@brainervirus/workit-cli 8.12.3 → 8.13.1

package/dist/index.js

@@ -65,7 +65,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@brainervirus/workit-cli",
-    version: "8.12.3",
+    version: "8.13.1",
     private: false,
     description: "Workit CLI — setup wizard, doctor, and task control for agentic coding workflows",
     keywords: [
@@ -103,13 +103,14 @@ var init_package = __esm(() => {
     },
     dependencies: {
       "@babel/parser": "7.29.9",
-      "@brainervirus/workit-core": "^8.12.3",
-      "@brainervirus/workit-cursor": "^8.12.3",
-      "@brainervirus/workit-opencode": "^8.12.3",
+      "@brainervirus/workit-cursor": "^8.13.1",
       "@inkjs/ui": "2.0.0",
       ink: "7.1.1",
       react: "19.2.8"
     },
+    devDependencies: {
+      "@brainervirus/workit-core": "^8.13.1"
+    },
     engines: {
       node: ">=24"
     }
@@ -10429,7 +10430,7 @@ var init_paths = __esm(() => {
 });
 
 // packages/workit-core/src/host-session.ts
-import { createHash as createHash3 } from "node:crypto";
+import { createHash as createHash3, randomBytes as randomBytes2, timingSafeEqual } from "node:crypto";
 import fs6 from "node:fs";
 import path6 from "node:path";
 function hostSessionFromEnv(env) {
@@ -10482,7 +10483,12 @@ function migrateRepoIssued(cwd) {
       const to = path6.join(userIssuedRoot(), lead);
       fs6.mkdirSync(to, { recursive: true, mode: 448 });
       for (const id of fs6.readdirSync(from)) {
-        fs6.copyFileSync(path6.join(from, id), path6.join(to, id));
+        try {
+          fs6.copyFileSync(path6.join(from, id), path6.join(to, id), fs6.constants.COPYFILE_EXCL);
+        } catch (error) {
+          if (error.code !== "EEXIST")
+            throw error;
+        }
         fs6.rmSync(path6.join(from, id), { force: true });
       }
       removeIfEmpty(from);
@@ -10490,7 +10496,25 @@ function migrateRepoIssued(cwd) {
   }
   removeIfEmpty(old);
 }
-function sessionClaimRefusal(env, claimed, cwd) {
+function issuedBinding(cwd, claimed) {
+  const record = issuedRecord(cwd, claimed);
+  const { stored, leadBound } = issuedToken(claimed);
+  if (stored)
+    return "token";
+  if (record === null)
+    return null;
+  return leadBound ? "token" : "legacy";
+}
+function issuedTokenMatches(cwd, claimed, token) {
+  migrateRepoIssued(cwd);
+  const { stored } = issuedToken(claimed);
+  if (!stored || !token)
+    return false;
+  const given = Buffer.from(tokenHash(token.trim()));
+  const want = Buffer.from(stored);
+  return given.length === want.length && timingSafeEqual(given, want);
+}
+function sessionClaimRefusal(env, claimed, cwd, options = {}) {
   const real = realHostSession(env);
   const host = family(real.host);
   if (real.kind !== "derived" && host !== null && HOST_SET_VARIABLE[host])
@@ -10500,18 +10524,22 @@ function sessionClaimRefusal(env, claimed, cwd) {
     };
   if (real.kind === "none" || !real.session)
     return null;
-  let issuedClaim = false;
-  if (claimed === real.session) {
-    const declaredChild = real.kind === "declared" && host === "claude_code" && claimed.includes(":");
-    if (!declaredChild || wasIssued(cwd, leadOf(claimed), claimed))
-      return null;
-    issuedClaim = true;
-  } else if (real.kind === "derived" && claimed.endsWith(`:${real.session}`))
-    return null;
-  else if (claimed.startsWith(`${real.session}:`)) {
-    if (wasIssued(cwd, real.session, claimed))
+  const ownShell = claimed === real.session && !(real.kind === "declared" && claimed.includes(":")) || real.kind === "derived" && claimed.endsWith(`:${real.session}`);
+  if (ownShell)
+    return options.flag ? {
+      error: `session_flag: --session ${claimed} names this shell's own ${real.host} session; on a host only an issued subagent id is passed as --session`,
+      unblock: "drop --session: the shell's own session is already the acting one"
+    } : null;
+  const issuedClaim = claimed === real.session || claimed.startsWith(`${real.session}:`);
+  if (issuedClaim) {
+    const binding = issuedBinding(cwd, claimed);
+    if (binding === "legacy")
       return null;
-    issuedClaim = true;
+    if (binding === "token")
+      return issuedTokenMatches(cwd, claimed, options.token) ? null : {
+        error: `unbound_session: ${claimed} was issued to a subagent, and this call did not present the token its SubagentStart hook gave it`,
+        unblock: `only that subagent acts as ${claimed}: it passes --token exactly as its SubagentStart context names it (or WORKIT_SESSION_TOKEN); anyone else spawns their own verifier`
+      };
   }
   const error = `forged_session: ${claimed} is neither this shell's session (${real.session}) nor an id its host issued to a child of it`;
   if (issuedClaim && noIssuedRecord(cwd, leadOf(claimed)) && host !== null && PLUGIN_UPDATE[host])
@@ -10522,10 +10550,10 @@ function sessionClaimRefusal(env, claimed, cwd) {
   const ownChildShell = host !== null && OWN_CHILD_SHELL.has(host);
   return {
     error,
-    unblock: ownChildShell ? `record the verdict from the verifier's own ${host === "pi" ? "Pi worker" : "OpenCode child session"} shell, where WORKIT_SESSION_ID is already set; never set WORKIT_SESSION_ID or --session by hand` : "never name a session yourself: spawn a verifier or reviewer subagent and pass exactly the --session its SubagentStart context names, or pass --as verifier"
+    unblock: ownChildShell ? `record the verdict from the verifier's own ${host === "pi" ? "Pi worker" : "OpenCode child session"} shell, where WORKIT_SESSION_ID is already set; never set WORKIT_SESSION_ID or --session by hand` : "never name a session yourself: spawn a verifier or reviewer subagent and pass exactly the --session and --token its SubagentStart context names, or pass --as verifier"
   };
 }
-var HOST_SESSION_VARS, family = (host) => host?.replace(/_(?:cli|desktop)$/, "") ?? null, hash = (value) => createHash3("sha256").update(value).digest("hex").slice(0, 32), userIssuedRoot = () => path6.join(resolveStateDir(), "issued"), safeList = (dir) => {
+var HOST_SESSION_VARS, family = (host) => host?.replace(/_(?:cli|desktop)$/, "") ?? null, hash = (value) => createHash3("sha256").update(value).digest("hex").slice(0, 32), userIssuedRoot = () => path6.join(resolveStateDir(), "issued"), userTokenRoot = () => path6.join(resolveStateDir(), "issued-tokens"), safeList = (dir) => {
   try {
     return fs6.readdirSync(dir);
   } catch {
@@ -10544,12 +10572,26 @@ var HOST_SESSION_VARS, family = (host) => host?.replace(/_(?:cli|desktop)$/, "")
   } catch {
     return false;
   }
-}, PLUGIN_UPDATE, wasIssued = (cwd, lead, claimed) => {
+}, PLUGIN_UPDATE, tokenHash = (token) => createHash3("sha256").update(token).digest("hex"), issuedRecord = (cwd, claimed) => {
+  const cut = claimed.lastIndexOf(":");
+  if (cut <= 0)
+    return null;
   migrateRepoIssued(cwd);
   try {
-    return fs6.existsSync(path6.join(userIssuedRoot(), hash(lead), hash(claimed)));
+    return fs6.readFileSync(path6.join(userIssuedRoot(), hash(claimed.slice(0, cut)), hash(claimed)), "utf8");
   } catch {
-    return false;
+    return null;
+  }
+}, TOKEN_HASH, issuedToken = (claimed) => {
+  const cut = claimed.lastIndexOf(":");
+  if (cut <= 0)
+    return { stored: null, leadBound: false };
+  const dir = path6.join(userTokenRoot(), hash(claimed.slice(0, cut)));
+  try {
+    const text = fs6.readFileSync(path6.join(dir, hash(claimed)), "utf8");
+    return { stored: TOKEN_HASH.exec(text)?.[1] ?? null, leadBound: true };
+  } catch {
+    return { stored: null, leadBound: safeList(dir).length > 0 };
   }
 }, leadOf = (session) => session.slice(0, session.lastIndexOf(":")), OWN_CHILD_SHELL, HOST_SET_VARIABLE;
 var init_host_session = __esm(() => {
@@ -10567,6 +10609,7 @@ var init_host_session = __esm(() => {
     claude_code: "claude plugin marketplace update workit && claude plugin update workit@workit",
     codex: "codex plugin remove workit@workit && codex plugin add workit@workit"
   };
+  TOKEN_HASH = /^([0-9a-f]{64})$/mu;
   OWN_CHILD_SHELL = new Set(["opencode", "pi"]);
   HOST_SET_VARIABLE = {
     opencode: "OPENCODE_SESSION_ID",
@@ -10599,7 +10642,7 @@ import { spawnSync as spawnSync3 } from "node:child_process";
 import fs7 from "node:fs";
 import { hostname } from "node:os";
 import path8 from "node:path";
-var metadataLockSchema, FOREIGN_LOCK_TTL_MS, UNREADABLE_LOCK_TTL_MS = 30000, RECLAIM_GUARD_TTL_MS = 30000, defaultLockTimeoutMs = 250, defaultLockTimeout = () => defaultLockTimeoutMs, setDefaultLockTimeout = (ms) => {
+var metadataLockSchema, FOREIGN_LOCK_TTL_MS, UNREADABLE_LOCK_TTL_MS = 30000, RECLAIM_GUARD_TTL_MS = 30000, IN_PROCESS_LOCK_TIMEOUT_MS = 250, defaultLockTimeoutMs, defaultLockTimeout = () => defaultLockTimeoutMs, hostAwareLockTimeout = (cliMs) => defaultLockTimeoutMs > IN_PROCESS_LOCK_TIMEOUT_MS ? cliMs : IN_PROCESS_LOCK_TIMEOUT_MS, setDefaultLockTimeout = (ms) => {
   defaultLockTimeoutMs = ms;
 }, parseMetadataLock = (raw) => {
   let value;
@@ -10789,6 +10832,7 @@ var init_store_lock = __esm(() => {
     externalAction: literal(true).optional()
   }).strict();
   FOREIGN_LOCK_TTL_MS = 10 * 60000;
+  defaultLockTimeoutMs = IN_PROCESS_LOCK_TIMEOUT_MS;
   TASK_STORE_LOCK = { reclaimUnverifiedAfterTtl: true };
 });
 
@@ -13697,6 +13741,14 @@ var PREFIXES, branchNames = (workspaceRoot) => {
 }, repoBranchPreset = (workspaceRoot) => {
   const detected = detectBranchPolicy(workspaceRoot);
   return detected.developBranch || detected.allowed.length ? detected.preset : null;
+}, releaseTagPrefixOf = (workspaceRoot, policyPrefix) => {
+  if (typeof policyPrefix === "string")
+    return policyPrefix.trim();
+  const r = spawnSync5("git", ["config", "--get", "gitflow.prefix.versiontag"], {
+    cwd: workspaceRoot,
+    encoding: "utf8"
+  });
+  return r.status === 0 ? (r.stdout ?? "").trim() : "v";
 };
 var init_branch_policy = __esm(() => {
   init_config();
@@ -14781,7 +14833,7 @@ var init_vcs_config = __esm(() => {
 
 // packages/workit-core/src/ledger.ts
 import { spawnSync as spawnSync9 } from "node:child_process";
-import { createHash as createHash9, randomBytes as randomBytes2 } from "node:crypto";
+import { createHash as createHash9, randomBytes as randomBytes3 } from "node:crypto";
 import fs12 from "node:fs";
 import path15 from "node:path";
 function resolveCommit(cwd, ref) {
@@ -14870,7 +14922,7 @@ function actorFromEnv(env) {
     agentId: value("WORKIT_AGENT_ID")
   };
 }
-function withLedgerLock(file, fn, waitMs = LOCK_WAIT_MS) {
+function withLedgerLock(file, fn, waitMs = hostAwareLockTimeout(LOCK_WAIT_MS)) {
   const lock = `${file}.lock`;
   const deadline = Date.now() + waitMs;
   let token = null;
@@ -14894,8 +14946,10 @@ function withLedgerLock(file, fn, waitMs = LOCK_WAIT_MS) {
 }
 function appendLine(file, build, options) {
   const write = () => {
-    const fd = fs12.openSync(file, "a+");
+    const fd = fs12.openSync(file, "a+", 384);
     try {
+      if (process.platform !== "win32")
+        tighten(fd);
       const size = fs12.fstatSync(fd).size;
       let fence = "";
       if (size > 0) {
@@ -14974,7 +15028,9 @@ function readLedger(cwd, options = {}) {
   if (!file.ok)
     return file;
   let text = "";
+  let stat = null;
   try {
+    stat = fs12.statSync(file.value);
     text = fs12.readFileSync(file.value, "utf8");
   } catch (error) {
     if (error.code === "ENOENT")
@@ -14994,6 +15050,7 @@ function readLedger(cwd, options = {}) {
   const integrity = { chained: 0, legacy: 0, unverified: [] };
   const earlier = new Set([null]);
   let chainStarted = false;
+  const ids = new Set;
   for (const raw of text.split(`
 `)) {
     const trimmed = raw.trim();
@@ -15027,6 +15084,10 @@ function readLedger(cwd, options = {}) {
       reason = "unsigned";
     else
       rowIntegrity = "legacy";
+    if (options.integrity && !reason && ids.has(parsed.id))
+      reason = "duplicate_id";
+    if (options.integrity)
+      ids.add(parsed.id);
     if (reason)
       rowIntegrity = "unverified";
     const pr = typeof parsed.pr === "number" && Number.isInteger(parsed.pr) ? parsed.pr : undefined;
@@ -15050,7 +15111,8 @@ function readLedger(cwd, options = {}) {
       seq: rows.length + 1,
       superseded: false,
       supersedeIgnored: false,
-      ...rowIntegrity ? { integrity: rowIntegrity } : {}
+      ...rowIntegrity ? { integrity: rowIntegrity } : {},
+      ...reason ? { integrityReason: reason } : {}
     };
     rows.push(row);
     if (!options.integrity)
@@ -15078,18 +15140,44 @@ function readLedger(cwd, options = {}) {
   const byId = new Map;
   for (const row of rows) {
     const target = row.supersedes ? byId.get(row.supersedes) : undefined;
-    if (target && supersedeAllowed(row, target, renameAwareBranch(scopeOf, row.branch)) === null)
+    if (target && row.integrity !== "unverified" && supersedeAllowed(row, target, renameAwareBranch(scopeOf, row.branch)) === null)
       target.superseded = true;
     else if (row.supersedes)
       row.supersedeIgnored = true;
     if (!byId.has(row.id))
       byId.set(row.id, row);
   }
+  if (options.integrity && stat && Buffer.byteLength(text) === stat.size)
+    tamperCache.set(file.value, {
+      size: stat.size,
+      stamp: fileStamp(stat),
+      breaks: integrity.unverified.filter((row) => TAMPER_REASONS.has(row.reason))
+    });
   return {
     ok: true,
     value: { path: file.value, rows, skipped, integrity: options.integrity ? integrity : null }
   };
 }
+function ledgerTampering(cwd) {
+  const file = ledgerPath(cwd);
+  if (!file.ok)
+    return [];
+  try {
+    const stat = fs12.statSync(file.value);
+    const cached = tamperCache.get(file.value);
+    if (cached && cached.size === stat.size && cached.stamp === fileStamp(stat))
+      return cached.breaks;
+  } catch {
+    return [];
+  }
+  const read = readLedger(cwd, { integrity: true });
+  return read.ok ? (read.value.integrity?.unverified ?? []).filter((row) => TAMPER_REASONS.has(row.reason)) : [];
+}
+function tamperedUnblock(cwd) {
+  const file = ledgerPath(cwd);
+  const where = file.ok ? file.value : "the ledger file";
+  return `workit ledger verify-integrity  # lists the edited or missing rows; if the edit is understood, move ${where} aside (mv ${where} ${where}.tampered-<date>) and record the verdicts again`;
+}
 function filterRows(rows, filter) {
   const matched = rows.filter((row) => (filter.branch === undefined || row.branch === filter.branch) && (filter.pr === undefined || row.pr === filter.pr) && (filter.type === undefined || row.type === filter.type));
   return filter.last === undefined ? matched : matched.slice(Math.max(0, matched.length - filter.last));
@@ -15205,15 +15293,51 @@ function authorSessions(cwd, rows, branch, range = { base: null, head: null }, s
     sessions.add(session);
   return sessions;
 }
-function effectiveOf(rows, authors, sameCode, isCurrent) {
+function sessionTrust(cwd, row) {
+  const session = row.actor.session;
+  if (!session || row.self === true)
+    return null;
+  const source = typeof row.sessionSource === "string" ? row.sessionSource : "env";
+  const host = row.actor.host;
+  const issuedOnly = source === "flag" ? host !== "cli" : source === "env" && session.includes(":") && !SHELL_VOUCHED_HOSTS.has(host);
+  if (!issuedOnly)
+    return null;
+  const binding = issuedBinding(cwd, session);
+  if (binding === null)
+    return "unissued_session";
+  return binding === "token" && row.sessionBound !== true ? "unbound_session" : null;
+}
+function trustReasons(cwd, row) {
+  if (row.integrity === "unverified")
+    return [row.integrityReason ?? "unsigned"];
+  if (row.integrity !== "verified")
+    return ["unsigned"];
+  const session = sessionTrust(cwd, row);
+  return session ? [session] : [];
+}
+function withIntegrity(cwd, rows) {
+  if (rows.every((row) => row.integrity !== undefined))
+    return rows;
+  const read = readLedger(cwd, { integrity: true });
+  const bySeq = new Map(read.ok ? read.value.rows.map((row) => [row.seq, row]) : []);
+  return rows.map((row) => {
+    if (row.integrity !== undefined)
+      return row;
+    const fresh = bySeq.get(row.seq);
+    return fresh && fresh.id === row.id && fresh.at === row.at ? fresh : row;
+  });
+}
+function effectiveOf(rows, reasonsOf, sameCode, isCurrent) {
   let effective = null;
   for (const row of rows) {
     if (!effective) {
       effective = row;
       continue;
     }
-    const rowIndependent = independenceReasons(row, authors).length === 0;
-    const effIndependent = independenceReasons(effective, authors).length === 0;
+    if (untrusted(reasonsOf(row)) && !untrusted(reasonsOf(effective)))
+      continue;
+    const rowIndependent = reasonsOf(row).length === 0;
+    const effIndependent = reasonsOf(effective).length === 0;
     if (effIndependent && !rowIndependent && isCurrent(effective))
       continue;
     if (effIndependent && FAILING.has(String(effective.result)) && row.actor.session === effective.actor.session && sameCode(effective, row))
@@ -15227,7 +15351,7 @@ function restackCarries(rows, branch, from, to) {
     return false;
   const edges = new Map;
   for (const row of rows)
-    if (row.type === "stack.restacked" && row.observer === "workit_cli" && row.branch === branch && row.patchEqual === true && typeof row.fromHead === "string" && row.head)
+    if (row.type === "stack.restacked" && row.observer === "workit_cli" && row.integrity === "verified" && row.branch === branch && row.patchEqual === true && typeof row.fromHead === "string" && row.head)
       edges.set(row.fromHead, [...edges.get(row.fromHead) ?? [], row.head]);
   const seen = new Set([from]);
   const queue = [from];
@@ -15243,7 +15367,8 @@ function restackCarries(rows, branch, from, to) {
   }
   return false;
 }
-function checkVerdicts(cwd, branch, rows) {
+function checkVerdicts(cwd, branch, ledgerRows) {
+  const rows = withIntegrity(cwd, ledgerRows);
   const head = branchHead(cwd, branch);
   const fallbackBase = defaultBase(cwd);
   const scope = branchScope(cwd, branch);
@@ -15273,21 +15398,47 @@ function checkVerdicts(cwd, branch, rows) {
     return verdictBasis(failed, { head: row.head, ...keys }) !== "stale" || restackCarries(rows, branch, failed.head, row.head);
   };
   const authors = authorSessions(cwd, rows, branch, { base: fallbackBase, head }, scope);
+  const failureAuthorCache = new Map;
+  const failureAuthors = (row) => {
+    let set = failureAuthorCache.get(row.seq);
+    if (!set) {
+      set = authorSessions(cwd, rows.filter((other) => other.integrity === "verified" && other.seq < row.seq), branch, { base: null, head: null }, scope);
+      failureAuthorCache.set(row.seq, set);
+    }
+    return set;
+  };
+  const reasonCache = new Map;
+  const reasonsOf = (row) => {
+    let reasons = reasonCache.get(row);
+    if (!reasons) {
+      const failing = FAILING.has(String(row.result));
+      reasons = [
+        ...trustReasons(cwd, row),
+        ...independenceReasons(row, failing ? failureAuthors(row) : authors)
+      ];
+      reasonCache.set(row, reasons);
+    }
+    return reasons;
+  };
+  const retired = new Set;
+  for (const row of rows)
+    if (row.type === "verdict" && row.supersedes && !row.supersedeIgnored && trustReasons(cwd, row).length === 0)
+      retired.add(row.supersedes);
   const byKind = new Map;
   for (const row of rows)
-    if (isLiveVerdict(row) && scope(row)) {
+    if (isLiveVerdict(row, retired) && scope(row)) {
       const kind = typeof row.kind === "string" ? row.kind : "review";
       byKind.set(kind, [...byKind.get(kind) ?? [], row]);
     }
   const verdicts = [];
   const warnings = [];
   for (const [kind, list] of byKind) {
-    const row = effectiveOf(list, authors, sameCode, (candidate) => basisOf(candidate) !== "stale");
+    const row = effectiveOf(list, reasonsOf, sameCode, (candidate) => basisOf(candidate) !== "stale");
     if (!row)
       continue;
     const basis = basisOf(row);
     const current = basis !== "stale";
-    const independence = independenceReasons(row, authors);
+    const independence = reasonsOf(row);
     const reasons = [
       ...current ? [] : ["stale"],
       ...PASSING.has(String(row.result)) ? [] : ["not_passing"],
@@ -15304,23 +15455,31 @@ function checkVerdicts(cwd, branch, rows) {
     });
     if (reasons.length === 0) {
       for (const later of list)
-        if (later.seq > row.seq && independenceReasons(later, authors).length > 0 && FAILING.has(String(later.result)) && basisOf(later) !== "stale")
+        if (later.seq > row.seq && reasonsOf(later).length > 0 && !untrusted(reasonsOf(later)) && FAILING.has(String(later.result)) && basisOf(later) !== "stale")
           warnings.push(`the author's own (self) ${String(later.result)} ${kind} verdict ${later.id} by ${later.actor.session ?? "no session"} on the current code is newer than the accepted pass ${row.id}: read it before merging`);
     }
   }
   for (const row of rows)
     if (row.integrity === "unverified" && scope(row))
       warnings.push(`ledger row ${row.id} (${row.type}) on ${row.branch ?? branch} is unverified: the workit CLI did not write it or it changed afterwards (workit ledger verify-integrity)`);
+  const tampered = ledgerTampering(cwd);
+  if (tampered.length) {
+    warnings.push(tamperedWarning(cwd, tampered));
+    for (const entry of verdicts) {
+      entry.accepted = false;
+      entry.reasons = [...entry.reasons, "ledger_tampered"];
+    }
+  }
   verdicts.sort((a, b) => a.verdict.seq - b.verdict.seq);
   const newestCurrent = verdicts.findLast((entry) => entry.current) ?? verdicts.at(-1) ?? null;
   const failing = verdicts.find((entry) => entry.current && entry.independent && FAILING.has(String(entry.verdict.result)));
   const newestAccepted = verdicts.findLast((entry) => entry.accepted && STRONG_RESULTS.has(String(entry.verdict.result))) ?? null;
-  const accepted = newestAccepted && !failing ? { accepted: true, verdict: newestAccepted.verdict, reasons: [] } : {
+  const accepted = tampered.length ? { accepted: false, verdict: null, reasons: ["ledger_tampered"] } : newestAccepted && !failing ? { accepted: true, verdict: newestAccepted.verdict, reasons: [] } : {
     accepted: false,
     verdict: failing?.verdict ?? null,
     reasons: failing ? ["failing_verdict"] : !newestCurrent ? ["no_verdict"] : newestCurrent.reasons.length ? newestCurrent.reasons : ["type_check_only"]
   };
-  const selfEntry = failing ? undefined : verdicts.findLast((entry) => entry.current && !entry.independent && STRONG_RESULTS.has(String(entry.verdict.result)));
+  const selfEntry = failing ? undefined : verdicts.findLast((entry) => entry.current && !entry.independent && !untrusted(entry.reasons) && STRONG_RESULTS.has(String(entry.verdict.result)));
   return {
     branch,
     head,
@@ -15515,6 +15674,7 @@ function recordVerdict(context, input) {
     self: self2,
     selfReason,
     sessionSource: context.sessionSource ?? "env",
+    ...context.sessionBound === true ? { sessionBound: true } : {},
     evidenceRefs: input.evidenceRefs ?? []
   }, { now: context.now });
 }
@@ -15743,7 +15903,7 @@ var LEDGER_VERSION = 1, MAX_LINE_BYTES = 4096, VERDICT_RESULTS, PASSING, FAILING
   } catch {
     return null;
   }
-}, newId2 = () => `${Date.now().toString(36)}-${randomBytes2(6).toString("hex")}`, NETWORK_FS_TYPES, isNetworkFsType = (type) => NETWORK_FS_TYPES.has(type >>> 0), onNetworkFs = (dir) => {
+}, newId2 = () => `${Date.now().toString(36)}-${randomBytes3(6).toString("hex")}`, NETWORK_FS_TYPES, isNetworkFsType = (type) => NETWORK_FS_TYPES.has(type >>> 0), onNetworkFs = (dir) => {
   if (process.platform !== "linux")
     return false;
   try {
@@ -15796,6 +15956,11 @@ ${body}`), TAIL_BYTES, lastLine = (fd, size) => {
       return text || null;
   }
   return null;
+}, tighten = (fd) => {
+  try {
+    if ((fs12.fstatSync(fd).mode & 63) !== 0)
+      fs12.fchmodSync(fd, 384);
+  } catch {}
 }, sealed = (row, id, at, previous) => {
   const { prevHash: _prev, rowHash: _row, ...fields } = row;
   const prevHash = previous === null ? null : sha2562(previous);
@@ -15810,7 +15975,7 @@ ${body}`), TAIL_BYTES, lastLine = (fd, size) => {
     session: str2(actor.session),
     agentId: str2(actor.agentId)
   };
-}, isLiveVerdict = (row) => row.type === "verdict" && typeof row.result === "string" && !row.superseded, RENAMED, renameAwareBranch = (scopeOf, branch) => {
+}, TAMPER_REASONS, tamperCache, fileStamp = (stat) => `${stat.ino}:${stat.mtimeMs}:${stat.ctimeMs}`, tamperedWarning = (cwd, breaks) => `the ledger was edited, or a row was removed or moved (${breaks.slice(0, 3).map((row) => `${row.reason} at row ${row.seq}`).join(", ")}${breaks.length > 3 ? ", …" : ""}): no verdict is accepted until it is repaired. ${tamperedUnblock(cwd)}`, isLiveVerdict = (row, retired) => row.type === "verdict" && typeof row.result === "string" && !retired.has(row.id), RENAMED, renameAwareBranch = (scopeOf, branch) => {
   return (target) => {
     const own = typeof branch === "string" ? branch : null;
     const theirs = typeof target.branch === "string" ? target.branch : null;
@@ -15827,7 +15992,7 @@ ${body}`), TAIL_BYTES, lastLine = (fd, size) => {
     if (derivesFrom(author, session) || derivesFrom(session, author))
       return true;
   return false;
-}, independenceReasons = (row, authors) => {
+}, TRUST_REASONS, SHELL_VOUCHED_HOSTS, untrusted = (reasons) => reasons.some((reason) => TRUST_REASONS.has(reason)), independenceReasons = (row, authors) => {
   const reasons = [];
   if (!row.actor.session)
     reasons.push("no_session");
@@ -15889,6 +16054,7 @@ ${body}`), TAIL_BYTES, lastLine = (fd, size) => {
   return brief.pr === null ? "workit pr create" : `workit pr status --pr ${brief.pr}`;
 };
 var init_ledger = __esm(() => {
+  init_store_lock();
   init_vcs_config();
   init_rev();
   init_host_session();
@@ -15927,14 +16093,14 @@ var init_ledger = __esm(() => {
           return null;
         throw error;
       }
-      const token = `${process.pid}-${randomBytes2(8).toString("hex")}`;
+      const token = `${process.pid}-${randomBytes3(8).toString("hex")}`;
       fs12.writeFileSync(path15.join(lock, LOCK_OWNER), token);
       return token;
     },
     release(lock, token) {
       if (lockToken(lock) !== token)
         return false;
-      const tomb = `${lock}.release-${randomBytes2(6).toString("hex")}`;
+      const tomb = `${lock}.release-${randomBytes3(6).toString("hex")}`;
       try {
         fs12.renameSync(lock, tomb);
       } catch {
@@ -15951,7 +16117,7 @@ var init_ledger = __esm(() => {
     },
     token: lockToken,
     reap(lock, observed) {
-      const tomb = `${lock}.reap-${randomBytes2(6).toString("hex")}`;
+      const tomb = `${lock}.reap-${randomBytes3(6).toString("hex")}`;
       try {
         fs12.renameSync(lock, tomb);
       } catch {
@@ -15970,7 +16136,24 @@ var init_ledger = __esm(() => {
     }
   };
   TAIL_BYTES = 64 * 1024;
+  TAMPER_REASONS = new Set(["hash_mismatch", "broken_link"]);
+  tamperCache = new Map;
   RENAMED = /^branch: renamed refs\/heads\/(.+) to refs\/heads\/(.+)$/iu;
+  TRUST_REASONS = new Set([
+    "unsigned",
+    "hash_mismatch",
+    "broken_link",
+    "duplicate_id",
+    "unissued_session",
+    "unbound_session"
+  ]);
+  SHELL_VOUCHED_HOSTS = new Set([
+    "cli",
+    "opencode",
+    "pi",
+    "codex_cli",
+    "codex_desktop"
+  ]);
   OBSERVED_ONLY = new Set([
     "check",
     "merge.unverified",
@@ -17311,6 +17494,7 @@ var init_shell_words = () => {};
 var SHELLS, POWERSHELLS, EVALS, WRAPPERS, WRAPPER_VALUES, KEYWORDS, DECLARATIONS, CD, PUSHD, POPD, GIT_VALUE_OPTIONS, GIT_CONFIG_OPTIONS, XARGS_VALUES, PARALLEL_VALUES, RECENT, LAUNCHERS, PUSH_VALUE_OPTIONS, VALUE_OPTIONS, API_VALUES, API_FIELDS, GIT_COMMANDS;
 var init_raw_git = __esm(() => {
   init_branch();
+  init_branch_policy();
   init_workspaces();
   init_ledger();
   init_paths();
@@ -63704,7 +63888,8 @@ var init_changelog = __esm(() => {
 });
 
 // packages/workit-core/src/core/hygiene.ts
-import { existsSync as existsSync9, readFileSync as readFileSync9, writeFileSync as writeFileSync4 } from "node:fs";
+import { spawnSync as spawnSync12 } from "node:child_process";
+import { existsSync as existsSync9, readFileSync as readFileSync9, readdirSync as readdirSync5, writeFileSync as writeFileSync4 } from "node:fs";
 import path26 from "node:path";
 var repoRoot2, templatesDir = () => path26.join(repoRoot2, "templates", "hygiene"), packageJson = (root) => {
   if (!existsSync9(path26.join(root, "package.json")))
@@ -63734,6 +63919,23 @@ var repoRoot2, templatesDir = () => path26.join(repoRoot2, "templates", "hygiene
     }
   }
   return "";
+}, projectTarget = (dir) => {
+  const start = path26.resolve(dir);
+  const top = spawnSync12("git", ["rev-parse", "--show-toplevel"], { cwd: start, encoding: "utf8" });
+  const root = top.status === 0 ? (top.stdout ?? "").trim() : "";
+  if (root)
+    return { ok: true, root: path26.resolve(root) };
+  let children = [];
+  try {
+    children = readdirSync5(start, { withFileTypes: true }).filter((entry) => entry.isDirectory() && existsSync9(path26.join(start, entry.name, ".git"))).map((entry) => path26.join(start, entry.name)).toSorted();
+  } catch {
+    children = [];
+  }
+  const where = children.length > 0 ? `run it inside one of its repositories: ${children.slice(0, 5).map((child) => `cd ${child}`).join(", ")}${children.length > 5 ? ` (+${children.length - 5} more)` : ""}` : "cd <repo> (or git init here) and run workit init again";
+  return {
+    ok: false,
+    refused: `${start} is not a git repository, so no project files were added there; ${where}`
+  };
 }, planHygieneFiles = (root, opts = {}) => {
   const openSource = opts.includeOpenSource ?? isOpenSource(root);
   const files = ["CHANGELOG.md", "README.md", ".editorconfig", ".gitattributes"];
@@ -63958,13 +64160,13 @@ var init_support_matrix = __esm(() => {
 });
 
 // packages/workit-cli/src/admin/host-install.ts
-import { spawnSync as spawnSync12 } from "node:child_process";
+import { spawnSync as spawnSync13 } from "node:child_process";
 import {
   accessSync,
   constants as constants2,
   existsSync as existsSync11,
   readFileSync as readFileSync11,
-  readdirSync as readdirSync5,
+  readdirSync as readdirSync6,
   realpathSync as realpathSync6,
   statSync as statSync2
 } from "node:fs";
@@ -64007,7 +64209,7 @@ function findHostExecutable(name, options = {}) {
     [path29.join(home, ".nvm", "versions", "node"), "bin"]
   ]) {
     try {
-      for (const entry of readdirSync5(base, { withFileTypes: true })) {
+      for (const entry of readdirSync6(base, { withFileTypes: true })) {
         if (entry.isDirectory())
           dirs.push(path29.join(base, entry.name, tail));
       }
@@ -64229,7 +64431,7 @@ function runHostCommand(step, context = {}) {
       stderr: `Cannot safely execute batch shim ${step.command}; resolve its Node.js CLI entrypoint and retry`
     };
   }
-  const result = spawnSync12(step.command, step.args, {
+  const result = spawnSync13(step.command, step.args, {
     cwd: step.cwd,
     env: (() => {
       const home = context.home ?? context.env?.HOME ?? os7.homedir();
@@ -64283,6 +64485,40 @@ var resolveWindowsShimScript = (shim) => {
   } catch {
     return false;
   }
+}, OPENCODE_PLUGIN_SCOPE = "@brainervirus", OPENCODE_PLUGIN_NAME = "workit-opencode", packageVersionAt = (root, name) => {
+  try {
+    const pkg = JSON.parse(readFileSync11(path29.join(root, "package.json"), "utf8"));
+    return pkg.name === name && typeof pkg.version === "string" ? pkg.version : null;
+  } catch {
+    return null;
+  }
+}, compareVersions = (a, b) => {
+  const pa = a.split(/[.+-]/).map((n) => Number(n) || 0);
+  const pb = b.split(/[.+-]/).map((n) => Number(n) || 0);
+  for (let i = 0;i < Math.max(pa.length, pb.length); i++) {
+    const d = (pa[i] ?? 0) - (pb[i] ?? 0);
+    if (d !== 0)
+      return d;
+  }
+  return 0;
+}, openCodeCacheDir = (home, env = process.env) => path29.join(env.XDG_CACHE_HOME || path29.join(home, ".cache"), "opencode"), subdirs = (dir) => {
+  try {
+    return readdirSync6(dir, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => path29.join(dir, entry.name));
+  } catch {
+    return [];
+  }
+}, openCodeInstalledPlugin = (home, env = process.env) => {
+  const name = `${OPENCODE_PLUGIN_SCOPE}/${OPENCODE_PLUGIN_NAME}`;
+  const cache = openCodeCacheDir(home, env);
+  const specDirs = (layout) => subdirs(path29.join(cache, layout, OPENCODE_PLUGIN_SCOPE)).filter((dir) => path29.basename(dir) === `${OPENCODE_PLUGIN_NAME}@latest`);
+  const installs = [...specDirs("npm").flatMap(subdirs), ...specDirs("packages")].map((dir) => path29.join(dir, "node_modules", OPENCODE_PLUGIN_SCOPE, OPENCODE_PLUGIN_NAME));
+  let best = null;
+  for (const root of installs) {
+    const version = packageVersionAt(root, name);
+    if (version && (!best || compareVersions(version, best.version) > 0))
+      best = { root, version };
+  }
+  return best;
 }, isCanonicalCodexPackage = (root) => {
   for (const file of [
     path29.join(root, ".codex-plugin", "plugin.json"),
@@ -64302,7 +64538,7 @@ var resolveWindowsShimScript = (shim) => {
     if (isCanonicalCodexPackage(root))
       return true;
     try {
-      return readdirSync5(root, { withFileTypes: true }).some((entry) => entry.isDirectory() && isCanonicalCodexPackage(path29.join(root, entry.name)));
+      return readdirSync6(root, { withFileTypes: true }).some((entry) => entry.isDirectory() && isCanonicalCodexPackage(path29.join(root, entry.name)));
     } catch {
       return false;
     }
@@ -64311,7 +64547,7 @@ var resolveWindowsShimScript = (shim) => {
     return true;
   const root = path29.join(codexHome, "plugins", "cache");
   try {
-    for (const marketplace of readdirSync5(root, { withFileTypes: true })) {
+    for (const marketplace of readdirSync6(root, { withFileTypes: true })) {
       if (!marketplace.isDirectory())
         continue;
       if (isPackageOrVersionDirectory(path29.join(root, marketplace.name, "workit")))
@@ -64389,9 +64625,9 @@ var init_host_install = __esm(() => {
 });
 
 // packages/workit-core/src/core/skill-manifests.ts
-import { cpSync as cpSync3, existsSync as existsSync12, readFileSync as readFileSync12, readdirSync as readdirSync6, statSync as statSync3, writeFileSync as writeFileSync5 } from "node:fs";
+import { cpSync as cpSync3, existsSync as existsSync12, readFileSync as readFileSync12, readdirSync as readdirSync7, statSync as statSync3, writeFileSync as writeFileSync5 } from "node:fs";
 import path30 from "node:path";
-var WORKIT_METHOD_SKILLS, skillManifestNames = (root) => existsSync12(root) ? readdirSync6(root).filter((name) => existsSync12(path30.join(root, name, "SKILL.md"))).toSorted() : [], validateSkillManifests = (root, expected, label) => {
+var WORKIT_METHOD_SKILLS, skillManifestNames = (root) => existsSync12(root) ? readdirSync7(root).filter((name) => existsSync12(path30.join(root, name, "SKILL.md"))).toSorted() : [], validateSkillManifests = (root, expected, label) => {
   const actual = skillManifestNames(root);
   const missing = expected.filter((name) => !actual.includes(name));
   const extra = actual.filter((name) => !expected.includes(name));
@@ -64403,7 +64639,7 @@ var WORKIT_METHOD_SKILLS, skillManifestNames = (root) => existsSync12(root) ? re
   const pending = [path30.join(pluginDir, "skills")];
   while (pending.length > 0) {
     const dir = pending.pop();
-    for (const entry of readdirSync6(dir, { withFileTypes: true })) {
+    for (const entry of readdirSync7(dir, { withFileTypes: true })) {
       const file = path30.join(dir, entry.name);
       if (entry.isDirectory())
         pending.push(file);
@@ -64434,7 +64670,7 @@ var init_skill_manifests = __esm(() => {
 });
 
 // packages/workit-core/src/git/session-hook.ts
-import { spawnSync as spawnSync13 } from "node:child_process";
+import { spawnSync as spawnSync14 } from "node:child_process";
 import {
   chmodSync,
   existsSync as existsSync13,
@@ -64629,7 +64865,7 @@ add_trailer "$(git rev-parse --git-path COMMIT_EDITMSG)"
 [ "$2" != merge ] || add_trailer "$(git rev-parse --git-path MERGE_MSG)"
 exit 0
 `, manualTrailerLine = () => `h="$(git rev-parse --git-common-dir 2>/dev/null)/${HELPER.join("/")}"; [ ! -f "$h" ] || sh "$h" "$@" || true`, lefthookTrailerRun = () => `set -f; IFS=; h=$(git rev-parse --git-common-dir 2>/dev/null)/${HELPER.join("/")}; [ ! -f $h ] || sh $h '' {2} {3} || true`, HELPER_REF, SESSION_HOOK_SCRIPT, run2 = (cwd, args, env) => {
-  const r = spawnSync13("git", args, {
+  const r = spawnSync14("git", args, {
     cwd,
     encoding: "utf8",
     timeout: GIT_TIMEOUTS.local,
@@ -64790,14 +65026,14 @@ ${manualTrailerLine()}
 });
 
 // packages/workit-cli/src/admin/doctor.ts
-import { spawnSync as spawnSync14 } from "node:child_process";
+import { spawnSync as spawnSync15 } from "node:child_process";
 import { createHash as createHash14 } from "node:crypto";
 import {
   existsSync as existsSync14,
   lstatSync as lstatSync5,
   mkdirSync as mkdirSync6,
   mkdtempSync,
-  readdirSync as readdirSync7,
+  readdirSync as readdirSync8,
   readFileSync as readFileSync14,
   readlinkSync as readlinkSync2,
   rmSync as rmSync3,
@@ -64823,7 +65059,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   const configDir = options.configDir ?? env.WORKFLOW_TOOLKIT_CONFIG ?? env.WORKFLOW_TOOLKIT_CONFIG_DIR ?? path32.join(home, ".config", "workit");
   const stateDir = options.stateDir ?? env.WORKFLOW_TOOLKIT_STATE ?? path32.join(home, ".local", "state", "workit");
   const cwd = options.cwd ?? process.cwd();
-  const dev = options.dev ?? env.WORKFLOW_TOOLKIT_DEV ?? findDevFromCwd(cwd);
+  const dev = options.dev?.trim() || env.WORKFLOW_TOOLKIT_DEV?.trim() || findDevFromCwd(cwd);
   return {
     host: options.host ?? "cli",
     home,
@@ -64833,7 +65069,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
     workspaceRoot: options.workspaceRoot ?? env.WORKFLOW_WORKSPACE_ROOT ?? cwd,
     dev,
     opencodeConfig: options.opencodeConfig ?? path32.join(home, ".config", "opencode", "opencode.json"),
-    opencodePackageCacheDir: options.opencodePackageCacheDir ?? path32.join(home, ".cache", "opencode", "packages", "@brainervirus", "workit-opencode@latest"),
+    opencodePackageCacheDir: options.opencodePackageCacheDir ?? null,
     cursorSettings: options.cursorSettings ?? path32.join(home, ".cursor", "settings.json"),
     cursorMcp: options.cursorMcp ?? path32.join(home, ".cursor", "mcp.json"),
     cursorPluginDir: options.cursorPluginDir ?? path32.join(home, ".cursor", "plugins", "local", "workit"),
@@ -64879,7 +65115,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   }
   return null;
 }, versionOf = (bin, env, timeout) => {
-  const r = spawnSync14(bin, ["--version"], { encoding: "utf8", env, timeout });
+  const r = spawnSync15(bin, ["--version"], { encoding: "utf8", env, timeout });
   if (r.error)
     return null;
   return (r.stdout ?? "").trim();
@@ -64897,7 +65133,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   if (env.BUN && existsSync14(env.BUN))
     return env.BUN;
   for (const candidate of [
-    path32.join(os8.homedir(), ".bun/bin/bun"),
+    path32.join(env.HOME || os8.homedir(), ".bun/bin/bun"),
     "/usr/local/bin/bun",
     "/usr/bin/bun"
   ]) {
@@ -64906,47 +65142,50 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   }
   return commandOnPath("bun", env) ? "bun" : null;
 }, checkRuntime = (res) => {
-  const node = versionOf("node", res.env);
-  const nodeOk = node !== null && semverAtLeast(node, SUPPORT_MATRIX.node.minimum);
+  const running = `v${process.versions.node}`;
+  const runningOk = semverAtLeast(running, SUPPORT_MATRIX.node.minimum);
+  const pathNode = versionOf("node", res.env);
   const bun = resolveBun(res.env);
   const bunVersion = bun ? versionOf(bun, res.env) : null;
   const bunOk = bunVersion !== null;
   const needsBun = res.dev !== null;
-  if (!nodeOk) {
+  if (!runningOk) {
     return {
       id: "runtime",
       status: "fail",
-      detail: `node ${SUPPORT_MATRIX.node.minimum}+ required (found ${node ?? "none on PATH"})`,
+      detail: `node ${SUPPORT_MATRIX.node.minimum}+ required (workit runs under ${running} at ${process.execPath})`,
       fix: `Install Node ${SUPPORT_MATRIX.node.minimum}+ (declared support: ${SUPPORT_MATRIX.node.minimum}/current)`
     };
   }
-  if (!bunOk && needsBun) {
+  const pathNote = pathNode !== null && pathNode !== running ? `; node on PATH is ${pathNode}${semverAtLeast(pathNode, SUPPORT_MATRIX.node.minimum) ? "" : ` (below ${SUPPORT_MATRIX.node.minimum}; it does not run this CLI)`}` : "";
+  if (pathNode === null) {
     return {
       id: "runtime",
-      status: "fail",
-      detail: `bun not found on PATH (dev checkout requires the pinned toolchain ${SUPPORT_MATRIX.bun})`,
-      fix: `Install bun ${SUPPORT_MATRIX.bun} (curl -fsSL https://bun.sh/install | bash)`
+      status: "warn",
+      detail: `workit runs under node ${running}, but no node is on PATH for host hooks`,
+      fix: `Put Node ${SUPPORT_MATRIX.node.minimum}+ on PATH (host hooks launch \`node\`)`
     };
   }
-  if (!bunOk) {
+  if (!bunOk && needsBun) {
     return {
       id: "runtime",
-      status: "warn",
-      detail: "bun not found on PATH — not required for published artifacts",
-      fix: "Install bun for development/installer use"
+      status: "fail",
+      detail: `bun not found on PATH (dev checkout requires the pinned toolchain ${SUPPORT_MATRIX.bun})`,
+      fix: `Install bun ${SUPPORT_MATRIX.bun} (curl -fsSL https://bun.sh/install | bash)`
     };
   }
+  const pathOld = !semverAtLeast(pathNode, SUPPORT_MATRIX.node.minimum);
   return {
     id: "runtime",
-    status: "pass",
-    detail: `node ${node} (>=${SUPPORT_MATRIX.node.minimum}), bun ${bunVersion ?? "n/a"}`
+    status: bunOk && !pathOld ? "pass" : "info",
+    detail: `node ${running} (>=${SUPPORT_MATRIX.node.minimum})${pathNote}, ${bunOk ? `bun ${bunVersion}` : "no bun (needed only for a dev checkout)"}`
   };
 }, checkVersions = (res) => {
   if (!res.dev) {
     return {
       id: "versions",
-      status: "warn",
-      detail: "no dev checkout found (WORKFLOW_TOOLKIT_DEV) — skipping version parity"
+      status: "info",
+      detail: "installed package, not a dev checkout — version parity applies to checkouts only"
     };
   }
   const corePkg = readJson(path32.join(res.dev, "packages/workit-core/package.json"));
@@ -64960,7 +65199,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   const refs = new Set;
   for (const name of ["workit-opencode", "workit-cursor", "workit-cli"]) {
     const pkg = readJson(path32.join(res.dev, "packages", name, "package.json"));
-    const dep = pkg?.dependencies?.["@brainervirus/workit-core"];
+    const dep = pkg?.dependencies?.["@brainervirus/workit-core"] ?? pkg?.devDependencies?.["@brainervirus/workit-core"];
     if (typeof dep === "string")
       refs.add(dep);
   }
@@ -65057,10 +65296,16 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
       status: "pass",
       detail: `codex CLI ${installed} matches the qualified pin`
     };
+  if (semverAtLeast(installed, qualified))
+    return {
+      id: "codex_pin",
+      status: "info",
+      detail: `codex CLI ${installed} is newer than the qualified ${qualified}`
+    };
   return {
     id: "codex_pin",
     status: "warn",
-    detail: `codex CLI ${installed} differs from the qualified ${qualified}`,
+    detail: `codex CLI ${installed} is older than the qualified ${qualified}`,
     fix: `Reinstall the qualified Codex CLI ${qualified} or record fresh qualification evidence`
   };
 }, readTomlTables = (file) => {
@@ -65117,7 +65362,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
     const dir = path32.join(codexHome, "plugins", "cache", marketplace, "workit");
     let versions = [];
     try {
-      versions = readdirSync7(dir).filter((v) => existsSync14(path32.join(dir, v, ".codex-plugin")));
+      versions = readdirSync8(dir).filter((v) => existsSync14(path32.join(dir, v, ".codex-plugin")));
     } catch {
       versions = [];
     }
@@ -65226,7 +65471,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   const installed = [];
   for (const install of installs) {
     const source = install.root ? path32.join(install.root, "agents") : null;
-    const files = source && existsSync14(source) ? readdirSync7(source).filter((f) => f.endsWith(".toml")).toSorted() : [];
+    const files = source && existsSync14(source) ? readdirSync8(source).filter((f) => f.endsWith(".toml")).toSorted() : [];
     if (files.length === 0) {
       problems.push(`${install.id} ${install.version ?? "?"} bundles no agents`);
       fixes.push(`codex plugin remove ${install.id} && codex plugin add ${install.id}`);
@@ -65454,8 +65699,8 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
     if (!dev && res.host === "opencode") {
       return {
         id: "assets",
-        status: "warn",
-        detail: "no dev checkout found (WORKFLOW_TOOLKIT_DEV) — skipping asset check"
+        status: "info",
+        detail: "installed package — OpenCode loads the published assets, no checkout to compare"
       };
     }
     return {
@@ -65490,7 +65735,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
 `)) {
       return false;
     }
-    return spawnSync14(runtime, ["--check", entry], { encoding: "utf8", env }).status === 0;
+    return spawnSync15(runtime, ["--check", entry], { encoding: "utf8", env }).status === 0;
   } catch {
     return false;
   }
@@ -65580,8 +65825,8 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   if (!dev && res.host !== "cursor") {
     return {
       id: "launcher",
-      status: "warn",
-      detail: "no dev checkout found (WORKFLOW_TOOLKIT_DEV) — skipping non-Cursor launcher checks"
+      status: "info",
+      detail: "installed package — non-Cursor launchers ship inside each host plugin, no checkout to check"
     };
   }
   return {
@@ -65621,7 +65866,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
       fix: "Re-run install-cursor-plugin.sh (or `workit init` with Cursor) to rewrite the hook entries"
     };
   const started = performance.now();
-  const probe = spawnSync14("node", [launcher, "--probe", "workit-cursor-hook"], {
+  const probe = spawnSync15("node", [launcher, "--probe", "workit-cursor-hook"], {
     encoding: "utf8",
     env: { ...res.env, WORKIT_CURSOR_HOOK_NPX_OFFLINE: "1" },
     timeout: 40000,
@@ -65690,18 +65935,18 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
       fix: "Install git and ensure it is on PATH"
     };
   }
-  if (process.platform !== "win32" && !commandOnPath("flock", res.env)) {
+  if (res.dev && process.platform !== "win32" && !commandOnPath("flock", res.env)) {
     return {
       id: "utility",
       status: "warn",
-      detail: "flock (util-linux) not found — sync-runtime requires it for locking",
-      fix: "Install util-linux (flock)"
+      detail: "flock not found — the dev checkout's sync-runtime requires it for locking",
+      fix: process.platform === "darwin" ? "brew install flock (Homebrew's util-linux is keg-only and leaves flock off PATH)" : "Install util-linux (flock)"
     };
   }
   return {
     id: "utility",
     status: "pass",
-    detail: "git (and flock where required) on PATH"
+    detail: res.dev ? "git and flock on PATH" : "git on PATH"
   };
 }, isFragileCachePin = (entry) => {
   const n = entry.replaceAll("\\", "/").toLowerCase();
@@ -65795,7 +66040,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   if (!cmd)
     return null;
   try {
-    const r = spawnSync14(cmd, ["view", pkgName, "version"], {
+    const r = spawnSync15(cmd, ["view", pkgName, "version"], {
       encoding: "utf8",
       timeout: 20000,
       env: res.env
@@ -65808,9 +66053,18 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
 }, installedPluginVersion = (res) => {
   const pkg = readJson(path32.join(res.cursorPluginDir, "package.json"));
   return typeof pkg?.version === "string" && pkg.version ? pkg.version : null;
-}, installedOpenCodeCacheVersion = (res) => {
-  const pkg = readJson(path32.join(res.opencodePackageCacheDir, "node_modules", "@brainervirus", "workit-opencode", "package.json"));
-  return typeof pkg?.version === "string" && pkg.version ? pkg.version : null;
+}, installedOpenCodeCache = (res) => {
+  if (res.opencodePackageCacheDir !== null) {
+    const pkg = readJson(path32.join(res.opencodePackageCacheDir, "node_modules", "@brainervirus", "workit-opencode", "package.json"));
+    return typeof pkg?.version === "string" && pkg.version ? { version: pkg.version, dir: res.opencodePackageCacheDir } : null;
+  }
+  const found = openCodeInstalledPlugin(res.home, res.env);
+  if (!found)
+    return null;
+  let dir = path32.dirname(path32.dirname(path32.dirname(found.root)));
+  if (path32.basename(dir) !== "workit-opencode@latest")
+    dir = path32.dirname(dir);
+  return { version: found.version, dir };
 }, checkOpenCodePackageCache = (res) => {
   if (!existsSync14(res.opencodeConfig)) {
     return {
@@ -65842,8 +66096,9 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
       detail: `opencode pin ${pin} is an exact version — not compared to registry latest`
     };
   }
-  const installed = installedOpenCodeCacheVersion(res);
-  if (installed === null) {
+  const cache = installedOpenCodeCache(res);
+  const installed = cache?.version ?? null;
+  if (cache === null || installed === null) {
     return {
       id: "stale_install",
       status: "pass",
@@ -65857,7 +66112,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
       status: "warn",
       registryProbed: true,
       detail: "registry_unreachable: cannot compare OpenCode @latest cache against published workit-opencode",
-      fix: `Retry when npm is reachable, or remove ${res.opencodePackageCacheDir} and restart OpenCode to re-resolve`
+      fix: `Retry when npm is reachable, or remove ${cache.dir} and restart OpenCode to re-resolve`
     };
   }
   if (!semverAtLeast(installed, expected)) {
@@ -65866,7 +66121,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
       status: "fail",
       registryProbed: true,
       detail: `stale_install: OpenCode @latest cache has workit-opencode ${installed} behind published ${expected}`,
-      fix: `Remove ${res.opencodePackageCacheDir} and restart OpenCode — it re-resolves @latest on the next launch`
+      fix: `Remove ${cache.dir} and restart OpenCode — it re-resolves @latest on the next launch`
     };
   }
   return {
@@ -66335,7 +66590,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
 }, defaultIdentityProbes = (env) => ({
   origin: (cwd) => {
     try {
-      const out = spawnSync14("git", ["remote", "get-url", "origin"], {
+      const out = spawnSync15("git", ["remote", "get-url", "origin"], {
         cwd,
         encoding: "utf8",
         env
@@ -66347,7 +66602,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   },
   ghLogin: (e) => {
     try {
-      const out = spawnSync14("gh", ["api", "user", "--jq", ".login"], { encoding: "utf8", env: e });
+      const out = spawnSync15("gh", ["api", "user", "--jq", ".login"], { encoding: "utf8", env: e });
       const login = (out.stdout ?? "").trim();
       return out.status === 0 && login ? login : null;
     } catch {
@@ -66356,7 +66611,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   },
   glabLogin: (e) => {
     try {
-      const out = spawnSync14("glab", ["api", "user", "--jq", ".username"], {
+      const out = spawnSync15("glab", ["api", "user", "--jq", ".username"], {
         encoding: "utf8",
         env: e
       });
@@ -66368,7 +66623,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   },
   sshLogin: (host) => {
     try {
-      const out = spawnSync14("ssh", ["-o", "BatchMode=yes", "-o", "ConnectTimeout=5", "-T", `git@${host}`], {
+      const out = spawnSync15("ssh", ["-o", "BatchMode=yes", "-o", "ConnectTimeout=5", "-T", `git@${host}`], {
         encoding: "utf8",
         env
       });
@@ -66525,10 +66780,10 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
     fix: repair,
     registryProbed
   };
-}, HOOK_ISSUED_MARKER = "workit-issued-sessions/2", hookRecordsIssued = (root) => {
+}, HOOK_ISSUED_MARKER = "workit-issued-sessions/3", hookRecordsIssued = (root) => {
   let files;
   try {
-    files = readdirSync7(path32.join(root, "dist")).filter((f) => f.endsWith(".js"));
+    files = readdirSync8(path32.join(root, "dist")).filter((f) => f.endsWith(".js"));
   } catch {
     return null;
   }
@@ -66587,12 +66842,12 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   if (cached)
     return cached;
   const viaShell = process.platform === "win32" && /\.(?:cmd|bat)$/i.test(bin);
-  const r = viaShell ? spawnSync14(`"${bin}" --version`, {
+  const r = viaShell ? spawnSync15(`"${bin}" --version`, {
     encoding: "utf8",
     env,
     timeout: WORKIT_PROBE_TIMEOUT_MS,
     shell: true
-  }) : spawnSync14(bin, ["--version"], { encoding: "utf8", env, timeout: WORKIT_PROBE_TIMEOUT_MS });
+  }) : spawnSync15(bin, ["--version"], { encoding: "utf8", env, timeout: WORKIT_PROBE_TIMEOUT_MS });
   const timedOut = r.error !== undefined && "code" in r.error && r.error.code === "ETIMEDOUT";
   const version = r.status === 0 ? (r.stdout ?? "").match(SEMVER)?.[0] ?? null : null;
   const probe = { version: timedOut ? null : version, timedOut };
@@ -66605,7 +66860,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
       version: i.version
     })),
     { label: "Cursor plugin", version: installedPluginVersion(res) },
-    { label: "OpenCode plugin", version: installedOpenCodeCacheVersion(res) }
+    { label: "OpenCode plugin", version: installedOpenCodeCache(res)?.version ?? null }
   ].filter((p) => p.version !== null);
   const newest = plugins.reduce((best, p) => best && semverAtLeast(best.version, p.version) ? best : p, null);
   const target = newest?.version ?? "latest";
@@ -66646,7 +66901,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   } : c) : raw;
   const failed = checks.filter((c) => c.status === "fail").length;
   const warned = checks.filter((c) => c.status === "warn").length;
-  const passed = checks.filter((c) => c.status === "pass").length;
+  const passed = checks.filter((c) => c.status === "pass" || c.status === "info").length;
   const exitCode = failed > 0 ? 1 : 0;
   const offline = !raw.some((c) => ("registryProbed" in c) && c.registryProbed);
   const report = {
@@ -66737,13 +66992,14 @@ import {
   mkdirSync as mkdirSync7,
   mkdtempSync as mkdtempSync2,
   readFileSync as readFileSync15,
-  readdirSync as readdirSync8,
+  readdirSync as readdirSync9,
   realpathSync as realpathSync7,
   renameSync as renameSync4,
   rmSync as rmSync4,
   statSync as statSync6,
   writeFileSync as writeFileSync8
 } from "node:fs";
+import { createRequire as createRequire2 } from "node:module";
 import os9 from "node:os";
 import path33 from "node:path";
 import { isDeepStrictEqual as isDeepStrictEqual2 } from "node:util";
@@ -66780,6 +67036,7 @@ function buildSetupPreview(values, opts = {}) {
   const blocked = [];
   const mutations = [];
   const preserved = [];
+  let projectRefused;
   const overrides = activeSetupOverrides(env);
   for (const entry of [state.config, state.youtrack, state.vcs, state.workspaces]) {
     if (entry.status === "malformed")
@@ -66902,8 +67159,11 @@ function buildSetupPreview(values, opts = {}) {
         }
       }
     }
-    if (values.applyProject) {
-      const root = path33.resolve(opts.cwd ?? process.cwd());
+    const target = values.applyProject ? projectTarget(opts.cwd ?? process.cwd()) : null;
+    if (target && !target.ok)
+      projectRefused = target.refused;
+    if (target?.ok) {
+      const root = target.root;
       const gitignorePath = path33.join(root, ".gitignore");
       const existing = existsSync15(gitignorePath) ? readFileSync15(gitignorePath, "utf8") : "";
       const existingLines = new Set(existing.split(`
@@ -66922,7 +67182,8 @@ function buildSetupPreview(values, opts = {}) {
     overrides,
     preserved,
     platforms: values.platforms ?? [],
-    state
+    state,
+    ...projectRefused === undefined ? {} : { projectRefused }
   };
 }
 function resolveApply(preview, options) {
@@ -67105,7 +67366,14 @@ function adapterRoot(platform, res, preferInstalledAdapter = false) {
   if (res.dev) {
     candidates.push(path33.join(res.dev, "packages", `workit-${platform}`));
   } else {
-    candidates.push(path33.join(packageRoot(), "..", `workit-${platform}`));
+    candidates.push(...nodeResolvedAdapters(platform));
+    if (platform === "cursor")
+      candidates.push(stagedCursor);
+    if (platform === "opencode") {
+      const cached = openCodeInstalledPlugin(res.home, res.env);
+      if (cached)
+        candidates.push(cached.root);
+    }
     let dir = path33.resolve(res.cwd);
     while (true) {
       candidates.push(path33.join(dir, "packages", `workit-${platform}`));
@@ -67115,17 +67383,14 @@ function adapterRoot(platform, res, preferInstalledAdapter = false) {
       dir = parent;
     }
   }
-  candidates.push(path33.join(res.home, ".local", "share", "workit", "packages", `workit-${platform}`));
-  if (platform === "cursor")
-    candidates.push(stagedCursor);
   for (const candidate of candidates) {
     if (isAdapter(candidate, platform))
-      return candidate;
+      return realRoot(candidate);
   }
   return null;
 }
 function applyOpenCode(root, res) {
-  const resolvedPin = opencodePin(root, res);
+  const resolvedPin = root === null ? OPENCODE_NPM_PIN : opencodePin(root, res);
   if (!resolvedPin) {
     return {
       platform: "opencode",
@@ -67424,6 +67689,10 @@ function applySetupPreview(preview, options = {}) {
       root = adapterRoot(platform, res, options.preferInstalledAdapter);
       rootFor.set(platform, root);
     }
+    if (root === null && registersNpmPin(platform, res)) {
+      entries.push(applyOpenCode(null, res));
+      continue;
+    }
     if (root === null) {
       entries.push({
         platform,
@@ -67465,12 +67734,20 @@ function applySetupPreview(preview, options = {}) {
       detail: "existing credential preserved"
     });
   }
+  if (preview.projectRefused) {
+    entries.push({
+      platform: "core",
+      file: path33.resolve(res.cwd),
+      status: "Skipped",
+      detail: preview.projectRefused
+    });
+  }
   const doctor = [];
   for (const platform of preview.platforms) {
     if (platform !== "opencode" && platform !== "cursor")
       continue;
     const root = rootFor.get(platform);
-    if (root === null || root === undefined)
+    if (root === undefined || root === null && !registersNpmPin(platform, res))
       continue;
     if (!entries.some((e) => e.platform === platform && e.status !== "Failed"))
       continue;
@@ -67599,6 +67876,16 @@ var TOKEN_PLACEHOLDER3 = "YOUR_TOKEN_HERE", YT_OVERRIDES, VCS_OVERRIDES, SETUP_O
   } catch {
     return false;
   }
+}, nodeResolvedAdapters = (platform) => {
+  const name = `@brainervirus/workit-${platform}`;
+  const require2 = createRequire2(path33.join(packageRoot(), "package.json"));
+  return (require2.resolve.paths(name) ?? []).map((dir) => path33.join(dir, name));
+}, realRoot = (root) => {
+  try {
+    return realpathSync7(root);
+  } catch {
+    return root;
+  }
 }, isDevOpenCodeAdapterRoot = (root, dev) => {
   if (dev)
     return true;
@@ -67613,7 +67900,7 @@ var TOKEN_PLACEHOLDER3 = "YOUR_TOKEN_HERE", YT_OVERRIDES, VCS_OVERRIDES, SETUP_O
       return `file://${entry}`;
   }
   return null;
-}, opencodePin = (root, res) => resolveOpenCodePin(root, { dev: res.dev }), CURSOR_HOOKS_FILE, localizedCursorHooks = (shipped, pluginDir) => {
+}, opencodePin = (root, res) => resolveOpenCodePin(root, { dev: res.dev }), registersNpmPin = (platform, res) => platform === "opencode" && !res.dev, CURSOR_HOOKS_FILE, localizedCursorHooks = (shipped, pluginDir) => {
   try {
     const merged = mergeCursorHooks(JSON.parse(shipped.toString("utf8")), { command: cursorHooksEntry(pluginDir).command }, pluginDir);
     return Buffer.from(`${JSON.stringify(merged.config, null, 2)}
@@ -67623,7 +67910,7 @@ var TOKEN_PLACEHOLDER3 = "YOUR_TOKEN_HERE", YT_OVERRIDES, VCS_OVERRIDES, SETUP_O
   }
 }, samePluginContent = (src, dest, pluginDir, relative = "") => {
   try {
-    for (const entry of readdirSync8(src, { withFileTypes: true })) {
+    for (const entry of readdirSync9(src, { withFileTypes: true })) {
       if (entry.name === "node_modules")
         continue;
       const source = path33.join(src, entry.name);
@@ -67638,7 +67925,7 @@ var TOKEN_PLACEHOLDER3 = "YOUR_TOKEN_HERE", YT_OVERRIDES, VCS_OVERRIDES, SETUP_O
           return false;
       }
     }
-    for (const entry of readdirSync8(dest, { withFileTypes: true })) {
+    for (const entry of readdirSync9(dest, { withFileTypes: true })) {
       if (existsSync15(path33.join(src, entry.name)))
         continue;
       const rel = path33.join(relative, entry.name);
@@ -67657,7 +67944,7 @@ var TOKEN_PLACEHOLDER3 = "YOUR_TOKEN_HERE", YT_OVERRIDES, VCS_OVERRIDES, SETUP_O
   const sourceRules = path33.join(src, "rules");
   const installedRules = path33.join(dest, "rules");
   try {
-    for (const entry of readdirSync8(installedRules, { withFileTypes: true })) {
+    for (const entry of readdirSync9(installedRules, { withFileTypes: true })) {
       if (!entry.isFile() || !entry.name.endsWith(".mdc"))
         continue;
       if (existsSync15(path33.join(sourceRules, entry.name)))
@@ -67674,7 +67961,7 @@ var TOKEN_PLACEHOLDER3 = "YOUR_TOKEN_HERE", YT_OVERRIDES, VCS_OVERRIDES, SETUP_O
   if (existsSync15(legacyRules)) {
     try {
       mkdirSync7(path33.join(res.cursorPluginDir, "rules"), { recursive: true });
-      for (const entry of readdirSync8(legacyRules, { withFileTypes: true })) {
+      for (const entry of readdirSync9(legacyRules, { withFileTypes: true })) {
         if (!entry.isFile() || !entry.name.endsWith(".mdc"))
           continue;
         const target = path33.join(res.cursorPluginDir, "rules", entry.name);
@@ -67684,7 +67971,7 @@ var TOKEN_PLACEHOLDER3 = "YOUR_TOKEN_HERE", YT_OVERRIDES, VCS_OVERRIDES, SETUP_O
     } catch {}
   }
   rmSync4(legacy, { recursive: true, force: true });
-}, failedDetail = (report) => report.checks.filter((c) => c.status === "fail").map((c) => `${c.id}: ${c.detail}`).join("; "), setupCompletionGuidance = () => [
+}, failedDetail = (report) => report.checks.filter((c) => c.status === "fail").map((c) => c.detail.startsWith(`${c.id}:`) ? c.detail : `${c.id}: ${c.detail}`).join("; "), setupCompletionGuidance = () => [
   "Run `workit doctor` to verify your installation.",
   "Run /wk-status in OpenCode to review token setup steps."
 ];
@@ -70753,7 +71040,43 @@ function Screen({
           }, undefined, false, undefined, this)
         ]
       }, undefined, true, undefined, this);
-    case "project":
+    case "project": {
+      const target = projectTargetFor(resolveBasePath(draft.values));
+      if (!target.ok) {
+        return /* @__PURE__ */ jsx_dev_runtime2.jsxDEV(Box_default, {
+          flexDirection: "column",
+          gap: 1,
+          children: [
+            /* @__PURE__ */ jsx_dev_runtime2.jsxDEV(Text, {
+              bold: true,
+              children: "Step 6 — Project setup"
+            }, undefined, false, undefined, this),
+            /* @__PURE__ */ jsx_dev_runtime2.jsxDEV(Text, {
+              color: "yellow",
+              children: [
+                "Skipped: ",
+                target.refused
+              ]
+            }, undefined, true, undefined, this),
+            /* @__PURE__ */ jsx_dev_runtime2.jsxDEV(ConfirmInput, {
+              defaultChoice: "confirm",
+              submitOnEnter: false,
+              onConfirm: () => {
+                dispatch({ type: "set", field: "applyProject", value: true });
+                dispatch({ type: "next" });
+              },
+              onCancel: () => {
+                dispatch({ type: "set", field: "applyProject", value: false });
+                dispatch({ type: "next" });
+              }
+            }, undefined, false, undefined, this),
+            /* @__PURE__ */ jsx_dev_runtime2.jsxDEV(Text, {
+              dimColor: true,
+              children: "y to keep this note in the summary · n to skip it · either adds no project files · b Back · Esc Cancel"
+            }, undefined, false, undefined, this)
+          ]
+        }, undefined, true, undefined, this);
+      }
       return /* @__PURE__ */ jsx_dev_runtime2.jsxDEV(Box_default, {
         flexDirection: "column",
         gap: 1,
@@ -70766,7 +71089,7 @@ function Screen({
             dimColor: true,
             children: [
               "Apply gitignore + hygiene in ",
-              resolveBasePath(draft.values),
+              target.root,
               "? (Existing files are never overwritten.)"
             ]
           }, undefined, true, undefined, this),
@@ -70788,6 +71111,7 @@ function Screen({
           }, undefined, false, undefined, this)
         ]
       }, undefined, true, undefined, this);
+    }
     case "summary": {
       const policy = effectivePolicy(draft.values);
       const preview = buildSetupPreview(draft.values, { cwd: resolveBasePath(draft.values) });
@@ -70929,8 +71253,15 @@ function Screen({
           }, undefined, true, undefined, this),
           /* @__PURE__ */ jsx_dev_runtime2.jsxDEV(Text, {
             children: [
-              "Project hygiene: ",
-              /* @__PURE__ */ jsx_dev_runtime2.jsxDEV(Text, {
+              "Project hygiene:",
+              " ",
+              preview.projectRefused ? /* @__PURE__ */ jsx_dev_runtime2.jsxDEV(Text, {
+                color: "yellow",
+                children: [
+                  "skipped — ",
+                  preview.projectRefused
+                ]
+              }, undefined, true, undefined, this) : /* @__PURE__ */ jsx_dev_runtime2.jsxDEV(Text, {
                 color: "green",
                 children: draft.values.applyProject ? "yes" : "no"
               }, undefined, false, undefined, this)
@@ -71019,7 +71350,11 @@ function Screen({
       }, undefined, false, undefined, this);
   }
 }
-var import_react66, jsx_dev_runtime2, PLATFORM_LABELS, BRANCH_PRESETS, BRANCH_PRESET_DESCRIPTIONS, SCREEN_PLACEHOLDERS, VCS_PROVIDERS, LOCALE_PICKER_OPTIONS, ISSUE_TRACKERS, WORKSPACE_ADVANCED_FIELDS, PROFILE_FIELDS, TRACK_FIELDS, enumFieldOptions = (field) => {
+var import_react66, jsx_dev_runtime2, lastProjectTarget = null, projectTargetFor = (base) => {
+  if (lastProjectTarget?.base !== base)
+    lastProjectTarget = { base, target: projectTarget(base) };
+  return lastProjectTarget.target;
+}, PLATFORM_LABELS, BRANCH_PRESETS, BRANCH_PRESET_DESCRIPTIONS, SCREEN_PLACEHOLDERS, VCS_PROVIDERS, LOCALE_PICKER_OPTIONS, ISSUE_TRACKERS, WORKSPACE_ADVANCED_FIELDS, PROFILE_FIELDS, TRACK_FIELDS, enumFieldOptions = (field) => {
   if (field === "commitPolicy.preset")
     return [{ label: "Inherit global", value: "inherit" }, ...commitPresetOptions];
   if (field === "branchPolicy.preset")
@@ -71061,6 +71396,7 @@ var init_steps = __esm(async () => {
   init_logic();
   init_workspaces();
   init_branch_policy();
+  init_hygiene();
   init_wizard_state();
   init_detect_hosts();
   await __promiseAll([
@@ -71452,7 +71788,7 @@ var init_init = __esm(() => {
 });
 
 // packages/workit-cli/src/upgrade.ts
-import { spawnSync as spawnSync15 } from "node:child_process";
+import { spawnSync as spawnSync16 } from "node:child_process";
 import {
   existsSync as existsSync18,
   mkdtempSync as mkdtempSync3,
@@ -71808,7 +72144,7 @@ async function runLaunchCommand(argv, deps = {}) {
   }
   if (deps.run)
     return deps.run(host, hostArgs).status ?? 1;
-  return spawnSync15(launch.command, launch.args, {
+  return spawnSync16(launch.command, launch.args, {
     stdio: "inherit",
     env
   }).status ?? 1;
@@ -71990,7 +72326,7 @@ var init_launch = __esm(() => {
 });
 
 // packages/workit-core/src/knowledge.ts
-import { spawnSync as spawnSync16 } from "node:child_process";
+import { spawnSync as spawnSync17 } from "node:child_process";
 import fs18 from "node:fs";
 import path38 from "node:path";
 function lintKnowledge(root) {
@@ -72111,7 +72447,7 @@ var AGENTS_BYTE_BUDGET, STEERING_FILES, NEED_BASED_FILES, STANDARDS_FILE = "CODI
     return "unreadable";
   }
 }, trackedTopLevel = (root) => {
-  const run = spawnSync16("git", ["ls-files", "-z", "--cached"], {
+  const run = spawnSync17("git", ["ls-files", "-z", "--cached"], {
     cwd: root,
     encoding: "utf8",
     maxBuffer: 256 * 1024 * 1024,
@@ -72479,7 +72815,8 @@ var R = "[REDACTED]", TOKEN_PATTERNS, WEBHOOK, URL_USERINFO, CURL_USER, KEY, ASS
 var init_redact = __esm(() => {
   TOKEN_PATTERNS = [
     /\b(?:gh[pousr]_[A-Za-z0-9]{20,}|github_pat_[A-Za-z0-9_]{20,})/gu,
-    /\bgl[a-z]{1,8}-[A-Za-z0-9_-]{16,}/gu,
+    /\b(?:glpat|gloas|gldt|glrtr|glrt|glcbt|glptt|glft|glimt|glagent|glwt|glsoat|glffct)-[A-Za-z0-9_-]{20,}/gu,
+    /\b_gitlab_session=[A-Za-z0-9%_-]{16,}/gu,
     /\bnpm_[A-Za-z0-9]{30,}/gu,
     /\bxox[abposr]-[A-Za-z0-9-]{10,}/gu,
     /\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/gu,
@@ -72513,7 +72850,7 @@ var init_redact = __esm(() => {
 });
 
 // packages/workit-core/src/checks.ts
-import { spawn, spawnSync as spawnSync17 } from "node:child_process";
+import { spawn, spawnSync as spawnSync18 } from "node:child_process";
 import { createHash as createHash16 } from "node:crypto";
 import fs19 from "node:fs";
 import os13 from "node:os";
@@ -72695,7 +73032,7 @@ function runCheckCommand(argv, options) {
       if (!child?.pid)
         return;
       if (windows)
-        spawnSync17("taskkill", ["/pid", String(child.pid), "/T", "/F"], {
+        spawnSync18("taskkill", ["/pid", String(child.pid), "/T", "/F"], {
           stdio: "ignore",
           windowsHide: true
         });
@@ -74031,7 +74368,7 @@ var init_check = __esm(() => {
 var success2 = (data) => ({ ok: true, data }), failure3 = (code, error, unblock) => ({ ok: false, code, error, ...unblock ? { unblock } : {} });
 
 // packages/workit-core/src/git/ops.ts
-import { spawnSync as spawnSync18 } from "node:child_process";
+import { spawnSync as spawnSync19 } from "node:child_process";
 import { existsSync as existsSync19, readFileSync as readFileSync19 } from "node:fs";
 import path42 from "node:path";
 function operationInProgress(cwd) {
@@ -74346,6 +74683,14 @@ function gitCommit(cwd, input) {
   const session = input.actor.session;
   if (session && !SESSION_SAFE.test(session))
     return failure3("invalid_input", "WORKIT_SESSION_ID must be 1-128 characters of [A-Za-z0-9_.:@/+-]");
+  if (session) {
+    const env = input.env ?? process.env;
+    if (issuedBinding(cwd, session) !== null)
+      return failure3("blocked", `judge_session: ${session} was issued to a verifier or reviewer subagent; it records verdicts and never authors commits`, "commit from the implementer's or the lead's own session (unset WORKIT_SESSION_ID back to the shell's)");
+    const refusal = sessionClaimRefusal(env, session, cwd);
+    if (refusal)
+      return failure3("blocked", refusal.error, "commit from the session this shell really is: never set WORKIT_SESSION_ID by hand for a commit (unset it, or use the id the host put in this shell)");
+  }
   const changeRequired = !input.amend && !input.allowEmpty;
   const emptyAmend = previous !== null && git5(cwd, ["rev-parse", "--verify", "-q", `${previous}^{tree}`]).stdout.trim() === git5(cwd, ["rev-parse", "--verify", "-q", `${previous}~1^{tree}`]).stdout.trim();
   const args = ["commit", "--no-edit"];
@@ -74628,6 +74973,51 @@ ${gitOutput(run)}`);
     recorded: row.ok ? { id: String(row.value.id) } : { error: row.error }
   });
 }
+function releaseLinesOf(cwd) {
+  const { preset, branches, production } = releaseBranchesOf(cwd);
+  let policyPrefix;
+  try {
+    const selected = resolveRuntimeWorkspacePolicy(cwd, "branch", process.env.WORKFLOW_PROFILE?.trim() || undefined).policy;
+    policyPrefix = selected?.releaseTagPrefix;
+  } catch {
+    policyPrefix = undefined;
+  }
+  const prefix = releaseTagPrefixOf(cwd, policyPrefix);
+  const trunk = production ?? "main";
+  const lines = [
+    {
+      track: null,
+      production: branches[0] ?? trunk,
+      integration: branches[1] ?? trunk,
+      mergeBack: branches[1] ? [branches[1]] : [],
+      tagPrefix: prefix,
+      gitflow: branches.length > 0,
+      naming: {}
+    }
+  ];
+  let raw;
+  try {
+    raw = resolveRuntimeReleaseTracks(cwd)?.releaseTracks;
+  } catch {
+    return lines;
+  }
+  for (const track of readReleaseTracks(raw).tracks) {
+    const value = isRecord8(raw) ? raw[track.name] : undefined;
+    const entry = isRecord8(value) ? value : {};
+    const strategy = typeof entry.strategy === "string" ? entry.strategy : preset;
+    const namespace = typeof entry.tagNamespace === "string" ? entry.tagNamespace.trim() : "";
+    lines.push({
+      track: track.name,
+      production: track.productionBranch,
+      integration: track.integrationBranch,
+      mergeBack: track.mergeBackBranches.length ? track.mergeBackBranches : [track.integrationBranch],
+      tagPrefix: `${namespace}${prefix}`,
+      gitflow: strategy === "gitflow",
+      naming: { release: track.naming.release, hotfix: track.naming.hotfix }
+    });
+  }
+  return lines;
+}
 function releasePushPreflight(cwd, names) {
   const progress = operationInProgress(cwd);
   if (progress)
@@ -74635,7 +75025,16 @@ function releasePushPreflight(cwd, names) {
   const wanted = [...new Set(names)];
   if (!wanted.length)
     return failure3("invalid_input", "name the release refs to push");
-  const { preset, branches, production } = releaseBranchesOf(cwd);
+  const { preset, production } = releaseBranchesOf(cwd);
+  const lines = releaseLinesOf(cwd);
+  const tracks = lines.filter((line) => line.track !== null && line.gitflow);
+  const branches = [
+    ...new Set([
+      ...releaseBranchesOf(cwd).branches,
+      ...tracks.flatMap((line) => [line.production, line.integration, ...line.mergeBack])
+    ])
+  ];
+  const tagShape = `${lines[0].tagPrefix}<version>`;
   const refs = [];
   for (const raw of wanted) {
     if (raw.startsWith("-") || raw.includes(":"))
@@ -74647,16 +75046,22 @@ function releasePushPreflight(cwd, names) {
     if (tag && branch)
       return failure3("invalid_input", `${raw} names both a branch and a tag`, `workit git push --release refs/heads/${raw}  # or refs/tags/${raw}`);
     if (tag) {
-      const prefix = releaseTagPrefix(cwd);
-      if (!isReleaseTag(tagName, prefix))
-        return failure3("blocked", `release_push_refused: tag ${tagName} is not a release tag (${prefix}<version>, from ${prefix === "v" ? "the default" : "gitflow.prefix.versiontag"})`, `git tag -a ${prefix}<version> -m <message>  # then: workit git push --release ${prefix}<version>`);
-      refs.push({ kind: "tag", name: tagName, ref: `refs/tags/${tagName}`, sha: tag });
+      const line = lineOfTag(tagName, lines);
+      if (!line)
+        return failure3("blocked", `release_push_refused: tag ${tagName} is not a release tag (${tagShape})`, `git tag -a ${tagShape} -m <message>  # then: workit git push --release ${tagShape}`);
+      refs.push({
+        kind: "tag",
+        name: tagName,
+        ref: `refs/tags/${tagName}`,
+        sha: tag,
+        production: line.track === null ? production : line.production
+      });
       continue;
     }
     if (!branch)
       return failure3("not_found", `${raw} is not a local branch or tag`);
     if (!branches.some((name) => name.toLowerCase() === branchName.toLowerCase()))
-      return failure3("blocked", branches.length ? `release_push_refused: ${branchName} is not a git-flow release branch (${branches.join(", ")})` : `release_push_refused: the ${preset} policy lands ${branchName} only through a reviewed PR; workit git push --release pushes v<version> tags there, not branches`, branches.length ? "workit git push  # a feature, bugfix, release or hotfix branch, then: workit pr create" : `workit pr create --base ${branchName}  # then tag the merged commit and: workit git push --release v<version>`);
+      return failure3("blocked", branches.length ? `release_push_refused: ${branchName} is not a git-flow release branch (${branches.join(", ")})` : `release_push_refused: the ${preset} policy lands ${branchName} only through a reviewed PR; workit git push --release pushes ${tagShape} tags there, not branches`, branches.length ? "workit git push  # a feature, bugfix, release or hotfix branch, then: workit pr create" : `workit pr create --base ${branchName}  # then tag the merged commit and: workit git push --release ${tagShape}`);
     refs.push({ kind: "branch", name: branchName, ref: `refs/heads/${branchName}`, sha: branch });
   }
   const remote = pushRemoteName(cwd, refs.find((ref) => ref.kind === "branch")?.name ?? null);
@@ -74668,7 +75073,14 @@ function releasePushPreflight(cwd, names) {
   const local = parseRemoteUrl(raw)?.protocol === "file";
   if (!local && !pushTargetIsStable(cwd, raw))
     return failure3("blocked", `push_target_rewritten: the push URL of "${remote}" is rewritten by a url.*.insteadOf rule, so the destination is not the one checked`, "git config --get-regexp '^url\\.'  # remove the rewrite for this remote");
-  return success2({ refs, remote, url: redactRemote(raw), rawUrl: raw, local, production });
+  return success2({
+    refs,
+    remote,
+    url: redactRemote(raw),
+    rawUrl: raw,
+    local,
+    production
+  });
 }
 function executeReleasePush(cwd, plan, input) {
   const previous = new Map;
@@ -74685,20 +75097,20 @@ function executeReleasePush(cwd, plan, input) {
       return failure3("failed", `non_fast_forward: ${plan.remote}/${ref.name} (${before.sha.slice(0, 12)}) is not part of local ${ref.name}; a release push never rewrites it`, `git fetch ${plan.remote} ${ref.name} && git switch ${ref.name} && git merge --ff-only ${plan.remote}/${ref.name}  # then: workit git push --release ${ref.name}`);
   }
   const tags = plan.refs.filter((ref) => ref.kind === "tag");
-  if (tags.length) {
-    let productionTip = null;
-    if (plan.production) {
-      const tip = remoteRefTip(cwd, plan.rawUrl, `refs/heads/${plan.production}`);
+  const contains = (tip, sha) => git5(cwd, ["merge-base", "--is-ancestor", sha, tip]).ok;
+  for (const tag of tags) {
+    const production = tag.production ?? plan.production;
+    let remoteTip = null;
+    if (production) {
+      const tip = remoteRefTip(cwd, plan.rawUrl, `refs/heads/${production}`);
       if (!tip.ok)
         return failure3(tip.code, tip.error);
-      productionTip = tip.sha;
-    }
-    const contains = (tip, sha) => git5(cwd, ["merge-base", "--is-ancestor", sha, tip]).ok;
-    for (const tag of tags) {
-      const released = productionTip !== null && contains(productionTip, tag.sha) || plan.refs.some((ref) => ref.kind === "branch" && contains(ref.sha, tag.sha));
-      if (!released)
-        return failure3("blocked", `tag_unreleased: ${tag.name} (${tag.sha.slice(0, 12)}) is not on ${plan.remote}/${plan.production ?? "the production branch"}${plan.refs.some((ref) => ref.kind === "branch") ? " or a branch in this push" : ""}; a release tag marks a commit that already landed`, `land it through a PR first (workit pr create), git fetch ${plan.remote}, then tag the merged commit`);
+      remoteTip = tip.sha;
     }
+    const pushed = plan.refs.find((ref) => ref.kind === "branch" && ref.name.toLowerCase() === production?.toLowerCase());
+    const released = remoteTip !== null && contains(remoteTip, tag.sha) || pushed !== undefined && contains(pushed.sha, tag.sha);
+    if (!released)
+      return failure3("blocked", `tag_unreleased: ${tag.name} (${tag.sha.slice(0, 12)}) is not on ${plan.remote}/${production ?? "the production branch"}${pushed ? ` or the ${production} in this push` : ""}; a release tag marks a commit that already landed on its line's production branch`, `land it through a PR first (workit pr create), git fetch ${plan.remote}, then tag the merged commit`);
   }
   const pending = plan.refs.filter((ref) => previous.get(ref.ref) !== ref.sha);
   if (pending.length) {
@@ -74777,7 +75189,7 @@ ${run.stdout}`;
   } : { ok: false, lease: false, error: gitError(run) };
 }
 var COMMIT_TIMEOUT_MS, PUSH_TIMEOUT_MS = 120000, git5 = (cwd, args, options = {}) => {
-  const result = spawnSync18("git", args, {
+  const result = spawnSync19("git", args, {
     cwd,
     encoding: "utf8",
     env: { ...options.env ?? process.env, GIT_TERMINAL_PROMPT: "0" },
@@ -74812,18 +75224,17 @@ ${run.stdout ?? ""}`).split(/\r?\n/u).map((value) => value.trimEnd()).filter((va
     ...lines.slice(-half)
   ].join(`
 `);
-}, validRefName = (cwd, name) => !name.startsWith("-") && git5(cwd, ["check-ref-format", "--branch", name]).ok, nulList = (text) => text.split("\x00").filter(Boolean), SESSION_SAFE, EXTRA_TRAILER, SESSION_KEY, TRAILER_LINE, sessionValues = (trailers) => trailers.filter((trailer) => SESSION_KEY.test(trailer)).map((trailer) => trailer.slice(trailer.indexOf(":") + 1).trim()), TRAILER_CONFIG, nothingToCommit = (what) => failure3("failed", `nothing_to_commit: ${what}`, "workit git commit --allow-empty -m '<msg>'  # only to record an empty commit on purpose"), SHA, SHA_PREFIX, releaseTagPrefix = (cwd) => {
-  const configured = git5(cwd, ["config", "--get", "gitflow.prefix.versiontag"]);
-  return configured.ok ? configured.stdout.trim() : "v";
-}, isReleaseTag = (name, prefix) => name.startsWith(prefix) && /^\d/u.test(name.slice(prefix.length));
+}, validRefName = (cwd, name) => !name.startsWith("-") && git5(cwd, ["check-ref-format", "--branch", name]).ok, nulList = (text) => text.split("\x00").filter(Boolean), SESSION_SAFE, EXTRA_TRAILER, SESSION_KEY, TRAILER_LINE, sessionValues = (trailers) => trailers.filter((trailer) => SESSION_KEY.test(trailer)).map((trailer) => trailer.slice(trailer.indexOf(":") + 1).trim()), TRAILER_CONFIG, nothingToCommit = (what) => failure3("failed", `nothing_to_commit: ${what}`, "workit git commit --allow-empty -m '<msg>'  # only to record an empty commit on purpose"), SHA, SHA_PREFIX, isRecord8 = (value) => typeof value === "object" && value !== null && !Array.isArray(value), lineOfTag = (tag, lines) => lines.filter((line) => tag.startsWith(line.tagPrefix) && /^\d/u.test(tag.slice(line.tagPrefix.length))).toSorted((a, b) => b.tagPrefix.length - a.tagPrefix.length)[0] ?? null;
 var init_ops = __esm(() => {
   init_branch();
+  init_branch_policy();
   init_commit_flavors();
   init_pr_create();
   init_release_tracks();
   init_vcs_config();
   init_workspaces();
   init_redact();
+  init_host_session();
   init_ledger();
   init_rev();
   COMMIT_TIMEOUT_MS = 10 * 60000;
@@ -75312,7 +75723,7 @@ var init_report = __esm(() => {
 });
 
 // packages/workit-core/src/forge/pr-ops.ts
-import { spawnSync as spawnSync19 } from "node:child_process";
+import { spawnSync as spawnSync20 } from "node:child_process";
 function fillFromCommits(cwd, resolved, base) {
   const tracking = `refs/remotes/${resolved.baseRemote}/${base}`;
   if (!base.startsWith("-"))
@@ -75320,7 +75731,7 @@ function fillFromCommits(cwd, resolved, base) {
   const from = resolveRef(cwd, tracking) ?? resolveRef(cwd, `refs/heads/${base}`);
   if (!from)
     return failure3("not_found", `base ${base} is not available locally`, `git fetch ${resolved.baseRemote} ${base}`);
-  const log = spawnSync19("git", ["log", "--reverse", "--no-merges", "--format=%s%x1f%b%x1e", `${from}..HEAD`], {
+  const log = spawnSync20("git", ["log", "--reverse", "--no-merges", "--format=%s%x1f%b%x1e", `${from}..HEAD`], {
     cwd,
     encoding: "utf8",
     timeout: GIT_TIMEOUTS.local,
@@ -75517,7 +75928,7 @@ function squashCommitList(cwd, resolved, base, head) {
   const from = resolveRef(cwd, `refs/remotes/${resolved.baseRemote}/${base}`) ?? resolveRef(cwd, `refs/heads/${base}`);
   if (!from)
     return "";
-  const log = spawnSync19("git", ["log", "--reverse", "--no-merges", "--format=%B%x1e", `${from}..${head}`], {
+  const log = spawnSync20("git", ["log", "--reverse", "--no-merges", "--format=%B%x1e", `${from}..${head}`], {
     cwd,
     encoding: "utf8",
     timeout: GIT_TIMEOUTS.local,
@@ -75590,7 +76001,7 @@ async function mergePullRequest(cwd, resolved, input, sleep) {
     if (reason)
       return refuse(`protected_branch: --delete-branch would delete ${branch}, which ${reason}; workit never deletes it`, `workit pr merge${input.pr ? ` --pr ${doc.number}` : ""} --method ${input.method}  # without --delete-branch`, { reason: "protected_branch" });
   }
-  const ledger = readLedger(cwd);
+  const ledger = readLedger(cwd, { integrity: true });
   if (!ledger.ok)
     return ledger;
   const check = checkVerdicts(cwd, branch, ledger.value.rows);
@@ -75622,18 +76033,54 @@ async function mergePullRequest(cwd, resolved, input, sleep) {
     unverified = { reason, recorded: String(recorded.value.id) };
   } else if (check.head !== head)
     return refuse(`head_mismatch: the verdict check reads ${branch} at ${check.head?.slice(0, 12) ?? "(missing)"} but ${label} is at ${head.slice(0, 12)}`, `git fetch && git switch ${branch} && git merge --ff-only @{u}  # then re-verify that head`, { reason: "head_mismatch", verdict: summary });
+  else if (!covered && check.accepted.reasons.includes("ledger_tampered"))
+    return refuse(`ledger_tampered: a ledger row was edited, removed or moved, so no verdict for ${label} is accepted until it is repaired`, tamperedUnblock(cwd), { reason: "ledger_tampered", verdict: summary });
   else if (!covered)
     return refuse(`NEEDS_VERDICT: ${label} has no accepted independent verdict for ${head.slice(0, 12)} (${check.accepted.reasons.join(", ")})`, `an independent session verifies the head and runs: workit ledger verdict verified --how "<what was exercised>" --branch ${branch}${grant.allowUnverified ? `; or, only if the user asks to merge unverified: workit pr merge --unverified --reason "<why>"` : ""}`, { reason: "needs_verdict", verdict: summary });
   const squashMessage = squashMessageFor(cwd, resolved, input, doc);
   if (squashMessage && !squashMessage.ok)
     return squashMessage;
+  const intent = appendObserved(cwd, {
+    type: "pr.merge.intent",
+    actor: input.actor,
+    branch,
+    head,
+    pr: doc.number,
+    base: doc.base,
+    method: input.method,
+    verdictId: verdict.verdictId,
+    ...unverified ? { unverified: unverified.recorded } : {},
+    grant: grant.source
+  });
+  if (!intent.ok)
+    return refuse(`intent_unrecorded: the merge intent for ${label} could not be recorded (${intent.error}); nothing was merged`, "fix the ledger (workit ledger check), then merge again", { reason: "intent_unrecorded" });
+  const intentId = String(intent.value.id);
   const merged = resolved.forge.merge(doc.number, {
     sha: head,
     method: input.method,
     ...squashMessage ? { squashMessage: squashMessage.data } : {}
   });
   if (!merged.ok)
-    return merged;
+    return {
+      ...merged,
+      error: `${merged.error} (merge intent ${intentId} is recorded: if the forge merged anyway, workit pr status reads it)`
+    };
+  const row = appendObserved(cwd, {
+    type: "pr.merged",
+    actor: input.actor,
+    branch,
+    head,
+    pr: doc.number,
+    base: doc.base,
+    mergeSha: merged.data.mergeSha,
+    method: input.method,
+    verdictId: verdict.verdictId,
+    ...unverified ? { unverified: unverified.recorded } : {},
+    grant: grant.source,
+    intent: intentId,
+    verified: false
+  });
+  const recorded = row.ok ? { id: String(row.value.id) } : { error: row.error };
   let state = "open";
   for (const delay of [0, ...VERIFY_DELAYS_MS]) {
     if (delay)
@@ -75648,9 +76095,21 @@ async function mergePullRequest(cwd, resolved, input, sleep) {
     return {
       ok: false,
       code: "failed",
-      error: `merge_unverified: the forge accepted the merge of ${label} but still reports it ${state}`,
-      unblock: `workit verify-delivery merged --pr ${doc.number}`
+      error: `merge_unverified: the forge accepted the merge of ${label} but still reports it ${state}${"id" in recorded ? `; recorded as pr.merged ${recorded.id} (verified: false)` : `; the pr.merged row could not be written (${recorded.error})`}`,
+      unblock: `workit verify-delivery merged --pr ${doc.number}`,
+      recorded
     };
+  const confirmation = "id" in recorded ? appendObserved(cwd, {
+    type: "pr.merge.verified",
+    actor: input.actor,
+    branch,
+    head,
+    pr: doc.number,
+    base: doc.base,
+    merged: recorded.id,
+    mergeSha: merged.data.mergeSha
+  }) : null;
+  const confirmed = confirmation === null ? { error: "no pr.merged row to confirm" } : confirmation.ok ? { id: String(confirmation.value.id) } : { error: confirmation.error };
   let deletedBranch = false;
   if (input.deleteBranch) {
     const deleted = deleteRemoteBranch(cwd, resolved.remote, branch, head);
@@ -75658,19 +76117,6 @@ async function mergePullRequest(cwd, resolved, input, sleep) {
     deletedBranch = deleted.ok || gone && gone.ok && gone.sha === null ? true : { error: deleted.error };
   }
   const mergeBack = mergeBackFor(cwd, doc.base, branch);
-  const row = appendObserved(cwd, {
-    type: "pr.merged",
-    actor: input.actor,
-    branch,
-    head,
-    pr: doc.number,
-    base: doc.base,
-    mergeSha: merged.data.mergeSha,
-    method: input.method,
-    verdictId: verdict.verdictId,
-    ...unverified ? { unverified: unverified.recorded } : {},
-    grant: grant.source
-  });
   return {
     ok: true,
     data: {
@@ -75685,7 +76131,8 @@ async function mergePullRequest(cwd, resolved, input, sleep) {
       unverified,
       grant: { source: grant.source },
       deletedBranch,
-      recorded: row.ok ? { id: String(row.value.id) } : { error: row.error },
+      recorded,
+      confirmed,
       mergeBack: mergeBack.branches,
       mergeBackTrack: mergeBack.track
     }
@@ -75743,8 +76190,8 @@ var init_pr_ops = __esm(() => {
 });
 
 // packages/workit-core/src/stack.ts
-import { spawnSync as spawnSync20 } from "node:child_process";
-import { createHash as createHash17, randomBytes as randomBytes3 } from "node:crypto";
+import { spawnSync as spawnSync21 } from "node:child_process";
+import { createHash as createHash17, randomBytes as randomBytes4 } from "node:crypto";
 import fs22 from "node:fs";
 import path44 from "node:path";
 function worktreeOf(cwd, branch) {
@@ -75790,7 +76237,7 @@ function gitRestack(cwd, input) {
     if (!scratch)
       return { ok: false, conflict: false, worktree: cwd, error: "no store root" };
     fs22.mkdirSync(scratch, { recursive: true });
-    dir = path44.join(scratch, `${input.branch.replace(/[^A-Za-z0-9._-]+/gu, "_").slice(0, 40)}-${randomBytes3(4).toString("hex")}`);
+    dir = path44.join(scratch, `${input.branch.replace(/[^A-Za-z0-9._-]+/gu, "_").slice(0, 40)}-${randomBytes4(4).toString("hex")}`);
     const added = gitRun3(cwd, ["worktree", "add", "-q", dir, input.branch], GIT_TIMEOUTS.worktree);
     if (!added.ok)
       return { ok: false, conflict: false, worktree: cwd, error: firstLine(added) };
@@ -75844,7 +76291,7 @@ function stacksDir(cwd) {
   return { ok: true, data: path44.join(root.value.root, "stacks") };
 }
 function parseStack(raw) {
-  if (!isRecord8(raw) || !Array.isArray(raw.branches))
+  if (!isRecord9(raw) || !Array.isArray(raw.branches))
     return null;
   const name = str3(raw.name);
   const trunk = str3(raw.trunk);
@@ -75852,12 +76299,12 @@ function parseStack(raw) {
     return null;
   const branches = [];
   for (const item of raw.branches) {
-    if (!isRecord8(item))
+    if (!isRecord9(item))
       return null;
     const branch = str3(item.branch);
     if (!branch)
       return null;
-    const merged = isRecord8(item.merged) ? {
+    const merged = isRecord9(item.merged) ? {
       pr: typeof item.merged.pr === "number" ? item.merged.pr : null,
       mergeSha: str3(item.merged.mergeSha),
       at: str3(item.merged.at) ?? ""
@@ -75870,7 +76317,7 @@ function parseStack(raw) {
       lastParentHead: str3(item.lastParentHead),
       patchId: str3(item.patchId),
       merged,
-      ...isRecord8(item.pendingRestack) && str3(item.pendingRestack.from) && str3(item.pendingRestack.tip) && str3(item.pendingRestack.onto) ? {
+      ...isRecord9(item.pendingRestack) && str3(item.pendingRestack.from) && str3(item.pendingRestack.tip) && str3(item.pendingRestack.onto) ? {
         pendingRestack: {
           from: str3(item.pendingRestack.from),
           tip: str3(item.pendingRestack.tip),
@@ -75999,13 +76446,13 @@ function takeLock(lock) {
     pid: process.pid,
     processStart: processStartOf(process.pid),
     host: localLockHost(),
-    nonce: randomBytes3(8).toString("hex")
+    nonce: randomBytes4(8).toString("hex")
   };
   fs22.writeFileSync(path44.join(lock, OWNER), JSON.stringify(owner));
   return owner;
 }
 function reapLock(lock, observed) {
-  const tomb = `${lock}.reap-${randomBytes3(6).toString("hex")}`;
+  const tomb = `${lock}.reap-${randomBytes4(6).toString("hex")}`;
   try {
     fs22.renameSync(lock, tomb);
   } catch {
@@ -76026,7 +76473,7 @@ function releaseLock(lock, owner) {
   const { raw } = readOwner(lock);
   if (raw !== JSON.stringify(owner))
     return;
-  const tomb = `${lock}.release-${randomBytes3(6).toString("hex")}`;
+  const tomb = `${lock}.release-${randomBytes4(6).toString("hex")}`;
   try {
     fs22.renameSync(lock, tomb);
     fs22.rmSync(tomb, { recursive: true, force: true });
@@ -76256,7 +76703,7 @@ function commitKeys(cwd, range) {
   const patches = new Map;
   const diff = gitRun3(cwd, ["log", "--no-merges", "-p", "--format=commit %H", range]);
   if (diff.ok && diff.stdout.trim()) {
-    const ids = spawnSync20("git", ["patch-id", "--stable"], {
+    const ids = spawnSync21("git", ["patch-id", "--stable"], {
       cwd,
       input: diff.stdout,
       encoding: "utf8",
@@ -76349,7 +76796,7 @@ function stackStatus(ctx, stack) {
   const mismatch = repoMismatch(ctx, stack);
   if (mismatch)
     return mismatch;
-  const ledger = readLedger(ctx.cwd);
+  const ledger = readLedger(ctx.cwd, { integrity: true });
   if (!ledger.ok)
     return stackFail(ledger.code, ledger.error, ledger.unblock);
   const remote = remoteFor(ctx.cwd, ctx.resolved, stack.trunk);
@@ -76773,7 +77220,7 @@ async function landStack(ctx, stack, options) {
     absorb(synced.data);
   }
   const ledgerRows = () => {
-    const ledger = readLedger(ctx.cwd);
+    const ledger = readLedger(ctx.cwd, { integrity: true });
     return ledger.ok ? ledger.value.rows : [];
   };
   const simulated = new Set;
@@ -76880,7 +77327,7 @@ var STACK_VERSION = 1, stackFail = (code, error, unblock, data) => ({
   ...unblock ? { unblock } : {},
   ...data ? { data } : {}
 }), fromForge = (result) => stackFail(result.code, result.error, result.unblock), stackDeps, gitRun3 = (cwd, args, timeoutMs = GIT_TIMEOUTS.local) => {
-  const run = spawnSync20("git", args, {
+  const run = spawnSync21("git", args, {
     cwd,
     encoding: "utf8",
     timeout: timeoutMs,
@@ -76920,7 +77367,7 @@ ${run.stdout}`.split(`
       return false;
   }
   return true;
-}, isRecord8 = (value) => typeof value === "object" && value !== null && !Array.isArray(value), str3 = (value) => typeof value === "string" && value ? value : null, LOCK_WAIT_MS3 = 2000, HEARTBEAT_MS = 20000, HEARTBEAT_STALE_MS, OWNERLESS_STALE_MS = 30000, OWNER = "owner", readOwner = (lock) => {
+}, isRecord9 = (value) => typeof value === "object" && value !== null && !Array.isArray(value), str3 = (value) => typeof value === "string" && value ? value : null, LOCK_WAIT_MS3 = 2000, HEARTBEAT_MS = 20000, HEARTBEAT_STALE_MS, OWNERLESS_STALE_MS = 30000, OWNER = "owner", readOwner = (lock) => {
   let raw = null;
   try {
     raw = fs22.readFileSync(path44.join(lock, OWNER), "utf8");
@@ -76961,7 +77408,7 @@ var init_stack = __esm(() => {
 });
 
 // packages/workit-core/src/forge/pr-edit.ts
-import { spawnSync as spawnSync21 } from "node:child_process";
+import { spawnSync as spawnSync22 } from "node:child_process";
 function openPr(cwd, resolved, pr) {
   const grant = requireGrant(cwd, "pr");
   if (!grant.allowed)
@@ -77126,7 +77573,7 @@ function replyToThread(cwd, resolved, input) {
   });
 }
 var label = (resolved, number) => `${resolved.forge.kind === "github" ? "PR #" : "MR !"}${number}`, git6 = (cwd, args) => {
-  const run = spawnSync21("git", args, {
+  const run = spawnSync22("git", args, {
     cwd,
     encoding: "utf8",
     timeout: GIT_TIMEOUTS.local,
@@ -77146,7 +77593,7 @@ var init_pr_edit = __esm(() => {
 });
 
 // packages/workit-core/src/forge/exec.ts
-import { spawnSync as spawnSync22 } from "node:child_process";
+import { spawnSync as spawnSync23 } from "node:child_process";
 import fs23 from "node:fs";
 import path45 from "node:path";
 function findExecutable(bin, env) {
@@ -77181,7 +77628,7 @@ function systemRunner(kind, apiHost, env = process.env) {
     if (!exe)
       return { status: null, stdout: "", stderr: "", timedOut: false, missing: true };
     const token = options.token ? kind === "github" ? { GH_TOKEN: options.token, GH_ENTERPRISE_TOKEN: options.token } : { GITLAB_TOKEN: options.token } : {};
-    const result = spawnSync22(exe, [...args], {
+    const result = spawnSync23(exe, [...args], {
       encoding: "utf8",
       env: { ...childEnv, ...token },
       maxBuffer: MAX_BUFFER2,
@@ -77678,6 +78125,24 @@ function createGitHubForge(options) {
       if (node?.pullRequest?.number !== number)
         return success2(null);
       return success2(node.isResolved ? "resolved" : "open");
+    },
+    findRelease(tag) {
+      const found = rest(`repos/${repo}/releases/tags/${encodeRef(tag)}`, `release ${tag}`);
+      if (!found.ok)
+        return found.code === "not_found" ? success2(null) : found;
+      return success2({
+        tag: found.data.tag_name ?? tag,
+        url: safeUrl(found.data.html_url ?? null)
+      });
+    },
+    createRelease(input) {
+      const created = apiWrite(runner, "gh", apiHost, ["api", "-X", "POST", `repos/${repo}/releases`, "--input", "-"], `release ${input.tag}`, undefined, JSON.stringify({ tag_name: input.tag, name: input.name, body: input.body }));
+      if (!created.ok)
+        return created;
+      return success2({
+        tag: created.data.tag_name ?? input.tag,
+        url: safeUrl(created.data.html_url ?? null)
+      });
     }
   };
 }
@@ -78063,6 +78528,24 @@ ${squash.body}` : squash.subject
       if (!notes.some((note) => note.resolvable === true))
         return success2(null);
       return success2(notes.some((note) => note.resolvable === true && note.resolved !== true) ? "open" : "resolved");
+    },
+    findRelease(tag) {
+      const found = apiJson(runner, "glab", apiHost, api(`${project}/releases/${encodeURIComponent(tag)}`), `release ${tag}`);
+      if (!found.ok)
+        return found.code === "not_found" ? success2(null) : found;
+      return success2({
+        tag: found.data.tag_name ?? tag,
+        url: safeUrl2(found.data["_links"]?.self ?? null)
+      });
+    },
+    createRelease(input) {
+      const created = apiWrite(runner, "glab", apiHost, ["api", "-X", "POST", `${project}/releases`, "--input", "-"], `release ${input.tag}`, undefined, JSON.stringify({ tag_name: input.tag, name: input.name, description: input.body }));
+      if (!created.ok)
+        return created;
+      return success2({
+        tag: created.data.tag_name ?? input.tag,
+        url: safeUrl2(created.data["_links"]?.self ?? null)
+      });
     }
   };
 }
@@ -78145,6 +78628,14 @@ function resolveCredential(workspace, derived, run, scope) {
     const explicit = typeof workspaceHost === "string" && workspaceHost.trim().toLowerCase().replace(/^https?:\/\//u, "").replace(/\/.*$/u, "") === apiHost;
     if (derived.via === "host_name" && !explicit)
       return failure3("blocked", `token_host_unverified: push host ${derived.host} only looks like ${kind}; workspace ${workspace?.name ?? "?"} vcs.tokenFile is not sent to it`, `if ${apiHost} is your ${kind} server, set ${kind}.host in ~/.config/workit/vcs.json (or vcs.host for the workspace); otherwise fix the push remote`);
+    if (process.platform !== "win32") {
+      let mode = 0;
+      try {
+        mode = fs24.statSync(tokenFile.trim()).mode;
+      } catch {}
+      if ((mode & 63) !== 0)
+        return failure3("blocked", `workspace ${workspace?.name ?? "?"} vcs.tokenFile is readable by group or other (mode ${(mode & 511).toString(8).padStart(4, "0")})`, `chmod 600 ${tokenFile.trim()}`);
+    }
     let token = "";
     try {
       token = fs24.readFileSync(tokenFile.trim(), "utf8").trim();
@@ -78568,17 +79059,20 @@ async function status(argv, io) {
   });
 }
 function verdictBlock(cwd, branch, doc) {
-  const ledger = readLedger(cwd);
+  const ledger = readLedger(cwd, { integrity: true });
   if (!ledger.ok)
     return null;
   const check = checkVerdicts(cwd, branch, ledger.value.rows);
   let landed = null;
   if (doc.state === "merged") {
-    const row = ledger.value.rows.findLast((candidate) => candidate.type === "pr.merged" && candidate.observer === "workit_cli" && candidate.pr === doc.number && candidate.base === doc.base);
+    const mine = (type) => ledger.value.rows.findLast((candidate) => candidate.type === type && candidate.observer === "workit_cli" && candidate.integrity !== "unverified" && candidate.pr === doc.number && candidate.base === doc.base);
+    const merged = mine("pr.merged");
+    const row = merged ?? mine("pr.merge.intent");
     landed = row ? {
       head: typeof row.head === "string" ? row.head : null,
       verdictId: typeof row.verdictId === "string" ? row.verdictId : null,
-      unverified: row.unverified !== undefined && row.unverified !== null
+      unverified: row.unverified !== undefined && row.unverified !== null,
+      ...merged ? {} : { intentOnly: true }
     } : "untracked";
   }
   return {
@@ -78749,7 +79243,7 @@ async function merge3(argv, io) {
   if (!result.ok)
     return emit(io, fail(result.code, result.error, {
       unblock: result.unblock,
-      data: "refusal" in result && result.refusal ? result.refusal : {}
+      data: "refusal" in result && result.refusal ? result.refusal : ("recorded" in result) && result.recorded ? { recorded: result.recorded } : {}
     }));
   return emit(io, ok(result.data), (data) => [
     `merged ${connected.data.forge.kind === "github" ? "PR #" : "MR !"}${data.number} (${data.method}) at head ${data.head.slice(0, 12)}${data.mergeSha ? ` -> ${data.mergeSha.slice(0, 12)}` : ""}`,
@@ -78758,7 +79252,8 @@ async function merge3(argv, io) {
       `merge back: ${data.base} is the ${data.mergeBackTrack} production branch; bring it into ${data.mergeBack.join(", ")}`
     ] : [],
     ...data.deletedBranch === true ? [`deleted ${data.branch}`] : typeof data.deletedBranch === "object" ? [`branch not deleted: ${data.deletedBranch.error}`] : [],
-    ..."error" in data.recorded ? [`ledger: not recorded (${data.recorded.error})`] : []
+    ..."error" in data.recorded ? [`ledger: not recorded (${data.recorded.error})`] : [],
+    ..."error" in data.confirmed && !("error" in data.recorded) ? [`ledger: merge not confirmed in the ledger (${data.confirmed.error})`] : []
   ]);
 }
 async function ready(argv, io) {
@@ -78908,7 +79403,7 @@ async function run11(argv, io) {
     return reply(rest, io);
   return usage3(io, sub && !sub.startsWith("-") ? `unknown pr subcommand "${sub}"` : "missing pr subcommand", USAGE4);
 }
-var STATUS_USAGE = "workit pr status [--pr <n> | --branch <b>] [--log-lines 60] [--json]", CREATE_USAGE = "workit pr create [--base <b> | --track <t>] (--title <t> [--body <text> | --body-file <f|->] | --fill) [--label <l>]… [--reviewer <login>]… [--draft] [--json]", MERGE_USAGE = "workit pr merge [--pr <n>] [--method squash|merge|rebase] [--subject <s>] [--body <b> | --body-file <f|->] [--delete-branch] [--unverified --reason <why>] [--json]", READY_USAGE = "workit pr ready [--pr <n>] [--undo] [--json]", EDIT_USAGE = "workit pr edit [--pr <n>] [--title <t>] [--body-file <f|->] [--add-label <l>]… [--remove-label <l>]… [--add-reviewer <login>]… [--base <b>] [--json]", THREADS_USAGE = "workit pr threads [--pr <n>] [--json]", REPLY_USAGE = "workit pr reply [--pr <n>] --thread <id> [--body-file <f|->] [--resolve] [--json]", USAGE4 = "workit pr status|create|merge|ready|edit|threads|reply ... (workit help pr)", prLabel = (kind, number) => `${kind === "github" ? "PR #" : "MR !"}${number}`, mergedVerdictLine = (landed) => landed === "untracked" ? "merged outside workit (no merge record)" : landed.unverified ? `merged unverified at ${(landed.head ?? "?").slice(0, 12)} (recorded bypass)` : `merged with accepted verdict ${landed.verdictId ?? "?"} at ${(landed.head ?? "?").slice(0, 12)}`, METHODS2;
+var STATUS_USAGE = "workit pr status [--pr <n> | --branch <b>] [--log-lines 60] [--json]", CREATE_USAGE = "workit pr create [--base <b> | --track <t>] (--title <t> [--body <text> | --body-file <f|->] | --fill) [--label <l>]… [--reviewer <login>]… [--draft] [--json]", MERGE_USAGE = "workit pr merge [--pr <n>] [--method squash|merge|rebase] [--subject <s>] [--body <b> | --body-file <f|->] [--delete-branch] [--unverified --reason <why>] [--json]", READY_USAGE = "workit pr ready [--pr <n>] [--undo] [--json]", EDIT_USAGE = "workit pr edit [--pr <n>] [--title <t>] [--body-file <f|->] [--add-label <l>]… [--remove-label <l>]… [--add-reviewer <login>]… [--base <b>] [--json]", THREADS_USAGE = "workit pr threads [--pr <n>] [--json]", REPLY_USAGE = "workit pr reply [--pr <n>] --thread <id> [--body-file <f|->] [--resolve] [--json]", USAGE4 = "workit pr status|create|merge|ready|edit|threads|reply ... (workit help pr)", prLabel = (kind, number) => `${kind === "github" ? "PR #" : "MR !"}${number}`, mergedVerdictLine = (landed) => landed === "untracked" ? "merged outside workit (no merge record)" : landed.unverified ? `merged unverified at ${(landed.head ?? "?").slice(0, 12)} (recorded bypass)` : `merged with accepted verdict ${landed.verdictId ?? "?"} at ${(landed.head ?? "?").slice(0, 12)}${landed.intentOnly ? " (merge intent recorded; the merge call itself failed)" : ""}`, METHODS2;
 var init_pr = __esm(() => {
   init_pr_body();
   init_pr_edit();
@@ -79433,7 +79928,7 @@ var init_git2 = __esm(() => {
 });
 
 // packages/workit-core/src/forge/verify.ts
-import { spawnSync as spawnSync23 } from "node:child_process";
+import { spawnSync as spawnSync24 } from "node:child_process";
 function finish(cwd, report, actor) {
   const delivered = report.observations.length > 0 && report.observations.every((entry) => entry.ok);
   const out = { ...report, delivered };
@@ -79646,7 +80141,7 @@ var NPM_NAME, SEMVER2, SAFE_ARG, systemNpm = (args) => {
   };
   const found = process.platform === "win32" ? findExecutable("npm.cmd", process.env) : null;
   const npmCmd = found && !/["%!^]/u.test(found) ? `"${found}"` : "npm.cmd";
-  const result = process.platform === "win32" ? spawnSync23(`${npmCmd} ${args.join(" ")}`, { ...options, shell: true }) : spawnSync23("npm", [...args], options);
+  const result = process.platform === "win32" ? spawnSync24(`${npmCmd} ${args.join(" ")}`, { ...options, shell: true }) : spawnSync24("npm", [...args], options);
   return { status: result.status, stdout: result.stdout ?? "", stderr: result.stderr ?? "" };
 }, short3 = (sha) => sha ? sha.slice(0, 12) : "(absent)", npmView = (stdout) => {
   try {
@@ -79668,12 +80163,700 @@ var init_verify = __esm(() => {
   SAFE_ARG = /^[0-9A-Za-z@/._~+-]+$/u;
 });
 
+// packages/workit-core/src/git/release.ts
+function lineFor(cwd, track) {
+  const lines = releaseLinesOf(cwd);
+  let name = track;
+  if (name === null && lines.length > 1) {
+    const resolved = vcsConfig("resolve", cwd);
+    if (resolved.ok === false)
+      return failure3("blocked", String(resolved.error));
+    if (resolved.releaseTrack?.blocking)
+      return failure3("blocked", String(resolved.releaseTrack.blocking), "pass --track <name>");
+    name = resolved.releaseTrack?.track?.name ?? null;
+  }
+  const line = lines.find((entry) => entry.track === name);
+  if (!line)
+    return failure3("invalid_input", `no release track ${JSON.stringify(name)} (configured: ${lines.map((entry) => entry.track).filter(Boolean).join(", ") || "none"})`);
+  return success2(line);
+}
+function releaseStart(cwd, input) {
+  const version = input.version.trim();
+  if (!validVersion(version))
+    return failure3("invalid_input", `${JSON.stringify(version)} is not a version (e.g. 1.4.0)`);
+  const kind = input.hotfix ? "hotfix" : "release";
+  const lineResult = lineFor(cwd, input.track ?? null);
+  if (!lineResult.ok)
+    return lineResult;
+  const line = lineResult.data;
+  const template = templateOf(line, kind);
+  const existing = git5(cwd, ["for-each-ref", "--format=%(refname:short)", "refs/heads"]).stdout.split(`
+`).filter((name) => name && versionIn(template, name) !== null);
+  if (existing.length)
+    return failure3("blocked", `release_exists: ${existing[0]} is still open; git-flow finishes one ${kind} before starting the next`, `workit release finish  # on ${existing[0]}`);
+  const tag = `${line.tagPrefix}${version}`;
+  if (resolveRef(cwd, `refs/tags/${tag}`))
+    return failure3("blocked", `tag_exists: ${tag} already exists`, "start the next version instead");
+  const base = kind === "hotfix" ? line.production : line.integration;
+  const remote = pushRemoteName(cwd, base);
+  if (remote) {
+    fetchRefs(cwd, remote, [`+refs/heads/${base}:refs/remotes/${remote}/${base}`]);
+    const local = resolveRef(cwd, `refs/heads/${base}`);
+    const tracked = resolveRef(cwd, `refs/remotes/${remote}/${base}`);
+    if (local && tracked && local !== tracked && !git5(cwd, ["merge-base", "--is-ancestor", local, tracked]).ok)
+      return failure3("blocked", `base_unpushed: local ${base} has commits ${remote}/${base} lacks; the ${kind} would start without them`, `land them on ${remote}/${base} first, or: git switch ${base} && git reset --keep ${remote}/${base}`);
+  }
+  const branched = gitBranch(cwd, {
+    name: branchFor(line, kind, version),
+    base,
+    ...line.track ? { track: line.track } : {}
+  });
+  if (!branched.ok)
+    return branched;
+  record2(cwd, input.actor, {
+    type: "release.started",
+    version,
+    kind,
+    branch: branched.data.branch,
+    head: branched.data.baseSha,
+    base,
+    track: line.track,
+    tag
+  });
+  return success2({
+    version,
+    kind,
+    branch: branched.data.branch,
+    base,
+    baseSha: branched.data.baseSha,
+    track: line.track,
+    tag,
+    notes: branched.data.notes
+  });
+}
+function locate(cwd, version, track) {
+  const lines = releaseLinesOf(cwd).filter((line) => track === null || line.track === track);
+  if (!lines.length)
+    return failure3("invalid_input", `no release track ${JSON.stringify(track)}`);
+  const rows = releaseRows(cwd);
+  const started = rows.filter((row) => row.type === "release.started");
+  const finished = new Set(rows.filter((row) => row.type === "release.finished").map((row) => String(row.branch)));
+  const startedRow = (branch) => started.findLast((row) => row.branch === branch && !finished.has(branch));
+  const lineOf = (branch, candidates) => {
+    const row = startedRow(branch);
+    const byRow = row ? candidates.find((line) => line.track === (row.track ?? null)) : undefined;
+    if (byRow)
+      return byRow;
+    const resolved = vcsConfig("resolve", cwd, { branch });
+    const name = resolved.ok === false ? null : resolved.releaseTrack?.track?.name ?? null;
+    return candidates.find((line) => line.track === name) ?? candidates[0];
+  };
+  const match = (branch) => {
+    const hits = [];
+    for (const line of lines)
+      for (const kind of KINDS) {
+        const found = versionIn(templateOf(line, kind), branch);
+        if (found)
+          hits.push({ line, kind, version: found });
+      }
+    if (!hits.length)
+      return null;
+    const line = lineOf(branch, hits.map((hit) => hit.line));
+    const hit = hits.find((entry) => entry.line === line) ?? hits[0];
+    return { ...hit, branch };
+  };
+  if (version !== null) {
+    if (!validVersion(version))
+      return failure3("invalid_input", `${JSON.stringify(version)} is not a version`);
+    for (const line of lines)
+      for (const kind of KINDS) {
+        const branch = branchFor(line, kind, version);
+        if (resolveRef(cwd, `refs/heads/${branch}`) || startedRow(branch)) {
+          const located = match(branch);
+          if (located)
+            return success2(located);
+        }
+      }
+    return failure3("not_found", `no release or hotfix branch for ${version} here, and none this ledger started`);
+  }
+  const current = currentBranch(cwd);
+  const here = current ? match(current) : null;
+  if (here)
+    return success2(here);
+  const open = started.findLast((row) => !finished.has(String(row.branch)));
+  if (open) {
+    const located = match(String(open.branch));
+    if (located)
+      return success2(located);
+  }
+  const branches = git5(cwd, ["for-each-ref", "--format=%(refname:short)", "refs/heads"]).stdout.split(`
+`).map((name) => name ? match(name) : null).filter((entry) => entry !== null);
+  if (branches.length === 1)
+    return success2(branches[0]);
+  return failure3(branches.length ? "invalid_input" : "not_found", branches.length ? `several releases are open (${branches.map((entry) => entry.branch).join(", ")}); name one` : "no release or hotfix branch to finish", branches.length ? `workit release finish ${branches[0].version}` : "workit release start <version>");
+}
+function changelogSection(cwd, ref, version) {
+  const shown = git5(cwd, ["show", `${ref}:CHANGELOG.md`]);
+  if (!shown.ok)
+    return null;
+  const lines = shown.stdout.split(/\r?\n/u);
+  const escaped = version.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&");
+  const heading = new RegExp(`^(#{1,3})\\s+\\[?v?${escaped}\\]?(?:[\\s(]|$)`, "u");
+  const start = lines.findIndex((line) => heading.test(line));
+  if (start < 0)
+    return null;
+  const level = heading.exec(lines[start])?.[1].length ?? 2;
+  let end = lines.length;
+  for (let index = start + 1;index < lines.length; index += 1) {
+    const hashes = /^(#+)\s/u.exec(lines[index])?.[1].length;
+    if (hashes !== undefined && hashes <= level) {
+      end = index;
+      break;
+    }
+  }
+  const body = lines.slice(start + 1, end).join(`
+`).trim();
+  return body || null;
+}
+function planReleaseFinish(cwd, input) {
+  const progress = operationInProgress(cwd);
+  if (progress)
+    return inProgressFailure(progress.operation, "finish the release");
+  const located = locate(cwd, input.version?.trim() || null, input.track ?? null);
+  if (!located.ok)
+    return located;
+  const { line, kind, version, branch } = located.data;
+  const notes = [];
+  const dirty = git5(cwd, ["status", "--porcelain", "--untracked-files=no"]).stdout.trim();
+  if (dirty)
+    return failure3("blocked", "dirty_worktree: tracked files have uncommitted changes; a release finish merges on a clean tree", "workit git commit -m '<msg>' -- <paths>  # on the release branch, or stash them");
+  const tag = `${line.tagPrefix}${version}`;
+  const rows = releaseRows(cwd).filter((row) => row.branch === branch || row.release === branch);
+  const recordedOpen = rows.findLast((row) => row.type === "release.hotfix_target");
+  const openRelease = kind !== "hotfix" ? null : typeof recordedOpen?.target === "string" ? recordedOpen.target : git5(cwd, ["for-each-ref", "--format=%(refname:short)", "refs/heads"]).stdout.split(`
+`).find((name) => name && versionIn(templateOf(line, "release"), name) !== null) ?? null;
+  const mergeBack = openRelease ? [...new Set(line.mergeBack.map((name) => name === line.integration ? openRelease : name))] : line.mergeBack;
+  if (openRelease)
+    notes.push(`${openRelease} is open: the hotfix merges back into it instead of ${line.integration}`);
+  const remote = pushRemoteName(cwd, line.production);
+  if (remote) {
+    const wanted = [line.production, ...mergeBack, branch];
+    for (const name of wanted)
+      fetchRefs(cwd, remote, [`+refs/heads/${name}:refs/remotes/${remote}/${name}`]);
+  }
+  const branchTip = resolveRef(cwd, `refs/heads/${branch}`);
+  const remoteBranch = remote ? resolveRef(cwd, `refs/remotes/${remote}/${branch}`) : null;
+  const mergedRow = rows.findLast((row) => row.type === "release.merged");
+  const deletedRow = rows.findLast((row) => row.type === "release.branch_deleted");
+  const recordedTip = [mergedRow?.releaseTip, deletedRow?.head].find((value) => typeof value === "string");
+  const releaseTip = branchTip ?? recordedTip ?? null;
+  if (!releaseTip)
+    return failure3("not_found", `${branch} is gone and this ledger did not record its merge; nothing to resume`);
+  for (const name of [line.production, ...mergeBack]) {
+    const local = resolveRef(cwd, `refs/heads/${name}`);
+    const tracked = remote ? resolveRef(cwd, `refs/remotes/${remote}/${name}`) : null;
+    if (!local && tracked) {
+      const created = git5(cwd, ["branch", "--no-track", name, tracked]);
+      if (!created.ok)
+        return failure3("failed", `could not create local ${name}: ${gitError(created)}`);
+      notes.push(`created local ${name} from ${remote}/${name}`);
+      continue;
+    }
+    if (!local)
+      return failure3("not_found", `${name} exists neither locally nor on ${remote ?? "a remote"}`);
+    if (!tracked || name === openRelease)
+      continue;
+    if (!isAncestor3(cwd, tracked, local))
+      return failure3("blocked", `branch_behind: local ${name} is behind or diverged from ${remote}/${name}; git-flow finishes only onto up-to-date branches`, `git switch ${name} && git merge --ff-only ${remote}/${name}  # then: workit release finish ${version}`);
+    const productionTracked = remote ? resolveRef(cwd, `refs/remotes/${remote}/${line.production}`) : null;
+    const foreign = git5(cwd, [
+      "rev-list",
+      local,
+      `^${tracked}`,
+      `^${releaseTip}`,
+      ...productionTracked ? [`^${productionTracked}`] : []
+    ]).stdout.split(`
+`).filter(Boolean).filter((sha) => !(git5(cwd, ["rev-parse", "-q", "--verify", `${sha}^2`]).ok && isAncestor3(cwd, releaseTip, sha)));
+    if (foreign.length)
+      return failure3("blocked", `branch_ahead: local ${name} has ${foreign.length} commit(s) ${remote}/${name} lacks that are not part of ${branch}; the finish push would publish them`, `land them through review first, or: git switch ${name} && git reset --keep ${remote}/${name}  # then: workit release finish ${version}`);
+  }
+  if (branchTip && remoteBranch && !isAncestor3(cwd, remoteBranch, branchTip))
+    return failure3("blocked", `release_behind: ${remote}/${branch} has commits local ${branch} lacks`, `git switch ${branch} && git merge --ff-only ${remote}/${branch}`);
+  const production = resolveRef(cwd, `refs/heads/${line.production}`);
+  const merged = isAncestor3(cwd, releaseTip, production);
+  const localTag = resolveRef(cwd, `refs/tags/${tag}`);
+  if (localTag && !(isAncestor3(cwd, localTag, production) && isAncestor3(cwd, releaseTip, localTag)))
+    return failure3("blocked", `tag_exists: ${tag} (${localTag.slice(0, 12)}) is not this release's merge on ${line.production}`, "a release tag never moves; finish under the next version");
+  if (remote) {
+    const remoteTag = remoteRefTip(cwd, remote, `refs/tags/${tag}`);
+    if (remoteTag.ok && remoteTag.sha && remoteTag.sha !== localTag)
+      return failure3("blocked", `tag_exists: ${remote} already has ${tag} at ${remoteTag.sha.slice(0, 12)}`, "a release tag never moves; finish under the next version");
+  }
+  const recordedMerge = typeof mergedRow?.merge === "string" ? mergedRow.merge : null;
+  const tagTarget = localTag ?? (merged ? recordedMerge ?? production : null);
+  const state = {
+    merged,
+    tagged: localTag !== null,
+    mergedBack: Object.fromEntries(mergeBack.map((name) => [
+      name,
+      localTag !== null && isAncestor3(cwd, localTag, resolveRef(cwd, `refs/heads/${name}`))
+    ])),
+    branchDeleted: branchTip === null
+  };
+  return success2({
+    version,
+    kind,
+    branch,
+    track: line.track,
+    tag,
+    production: line.production,
+    mergeBack,
+    pushBranches: [line.production, ...mergeBack.filter((name) => name !== openRelease)],
+    openRelease,
+    gitflow: line.gitflow,
+    remote,
+    releaseTip,
+    published: remoteBranch,
+    tagTarget,
+    mergeRecorded: mergedRow !== undefined,
+    state,
+    changelog: changelogSection(cwd, branchTip ?? production, version),
+    notes,
+    warnings: integrationPrWarning(cwd, line.production)
+  });
+}
+function integrationPrWarning(cwd, production) {
+  try {
+    const selected = resolveRuntimeWorkspacePolicy(cwd, "branch", process.env.WORKFLOW_PROFILE?.trim() || undefined).policy;
+    return selected?.integration === "pr" ? [
+      `the workspace integration mode is pr: the remote may require pull requests on ${production}, which would reject the finish push`
+    ] : [];
+  } catch {
+    return [];
+  }
+}
+function finishLocally(cwd, plan, actor) {
+  const ran = [];
+  const base = { version: plan.version, release: plan.branch, tag: plan.tag, track: plan.track };
+  let tagTarget = plan.tagTarget;
+  if (plan.openRelease && !releaseRows(cwd).some((row) => row.type === "release.hotfix_target" && row.release === plan.branch))
+    record2(cwd, actor, {
+      type: "release.hotfix_target",
+      ...base,
+      branch: plan.branch,
+      target: plan.openRelease
+    });
+  if (plan.state.merged && !plan.mergeRecorded && tagTarget)
+    record2(cwd, actor, {
+      type: "release.merged",
+      ...base,
+      branch: plan.production,
+      head: tagTarget,
+      merge: tagTarget,
+      releaseTip: plan.releaseTip,
+      observed: true
+    });
+  if (!plan.state.merged) {
+    const on = switchTo(cwd, plan.production);
+    if (!on.ok)
+      return on;
+    const merged = mergeNoFf(cwd, plan.branch, plan.production, plan.version);
+    if (!merged.ok)
+      return merged;
+    tagTarget = merged.data;
+    ran.push("merge");
+    record2(cwd, actor, {
+      type: "release.merged",
+      ...base,
+      branch: plan.production,
+      head: merged.data,
+      merge: merged.data,
+      releaseTip: plan.releaseTip
+    });
+  }
+  if (!tagTarget)
+    return failure3("failed", `cannot tell which ${plan.production} commit to tag`);
+  if (!plan.state.tagged) {
+    const message = plan.changelog ?? `Release ${plan.version}`;
+    const tagged = git5(cwd, [
+      "tag",
+      "-a",
+      "--cleanup=verbatim",
+      plan.tag,
+      "-m",
+      message,
+      tagTarget
+    ]);
+    if (!tagged.ok)
+      return failure3("failed", `git tag ${plan.tag} failed: ${gitError(tagged)}`);
+    ran.push("tag");
+    record2(cwd, actor, {
+      type: "release.tagged",
+      ...base,
+      branch: plan.production,
+      head: tagTarget
+    });
+  }
+  for (const name of plan.mergeBack) {
+    if (plan.state.mergedBack[name])
+      continue;
+    const on = switchTo(cwd, name);
+    if (!on.ok)
+      return on;
+    const merged = mergeNoFf(cwd, plan.tag, name, plan.version);
+    if (!merged.ok)
+      return merged;
+    ran.push(`merge-back ${name}`);
+    record2(cwd, actor, { type: "release.merged_back", ...base, branch: name, head: merged.data });
+  }
+  if (!plan.state.branchDeleted) {
+    if (currentBranch(cwd) === plan.branch) {
+      const on = switchTo(cwd, plan.mergeBack.at(-1) ?? plan.production);
+      if (!on.ok)
+        return on;
+    }
+    const deleted = git5(cwd, ["branch", "-d", plan.branch]);
+    if (!deleted.ok)
+      return failure3("failed", `git branch -d ${plan.branch} failed: ${gitError(deleted)}`, plan.published ? `workit release publish ${plan.version}  # its remote copy lacks commits; then: workit release finish ${plan.version}` : undefined);
+    ran.push("delete-branch");
+    record2(cwd, actor, {
+      type: "release.branch_deleted",
+      ...base,
+      branch: plan.branch,
+      head: plan.releaseTip
+    });
+  }
+  return success2({ ran, tagTarget });
+}
+function recordReleaseStep(cwd, actor, plan, row) {
+  record2(cwd, actor, {
+    version: plan.version,
+    release: plan.branch,
+    tag: plan.tag,
+    track: plan.track,
+    ...row
+  });
+}
+function releaseToPublish(cwd, version) {
+  const located = locate(cwd, version, null);
+  if (!located.ok)
+    return located;
+  if (!resolveRef(cwd, `refs/heads/${located.data.branch}`))
+    return failure3("not_found", `${located.data.branch} is not a local branch`);
+  return located;
+}
+var VERSION, PLACEHOLDER3, validVersion = (version) => VERSION.test(version) && !version.includes("..") && !version.endsWith(".lock"), templateOf = (line, kind) => {
+  const template = line.naming[kind];
+  if (!template)
+    return `${kind}/{version}`;
+  return /\{[^}]*\}/u.test(template) ? template : `${template.replace(/\/?\*?$/u, "")}/{version}`;
+}, branchFor = (line, kind, version) => trackBranchName({ naming: line.naming }, kind, version) ?? `${kind}/${version}`, versionIn = (template, branch) => {
+  const pattern = template.split(PLACEHOLDER3).map((part) => part.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&")).join("(.+)");
+  const match = new RegExp(`^${pattern}$`, "u").exec(branch);
+  return match?.[1] && validVersion(match[1]) ? match[1] : null;
+}, releaseRows = (cwd) => {
+  const ledger = readLedger(cwd);
+  if (!ledger.ok)
+    return [];
+  return ledger.value.rows.filter((row) => row.type.startsWith("release."));
+}, record2 = (cwd, actor, row) => {
+  appendObserved(cwd, { ...row, actor });
+}, KINDS, isAncestor3 = (cwd, ancestor, descendant) => git5(cwd, ["merge-base", "--is-ancestor", ancestor, descendant]).ok, switchTo = (cwd, branch) => {
+  if (currentBranch(cwd) === branch)
+    return success2(undefined);
+  const switched = git5(cwd, ["switch", "-q", branch]);
+  return switched.ok ? success2(undefined) : failure3("failed", `git switch ${branch} failed: ${gitError(switched)}`);
+}, mergeNoFf = (cwd, what, into, version) => {
+  const merged = git5(cwd, ["merge", "--no-ff", "--no-edit", what], { timeoutMs: 10 * 60000 });
+  if (!merged.ok) {
+    const conflicted = git5(cwd, ["rev-parse", "-q", "--verify", "MERGE_HEAD"]).ok;
+    return failure3("failed", conflicted ? `merge_conflict: merging ${what} into ${into} conflicts` : `git merge ${what} into ${into} failed: ${gitError(merged)}`, conflicted ? `resolve the conflicts, git add <files>, git merge --continue, then: workit release finish ${version}` : undefined);
+  }
+  return success2(git5(cwd, ["rev-parse", "HEAD"]).stdout.trim());
+}, switchToRelease = (cwd, plan) => switchTo(cwd, plan.branch);
+var init_release = __esm(() => {
+  init_ledger();
+  init_vcs_config();
+  init_release_tracks();
+  init_workspaces();
+  init_ops();
+  init_rev();
+  VERSION = /^[0-9A-Za-z][0-9A-Za-z._+-]{0,99}$/u;
+  PLACEHOLDER3 = /\{[^}]*\}/gu;
+  KINDS = ["release", "hotfix"];
+});
+
+// packages/workit-cli/src/verbs/release.ts
+var exports_release = {};
+__export(exports_release, {
+  run: () => run14
+});
+async function subVerb(load, argv, io) {
+  let out = "";
+  let err = "";
+  const verb = await load();
+  await verb.run(argv, {
+    ...io,
+    json: true,
+    stdout: (text) => void (out += text),
+    stderr: (text) => void (err += text)
+  });
+  try {
+    return JSON.parse(out);
+  } catch {
+    return fail("failed", (out + err).trim() || `${argv.join(" ")} printed nothing`);
+  }
+}
+async function start(argv, io) {
+  const flags = parseFlags(argv, { hotfix: "boolean", track: "value" });
+  if (typeof flags === "string")
+    return usage3(io, flags, START_USAGE);
+  if (flags.positionals.length !== 1)
+    return usage3(io, flags.positionals.length ? "pass one version" : "missing <version>", START_USAGE);
+  const result = releaseStart(io.cwd, {
+    version: flags.positionals[0],
+    hotfix: flags.booleans.has("hotfix"),
+    track: flags.values.track ?? null,
+    actor: actorFromEnv(io.env)
+  });
+  if (!result.ok)
+    return forgeFail(io, result);
+  return emit(io, ok(result.data), (data) => [
+    `started ${data.branch} from ${data.base} (${short4(data.baseSha)}), local only; it will be tagged ${data.tag}`,
+    `next: commit the version bump, changelog and docs on ${data.branch} (workit git commit), then: workit release finish`,
+    ...data.notes.map((note) => `note: ${note}`)
+  ]);
+}
+async function releasePr(io, plan, dryRun) {
+  const title = `chore(release): ${plan.version}`;
+  if (dryRun)
+    return emit(io, ok({
+      ...plan,
+      steps: [`push ${plan.branch}`, `open a PR ${plan.branch} -> ${plan.production}: ${title}`]
+    }), () => [
+      `would push ${plan.branch} and open a release PR into ${plan.production} (not git-flow: the trunk moves only through review)`
+    ]);
+  const switched = switchToRelease(io.cwd, plan);
+  if (!switched.ok)
+    return forgeFail(io, switched);
+  const pushed = await subVerb(() => Promise.resolve().then(() => (init_git2(), exports_git)), ["push", "--set-upstream"], io);
+  if (!pushed.ok)
+    return emit(io, pushed);
+  const pr = await subVerb(() => Promise.resolve().then(() => (init_pr(), exports_pr)), [
+    "create",
+    "--base",
+    plan.production,
+    "--title",
+    title,
+    `--body=${plan.changelog ?? `Release ${plan.version}`}`
+  ], io);
+  if (!pr.ok)
+    return emit(io, pr);
+  recordReleaseStep(io.cwd, actorFromEnv(io.env), plan, {
+    type: "release.pr_opened",
+    branch: plan.branch,
+    pr: pr.data.number ?? null
+  });
+  return emit(io, ok({ ...plan, pr: pr.data }), () => [
+    `opened the release PR ${String(pr.data.url ?? "")} into ${plan.production}`,
+    `next: once it merges, tag the merged commit ${plan.tag} and: workit git push --release ${plan.tag}`
+  ]);
+}
+async function finish2(argv, io) {
+  const flags = parseFlags(argv, { track: "value", "dry-run": "boolean" });
+  if (typeof flags === "string")
+    return usage3(io, flags, FINISH_USAGE);
+  if (flags.positionals.length > 1)
+    return usage3(io, `unexpected argument ${flags.positionals[1]}`, FINISH_USAGE);
+  const dryRun = flags.booleans.has("dry-run");
+  const planned = planReleaseFinish(io.cwd, {
+    version: flags.positionals[0] ?? null,
+    track: flags.values.track ?? null
+  });
+  if (!planned.ok)
+    return forgeFail(io, planned);
+  const plan = planned.data;
+  if (!plan.gitflow) {
+    if (!dryRun && plan.state.branchDeleted)
+      return emit(io, fail("not_found", `${plan.branch} is gone; nothing to open a PR from`));
+    return releasePr(io, plan, dryRun);
+  }
+  const actor = actorFromEnv(io.env);
+  const local = isLocalRemote(io.cwd, plan.remote);
+  const release = requireGrant(io.cwd, "release");
+  const push = requireGrant(io.cwd, "push", { forge: !local });
+  const steps = stepsOf(plan);
+  for (const warning of plan.warnings)
+    io.stderr(`warning: ${warning}
+`);
+  const warned = (envelope) => plan.warnings.length ? { ...envelope, warnings: plan.warnings } : envelope;
+  if (dryRun) {
+    const missing = [release, push].find((grant) => !grant.allowed);
+    const data = { ...plan, steps, grants: { release: release.allowed, push: push.allowed } };
+    if (missing && !missing.allowed)
+      return emit(io, warned(fail("blocked", missing.error, { unblock: missing.unblock, data })));
+    return emit(io, warned(ok(data)), () => [
+      `finish ${plan.branch} -> ${plan.production} as ${plan.tag}:`,
+      ...steps.map((entry) => `  ${entry.done ? "done" : "todo"}  ${entry.step}`)
+    ]);
+  }
+  if (!release.allowed)
+    return blocked(io, release);
+  if (!push.allowed)
+    return blocked(io, push);
+  const resume = `workit release finish ${plan.version}${plan.track ? ` --track ${plan.track}` : ""}`;
+  const merged = finishLocally(io.cwd, plan, actor);
+  if (!merged.ok)
+    return forgeFail(io, merged, { step: "merge", resume });
+  const notes = [...plan.notes];
+  const pushed = await subVerb(() => Promise.resolve().then(() => (init_git2(), exports_git)), ["push", ...[...plan.pushBranches, plan.tag].flatMap((ref) => ["--release", ref])], io);
+  if (!pushed.ok)
+    return emit(io, { ...pushed, data: { ...pushed.data, step: "push", resume } });
+  if (plan.published && plan.remote) {
+    const removed = deleteRemoteBranch(io.cwd, plan.remote, plan.branch, plan.published);
+    notes.push(removed.ok ? `deleted ${plan.remote}/${plan.branch}` : `kept ${plan.remote}/${plan.branch}: ${removed.error}`);
+    if (removed.ok)
+      recordReleaseStep(io.cwd, actor, plan, {
+        type: "release.remote_branch_deleted",
+        branch: plan.branch,
+        head: plan.published
+      });
+  }
+  let forgeRelease = null;
+  if (local)
+    notes.push(`${plan.remote ?? "the remote"} is a local path: no forge release`);
+  else {
+    const connected = connect(io);
+    if (!connected.ok)
+      return forgeFail(io, connected, { step: "forge-release", resume });
+    const forge = connected.data.forge;
+    const found = forge.findRelease(plan.tag);
+    if (!found.ok)
+      return forgeFail(io, found, { step: "forge-release", resume });
+    if (found.data)
+      forgeRelease = { url: found.data.url, created: false };
+    else {
+      const created = forge.createRelease({
+        tag: plan.tag,
+        name: plan.tag,
+        body: plan.changelog ?? `Release ${plan.version}`
+      });
+      if (!created.ok)
+        return forgeFail(io, created, { step: "forge-release", resume });
+      forgeRelease = { url: created.data.url, created: true };
+    }
+    recordReleaseStep(io.cwd, actor, plan, {
+      type: "release.forge_released",
+      branch: plan.production,
+      url: forgeRelease.url,
+      created: forgeRelease.created
+    });
+  }
+  const verified = verifyReleased(io.cwd, { tag: plan.tag, actor }, forgeDeps.npm);
+  if (!verified.ok)
+    return forgeFail(io, verified, { step: "verify", resume });
+  if (!verified.data.delivered)
+    return emit(io, fail("failed", `release_unverified: ${plan.tag} is not on ${plan.remote ?? "the remote"}`, {
+      data: { step: "verify", resume, report: verified.data },
+      unblock: resume
+    }));
+  recordReleaseStep(io.cwd, actor, plan, {
+    type: "release.finished",
+    branch: plan.branch,
+    head: merged.data.tagTarget
+  });
+  return emit(io, warned(ok({ ...plan, ran: merged.data.ran, push: pushed.data, forgeRelease, notes })), () => [
+    `finished ${plan.branch}: ${plan.production} and ${plan.mergeBack.join(", ")} merged, ${plan.tag} tagged on ${short4(merged.data.tagTarget)}`,
+    `pushed ${[...plan.pushBranches, plan.tag].join(", ")} to ${plan.remote ?? "the remote"}; remote tips verified`,
+    ...forgeRelease ? [
+      `forge release ${plan.tag}${forgeRelease.created ? " created" : " already there"}${forgeRelease.url ? `: ${forgeRelease.url}` : ""}`
+    ] : [],
+    ...notes.map((note) => `note: ${note}`)
+  ]);
+}
+async function publish(argv, io) {
+  const flags = parseFlags(argv, {});
+  if (typeof flags === "string")
+    return usage3(io, flags, PUBLISH_USAGE);
+  if (flags.positionals.length > 1)
+    return usage3(io, `unexpected argument ${flags.positionals[1]}`, PUBLISH_USAGE);
+  const located = releaseToPublish(io.cwd, flags.positionals[0] ?? null);
+  if (!located.ok)
+    return forgeFail(io, located);
+  const plan = pushPreflight(io.cwd, { branch: located.data.branch });
+  if (!plan.ok)
+    return forgeFail(io, plan);
+  const identity = plan.data.local ? null : pushIdentity(io, plan.data.branch);
+  if (identity && !identity.ok)
+    return forgeFail(io, identity);
+  const checked = identity?.data ?? null;
+  const grant = requireGrant(io.cwd, "push", { forge: checked?.forge != null });
+  if (!grant.allowed)
+    return blocked(io, grant);
+  const actor = actorFromEnv(io.env);
+  const result = executePush(io.cwd, plan.data, {
+    setUpstream: true,
+    actor,
+    ...checked ? { identity: { ...checked } } : {}
+  });
+  if (!result.ok)
+    return forgeFail(io, result);
+  appendObserved(io.cwd, {
+    type: "release.published",
+    actor,
+    version: located.data.version,
+    branch: located.data.branch,
+    head: result.data.sha
+  });
+  return emit(io, ok({ ...result.data, version: located.data.version }), (data) => [
+    `published ${data.branch} (${short4(data.sha)}) to ${data.remote}; remote tip verified`
+  ]);
+}
+async function run14(argv, io) {
+  const [sub, ...rest] = argv;
+  if (sub === "start")
+    return start(rest, io);
+  if (sub === "finish")
+    return finish2(rest, io);
+  if (sub === "publish")
+    return publish(rest, io);
+  return usage3(io, sub && !sub.startsWith("-") ? `unknown release subcommand "${sub}"` : "missing release subcommand", USAGE6);
+}
+var START_USAGE = "workit release start <version> [--hotfix] [--track <t>] [--json]", FINISH_USAGE = "workit release finish [<version>] [--track <t>] [--dry-run] [--json]", PUBLISH_USAGE = "workit release publish [<version>] [--json]", USAGE6 = "workit release start|finish|publish ... (workit help release)", short4 = (sha) => sha ? sha.slice(0, 12) : "(none)", blocked = (io, grant) => emit(io, fail("blocked", grant.error, { unblock: grant.unblock, data: { reason: grant.reason } })), isLocalRemote = (cwd, remote) => {
+  const url = remote ? pushUrl(cwd, remote) : null;
+  return !url || parseRemoteUrl(url)?.protocol === "file";
+}, stepsOf = (plan) => [
+  { step: `merge ${plan.branch} into ${plan.production} (--no-ff)`, done: plan.state.merged },
+  { step: `tag ${plan.tag} (annotated)`, done: plan.state.tagged },
+  ...plan.mergeBack.map((name) => ({
+    step: `merge ${plan.tag} into ${name} (--no-ff)`,
+    done: plan.state.mergedBack[name] === true
+  })),
+  { step: `delete local ${plan.branch}`, done: plan.state.branchDeleted },
+  {
+    step: `push ${[...plan.pushBranches, plan.tag].join(", ")} (atomic, fast-forward only)`,
+    done: false
+  },
+  { step: `forge release ${plan.tag}`, done: false },
+  { step: `verify ${plan.tag} on the remote`, done: false }
+];
+var init_release2 = __esm(() => {
+  init_autonomy();
+  init_verify();
+  init_ops();
+  init_release();
+  init_rev();
+  init_ledger();
+  init_output();
+  init_forge_common();
+});
+
 // packages/workit-cli/src/verbs/verify-delivery.ts
 var exports_verify_delivery = {};
 __export(exports_verify_delivery, {
-  run: () => run14
+  run: () => run15
 });
-async function run14(argv, io) {
+async function run15(argv, io) {
   const flags = parseFlags(argv, {
     expect: "value",
     branch: "value",
@@ -79683,31 +80866,31 @@ async function run14(argv, io) {
     package: "value"
   });
   if (typeof flags === "string")
-    return usage3(io, flags, USAGE6);
+    return usage3(io, flags, USAGE7);
   if (flags.positionals.length > 1)
-    return usage3(io, `unexpected argument ${flags.positionals[1]}`, USAGE6);
+    return usage3(io, `unexpected argument ${flags.positionals[1]}`, USAGE7);
   const named = flags.positionals[0];
   if (named !== undefined && !ENDPOINTS[named])
-    return usage3(io, `unknown endpoint "${named}"`, USAGE6);
+    return usage3(io, `unknown endpoint "${named}"`, USAGE7);
   if (flags.values.expect !== undefined && !ENDPOINTS[flags.values.expect])
-    return usage3(io, "--expect must be pushed, pr, merged or released", USAGE6);
+    return usage3(io, "--expect must be pushed, pr, merged or released", USAGE7);
   if (named && flags.values.expect && ENDPOINTS[named] !== ENDPOINTS[flags.values.expect])
-    return usage3(io, `${named} and --expect ${flags.values.expect} disagree`, USAGE6);
+    return usage3(io, `${named} and --expect ${flags.values.expect} disagree`, USAGE7);
   const expect = ENDPOINTS[named ?? ""] ?? ENDPOINTS[flags.values.expect ?? ""] ?? (flags.values.tag || flags.values.package ? "released" : flags.values.pr ? "pr" : "pushed");
   const pr = positiveInt(flags.values.pr, "--pr");
   if (typeof pr === "string")
-    return usage3(io, pr, USAGE6);
+    return usage3(io, pr, USAGE7);
   if (pr && flags.values.branch)
-    return usage3(io, "pass --pr or --branch, not both", USAGE6);
+    return usage3(io, "pass --pr or --branch, not both", USAGE7);
   const sha = flags.values.sha ?? null;
   if (sha !== null && !/^[0-9a-f]{7,64}$/u.test(sha))
-    return usage3(io, "--sha must be a commit sha (7-64 hex chars)", USAGE6);
+    return usage3(io, "--sha must be a commit sha (7-64 hex chars)", USAGE7);
   const actor = actorFromEnv(io.env);
   const branch = flags.values.branch ?? null;
   let result;
   if (expect === "pushed") {
     if (pr)
-      return usage3(io, "push is checked by --branch, not --pr", USAGE6);
+      return usage3(io, "push is checked by --branch, not --pr", USAGE7);
     result = verifyPushed(io.cwd, { branch, sha, actor });
   } else if (expect === "released") {
     result = verifyReleased(io.cwd, { tag: flags.values.tag ?? null, pkg: flags.values.package ?? null, sha, actor }, forgeDeps.npm);
@@ -79732,7 +80915,7 @@ async function run14(argv, io) {
     unblock: expect === "pushed" ? "workit git push" : expect === "pr" ? "workit git push && workit pr create --fill" : expect === "merged" ? "workit pr status  # then workit pr merge when READY and granted" : "check the release workflow; the tag/package is not published"
   }));
 }
-var USAGE6 = "workit verify-delivery [push|pr|merge|release] [--expect pushed|pr|merged|released] [--branch <b>] [--pr <n>] [--sha <sha>] [--tag <t>] [--package <name[@version]>] [--json]", ENDPOINTS, render2 = (report) => [
+var USAGE7 = "workit verify-delivery [push|pr|merge|release] [--expect pushed|pr|merged|released] [--branch <b>] [--pr <n>] [--sha <sha>] [--tag <t>] [--package <name[@version]>] [--json]", ENDPOINTS, render2 = (report) => [
   `${report.expect}: ${report.delivered ? "delivered" : "NOT delivered"}${report.branch ? ` (${report.branch}${report.sha ? ` @ ${report.sha.slice(0, 12)}` : ""})` : ""}${report.pr ? ` #${report.pr}` : ""}`,
   ...report.observations.map((entry) => `  ${entry.ok ? "ok" : "x "} ${entry.kind}: expected ${entry.expected ?? "-"}, observed ${entry.observed ?? "(none)"}${entry.note ? ` — ${entry.note}` : ""}`)
 ];
@@ -79755,7 +80938,7 @@ var init_verify_delivery = __esm(() => {
 // packages/workit-cli/src/verbs/stack.ts
 var exports_stack = {};
 __export(exports_stack, {
-  run: () => run15
+  run: () => run16
 });
 async function plan(argv, io) {
   const flags = parseFlags(argv, { name: "value", trunk: "value", track: "value" });
@@ -79929,7 +81112,7 @@ async function land(argv, io) {
     ...data.dryRun ? [
       data.wouldLand.length ? `would land: ${data.wouldLand.map((item) => `${label2(kind, item.pr)} (${item.branch})`).join(", ")}` : "would land nothing"
     ] : [
-      data.landed.length ? `landed: ${data.landed.map((item) => `${label2(kind, item.pr)} (${item.branch}) -> ${short4(item.mergeSha)}${item.unverified ? ` UNVERIFIED (ledger ${item.unverified})` : ""}`).join(", ")}` : "landed nothing"
+      data.landed.length ? `landed: ${data.landed.map((item) => `${label2(kind, item.pr)} (${item.branch}) -> ${short5(item.mergeSha)}${item.unverified ? ` UNVERIFIED (ledger ${item.unverified})` : ""}`).join(", ")}` : "landed nothing"
     ],
     ...data.retargeted.length ? [`retargeted: ${data.retargeted.map((pr) => label2(kind, pr)).join(", ")}`] : [],
     ...data.restacked.length ? [`restacked: ${data.restacked.join(", ")}`] : [],
@@ -79937,7 +81120,7 @@ async function land(argv, io) {
   unblock: ${data.stoppedAt.unblock}` : data.complete ? "stack complete" : ""
   ].filter(Boolean));
 }
-async function run15(argv, io) {
+async function run16(argv, io) {
   const [sub, ...rest] = argv.filter((arg) => arg !== "--json");
   if (sub === "plan")
     return plan(rest, io);
@@ -79947,13 +81130,13 @@ async function run15(argv, io) {
     return sync(rest, io);
   if (sub === "land")
     return land(rest, io);
-  return usage3(io, sub && !sub.startsWith("-") ? `unknown stack subcommand "${sub}"` : "missing stack subcommand", USAGE7);
+  return usage3(io, sub && !sub.startsWith("-") ? `unknown stack subcommand "${sub}"` : "missing stack subcommand", USAGE8);
 }
-var PLAN_USAGE = "workit stack plan [--name <n>] [--trunk <b> | --track <t>] [<bottom> … <top>] [--json]", STATUS_USAGE2 = "workit stack status [--name <n>] [--json]", SYNC_USAGE = "workit stack sync [--name <n>] [--local] [--dry-run] [--force <branch>]… [--json]", LAND_USAGE = "workit stack land [--name <n>] [--dry-run] [--max <n>] [--method squash|merge|rebase] [--unverified --reason <why>] [--timeout 20m] [--interval 30s] [--json]", USAGE7 = "workit stack plan|status|sync|land ... (workit help stack)", short4 = (sha) => sha ? sha.slice(0, 12) : "?", stackFailed = (io, result) => emit(io, fail(result.code, result.error, { unblock: result.unblock, data: result.data ?? {} })), label2 = (forge, pr) => pr === null ? "no PR" : `${forge === "gitlab" ? "MR !" : "PR #"}${pr}`, renderSync = (data) => [
+var PLAN_USAGE = "workit stack plan [--name <n>] [--trunk <b> | --track <t>] [<bottom> … <top>] [--json]", STATUS_USAGE2 = "workit stack status [--name <n>] [--json]", SYNC_USAGE = "workit stack sync [--name <n>] [--local] [--dry-run] [--force <branch>]… [--json]", LAND_USAGE = "workit stack land [--name <n>] [--dry-run] [--max <n>] [--method squash|merge|rebase] [--unverified --reason <why>] [--timeout 20m] [--interval 30s] [--json]", USAGE8 = "workit stack plan|status|sync|land ... (workit help stack)", short5 = (sha) => sha ? sha.slice(0, 12) : "?", stackFailed = (io, result) => emit(io, fail(result.code, result.error, { unblock: result.unblock, data: result.data ?? {} })), label2 = (forge, pr) => pr === null ? "no PR" : `${forge === "gitlab" ? "MR !" : "PR #"}${pr}`, renderSync = (data) => [
   `${data.dryRun ? "would sync" : "synced"} stack ${data.name}${data.merged.length ? `; merged: ${data.merged.map((item) => item.branch).join(", ")}` : ""}`,
   ...data.steps.map((step) => [
     `  ${step.branch} on ${step.parent}:`,
-    step.restack ? `restacked ${short4(step.restack.from)} -> ${short4(step.restack.onto)}${step.restack.head ? ` = ${short4(step.restack.head)}` : ""}${step.restack.carried === true ? " (same change; verdict carries)" : step.restack.carried === false ? " (change differs; verdict stale)" : ""}` : "up to date",
+    step.restack ? `restacked ${short5(step.restack.from)} -> ${short5(step.restack.onto)}${step.restack.head ? ` = ${short5(step.restack.head)}` : ""}${step.restack.carried === true ? " (same change; verdict carries)" : step.restack.carried === false ? " (change differs; verdict stale)" : ""}` : "up to date",
     step.push ? step.push.pushed ? `pushed${step.push.forced ? " (lease)" : ""}` : "remote current" : "",
     step.retarget ? `retargeted ${step.retarget.from} -> ${step.retarget.to}` : ""
   ].filter(Boolean).join(" "))
@@ -79967,7 +81150,7 @@ var init_stack2 = __esm(() => {
 });
 
 // packages/workit-core/src/fanout.ts
-import { spawnSync as spawnSync24 } from "node:child_process";
+import { spawnSync as spawnSync25 } from "node:child_process";
 import { createHash as createHash18 } from "node:crypto";
 import fs25 from "node:fs";
 import path48 from "node:path";
@@ -80116,7 +81299,7 @@ function inScope(plan, slice, file) {
 }
 function parsePlan(raw, defaults, name) {
   const problems = [];
-  if (!isRecord9(raw))
+  if (!isRecord10(raw))
     return { ok: false, problems: ["the plan must be a JSON object"] };
   const planName = name ?? (typeof raw.name === "string" ? raw.name.trim() : "");
   if (!planName || planName.length > 200 || /\p{Cc}/u.test(planName))
@@ -80139,8 +81322,8 @@ function parsePlan(raw, defaults, name) {
   const seenIds = new Set;
   const seenBranches = new Map;
   raw.slices.forEach((item, index) => {
-    const where = isRecord9(item) && typeof item.id === "string" ? `slice ${item.id}` : `slice #${index + 1}`;
-    if (!isRecord9(item)) {
+    const where = isRecord10(item) && typeof item.id === "string" ? `slice ${item.id}` : `slice #${index + 1}`;
+    if (!isRecord10(item)) {
       problems.push(`${where}: must be an object`);
       return;
     }
@@ -80458,7 +81641,7 @@ function fanoutsDir(cwd) {
   return { ok: true, data: path48.join(root.value.root, "fanouts") };
 }
 function parseStored(raw) {
-  if (!isRecord9(raw) || typeof raw.name !== "string" || typeof raw.trunk !== "string")
+  if (!isRecord10(raw) || typeof raw.name !== "string" || typeof raw.trunk !== "string")
     return null;
   if (!Array.isArray(raw.slices))
     return null;
@@ -80475,7 +81658,7 @@ function parseStored(raw) {
   });
   const slices = [];
   for (const item of raw.slices) {
-    if (!isRecord9(item) || typeof item.id !== "string" || typeof item.branch !== "string")
+    if (!isRecord10(item) || typeof item.id !== "string" || typeof item.branch !== "string")
       return null;
     slices.push({
       id: item.id,
@@ -80598,7 +81781,7 @@ function planFanout(cwd, input, now = new Date) {
     return fanoutFail("blocked", "--take-lead needs a session: WORKIT_SESSION_ID is not set", "export WORKIT_SESSION_ID=<your session id>, then plan again with --take-lead");
   if (input.takeLead && isDelegateSession(session))
     return fanoutFail("blocked", `session ${session} is a worker or verifier id; only a lead takes the lead`, "run --take-lead from the lead's own session");
-  const parsed = parsePlan(input.trunk && isRecord9(input.raw) ? { ...input.raw, trunk: input.trunk } : input.raw, {
+  const parsed = parsePlan(input.trunk && isRecord10(input.raw) ? { ...input.raw, trunk: input.trunk } : input.raw, {
     trunk: input.trunk ?? defaultTrunk(cwd),
     root: mainCheckout(cwd),
     worktreeRoot: worktreeRoot(cwd)
@@ -80721,7 +81904,7 @@ var FANOUT_VERSION = 1, TIERS, FAN_IN_MODES, fanoutFail = (code, error, unblock,
   error,
   ...unblock ? { unblock } : {},
   ...data ? { data } : {}
-}), DEFAULT_SHARED, escapeRegExp4 = (text) => text.replace(/[.+^$()|[\]\\{}*?]/gu, "\\$&"), unescape2 = (pattern) => pattern.replace(/\\(.)/gu, "$1"), hasWildcard = (pattern) => /[*?{]/u.test(pattern.replace(/\\./gu, "")), compiled, matchesAny = (patterns, file) => patterns.some((pattern) => matchesScope(pattern, file)), isRecord9 = (value) => typeof value === "object" && value !== null && !Array.isArray(value), PLACEHOLDER3, filled = (text) => text.trim() !== "" && !PLACEHOLDER3.test(text.trim()), textList = (value) => {
+}), DEFAULT_SHARED, escapeRegExp4 = (text) => text.replace(/[.+^$()|[\]\\{}*?]/gu, "\\$&"), unescape2 = (pattern) => pattern.replace(/\\(.)/gu, "$1"), hasWildcard = (pattern) => /[*?{]/u.test(pattern.replace(/\\./gu, "")), compiled, matchesAny = (patterns, file) => patterns.some((pattern) => matchesScope(pattern, file)), isRecord10 = (value) => typeof value === "object" && value !== null && !Array.isArray(value), PLACEHOLDER4, filled = (text) => text.trim() !== "" && !PLACEHOLDER4.test(text.trim()), textList = (value) => {
   if (typeof value === "string")
     return [value];
   if (Array.isArray(value) && value.every((item) => typeof item === "string"))
@@ -80740,7 +81923,7 @@ var FANOUT_VERSION = 1, TIERS, FAN_IN_MODES, fanoutFail = (code, error, unblock,
     text: edges.map((edge) => `add "${edge.dependsOn}" to "dependsOn" of slice ${edge.slice}`).join("; ")
   };
 }, gitRun4 = (cwd, args, timeoutMs = GIT_TIMEOUTS.local) => {
-  const run = spawnSync24("git", args, {
+  const run = spawnSync25("git", args, {
     cwd,
     encoding: "utf8",
     timeout: timeoutMs,
@@ -80773,12 +81956,12 @@ var init_fanout = __esm(() => {
     "CHANGELOG.md"
   ];
   compiled = new Map;
-  PLACEHOLDER3 = /^(?:<[^>]*>|tbd|todo|fixme|\?+|\.\.\.|…)$/iu;
+  PLACEHOLDER4 = /^(?:<[^>]*>|tbd|todo|fixme|\?+|\.\.\.|…)$/iu;
   ID = /^[a-z0-9][a-z0-9._-]{0,63}$/u;
 });
 
 // packages/workit-core/src/fanout-worktree.ts
-import { randomBytes as randomBytes4 } from "node:crypto";
+import { randomBytes as randomBytes5 } from "node:crypto";
 import fs26 from "node:fs";
 import path49 from "node:path";
 function rowSample(lines) {
@@ -80862,7 +82045,7 @@ function markAdminDir(worktree) {
   const admin = adminDir(worktree);
   if (!admin)
     return null;
-  const token = randomBytes4(16).toString("hex");
+  const token = randomBytes5(16).toString("hex");
   try {
     fs26.writeFileSync(path49.join(admin.path, TOKEN_FILE), `${token}
 `);
@@ -81287,7 +82470,7 @@ var init_fanout_brief = __esm(() => {
 });
 
 // packages/workit-core/src/fanout-landed.ts
-import { spawnSync as spawnSync25 } from "node:child_process";
+import { spawnSync as spawnSync26 } from "node:child_process";
 function forgeBreaker(resolved) {
   if (!resolved)
     return { forge: null, down: () => null };
@@ -81330,9 +82513,9 @@ function hasOwnCommits2(cwd, branch, start, head) {
     const onto = /^rebase(?: -i)? \(finish\): \S+ onto ([0-9a-f]+)/u.exec(subject)?.[1];
     if (!made && !(onto && !sha.startsWith(onto) && !onto.startsWith(sha)))
       continue;
-    if (sha !== head && !isAncestor3(cwd, sha, head))
+    if (sha !== head && !isAncestor4(cwd, sha, head))
       continue;
-    if (start && (sha === start || isAncestor3(cwd, sha, start)))
+    if (start && (sha === start || isAncestor4(cwd, sha, start)))
       continue;
     return true;
   }
@@ -81342,7 +82525,7 @@ function reverted(cwd, trunk, landedHead, start) {
   const fork = mergeBase(cwd, landedHead, trunk);
   if (fork && fork !== landedHead)
     return unchangedSince(cwd, fork, landedHead, trunk);
-  const before = start && start !== landedHead && isAncestor3(cwd, start, landedHead) ? start : gitRun4(cwd, ["rev-parse", "--verify", "-q", `${landedHead}^1`]).stdout.trim();
+  const before = start && start !== landedHead && isAncestor4(cwd, start, landedHead) ? start : gitRun4(cwd, ["rev-parse", "--verify", "-q", `${landedHead}^1`]).stdout.trim();
   return before ? unchangedSince(cwd, before, landedHead, trunk) : false;
 }
 function unchangedSince(cwd, before, after, trunk) {
@@ -81378,7 +82561,7 @@ function trunkPatchIds(ctx, fork) {
     "--"
   ]);
   if (log.ok && log.stdout.trim()) {
-    const run = spawnSync25("git", ["patch-id", "--stable"], {
+    const run = spawnSync26("git", ["patch-id", "--stable"], {
       cwd: ctx.cwd,
       input: log.stdout,
       encoding: "utf8",
@@ -81450,9 +82633,9 @@ function detectLanding(ctx, slice, input) {
           }
           return merged ? landed("pr_merged", merged) : { ...out, landed: true, how: "pr_merged" };
         }
-        if (!merged || head === merged || isAncestor3(ctx.cwd, head, merged))
+        if (!merged || head === merged || isAncestor4(ctx.cwd, head, merged))
           return landed("pr_merged", merged ?? head);
-        out.note = isAncestor3(ctx.cwd, merged, head) ? `${label} merged at ${merged.slice(0, 12)}; ${slice.branch} is ahead of it with newer commits` : `${label} merged at ${merged.slice(0, 12)}; ${slice.branch} has diverged from it (rewritten after the merge)`;
+        out.note = isAncestor4(ctx.cwd, merged, head) ? `${label} merged at ${merged.slice(0, 12)}; ${slice.branch} is ahead of it with newer commits` : `${label} merged at ${merged.slice(0, 12)}; ${slice.branch} has diverged from it (rewritten after the merge)`;
         return out;
       }
     }
@@ -81469,7 +82652,7 @@ function detectLanding(ctx, slice, input) {
   if (trunkIds.size === 0)
     return out;
   const froms = [fork];
-  if (input.parentHead && input.parentHead !== head && isAncestor3(ctx.cwd, input.parentHead, head))
+  if (input.parentHead && input.parentHead !== head && isAncestor4(ctx.cwd, input.parentHead, head))
     froms.push(input.parentHead);
   for (const from of froms) {
     const id = patchId(ctx.cwd, from, head);
@@ -81485,7 +82668,7 @@ function sliceStart(cwd, rows, fanout, slice) {
   const row = rows.findLast((candidate) => candidate.type === "fanout.worktree.created" && candidate.fanout === fanout && candidate.slice === slice.id && typeof candidate.baseSha === "string" && inSliceRun(candidate, slice));
   return row?.baseSha ?? null;
 }
-var isAncestor3 = (cwd, a, b) => gitRun4(cwd, ["merge-base", "--is-ancestor", a, b]).ok, TRUNK_SCAN = 500;
+var isAncestor4 = (cwd, a, b) => gitRun4(cwd, ["merge-base", "--is-ancestor", a, b]).ok, TRUNK_SCAN = 500;
 var init_fanout_landed = __esm(() => {
   init_rev();
   init_fanout();
@@ -81542,7 +82725,7 @@ function checkFanout(cwd, plan, options = {}) {
       const b = tips.get(second);
       if (landings.get(first)?.landed || landings.get(second)?.landed)
         continue;
-      if (!a || !b || isAncestor4(cwd, a, b) || isAncestor4(cwd, b, a))
+      if (!a || !b || isAncestor5(cwd, a, b) || isAncestor5(cwd, b, a))
         continue;
       const check = checks.get(second);
       const theirs = new Map((changedBy.get(first) ?? []).map((file) => [file.toLowerCase(), file]));
@@ -81722,7 +82905,7 @@ function unblockFor(check, plan) {
     return `unblock ${check.waitsFor.join(", ")} first`;
   return check.reasons[0] ?? "workit fanout check";
 }
-var SAFE = (value) => Boolean(value) && !value?.startsWith("-"), isAncestor4 = (cwd, a, b) => gitRun4(cwd, ["merge-base", "--is-ancestor", a, b]).ok, resolves = (cwd, ref) => gitRun4(cwd, ["rev-parse", "--verify", "-q", `${ref}^{commit}`]).ok, blank2 = (slice, head) => ({
+var SAFE = (value) => Boolean(value) && !value?.startsWith("-"), isAncestor5 = (cwd, a, b) => gitRun4(cwd, ["merge-base", "--is-ancestor", a, b]).ok, resolves = (cwd, ref) => gitRun4(cwd, ["rev-parse", "--verify", "-q", `${ref}^{commit}`]).ok, blank2 = (slice, head) => ({
   id: slice.id,
   branch: slice.branch,
   head,
@@ -81939,7 +83122,7 @@ var init_fanout_status = __esm(() => {
 // packages/workit-cli/src/verbs/fanout.ts
 var exports_fanout = {};
 __export(exports_fanout, {
-  run: () => run16
+  run: () => run17
 });
 import fs27 from "node:fs";
 import path50 from "node:path";
@@ -82135,7 +83318,7 @@ function worktree(argv, io) {
       return failed(io, result);
     return emit(io, ok(result.data), (data) => [
       `${data.created ? "created" : "kept"} worktree for slice ${data.slice} (${data.mode}): ${data.path}`,
-      `  branch ${data.branch} <- ${data.base} at ${short5(data.head)}`,
+      `  branch ${data.branch} <- ${data.base} at ${short6(data.head)}`,
       `  scratch ${data.scratch}  (put it in the worker brief: temp files go here)`,
       ...data.notes.map((note) => `note: ${note}`)
     ]);
@@ -82159,7 +83342,7 @@ function worktree(argv, io) {
     ...data.notes.map((note) => `note: ${note}`)
   ]);
 }
-async function run16(argv, io) {
+async function run17(argv, io) {
   const [sub, ...rest] = argv.filter((arg) => arg !== "--json");
   if (sub === "plan")
     return plan2(rest, io);
@@ -82171,9 +83354,9 @@ async function run16(argv, io) {
     return status3(rest, io);
   if (sub === "worktree")
     return worktree(rest, io);
-  return usage3(io, sub && !sub.startsWith("-") ? `unknown fanout subcommand "${sub}"` : "missing fanout subcommand", USAGE8);
+  return usage3(io, sub && !sub.startsWith("-") ? `unknown fanout subcommand "${sub}"` : "missing fanout subcommand", USAGE9);
 }
-var PLAN_USAGE2 = "workit fanout plan <plan.json> [--name <n>] [--trunk <b> | --track <t>] [--take-lead] [--json]", BRIEF_USAGE = "workit fanout brief <slice> [--name <n>] [--mode new|resume] [--attempt <n>] [--json]", CHECK_USAGE = "workit fanout check [<slice>…] [--name <n>] [--base <ref>] [--offline] [--json]", STATUS_USAGE3 = "workit fanout status [--name <n>] [--stuck-after 30m] [--offline] [--json]", WORKTREE_USAGE = "workit fanout worktree create <slice> [--name <n>] | worktree release <slice> [--name <n>] [--force] [--json]", USAGE8 = "workit fanout plan|brief|check|status|worktree ... (workit help fanout)", failed = (io, result) => emit(io, fail(result.code, result.error, { unblock: result.unblock, data: result.data ?? {} })), renderCheck = (data) => [
+var PLAN_USAGE2 = "workit fanout plan <plan.json> [--name <n>] [--trunk <b> | --track <t>] [--take-lead] [--json]", BRIEF_USAGE = "workit fanout brief <slice> [--name <n>] [--mode new|resume] [--attempt <n>] [--json]", CHECK_USAGE = "workit fanout check [<slice>…] [--name <n>] [--base <ref>] [--offline] [--json]", STATUS_USAGE3 = "workit fanout status [--name <n>] [--stuck-after 30m] [--offline] [--json]", WORKTREE_USAGE = "workit fanout worktree create <slice> [--name <n>] | worktree release <slice> [--name <n>] [--force] [--json]", USAGE9 = "workit fanout plan|brief|check|status|worktree ... (workit help fanout)", failed = (io, result) => emit(io, fail(result.code, result.error, { unblock: result.unblock, data: result.data ?? {} })), renderCheck = (data) => [
   `fanout ${data.name} against ${data.trunkRef}: ${data.ready ? "ready to land" : "blocked"}`,
   ...data.slices.map((slice) => slice.status === "landed" ? `  -- ${slice.id} (${slice.branch}) landed (${slice.landed?.how}${slice.landed?.pr ? ` #${slice.landed.pr}` : ""})` : `  ${slice.status === "ready" ? "ok " : "x  "}${slice.id} (${slice.branch}) ${slice.changed} file${slice.changed === 1 ? "" : "s"} · verdict ${slice.verdict.accepted ? "accepted" : slice.verdict.basis}${slice.reasons.length ? `
       ${slice.reasons.join(`
@@ -82183,7 +83366,7 @@ var PLAN_USAGE2 = "workit fanout plan <plan.json> [--name <n>] [--trunk <b> | --
   `landing order: ${data.landingOrder.join(", ")}`,
   `next: ${data.next}`,
   ...data.notes.map((note) => `note: ${note}`)
-], short5 = (sha) => sha ? sha.slice(0, 7) : "-", renderStatus2 = (data) => {
+], short6 = (sha) => sha ? sha.slice(0, 7) : "-", renderStatus2 = (data) => {
   const counts = new Map;
   for (const slice of data.slices)
     counts.set(slice.state, (counts.get(slice.state) ?? 0) + 1);
@@ -82191,7 +83374,7 @@ var PLAN_USAGE2 = "workit fanout plan <plan.json> [--name <n>] [--trunk <b> | --
     `fanout ${data.name} on ${data.trunk}: ${[...counts].map(([state, count]) => `${count} ${state.replace("_", " ")}`).join(", ")} · forge ${data.forge.available ? "on" : "off"}`,
     ...data.slices.map((slice) => {
       const parts = [
-        slice.branchExists ? short5(slice.head) : "no branch",
+        slice.branchExists ? short6(slice.head) : "no branch",
         slice.lastCommitAt && slice.idleMinutes !== null ? `idle ${slice.idleMinutes} min` : null,
         slice.pr ? `PR #${slice.pr.number} ${slice.pr.state}` : null,
         slice.ci === "unknown" ? null : `CI ${slice.ci}`,
@@ -82225,9 +83408,9 @@ var init_fanout2 = __esm(() => {
 // packages/workit-cli/src/verbs/ledger.ts
 var exports_ledger = {};
 __export(exports_ledger, {
-  run: () => run17
+  run: () => run18
 });
-import { randomBytes as randomBytes5 } from "node:crypto";
+import { randomBytes as randomBytes6 } from "node:crypto";
 import { parseArgs } from "node:util";
 function targetBranch(io, rows, branch, pr) {
   if (pr !== undefined) {
@@ -82249,7 +83432,7 @@ function targetBranch(io, rows, branch, pr) {
   }
   return { ok: true, value: branch ?? null };
 }
-async function run17(argv, io) {
+async function run18(argv, io) {
   let parsed;
   try {
     parsed = parseArgs({ args: argv, options: OPTIONS, allowPositionals: true, strict: true });
@@ -82365,10 +83548,12 @@ async function run17(argv, io) {
   if (rest.length !== 1)
     return usage4(io, `ledger verdict takes one result: ${VERDICT_RESULTS.join("|")}`);
   const claimed = values.self === true ? null : claimedSession(acting);
-  const refusal = claimed === null ? null : sessionClaimRefusal(io.env, claimed, io.cwd);
+  const token = values.token ?? io.env.WORKIT_SESSION_TOKEN ?? null;
+  const refusal = claimed === null ? null : sessionClaimRefusal(io.env, claimed, io.cwd, { token, flag: acting.source === "flag" });
   if (refusal)
     return emit(io, fail("blocked", refusal.error, { unblock: refusal.unblock }));
-  const verdict = await recorded(recordVerdict(context, {
+  const bound = claimed !== null && issuedTokenMatches(io.cwd, claimed, token);
+  const verdict = await recorded(recordVerdict({ ...context, ...bound ? { sessionBound: true } : {} }, {
     result: rest[0],
     kind: values.kind,
     how: values.how,
@@ -82384,7 +83569,12 @@ async function run17(argv, io) {
   if (shadowed)
     io.stderr(`warning: ${shadowed}
 `);
-  return fromResult(io, verdict, (row) => `recorded verdict ${row.id}: ${row.result} [${row.kind}] for ${row.branch} @ ${(row.head ?? "").slice(0, 12)} as ${actor.session ?? "no session"}${row.self ? ` (self${row.selfReason === "no_session" ? ": WORKIT_SESSION_ID unset" : ""}; never accepted)` : ""}`);
+  const withGate = verdict.ok ? { ok: true, value: { ...verdict.value, gate: gateReading(io.cwd, verdict.value) } } : verdict;
+  return fromResult(io, withGate, (row) => [
+    `recorded verdict ${row.id}: ${row.result} [${row.kind}] for ${row.branch} @ ${(row.head ?? "").slice(0, 12)} as ${actor.session ?? "no session"}${row.self ? ` (self${row.selfReason === "no_session" ? ": WORKIT_SESSION_ID unset" : ""}; never accepted)` : ""}`,
+    row.gate ? `gate: ${row.branch} ${row.gate.accepted ? `accepted (verdict ${row.gate.verdictId ?? "?"})` : `not accepted (${row.gate.reasons.join(", ")})`}` : "gate: unknown (ledger unreadable)"
+  ].join(`
+`));
 }
 function standingFanout(io, values) {
   if (values.fanout !== undefined) {
@@ -82441,7 +83631,7 @@ async function standing(io, values, args) {
     return usage4(io, `unexpected argument: ${rest[1]}`);
   return fromResult(io, clearStanding(context, { fanout, lead, leads, target: rest[0] ?? null }), (row) => row.target ? `cleared standing order ${row.target} for fanout ${fanout}` : `cleared every standing order for fanout ${fanout}`);
 }
-var USAGE9 = "workit ledger decision|ruling|verdict|standing|list|check ... (workit help ledger for the grammar)", STANDING_USAGE = 'workit ledger standing add "<order>" | list | clear [<id>]  [--fanout <name>] [--json]', OPTIONS, SESSION_SAFE2, ROLE_SAFE, actorFor = (io, values) => {
+var USAGE10 = "workit ledger decision|ruling|verdict|standing|list|check ... (workit help ledger for the grammar)", STANDING_USAGE = 'workit ledger standing add "<order>" | list | clear [<id>]  [--fanout <name>] [--json]', OPTIONS, SESSION_SAFE2, ROLE_SAFE, actorFor = (io, values) => {
   const actor = actorFromEnv(io.env);
   if (values.session !== undefined && values.as !== undefined)
     return new Error("pass --session or --as, not both");
@@ -82455,7 +83645,7 @@ var USAGE9 = "workit ledger decision|ruling|verdict|standing|list|check ... (wor
       return new Error("--as takes a lowercase role, e.g. verifier");
     const prefix = (actor.session ?? actor.host).slice(0, 96);
     return {
-      actor: { ...actor, session: `${prefix}:${values.as}:${randomBytes5(4).toString("hex")}` },
+      actor: { ...actor, session: `${prefix}:${values.as}:${randomBytes6(4).toString("hex")}` },
       source: "as",
       derivedFrom: actor.session
     };
@@ -82466,7 +83656,7 @@ var USAGE9 = "workit ledger decision|ruling|verdict|standing|list|check ... (wor
     return;
   const parsed = Number(value);
   return Number.isInteger(parsed) && parsed > 0 ? parsed : new Error(`${flag} must be a positive integer`);
-}, failed2 = (io, result) => emit(io, fail(result.code, result.error, result.unblock ? { unblock: result.unblock } : {})), fromResult = (io, result, human) => result.ok ? emit(io, ok(result.value), human) : failed2(io, result), usage4 = (io, error) => emit(io, fail("invalid_input", error, { unblock: USAGE9 })), passedTestOn = (cwd, verdict) => {
+}, failed2 = (io, result) => emit(io, fail(result.code, result.error, result.unblock ? { unblock: result.unblock } : {})), fromResult = (io, result, human) => result.ok ? emit(io, ok(result.value), human) : failed2(io, result), usage4 = (io, error) => emit(io, fail("invalid_input", error, { unblock: USAGE10 })), passedTestOn = (cwd, verdict) => {
   const ledger = readLedger(cwd);
   return ledger.ok && ledger.value.rows.some((row) => row.type === "check" && row.observer === "workit_cli" && row.name === "test" && row.result === "passed" && row.dirty !== true && row.branch === verdict.branch && row.head === verdict.head);
 }, verdictLines = (check) => {
@@ -82498,7 +83688,17 @@ var USAGE9 = "workit ledger decision|ruling|verdict|standing|list|check ... (wor
 ] : [
   `${data.unverified_rows.length} unverified row(s) (not written by the workit CLI, or changed afterwards):`,
   ...data.unverified_rows.map((row) => `  #${row.seq} ${row.id} ${row.type}${row.branch ? ` [${row.branch}]` : ""}: ${row.reason}`)
-];
+], gateReading = (cwd, row) => {
+  const ledger = readLedger(cwd, { integrity: true });
+  if (!ledger.ok || !row.branch)
+    return null;
+  const { accepted } = checkVerdicts(cwd, row.branch, ledger.value.rows);
+  return {
+    accepted: accepted.accepted,
+    reasons: accepted.reasons,
+    verdictId: typeof accepted.verdict?.id === "string" ? accepted.verdict.id : null
+  };
+};
 var init_ledger2 = __esm(() => {
   init_ledger();
   init_fanout();
@@ -82522,6 +83722,7 @@ var init_ledger2 = __esm(() => {
     last: { type: "string" },
     supersedes: { type: "string" },
     session: { type: "string" },
+    token: { type: "string" },
     as: { type: "string" },
     fanout: { type: "string" },
     json: { type: "boolean" }
@@ -98377,11 +99578,11 @@ var init_rules = __esm(() => {
 });
 
 // packages/workit-cli/src/test-audit/audit.ts
-import { spawnSync as spawnSync26 } from "node:child_process";
-import { existsSync as existsSync20, readdirSync as readdirSync9, readFileSync as readFileSync23, statSync as statSync8 } from "node:fs";
+import { spawnSync as spawnSync27 } from "node:child_process";
+import { existsSync as existsSync20, readdirSync as readdirSync10, readFileSync as readFileSync23, statSync as statSync8 } from "node:fs";
 import path52 from "node:path";
 function git7(cwd, args) {
-  const run = spawnSync26("git", ["-c", "core.quotepath=off", ...args], {
+  const run = spawnSync27("git", ["-c", "core.quotepath=off", ...args], {
     cwd,
     encoding: "utf8",
     maxBuffer: 64 * 1024 * 1024
@@ -98389,7 +99590,7 @@ function git7(cwd, args) {
   return { ok: run.status === 0, stdout: run.stdout ?? "" };
 }
 function walkTests(dir, out) {
-  for (const entry of readdirSync9(dir, { withFileTypes: true })) {
+  for (const entry of readdirSync10(dir, { withFileTypes: true })) {
     if (entry.name.startsWith(".") && entry.name !== "." && entry.isDirectory())
       continue;
     const full = path52.join(dir, entry.name);
@@ -98525,7 +99726,7 @@ import {
   lstatSync as lstatSync8,
   mkdirSync as mkdirSync10,
   mkdtempSync as mkdtempSync4,
-  readdirSync as readdirSync10,
+  readdirSync as readdirSync11,
   readFileSync as readFileSync24,
   readlinkSync as readlinkSync3,
   realpathSync as realpathSync9,
@@ -98622,7 +99823,7 @@ function removeStaleCopies(tmp = os16.tmpdir()) {
   let removed = 0;
   let names = [];
   try {
-    names = readdirSync10(tmp);
+    names = readdirSync11(tmp);
   } catch {
     return 0;
   }
@@ -98651,7 +99852,7 @@ function removeStaleCopies(tmp = os16.tmpdir()) {
 }
 function linkNodeModules(origin, target, repo, copy) {
   mkdirSync10(target, { recursive: true });
-  for (const entry of readdirSync10(origin, { withFileTypes: true })) {
+  for (const entry of readdirSync11(origin, { withFileTypes: true })) {
     const from = path53.join(origin, entry.name);
     const to = path53.join(target, entry.name);
     if (entry.name.startsWith("@") && entry.isDirectory()) {
@@ -98845,7 +100046,7 @@ async function runMutation(options) {
     if (!runnable.includes(mutant))
       record({ ...mutant, status: "no-tests", durationMs: 0, tests: [] });
   if (runnable.length === 0)
-    return finish2(options, 0, results, counts, started);
+    return finish3(options, 0, results, counts, started);
   removeStaleCopies();
   const { dir: copyDir, tree: copy } = copyWorkingTree(repo);
   const copyCwd = path53.join(copy, cwdRelative);
@@ -98909,7 +100110,7 @@ async function runMutation(options) {
         restore();
       }
     }
-    return finish2(options, baseline.durationMs, results, counts, started);
+    return finish3(options, baseline.durationMs, results, counts, started);
   } finally {
     process.off("SIGINT", onSignal);
     process.off("SIGTERM", onSignal);
@@ -98917,7 +100118,7 @@ async function runMutation(options) {
     cleanup();
   }
 }
-function finish2(options, baselineMs, results, counts, started) {
+function finish3(options, baselineMs, results, counts, started) {
   const decided = counts.killed + counts.timeout + counts.survived;
   return {
     base: options.base,
@@ -98987,7 +100188,7 @@ var init_mutate = __esm(() => {
 // packages/workit-cli/src/verbs/test-audit.ts
 var exports_test_audit = {};
 __export(exports_test_audit, {
-  run: () => run18
+  run: () => run19
 });
 import { existsSync as existsSync22 } from "node:fs";
 import path54 from "node:path";
@@ -99088,11 +100289,11 @@ function human(data) {
   }
   return lines;
 }
-async function run18(argv, io) {
+async function run19(argv, io) {
   const options = parse7(argv);
   if (typeof options === "string")
     return emit(io, fail("invalid_input", `${options}
-usage: ${USAGE10}`));
+usage: ${USAGE11}`));
   const top = git7(io.cwd, ["rev-parse", "--show-toplevel"]);
   const repo = top.ok ? path54.resolve(top.stdout.trim()) : null;
   const display = (file) => toPosix(path54.relative(io.cwd, file) || file);
@@ -99178,7 +100379,7 @@ usage: ${USAGE10}`));
   }
   return emit(io, ok(data), human);
 }
-var USAGE10 = "workit test-audit [paths…] [--diff [base]] [--rule <ids>] [--min-severity <level>] [--fail-on <level>] [--mutate [--test-cmd <cmd>] [--max-mutants <n>] [--budget <s>] [--timeout <s>]] [--json]", LEVELS, VALUE_FLAGS2, quote = (arg) => /^[\w./@:=+-]+$/.test(arg) ? arg : `'${arg.replace(/'/g, "'\\''")}'`;
+var USAGE11 = "workit test-audit [paths…] [--diff [base]] [--rule <ids>] [--min-severity <level>] [--fail-on <level>] [--mutate [--test-cmd <cmd>] [--max-mutants <n>] [--budget <s>] [--timeout <s>]] [--json]", LEVELS, VALUE_FLAGS2, quote = (arg) => /^[\w./@:=+-]+$/.test(arg) ? arg : `'${arg.replace(/'/g, "'\\''")}'`;
 var init_test_audit = __esm(() => {
   init_audit();
   init_mutate();
@@ -99199,12 +100400,12 @@ var init_test_audit = __esm(() => {
 // packages/workit-cli/src/verbs/knowledge.ts
 var exports_knowledge = {};
 __export(exports_knowledge, {
-  run: () => run19
+  run: () => run20
 });
-async function run19(argv, io) {
+async function run20(argv, io) {
   const [sub, ...rest] = argv.filter((arg) => arg !== "--json");
   if (sub !== "lint" || rest.length > 0)
-    return emit(io, fail("invalid_input", `usage: ${USAGE11}`));
+    return emit(io, fail("invalid_input", `usage: ${USAGE12}`));
   const report = lintKnowledge(checkRoot(io.cwd));
   if (report.unreadable.length > 0)
     return emit(io, fail("unavailable", `knowledge lint: cannot read ${report.unreadable.join(", ")}`, {
@@ -99221,7 +100422,7 @@ async function run19(argv, io) {
 `);
   return report.findings.length === 0 ? 0 : 1;
 }
-var USAGE11 = "workit knowledge lint [--json]";
+var USAGE12 = "workit knowledge lint [--json]";
 var init_knowledge2 = __esm(() => {
   init_check_config();
   init_knowledge();
@@ -99335,14 +100536,14 @@ var init_youtrack_writes = __esm(() => {
 // packages/workit-cli/src/verbs/youtrack.ts
 var exports_youtrack = {};
 __export(exports_youtrack, {
-  run: () => run20
+  run: () => run21
 });
 import { readFileSync as readFileSync25 } from "node:fs";
 import path55 from "node:path";
-async function run20(argv, io) {
+async function run21(argv, io) {
   const [sub, ...rest] = argv;
   if (sub !== "note" && sub !== "time" && sub !== "meeting")
-    return usage3(io, `unknown subcommand "${sub ?? ""}"`, USAGE12);
+    return usage3(io, `unknown subcommand "${sub ?? ""}"`, USAGE13);
   const flags = parseFlags(rest, {
     markdown: "value",
     file: "value",
@@ -99351,18 +100552,18 @@ async function run20(argv, io) {
     date: "value"
   });
   if (typeof flags === "string")
-    return usage3(io, flags, USAGE12);
+    return usage3(io, flags, USAGE13);
   const [issueId, extra] = flags.positionals;
   if (!issueId || !ISSUE_RE2.test(issueId))
-    return usage3(io, "an issue id like ABC-123 is required", USAGE12);
+    return usage3(io, "an issue id like ABC-123 is required", USAGE13);
   if (extra !== undefined)
-    return usage3(io, `unexpected argument ${extra}`, USAGE12);
+    return usage3(io, `unexpected argument ${extra}`, USAGE13);
   const minutes = positiveInt(flags.values.minutes, "--minutes");
   if (typeof minutes === "string")
-    return usage3(io, minutes, USAGE12);
+    return usage3(io, minutes, USAGE13);
   const date = youTrackWorkDateMs(flags.values.date ?? "auto");
   if ("error" in date)
-    return usage3(io, date.error, USAGE12);
+    return usage3(io, date.error, USAGE13);
   const dateMs = date.data.dateMs;
   const markedDay = flags.values.date !== undefined && flags.values.date !== "auto" ? { dateMs } : {};
   const root = io.cwd;
@@ -99380,24 +100581,24 @@ async function run20(argv, io) {
   };
   if (sub === "note") {
     if (Boolean(flags.values.markdown) === Boolean(flags.values.file))
-      return usage3(io, "pass exactly one of --markdown or --file", USAGE12);
+      return usage3(io, "pass exactly one of --markdown or --file", USAGE13);
     let markdown = flags.values.markdown ?? "";
     if (flags.values.file)
       try {
         markdown = readFileSync25(path55.resolve(io.cwd, flags.values.file), "utf8");
       } catch (error) {
-        return usage3(io, `cannot read ${flags.values.file}: ${String(error)}`, USAGE12);
+        return usage3(io, `cannot read ${flags.values.file}: ${String(error)}`, USAGE13);
       }
     if (!markdown.trim())
-      return usage3(io, "the note is empty", USAGE12);
+      return usage3(io, "the note is empty", USAGE13);
     const missing = step("comment", "comments", { operation: "note", issueId, markdown }, markdown, async (text) => commentResult(await postComment(issueId, text, root))) ?? (minutes ? step("time", "workItems", { operation: "note.time", issueId, markdown, minutes, ...markedDay }, "workit update", (text) => logTimeUpdate({ issueId, minutes, text, dateMs, workspace_root: root })) : null);
     if (missing)
       return emit(io, fail("unavailable", missing));
   } else {
     if (!minutes)
-      return usage3(io, `${sub} needs --minutes <n>`, USAGE12);
+      return usage3(io, `${sub} needs --minutes <n>`, USAGE13);
     if (sub === "meeting" && !flags.values.text)
-      return usage3(io, "meeting needs --text <what the meeting was>", USAGE12);
+      return usage3(io, "meeting needs --text <what the meeting was>", USAGE13);
     const text = flags.values.text ?? "";
     const missing = step(sub, "workItems", { operation: sub, issueId, minutes, text, ...markedDay }, text, (marked) => logTimeUpdate({ issueId, minutes, text: marked, dateMs, workspace_root: root }));
     if (missing)
@@ -99426,7 +100627,7 @@ async function run20(argv, io) {
     ...data.steps.flatMap((entry) => entry.note ? [`  note (${entry.step}): ${entry.note}`] : [])
   ]);
 }
-var USAGE12 = "workit youtrack note <ISSUE> (--markdown <t> | --file <p>) [--minutes <n>] [--date auto|YYYY-MM-DD] | youtrack time <ISSUE> --minutes <n> [--text <t>] [--date …] | youtrack meeting <ISSUE> --minutes <n> --text <t> [--date …]", commentResult = (value) => {
+var USAGE13 = "workit youtrack note <ISSUE> (--markdown <t> | --file <p>) [--minutes <n>] [--date auto|YYYY-MM-DD] | youtrack time <ISSUE> --minutes <n> [--text <t>] [--date …] | youtrack meeting <ISSUE> --minutes <n> --text <t> [--date …]", commentResult = (value) => {
   try {
     return { ok: true, data: unwrap2(value) };
   } catch (error) {
@@ -99450,14 +100651,14 @@ var init_youtrack2 = __esm(() => {
 // packages/workit-cli/src/verbs/changelog.ts
 var exports_changelog = {};
 __export(exports_changelog, {
-  run: () => run21
+  run: () => run22
 });
 import { readFileSync as readFileSync26 } from "node:fs";
 import path56 from "node:path";
-async function run21(argv, io) {
+async function run22(argv, io) {
   const [sub, ...rest] = argv;
   if (sub !== "apply")
-    return usage3(io, `unknown subcommand "${sub ?? ""}"`, USAGE13);
+    return usage3(io, `unknown subcommand "${sub ?? ""}"`, USAGE14);
   const flags = parseFlags(rest, {
     entries: "value",
     path: "value",
@@ -99465,18 +100666,18 @@ async function run21(argv, io) {
     preview: "boolean"
   });
   if (typeof flags === "string")
-    return usage3(io, flags, USAGE13);
+    return usage3(io, flags, USAGE14);
   if (flags.positionals.length)
-    return usage3(io, `unexpected argument ${flags.positionals[0]}`, USAGE13);
+    return usage3(io, `unexpected argument ${flags.positionals[0]}`, USAGE14);
   const normalizeOnly = flags.booleans.has("normalize-only");
   if (!normalizeOnly && !flags.values.entries)
-    return usage3(io, "pass --entries <JSON> or --normalize-only", USAGE13);
+    return usage3(io, "pass --entries <JSON> or --normalize-only", USAGE14);
   let entries;
   if (flags.values.entries)
     try {
       entries = readEntries(flags.values.entries, io.cwd);
     } catch (error) {
-      return usage3(io, `--entries is not valid JSON: ${String(error)}`, USAGE13);
+      return usage3(io, `--entries is not valid JSON: ${String(error)}`, USAGE14);
     }
   const input = {
     entries,
@@ -99498,7 +100699,7 @@ async function run21(argv, io) {
     `changelog updated: ${String(applied.path ?? "CHANGELOG.md")}`
   ]);
 }
-var USAGE13 = "workit changelog apply (--entries <JSON|@file|-> | --normalize-only) [--path CHANGELOG.md] [--preview]", readEntries = (raw, cwd) => {
+var USAGE14 = "workit changelog apply (--entries <JSON|@file|-> | --normalize-only) [--path CHANGELOG.md] [--preview]", readEntries = (raw, cwd) => {
   const text = raw === "-" ? readFileSync26(0, "utf8") : raw.startsWith("@") ? readFileSync26(path56.resolve(cwd, raw.slice(1)), "utf8") : raw;
   return JSON.parse(text);
 };
@@ -99511,12 +100712,12 @@ var init_changelog2 = __esm(() => {
 // packages/workit-cli/src/verbs/handoff.ts
 var exports_handoff = {};
 __export(exports_handoff, {
-  run: () => run22
+  run: () => run23
 });
 import { parseArgs as parseArgs2 } from "node:util";
 function human2(brief) {
   const lines = [
-    `branch: ${brief.branch ?? "(detached)"} @ ${short6(brief.head)}${brief.subject ? ` ${brief.subject}` : ""}`
+    `branch: ${brief.branch ?? "(detached)"} @ ${short7(brief.head)}${brief.subject ? ` ${brief.subject}` : ""}`
   ];
   if (brief.base)
     lines.push(`base:   ${brief.base}${brief.ahead === null ? "" : ` (ahead ${brief.ahead}, behind ${brief.behind})`}`);
@@ -99559,11 +100760,11 @@ async function resumeBrief(argv, io) {
       strict: true
     }));
   } catch (error) {
-    return emit(io, fail("invalid_input", error.message, { unblock: USAGE14 }));
+    return emit(io, fail("invalid_input", error.message, { unblock: USAGE15 }));
   }
   const last = values.last === undefined ? 10 : Number(values.last);
   if (!Number.isInteger(last) || last < 1)
-    return emit(io, fail("invalid_input", "--last must be a positive integer", { unblock: USAGE14 }));
+    return emit(io, fail("invalid_input", "--last must be a positive integer", { unblock: USAGE15 }));
   const built = buildHandoff(io.cwd, {
     last,
     note: values.note ?? null,
@@ -99581,13 +100782,13 @@ async function resumeBrief(argv, io) {
   }
   return emit(io, ok({ ...data, recorded }), human2);
 }
-async function run22(argv, io) {
+async function run23(argv, io) {
   if (!argv.some((arg) => arg === "--task" || arg.startsWith("--task=")))
     return resumeBrief(argv, io);
   await Promise.resolve().then(() => init_task());
   return runTaskCommand(["handoff", ...argv]);
 }
-var USAGE14 = "workit handoff [--note <text>] [--next <text>] [--record] [--last <n>] [--json]", short6 = (sha) => sha ? sha.slice(0, 12) : "no commit";
+var USAGE15 = "workit handoff [--note <text>] [--next <text>] [--record] [--last <n>] [--json]", short7 = (sha) => sha ? sha.slice(0, 12) : "no commit";
 var init_handoff = __esm(() => {
   init_ledger();
   init_output();
@@ -99788,7 +100989,7 @@ function withSubcommands(entry, options = {}) {
   };
 }
 var VERIFY_OPTIONS = "[--expect pushed|pr|merged|released] [--pr <n> | --branch <b>] [--sha <sha>] [--tag <t>] [--package <name[@version]>]";
-var LEDGER_ACTOR = "[--branch <b> | --pr <n>] [--supersedes <id>] [--session <id> | --as <role>]";
+var LEDGER_ACTOR = "[--branch <b> | --pr <n>] [--supersedes <id>] [--session <id> [--token <t>] | --as <role>]";
 var VERBS = [
   {
     name: "init",
@@ -99966,6 +101167,35 @@ var VERBS = [
     ],
     load: () => Promise.resolve().then(() => (init_git2(), exports_git))
   }),
+  withSubcommands({
+    name: "release",
+    group: "delivery",
+    summary: "git-flow releases without the git-flow binary: start a local release branch, finish it (merge, tag, merge back, push, forge release), publish it only when asked",
+    subcommands: [
+      {
+        name: "start",
+        usage: "workit release start <version> [--hotfix] [--track <t>]",
+        summary: "Cut release/<version> (hotfix/<version> from production) locally; never pushes it"
+      },
+      {
+        name: "finish",
+        usage: "workit release finish [<version>] [--track <t>] [--dry-run]",
+        summary: "Merge into production, tag, merge back, delete the branch, push production, merge-back branches and the tag, publish the forge release; resumes an interrupted finish"
+      },
+      {
+        name: "publish",
+        usage: "workit release publish [<version>]",
+        summary: "Push the release branch (opt-in: others commit to it or CI runs on it)"
+      }
+    ],
+    examples: [
+      "workit release start 1.4.0",
+      'workit git commit -m "chore(release): 1.4.0" -- package.json CHANGELOG.md',
+      "workit release finish --dry-run",
+      "workit release finish"
+    ],
+    load: () => Promise.resolve().then(() => (init_release2(), exports_release))
+  }),
   withSubcommands({
     name: "verify-delivery",
     group: "delivery",
@@ -100088,7 +101318,7 @@ var VERBS = [
       },
       {
         name: "standing",
-        usage: `workit ledger standing add "<order>" | standing list | standing clear [<id>]  [--fanout <name>] [--supersedes <id>] [--session <id> | --as <role>]`,
+        usage: `workit ledger standing add "<order>" | standing list | standing clear [<id>]  [--fanout <name>] [--supersedes <id>] [--session <id> [--token <t>] | --as <role>]`,
         summary: "The lead's standing orders for a fanout's workers"
       },
       {