@brainervirus/workit-claude-code 7.0.0 → 7.2.0

package/dist/workit.js

@@ -65,7 +65,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@brainervirus/workit-cli",
-    version: "6.0.1",
+    version: "7.2.0",
     private: false,
     description: "Workit CLI — setup wizard, doctor, and task control for agentic coding workflows",
     keywords: [
@@ -103,9 +103,9 @@ var init_package = __esm(() => {
     },
     dependencies: {
       "@babel/parser": "7.29.9",
-      "@brainervirus/workit-core": "workspace:*",
-      "@brainervirus/workit-cursor": "workspace:*",
-      "@brainervirus/workit-opencode": "workspace:*",
+      "@brainervirus/workit-core": "^7.2.0",
+      "@brainervirus/workit-cursor": "^7.2.0",
+      "@brainervirus/workit-opencode": "^7.2.0",
       "@inkjs/ui": "2.0.0",
       ink: "7.1.1",
       react: "19.2.8"
@@ -15029,14 +15029,14 @@ var diagnosticLogger, setDiagnosticLogger = (logger) => {
   if (result.status === "malformed")
     throw new Error(result.error);
   return result.config ?? DEFAULTS;
-}, resolveBranchPolicy = (config, workspace) => {
+}, vcsConfigPath = () => process.env.WORKFLOW_VCS_CONFIG ?? path13.join(configDir(), "vcs.json"), branchGlobPattern = (glob) => new RegExp(`^${glob.replace(/[.+?^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*")}$`, "i"), resolveBranchPolicy = (config, workspace) => {
   const wp = workspace?.branchPolicy ?? {};
   const preset = Object.hasOwn(PRESETS, wp.preset) ? wp.preset : config.branchPolicy?.preset ?? "gitflow";
   const merged = mergePreset(preset, {
     allowed: wp.allowed,
     protectedNames: wp.protected
   }, config);
-  const allowed = merged.allowed.map((p) => new RegExp(`^${p.replace(/[.+?^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*")}$`, "i"));
+  const allowed = merged.allowed.map(branchGlobPattern);
   return {
     preset,
     allowed,
@@ -15090,6 +15090,14 @@ var init_config = __esm(() => {
 import { createHash as createHash8 } from "node:crypto";
 import { readFileSync as readFileSync4, realpathSync as realpathSync3 } from "node:fs";
 import path14 from "node:path";
+function workspaceDefaultTarget(cwd, globalDefault) {
+  const ws = resolveRuntimeWorkspaceVcs(cwd);
+  const wp = ws?.branchPolicy ?? {};
+  const hasWorkspacePolicy = typeof wp.preset === "string" && Object.hasOwn(PRESETS, wp.preset);
+  const selected = resolveRuntimeWorkspacePolicy(cwd, "branch", process.env.WORKFLOW_PROFILE?.trim() || undefined);
+  const policyDefault = resolveBranchPolicy(readConfig(), selected.policy ? { branchPolicy: selected.policy } : null).defaultTargetBranch;
+  return String(ws?.vcs?.defaultTargetBranch ?? (hasWorkspacePolicy ? policyDefault : globalDefault ?? policyDefault) ?? "develop");
+}
 var nonBlank, branchPreset, commitPreset, workspaceBranchPolicySchema, workspaceCommitPolicySchema, workspaceProfileSchema, versionSourceSchema, releaseTrackSchema, workspaceConfigSchema, workspacesFileSchema, workspacesRevision = (contents) => createHash8("sha256").update(contents ?? "<missing>").digest("hex"), validateWorkspacesDocument = (parsed, file) => {
   if (!isConfigObject(parsed)) {
     return { status: "malformed", path: file, entries: [], error: `${file} is not a JSON object` };
@@ -15279,7 +15287,7 @@ var nonBlank, branchPreset, commitPreset, workspaceBranchPolicySchema, workspace
     profiles: record(nonBlank, profileSchema).optional()
   }).passthrough();
   return entrySchema;
-}, resolveRuntimeWorkspaceVcs = (cwd) => resolveRuntimeWorkspaceCandidate(cwd, "vcs"), runtimeWorkspaceIndexSchema, resolveRuntimeWorkspaceCandidate = (cwd, kind) => {
+}, resolveRuntimeWorkspaceVcs = (cwd) => resolveRuntimeWorkspaceCandidate(cwd, "vcs"), runtimeWorkspaceIndexSchema, matchRuntimeWorkspace = (cwd) => {
   const file = path14.join(configDir(), "workspaces.json");
   let raw;
   try {
@@ -15314,8 +15322,15 @@ var nonBlank, branchPreset, commitPreset, workspaceBranchPolicySchema, workspace
   });
   const workspaceName = process.env.WORKFLOW_WORKSPACE_NAME?.trim() || undefined;
   const selected = selectWorkspaceMatch(matches, cwd, workspaceName);
-  if (!selected)
+  return selected ? { file, selected } : null;
+}, resolveRuntimeReleaseTracks = (cwd) => {
+  const matched = matchRuntimeWorkspace(cwd);
+  return matched ? { workspace: matched.selected.name, releaseTracks: matched.selected.releaseTracks } : null;
+}, resolveRuntimeWorkspaceCandidate = (cwd, kind) => {
+  const matched = matchRuntimeWorkspace(cwd);
+  if (!matched)
     return null;
+  const { file, selected } = matched;
   const policy = runtimeWorkspacePolicySchema(kind).safeParse(selected);
   if (!policy.success) {
     const detail = policy.error.issues.map((issue) => `${issue.path.map(String).join(".") || "workspace"}: ${issue.message}`).join("; ");
@@ -15416,26 +15431,31 @@ var init_workspaces = __esm(() => {
     object({ kind: literal("manual") }).strict()
   ]);
   releaseTrackSchema = object({
-    strategy: branchPreset,
+    strategy: branchPreset.optional(),
     productionBranch: nonBlank,
     integrationBranch: nonBlank,
-    naming: object({ feature: nonBlank, release: nonBlank, hotfix: nonBlank }).strict(),
-    baseBranch: nonBlank,
-    mergeBackBranches: array(nonBlank),
-    pullRequestTarget: nonBlank,
-    tagNamespace: string2(),
-    versionSource: versionSourceSchema,
-    requiredChecks: array(nonBlank)
-  }).strict().superRefine((track, context) => {
+    naming: object({
+      feature: nonBlank.optional(),
+      release: nonBlank.optional(),
+      hotfix: nonBlank.optional()
+    }).passthrough().optional(),
+    baseBranch: nonBlank.optional(),
+    mergeBackBranches: array(nonBlank).optional(),
+    pullRequestTarget: nonBlank.optional(),
+    tagNamespace: string2().optional(),
+    versionSource: versionSourceSchema.optional(),
+    requiredChecks: array(nonBlank).optional(),
+    critical: array(nonBlank).optional()
+  }).passthrough().superRefine((track, context) => {
     for (const [field, values] of [
-      ["mergeBackBranches", track.mergeBackBranches],
-      ["requiredChecks", track.requiredChecks]
+      ["mergeBackBranches", track.mergeBackBranches ?? []],
+      ["requiredChecks", track.requiredChecks ?? []]
     ]) {
       if (new Set(values).size !== values.length) {
         context.addIssue({ code: "custom", path: [field], message: "entries must be unique" });
       }
     }
-    if (track.versionSource.kind === "package-json" && (path14.posix.isAbsolute(track.versionSource.path.replaceAll("\\", "/")) || /^[A-Za-z]:\//u.test(track.versionSource.path.replaceAll("\\", "/")) || track.versionSource.path.replaceAll("\\", "/").split("/").includes(".."))) {
+    if (track.versionSource?.kind === "package-json" && (path14.posix.isAbsolute(track.versionSource.path.replaceAll("\\", "/")) || /^[A-Za-z]:\//u.test(track.versionSource.path.replaceAll("\\", "/")) || track.versionSource.path.replaceAll("\\", "/").split("/").includes(".."))) {
       context.addIssue({
         code: "custom",
         path: ["versionSource", "path"],
@@ -15453,7 +15473,7 @@ var init_workspaces = __esm(() => {
       account: nonBlank.optional()
     }).passthrough().optional(),
     autoApprove: union([boolean2(), array(nonBlank)]).optional(),
-    defaultEndpoint: _enum(["commit", "pr"]).optional(),
+    defaultEndpoint: unknown().optional(),
     verification: _enum(["self", "independent"]).optional(),
     autonomy: object(Object.fromEntries(["push", "pr", "merge", "release", "rerun"].map((kind) => [
       kind,
@@ -15502,11 +15522,473 @@ var init_workspaces = __esm(() => {
   }).passthrough();
 });
 
+// packages/workit-core/src/core/release-tracks.ts
+import { createHash as createHash9 } from "node:crypto";
+import { spawnSync as spawnSync7 } from "node:child_process";
+import { readFileSync as readFileSync5 } from "node:fs";
+function readReleaseTracks(raw) {
+  const out = { tracks: [], issues: [], error: null, protectedBranches: [] };
+  if (raw === undefined || raw === null)
+    return out;
+  if (!isRecord3(raw)) {
+    out.issues.push("releaseTracks is not an object; ignored");
+    return out;
+  }
+  const fatal = [];
+  const protectedNames = new Set;
+  for (const [name, entry] of Object.entries(raw).toSorted(([a], [b]) => a < b ? -1 : 1)) {
+    const label = `release track ${JSON.stringify(name)}`;
+    if (!isRecord3(entry)) {
+      out.issues.push(`${label} is not an object; ignored`);
+      continue;
+    }
+    for (const branch of namedBranches(entry))
+      protectedNames.add(branch);
+    if (!name.trim()) {
+      out.issues.push("a release track with a blank name was ignored");
+      continue;
+    }
+    let critical = [];
+    if (Array.isArray(entry.critical))
+      critical = entry.critical.filter((item) => typeof item === "string");
+    else if (entry.critical !== undefined)
+      out.issues.push(`${label} critical: must be a list of field names; ignored`);
+    const isCritical = (field) => critical.some((item) => field === item || field.startsWith(`${item}.`));
+    const problem = (field, message) => {
+      if (isCritical(field))
+        fatal.push(`${label} ${field}: ${message}`);
+      else
+        out.issues.push(`${label} ${field}: ${message}`);
+    };
+    for (const key of Object.keys(entry))
+      if (!KNOWN_FIELDS.has(key))
+        problem(key, "unknown field, ignored");
+    const productionBranch = branchName(entry.productionBranch);
+    const integrationBranch = branchName(entry.integrationBranch);
+    if (!productionBranch)
+      problem("productionBranch", "missing or not a branch name");
+    if (!integrationBranch)
+      problem("integrationBranch", "missing or not a branch name");
+    const optionalBranch = (field) => {
+      if (entry[field] === undefined)
+        return null;
+      const value = branchName(entry[field]);
+      if (!value)
+        problem(field, "not a branch name; using the integration branch");
+      return value;
+    };
+    const baseBranch = optionalBranch("baseBranch");
+    const pullRequestTarget = optionalBranch("pullRequestTarget");
+    let mergeBackBranches = [];
+    if (entry.mergeBackBranches !== undefined) {
+      const list = Array.isArray(entry.mergeBackBranches) ? entry.mergeBackBranches.map(branchName) : [null];
+      if (list.some((item) => item === null))
+        problem("mergeBackBranches", "must be a list of branch names; ignored");
+      else
+        mergeBackBranches = [...new Set(list)];
+    }
+    const naming = {};
+    if (entry.naming !== undefined) {
+      if (!isRecord3(entry.naming))
+        problem("naming", "not an object; ignored");
+      else
+        for (const kind of ["feature", "release", "hotfix"]) {
+          const template = entry.naming[kind];
+          if (template === undefined)
+            continue;
+          if (typeof template !== "string" || !template.trim())
+            problem(`naming.${kind}`, "not a template string; ignored");
+          else if (!literalOf(template))
+            problem(`naming.${kind}`, "needs literal text besides placeholders; ignored");
+          else
+            naming[kind] = template.trim();
+        }
+    }
+    if (!productionBranch || !integrationBranch) {
+      out.issues.push(`${label} was skipped: it needs a productionBranch and integrationBranch`);
+      continue;
+    }
+    out.tracks.push({
+      name,
+      productionBranch,
+      integrationBranch,
+      baseBranch: baseBranch ?? integrationBranch,
+      pullRequestTarget: pullRequestTarget ?? integrationBranch,
+      mergeBackBranches,
+      naming
+    });
+  }
+  out.protectedBranches = [...protectedNames];
+  if (fatal.length)
+    out.error = `workspace releaseTracks cannot be read by this Workit (${fatal.join("; ")}); upgrade Workit or fix the track`;
+  return out;
+}
+function resolveReleaseTrack(input) {
+  const tracks = [...input.tracks];
+  const issues = [...input.issues ?? []];
+  const requested = input.requested?.trim();
+  if (tracks.length === 0) {
+    if (requested)
+      return {
+        status: "invalid",
+        error: `no release tracks configured for this workspace; --track ${requested} cannot apply`,
+        issues
+      };
+    return { status: "none", issues };
+  }
+  const names = tracks.map((track) => track.name).join(", ");
+  let envProblem = null;
+  const done = (track, source, detail, warnings = [], ambiguous = null) => ({
+    status: "resolved",
+    track: track && track.name !== IMPLICIT ? track : null,
+    source,
+    detail,
+    warnings: [...issues, ...envProblem ? [envProblem] : [], ...warnings],
+    tracks,
+    blocking: envProblem ?? ambiguous
+  });
+  if (requested) {
+    const named = tracks.find((track) => track.name === requested);
+    if (!named)
+      return {
+        status: "invalid",
+        error: `no release track ${JSON.stringify(requested)}; configured: ${names}`,
+        issues
+      };
+    return done(named, "flag", `track ${named.name} was requested explicitly`);
+  }
+  const owned = (branch) => branch !== null && tracks.some((track) => [
+    track.integrationBranch,
+    track.productionBranch,
+    track.baseBranch,
+    track.pullRequestTarget
+  ].includes(branch));
+  const implicit = input.defaultBranch && !owned(input.defaultBranch) ? {
+    name: IMPLICIT,
+    productionBranch: input.defaultBranch,
+    integrationBranch: input.defaultBranch,
+    baseBranch: input.defaultBranch,
+    pullRequestTarget: input.defaultBranch,
+    mergeBackBranches: [],
+    naming: {}
+  } : null;
+  const candidates = implicit ? [...tracks, implicit] : tracks;
+  const label = (track) => track.name === IMPLICIT ? `the workspace default line (${track.integrationBranch})` : `track ${track.name}`;
+  const fallback = (why) => {
+    const byDefault = input.defaultBranch ? tracks.filter((track) => track.integrationBranch === input.defaultBranch || track.pullRequestTarget === input.defaultBranch) : [];
+    const track = byDefault.length === 1 ? byDefault[0] : null;
+    const target = track ? `track ${track.name}` : `default target ${input.defaultBranch ?? "(none)"}`;
+    const ambiguous = candidates.length >= 2 ? `can't tell which release line ${input.branch ?? "HEAD"} is on (${why}); pass --track <name> (${names}) or --base <branch>` : null;
+    return done(track, "default", `${why}; using the workspace ${target}`, [
+      `release track not determined: ${why}; using the workspace ${target} (pass --track <name> to choose)`
+    ], ambiguous);
+  };
+  const branch = input.branch;
+  if (branch) {
+    const owners = ownedBy(candidates, branch);
+    if (owners.length === 1)
+      return done(owners[0], "branch", `${branch} is a branch of ${label(owners[0])}`);
+    if (owners.length > 1)
+      return fallback(`${branch} belongs to more than one track (${owners.map((track) => track.name).join(", ")})`);
+  }
+  const env = input.envRequested?.trim();
+  if (env) {
+    const named = tracks.find((track) => track.name === env);
+    if (named)
+      return done(named, "env", `WORKFLOW_RELEASE_TRACK selects track ${named.name}`);
+    envProblem = `WORKFLOW_RELEASE_TRACK=${env} names no release track of this workspace (${names}); ignored`;
+  }
+  if (!branch)
+    return fallback("HEAD is detached");
+  if (tracks.length === 1 && !implicit)
+    return done(tracks[0], "only-track", `${tracks[0].name} is the only track`);
+  let remotes = null;
+  const short = (ref) => shortRef(ref, remotes ??= input.probe.remotes());
+  const ownerOf = (ref) => {
+    const owner = ownedBy(candidates, short(ref));
+    return owner.length === 1 ? owner[0] : null;
+  };
+  const followRecorded = (start) => {
+    let cursor = start;
+    const seen = new Set([start]);
+    for (let hop = 0;hop < MAX_RECORDED_HOPS; hop += 1) {
+      const recorded = input.probe.recordedBase(cursor);
+      if (!recorded)
+        return null;
+      const base = short(recorded);
+      const owner = ownerOf(base);
+      if (owner)
+        return owner;
+      if (ownedBy(candidates, base).length > 1 || seen.has(base))
+        return null;
+      seen.add(base);
+      cursor = base;
+    }
+    return null;
+  };
+  const recordedOwner = followRecorded(branch);
+  if (recordedOwner)
+    return done(recordedOwner, "recorded-base", `${branch} was created on ${label(recordedOwner)}'s line (recorded base)`);
+  for (const source of ["reflog", "checkout"]) {
+    const ref = source === "reflog" ? input.probe.createdFrom(branch) : input.probe.checkedOutFrom(branch);
+    if (!ref)
+      continue;
+    const owner = ownerOf(ref) ?? followRecorded(short(ref));
+    if (owner)
+      return done(owner, source, `${branch} was created from ${short(ref)} (${source === "reflog" ? "branch reflog" : "HEAD reflog"})`);
+  }
+  const forks = [];
+  for (const track of candidates)
+    for (const ref of new Set([track.integrationBranch, track.baseBranch])) {
+      const sha = input.probe.mergeBase(branch, ref);
+      if (sha)
+        forks.push({ track, ref, sha });
+    }
+  if (forks.length === 0)
+    return fallback(`no track branch could be compared with ${branch} (fetch the track branches)`);
+  const ancestry = new Map;
+  const descends = (older, newer) => {
+    if (older === newer)
+      return false;
+    const key = `${older}>${newer}`;
+    if (!ancestry.has(key))
+      ancestry.set(key, input.probe.isAncestor(older, newer));
+    return ancestry.get(key);
+  };
+  const winners = forks.filter((fork) => forks.every((other) => other.track === fork.track || descends(other.sha, fork.sha)));
+  const winningTracks = [...new Set(winners.map((fork) => fork.track))];
+  if (winningTracks.length === 1 && forks.some((fork) => fork.track !== winningTracks[0])) {
+    const win = winners[0];
+    return done(win.track, "ancestry", `${branch} forked from ${win.ref} at ${win.sha.slice(0, 12)}, after every other line's fork point`);
+  }
+  if (winningTracks.length === 1)
+    return fallback(`only ${label(winningTracks[0])} could be compared with ${branch}`);
+  const newest = forks.filter((fork) => !forks.some((other) => descends(fork.sha, other.sha)));
+  return fallback(`${branch} has the same or unrelated fork points with ${[...new Set(newest.map((fork) => `${fork.ref} (${fork.track.name === IMPLICIT ? "workspace default" : fork.track.name})`))].join(" and ")}`);
+}
+function gitTrackProbe(cwd) {
+  let remote;
+  let remotes;
+  const tip = (branch) => {
+    remote ??= pushRemoteName(cwd) ?? "origin";
+    return resolveRef(cwd, `refs/remotes/${remote}/${branch}`) ?? resolveRef(cwd, `refs/heads/${branch}`);
+  };
+  return {
+    remotes: () => remotes ??= remoteNames(cwd),
+    recordedBase: (branch) => git4(cwd, ["config", "--get", recordedBaseKey(branch)]) || null,
+    createdFrom: (branch) => {
+      const log = git4(cwd, ["reflog", "show", "--format=%gs", `refs/heads/${branch}`, "--"]);
+      const oldest = log?.split(`
+`).findLast(Boolean) ?? "";
+      const match = /^branch: Created from (\S+)$/u.exec(oldest);
+      return match && match[1] !== "HEAD" ? match[1] : null;
+    },
+    checkedOutFrom: (branch) => {
+      const own = reflog(cwd, `refs/heads/${branch}`);
+      const created = own.at(-1);
+      if (!created || created.subject !== "branch: Created from HEAD")
+        return null;
+      const pattern = new RegExp(`^checkout: moving from (\\S+) to ${escapeRegExp(branch)}$`, "u");
+      const entry = reflog(cwd, "HEAD").findLast((item) => item.time >= created.time && item.sha === created.sha && pattern.test(item.subject));
+      return entry ? pattern.exec(entry.subject)?.[1] ?? null : null;
+    },
+    mergeBase: (branch, trackBranch) => {
+      const base = tip(trackBranch);
+      return base && resolveRef(cwd, `refs/heads/${branch}`) ? mergeBase(cwd, base, `refs/heads/${branch}`) : null;
+    },
+    isAncestor: (ancestor, descendant) => git4(cwd, ["merge-base", "--is-ancestor", ancestor, descendant]) !== null
+  };
+}
+function workspaceReleaseTracks(cwd) {
+  const raw = resolveRuntimeReleaseTracks(cwd);
+  return { workspace: raw?.workspace ?? null, ...readReleaseTracks(raw?.releaseTracks) };
+}
+function resolveTrackFor(cwd, options) {
+  const read = workspaceReleaseTracks(cwd);
+  if (read.error)
+    return { status: "invalid", error: read.error, issues: read.issues };
+  if (read.tracks.length === 0 && !options.track?.trim())
+    return { status: "none", issues: read.issues };
+  const branch = options.branch === undefined ? currentBranch(cwd) : options.branch;
+  const envRequested = process.env.WORKFLOW_RELEASE_TRACK?.trim() || null;
+  const input = {
+    tracks: read.tracks,
+    requested: options.track ?? null,
+    envRequested,
+    branch,
+    defaultBranch: options.defaultBranch,
+    issues: read.issues
+  };
+  let key = null;
+  if (!options.probe) {
+    const refs = git4(cwd, [
+      "for-each-ref",
+      "--format=%(refname) %(objectname)",
+      "refs/heads",
+      "refs/remotes"
+    ]) ?? "";
+    const head = git4(cwd, ["reflog", "show", "-n", "1", "--format=%H %gs", "HEAD", "--"]) ?? "";
+    const own = branch ? [
+      git4(cwd, [
+        "log",
+        "-g",
+        "-n",
+        "1",
+        "--date=unix",
+        "--format=%H %gd %gs",
+        `refs/heads/${branch}`,
+        "--"
+      ]) ?? "",
+      git4(cwd, ["config", "--get", recordedBaseKey(branch)]) ?? ""
+    ] : [];
+    key = createHash9("sha256").update(JSON.stringify({ cwd, input, refs, head, own })).digest("hex");
+    const hit = memo3.get(key);
+    if (hit)
+      return hit;
+  }
+  const resolution = resolveReleaseTrack({ ...input, probe: options.probe ?? gitTrackProbe(cwd) });
+  if (key) {
+    if (memo3.size >= MEMO_LIMIT)
+      memo3.delete(memo3.keys().next().value);
+    memo3.set(key, resolution);
+  }
+  return resolution;
+}
+function releaseTracksReport(cwd) {
+  let raw;
+  try {
+    raw = resolveRuntimeReleaseTracks(cwd);
+  } catch (error) {
+    return {
+      workspace: null,
+      tracks: [],
+      resolved: null,
+      warnings: [],
+      error: error instanceof Error ? error.message : String(error)
+    };
+  }
+  const read = readReleaseTracks(raw?.releaseTracks);
+  const tracks = read.tracks.map(({ name, integrationBranch, productionBranch }) => ({
+    name,
+    integrationBranch,
+    productionBranch
+  }));
+  const base = { workspace: raw?.workspace ?? null, tracks };
+  if (read.error)
+    return { ...base, resolved: null, warnings: read.issues, error: read.error };
+  if (tracks.length === 0)
+    return { ...base, resolved: null, warnings: read.issues, error: null };
+  let defaultBranch;
+  try {
+    defaultBranch = workspaceDefaultTarget(cwd, globalDefaultTarget());
+  } catch (error) {
+    return {
+      ...base,
+      resolved: null,
+      warnings: read.issues,
+      error: error instanceof Error ? error.message : String(error)
+    };
+  }
+  const resolution = resolveTrackFor(cwd, { defaultBranch });
+  if (resolution.status === "invalid")
+    return { ...base, resolved: null, warnings: resolution.issues, error: resolution.error };
+  if (resolution.status === "none")
+    return { ...base, resolved: null, warnings: resolution.issues, error: null };
+  return {
+    ...base,
+    resolved: {
+      name: resolution.track?.name ?? null,
+      source: resolution.source,
+      detail: resolution.detail
+    },
+    warnings: resolution.warnings,
+    error: null
+  };
+}
+var ReleaseTrackError, KNOWN_FIELDS, BRANCH_FIELDS, PLACEHOLDER, HAS_PLACEHOLDER, isRecord3 = (value) => typeof value === "object" && value !== null && !Array.isArray(value), branchName = (value) => typeof value === "string" && value.trim() && !value.trim().startsWith("-") ? value.trim() : null, namedBranches = (entry) => [
+  ...BRANCH_FIELDS.map((field) => branchName(entry[field])),
+  ...Array.isArray(entry.mergeBackBranches) ? entry.mergeBackBranches.map(branchName) : []
+].filter((name) => name !== null), literalOf = (template) => template.replace(PLACEHOLDER, "").replace(/[*/]/gu, "").trim(), trackBranches = (tracks) => [
+  ...new Set(tracks.flatMap((track) => [
+    track.productionBranch,
+    track.integrationBranch,
+    track.baseBranch,
+    track.pullRequestTarget,
+    ...track.mergeBackBranches
+  ]))
+], namingGlob = (template) => HAS_PLACEHOLDER.test(template) ? template.replace(PLACEHOLDER, "*") : `${template.replace(/\/?\*?$/u, "")}/*`, trackBranchName = (track, kind, slug) => {
+  const template = track?.naming[kind];
+  if (!template)
+    return null;
+  return HAS_PLACEHOLDER.test(template) ? template.replace(PLACEHOLDER, slug) : `${template.replace(/\/?\*?$/u, "")}/${slug}`;
+}, IMPLICIT = "", ownedBy = (tracks, branch) => tracks.filter((track) => [track.integrationBranch, track.productionBranch, track.baseBranch].includes(branch)), shortRef = (ref, remotes) => {
+  const bare = ref.replace(/^refs\/heads\//u, "").replace(/^refs\/remotes\/[^/]+\//u, "");
+  const remote = remotes.find((name) => bare.startsWith(`${name}/`));
+  return remote ? bare.slice(remote.length + 1) : bare;
+}, MAX_RECORDED_HOPS = 10, git4 = (cwd, args) => {
+  const run = spawnSync7("git", args, {
+    cwd,
+    encoding: "utf8",
+    timeout: 20000,
+    windowsHide: true,
+    stdio: ["ignore", "pipe", "ignore"]
+  });
+  return run.status === 0 ? (run.stdout ?? "").trim() : null;
+}, recordedBaseKey = (branch) => `branch.${branch}.workitBase`, recordBranchBase = (cwd, branch, base) => {
+  git4(cwd, ["config", recordedBaseKey(branch), base]);
+}, escapeRegExp = (text) => text.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&"), reflog = (cwd, ref) => (git4(cwd, ["log", "-g", "--date=unix", "--format=%H%x09%gd%x09%gs", ref, "--"]) ?? "").split(`
+`).map((line) => {
+  const [sha = "", selector = "", ...subject] = line.split("\t");
+  return {
+    sha,
+    time: Number(/@\{(\d+)\}$/u.exec(selector)?.[1] ?? Number.NaN),
+    subject: subject.join("\t")
+  };
+}).filter((entry) => entry.sha && Number.isFinite(entry.time)), globalDefaultTarget = () => {
+  try {
+    const parsed = JSON.parse(readFileSync5(vcsConfigPath(), "utf8"));
+    return isRecord3(parsed) ? parsed.defaultTargetBranch : undefined;
+  } catch {
+    return;
+  }
+}, memo3, MEMO_LIMIT = 64, describeReleaseTracks = (report) => report.tracks.length === 0 && !report.error ? [] : [
+  `release tracks: ${report.tracks.map((track) => `${track.name} (${track.integrationBranch} -> ${track.productionBranch})`).join(", ") || "(none usable)"}`,
+  ...report.resolved ? [
+    `this checkout: ${report.resolved.name ?? "workspace default"} (${report.resolved.detail})`
+  ] : [],
+  ...report.error ? [`release tracks error: ${report.error}`] : [],
+  ...report.warnings.map((warning) => `note: ${warning}`)
+];
+var init_release_tracks = __esm(() => {
+  init_rev();
+  init_config();
+  init_workspaces();
+  ReleaseTrackError = class ReleaseTrackError extends Error {
+  };
+  KNOWN_FIELDS = new Set([
+    "strategy",
+    "productionBranch",
+    "integrationBranch",
+    "naming",
+    "baseBranch",
+    "mergeBackBranches",
+    "pullRequestTarget",
+    "tagNamespace",
+    "versionSource",
+    "requiredChecks",
+    "critical"
+  ]);
+  BRANCH_FIELDS = ["productionBranch", "integrationBranch", "baseBranch", "pullRequestTarget"];
+  PLACEHOLDER = /\{[^}]*\}/gu;
+  HAS_PLACEHOLDER = /\{[^}]*\}/u;
+  memo3 = new Map;
+});
+
 // packages/workit-core/src/core/vcs-config.ts
 import fs12 from "node:fs";
 import path15 from "node:path";
-import { spawnSync as spawnSync7 } from "node:child_process";
-function vcsConfig(mode, cwd) {
+import { spawnSync as spawnSync8 } from "node:child_process";
+function vcsConfig(mode, cwd, options = {}) {
   const ws = resolveRuntimeWorkspaceVcs(vcsCwd(cwd));
   const wsVcs = ws?.vcs ?? {};
   const wsYt = ws?.youtrack ?? {};
@@ -15516,10 +15998,7 @@ function vcsConfig(mode, cwd) {
   const determinateRoot = cwd !== undefined || process.env.WORKFLOW_WORKSPACE_ROOT !== undefined;
   const rawProvider = wsVcs.provider ?? (determinateRoot ? remoteProvider(root) : null) ?? cfg.provider ?? null;
   const provider = rawProvider === null || rawProvider === undefined ? null : String(rawProvider).toLowerCase() || null;
-  const wp = ws?.branchPolicy ?? {};
-  const hasWorkspacePolicy = typeof wp.preset === "string" && Object.hasOwn(PRESETS, wp.preset);
-  const policyDefault = resolveBranchPolicyFor(root).defaultTargetBranch;
-  const defaultTarget = String(wsVcs.defaultTargetBranch ?? (hasWorkspacePolicy ? policyDefault : cfg.defaultTargetBranch ?? policyDefault) ?? "develop");
+  const workspaceDefault = workspaceDefaultTarget(root, cfg.defaultTargetBranch);
   const linkIssues = typeof wsYt.link_issues === "boolean" ? wsYt.link_issues : null;
   const youtrackBaseUrl = typeof wsYt.baseUrl === "string" ? wsYt.baseUrl : null;
   let issuesProvider = null;
@@ -15531,11 +16010,24 @@ function vcsConfig(mode, cwd) {
   if (mode === "resolve") {
     if (cfgStatus === "malformed")
       return { ok: false, error: cfgError, configPath: cfgPath };
+    const trackResolution = resolveTrackFor(root, {
+      track: options.track,
+      ...options.branch !== undefined ? { branch: options.branch } : {},
+      defaultBranch: workspaceDefault
+    });
+    if (trackResolution.status === "invalid")
+      return { ok: false, error: trackResolution.error, configPath: workspacesPath() };
+    const releaseTrack = trackSummary(trackResolution);
+    const defaultTarget = releaseTrack?.track?.pullRequestTarget ?? workspaceDefault;
+    const baseBranch = releaseTrack?.track?.baseBranch ?? defaultTarget;
     return {
       ok: true,
       workspace_name: ws?.name ?? null,
       provider,
       defaultTargetBranch: defaultTarget,
+      workspaceDefaultTargetBranch: workspaceDefault,
+      baseBranch,
+      releaseTrack,
       link_issues: linkIssues,
       youtrack_base_url: youtrackBaseUrl,
       issues_provider: issuesProvider,
@@ -15559,7 +16051,7 @@ function vcsConfig(mode, cwd) {
     ok: true,
     configPath: path15.resolve(cfgPath),
     provider,
-    defaultTargetBranch: defaultTarget,
+    defaultTargetBranch: workspaceDefault,
     pr: cfg.pr ?? {},
     workspace_name: ws?.name ?? null,
     link_issues: linkIssues,
@@ -15577,8 +16069,8 @@ function vcsConfig(mode, cwd) {
   }
   return out;
 }
-var vcsConfigPath = () => process.env.WORKFLOW_VCS_CONFIG ?? path15.join(configDir(), "vcs.json"), vcsCwd = (cwd) => cwd ?? process.env.WORKFLOW_WORKSPACE_ROOT ?? process.cwd(), remoteProvider = (cwd) => {
-  const r = spawnSync7("git", ["remote", "get-url", "origin"], { cwd, encoding: "utf8" });
+var workspacesPath = () => path15.join(configDir(), "workspaces.json"), vcsCwd = (cwd) => cwd ?? process.env.WORKFLOW_WORKSPACE_ROOT ?? process.cwd(), remoteProvider = (cwd) => {
+  const r = spawnSync8("git", ["remote", "get-url", "origin"], { cwd, encoding: "utf8" });
   if (r.status !== 0)
     return null;
   const url = (r.stdout ?? "").trim();
@@ -15605,29 +16097,60 @@ var vcsConfigPath = () => process.env.WORKFLOW_VCS_CONFIG ?? path15.join(configD
     return { status: "valid", path: file, config: parsed };
   }
   return { status: "malformed", path: file, config: {}, error: `${file} is not a JSON object` };
-};
+}, trackSummary = (resolution) => resolution.status === "resolved" ? {
+  name: resolution.track?.name ?? null,
+  source: resolution.source,
+  detail: resolution.detail,
+  warnings: resolution.warnings,
+  track: resolution.track,
+  tracks: resolution.tracks,
+  blocking: resolution.blocking
+} : null;
 var init_vcs_config = __esm(() => {
   init_config();
   init_workspaces();
-  init_branch();
+  init_release_tracks();
 });
 
 // packages/workit-core/src/core/branch.ts
 import { execFileSync } from "node:child_process";
-import { createHash as createHash9 } from "node:crypto";
+import { createHash as createHash10 } from "node:crypto";
 import path16 from "node:path";
 function effectiveWorkspacePolicy(workspaceRoot, kind, profileName) {
   const selected = resolveRuntimeWorkspacePolicy(workspaceRoot, kind, profileName?.trim() || process.env.WORKFLOW_PROFILE?.trim() || undefined);
   const config = readConfig();
   return kind === "branch" ? {
-    branchPolicy: resolveBranchPolicy(config, selected.policy ? { branchPolicy: selected.policy } : null),
+    branchPolicy: withReleaseTracks(workspaceRoot, resolveBranchPolicy(config, selected.policy ? { branchPolicy: selected.policy } : null)),
     provenance: { branchPolicy: selected.source }
   } : {
     commitPolicy: resolveCommitPolicy(config, selected.policy ? { commitPolicy: selected.policy } : null),
     provenance: { commitPolicy: selected.source }
   };
 }
-var validateBranchNamePolicy = (name, policy, source) => {
+var withReleaseTracks = (workspaceRoot, policy) => {
+  const read = workspaceReleaseTracks(workspaceRoot);
+  if (read.error)
+    throw new ReleaseTrackError(read.error);
+  if (read.tracks.length === 0 && read.protectedBranches.length === 0)
+    return policy;
+  const known = new Set(policy.allowed.map((pattern) => pattern.source));
+  const allowed = [...policy.allowed];
+  for (const glob of read.tracks.flatMap((track) => Object.values(track.naming).map(namingGlob))) {
+    const pattern = branchGlobPattern(glob);
+    if (!known.has(pattern.source)) {
+      known.add(pattern.source);
+      allowed.push(pattern);
+    }
+  }
+  return {
+    ...policy,
+    allowed,
+    protected: new Set([
+      ...policy.protected,
+      ...[...trackBranches(read.tracks), ...read.protectedBranches].map((name) => name.toLowerCase())
+    ])
+  };
+}, validateBranchNamePolicy = (name, policy, source) => {
   const allowed = policy.allowed.map((pattern) => `/${pattern.source}/${pattern.flags}`);
   if (policy.protected.has(name.toLowerCase())) {
     const correction = `choose a non-protected branch matching one of: ${allowed.join(", ")}`;
@@ -15658,7 +16181,7 @@ var validateBranchNamePolicy = (name, policy, source) => {
   const source = resolved.provenance.branchPolicy;
   const allowed = branchPolicy.allowed.map((pattern) => `${pattern.source}/${pattern.flags}`).toSorted();
   const protectedRefs = [...branchPolicy.protected].map((name) => name.toLowerCase()).toSorted();
-  const fingerprint = createHash9("sha256").update(JSON.stringify({ allowed, protectedRefs, source })).digest("hex");
+  const fingerprint = createHash10("sha256").update(JSON.stringify({ allowed, protectedRefs, source })).digest("hex");
   return {
     branchPolicy,
     namePolicy: { allowed: branchPolicy.allowed, protected: branchPolicy.protected },
@@ -15669,7 +16192,7 @@ var validateBranchNamePolicy = (name, policy, source) => {
   const resolved = effectiveWorkspacePolicy(workspaceRoot, "commit");
   const policy = resolved.commitPolicy;
   const source = resolved.provenance.commitPolicy;
-  const fingerprint = createHash9("sha256").update(JSON.stringify({ preset: policy.preset, pattern: policy.pattern ?? null, source })).digest("hex");
+  const fingerprint = createHash10("sha256").update(JSON.stringify({ preset: policy.preset, pattern: policy.pattern ?? null, source })).digest("hex");
   return { policy, source, fingerprint };
 }, validateCommitMessagePolicy = (message, policy, source) => {
   const attempted = message.split(`
@@ -15759,6 +16282,7 @@ var init_branch = __esm(() => {
   init_config();
   init_workspaces();
   init_vcs_config();
+  init_release_tracks();
 });
 
 // packages/workit-core/src/core/route-intent.ts
@@ -15767,11 +16291,11 @@ var init_route_intent = __esm(() => {
 });
 
 // packages/workit-core/src/core/runtime-identity.ts
-import { createHash as createHash10 } from "node:crypto";
-import { readFileSync as readFileSync5 } from "node:fs";
-var sha256Hex = (bytes) => createHash10("sha256").update(bytes).digest("hex"), bundleHashOfFile = (file) => {
+import { createHash as createHash11 } from "node:crypto";
+import { readFileSync as readFileSync6 } from "node:fs";
+var sha256Hex = (bytes) => createHash11("sha256").update(bytes).digest("hex"), bundleHashOfFile = (file) => {
   try {
-    return sha256Hex(readFileSync5(file));
+    return sha256Hex(readFileSync6(file));
   } catch {
     return null;
   }
@@ -15933,6 +16457,46 @@ var init_safe_write = () => {};
 import { copyFileSync as copyFileSync3, existsSync as existsSync6 } from "node:fs";
 import os3 from "node:os";
 import path18 from "node:path";
+function endpointOf(entry) {
+  const raw = entry?.defaultEndpoint;
+  if (raw === undefined)
+    return { raw, endpoint: DEFAULT_ENDPOINT };
+  if (isDefaultEndpoint(raw))
+    return { raw, endpoint: raw };
+  return {
+    raw,
+    endpoint: DEFAULT_ENDPOINT,
+    issue: `defaultEndpoint ${JSON.stringify(raw)} is not one of ${DEFAULT_ENDPOINTS.join(", ")}; using ${DEFAULT_ENDPOINT}`
+  };
+}
+function effectiveEndpoint(endpoint, context) {
+  if (endpoint === "commit")
+    return { endpoint };
+  const missing = (kind) => `${kind} grant missing; ${grantHint(context.workspace, kind)}`;
+  if (context.grants.push === false)
+    return { endpoint: "commit", reason: missing("push") };
+  if (context.grants.pr === false)
+    return { endpoint: "commit", reason: missing("pr") };
+  if (context.configured.length > 0 && !context.accountConfigured)
+    return {
+      endpoint: "commit",
+      reason: `vcs.account missing; set vcs.account for workspace "${context.workspace ?? "?"}" in ~/.config/workit/workspaces.json`
+    };
+  if (endpoint === "merged" && context.grants.merge === false)
+    return { endpoint: "green", reason: missing("merge") };
+  return { endpoint };
+}
+function endpointView(entry, context) {
+  const { raw, endpoint, issue } = endpointOf(entry);
+  const effective = effectiveEndpoint(endpoint, context);
+  return {
+    defaultEndpoint: endpoint,
+    configuredEndpoint: raw ?? null,
+    effectiveEndpoint: effective.endpoint,
+    ...effective.reason ? { endpointReason: effective.reason } : {},
+    ...issue ? { endpointIssue: issue } : {}
+  };
+}
 function configuredGrants(entry) {
   const record = entry ?? {};
   const raw = record.autonomy;
@@ -15958,18 +16522,28 @@ function resolveAutonomy(cwd) {
       source: "default",
       accountConfigured: false,
       defaultEndpoint: DEFAULT_ENDPOINT,
+      configuredEndpoint: null,
+      effectiveEndpoint: DEFAULT_ENDPOINT,
       verification: DEFAULT_VERIFICATION,
       note: override
     };
   const workspace = resolveWorkspaceFrom(cwd, grantsDir(), process.env.WORKFLOW_WORKSPACE_NAME?.trim() || undefined);
   const { grants, source } = configuredGrants(workspace);
+  const full = { ...DEFAULT_GRANTS, ...grants };
+  const configured = GRANT_KINDS.filter((kind) => grants[kind] !== undefined);
+  const accountConfigured = Boolean(workspace?.vcs?.account);
   return {
     workspace: workspace?.name ?? null,
-    grants: { ...DEFAULT_GRANTS, ...grants },
-    configured: GRANT_KINDS.filter((kind) => grants[kind] !== undefined),
+    grants: full,
+    configured,
     source,
-    accountConfigured: Boolean(workspace?.vcs?.account),
-    defaultEndpoint: endpointOf(workspace),
+    accountConfigured,
+    ...endpointView(workspace, {
+      workspace: workspace?.name ?? null,
+      grants: full,
+      configured,
+      accountConfigured
+    }),
     verification: verificationOf(workspace)
   };
 }
@@ -16075,14 +16649,21 @@ function writeGrants(workspaceName, changes, dir = grantsDir(), endpoint, verifi
       error: `failed to write ${current.path}: ${error instanceof Error ? error.message : String(error)}`
     };
   }
+  const full = { ...DEFAULT_GRANTS, ...grants };
+  const configured = GRANT_KINDS.filter((kind) => grants[kind] !== undefined);
   return {
     ok: true,
     path: current.path,
     backup,
     workspace: workspaceName,
-    grants: { ...DEFAULT_GRANTS, ...grants },
-    configured: GRANT_KINDS.filter((kind) => grants[kind] !== undefined),
-    defaultEndpoint: endpointOf(entry),
+    grants: full,
+    configured,
+    ...endpointView(entry, {
+      workspace: workspaceName,
+      grants: full,
+      configured,
+      accountConfigured: Boolean(accountOf(entry))
+    }),
     verification: verificationOf(entry)
   };
 }
@@ -16094,12 +16675,19 @@ function listGrants(dir = grantsDir()) {
     path: current.path,
     workspaces: current.entries.map((entry) => {
       const { grants } = configuredGrants(entry);
+      const full = { ...DEFAULT_GRANTS, ...grants };
+      const configured = GRANT_KINDS.filter((kind) => grants[kind] !== undefined);
       return {
         name: entry.name,
         glob: entry.glob,
-        grants: { ...DEFAULT_GRANTS, ...grants },
-        configured: GRANT_KINDS.filter((kind) => grants[kind] !== undefined),
-        defaultEndpoint: endpointOf(entry),
+        grants: full,
+        configured,
+        ...endpointView(entry, {
+          workspace: entry.name,
+          grants: full,
+          configured,
+          accountConfigured: Boolean(entry.vcs?.account)
+        }),
         verification: verificationOf(entry)
       };
     })
@@ -16114,7 +16702,7 @@ var accountHome = () => {
 }, grantsHome, grantsDir = () => path18.join(grantsHome.resolve(), ".config", "workit"), grantsOverride = () => {
   const configured = path18.resolve(resolveConfigDir());
   return configured === path18.resolve(grantsDir()) ? null : `the config directory is redirected to ${configured} (WORKFLOW_TOOLKIT_CONFIG, WORKFLOW_TOOLKIT_CONFIG_DIR or XDG_CONFIG_HOME); grants are read only from ${path18.join(grantsDir(), "workspaces.json")}, so the D4 defaults apply`;
-}, GRANT_KINDS, DEFAULT_GRANTS, DEFAULT_ENDPOINT = "commit", DEFAULT_VERIFICATION = "self", verificationOf = (entry) => entry?.verification === "independent" ? "independent" : "self", endpointOf = (entry) => entry?.defaultEndpoint === "pr" ? "pr" : "commit", isGrantKind = (value) => typeof value === "string" && GRANT_KINDS.includes(value), isGrantValue = (value) => value === true || value === false || value === "verified", normalized = (kind, value) => value === "verified" && kind !== "merge" ? true : value, fromAutoApprove = (value) => {
+}, GRANT_KINDS, DEFAULT_GRANTS, DEFAULT_ENDPOINTS, DEFAULT_ENDPOINT = "commit", isDefaultEndpoint = (value) => typeof value === "string" && DEFAULT_ENDPOINTS.includes(value), raisesEndpoint = (current, next) => DEFAULT_ENDPOINTS.indexOf(next) > DEFAULT_ENDPOINTS.indexOf(current), DEFAULT_VERIFICATION = "self", verificationOf = (entry) => entry?.verification === "independent" ? "independent" : "self", isGrantKind = (value) => typeof value === "string" && GRANT_KINDS.includes(value), isGrantValue = (value) => value === true || value === false || value === "verified", normalized = (kind, value) => value === "verified" && kind !== "merge" ? true : value, fromAutoApprove = (value) => {
   if (value === true)
     return { push: true, pr: true, merge: "verified" };
   if (!Array.isArray(value))
@@ -16126,7 +16714,7 @@ var accountHome = () => {
     else if (item === "merge")
       grants.merge = "verified";
   return Object.keys(grants).length > 0 ? grants : null;
-}, suggested = (kind) => kind === "merge" ? "verified" : "true", grantHint = (workspace, kind) => `ask the user to run, in their own terminal: workit grant set ${workspace ?? "<workspace>"} ${kind}=${suggested(kind)}`, raises = (kind, current, next) => {
+}, accountOf = (entry) => entry?.vcs?.account, suggested = (kind) => kind === "merge" ? "verified" : "true", grantHint = (workspace, kind) => `ask the user to run, in their own terminal: workit grant set ${workspace ?? "<workspace>"} ${kind}=${suggested(kind)}`, raises = (kind, current, next) => {
   const rank = (value) => value === true ? 2 : value === "verified" ? 1 : 0;
   return rank(normalized(kind, next)) > rank(normalized(kind, current));
 };
@@ -16143,6 +16731,7 @@ var init_autonomy = __esm(() => {
     release: false,
     rerun: true
   });
+  DEFAULT_ENDPOINTS = ["commit", "pr", "green", "merged"];
 });
 
 // packages/workit-core/src/core/task-engine.ts
@@ -17796,7 +18385,7 @@ var init_pr_body = __esm(() => {
 
 // packages/workit-core/src/core/pr-create.ts
 import path19 from "node:path";
-import { spawnSync as spawnSync8 } from "node:child_process";
+import { spawnSync as spawnSync9 } from "node:child_process";
 import { pathToFileURL } from "node:url";
 var safePushUrl = (remote) => {
   const raw = remote.trim();
@@ -17824,7 +18413,7 @@ var safePushUrl = (remote) => {
   const target = safePushUrl(remote);
   if (!target)
     return false;
-  const result = spawnSync8("git", ["config", "--get-regexp", "^url\\..*\\.(insteadof|pushinsteadof)$"], { cwd, encoding: "utf8" });
+  const result = spawnSync9("git", ["config", "--get-regexp", "^url\\..*\\.(insteadof|pushinsteadof)$"], { cwd, encoding: "utf8" });
   if (result.status !== 0 && result.status !== 1)
     return false;
   const prefixes = (result.stdout ?? "").split(/\r?\n/u).map((line) => line.trim().slice(line.trim().indexOf(" ") + 1)).filter(Boolean);
@@ -18400,7 +18989,7 @@ var init_core3 = __esm(() => {
 });
 
 // packages/workit-cli/src/task.ts
-import { readFileSync as readFileSync6 } from "node:fs";
+import { readFileSync as readFileSync7 } from "node:fs";
 import path22 from "node:path";
 async function readInput(input) {
   if (typeof input === "string")
@@ -18417,7 +19006,7 @@ async function payloadValue(raw, deps) {
     return { ok: true, value: {} };
   let source;
   try {
-    source = raw === "-" ? await readInput(deps.stdin ?? process.stdin) : raw.startsWith("@") ? decodeUtf8(readFileSync6(raw.slice(1))) : raw;
+    source = raw === "-" ? await readInput(deps.stdin ?? process.stdin) : raw.startsWith("@") ? decodeUtf8(readFileSync7(raw.slice(1))) : raw;
   } catch (error) {
     return {
       ok: false,
@@ -18750,7 +19339,7 @@ function isImplicitTaskForm(argv) {
   const [action, first] = argv;
   if (!action)
     return false;
-  if (IMPLICIT.has(action))
+  if (IMPLICIT2.has(action))
     return true;
   if (action === "start")
     return first !== undefined && !first.startsWith("--");
@@ -18948,7 +19537,7 @@ async function run(argv, io) {
   }
   return emit(io, fail("invalid_input", `unknown task action ${action ?? ""}`, { unblock: USAGE }));
 }
-var USAGE = 'workit task status [--all] | task start "<objective>" | task note "<text>" [--next "<t>"] [--objective "<t>"] | task close [--outcome verified|limited|stopped] [--summary "<t>"] [--confirm] | task adopt <id>', IMPLICIT, VALUE_FLAGS, SWITCHES, ENGINE_CODES, engineFailure = (io, result, unblock) => emit(io, fail(ENGINE_CODES[result.code] ?? "failed", `${result.code}: ${result.error}`, {
+var USAGE = 'workit task status [--all] | task start "<objective>" | task note "<text>" [--next "<t>"] [--objective "<t>"] | task close [--outcome verified|limited|stopped] [--summary "<t>"] [--confirm] | task adopt <id>', IMPLICIT2, VALUE_FLAGS, SWITCHES, ENGINE_CODES, engineFailure = (io, result, unblock) => emit(io, fail(ENGINE_CODES[result.code] ?? "failed", `${result.code}: ${result.error}`, {
   data: { code: result.code },
   ...unblock ? { unblock } : result.code === "busy" ? { unblock: "retry the same command" } : {}
 })), OUTCOMES, rootFor = (io) => io.env.WORKFLOW_WORKSPACE_ROOT || checkRoot(io.cwd);
@@ -18956,7 +19545,7 @@ var init_task2 = __esm(() => {
   init_check_config();
   init_output();
   init_task();
-  IMPLICIT = new Set(["status", "note", "adopt"]);
+  IMPLICIT2 = new Set(["status", "note", "adopt"]);
   VALUE_FLAGS = new Set(["--next", "--objective", "--outcome", "--summary"]);
   SWITCHES = new Set(["--all", "--json", "--confirm"]);
   ENGINE_CODES = {
@@ -61542,7 +62131,7 @@ var init_gitignore = __esm(() => {
 // packages/workit-core/src/core/changelog.ts
 import fs16 from "node:fs";
 import path23 from "node:path";
-import { createHash as createHash11 } from "node:crypto";
+import { createHash as createHash12 } from "node:crypto";
 function normalizeBullet(text) {
   text = text.trim();
   const m = BULLET_RE.exec(text);
@@ -61829,7 +62418,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
-`, digestBytes2 = (value) => createHash11("sha256").update(value).digest("hex"), readChangelogSource = (target) => {
+`, digestBytes2 = (value) => createHash12("sha256").update(value).digest("hex"), readChangelogSource = (target) => {
   if (!fs16.existsSync(target)) {
     const bytes = Buffer.from(SKELETON, "utf8");
     return { exists: false, bytes, text: SKELETON };
@@ -61869,13 +62458,13 @@ var init_changelog = __esm(() => {
 });
 
 // packages/workit-core/src/core/hygiene.ts
-import { existsSync as existsSync9, readFileSync as readFileSync8, writeFileSync as writeFileSync4 } from "node:fs";
+import { existsSync as existsSync9, readFileSync as readFileSync9, writeFileSync as writeFileSync4 } from "node:fs";
 import path24 from "node:path";
 var repoRoot2, templatesDir = () => path24.join(repoRoot2, "templates", "hygiene"), packageJson = (root) => {
   if (!existsSync9(path24.join(root, "package.json")))
     return null;
   try {
-    return JSON.parse(readFileSync8(path24.join(root, "package.json"), "utf8"));
+    return JSON.parse(readFileSync9(path24.join(root, "package.json"), "utf8"));
   } catch {
     return null;
   }
@@ -61911,7 +62500,7 @@ var repoRoot2, templatesDir = () => path24.join(repoRoot2, "templates", "hygiene
     const tpl = path24.join(templatesDir(), file);
     if (!existsSync9(tpl))
       continue;
-    const content = readFileSync8(tpl, "utf8").replace(/<PROJECT>/g, path24.basename(root)).replace(/<YEAR>/g, String(new Date().getFullYear())).replace(/<HOLDER>\s*/g, licenseHolder(root));
+    const content = readFileSync9(tpl, "utf8").replace(/<PROJECT>/g, path24.basename(root)).replace(/<YEAR>/g, String(new Date().getFullYear())).replace(/<HOLDER>\s*/g, licenseHolder(root));
     planned.push({ path: path24.join(root, file), content });
   }
   return planned;
@@ -61923,13 +62512,13 @@ var init_hygiene = __esm(() => {
 });
 
 // packages/workit-cli/src/admin/setup-state.ts
-import { existsSync as existsSync10, readFileSync as readFileSync9 } from "node:fs";
+import { existsSync as existsSync10, readFileSync as readFileSync10 } from "node:fs";
 import path25 from "node:path";
 var classifySetupFile = (dir, name) => {
   const file = path25.join(dir, name);
   let raw;
   try {
-    raw = readFileSync9(file, "utf8");
+    raw = readFileSync10(file, "utf8");
   } catch {
     if (existsSync10(file)) {
       return { file, status: "malformed", error: `${file} is not readable` };
@@ -61978,7 +62567,7 @@ function mergeOpenCodePlugins(plugin, pin) {
   return { config, changed };
 }
 function mergeOpenCodeConfig(config, pin) {
-  const base = isRecord3(config) ? { ...config } : {};
+  const base = isRecord4(config) ? { ...config } : {};
   const changed = [];
   const plugins = mergeOpenCodePlugins(base.plugin, pin);
   if (plugins.changed.length > 0) {
@@ -61988,7 +62577,7 @@ function mergeOpenCodeConfig(config, pin) {
   return { config: base, changed };
 }
 function mergeCursorEnabledPlugins(enabled) {
-  const prev = isRecord3(enabled) ? { ...enabled } : {};
+  const prev = isRecord4(enabled) ? { ...enabled } : {};
   const next = { ...prev, workit: true };
   delete next["workflow-toolkit"];
   delete next["local/workflow-toolkit"];
@@ -62010,7 +62599,7 @@ function mergeCursorPluginDirs(pluginDirs, pluginDir) {
   return { config: next, changed };
 }
 function mergeCursorSettings(settings, pluginDir) {
-  const base = isRecord3(settings) ? { ...settings } : {};
+  const base = isRecord4(settings) ? { ...settings } : {};
   const changed = [];
   const enabled = mergeCursorEnabledPlugins(base.enabled_plugins);
   if (enabled.changed.length > 0) {
@@ -62025,8 +62614,8 @@ function mergeCursorSettings(settings, pluginDir) {
   return { config: base, changed };
 }
 function mergeCursorMcp(mcp, serverName, server) {
-  const base = isRecord3(mcp) ? { ...mcp } : {};
-  const servers = isRecord3(base.mcpServers) ? { ...base.mcpServers } : {};
+  const base = isRecord4(mcp) ? { ...mcp } : {};
+  const servers = isRecord4(base.mcpServers) ? { ...base.mcpServers } : {};
   delete servers["workflow-toolkit"];
   servers[serverName] = server;
   const changed = JSON.stringify(servers) !== JSON.stringify(base.mcpServers) ? ["mcpServers"] : [];
@@ -62034,7 +62623,7 @@ function mergeCursorMcp(mcp, serverName, server) {
   return { config: base, changed };
 }
 function cursorHookDrift(installed) {
-  if (!isRecord3(installed) || !isRecord3(installed.hooks))
+  if (!isRecord4(installed) || !isRecord4(installed.hooks))
     return ["hooks file is not a hook map"];
   const hooks = installed.hooks;
   const drift = [];
@@ -62044,7 +62633,7 @@ function cursorHookDrift(installed) {
       continue;
     const canonical = canonicalHookEntry(event);
     const entry = Array.isArray(list) ? list[0] : undefined;
-    if (!isRecord3(entry) || entry.command !== canonical.command || event === "preToolUse" && entry.matcher !== canonical.matcher)
+    if (!isRecord4(entry) || entry.command !== canonical.command || event === "preToolUse" && entry.matcher !== canonical.matcher)
       drift.push(event);
   }
   return drift;
@@ -62068,7 +62657,7 @@ function cursorHooksEntry(_packageDir) {
     args: []
   };
 }
-var OPENCODE_NPM_PIN = "@brainervirus/workit-opencode", isRecord3 = (v) => v !== null && typeof v === "object" && !Array.isArray(v), named = (s, name) => s === name || s.startsWith(`${name}@`), CURSOR_RUNTIME_PACKAGE = "@brainervirus/workit-cursor@latest", CURSOR_HOOK_RUN_COMMAND, CURSOR_PRETOOLUSE_MATCHER = "Write|Edit|Delete|Shell|Remove|ApplyPatch|Apply_Patch|Patch|Rename|Mkdir|Mv|Cp|Touch", canonicalHookEntry = (event) => event === "preToolUse" ? { command: CURSOR_HOOK_RUN_COMMAND, matcher: CURSOR_PRETOOLUSE_MATCHER, failClosed: true } : { command: CURSOR_HOOK_RUN_COMMAND, failClosed: true };
+var OPENCODE_NPM_PIN = "@brainervirus/workit-opencode", isRecord4 = (v) => v !== null && typeof v === "object" && !Array.isArray(v), named = (s, name) => s === name || s.startsWith(`${name}@`), CURSOR_RUNTIME_PACKAGE = "@brainervirus/workit-cursor@latest", CURSOR_HOOK_RUN_COMMAND, CURSOR_PRETOOLUSE_MATCHER = "Write|Edit|Delete|Shell|Remove|ApplyPatch|Apply_Patch|Patch|Rename|Mkdir|Mv|Cp|Touch", canonicalHookEntry = (event) => event === "preToolUse" ? { command: CURSOR_HOOK_RUN_COMMAND, matcher: CURSOR_PRETOOLUSE_MATCHER, failClosed: true } : { command: CURSOR_HOOK_RUN_COMMAND, failClosed: true };
 var init_registration = __esm(() => {
   CURSOR_HOOK_RUN_COMMAND = `npx -y --prefer-online --min-release-age=0 --package=${CURSOR_RUNTIME_PACKAGE} workit-cursor-hook`;
 });
@@ -62087,12 +62676,12 @@ var init_support_matrix = __esm(() => {
 });
 
 // packages/workit-cli/src/admin/host-install.ts
-import { spawnSync as spawnSync9 } from "node:child_process";
+import { spawnSync as spawnSync10 } from "node:child_process";
 import {
   accessSync,
   constants as constants2,
   existsSync as existsSync11,
-  readFileSync as readFileSync10,
+  readFileSync as readFileSync11,
   readdirSync as readdirSync4,
   realpathSync as realpathSync6,
   statSync as statSync2
@@ -62358,7 +62947,7 @@ function runHostCommand(step, context = {}) {
       stderr: `Cannot safely execute batch shim ${step.command}; resolve its Node.js CLI entrypoint and retry`
     };
   }
-  const result = spawnSync9(step.command, step.args, {
+  const result = spawnSync10(step.command, step.args, {
     cwd: step.cwd,
     env: (() => {
       const home = context.home ?? context.env?.HOME ?? os6.homedir();
@@ -62382,7 +62971,7 @@ function runHostCommand(step, context = {}) {
 }
 var resolveWindowsShimScript = (shim) => {
   try {
-    const contents = readFileSync10(shim, "utf8");
+    const contents = readFileSync11(shim, "utf8");
     return resolveWindowsShimEntry(contents, shim);
   } catch {
     return null;
@@ -62403,7 +62992,7 @@ var resolveWindowsShimScript = (shim) => {
 }, isPiWorkitInstalled = (home, env = process.env) => {
   const settings = path27.join(env.PI_CODING_AGENT_DIR ?? path27.join(home, ".pi", "agent"), "settings.json");
   try {
-    const document2 = JSON.parse(readFileSync10(settings, "utf8"));
+    const document2 = JSON.parse(readFileSync11(settings, "utf8"));
     return (document2.packages ?? []).some((entry) => {
       const source = entry && typeof entry === "object" && !Array.isArray(entry) ? entry.source : entry;
       const value = String(source).replaceAll("\\", "/").replace(/\/+$/, "");
@@ -62418,7 +63007,7 @@ var resolveWindowsShimScript = (shim) => {
     path27.join(root, "package.json")
   ]) {
     try {
-      const manifest = JSON.parse(readFileSync10(file, "utf8"));
+      const manifest = JSON.parse(readFileSync11(file, "utf8"));
       const repository = typeof manifest.repository === "string" ? manifest.repository : manifest.repository?.url;
       if ((manifest.name === "workit" || manifest.name === "@brainervirus/workit-codex") && repository?.replace(/\.git$/, "").toLowerCase() === "https://github.com/brainervirus/workit")
         return true;
@@ -62459,7 +63048,7 @@ var resolveWindowsShimScript = (shim) => {
   return relative === "" || !relative.startsWith("..") && !path27.isAbsolute(relative);
 }, isCanonicalClaudePlugin = (root) => {
   try {
-    const manifest = JSON.parse(readFileSync10(path27.join(root, ".claude-plugin", "plugin.json"), "utf8"));
+    const manifest = JSON.parse(readFileSync11(path27.join(root, ".claude-plugin", "plugin.json"), "utf8"));
     const repository = typeof manifest.repository === "string" ? manifest.repository : manifest.repository?.url;
     return manifest.name === "workit" && repository?.replace(/\.git$/, "").toLowerCase() === "https://github.com/brainervirus/workit";
   } catch {
@@ -62469,7 +63058,7 @@ var resolveWindowsShimScript = (shim) => {
   const file = path27.join(claudeConfigDir(home, env), "plugins", "installed_plugins.json");
   let registry;
   try {
-    registry = JSON.parse(readFileSync10(file, "utf8"));
+    registry = JSON.parse(readFileSync11(file, "utf8"));
   } catch {
     return [];
   }
@@ -62518,7 +63107,7 @@ var init_host_install = __esm(() => {
 });
 
 // packages/workit-core/src/core/skill-manifests.ts
-import { existsSync as existsSync12, readFileSync as readFileSync11, readdirSync as readdirSync5, statSync as statSync3 } from "node:fs";
+import { existsSync as existsSync12, readFileSync as readFileSync12, readdirSync as readdirSync5, statSync as statSync3 } from "node:fs";
 import path28 from "node:path";
 var WORKIT_METHOD_SKILLS, skillManifestNames = (root) => existsSync12(root) ? readdirSync5(root).filter((name) => existsSync12(path28.join(root, name, "SKILL.md"))).toSorted() : [], validateSkillManifests = (root, expected, label) => {
   const actual = skillManifestNames(root);
@@ -62536,7 +63125,7 @@ var WORKIT_METHOD_SKILLS, skillManifestNames = (root) => existsSync12(root) ? re
       const file = path28.join(dir, entry.name);
       if (entry.isDirectory())
         pending.push(file);
-      else if ((statSync3(file).mode & 73) !== 0 || readFileSync11(file).subarray(0, 2).toString("latin1") === "#!") {
+      else if ((statSync3(file).mode & 73) !== 0 || readFileSync12(file).subarray(0, 2).toString("latin1") === "#!") {
         return `Cursor vendor contains active file: ${file}`;
       }
     }
@@ -62561,13 +63150,13 @@ var init_skill_manifests = __esm(() => {
 });
 
 // packages/workit-cli/src/admin/doctor.ts
-import { spawnSync as spawnSync10 } from "node:child_process";
+import { spawnSync as spawnSync11 } from "node:child_process";
 import {
   existsSync as existsSync13,
   lstatSync as lstatSync4,
   mkdirSync as mkdirSync4,
   mkdtempSync,
-  readFileSync as readFileSync12,
+  readFileSync as readFileSync13,
   readlinkSync as readlinkSync2,
   rmSync as rmSync2,
   statSync as statSync4,
@@ -62611,14 +63200,14 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   };
 }, readJson = (p) => {
   try {
-    const parsed = JSON.parse(readFileSync12(p, "utf8"));
+    const parsed = JSON.parse(readFileSync13(p, "utf8"));
     return parsed !== null && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
   } catch {
     return null;
   }
 }, parsesAsConfigObject = (p) => {
   try {
-    return isConfigObject(JSON.parse(readFileSync12(p, "utf8")));
+    return isConfigObject(JSON.parse(readFileSync13(p, "utf8")));
   } catch {
     return false;
   }
@@ -62645,7 +63234,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   }
   return false;
 }, versionOf = (bin, env, timeout) => {
-  const r = spawnSync10(bin, ["--version"], { encoding: "utf8", env, timeout });
+  const r = spawnSync11(bin, ["--version"], { encoding: "utf8", env, timeout });
   if (r.error)
     return null;
   return (r.stdout ?? "").trim();
@@ -62890,11 +63479,11 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
 }, validNodeEntry = (entry, runtime, env) => {
   try {
     const stat = statSync4(entry);
-    if (!stat.isFile() || stat.size === 0 || !readFileSync12(entry, "utf8").startsWith(`#!/usr/bin/env node
+    if (!stat.isFile() || stat.size === 0 || !readFileSync13(entry, "utf8").startsWith(`#!/usr/bin/env node
 `)) {
       return false;
     }
-    return spawnSync10(runtime, ["--check", entry], { encoding: "utf8", env }).status === 0;
+    return spawnSync11(runtime, ["--check", entry], { encoding: "utf8", env }).status === 0;
   } catch {
     return false;
   }
@@ -63108,7 +63697,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   if (!cmd)
     return null;
   try {
-    const r = spawnSync10(cmd, ["view", pkgName, "version"], {
+    const r = spawnSync11(cmd, ["view", pkgName, "version"], {
       encoding: "utf8",
       timeout: 20000,
       env: res.env
@@ -63419,12 +64008,27 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
       fix: `Choose a matching workspace with WORKFLOW_WORKSPACE_NAME or repair ${file}`
     };
   }
-  if (match)
-    return {
-      id: "workspace_mismatch",
-      status: "pass",
-      detail: `current directory matches workspace "${match.name}"`
-    };
+  if (match) {
+    const matched = `current directory matches workspace "${match.name}"`;
+    const tracks = releaseTracksReport(res.cwd);
+    const lines = describeReleaseTracks(tracks);
+    const detail = [matched, ...lines].join("; ");
+    if (tracks.error)
+      return {
+        id: "workspace_mismatch",
+        status: "fail",
+        detail,
+        fix: `Repair releaseTracks in ${file} (or upgrade Workit for a critical field)`
+      };
+    if (tracks.warnings.length)
+      return {
+        id: "workspace_mismatch",
+        status: "warn",
+        detail,
+        fix: `Fix the reported releaseTracks fields in ${file}, or pass --track <name> where the track is not determined`
+      };
+    return { id: "workspace_mismatch", status: "pass", detail };
+  }
   return {
     id: "workspace_mismatch",
     status: "fail",
@@ -63433,7 +64037,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   };
 }, isPlaceholder = (p) => {
   try {
-    return readFileSync12(p, "utf8").trim() === TOKEN_PLACEHOLDER2;
+    return readFileSync13(p, "utf8").trim() === TOKEN_PLACEHOLDER2;
   } catch {
     return false;
   }
@@ -63522,7 +64126,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
 }, defaultIdentityProbes = (env) => ({
   origin: (cwd) => {
     try {
-      const out = spawnSync10("git", ["remote", "get-url", "origin"], {
+      const out = spawnSync11("git", ["remote", "get-url", "origin"], {
         cwd,
         encoding: "utf8",
         env
@@ -63534,7 +64138,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   },
   ghLogin: (e) => {
     try {
-      const out = spawnSync10("gh", ["api", "user", "--jq", ".login"], { encoding: "utf8", env: e });
+      const out = spawnSync11("gh", ["api", "user", "--jq", ".login"], { encoding: "utf8", env: e });
       const login = (out.stdout ?? "").trim();
       return out.status === 0 && login ? login : null;
     } catch {
@@ -63543,7 +64147,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   },
   glabLogin: (e) => {
     try {
-      const out = spawnSync10("glab", ["api", "user", "--jq", ".username"], {
+      const out = spawnSync11("glab", ["api", "user", "--jq", ".username"], {
         encoding: "utf8",
         env: e
       });
@@ -63555,7 +64159,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   },
   sshLogin: (host) => {
     try {
-      const out = spawnSync10("ssh", ["-o", "BatchMode=yes", "-o", "ConnectTimeout=5", "-T", `git@${host}`], {
+      const out = spawnSync11("ssh", ["-o", "BatchMode=yes", "-o", "ConnectTimeout=5", "-T", `git@${host}`], {
         encoding: "utf8",
         env
       });
@@ -63749,6 +64353,7 @@ var init_doctor = __esm(() => {
   init_store_lock();
   init_runtime_identity();
   init_boundary();
+  init_release_tracks();
   init_config();
   init_package_root();
   init_registration();
@@ -63797,7 +64402,7 @@ import {
   lstatSync as lstatSync5,
   mkdirSync as mkdirSync5,
   mkdtempSync as mkdtempSync2,
-  readFileSync as readFileSync13,
+  readFileSync as readFileSync14,
   readdirSync as readdirSync6,
   realpathSync as realpathSync7,
   renameSync as renameSync3,
@@ -63966,7 +64571,7 @@ function buildSetupPreview(values, opts = {}) {
     if (values.applyProject) {
       const root = path30.resolve(opts.cwd ?? process.cwd());
       const gitignorePath = path30.join(root, ".gitignore");
-      const existing = existsSync14(gitignorePath) ? readFileSync13(gitignorePath, "utf8") : "";
+      const existing = existsSync14(gitignorePath) ? readFileSync14(gitignorePath, "utf8") : "";
       const existingLines = new Set(existing.split(`
 `).map((l) => l.trim()).filter(Boolean));
       const entries = GITIGNORE_ENTRIES.filter((e) => e.trim() !== "" && !existingLines.has(e.trim()));
@@ -63997,7 +64602,7 @@ function deepMerge(base, patch) {
   const out = { ...base };
   for (const [key, value] of Object.entries(patch)) {
     const prev = out[key];
-    out[key] = isRecord4(prev) && isRecord4(value) ? deepMerge(prev, value) : value;
+    out[key] = isRecord5(prev) && isRecord5(value) ? deepMerge(prev, value) : value;
   }
   return out;
 }
@@ -64324,8 +64929,8 @@ function applyCursorMcp(root, res) {
   }
   const mcpBase = mcpExisting.kind === "record" ? mcpExisting.value : {};
   const server = cursorMcpServerEntry(res.cursorPluginDir);
-  const servers = isRecord4(mcpBase.mcpServers) ? mcpBase.mcpServers : {};
-  const current = isRecord4(servers.workit) ? servers.workit : {};
+  const servers = isRecord5(mcpBase.mcpServers) ? mcpBase.mcpServers : {};
+  const current = isRecord5(servers.workit) ? servers.workit : {};
   const previousArgs = Array.isArray(current.args) ? current.args.map(String) : [];
   const previousPackage = previousArgs.find((arg) => arg.startsWith("--package=@brainervirus/workit-cursor@") && arg !== `--package=${CURSOR_RUNTIME_PACKAGE}`);
   if (previousPackage) {
@@ -64586,7 +65191,7 @@ var TOKEN_PLACEHOLDER3 = "YOUR_TOKEN_HERE", YT_OVERRIDES, VCS_OVERRIDES, SETUP_O
 }, configuredTokenPath = (config, ...keys) => {
   let cursor = config;
   for (const key of keys) {
-    if (!isRecord4(cursor))
+    if (!isRecord5(cursor))
       return null;
     cursor = cursor[key];
   }
@@ -64599,8 +65204,8 @@ var TOKEN_PLACEHOLDER3 = "YOUR_TOKEN_HERE", YT_OVERRIDES, VCS_OVERRIDES, SETUP_O
   return configured ?? fallback;
 }, readConfigRecord = (file) => {
   try {
-    const value = JSON.parse(readFileSync13(file, "utf8"));
-    return isRecord4(value) ? value : null;
+    const value = JSON.parse(readFileSync14(file, "utf8"));
+    return isRecord5(value) ? value : null;
   } catch {
     return null;
   }
@@ -64617,10 +65222,10 @@ var TOKEN_PLACEHOLDER3 = "YOUR_TOKEN_HERE", YT_OVERRIDES, VCS_OVERRIDES, SETUP_O
     cursorMcp: options.cursorMcp ?? path30.join(home, ".cursor", "mcp.json"),
     cursorPluginDir: options.cursorPluginDir ?? path30.join(home, ".cursor", "plugins", "local", "workit")
   };
-}, isRecord4 = (v) => v !== null && typeof v === "object" && !Array.isArray(v), readExisting = (p) => {
+}, isRecord5 = (v) => v !== null && typeof v === "object" && !Array.isArray(v), readExisting = (p) => {
   let raw;
   try {
-    raw = readFileSync13(p, "utf8");
+    raw = readFileSync14(p, "utf8");
   } catch {
     if (existsSync14(p))
       return { kind: "malformed", error: `${p} is not readable` };
@@ -64632,12 +65237,12 @@ var TOKEN_PLACEHOLDER3 = "YOUR_TOKEN_HERE", YT_OVERRIDES, VCS_OVERRIDES, SETUP_O
   } catch {
     return { kind: "malformed", error: `${p} is not valid JSON` };
   }
-  if (isRecord4(value))
+  if (isRecord5(value))
     return { kind: "record", value, raw };
   return { kind: "malformed", error: `${p} is not a JSON object` };
 }, readFileSafe = (p) => {
   try {
-    return readFileSync13(p, "utf8");
+    return readFileSync14(p, "utf8");
   } catch {
     return null;
   }
@@ -64652,7 +65257,7 @@ var TOKEN_PLACEHOLDER3 = "YOUR_TOKEN_HERE", YT_OVERRIDES, VCS_OVERRIDES, SETUP_O
   }
 }, isAdapter = (root, platform) => {
   try {
-    const pkg = JSON.parse(readFileSync13(path30.join(root, "package.json"), "utf8"));
+    const pkg = JSON.parse(readFileSync14(path30.join(root, "package.json"), "utf8"));
     return pkg.name === `@brainervirus/workit-${platform}`;
   } catch {
     return false;
@@ -64681,7 +65286,7 @@ var TOKEN_PLACEHOLDER3 = "YOUR_TOKEN_HERE", YT_OVERRIDES, VCS_OVERRIDES, SETUP_O
       if (entry.isDirectory()) {
         if (!statSync5(installed).isDirectory() || !samePluginContent(source, installed, path30.join(relative, entry.name)))
           return false;
-      } else if (!readFileSync13(source).equals(readFileSync13(installed))) {
+      } else if (!readFileSync14(source).equals(readFileSync14(installed))) {
         return false;
       }
     }
@@ -64709,7 +65314,7 @@ var TOKEN_PLACEHOLDER3 = "YOUR_TOKEN_HERE", YT_OVERRIDES, VCS_OVERRIDES, SETUP_O
         continue;
       if (existsSync14(path30.join(sourceRules, entry.name)))
         continue;
-      preserved.set(entry.name, readFileSync13(path30.join(installedRules, entry.name)));
+      preserved.set(entry.name, readFileSync14(path30.join(installedRules, entry.name)));
     }
   } catch {}
   return preserved;
@@ -64763,10 +65368,10 @@ var init_setup = __esm(() => {
 });
 
 // packages/workit-core/src/core/branch-policy.ts
-import { spawnSync as spawnSync11 } from "node:child_process";
+import { spawnSync as spawnSync12 } from "node:child_process";
 var PREFIXES, detectBranchPolicy = (workspaceRoot) => {
   const branchExists = (name) => {
-    const r = spawnSync11("git", ["branch", "--list", name], {
+    const r = spawnSync12("git", ["branch", "--list", name], {
       cwd: workspaceRoot,
       encoding: "utf8"
     });
@@ -64826,7 +65431,7 @@ var init_branch_policy = __esm(() => {
 });
 
 // packages/workit-core/src/core/workspace-branch-policy.ts
-import { mkdirSync as mkdirSync6, readFileSync as readFileSync14, renameSync as renameSync4, rmSync as rmSync4, writeFileSync as writeFileSync7 } from "node:fs";
+import { mkdirSync as mkdirSync6, readFileSync as readFileSync15, renameSync as renameSync4, rmSync as rmSync4, writeFileSync as writeFileSync7 } from "node:fs";
 import path31 from "node:path";
 import { isDeepStrictEqual as isDeepStrictEqual3 } from "node:util";
 function applyWorkspaceBranchPolicy(opts) {
@@ -64924,7 +65529,7 @@ function applyWorkspaceBranchPolicy(opts) {
 }
 var readFileSafe2 = (p) => {
   try {
-    return readFileSync14(p, "utf8");
+    return readFileSync15(p, "utf8");
   } catch {
     return null;
   }
@@ -65103,17 +65708,18 @@ function setProfileEditorValue(profile, field, value, defaults = {}) {
   };
 }
 function trackEditorValue(track, field) {
+  const source = track.versionSource ?? { kind: "git-tag" };
   if (field.startsWith("naming."))
-    return track.naming[field.slice(7)];
+    return track.naming?.[field.slice(7)] ?? "";
   if (field === "mergeBackBranches" || field === "requiredChecks")
-    return track[field].join(", ");
+    return (track[field] ?? []).join(", ");
   if (field.startsWith("versionSource.")) {
     const key = field.slice(14);
     if (key === "kind")
-      return track.versionSource.kind;
+      return source.kind;
     if (key === "path")
-      return track.versionSource.kind === "package-json" ? track.versionSource.path : "";
-    return track.versionSource.kind === "package-json" ? track.versionSource.field : "";
+      return source.kind === "package-json" ? source.path : "";
+    return source.kind === "package-json" ? source.field : "";
   }
   return String(track[field] ?? "");
 }
@@ -65123,12 +65729,13 @@ function setTrackEditorValue(track, field, value) {
   if (field === "mergeBackBranches" || field === "requiredChecks")
     return { ...track, [field]: splitList(value) };
   if (field.startsWith("versionSource.")) {
+    const current = track.versionSource ?? { kind: "git-tag" };
     const key = field.slice(14);
-    const kind = key === "kind" ? value : track.versionSource.kind;
+    const kind = key === "kind" ? value : current.kind;
     const versionSource = kind === "package-json" ? {
       kind,
-      path: key === "path" ? value : track.versionSource.kind === kind ? track.versionSource.path : "package.json",
-      field: key === "field" ? value : track.versionSource.kind === kind ? track.versionSource.field : "version"
+      path: key === "path" ? value : current.kind === kind ? current.path : "package.json",
+      field: key === "field" ? value : current.kind === kind ? current.field : "version"
     } : kind === "manual" ? { kind } : { kind: "git-tag" };
     return { ...track, versionSource };
   }
@@ -65762,13 +66369,13 @@ var init_wizard_state = __esm(() => {
 });
 
 // packages/workit-cli/src/admin/uninstall.ts
-import { existsSync as existsSync16, readFileSync as readFileSync15, realpathSync as realpathSync8, rmSync as rmSync5, writeFileSync as writeFileSync8 } from "node:fs";
+import { existsSync as existsSync16, readFileSync as readFileSync16, realpathSync as realpathSync8, rmSync as rmSync5, writeFileSync as writeFileSync8 } from "node:fs";
 import os9 from "node:os";
 import path33 from "node:path";
 function cleanCursorSettings(settings, pluginDir) {
   const next = { ...settings };
   let changed = false;
-  if (isRecord5(next.enabled_plugins)) {
+  if (isRecord6(next.enabled_plugins)) {
     const enabled = { ...next.enabled_plugins };
     for (const identity of ["workit", ...CURSOR_LEGACY_IDENTITIES]) {
       if (identity in enabled) {
@@ -65809,7 +66416,7 @@ function cleanOpenCodeConfig(config) {
 function cleanCursorMcp(mcp) {
   const next = { ...mcp };
   let changed = false;
-  if (isRecord5(next.mcpServers)) {
+  if (isRecord6(next.mcpServers)) {
     const servers = { ...next.mcpServers };
     for (const name of ["workit", "workflow-toolkit"]) {
       if (name in servers) {
@@ -65834,7 +66441,7 @@ function cleanPiConfig(config) {
       changed = true;
     }
   }
-  const pi = isRecord5(next.pi) ? { ...next.pi } : null;
+  const pi = isRecord6(next.pi) ? { ...next.pi } : null;
   if (pi && Array.isArray(pi.extensions)) {
     const kept = pi.extensions.filter((entry) => !String(entry).includes("workit"));
     if (kept.length !== pi.extensions.length) {
@@ -65982,10 +66589,10 @@ var resolveUninstallPaths = (options = {}) => {
     codexPluginDir: path33.join(home, ".codex", "plugins", "workit"),
     piConfig: path33.join(home, ".pi", "config.json")
   };
-}, isRecord5 = (v) => v !== null && typeof v === "object" && !Array.isArray(v), readJsonRecord = (file) => {
+}, isRecord6 = (v) => v !== null && typeof v === "object" && !Array.isArray(v), readJsonRecord = (file) => {
   let raw;
   try {
-    raw = readFileSync15(file, "utf8");
+    raw = readFileSync16(file, "utf8");
   } catch {
     if (existsSync16(file))
       return { kind: "malformed", error: `${file} is not readable` };
@@ -65993,7 +66600,7 @@ var resolveUninstallPaths = (options = {}) => {
   }
   try {
     const value = JSON.parse(raw);
-    return isRecord5(value) ? { kind: "record", value } : { kind: "malformed", error: `${file} is not a JSON object` };
+    return isRecord6(value) ? { kind: "record", value } : { kind: "malformed", error: `${file} is not a JSON object` };
   } catch {
     return { kind: "malformed", error: `${file} is not valid JSON` };
   }
@@ -66035,7 +66642,7 @@ var resolveUninstallPaths = (options = {}) => {
 `;
   let current;
   try {
-    current = readFileSync15(target, "utf8");
+    current = readFileSync16(target, "utf8");
   } catch (error) {
     return {
       status: "failed",
@@ -68305,7 +68912,7 @@ var init_steps = __esm(async () => {
 import { appendFileSync, mkdirSync as mkdirSync7, readdirSync as readdirSync7, unlinkSync as unlinkSync3 } from "node:fs";
 import os11 from "node:os";
 import path34 from "node:path";
-var REDACTED = "[REDACTED]", DEFAULT_MAX_RATE = 20, DEFAULT_RATE_WINDOW_MS = 1000, DEFAULT_MAX_FIELD_LENGTH = 200, DEFAULT_MAX_STACK_LINES = 30, DAY_FILE, RETAINED_DAYS = 7, SECRET_VALUE, KEY_EQ_VALUE, URL_QUERY, splitKey = (key) => key.split(/[_-]+|(?<=[a-z0-9])(?=[A-Z])|(?<=[A-Z])(?=[A-Z][a-z])/).map((word) => word.toLowerCase()), SENSITIVE_WORDS, STACK_WORDS, escapeRegExp2 = (value) => value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"), resolveStateDir = () => {
+var REDACTED = "[REDACTED]", DEFAULT_MAX_RATE = 20, DEFAULT_RATE_WINDOW_MS = 1000, DEFAULT_MAX_FIELD_LENGTH = 200, DEFAULT_MAX_STACK_LINES = 30, DAY_FILE, RETAINED_DAYS = 7, SECRET_VALUE, KEY_EQ_VALUE, URL_QUERY, splitKey = (key) => key.split(/[_-]+|(?<=[a-z0-9])(?=[A-Z])|(?<=[A-Z])(?=[A-Z][a-z])/).map((word) => word.toLowerCase()), SENSITIVE_WORDS, STACK_WORDS, escapeRegExp3 = (value) => value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"), resolveStateDir = () => {
   const override = process.env.WORKFLOW_TOOLKIT_STATE;
   if (override)
     return override;
@@ -68507,7 +69114,7 @@ var init_logger = __esm(() => {
     "query"
   ]);
   STACK_WORDS = new Set(["stack", "stacktrace", "trace"]);
-  homePattern = new RegExp(`${escapeRegExp2(os11.homedir())}(?=[/\\\\]|$)|\\$HOME(?=[/\\\\]|$)`, "g");
+  homePattern = new RegExp(`${escapeRegExp3(os11.homedir())}(?=[/\\\\]|$)|\\$HOME(?=[/\\\\]|$)`, "g");
   DEFAULT_OPTIONS = {
     maxFieldLength: DEFAULT_MAX_FIELD_LENGTH,
     maxStackLines: DEFAULT_MAX_STACK_LINES
@@ -68772,12 +69379,12 @@ var init_init = __esm(() => {
 });
 
 // packages/workit-cli/src/upgrade.ts
-import { spawnSync as spawnSync12 } from "node:child_process";
+import { spawnSync as spawnSync13 } from "node:child_process";
 import {
   existsSync as existsSync17,
   mkdtempSync as mkdtempSync3,
   rmSync as rmSync6,
-  readFileSync as readFileSync16,
+  readFileSync as readFileSync17,
   mkdirSync as mkdirSync8,
   copyFileSync as copyFileSync5,
   chmodSync,
@@ -68786,7 +69393,7 @@ import {
 } from "node:fs";
 import path35 from "node:path";
 import os12 from "node:os";
-import { createHash as createHash12 } from "node:crypto";
+import { createHash as createHash13 } from "node:crypto";
 function previewUpgrade(hosts = HOSTS2, deps = {}) {
   const paths = upgradePaths(deps);
   const { home, configDir } = paths;
@@ -68914,7 +69521,7 @@ function applyUpgrade(plan, deps = {}) {
   mkdirSync8(backup, { recursive: true, mode: 448 });
   for (const file of Object.keys(plan.configDigests))
     if (existsSync17(file)) {
-      const target = path35.join(backup, createHash12("sha256").update(file).digest("hex").slice(0, 12) + "-" + path35.basename(file));
+      const target = path35.join(backup, createHash13("sha256").update(file).digest("hex").slice(0, 12) + "-" + path35.basename(file));
       copyFileSync5(file, target);
       chmodSync(target, 384);
     }
@@ -69128,7 +69735,7 @@ async function runLaunchCommand(argv, deps = {}) {
   }
   if (deps.run)
     return deps.run(host, hostArgs).status ?? 1;
-  return spawnSync12(launch.command, launch.args, {
+  return spawnSync13(launch.command, launch.args, {
     stdio: "inherit",
     env
   }).status ?? 1;
@@ -69162,14 +69769,14 @@ var HOSTS2, upgradePaths = (deps) => {
     return null;
   let data;
   try {
-    data = JSON.parse(readFileSync16(file, "utf8"));
+    data = JSON.parse(readFileSync17(file, "utf8"));
   } catch {
     throw new Error(`${file} is not valid JSON; use the native host to inspect JSONC settings`);
   }
   if (!data || typeof data !== "object" || Array.isArray(data))
     throw new Error(`${file} is not a configuration object`);
   return data;
-}, digest2 = (file) => existsSync17(file) ? createHash12("sha256").update(readFileSync16(file)).digest("hex") : "missing", runner = (deps) => deps.run ?? ((command, args) => {
+}, digest2 = (file) => existsSync17(file) ? createHash13("sha256").update(readFileSync17(file)).digest("hex") : "missing", runner = (deps) => deps.run ?? ((command, args) => {
   const { home, env } = upgradePaths(deps);
   let step;
   try {
@@ -69309,12 +69916,49 @@ var init_launch = __esm(() => {
   init_upgrade();
 });
 
+// packages/workit-cli/src/prompt.ts
+import { createInterface } from "node:readline/promises";
+async function askLine(question, output = process.stdout) {
+  const prompt = createInterface({ input: process.stdin, output });
+  try {
+    return await prompt.question(question);
+  } finally {
+    prompt.close();
+  }
+}
+async function askOrCancel(io, ask) {
+  try {
+    return await ask();
+  } catch (error) {
+    if (!isPromptAbort(error))
+      throw error;
+    io.stderr(`
+Cancelled.
+`);
+    return null;
+  }
+}
+function cancelled(io) {
+  if (io.json) {
+    const envelope = {
+      ok: false,
+      code: "failed",
+      data: { reason: "cancelled" },
+      error: "cancelled"
+    };
+    io.stdout(`${JSON.stringify(envelope)}
+`);
+  }
+  return CANCELLED_EXIT;
+}
+var CANCELLED_EXIT = 130, isPromptAbort = (error) => typeof error === "object" && error !== null && (error.name === "AbortError" || error.code === "ABORT_ERR");
+var init_prompt = () => {};
+
 // packages/workit-cli/src/verbs/doctor.ts
 var exports_doctor = {};
 __export(exports_doctor, {
   run: () => run5
 });
-import { createInterface } from "node:readline/promises";
 async function confirmForcedLockClear(root, args, io) {
   const lock = inspectMetadataLock(root);
   if (!lock.present)
@@ -69331,23 +69975,20 @@ async function confirmForcedLockClear(root, args, io) {
 `);
     return false;
   }
-  const rl = createInterface({
-    input: process.stdin,
-    output: io.json ? process.stderr : process.stdout
-  });
-  try {
-    const answer = await rl.question("Remove this lock even if its holder may be alive? [y/N] ");
-    return /^y(es)?$/i.test(answer.trim());
-  } finally {
-    rl.close();
-  }
+  const answer = await askOrCancel(io, () => askLine("Remove this lock even if its holder may be alive? [y/N] ", io.json ? process.stderr : process.stdout));
+  if (answer === null)
+    return "cancelled";
+  return /^y(es)?$/i.test(answer.trim());
 }
 async function run5(argv, io) {
   const root = workspaceRootFor();
   const force = argv.includes("--force");
   let fixLock = null;
   if (argv.includes("--fix-lock")) {
-    if (force && !await confirmForcedLockClear(root, argv, io)) {
+    const confirmed = force ? await confirmForcedLockClear(root, argv, io) : true;
+    if (confirmed === "cancelled")
+      return cancelled(io);
+    if (!confirmed) {
       if (!io.json)
         return 3;
       return emit(io, fail("blocked", "fix-lock --force: refusing without --yes outside an interactive terminal", {
@@ -69386,6 +70027,7 @@ var init_doctor2 = __esm(() => {
   init_doctor();
   init_store_lock();
   init_output();
+  init_prompt();
   init_task();
 });
 
@@ -69493,8 +70135,8 @@ var init_redact = __esm(() => {
 });
 
 // packages/workit-core/src/checks.ts
-import { spawn, spawnSync as spawnSync13 } from "node:child_process";
-import { createHash as createHash13 } from "node:crypto";
+import { spawn, spawnSync as spawnSync14 } from "node:child_process";
+import { createHash as createHash14 } from "node:crypto";
 import fs17 from "node:fs";
 import os13 from "node:os";
 import path36 from "node:path";
@@ -69672,7 +70314,7 @@ function runCheckCommand(argv, options) {
       if (!child?.pid)
         return;
       if (windows)
-        spawnSync13("taskkill", ["/pid", String(child.pid), "/T", "/F"], {
+        spawnSync14("taskkill", ["/pid", String(child.pid), "/T", "/F"], {
           stdio: "ignore",
           windowsHide: true
         });
@@ -69828,7 +70470,7 @@ function pruneCheckLogs(storeRoot, options = {}) {
   }
   return report;
 }
-var MAX_LOG_BYTES, TAIL_LINES = 80, MAX_LINE_CHARS = 400, redactLog = (text) => redactText(text), PEM_BEGIN, PEM_END, BATCH_BYTES, MAX_PENDING, PEM_BODY, MAX_KEY_LINES = 4096, MAX_KEY_BYTES, CMD_META, DRAIN_MS = 250, FORWARDED_SIGNALS, logDigest = (log) => `sha256:${createHash13("sha256").update(log).digest("hex")}`, LOG_RETENTION;
+var MAX_LOG_BYTES, TAIL_LINES = 80, MAX_LINE_CHARS = 400, redactLog = (text) => redactText(text), PEM_BEGIN, PEM_END, BATCH_BYTES, MAX_PENDING, PEM_BODY, MAX_KEY_LINES = 4096, MAX_KEY_BYTES, CMD_META, DRAIN_MS = 250, FORWARDED_SIGNALS, logDigest = (log) => `sha256:${createHash14("sha256").update(log).digest("hex")}`, LOG_RETENTION;
 var init_checks3 = __esm(() => {
   init_redact();
   MAX_LOG_BYTES = 2 * 1024 * 1024;
@@ -69917,7 +70559,6 @@ __export(exports_grant, {
   run: () => run8,
   runGrant: () => runGrant
 });
-import { createInterface as createInterface2 } from "node:readline/promises";
 function show(argv, io) {
   const all = argv.includes("--all");
   const named = argv.filter((arg) => !arg.startsWith("--"));
@@ -69932,7 +70573,7 @@ function show(argv, io) {
       return emit(io, fail("not_found", `no workspace named "${named[0]}" in ${listed.path}`));
     return emit(io, ok({ path: listed.path, defaults: DEFAULT_GRANTS, workspaces: rows }), () => rows.flatMap((entry) => [
       `${entry.name} (${entry.glob})`,
-      ...describe2(entry.grants, entry.configured, entry.defaultEndpoint, entry.verification)
+      ...describe2(entry.grants, entry.configured, entry, entry.verification)
     ]));
   }
   let autonomy;
@@ -69941,10 +70582,13 @@ function show(argv, io) {
   } catch (error) {
     return emit(io, fail("invalid_input", error instanceof Error ? error.message : String(error)));
   }
-  return emit(io, ok(autonomy), (data) => [
+  const tracks = releaseTracksReport(io.cwd);
+  const shown = tracks.tracks.length || tracks.error ? { ...autonomy, releaseTracks: tracks } : autonomy;
+  return emit(io, ok(shown), (data) => [
     ...data.note ? [`note: ${data.note}`] : [],
     data.workspace ? `workspace ${data.workspace} (${data.source === "default" ? "D4 defaults" : `from ${data.source}`})` : "no workspace matches this checkout: D4 defaults apply",
-    ...describe2(data.grants, data.configured, data.defaultEndpoint, data.verification),
+    ...describe2(data.grants, data.configured, data, data.verification),
+    ...describeReleaseTracks(tracks).map((line) => `  ${line}`),
     "raising a grant needs the user: workit grant set <workspace> <kind>=<value>"
   ]);
 }
@@ -69966,10 +70610,10 @@ async function change(verb, argv, io, deps) {
     if (kind === "defaultEndpoint") {
       if (verb === "unset")
         endpoint = null;
-      else if (raw === "commit" || raw === "pr")
+      else if (isDefaultEndpoint(raw))
         endpoint = raw;
       else
-        return usage2(io, `${spec}: defaultEndpoint must be commit or pr`);
+        return usage2(io, `${spec}: defaultEndpoint must be ${DEFAULT_ENDPOINTS.join(", ")}`);
       continue;
     }
     if (kind === "verification") {
@@ -69993,8 +70637,8 @@ async function change(verb, argv, io, deps) {
     changes.push({ kind, value });
   }
   const raised = changes.filter(({ kind, value }) => raises(kind, entry.grants[kind], value ?? DEFAULT_GRANTS[kind])).map(({ kind, value }) => ({ kind, value: String(value ?? DEFAULT_GRANTS[kind]) }));
-  if (endpoint === "pr" && entry.defaultEndpoint !== "pr")
-    raised.push({ kind: "defaultEndpoint", value: "pr" });
+  if (endpoint && raisesEndpoint(entry.defaultEndpoint, endpoint))
+    raised.push({ kind: "defaultEndpoint", value: endpoint });
   if (verification !== undefined && verification !== "independent" && entry.verification === "independent")
     raised.push({ kind: "verification", value: "self" });
   if (raised.length > 0) {
@@ -70002,7 +70646,9 @@ async function change(verb, argv, io, deps) {
     const agent = agentMarker(io.env);
     if (!deps.interactive() || agent)
       return emit(io, fail("blocked", `grant_raise_refused: raising ${raised.map(({ kind }) => kind).join(", ")} needs the user at an interactive terminal${agent ? ` (this shell belongs to an agent: ${agent} is set)` : ""}; grants are never raised headless`, { unblock: `ask the user to run, in their own terminal: ${command}` }));
-    const answer = await deps.ask(`Raise ${raised.map(({ kind, value }) => `${kind}=${value}`).join(", ")} for workspace "${workspace}"? An agent there may then do this without asking. Type the workspace name to confirm: `);
+    const answer = await askOrCancel(io, () => deps.ask(`Raise ${raised.map(({ kind, value }) => `${kind}=${value}`).join(", ")} for workspace "${workspace}"? An agent there may then do this without asking. Type the workspace name to confirm: `));
+    if (answer === null)
+      return cancelled(io);
     if (answer.trim() !== workspace)
       return emit(io, fail("blocked", "grant change not confirmed; nothing was written"));
   }
@@ -70011,7 +70657,7 @@ async function change(verb, argv, io, deps) {
     return emit(io, fail(written.code, written.error));
   return emit(io, ok(written), (data) => [
     `${data.workspace}: grants updated in ${data.path}${data.backup ? ` (previous copy: ${data.backup})` : ""}`,
-    ...describe2(data.grants, data.configured, data.defaultEndpoint, data.verification)
+    ...describe2(data.grants, data.configured, data, data.verification)
   ]);
 }
 async function runGrant(argv, io, deps = defaultDeps) {
@@ -70029,15 +70675,18 @@ async function runGrant(argv, io, deps = defaultDeps) {
   }
   return usage2(io, `unknown subcommand "${sub}"`);
 }
-var USAGE2 = "workit grant show [<workspace>] [--all] | grant set <workspace> <kind>=<true|false|verified>… [defaultEndpoint=commit|pr] [verification=self|independent] | grant unset <workspace> <kind>…  (kinds: push, pr, merge, release, rerun, defaultEndpoint, verification)", AGENT_ENV, agentMarker = (env) => AGENT_ENV.find((name) => env[name]) ?? Object.keys(env).find((name) => name.startsWith("CODEX_") && env[name]), defaultDeps, parseValue = (raw) => raw === "true" || raw === "yes" || raw === "on" ? true : raw === "false" || raw === "no" || raw === "off" ? false : raw === "verified" ? "verified" : null, describe2 = (grants, configured, endpoint, verification) => [
+var USAGE2 = "workit grant show [<workspace>] [--all] | grant set <workspace> <kind>=<true|false|verified>… [defaultEndpoint=commit|pr|green|merged] [verification=self|independent] | grant unset <workspace> <kind>…  (kinds: push, pr, merge, release, rerun, defaultEndpoint, verification)", AGENT_ENV, agentMarker = (env) => AGENT_ENV.find((name) => env[name]) ?? Object.keys(env).find((name) => name.startsWith("CODEX_") && env[name]), defaultDeps, parseValue = (raw) => raw === "true" || raw === "yes" || raw === "on" ? true : raw === "false" || raw === "no" || raw === "off" ? false : raw === "verified" ? "verified" : null, STOPS_AT, endpointLabel = (view) => view.effectiveEndpoint === view.defaultEndpoint ? view.defaultEndpoint : `${view.defaultEndpoint} (effective: ${view.effectiveEndpoint}${view.endpointReason ? `, ${view.endpointReason}` : ""})`, describe2 = (grants, configured, endpoint, verification) => [
   ...GRANT_KINDS.map((kind) => `  ${kind.padEnd(8)}${String(grants[kind]).padEnd(10)}${configured.includes(kind) ? "configured" : "default"}${kind === "release" ? " (no consumer yet: reserved, not enforced)" : ""}`),
-  `  default endpoint: ${endpoint} (an unnamed request stops at ${endpoint === "pr" ? "an opened PR" : "a local commit"})`,
+  `  default endpoint: ${endpointLabel(endpoint)} (an unnamed request stops at ${STOPS_AT[endpoint.effectiveEndpoint]})`,
+  ...endpoint.endpointIssue ? [`  note: ${endpoint.endpointIssue}`] : [],
   `  verification: ${verification} (${verification === "independent" ? "a normal-risk behavior change needs a non-author verdict" : "a normal-risk behavior change needs a passing check and the author's --self verdict, shown as self-reviewed"})`
 ], usage2 = (io, message) => emit(io, fail("invalid_input", `${message}
 usage: ${USAGE2}`)), run8 = (argv, io) => runGrant(argv, io);
 var init_grant = __esm(() => {
   init_autonomy();
+  init_release_tracks();
   init_output();
+  init_prompt();
   AGENT_ENV = [
     "CLAUDECODE",
     "OPENCODE",
@@ -70048,14 +70697,13 @@ var init_grant = __esm(() => {
   ];
   defaultDeps = {
     interactive: () => process.stdin.isTTY === true && process.stdout.isTTY === true,
-    ask: async (question) => {
-      const prompt = createInterface2({ input: process.stdin, output: process.stdout });
-      try {
-        return await prompt.question(question);
-      } finally {
-        prompt.close();
-      }
-    }
+    ask: (question) => askLine(question)
+  };
+  STOPS_AT = {
+    commit: "a local commit",
+    pr: "an opened PR",
+    green: "a merge-ready PR: CI green, threads resolved, verified; never merged",
+    merged: "a merged PR (workit pr merge)"
   };
 });
 
@@ -70392,9 +71040,9 @@ var init_check = __esm(() => {
 var success2 = (data) => ({ ok: true, data }), failure3 = (code, error, unblock) => ({ ok: false, code, error, ...unblock ? { unblock } : {} });
 
 // packages/workit-core/src/git/ops.ts
-import { spawnSync as spawnSync14 } from "node:child_process";
+import { spawnSync as spawnSync15 } from "node:child_process";
 function dirtEntries(cwd) {
-  const run = git4(cwd, ["status", "--porcelain=v1", "-z", "--untracked-files=all"]);
+  const run = git5(cwd, ["status", "--porcelain=v1", "-z", "--untracked-files=all"]);
   if (!run.ok)
     return [];
   const parts = run.stdout.split("\x00");
@@ -70410,9 +71058,19 @@ function dirtEntries(cwd) {
   return out;
 }
 function gitBranch(cwd, input) {
-  const name = input.name.trim();
   if (!headSha(cwd) && currentBranch(cwd) === null)
     return failure3("invalid_input", "not inside a git repository with a commit");
+  const explicitBase = input.base?.trim() || null;
+  const resolved = vcsConfig("resolve", cwd, {
+    track: input.track ?? null,
+    ...explicitBase ? { branch: explicitBase } : {}
+  });
+  const releaseTrack = resolved.ok === false ? null : resolved.releaseTrack ?? null;
+  if (releaseTrack?.blocking && (!explicitBase || input.name === undefined))
+    return failure3("blocked", String(releaseTrack.blocking), "workit git branch … --track <name>  # or --base <branch>");
+  const name = (input.name ?? (input.kind && input.slug ? trackBranchName(releaseTrack?.track ?? null, input.kind, input.slug) ?? `${input.kind}/${input.slug}` : "")).trim();
+  if (!name)
+    return failure3("invalid_input", "missing branch name");
   if (!validRefName(cwd, name))
     return failure3("invalid_input", `invalid branch name ${JSON.stringify(name)}`);
   const policy = validateBranchNameFor(cwd, name);
@@ -70420,23 +71078,25 @@ function gitBranch(cwd, input) {
     return failure3("blocked", policy.error, policy.correction);
   if (resolveRef(cwd, `refs/heads/${name}`))
     return failure3("failed", `branch_exists: ${name} already exists`, `git switch ${name}`);
-  let base = input.base?.trim() || null;
+  let base = explicitBase;
   let defaultTarget = null;
-  const resolved = vcsConfig("resolve", cwd);
-  if (resolved.ok === false && !base)
+  let defaultBase = null;
+  if (resolved.ok === false && (!base || input.track))
     return failure3("blocked", String(resolved.error), "fix ~/.config/workit/vcs.json or pass --base <branch>");
-  if (resolved.ok !== false)
+  if (resolved.ok !== false) {
     defaultTarget = String(resolved.defaultTargetBranch ?? "") || null;
-  base ??= defaultTarget;
+    defaultBase = String(resolved.baseBranch ?? "") || defaultTarget;
+  }
+  base ??= defaultBase;
   if (!base)
     return failure3("invalid_input", "no default target branch is configured; pass --base <branch>");
   if (base.startsWith("-"))
     return failure3("invalid_input", "--base must not start with -");
-  const notes = [];
+  const notes = [...releaseTrack?.warnings ?? []];
   const remotes = remoteNames(cwd);
   const remote = remotes.includes("origin") ? "origin" : pushRemoteName(cwd);
   const localTip = resolveRef(cwd, `refs/heads/${base}`);
-  const stackParent = localTip !== null && base !== defaultTarget && !isProtectedTarget(cwd, base);
+  const stackParent = localTip !== null && base !== defaultTarget && base !== defaultBase && !isProtectedTarget(cwd, base);
   let baseRef = null;
   if (stackParent)
     baseRef = `refs/heads/${base}`;
@@ -70454,18 +71114,19 @@ function gitBranch(cwd, input) {
     }
   } else if (localTip)
     baseRef = `refs/heads/${base}`;
-  if (!baseRef && git4(cwd, ["rev-parse", "--verify", "-q", `${base}^{commit}`]).ok)
+  if (!baseRef && git5(cwd, ["rev-parse", "--verify", "-q", `${base}^{commit}`]).ok)
     baseRef = base;
-  const baseSha = baseRef ? git4(cwd, ["rev-parse", "--verify", "-q", `${baseRef}^{commit}`]).stdout.trim() : "";
+  const baseSha = baseRef ? git5(cwd, ["rev-parse", "--verify", "-q", `${baseRef}^{commit}`]).stdout.trim() : "";
   if (!baseRef || !baseSha)
     return failure3("not_found", `base ${base} does not resolve (no ${remote ?? "remote"}/${base}, no local ${base})`, `git fetch ${remote ?? "origin"} ${base}  # or pass --base <ref>`);
   const dirt = classifyBranchDirt(cwd);
   if (dirt === "stash-required" && !input.carry)
     return failure3("blocked", "dirty_worktree: tracked changes outside docs/ would ride along to the new branch", `commit them first (workit git commit -m … -- <paths>), or pass --carry to bring them along`);
   const previous = currentBranch(cwd);
-  const switched = git4(cwd, ["switch", "--no-track", "-c", name, baseSha]);
+  const switched = git5(cwd, ["switch", "--no-track", "-c", name, baseSha]);
   if (!switched.ok)
     return failure3("failed", `git switch -c ${name} failed: ${gitError(switched)}`);
+  recordBranchBase(cwd, name, base);
   return success2({
     branch: name,
     previous,
@@ -70473,7 +71134,8 @@ function gitBranch(cwd, input) {
     baseRef,
     baseSha,
     carried: dirt !== "clean",
-    notes
+    notes,
+    releaseTrack
   });
 }
 function lintCommitMessage(cwd, message) {
@@ -70488,7 +71150,7 @@ function lintCommitMessage(cwd, message) {
   }
   if (preset !== "auto")
     return { ok: true };
-  const log = git4(cwd, ["log", "-n", "50", "--no-merges", "--format=%s"]);
+  const log = git5(cwd, ["log", "-n", "50", "--no-merges", "--format=%s"]);
   const subjects = log.ok ? log.stdout.split(`
 `).filter(Boolean) : [];
   const detected = detectCommitFlavor(subjects).flavor;
@@ -70526,28 +71188,28 @@ function gitCommit(cwd, input) {
   if (paths.length) {
     if (paths.some((value) => value.startsWith("-") || !value.trim()))
       return failure3("invalid_input", "paths must not be empty or start with -");
-    const added = git4(cwd, ["add", "-A", "--", ...paths]);
+    const added = git5(cwd, ["add", "-A", "--", ...paths]);
     if (!added.ok)
       return failure3("failed", `git add failed: ${gitError(added)}`);
     args.push("--", ...paths);
   } else if (input.all) {
-    const added = git4(cwd, ["add", "-A"]);
+    const added = git5(cwd, ["add", "-A"]);
     if (!added.ok)
       return failure3("failed", `git add failed: ${gitError(added)}`);
   } else {
-    const staged = git4(cwd, ["diff", "--cached", "--name-only", "-z"]);
+    const staged = git5(cwd, ["diff", "--cached", "--name-only", "-z"]);
     if (staged.ok && !staged.stdout.replaceAll("\x00", "")) {
       const dirt = dirtEntries(cwd);
       return failure3(dirt.length ? "blocked" : "failed", dirt.length ? `nothing_staged: nothing is staged and workit never commits unrelated changes implicitly (${dirt.length} changed: ${dirt.slice(0, 5).map((entry) => entry.slice(3)).join(", ")}${dirt.length > 5 ? ", …" : ""})` : "nothing_to_commit: the working tree is clean", dirt.length ? `workit git commit -m '<msg>' -- <paths>  # or --all to commit every change` : undefined);
     }
   }
-  const committed = git4(cwd, args, { timeoutMs: COMMIT_TIMEOUT_MS, env: input.env });
+  const committed = git5(cwd, args, { timeoutMs: COMMIT_TIMEOUT_MS, env: input.env });
   if (!committed.ok)
     return failure3("failed", `git commit failed: ${gitError(committed, 6)}`);
   const sha = headSha(cwd);
   if (!sha)
     return failure3("failed", "the commit did not resolve");
-  const files = nulList(git4(cwd, ["diff-tree", "--root", "--no-commit-id", "--name-only", "-r", "-z", sha]).stdout);
+  const files = nulList(git5(cwd, ["diff-tree", "--root", "--no-commit-id", "--name-only", "-r", "-z", sha]).stdout);
   const leftDirty = dirtEntries(cwd).length;
   const listed = [];
   let size = 0;
@@ -70619,9 +71281,9 @@ function recordedRemoteTip(cwd, plan) {
   return;
 }
 function includesRemoteTip(cwd, branch, tip) {
-  if (git4(cwd, ["merge-base", "--is-ancestor", tip, `refs/heads/${branch}`]).ok)
+  if (git5(cwd, ["merge-base", "--is-ancestor", tip, `refs/heads/${branch}`]).ok)
     return true;
-  const reflog = git4(cwd, ["reflog", "show", "--format=%H", `refs/heads/${branch}`, "--"]);
+  const reflog = git5(cwd, ["reflog", "show", "--format=%H", `refs/heads/${branch}`, "--"]);
   return reflog.ok && reflog.stdout.split(`
 `).some((line) => line.trim() === tip);
 }
@@ -70671,7 +71333,7 @@ ${run.stdout}`;
     return failure3("failed", `push_unverified: ${plan.remote}/${plan.branch} is at ${after.sha?.slice(0, 12) ?? "(absent)"}, not the pushed ${plan.sha.slice(0, 12)}`, "workit verify-delivery push");
   let upstream = false;
   if (input.setUpstream) {
-    upstream = git4(cwd, ["config", `branch.${plan.branch}.remote`, plan.remote]).ok && git4(cwd, ["config", `branch.${plan.branch}.merge`, `refs/heads/${plan.branch}`]).ok;
+    upstream = git5(cwd, ["config", `branch.${plan.branch}.remote`, plan.remote]).ok && git5(cwd, ["config", `branch.${plan.branch}.merge`, `refs/heads/${plan.branch}`]).ok;
   }
   const row = appendObserved(cwd, {
     type: pushed ? "push.verified" : "push.noop",
@@ -70721,8 +71383,8 @@ function deleteRemoteBranch(cwd, target, branch, expectedTip, options = {}) {
 ${run.stdout}`;
   return /stale info|cannot lock ref|fetch first|non-fast-forward/iu.test(text) ? { ok: false, lease: true, error: "the remote branch tip changed before deletion" } : { ok: false, lease: false, error: gitError(run) };
 }
-var COMMIT_TIMEOUT_MS, PUSH_TIMEOUT_MS = 120000, git4 = (cwd, args, options = {}) => {
-  const result = spawnSync14("git", args, {
+var COMMIT_TIMEOUT_MS, PUSH_TIMEOUT_MS = 120000, git5 = (cwd, args, options = {}) => {
+  const result = spawnSync15("git", args, {
     cwd,
     encoding: "utf8",
     env: { ...options.env ?? process.env, GIT_TERMINAL_PROMPT: "0" },
@@ -70742,11 +71404,12 @@ var COMMIT_TIMEOUT_MS, PUSH_TIMEOUT_MS = 120000, git4 = (cwd, args, options = {}
   const lines = redactText(`${run.stderr}
 ${run.stdout ?? ""}`).split(/\r?\n/u).map((value) => value.trim()).filter((value) => value && !value.startsWith("hint:"));
   return lines.slice(-max).join(" / ").slice(0, 400) || "git failed";
-}, validRefName = (cwd, name) => !name.startsWith("-") && git4(cwd, ["check-ref-format", "--branch", name]).ok, nulList = (text) => text.split("\x00").filter(Boolean), SESSION_SAFE, SHA;
+}, validRefName = (cwd, name) => !name.startsWith("-") && git5(cwd, ["check-ref-format", "--branch", name]).ok, nulList = (text) => text.split("\x00").filter(Boolean), SESSION_SAFE, SHA;
 var init_ops = __esm(() => {
   init_branch();
   init_commit_flavors();
   init_pr_create();
+  init_release_tracks();
   init_vcs_config();
   init_redact();
   init_ledger();
@@ -70903,6 +71566,32 @@ function blockersOf(input) {
   }
   return out;
 }
+function babysitAction(next, reason, draft) {
+  switch (next) {
+    case "MERGED":
+      return "merged";
+    case "CLOSED":
+      return null;
+    case "RESOLVE_CONFLICTS":
+    case "REBASE":
+      return "update-branch";
+    case "RESOLVE_THREADS":
+    case "ADDRESS_REVIEW":
+      return "address-threads";
+    case "FIX_CI":
+      return "fix-ci";
+    case "WAITING_CI":
+      return "wait";
+    case "IN_MERGE_QUEUE":
+      return "wait-forge";
+    default:
+      if (draft)
+        return "mark-ready";
+      if (next === "NOT_MERGEABLE" && reason === "mergeability_unknown")
+        return "wait-forge";
+      return "ready";
+  }
+}
 function computeBehindBase(cwd, remotes, baseSha, headSha_, options = {}) {
   const empty = { behind: null, ahead: null, upToDate: null };
   if (!baseSha)
@@ -71027,7 +71716,8 @@ function buildStatusDoc(cwd, resolved, status, options) {
     blockers: status.state === "open" ? blockers.map((blocker) => blocker.reason) : [],
     identity: options.identity ?? null,
     truncated: status.truncated,
-    next: blockers[0]?.next ?? "READY"
+    next: blockers[0]?.next ?? "READY",
+    babysit: babysitAction(blockers[0]?.next ?? "READY", blockers[0]?.reason ?? null, status.draft || blockers.some((blocker) => blocker.next === "MARK_READY"))
   });
 }
 function prStatusReport(cwd, resolved, options = {}) {
@@ -71175,7 +71865,7 @@ var init_report = __esm(() => {
 });
 
 // packages/workit-core/src/forge/pr-ops.ts
-import { spawnSync as spawnSync15 } from "node:child_process";
+import { spawnSync as spawnSync16 } from "node:child_process";
 function fillFromCommits(cwd, resolved, base) {
   const tracking = `refs/remotes/${resolved.baseRemote}/${base}`;
   if (!base.startsWith("-"))
@@ -71183,7 +71873,7 @@ function fillFromCommits(cwd, resolved, base) {
   const from = resolveRef(cwd, tracking) ?? resolveRef(cwd, `refs/heads/${base}`);
   if (!from)
     return failure3("not_found", `base ${base} is not available locally`, `git fetch ${resolved.baseRemote} ${base}`);
-  const log = spawnSync15("git", ["log", "--reverse", "--no-merges", "--format=%s%x1f%b%x1e", `${from}..HEAD`], {
+  const log = spawnSync16("git", ["log", "--reverse", "--no-merges", "--format=%s%x1f%b%x1e", `${from}..HEAD`], {
     cwd,
     encoding: "utf8",
     timeout: GIT_TIMEOUTS.local,
@@ -71382,6 +72072,7 @@ async function mergePullRequest(cwd, resolved, input, sleep) {
     const gone = !deleted.ok && remoteRefTip(cwd, resolved.remote, `refs/heads/${branch}`);
     deletedBranch = deleted.ok || gone && gone.ok && gone.sha === null ? true : { error: deleted.error };
   }
+  const mergeBack = mergeBackFor(cwd, doc.base);
   const row = appendObserved(cwd, {
     type: "pr.merged",
     actor: input.actor,
@@ -71407,11 +72098,25 @@ async function mergePullRequest(cwd, resolved, input, sleep) {
       verdict,
       grant: { source: grant.source },
       deletedBranch,
-      recorded: row.ok ? { id: String(row.value.id) } : { error: row.error }
+      recorded: row.ok ? { id: String(row.value.id) } : { error: row.error },
+      mergeBack: mergeBack.branches,
+      mergeBackTrack: mergeBack.track
     }
   };
 }
-var VERIFY_DELAYS_MS, noun = (resolved) => resolved.forge.kind === "github" ? "pull request" : "merge request", grantBlocked = (decision) => failure3("blocked", decision.error, decision.unblock), refuse = (error, unblock, refusal) => ({
+var VERIFY_DELAYS_MS, noun = (resolved) => resolved.forge.kind === "github" ? "pull request" : "merge request", grantBlocked = (decision) => failure3("blocked", decision.error, decision.unblock), mergeBackFor = (cwd, base) => {
+  try {
+    const owners = workspaceReleaseTracks(cwd).tracks.filter((track) => track.productionBranch === base);
+    if (owners.length !== 1)
+      return { track: null, branches: [] };
+    return {
+      track: owners[0].name,
+      branches: owners[0].mergeBackBranches.filter((branch) => branch !== base)
+    };
+  } catch {
+    return { track: null, branches: [] };
+  }
+}, refuse = (error, unblock, refusal) => ({
   ok: false,
   code: "blocked",
   error,
@@ -71422,6 +72127,7 @@ var init_pr_ops = __esm(() => {
   init_autonomy();
   init_branch();
   init_vcs_config();
+  init_release_tracks();
   init_ops();
   init_rev();
   init_ledger();
@@ -71442,7 +72148,7 @@ var init_pr_ops = __esm(() => {
 });
 
 // packages/workit-core/src/forge/exec.ts
-import { spawnSync as spawnSync16 } from "node:child_process";
+import { spawnSync as spawnSync17 } from "node:child_process";
 import fs19 from "node:fs";
 import path39 from "node:path";
 function findExecutable(bin, env) {
@@ -71477,7 +72183,7 @@ function systemRunner(kind, apiHost, env = process.env) {
     if (!exe)
       return { status: null, stdout: "", stderr: "", timedOut: false, missing: true };
     const token = options.token ? kind === "github" ? { GH_TOKEN: options.token, GH_ENTERPRISE_TOKEN: options.token } : { GITLAB_TOKEN: options.token } : {};
-    const result = spawnSync16(exe, [...args], {
+    const result = spawnSync17(exe, [...args], {
       encoding: "utf8",
       env: { ...childEnv, ...token },
       maxBuffer: MAX_BUFFER2,
@@ -72370,6 +73076,8 @@ function renderStatus(doc) {
     lines.push(`blockers: ${doc.blockers.join(", ")}`);
   if (doc.identity?.note)
     lines.push(`identity: ${doc.identity.note}`);
+  if (doc.babysit)
+    lines.push(`babysit: ${doc.babysit}`);
   lines.push(`next: ${doc.next}`);
   return lines;
 }
@@ -72390,7 +73098,7 @@ var exports_pr = {};
 __export(exports_pr, {
   run: () => run10
 });
-import { readFileSync as readFileSync17 } from "node:fs";
+import { readFileSync as readFileSync18 } from "node:fs";
 import path40 from "node:path";
 async function status(argv, io) {
   const flags = parseFlags(argv, { pr: "value", branch: "value", "log-lines": "value" });
@@ -72443,6 +73151,7 @@ function verdictBlock(cwd, branch) {
 async function create4(argv, io) {
   const flags = parseFlags(argv, {
     base: "value",
+    track: "value",
     title: "value",
     body: "value",
     "body-file": "value",
@@ -72461,18 +73170,26 @@ async function create4(argv, io) {
   let body = flags.values.body ?? null;
   if (flags.values["body-file"] !== undefined) {
     try {
-      body = readFileSync17(path40.resolve(io.cwd, flags.values["body-file"]), "utf8");
+      body = readFileSync18(path40.resolve(io.cwd, flags.values["body-file"]), "utf8");
     } catch {
       return usage3(io, `cannot read --body-file ${flags.values["body-file"]}`, CREATE_USAGE);
     }
   }
+  if (flags.values.base !== undefined && flags.values.track !== undefined)
+    return usage3(io, "pass --base or --track, not both (--track picks the base for you)", CREATE_USAGE);
   let base = flags.values.base ?? null;
+  let releaseTrack = null;
   if (!base) {
-    const resolved = vcsConfig("resolve", io.cwd);
+    const resolved = vcsConfig("resolve", io.cwd, { track: flags.values.track ?? null });
     if (resolved.ok === false)
       return emit(io, fail("blocked", String(resolved.error), {
         unblock: "fix ~/.config/workit/vcs.json or pass --base <b>"
       }));
+    releaseTrack = resolved.releaseTrack ?? null;
+    if (releaseTrack?.blocking)
+      return emit(io, fail("blocked", releaseTrack.blocking, {
+        unblock: "workit pr create --track <name> …  # or --base <branch>"
+      }));
     base = String(resolved.defaultTargetBranch ?? "") || null;
   }
   if (!base)
@@ -72502,8 +73219,11 @@ async function create4(argv, io) {
   }, forgeDeps.sleep);
   if (!result.ok)
     return forgeFail(io, result);
-  return emit(io, ok(result.data), (data) => [
+  const created = releaseTrack ? { ...result.data, releaseTrack } : result.data;
+  return emit(io, ok(created), (data) => [
     `${data.created ? "opened" : "found open"} ${connected.data.forge.kind === "github" ? "PR #" : "MR !"}${data.number}${data.draft && data.created ? " (draft)" : ""}: ${data.branch} -> ${data.base}  ${data.url}`,
+    ...data.releaseTrack?.name ? [`release track: ${data.releaseTrack.name} (${data.releaseTrack.detail})`] : [],
+    ...(data.releaseTrack?.warnings ?? []).map((warning) => `note: ${warning}`),
     `head ${data.head.slice(0, 12)} verified on the forge`,
     ..."error" in data.recorded ? [`ledger: not recorded (${data.recorded.error})`] : []
   ]);
@@ -72532,6 +73252,9 @@ async function merge3(argv, io) {
   return emit(io, ok(result.data), (data) => [
     `merged ${connected.data.forge.kind === "github" ? "PR #" : "MR !"}${data.number} (${data.method}) at head ${data.head.slice(0, 12)}${data.mergeSha ? ` -> ${data.mergeSha.slice(0, 12)}` : ""}`,
     data.verdict.required ? `verdict ${data.verdict.verdictId ?? "?"} accepted for that head` : "no verdict required (workspace grants merge: true)",
+    ...data.mergeBack.length ? [
+      `merge back: ${data.base} is the ${data.mergeBackTrack} production branch; bring it into ${data.mergeBack.join(", ")}`
+    ] : [],
     ...data.deletedBranch === true ? [`deleted ${data.branch}`] : typeof data.deletedBranch === "object" ? [`branch not deleted: ${data.deletedBranch.error}`] : [],
     ..."error" in data.recorded ? [`ledger: not recorded (${data.recorded.error})`] : []
   ]);
@@ -72546,7 +73269,7 @@ async function run10(argv, io) {
     return merge3(rest, io);
   return usage3(io, sub && !sub.startsWith("-") ? `unknown pr subcommand "${sub}"` : "missing pr subcommand", USAGE4);
 }
-var STATUS_USAGE = "workit pr status [--pr <n> | --branch <b>] [--log-lines 60] [--json]", CREATE_USAGE = "workit pr create [--base <b>] (--title <t> [--body <text> | --body-file <f>] | --fill) [--draft] [--json]", MERGE_USAGE = "workit pr merge [--pr <n>] [--method squash|merge|rebase] [--delete-branch] [--json]", USAGE4 = "workit pr status|create|merge ... (workit help pr)", METHODS2;
+var STATUS_USAGE = "workit pr status [--pr <n> | --branch <b>] [--log-lines 60] [--json]", CREATE_USAGE = "workit pr create [--base <b> | --track <t>] (--title <t> [--body <text> | --body-file <f>] | --fill) [--draft] [--json]", MERGE_USAGE = "workit pr merge [--pr <n>] [--method squash|merge|rebase] [--delete-branch] [--json]", USAGE4 = "workit pr status|create|merge ... (workit help pr)", METHODS2;
 var init_pr = __esm(() => {
   init_pr_body();
   init_pr_ops();
@@ -72777,7 +73500,13 @@ __export(exports_git, {
   run: () => run12
 });
 async function branch(argv, io) {
-  const flags = parseFlags(argv, { base: "value", kind: "value", slug: "value", carry: "boolean" });
+  const flags = parseFlags(argv, {
+    base: "value",
+    kind: "value",
+    slug: "value",
+    track: "value",
+    carry: "boolean"
+  });
   if (typeof flags === "string")
     return usage3(io, flags, BRANCH_USAGE);
   const { kind, slug } = flags.values;
@@ -72789,18 +73518,19 @@ async function branch(argv, io) {
     return usage3(io, "--kind must be feature, bugfix or hotfix", BRANCH_USAGE);
   if (kind !== undefined && flags.positionals.length)
     return usage3(io, "pass a name or --kind/--slug, not both", BRANCH_USAGE);
-  const name = kind !== undefined ? `${kind}/${slug}` : flags.positionals[0];
-  if (!name)
+  if (kind === undefined && !flags.positionals[0])
     return usage3(io, "missing branch name", BRANCH_USAGE);
   const result = gitBranch(io.cwd, {
-    name,
+    ...kind !== undefined ? { kind, slug } : { name: flags.positionals[0] },
     base: flags.values.base ?? null,
+    track: flags.values.track ?? null,
     carry: flags.booleans.has("carry")
   });
   if (!result.ok)
     return forgeFail(io, result);
   return emit(io, ok(result.data), (data) => [
     `switched to new branch ${data.branch} from ${data.baseRef} (${short2(data.baseSha)})${data.carried ? ", carrying uncommitted changes" : ""}`,
+    ...data.releaseTrack?.name ? [`release track: ${data.releaseTrack.name} (${data.releaseTrack.detail})`] : [],
     ...data.notes.map((note) => `note: ${note}`)
   ]);
 }
@@ -72921,7 +73651,7 @@ async function run12(argv, io) {
     return push(rest, io);
   return usage3(io, sub && !sub.startsWith("-") ? `unknown git subcommand "${sub}"` : "missing git subcommand", USAGE5);
 }
-var BRANCH_USAGE = "workit git branch <name> | --kind feature|bugfix|hotfix --slug <s>  [--base <b>] [--carry] [--json]", COMMIT_USAGE = "workit git commit -m <msg> [--all | [--] <paths…>] [--json]", PUSH_USAGE = "workit git push [--set-upstream] [--force-with-lease [--expect <sha>] [--overwrite-unintegrated]] [--json]", USAGE5 = "workit git branch|commit|push ... (workit help git)", short2 = (sha) => sha ? sha.slice(0, 12) : "(none)";
+var BRANCH_USAGE = "workit git branch <name> | --kind feature|bugfix|hotfix --slug <s>  [--base <b>] [--track <t>] [--carry] [--json]", COMMIT_USAGE = "workit git commit -m <msg> [--all | [--] <paths…>] [--json]", PUSH_USAGE = "workit git push [--set-upstream] [--force-with-lease [--expect <sha>] [--overwrite-unintegrated]] [--json]", USAGE5 = "workit git branch|commit|push ... (workit help git)", short2 = (sha) => sha ? sha.slice(0, 12) : "(none)";
 var init_git2 = __esm(() => {
   init_autonomy();
   init_ops();
@@ -72932,7 +73662,7 @@ var init_git2 = __esm(() => {
 });
 
 // packages/workit-core/src/forge/verify.ts
-import { spawnSync as spawnSync17 } from "node:child_process";
+import { spawnSync as spawnSync18 } from "node:child_process";
 function finish(cwd, report, actor) {
   const delivered = report.observations.length > 0 && report.observations.every((entry) => entry.ok);
   const out = { ...report, delivered };
@@ -73145,7 +73875,7 @@ var NPM_NAME, SEMVER, SAFE_ARG, systemNpm = (args) => {
   };
   const found = process.platform === "win32" ? findExecutable("npm.cmd", process.env) : null;
   const npmCmd = found && !/["%!^]/u.test(found) ? `"${found}"` : "npm.cmd";
-  const result = process.platform === "win32" ? spawnSync17(`${npmCmd} ${args.join(" ")}`, { ...options, shell: true }) : spawnSync17("npm", [...args], options);
+  const result = process.platform === "win32" ? spawnSync18(`${npmCmd} ${args.join(" ")}`, { ...options, shell: true }) : spawnSync18("npm", [...args], options);
   return { status: result.status, stdout: result.stdout ?? "", stderr: result.stderr ?? "" };
 }, short3 = (sha) => sha ? sha.slice(0, 12) : "(absent)", npmView = (stdout) => {
   try {
@@ -73252,8 +73982,8 @@ var init_verify_delivery = __esm(() => {
 });
 
 // packages/workit-core/src/stack.ts
-import { spawnSync as spawnSync18 } from "node:child_process";
-import { createHash as createHash14, randomBytes as randomBytes3 } from "node:crypto";
+import { spawnSync as spawnSync19 } from "node:child_process";
+import { createHash as createHash15, randomBytes as randomBytes3 } from "node:crypto";
 import fs21 from "node:fs";
 import path41 from "node:path";
 function worktreeOf(cwd, branch) {
@@ -73353,7 +74083,7 @@ function stacksDir(cwd) {
   return { ok: true, data: path41.join(root.value.root, "stacks") };
 }
 function parseStack(raw) {
-  if (!isRecord6(raw) || !Array.isArray(raw.branches))
+  if (!isRecord7(raw) || !Array.isArray(raw.branches))
     return null;
   const name = str3(raw.name);
   const trunk = str3(raw.trunk);
@@ -73361,12 +74091,12 @@ function parseStack(raw) {
     return null;
   const branches = [];
   for (const item of raw.branches) {
-    if (!isRecord6(item))
+    if (!isRecord7(item))
       return null;
     const branch = str3(item.branch);
     if (!branch)
       return null;
-    const merged = isRecord6(item.merged) ? {
+    const merged = isRecord7(item.merged) ? {
       pr: typeof item.merged.pr === "number" ? item.merged.pr : null,
       mergeSha: str3(item.merged.mergeSha),
       at: str3(item.merged.at) ?? ""
@@ -73379,7 +74109,7 @@ function parseStack(raw) {
       lastParentHead: str3(item.lastParentHead),
       patchId: str3(item.patchId),
       merged,
-      ...isRecord6(item.pendingRestack) && str3(item.pendingRestack.from) && str3(item.pendingRestack.tip) && str3(item.pendingRestack.onto) ? {
+      ...isRecord7(item.pendingRestack) && str3(item.pendingRestack.from) && str3(item.pendingRestack.tip) && str3(item.pendingRestack.onto) ? {
         pendingRestack: {
           from: str3(item.pendingRestack.from),
           tip: str3(item.pendingRestack.tip),
@@ -73765,7 +74495,7 @@ function commitKeys(cwd, range) {
   const patches = new Map;
   const diff = gitRun3(cwd, ["log", "--no-merges", "-p", "--format=commit %H", range]);
   if (diff.ok && diff.stdout.trim()) {
-    const ids = spawnSync18("git", ["patch-id", "--stable"], {
+    const ids = spawnSync19("git", ["patch-id", "--stable"], {
       cwd,
       input: diff.stdout,
       encoding: "utf8",
@@ -74373,7 +75103,7 @@ var STACK_VERSION = 1, stackFail = (code, error, unblock, data) => ({
   ...unblock ? { unblock } : {},
   ...data ? { data } : {}
 }), fromForge = (result) => stackFail(result.code, result.error, result.unblock), stackDeps, gitRun3 = (cwd, args, timeoutMs = GIT_TIMEOUTS.local) => {
-  const run = spawnSync18("git", args, {
+  const run = spawnSync19("git", args, {
     cwd,
     encoding: "utf8",
     timeout: timeoutMs,
@@ -74404,7 +75134,7 @@ var STACK_VERSION = 1, stackFail = (code, error, unblock, data) => ({
   return dir.ok ? path41.join(dir.data, "worktrees") : null;
 }, firstLine = (run) => (`${run.stderr}
 ${run.stdout}`.split(`
-`).find((line) => line.trim()) ?? "git failed").trim().slice(0, 300), stackFileName = (name) => `${name.replace(/[^A-Za-z0-9._-]+/gu, "_").replace(/^[._]+/u, "").slice(0, 48).toLowerCase()}-${createHash14("sha256").update(name).digest("hex").slice(0, 12)}.json`, fileFor, validName = (name) => {
+`).find((line) => line.trim()) ?? "git failed").trim().slice(0, 300), stackFileName = (name) => `${name.replace(/[^A-Za-z0-9._-]+/gu, "_").replace(/^[._]+/u, "").slice(0, 48).toLowerCase()}-${createHash15("sha256").update(name).digest("hex").slice(0, 12)}.json`, fileFor, validName = (name) => {
   if (name.length === 0 || name.length > 200)
     return false;
   for (let index = 0;index < name.length; index += 1) {
@@ -74413,7 +75143,7 @@ ${run.stdout}`.split(`
       return false;
   }
   return true;
-}, isRecord6 = (value) => typeof value === "object" && value !== null && !Array.isArray(value), str3 = (value) => typeof value === "string" && value ? value : null, LOCK_WAIT_MS3 = 2000, HEARTBEAT_MS = 20000, HEARTBEAT_STALE_MS, OWNERLESS_STALE_MS = 30000, OWNER = "owner", readOwner = (lock) => {
+}, isRecord7 = (value) => typeof value === "object" && value !== null && !Array.isArray(value), str3 = (value) => typeof value === "string" && value ? value : null, LOCK_WAIT_MS3 = 2000, HEARTBEAT_MS = 20000, HEARTBEAT_STALE_MS, OWNERLESS_STALE_MS = 30000, OWNER = "owner", readOwner = (lock) => {
   let raw = null;
   try {
     raw = fs21.readFileSync(path41.join(lock, OWNER), "utf8");
@@ -74459,7 +75189,7 @@ __export(exports_stack, {
   run: () => run14
 });
 async function plan(argv, io) {
-  const flags = parseFlags(argv, { name: "value", trunk: "value" });
+  const flags = parseFlags(argv, { name: "value", trunk: "value", track: "value" });
   if (typeof flags === "string")
     return usage3(io, flags, PLAN_USAGE);
   const name = flags.values.name ?? null;
@@ -74472,7 +75202,20 @@ async function plan(argv, io) {
     if (selected.ok)
       existing = selected.data;
   }
-  const trunk = flags.values.trunk ?? existing?.trunk ?? defaultTrunk(io) ?? "main";
+  const track = flags.values.track ?? null;
+  if (track !== null && flags.values.trunk !== undefined)
+    return usage3(io, "pass --trunk or --track, not both (--track picks the trunk)", PLAN_USAGE);
+  let trunk = flags.values.trunk ?? existing?.trunk ?? null;
+  if (trunk === null || track !== null) {
+    const derived = defaultTrunk(io, track, flags.positionals[0] ?? null);
+    if ("error" in derived)
+      return emit(io, fail("blocked", derived.error, {
+        unblock: "workit stack plan --track <name> …  # or --trunk <branch>"
+      }));
+    if (existing && track !== null && derived.trunk !== existing.trunk)
+      return emit(io, fail("invalid_input", `stack ${existing.name} is on trunk ${existing.trunk}; --track ${track} targets ${derived.trunk ?? "(none)"}`, { unblock: "drop --track to re-plan on the recorded trunk" }));
+    trunk ??= derived.trunk ?? "main";
+  }
   const connected = connect(io, flags.positionals[0] ?? null);
   const resolved = connected.ok ? connected.data : null;
   const planned = planStack(io.cwd, resolved, { name, trunk, branches: flags.positionals }, existing);
@@ -74632,9 +75375,16 @@ async function run14(argv, io) {
     return land(rest, io);
   return usage3(io, sub && !sub.startsWith("-") ? `unknown stack subcommand "${sub}"` : "missing stack subcommand", USAGE7);
 }
-var PLAN_USAGE = "workit stack plan [--name <n>] [--trunk <b>] [<bottom> … <top>] [--json]", STATUS_USAGE2 = "workit stack status [--name <n>] [--json]", SYNC_USAGE = "workit stack sync [--name <n>] [--local] [--dry-run] [--force <branch>]… [--json]", LAND_USAGE = "workit stack land [--name <n>] [--dry-run] [--max <n>] [--method squash|merge|rebase] [--timeout 20m] [--interval 30s] [--json]", USAGE7 = "workit stack plan|status|sync|land ... (workit help stack)", short4 = (sha) => sha ? sha.slice(0, 12) : "?", stackFailed = (io, result) => emit(io, fail(result.code, result.error, { unblock: result.unblock, data: result.data ?? {} })), defaultTrunk = (io) => {
-  const resolved = vcsConfig("resolve", io.cwd);
-  return resolved.ok === false ? null : String(resolved.defaultTargetBranch ?? "") || null;
+var PLAN_USAGE = "workit stack plan [--name <n>] [--trunk <b> | --track <t>] [<bottom> … <top>] [--json]", STATUS_USAGE2 = "workit stack status [--name <n>] [--json]", SYNC_USAGE = "workit stack sync [--name <n>] [--local] [--dry-run] [--force <branch>]… [--json]", LAND_USAGE = "workit stack land [--name <n>] [--dry-run] [--max <n>] [--method squash|merge|rebase] [--timeout 20m] [--interval 30s] [--json]", USAGE7 = "workit stack plan|status|sync|land ... (workit help stack)", short4 = (sha) => sha ? sha.slice(0, 12) : "?", stackFailed = (io, result) => emit(io, fail(result.code, result.error, { unblock: result.unblock, data: result.data ?? {} })), defaultTrunk = (io, track, branch) => {
+  const resolved = vcsConfig("resolve", io.cwd, {
+    track,
+    ...branch ? { branch } : {}
+  });
+  if (resolved.ok === false)
+    return track !== null || String(resolved.configPath ?? "").endsWith("workspaces.json") ? { error: String(resolved.error) } : { trunk: null };
+  if (resolved.releaseTrack?.blocking)
+    return { error: String(resolved.releaseTrack.blocking) };
+  return { trunk: String(resolved.defaultTargetBranch ?? "") || null };
 }, label = (forge, pr) => pr === null ? "no PR" : `${forge === "gitlab" ? "MR !" : "PR #"}${pr}`, renderSync = (data) => [
   `${data.dryRun ? "would sync" : "synced"} stack ${data.name}${data.merged.length ? `; merged: ${data.merged.map((item) => item.branch).join(", ")}` : ""}`,
   ...data.steps.map((step) => [
@@ -90686,11 +91436,11 @@ var init_rules = __esm(() => {
 });
 
 // packages/workit-cli/src/test-audit/audit.ts
-import { spawnSync as spawnSync19 } from "node:child_process";
-import { existsSync as existsSync18, readdirSync as readdirSync8, readFileSync as readFileSync18, statSync as statSync7 } from "node:fs";
+import { spawnSync as spawnSync20 } from "node:child_process";
+import { existsSync as existsSync18, readdirSync as readdirSync8, readFileSync as readFileSync19, statSync as statSync7 } from "node:fs";
 import path43 from "node:path";
-function git5(cwd, args) {
-  const run = spawnSync19("git", ["-c", "core.quotepath=off", ...args], {
+function git6(cwd, args) {
+  const run = spawnSync20("git", ["-c", "core.quotepath=off", ...args], {
     cwd,
     encoding: "utf8",
     maxBuffer: 64 * 1024 * 1024
@@ -90726,20 +91476,20 @@ function expandPaths(cwd, inputs) {
 function resolveBase(cwd, base) {
   const candidates = base ? [base] : ["origin/main", "main", "origin/master", "master"];
   for (const candidate of candidates) {
-    if (!git5(cwd, ["rev-parse", "--verify", "--quiet", `${candidate}^{commit}`]).ok)
+    if (!git6(cwd, ["rev-parse", "--verify", "--quiet", `${candidate}^{commit}`]).ok)
       continue;
-    const mergeBase = git5(cwd, ["merge-base", candidate, "HEAD"]);
+    const mergeBase = git6(cwd, ["merge-base", candidate, "HEAD"]);
     return mergeBase.ok ? mergeBase.stdout.trim() : null;
   }
   return null;
 }
 function changedLines(cwd, base) {
-  const root = git5(cwd, ["rev-parse", "--show-toplevel"]).stdout.trim();
+  const root = git6(cwd, ["rev-parse", "--show-toplevel"]).stdout.trim();
   const changed = new Map;
-  const names = git5(root, ["diff", "--name-only", "-z", "--no-renames", "--diff-filter=AM", base]);
+  const names = git6(root, ["diff", "--name-only", "-z", "--no-renames", "--diff-filter=AM", base]);
   for (const file of names.stdout.split("\x00").filter(Boolean)) {
     const lines = new Set;
-    const diff = git5(root, ["diff", "-U0", "--no-color", "--no-ext-diff", base, "--", file]);
+    const diff = git6(root, ["diff", "-U0", "--no-color", "--no-ext-diff", base, "--", file]);
     for (const line of diff.stdout.split(`
 `)) {
       const hunk = /^@@ -\S+ \+(\d+)(?:,(\d+))? @@/.exec(line);
@@ -90752,7 +91502,7 @@ function changedLines(cwd, base) {
     }
     changed.set(path43.join(root, file), lines);
   }
-  const untracked = git5(root, ["ls-files", "--others", "--exclude-standard", "-z"]);
+  const untracked = git6(root, ["ls-files", "--others", "--exclude-standard", "-z"]);
   for (const file of untracked.stdout.split("\x00").filter(Boolean))
     changed.set(path43.join(root, file), "all");
   return changed;
@@ -90767,7 +91517,7 @@ function auditFiles(files, display) {
     const shown = display(file);
     let parsed;
     try {
-      parsed = parseSource(readFileSync18(file, "utf8"), file);
+      parsed = parseSource(readFileSync19(file, "utf8"), file);
     } catch (error) {
       parseErrors.push({
         file: shown,
@@ -90835,7 +91585,7 @@ import {
   mkdirSync as mkdirSync9,
   mkdtempSync as mkdtempSync4,
   readdirSync as readdirSync9,
-  readFileSync as readFileSync19,
+  readFileSync as readFileSync20,
   readlinkSync as readlinkSync3,
   realpathSync as realpathSync9,
   renameSync as renameSync5,
@@ -90944,7 +91694,7 @@ function removeStaleCopies(tmp = os14.tmpdir()) {
       const stat = lstatSync7(dir);
       if (!stat.isDirectory() || uid !== undefined && stat.uid !== uid)
         continue;
-      const pid = Number(readFileSync19(path44.join(dir, PID_FILE), "utf8"));
+      const pid = Number(readFileSync20(path44.join(dir, PID_FILE), "utf8"));
       if (Number.isInteger(pid) && pid > 0 && alive(pid))
         continue;
     } catch (error) {
@@ -91022,18 +91772,18 @@ function copyWorkingTree(repo) {
   const dir = mkdtempSync4(path44.join(os14.tmpdir(), TEMP_PREFIX));
   writeFileSync9(path44.join(dir, PID_FILE), String(process.pid));
   const tree = path44.join(dir, "tree");
-  const head = git5(repo, ["rev-parse", "--verify", "--quiet", "HEAD"]).stdout.trim();
-  if (head && git5(dir, ["clone", "-q", "--shared", "--no-checkout", repo, tree]).ok) {
-    const branch = git5(repo, ["symbolic-ref", "--quiet", "--short", "HEAD"]).stdout.trim();
+  const head = git6(repo, ["rev-parse", "--verify", "--quiet", "HEAD"]).stdout.trim();
+  if (head && git6(dir, ["clone", "-q", "--shared", "--no-checkout", repo, tree]).ok) {
+    const branch = git6(repo, ["symbolic-ref", "--quiet", "--short", "HEAD"]).stdout.trim();
     if (branch) {
-      git5(tree, ["update-ref", `refs/heads/${branch}`, head]);
-      git5(tree, ["symbolic-ref", "HEAD", `refs/heads/${branch}`]);
+      git6(tree, ["update-ref", `refs/heads/${branch}`, head]);
+      git6(tree, ["symbolic-ref", "HEAD", `refs/heads/${branch}`]);
     } else
-      git5(tree, ["update-ref", "--no-deref", "HEAD", head]);
-    git5(tree, ["reset", "-q"]);
+      git6(tree, ["update-ref", "--no-deref", "HEAD", head]);
+    git6(tree, ["reset", "-q"]);
   } else
     mkdirSync9(tree, { recursive: true });
-  const listed = git5(repo, ["ls-files", "-co", "--exclude-standard", "-z"]).stdout.split("\x00");
+  const listed = git6(repo, ["ls-files", "-co", "--exclude-standard", "-z"]).stdout.split("\x00");
   const dirs = new Set([""]);
   for (const relative of listed) {
     if (!relative)
@@ -91096,10 +91846,10 @@ function runCommand(command, cwd, timeoutMs, env) {
 async function runMutation(options) {
   const started = performance.now();
   const { repo } = options;
-  const tracked = git5(repo, ["ls-files", "-co", "--exclude-standard", "-z"]).stdout.split("\x00").filter(Boolean);
+  const tracked = git6(repo, ["ls-files", "-co", "--exclude-standard", "-z"]).stdout.split("\x00").filter(Boolean);
   const testFiles = tracked.filter((file) => TEST_FILE.test(file)).map((file) => {
     try {
-      return { file, text: readFileSync19(path44.join(repo, file), "utf8") };
+      return { file, text: readFileSync20(path44.join(repo, file), "utf8") };
     } catch {
       return { file, text: "" };
     }
@@ -91112,7 +91862,7 @@ async function runMutation(options) {
     if (NOT_SOURCE.test(relative) || !existsSync19(absolute))
       continue;
     try {
-      candidates.push(...mutantsFor(readFileSync19(absolute, "utf8"), relative, lines));
+      candidates.push(...mutantsFor(readFileSync20(absolute, "utf8"), relative, lines));
     } catch {}
   }
   const mutants = candidates.map((mutant, index) => ({ ...mutant, id: index + 1 }));
@@ -91192,7 +91942,7 @@ async function runMutation(options) {
         record({ ...mutant, status: "skipped", durationMs: 0, tests, reason: "budget" });
         continue;
       }
-      const original = readFileSync19(path44.join(copy, mutant.file), "utf8");
+      const original = readFileSync20(path44.join(copy, mutant.file), "utf8");
       const mutated = original.slice(0, mutant.start) + mutant.replacement + original.slice(mutant.end);
       current = { file: mutant.file, original };
       if (!writeInside(copy, mutant.file, mutated)) {
@@ -91398,7 +92148,7 @@ async function run16(argv, io) {
   if (typeof options === "string")
     return emit(io, fail("invalid_input", `${options}
 usage: ${USAGE9}`));
-  const top = git5(io.cwd, ["rev-parse", "--show-toplevel"]);
+  const top = git6(io.cwd, ["rev-parse", "--show-toplevel"]);
   const repo = top.ok ? path45.resolve(top.stdout.trim()) : null;
   const display = (file) => toPosix(path45.relative(io.cwd, file) || file);
   let base = null;
@@ -91610,7 +92360,7 @@ var exports_youtrack = {};
 __export(exports_youtrack, {
   run: () => run17
 });
-import { readFileSync as readFileSync20 } from "node:fs";
+import { readFileSync as readFileSync21 } from "node:fs";
 import path46 from "node:path";
 async function run17(argv, io) {
   const [sub, ...rest] = argv;
@@ -91657,7 +92407,7 @@ async function run17(argv, io) {
     let markdown = flags.values.markdown ?? "";
     if (flags.values.file)
       try {
-        markdown = readFileSync20(path46.resolve(io.cwd, flags.values.file), "utf8");
+        markdown = readFileSync21(path46.resolve(io.cwd, flags.values.file), "utf8");
       } catch (error) {
         return usage3(io, `cannot read ${flags.values.file}: ${String(error)}`, USAGE10);
       }
@@ -91725,7 +92475,7 @@ var exports_changelog = {};
 __export(exports_changelog, {
   run: () => run18
 });
-import { readFileSync as readFileSync21 } from "node:fs";
+import { readFileSync as readFileSync22 } from "node:fs";
 import path47 from "node:path";
 async function run18(argv, io) {
   const [sub, ...rest] = argv;
@@ -91772,7 +92522,7 @@ async function run18(argv, io) {
   ]);
 }
 var USAGE11 = "workit changelog apply (--entries <JSON|@file|-> | --normalize-only) [--path CHANGELOG.md] [--preview]", readEntries = (raw, cwd) => {
-  const text = raw === "-" ? readFileSync21(0, "utf8") : raw.startsWith("@") ? readFileSync21(path47.resolve(cwd, raw.slice(1)), "utf8") : raw;
+  const text = raw === "-" ? readFileSync22(0, "utf8") : raw.startsWith("@") ? readFileSync22(path47.resolve(cwd, raw.slice(1)), "utf8") : raw;
   return JSON.parse(text);
 };
 var init_changelog2 = __esm(() => {
@@ -91949,7 +92699,7 @@ var VERBS = [
   {
     name: "pr",
     group: "delivery",
-    usage: "workit pr status [--pr <n>] | pr create [--base <b>] (--title <t> | --fill) [--draft] | pr merge [--pr <n>] [--method squash|merge|rebase] [--delete-branch]",
+    usage: "workit pr status [--pr <n>] | pr create [--base <b> | --track <t>] (--title <t> | --fill) [--draft] | pr merge [--pr <n>] [--method squash|merge|rebase] [--delete-branch]",
     summary: "PR/MR state with failing log tails and next action; open a SHA-verified PR; merge only when READY, verified and granted",
     load: () => Promise.resolve().then(() => (init_pr(), exports_pr))
   },
@@ -91963,7 +92713,7 @@ var VERBS = [
   {
     name: "git",
     group: "delivery",
-    usage: "workit git branch <name> [--base <b>] | git commit -m <msg> [--all | -- <paths…>] | git push [--set-upstream] [--force-with-lease]",
+    usage: "workit git branch <name> [--base <b>] [--track <t>] | git commit -m <msg> [--all | -- <paths…>] | git push [--set-upstream] [--force-with-lease]",
     summary: "Policy-checked branch and commit (Workit-Session trailer); push with a lease and a verified remote tip",
     load: () => Promise.resolve().then(() => (init_git2(), exports_git))
   },