chore(release): plan v2026.10.4

[kryptobaseddev]

Release plan for v2026.10.4 (hotfix), generated from main da4eac935.

• Archives the v2026.10.3 changesets into .changeset/shipped/v2026.10.3/ and removes .cleo/release/v2026.10.3.plan.json, following the chore(release): plan v2026.10.3 — first cloud push fix (needs cleo-nexus #33), vault fixes #1799 pattern.
• .cleo/release/v2026.10.4.plan.json comes from cleo release plan v2026.10.4 --tasks T13103,T12472,T13100,T13104,T13106,T13122,T13136,T13119,T13150. It is a regular release on channel latest; the previous version and tag are v2026.10.3.
  • Task scope = closed tasks only (owner decision: option C, no override).
  • Every other PR merged since v2026.10.3 still ships as commits: feat(T13102): guided first run — cleo login nexus links and backs up; cloud restore by name #1797, fix(T13130): owned-process probe reads ESRCH as a process that is gone #1807, fix(T13123): typecheck and lint slots are RAM-derived and pressure-sensitive; evidence runs get a heap ceiling #1810, fix(T13124): install the heavy-command hook for every harness in use, report every outcome, govern pre-approved commands in Claude Code's default modes #1811, fix(T13126): cleo --version/--help stop loading all of CORE; resolve fast path; built-CLI startup ratchet (gate 39) #1812, fix(T13140): release open reuses main's tested CI run; --no-commit-plan dispatches the merged plan (T13050) #1816, ci(T13141): the release bump-PR's dispatched CI runs the version-only set #1817, fix(T13125): tool:test runs only the affected packages without a declared affectedCommand; doctor proposes one #1818 and fix(T13126): loading @cleocode/core no longer evaluates js-tiktoken, the Bedrock SDK or ai #1820. Their tasks close through the normal route.
• The release notes, which also become the CHANGELOG.md section, describe every shipped change:
  • an update line (cleo self-update);
  • Highlights, in the owner's order: the macOS empty-store fix (fix(T13119,T13150): exodus-on-open is no longer deferred by CPU saturation on macOS #1826), the heavy-command hook (fix(T13124): install the heavy-command hook for every harness in use, report every outcome, govern pre-approved commands in Claude Code's default modes #1811), no implicit whole-suite evidence (fix(T13125): tool:test runs only the affected packages without a declared affectedCommand; doctor proposes one #1818), CLI startup memory (fix(T13126): cleo --version/--help stop loading all of CORE; resolve fast path; built-CLI startup ratchet (gate 39) #1812, fix(T13126): loading @cleocode/core no longer evaluates js-tiktoken, the Bedrock SDK or ai #1820), and the heap/worker/typecheck caps (fix(T13122): plan the heavy-tool heap against the run's budget; inherited values can only tighten it #1808, fix(T13123): typecheck and lint slots are RAM-derived and pressure-sensitive; evidence runs get a heap ceiling #1810, fix(T13122): bound MAKEFLAGS flag clusters, a dash-spelled workspace variable and coloured npm warnings #1824);
  • Also in this release: feat(T13102): guided first run — cleo login nexus links and backs up; cloud restore by name #1797, fix(T13140): release open reuses main's tested CI run; --no-commit-plan dispatches the merged plan (T13050) #1816, ci(T13141): the release bump-PR's dispatched CI runs the version-only set #1817 and fix(T13130): owned-process probe reads ESRCH as a process that is gone #1807;
  • then the generated Added/Fixed entries.
• The CHANGELOG.md body equals meta.releaseNotes, checked byte for byte after trimming. cleo release validate-changelog v2026.10.4 reports valid.

Plan sha256: 442383652c78a85e6c14c4337157f8526369a6409506016d5f1cb9a31bd53bdf

release-prepare is not dispatched from here; main dispatches it after this merges.

🤖 Generated with Claude Code

[kryptobaseddev]

Independent review: review-p0 APPROVED at 4c03e2d. Plan sha256 442383652c78a85e6c14c4337157f8526369a6409506016d5f1cb9a31bd53bdf (verified against the file at that head). Diff is release metadata only (changeset archive moves, .cleo/release plan files, CHANGELOG); CHANGELOG body equals meta.releaseNotes. Recovery wording verified in a sandbox against released 2026.10.3 (team-p0-startup); the id-collision limit is tracked in T13172. Main push CI on parent da4eac9 (run 37171533531) green on all 4 ubuntu shards. PR CI green (77 pass, 0 fail).