@m8t-stack/cli 0.2.121 → 0.2.123

package/dist/cli.js

@@ -1454,7 +1454,7 @@ function installFoundryDnsShim() {
 }
 
 // src/lib/package-version.ts
-var CLI_VERSION = "0.2.121";
+var CLI_VERSION = "0.2.123";
 
 // src/lib/render-error.ts
 init_errors();
@@ -16353,8 +16353,8 @@ function isM8tBrainMarker(yamlText) {
   }
   if (!parsed || typeof parsed !== "object") return false;
   const root = parsed;
-  const isObj4 = (v) => typeof v === "object" && v !== null;
-  return isObj4(root.engine) || isObj4(root.processes) || isObj4(root.link);
+  const isObj3 = (v) => typeof v === "object" && v !== null;
+  return isObj3(root.engine) || isObj3(root.processes) || isObj3(root.link);
 }
 async function createBlankRepo(args) {
   const res = await fetch(`https://api.github.com/orgs/${args.org}/repos`, {
@@ -19485,15 +19485,16 @@ async function stagePublicImageIfNeeded(args) {
   const notes = [];
   const { host, repo, tag } = parseImageRef(args.image);
   if (isAcrHost(host)) return { image: args.image, staged: false, notes };
+  const sourceRef = args.digest ? `${host}/${repo}@${args.digest}` : args.image;
   const acrName = deriveAcrName(args.project.accountName);
   const resourceGroup = resourceGroupFromScope(args.project.accountScope);
-  args.onProgress?.(`staging ${args.image} into ${acrName} (server-side import)\u2026`);
+  args.onProgress?.(`staging ${sourceRef} into ${acrName} (server-side import)\u2026`);
   const acr = await ensureAcr({ acrName, resourceGroup, location: args.project.region });
   if (acr.created) notes.push(`created ACR '${acrName}' in ${resourceGroup} for hosted-agent images.`);
-  const { imported } = await ensureImageInAcr({ acrName, sourceRef: args.image, repo, tag });
+  const { imported } = await ensureImageInAcr({ acrName, sourceRef, repo, tag });
   const acrRef = `${acr.loginServer}/${repo}:${tag}`;
   notes.push(
-    imported ? `imported ${args.image} \u2192 ${acrRef} (server-side, no local build).` : `image already present in ${acrName}; using ${acrRef}.`
+    imported ? `imported ${sourceRef} \u2192 ${acrRef} (server-side, no local build).` : `image already present in ${acrName}; using ${acrRef}.`
   );
   return { image: acrRef, staged: true, notes };
 }
@@ -20536,6 +20537,12 @@ var AzureExecDeployCommand = class extends M8tCommand {
   name = Option31.String();
   image = Option31.String("--image");
   imageTag = Option31.String("--image-tag");
+  // `sha256:<hex>` to import FROM, when the caller knows exactly which bytes it
+  // wants. The cloud installer passes the release manifest's digest so the
+  // executor an install deploys is the one the RELEASE names, not whatever the
+  // engine's own baked pin happened to be — the same correction the gateway got.
+  // The destination in the customer's ACR stays tagged; only the source is pinned.
+  imageDigest = Option31.String("--image-digest", { description: "Import the image from this digest instead of the tag. Must be sha256:<64 hex>." });
   size = Option31.String("--size");
   scope = Option31.String("--scope");
   resourceGroup = Option31.String("--resource-group");
@@ -20624,7 +20631,18 @@ var AzureExecDeployCommand = class extends M8tCommand {
       currentMetadata = { ...current.metadata ?? {} };
     } catch {
     }
-    const staged = await stagePublicImageIfNeeded({ image: requestedImage, project });
+    const imageDigest = typeof this.imageDigest === "string" ? this.imageDigest.trim() : "";
+    if (imageDigest && !/^sha256:[0-9a-f]{64}$/.test(imageDigest)) {
+      throw new LocalCliError({
+        code: "AZURE_EXEC_IMAGE_DIGEST_INVALID",
+        message: `--image-digest must be sha256:<64 hex>, got ${JSON.stringify(imageDigest)}.`
+      });
+    }
+    const staged = await stagePublicImageIfNeeded({
+      image: requestedImage,
+      project,
+      ...imageDigest ? { digest: imageDigest } : {}
+    });
     for (const n of staged.notes) {
       warnings.add(n);
     }
@@ -22659,6 +22677,13 @@ var PlatformStatusCommand = class extends M8tCommand {
           kind: "platform-status",
           gateway: resourceGroup,
           targetVersion: manifest.platform.tag,
+          // What the install RECORDS it is running, as opposed to what the channel
+          // currently offers (targetVersion). `managed` already says whether a stamp
+          // exists; this says what it holds — the row the updater diffs against and
+          // fleet telemetry aggregates, which was previously unreadable from this
+          // command at all. null when unstamped, never absent, so a consumer can
+          // tell "no stamp" from "field not emitted by an older CLI".
+          installedVersion: stamp?.platformVersion ?? null,
           managed: stamp !== null,
           rows,
           ...verify ? { verify } : {}
@@ -22666,7 +22691,9 @@ var PlatformStatusCommand = class extends M8tCommand {
       );
       return 0;
     }
-    log(colors.field(`target: ${manifest.platform.tag}${stamp === null ? "  (unmanaged \u2014 no stamp found)" : ""}`));
+    log(colors.field(
+      `installed: ${stamp?.platformVersion ?? "(none)"}    target: ${manifest.platform.tag}` + (stamp === null ? "  (unmanaged \u2014 no stamp found)" : "")
+    ));
     this.context.stdout.write(this.renderRows(rows) + "\n");
     if (verify) {
       log("");
@@ -24533,74 +24560,26 @@ import { DefaultAzureCredential as DefaultAzureCredential20, ManagedIdentityCred
 init_errors();
 
 // src/lib/platform-stamp-seed.ts
-var IMAGE_COMPONENTS = ["gateway", "codingAgent", "azureExecutor"];
-var BARE_SEMVER = /^\d+\.\d+\.\d+$/;
+var BARE_SEMVER = /^\d+\.\d+\.\d+(?:-canary\.(?:0|[1-9]\d*))?$/;
 function isBarePlatformVersion(v) {
   return typeof v === "string" && BARE_SEMVER.test(v);
 }
-function isObj3(v) {
-  return typeof v === "object" && v !== null && !Array.isArray(v);
-}
-function validateDescriptor(raw) {
-  const errors = [];
-  if (!isObj3(raw)) return ["descriptor is not an object"];
-  if (raw.schemaVersion !== 1) errors.push("schemaVersion must be the integer 1");
-  if (typeof raw.platformVersion !== "string" || !BARE_SEMVER.test(raw.platformVersion)) {
-    errors.push(`platformVersion must be a bare X.Y.Z release version, got ${JSON.stringify(raw.platformVersion)}`);
-  }
-  if (!isObj3(raw.generatedFrom)) {
-    errors.push("generatedFrom is required");
-  } else {
-    if (typeof raw.generatedFrom.commit !== "string") {
-      errors.push("generatedFrom.commit is required");
-    }
-    if (typeof raw.generatedFrom.generatedAt !== "string") {
-      errors.push("generatedFrom.generatedAt is required");
-    }
-  }
-  const images = raw.images;
-  if (!isObj3(images)) {
-    errors.push("images is required");
-  } else {
-    for (const key2 of IMAGE_COMPONENTS) {
-      const img = images[key2];
-      if (!isObj3(img)) {
-        errors.push(`images.${key2} is required`);
-        continue;
-      }
-      if (typeof img.ref !== "string" || img.ref.length === 0) errors.push(`images.${key2}.ref is required`);
-      if (typeof img.tag !== "string" || img.tag.length === 0) errors.push(`images.${key2}.tag is required`);
-      if (typeof img.digest !== "string") errors.push(`images.${key2}.digest must be a string (may be empty)`);
-    }
-  }
-  const content = raw.content;
-  if (content !== void 0) {
-    if (!isObj3(content)) {
-      errors.push("content must be an object when present");
-    } else {
-      if (!isObj3(content.personas)) errors.push("content.personas must be an object");
-      if (typeof content.infra !== "string") errors.push("content.infra must be a string");
-      if (typeof content.brainSeedsRev !== "string") errors.push("content.brainSeedsRev must be a string");
-    }
-  }
-  return errors;
-}
-function buildSeedStamp(d, cliVersion, nowIso, platformVersionOverride) {
-  if (platformVersionOverride !== void 0 && !isBarePlatformVersion(platformVersionOverride)) {
-    throw new Error(`platformVersionOverride must be a bare X.Y.Z release version, got ${JSON.stringify(platformVersionOverride)}`);
+function buildSeedStamp(m, cliVersion, nowIso) {
+  if (!isBarePlatformVersion(m.platform.version)) {
+    throw new Error(`manifest platform.version must be a bare X.Y.Z release version, got ${JSON.stringify(m.platform.version)}`);
   }
   const img = (k) => ({
-    tag: d.images[k].tag,
-    digest: d.images[k].digest,
+    tag: m.components[k].tag,
+    digest: m.components[k].digest,
     state: "managed"
   });
   const personas = {};
-  for (const [name, treeSha] of Object.entries(d.content?.personas ?? {})) {
-    personas[name] = { treeSha, foundryVersion: "" };
+  for (const [name, item] of Object.entries(m.components.personas.items)) {
+    personas[name] = { treeSha: item.treeSha, foundryVersion: "" };
   }
   const stamp = {
     schemaVersion: 1,
-    platformVersion: platformTag(platformVersionOverride ?? d.platformVersion),
+    platformVersion: platformTag(m.platform.version),
     previousPlatformVersion: null,
     updatedAt: nowIso,
     lastResult: "success",
@@ -24611,22 +24590,16 @@ function buildSeedStamp(d, cliVersion, nowIso, platformVersionOverride) {
       codingAgent: img("codingAgent"),
       azureExecutor: img("azureExecutor"),
       personas,
-      infra: { treeSha: d.content?.infra ?? "" }
+      infra: { treeSha: m.components.infra?.treeSha ?? "" }
     }
   };
-  if (d.content?.brainSeedsRev) stamp.components.brainSeeds = { seedRev: d.content.brainSeedsRev };
+  const seedRev = seedSetRev(m);
+  if (seedRev) stamp.components.brainSeeds = { seedRev };
   return stamp;
 }
 
 // src/commands/platform/seed-stamp.ts
 async function seedStamp2(args) {
-  if (args.platformVersion !== void 0 && !isBarePlatformVersion(args.platformVersion)) {
-    throw new LocalCliError({
-      code: "PLATFORM_SEED_VERSION_INVALID",
-      message: `--platform-version must be a bare X.Y.Z release version, got ${JSON.stringify(args.platformVersion)}.`,
-      hint: "Pass the platform release this install is deploying, e.g. --platform-version 0.7.8. Omit the flag to stamp the version baked into the installer image."
-    });
-  }
   const readFileImpl = args.readFileImpl ?? ((p) => readFileSync20(p, "utf8"));
   const readStampImpl = args.readStampImpl ?? readStamp;
   const writeStampImpl = args.writeStampImpl ?? ((stamp2, o) => writeStamp({ ...o, stamp: stamp2 }));
@@ -24634,34 +24607,34 @@ async function seedStamp2(args) {
   const ctx = { credential: args.credential, subscriptionId: args.subscriptionId, resourceGroup: args.resourceGroup };
   let raw;
   try {
-    raw = JSON.parse(readFileImpl(args.descriptorPath));
+    raw = JSON.parse(readFileImpl(args.manifestPath));
   } catch (e) {
     throw new LocalCliError({
-      code: "PLATFORM_SEED_DESCRIPTOR_UNREADABLE",
-      message: `Cannot read the install descriptor at ${args.descriptorPath}.`,
-      hint: "The descriptor is generated at installer-image build time (scripts/install-descriptor-gen.mjs). An image built without that step cannot seed a stamp.",
+      code: "PLATFORM_SEED_MANIFEST_UNREADABLE",
+      message: `Cannot read the release manifest at ${args.manifestPath}.`,
+      hint: "The installer writes it at preflight after verifying its digest. Reaching this without one means the manifest gate was bypassed.",
       cause: e
     });
   }
-  const errors = validateDescriptor(raw);
+  const errors = validateManifest(raw);
   if (errors.length > 0) {
     throw new LocalCliError({
-      code: "PLATFORM_SEED_DESCRIPTOR_INVALID",
-      message: `The install descriptor at ${args.descriptorPath} is not valid: ${errors.join("; ")}.`,
-      hint: "Regenerate it with scripts/install-descriptor-gen.mjs."
+      code: "PLATFORM_SEED_MANIFEST_INVALID",
+      message: `The release manifest at ${args.manifestPath} is not valid: ${errors.join("; ")}.`,
+      hint: "This install was launched against a manifest the platform cannot read. Nothing was stamped."
     });
   }
-  const descriptor = raw;
+  const manifest = raw;
   const { accountName } = await discoverImpl(ctx);
   const existing = await readStampImpl(ctx);
   if (existing) {
     args.onProgress?.(`platform stamp already present (${existing.platformVersion}) \u2014 leaving it untouched.`);
     return { outcome: "already-stamped", platformVersion: existing.platformVersion, storageAccount: accountName };
   }
-  const stamp = buildSeedStamp(descriptor, CLI_VERSION, args.nowIso ?? (/* @__PURE__ */ new Date()).toISOString(), args.platformVersion);
+  const stamp = buildSeedStamp(manifest, CLI_VERSION, args.nowIso ?? (/* @__PURE__ */ new Date()).toISOString());
   await writeStampImpl(stamp, { ...ctx, onProgress: args.onProgress });
   return {
-    outcome: descriptor.content ? "seeded" : "seeded-partial",
+    outcome: "seeded",
     platformVersion: stamp.platformVersion,
     storageAccount: accountName,
     components: {
@@ -24674,11 +24647,10 @@ async function seedStamp2(args) {
 var PlatformSeedStampCommand = class extends M8tCommand {
   static paths = [["platform", "seed-stamp"]];
   static usage = Command39.Usage({
-    description: "INTERNAL: write the initial installed-state stamp from a build-time install descriptor.",
-    details: "Used by the cloud installer at the end of a from-zero install so the platform records which release it is running. Writes the stamp ONLY IF ABSENT \u2014 it never overwrites a stamp written by the converge engine, so a re-run or a container restart is harmless. Not a founder-facing command: to change what is installed, use 'm8t platform update'."
+    description: "INTERNAL: write the initial installed-state stamp from the release manifest this install deployed.",
+    details: "Used by the cloud installer at the end of a from-zero install so the platform records which release it is running. Seeds from the SAME document every later converge stamps from, so the first update diffs against a row that describes the same release. Writes the stamp ONLY IF ABSENT \u2014 it never overwrites a stamp written by the converge engine, so a re-run or a container restart is harmless. Not a founder-facing command: to change what is installed, use 'm8t platform update'."
   });
-  descriptor = Option36.String("--descriptor", { description: "Path to install-descriptor.json (baked into the installer image)." });
-  platformVersion = Option36.String("--platform-version", { description: "Bare X.Y.Z release this install is deploying. Overrides the descriptor's baked version, which lags by one declaration under publish->select. Omit to use the baked value." });
+  manifest = Option36.String("--manifest", { description: "Path to the fetched, digest-verified release manifest for the release this install deployed." });
   subscription = Option36.String("--subscription");
   resourceGroup = Option36.String("--resource-group");
   miClientId = Option36.String("--mi-client-id", { description: "Authenticate as this user-assigned managed identity instead of the ambient credential." });
@@ -24697,13 +24669,7 @@ var PlatformSeedStampCommand = class extends M8tCommand {
     };
     const credential2 = typeof this.miClientId === "string" && this.miClientId.trim().length > 0 ? new ManagedIdentityCredential4({ clientId: this.miClientId.trim() }) : new DefaultAzureCredential20();
     const result2 = await seedStamp2({
-      descriptorPath: need(this.descriptor, "--descriptor"),
-      // Absent flag ⇒ undefined ⇒ the descriptor's baked value. A flag PASSED but
-      // empty is not the same thing and is refused below, deliberately: the
-      // installer omits the flag entirely when it has nothing to say
-      // (installer/lib.sh), so an empty one means a launcher computed a version and
-      // got nothing — which should be loud, not silently absorbed by the fallback.
-      platformVersion: typeof this.platformVersion === "string" ? this.platformVersion.trim() : void 0,
+      manifestPath: need(this.manifest, "--manifest"),
       credential: credential2,
       subscriptionId: need(this.subscription, "--subscription"),
       resourceGroup: need(this.resourceGroup, "--resource-group"),
@@ -24719,23 +24685,141 @@ var PlatformSeedStampCommand = class extends M8tCommand {
   }
 };
 
-// src/commands/platform/gateway-adopt.ts
+// src/commands/platform/verify-content.ts
+import { readFileSync as readFileSync21 } from "fs";
 import { Command as Command40, Option as Option37 } from "clipanion";
+init_errors();
+
+// src/lib/platform-content-crosscheck.ts
+function crossCheckContent(manifest, content) {
+  const problems = [];
+  const manifestInfra = manifest.components.infra?.treeSha ?? "";
+  if (content.infra !== manifestInfra) {
+    problems.push({ field: "infra", baked: content.infra, manifest: manifestInfra });
+  }
+  for (const [name, item] of Object.entries(manifest.components.personas.items)) {
+    if (!Object.hasOwn(content.personas, name)) continue;
+    if (content.personas[name] !== item.treeSha) {
+      problems.push({ field: `personas.${name}`, baked: content.personas[name], manifest: item.treeSha });
+    }
+  }
+  const manifestSeeds = manifest.components.brainSeeds.items;
+  for (const entry of content.brainSeedsRev.split("|")) {
+    if (!entry) continue;
+    const first = entry.indexOf(":");
+    const second = entry.indexOf(":", first + 1);
+    if (first < 0 || second < 0) continue;
+    const name = entry.slice(0, first);
+    const sub = entry.slice(first + 1, second);
+    const baked = entry.slice(second + 1);
+    if (!Object.hasOwn(manifestSeeds, name)) continue;
+    const subtrees = manifestSeeds[name].subtrees;
+    if (!Object.hasOwn(subtrees, sub)) continue;
+    const want = subtrees[sub] ?? "-";
+    if (baked !== want) {
+      problems.push({ field: `brainSeeds.${name}.${sub}`, baked, manifest: want });
+    }
+  }
+  return problems;
+}
+function describeCrossCheckProblems(problems, version) {
+  if (problems.length === 0) return "";
+  const lines = problems.map((p) => `  ${p.field}
+    this image carries: ${p.baked}
+    ${version} names:    ${p.manifest}`);
+  return `This installer image does not carry the content that platform ${version} names.
+${lines.join("\n")}
+
+The install was stopped before anything was deployed. This is a fault in the release, not in your setup: the engine and the manifest were built from different trees. Get the newest CLI with \`npm install -g @m8t-stack/cli\` and start the install again.`;
+}
+
+// src/commands/platform/verify-content.ts
+function readJson(path47, what) {
+  let raw;
+  try {
+    raw = readFileSync21(path47, "utf8");
+  } catch (e) {
+    throw new LocalCliError({ code: "PLATFORM_VERIFY_READ_FAILED", message: `Could not read the ${what} at '${path47}': ${e.message}` });
+  }
+  try {
+    return JSON.parse(raw);
+  } catch (e) {
+    throw new LocalCliError({ code: "PLATFORM_VERIFY_PARSE_FAILED", message: `The ${what} at '${path47}' is not valid JSON: ${e.message}` });
+  }
+}
+var PlatformVerifyContentCommand = class extends M8tCommand {
+  static paths = [["platform", "verify-content"]];
+  static usage = Command40.Usage({
+    category: "Platform",
+    description: "INTERNAL: check that this installer image's baked content is what the release manifest names.",
+    details: "Run by the cloud installer at preflight, before anything is deployed. Compares the image's install-descriptor.json content block (persona tree SHAs, the deploy/ tree SHA, the brain-seed rev \u2014 all computed from the tree the image actually baked) against the same facts in the release manifest the install was handed. Exits non-zero, naming every field that disagrees and both values, when they do not match. Not a founder-facing command."
+  });
+  manifest = Option37.String("--manifest", { description: "Path to the fetched, digest-verified release manifest." });
+  descriptor = Option37.String("--descriptor", { description: "Path to install-descriptor.json (baked into this image)." });
+  // Not `async`: this command is pure file reads and a comparison, with no
+  // awaited work at all. The base class wants a Promise, so it gets one.
+  executeCommand() {
+    const need = (v, flag) => {
+      if (typeof v !== "string" || v.trim().length === 0) {
+        throw new LocalCliError({ code: "PLATFORM_VERIFY_ARG_MISSING", message: `${flag} is required.` });
+      }
+      return v.trim();
+    };
+    const manifestPath = need(this.manifest, "--manifest");
+    const rawManifest = readJson(manifestPath, "release manifest");
+    const manifestErrors = validateManifest(rawManifest);
+    if (manifestErrors.length > 0) {
+      throw new LocalCliError({
+        code: "PLATFORM_VERIFY_MANIFEST_INVALID",
+        message: `The release manifest at '${manifestPath}' is not a manifest this platform can read:
+  - ${manifestErrors.join("\n  - ")}`,
+        hint: "Nothing was compared and nothing was deployed. This is a fault in the release, not in your setup."
+      });
+    }
+    const manifest = rawManifest;
+    const descriptor = readJson(need(this.descriptor, "--descriptor"), "install descriptor");
+    const content = descriptor.content;
+    if (!content || typeof content.brainSeedsRev !== "string" || typeof content.infra !== "string" || typeof content.personas !== "object") {
+      throw new LocalCliError({
+        code: "PLATFORM_VERIFY_DESCRIPTOR_INCOMPLETE",
+        message: "This installer image's descriptor carries no usable content block, so there is nothing to check the release manifest against.",
+        hint: "The image was built without scripts/install-descriptor-gen.mjs, or built where it could not read its own tree. It is malformed \u2014 reinstall with the current CLI (`npm install -g @m8t-stack/cli`)."
+      });
+    }
+    const problems = crossCheckContent(manifest, {
+      personas: content.personas,
+      infra: content.infra,
+      brainSeedsRev: content.brainSeedsRev
+    });
+    if (problems.length > 0) {
+      throw new LocalCliError({
+        code: "PLATFORM_VERIFY_CONTENT_MISMATCH",
+        message: describeCrossCheckProblems(problems, manifest.platform.version)
+      });
+    }
+    this.context.stderr.write(`content verified against platform ${manifest.platform.version}
+`);
+    return Promise.resolve(0);
+  }
+};
+
+// src/commands/platform/gateway-adopt.ts
+import { Command as Command41, Option as Option38 } from "clipanion";
 import { DefaultAzureCredential as DefaultAzureCredential21 } from "@azure/identity";
 init_errors();
 var PlatformGatewayAdoptCommand = class extends M8tCommand {
   static paths = [["platform", "gateway", "adopt"]];
-  static usage = Command40.Usage({
+  static usage = Command41.Usage({
     description: "Explicitly authorize one legacy m8t ACR gateway for managed, digest-pinned updates.",
     details: "Fail-closed ownership transition. Reads the live gateway and ACR digest, requires the operator to repeat both exactly, verifies the generated legacy topology, and atomically writes the adoption marker with a pending platform update. Unadopted BYOC remains external."
   });
-  subscription = Option37.String("--subscription");
-  resourceGroup = Option37.String("--resource-group");
-  target = Option37.String("--target", { description: "Published platform target whose installer contains adoption support." });
-  expectedImage = Option37.String("--expected-image", { description: "Exact live legacy ACR image ref." });
-  expectedDigest = Option37.String("--expected-digest", { description: "Exact sha256 digest resolved from that ACR image." });
-  expectedAcrResourceId = Option37.String("--expected-acr-resource-id", { description: "Exact ARM id of the legacy ACR." });
-  output = Option37.String("--output");
+  subscription = Option38.String("--subscription");
+  resourceGroup = Option38.String("--resource-group");
+  target = Option38.String("--target", { description: "Published platform target whose installer contains adoption support." });
+  expectedImage = Option38.String("--expected-image", { description: "Exact live legacy ACR image ref." });
+  expectedDigest = Option38.String("--expected-digest", { description: "Exact sha256 digest resolved from that ACR image." });
+  expectedAcrResourceId = Option38.String("--expected-acr-resource-id", { description: "Exact ARM id of the legacy ACR." });
+  output = Option38.String("--output");
   async executeCommand() {
     const need = (v, flag) => {
       if (typeof v !== "string" || v.trim() === "") throw new LocalCliError({ code: "PLATFORM_GATEWAY_ADOPTION_ARG_MISSING", message: `${flag} is required.` });
@@ -24802,7 +24886,7 @@ var PlatformGatewayAdoptCommand = class extends M8tCommand {
 };
 
 // src/commands/platform/policy.ts
-import { Command as Command41, Option as Option38 } from "clipanion";
+import { Command as Command42, Option as Option39 } from "clipanion";
 import { DefaultAzureCredential as DefaultAzureCredential22, ManagedIdentityCredential as ManagedIdentityCredential5 } from "@azure/identity";
 init_errors();
 
@@ -24858,16 +24942,16 @@ async function readPolicy(opts) {
 // src/commands/platform/policy.ts
 var PlatformPolicyCommand = class extends M8tCommand {
   static paths = [["platform", "policy"]];
-  static usage = Command41.Usage({
+  static usage = Command42.Usage({
     description: "Show or set how this install handles available platform updates.",
     details: "Modes: 'notify-only' shows updates but never applies them; 'auto-critical' (the default when unset) applies critical releases without asking; 'auto-all' applies every release. Use 'notify-only' where something else already controls what is deployed.",
     examples: [["Show the current mode", "m8t platform policy"], ["Never apply automatically", "m8t platform policy --set notify-only"]]
   });
-  set = Option38.String("--set", { description: "notify-only | auto-critical | auto-all" });
-  subscription = Option38.String("--subscription");
-  resourceGroup = Option38.String("--resource-group");
-  miClientId = Option38.String("--mi-client-id");
-  output = Option38.String("--output");
+  set = Option39.String("--set", { description: "notify-only | auto-critical | auto-all" });
+  subscription = Option39.String("--subscription");
+  resourceGroup = Option39.String("--resource-group");
+  miClientId = Option39.String("--mi-client-id");
+  output = Option39.String("--output");
   async executeCommand() {
     const mode = resolveOutputMode(this.output, this.context.stdout);
     const need = (v, flag) => {
@@ -24913,7 +24997,7 @@ var PlatformPolicyCommand = class extends M8tCommand {
 };
 
 // src/commands/platform/enable-cost-report.ts
-import { Command as Command42, Option as Option39 } from "clipanion";
+import { Command as Command43, Option as Option40 } from "clipanion";
 
 // src/lib/wire-gateway-acs.ts
 init_rbac();
@@ -24953,18 +25037,18 @@ async function wireGatewayForAcs(args) {
 init_errors();
 var PlatformEnableCostReportCommand = class extends M8tCommand {
   static paths = [["platform", "enable-cost-report"]];
-  static usage = Command42.Usage({
+  static usage = Command43.Usage({
     description: "Wire the deployed gateway to send the bi-weekly cost report via ACS Email.",
     details: "Discovers the live gateway Container App, grants its managed identity Contributor at the ACS resource scope (authorising the ACS Email send), and sets M8T_ACS_ENDPOINT / M8T_ACS_SENDER / M8T_ENABLE_COST_REPORTER=1 on the gateway. Idempotent \u2014 safely re-runnable. ACS is created during the executor deploy; pass its endpoint, sender, and resource id (from that deploy or 'az communication list')."
   });
-  subscription = Option39.String("--subscription");
-  resourceGroup = Option39.String("--resource-group", {
+  subscription = Option40.String("--subscription");
+  resourceGroup = Option40.String("--resource-group", {
     description: "m8t resource group to disambiguate the gateway (multi-deployment subscriptions)."
   });
-  acsEndpoint = Option39.String("--acs-endpoint", { required: true, description: "ACS data-plane endpoint, e.g. https://acs-<name>.communication.azure.com/" });
-  acsSender = Option39.String("--acs-sender", { required: true, description: "Managed-domain sender address, e.g. DoNotReply@<guid>.azurecomm.net" });
-  acsResourceId = Option39.String("--acs-resource-id", { required: true, description: "ARM resource id of the acs-<name> Communication Service \u2014 the role-grant scope." });
-  output = Option39.String("--output");
+  acsEndpoint = Option40.String("--acs-endpoint", { required: true, description: "ACS data-plane endpoint, e.g. https://acs-<name>.communication.azure.com/" });
+  acsSender = Option40.String("--acs-sender", { required: true, description: "Managed-domain sender address, e.g. DoNotReply@<guid>.azurecomm.net" });
+  acsResourceId = Option40.String("--acs-resource-id", { required: true, description: "ARM resource id of the acs-<name> Communication Service \u2014 the role-grant scope." });
+  output = Option40.String("--output");
   async executeCommand() {
     const mode = resolveOutputMode(
       this.output,
@@ -25038,13 +25122,13 @@ var PlatformEnableCostReportCommand = class extends M8tCommand {
 };
 
 // src/commands/platform/email.ts
-import { Command as Command43, Option as Option40 } from "clipanion";
+import { Command as Command44, Option as Option41 } from "clipanion";
 import { DefaultAzureCredential as DefaultAzureCredential23 } from "@azure/identity";
 import { CommunicationServiceManagementClient as CommunicationServiceManagementClient2 } from "@azure/arm-communication";
 init_errors();
 var PlatformEmailCommand = class extends M8tCommand {
   static paths = [["platform", "email"]];
-  static usage = Command43.Usage({
+  static usage = Command44.Usage({
     description: "Turn outbound email (advisor handoffs) on or off for this install.",
     details: "`on` resolves the ACS sender (reusing an existing one, provisioning only if there is none), records the decision in the platform stamp, and reconciles the executor's environment. `off` records the decision and strips the executor's email wiring, leaving the ACS resource in place so turning it back on is a flag flip. Idempotent \u2014 re-running either direction is safe, and no new agent version is posted when nothing changes.",
     examples: [
@@ -25052,19 +25136,19 @@ var PlatformEmailCommand = class extends M8tCommand {
       ["Turn it off (a shared, public-facing deployment should stay off)", "m8t platform email off"]
     ]
   });
-  state = Option40.String({ required: true, name: "on|off" });
-  subscription = Option40.String("--subscription");
-  resourceGroup = Option40.String("--resource-group", {
+  state = Option41.String({ required: true, name: "on|off" });
+  subscription = Option41.String("--subscription");
+  resourceGroup = Option41.String("--resource-group", {
     description: "m8t resource group, to disambiguate in a multi-deployment subscription."
   });
-  agent = Option40.String("--agent", { description: `Executor agent name. Resolved by persona when omitted (usually ${EXECUTOR_AGENT_FALLBACK}).` });
-  kvUri = Option40.String("--kv-uri", {
+  agent = Option41.String("--agent", { description: `Executor agent name. Resolved by persona when omitted (usually ${EXECUTOR_AGENT_FALLBACK}).` });
+  kvUri = Option41.String("--kv-uri", {
     description: "Install's Key Vault URI. Only needed if no ACS is on record yet and one must be provisioned."
   });
-  endpoint = Option40.String("--endpoint", {
+  endpoint = Option41.String("--endpoint", {
     description: "Foundry project endpoint, to disambiguate a subscription holding several."
   });
-  output = Option40.String("--output");
+  output = Option41.String("--output");
   async executeCommand() {
     const wanted = this.state.trim().toLowerCase();
     if (wanted !== "on" && wanted !== "off") {
@@ -25214,45 +25298,45 @@ var PlatformEmailCommand = class extends M8tCommand {
 };
 
 // src/commands/platform/enable-auto-update.ts
-import { Command as Command44, Option as Option41 } from "clipanion";
+import { Command as Command45, Option as Option42 } from "clipanion";
 import { confirm as confirm6 } from "@inquirer/prompts";
 import { DefaultAzureCredential as DefaultAzureCredential24 } from "@azure/identity";
 init_errors();
 var PlatformEnableAutoUpdateCommand = class extends M8tCommand {
   static paths = [["platform", "enable-auto-update"]];
-  static usage = Command44.Usage({
+  static usage = Command45.Usage({
     category: "Platform",
     description: "Retrofit the auto-updater (MI + cron job + role assignments) onto an existing install.",
     details: "For an install that predates the Platform Update Framework: recovers the deployment's resource-name suffix (from the stamped system/infra-params row, or by verified derivation from the live gateway), recovers the other bicep params from live state (WITHOUT changing the deployed gateway image), and re-runs deploy/main.bicep with provisionUpdater=true \u2014 which provisions the updater managed identity, the cron Container Apps Job, and every role assignment (Owner@RG + Foundry User@account + Storage Table + Storage Blob + AcrPull), all scoped to the resource group. On success, backfills system/infra-params so future converges never have to re-derive the suffix. Idempotent \u2014 safe to re-run."
   });
-  subscription = Option41.String("--subscription");
-  resourceGroup = Option41.String("--resource-group", {
+  subscription = Option42.String("--subscription");
+  resourceGroup = Option42.String("--resource-group", {
     description: "m8t resource group to disambiguate the gateway (multi-deployment subscriptions)."
   });
-  suffix = Option41.String("--suffix", {
+  suffix = Option42.String("--suffix", {
     description: "The existing deployment's resource-name suffix. Required when it cannot be recovered from system/infra-params or the live gateway."
   });
-  installerImage = Option41.String("--installer-image", {
+  installerImage = Option42.String("--installer-image", {
     required: true,
     description: "Updater CA-Job image ref (the converge engine at the current release). Required \u2014 an empty image would skip provisioning."
   });
-  updateCron = Option41.String("--update-cron", {
+  updateCron = Option42.String("--update-cron", {
     description: "Cron schedule for the updater job (bicep default applies when omitted)."
   });
-  channelUrl = Option41.String("--channel-url", {
+  channelUrl = Option42.String("--channel-url", {
     description: "Release-channel URL the updater job polls (bicep default applies when omitted)."
   });
-  location = Option41.String("--location", {
+  location = Option42.String("--location", {
     description: "Region for the updater identity + job. Defaults to this install's stamped region, then to the resource group's existing resources."
   });
-  foundryTracing = Option41.String("--foundry-tracing", {
+  foundryTracing = Option42.String("--foundry-tracing", {
     description: "project | account | skip. Omitting it keeps the value already stamped on this install; only an install with nothing stamped falls through to the default (project)."
   });
-  endpoint = Option41.String("--endpoint", {
+  endpoint = Option42.String("--endpoint", {
     description: "Foundry project endpoint URL. Disambiguates the project in a multi-project subscription."
   });
-  yes = Option41.Boolean("--yes", false);
-  output = Option41.String("--output");
+  yes = Option42.Boolean("--yes", false);
+  output = Option42.String("--output");
   async executeCommand() {
     const mode = resolveOutputMode(
       this.output,
@@ -25433,7 +25517,7 @@ var PlatformEnableAutoUpdateCommand = class extends M8tCommand {
 };
 
 // src/commands/deploy.ts
-import { Command as Command45, Option as Option42 } from "clipanion";
+import { Command as Command46, Option as Option43 } from "clipanion";
 
 // src/lib/app-reg.ts
 init_esm();
@@ -25997,15 +26081,15 @@ function classifyWhatIf(changes) {
 var DEFAULT_IMAGE_REF = "ghcr.io/m8t-labs/m8t:latest";
 var DeployCommand = class extends M8tCommand {
   static paths = [["deploy"]];
-  static usage = Command45.Usage({
+  static usage = Command46.Usage({
     description: "Deploy (or update) the m8t gateway/webapp stack via Bicep.",
     details: "Ensures the Entra app reg (or pass --client-id to reuse an existing one \u2014 required if you can't create app regs), writes ~/.m8t/config.yaml, ensures the resource group, and runs deploy/main.bicep. The repo is located via ~/.m8t/repo-root."
   });
-  subscription = Option42.String("--subscription");
-  resourceGroup = Option42.String("--resource-group", "rg-m8t-stack");
-  location = Option42.String("--location", "eastus");
-  suffix = Option42.String("--suffix", "");
-  imageRef = Option42.String("--image-ref", DEFAULT_IMAGE_REF);
+  subscription = Option43.String("--subscription");
+  resourceGroup = Option43.String("--resource-group", "rg-m8t-stack");
+  location = Option43.String("--location", "eastus");
+  suffix = Option43.String("--suffix", "");
+  imageRef = Option43.String("--image-ref", DEFAULT_IMAGE_REF);
   // Gateway-only override. Empty ⇒ the gateway uses --image-ref, which is the
   // from-zero case. It exists because the gateway and the voice relay do NOT
   // always run the same image: a converge preserves a BYOC gateway on its own
@@ -26013,28 +26097,28 @@ var DeployCommand = class extends M8tCommand {
   // (`--what-if`) that can only express one image therefore reports the other
   // app as drift on every single run, forever — which is exactly what the
   // infra-drift gate did from 2026-08-11.
-  gatewayImageRef = Option42.String("--gateway-image-ref", "");
-  acrPullIdentity = Option42.String("--acrpull-identity");
-  acrResourceId = Option42.String("--acr-resource-id");
-  foundryEndpoint = Option42.String("--foundry-endpoint");
-  foundryResourceId = Option42.String("--foundry-resource-id");
-  foundryTracing = Option42.String("--foundry-tracing");
+  gatewayImageRef = Option43.String("--gateway-image-ref", "");
+  acrPullIdentity = Option43.String("--acrpull-identity");
+  acrResourceId = Option43.String("--acr-resource-id");
+  foundryEndpoint = Option43.String("--foundry-endpoint");
+  foundryResourceId = Option43.String("--foundry-resource-id");
+  foundryTracing = Option43.String("--foundry-tracing");
   // project | account | skip (bicep default: project)
-  clientId = Option42.String("--client-id");
-  whatIf = Option42.Boolean("--what-if", false);
+  clientId = Option43.String("--client-id");
+  whatIf = Option43.Boolean("--what-if", false);
   // Only meaningful with --what-if. Routes the comparison through the
   // value-free renderers (see ./lib/whatif-redact.js) instead of the default
   // before/after renderer. Defaults false so a local, interactive run keeps
   // showing values — that is the whole diagnostic point of --what-if.
   // Automation that forwards this output anywhere non-private (a CI log, an
   // issue) MUST pass --redact.
-  redact = Option42.Boolean("--redact", false);
-  output = Option42.String("--output");
+  redact = Option43.Boolean("--redact", false);
+  output = Option43.String("--output");
   // Subscription-scoped role assignments. Omitted ⇒ the template default (true).
   // Pass false when deploying as a principal scoped to the resource group only:
   // it cannot deploy at subscription scope, and those assignments persist
   // idempotently from the initial deployment anyway.
-  assignSubscriptionRoles = Option42.String("--assign-subscription-roles");
+  assignSubscriptionRoles = Option43.String("--assign-subscription-roles");
   /**
    * The installer image the updater Container-Apps Job runs.
    *
@@ -26045,23 +26129,23 @@ var DeployCommand = class extends M8tCommand {
    * than that — the comparison proposes REMOVING an updater job that exists and
    * should, and reports it as drift on every single run.
    */
-  installerImage = Option42.String("--installer-image");
+  installerImage = Option43.String("--installer-image");
   // Referee — all optional, undefined by default ⇒ the bicep defaults
   // apply (dormant: gatewayCpu=0.25, gatewayMemory=0.5Gi, every referee/exam var
   // empty). Only pass these when explicitly enabling the referee exam stack.
-  gatewayCpu = Option42.String("--gateway-cpu");
-  gatewayMemory = Option42.String("--gateway-memory");
-  refereeEnabled = Option42.String("--referee-enabled");
-  refereeBrainRepos = Option42.String("--referee-brain-repos");
-  refereeFeedRepo = Option42.String("--referee-feed-repo");
-  refereeInstallationId = Option42.String("--referee-installation-id");
-  refereeWebhookHmacKvUri = Option42.String("--referee-webhook-hmac-kv-uri");
-  examKvUri = Option42.String("--exam-kv-uri");
-  examLaWorkspaceId = Option42.String("--exam-la-workspace-id");
-  brainEvalDeployment = Option42.String("--brain-eval-deployment");
-  brainAppLogin = Option42.String("--brain-app-login");
-  refereeCheckpointDir = Option42.String("--referee-checkpoint-dir");
-  examApiBase = Option42.String("--exam-api-base");
+  gatewayCpu = Option43.String("--gateway-cpu");
+  gatewayMemory = Option43.String("--gateway-memory");
+  refereeEnabled = Option43.String("--referee-enabled");
+  refereeBrainRepos = Option43.String("--referee-brain-repos");
+  refereeFeedRepo = Option43.String("--referee-feed-repo");
+  refereeInstallationId = Option43.String("--referee-installation-id");
+  refereeWebhookHmacKvUri = Option43.String("--referee-webhook-hmac-kv-uri");
+  examKvUri = Option43.String("--exam-kv-uri");
+  examLaWorkspaceId = Option43.String("--exam-la-workspace-id");
+  brainEvalDeployment = Option43.String("--brain-eval-deployment");
+  brainAppLogin = Option43.String("--brain-app-login");
+  refereeCheckpointDir = Option43.String("--referee-checkpoint-dir");
+  examApiBase = Option43.String("--exam-api-base");
   async executeCommand() {
     const mode = resolveOutputMode(
       this.output,
@@ -26245,7 +26329,7 @@ var DeployCommand = class extends M8tCommand {
 
 // src/commands/eval/skill.ts
 import { spawnSync as spawnSync4 } from "child_process";
-import { Command as Command46, Option as Option43 } from "clipanion";
+import { Command as Command47, Option as Option44 } from "clipanion";
 init_errors();
 var DECISIONS = /* @__PURE__ */ new Set(["promote", "reject", "needs_review"]);
 var JUDGE_STATUSES = /* @__PURE__ */ new Set(["ok", "skipped", "unavailable"]);
@@ -26270,14 +26354,14 @@ function parseVerdict(stdout) {
 }
 var EvalSkillCommand = class extends M8tCommand {
   static paths = [["eval", "skill"]];
-  static usage = Command46.Usage({
+  static usage = Command47.Usage({
     description: "Vet one inbox skill candidate: promote / reject / needs_review. Shells out to the Python `brain-eval` core (override its path with $BRAIN_EVAL_BIN)."
   });
-  candidate = Option43.String();
-  skillsDir = Option43.String("--skills-dir");
-  noJudge = Option43.Boolean("--no-judge", false);
-  deployment = Option43.String("--deployment");
-  output = Option43.String("--output");
+  candidate = Option44.String();
+  skillsDir = Option44.String("--skills-dir");
+  noJudge = Option44.Boolean("--no-judge", false);
+  deployment = Option44.String("--deployment");
+  output = Option44.String("--output");
   executeCommand() {
     return Promise.resolve(this._runCommand());
   }
@@ -26334,9 +26418,9 @@ var EvalSkillCommand = class extends M8tCommand {
 
 // src/commands/eval/exam.ts
 import { spawnSync as spawnSync5 } from "child_process";
-import { writeFileSync as writeFileSync8, mkdirSync as mkdirSync6, readFileSync as readFileSync21, existsSync as existsSync20, readdirSync as readdirSync3 } from "fs";
+import { writeFileSync as writeFileSync8, mkdirSync as mkdirSync6, readFileSync as readFileSync22, existsSync as existsSync20, readdirSync as readdirSync3 } from "fs";
 import { join as join30 } from "path";
-import { Command as Command47, Option as Option44 } from "clipanion";
+import { Command as Command48, Option as Option45 } from "clipanion";
 init_errors();
 init_esm();
 function parseArmToken(tok, opts) {
@@ -26539,7 +26623,7 @@ function readSealedTaskIds(taskSetVersion, refereeHomeOut, env = process.env) {
   const manifestPath = join30(home, "tasksets", worker, versionDir, "manifest.yaml");
   let text;
   try {
-    text = readFileSync21(manifestPath, "utf-8");
+    text = readFileSync22(manifestPath, "utf-8");
   } catch (e) {
     throw new LocalCliError({
       code: "EXAM_REDACTION_UNSAFE",
@@ -26566,24 +26650,24 @@ function buildPlan(args) {
 }
 var EvalExamCommand = class extends M8tCommand {
   static paths = [["eval", "exam"]];
-  static usage = Command47.Usage({
+  static usage = Command48.Usage({
     description: "Run a brain exam: impact A/B + dream-delta. Resolves the plan, then shells out to the Python `brain-exam` orchestrator (override its path with $BRAIN_EXAM_BIN). Renders an ExamVerdict: three-valued verdict + power note + per-task flips."
   });
-  worker = Option44.String();
-  arms = Option44.String("--arms");
-  taskSet = Option44.String("--task-set");
-  examType = Option44.String("--exam-type");
-  skill = Option44.String("--skill");
-  reps = Option44.String("-n,--reps");
-  probes = Option44.String("--probes");
-  pool = Option44.String("--pool");
-  out = Option44.String("--out");
-  dryRun = Option44.Boolean("--dry-run", false);
-  keepArms = Option44.Boolean("--keep-arms", false);
-  allowStub = Option44.Boolean("--allow-stub", false);
-  deployment = Option44.String("--deployment");
-  output = Option44.String("--output");
-  observeWaitS = Option44.String("--observe-wait-s");
+  worker = Option45.String();
+  arms = Option45.String("--arms");
+  taskSet = Option45.String("--task-set");
+  examType = Option45.String("--exam-type");
+  skill = Option45.String("--skill");
+  reps = Option45.String("-n,--reps");
+  probes = Option45.String("--probes");
+  pool = Option45.String("--pool");
+  out = Option45.String("--out");
+  dryRun = Option45.Boolean("--dry-run", false);
+  keepArms = Option45.Boolean("--keep-arms", false);
+  allowStub = Option45.Boolean("--allow-stub", false);
+  deployment = Option45.String("--deployment");
+  output = Option45.String("--output");
+  observeWaitS = Option45.String("--observe-wait-s");
   async executeCommand() {
     await Promise.resolve();
     const worker = typeof this.worker === "string" ? this.worker : void 0;
@@ -26698,10 +26782,10 @@ var EvalExamCommand = class extends M8tCommand {
 };
 
 // src/commands/version.ts
-import { Command as Command48, Option as Option45 } from "clipanion";
+import { Command as Command49, Option as Option46 } from "clipanion";
 var VersionCommand = class extends M8tCommand {
   static paths = [["version"], ["--version"], ["-v"]];
-  static usage = Command48.Usage({
+  static usage = Command49.Usage({
     description: "Print the CLI version.",
     details: "Prints the m8t CLI version. With --verbose, also prints Node version and platform.",
     examples: [
@@ -26709,8 +26793,8 @@ var VersionCommand = class extends M8tCommand {
       ["Print as JSON", "$0 version --output json"]
     ]
   });
-  output = Option45.String("--output", { description: "pretty | json | auto (default)" });
-  verbose = Option45.Boolean("--verbose", false);
+  output = Option46.String("--output", { description: "pretty | json | auto (default)" });
+  verbose = Option46.Boolean("--verbose", false);
   executeCommand() {
     const mode = resolveOutputMode(
       this.output ?? "auto",
@@ -26741,18 +26825,18 @@ var VersionCommand = class extends M8tCommand {
 };
 
 // src/commands/whoami.ts
-import { Command as Command49, Option as Option46 } from "clipanion";
+import { Command as Command50, Option as Option47 } from "clipanion";
 var WhoamiCommand = class extends M8tCommand {
   static paths = [["whoami"]];
-  static usage = Command49.Usage({
+  static usage = Command50.Usage({
     description: "Show your identity + the gateway you'll talk to. Probes the backend."
   });
-  output = Option46.String("--output");
-  verbose = Option46.Boolean("--verbose", false);
-  subscription = Option46.String("--subscription", {
+  output = Option47.String("--output");
+  verbose = Option47.Boolean("--verbose", false);
+  subscription = Option47.String("--subscription", {
     description: "Azure subscription ID to discover gateway in (defaults to active az subscription)."
   });
-  resourceGroup = Option46.String("--resource-group", {
+  resourceGroup = Option47.String("--resource-group", {
     description: "m8t resource group to disambiguate the gateway (multi-deployment subscriptions)."
   });
   async executeCommand() {
@@ -26817,7 +26901,7 @@ var WhoamiCommand = class extends M8tCommand {
 };
 
 // src/commands/status.ts
-import { Command as Command50, Option as Option47 } from "clipanion";
+import { Command as Command51, Option as Option48 } from "clipanion";
 
 // src/lib/azd.ts
 init_errors();
@@ -26882,10 +26966,10 @@ async function resolveLocalContext() {
 // src/commands/status.ts
 var StatusCommand = class extends M8tCommand {
   static paths = [["status"]];
-  static usage = Command50.Usage({
+  static usage = Command51.Usage({
     description: "Show the local m8t context: identity, config.yaml, gateway cache, azd mode."
   });
-  output = Option47.String("--output");
+  output = Option48.String("--output");
   async executeCommand() {
     const mode = resolveOutputMode(
       this.output,
@@ -26923,7 +27007,7 @@ var StatusCommand = class extends M8tCommand {
 };
 
 // src/commands/doctor.ts
-import { Command as Command51, Option as Option48 } from "clipanion";
+import { Command as Command52, Option as Option49 } from "clipanion";
 import { DefaultAzureCredential as DefaultAzureCredential25 } from "@azure/identity";
 import * as fs30 from "fs";
 import * as os12 from "os";
@@ -27471,12 +27555,12 @@ function probeLegacyStateDir() {
 }
 var DoctorCommand = class extends M8tCommand {
   static paths = [["doctor"]];
-  static usage = Command51.Usage({
+  static usage = Command52.Usage({
     description: "Diagnose the local m8t setup: az login, config.yaml, gateway, Foundry data-plane."
   });
-  output = Option48.String("--output");
-  agent = Option48.String("--agent");
-  resourceGroup = Option48.String("--resource-group", {
+  output = Option49.String("--output");
+  agent = Option49.String("--agent");
+  resourceGroup = Option49.String("--resource-group", {
     description: "m8t resource group to disambiguate the gateway (multi-deployment subscriptions)."
   });
   async executeCommand() {
@@ -27666,7 +27750,7 @@ var DoctorCommand = class extends M8tCommand {
 };
 
 // src/commands/prereqs.ts
-import { Command as Command52, Option as Option49 } from "clipanion";
+import { Command as Command53, Option as Option50 } from "clipanion";
 init_errors();
 
 // src/lib/prereq-deps.ts
@@ -28372,7 +28456,7 @@ function renderVerdict(v) {
 }
 var PrereqsCommand = class extends M8tCommand {
   static paths = [["prereqs"]];
-  static usage = Command52.Usage({
+  static usage = Command53.Usage({
     description: "Check (and optionally fix) everything m8t needs \u2014 to install, or for you to use it.",
     details: "Runs one of two phases. With no platform discoverable it checks INSTALL prerequisites: your Azure sign-in, subscription and directory rights, resource-provider registrations, soft-deleted Cognitive Services accounts (they hold their model quota until purged), and model quota. With a platform live it checks USAGE prerequisites for the signed-in account: the sign-in redirect URI, Foundry data-plane access, and Key Vault secrets access. Pass --fix to repair what is repairable, and --fix --for <upn> to set a teammate up (usage phase only). Read-only without --fix.",
     examples: [
@@ -28383,15 +28467,15 @@ var PrereqsCommand = class extends M8tCommand {
       ["Set a teammate up (needs role-assignment rights)", "$0 prereqs --fix --for alice@contoso.com"]
     ]
   });
-  fix = Option49.Boolean("--fix", false, { description: "Repair what is repairable. Without it the command only reports." });
-  for_ = Option49.String("--for", { description: "UPN or object id of another person. Usage phase only." });
-  phase = Option49.String("--phase", { description: "Force 'install' or 'usage' instead of auto-detecting." });
-  region = Option49.String("--region", { description: "Target region. Enables the install-phase quota check, and judges soft-deleted accounts against the region you will install into (without it, they only warn)." });
-  model = Option49.String("--model", { description: `Model whose quota the install needs (default ${INSTALL_REASONING_MODEL}).` });
-  clientId = Option49.String("--client-id", { description: "A ready app registration, in place of directory-admin rights." });
-  subscription = Option49.String("--subscription");
-  resourceGroup = Option49.String("--resource-group");
-  output = Option49.String("--output");
+  fix = Option50.Boolean("--fix", false, { description: "Repair what is repairable. Without it the command only reports." });
+  for_ = Option50.String("--for", { description: "UPN or object id of another person. Usage phase only." });
+  phase = Option50.String("--phase", { description: "Force 'install' or 'usage' instead of auto-detecting." });
+  region = Option50.String("--region", { description: "Target region. Enables the install-phase quota check, and judges soft-deleted accounts against the region you will install into (without it, they only warn)." });
+  model = Option50.String("--model", { description: `Model whose quota the install needs (default ${INSTALL_REASONING_MODEL}).` });
+  clientId = Option50.String("--client-id", { description: "A ready app registration, in place of directory-admin rights." });
+  subscription = Option50.String("--subscription");
+  resourceGroup = Option50.String("--resource-group");
+  output = Option50.String("--output");
   async executeCommand() {
     const mode = resolveOutputMode(this.output, this.context.stdout);
     const json = mode === "json";
@@ -28447,7 +28531,7 @@ var PrereqsCommand = class extends M8tCommand {
 };
 
 // src/commands/switch.ts
-import { Command as Command53, Option as Option50 } from "clipanion";
+import { Command as Command54, Option as Option51 } from "clipanion";
 
 // src/lib/profiles.ts
 import * as fs31 from "fs/promises";
@@ -28587,14 +28671,14 @@ async function profileSwitch(name, asName) {
 init_errors();
 var SwitchCommand = class extends M8tCommand {
   static paths = [["switch"]];
-  static usage = Command53.Usage({
+  static usage = Command54.Usage({
     description: "Re-point local config at another deployment: --subscription <id|name> (discovery) or <profile>."
   });
-  profile = Option50.String({ required: false });
-  subscription = Option50.String("--subscription");
-  list = Option50.Boolean("--list", false);
-  as = Option50.String("--as");
-  output = Option50.String("--output");
+  profile = Option51.String({ required: false });
+  subscription = Option51.String("--subscription");
+  list = Option51.Boolean("--list", false);
+  as = Option51.String("--as");
+  output = Option51.String("--output");
   async executeCommand() {
     const mode = resolveOutputMode(
       this.output,
@@ -28651,7 +28735,7 @@ var SwitchCommand = class extends M8tCommand {
 
 // src/commands/open.ts
 import { spawn as spawn5 } from "child_process";
-import { Command as Command54, Option as Option51 } from "clipanion";
+import { Command as Command55, Option as Option52 } from "clipanion";
 
 // src/lib/open-targets.ts
 init_errors();
@@ -28697,14 +28781,14 @@ function openUrl(url) {
 }
 var OpenCommand = class extends M8tCommand {
   static paths = [["open"]];
-  static usage = Command54.Usage({
+  static usage = Command55.Usage({
     description: "Open the deployed webapp (default), the Foundry portal, or the resource group.",
     details: "Targets: webapp (deployed app, default) | foundry (ai.azure.com) | portal (resource group in the Azure portal). Pass --print to emit the URL instead of launching a browser (also the default when stdout isn't a TTY)."
   });
-  target = Option51.String({ required: false });
-  print = Option51.Boolean("--print", false);
-  output = Option51.String("--output");
-  resourceGroup = Option51.String("--resource-group", {
+  target = Option52.String({ required: false });
+  print = Option52.Boolean("--print", false);
+  output = Option52.String("--output");
+  resourceGroup = Option52.String("--resource-group", {
     description: "m8t resource group to disambiguate the gateway (multi-deployment subscriptions)."
   });
   async executeCommand() {
@@ -28748,7 +28832,7 @@ var OpenCommand = class extends M8tCommand {
 };
 
 // src/commands/dream/run.ts
-import { Command as Command55, Option as Option52 } from "clipanion";
+import { Command as Command56, Option as Option53 } from "clipanion";
 import { AzureCliCredential } from "@azure/identity";
 import { TableClient as TableClient8 } from "@azure/data-tables";
 import { AIProjectClient as AIProjectClient3 } from "@azure/ai-projects";
@@ -31265,28 +31349,28 @@ function redactTranscripts(input) {
 }
 var DreamRunCommand = class extends M8tCommand {
   static paths = [["dream", "run"]];
-  static usage = Command55.Usage({
+  static usage = Command56.Usage({
     description: "Dry-run the brain consumption pipeline for one worker (no model call, no writes). Pass --live to actually run it.",
     details: "Builds AzureCliCredential + resolves the Foundry project, ledger table, and Log Analytics workspace, runs the consumption pipeline, and prints the skip-ledger, the partition invariant, and harvest stats. Transcripts are metadata-only unless --show-transcripts is passed.\n\nThe bare command is READ-ONLY. --live takes the other branch: a real model call and a commit to the worker's brain repo through a minted GitHub App token."
   });
-  worker = Option52.String("--worker", { description: "Worker (canonical name) to harvest. Required." });
+  worker = Option53.String("--worker", { description: "Worker (canonical name) to harvest. Required." });
   // Opting IN to the side effects, rather than opting out of them. This command's
   // own help has always described a dry run, but the bare invocation used to take
   // the live branch — a real model call and a commit to the brain repo — so anyone
   // acting on `--help` got the opposite of what they read.
-  live = Option52.Boolean("--live", false, { description: "Actually run it: model call + commit to the brain repo." });
-  dryRun = Option52.Boolean("--dry-run", false, { description: "Read-only harvest. This is the default; the flag is accepted for compatibility." });
-  since = Option52.String("--since", { description: "ISO-8601 start override (rejected if malformed or future)." });
-  reset = Option52.Boolean("--reset", false, { description: "Ignore the stored cursor; read from the beginning." });
-  showTranscripts = Option52.Boolean("--show-transcripts", false, {
+  live = Option53.Boolean("--live", false, { description: "Actually run it: model call + commit to the brain repo." });
+  dryRun = Option53.Boolean("--dry-run", false, { description: "Read-only harvest. This is the default; the flag is accepted for compatibility." });
+  since = Option53.String("--since", { description: "ISO-8601 start override (rejected if malformed or future)." });
+  reset = Option53.Boolean("--reset", false, { description: "Ignore the stored cursor; read from the beginning." });
+  showTranscripts = Option53.Boolean("--show-transcripts", false, {
     description: "Print transcript bodies (default: metadata only)."
   });
-  subscription = Option52.String("--subscription");
-  endpoint = Option52.String("--endpoint");
-  storageAccount = Option52.String("--storage-account", {
+  subscription = Option53.String("--subscription");
+  endpoint = Option53.String("--endpoint");
+  storageAccount = Option53.String("--storage-account", {
     description: "Ledger storage account name (skips tag-based discovery)"
   });
-  output = Option52.String("--output");
+  output = Option53.String("--output");
   // Resolution seam — overridden by tests; built lazily at runtime otherwise.
   deps;
   async executeCommand() {
@@ -31661,7 +31745,7 @@ function defaultDeps(overrides) {
 
 // src/commands/conversations/sweep.ts
 import { createHash as createHash5 } from "crypto";
-import { Command as Command56, Option as Option53 } from "clipanion";
+import { Command as Command57, Option as Option54 } from "clipanion";
 import { AzureCliCredential as AzureCliCredential2 } from "@azure/identity";
 import { TableClient as TableClient9 } from "@azure/data-tables";
 import { AIProjectClient as AIProjectClient4 } from "@azure/ai-projects";
@@ -31787,7 +31871,7 @@ function defaultDeps2() {
 }
 var ConversationsSweepCommand = class extends M8tCommand {
   static paths = [["conversations", "sweep"]];
-  static usage = Command56.Usage({
+  static usage = Command57.Usage({
     category: "Conversations",
     description: "Delete expired public-visitor conversations (dry run by default)",
     details: `
@@ -31803,22 +31887,22 @@ var ConversationsSweepCommand = class extends M8tCommand {
       ["Delete, capped at 50", "m8t conversations sweep --delete --max 50"]
     ]
   });
-  doDelete = Option53.Boolean("--delete", false, {
+  doDelete = Option54.Boolean("--delete", false, {
     description: "Perform deletions (without this flag the command only reports)"
   });
-  principal = Option53.String("--principal", {
+  principal = Option54.String("--principal", {
     description: "Service-principal oid whose end-user keys are known-ephemeral (required with --delete; a dry run without it reports candidates grouped by principal)"
   });
-  max = Option53.String("--max", "200", { description: "Maximum deletions per run" });
-  graceDays = Option53.String("--grace-days", "14", {
+  max = Option54.String("--max", "200", { description: "Maximum deletions per run" });
+  graceDays = Option54.String("--grace-days", "14", {
     description: "Days past the 30-day key life before a conversation is eligible"
   });
-  lookbackDays = Option53.String("--lookback-days", "180", {
+  lookbackDays = Option54.String("--lookback-days", "180", {
     description: "How far back to scan ledger activity for candidates"
   });
-  subscription = Option53.String("--subscription", { description: "Azure subscription id override" });
-  endpoint = Option53.String("--endpoint", { description: "Foundry project endpoint override" });
-  storageAccount = Option53.String("--storage-account", {
+  subscription = Option54.String("--subscription", { description: "Azure subscription id override" });
+  endpoint = Option54.String("--endpoint", { description: "Foundry project endpoint override" });
+  storageAccount = Option54.String("--storage-account", {
     description: "Ledger storage account name (skips tag-based discovery)"
   });
   deps = defaultDeps2();
@@ -31946,7 +32030,7 @@ var ConversationsSweepCommand = class extends M8tCommand {
 };
 
 // src/commands/foundry/create.ts
-import { Command as Command57, Option as Option54 } from "clipanion";
+import { Command as Command58, Option as Option55 } from "clipanion";
 
 // src/lib/foundry-create.ts
 init_errors();
@@ -32184,7 +32268,7 @@ async function createFoundryProject(args) {
 init_errors();
 var FoundryCreateCommand = class extends M8tCommand {
   static paths = [["foundry", "create"]];
-  static usage = Command57.Usage({
+  static usage = Command58.Usage({
     description: "Create an AI Foundry (AIServices) account + project + model deployment from scratch.",
     details: "Non-interactive and idempotent. Creates the AIServices account (custom subdomain + project management), a project, and a model deployment (default gpt-4.1-mini @ capacity 50). Region must be hosted-agent-eligible. Emits the project endpoint as structured output. Re-run is a clean no-op (account/project skipped if present; deployment capacity converges UP, never down).",
     examples: [
@@ -32193,16 +32277,16 @@ var FoundryCreateCommand = class extends M8tCommand {
       ["Higher capacity for a reasoning model", "$0 foundry create --resource-group rg-m8t-stack --location eastus2 --model gpt-5-mini --capacity 250"]
     ]
   });
-  resourceGroup = Option54.String("--resource-group");
-  location = Option54.String("--location");
-  account = Option54.String("--account");
-  project = Option54.String("--project", "m8t");
-  model = Option54.String("--model", "gpt-4.1-mini");
-  modelVersion = Option54.String("--model-version", "2025-04-14");
-  capacity = Option54.String("--capacity", "50");
-  subscription = Option54.String("--subscription");
-  skipQuotaCheck = Option54.Boolean("--skip-quota-check", false);
-  output = Option54.String("--output");
+  resourceGroup = Option55.String("--resource-group");
+  location = Option55.String("--location");
+  account = Option55.String("--account");
+  project = Option55.String("--project", "m8t");
+  model = Option55.String("--model", "gpt-4.1-mini");
+  modelVersion = Option55.String("--model-version", "2025-04-14");
+  capacity = Option55.String("--capacity", "50");
+  subscription = Option55.String("--subscription");
+  skipQuotaCheck = Option55.Boolean("--skip-quota-check", false);
+  output = Option55.String("--output");
   async executeCommand() {
     const mode = resolveOutputMode(
       this.output,
@@ -32274,22 +32358,22 @@ var FoundryCreateCommand = class extends M8tCommand {
 };
 
 // src/commands/foundry/await-ready.ts
-import { Command as Command58, Option as Option55 } from "clipanion";
+import { Command as Command59, Option as Option56 } from "clipanion";
 import { AzureCliCredential as AzureCliCredential3 } from "@azure/identity";
 init_errors();
 var FoundryAwaitReadyCommand = class extends M8tCommand {
   static paths = [["foundry", "await-ready"]];
-  static usage = Command58.Usage({
+  static usage = Command59.Usage({
     description: "Wait until a freshly-created Foundry project's data plane reliably serves it.",
     details: "Probes the project (GET /agents) until it returns 200 on a few consecutive tries, or fails clearly after a bounded budget. A newly-created account can serve intermittent 404 'Project not found' for minutes; run this after 'foundry create' and before deploying agents so the worker phase doesn't catch the unstable window.",
     examples: [["Wait for a project to be ready", "$0 foundry await-ready --endpoint https://acc.services.ai.azure.com/api/projects/m8t"]]
   });
-  endpoint = Option55.String("--endpoint");
-  consecutive = Option55.String("--consecutive", "3");
-  attempts = Option55.String("--attempts", "60");
-  interval = Option55.String("--interval", "5");
-  subscription = Option55.String("--subscription");
-  output = Option55.String("--output");
+  endpoint = Option56.String("--endpoint");
+  consecutive = Option56.String("--consecutive", "3");
+  attempts = Option56.String("--attempts", "60");
+  interval = Option56.String("--interval", "5");
+  subscription = Option56.String("--subscription");
+  output = Option56.String("--output");
   async executeCommand() {
     const mode = resolveOutputMode(this.output, this.context.stdout);
     const endpoint = typeof this.endpoint === "string" ? this.endpoint : void 0;
@@ -32323,7 +32407,7 @@ var FoundryAwaitReadyCommand = class extends M8tCommand {
 };
 
 // src/commands/bootstrap/preflight.ts
-import { Command as Command59, Option as Option56 } from "clipanion";
+import { Command as Command60, Option as Option57 } from "clipanion";
 
 // ../../packages/telemetry-contract/artifact/tier-map.ts
 var EVENT_TIERS = {
@@ -32375,7 +32459,7 @@ function preflightRenderable(results) {
 }
 var BootstrapPreflightCommand = class extends M8tCommand {
   static paths = [["bootstrap", "preflight"]];
-  static usage = Command59.Usage({
+  static usage = Command60.Usage({
     description: "Loudly verify you can install m8t (Owner/UAA + directory admin) and hard-stop if not.",
     details: "Step 1 of `m8t bootstrap`. Prints an unmissable admin-credentials notice, then checks: Owner or User Access Administrator at subscription scope (hard requirement), directory-admin capability to register the app (or pass --client-id), every Azure resource provider the install uses (registering any that are missing), soft-deleted Cognitive Services accounts (they keep their model quota until purged, so quota can read free and the model deployment still fail), and \u2014 with --location \u2014 model quota in the target region. Exits non-zero with the exact failing check + remedy. `m8t prereqs` runs the same substrate checks on their own.",
     examples: [
@@ -32384,9 +32468,9 @@ var BootstrapPreflightCommand = class extends M8tCommand {
       ["BYO app registration (directory guests)", "$0 bootstrap preflight --client-id <appId>"]
     ]
   });
-  clientId = Option56.String("--client-id");
-  subscription = Option56.String("--subscription");
-  location = Option56.String("--location", {
+  clientId = Option57.String("--client-id");
+  subscription = Option57.String("--subscription");
+  location = Option57.String("--location", {
     description: "Target region. Enables the model-quota check \u2014 without it, quota is not verified."
   });
   async executeCommand() {
@@ -32483,10 +32567,10 @@ ${colors.error("  " + why)}
 }
 
 // src/commands/bootstrap/launch.ts
-import * as fs34 from "fs";
+import * as fs35 from "fs";
 import * as os15 from "os";
 import * as path37 from "path";
-import { Command as Command60, Option as Option57 } from "clipanion";
+import { Command as Command61, Option as Option58 } from "clipanion";
 init_errors();
 
 // src/lib/bootstrap-mi.ts
@@ -32589,6 +32673,8 @@ function buildAciCreateArgs(s) {
     `INSTALLER_IMAGE_REF=${s.image}`
   ];
   if (s.platformVersion) env.push(`M8T_PLATFORM_VERSION=${s.platformVersion}`);
+  if (s.releaseManifestSha256) env.push(`M8T_RELEASE_MANIFEST_SHA256=${s.releaseManifestSha256}`);
+  if (s.unreleasedDebug) env.push("M8T_UNRELEASED_DEBUG=1");
   if (s.gatewayImageRef) env.push(`GATEWAY_IMAGE_REF=${s.gatewayImageRef}`);
   if (s.foundryTracing) env.push(`FOUNDRY_TRACING=${s.foundryTracing}`);
   if (s.skipBrains) env.push("SKIP_BRAINS=true");
@@ -32849,6 +32935,142 @@ ${colors.error("\u2717")} The GitHub App on disk is installed on ${colors.field(
 `;
 }
 
+// src/lib/bootstrap-launch-target.ts
+init_errors();
+var BARE_VERSION = /^\d+\.\d+\.\d+(?:-canary\.(?:0|[1-9]\d*))?$/;
+function bareVersionOf(raw) {
+  const bare = raw.trim().replace(/^platform-v/, "");
+  return BARE_VERSION.test(bare) ? bare : null;
+}
+function engineImageOf(m) {
+  const c = m.manifest.components.installer;
+  return `${c.ref}:${c.tag}`;
+}
+async function resolveLaunchTarget(args) {
+  const { pinnedInstallerRef, pinnedPlatformVersion, fetchSealed } = args;
+  const release = typeof args.release === "string" && args.release.length > 0 ? args.release : void 0;
+  const tagOverride = typeof args.installerTag === "string" && args.installerTag.length > 0 ? args.installerTag : void 0;
+  const imageOverride = typeof args.installerImage === "string" && args.installerImage.length > 0 ? args.installerImage : void 0;
+  const pinnedRepo = pinnedInstallerRef.slice(0, pinnedInstallerRef.lastIndexOf(":"));
+  const overrideEngine = imageOverride ?? (tagOverride !== void 0 ? `${pinnedRepo}:${tagOverride}` : void 0);
+  const explicitEngine = overrideEngine !== void 0 && overrideEngine !== pinnedInstallerRef;
+  const overrideFlag = imageOverride !== void 0 ? "--installer-image" : "--installer-tag";
+  if (release !== void 0) {
+    const bare = bareVersionOf(release);
+    if (!bare) {
+      throw new LocalCliError({
+        code: "BOOTSTRAP_RELEASE_INVALID",
+        message: `--release must name a platform release, got ${JSON.stringify(release)}.`,
+        hint: "Pass a release version, e.g. --release 0.7.2 (or --release platform-v0.7.2). There is no 'latest' here on purpose: an install pins the release it installs."
+      });
+    }
+    const sealedManifest2 = await fetchSealed(bare);
+    const engineFromManifest2 = engineImageOf(sealedManifest2);
+    if (explicitEngine && overrideEngine !== engineFromManifest2) {
+      throw new LocalCliError({
+        code: "BOOTSTRAP_RELEASE_OVERRIDE_CONFLICT",
+        message: `--release ${bare} names the engine ${engineFromManifest2}, but ${overrideFlag} names ${overrideEngine}.`,
+        hint: `Drop the override to install release ${bare} as published, or drop --release to launch that engine as an unreleased-debug install.`
+      });
+    }
+    assertManifestSelfConsistent(sealedManifest2, bare);
+    return { kind: "released", version: bare, engineImage: engineFromManifest2, manifestSha256: sealedManifest2.digest };
+  }
+  if (explicitEngine) {
+    const engineImage = overrideEngine;
+    return {
+      kind: "unreleased-debug",
+      engineImage,
+      reason: `${overrideFlag} points this install at ${engineImage}, which no release manifest names. The install will deploy what that engine carries and will NOT claim a platform release version.`
+    };
+  }
+  const sealedManifest = await fetchSealed(pinnedPlatformVersion);
+  assertManifestSelfConsistent(sealedManifest, pinnedPlatformVersion);
+  const engineFromManifest = engineImageOf(sealedManifest);
+  if (engineFromManifest !== pinnedInstallerRef) {
+    throw new LocalCliError({
+      code: "BOOTSTRAP_ENGINE_MANIFEST_MISMATCH",
+      message: `This CLI installs platform ${pinnedPlatformVersion} with the engine ${pinnedInstallerRef}, but ${pinnedPlatformVersion}'s manifest names ${engineFromManifest}. The release and this CLI disagree about which engine runs it.`,
+      hint: `Get the newest CLI with \`npm install -g @m8t-stack/cli\` \u2014 the CLI is what pins the engine. If that does not resolve it, install the release explicitly with \`m8t bootstrap launch --release ${pinnedPlatformVersion}\`, which takes the engine from the manifest.`
+    });
+  }
+  return {
+    kind: "released",
+    version: pinnedPlatformVersion,
+    engineImage: pinnedInstallerRef,
+    manifestSha256: sealedManifest.digest
+  };
+}
+function assertManifestSelfConsistent(sealedManifest, expected) {
+  const declared = sealedManifest.manifest.platform.version;
+  if (declared !== expected) {
+    throw new LocalCliError({
+      code: "BOOTSTRAP_MANIFEST_VERSION_MISMATCH",
+      message: `Asked the channel for platform ${expected}, but the manifest it returned declares ${declared}.`,
+      hint: "The channel pointer may be misconfigured, or that release's manifest asset is wrong. Nothing was installed."
+    });
+  }
+}
+
+// src/lib/manifest-seal.ts
+import * as fs34 from "fs";
+import { createHash as createHash8 } from "crypto";
+init_errors();
+function manifestDigestOf(raw) {
+  return `sha256:${createHash8("sha256").update(raw, "utf8").digest("hex")}`;
+}
+async function fetchSealedManifest(source, deps = {}) {
+  const readFile10 = deps.readFile ?? ((p) => fs34.readFileSync(p, "utf8"));
+  const fetchImpl = deps.fetchImpl ?? fetch;
+  const ghToken = deps.ghToken ?? getGhToken;
+  let raw;
+  if ("file" in source) {
+    try {
+      raw = readFile10(source.file);
+    } catch (e) {
+      throw new LocalCliError({
+        code: "PLATFORM_MANIFEST_READ_FAILED",
+        message: `Could not read manifest file '${source.file}': ${e.message}`
+      });
+    }
+  } else {
+    const url = "url" in source ? source.url : source.version ? channelUrlForVersion(source.version) : CHANNEL_LATEST_URL;
+    let token;
+    try {
+      token = await ghToken();
+    } catch {
+      token = void 0;
+    }
+    const res = await fetchImpl(url, { headers: token ? { Authorization: `Bearer ${token}` } : {} });
+    if (!res.ok) {
+      throw new LocalCliError({
+        code: "PLATFORM_MANIFEST_FETCH_FAILED",
+        message: `GET ${url} returned HTTP ${res.status.toString()}.`,
+        hint: "The engine fetches this same URL and must see the same bytes. Check the release exists and its manifest asset is published."
+      });
+    }
+    raw = await res.text();
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (e) {
+    throw new LocalCliError({
+      code: "PLATFORM_MANIFEST_PARSE_FAILED",
+      message: `Manifest is not valid JSON: ${e.message}`
+    });
+  }
+  const errors = validateManifest(parsed);
+  if (errors.length > 0) {
+    throw new LocalCliError({
+      code: "PLATFORM_MANIFEST_INVALID",
+      message: `Fetched manifest failed validation:
+  - ${errors.join("\n  - ")}`
+    });
+  }
+  return { raw, digest: manifestDigestOf(raw), manifest: parsed };
+}
+
 // src/commands/bootstrap/launch.ts
 var DEFAULT_RG = "rg-m8t-stack";
 var DEFAULT_INSTALLER = `${PINNED_INSTALLER.registry}/${PINNED_INSTALLER.image}`;
@@ -32857,7 +33079,7 @@ var ACI_NAME = "m8t-installer";
 var MI_NAME = "m8t-installer-mi";
 var BootstrapLaunchCommand = class extends M8tCommand {
   static paths = [["bootstrap", "launch"]];
-  static usage = Command60.Usage({
+  static usage = Command61.Usage({
     description: "Create + authorize the installer managed identity, then kick the cloud installer.",
     details: "Step 2 of `m8t bootstrap` (run after `preflight`). Ensures the resource group, creates the m8t app registration (or uses --client-id), creates a user-assigned managed identity granted Owner at subscription scope, and launches the published m8t-installer image as an ACI run-to-completion job under that identity. Writes ~/.m8t/bootstrap.json for `status` and `reap`, and threads your Azure object id so the installer can grant you the platform's data-plane roles itself.",
     examples: [
@@ -32868,31 +33090,37 @@ var BootstrapLaunchCommand = class extends M8tCommand {
       ["Share a support contact", "$0 bootstrap launch --location eastus2 --contact-email you@example.com --company 'Acme'"]
     ]
   });
-  location = Option57.String("--location");
-  resourceGroup = Option57.String("--resource-group");
-  clientId = Option57.String("--client-id");
-  subscription = Option57.String("--subscription");
-  installerTag = Option57.String("--installer-tag");
+  location = Option58.String("--location");
+  resourceGroup = Option58.String("--resource-group");
+  clientId = Option58.String("--client-id");
+  subscription = Option58.String("--subscription");
+  // Install a PAST release, properly: its sealed manifest, the engine ITS manifest
+  // names, and a stamp that honestly says which release this is. The replication
+  // case ("they installed 0.7.2 and won't update") used to be approximated with
+  // --installer-tag, which pins the engine and nothing else — right box, wrong
+  // everything else, and silent about it.
+  release = Option58.String("--release", { description: "Install a specific published release (e.g. 0.7.2) instead of the one this CLI pins. Uses that release's own engine and manifest." });
+  installerTag = Option58.String("--installer-tag");
   // Full image ref override (registry + repo + tag) — an escape hatch when the
   // default org/tag is wrong for the current CLI (e.g. a stale published build).
   // Wins over --installer-tag / the pinned default.
-  installerImage = Option57.String("--installer-image");
-  gatewayImageRef = Option57.String("--gateway-image-ref");
-  githubAppCreds = Option57.String("--github-app-creds");
-  contactEmail = Option57.String("--contact-email", { description: "Share a contact email with m8t support. Not sent unless you pass it." });
-  company = Option57.String("--company", { description: "Share your company name with m8t support. Not sent unless you pass it." });
+  installerImage = Option58.String("--installer-image");
+  gatewayImageRef = Option58.String("--gateway-image-ref");
+  githubAppCreds = Option58.String("--github-app-creds");
+  contactEmail = Option58.String("--contact-email", { description: "Share a contact email with m8t support. Not sent unless you pass it." });
+  company = Option58.String("--company", { description: "Share your company name with m8t support. Not sent unless you pass it." });
   // Value-carrying on purpose: a bare --force would be cargo-culted into
   // runbooks and harness prompts and erode the protection, whereas a faithful
   // paste can never accidentally carry the victim group's name. It AUTHORIZES
   // the target; --resource-group is what CHOOSES it.
-  reinstallInto = Option57.String("--reinstall-into", { description: "Consent to installing into --resource-group even though it already holds resources. Must match the target group's name." });
-  org = Option57.String("--org", { description: "Assert the GitHub App on disk is installed on this org; refuses on a mismatch." });
-  noBrains = Option57.Boolean("--no-brains", false, { description: "Install without brain-backed workers. For test and CI rigs; the supported install creates brains." });
+  reinstallInto = Option58.String("--reinstall-into", { description: "Consent to installing into --resource-group even though it already holds resources. Must match the target group's name." });
+  org = Option58.String("--org", { description: "Assert the GitHub App on disk is installed on this org; refuses on a mismatch." });
+  noBrains = Option58.Boolean("--no-brains", false, { description: "Install without brain-backed workers. For test and CI rigs; the supported install creates brains." });
   // The opt-out TELEMETRY.md names. Without it there is no way to decline at
   // install time — the ACI env is built entirely from these options, so a
   // founder setting FOUNDRY_TRACING in their own shell reaches nothing. A
   // privacy notice that documents a control has to be a control that exists.
-  foundryTracing = Option57.String("--foundry-tracing", { description: "Where agent traces go: project (default, your own App Insights) | account (legacy shared) | skip (no tracing \u2014 you lose the record of what your agents did)." });
+  foundryTracing = Option58.String("--foundry-tracing", { description: "Where agent traces go: project (default, your own App Insights) | account (legacy shared) | skip (no tracing \u2014 you lose the record of what your agents did)." });
   async executeCommand() {
     const location = typeof this.location === "string" ? this.location : void 0;
     if (!location) {
@@ -32901,15 +33129,38 @@ var BootstrapLaunchCommand = class extends M8tCommand {
     const resourceGroupOpt = typeof this.resourceGroup === "string" ? this.resourceGroup : void 0;
     const resourceGroup = resourceGroupOpt ?? DEFAULT_RG;
     const clientIdOpt = typeof this.clientId === "string" ? this.clientId : void 0;
-    const installerTag = (typeof this.installerTag === "string" ? this.installerTag : void 0) ?? DEFAULT_INSTALLER_TAG;
-    const installerImageOverride = typeof this.installerImage === "string" ? this.installerImage : void 0;
-    const installerImage = installerImageOverride ?? `${DEFAULT_INSTALLER}:${installerTag}`;
     const gatewayImageRef = typeof this.gatewayImageRef === "string" ? this.gatewayImageRef : void 0;
     const foundryTracing = parseFoundryTracingMode(typeof this.foundryTracing === "string" ? this.foundryTracing : void 0) ?? DEFAULT_FOUNDRY_TRACING;
     const account = await getAzAccount();
     const subscriptionId = (typeof this.subscription === "string" ? this.subscription : void 0) ?? account.subscriptionId;
     const out = (m) => this.context.stderr.write(`  ${colors.dim(m)}
 `);
+    const target = await resolveLaunchTarget({
+      pinnedInstallerRef: `${DEFAULT_INSTALLER}:${DEFAULT_INSTALLER_TAG}`,
+      pinnedPlatformVersion: PINNED_PLATFORM_VERSION,
+      ...typeof this.release === "string" ? { release: this.release } : {},
+      ...typeof this.installerTag === "string" ? { installerTag: this.installerTag } : {},
+      ...typeof this.installerImage === "string" ? { installerImage: this.installerImage } : {},
+      // THE SAME RULE THE ENGINE APPLIES, from the same helper family. The engine
+      // derives its URL with manifest_url_for (installer/lib.sh), which honours
+      // M8T_UPDATE_CHANNEL_URL — and this launch threads that very variable into
+      // the container below. Sealing against the DEFAULT channel while the engine
+      // fetched a custom one would make the two hash different documents and
+      // refuse every custom-channel install at preflight, blaming the network.
+      // Every shakedown rig uses a custom channel.
+      fetchSealed: async (version) => fetchSealedManifest(manifestSourceForVersionTag(process.env.M8T_UPDATE_CHANNEL_URL ?? "", platformTag(version)))
+    });
+    const installerImage = target.engineImage;
+    const installerTag = installerImage.slice(installerImage.lastIndexOf(":") + 1);
+    if (target.kind === "unreleased-debug") {
+      this.context.stderr.write(
+        `${colors.warn("!")} unreleased-debug install: ${target.reason}
+  ${colors.hint("this install will report no platform version, and the updater will treat it as unrecognised.")}
+`
+      );
+    } else {
+      out(`installing platform ${target.version} with engine ${installerImage}`);
+    }
     const reinstallInto = typeof this.reinstallInto === "string" ? this.reinstallInto : void 0;
     if (reinstallInto !== void 0 && reinstallInto.toLowerCase() !== resourceGroup.toLowerCase()) {
       const targetExplanation = resourceGroupOpt === void 0 ? `you did not pass --resource-group, so the target is the default '${DEFAULT_RG}'` : `the target resource group is '${resourceGroup}'`;
@@ -32938,7 +33189,7 @@ var BootstrapLaunchCommand = class extends M8tCommand {
     let githubApp;
     if (skipBrains) {
       out("installing without brain-backed workers; no GitHub App credentials will be used");
-    } else if (!fs34.existsSync(credsPath)) {
+    } else if (!fs35.existsSync(credsPath)) {
       this.context.stderr.write(buildMissingCredsRefusal(credsPath));
       throw new LocalCliError({
         code: "GITHUB_APP_CREDS_MISSING",
@@ -32948,7 +33199,7 @@ var BootstrapLaunchCommand = class extends M8tCommand {
     } else {
       let parsed;
       try {
-        parsed = JSON.parse(fs34.readFileSync(credsPath, "utf8"));
+        parsed = JSON.parse(fs35.readFileSync(credsPath, "utf8"));
       } catch {
         throw new LocalCliError({
           code: "GITHUB_APP_CREDS_INVALID",
@@ -32966,7 +33217,7 @@ var BootstrapLaunchCommand = class extends M8tCommand {
       }
       let pem;
       try {
-        pem = fs34.readFileSync(parsed.pemPath, "utf8");
+        pem = fs35.readFileSync(parsed.pemPath, "utf8");
       } catch {
         throw new LocalCliError({
           code: "GITHUB_APP_PEM_MISSING",
@@ -33022,7 +33273,6 @@ var BootstrapLaunchCommand = class extends M8tCommand {
     } catch (e) {
       out(`warning: could not determine your Azure object id (${e.message}) \u2014 the install will not grant you data-plane access; run 'm8t prereqs --fix' afterwards`);
     }
-    const platformVersion = installerImage === PINNED_INSTALLER.ref ? PINNED_PLATFORM_VERSION : "";
     out("launching the cloud installer (ACI)\u2026");
     await kickInstaller({
       aciName: ACI_NAME,
@@ -33036,7 +33286,7 @@ var BootstrapLaunchCommand = class extends M8tCommand {
       gatewayImageRef,
       foundryTracing,
       githubApp,
-      ...platformVersion ? { platformVersion } : {},
+      ...target.kind === "released" ? { platformVersion: target.version, releaseManifestSha256: target.manifestSha256 } : { unreleasedDebug: true },
       ...founderObjectId ? { founderObjectId } : {},
       ...skipBrains ? { skipBrains: true } : {},
       // Opt-in only. The signed-in UPN was previously seeded here automatically;
@@ -33056,7 +33306,7 @@ var BootstrapLaunchCommand = class extends M8tCommand {
 };
 
 // src/commands/bootstrap/status.ts
-import { Command as Command62, Option as Option59 } from "clipanion";
+import { Command as Command63, Option as Option60 } from "clipanion";
 init_errors();
 
 // src/lib/bootstrap-aci-state.ts
@@ -33083,13 +33333,13 @@ async function getAciState(opts) {
 
 // src/lib/bootstrap-finalize.ts
 init_errors();
-import * as fs39 from "fs/promises";
+import * as fs40 from "fs/promises";
 import * as os20 from "os";
 import * as path44 from "path";
 
 // src/lib/company-profile-seed.ts
 import { spawn as spawn6 } from "child_process";
-import { closeSync, openSync, readFileSync as readFileSync24 } from "fs";
+import { closeSync, openSync, readFileSync as readFileSync26 } from "fs";
 import * as os17 from "os";
 import * as path39 from "path";
 init_errors();
@@ -33686,7 +33936,7 @@ async function getSignedInUserIdentity(runAzImpl = runAz) {
 }
 
 // src/lib/onboarding-profile-store.ts
-import * as fs35 from "fs/promises";
+import * as fs36 from "fs/promises";
 import * as os16 from "os";
 import * as path38 from "path";
 var ONBOARDING_PROFILE_FILE = "onboarding-profile.json";
@@ -33727,7 +33977,7 @@ function canonical(value) {
 async function readOnboardingProfile(home = os16.homedir()) {
   let raw;
   try {
-    raw = await fs35.readFile(file(home), "utf8");
+    raw = await fs36.readFile(file(home), "utf8");
   } catch {
     return null;
   }
@@ -33738,11 +33988,11 @@ async function readOnboardingProfile(home = os16.homedir()) {
   }
 }
 async function writeOnboardingProfile(profile, home = os16.homedir()) {
-  await fs35.mkdir(dir(home), { recursive: true });
+  await fs36.mkdir(dir(home), { recursive: true });
   const target = file(home);
   const tmp = `${target}.tmp`;
-  await fs35.writeFile(tmp, JSON.stringify(profile, null, 2), { encoding: "utf8", mode: 384 });
-  await fs35.rename(tmp, target);
+  await fs36.writeFile(tmp, JSON.stringify(profile, null, 2), { encoding: "utf8", mode: 384 });
+  await fs36.rename(tmp, target);
 }
 function toOnboardingBlock(profile) {
   return {
@@ -33759,7 +34009,7 @@ function toOnboardingBlock(profile) {
 function readGithubAppCreds(credsPath) {
   const p = credsPath ?? path39.join(os17.homedir(), ".m8t", "github-app.json");
   try {
-    return JSON.parse(readFileSync24(p, "utf8"));
+    return JSON.parse(readFileSync26(p, "utf8"));
   } catch {
     return null;
   }
@@ -33828,7 +34078,7 @@ function upsertMemoryIndexOnce(existing, line2, targetPath2) {
 async function applyProfileToBrain(args) {
   const token = await mintInstallationTokenFromPem({
     appId: args.appCreds.appId,
-    privateKeyPem: readFileSync24(args.appCreds.pemPath, "utf8"),
+    privateKeyPem: readFileSync26(args.appCreds.pemPath, "utf8"),
     installationId: args.appCreds.installationId,
     fetchImpl: args.fetchImpl
   });
@@ -34037,15 +34287,15 @@ function renderInstallSummary(args) {
 
 // src/lib/companion-install.ts
 import { constants as constants2 } from "fs";
-import * as fs38 from "fs/promises";
+import * as fs39 from "fs/promises";
 import * as path42 from "path";
 import { randomUUID as randomUUID4 } from "crypto";
 import { execFile as execFile2, spawn as spawn7 } from "child_process";
 
 // src/lib/companion-artifact.ts
-import { createHash as createHash8 } from "crypto";
+import { createHash as createHash9 } from "crypto";
 import { constants } from "fs";
-import * as fs36 from "fs/promises";
+import * as fs37 from "fs/promises";
 import * as path40 from "path";
 var SHA256 = /^[a-f0-9]{64}$/u;
 var VERSION2 = /^[A-Za-z0-9][A-Za-z0-9._+-]{0,127}$/u;
@@ -34081,7 +34331,7 @@ function canonicalEntry(entry) {
 `;
 }
 function artifactTreeSha256(entries) {
-  const hash = createHash8("sha256");
+  const hash = createHash9("sha256");
   const ordered = [...entries].sort(
     (left, right) => left.path.localeCompare(right.path)
   );
@@ -34151,17 +34401,17 @@ function parseArtifactManifest(value) {
   };
 }
 async function sha256File2(filePath) {
-  return createHash8("sha256").update(await fs36.readFile(filePath)).digest("hex");
+  return createHash9("sha256").update(await fs37.readFile(filePath)).digest("hex");
 }
 async function walk2(root, relative4 = "") {
   const directory = path40.join(root, ...relative4.split("/").filter(Boolean));
-  const children = await fs36.readdir(directory, { withFileTypes: true });
+  const children = await fs37.readdir(directory, { withFileTypes: true });
   const entries = [];
   for (const child of children.sort((left, right) => left.name.localeCompare(right.name))) {
     const childRelative = relative4 ? `${relative4}/${child.name}` : child.name;
     normalizedRelative(childRelative);
     const childPath = path40.join(directory, child.name);
-    const stat5 = await fs36.lstat(childPath);
+    const stat5 = await fs37.lstat(childPath);
     if (stat5.isDirectory()) {
       entries.push(...await walk2(root, childRelative));
     } else if (stat5.isFile()) {
@@ -34173,7 +34423,7 @@ async function walk2(root, relative4 = "") {
         sha256: await sha256File2(childPath)
       });
     } else if (stat5.isSymbolicLink()) {
-      const target = await fs36.readlink(childPath);
+      const target = await fs37.readlink(childPath);
       entries.push({
         type: "symlink",
         path: childRelative,
@@ -34186,17 +34436,17 @@ async function walk2(root, relative4 = "") {
   return entries;
 }
 async function ensureRealDirectory(root) {
-  const stat5 = await fs36.lstat(root);
+  const stat5 = await fs37.lstat(root);
   if (stat5.isSymbolicLink()) throw new Error("Artifact root is a symbolic link");
   if (!stat5.isDirectory()) throw new Error("Artifact root is not a directory");
 }
 async function validateResolvedLinks(root, entries) {
-  const realRoot = await fs36.realpath(root);
+  const realRoot = await fs37.realpath(root);
   for (const entry of entries) {
     if (entry.type !== "symlink") continue;
     try {
       const linkPath = path40.join(root, ...entry.path.split("/"));
-      const resolved = await fs36.realpath(linkPath);
+      const resolved = await fs37.realpath(linkPath);
       const relative4 = path40.relative(realRoot, resolved);
       if (relative4 === ".." || relative4.startsWith(`..${path40.sep}`) || path40.isAbsolute(relative4)) {
         throw new Error("Artifact symlink chain escapes the payload root");
@@ -34228,13 +34478,13 @@ async function buildArtifactManifest(payloadRoot, input) {
   return manifest;
 }
 async function readArtifactManifest(manifestPath) {
-  const before = await fs36.lstat(manifestPath);
+  const before = await fs37.lstat(manifestPath);
   if (before.isSymbolicLink() || !before.isFile()) {
     throw new Error("Artifact manifest is a symbolic link or non-file");
   }
   let handle;
   try {
-    handle = await fs36.open(
+    handle = await fs37.open(
       manifestPath,
       constants.O_RDONLY | constants.O_NOFOLLOW
     );
@@ -34292,37 +34542,37 @@ async function verifyArtifactPayload(payloadRoot, manifest) {
 async function copyArtifactPayload(sourceRoot, targetRoot, manifest) {
   await verifyArtifactSource(sourceRoot, manifest);
   try {
-    const targetStat = await fs36.lstat(targetRoot);
+    const targetStat = await fs37.lstat(targetRoot);
     if (targetStat.isSymbolicLink()) {
       throw new Error("Install target is a symbolic link");
     }
     if (!targetStat.isDirectory()) throw new Error("Install target is not a directory");
-    if ((await fs36.readdir(targetRoot)).length > 0) {
+    if ((await fs37.readdir(targetRoot)).length > 0) {
       throw new Error("Install staging target is not empty");
     }
   } catch (error) {
     if (error.code !== "ENOENT") throw error;
-    await fs36.mkdir(targetRoot, { recursive: false, mode: 448 });
+    await fs37.mkdir(targetRoot, { recursive: false, mode: 448 });
   }
   for (const entry of manifest.entries) {
     const source = ensureContainedEntry(sourceRoot, entry.path);
     const target = ensureContainedEntry(targetRoot, entry.path);
-    await fs36.mkdir(path40.dirname(target), { recursive: true, mode: 448 });
+    await fs37.mkdir(path40.dirname(target), { recursive: true, mode: 448 });
     if (entry.type === "file") {
-      await fs36.copyFile(source, target);
-      await fs36.chmod(target, entry.mode);
+      await fs37.copyFile(source, target);
+      await fs37.chmod(target, entry.mode);
     } else {
-      await fs36.symlink(entry.target, target);
+      await fs37.symlink(entry.target, target);
     }
   }
   await verifyArtifactPayload(targetRoot, manifest);
 }
 
 // src/lib/companion-download.ts
-import { createHash as createHash9 } from "crypto";
+import { createHash as createHash10 } from "crypto";
 import { execFile } from "child_process";
 import { createReadStream } from "fs";
-import * as fs37 from "fs/promises";
+import * as fs38 from "fs/promises";
 import * as os18 from "os";
 import * as path41 from "path";
 init_errors();
@@ -34370,11 +34620,11 @@ function declaredLength(response) {
   return Number.isSafeInteger(value) && value >= 0 ? value : null;
 }
 async function usableBytes(partial) {
-  const status = await fs37.lstat(partial).catch(() => null);
+  const status = await fs38.lstat(partial).catch(() => null);
   if (status === null) return 0;
   if (!status.isFile()) {
-    await fs37.rm(partial, { recursive: true, force: true }).catch(() => void 0);
-    if (await fs37.lstat(partial).then(() => true, () => false)) {
+    await fs38.rm(partial, { recursive: true, force: true }).catch(() => void 0);
+    if (await fs38.lstat(partial).then(() => true, () => false)) {
       throw new LocalCliError({
         code: "COMPANION_DOWNLOAD_PATH_OCCUPIED",
         message: `${partial} is not a file and could not be cleared.`,
@@ -34386,14 +34636,14 @@ async function usableBytes(partial) {
   return status.size;
 }
 async function sweepForeignPartials(directory, keep) {
-  const entries = await fs37.readdir(directory).catch(() => []);
+  const entries = await fs38.readdir(directory).catch(() => []);
   await Promise.all(
-    entries.filter((name) => name.endsWith(".part") && name !== keep).map((name) => fs37.rm(path41.join(directory, name), { recursive: true, force: true }))
+    entries.filter((name) => name.endsWith(".part") && name !== keep).map((name) => fs38.rm(path41.join(directory, name), { recursive: true, force: true }))
   );
 }
 function sha256File3(filePath) {
   return new Promise((resolve6, reject) => {
-    const hash = createHash9("sha256");
+    const hash = createHash10("sha256");
     const stream = createReadStream(filePath);
     stream.on("error", reject);
     stream.on("data", (chunk) => hash.update(chunk));
@@ -34407,7 +34657,7 @@ async function transferToDisk(input) {
   for (let attempt = 0; attempt < MAX_ATTEMPTS2; attempt++) {
     let existing = await usableBytes(input.partial);
     if (existing > input.maxAssetBytes) {
-      await fs37.rm(input.partial, { force: true }).catch(() => void 0);
+      await fs38.rm(input.partial, { force: true }).catch(() => void 0);
       existing = 0;
     }
     let received = existing;
@@ -34424,7 +34674,7 @@ async function transferToDisk(input) {
         if (existing > 0 && await sha256File3(input.partial).catch(() => null) === input.expectedDigest) {
           return;
         }
-        await fs37.rm(input.partial, { force: true }).catch(() => void 0);
+        await fs38.rm(input.partial, { force: true }).catch(() => void 0);
         lastError = new Error("the interrupted download no longer fits the published asset");
         continue;
       }
@@ -34449,7 +34699,7 @@ async function transferToDisk(input) {
         const range = parseContentRange(response.headers.get("content-range"));
         if (range?.start !== existing) {
           await response.body?.cancel().catch(() => void 0);
-          await fs37.rm(input.partial, { force: true }).catch(() => void 0);
+          await fs38.rm(input.partial, { force: true }).catch(() => void 0);
           lastError = new Error("the server answered a different range than the one requested");
           continue;
         }
@@ -34462,14 +34712,14 @@ async function transferToDisk(input) {
       const declaredBody = declaredLength(response);
       if (total !== null && total > input.maxAssetBytes || declaredBody !== null && declaredBody > input.maxAssetBytes) {
         await response.body?.cancel().catch(() => void 0);
-        await fs37.rm(input.partial, { force: true }).catch(() => void 0);
+        await fs38.rm(input.partial, { force: true }).catch(() => void 0);
         throw tooLarge(input.asset);
       }
       if (offset > 0) input.onEvent({ kind: "resumed", received: offset, total });
       received = offset;
       const body = response.body;
       if (body === null) throw new Error("the response carried no body");
-      const handle = await fs37.open(input.partial, offset > 0 ? "a" : "w", 384);
+      const handle = await fs38.open(input.partial, offset > 0 ? "a" : "w", 384);
       try {
         for await (const chunk of body) {
           received += chunk.byteLength;
@@ -34492,7 +34742,7 @@ async function transferToDisk(input) {
     } catch (error) {
       if (error instanceof LocalCliError) {
         if (error.code === "COMPANION_ASSET_TOO_LARGE") {
-          await fs37.rm(input.partial, { force: true }).catch(() => void 0);
+          await fs38.rm(input.partial, { force: true }).catch(() => void 0);
         }
         throw error;
       }
@@ -34508,7 +34758,7 @@ async function transferToDisk(input) {
       }
     }
   }
-  const kept = await fs37.lstat(input.partial).then(
+  const kept = await fs38.lstat(input.partial).then(
     (status) => status.isFile() ? status.size : 0,
     () => 0
   );
@@ -34535,7 +34785,7 @@ async function downloadCompanionArtifact(component, deps = {}) {
   const directory = deps.downloadDirectory ?? companionDownloadDirectory(os18.homedir());
   const partialName = `${pinned.sha256}.part`;
   const partial = path41.join(directory, partialName);
-  await fs37.mkdir(directory, { recursive: true, mode: 448 });
+  await fs38.mkdir(directory, { recursive: true, mode: 448 });
   await sweepForeignPartials(directory, partialName);
   await transferToDisk({
     url,
@@ -34549,20 +34799,20 @@ async function downloadCompanionArtifact(component, deps = {}) {
   });
   const digest = await sha256File3(partial);
   if (digest !== pinned.sha256) {
-    await fs37.rm(partial, { force: true }).catch(() => void 0);
+    await fs38.rm(partial, { force: true }).catch(() => void 0);
     throw new LocalCliError({
       code: "COMPANION_ASSET_DIGEST_MISMATCH",
       message: `${pinned.asset} does not match the digest the release pins for it.`,
       hint: "Nothing was unpacked. This is what a corrupted download or a substituted file looks like \u2014 retry, and report it if it persists."
     });
   }
-  const root = await (deps.makeTemporaryDirectory ?? (() => fs37.mkdtemp(path41.join(os18.tmpdir(), "m8t-companion-"))))();
+  const root = await (deps.makeTemporaryDirectory ?? (() => fs38.mkdtemp(path41.join(os18.tmpdir(), "m8t-companion-"))))();
   const dispose = async () => {
-    await fs37.rm(root, { recursive: true, force: true }).catch(() => void 0);
+    await fs38.rm(root, { recursive: true, force: true }).catch(() => void 0);
   };
   try {
     const unpacked = path41.join(root, "unpacked");
-    await fs37.mkdir(unpacked, { recursive: false, mode: 448 });
+    await fs38.mkdir(unpacked, { recursive: false, mode: 448 });
     await (deps.extract ?? extractArchive)(partial, unpacked);
     return {
       version: component.version,
@@ -34573,7 +34823,7 @@ async function downloadCompanionArtifact(component, deps = {}) {
     await dispose();
     throw error;
   } finally {
-    await fs37.rm(partial, { force: true }).catch(() => void 0);
+    await fs38.rm(partial, { force: true }).catch(() => void 0);
   }
 }
 
@@ -34617,10 +34867,10 @@ async function setCompanionStartAtLogin(input) {
     );
     await assertNotSymlink(registration, "Start-at-login registration");
     if (!input.enabled) {
-      await fs38.rm(registration, { force: true });
+      await fs39.rm(registration, { force: true });
       return;
     }
-    await fs38.mkdir(launchAgents, { recursive: true, mode: 448 });
+    await fs39.mkdir(launchAgents, { recursive: true, mode: 448 });
     const plist = '<?xml version="1.0" encoding="UTF-8"?>\n<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">\n<plist version="1.0"><dict><key>Label</key><string>com.m8t.companion</string><key>ProgramArguments</key><array><string>' + xmlEscape(input.executable) + "</string></array><key>RunAtLoad</key><true/></dict></plist>\n";
     await atomicWriteText(registration, plist, 384);
     return;
@@ -34802,7 +35052,7 @@ function validateGatewayOrigin(value) {
 }
 async function assertNotSymlink(filePath, kind) {
   try {
-    if ((await fs38.lstat(filePath)).isSymbolicLink()) {
+    if ((await fs39.lstat(filePath)).isSymbolicLink()) {
       throw new Error(`${kind} is a symbolic link`);
     }
   } catch (error) {
@@ -34817,14 +35067,14 @@ async function assertOwnedDirectoryChain(anchor, targetDirectory) {
   }
   const segments = relative4.split(path42.sep).filter(Boolean);
   let current = anchor;
-  const anchorStatus = await fs38.lstat(anchor);
+  const anchorStatus = await fs39.lstat(anchor);
   if (anchorStatus.isSymbolicLink() || !anchorStatus.isDirectory()) {
     throw new Error("Companion owned directory anchor is unsafe");
   }
   for (const segment of segments) {
     current = path42.join(current, segment);
     try {
-      const status = await fs38.lstat(current);
+      const status = await fs39.lstat(current);
       if (status.isSymbolicLink() || !status.isDirectory()) {
         throw new Error("Companion owned directory contains a symbolic link");
       }
@@ -34843,13 +35093,13 @@ async function assertOwnedParents(options, paths) {
   await assertOwnedDirectoryChain(targetAnchor, path42.dirname(paths.targetRoot));
 }
 async function readRegularText(filePath, maxBytes) {
-  const before = await fs38.lstat(filePath);
+  const before = await fs39.lstat(filePath);
   if (before.isSymbolicLink() || !before.isFile()) {
     throw new Error("Companion state file is not a regular file");
   }
   let handle;
   try {
-    handle = await fs38.open(
+    handle = await fs39.open(
       filePath,
       constants2.O_RDONLY | constants2.O_NOFOLLOW
     );
@@ -34872,27 +35122,27 @@ async function atomicWriteJson(filePath, value) {
 }
 async function atomicWriteText(filePath, contents, mode) {
   await assertNotSymlink(filePath, "Companion state file");
-  await fs38.mkdir(path42.dirname(filePath), {
+  await fs39.mkdir(path42.dirname(filePath), {
     recursive: true,
     mode: 448
   });
   const temporary = `${filePath}.${randomUUID4()}.tmp`;
   try {
-    await fs38.writeFile(temporary, contents, {
+    await fs39.writeFile(temporary, contents, {
       mode,
       flag: "wx"
     });
-    await fs38.rename(temporary, filePath);
-    await fs38.chmod(filePath, mode).catch(() => void 0);
+    await fs39.rename(temporary, filePath);
+    await fs39.chmod(filePath, mode).catch(() => void 0);
   } finally {
-    await fs38.rm(temporary, { force: true }).catch(() => void 0);
+    await fs39.rm(temporary, { force: true }).catch(() => void 0);
   }
 }
 async function realRegularFile(filePath, executable) {
-  const real = await fs38.realpath(filePath);
-  const stat5 = await fs38.stat(real);
+  const real = await fs39.realpath(filePath);
+  const stat5 = await fs39.stat(real);
   if (!stat5.isFile()) throw new Error("Companion launch target is not a file");
-  await fs38.access(real, executable ? constants2.X_OK : constants2.R_OK);
+  await fs39.access(real, executable ? constants2.X_OK : constants2.R_OK);
   return real;
 }
 function defaultLaunch(executable) {
@@ -34908,7 +35158,7 @@ async function companionIsRunning(platform, executable) {
   if (platform !== "win32") return false;
   let handle;
   try {
-    handle = await fs38.open(executable, "r+");
+    handle = await fs39.open(executable, "r+");
   } catch (error) {
     const code = error.code;
     if (code === "ENOENT") return false;
@@ -35022,7 +35272,7 @@ async function snapshotFile(filePath) {
 }
 async function restoreFile(filePath, bytes) {
   if (bytes === null) {
-    await fs38.rm(filePath, { force: true });
+    await fs39.rm(filePath, { force: true });
   } else {
     await atomicWriteJson(filePath, JSON.parse(bytes.toString("utf8")));
   }
@@ -35066,7 +35316,7 @@ async function converge(options, force) {
   }
   if (current.state === "not-installed") {
     try {
-      await fs38.lstat(paths.targetRoot);
+      await fs39.lstat(paths.targetRoot);
       throw new Error(
         "The fixed companion target exists without an owned install manifest"
       );
@@ -35077,7 +35327,7 @@ async function converge(options, force) {
   const stage = `${paths.targetRoot}.m8t-stage-${randomUUID4()}`;
   const backup = `${paths.targetRoot}.m8t-backup-${randomUUID4()}`;
   const copy = options.copyPayload ?? copyArtifactPayload;
-  await fs38.mkdir(path42.dirname(paths.targetRoot), {
+  await fs39.mkdir(path42.dirname(paths.targetRoot), {
     recursive: true,
     mode: 448
   });
@@ -35094,12 +35344,12 @@ async function converge(options, force) {
   try {
     await copy(payloadRoot, stage, artifactManifest);
     try {
-      await fs38.rename(paths.targetRoot, backup);
+      await fs39.rename(paths.targetRoot, backup);
       movedPrior = true;
     } catch (error) {
       if (error.code !== "ENOENT") throw error;
     }
-    await fs38.rename(stage, paths.targetRoot);
+    await fs39.rename(stage, paths.targetRoot);
     installedStage = true;
     const nodeExecutable = await realRegularFile(
       options.nodeExecutable,
@@ -35162,7 +35412,7 @@ async function converge(options, force) {
     );
     loginChanged = true;
     await (options.launch ?? defaultLaunch)(executable);
-    await fs38.rm(backup, { recursive: true, force: true });
+    await fs39.rm(backup, { recursive: true, force: true });
     return {
       state: "installed",
       version: artifactManifest.version,
@@ -35176,15 +35426,15 @@ async function converge(options, force) {
         () => void 0
       );
     }
-    await fs38.rm(stage, { recursive: true, force: true }).catch(() => void 0);
+    await fs39.rm(stage, { recursive: true, force: true }).catch(() => void 0);
     if (installedStage) {
-      await fs38.rm(paths.targetRoot, {
+      await fs39.rm(paths.targetRoot, {
         recursive: true,
         force: true
       }).catch(() => void 0);
     }
     if (movedPrior) {
-      await fs38.rename(backup, paths.targetRoot).catch(() => void 0);
+      await fs39.rename(backup, paths.targetRoot).catch(() => void 0);
     }
     await Promise.all([
       restoreFile(paths.installManifest, snapshots[0]),
@@ -35205,7 +35455,7 @@ async function uninstallCompanion(options) {
   const expectedPaths = companionInstallPaths(options);
   await assertOwnedParents(options, expectedPaths);
   const remove = options.removeOwnedPath ?? (async (ownedPath, recursive) => {
-    await fs38.rm(ownedPath, { recursive, force: true });
+    await fs39.rm(ownedPath, { recursive, force: true });
   });
   const installed2 = await readInstalled(options);
   if (!installed2) {
@@ -35233,7 +35483,7 @@ async function uninstallCompanion(options) {
 // src/commands/companion/install.ts
 import * as os19 from "os";
 import * as path43 from "path";
-import { Command as Command61, Option as Option58 } from "clipanion";
+import { Command as Command62, Option as Option59 } from "clipanion";
 
 // src/lib/companion-channel.ts
 async function readCompanionRelease(source = { url: CHANNEL_LATEST_URL }, deps = {}) {
@@ -35364,7 +35614,7 @@ Version: ${state.version}
 }
 var CompanionInstallCommand = class extends M8tCommand {
   static paths = [["companion", "install"]];
-  static usage = Command61.Usage({
+  static usage = Command62.Usage({
     description: "Install the desktop companions for this user from the release channel.",
     examples: [
       ["Install the released build", "$0 companion install"],
@@ -35374,10 +35624,10 @@ var CompanionInstallCommand = class extends M8tCommand {
       ]
     ]
   });
-  from = Option58.String("--from", {
+  from = Option59.String("--from", {
     description: "A locally staged build directory instead of the released one."
   });
-  resourceGroup = Option58.String("--resource-group", {
+  resourceGroup = Option59.String("--resource-group", {
     description: "Which deployment to bind to, when the subscription holds more than one."
   });
   async executeCommand() {
@@ -35402,7 +35652,7 @@ function resolveRepoRootMarker(args) {
 }
 async function looksLikeCheckout(dir2) {
   try {
-    return (await fs39.stat(path44.join(dir2, "brain-template"))).isDirectory();
+    return (await fs40.stat(path44.join(dir2, "brain-template"))).isDirectory();
   } catch {
     return false;
   }
@@ -35425,15 +35675,15 @@ async function finalizeInstall(args, deps = defaultFinalizeDeps) {
   const markerDir = path44.join(deps.homedir(), ".m8t");
   const markerPath = path44.join(markerDir, "repo-root");
   const cwd = process.cwd();
-  const existing = await fs39.readFile(markerPath, "utf8").then((s) => s.trim()).catch(() => null);
+  const existing = await fs40.readFile(markerPath, "utf8").then((s) => s.trim()).catch(() => null);
   const repoRoot = resolveRepoRootMarker({
     ...args.repoRoot !== void 0 ? { explicit: args.repoRoot } : {},
     cwd,
     cwdIsCheckout: await looksLikeCheckout(cwd),
     existing
   });
-  await fs39.mkdir(markerDir, { recursive: true });
-  await fs39.writeFile(markerPath, `${repoRoot}
+  await fs40.mkdir(markerDir, { recursive: true });
+  await fs40.writeFile(markerPath, `${repoRoot}
 `, "utf8");
   let webappUrl;
   try {
@@ -35592,7 +35842,7 @@ var BootstrapStatusCommand = class extends M8tCommand {
   // runbooks and shakedown recipes that a founder may already be part-way
   // through — it prints a deprecation notice and does the right thing.
   static paths = [["bootstrap", "status"], ["bootstrap", "finish"]];
-  static usage = Command62.Usage({
+  static usage = Command63.Usage({
     description: "Show the cloud installer's live status (phase, progress, result) \u2014 and finish the local setup when it lands.",
     details: "Reads the durable status blob written by the installer. --watch polls until the install reaches done or failed.\n\nOn reaching done under --watch this also completes the local half of the install, which nothing else in the bootstrap path can do: it registers the webapp's sign-in redirect URI (the installer runs as a managed identity with no directory role, and at launch time the gateway FQDN did not exist yet), writes ~/.m8t/repo-root and the gateway discovery cache, and seeds your advisors' brains from the onboarding intake. Re-runnable \u2014 `m8t bootstrap finish` is a deprecated alias that does exactly this on an already-done install.",
     examples: [
@@ -35601,12 +35851,12 @@ var BootstrapStatusCommand = class extends M8tCommand {
       ["Redo the local setup on a finished install", "$0 bootstrap status --finalize --repo-root /path/to/m8t"]
     ]
   });
-  watch = Option59.Boolean("--watch", false);
-  output = Option59.String("--output");
-  repoRoot = Option59.String("--repo-root", { description: "The m8t clone to point local tools at (default: the current directory)." });
-  finalize = Option59.Boolean("--finalize", false, { description: "Complete the local setup against an already-done install, without watching." });
-  subscription = Option59.String("--subscription");
-  resourceGroup = Option59.String("--resource-group");
+  watch = Option60.Boolean("--watch", false);
+  output = Option60.String("--output");
+  repoRoot = Option60.String("--repo-root", { description: "The m8t clone to point local tools at (default: the current directory)." });
+  finalize = Option60.Boolean("--finalize", false, { description: "Complete the local setup against an already-done install, without watching." });
+  subscription = Option60.String("--subscription");
+  resourceGroup = Option60.String("--resource-group");
   async executeCommand() {
     const state = await readBootstrapState();
     if (!state) {
@@ -35739,7 +35989,7 @@ function formatStatus(d) {
 }
 
 // src/commands/bootstrap/reap.ts
-import { Command as Command63, Option as Option60 } from "clipanion";
+import { Command as Command64, Option as Option61 } from "clipanion";
 init_errors();
 
 // src/lib/bootstrap-reap.ts
@@ -35833,7 +36083,7 @@ async function reapInstaller(opts) {
 // src/commands/bootstrap/reap.ts
 var BootstrapReapCommand = class extends M8tCommand {
   static paths = [["bootstrap", "reap"]];
-  static usage = Command63.Usage({
+  static usage = Command64.Usage({
     description: "Tear down the installer scaffolding (ACI \u2192 MI \u2192 its role assignments) after a successful install.",
     details: "Runs locally on the 'done' signal (the installer can't delete its own identity). The platform RG and the gateway's own assignments persist. A failed install is left intact for diagnosis unless --force.\n\n--sweep-orphans is a DIFFERENT and much broader mode: instead of reaping this install, it scans the WHOLE SUBSCRIPTION for m8t role assignments left behind by installs whose resources are gone \u2014 orphaned installer Owner-at-subscription-scope grants and orphaned gateway subscription-scope roles. It is a dry run that only lists what it found unless you also pass --yes, which deletes them.",
     examples: [
@@ -35843,9 +36093,9 @@ var BootstrapReapCommand = class extends M8tCommand {
       ["\u2026and delete them", "$0 bootstrap reap --sweep-orphans --yes"]
     ]
   });
-  force = Option60.Boolean("--force", false, { description: "Reap even if the install failed or never reported a status." });
-  sweepOrphans = Option60.Boolean("--sweep-orphans", false, { description: "Subscription-wide: find m8t role assignments orphaned by earlier installs. Lists only, unless --yes." });
-  yes = Option60.Boolean("--yes", false, { description: "With --sweep-orphans, actually delete what the sweep found." });
+  force = Option61.Boolean("--force", false, { description: "Reap even if the install failed or never reported a status." });
+  sweepOrphans = Option61.Boolean("--sweep-orphans", false, { description: "Subscription-wide: find m8t role assignments orphaned by earlier installs. Lists only, unless --yes." });
+  yes = Option61.Boolean("--yes", false, { description: "With --sweep-orphans, actually delete what the sweep found." });
   async executeCommand() {
     if (this.sweepOrphans === true) {
       const { subscriptionId: sub } = await getAzAccount();
@@ -35939,10 +36189,10 @@ Found ${String(total)} orphaned assignment(s) (${breakdown}) (dry-run). ${colors
 };
 
 // src/commands/bootstrap/ui.ts
-import { Command as Command64, Option as Option61 } from "clipanion";
+import { Command as Command65, Option as Option62 } from "clipanion";
 
 // src/lib/bootstrap-ui.ts
-import * as fs40 from "fs";
+import * as fs41 from "fs";
 import * as net from "net";
 import * as os21 from "os";
 import * as path45 from "path";
@@ -35978,7 +36228,7 @@ function parseManagedPid(text) {
 function stopPidFile(pidPath) {
   let pidStr;
   try {
-    pidStr = fs40.readFileSync(pidPath, "utf8").trim();
+    pidStr = fs41.readFileSync(pidPath, "utf8").trim();
   } catch {
     return false;
   }
@@ -35995,7 +36245,7 @@ function stopPidFile(pidPath) {
     }
   }
   try {
-    fs40.unlinkSync(pidPath);
+    fs41.unlinkSync(pidPath);
   } catch {
   }
   return true;
@@ -36014,7 +36264,7 @@ function renderDeprecationNotice() {
 }
 var BootstrapUiCommand = class extends M8tCommand {
   static paths = [["bootstrap", "ui"]];
-  static usage = Command64.Usage({
+  static usage = Command65.Usage({
     description: "DEPRECATED \u2014 does nothing. Use `m8t bootstrap profile` instead.",
     details: [
       "The local onboarding chat has been retired. Your details are collected by",
@@ -36034,14 +36284,14 @@ var BootstrapUiCommand = class extends M8tCommand {
   // Accepted and ignored, deliberately: removing them would turn an old script's
   // harmless no-op into an "unknown option" failure mid-install. CLI-rewrite: drop
   // the whole surface when the rewrite lands.
-  repoRoot = Option61.String("--repo-root", { description: "Ignored (deprecated)." });
-  port = Option61.String("--port", "3000", { description: "Ignored (deprecated)." });
-  endpoint = Option61.String("--endpoint", { description: "Ignored (deprecated)." });
-  prepOnly = Option61.Boolean("--prep-only", false, { description: "Ignored (deprecated)." });
-  skipInstall = Option61.Boolean("--skip-install", false, { description: "Ignored (deprecated)." });
-  foreground = Option61.Boolean("--foreground", false, { description: "Ignored (deprecated)." });
-  voice = Option61.Boolean("--voice", false, { description: "Ignored (deprecated)." });
-  stop = Option61.Boolean("--stop", false, {
+  repoRoot = Option62.String("--repo-root", { description: "Ignored (deprecated)." });
+  port = Option62.String("--port", "3000", { description: "Ignored (deprecated)." });
+  endpoint = Option62.String("--endpoint", { description: "Ignored (deprecated)." });
+  prepOnly = Option62.Boolean("--prep-only", false, { description: "Ignored (deprecated)." });
+  skipInstall = Option62.Boolean("--skip-install", false, { description: "Ignored (deprecated)." });
+  foreground = Option62.Boolean("--foreground", false, { description: "Ignored (deprecated)." });
+  voice = Option62.Boolean("--voice", false, { description: "Ignored (deprecated)." });
+  stop = Option62.Boolean("--stop", false, {
     description: "Shut down a local chat UI left running by an earlier version of this command."
   });
   // Not `async`: there is nothing left to await. Everything this command used to
@@ -36063,7 +36313,7 @@ var BootstrapUiCommand = class extends M8tCommand {
 
 // src/commands/bootstrap/profile.ts
 import * as readline3 from "readline/promises";
-import { Command as Command65, Option as Option62 } from "clipanion";
+import { Command as Command66, Option as Option63 } from "clipanion";
 
 // src/lib/profile-collect.ts
 init_errors();
@@ -36232,7 +36482,7 @@ async function openChatInvite(deps = {}) {
 // src/commands/bootstrap/profile.ts
 var BootstrapProfileCommand = class extends M8tCommand {
   static paths = [["bootstrap", "profile"]];
-  static usage = Command65.Usage({
+  static usage = Command66.Usage({
     description: "Confirm your email + your Microsoft startup advisor, and open Ezra to talk to while the install runs.",
     details: [
       "Run after `m8t bootstrap launch`, in parallel with `status --watch`. Records the two",
@@ -36252,12 +36502,12 @@ var BootstrapProfileCommand = class extends M8tCommand {
       ["Skip the browser hand-off", "$0 bootstrap profile --founder-email you@example.com --print"]
     ]
   });
-  founderEmail = Option62.String("--founder-email", { description: "The founder's contact address \u2014 Ezra copies them on its outbound mail." });
-  advisorName = Option62.String("--advisor-name", { description: "Their Microsoft startup advisor's name." });
-  advisorEmail = Option62.String("--advisor-email", { description: "Their Microsoft startup advisor's email." });
-  noAdvisor = Option62.Boolean("--no-advisor", false, { description: "Record that they have no startup advisor to add (or don't know it yet)." });
-  noChat = Option62.Boolean("--no-chat", false, { description: "Record the answers without opening the hosted Ezra." });
-  print = Option62.Boolean("--print", false, { description: "Print the chat link instead of opening a browser (headless / SSH)." });
+  founderEmail = Option63.String("--founder-email", { description: "The founder's contact address \u2014 Ezra copies them on its outbound mail." });
+  advisorName = Option63.String("--advisor-name", { description: "Their Microsoft startup advisor's name." });
+  advisorEmail = Option63.String("--advisor-email", { description: "Their Microsoft startup advisor's email." });
+  noAdvisor = Option63.Boolean("--no-advisor", false, { description: "Record that they have no startup advisor to add (or don't know it yet)." });
+  noChat = Option63.Boolean("--no-chat", false, { description: "Record the answers without opening the hosted Ezra." });
+  print = Option63.Boolean("--print", false, { description: "Print the chat link instead of opening a browser (headless / SSH)." });
   async executeCommand() {
     const stdin = this.context.stdin;
     const stdout = this.context.stdout;
@@ -36350,10 +36600,10 @@ var BootstrapProfileCommand = class extends M8tCommand {
 };
 
 // src/commands/bootstrap/seed-profile.ts
-import { Command as Command66, Option as Option63 } from "clipanion";
+import { Command as Command67, Option as Option64 } from "clipanion";
 var BootstrapSeedProfileCommand = class extends M8tCommand {
   static paths = [["bootstrap", "seed-profile"]];
-  static usage = Command66.Usage({
+  static usage = Command67.Usage({
     description: "Seed your advisors' brains with how to reach you, from what you confirmed at `m8t bootstrap profile`.",
     details: [
       "Renders memory/founder.md + memory/company-profile.md (+ their MEMORY.md index lines)",
@@ -36370,11 +36620,11 @@ var BootstrapSeedProfileCommand = class extends M8tCommand {
       ["Seed now (idempotent)", "$0 bootstrap seed-profile"]
     ]
   });
-  endpoint = Option63.String("--endpoint", { description: "Override the Foundry endpoint (else read from the install status)." });
-  brain = Option63.String("--brain", { description: "Seed only this one brain repo, instead of both <org>/stacey-brain and <org>/ezra-brain." });
-  watch = Option63.Boolean("--watch", false, { description: "Poll until the intake completes (or --timeout)." });
-  timeout = Option63.String("--timeout", { description: "Watch timeout in minutes (default 20)." });
-  githubAppCreds = Option63.String("--github-app-creds");
+  endpoint = Option64.String("--endpoint", { description: "Override the Foundry endpoint (else read from the install status)." });
+  brain = Option64.String("--brain", { description: "Seed only this one brain repo, instead of both <org>/stacey-brain and <org>/ezra-brain." });
+  watch = Option64.Boolean("--watch", false, { description: "Poll until the intake completes (or --timeout)." });
+  timeout = Option64.String("--timeout", { description: "Watch timeout in minutes (default 20)." });
+  githubAppCreds = Option64.String("--github-app-creds");
   async executeCommand() {
     const ctx = await resolveSeedContext({
       endpointOverride: typeof this.endpoint === "string" ? this.endpoint : void 0,
@@ -36459,10 +36709,10 @@ var BootstrapSeedProfileCommand = class extends M8tCommand {
 };
 
 // src/commands/telemetry/enroll.ts
-import * as fs41 from "fs";
+import * as fs42 from "fs";
 import * as os22 from "os";
 import * as path46 from "path";
-import { Command as Command67, Option as Option64 } from "clipanion";
+import { Command as Command68, Option as Option65 } from "clipanion";
 init_errors();
 
 // src/lib/telemetry-enroll.ts
@@ -36544,7 +36794,7 @@ async function resolveKeyVaultName(containerAppResourceId) {
 }
 var TelemetryEnrollCommand = class extends M8tCommand {
   static paths = [["telemetry", "enroll"]];
-  static usage = Command67.Usage({
+  static usage = Command68.Usage({
     description: "Enroll this installation for operational telemetry (pre-existing installs).",
     details: "Generates an instance id + ingest key from the m8t telemetry ingest and stores the key in your platform Key Vault, the same place the installer writes it on a fresh install. Your installation is identified only by that random instance id \u2014 no contact, company, or subscription details are sent unless you pass them explicitly. Idempotent: refuses if a key already exists.",
     examples: [
@@ -36552,11 +36802,11 @@ var TelemetryEnrollCommand = class extends M8tCommand {
       ["Enroll and share a support contact", "$0 telemetry enroll --contact-email you@example.com --company 'Acme'"]
     ]
   });
-  company = Option64.String("--company", { description: "Share your company name with m8t support. Not sent unless you pass it." });
-  contactEmail = Option64.String("--contact-email", { description: "Share a contact email with m8t support. Not sent unless you pass it." });
-  subscription = Option64.String("--subscription", { description: "Azure subscription id used to find your deployment. Never sent to m8t." });
-  resourceGroup = Option64.String("--resource-group", { description: "Resource group to disambiguate discovery, if you have more than one m8t deployment." });
-  force = Option64.Boolean("--force", false, { description: "Enroll even when a key is already stored. Use only when m8t support asks you to." });
+  company = Option65.String("--company", { description: "Share your company name with m8t support. Not sent unless you pass it." });
+  contactEmail = Option65.String("--contact-email", { description: "Share a contact email with m8t support. Not sent unless you pass it." });
+  subscription = Option65.String("--subscription", { description: "Azure subscription id used to find your deployment. Never sent to m8t." });
+  resourceGroup = Option65.String("--resource-group", { description: "Resource group to disambiguate discovery, if you have more than one m8t deployment." });
+  force = Option65.Boolean("--force", false, { description: "Enroll even when a key is already stored. Use only when m8t support asks you to." });
   async executeCommand() {
     const account = await getAzAccount();
     const subscriptionId = (typeof this.subscription === "string" ? this.subscription : void 0) ?? account.subscriptionId;
@@ -36589,13 +36839,13 @@ var TelemetryEnrollCommand = class extends M8tCommand {
       ...company ? { company } : {},
       ...contactEmail ? { contactEmail } : {}
     });
-    const keyDir = fs41.mkdtempSync(path46.join(os22.tmpdir(), "m8t-ingest-key-"));
+    const keyDir = fs42.mkdtempSync(path46.join(os22.tmpdir(), "m8t-ingest-key-"));
     const keyFile = path46.join(keyDir, "key");
     try {
-      fs41.writeFileSync(keyFile, ingestKey, { mode: 384 });
+      fs42.writeFileSync(keyFile, ingestKey, { mode: 384 });
       await runAz(["keyvault", "secret", "set", "--vault-name", kvName, "--name", INGEST_KEY_SECRET, "--file", keyFile, "--only-show-errors"]);
     } finally {
-      fs41.rmSync(keyDir, { recursive: true, force: true });
+      fs42.rmSync(keyDir, { recursive: true, force: true });
     }
     this.context.stdout.write(
       `${colors.success("\u2713")} enrolled (instance ${instanceId}); ingest key stored in Key Vault ${kvName}. The gateway picks it up on its next cycle.
@@ -36606,7 +36856,7 @@ var TelemetryEnrollCommand = class extends M8tCommand {
 };
 
 // src/commands/companion/bridge.ts
-import { Command as Command68, Option as Option65 } from "clipanion";
+import { Command as Command69, Option as Option66 } from "clipanion";
 
 // ../../packages/companion-bridge-contract/src/index.ts
 var COMPANION_MESSAGE_MAX_CODE_POINTS = 32768;
@@ -38073,14 +38323,14 @@ async function runCompanionBridge(stdin, stdout, stderr, deps = defaultDeps3) {
     return 3;
   }
 }
-var CompanionBridgeCommand = class extends Command68 {
+var CompanionBridgeCommand = class extends Command69 {
   static paths = [["companion", "_bridge"]];
   /**
    * One process serving many requests instead of one per request, so the
    * session keeps its authenticated context between them. A CLI predating the
    * flag rejects it outright, which is how the app knows to fall back.
    */
-  serve = Option65.Boolean("--serve", false);
+  serve = Option66.Boolean("--serve", false);
   async execute() {
     if (this.serve) {
       return runCompanionBridgeServe(
@@ -38098,7 +38348,7 @@ var CompanionBridgeCommand = class extends Command68 {
 };
 
 // src/commands/companion/status.ts
-import { Command as Command69 } from "clipanion";
+import { Command as Command70 } from "clipanion";
 async function withTimeout(work, ms) {
   let timer;
   try {
@@ -38170,7 +38420,7 @@ Run: m8t companion install
 }
 var CompanionStatusCommand = class extends M8tCommand {
   static paths = [["companion", "status"]];
-  static usage = Command69.Usage({
+  static usage = Command70.Usage({
     description: "Verify the installed desktop companion without launching it."
   });
   async executeCommand() {
@@ -38184,7 +38434,7 @@ var CompanionStatusCommand = class extends M8tCommand {
 };
 
 // src/commands/companion/repair.ts
-import { Command as Command70, Option as Option66 } from "clipanion";
+import { Command as Command71, Option as Option67 } from "clipanion";
 async function runCompanionRepairCommand(stdout, repair) {
   const state = await repair();
   if (state.state === "not-released") {
@@ -38203,10 +38453,10 @@ async function runCompanionRepairCommand(stdout, repair) {
 }
 var CompanionRepairCommand = class extends M8tCommand {
   static paths = [["companion", "repair"]];
-  static usage = Command70.Usage({
+  static usage = Command71.Usage({
     description: "Restore the desktop companions and start-at-login state."
   });
-  resourceGroup = Option66.String("--resource-group", {
+  resourceGroup = Option67.String("--resource-group", {
     description: "Which deployment to bind to, when the subscription holds more than one."
   });
   async executeCommand() {
@@ -38224,7 +38474,7 @@ var CompanionRepairCommand = class extends M8tCommand {
 };
 
 // src/commands/companion/uninstall.ts
-import { Command as Command71 } from "clipanion";
+import { Command as Command72 } from "clipanion";
 async function runCompanionUninstallCommand(stdout, uninstall) {
   const state = await uninstall();
   if (state.state !== "not-installed") {
@@ -38236,7 +38486,7 @@ async function runCompanionUninstallCommand(stdout, uninstall) {
 }
 var CompanionUninstallCommand = class extends M8tCommand {
   static paths = [["companion", "uninstall"]];
-  static usage = Command71.Usage({
+  static usage = Command72.Usage({
     description: "Remove only this user's desktop companion installation."
   });
   async executeCommand() {
@@ -38297,6 +38547,7 @@ cli.register(PlatformConvergeCommand);
 cli.register(PlatformClearIntentCommand);
 cli.register(PlatformRequestUpdateCommand);
 cli.register(PlatformSeedStampCommand);
+cli.register(PlatformVerifyContentCommand);
 cli.register(PlatformGatewayAdoptCommand);
 cli.register(PlatformPolicyCommand);
 cli.register(PlatformEnableCostReportCommand);