@groundnuty/macf-core 0.2.46 → 0.2.48

package/dist/fleet-upgrade.d.ts

@@ -16,7 +16,10 @@ export type UpgradeDisposition = 'behind' | 'at-target' | 'offline';
 export interface AgentUpgradePlan {
     /** The agent's routing label (registry key). */
     readonly agent: string;
-    /** The fleet (registry identifier) this member belongs to. */
+    /**
+     * The fleet this member belongs to — the workspace's PROJECT (macf#710), NOT
+     * its (possibly-shared) registry scope. See `WorkspaceRecord.project`.
+     */
     readonly fleet: string;
     /** The agent's live self-reported `/health.version`, or `null` when offline/version-less. */
     readonly runningVersion: string | null;
@@ -27,18 +30,92 @@ export interface AgentUpgradePlan {
 }
 /**
  * The EXECUTE-path outcome of a single agent in the roll:
- * - `upgraded`     — rolled + came up green on the target.
- * - `busy-skipped` — busy-gated (or `--wait` timed out still busy); NOT a
- *                    failure, so the roll CONTINUES to the next agent.
- * - `halted`       — did not verify-green within the budget; the roll STOPS here.
+ * - `upgraded`              — rolled + confirmed green on the target. CONTINUES.
+ * - `busy-skipped`          — busy-gated (or `--wait` timed out still busy),
+ *                             BEFORE any mutation; NOT a failure, CONTINUES.
+ * - `config-dirty-skipped`  — config-dirty-gated (uncommitted changes on the
+ *                             roll's touched-config surface), BEFORE any
+ *                             mutation; NOT a failure, CONTINUES. The roll
+ *                             OBJECTS with the specific file list + an
+ *                             agent-directed message (macf#725 — replaces
+ *                             macf#722 Fix B's silent skip).
+ * - `halted`                — verify-green did NOT confirm the target version;
+ *                             the roll STOPS here. `reason` distinguishes WHY
+ *                             (see `HaltReason`).
+ *
+ * The two pre-flight skip outcomes (`busy-skipped` / `config-dirty-skipped`)
+ * are safe to continue past because the agent was NEVER mutated. `halted` is
+ * always terminal because the agent WAS rolled and its post-restart state is
+ * either confirmed-bad or unconfirmed — neither is safe to leave behind while
+ * moving on to the next agent (macf#722 Fix A).
+ */
+export type RollOutcome = 'upgraded' | 'busy-skipped' | 'config-dirty-skipped' | 'halted';
+/**
+ * WHY a roll halted (only meaningful when `outcome === 'halted'`):
+ * - `bad-release`           — verify-green confirmed the agent came back up
+ *                             REACHABLE at its OLD (pre-upgrade) version — a
+ *                             crash-loop / stuck-old-process release. Terminal;
+ *                             stops this fleet's roll + later fleets.
+ * - `relaunch-unconfirmed`  — past the full verify-green grace budget, the
+ *                             agent was never confirmed at the target version:
+ *                             down the whole time, unreachable, or reachable at
+ *                             some OTHER (neither old-pin nor target) version.
+ *                             "Not yet green" cannot distinguish a slow-but-fine
+ *                             relaunch from a release that crashes on startup
+ *                             (which never shows the old version either), so
+ *                             this is deliberately NOT a continue.
  */
-export type RollOutcome = 'upgraded' | 'busy-skipped' | 'halted';
-/** The per-agent EXECUTE result. `detail` carries the green version or halt reason. */
+export type HaltReason = 'bad-release' | 'relaunch-unconfirmed';
+/** The per-agent EXECUTE result. `detail` carries a human-readable summary. */
 export interface AgentRollResult {
     readonly agent: string;
     readonly outcome: RollOutcome;
+    /** Set only when `outcome === 'halted'` — see `HaltReason`. */
+    readonly reason?: HaltReason;
     readonly detail?: string;
 }
+/**
+ * The roll's TOUCHED-CONFIG-SURFACE UNION (macf#722 Fix B, corrected naming
+ * macf#725) — the path globs `rollFleet`'s pre-flight config-dirty gate checks
+ * for uncommitted tracked changes before touching an agent.
+ *
+ * **This is a UNION, not an "operator-preserved" set** (the DR-037 Amendment B
+ * naming was a misnomer, corrected here macf#725): it spans BOTH (a) the files
+ * `macf update` OVERWRITES (the managed surface — canonical rules/scripts/hooks
+ * under `.claude/**`, `.macf/*`) and (b) the files `restart-self` would STASH
+ * (the operator surface — `settings.local.json`, `rules/project/**`,
+ * `env.local.*`, `CLAUDE.md`, a hand-authored `claude.sh`). Both halves answer
+ * the SAME pre-flight question the gate asks — "would this roll's `upgrade` +
+ * `restart` silently clobber or stash SOMETHING uncommitted on this surface?"
+ * — so both belong in the one union the gate checks, regardless of which half
+ * of DR-029's managed-vs-operator taxonomy a given path falls in.
+ *
+ * Sourced from DR-029's Amendment (2026-06-27, macf#598) managed-vs-operator
+ * taxonomy: `.claude/**` (rules + scripts + settings — managed AND
+ * project-tier), `CLAUDE.md` (operator workbench doc), `claude.sh` (the
+ * launcher — operator-preserved when hand-authored/header-less, and harmless
+ * to include even when macf-managed since a macf-managed copy is never
+ * legitimately "dirty" outside an in-flight `macf update`), and `env.local.*`
+ * (the operator-custom env extension slot — see
+ * `design/decisions/DR-029-substrate-config-via-init-and-reintegrate.md`
+ * Amendment table). Deliberately excludes macf-managed/regenerated files
+ * (`env.*` canonical seven, `host-prelude.sh`) that are ONLY ever touched by
+ * `macf update` itself and never by an operator — dirtiness there pre-flight
+ * would still be a genuine conflict (someone hand-edited a regenerated file),
+ * so those ARE covered by `.claude/**`/`.macf/*` where they live; the excluded
+ * class is narrower than "everything macf update touches."
+ *
+ * NOTE (macf#724 review, still applicable post-rename): this gate's set is
+ * intentionally a slight SUPERSET of DR-029's *regenerate*-boundary for
+ * `claude.sh`. The two answer DIFFERENT questions — this gate: "does the roll
+ * need to OBJECT before touching this agent?"; DR-029's header-conditional
+ * rule: "should `macf update` REGENERATE this file?". So do NOT "align"
+ * `claude.sh` here to DR-029's header-conditional form: that would reintroduce
+ * the roll-past-a-dirty-managed-`claude.sh` hole. Unconditional here is
+ * harmless when clean (nothing flagged) and protective when dirty, regardless
+ * of header.
+ */
+export declare const ROLL_TOUCHED_CONFIG_PATTERNS: readonly [".claude/**", "CLAUDE.md", "claude.sh", "env.local.*"];
 /** The result of rolling ONE fleet (the EXECUTE path). */
 export interface FleetRollResult {
     readonly results: readonly AgentRollResult[];
@@ -48,6 +125,8 @@ export interface FleetRollResult {
     readonly upgraded: number;
     /** Count of agents skipped because they were busy. */
     readonly busySkipped: number;
+    /** Count of agents skipped because their config surface was dirty (macf#722 Fix B). */
+    readonly configDirtySkipped: number;
 }
 /** Progress events for CLI rendering (the RESULT objects are what tests assert on). */
 export type UpgradeEvent = {
@@ -64,18 +143,42 @@ export type UpgradeEvent = {
     readonly agent: string;
     readonly from: string | null;
     readonly to: string;
+}
+/**
+ * The pre-flight OBJECT (macf#725) — the agent's touched-config surface has
+ * UNCOMMITTED changes. `files` is the exact uncommitted-path list;
+ * `message` is the ready-to-forward, agent-directed text (inspect + commit /
+ * delete / gitignore, then re-run). Fired INSTEAD of any mutation — nothing
+ * on this agent was touched.
+ */
+ | {
+    readonly kind: 'config-dirty-skip';
+    readonly agent: string;
+    readonly files: readonly string[];
+    readonly message: string;
 } | {
     readonly kind: 'busy-skip';
     readonly agent: string;
     readonly waited: boolean;
-} | {
+}
+/**
+ * The post-upgrade modified-files report (macf#725) — fired once an agent is
+ * confirmed green, before advancing to the next agent. `files` lists what
+ * `macf update` regenerated (and `restart-self` deliberately left
+ * uncommitted) in the relaunched agent's workspace; `message` is the
+ * ready-to-forward, agent-directed text (review with `git diff` + commit /
+ * act as needed).
+ */
+ | {
     readonly kind: 'upgraded';
     readonly agent: string;
     readonly version: string;
+    readonly modifiedFiles: readonly string[];
+    readonly message: string;
 } | {
     readonly kind: 'halt';
     readonly agent: string;
-    readonly reason: string;
+    readonly reason: HaltReason;
     readonly lastVersion: string | null;
 };
 /**
@@ -96,6 +199,16 @@ export interface RollFleetOptions {
     readonly waitTimeoutMs?: number;
     /** Re-poll interval while waiting for idle (ms). */
     readonly waitPollMs?: number;
+    /**
+     * `--force` (macf#722 Fix B / macf#725): roll an agent EVEN IF its config
+     * surface is dirty PRE-flight — bypasses the pre-flight config-dirty OBJECT
+     * gate. Once bypassed for an agent, that agent's `restart` is ALSO told
+     * `leaveConfigUncommitted: true` (same as the normal clean-path transaction)
+     * — `--force` means "roll anyway," not "stash the pre-existing dirt," so the
+     * pre-existing uncommitted files are left in place exactly like `macf
+     * update`'s own regeneration would be.
+     */
+    readonly force?: boolean;
 }
 /** Injected side-effect seams for the roll (all fakeable in tests). */
 export interface RollFleetDeps {
@@ -119,11 +232,46 @@ export declare const DEFAULT_WAIT_TIMEOUT_MS = 300000;
 /** Default `--wait` re-poll interval (ms). */
 export declare const DEFAULT_WAIT_POLL_MS = 5000;
 /**
- * Roll ONE fleet: for every `behind` plan (in order) run the busy-gate → upgrade
- * → restart → verify-green cycle, HALTING the roll on the first agent that fails
- * to come up green. Non-`behind` plans are ignored (planned skips). Busy agents
- * are skipped + reported (never a halt); with `wait`, they are re-polled for idle
- * first. The verb order + HALT semantics mirror `fleet/upgrade.sh`'s `roll_one`.
+ * Build the agent-directed OBJECT message for a config-dirty pre-flight skip
+ * (macf#725). Pure — exported for CLI-rendering reuse / tests.
+ */
+export declare function buildConfigDirtyMessage(agent: string, files: readonly string[]): string;
+/**
+ * Build the agent-directed post-upgrade modified-files message (macf#725).
+ * Pure — exported for CLI-rendering reuse / tests.
+ *
+ * The message names the intended STEADY-STATE explicitly: a clean roll LEAVES
+ * this regeneration uncommitted (so the agent can review it), which means the
+ * NEXT roll's pre-flight WILL re-flag these same files as uncommitted unless
+ * they're committed. That re-flag is intended hygiene ("commit last update's
+ * regen before upgrading again"), not a surprise — so the message tells the
+ * agent to commit them, not merely review them.
+ */
+export declare function buildModifiedFilesMessage(agent: string, files: readonly string[]): string;
+/**
+ * Roll ONE fleet: for every `behind` plan (in order) run the PRE-FLIGHT gates
+ * (config-dirty, then busy) → upgrade → restart → verify-green cycle, HALTING
+ * the roll on the first agent whose post-restart state isn't confirmed-green.
+ * Non-`behind` plans are ignored (planned skips). Pre-flight-gated agents are
+ * skipped + reported and NEVER a halt (they were never mutated, so continuing
+ * is always safe) — config-dirty is checked first because a busy-but-clean
+ * agent may still become idle later (`--wait`), whereas a dirty agent is
+ * skip-only regardless. With `wait`, a busy agent is re-polled for idle first.
+ * The verb order + HALT semantics mirror `fleet/upgrade.sh`'s `roll_one`.
+ *
+ * **Transactional + OBJECT-with-message revision (macf#725).** The pre-flight
+ * config-dirty gate is the ONLY decision point that inspects PRE-upgrade
+ * state: clean (or explicitly `--force`-bypassed) ⇒ the roll enters the
+ * transaction and MUST complete it — `upgrade` → `restart(agent,
+ * { leaveConfigUncommitted: true })` always runs together, never mutating
+ * `upgrade` without following through to `restart`. Dirty (and not forced) ⇒
+ * the roll does NOTHING to this agent (no `upgrade`, no `restart`) and OBJECTS
+ * via `onEvent` with the exact file list + an agent-directed message —
+ * reconcile is MANUAL: the agent (or operator) resolves the flagged files and
+ * a clean re-run completes it. This replaces the earlier (macf#722 Fix B)
+ * silent-skip + separately-force-stashed-restart shape, which could dirty the
+ * workspace via `upgrade` and then have `restart-self`'s OWN guard refuse —
+ * aborting mid-transaction with the workspace already mutated.
  */
 export declare function rollFleet(plans: readonly AgentUpgradePlan[], opts: RollFleetOptions, deps: RollFleetDeps): Promise<FleetRollResult>;
 /** Options for the multi-fleet orchestrator. */
@@ -134,9 +282,11 @@ export interface UpgradeFleetsOptions extends RollFleetOptions {
 /** Injected seams for the multi-fleet orchestrator. */
 export interface UpgradeFleetsDeps {
     /**
-     * Resolve the driver for a fleet (registry identifier). Production binds
-     * `createVmDriverFromConfig` at a representative workspace; tests return a fake.
-     * `null` ⇒ the fleet cannot be reached (skip + report, NOT a halt).
+     * Resolve the driver for a fleet (a PROJECT identifier — macf#710). Production
+     * binds `createVmDriverFromConfig` at a representative workspace OF THAT
+     * PROJECT (so the driver's mTLS CA + registry namespace are the project's own,
+     * never a sibling project's sharing the same registry scope); tests return a
+     * fake. `null` ⇒ the fleet cannot be reached (skip + report, NOT a halt).
      */
     readonly resolveDriver: (fleet: string) => Promise<FleetDriver | null>;
     readonly verifyGreen: (opts: VerifyGreenOptions) => Promise<VerifyGreenResult>;
@@ -161,11 +311,14 @@ export interface FleetUpgradeReport {
     readonly halted: boolean;
 }
 /**
- * Orchestrate a rolling upgrade across the ORDERED `fleets` (registry
- * identifiers), fleet-by-fleet. Each fleet is probed + planned; in EXECUTE mode
- * it is then rolled, and a HALT in one fleet STOPS the whole run — later fleets
- * are never started (a bad release cannot cascade across fleets). An unresolvable
- * fleet is skipped + reported and does NOT halt the run.
+ * Orchestrate a rolling upgrade across the ORDERED `fleets` (PROJECT
+ * identifiers — macf#710: a "fleet" == a project, which owns its own CA +
+ * registry namespace + version cadence; a profile/org registry scope hosting N
+ * projects yields N fleets here, never one), fleet-by-fleet. Each fleet is
+ * probed + planned; in EXECUTE mode it is then rolled, and a HALT in one fleet
+ * STOPS the whole run — later fleets are never started (a bad release cannot
+ * cascade across fleets). An unresolvable fleet is skipped + reported and does
+ * NOT halt the run.
  */
 export declare function upgradeFleets(fleets: readonly string[], opts: UpgradeFleetsOptions, deps: UpgradeFleetsDeps): Promise<FleetUpgradeReport>;
 //# sourceMappingURL=fleet-upgrade.d.ts.map

package/dist/fleet-upgrade.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fleet-upgrade.d.ts","sourceRoot":"","sources":["../src/fleet-upgrade.ts"],"names":[],"mappings":"AAiCA,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACjE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,KAAK,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAE/E;;;;;;;;;GASG;AACH,MAAM,MAAM,kBAAkB,GAAG,QAAQ,GAAG,WAAW,GAAG,SAAS,CAAC;AAEpE,oFAAoF;AACpF,MAAM,WAAW,gBAAgB;IAC/B,gDAAgD;IAChD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,8DAA8D;IAC9D,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,6FAA6F;IAC7F,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC,iFAAiF;IACjF,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,+DAA+D;IAC/D,QAAQ,CAAC,WAAW,EAAE,kBAAkB,CAAC;CAC1C;AAED;;;;;;GAMG;AACH,MAAM,MAAM,WAAW,GAAG,UAAU,GAAG,cAAc,GAAG,QAAQ,CAAC;AAEjE,uFAAuF;AACvF,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC;IAC9B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,0DAA0D;AAC1D,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,OAAO,EAAE,SAAS,eAAe,EAAE,CAAC;IAC7C,yEAAyE;IACzE,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,+CAA+C;IAC/C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,sDAAsD;IACtD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,uFAAuF;AACvF,MAAM,MAAM,YAAY,GACpB;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACzG;IAAE,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACnF;IAAE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GAC1G;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;CAAE,GAChF;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAC/E;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC;AAEpH;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,SAAS,eAAe,EAAE,EACnC,KAAK,EAAE,UAAU,EACjB,aAAa,EAAE,MAAM,GACpB,SAAS,gBAAgB,EAAE,CAqB7B;AAED,wCAAwC;AACxC,MAAM,WAAW,gBAAgB;IAC/B,6EAA6E;IAC7E,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,oDAAoD;IACpD,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,oEAAoE;IACpE,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB,gFAAgF;IAChF,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,oDAAoD;IACpD,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,uEAAuE;AACvE,MAAM,WAAW,aAAa;IAC5B,wDAAwD;IACxD,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B;;;;OAIG;IACH,QAAQ,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,kBAAkB,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAC/E,yFAAyF;IACzF,QAAQ,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C,6EAA6E;IAC7E,QAAQ,CAAC,GAAG,EAAE,MAAM,MAAM,CAAC;IAC3B,gDAAgD;IAChD,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,EAAE,YAAY,KAAK,IAAI,CAAC;CAC/C;AAED,sEAAsE;AACtE,eAAO,MAAM,uBAAuB,SAAU,CAAC;AAC/C,8CAA8C;AAC9C,eAAO,MAAM,oBAAoB,OAAQ,CAAC;AAmB1C;;;;;;GAMG;AACH,wBAAsB,SAAS,CAC7B,KAAK,EAAE,SAAS,gBAAgB,EAAE,EAClC,IAAI,EAAE,gBAAgB,EACtB,IAAI,EAAE,aAAa,GAClB,OAAO,CAAC,eAAe,CAAC,CAiD1B;AAED,gDAAgD;AAChD,MAAM,WAAW,oBAAqB,SAAQ,gBAAgB;IAC5D,mFAAmF;IACnF,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B;AAED,uDAAuD;AACvD,MAAM,WAAW,iBAAiB;IAChC;;;;OAIG;IACH,QAAQ,CAAC,aAAa,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IACvE,QAAQ,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,kBAAkB,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAC/E,QAAQ,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C,QAAQ,CAAC,GAAG,EAAE,MAAM,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,EAAE,YAAY,KAAK,IAAI,CAAC;CAC/C;AAED,2CAA2C;AAC3C,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,SAAS,gBAAgB,EAAE,CAAC;IAC5C,oCAAoC;IACpC,QAAQ,CAAC,MAAM,CAAC,EAAE,eAAe,CAAC;IAClC,yEAAyE;IACzE,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,sDAAsD;AACtD,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,SAAS,eAAe,EAAE,CAAC;IAC5C,iFAAiF;IACjF,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,SAAS,MAAM,EAAE,EACzB,IAAI,EAAE,oBAAoB,EAC1B,IAAI,EAAE,iBAAiB,GACtB,OAAO,CAAC,kBAAkB,CAAC,CAsC7B"}
+{"version":3,"file":"fleet-upgrade.d.ts","sourceRoot":"","sources":["../src/fleet-upgrade.ts"],"names":[],"mappings":"AAgEA,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACjE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,KAAK,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAE/E;;;;;;;;;GASG;AACH,MAAM,MAAM,kBAAkB,GAAG,QAAQ,GAAG,WAAW,GAAG,SAAS,CAAC;AAEpE,oFAAoF;AACpF,MAAM,WAAW,gBAAgB;IAC/B,gDAAgD;IAChD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,6FAA6F;IAC7F,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC,iFAAiF;IACjF,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,+DAA+D;IAC/D,QAAQ,CAAC,WAAW,EAAE,kBAAkB,CAAC;CAC1C;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,MAAM,WAAW,GAAG,UAAU,GAAG,cAAc,GAAG,sBAAsB,GAAG,QAAQ,CAAC;AAE1F;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,UAAU,GAAG,aAAa,GAAG,sBAAsB,CAAC;AAEhE,+EAA+E;AAC/E,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC;IAC9B,+DAA+D;IAC/D,QAAQ,CAAC,MAAM,CAAC,EAAE,UAAU,CAAC;IAC7B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,eAAO,MAAM,4BAA4B,kEAK/B,CAAC;AAEX,0DAA0D;AAC1D,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,OAAO,EAAE,SAAS,eAAe,EAAE,CAAC;IAC7C,yEAAyE;IACzE,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,+CAA+C;IAC/C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,sDAAsD;IACtD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,uFAAuF;IACvF,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;CACrC;AAED,uFAAuF;AACvF,MAAM,MAAM,YAAY,GACpB;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACzG;IAAE,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACnF;IAAE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;CAAE;AAC5G;;;;;;GAMG;GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAC3H;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;CAAE;AAClF;;;;;;;GAOG;GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACpJ;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC;AAExH;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,SAAS,eAAe,EAAE,EACnC,KAAK,EAAE,UAAU,EACjB,aAAa,EAAE,MAAM,GACpB,SAAS,gBAAgB,EAAE,CAqB7B;AAED,wCAAwC;AACxC,MAAM,WAAW,gBAAgB;IAC/B,6EAA6E;IAC7E,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,oDAAoD;IACpD,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,oEAAoE;IACpE,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB,gFAAgF;IAChF,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,oDAAoD;IACpD,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;;;;;OAQG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,uEAAuE;AACvE,MAAM,WAAW,aAAa;IAC5B,wDAAwD;IACxD,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B;;;;OAIG;IACH,QAAQ,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,kBAAkB,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAC/E,yFAAyF;IACzF,QAAQ,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C,6EAA6E;IAC7E,QAAQ,CAAC,GAAG,EAAE,MAAM,MAAM,CAAC;IAC3B,gDAAgD;IAChD,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,EAAE,YAAY,KAAK,IAAI,CAAC;CAC/C;AAED,sEAAsE;AACtE,eAAO,MAAM,uBAAuB,SAAU,CAAC;AAC/C,8CAA8C;AAC9C,eAAO,MAAM,oBAAoB,OAAQ,CAAC;AAuC1C;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAMvF;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAMzF;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAsB,SAAS,CAC7B,KAAK,EAAE,SAAS,gBAAgB,EAAE,EAClC,IAAI,EAAE,gBAAgB,EACtB,IAAI,EAAE,aAAa,GAClB,OAAO,CAAC,eAAe,CAAC,CAuF1B;AAED,gDAAgD;AAChD,MAAM,WAAW,oBAAqB,SAAQ,gBAAgB;IAC5D,mFAAmF;IACnF,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B;AAED,uDAAuD;AACvD,MAAM,WAAW,iBAAiB;IAChC;;;;;;OAMG;IACH,QAAQ,CAAC,aAAa,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IACvE,QAAQ,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,kBAAkB,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAC/E,QAAQ,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C,QAAQ,CAAC,GAAG,EAAE,MAAM,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,EAAE,YAAY,KAAK,IAAI,CAAC;CAC/C;AAED,2CAA2C;AAC3C,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,SAAS,gBAAgB,EAAE,CAAC;IAC5C,oCAAoC;IACpC,QAAQ,CAAC,MAAM,CAAC,EAAE,eAAe,CAAC;IAClC,yEAAyE;IACzE,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,sDAAsD;AACtD,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,SAAS,eAAe,EAAE,CAAC;IAC5C,iFAAiF;IACjF,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B;AAED;;;;;;;;;GASG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,SAAS,MAAM,EAAE,EACzB,IAAI,EAAE,oBAAoB,EAC1B,IAAI,EAAE,iBAAiB,GACtB,OAAO,CAAC,kBAAkB,CAAC,CAsC7B"}

package/dist/fleet-upgrade.js

@@ -7,21 +7,46 @@
  * logic lives in macf-core; the per-runtime driver bodies live in `packages/macf`
  * or a future K8s package). It NEVER touches `/proc`, tmux, `capture-pane`, or
  * kubectl — it drives entirely off the injected `FleetDriver` verbs
- * (`probe`/`discoverWorkspaces`/`isBusy`/`upgrade`/`restart`) plus an injected
- * `verifyGreen` runner, so the SAME sequencer rolls a VM tmux fleet, a macOS
- * host, and a far-future K8s deployment by swapping only the driver.
+ * (`probe`/`discoverWorkspaces`/`isBusy`/`listDirtyConfig`/`upgrade`/`restart`/
+ * `listModifiedFiles`) plus an injected `verifyGreen` runner, so the SAME
+ * sequencer rolls a VM tmux fleet, a macOS host, and a far-future K8s deployment
+ * by swapping only the driver.
  *
  * The state machine (per fleet, one agent at a time):
  *
  *   probe() + discoverWorkspaces()
  *     → for each member whose RUNNING version < target (compareSemver):
- *         busy-gate (driver.isBusy → busy ⇒ SKIP+REPORT, or `--wait` for idle)
- *           → driver.upgrade(agent)
- *           → driver.restart(agent)
- *           → verifyGreen({agent, target})   // re-resolves the fresh endpoint
- *               → green ⇒ next agent
- *               → NOT green within the budget ⇒ HALT the roll (a bad release
- *                 stalls at agent 1 and CANNOT brick the fleet)
+ *         PRE-FLIGHT gate (BEFORE any mutation — never touches the agent):
+ *           config-dirty-gate (driver.listDirtyConfig → non-empty ⇒ OBJECT:
+ *             SKIP+REPORT the list of uncommitted files + an agent-directed
+ *             message to inspect-and-commit-or-delete-or-gitignore-then-retry,
+ *             unless `--force`; macf#725 — TRANSACTIONAL revision of macf#722
+ *             Fix B: rather than silently stashing operator dirt, the roll
+ *             OBJECTS and does NOTHING until the agent resolves it)
+ *           busy-gate (driver.isBusy → busy ⇒ SKIP+REPORT, or `--wait` for idle)
+ *         → driver.upgrade(agent)        // dirties the managed config surface —
+ *                                        // this is EXPECTED, not a fault
+ *         → driver.restart(agent, { leaveConfigUncommitted: true })
+ *             // relaunches WITHOUT stashing macf update's own regeneration —
+ *             // the pre-flight gate already proved the ONLY dirt is the
+ *             // upgrade's, so leaving it uncommitted (visible via `git status`
+ *             // in the relaunched agent) is safe + intended (macf#725)
+ *         → verifyGreen({agent, target})   // re-resolves the fresh endpoint
+ *             each poll, over a relaunch-aware grace budget (`--verify-timeout`)
+ *             → green on TARGET ⇒ driver.listModifiedFiles(agent) → emit an
+ *               agent-directed "review + commit what macf update regenerated"
+ *               message + list, THEN next agent (`upgraded`)
+ *             → confirmed back on the OLD (pre-upgrade) version ⇒ HALT the
+ *               roll, reason `bad-release` (a crash-loop / stuck-old-process
+ *               release stalls at agent 1 and CANNOT brick the fleet)
+ *             → past-grace still NOT confirmed green (down / unreachable /
+ *               some other unknown version) ⇒ HALT the roll, reason
+ *               `relaunch-unconfirmed` — this is NOT a continue: "not yet
+ *               green" cannot distinguish a slow-but-fine relaunch from a
+ *               release that crashes on startup (which never shows the old
+ *               version either), so continuing past an unconfirmed agent
+ *               would risk cascading a crash-on-start release across the
+ *               fleet (macf#722 Fix A)
  *
  * Multi-fleet (`--fleet a,b,c`) rolls fleet-by-fleet: each fleet's roll must
  * finish without a HALT before the next fleet starts (a bad release in fleet-1
@@ -29,8 +54,61 @@
  *
  * DRY-RUN is the default at the command boundary: `execute: false` computes +
  * reports the PLAN (probe + classify) and performs NO driver mutations.
+ *
+ * **Reconcile is MANUAL this iteration (macf#725).** The config-dirty OBJECT
+ * path surfaces the dirt via `onEvent` + a non-mutating skip; it does NOT
+ * auto-resolve (no auto-stash, no auto-commit, no auto-delete). A clean
+ * re-run, after the agent (or operator) resolves the flagged files, completes
+ * the roll for that agent.
  */
 import { compareSemver } from './semver.js';
+/**
+ * The roll's TOUCHED-CONFIG-SURFACE UNION (macf#722 Fix B, corrected naming
+ * macf#725) — the path globs `rollFleet`'s pre-flight config-dirty gate checks
+ * for uncommitted tracked changes before touching an agent.
+ *
+ * **This is a UNION, not an "operator-preserved" set** (the DR-037 Amendment B
+ * naming was a misnomer, corrected here macf#725): it spans BOTH (a) the files
+ * `macf update` OVERWRITES (the managed surface — canonical rules/scripts/hooks
+ * under `.claude/**`, `.macf/*`) and (b) the files `restart-self` would STASH
+ * (the operator surface — `settings.local.json`, `rules/project/**`,
+ * `env.local.*`, `CLAUDE.md`, a hand-authored `claude.sh`). Both halves answer
+ * the SAME pre-flight question the gate asks — "would this roll's `upgrade` +
+ * `restart` silently clobber or stash SOMETHING uncommitted on this surface?"
+ * — so both belong in the one union the gate checks, regardless of which half
+ * of DR-029's managed-vs-operator taxonomy a given path falls in.
+ *
+ * Sourced from DR-029's Amendment (2026-06-27, macf#598) managed-vs-operator
+ * taxonomy: `.claude/**` (rules + scripts + settings — managed AND
+ * project-tier), `CLAUDE.md` (operator workbench doc), `claude.sh` (the
+ * launcher — operator-preserved when hand-authored/header-less, and harmless
+ * to include even when macf-managed since a macf-managed copy is never
+ * legitimately "dirty" outside an in-flight `macf update`), and `env.local.*`
+ * (the operator-custom env extension slot — see
+ * `design/decisions/DR-029-substrate-config-via-init-and-reintegrate.md`
+ * Amendment table). Deliberately excludes macf-managed/regenerated files
+ * (`env.*` canonical seven, `host-prelude.sh`) that are ONLY ever touched by
+ * `macf update` itself and never by an operator — dirtiness there pre-flight
+ * would still be a genuine conflict (someone hand-edited a regenerated file),
+ * so those ARE covered by `.claude/**`/`.macf/*` where they live; the excluded
+ * class is narrower than "everything macf update touches."
+ *
+ * NOTE (macf#724 review, still applicable post-rename): this gate's set is
+ * intentionally a slight SUPERSET of DR-029's *regenerate*-boundary for
+ * `claude.sh`. The two answer DIFFERENT questions — this gate: "does the roll
+ * need to OBJECT before touching this agent?"; DR-029's header-conditional
+ * rule: "should `macf update` REGENERATE this file?". So do NOT "align"
+ * `claude.sh` here to DR-029's header-conditional form: that would reintroduce
+ * the roll-past-a-dirty-managed-`claude.sh` hole. Unconditional here is
+ * harmless when clean (nothing flagged) and protective when dirty, regardless
+ * of header.
+ */
+export const ROLL_TOUCHED_CONFIG_PATTERNS = [
+    '.claude/**',
+    'CLAUDE.md',
+    'claude.sh',
+    'env.local.*',
+];
 /**
  * Classify each discovered fleet member against the target version. PURE — no
  * driver, no clock, no network. The single source of the behind/at-target/offline
@@ -53,7 +131,7 @@ export function planFleetUpgrade(members, state, targetVersion) {
         }
         return {
             agent: m.agent,
-            fleet: m.registry,
+            fleet: m.project,
             runningVersion,
             pinnedVersion: m.versionPin,
             disposition,
@@ -82,20 +160,107 @@ async function waitForIdle(agent, opts, deps) {
     return false;
 }
 /**
- * Roll ONE fleet: for every `behind` plan (in order) run the busy-gate → upgrade
- * → restart → verify-green cycle, HALTING the roll on the first agent that fails
- * to come up green. Non-`behind` plans are ignored (planned skips). Busy agents
- * are skipped + reported (never a halt); with `wait`, they are re-polled for idle
- * first. The verb order + HALT semantics mirror `fleet/upgrade.sh`'s `roll_one`.
+ * Classify a failed verify-green against the agent's PRE-upgrade running
+ * version (macf#722 Fix A). `bad-release` requires POSITIVE confirmation that
+ * the agent came back reachable at the OLD pin — everything else (never
+ * reachable, or reachable at some other unrecognized version) is
+ * `relaunch-unconfirmed`. Never infer `bad-release` from absence of success;
+ * only from the last-seen version actually matching the old pin.
+ */
+function classifyHalt(green, oldVersion) {
+    if (green.reason === 'wrong-version' &&
+        green.lastVersion !== null &&
+        oldVersion !== null &&
+        compareSemver(green.lastVersion, oldVersion) === 0) {
+        return 'bad-release';
+    }
+    return 'relaunch-unconfirmed';
+}
+/**
+ * Build the agent-directed OBJECT message for a config-dirty pre-flight skip
+ * (macf#725). Pure — exported for CLI-rendering reuse / tests.
+ */
+export function buildConfigDirtyMessage(agent, files) {
+    return (`Fleet upgrade skipped ${agent} — these files have uncommitted changes ` +
+        `\`macf update\` would overwrite: ${files.join(', ')}. Inspect each and ` +
+        `commit, delete, or .gitignore it, then re-run the upgrade.`);
+}
+/**
+ * Build the agent-directed post-upgrade modified-files message (macf#725).
+ * Pure — exported for CLI-rendering reuse / tests.
+ *
+ * The message names the intended STEADY-STATE explicitly: a clean roll LEAVES
+ * this regeneration uncommitted (so the agent can review it), which means the
+ * NEXT roll's pre-flight WILL re-flag these same files as uncommitted unless
+ * they're committed. That re-flag is intended hygiene ("commit last update's
+ * regen before upgrading again"), not a surprise — so the message tells the
+ * agent to commit them, not merely review them.
+ */
+export function buildModifiedFilesMessage(agent, files) {
+    return (`Fleet upgrade regenerated these files in ${agent}'s workspace: ` +
+        `${files.join(', ')}. Review with \`git diff\` and commit them (so the next ` +
+        `upgrade's pre-flight doesn't re-flag them as uncommitted) or act as needed.`);
+}
+/**
+ * Roll ONE fleet: for every `behind` plan (in order) run the PRE-FLIGHT gates
+ * (config-dirty, then busy) → upgrade → restart → verify-green cycle, HALTING
+ * the roll on the first agent whose post-restart state isn't confirmed-green.
+ * Non-`behind` plans are ignored (planned skips). Pre-flight-gated agents are
+ * skipped + reported and NEVER a halt (they were never mutated, so continuing
+ * is always safe) — config-dirty is checked first because a busy-but-clean
+ * agent may still become idle later (`--wait`), whereas a dirty agent is
+ * skip-only regardless. With `wait`, a busy agent is re-polled for idle first.
+ * The verb order + HALT semantics mirror `fleet/upgrade.sh`'s `roll_one`.
+ *
+ * **Transactional + OBJECT-with-message revision (macf#725).** The pre-flight
+ * config-dirty gate is the ONLY decision point that inspects PRE-upgrade
+ * state: clean (or explicitly `--force`-bypassed) ⇒ the roll enters the
+ * transaction and MUST complete it — `upgrade` → `restart(agent,
+ * { leaveConfigUncommitted: true })` always runs together, never mutating
+ * `upgrade` without following through to `restart`. Dirty (and not forced) ⇒
+ * the roll does NOTHING to this agent (no `upgrade`, no `restart`) and OBJECTS
+ * via `onEvent` with the exact file list + an agent-directed message —
+ * reconcile is MANUAL: the agent (or operator) resolves the flagged files and
+ * a clean re-run completes it. This replaces the earlier (macf#722 Fix B)
+ * silent-skip + separately-force-stashed-restart shape, which could dirty the
+ * workspace via `upgrade` and then have `restart-self`'s OWN guard refuse —
+ * aborting mid-transaction with the workspace already mutated.
  */
 export async function rollFleet(plans, opts, deps) {
     const results = [];
     let upgraded = 0;
     let busySkipped = 0;
+    let configDirtySkipped = 0;
     for (const plan of plans) {
         if (plan.disposition !== 'behind')
             continue;
         const agent = plan.agent;
+        // PRE-FLIGHT config-dirty gate. By-design inter-roll STEADY-STATE
+        // (macf#725): a clean roll LEAVES `macf update`'s regeneration uncommitted
+        // (so the relaunched agent reviews it — see `restart`'s
+        // `leaveConfigUncommitted` below + `buildModifiedFilesMessage`).
+        // Consequently, the NEXT roll's pre-flight WILL object on that
+        // still-uncommitted regen. This is INTENDED HYGIENE — "commit last update's
+        // regen before upgrading again" — NOT the mid-run abort bug this revision
+        // fixed: it is self-resolving via the object-with-message (the agent
+        // commits the flagged regen, then a clean re-run rolls). The alternative —
+        // auto-committing the deterministic canonical regen at end-of-transaction
+        // (zero inter-roll friction, but trades away the agent's review-visibility
+        // of what changed) — is a DEFERRED future option, the operator's call.
+        if (!opts.force) {
+            const dirtyFiles = await deps.driver.listDirtyConfig(agent);
+            if (dirtyFiles.length > 0) {
+                configDirtySkipped += 1;
+                const message = buildConfigDirtyMessage(agent, dirtyFiles);
+                results.push({
+                    agent,
+                    outcome: 'config-dirty-skipped',
+                    detail: message,
+                });
+                deps.onEvent?.({ kind: 'config-dirty-skip', agent, files: dirtyFiles, message });
+                continue;
+            }
+        }
         let busy = await deps.driver.isBusy(agent);
         let waited = false;
         if (busy && opts.wait) {
@@ -108,9 +273,16 @@ export async function rollFleet(plans, opts, deps) {
             deps.onEvent?.({ kind: 'busy-skip', agent, waited });
             continue;
         }
+        // --- ENTERING THE TRANSACTION: upgrade + restart run together, always. ---
         deps.onEvent?.({ kind: 'roll-start', agent, from: plan.runningVersion, to: opts.targetVersion });
         await deps.driver.upgrade(agent);
-        await deps.driver.restart(agent);
+        // The pre-flight gate above (clean, or explicitly `--force`-bypassed) is
+        // the only thing that decided whether to enter this transaction. Once
+        // entered, `restart` must NOT stash or refuse on the config surface —
+        // `upgrade` (macf update) is EXPECTED to have just dirtied it, and that
+        // dirt (plus any pre-existing `--force`-bypassed dirt) is deliberately
+        // LEFT UNCOMMITTED for the relaunched agent to see via `git status`.
+        await deps.driver.restart(agent, { leaveConfigUncommitted: true });
         const green = await deps.verifyGreen({
             agent,
             targetVersion: opts.targetVersion,
@@ -118,27 +290,33 @@ export async function rollFleet(plans, opts, deps) {
         });
         if (green.ok) {
             upgraded += 1;
-            results.push({ agent, outcome: 'upgraded', detail: green.version });
-            deps.onEvent?.({ kind: 'upgraded', agent, version: green.version });
+            const modifiedFiles = await deps.driver.listModifiedFiles(agent);
+            const message = buildModifiedFilesMessage(agent, modifiedFiles);
+            results.push({ agent, outcome: 'upgraded', detail: message });
+            deps.onEvent?.({ kind: 'upgraded', agent, version: green.version, modifiedFiles, message });
             continue;
         }
-        const reason = green.reason;
+        const reason = classifyHalt(green, plan.runningVersion);
         results.push({
             agent,
             outcome: 'halted',
-            detail: `verify-green ${reason} (last=${green.lastVersion ?? 'down'})`,
+            reason,
+            detail: `${reason}: verify-green ${green.reason} (last=${green.lastVersion ?? 'down'})`,
         });
         deps.onEvent?.({ kind: 'halt', agent, reason, lastVersion: green.lastVersion });
-        return { results, halted: true, upgraded, busySkipped };
+        return { results, halted: true, upgraded, busySkipped, configDirtySkipped };
     }
-    return { results, halted: false, upgraded, busySkipped };
+    return { results, halted: false, upgraded, busySkipped, configDirtySkipped };
 }
 /**
- * Orchestrate a rolling upgrade across the ORDERED `fleets` (registry
- * identifiers), fleet-by-fleet. Each fleet is probed + planned; in EXECUTE mode
- * it is then rolled, and a HALT in one fleet STOPS the whole run — later fleets
- * are never started (a bad release cannot cascade across fleets). An unresolvable
- * fleet is skipped + reported and does NOT halt the run.
+ * Orchestrate a rolling upgrade across the ORDERED `fleets` (PROJECT
+ * identifiers — macf#710: a "fleet" == a project, which owns its own CA +
+ * registry namespace + version cadence; a profile/org registry scope hosting N
+ * projects yields N fleets here, never one), fleet-by-fleet. Each fleet is
+ * probed + planned; in EXECUTE mode it is then rolled, and a HALT in one fleet
+ * STOPS the whole run — later fleets are never started (a bad release cannot
+ * cascade across fleets). An unresolvable fleet is skipped + reported and does
+ * NOT halt the run.
  */
 export async function upgradeFleets(fleets, opts, deps) {
     const reports = [];
@@ -150,7 +328,7 @@ export async function upgradeFleets(fleets, opts, deps) {
             deps.onEvent?.({ kind: 'fleet-skipped', fleet, reason: 'driver-unresolved' });
             continue;
         }
-        const members = driver.discoverWorkspaces().filter((r) => r.registry === fleet);
+        const members = driver.discoverWorkspaces().filter((r) => r.project === fleet);
         const state = await driver.probe();
         const plans = planFleetUpgrade(members, state, opts.targetVersion);
         const behind = plans.filter((p) => p.disposition === 'behind').length;

package/dist/fleet-upgrade.js.map

@@ -1 +1 @@
-{"version":3,"file":"fleet-upgrade.js","sourceRoot":"","sources":["../src/fleet-upgrade.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAmE5C;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAC9B,OAAmC,EACnC,KAAiB,EACjB,aAAqB;IAErB,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7D,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACvB,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACjC,MAAM,cAAc,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACpE,IAAI,WAA+B,CAAC;QACpC,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;YAC5B,WAAW,GAAG,SAAS,CAAC;QAC1B,CAAC;aAAM,IAAI,aAAa,CAAC,cAAc,EAAE,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7D,WAAW,GAAG,WAAW,CAAC;QAC5B,CAAC;aAAM,CAAC;YACN,WAAW,GAAG,QAAQ,CAAC;QACzB,CAAC;QACD,OAAO;YACL,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,KAAK,EAAE,CAAC,CAAC,QAAQ;YACjB,cAAc;YACd,aAAa,EAAE,CAAC,CAAC,UAAU;YAC3B,WAAW;SACZ,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAkCD,sEAAsE;AACtE,MAAM,CAAC,MAAM,uBAAuB,GAAG,OAAO,CAAC;AAC/C,8CAA8C;AAC9C,MAAM,CAAC,MAAM,oBAAoB,GAAG,KAAK,CAAC;AAE1C;;;;;GAKG;AACH,KAAK,UAAU,WAAW,CAAC,KAAa,EAAE,IAAsB,EAAE,IAAmB;IACnF,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,IAAI,uBAAuB,CAAC;IAC7D,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,IAAI,oBAAoB,CAAC;IACrD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACzB,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,GAAG,MAAM,EAAE,CAAC;QACnC,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACvB,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;IACtD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,KAAkC,EAClC,IAAsB,EACtB,IAAmB;IAEnB,MAAM,OAAO,GAAsB,EAAE,CAAC;IACtC,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,WAAW,GAAG,CAAC,CAAC;IAEpB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,WAAW,KAAK,QAAQ;YAAE,SAAS;QAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QAEzB,IAAI,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC3C,IAAI,MAAM,GAAG,KAAK,CAAC;QACnB,IAAI,IAAI,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACtB,MAAM,GAAG,IAAI,CAAC;YACd,IAAI,GAAG,CAAC,CAAC,MAAM,WAAW,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;QACjD,CAAC;QACD,IAAI,IAAI,EAAE,CAAC;YACT,WAAW,IAAI,CAAC,CAAC;YACjB,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;YACtG,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;YACrD,SAAS;QACX,CAAC;QAED,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,cAAc,EAAE,EAAE,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC;QACjG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACjC,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACjC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC;YACnC,KAAK;YACL,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,SAAS,EAAE,IAAI,CAAC,eAAe;SAChC,CAAC,CAAC;QAEH,IAAI,KAAK,CAAC,EAAE,EAAE,CAAC;YACb,QAAQ,IAAI,CAAC,CAAC;YACd,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YACpE,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YACpE,SAAS;QACX,CAAC;QAED,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;QAC5B,OAAO,CAAC,IAAI,CAAC;YACX,KAAK;YACL,OAAO,EAAE,QAAQ;YACjB,MAAM,EAAE,gBAAgB,MAAM,UAAU,KAAK,CAAC,WAAW,IAAI,MAAM,GAAG;SACvE,CAAC,CAAC;QACH,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;QAChF,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC;IAC1D,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC;AAC3D,CAAC;AAwCD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAAyB,EACzB,IAA0B,EAC1B,IAAuB;IAEvB,MAAM,OAAO,GAAsB,EAAE,CAAC;IACtC,IAAI,MAAM,GAAG,KAAK,CAAC;IAEnB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QAC/C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC,CAAC;YACjE,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC,CAAC;YAC9E,SAAS;QACX,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,CAAC,kBAAkB,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC;QAChF,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;QACnE,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,MAAM,CAAC;QACtE,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QAE5E,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;YAC/B,SAAS;QACX,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE;YAC1C,MAAM;YACN,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,OAAO,EAAE,IAAI,CAAC,OAAO;SACtB,CAAC,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QACvC,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAClB,MAAM,GAAG,IAAI,CAAC;YACd,MAAM,CAAC,kEAAkE;QAC3E,CAAC;IACH,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,aAAa,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AACjE,CAAC"}
+{"version":3,"file":"fleet-upgrade.js","sourceRoot":"","sources":["../src/fleet-upgrade.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8DG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAmF5C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG;IAC1C,YAAY;IACZ,WAAW;IACX,WAAW;IACX,aAAa;CACL,CAAC;AAwCX;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAC9B,OAAmC,EACnC,KAAiB,EACjB,aAAqB;IAErB,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7D,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACvB,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACjC,MAAM,cAAc,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACpE,IAAI,WAA+B,CAAC;QACpC,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;YAC5B,WAAW,GAAG,SAAS,CAAC;QAC1B,CAAC;aAAM,IAAI,aAAa,CAAC,cAAc,EAAE,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7D,WAAW,GAAG,WAAW,CAAC;QAC5B,CAAC;aAAM,CAAC;YACN,WAAW,GAAG,QAAQ,CAAC;QACzB,CAAC;QACD,OAAO;YACL,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,KAAK,EAAE,CAAC,CAAC,OAAO;YAChB,cAAc;YACd,aAAa,EAAE,CAAC,CAAC,UAAU;YAC3B,WAAW;SACZ,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AA4CD,sEAAsE;AACtE,MAAM,CAAC,MAAM,uBAAuB,GAAG,OAAO,CAAC;AAC/C,8CAA8C;AAC9C,MAAM,CAAC,MAAM,oBAAoB,GAAG,KAAK,CAAC;AAE1C;;;;;GAKG;AACH,KAAK,UAAU,WAAW,CAAC,KAAa,EAAE,IAAsB,EAAE,IAAmB;IACnF,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,IAAI,uBAAuB,CAAC;IAC7D,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,IAAI,oBAAoB,CAAC;IACrD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACzB,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,GAAG,MAAM,EAAE,CAAC;QACnC,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACvB,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;IACtD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,YAAY,CAAC,KAAiD,EAAE,UAAyB;IAChG,IACE,KAAK,CAAC,MAAM,KAAK,eAAe;QAChC,KAAK,CAAC,WAAW,KAAK,IAAI;QAC1B,UAAU,KAAK,IAAI;QACnB,aAAa,CAAC,KAAK,CAAC,WAAW,EAAE,UAAU,CAAC,KAAK,CAAC,EAClD,CAAC;QACD,OAAO,aAAa,CAAC;IACvB,CAAC;IACD,OAAO,sBAAsB,CAAC;AAChC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAAa,EAAE,KAAwB;IAC7E,OAAO,CACL,yBAAyB,KAAK,0CAA0C;QACxE,oCAAoC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,qBAAqB;QACzE,4DAA4D,CAC7D,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,yBAAyB,CAAC,KAAa,EAAE,KAAwB;IAC/E,OAAO,CACL,4CAA4C,KAAK,gBAAgB;QACjE,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,0DAA0D;QAC7E,6EAA6E,CAC9E,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,KAAkC,EAClC,IAAsB,EACtB,IAAmB;IAEnB,MAAM,OAAO,GAAsB,EAAE,CAAC;IACtC,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,IAAI,kBAAkB,GAAG,CAAC,CAAC;IAE3B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,WAAW,KAAK,QAAQ;YAAE,SAAS;QAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QAEzB,kEAAkE;QAClE,2EAA2E;QAC3E,wDAAwD;QACxD,iEAAiE;QACjE,+DAA+D;QAC/D,4EAA4E;QAC5E,0EAA0E;QAC1E,qEAAqE;QACrE,2EAA2E;QAC3E,0EAA0E;QAC1E,2EAA2E;QAC3E,uEAAuE;QACvE,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAChB,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;YAC5D,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC1B,kBAAkB,IAAI,CAAC,CAAC;gBACxB,MAAM,OAAO,GAAG,uBAAuB,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;gBAC3D,OAAO,CAAC,IAAI,CAAC;oBACX,KAAK;oBACL,OAAO,EAAE,sBAAsB;oBAC/B,MAAM,EAAE,OAAO;iBAChB,CAAC,CAAC;gBACH,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC;gBACjF,SAAS;YACX,CAAC;QACH,CAAC;QAED,IAAI,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC3C,IAAI,MAAM,GAAG,KAAK,CAAC;QACnB,IAAI,IAAI,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACtB,MAAM,GAAG,IAAI,CAAC;YACd,IAAI,GAAG,CAAC,CAAC,MAAM,WAAW,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;QACjD,CAAC;QACD,IAAI,IAAI,EAAE,CAAC;YACT,WAAW,IAAI,CAAC,CAAC;YACjB,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;YACtG,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;YACrD,SAAS;QACX,CAAC;QAED,4EAA4E;QAC5E,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,cAAc,EAAE,EAAE,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC;QACjG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACjC,yEAAyE;QACzE,sEAAsE;QACtE,sEAAsE;QACtE,wEAAwE;QACxE,uEAAuE;QACvE,qEAAqE;QACrE,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,sBAAsB,EAAE,IAAI,EAAE,CAAC,CAAC;QACnE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC;YACnC,KAAK;YACL,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,SAAS,EAAE,IAAI,CAAC,eAAe;SAChC,CAAC,CAAC;QAEH,IAAI,KAAK,CAAC,EAAE,EAAE,CAAC;YACb,QAAQ,IAAI,CAAC,CAAC;YACd,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;YACjE,MAAM,OAAO,GAAG,yBAAyB,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;YAChE,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;YAC9D,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC,CAAC;YAC5F,SAAS;QACX,CAAC;QAED,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;QACxD,OAAO,CAAC,IAAI,CAAC;YACX,KAAK;YACL,OAAO,EAAE,QAAQ;YACjB,MAAM;YACN,MAAM,EAAE,GAAG,MAAM,kBAAkB,KAAK,CAAC,MAAM,UAAU,KAAK,CAAC,WAAW,IAAI,MAAM,GAAG;SACxF,CAAC,CAAC;QACH,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;QAChF,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC;IAC9E,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC;AAC/E,CAAC;AA0CD;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAAyB,EACzB,IAA0B,EAC1B,IAAuB;IAEvB,MAAM,OAAO,GAAsB,EAAE,CAAC;IACtC,IAAI,MAAM,GAAG,KAAK,CAAC;IAEnB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QAC/C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC,CAAC;YACjE,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC,CAAC;YAC9E,SAAS;QACX,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,CAAC,kBAAkB,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,KAAK,CAAC,CAAC;QAC/E,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;QACnE,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,MAAM,CAAC;QACtE,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QAE5E,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;YAC/B,SAAS;QACX,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE;YAC1C,MAAM;YACN,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,OAAO,EAAE,IAAI,CAAC,OAAO;SACtB,CAAC,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QACvC,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAClB,MAAM,GAAG,IAAI,CAAC;YACd,MAAM,CAAC,kEAAkE;QAC3E,CAAC;IACH,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,aAAa,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AACjE,CAAC"}