@attalabs/vinaya 0.17.1 → 0.19.0

package/dist/index.js

@@ -15,6 +15,23 @@ function maskCode(body) {
 `).map((line) => replaceInlineSpans(line, (span) => " ".repeat(span.length))).join(`
 `);
 }
+var DETAILS_OPEN = /<details\b[^>]*>/gi;
+var DETAILS_CLOSE = /<\/details\s*>/gi;
+function maskDetailsBlocks(body) {
+  const fill = (line) => " ".repeat(line.length);
+  const lines = body.split(`
+`);
+  let depth = 0;
+  const out = lines.map((line) => {
+    const opens = line.match(DETAILS_OPEN)?.length ?? 0;
+    const closes = line.match(DETAILS_CLOSE)?.length ?? 0;
+    const maskThisLine = depth > 0 || opens > 0;
+    depth = Math.max(0, depth + opens - closes);
+    return maskThisLine ? fill(line) : line;
+  });
+  return out.join(`
+`);
+}
 function stripCode(body, options = {}) {
   const normalised = body.replace(/\r\n?/g, `
 `);
@@ -281,6 +298,9 @@ function entry(key) {
 function label(key) {
   return entry(key).id;
 }
+function trancheLabel(slug) {
+  return `${label("tranche")}${slug}`;
+}
 function matchesLabel(key, name) {
   const l = entry(key);
   if (l.form === "prefix")
@@ -1205,6 +1225,104 @@ function findDeadBranchPushes(facts) {
     latestCommitAt
   }));
 }
+// ../../packages/aeg-core/src/milestone-validation.ts
+var RELEASE_FIELD = /^\s*(?:\*\*)?Release(?:\*\*)?\s*:\s*(?:\*\*)?\s*(.+)$/im;
+var VALUE_EDGE_MARKUP2 = /^[`.;\s]+|[`.;\s]+$/g;
+function unwrapValue2(raw) {
+  return raw.replace(/\*\*/g, "").replace(VALUE_EDGE_MARKUP2, "");
+}
+var RELEASE_VALUE = /^v?\d+\.\d+\.\d+(?:-[0-9A-Za-z][0-9A-Za-z.-]*)?(?:\+[0-9A-Za-z][0-9A-Za-z.-]*)?$/;
+function pathText(body) {
+  return stripCode(body, { inlineSpans: "keep" });
+}
+function releaseFieldFromText(text) {
+  const m = text.match(RELEASE_FIELD);
+  if (!m)
+    return { declared: false, value: null };
+  const raw = unwrapValue2(m[1] ?? "");
+  return { declared: true, value: RELEASE_VALUE.test(raw) ? raw : null };
+}
+var INTENTS_HEADING = /^#{1,6}\s*Tranche intents\s*$/im;
+var NEXT_HEADING = /^#{1,6}\s+\S/m;
+var INTENT_BULLET = /^-\s+([a-z0-9][a-z0-9-]*)\s*:\s*(.+)$/i;
+function intentsBlock(text) {
+  const start = text.match(INTENTS_HEADING);
+  if (!start || start.index === undefined)
+    return null;
+  const rest = text.slice(start.index + start[0].length);
+  const next = rest.match(NEXT_HEADING);
+  const sectionEnd = next && next.index !== undefined ? next.index : rest.length;
+  return { start: start.index, end: start.index + start[0].length + sectionEnd, section: rest.slice(0, sectionEnd) };
+}
+function intentsSectionText(text) {
+  return intentsBlock(text)?.section ?? null;
+}
+function parseIntents(text) {
+  const section = intentsSectionText(text);
+  if (section === null)
+    return { intents: [], malformed: false };
+  const intents = [];
+  for (const line of section.split(`
+`)) {
+    const trimmed = line.trim();
+    if (trimmed.length === 0)
+      continue;
+    const m = trimmed.match(INTENT_BULLET);
+    if (!m)
+      return { intents: [], malformed: true };
+    intents.push({ slug: (m[1] ?? "").toLowerCase(), goal: (m[2] ?? "").trim() });
+  }
+  return { intents, malformed: false };
+}
+function goalRemainder(text) {
+  const withoutRelease = text.replace(RELEASE_FIELD, "");
+  const block = intentsBlock(withoutRelease);
+  const remainder = block ? withoutRelease.slice(0, block.start) + withoutRelease.slice(block.end) : withoutRelease;
+  return remainder.trim();
+}
+function checkMilestoneShape(body) {
+  const errors = [];
+  const text = pathText(body);
+  const release = releaseFieldFromText(text);
+  if (release.declared && release.value === null) {
+    errors.push("milestone-validation Release: the `Release:` field is present but is not a version — " + "write a semver value (e.g. `Release: 1.2.0`), or omit the field entirely for a milestone that declares no version.");
+  }
+  const { intents, malformed } = parseIntents(text);
+  if (malformed) {
+    errors.push("milestone-validation intents: the `### Tranche intents` section does not parse — every non-blank " + "line under it must read `- <slug>: <intent text>`.");
+  }
+  const goal = goalRemainder(text);
+  if (goal.length === 0) {
+    errors.push("milestone-validation goal: no goal text — a milestone description must carry prose beyond its " + "`Release:` field and `### Tranche intents` section.");
+  }
+  if (errors.length > 0)
+    return { status: "fail", errors };
+  return { status: "pass", goal, release: release.value, intents };
+}
+function checkAdoptable(facts) {
+  const errors = [];
+  if (!facts.target.exists) {
+    errors.push(`milestone-adopt target: Milestone "${facts.target.title}" does not exist — create it first with \`vinaya milestone create\`.`);
+  } else if (facts.target.state === "closed") {
+    errors.push(`milestone-adopt target: Milestone "${facts.target.title}" is closed — adopt requires an open target.`);
+  }
+  for (const s of facts.slugs) {
+    if (!s.labelExists) {
+      errors.push(`milestone-adopt unknown-slug: no \`vinaya/tranche:${s.slug}\` label exists in this repo.`);
+      continue;
+    }
+    if (s.issueNumbers.length === 0) {
+      errors.push(`milestone-adopt no-issues: \`vinaya/tranche:${s.slug}\` carries no Issues — nothing to adopt.`);
+      continue;
+    }
+    if (s.adoptedElsewhere.length > 0) {
+      errors.push(`milestone-adopt already-adopted: "${s.slug}" is already adopted into "${s.adoptedElsewhere.join('", "')}" — adopt it from there, not from here.`);
+    }
+  }
+  if (errors.length > 0)
+    return { status: "fail", errors };
+  return { status: "pass" };
+}
 // src/lib/detect.ts
 import { execFile as execFile4 } from "node:child_process";
 import { existsSync as existsSync4, readdirSync, readFileSync as readFileSync4, statSync } from "node:fs";
@@ -2025,18 +2143,6 @@ function buildInitOps(ctx) {
   ops.push({ kind: "print", message: CODEOWNERS_NOTE, group: "Branch protection (printed, never applied)" });
   return ops;
 }
-function buildInitProductOps(name) {
-  const safe = name.trim();
-  return [
-    {
-      kind: "create-label",
-      name: `project:${safe}`,
-      color: "0e8a16",
-      description: `Governed product area: ${safe}`,
-      group: `Governed product area: ${safe}`
-    }
-  ];
-}
 
 // src/lib/ops.ts
 import { execFileSync as execFileSync3 } from "node:child_process";
@@ -2129,7 +2235,8 @@ var BRIEF_BUILTINS = [
   "for",
   "closesN",
   "premiseCoverage",
-  "issueRationale"
+  "issueRationale",
+  "milestoneShape"
 ];
 var BriefSectionSchema = z.union([
   z.object({ builtin: z.enum(BRIEF_BUILTINS) }),
@@ -2139,7 +2246,9 @@ var BriefSectionSchema = z.union([
 ]);
 var BriefSchemaSchema = z.object({
   pr: z.object({ sections: z.array(BriefSectionSchema) }).optional(),
-  issue: z.object({ sections: z.array(BriefSectionSchema) }).optional()
+  issue: z.object({ sections: z.array(BriefSectionSchema) }).optional(),
+  milestone: z.object({ sections: z.array(BriefSectionSchema) }).optional(),
+  ack: z.array(z.enum(BRIEF_BUILTINS)).optional()
 });
 var MANAGED_MANIFEST_VERSION = 2;
 function isSafeRepoRelPath(p) {
@@ -2343,17 +2452,22 @@ ${end}`;
 function abs(repoRoot, relPath) {
   return join4(repoRoot, relPath);
 }
+var GIT_DIR_PREFIX = ".git/";
 function resolveManagedBlockPath(repoRoot, opPath) {
-  if (!opPath.startsWith(".git/"))
+  if (!opPath.startsWith(GIT_DIR_PREFIX))
     return join4(repoRoot, opPath);
+  return join4(gitCommonDir(repoRoot), opPath.slice(GIT_DIR_PREFIX.length));
+}
+function gitCommonDir(repoRoot) {
   try {
     const commonDir = execFileSync3("git", ["-C", repoRoot, "rev-parse", "--git-common-dir"], {
       encoding: "utf8"
     }).trim();
-    const gitDir = isAbsolute(commonDir) ? commonDir : join4(repoRoot, commonDir);
-    return join4(gitDir, opPath.slice(".git/".length));
+    if (commonDir === "")
+      return join4(repoRoot, ".git");
+    return isAbsolute(commonDir) ? commonDir : join4(repoRoot, commonDir);
   } catch {
-    return join4(repoRoot, opPath);
+    return join4(repoRoot, ".git");
   }
 }
 function containedAbs(repoRoot, relPath) {
@@ -2363,6 +2477,16 @@ function containedAbs(repoRoot, relPath) {
     return null;
   return target === root || target.startsWith(root + sep) ? target : null;
 }
+function containedManagedBlockAbs(repoRoot, relPath) {
+  if (!relPath.startsWith(GIT_DIR_PREFIX))
+    return containedAbs(repoRoot, relPath);
+  const commonDir = gitCommonDir(repoRoot);
+  const hooksRoot = resolve(join4(commonDir, "hooks"));
+  const target = resolve(join4(commonDir, relPath.slice(GIT_DIR_PREFIX.length)));
+  if (target === hooksRoot)
+    return null;
+  return target.startsWith(hooksRoot + sep) ? target : null;
+}
 function fileContains(repoRoot, relPath, needle) {
   const p = resolveManagedBlockPath(repoRoot, relPath);
   if (!existsSync3(p))
@@ -2583,7 +2707,7 @@ function planEject(manifest, repoRoot) {
   const actions = [];
   const escapes = [];
   for (const b of manifest.blocks) {
-    const p = containedAbs(repoRoot, b.path);
+    const p = containedManagedBlockAbs(repoRoot, b.path);
     if (p === null) {
       escapes.push(b.path);
       continue;
@@ -2648,7 +2772,7 @@ function applyEject(plan, repoRoot) {
     if (a.kind === "strip-block") {
       if (!a.present)
         continue;
-      const p = containedAbs(repoRoot, a.path);
+      const p = containedManagedBlockAbs(repoRoot, a.path);
       if (p === null)
         continue;
       const content = readFileSync3(p, "utf-8");
@@ -3037,6 +3161,14 @@ function parseTrancheArgs(args) {
   const slug = args.find((a) => !a.startsWith("--")) ?? null;
   return { slug, yes };
 }
+function trancheArchivalStatus(issues) {
+  if (issues.length === 0)
+    return { kind: "no-tranche" };
+  const openIssues = issues.filter((i) => i.state === "OPEN");
+  if (openIssues.length > 0)
+    return { kind: "open", openIssues };
+  return { kind: "complete" };
+}
 async function runArchiveTranche(args, deps) {
   const { slug, yes } = parseTrancheArgs(args);
   if (!slug) {
@@ -3053,23 +3185,39 @@ async function runArchiveTranche(args, deps) {
     return 1;
   }
   const repoFlag = `${repo.owner}/${repo.repo}`;
-  const milestones = shJson(["gh", "api", `repos/${repoFlag}/milestones?state=open&per_page=100`]);
-  const milestone = milestones.find((m) => m.title === slug);
-  if (!milestone) {
-    console.error(`Error: no open tranche milestone named '${slug}' found in ${repoFlag}.`);
-    return 1;
-  }
-  const openIssues = shJson([
+  const issues = shJson([
     "gh",
-    "api",
-    `repos/${repoFlag}/issues?milestone=${milestone.number}&state=open&per_page=100`
+    "issue",
+    "list",
+    "-R",
+    repoFlag,
+    "--label",
+    trancheLabel(slug),
+    "--state",
+    "all",
+    "--json",
+    "number,title,state",
+    "--limit",
+    "200"
   ]);
-  if (openIssues.length > 0) {
-    console.error(`Error: tranche '${slug}' still has ${openIssues.length} open task(s) — refusing to close:
-` + openIssues.map((i) => `  #${i.number} — ${i.title}`).join(`
+  const status = trancheArchivalStatus(issues);
+  if (status.kind === "no-tranche") {
+    console.error(`Error: no tranche found for '${slug}' in ${repoFlag} — no Issues carry ${trancheLabel(slug)}.`);
+    return 1;
+  }
+  if (status.kind === "open") {
+    console.error(`Error: tranche '${slug}' still has ${status.openIssues.length} open task(s) — refusing to close:
+` + status.openIssues.map((i) => `  #${i.number} — ${i.title}`).join(`
 `));
     return 1;
   }
+  const milestones = shJson(["gh", "api", `repos/${repoFlag}/milestones?state=open&per_page=100`]);
+  const milestone = milestones.find((m) => m.title === slug);
+  if (!milestone) {
+    process.stdout.write(`Tranche '${slug}' is complete (${issues.length} task(s), all closed) — no open Milestone to close.
+`);
+    return 0;
+  }
   if (!yes) {
     const ok = await promptYesNo(`Close tranche '${slug}' (Milestone #${milestone.number}, all tasks closed)?`, false);
     closeStdin();
@@ -4735,6 +4883,31 @@ function diagnoseBlastRadiusDeprecation(repoRoot, config) {
     warn("blast-radius", `${LEGACY_AEG_PACKAGES_PATH} is deprecated — checkBlastRadiusScope now derives packages/* domains live and ships built-in cross-cutting defaults. Declare anything beyond those in vinaya.config.json's blastRadius.extraDomains instead. ${migrationNote}`)
   ];
 }
+var BRIEF_KIND_LABEL = {
+  pr: "PR bodies",
+  issue: "task Issue bodies"
+};
+function builtinsIn(sections) {
+  return (sections ?? []).flatMap((s) => ("builtin" in s) ? [s.builtin] : []);
+}
+function diagnoseBriefSchemaDrift(config) {
+  if (!config)
+    return [];
+  const shipped = starterConfig().briefSchema;
+  const acked = new Set(config.briefSchema?.ack ?? []);
+  const findings = [];
+  for (const kind of ["pr", "issue"]) {
+    const expected = builtinsIn(shipped?.[kind]?.sections);
+    if (expected.length === 0)
+      continue;
+    const present = new Set(builtinsIn(config.briefSchema?.[kind]?.sections));
+    const missing = expected.filter((b) => !present.has(b) && !acked.has(b));
+    if (missing.length === 0)
+      continue;
+    findings.push(info("brief-schema", `briefSchema.${kind} is missing ${missing.length} builtin${missing.length === 1 ? "" : "s"} the shipped default declares for ${BRIEF_KIND_LABEL[kind]}: ${missing.join(", ")}. ` + "This is adopter-owned config — `vinaya upgrade` will never restore it, and nothing else reports it. " + "If the omission is deliberate, list those names in `briefSchema.ack` to silence this; if it was a workaround for a vinaya defect, check whether that defect is fixed and the builtin can come back."));
+  }
+  return findings;
+}
 function diagnoseEnvDeclarations(repoRoot, config) {
   const resolved = resolveChecks(coreCheckRegistry(), config?.checks).resolved;
   const specs = resolved.map((entry2) => entry2.source === "config" ? { ...entry2.spec, run: join9(repoRoot, entry2.spec.run) } : entry2.spec);
@@ -4893,6 +5066,7 @@ async function runDoctor(args, deps) {
     findings.push(...diagnoseDocOwnersHealth(repo.repoRoot));
   }
   findings.push(...diagnoseBlastRadiusDeprecation(repo.repoRoot, configRead.kind === "ok" ? configRead.config : null));
+  findings.push(...diagnoseBriefSchemaDrift(configRead.kind === "ok" ? configRead.config : null));
   findings.push(...diagnoseEnvDeclarations(repo.repoRoot, configRead.kind === "ok" ? configRead.config : null));
   findings.push(...diagnoseCheckClassification(configRead.kind === "ok" ? configRead.config : null));
   findings.push(...diagnoseGlobalConfigChecks());
@@ -5034,7 +5208,7 @@ async function runEject(args, deps) {
   const plan = planEject(read.manifest, repo.repoRoot);
   const unarm = read.manifest.blocks.some((b) => b.path.startsWith(`${TRACKED_HOOK_DIR}/`)) && await deps.readHooksPath(repo.repoRoot) === TRACKED_HOOK_DIR;
   if (plan.escapes.length > 0) {
-    console.error("Error: the ownership manifest records paths that resolve OUTSIDE this repo:");
+    console.error("Error: the ownership manifest records paths that resolve OUTSIDE the bounds vinaya may touch:");
     for (const p of plan.escapes)
       console.error(`  ${p}`);
     console.error("Refusing to remove anything. This manifest is corrupt or hand-edited — fix vinaya.config.json, then re-run.");
@@ -5315,17 +5489,9 @@ async function runInitProduct(args, deps) {
     console.error("Error: this repo is not Vinaya-initialized yet. Run `vinaya init` first.");
     return 1;
   }
-  const noRemote = !repo.owner || !repo.repo;
-  if (noRemote) {
-    console.warn("Warning: no `origin` remote (or it is not a GitHub URL) — skipping label creation. " + `Re-run 'vinaya init product ${name}' after adding a GitHub remote to create it.`);
-  }
-  const ops = noRemote ? [] : buildInitProductOps(name);
-  const plan = planInstall(ops, repo.repoRoot, new Set(existing.files));
   const registryPlan = planRegistryRow(repo.repoRoot, name, productPath, specsPath);
   process.stdout.write(`vinaya init product ${name} — the full diff:
 
-`);
-  process.stdout.write(`${renderInstallDiff(plan)}
 `);
   process.stdout.write(`── Project registry ─────────────────────────────
 `);
@@ -5346,29 +5512,11 @@ async function runInitProduct(args, deps) {
     }
   }
   applyRegistryRow(repo.repoRoot, registryPlan, name, productPath, specsPath);
-  const added = await applyInstall(plan, repo.repoRoot, deps.labelGateway(repo.repoRoot));
-  const merged = {
-    version: existing.version,
-    files: [...new Set([...existing.files, ...added.files])],
-    blocks: dedupeBlocks2([...existing.blocks, ...added.blocks]),
-    labels: [...new Set([...existing.labels, ...added.labels])]
-  };
-  writeManifest(repo.repoRoot, merged);
   process.stdout.write(`
 Governed product area '${name}' scaffolded.
 `);
   return 0;
 }
-function dedupeBlocks2(bs) {
-  const seen = new Set;
-  return bs.filter((b) => {
-    const k = `${b.path}::${b.marker}`;
-    if (seen.has(k))
-      return false;
-    seen.add(k);
-    return true;
-  });
-}
 async function initCommand(args) {
   process.exit(await runInit(args, realDeps5()));
 }
@@ -5496,7 +5644,11 @@ function runBuiltin(name, input) {
     for: () => checkForField(body),
     closesN: () => checkClosesN(body),
     premiseCoverage: () => checkPremiseCoverage(body, changedFiles2),
-    issueRationale: () => checkIssueRationale(body)
+    issueRationale: () => checkIssueRationale(body),
+    milestoneShape: () => {
+      const result = checkMilestoneShape(body);
+      return { errors: result.status === "fail" ? result.errors : [] };
+    }
   };
   return table[name]().errors;
 }
@@ -5514,7 +5666,8 @@ var BUILTIN_RECOVERY = {
   for: "Add a `For: <model + environment>` field to the body header block (before the first `##` heading), then re-run `{cmd}`.",
   closesN: "Add a `Closes #<N>` reference naming the task Issue to the body, then re-run `{cmd}`.",
   premiseCoverage: "Add a `Premise:` assertion whose path matches a file this change touches, then re-run `{cmd}`.",
-  issueRationale: "Add the missing Planner-rationale field named above (every task Issue carries all eight fields), then re-run `{cmd}`."
+  issueRationale: "Add the missing Planner-rationale field named above (every task Issue carries all eight fields), then re-run `{cmd}`.",
+  milestoneShape: "Fix the Milestone description as named above — a goal, an optional well-formed `Release:` field, and an optional parseable `### Tranche intents` section — then re-run `{cmd}`."
 };
 function escapeRegExp(literal) {
   return literal.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
@@ -5788,6 +5941,238 @@ function issueEditCommand(args) {
   runGhWrite(["issue", "edit", issueRef], ghArgs, bodyResult, json);
 }
 
+// src/commands/milestone.ts
+import { execFileSync as execFileSync11 } from "node:child_process";
+var RETRY_CREATE2 = "vinaya milestone create --title <title> --body-file <path>";
+var RETRY_ADOPT = "vinaya milestone adopt --target <title> --slug <slug> [--slug <slug> ...]";
+function sh3(args, input) {
+  return execFileSync11(args[0], args.slice(1), { encoding: "utf8", input, env: process.env }).trim();
+}
+function shJson2(args, input) {
+  return JSON.parse(sh3(args, input));
+}
+function ghErrorDetail(e) {
+  const stderr = e?.stderr;
+  const text = typeof stderr === "string" ? stderr : stderr?.toString();
+  return (text && text.trim().length > 0 ? text : e?.message ?? "unknown error").trim();
+}
+function locateBodyOrRefuse2(args) {
+  let result;
+  try {
+    result = locateBody(args);
+  } catch (e) {
+    if (e instanceof ForgeArgError) {
+      refuse([makeCheckError("forge-args", e.message, `Fix the invocation, then re-run \`${RETRY_CREATE2}\`.`)]);
+    }
+    throw e;
+  }
+  if (result === null) {
+    refuse([
+      makeCheckError("forge-args", "`vinaya milestone create` requires a `--body-file <path>` (or `--body <text>`) carrying the milestone description.", `Add \`--body-file <path>\`, then re-run \`${RETRY_CREATE2}\`.`)
+    ]);
+  }
+  return result;
+}
+async function milestoneCreateCommand(args) {
+  const json = args.includes("--json");
+  const validateOnly = args.includes("--validate-only");
+  const rest = args.filter((a) => a !== "--json" && a !== "--validate-only");
+  const title = extractTitle(rest);
+  if (!title) {
+    refuse([
+      makeCheckError("forge-args", "`vinaya milestone create` requires a `--title <title>` — the Milestone title is free text, never parsed for the version.", `Add \`--title <title>\`, then re-run \`${RETRY_CREATE2}\`.`)
+    ]);
+  }
+  const bodyResult = locateBodyOrRefuse2(rest);
+  const body = bodyResult.body;
+  const shape = checkMilestoneShape(body);
+  if (shape.status === "fail") {
+    refuse(shape.errors.map((message) => makeCheckError("milestone-shape", message, `Fix the Milestone description, then re-run \`${RETRY_CREATE2}\`.`)));
+  }
+  const sections = resolveSections("milestone", RETRY_CREATE2);
+  const schemaErrors = validateForgeWrite({ body, title: null, sections, changedFiles: [], retryCommand: RETRY_CREATE2 });
+  if (schemaErrors.length > 0)
+    refuse(schemaErrors);
+  if (validateOnly) {
+    if (json)
+      printJson({ validated: true, written: false, command: "milestone create" });
+    else
+      process.stdout.write(`✓ all brief-schema gates PASS — nothing written (--validate-only).
+`);
+    return;
+  }
+  const repo = await detectGitRepo();
+  if (!repo?.owner || !repo.repo) {
+    refuse([
+      makeCheckError("forge-fetch", "Could not resolve a GitHub owner/repo from the `origin` remote.", "Run this command from inside a git repository whose `origin` remote points at GitHub.")
+    ]);
+  }
+  const repoFlag = `${repo.owner}/${repo.repo}`;
+  let out;
+  try {
+    out = sh3(["gh", "api", `repos/${repoFlag}/milestones`, "--input", "-"], JSON.stringify({ title, description: body }));
+  } catch (e) {
+    refuse([
+      makeCheckError("forge-fetch", `\`gh api repos/${repoFlag}/milestones\` failed: ${ghErrorDetail(e)}`, `Check \`gh auth status\` and network, then re-run \`${RETRY_CREATE2}\`.`)
+    ]);
+  }
+  const created = JSON.parse(out);
+  if (json)
+    printJson({ validated: true, written: true, number: created.number, url: created.html_url });
+  else
+    process.stdout.write(`${created.html_url}
+`);
+}
+function extractTarget(args) {
+  for (let i = 0;i < args.length; i++) {
+    const a = args[i];
+    if (a === "--target" || a === "-m")
+      return args[i + 1] ?? null;
+    if (a.startsWith("--target="))
+      return a.slice("--target=".length);
+  }
+  return null;
+}
+function extractSlugs(args) {
+  const slugs = [];
+  for (let i = 0;i < args.length; i++) {
+    const a = args[i];
+    if (a === "--slug") {
+      const v = args[i + 1];
+      if (v)
+        slugs.push(v);
+    } else if (a.startsWith("--slug=")) {
+      slugs.push(a.slice("--slug=".length));
+    }
+  }
+  return slugs;
+}
+function ghJsonOrRefuse(args, what) {
+  try {
+    return shJson2(args);
+  } catch (e) {
+    refuse([
+      makeCheckError("forge-fetch", `could not fetch ${what} from the forge: ${ghErrorDetail(e)}`, `Check \`gh auth status\` and network, then re-run \`${RETRY_ADOPT}\`.`)
+    ]);
+  }
+}
+function fetchAdoptFacts(repoFlag, target, slugs) {
+  const labels = ghJsonOrRefuse(["gh", "api", `repos/${repoFlag}/labels?per_page=100`], "this repo's labels");
+  const milestones = ghJsonOrRefuse(["gh", "api", `repos/${repoFlag}/milestones?state=all&per_page=100`], "this repo's Milestones");
+  const targetMilestone = milestones.find((m) => m.title === target);
+  const targetFacts = {
+    title: target,
+    exists: !!targetMilestone,
+    state: targetMilestone?.state ?? null
+  };
+  const slugFacts = slugs.map((slug) => {
+    const labelExists = labels.some((l) => l.name === trancheLabel(slug));
+    const issues = labelExists ? ghJsonOrRefuse([
+      "gh",
+      "issue",
+      "list",
+      "-R",
+      repoFlag,
+      "--label",
+      trancheLabel(slug),
+      "--state",
+      "all",
+      "--json",
+      "number,state,milestone",
+      "--limit",
+      "200"
+    ], `Issues for \`${trancheLabel(slug)}\``) : [];
+    const elsewhere = new Set;
+    for (const issue of issues) {
+      const title = issue.milestone?.title;
+      if (title && title !== slug && title !== target)
+        elsewhere.add(title);
+    }
+    return {
+      slug,
+      labelExists,
+      issueNumbers: issues.map((i) => i.number),
+      adoptedElsewhere: [...elsewhere]
+    };
+  });
+  return { facts: { target: targetFacts, slugs: slugFacts }, milestones };
+}
+function failMidWrite(message) {
+  console.error(`
+[milestone adopt] PARTIAL WRITE — ${message}`);
+  console.error(`[milestone adopt] Re-running \`${RETRY_ADOPT}\` is safe — every write here is idempotent.`);
+  process.exit(1);
+}
+async function milestoneAdoptCommand(args) {
+  const json = args.includes("--json");
+  const validateOnly = args.includes("--validate-only");
+  const rest = args.filter((a) => a !== "--json" && a !== "--validate-only");
+  const target = extractTarget(rest);
+  if (!target) {
+    refuse([
+      makeCheckError("forge-args", "`vinaya milestone adopt` requires a `--target <title>` — the Milestone every named slug is adopted into.", `Add \`--target <title>\`, then re-run \`${RETRY_ADOPT}\`.`)
+    ]);
+  }
+  const slugs = extractSlugs(rest);
+  if (slugs.length === 0) {
+    refuse([
+      makeCheckError("forge-args", "`vinaya milestone adopt` requires at least one `--slug <slug>` — the tranche(s) to move into the target Milestone.", `Add one or more \`--slug <slug>\`, then re-run \`${RETRY_ADOPT}\`.`)
+    ]);
+  }
+  const repo = await detectGitRepo();
+  if (!repo?.owner || !repo.repo) {
+    refuse([
+      makeCheckError("forge-fetch", "Could not resolve a GitHub owner/repo from the `origin` remote.", "Run this command from inside a git repository whose `origin` remote points at GitHub.")
+    ]);
+  }
+  const repoFlag = `${repo.owner}/${repo.repo}`;
+  const { facts, milestones } = fetchAdoptFacts(repoFlag, target, slugs);
+  const verdict = checkAdoptable(facts);
+  if (verdict.status === "fail") {
+    refuse(verdict.errors.map((message) => makeCheckError("milestone-adopt", message, `Fix the input above, then re-run \`${RETRY_ADOPT}\`.`)));
+  }
+  if (validateOnly) {
+    if (json)
+      printJson({ validated: true, written: false, command: "milestone adopt" });
+    else
+      process.stdout.write(`✓ adopt is safe — nothing written (--validate-only).
+`);
+    return;
+  }
+  const adopted = [];
+  for (const slugFact of facts.slugs) {
+    for (const issueNumber of slugFact.issueNumbers) {
+      try {
+        sh3(["gh", "issue", "edit", String(issueNumber), "-R", repoFlag, "--milestone", target]);
+      } catch (e) {
+        failMidWrite(`failed to attach Issue #${issueNumber} (tranche \`${slugFact.slug}\`) to Milestone "${target}": ` + `${ghErrorDetail(e)}. Slugs already adopted this run: ${adopted.map((a) => a.slug).join(", ") || "(none)"}.`);
+      }
+    }
+    const legacy = milestones.find((m) => m.title === slugFact.slug && m.title !== target);
+    let closedMilestone = null;
+    if (legacy) {
+      closedMilestone = legacy.number;
+      if (legacy.state !== "closed") {
+        try {
+          sh3(["gh", "api", "-X", "PATCH", `repos/${repoFlag}/milestones/${legacy.number}`, "-f", "state=closed"]);
+        } catch (e) {
+          failMidWrite(`attached tranche \`${slugFact.slug}\`'s Issue(s) to Milestone "${target}", but failed to close its old ` + `Milestone #${legacy.number}: ${ghErrorDetail(e)}. Slugs already adopted this run: ` + `${adopted.map((a) => a.slug).join(", ") || "(none)"}.`);
+        }
+      }
+    }
+    adopted.push({ slug: slugFact.slug, issueCount: slugFact.issueNumbers.length, closedMilestone });
+  }
+  if (json)
+    printJson({ validated: true, written: true, target, adopted });
+  else {
+    for (const a of adopted) {
+      const closedNote = a.closedMilestone ? ` (old Milestone #${a.closedMilestone} closed)` : "";
+      process.stdout.write(`${a.slug}: ${a.issueCount} Issue(s) → "${target}"${closedNote}
+`);
+    }
+  }
+}
+
 // src/commands/new-check.ts
 import { chmodSync as chmodSync2, existsSync as existsSync14, mkdirSync as mkdirSync4, readFileSync as readFileSync14, writeFileSync as writeFileSync7 } from "node:fs";
 import { join as join15 } from "node:path";
@@ -5832,12 +6217,205 @@ ${registration}
 }
 
 // src/commands/pr.ts
-import { execFileSync as execFileSync11 } from "node:child_process";
-var RETRY_CREATE2 = "vinaya pr create --validate-only …";
+import { execFileSync as execFileSync12 } from "node:child_process";
+
+// src/checks/body-bare-digits-logic.ts
+function blankRange(text, start, end) {
+  const region = text.slice(start, end);
+  return text.slice(0, start) + region.replace(/[^\n]/g, " ") + text.slice(end);
+}
+var EXEMPT_ANCHOR_FIELDS = ["CLOSES", "TIER", "PROJECT", "EVIDENCE"];
+var FIELD_SECTION_HEADING = {
+  CLOSES: null,
+  PROJECT: null,
+  TIER: /^scope$/i,
+  EVIDENCE: /^evidence$/i
+};
+var HEADING = /^#{1,6}\s/;
+var HEADING_TEXT = /^#{1,6}\s+(.*?)\s*$/;
+function headerBlockEnd(body) {
+  const lines = body.split(`
+`);
+  let offset = 0;
+  for (const line of lines) {
+    if (HEADING.test(line))
+      return offset;
+    offset += line.length + 1;
+  }
+  return body.length;
+}
+function namedSectionBounds(body, namePattern) {
+  const lines = body.split(`
+`);
+  let offset = 0;
+  let start = -1;
+  let end = body.length;
+  for (const line of lines) {
+    const headingText = HEADING_TEXT.exec(line);
+    if (start === -1 && headingText && namePattern.test(headingText[1])) {
+      start = offset;
+    } else if (start !== -1 && HEADING.test(line)) {
+      end = offset;
+      break;
+    }
+    offset += line.length + 1;
+  }
+  return start === -1 ? null : { start, end };
+}
+function isInCanonicalSection(body, field, outerStart) {
+  const pattern = FIELD_SECTION_HEADING[field];
+  if (pattern === null)
+    return outerStart < headerBlockEnd(body);
+  const bounds = namedSectionBounds(body, pattern);
+  return bounds !== null && outerStart >= bounds.start && outerStart < bounds.end;
+}
+var PROJECT_LABEL = /^\s*(?:\*\*)?Project(?:\(s\))?(?:\*\*)?\s*:\s*(?:\*\*)?/i;
+var FIELD_CONTENT_SIGNATURE = {
+  CLOSES: /Closes\s*#\d+/i,
+  PROJECT: PROJECT_LABEL,
+  TIER: TIER_FIELD,
+  EVIDENCE: /^Head:\s*\S/m
+};
+function blankAnchoredRegions(body) {
+  let masked = body;
+  for (const field of EXEMPT_ANCHOR_FIELDS) {
+    const bounds = anchoredRegionBounds(body, field);
+    if (!bounds || !isInCanonicalSection(body, field, bounds.outerStart))
+      continue;
+    const content = body.slice(bounds.innerStart, bounds.innerEnd);
+    if (!FIELD_CONTENT_SIGNATURE[field].test(content))
+      continue;
+    masked = blankRange(masked, bounds.outerStart, bounds.innerStart);
+    masked = blankRange(masked, bounds.innerEnd, bounds.outerEnd);
+    const blankedContent = content.split(`
+`).map(BOUNDED_ANCHOR_BLANK[field]).join(`
+`);
+    masked = masked.slice(0, bounds.innerStart) + blankedContent + masked.slice(bounds.innerEnd);
+  }
+  return masked;
+}
+function blankTokenReportSection(body) {
+  const lines = body.split(`
+`);
+  const HEADING2 = /^#{1,6}\s/;
+  const TOKEN_REPORT_HEADING = /^#{1,6}\s*token report\s*$/i;
+  const startIdx = lines.findIndex((l) => TOKEN_REPORT_HEADING.test(l));
+  if (startIdx === -1)
+    return body;
+  let endIdx = lines.length;
+  for (let i = startIdx + 1;i < lines.length; i++) {
+    if (HEADING2.test(lines[i])) {
+      endIdx = i;
+      break;
+    }
+  }
+  const fill = (line) => " ".repeat(line.length);
+  for (let i = startIdx;i < endIdx; i++)
+    lines[i] = fill(lines[i]);
+  return lines.join(`
+`);
+}
+function blankTierField(line) {
+  const m = TIER_FIELD.exec(line);
+  if (!m)
+    return line;
+  return line.slice(0, m.index) + " ".repeat(m[0].length) + line.slice(m.index + m[0].length);
+}
+var SEGMENT_HAS_DIGIT = /\p{Nd}/u;
+function blankProjectField(line) {
+  const label2 = PROJECT_LABEL.exec(line);
+  if (!label2)
+    return line;
+  const valueStart = label2.index + label2[0].length;
+  const segments = line.slice(valueStart).split(",");
+  const blanked = segments.map((seg) => {
+    const name = unwrapValue(seg);
+    const isRealName = PROJECT_SLUG.test(name) && !SEGMENT_HAS_DIGIT.test(name);
+    return isRealName ? " ".repeat(seg.length) : seg;
+  });
+  return line.slice(0, valueStart) + blanked.join(",");
+}
+function blankUnanchoredStructuralFields(body) {
+  return body.split(`
+`).map((l) => blankProjectField(blankTierField(l))).join(`
+`);
+}
+var CLOSES_REF = /Closes\s*#\d+/i;
+var EVIDENCE_HEADING = /^#{1,6}\s/;
+var EVIDENCE_HEAD_LINE = /^Head:\s*\S+$/i;
+function blankClosesField(line) {
+  const m = CLOSES_REF.exec(line);
+  if (!m)
+    return line;
+  return line.slice(0, m.index) + " ".repeat(m[0].length) + line.slice(m.index + m[0].length);
+}
+function blankEvidenceField(line) {
+  const trimmed = line.trim();
+  if (trimmed === "" || EVIDENCE_HEAD_LINE.test(trimmed) || EVIDENCE_HEADING.test(trimmed))
+    return " ".repeat(line.length);
+  return line;
+}
+var BOUNDED_ANCHOR_BLANK = {
+  CLOSES: blankClosesField,
+  TIER: blankTierField,
+  PROJECT: blankProjectField,
+  EVIDENCE: blankEvidenceField
+};
+function buildScanMask(body) {
+  let masked = maskDetailsBlocks(maskCode(body));
+  masked = blankAnchoredRegions(masked);
+  masked = blankTokenReportSection(masked);
+  masked = blankUnanchoredStructuralFields(masked);
+  return masked;
+}
+var TOKEN_WITH_DIGIT = /\S*\p{Nd}\S*/gu;
+var LIST_MARKER_TOKEN = /^\p{Nd}{1,9}[.)]$/u;
+var ZERO_WIDTH = /[\u200B-\u200D\u2060\uFEFF]/g;
+var HTML_ENTITIES = {
+  "&quot;": '"',
+  "&apos;": "'",
+  "&lt;": "<",
+  "&gt;": ">",
+  "&amp;": "&"
+};
+function decodeNamedEntities(body) {
+  return body.replace(/&(?:quot|apos|lt|gt|amp);/g, (m) => HTML_ENTITIES[m] ?? m);
+}
+function isLineLeadingListMarker(line, matchStart, rawToken) {
+  if (!LIST_MARKER_TOKEN.test(rawToken))
+    return false;
+  const before = line.slice(0, matchStart);
+  return /^ {0,3}$/.test(before);
+}
+function checkBareDigits(rawBody) {
+  const body = decodeNamedEntities(rawBody.replace(ZERO_WIDTH, ""));
+  const masked = buildScanMask(body);
+  const maskedLines = masked.split(`
+`);
+  const origLines = body.split(`
+`);
+  const violations = [];
+  for (let i = 0;i < maskedLines.length; i++) {
+    const maskedLine = maskedLines[i];
+    const origLine = origLines[i];
+    TOKEN_WITH_DIGIT.lastIndex = 0;
+    let m;
+    while ((m = TOKEN_WITH_DIGIT.exec(maskedLine)) !== null) {
+      const rawToken = origLine.slice(m.index, m.index + m[0].length);
+      if (isLineLeadingListMarker(maskedLine, m.index, rawToken))
+        continue;
+      violations.push({ line: i + 1, text: origLine.trim() });
+    }
+  }
+  return { violations };
+}
+
+// src/commands/pr.ts
+var RETRY_CREATE3 = "vinaya pr create --validate-only …";
 var RETRY_EDIT2 = "vinaya pr edit <n> --validate-only …";
 function git3(args) {
   try {
-    return execFileSync11("git", args, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+    return execFileSync12("git", args, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
   } catch {
     return "";
   }
@@ -5850,7 +6428,7 @@ function localChangedFiles() {
   return out.split(`
 `).map((s) => s.trim()).filter(Boolean);
 }
-function locateBodyOrRefuse2(ghArgs, retryCommand) {
+function locateBodyOrRefuse3(ghArgs, retryCommand) {
   try {
     return locateBody(ghArgs);
   } catch (e) {
@@ -5871,7 +6449,7 @@ function reportPass2(json, command) {
 function runGhWrite2(ghCmd, ghArgs, bodyResult, json) {
   const { finalArgs, cleanup: cleanup2 } = resolveShippableArgs(ghArgs, bodyResult);
   try {
-    const out = execFileSync11("gh", [...ghCmd, ...finalArgs], { encoding: "utf8", stdio: ["ignore", "pipe", "inherit"] });
+    const out = execFileSync12("gh", [...ghCmd, ...finalArgs], { encoding: "utf8", stdio: ["ignore", "pipe", "inherit"] });
     const url = out.trim();
     if (json)
       printJson({ validated: true, written: true, url });
@@ -5885,7 +6463,7 @@ function runGhWrite2(ghCmd, ghArgs, bodyResult, json) {
 function fetchPrForgeContext(prRef) {
   let viewOut;
   try {
-    viewOut = execFileSync11("gh", ["pr", "view", prRef, "--json", "headRefName,files"], {
+    viewOut = execFileSync12("gh", ["pr", "view", prRef, "--json", "headRefName,files"], {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "pipe"]
     });
@@ -5910,19 +6488,25 @@ function fetchPrForgeContext(prRef) {
   const changedFiles2 = (parsed.files ?? []).map((f) => f.path);
   return { changedFiles: changedFiles2, branch: parsed.headRefName ?? "" };
 }
+function refuseOnBareDigits(body, retryCommand) {
+  const { violations } = checkBareDigits(body);
+  if (violations.length === 0)
+    return;
+  refuse(violations.map((v) => makeCheckError("body-bare-digits", `body-bare-digits: bare digit outside a fenced block, line ${v.line}: ${v.text}`, `Backtick the digit, move it into a fenced block, or state it as a symbol, then re-run \`${retryCommand}\`.`)));
+}
 function prCreateCommand(args) {
   const json = args.includes("--json");
   const validateOnly = args.includes("--validate-only");
   const ghArgs = args.filter((a) => a !== "--json" && a !== "--validate-only");
-  const bodyResult = locateBodyOrRefuse2(ghArgs, RETRY_CREATE2);
+  const bodyResult = locateBodyOrRefuse3(ghArgs, RETRY_CREATE3);
   const body = bodyResult?.body ?? null;
   const title = extractTitle(ghArgs);
   if (body === null) {
     refuse([
-      makeCheckError("forge-args", "No `--body-file <path>` (or `--body`) argument found — the brief-schema gate needs the PR body to validate it.", `Add \`--body-file <path>\` (or \`--body\`), then re-run \`${RETRY_CREATE2}\`.`)
+      makeCheckError("forge-args", "No `--body-file <path>` (or `--body`) argument found — the brief-schema gate needs the PR body to validate it.", `Add \`--body-file <path>\` (or \`--body\`), then re-run \`${RETRY_CREATE3}\`.`)
     ]);
   }
-  const sections = resolveSections("pr", RETRY_CREATE2);
+  const sections = resolveSections("pr", RETRY_CREATE3);
   const changedFiles2 = localChangedFiles();
   const headCommit = git3(["rev-parse", "--verify", "--quiet", "HEAD"]);
   const branch = headCommit === "" ? "" : git3(["symbolic-ref", "--quiet", "--short", "HEAD"]);
@@ -5931,11 +6515,12 @@ function prCreateCommand(args) {
     title,
     sections,
     changedFiles: changedFiles2,
-    retryCommand: RETRY_CREATE2,
+    retryCommand: RETRY_CREATE3,
     branch
   });
   if (errors.length > 0)
     refuse(errors);
+  refuseOnBareDigits(body, RETRY_CREATE3);
   if (validateOnly) {
     reportPass2(json, "pr create");
     return;
@@ -5953,7 +6538,7 @@ function prEditCommand(args) {
     ]);
   }
   const ghArgs = rest.slice(1);
-  const bodyResult = locateBodyOrRefuse2(ghArgs, RETRY_EDIT2);
+  const bodyResult = locateBodyOrRefuse3(ghArgs, RETRY_EDIT2);
   const body = bodyResult?.body ?? null;
   const title = extractTitle(ghArgs);
   if (body === null && title === null) {
@@ -5979,6 +6564,8 @@ function prEditCommand(args) {
   });
   if (errors.length > 0)
     refuse(errors);
+  if (body !== null)
+    refuseOnBareDigits(body, RETRY_EDIT2);
   if (validateOnly) {
     reportPass2(json, "pr edit");
     return;
@@ -5987,14 +6574,14 @@ function prEditCommand(args) {
 }
 
 // src/commands/pr-report.ts
-import { execFileSync as execFileSync12, spawnSync as spawnSync2 } from "node:child_process";
+import { execFileSync as execFileSync13, spawnSync as spawnSync2 } from "node:child_process";
 import { existsSync as existsSync15, readFileSync as readFileSync15, writeFileSync as writeFileSync8 } from "node:fs";
 import { join as join16 } from "node:path";
 var EVIDENCE_START = "<!-- AEG:EVIDENCE:START -->";
 var EVIDENCE_END = "<!-- AEG:EVIDENCE:END -->";
 function git4(args) {
   try {
-    return execFileSync12("git", args, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+    return execFileSync13("git", args, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
   } catch {
     return "";
   }
@@ -6012,7 +6599,7 @@ class GitCommandError extends Error {
 }
 function gitStrict(args) {
   try {
-    return execFileSync12("git", args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
+    return execFileSync13("git", args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
   } catch (err) {
     const stderr = err.stderr;
     throw new GitCommandError(args, String(stderr ?? err.message).trim() || "non-zero exit");
@@ -6166,7 +6753,7 @@ async function prReportCommand(args) {
 }
 
 // src/commands/quickstart.ts
-import { execFileSync as execFileSync13 } from "node:child_process";
+import { execFileSync as execFileSync14 } from "node:child_process";
 import { existsSync as existsSync17, readFileSync as readFileSync17 } from "node:fs";
 import { join as join18 } from "node:path";
 
@@ -6362,7 +6949,7 @@ function realDeps6() {
   };
 }
 function execGit(repoRoot2, args) {
-  return execFileSync13("git", args, { cwd: repoRoot2, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
+  return execFileSync14("git", args, { cwd: repoRoot2, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
 }
 function errorDetail(err) {
   const stderr = err.stderr;
@@ -6479,7 +7066,7 @@ async function quickstartCommand(args) {
 }
 
 // src/commands/review-post.ts
-import { execFileSync as execFileSync14 } from "node:child_process";
+import { execFileSync as execFileSync15 } from "node:child_process";
 import { readFileSync as readFileSync18, rmSync as rmSync4, writeFileSync as writeFileSync10 } from "node:fs";
 import { tmpdir as tmpdir2 } from "node:os";
 import { join as join19 } from "node:path";
@@ -6609,15 +7196,22 @@ function parseFlags(args) {
   const map = new Map;
   for (let i = 0;i < args.length; i++) {
     const a = args[i];
-    if (a.startsWith("--")) {
-      const value = args[i + 1];
-      if (value === undefined || value.startsWith("--")) {
-        map.set(a, "");
-        continue;
-      }
-      map.set(a, value);
-      i++;
+    if (a === "--")
+      break;
+    if (!a.startsWith("--"))
+      continue;
+    const eq = a.indexOf("=");
+    if (eq > 2) {
+      map.set(a.slice(0, eq), a.slice(eq + 1));
+      continue;
     }
+    const value = args[i + 1];
+    if (value === undefined || value.startsWith("--")) {
+      map.set(a, "");
+      continue;
+    }
+    map.set(a, value);
+    i++;
   }
   return map;
 }
@@ -6639,6 +7233,11 @@ function requireTokenField(flags2, name) {
   return v;
 }
 function readFindingsFile(path, allowedSeverities) {
+  if (path === undefined)
+    return [];
+  if (path.trim() === "") {
+    refuseCmd("`--findings-file` was given with no path.", "Pass the path to the findings file, or omit the flag entirely if there are no findings.");
+  }
   if (!path)
     return [];
   let content;
@@ -6674,7 +7273,7 @@ function normalizeSecurityVerdict(raw) {
 }
 function gh(args) {
   try {
-    return execFileSync14("gh", args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
+    return execFileSync15("gh", args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
   } catch (err) {
     const stderr = err.stderr;
     throw new Error(String(stderr ?? err.message).trim() || "gh command failed");
@@ -6708,9 +7307,61 @@ function fetchComments(pr) {
   const parsed = JSON.parse(out);
   return parsed.comments.map((c) => ({ body: c.body, author: c.author?.login ?? null }));
 }
+var VALUE_FLAGS = [
+  "--brief-conformance",
+  "--config-scan",
+  "--cost",
+  "--docs",
+  "--findings-file",
+  "--model",
+  "--pr",
+  "--role",
+  "--scope",
+  "--secrets",
+  "--secrets-evidence-file",
+  "--spec-conformance",
+  "--task-id",
+  "--tests",
+  "--tokens-in",
+  "--tokens-out",
+  "--verdict"
+];
+var NULLARY_FLAGS = ["--json"];
+function unknownFlags(args, known = [...VALUE_FLAGS, ...NULLARY_FLAGS]) {
+  const out = [];
+  for (let i = 0;i < args.length; i++) {
+    const a = args[i];
+    if (known.includes(a) && !NULLARY_FLAGS.includes(a)) {
+      const next = args[i + 1];
+      if (next !== undefined && !next.startsWith("--"))
+        i++;
+      continue;
+    }
+    if (a === "--")
+      break;
+    const looksLikeFlag = a.startsWith("--") || a.startsWith("-") && a.length > 1;
+    if (!looksLikeFlag)
+      continue;
+    const name = a.split("=")[0];
+    if (!known.includes(name)) {
+      out.push(name);
+      continue;
+    }
+    if (NULLARY_FLAGS.includes(name) && a.includes("="))
+      out.push(name);
+  }
+  return out;
+}
+function rejectUnknownFlags(args, known = [...VALUE_FLAGS, ...NULLARY_FLAGS]) {
+  const unknown = unknownFlags(args, known);
+  if (unknown.length === 0)
+    return;
+  refuseCmd(`unrecognised flag${unknown.length > 1 ? "s" : ""}: ${unknown.join(", ")}.`, `\`vinaya review post\` accepts: ${[...known].sort().join(", ")}. If you meant to preview without posting, note that this command has no dry-run flag — see atta-labs/vinaya#184.`);
+}
 async function reviewPostCommand(args) {
+  rejectUnknownFlags(args);
   const json = args.includes("--json");
-  const flags2 = parseFlags(args.filter((a) => a !== "--json"));
+  const flags2 = parseFlags(args.filter((a) => !NULLARY_FLAGS.includes(a)));
   const role = flags2.get("--role");
   if (role !== "code-reviewer" && role !== "security") {
     refuseCmd(`\`--role ${role ?? "(missing)"}\` is not \`code-reviewer\` or \`security\`.`, "Pass `--role code-reviewer` or `--role security`.");
@@ -6815,6 +7466,43 @@ function execFileForRepo(cwd) {
 }
 var PRIMARY_PORT = 3008;
 var FALLBACK_PORT = 3108;
+function parsePortFlag(args) {
+  const found = [];
+  for (let k = 0;k < args.length; k++) {
+    const a = args[k];
+    if (a === "--port") {
+      const raw2 = args[k + 1];
+      if (raw2 === undefined)
+        throw new PortFlagError("`--port` requires a port number.");
+      if (raw2.startsWith("-")) {
+        throw new PortFlagError(`\`--port ${raw2}\` is not a port number — a port is a positive integer.`);
+      }
+      found.push(raw2);
+      k++;
+    } else if (a.startsWith("--port=")) {
+      found.push(a.slice("--port=".length));
+    }
+  }
+  if (found.length === 0)
+    return null;
+  if (found.length > 1 && new Set(found).size > 1) {
+    throw new PortFlagError(`\`--port\` given more than once with different values (${found.join(", ")}).`);
+  }
+  const raw = found[0];
+  if (raw === "")
+    throw new PortFlagError("`--port` requires a port number.");
+  if (!/^[0-9]+$/.test(raw))
+    throw new PortFlagError(`\`--port ${raw}\` is not a port number.`);
+  if (raw.length > 1 && raw.startsWith("0"))
+    throw new PortFlagError(`\`--port ${raw}\` has a leading zero — write the port without it.`);
+  const port = Number(raw);
+  if (port < 1 || port > 65535)
+    throw new PortFlagError(`\`--port ${raw}\` is outside the valid range 1-65535.`);
+  return port;
+}
+
+class PortFlagError extends Error {
+}
 function resolveStudioTarget(cwd, moduleUrl = import.meta.url) {
   let dir = cwd;
   for (;; ) {
@@ -6862,13 +7550,22 @@ function ensureStudioNodeModules(bundleRoot) {
     renameSync(packed, real);
   }
 }
-async function spawnStandalone(cwd, serverPath, bundleRoot) {
+async function spawnStandalone(cwd, serverPath, bundleRoot, explicitPort) {
   ensureStudioNodeModules(bundleRoot);
   const repo = await resolveRepo(() => execFileForRepo(cwd));
-  const primaryFree = await isPortFree(PRIMARY_PORT);
-  const port = primaryFree ? PRIMARY_PORT : FALLBACK_PORT;
-  if (!primaryFree) {
-    console.info(`[studio] port ${PRIMARY_PORT} is taken — falling back to ${FALLBACK_PORT}`);
+  let port;
+  if (explicitPort !== null) {
+    if (!await isPortFree(explicitPort)) {
+      console.error(`[studio] port ${explicitPort} is taken, and \`--port\` was given explicitly — refusing to bind elsewhere.`);
+      return 1;
+    }
+    port = explicitPort;
+  } else {
+    const primaryFree = await isPortFree(PRIMARY_PORT);
+    port = primaryFree ? PRIMARY_PORT : FALLBACK_PORT;
+    if (!primaryFree) {
+      console.info(`[studio] port ${PRIMARY_PORT} is taken — falling back to ${FALLBACK_PORT}`);
+    }
   }
   const env = { HOSTNAME: "127.0.0.1", ...process.env, PORT: String(port), VINAYA_REPO_ROOT: cwd };
   if (repo)
@@ -6879,13 +7576,27 @@ async function spawnStandalone(cwd, serverPath, bundleRoot) {
   });
 }
 async function runStudio(cwd, args, moduleUrl = import.meta.url) {
+  let explicitPort;
+  try {
+    explicitPort = parsePortFlag(args);
+  } catch (err) {
+    if (err instanceof PortFlagError) {
+      console.error(`[studio] ${err.message}`);
+      return 2;
+    }
+    throw err;
+  }
   const target = resolveStudioTarget(cwd, moduleUrl);
   switch (target.kind) {
     case "workspace":
+      if (explicitPort !== null) {
+        console.error(`[studio] \`--port ${explicitPort}\` cannot apply here: this is a workspace checkout, and Studio's own dev script chooses the port. Set it there, or run against a published install.`);
+        return 2;
+      }
       return spawnDev(target.webDir, args);
     case "package": {
       const bundleRoot = join20(target.packageDir, "..", "..", "..");
-      return spawnStandalone(cwd, join20(target.packageDir, "server.js"), bundleRoot);
+      return spawnStandalone(cwd, join20(target.packageDir, "server.js"), bundleRoot, explicitPort);
     }
     case "missing":
       console.error("Vinaya Studio isn't available in this install — no published @attalabs/vinaya build bundles the Studio app yet. Inside a checkout that contains Studio's source (apps/vinaya-studio/web), `vinaya studio` runs it directly.");
@@ -7000,6 +7711,10 @@ function translateHookPaths(manifest) {
     blocks: manifest.blocks.map((b) => b.path.startsWith(".git/hooks/") ? { ...b, path: `${TRACKED_HOOK_DIR}/${b.path.slice(".git/hooks/".length)}` } : b)
   };
 }
+function extractWorkflowTrigger(content) {
+  const match = content.match(/^on:\r?\n {2}([A-Za-z0-9_]+):/m);
+  return match?.[1] ?? null;
+}
 function planUpgrade(ops, repoRoot2, manifest, routing) {
   const entries = [];
   let hasChanges = routing.arm || routing.migratesManifest || routing.strips.some((s) => s.present);
@@ -7012,6 +7727,7 @@ function planUpgrade(ops, repoRoot2, manifest, routing) {
       const exists = existsSync19(abs2);
       const owned = ownedFiles.has(op.path);
       let action;
+      let triggerChange;
       if (op.path === CONFIG_PATH || op.path === DOC_OWNERS_PATH) {
         action = "keep";
       } else if (!owned) {
@@ -7019,13 +7735,22 @@ function planUpgrade(ops, repoRoot2, manifest, routing) {
       } else if (!exists) {
         action = "recreate";
         hasChanges = true;
-      } else if (readFileSync20(abs2, "utf-8") !== op.content) {
-        action = "regenerate";
-        hasChanges = true;
       } else {
-        action = "current";
+        const diskContent = readFileSync20(abs2, "utf-8");
+        if (diskContent !== op.content) {
+          action = "regenerate";
+          hasChanges = true;
+          if (op.path.startsWith(".github/workflows/")) {
+            const from = extractWorkflowTrigger(diskContent);
+            const to = extractWorkflowTrigger(op.content);
+            if (from && to && from !== to)
+              triggerChange = { from, to };
+          }
+        } else {
+          action = "current";
+        }
       }
-      entries.push({ kind: "create-file", op, action });
+      entries.push({ kind: "create-file", op, action, ...triggerChange ? { triggerChange } : {} });
     } else if (op.kind === "managed-block") {
       const abs2 = resolveManagedBlockPath(repoRoot2, op.path);
       const owned = ownedBlocks.has(blockKey(op.path, op.marker));
@@ -7090,6 +7815,12 @@ function renderUpgradeDiff(plan) {
         case "regenerate":
           lines.push(`  ~ regenerate ${e.op.path}`);
           lines.push(indent(e.op.content));
+          if (e.triggerChange) {
+            lines.push("");
+            lines.push(`  ⚠ TRIGGER CHANGE: ${e.op.path} is moving from \`${e.triggerChange.from}\` to ` + `\`${e.triggerChange.to}\`.`);
+            lines.push("     GitHub evaluates a `pull_request` trigger from the pull request branch's own copy of the " + "workflow file, but a `pull_request_target` trigger from the copy on the BASE branch — never " + "the pull request branch's. The pull request that carries this exact change matches NEITHER: " + "as `pull_request` it no longer matches (the pull request branch now declares " + "`pull_request_target`), and as `pull_request_target` the base branch still declares the old " + "trigger until this pull request merges. No workflow run fires under either event, so this " + "file's required check-run never appears for this pull request — not failing, not pending, " + "simply absent — and a ruleset or branch-protection rule that requires it will block this pull " + "request from merging through the normal flow.");
+            lines.push("     To get this pull request merged: temporarily add a ruleset bypass actor (or, under classic " + "branch protection, a temporary admin override) for the merge, then remove it once this pull " + "request is in.");
+          }
           break;
         case "recreate":
           lines.push(`  + recreate   ${e.op.path} (recorded as owned but missing on disk)`);
@@ -7254,12 +7985,12 @@ async function upgradeCommand(args) {
 }
 
 // src/commands/waiver.ts
-import { execFileSync as execFileSync15 } from "node:child_process";
+import { execFileSync as execFileSync16 } from "node:child_process";
 function labelFor(kind) {
   return kind === "docs" ? WAIVER_LABEL : WAIVER_LABEL_REVIEW;
 }
 function gh2(args) {
-  return execFileSync15("gh", args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], env: process.env }).trim();
+  return execFileSync16("gh", args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], env: process.env }).trim();
 }
 function detectPrNumber() {
   try {
@@ -7269,15 +8000,15 @@ function detectPrNumber() {
     return null;
   }
 }
-var VALUE_FLAGS = ["--reason"];
+var VALUE_FLAGS2 = ["--reason"];
 var BOOLEAN_FLAGS = ["--print-only"];
 function positionalArgs(args) {
   const result = [];
   for (let i = 0;i < args.length; i++) {
     const a = args[i];
-    if (VALUE_FLAGS.some((f) => a.startsWith(`${f}=`)))
+    if (VALUE_FLAGS2.some((f) => a.startsWith(`${f}=`)))
       continue;
-    if (VALUE_FLAGS.includes(a)) {
+    if (VALUE_FLAGS2.includes(a)) {
       i += 1;
       continue;
     }
@@ -7359,8 +8090,8 @@ Reason: ${reason}`];
   }
   process.stdout.write(`Applying \`${label2}\` to PR #${prNumber} under your authenticated \`gh\` identity — vinaya never fabricates an actor.
 `);
-  execFileSync15("gh", editArgs, { stdio: "inherit", env: process.env });
-  execFileSync15("gh", commentArgs, { stdio: "inherit", env: process.env });
+  execFileSync16("gh", editArgs, { stdio: "inherit", env: process.env });
+  execFileSync16("gh", commentArgs, { stdio: "inherit", env: process.env });
   process.stdout.write(`
 ✓ Label applied and reason posted as a PR comment.
 `);
@@ -7397,7 +8128,7 @@ var COMMANDS = [
   },
   {
     name: "init product",
-    description: "Register a project in .vinaya/projects.md (and its project:<name> label) in an already-initialized repo",
+    description: "Register a project in .vinaya/projects.md in an already-initialized repo",
     flags: [
       {
         flag: "--path <path>",
@@ -7406,8 +8137,8 @@ var COMMANDS = [
     ],
     details: [
       "Writes (or appends to) `.vinaya/projects.md` — the registry Vinaya Studio's tranche board resolves a project's board link against. Idempotent: re-running with the same name updates nothing.",
-      "Also creates a `project:<name>` label (create-if-absent) — informational only, not read by any shipped check or by Studio.",
-      "A missing GitHub remote skips the label (the one forge-reaching op) but still writes the registry row, which is a pure local file write."
+      "Reaches no forge and needs no GitHub remote or credentials: the registry row is a pure local file write, and it is deliberately NOT recorded in the ownership manifest, so `eject` does not reverse adopter-declared data.",
+      "Creates no label. Project is a field, not a label: a task Issue declares its project in the body's `**Project:**` field, and a `project:*` label is ignored wherever one still exists."
     ],
     status: "shipped"
   },
@@ -7520,6 +8251,37 @@ var COMMANDS = [
     ],
     status: "shipped"
   },
+  {
+    name: "milestone create",
+    description: "Create a GitHub Milestone from a validated body",
+    flags: [
+      { flag: "--title", description: "Milestone title — free text, never parsed for a version" },
+      {
+        flag: "--body-file",
+        description: "Path to the Milestone description (stream-safe; same bytes validated and sent)"
+      },
+      { flag: "--validate-only", description: "Run every gate and report PASS without creating the Milestone" },
+      { flag: "--json", description: "Enveloped JSON output (schema: 1)" }
+    ],
+    details: [
+      "Refuses before any `gh` call when the goal is absent, an optional `Release:` field is present but not a version, or an optional `### Tranche intents` section (`- <slug>: <intent text>`) doesn't parse. `Release:` is the sole authority for the milestone's version — the title is never parsed for one."
+    ],
+    status: "shipped"
+  },
+  {
+    name: "milestone adopt",
+    description: "Move one or more existing tranches into a target Milestone",
+    flags: [
+      { flag: "--target", description: "The Milestone every named slug is adopted into" },
+      { flag: "--slug", description: "A tranche slug to adopt — repeatable for a multi-slug move" },
+      { flag: "--validate-only", description: "Run every gate and report PASS without writing anything" },
+      { flag: "--json", description: "Enveloped JSON output (schema: 1)" }
+    ],
+    details: [
+      "Reattaches every Issue carrying each named `vinaya/tranche:<slug>` label to `--target`, then closes (never deletes) each slug's old tranche-Milestone. Every fact for every named slug is gathered and checked in ONE call before any write, so a single unsafe slug — an unknown slug, a slug whose label carries no Issues, a target that does not exist or is closed, or a slug already adopted into a different Milestone — refuses the whole invocation, not just its own slug."
+    ],
+    status: "shipped"
+  },
   {
     name: "review post",
     description: "Render, post, and self-verify a code-reviewer or security-review verdict comment on a PR",
@@ -7662,6 +8424,12 @@ var COMMANDS = [
   {
     name: "studio",
     description: "Launch Vinaya Studio — runs the Studio dev app when its source (apps/vinaya-studio/web) is in a checkout above the current directory; a published install launches its bundled standalone server instead",
+    flags: [
+      {
+        flag: "--port <n>",
+        description: "Bind this exact port. Without the flag the default is unchanged — 3008, falling back to 3108 when it is taken. With it there is no fallback: a taken port is refused, so you always know which server answered. Accepts `--port 3208` and `--port=3208`. Applies to a published install; in a workspace checkout Studio's own dev script owns the port and the flag is refused."
+      }
+    ],
     details: [
       "Resolution happens in this order: a workspace checkout carrying `apps/vinaya-studio/web` (Studio's source, which lives in the attalabs monorepo — not this repository) runs the dev app directly; a published install's `studio-standalone/` bundle (fetched from attalabs' release artifact at publish time, see `scripts/bundle-studio.ts`) runs that bundled server; anything else — a publish that shipped without the bundle — gets an explicit refusal and exit 1 rather than a silent no-op.",
       "Every published `@attalabs/vinaya` build ships the `studio-standalone/` bundle: `prepack` fetches attalabs’ latest CI-built standalone Studio artifact and assembles it into the tarball before publish."
@@ -7812,6 +8580,18 @@ try {
       }
       break;
     }
+    case "milestone": {
+      const [subcommand, ...rest] = args;
+      if (subcommand === "create") {
+        await milestoneCreateCommand(rest);
+      } else if (subcommand === "adopt") {
+        await milestoneAdoptCommand(rest);
+      } else {
+        console.error(`Unknown 'milestone' subcommand: ${subcommand ?? "(none)"} (expected 'create' or 'adopt')`);
+        process.exit(2);
+      }
+      break;
+    }
     case "review": {
       const [subcommand, ...rest] = args;
       if (subcommand === "post") {