v0.5.0

Added

• fleet validate (and --all, --json): run a repo-configured validate
  command inside an agent's worktree and record the outcome on the agent's
  state entry, pinned to the exact commit and command. Staleness is derived,
  never stored — a record only ever means "this commit got this result from
  this command". Dirty worktrees are refused: a record certifies a commit.
• fleet list now shows a VALIDATED column (passed / failed / stale /
  —), and its --json output — and therefore the read-only MCP tools —
  carries validation and validatedAt per agent, with no change to the MCP
  tool surface.
• fleet merge enforces the gate when validate is configured: a passing
  record at the agent's tip is trusted (the command is not re-run), a failing
  record at the tip refuses immediately, and a missing or stale record is run
  and recorded on the spot. preMerge is unchanged and still runs at merge
  time — validate is the recorded, skippable gate; preMerge the always-run
  hook.
• fleet dashboard (and --once, --interval): one live pane composing the
  agent table (validation column included), per-agent touched-file counts, a
  validation tally, and the full collision report with merge-simulation
  verdicts. --once prints a single frame for scripts and CI logs.
• fleet check results (human, --json, and MCP) now include agentFiles:
  how many files each agent touched vs its base, computed for any fleet size —
  including a single agent, which previously short-circuited before gathering
  anything.
• New .fleetrc.json key validate, validated like the other hook commands
  and covered by the shipped JSON schema.

Fixed

• Shell completions now list init and undo, which were missing from the
  generated scripts.
• State and undo records can no longer direct Git operations at worktrees
  outside .fleet/worktrees/<agent> (including lookalike paths, symlinks, and
  Windows junctions). Unsafe state is refused before mutation and can be
  rebuilt safely with fleet doctor --fix.
• State and undo records must also keep the documented fleet/<agent> branch
  identity. A corrupted record can no longer redirect merge, validation, or
  branch-deletion operations to an unrelated branch.
• Validation now re-checks worktree cleanliness after the configured command.
  Commands that leave tracked or untracked changes no longer create a record
  or let fleet merge proceed, regardless of their exit code; commands that
  commit their changes and finish clean remain supported.
• Stale-lock recovery diagnostics now go to stderr, preserving the single
  parseable stdout payload promised by mutating commands with --json.
• Successful merges now persist undo metadata before post-merge cleanup. If
  worktree removal, branch deletion, or the state write is interrupted,
  fleet undo recovers from live branch/worktree state instead of losing the
  rollback path.

Notes

• The state file gains an optional per-agent validation object; the schema
  version stays 1 and files written by older versions load unchanged.
  fleet doctor --fix rebuilds drop the record (it is re-derivable by
  re-running fleet validate), consistent with rebuilds re-deriving
  baseBranch and createdAt.
• The MCP surface is still read-only: validation state flows out through the
  existing tools; nothing new is invokable by an agent.