v2026.10.8

Upgrading: from 2026.10.6 or older, run cleo self-update --no-auto-upgrade, then cleo upgrade. From 2026.10.7, cleo self-update is safe. 2026.10.8 fixes a 2026.10.7 bug where cleo complete could wipe a task's cached typed-gate passes and then refuse them.

Added

• Sync: the undo-budget rebind runs at the next pull to head - reconcile, signed retire of the old replica, late old segments as history (provenance: T13278; groundwork for T12763 and T12753)
• Throwaway containers: a --rm / cleo.task + cleo.ttl label convention, and a bounded reaper behind cleo doctor system --repair (dry run first) (provenance: T13436)

Fixed

• Sync: a replica retire counts only once the server confirms it (provenance: T13366)
• a research or spike task's own-branch PR still implements it ahead of its review doc, and checkout-required names the merge it switches to and offers ci: only when evidence.ciSatisfies is set (provenance: T13463)
• cleo done --plan and cleo complete judge a stored typed result as stale with one shared predicate, so the plan never reads as a pass a result completion refuses (provenance: T13502)
• a typed test gate fails on a non-zero failed count even with exit 0, and cleo complete names cleo verify --run (not --no-run) when typed gates have no cached pass (provenance: T13516)
• a cache-only gate write (--no-run, or cleo complete's merged-CI record) no longer wipes a typed gate's stored pass after HEAD moves; a pass that still proves the gate on the same inputs is kept. A --no-run write that links a typed gate now also succeeds when that gate's stored pass still holds (provenance: T13525)
• typed gates that run a script through pnpm's node_modules link no longer fail verify, and a gate whose inputs cannot be captured fails alone instead of aborting every gate (provenance: T13527)