v2026.6.7

Added

• Exodus fleet-flow surface: cleo doctor exodus-health (read-only per-scope state + recommendations), cleo exodus migrate --scope global|project|both, and cleo exodus seal --scope to certify an already-migrated install (memory-safe count-parity gate → archive + completion marker) without a destructive re-migrate or the OOM-prone verify. (provenance: T11837; #970)
• Per-operation input/output schema SSoT — OperationDef.inputSchema/outputSchema + cleo <op> --describe + describeOperation(). (provenance: T11692; #974)
• Orphan-prevention guard: a single child-disposition path with a write-time strict-spine invariant; filing a child under a done parent reopens it (PM-Core V2). (provenance: T11811; #968)

Changed

• Honest exodus migrate diagnostics: capture existingBefore to distinguish idempotent PK-dedup (zero loss) from a genuine constraint shortfall, replacing the misleading hard-coded "CHECK/type constraint violation" message that conflated the two. (provenance: T11835; #967)
• Right-size the exodus disk preflight (1.2× largest source + consolidated estimate, was 3× of the sum) and make the per-source staging copy optional for large sources. (provenance: T11838; #972)

Fixed

• Exodus verifyMigration content digest now streams (statement iterator + set-based COUNT(*)) instead of .all()-materializing whole tables — a 697K-row / 1.7 GB-class verify completes in bounded memory (3M rows in 3.7 s at 44 MB heap), eliminating the OOM that rolled back an otherwise-lossless cutover. (provenance: T11834; #966)
• Classify NULL→NOT-NULL-default substitution as a distinct non-fatal exodus verify diagnostic so a faithful fresh migration no longer reports a false hashMatch=false. (provenance: T11836; #971)

Docs

• ADR-072 (nexus DB topology split) superseded by ADR-090 (dual-cleo.db residency); zero-orphans session ledger. (provenance: T11810; #969)