canon-ai 3.3.1 → 3.5.0

package/CHANGELOG.md

@@ -4,6 +4,45 @@
 
 ## [Unreleased]
 
+## [3.5.0] — 2026-09-29
+
+### Added
+
+- **A reviewer that can't reach a verdict now stops the run for a human.** If a code-review lens returns nothing usable twice, the foreman sets `code_review` to `blocked` instead of being pushed to invent a verdict; recover with `canon task reset-code-review` for each bundle member, then `canon run`.
+- **Plans include a short feasibility check.** Pipeline, reroute, and `/canon-spec` XS plans now confirm the code they rely on exists, trace the real call path and callers, and name the input that makes each new test fail without the fix.
+- **`CLAUDE_MODEL_LIGHT` and `CLAUDE_MODEL_STRONG` override each tier's model.** Existing per-phase pins and `CLAUDE_MODEL` still work and take precedence in that order.
+
+### Changed
+
+- **Claude defaults are re-baselined for the 5.5 generation.** Spec, plan, and code review run Sonnet `medium` for XS/S, Opus `medium` for M/L, and Opus `high` for XL/delicate; QA runs Sonnet `medium` at every size, and nothing runs at `xhigh`. A model pin now replaces only the model, so a Sonnet pin on M/L review or plan drops from `high` to `medium` effort.
+- **Unattended Claude phases get an explicit unattended-session contract.** Like Codex's headless preamble, it says no one will answer questions, finishing means the artifact is written and the phase command has run, and the phase must not start other phases or reviewers.
+- **The code-review foreman accepts clean lens results and bounds delegation.** A lens's empty result is now valid rather than "a bug in the lens," and the foreman spawns only its two lenses plus one re-spawn.
+- **`/canon-spec-review` no longer requires a task ID.** With no argument it reviews the task under discussion, or asks which one when that's ambiguous.
+
+## [3.4.0] — 2026-09-27
+
+### Added
+
+- **`code_review` catches files outside the spec's Affected Files at pre-flight instead of at `--pr`.** Previously, a helper, fixture, or rebuilt file the spec didn't list could pass `code_review`, only for `--pr`'s base-drift check to reject it. That forced a spec edit and a second `--pr`. The same scope check now runs just before `code_review`. A normal run halts before any reviewer starts, names the file, and offers two fixes: add it to Affected Files and re-run, or reroute to remove it. In a full-send run, the code-review foreman judges each out-of-scope file instead. It classes each one as an appropriate scope expansion, a spec miss, or something that shouldn't have changed, and records the outcome in `review.md`. For the first two, it also adds a `## Amendment (full-send scope)` section to the spec. That heading does not satisfy the human amendment gate on `--reroute`. `--pr`'s base-drift message now says whether the base branch advanced or the file is out of scope. It no longer labels both cases as scope violations.
+- **The anchored code-review lens checks changed code against `docs/patterns.md`.** When the project keeps that file, the lens reads it first, using its Trigger Table if it has one. It reports each violation of a written project rule as a finding that names the rule, not as a nit. The check runs every round and covers only code the diff changes.
+
+### Changed
+
+- **`code_review` re-rounds review only the fix, not the whole diff, when that's safe.** A full review still runs in these cases:
+  - Round 1.
+  - Every round of an XL or delicate task.
+  - Any round where the previous round's record is missing or unusable.
+  - The fix touches files outside the previous round's change set.
+  - The fix exceeds a size threshold.
+
+  Otherwise, cold-Codex and the cold-Claude lens review only the changes since the commit the previous round reviewed. The anchored lens keeps the full diff, spec, and handoff. No lens is skipped. `review.md` states each round's scope, base, and reason. Each cold-Codex round now writes its own `tasks/<id>/review-cold-codex-run-N.md` instead of overwriting the previous one. The cold-Claude lens also gains a standing sibling-site sweep: when a diff adds or changes a guard or invariant, it looks for other sites that need the same treatment.
+- **The handoff template's guidance on directory paths matches `docs-refs-check`.** Backticking an existing directory is fine. A directory the task deleted should be described in prose or written as a markdown link.
+
+### Fixed
+
+- **The post-implement auto-commit no longer fails when the spec's Affected Files lists a deleted or renamed file.** A path that git had already staged as deleted or renamed away made `git add` fail with "pathspec did not match". All three commit sites now drop paths that are neither tracked nor on disk before staging.
+- **`docs-refs-check` accepts backticked paths to existing directories.** It had reported them as missing files.
+
 ## [3.3.1] — 2026-09-24
 
 ### Fixed

package/README.md

@@ -86,7 +86,7 @@ The pipeline supports two tiers:
 - **Fast tier** (XS tasks): spec + plan in one Claude session, skip Codex spec review, human gate replaces it.
 - **Full tier** (S / M / L / XL / delicate tasks): every phase runs separately, Codex reviews specs before they reach the human.
 
-`delicate: true` (set in `status.json` at task creation) promotes any task to full tier and upgrades the orchestrator's model and effort across every phase. Use it for sensitive surfaces — auth, payments, persistent storage, anything where a regression has unbounded blast radius.
+`delicate: true` (set in `status.json` at task creation) promotes any task to full tier and upgrades the model and effort for spec, plan, and code review, plus Codex spec review and implementation; QA and the cold-Codex review lens stay on their regular cells. Use it for sensitive surfaces — auth, payments, persistent storage, anything where a regression has unbounded blast radius.
 
 A single command runs a task end-to-end:
 

package/dist/cli/index.js

@@ -555,20 +555,6 @@ import path4 from "path";
 import { fileURLToPath } from "url";
 var __filename = fileURLToPath(import.meta.url);
 var __dirname = path4.dirname(__filename);
-function parseMaxReviewLoops(raw) {
-  if (!raw) return null;
-  const trimmed = raw.trim();
-  if (!/^-?\d+$/.test(trimmed)) {
-    warn(`Invalid MAX_REVIEW_LOOPS value "${raw}"; using the size-aware default.`);
-    return null;
-  }
-  const parsed = Number(trimmed);
-  if (!Number.isInteger(parsed) || parsed < 0) {
-    warn(`Invalid MAX_REVIEW_LOOPS value "${raw}"; using the size-aware default.`);
-    return null;
-  }
-  return parsed;
-}
 function resolveRepoRoot() {
   try {
     const result = spawnSync("git", ["rev-parse", "--git-common-dir"], { encoding: "utf8" });
@@ -601,15 +587,6 @@ function resolveProjectName() {
 }
 var config = {
   projectName: resolveProjectName(),
-  claudeBudget: process.env.CLAUDE_BUDGET ?? null,
-  claudeModelSpec: process.env.CLAUDE_MODEL_SPEC ?? process.env.CLAUDE_MODEL ?? "opus",
-  claudeModelPlan: process.env.CLAUDE_MODEL_PLAN ?? process.env.CLAUDE_MODEL ?? "sonnet",
-  claudeModelReview: process.env.CLAUDE_MODEL_REVIEW ?? process.env.CLAUDE_MODEL ?? "sonnet",
-  claudeModelReviewLarge: process.env.CLAUDE_MODEL_REVIEW_LARGE ?? process.env.CLAUDE_MODEL ?? "opus",
-  claudeModelQa: process.env.CLAUDE_MODEL_QA ?? process.env.CLAUDE_MODEL ?? "sonnet",
-  codexModelMini: process.env.CODEX_MODEL_MINI ?? process.env.CODEX_MODEL_DEFAULT ?? "gpt-6-luna",
-  codexModelFull: process.env.CODEX_MODEL_FULL ?? process.env.CODEX_MODEL_DELICATE ?? "gpt-6-sol",
-  maxReviewLoops: parseMaxReviewLoops(process.env.MAX_REVIEW_LOOPS),
   maxContextBytes: Number.parseInt(process.env.MAX_CONTEXT_BYTES ?? String(64 * 1024), 10)
 };
 
@@ -1247,7 +1224,7 @@ function checkTemplates(cwd) {
 }
 function checkCanonVersion(cwd) {
   const versionPath = join(cwd, ".canon", "version");
-  const installedVersion = "3.3.1";
+  const installedVersion = "3.5.0";
   if (!existsSync(versionPath)) {
     return { label: ".canon/version", status: "warn", detail: "missing \u2014 run `canon upgrade`" };
   }
@@ -1744,7 +1721,7 @@ function initCmd(_args) {
 }
 function writeCanonVersion(cwd) {
   const versionPath = join2(cwd, ".canon", "version");
-  const version = "3.3.1";
+  const version = "3.5.0";
   mkdirSync(dirname2(versionPath), { recursive: true });
   writeFileSync(versionPath, version + "\n");
 }
@@ -2696,16 +2673,17 @@ function watchCmd(args2, deps = {}) {
 
 // src/task/index.ts
 import { spawnSync as spawnSync7 } from "child_process";
-import fs13 from "fs";
+import fs14 from "fs";
 import path14 from "path";
 
 // src/orchestrator/canon-snapshot.ts
 import { spawnSync as spawnSync6 } from "child_process";
-import fs9 from "fs";
+import fs10 from "fs";
 import path10 from "path";
 
 // src/orchestrator/git.ts
 import { spawnSync as spawnSync5 } from "child_process";
+import fs9 from "fs";
 import path9 from "path";
 
 // src/orchestrator/worktree.ts
@@ -2753,7 +2731,7 @@ function isInstalledSourcePath(sourcePath) {
   return sourcePath.includes("/node_modules/") || sourcePath.includes("\\node_modules\\") || sourcePath.includes("/_npx/") || sourcePath.includes("\\_npx\\");
 }
 function resolveCanonVersion(explicit) {
-  return explicit ?? "3.3.1" ?? "dev";
+  return explicit ?? "3.5.0" ?? "dev";
 }
 function resolveOrchestratorCommit(repoRoot, upstreamCommit, runGitAt) {
   const ownToplevel = captureGitOutput(repoRoot, ["rev-parse", "--show-toplevel"], runGitAt);
@@ -2832,24 +2810,24 @@ function applyCanonSnapshot(status, canon) {
   return next;
 }
 function refreshCanonSnapshotAtPath(statusFilePath, options = {}) {
-  const status = JSON.parse(fs9.readFileSync(statusFilePath, "utf8"));
+  const status = JSON.parse(fs10.readFileSync(statusFilePath, "utf8"));
   const canon = captureCanonSnapshot(REPO_ROOT, options);
   const next = applyCanonSnapshot(status, canon);
   const serialized = `${JSON.stringify(next, null, 2)}
 `;
-  const current = fs9.readFileSync(statusFilePath, "utf8");
+  const current = fs10.readFileSync(statusFilePath, "utf8");
   if (current !== serialized) {
-    fs9.writeFileSync(statusFilePath, serialized, "utf8");
+    fs10.writeFileSync(statusFilePath, serialized, "utf8");
   }
   return canon;
 }
 
 // src/orchestrator/review-archive.ts
-import fs12 from "fs";
+import fs13 from "fs";
 import path13 from "path";
 
 // src/task/templates.ts
-import fs10 from "fs";
+import fs11 from "fs";
 import path11 from "path";
 function tasksRoot() {
   return process.env.CANON_TASKS_DIR_OVERRIDE ?? "tasks";
@@ -2862,17 +2840,17 @@ function taskTemplateOverrideRoot() {
 }
 function resolveTaskTemplateSource(basename2) {
   const override = path11.join(taskTemplateOverrideRoot(), basename2);
-  if (fs10.existsSync(override)) return override;
+  if (fs11.existsSync(override)) return override;
   const managed = path11.join(templatesRoot(), basename2);
-  return fs10.existsSync(managed) ? managed : null;
+  return fs11.existsSync(managed) ? managed : null;
 }
 function renderTaskTemplate(source, taskId, title) {
-  return fs10.readFileSync(source, "utf8").replaceAll("[TASK-ID]", taskId).replaceAll("[Title]", title);
+  return fs11.readFileSync(source, "utf8").replaceAll("[TASK-ID]", taskId).replaceAll("[Title]", title);
 }
 function scaffoldTaskArtifact(taskDir, basename2, taskId, title) {
   const source = resolveTaskTemplateSource(basename2);
   if (!source) return null;
-  fs10.writeFileSync(path11.join(taskDir, basename2), renderTaskTemplate(source, taskId, title), "utf8");
+  fs11.writeFileSync(path11.join(taskDir, basename2), renderTaskTemplate(source, taskId, title), "utf8");
   return source;
 }
 function isPristineTaskArtifact(content, basename2, taskId, title) {
@@ -2887,7 +2865,7 @@ function isPristineTaskArtifact(content, basename2, taskId, title) {
 }
 
 // src/orchestrator/validation.ts
-import fs11 from "fs";
+import fs12 from "fs";
 import path12 from "path";
 function computeLatestValidationResults(handoffContent) {
   const latest = /* @__PURE__ */ new Map();
@@ -3019,7 +2997,7 @@ function isTemplateUnfilled(content) {
 function isDoneMdTemplate(donePath) {
   let content;
   try {
-    content = fs11.readFileSync(donePath, "utf8");
+    content = fs12.readFileSync(donePath, "utf8");
   } catch {
     return true;
   }
@@ -3058,7 +3036,7 @@ function checkPhaseGate(taskId, phase, verdict, taskDirOverride) {
     const artifactPath = path12.join(taskDir, config2.artifactName);
     let content;
     try {
-      content = fs11.readFileSync(artifactPath, "utf8");
+      content = fs12.readFileSync(artifactPath, "utf8");
     } catch {
       return { ok: false, reason: `${config2.artifactName} is missing for phase '${phase}'` };
     }
@@ -3070,7 +3048,7 @@ function checkPhaseGate(taskId, phase, verdict, taskDirOverride) {
     if (phase === "spec_review" || phase === "plan") {
       let statusRaw;
       try {
-        statusRaw = fs11.readFileSync(path12.join(taskDir, "status.json"), "utf8");
+        statusRaw = fs12.readFileSync(path12.join(taskDir, "status.json"), "utf8");
       } catch {
         return { ok: false, reason: `cannot determine reroute state for '${phase}': status.json in ${taskDir} is missing or unreadable` };
       }
@@ -3108,7 +3086,7 @@ function checkPhaseGate(taskId, phase, verdict, taskDirOverride) {
     const handoffPath = path12.join(taskDir, "handoff.md");
     let handoffContent;
     try {
-      handoffContent = fs11.readFileSync(handoffPath, "utf8");
+      handoffContent = fs12.readFileSync(handoffPath, "utf8");
     } catch {
       return { ok: false, reason: `closing human_review requires a handoff.md \u2014 none found in ${taskDir}` };
     }
@@ -3117,7 +3095,7 @@ function checkPhaseGate(taskId, phase, verdict, taskDirOverride) {
     const donePath = path12.join(taskDir, "done.md");
     let doneContent = "";
     try {
-      doneContent = fs11.readFileSync(donePath, "utf8");
+      doneContent = fs12.readFileSync(donePath, "utf8");
     } catch {
     }
     if (hasHumanPendingWaiver(doneContent)) return { ok: true };
@@ -3135,7 +3113,7 @@ function parseHandoffChangesRows(taskId) {
   const handoffPath = path12.join(taskDirFor(taskId), "handoff.md");
   let content;
   try {
-    content = fs11.readFileSync(handoffPath, "utf8");
+    content = fs12.readFileSync(handoffPath, "utf8");
   } catch {
     return { files: [], malformed: [] };
   }
@@ -3439,7 +3417,7 @@ var REVIEW_ARCHIVE_PREFIX = "review-prior-";
 var REVIEW_ARCHIVE_RE = new RegExp(`^${REVIEW_ARCHIVE_PREFIX}(\\d+)\\.md$`);
 function newestReviewArchiveNumber(taskDir) {
   let newest = 0;
-  for (const name of fs12.readdirSync(taskDir)) {
+  for (const name of fs13.readdirSync(taskDir)) {
     const match = REVIEW_ARCHIVE_RE.exec(name);
     if (match) newest = Math.max(newest, Number(match[1]));
   }
@@ -3447,21 +3425,21 @@ function newestReviewArchiveNumber(taskDir) {
 }
 function archivePriorReview(taskDir, options = {}) {
   const reviewPath = path13.join(taskDir, "review.md");
-  if (!fs12.existsSync(reviewPath)) return null;
+  if (!fs13.existsSync(reviewPath)) return null;
   if (options.skipUnfilledTemplate) {
-    const content = fs12.readFileSync(reviewPath, "utf8");
+    const content = fs13.readFileSync(reviewPath, "utf8");
     if (isTemplateUnfilled(content)) return null;
     if (options.scaffold && isPristineTaskArtifact(content, "review.md", options.scaffold.taskId, options.scaffold.title)) {
       return null;
     }
   }
   const archiveName = `${REVIEW_ARCHIVE_PREFIX}${newestReviewArchiveNumber(taskDir) + 1}.md`;
-  fs12.renameSync(reviewPath, path13.join(taskDir, archiveName));
+  fs13.renameSync(reviewPath, path13.join(taskDir, archiveName));
   return archiveName;
 }
 function rescaffoldReview(taskDir, identity) {
   try {
-    if (fs12.existsSync(path13.join(taskDir, "review.md"))) return { outcome: "exists" };
+    if (fs13.existsSync(path13.join(taskDir, "review.md"))) return { outcome: "exists" };
     const source = scaffoldTaskArtifact(taskDir, "review.md", identity.taskId, identity.title);
     return source ? { outcome: "written", source } : { outcome: "no-template" };
   } catch (error) {
@@ -3534,7 +3512,7 @@ function taskRootForGate(cwd) {
 }
 function readJsonFile(filePath) {
   try {
-    return JSON.parse(fs13.readFileSync(filePath, "utf8"));
+    return JSON.parse(fs14.readFileSync(filePath, "utf8"));
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error);
     throw new Error(`Error: failed to read ${filePath}: ${message}`);
@@ -3542,9 +3520,9 @@ function readJsonFile(filePath) {
 }
 function writeJsonAtomic(filePath, data) {
   const tmpFile = `${filePath}.tmp`;
-  fs13.writeFileSync(tmpFile, `${JSON.stringify(data, null, 2)}
+  fs14.writeFileSync(tmpFile, `${JSON.stringify(data, null, 2)}
 `, "utf8");
-  fs13.renameSync(tmpFile, filePath);
+  fs14.renameSync(tmpFile, filePath);
 }
 function writeStatusAtomic(filePath, status) {
   status.status = deriveTopLevelStatus(status);
@@ -3585,15 +3563,15 @@ function currentBranchOrEmpty() {
 }
 function listTemplateFiles() {
   const root = templatesRoot();
-  if (!fs13.existsSync(root)) {
+  if (!fs14.existsSync(root)) {
     throw new Error(`Error: templates directory not found at ${root}`);
   }
-  return fs13.readdirSync(root).filter((name) => name.endsWith(".md") || name.endsWith(".json")).sort();
+  return fs14.readdirSync(root).filter((name) => name.endsWith(".md") || name.endsWith(".json")).sort();
 }
 function printCreatedTask(taskDir, baseBranch) {
   console.log(`Created task: ${taskDir}`);
   console.log("Files:");
-  for (const file of fs13.readdirSync(taskDir).sort()) {
+  for (const file of fs14.readdirSync(taskDir).sort()) {
     console.log(file);
   }
   console.log("");
@@ -3631,16 +3609,16 @@ function taskNew(args2) {
     throw new Error("Error: title must be single-line (no embedded newlines).");
   }
   const taskDir = taskDirFromRoot(id);
-  if (fs13.existsSync(taskDir)) {
+  if (fs14.existsSync(taskDir)) {
     throw new Error(`Error: Task directory ${taskDir} already exists.`);
   }
   if (!baseBranch) {
     baseBranch = currentBranchOrEmpty() || "main";
   }
-  fs13.mkdirSync(taskDir, { recursive: true });
+  fs14.mkdirSync(taskDir, { recursive: true });
   for (const basename2 of listTemplateFiles()) {
     const source = resolveTaskTemplateSource(basename2) ?? path14.join(templatesRoot(), basename2);
-    fs13.writeFileSync(path14.join(taskDir, basename2), renderTaskTemplate(source, id, title), "utf8");
+    fs14.writeFileSync(path14.join(taskDir, basename2), renderTaskTemplate(source, id, title), "utf8");
   }
   const statusPath = path14.join(taskDir, "status.json");
   const status = readJsonFile(statusPath);
@@ -3663,13 +3641,13 @@ function derivePhase(status) {
 }
 function taskList() {
   const root = tasksRoot();
-  if (!fs13.existsSync(root)) {
+  if (!fs14.existsSync(root)) {
     console.log("No tasks found.");
     return;
   }
   const rows = [];
   let invalidCount = 0;
-  for (const entry of fs13.readdirSync(root).sort()) {
+  for (const entry of fs14.readdirSync(root).sort()) {
     if (entry === "_archive" || entry === "_templates") continue;
     if (isOrphanedWorktreeState(entry)) {
       invalidCount += 1;
@@ -3687,7 +3665,7 @@ function taskList() {
       continue;
     }
     const statusPath = path14.join(taskDirForCwd(process.cwd(), entry), "status.json");
-    if (!fs13.existsSync(statusPath)) continue;
+    if (!fs14.existsSync(statusPath)) continue;
     try {
       const status = readJsonFile(statusPath);
       const phase = derivePhase(status);
@@ -3724,7 +3702,7 @@ function taskStatus(id) {
   validateTaskId(id);
   const cwd = resolveTaskCwd(id);
   const statusPath = taskStatusFileForCwd(cwd, id);
-  if (!fs13.existsSync(statusPath)) {
+  if (!fs14.existsSync(statusPath)) {
     throw new Error(`Error: No status.json found for task ${id}`);
   }
   const status = readJsonFile(statusPath);
@@ -3797,7 +3775,7 @@ function taskPhase(id, phaseArg, statusArg, verdictArg) {
   assertValidVerdict(phaseArg, verdictArg);
   const taskCwd = resolveTaskCwd(id);
   const statusPath = taskStatusFileForCwd(taskCwd, id);
-  if (!fs13.existsSync(statusPath)) {
+  if (!fs14.existsSync(statusPath)) {
     throw new Error(`Error: No status.json found for task ${id} (looked in ${taskDirForCwd(taskCwd, id)}/)`);
   }
   const status = readJsonFile(statusPath);
@@ -3863,7 +3841,7 @@ function taskAccept(ids, phaseArg, options = {}) {
   for (const id of ids) {
     const taskCwd = resolveTaskCwd(id);
     const statusPath = taskStatusFileForCwd(taskCwd, id);
-    if (!fs13.existsSync(statusPath)) {
+    if (!fs14.existsSync(statusPath)) {
       throw new Error(`Error: No status.json found for task ${id} (looked in ${taskDirForCwd(taskCwd, id)}/)`);
     }
     const status = readJsonFile(statusPath);
@@ -3965,7 +3943,7 @@ function taskAccept(ids, phaseArg, options = {}) {
     const originalSnapshots2 = /* @__PURE__ */ new Map();
     for (const ctx of ctxByTask.values()) {
       try {
-        originalSnapshots2.set(ctx.statusPath, fs13.readFileSync(ctx.statusPath, "utf8"));
+        originalSnapshots2.set(ctx.statusPath, fs14.readFileSync(ctx.statusPath, "utf8"));
       } catch (error) {
         const message = error instanceof Error ? error.message : String(error);
         throw new Error(`Error: failed to read ${ctx.statusPath} for rollback snapshot: ${message}`);
@@ -4002,8 +3980,8 @@ function taskAccept(ids, phaseArg, options = {}) {
         if (original === void 0) continue;
         try {
           const tmpFile = `${filePath}.rollback.tmp`;
-          fs13.writeFileSync(tmpFile, original, "utf8");
-          fs13.renameSync(tmpFile, filePath);
+          fs14.writeFileSync(tmpFile, original, "utf8");
+          fs14.renameSync(tmpFile, filePath);
         } catch (rollbackErr) {
           const message = rollbackErr instanceof Error ? rollbackErr.message : String(rollbackErr);
           rollbackErrors.push(`    ${filePath}: ${message}`);
@@ -4027,12 +4005,12 @@ ${rollbackErrors.join("\n")}`
       const bundleNote = ids.length > 1 ? ` Bundle: ${ids.join(", ")}.` : "";
       const noteLine = `[${today()}] Operator accepted ${phaseArg} via \`canon task accept\` \u2014 ${sanctioned ? "sanctioned (agent verdict overridden)" : "unblocked (advancing verdict preserved)"}. Reason: ${reason}.${bundleNote}`;
       try {
-        if (fs13.existsSync(notesPath)) {
-          fs13.appendFileSync(notesPath, `
+        if (fs14.existsSync(notesPath)) {
+          fs14.appendFileSync(notesPath, `
 ${noteLine}
 `, "utf8");
         } else {
-          fs13.writeFileSync(notesPath, `${noteLine}
+          fs14.writeFileSync(notesPath, `${noteLine}
 `, "utf8");
         }
       } catch (error) {
@@ -4155,7 +4133,7 @@ ${noteLine}
   const originalSnapshots = /* @__PURE__ */ new Map();
   for (const ctx of ctxByTask.values()) {
     try {
-      originalSnapshots.set(ctx.statusPath, fs13.readFileSync(ctx.statusPath, "utf8"));
+      originalSnapshots.set(ctx.statusPath, fs14.readFileSync(ctx.statusPath, "utf8"));
     } catch (error) {
       const message = error instanceof Error ? error.message : String(error);
       throw new Error(`Error: failed to read ${ctx.statusPath} for rollback snapshot: ${message}`);
@@ -4180,8 +4158,8 @@ ${noteLine}
       if (original === void 0) continue;
       try {
         const tmpFile = `${filePath}.rollback.tmp`;
-        fs13.writeFileSync(tmpFile, original, "utf8");
-        fs13.renameSync(tmpFile, filePath);
+        fs14.writeFileSync(tmpFile, original, "utf8");
+        fs14.renameSync(tmpFile, filePath);
       } catch (rollbackErr) {
         const message = rollbackErr instanceof Error ? rollbackErr.message : String(rollbackErr);
         rollbackErrors.push(`    ${filePath}: ${message}`);
@@ -4203,12 +4181,12 @@ ${noteLine}
     const notesPath = path14.join(taskDirForCwd(ctx.taskCwd, ctx.id), "notes.md");
     const noteLine = `[${today()}] Operator accepted implement phase via \`canon task accept\` \u2014 auto-commit will be skipped.${options.force ? " (--force)" : ""}`;
     try {
-      if (fs13.existsSync(notesPath)) {
-        fs13.appendFileSync(notesPath, `
+      if (fs14.existsSync(notesPath)) {
+        fs14.appendFileSync(notesPath, `
 ${noteLine}
 `, "utf8");
       } else {
-        fs13.writeFileSync(notesPath, `${noteLine}
+        fs14.writeFileSync(notesPath, `${noteLine}
 `, "utf8");
       }
     } catch (error) {
@@ -4228,14 +4206,14 @@ function taskResetSpecReview(id) {
   const taskCwd = resolveTaskCwd(id);
   const taskDir = taskDirForCwd(taskCwd, id);
   const statusPath = path14.join(taskDir, "status.json");
-  if (!fs13.existsSync(statusPath)) {
+  if (!fs14.existsSync(statusPath)) {
     throw new Error(`Error: no status.json at ${statusPath}`);
   }
   const reviewPath = path14.join(taskDir, "spec-review.md");
-  if (fs13.existsSync(reviewPath)) {
+  if (fs14.existsSync(reviewPath)) {
     let n = 1;
-    while (fs13.existsSync(path14.join(taskDir, `spec-review-prior-${n}.md`))) n += 1;
-    fs13.renameSync(reviewPath, path14.join(taskDir, `spec-review-prior-${n}.md`));
+    while (fs14.existsSync(path14.join(taskDir, `spec-review-prior-${n}.md`))) n += 1;
+    fs14.renameSync(reviewPath, path14.join(taskDir, `spec-review-prior-${n}.md`));
     console.log(`Archived prior spec-review.md \u2192 spec-review-prior-${n}.md`);
   }
   const status = readJsonFile(statusPath);
@@ -4259,7 +4237,7 @@ function taskResetCodeReview(id) {
   const taskCwd = resolveTaskCwd(id);
   const taskDir = taskDirForCwd(taskCwd, id);
   const statusPath = path14.join(taskDir, "status.json");
-  if (!fs13.existsSync(statusPath)) {
+  if (!fs14.existsSync(statusPath)) {
     throw new Error(`Error: no status.json at ${statusPath}`);
   }
   const status = readJsonFile(statusPath);
@@ -4345,12 +4323,12 @@ function resolveMainCheckoutRoot() {
 }
 function safeRealpath(target) {
   try {
-    return fs13.realpathSync(target);
+    return fs14.realpathSync(target);
   } catch {
     const parent = path14.dirname(target);
     if (parent === target) return target;
     try {
-      return path14.join(fs13.realpathSync(parent), path14.basename(target));
+      return path14.join(fs14.realpathSync(parent), path14.basename(target));
     } catch {
       return target;
     }
@@ -4458,12 +4436,12 @@ function taskPostMergeSync(branchArg) {
 }
 function nudgeShippableTasks() {
   const root = tasksRoot();
-  if (!fs13.existsSync(root)) return;
+  if (!fs14.existsSync(root)) return;
   const shippable = [];
-  for (const entry of fs13.readdirSync(root).sort()) {
+  for (const entry of fs14.readdirSync(root).sort()) {
     if (entry === "_archive" || entry.startsWith("_")) continue;
     const statusPath = path14.join(root, entry, "status.json");
-    if (!fs13.existsSync(statusPath)) continue;
+    if (!fs14.existsSync(statusPath)) continue;
     let status;
     try {
       status = readJsonFile(statusPath);
@@ -4538,7 +4516,7 @@ function taskSet(args2) {
   validateTaskId(id);
   const taskCwd = resolveTaskCwd(id);
   const statusPath = taskStatusFileForCwd(taskCwd, id);
-  if (!fs13.existsSync(statusPath)) {
+  if (!fs14.existsSync(statusPath)) {
     throw new Error(`Error: No status.json found for task ${id}`);
   }
   const status = readJsonFile(statusPath);
@@ -4879,7 +4857,7 @@ function currentPinFromManifest(manifest) {
   return "unknown";
 }
 function bakedVersion() {
-  return "3.3.1";
+  return "3.5.0";
 }
 function ownPackageName(pkgDir) {
   try {
@@ -5355,7 +5333,7 @@ function runUpgrade(cwd, pkgDir, options = {}) {
     cutoverWarnings.push(docsRefsCheckRel);
   }
   const versionPath = join5(cwd, ".canon", "version");
-  const newVersion = "3.3.1";
+  const newVersion = "3.5.0";
   const currentVersion = existsSync5(versionPath) ? readFileSync4(versionPath, "utf8").trim() : null;
   if (currentVersion !== newVersion) {
     pending.push({ rel: ".canon/version", projectPath: versionPath, content: newVersion + "\n" });
@@ -5663,7 +5641,7 @@ Global:
 `);
 }
 function printVersion() {
-  console.log("3.3.1");
+  console.log("3.5.0");
 }
 switch (command) {
   case "doctor":