
           sagaId: String(args.sagaId),
@@ -91509,9 +91663,9 @@ var init_workgraph2 = __esm({
       async run() {
         const { validateWorkGraphStructure } = await import("@cleocode/core/workgraph");
         const { taskList: taskList2 } = await import("@cleocode/core/internal");
-        const { getProjectRoot: getProjectRoot73 } = await import("@cleocode/core");
+        const { getProjectRoot: getProjectRoot74 } = await import("@cleocode/core");
         const { cliOutput: cliOutput2 } = await Promise.resolve().then(() => (init_renderers(), renderers_exports));
-        const projectRoot = getProjectRoot73();
+        const projectRoot = getProjectRoot74();
         const listResult = await taskList2(projectRoot, { limit: 5e3 });
         const tasks = listResult.success ? listResult.data?.tasks ?? [] : [];
         const nodes = tasks.map((t) => ({
@@ -91530,9 +91684,9 @@ var init_workgraph2 = __esm({
         description: "One-shot saga-to-saga workgraph dashboard (tracking checklist)"
       },
       async run() {
-        const { sagas: sagas2, getProjectRoot: getProjectRoot73 } = await import("@cleocode/core");
+        const { sagas: sagas2, getProjectRoot: getProjectRoot74 } = await import("@cleocode/core");
         const { cliOutput: cliOutput2 } = await Promise.resolve().then(() => (init_renderers(), renderers_exports));
-        const projectRoot = getProjectRoot73();
+        const projectRoot = getProjectRoot74();
         const listResult = await sagas2.sagaList(projectRoot);
         if (!listResult.success) {
           cliOutput2(listResult, { command: "workgraph", operation: "workgraph.status" });
@@ -91598,7 +91752,7 @@ __export(worktree_exports, {
   worktreeCommand: () => worktreeCommand
 });
 import readline4 from "node:readline";
-import { getProjectRoot as getProjectRoot72, listWorktrees as listWorktrees2 } from "@cleocode/core/internal";
+import { getProjectRoot as getProjectRoot73, listWorktrees as listWorktrees2 } from "@cleocode/core/internal";
 async function promptYesNo2(question) {
   return new Promise((resolve13) => {
     const rl = readline4.createInterface({ input: process.stdin, output: process.stdout });
@@ -91703,7 +91857,7 @@ var init_worktree3 = __esm({
         const staleDays = staleDaysRaw !== void 0 ? Number.parseInt(staleDaysRaw, 10) : void 0;
         const idleDaysRaw = typeof args["idle-days"] === "string" ? args["idle-days"] : void 0;
         const idleDays = idleDaysRaw !== void 0 ? Number.parseInt(idleDaysRaw, 10) : void 0;
-        const projectRoot = getProjectRoot72();
+        const projectRoot = getProjectRoot73();
         const listResult = await listWorktrees2({
           projectRoot,
           ...staleDays !== void 0 && !Number.isNaN(staleDays) ? { staleDays } : {}
@@ -91962,6 +92116,16 @@ function cittyErrorFix(code) {
   return `Run 'cleo <command> --help' to see required arguments.`;
 }
 
+// packages/cleo/src/cli/cleo-error-like.ts
+function asCleoErrorLike(err) {
+  if (!(err instanceof Error)) return null;
+  const candidate = err;
+  return typeof candidate.code === "number" && Number.isInteger(candidate.code) && typeof candidate.toLAFSError === "function" ? candidate : null;
+}
+function cleoErrorCodeName(typed) {
+  return typeof typed.codeName === "string" && typed.codeName.length > 0 ? typed.codeName : typed.toLAFSError().code;
+}
+
 // packages/cleo/src/cli/index.ts
 init_describe_context();
 init_field_context();
@@ -92287,6 +92451,12 @@ var COMMAND_MANIFEST = [
     description: "Canonical six-verb docs path: add, update, fetch, list, remove, publish. ",
     load: async () => (await Promise.resolve().then(() => (init_docs3(), docs_exports))).docsCommand
   },
+  {
+    exportName: "doctorAcBindingsCommand",
+    name: "ac-bindings",
+    description: "Report evidence bindings whose acceptance criterion no longer exists (dangling ",
+    load: async () => (await Promise.resolve().then(() => (init_doctor_ac_bindings(), doctor_ac_bindings_exports))).doctorAcBindingsCommand
+  },
   {
     exportName: "doctorAcceptanceDriftCommand",
     name: "acceptance-drift",
@@ -92350,7 +92520,7 @@ var COMMAND_MANIFEST = [
   {
     exportName: "doctorManifestRowsCommand",
     name: "manifest-rows",
-    description: "List manifest rows whose metadata violates the stored field contract. --repair shows the plan (writes nothing); --repair --apply moves each bad field under _malformed (nothing lost) with a receipt; --rollback <receipt> undoes it.",
+    description: "List manifest rows whose metadata violates the stored field contract, and (read-only) rows with an invalid id, linked task id or file reference. --repair shows the plan (writes nothing); --repair --apply moves each bad field under _malformed (nothing lost) with a receipt; --rollback <receipt> undoes it.",
     load: async () => (await Promise.resolve().then(() => (init_doctor_manifest_rows(), doctor_manifest_rows_exports))).doctorManifestRowsCommand
   },
   {
@@ -93548,11 +93718,6 @@ Valid modes: ${validModes.join(", ")}
   const dispatchArgv = describeFlag && !isHelpOrVersion ? [...normalizedArgv, "__cleo_describe__"] : normalizedArgv;
   await runMainWithLafsEnvelope(main, dispatchArgv, customShowUsage);
 }
-function asCleoErrorLike(err) {
-  if (!(err instanceof Error) || err.name !== "CleoError") return null;
-  const candidate = err;
-  return typeof candidate.code === "number" && typeof candidate.toLAFSError === "function" ? candidate : null;
-}
 function asCittyCliError(value) {
   if (!(value instanceof Error)) return null;
   if (value.name !== "CLIError") return null;
@@ -93632,7 +93797,7 @@ async function runMainWithLafsEnvelope(cmd, rawArgs, showUsage2) {
       const typed = asCleoErrorLike(err);
       if (typed) {
         cliError2(typed.message, typed.code, {
-          name: typed.toLAFSError().code,
+          name: cleoErrorCodeName(typed),
           fix: typed.fix,
           alternatives: typed.alternatives,
           details: typed.details
@@ -93658,7 +93823,7 @@ async function runStartupMaintenance() {
     detectAndRemoveStrayProjectNexus,
     getGlobalSalt,
     getLogger: getLogger22,
-    getProjectRoot: getProjectRoot73,
+    getProjectRoot: getProjectRoot74,
     isCleanupMarkerSet,
     isMissingProjectError,
     migrateSignaldockToConduit,
@@ -93668,7 +93833,7 @@ async function runStartupMaintenance() {
   } = await import("@cleocode/core/internal");
   let projectRootForCleanup = "";
   try {
-    projectRootForCleanup = getProjectRoot73();
+    projectRootForCleanup = getProjectRoot74();
   } catch {
   }
   if (!isCleanupMarkerSet(CLI_VERSION, projectRootForCleanup)) {
@@ -93688,7 +93853,7 @@ async function runStartupMaintenance() {
   const isInitInvocation = process.argv.slice(2).some((a) => a === "init");
   if (!isInitInvocation) {
     try {
-      const _projectRootForMigration = getProjectRoot73();
+      const _projectRootForMigration = getProjectRoot74();
       if (needsSignaldockToConduitMigration(_projectRootForMigration)) {
         const migrationResult = await migrateSignaldockToConduit(_projectRootForMigration);
         if (migrationResult.status === "failed") {