fix: dogfood G23-G38 first-run, background plan, and CLI error-contract repairs

Owner adjudicated the agent-proposed G23-G38 triage "Yes for all" on
2026-09-16 (docs/work-log/dogfood-findings-2026-09-15.md, "Owner decisions
(2026-09-16)"). Landed as small existing-contract repairs, one behavior
regression per finding (all observed failing pre-change):

- G23/G38 init/setup: no key prompt for `fake` (ProviderConfig.requires_api_key),
  non-TTY stdin without --provider fails fast with a classified error before any
  write; key-requiring providers proceed with api_key_note.
- G24 init next_steps show the workspace-write plan gate (plan -> --from-plan).
- G29 init/setup append `.teaagent/` to .gitignore in git repos (--no-gitignore
  opt-out, gitignore status reported); first next step commits the scaffold so
  the git sandbox stays enabled.
- G30 `fake` is requires_network=False: preflight skips DNS/loopback probes.
- G31 background worker argv forwards --from-plan/--require-plan/
  --skip-plan-check (+ --allow-external-plan); --from-plan without a positional
  task no longer crashes the parent.
- G26 run-list JSON arrays contain only run records; scratchpad hint is
  human-output only.
- G35 MCP unknown tools/call -> JSON-RPC -32602, session keeps serving (catch
  narrowed to the registry lookup). G27 mcp trust allow/deny without
  TEAAGENT_MCP_TRUST_KEY -> classified error (G11 wrong-key semantics untouched).
- G32 memory auto-invalidate accepts a str root. G33 skill candidate install
  not-found -> classified error. G36 automation add validates the schedule
  before persisting. G37 automation show/pause/resume/delete/run accept a
  unique name. G28 bare audit verify errors up front without a legacy log.
  G25 release evidence prints gate progress on stderr.
- G34 held under ADR-0043 (no change). D1 still deferred.

Docs: cli/USAGE/daily-driver/audit guide updated; risk record
docs/reviews/dogfood-g23-g38-2026-09-16-risk.md; roadmap-status, backlog,
findings, and the rethink record updated; generated artifacts regenerated.

Gate: governance-gap (G26/G27/G28/G29/G31/G32/G33/G35/G36) and owner-override (G23/G24/G25/G30/G37/G38, owner "Yes for all" 2026-09-16)
Constraint: existing-contract repairs only; no sandbox/approval/policy/runner-core code; G34 consensus untouched; no owner verdict supplied
Tested: focused pytest 180 passed across new tests/test_dogfood_*_g*.py and touched families; integrated /tmp scratch journey (headless init -> committed scaffold -> offline preflight ready -> sandboxed agent run completed, porcelain clean; runs list schema; audit verify bare error; MCP -32602 then valid call); ruff/mypy clean on 19 changed files; verify_docs.sh PASS
Not-tested: live `release evidence` default-profile progress (unit-proven with stubbed runner); full pytest suite
Confidence: high
Action: G-P2-19
Roadmap-Status: updated (2026-09-16 G23-G38 implemented note; no horizon/milestone status column moved)

Author: johnteee

docs/USAGE.md

@@ -85,7 +85,7 @@ teaagent memory failures prune
 - `plan` writes a reviewable artifact; `run --from-plan` binds execution to that artifact (task + content hash in the run audit log). Plans must live under `.teaagent/plans/` unless you pass `--allow-external-plan` (other paths must still be under `--root`).
 - **Plan-before-write enforcement**: `workspace-write` mode requires a plan by default. Use `--skip-plan-check` to override.
 
-**Advanced paths** (not part of the golden path): `teaagent init`, `teaagent doctor providers --wizard`, manual `providers_env.zsh`, Keychain scripts, per-provider env exports — see [Recovery recipes](#recovery-recipes) and [API Key Setup](#api-key-setup).
+**Advanced paths** (not part of the golden path): `teaagent init` (non-interactive stdin requires `--provider`; skips the API-key prompt for `fake`; adds `.teaagent/` to `.gitignore` in git repos unless `--no-gitignore`; for `workspace-write` its next-steps show the `plan` → `--from-plan` gate), `teaagent doctor providers --wizard`, manual `providers_env.zsh`, Keychain scripts, per-provider env exports — see [Recovery recipes](#recovery-recipes) and [API Key Setup](#api-key-setup).
 
 ## Setup model
 

docs/backlog-priority.md

@@ -1,6 +1,6 @@
 # Backlog Priority
 
-> **Last reviewed:** 2026-09-16 (dogfood G23–G38 triage row added as Proposed; no priority or shipped/beta change)
+> **Last reviewed:** 2026-09-16 (dogfood G23–G38 adjudicated "Yes for all" and implemented; G34 held; no priority or shipped/beta change)
 > **Review trigger:** Backlog priorities or shipped/beta status claims change.
 > **Scheduling gate (2026-08-26):** DR-006 remains authoritative. EFX-001–003
 > are in-progress P0 `governance-gap` remediations on existing seams; no
@@ -68,7 +68,7 @@ was met on 2026-06-22; completing that intake does not authorize new work.
 | CP-6 Community Presence | `legacy-competitive` | **Hold** — external acquisition non-goal |
 | M4 cloud/background/control-plane cockpit | `legacy-competitive` | **Hold except DR-006 carve-out** — background lifecycle + operator cockpit eligible under owner-override co-maintainer dogfood; cloud/SaaS/multi-tenant GTM held (T4). 2026-09-15 co-maintainer dogfood session completed (B2 evidence, B1 still pending) |
 | RBAC enforce flip (ADR 0031, packet evaluated 2026-09-15) | `governance-gap` | **Hold** — 4/5 criteria prepared, promotion not ready; owner extended to 2026-09-29 conditioned on G1–G5 landing and re-dogfood; promotion_ready=false; no premature enforce flip |
-| Dogfood findings G23–G38 (2026-09-15 sweep; triage in `work-log/dogfood-findings-2026-09-15.md`, reasoning in `reviews/roadmap-rethink-2026-09-16.md` §5) | proposed per item: 9 `governance-gap`, 6 `owner-override`, 1 `legacy-competitive` (G34) | **Proposed — not scheduled**; owner adjudication batch pending; nothing lands without its cited gate |
+| Dogfood findings G23–G38 (2026-09-15 sweep; decisions in `work-log/dogfood-findings-2026-09-15.md` §"Owner decisions (2026-09-16)", reasoning in `reviews/roadmap-rethink-2026-09-16.md` §5) | 9 `governance-gap`, 6 `owner-override`, 1 `legacy-competitive` (G34) | **Done 2026-09-16** except G34 (**Hold**, ADR-0043 expiry review 2026-12-09) — owner "Yes for all"; landed with per-finding behavior regressions and an integrated first-run scratch journey; residual twins listed in the findings record |
 | TASK-006 RunEvent taxonomy + M0 | `harness-migration` | **Done** — ADR-0032 run-event taxonomy; `teaagent/runner/_events.py` spine + audit dual-write (M0–M7 in work-log) |
 | TASK-001 constitution repositioning | `owner-override` | **Done (Human Review 2026-07-22)** — owner ratified harness-first positioning; no README/product-contract changes required |
 | TASK-002 docs tiering | `harness-migration` | **Done** — tier column in `docs/generated/docs-inventory.md` + aging dashboard; `check-docs-inventory` pre-commit regen |

docs/cli.md

@@ -283,6 +283,21 @@ teaagent tui --permission-mode allow
 teaagent tui --permission-mode danger-full-access
 ```
 
+## Workspace Init
+
+`teaagent init` is the non-wizard bootstrap (the guided flow is `teaagent setup`):
+
+```bash
+teaagent init --root . --provider fake                 # offline smoke provider needs no key
+teaagent init --root . --provider gpt --api-key sk-...
+teaagent init --root . --provider gpt --no-gitignore   # opt out of the .gitignore addition
+```
+
+- Non-interactive stdin (piped/headless): `init` and `setup` without `--provider` fail fast with `{"ok": false, "message": "provider is required in non-interactive mode; pass --provider <name> (choices: ...) or run in a terminal"}` and exit 1 before writing any file. They never silently select a credentialed provider.
+- Providers that need no key (`fake`) are never prompted for one. For a key-requiring provider on non-TTY stdin, `init` proceeds without storing a key and reports `api_key_note` naming the env var to set.
+- In a git repo, `init` (and `setup`, when it writes config) adds `.teaagent/` to `.gitignore` so the auto-enabled git sandbox stays usable; the result is reported as `gitignore: added|present|skipped|not-a-git-repo`. Existing lines are never rewritten and no git command runs; `--no-gitignore` opts out.
+- For `--permission-mode workspace-write`, `next_steps` include the plan-gate path (`teaagent agent plan ...` then `teaagent agent run ... --from-plan .teaagent/plans/<plan-file>.md`); `--skip-plan-check` is not recommended.
+
 ## Model Adapters
 
 List supported providers:
@@ -613,7 +628,7 @@ Streamable HTTP details:
 - `--auth-token TOKEN` requires `Authorization: Bearer TOKEN` on every request.
 - `--allowed-origin URL` may be repeated to whitelist browser Origin headers. Default: allow all.
 
-Supported methods: `initialize`, `tools/list`, `tools/call`. Each tool is exposed with its `inputSchema` and read-only / destructive / idempotent annotations. Tool errors are returned as `result.isError = true` rather than JSON-RPC errors so the client can recover.
+Supported methods: `initialize`, `tools/list`, `tools/call`. Each tool is exposed with its `inputSchema` and read-only / destructive / idempotent annotations. Tool *execution* errors are returned as `result.isError = true` rather than JSON-RPC errors so the client can recover; a `tools/call` for an unregistered tool is a JSON-RPC `-32602` (Invalid params) error frame (`tool 'X' is not registered`) and the server keeps serving.
 
 ## Subagent Delegation
 
@@ -1015,25 +1030,34 @@ teaagent agent automation add daily-brief "Summarize open TODOs" --schedule "dai
 teaagent agent automation add lint-sweep "Check docs consistency" --schedule "every 2h" --root . --auto-propose-skill
 ```
 
-List and inspect:
+Schedules accept `every <N>m`, `every <N>h`, or `daily HH:MM`. Any other value
+(for example a cron expression like `*/5 * * * *`) is rejected before anything
+is written, returning `{"status": "error", "message": "unsupported schedule
+'...'; use 'every 30m', 'every 2h', or 'daily HH:MM'"}` with exit code 1.
+
+List and inspect. The `show`, `pause`, `resume`, `delete`, and `run` commands
+accept either the hex `automation_id` or a unique automation `name`; a name
+that matches more than one automation returns an `ambiguous automation name
+'<name>': ids ...` error (exit code 1), and an unknown value returns the
+usual `automation '<value>' not found` error.
 
 ```bash
 teaagent agent automation list --root .
-teaagent agent automation show <automation_id> --root .
+teaagent agent automation show <automation-or-name> --root .
 ```
 
 Control lifecycle:
 
 ```bash
-teaagent agent automation pause <automation_id> --root .
-teaagent agent automation resume <automation_id> --root .
-teaagent agent automation delete <automation_id> --root .
+teaagent agent automation pause <automation-or-name> --root .
+teaagent agent automation resume <automation-or-name> --root .
+teaagent agent automation delete <automation-or-name> --root .
 ```
 
 Execute runs:
 
 ```bash
-teaagent agent automation run <automation_id> --root .
+teaagent agent automation run <automation-or-name> --root .
 teaagent agent automation tick --root .
 teaagent agent automation tick --dry-run --root .
 teaagent agent automation serve --interval-seconds 30 --max-ticks 10 --root .

docs/daily-driver-current-status.md

@@ -11,10 +11,10 @@
 > `docs/analysis/`.
 >
 > **Review trigger:** TUI, chat, agent mode, approval, cost, undo, or resume behavior changes.
-> **Last reviewed:** 2026-09-15 (approval behavior changes: deny grants block
-> all modes, `approval reject` CLI, 24h pending-approval TTL, unbounded pending
-> surfaces — see `permission-and-approval-playbook.md`; undo refuses off-branch;
-> attach inherits the run's recorded provider)
+> **Last reviewed:** 2026-09-16 (first-run and error-contract fixes G23–G38:
+> offline-ready `fake` provider, `init`/`setup` gitignore `.teaagent/` and fail
+> fast on non-interactive stdin, `--background` honors plan flags, run-list JSON
+> arrays contain only runs, MCP unknown-tool calls no longer end the session)
 
 This page is the short daily-use entry point for TeaAgent's TUI, TUI chat, and
 agent mode. It is intentionally more practical than the audit corpus.
@@ -43,6 +43,9 @@ daily-driver plan is historical evidence, not an active scheduling authority.
 
 - Approval governance now fail-closes GitHub/browser/MCP external mutations in prompt/read-only/workspace-write, consumes one-time JIT grants, and refuses blind redispatch of unmatched non-idempotent starts. Providerless acceptance is in `tests/acceptance/test_efx_durable_effect_flow.py`. Keep live credentials off until a live-credential dry-run exists; see "Known issues."
 - `daily`/`preflight` warn when `GITHUB_TOKEN`/`GH_TOKEN` sit in the shell environment: external-effect tools stay fail-closed until approved, but remove ambient tokens unless authorizing live use (EFX-002).
+- The `fake` provider is offline-ready: `agent preflight`/`plan`/`daily` pass with no DNS or socket call because `ProviderConfig.requires_network=False` short-circuits the connectivity and loopback-bind checks (G30).
+- `init`/`setup` add `.teaagent/` to `.gitignore` in git repos (append-only; `--no-gitignore` opts out) so the auto-enabled git sandbox no longer self-disables on first run, and non-interactive `init`/`setup` fail fast with a classified error instead of crashing on stdin EOF (G23/G29/G38).
+- `agent run --background` forwards `--from-plan`/`--require-plan`/`--skip-plan-check` to the worker, so a workspace-write background run with a valid plan produces a run instead of dying on `PLAN_GATE` (G31). `runs list`/`session list` JSON arrays contain only run records; the scratchpad hint is human-output only (G26).
 - `teaagent chat` prints successful task answers and no longer marks successful tasks as failures.
 - `teaagent chat` `/cost` and `/budget` are wired to real session cost. Budget semantics are explicit: `None` means unlimited, while `0` is a real zero cap. Cost display labels whether the value is actual, estimated, or unavailable.
 - Matched deny grants now hard-block in every mode (`approval check` reports

docs/generated/docs-aging-dashboard.md

@@ -4,12 +4,24 @@
 
 **Stale threshold:** 90 days since `Last reviewed`
 **Current-truth docs scanned:** 17
-**Needs attention (working tier only):** 0
+**Needs attention (working tier only):** 2
 **Archive-tier docs (exempt from staleness):** 0
 
 Regenerate: `python3 scripts/report_docs_aging.py`
 
-All scanned current-truth working-tier docs are fresh.
+## Stale Or Incomplete By Owner Surface
+
+### cli
+
+| Document | Status | Last reviewed | File mtime | Notes |
+| --- | --- | --- | --- | --- |
+| `docs/cli.md` | stale_by_mtime | 2026-09-15 | 2026-09-16 | Missing owner banner; File modified after last reviewed date |
+
+### daily-driver
+
+| Document | Status | Last reviewed | File mtime | Notes |
+| --- | --- | --- | --- | --- |
+| `docs/USAGE.md` | stale_by_mtime | 2026-08-26 | 2026-09-16 | Missing owner banner; File modified after last reviewed date |
 
 ## Review Triggers (Current-Truth Docs)
 
@@ -35,7 +47,7 @@ All scanned current-truth working-tier docs are fresh.
 
 ## Corpus Cost (G5 Signal)
 
-**Total docs:** 664 (baseline 582 at diagnosis, delta +82)
+**Total docs:** 665 (baseline 582 at diagnosis, delta +83)
 **Live corpus (non-archive):** 377
 **Working-tier docs unreferenced by INDEX.md:** 328
 

docs/generated/docs-inventory.md

@@ -6,7 +6,7 @@
 Generated by `python3 scripts/generate_docs_inventory.py`.
 Do not edit this file manually — regenerate instead.
 
-**Markdown files:** 663
+**Markdown files:** 664
 
 | Path | Tier | Bytes | SHA256 (12) |
 | --- | --- | ---: | --- |
@@ -197,11 +197,11 @@ Do not edit this file manually — regenerate instead.
 | `architecture/seven-control-loops-teaagent-integration-map-2026-06-05.md` | archive | 9282 | `6d85e832f8eb` |
 | `archive/INDEX.md` | working | 8774 | `1efa1af575f5` |
 | `audit-events.md` | working | 2376 | `b83066076fba` |
-| `backlog-priority.md` | working | 40373 | `8c520656cfe5` |
-| `cli.md` | working | 38796 | `3acc21fd9fc1` |
+| `backlog-priority.md` | working | 40547 | `c67c411d0f0e` |
+| `cli.md` | working | 41038 | `473615a342bb` |
 | `cloud-deployment.md` | working | 9431 | `50f6461a2077` |
 | `context-bus-and-federated-sync.md` | working | 1564 | `2dde6eed4bf8` |
-| `daily-driver-current-status.md` | working | 20349 | `5daffd323d92` |
+| `daily-driver-current-status.md` | working | 21210 | `b462a4be8393` |
 | `daily-driver-known-issues-2026-06-01.md` | archive | 3336 | `a7432126b3c0` |
 | `daily-driver-troubleshooting.md` | working | 2742 | `e8d7822c46f7` |
 | `debugging/agent-resume-debug-checklist-2026-06-02.md` | archive | 1062 | `ed20d824bd09` |
@@ -245,8 +245,8 @@ Do not edit this file manually — regenerate instead.
 | `error-reference.md` | working | 4897 | `067448aba6f1` |
 | `gateway-oauth-tenants.md` | working | 1818 | `0ff9c7df4652` |
 | `generated/command-snippet-inventory.md` | working | 8128 | `bf21da5dfe66` |
-| `generated/docs-aging-dashboard.md` | working | 3433 | `630bf72efcf3` |
-| `generated/release-docs-evidence.md` | working | 3637 | `95087ecd2030` |
+| `generated/docs-aging-dashboard.md` | working | 3879 | `a39993abb672` |
+| `generated/release-docs-evidence.md` | working | 3655 | `daf015a2071b` |
 | `governance-compliance.md` | constitution | 1645 | `d7665f2f7864` |
 | `governance/code-review-checklist.md` | working | 4379 | `f580da208c75` |
 | `governance/command-snippet-registry.md` | working | 3023 | `2e6c2b337773` |
@@ -327,7 +327,7 @@ Do not edit this file manually — regenerate instead.
 | `modules/chat_session_controller/inspection.md` | working | 6787 | `a7ae96ec3ff6` |
 | `modules/chat_session_controller/risks.md` | working | 5986 | `fc08a72f2d0a` |
 | `modules/chat_session_controller/spec.md` | working | 5168 | `a1f2064ac215` |
-| `modules/cli/api.md` | working | 5128 | `3a2bee1158df` |
+| `modules/cli/api.md` | working | 5254 | `22c6dfd42b76` |
 | `modules/cli/inspection.md` | working | 2414 | `9199c6e04deb` |
 | `modules/cli/risks.md` | working | 1895 | `8620e45968f3` |
 | `modules/cli/spec.md` | working | 2010 | `e897ccd69471` |
@@ -550,13 +550,14 @@ Do not edit this file manually — regenerate instead.
 | `reviews/daily-driver-red-team-review-2026-06-02.md` | archive | 1128 | `6c888b373a62` |
 | `reviews/documentation-critical-questioning-2026-06-04.md` | archive | 6534 | `aa91faf505c8` |
 | `reviews/dogfood-g1-g22-2026-09-15-risk.md` | archive | 4163 | `34004ccff1fc` |
+| `reviews/dogfood-g23-g38-2026-09-16-risk.md` | archive | 5563 | `450338425f03` |
 | `reviews/dynamic-skill-critical-questioning-2026-06-05.md` | archive | 10579 | `7924fed20806` |
 | `reviews/efx-001-003-durable-effect-risk.md` | working | 4706 | `d095a036381a` |
 | `reviews/efx-001-003-implementation-contract-2026-08-25.md` | archive | 1343 | `bfd90d658ad6` |
 | `reviews/goals-instruments-2026-09-12-risk.md` | archive | 1639 | `fdecf57c92b6` |
 | `reviews/project-state-critical-questioning-2026-06-04.md` | archive | 7340 | `78b9b54c3a9c` |
 | `reviews/roadmap-intent-socratic-2026-09-09.md` | archive | 11911 | `57b215adbe19` |
-| `reviews/roadmap-rethink-2026-09-16.md` | archive | 27630 | `e7e640bcf0f1` |
+| `reviews/roadmap-rethink-2026-09-16.md` | archive | 28169 | `8c17b552efbc` |
 | `reviews/roadmaps-socratic-panel-2026-09-15-r10.md` | archive | 3861 | `e11b0872d78d` |
 | `reviews/roadmaps-socratic-panel-2026-09-15-r11.md` | archive | 1823 | `0a831c7afadf` |
 | `reviews/roadmaps-socratic-panel-2026-09-15-r12.md` | archive | 2308 | `790625d98890` |
@@ -577,8 +578,8 @@ Do not edit this file manually — regenerate instead.
 | `reviews/sec09-sec15-multisig-hardening-risk.md` | working | 11076 | `ae895567bb02` |
 | `reviews/security-risk-assessment-2026-06-02.md` | archive | 24112 | `4c9e2e00d001` |
 | `reviews/seven-control-loops-critical-questioning-2026-06-05.md` | archive | 7531 | `ae1e34b8369d` |
-| `roadmap-status.md` | constitution | 95823 | `8ac6c6ab9a70` |
-| `run-evidence-and-audit-guide.md` | working | 2158 | `9c369d008852` |
+| `roadmap-status.md` | constitution | 97149 | `a76ac5d2e31d` |
+| `run-evidence-and-audit-guide.md` | working | 2494 | `5ef9c11997d7` |
 | `security-whitepaper.md` | working | 9690 | `87fc3c31c4a3` |
 | `security/approval-abuse-cases-2026-06-02.md` | archive | 1281 | `4c43296d1c66` |
 | `security/audit-tamper-response.md` | working | 7972 | `1ab41b073195` |
@@ -652,14 +653,14 @@ Do not edit this file manually — regenerate instead.
 | `troubleshooting.md` | working | 9387 | `01d6fcbfc491` |
 | `tui-chat-reference.md` | working | 3298 | `1c849cfe634d` |
 | `tui-daily-driver-guide.md` | working | 3869 | `865f82d84d19` |
-| `USAGE.md` | working | 40389 | `c807e038ba57` |
+| `USAGE.md` | working | 40621 | `8f4f64381e25` |
 | `use-case-matrix.md` | working | 3807 | `7103bb3d6eee` |
 | `use-cases.md` | working | 19340 | `68eb4ba7da10` |
 | `ux-stability-contract.md` | working | 2238 | `1c5511e10ede` |
 | `wasm-skill-ci.md` | working | 974 | `8340d6f1e5c1` |
 | `work-log/adr-0031-2026-09-29-readiness-checklist.md` | archive | 2648 | `d6c389333f64` |
 | `work-log/documentation-optimization-work-items-2026-06-04.md` | archive | 11750 | `9233b40b0bce` |
-| `work-log/dogfood-findings-2026-09-15.md` | archive | 30769 | `48c38195eb08` |
+| `work-log/dogfood-findings-2026-09-15.md` | archive | 35616 | `693232372207` |
 | `work-log/fact-check-review-findings-2026-06-20.md` | archive | 3926 | `ee5ee658959e` |
 | `work-log/m4-approval-sliceB-blocked-2026-06-13.md` | archive | 7347 | `3981ed82bc08` |
 | `work-log/m4-budget-stays-inline-2026-06-13.md` | archive | 5727 | `0e7a6ee74954` |

docs/generated/release-docs-evidence.json

@@ -1,11 +1,11 @@
 {
   "ok": true,
-  "created_at": "2026-09-16T13:56:03+00:00",
+  "created_at": "2026-09-16T14:31:43+00:00",
   "repo_root": "/Users/teee/dev/teaagent",
   "git": {
     "branch": "main",
-    "commit": "96a4a8ccbdfa72d85fa8acccb0ce99ac6ec27232",
-    "dirty": false
+    "commit": "fb35805804e882caa3ba1a250a6a65b03b5d604b",
+    "dirty": true
   },
   "commands": [
     {
@@ -23,8 +23,11 @@
   ],
   "docs_freshness": {
     "scanned": 17,
-    "needs_attention": 0,
-    "by_owner": {},
+    "needs_attention": 2,
+    "by_owner": {
+      "daily-driver": 1,
+      "cli": 1
+    },
     "stale_threshold_days": 90
   },
   "roadmap_excerpt": {

docs/generated/release-docs-evidence.md

@@ -1,8 +1,8 @@
 # Release Documentation Evidence Bundle (Generated)
 
-**Generated:** 2026-09-16T13:56:03+00:00
-**Git commit:** `96a4a8ccbdfa72d85fa8acccb0ce99ac6ec27232` on `main`
-**Working tree dirty:** no
+**Generated:** 2026-09-16T14:31:43+00:00
+**Git commit:** `fb35805804e882caa3ba1a250a6a65b03b5d604b` on `main`
+**Working tree dirty:** yes
 
 Regenerate: `python3 scripts/build_release_docs_evidence_bundle.py`
 
@@ -21,8 +21,10 @@ Regenerate: `python3 scripts/build_release_docs_evidence_bundle.py`
 ## Documentation Freshness
 
 - Current-truth docs scanned: **17**
-- Needs attention: **0** (>90 days)
-- All scanned current-truth docs are fresh.
+- Needs attention: **2** (>90 days)
+- Stale by owner surface:
+  - `cli`: 1
+  - `daily-driver`: 1
 
 ## Roadmap Excerpt