@m8t-stack/cli 0.2.88 → 0.2.90

package/dist/cli.js

@@ -1461,8 +1461,33 @@ var init_enable_hosted_brain = __esm({
 // src/cli.ts
 import { Builtins, Cli } from "clipanion";
 
+// src/lib/dns-shim.ts
+import dns from "dns";
+var installed = false;
+function installFoundryDnsShim() {
+  if (installed) return;
+  installed = true;
+  const origLookup = dns.lookup.bind(dns);
+  dns.lookup = (hostname, options, cb) => {
+    const opts = typeof options === "function" ? {} : options;
+    const callback = typeof options === "function" ? options : cb;
+    if (typeof hostname === "string" && hostname.endsWith("services.ai.azure.com")) {
+      dns.resolve4(hostname, (err, addrs) => {
+        if (err || !addrs?.length) {
+          origLookup(hostname, options, cb);
+          return;
+        }
+        if (opts?.all) callback(null, addrs.map((a) => ({ address: a, family: 4 })));
+        else callback(null, addrs[0], 4);
+      });
+      return;
+    }
+    origLookup(hostname, options, cb);
+  };
+}
+
 // src/lib/package-version.ts
-var CLI_VERSION = "0.2.88";
+var CLI_VERSION = "0.2.90";
 
 // src/lib/render-error.ts
 init_errors();
@@ -19667,19 +19692,20 @@ init_rbac();
 // src/lib/acs-provision.ts
 var MANAGED_DOMAIN = "AzureManagedDomain";
 async function provisionAcsEmail(args) {
-  const { client, subscriptionId, resourceGroup, name, dataLocation, onProgress } = args;
-  const acsName = `acs-${name}`;
-  const emailName = `${name}-email`;
+  const { client, subscriptionId, resourceGroup, name, dataLocation, tags, onProgress } = args;
+  const acsName = args.acsName ?? `acs-${name}`;
+  const emailName = args.emailName ?? `${name}-email`;
   onProgress?.(`creating ACS resource ${acsName}\u2026`);
   const acs = await client.communicationServices.beginCreateOrUpdateAndWait(
     resourceGroup,
     acsName,
-    { location: "global", dataLocation }
+    { location: "global", dataLocation, ...tags ? { tags } : {} }
   );
   onProgress?.(`creating Email Communication Service ${emailName}\u2026`);
   await client.emailServices.beginCreateOrUpdateAndWait(resourceGroup, emailName, {
     location: "global",
-    dataLocation
+    dataLocation,
+    ...tags ? { tags } : {}
   });
   onProgress?.("provisioning the Azure-managed domain\u2026");
   const domain = await client.domains.beginCreateOrUpdateAndWait(
@@ -19693,7 +19719,8 @@ async function provisionAcsEmail(args) {
   await client.communicationServices.beginCreateOrUpdateAndWait(resourceGroup, acsName, {
     location: "global",
     dataLocation,
-    linkedDomains: [domainResourceId]
+    linkedDomains: [domainResourceId],
+    ...tags ? { tags } : {}
   });
   const hostName = acs.hostName ?? `${acsName}.communication.azure.com`;
   const fromSenderDomain = domain.fromSenderDomain;
@@ -19706,6 +19733,515 @@ async function provisionAcsEmail(args) {
   };
 }
 
+// src/lib/acs-resolve.ts
+init_errors();
+var ACS_PLATFORM_TAG = "m8t:email";
+var ACS_PLATFORM_TAG_VALUE = "platform";
+var VERIFIED = "Verified";
+function emailFeatureFrom(acs, enabled) {
+  return { enabled, acsEndpoint: acs.endpoint, acsSender: acs.sender };
+}
+function platformSuffixFromKvUri(kvUri) {
+  const host = /^https?:\/\/([^./]+)\./i.exec(kvUri.trim())?.[1];
+  if (!host) return null;
+  return /^m8t-kv-(.+)$/i.exec(host)?.[1] ?? host;
+}
+function resourceGroupFromArmId(armId) {
+  return /\/resourceGroups\/([^/]+)/i.exec(armId)?.[1] ?? null;
+}
+function classifyGrantScope(grantScope, expectedSubscriptionId) {
+  const unusable = (reason) => ({ kind: "unusable", reason });
+  const parts = grantScope.trim().replace(/^\/+/, "").replace(/\/+$/, "").split("/");
+  if (parts.length < 2 || parts[0]?.toLowerCase() !== "subscriptions") {
+    return unusable(`'${grantScope}' is not a recognisable Azure scope`);
+  }
+  const subscriptionId = parts[1] ?? "";
+  if (subscriptionId === "") return unusable(`'${grantScope}' names no subscription`);
+  if (subscriptionId.toLowerCase() !== expectedSubscriptionId.toLowerCase()) {
+    return unusable(
+      `the Contributor scope is in subscription ${subscriptionId}, but this deploy targets ${expectedSubscriptionId} \u2014 an ACS created here would not be covered by that grant`
+    );
+  }
+  if (parts.length === 2) return { kind: "subscription", subscriptionId };
+  if (parts.length < 4 || parts[2]?.toLowerCase() !== "resourcegroups") {
+    return unusable(`'${grantScope}' is neither a subscription nor a resource-group scope`);
+  }
+  const resourceGroup = parts[3] ?? "";
+  if (resourceGroup === "") return unusable(`'${grantScope}' names no resource group`);
+  if (parts.length > 4) {
+    return unusable(
+      `the Contributor scope is a single resource (${grantScope}), so no resource group is authorised for an ACS data-plane send`
+    );
+  }
+  return { kind: "resource-group", subscriptionId, resourceGroup };
+}
+function parseDomainId(id) {
+  const m = /\/emailServices\/([^/]+)\/domains\/([^/]+)/i.exec(id);
+  if (!m?.[1] || !m[2]) return null;
+  return { emailServiceName: m[1], domainName: m[2] };
+}
+async function resolveAcs(args) {
+  const { client, stamp, subscriptionId, resourceGroup, suffix, dataLocation, onProgress } = args;
+  const recorded = stamp?.features?.email;
+  if (recorded?.acsEndpoint && recorded.acsSender) {
+    onProgress?.("using the ACS sender recorded in the platform stamp.");
+    return { source: "stamp", acs: { endpoint: recorded.acsEndpoint, sender: recorded.acsSender } };
+  }
+  onProgress?.(`looking for an existing email-capable ACS in ${resourceGroup}\u2026`);
+  const candidates = [];
+  for await (const r of client.communicationServices.listByResourceGroup(resourceGroup)) {
+    const linked = r.linkedDomains;
+    if (!linked || linked.length === 0) continue;
+    if (!r.name || !r.hostName) continue;
+    candidates.push({
+      name: r.name,
+      hostName: r.hostName,
+      linkedDomains: linked,
+      tagged: r.tags?.[ACS_PLATFORM_TAG] === ACS_PLATFORM_TAG_VALUE
+    });
+  }
+  candidates.sort((a, b) => a.tagged === b.tagged ? a.name.localeCompare(b.name) : a.tagged ? -1 : 1);
+  for (const c of candidates) {
+    const sender = await verifiedSenderFor(client, resourceGroup, c);
+    if (sender === null) continue;
+    onProgress?.(`adopting the existing ACS ${c.name} (verified managed domain).`);
+    return { source: "discovered", acsName: c.name, acs: { endpoint: `https://${c.hostName}/`, sender } };
+  }
+  if (suffix === null || suffix === "") {
+    throw new LocalCliError({
+      code: "NO_PLATFORM_SUFFIX",
+      message: "No email-capable ACS exists here and one cannot be named: this install's resource suffix could not be worked out.",
+      hint: "Pass --kv-uri <install vault uri> (or set AZURE_KEYVAULT_URI) so the ACS can be named consistently with the rest of the platform."
+    });
+  }
+  const acsName = `m8t-acs-${suffix}`;
+  const emailName = `m8t-email-${suffix}`;
+  onProgress?.(`no email-capable ACS found \u2014 provisioning ${acsName}\u2026`);
+  const provisioned = await provisionAcsEmail({
+    client,
+    subscriptionId,
+    resourceGroup,
+    name: `m8t-${suffix}`,
+    acsName,
+    emailName,
+    dataLocation,
+    tags: { [ACS_PLATFORM_TAG]: ACS_PLATFORM_TAG_VALUE },
+    onProgress
+  });
+  return { source: "provisioned", acsName, acs: { endpoint: provisioned.endpoint, sender: provisioned.sender } };
+}
+async function verifiedSenderFor(client, resourceGroup, c) {
+  for (const id of c.linkedDomains) {
+    const parsed = parseDomainId(id);
+    if (!parsed) continue;
+    try {
+      const d = await client.domains.get(resourceGroup, parsed.emailServiceName, parsed.domainName);
+      if (d.verificationStates?.domain?.status !== VERIFIED) continue;
+      if (!d.fromSenderDomain) continue;
+      return `DoNotReply@${d.fromSenderDomain}`;
+    } catch {
+      continue;
+    }
+  }
+  return null;
+}
+
+// src/lib/platform-stamp.ts
+import { TableClient as TableClient2 } from "@azure/data-tables";
+
+// ../../packages/platform-release/dist/esm/manifest.js
+var SEVERITIES = ["critical", "recommended", "optional"];
+var IMAGE_KEYS = ["gateway", "codingAgent", "azureExecutor", "installer"];
+var COMPANION_TARGETS = [
+  "darwin-arm64",
+  "darwin-x64",
+  "win32-arm64",
+  "win32-x64"
+];
+function companionTargetFor(platform, architecture) {
+  const target = `${platform}-${architecture}`;
+  return COMPANION_TARGETS.includes(target) ? target : null;
+}
+function isObj2(v) {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+function validateManifest(m) {
+  const errors = [];
+  if (!isObj2(m))
+    return ["manifest is not an object"];
+  if (m.schemaVersion !== 1)
+    errors.push("schemaVersion must be the integer 1");
+  const p = m.platform;
+  if (!isObj2(p)) {
+    errors.push("platform is required");
+  } else {
+    for (const f of ["version", "tag", "releasedAt", "commit", "notes", "notesUrl"]) {
+      if (typeof p[f] !== "string" || p[f].length === 0)
+        errors.push(`platform.${f} is required`);
+    }
+    if (!SEVERITIES.includes(p.severity))
+      errors.push(`platform.severity must be one of ${SEVERITIES.join("|")}`);
+    if (!(typeof p.previousVersion === "string" || p.previousVersion === null)) {
+      errors.push("platform.previousVersion must be a string or null");
+    }
+  }
+  const c = m.components;
+  if (!isObj2(c)) {
+    errors.push("components is required");
+    return errors;
+  }
+  for (const key2 of IMAGE_KEYS) {
+    const img = c[key2];
+    if (!isObj2(img)) {
+      errors.push(`components.${key2} is required`);
+      continue;
+    }
+    if (img.kind !== "image")
+      errors.push(`components.${key2}.kind must be "image"`);
+    for (const f of ["ref", "tag", "version"]) {
+      if (typeof img[f] !== "string" || img[f].length === 0)
+        errors.push(`components.${key2}.${f} is required`);
+    }
+    if (typeof img.digest !== "string" || !/^sha256:[0-9a-f]+$/.test(img.digest)) {
+      errors.push(`components.${key2}.digest must be a sha256:\u2026 digest`);
+    }
+  }
+  const cli2 = c.cli;
+  if (!isObj2(cli2) || cli2.kind !== "npm") {
+    errors.push("components.cli (kind: npm) is required");
+  } else {
+    for (const f of ["package", "version", "min", "recommended"]) {
+      if (typeof cli2[f] !== "string" || cli2[f].length === 0)
+        errors.push(`components.cli.${f} is required`);
+    }
+  }
+  const personas = c.personas;
+  if (!isObj2(personas) || !isObj2(personas.items)) {
+    errors.push("components.personas.items is required");
+  } else {
+    for (const [name, item] of Object.entries(personas.items)) {
+      if (!isObj2(item) || typeof item.path !== "string" || item.path.length === 0) {
+        errors.push(`components.personas.items.${name}.path is required`);
+      }
+      if (!isObj2(item) || typeof item.treeSha !== "string" || item.treeSha.length < 4) {
+        errors.push(`components.personas.items.${name}.treeSha is required`);
+      }
+    }
+  }
+  const seeds = c.brainSeeds;
+  if (!isObj2(seeds) || !isObj2(seeds.items)) {
+    errors.push("components.brainSeeds.items is required");
+  } else {
+    for (const [name, item] of Object.entries(seeds.items)) {
+      if (!isObj2(item) || typeof item.path !== "string" || item.path.length === 0) {
+        errors.push(`components.brainSeeds.items.${name}.path is required`);
+      }
+      if (!isObj2(item) || !isObj2(item.subtrees)) {
+        errors.push(`components.brainSeeds.items.${name}.subtrees is required`);
+      }
+    }
+  }
+  const infra = c.infra;
+  if (infra !== void 0) {
+    if (!isObj2(infra) || infra.kind !== "infra") {
+      errors.push('components.infra.kind must be "infra"');
+    }
+    if (!isObj2(infra) || typeof infra.treeSha !== "string" || infra.treeSha.length < 4) {
+      errors.push("components.infra.treeSha is required");
+    }
+  }
+  const companion = c.companion;
+  if (companion !== void 0) {
+    if (!isObj2(companion) || companion.kind !== "desktop") {
+      errors.push('components.companion.kind must be "desktop"');
+    } else {
+      for (const f of ["version", "tag"]) {
+        if (typeof companion[f] !== "string" || companion[f].length === 0) {
+          errors.push(`components.companion.${f} is required`);
+        }
+      }
+      if (!isObj2(companion.targets) || Object.keys(companion.targets).length === 0) {
+        errors.push("components.companion.targets must name at least one target");
+      } else {
+        for (const [name, target] of Object.entries(companion.targets)) {
+          if (!COMPANION_TARGETS.includes(name)) {
+            errors.push(`components.companion.targets.${name} is not a known target`);
+            continue;
+          }
+          if (!isObj2(target) || typeof target.asset !== "string" || target.asset.length === 0) {
+            errors.push(`components.companion.targets.${name}.asset is required`);
+          }
+          if (!isObj2(target) || typeof target.sha256 !== "string" || !/^[0-9a-f]{64}$/.test(target.sha256)) {
+            errors.push(`components.companion.targets.${name}.sha256 must be a sha256 hex digest`);
+          }
+        }
+      }
+    }
+  }
+  return errors;
+}
+
+// ../../packages/platform-release/dist/esm/stamp.js
+var TABLE = "Metadata";
+var PK = "system";
+var RK = "platform";
+function isEmailFeatureUsable(f) {
+  return f?.enabled === true && typeof f.acsEndpoint === "string" && f.acsEndpoint !== "" && typeof f.acsSender === "string" && f.acsSender !== "";
+}
+function stampToEntity(s) {
+  return {
+    partitionKey: PK,
+    rowKey: RK,
+    platformVersion: s.platformVersion,
+    updatedAt: s.updatedAt,
+    lastResult: s.lastResult,
+    value: JSON.stringify(s)
+  };
+}
+function entityToStamp(e) {
+  const raw = e.value;
+  if (typeof raw !== "string")
+    return null;
+  try {
+    return JSON.parse(raw);
+  } catch {
+    return null;
+  }
+}
+
+// ../../packages/platform-release/dist/esm/channel-url.js
+var RELEASES_REPO = "m8t-labs/m8t-releases";
+var RELEASES_BASE = `https://github.com/${RELEASES_REPO}/releases`;
+var CHANNEL_LATEST_URL = `${RELEASES_BASE}/latest/download/manifest.json`;
+var CANARY_POINTER_TAG = "canary";
+var CHANNEL_CANARY_URL = `${RELEASES_BASE}/download/${CANARY_POINTER_TAG}/manifest.json`;
+function platformTag(version) {
+  const bare = version.trim().replace(/^platform-/, "").replace(/^v/, "");
+  return `platform-v${bare}`;
+}
+function channelUrlForVersion(version) {
+  return `${RELEASES_BASE}/download/${platformTag(version)}/manifest.json`;
+}
+function releaseAssetUrl(tag, asset) {
+  return `${RELEASES_BASE}/download/${tag}/${asset}`;
+}
+
+// ../../packages/platform-release/dist/esm/canary-version.js
+var CANARY_IDENTIFIER = "canary";
+var STABLE_CORE = String.raw`\d+\.\d+\.\d+`;
+var CANARY_SUFFIX = String.raw`-${CANARY_IDENTIFIER}\.(?:0|[1-9]\d*)`;
+var CANARY_VERSION_PATTERN = `^${STABLE_CORE}${CANARY_SUFFIX}$`;
+var PLATFORM_VERSION_PATTERN = `^${STABLE_CORE}(?:${CANARY_SUFFIX})?$`;
+var PLATFORM_TAG_PATTERN = `^platform-v${STABLE_CORE}(?:${CANARY_SUFFIX})?$`;
+var CANARY_VERSION_RE = new RegExp(CANARY_VERSION_PATTERN);
+var STABLE_CORE_RE = new RegExp(`^${STABLE_CORE}$`);
+
+// ../../packages/platform-release/dist/esm/apply-request.js
+var APPLY_REQUEST_PK = "system";
+var APPLY_REQUEST_RK = "apply-request";
+var IN_FLIGHT = ["claimed", "applying"];
+var LEASE_MS = 30 * 60 * 1e3;
+var MAX_LEASE_TAKEOVERS = 2;
+var MAX_HEALTHY_IN_FLIGHT_MS = LEASE_MS * (MAX_LEASE_TAKEOVERS + 1);
+function isInFlight(status) {
+  return IN_FLIGHT.includes(status);
+}
+var BLOCKS_NEW_INTENT = ["pending", "claimed", "applying", "awaiting-engine-update"];
+function blocksNewIntent(status) {
+  return BLOCKS_NEW_INTENT.includes(status);
+}
+function newIntent(target, provenance, nowIso) {
+  return {
+    schemaVersion: 1,
+    target,
+    provenance,
+    status: "pending",
+    phase: null,
+    claimedBy: null,
+    leaseUntil: null,
+    attempt: 0,
+    breaker: "none",
+    result: null,
+    createdAt: nowIso,
+    updatedAt: nowIso
+  };
+}
+function applyRequestToEntity(r) {
+  return { partitionKey: APPLY_REQUEST_PK, rowKey: APPLY_REQUEST_RK, value: JSON.stringify(r), updatedAt: r.updatedAt };
+}
+function entityToApplyRequest(e) {
+  return JSON.parse(e.value);
+}
+
+// ../../packages/platform-release/dist/esm/update-policy.js
+var DEFAULT_POLICY_MODE = "auto-critical";
+var UPDATE_POLICY_PK = "system";
+var UPDATE_POLICY_RK = "update-policy";
+var MODES = ["notify-only", "auto-critical", "auto-all"];
+function isPolicyMode(x) {
+  return typeof x === "string" && MODES.includes(x);
+}
+function updatePolicyToEntity(p) {
+  return { partitionKey: UPDATE_POLICY_PK, rowKey: UPDATE_POLICY_RK, value: JSON.stringify(p) };
+}
+function entityToUpdatePolicy(e) {
+  return JSON.parse(e.value);
+}
+
+// ../../packages/platform-release/dist/esm/infra-params.js
+var INFRA_PARAMS_PK = "system";
+var INFRA_PARAMS_RK = "infra-params";
+function infraParamsToEntity(p) {
+  return { partitionKey: INFRA_PARAMS_PK, rowKey: INFRA_PARAMS_RK, value: JSON.stringify(p) };
+}
+function entityToInfraParams(e) {
+  return JSON.parse(e.value);
+}
+
+// src/lib/platform-storage-discovery.ts
+init_http();
+init_errors();
+var ARM3 = "https://management.azure.com";
+var ARM_SCOPE7 = "https://management.azure.com/.default";
+var STORAGE_API = "2023-05-01";
+async function discoverStampStorage(opts) {
+  const list = await authedJson({
+    credential: opts.credential,
+    scope: ARM_SCOPE7,
+    method: "GET",
+    url: `${ARM3}/subscriptions/${opts.subscriptionId}/resourceGroups/${opts.resourceGroup}/providers/Microsoft.Storage/storageAccounts?api-version=${STORAGE_API}`
+  }) ?? {};
+  const accounts = (list.value ?? []).filter((a) => a.properties?.primaryEndpoints?.table);
+  const chosen = accounts.find((a) => a.tags?.m8t === "storage") ?? accounts.find((a) => a.tags?.["m8t:role"] === "gateway" || a.tags?.["m8t:role"] === "ledger") ?? (accounts.length === 1 ? accounts[0] : void 0);
+  const tableEndpoint = chosen?.properties?.primaryEndpoints?.table?.replace(/\/$/, "");
+  if (!tableEndpoint || !chosen?.id || !chosen.name) {
+    throw new LocalCliError({
+      code: "PLATFORM_STAMP_STORAGE_NOT_FOUND",
+      message: `No table-capable storage account found in resource group ${opts.resourceGroup}.`,
+      hint: `Found: ${accounts.map((a) => a.name).join(", ") || "(none)"}.`
+    });
+  }
+  return { tableEndpoint, accountResourceId: chosen.id, accountName: chosen.name };
+}
+
+// src/lib/metadata-table-write.ts
+import { TableClient, AzureNamedKeyCredential } from "@azure/data-tables";
+init_errors();
+init_rbac();
+function is403(e) {
+  return e.statusCode === 403;
+}
+function is404(e) {
+  return e.statusCode === 404;
+}
+function sleep2(ms) {
+  return new Promise((r) => setTimeout(r, ms));
+}
+async function makeSharedKeyClient(opts) {
+  const rg = /\/resourceGroups\/([^/]+)\//i.exec(opts.accountResourceId)?.[1];
+  if (!rg) return null;
+  const key2 = (await runAz(["storage", "account", "keys", "list", "--account-name", opts.accountName, "-g", rg, "--query", "[0].value", "-o", "tsv"])).trim();
+  if (!key2) return null;
+  return new TableClient(opts.tableEndpoint, TABLE, new AzureNamedKeyCredential(opts.accountName, key2));
+}
+async function upsertMetadataEntity(opts) {
+  const discover = opts.discoverImpl ?? discoverStampStorage;
+  const makeAad = opts.aadClientImpl ?? ((endpoint, credential2) => new TableClient(endpoint, TABLE, credential2));
+  const makeShared = opts.sharedClientImpl ?? makeSharedKeyClient;
+  const nap = opts.sleepImpl ?? sleep2;
+  const { tableEndpoint, accountResourceId, accountName } = await discover({
+    credential: opts.credential,
+    subscriptionId: opts.subscriptionId,
+    resourceGroup: opts.resourceGroup
+  });
+  const aad = makeAad(tableEndpoint, opts.credential);
+  await aad.createTable().catch(() => void 0);
+  try {
+    await aad.upsertEntity(opts.entity, "Replace");
+    return;
+  } catch (e) {
+    if (!is403(e)) throw e;
+  }
+  opts.onProgress?.(`writing the ${opts.label} with the account key \u2014 your identity lacks the Storage Table data role.`);
+  const shared = await makeShared({ tableEndpoint, accountResourceId, accountName });
+  if (shared) {
+    await shared.createTable().catch(() => void 0);
+    await shared.upsertEntity(opts.entity, "Replace");
+    return;
+  }
+  opts.onProgress?.("shared-key access is disabled \u2014 granting Storage Table Data Contributor to your identity (one-time)\u2026");
+  try {
+    const oid = await getCallerObjectId();
+    await grantStorageTableDataContributor({
+      credential: opts.credential,
+      subscriptionId: opts.subscriptionId,
+      scope: accountResourceId,
+      principalId: oid
+    });
+  } catch (e) {
+    throw new LocalCliError({
+      code: opts.errorCode,
+      message: `Cannot write the ${opts.label}: AAD lacks the Storage Table data role for ${accountName}, shared-key access is disabled, and self-granting the role failed.`,
+      hint: "Grant yourself 'Storage Table Data Contributor' on the storage account and retry.",
+      cause: e
+    });
+  }
+  for (let i = 0; i < 6; i++) {
+    await nap(1e4);
+    try {
+      await aad.upsertEntity(opts.entity, "Replace");
+      return;
+    } catch (e) {
+      if (!is403(e)) throw e;
+    }
+  }
+  throw new LocalCliError({
+    code: opts.errorCode,
+    message: `Cannot write the ${opts.label}: granted 'Storage Table Data Contributor' on ${accountName}, but the data-plane role has not propagated yet.`,
+    hint: opts.retryHint
+  });
+}
+
+// src/lib/platform-stamp.ts
+async function writeStamp(opts) {
+  const entity = stampToEntity(opts.stamp);
+  await upsertMetadataEntity({
+    credential: opts.credential,
+    subscriptionId: opts.subscriptionId,
+    resourceGroup: opts.resourceGroup,
+    entity,
+    label: "platform stamp",
+    errorCode: "PLATFORM_STAMP_NO_ACCESS",
+    retryHint: "The role assignment persists \u2014 retry 'm8t platform update' in a few minutes.",
+    ...opts.onProgress ? { onProgress: opts.onProgress } : {}
+  });
+}
+async function readStampOutcome(opts) {
+  const { tableEndpoint, accountResourceId, accountName } = await discoverStampStorage(opts);
+  const aad = new TableClient2(tableEndpoint, TABLE, opts.credential);
+  try {
+    const row = await aad.getEntity(PK, RK);
+    const stamp = entityToStamp(row);
+    return stamp ? { source: "explicit", stamp } : { source: "unreadable" };
+  } catch (e) {
+    if (is404(e)) return { source: "absent" };
+    if (!is403(e)) return { source: "unreadable" };
+  }
+  try {
+    const shared = await makeSharedKeyClient({ tableEndpoint, accountResourceId, accountName });
+    if (!shared) return { source: "unreadable" };
+    const row = await shared.getEntity(PK, RK);
+    const stamp = entityToStamp(row);
+    return stamp ? { source: "explicit", stamp } : { source: "unreadable" };
+  } catch {
+    return { source: "unreadable" };
+  }
+}
+async function readStamp(opts) {
+  const result2 = await readStampOutcome(opts);
+  return result2.source === "explicit" ? result2.stamp : null;
+}
+
 // src/commands/azure-exec/deploy.ts
 import { CommunicationServiceManagementClient } from "@azure/arm-communication";
 var SIZE_PRESETS2 = {
@@ -19746,7 +20282,14 @@ var AzureExecDeployCommand = class extends M8tCommand {
   output = Option31.String("--output");
   skipQuotaCheck = Option31.Boolean("--skip-quota-check", false);
   grantAccessAdmin = Option31.Boolean("--grant-access-admin", false);
-  enableEmail = Option31.Boolean("--enable-email", false);
+  /** Deprecated no-op: outbound email is provisioned by default now. Kept for one release
+   *  so runbooks and scripts that still pass it do not hard-fail. */
+  enableEmail = Option31.Boolean("--enable-email", false, {
+    description: "Deprecated no-op \u2014 outbound email is provisioned by default. Use --no-email to opt out."
+  });
+  noEmail = Option31.Boolean("--no-email", false, {
+    description: "Deploy without outbound email. The executor renders advisor handoffs but cannot send them."
+  });
   async executeCommand() {
     if (!NAME_RE2.test(this.name)) {
       throw new LocalCliError({
@@ -19796,12 +20339,8 @@ var AzureExecDeployCommand = class extends M8tCommand {
         });
       }
     }
-    if (this.enableEmail === true && (typeof this.resourceGroup !== "string" || this.resourceGroup.length === 0)) {
-      throw new LocalCliError({
-        code: "USAGE",
-        message: "--enable-email requires --resource-group (the ACS resource lands in the Contributor-granted RG so the executor's identity can send).",
-        hint: "Pass --resource-group <rg> (the same scope the executor is granted Contributor on)."
-      });
+    if (this.enableEmail === true) {
+      warnings.add("--enable-email is a no-op now: outbound email is provisioned by default. Pass --no-email to opt out.");
     }
     const imageInput = this.image ?? DEFAULT_IMAGE2;
     const repoRef = imageInput.includes("/") ? imageInput : `${DEFAULT_REGISTRY2}/${imageInput}`;
@@ -19843,20 +20382,62 @@ var AzureExecDeployCommand = class extends M8tCommand {
       privateKeyPem,
       write: (s) => this.context.stdout.write(s)
     });
+    const wantEmail = this.noEmail !== true;
     let acsEnv = {};
-    if (this.enableEmail === true && typeof this.resourceGroup === "string") {
-      const resourceGroup = this.resourceGroup;
-      onProgress?.("provisioning ACS Email (managed domain)\u2026");
-      const acsClient = new CommunicationServiceManagementClient(credential2, subscriptionId);
-      const acs = await provisionAcsEmail({
-        client: acsClient,
+    const stampRg = await this.resolvePlatformResourceGroup({ subscriptionId, interactive, warnings });
+    const scopeClass = classifyGrantScope(grantScope, subscriptionId);
+    if (wantEmail) {
+      const suffix = platformSuffixFromKvUri(kvUri);
+      const acsRg = scopeClass.kind === "resource-group" ? scopeClass.resourceGroup : scopeClass.kind === "subscription" ? stampRg : null;
+      if (scopeClass.kind === "unusable") {
+        warnings.add(`Outbound email was NOT provisioned: ${scopeClass.reason}. Re-run with --resource-group <rg> to place it explicitly.`);
+      } else if (acsRg === null || suffix === null) {
+        warnings.add(
+          "Outbound email was NOT provisioned: could not work out which resource group it belongs in. Re-run with --resource-group <rg>, or turn it on later with `m8t platform email on`."
+        );
+      } else {
+        try {
+          onProgress?.("resolving the ACS email sender\u2026");
+          const acsClient = new CommunicationServiceManagementClient(credential2, subscriptionId);
+          const resolution = await resolveAcs({
+            client: acsClient,
+            stamp: stampRg === null ? null : await this.readStampQuietly({ credential: credential2, subscriptionId, resourceGroup: stampRg }),
+            subscriptionId,
+            resourceGroup: acsRg,
+            suffix,
+            dataLocation: "United States",
+            onProgress
+          });
+          acsEnv = {
+            M8T_ACS_ENDPOINT: resolution.acs.endpoint,
+            M8T_ACS_SENDER: resolution.acs.sender,
+            M8T_EMAIL_ENABLED: "true"
+          };
+          await this.recordEmailIntent({
+            credential: credential2,
+            subscriptionId,
+            resourceGroup: stampRg,
+            feature: emailFeatureFrom(resolution.acs, true),
+            warnings,
+            onProgress
+          });
+        } catch (e) {
+          acsEnv = {};
+          warnings.add(
+            `Outbound email was NOT provisioned (${e instanceof Error ? e.message : String(e)}). The executor is deployed and usable; turn email on later with \`m8t platform email on\`.`
+          );
+        }
+      }
+    } else {
+      onProgress?.("--no-email: skipping outbound email.");
+      await this.recordEmailIntent({
+        credential: credential2,
         subscriptionId,
-        resourceGroup,
-        name: this.name,
-        dataLocation: "United States",
+        resourceGroup: stampRg,
+        feature: { enabled: false, acsEndpoint: "", acsSender: "" },
+        warnings,
         onProgress
       });
-      acsEnv = { M8T_ACS_ENDPOINT: acs.endpoint, M8T_ACS_SENDER: acs.sender };
     }
     const env = {
       MODEL_DEPLOYMENT_NAME: this.modelDeployment ?? DEFAULT_MODEL2,
@@ -19977,6 +20558,93 @@ var AzureExecDeployCommand = class extends M8tCommand {
     );
     return 0;
   }
+  /** Resolve the PLATFORM resource group — the one holding the stamp's storage account.
+   *
+   *  Deliberately independent of the ACS resource group: they are often the same, but when
+   *  they are not, reading the stamp from the wrong one throws and would read as "no stamp".
+   *  Returns null (with a warning) rather than throwing, because a worker deploy must not
+   *  fail over the stamp. */
+  async resolvePlatformResourceGroup(opts) {
+    const disambiguator = typeof this.resourceGroup === "string" && this.resourceGroup.length > 0 ? this.resourceGroup : void 0;
+    try {
+      return resourceGroupFromArmId(
+        (await discoverGateway({
+          subscriptionId: opts.subscriptionId,
+          interactive: opts.interactive,
+          ...disambiguator !== void 0 ? { resourceGroup: disambiguator } : {}
+        })).containerAppResourceId
+      );
+    } catch (e) {
+      if (e.code === "GATEWAY_DISCOVERY_RG_NOT_FOUND" && disambiguator !== void 0) {
+        try {
+          return resourceGroupFromArmId(
+            (await discoverGateway({ subscriptionId: opts.subscriptionId, interactive: opts.interactive })).containerAppResourceId
+          );
+        } catch (retryErr) {
+          opts.warnings.add(
+            `Could not locate the platform resource group (${retryErr instanceof Error ? retryErr.message : String(retryErr)}), so the outbound-email decision could not be recorded. Run \`m8t platform email on|off\` once the platform resolves.`
+          );
+          return null;
+        }
+      }
+      opts.warnings.add(
+        `Could not locate the platform resource group (${e instanceof Error ? e.message : String(e)}), so the outbound-email decision could not be recorded. Run \`m8t platform email on|off\` once the platform resolves.`
+      );
+      return null;
+    }
+  }
+  /** Read the platform stamp, distinguishing "genuinely absent" from "unreadable".
+   *
+   *  🔴 The distinction matters: on `absent` (a fresh install) falling through to ACS
+   *  discovery is correct, but on `unreadable` we cannot know whether an ACS is already on
+   *  record, and provisioning a duplicate billable resource on a failed read would be worse
+   *  than doing nothing. `unreadable` therefore throws, and the caller's catch turns it into
+   *  a loud skip. */
+  async readStampQuietly(opts) {
+    const outcome = await readStampOutcome(opts);
+    if (outcome.source === "explicit") return outcome.stamp;
+    if (outcome.source === "absent") return null;
+    throw new Error(
+      "the platform stamp exists but could not be read, so it is not safe to decide whether an ACS is already on record"
+    );
+  }
+  /** Persist the outbound-email decision to the platform stamp.
+   *
+   *  Recording intent is the durability fix: before this, email lived only in the argv of
+   *  one command. If the stamp cannot be read or written, the deploy still succeeds — but
+   *  it WARNS, because an intent that silently failed to persist is exactly the state that
+   *  hid this outage. */
+  async recordEmailIntent(opts) {
+    const { credential: credential2, subscriptionId, resourceGroup, feature, warnings, onProgress } = opts;
+    if (resourceGroup === null) return;
+    try {
+      const current = await readStamp({ credential: credential2, subscriptionId, resourceGroup });
+      if (current === null) {
+        warnings.add(
+          `Outbound email is ${feature.enabled ? "on" : "off"} for this executor, but there is no platform stamp to record it in \u2014 a later converge will not know about it. Run \`m8t platform email on\` once the stamp exists.`
+        );
+        return;
+      }
+      const prior = current.features?.email;
+      const merged = {
+        enabled: feature.enabled,
+        acsEndpoint: feature.acsEndpoint || (prior?.acsEndpoint ?? ""),
+        acsSender: feature.acsSender || (prior?.acsSender ?? "")
+      };
+      await writeStamp({
+        credential: credential2,
+        subscriptionId,
+        resourceGroup,
+        stamp: { ...current, features: { ...current.features, email: merged } },
+        onProgress
+      });
+      onProgress?.(`recorded outbound email = ${merged.enabled ? "on" : "off"} in the platform stamp.`);
+    } catch (e) {
+      warnings.add(
+        `Could not record the outbound-email decision in the platform stamp (${e instanceof Error ? e.message : String(e)}). The executor is wired correctly, but a later converge will not know the intent.`
+      );
+    }
+  }
   resolveScope(subscriptionId) {
     if (typeof this.scope === "string" && this.scope.startsWith("/subscriptions/")) return this.scope;
     if (typeof this.resourceGroup === "string" && this.resourceGroup.length > 0) {
@@ -20144,254 +20812,6 @@ async function fetchPublicTags(repo, fetchImpl = fetch) {
 
 // src/lib/release-channel.ts
 import * as fs23 from "fs";
-
-// ../../packages/platform-release/dist/esm/manifest.js
-var SEVERITIES = ["critical", "recommended", "optional"];
-var IMAGE_KEYS = ["gateway", "codingAgent", "azureExecutor", "installer"];
-var COMPANION_TARGETS = [
-  "darwin-arm64",
-  "darwin-x64",
-  "win32-arm64",
-  "win32-x64"
-];
-function companionTargetFor(platform, architecture) {
-  const target = `${platform}-${architecture}`;
-  return COMPANION_TARGETS.includes(target) ? target : null;
-}
-function isObj2(v) {
-  return typeof v === "object" && v !== null && !Array.isArray(v);
-}
-function validateManifest(m) {
-  const errors = [];
-  if (!isObj2(m))
-    return ["manifest is not an object"];
-  if (m.schemaVersion !== 1)
-    errors.push("schemaVersion must be the integer 1");
-  const p = m.platform;
-  if (!isObj2(p)) {
-    errors.push("platform is required");
-  } else {
-    for (const f of ["version", "tag", "releasedAt", "commit", "notes", "notesUrl"]) {
-      if (typeof p[f] !== "string" || p[f].length === 0)
-        errors.push(`platform.${f} is required`);
-    }
-    if (!SEVERITIES.includes(p.severity))
-      errors.push(`platform.severity must be one of ${SEVERITIES.join("|")}`);
-    if (!(typeof p.previousVersion === "string" || p.previousVersion === null)) {
-      errors.push("platform.previousVersion must be a string or null");
-    }
-  }
-  const c = m.components;
-  if (!isObj2(c)) {
-    errors.push("components is required");
-    return errors;
-  }
-  for (const key2 of IMAGE_KEYS) {
-    const img = c[key2];
-    if (!isObj2(img)) {
-      errors.push(`components.${key2} is required`);
-      continue;
-    }
-    if (img.kind !== "image")
-      errors.push(`components.${key2}.kind must be "image"`);
-    for (const f of ["ref", "tag", "version"]) {
-      if (typeof img[f] !== "string" || img[f].length === 0)
-        errors.push(`components.${key2}.${f} is required`);
-    }
-    if (typeof img.digest !== "string" || !/^sha256:[0-9a-f]+$/.test(img.digest)) {
-      errors.push(`components.${key2}.digest must be a sha256:\u2026 digest`);
-    }
-  }
-  const cli2 = c.cli;
-  if (!isObj2(cli2) || cli2.kind !== "npm") {
-    errors.push("components.cli (kind: npm) is required");
-  } else {
-    for (const f of ["package", "version", "min", "recommended"]) {
-      if (typeof cli2[f] !== "string" || cli2[f].length === 0)
-        errors.push(`components.cli.${f} is required`);
-    }
-  }
-  const personas = c.personas;
-  if (!isObj2(personas) || !isObj2(personas.items)) {
-    errors.push("components.personas.items is required");
-  } else {
-    for (const [name, item] of Object.entries(personas.items)) {
-      if (!isObj2(item) || typeof item.path !== "string" || item.path.length === 0) {
-        errors.push(`components.personas.items.${name}.path is required`);
-      }
-      if (!isObj2(item) || typeof item.treeSha !== "string" || item.treeSha.length < 4) {
-        errors.push(`components.personas.items.${name}.treeSha is required`);
-      }
-    }
-  }
-  const seeds = c.brainSeeds;
-  if (!isObj2(seeds) || !isObj2(seeds.items)) {
-    errors.push("components.brainSeeds.items is required");
-  } else {
-    for (const [name, item] of Object.entries(seeds.items)) {
-      if (!isObj2(item) || typeof item.path !== "string" || item.path.length === 0) {
-        errors.push(`components.brainSeeds.items.${name}.path is required`);
-      }
-      if (!isObj2(item) || !isObj2(item.subtrees)) {
-        errors.push(`components.brainSeeds.items.${name}.subtrees is required`);
-      }
-    }
-  }
-  const infra = c.infra;
-  if (infra !== void 0) {
-    if (!isObj2(infra) || infra.kind !== "infra") {
-      errors.push('components.infra.kind must be "infra"');
-    }
-    if (!isObj2(infra) || typeof infra.treeSha !== "string" || infra.treeSha.length < 4) {
-      errors.push("components.infra.treeSha is required");
-    }
-  }
-  const companion = c.companion;
-  if (companion !== void 0) {
-    if (!isObj2(companion) || companion.kind !== "desktop") {
-      errors.push('components.companion.kind must be "desktop"');
-    } else {
-      for (const f of ["version", "tag"]) {
-        if (typeof companion[f] !== "string" || companion[f].length === 0) {
-          errors.push(`components.companion.${f} is required`);
-        }
-      }
-      if (!isObj2(companion.targets) || Object.keys(companion.targets).length === 0) {
-        errors.push("components.companion.targets must name at least one target");
-      } else {
-        for (const [name, target] of Object.entries(companion.targets)) {
-          if (!COMPANION_TARGETS.includes(name)) {
-            errors.push(`components.companion.targets.${name} is not a known target`);
-            continue;
-          }
-          if (!isObj2(target) || typeof target.asset !== "string" || target.asset.length === 0) {
-            errors.push(`components.companion.targets.${name}.asset is required`);
-          }
-          if (!isObj2(target) || typeof target.sha256 !== "string" || !/^[0-9a-f]{64}$/.test(target.sha256)) {
-            errors.push(`components.companion.targets.${name}.sha256 must be a sha256 hex digest`);
-          }
-        }
-      }
-    }
-  }
-  return errors;
-}
-
-// ../../packages/platform-release/dist/esm/stamp.js
-var TABLE = "Metadata";
-var PK = "system";
-var RK = "platform";
-function stampToEntity(s) {
-  return {
-    partitionKey: PK,
-    rowKey: RK,
-    platformVersion: s.platformVersion,
-    updatedAt: s.updatedAt,
-    lastResult: s.lastResult,
-    value: JSON.stringify(s)
-  };
-}
-function entityToStamp(e) {
-  const raw = e.value;
-  if (typeof raw !== "string")
-    return null;
-  try {
-    return JSON.parse(raw);
-  } catch {
-    return null;
-  }
-}
-
-// ../../packages/platform-release/dist/esm/channel-url.js
-var RELEASES_REPO = "m8t-labs/m8t-releases";
-var RELEASES_BASE = `https://github.com/${RELEASES_REPO}/releases`;
-var CHANNEL_LATEST_URL = `${RELEASES_BASE}/latest/download/manifest.json`;
-var CANARY_POINTER_TAG = "canary";
-var CHANNEL_CANARY_URL = `${RELEASES_BASE}/download/${CANARY_POINTER_TAG}/manifest.json`;
-function platformTag(version) {
-  const bare = version.trim().replace(/^platform-/, "").replace(/^v/, "");
-  return `platform-v${bare}`;
-}
-function channelUrlForVersion(version) {
-  return `${RELEASES_BASE}/download/${platformTag(version)}/manifest.json`;
-}
-function releaseAssetUrl(tag, asset) {
-  return `${RELEASES_BASE}/download/${tag}/${asset}`;
-}
-
-// ../../packages/platform-release/dist/esm/canary-version.js
-var CANARY_IDENTIFIER = "canary";
-var STABLE_CORE = String.raw`\d+\.\d+\.\d+`;
-var CANARY_SUFFIX = String.raw`-${CANARY_IDENTIFIER}\.(?:0|[1-9]\d*)`;
-var CANARY_VERSION_PATTERN = `^${STABLE_CORE}${CANARY_SUFFIX}$`;
-var PLATFORM_VERSION_PATTERN = `^${STABLE_CORE}(?:${CANARY_SUFFIX})?$`;
-var PLATFORM_TAG_PATTERN = `^platform-v${STABLE_CORE}(?:${CANARY_SUFFIX})?$`;
-var CANARY_VERSION_RE = new RegExp(CANARY_VERSION_PATTERN);
-var STABLE_CORE_RE = new RegExp(`^${STABLE_CORE}$`);
-
-// ../../packages/platform-release/dist/esm/apply-request.js
-var APPLY_REQUEST_PK = "system";
-var APPLY_REQUEST_RK = "apply-request";
-var IN_FLIGHT = ["claimed", "applying"];
-var LEASE_MS = 30 * 60 * 1e3;
-var MAX_LEASE_TAKEOVERS = 2;
-var MAX_HEALTHY_IN_FLIGHT_MS = LEASE_MS * (MAX_LEASE_TAKEOVERS + 1);
-function isInFlight(status) {
-  return IN_FLIGHT.includes(status);
-}
-var BLOCKS_NEW_INTENT = ["pending", "claimed", "applying", "awaiting-engine-update"];
-function blocksNewIntent(status) {
-  return BLOCKS_NEW_INTENT.includes(status);
-}
-function newIntent(target, provenance, nowIso) {
-  return {
-    schemaVersion: 1,
-    target,
-    provenance,
-    status: "pending",
-    phase: null,
-    claimedBy: null,
-    leaseUntil: null,
-    attempt: 0,
-    breaker: "none",
-    result: null,
-    createdAt: nowIso,
-    updatedAt: nowIso
-  };
-}
-function applyRequestToEntity(r) {
-  return { partitionKey: APPLY_REQUEST_PK, rowKey: APPLY_REQUEST_RK, value: JSON.stringify(r), updatedAt: r.updatedAt };
-}
-function entityToApplyRequest(e) {
-  return JSON.parse(e.value);
-}
-
-// ../../packages/platform-release/dist/esm/update-policy.js
-var DEFAULT_POLICY_MODE = "auto-critical";
-var UPDATE_POLICY_PK = "system";
-var UPDATE_POLICY_RK = "update-policy";
-var MODES = ["notify-only", "auto-critical", "auto-all"];
-function isPolicyMode(x) {
-  return typeof x === "string" && MODES.includes(x);
-}
-function updatePolicyToEntity(p) {
-  return { partitionKey: UPDATE_POLICY_PK, rowKey: UPDATE_POLICY_RK, value: JSON.stringify(p) };
-}
-function entityToUpdatePolicy(e) {
-  return JSON.parse(e.value);
-}
-
-// ../../packages/platform-release/dist/esm/infra-params.js
-var INFRA_PARAMS_PK = "system";
-var INFRA_PARAMS_RK = "infra-params";
-function infraParamsToEntity(p) {
-  return { partitionKey: INFRA_PARAMS_PK, rowKey: INFRA_PARAMS_RK, value: JSON.stringify(p) };
-}
-function entityToInfraParams(e) {
-  return JSON.parse(e.value);
-}
-
-// src/lib/release-channel.ts
 init_errors();
 function manifestSourceForVersionTag(channelUrl, version) {
   const tag = platformTag(version);
@@ -20551,153 +20971,6 @@ async function resolveReleaseContentWithAgents(manifest, opts = {}) {
   return contentDir;
 }
 
-// src/lib/platform-stamp.ts
-import { TableClient as TableClient2 } from "@azure/data-tables";
-
-// src/lib/platform-storage-discovery.ts
-init_http();
-init_errors();
-var ARM3 = "https://management.azure.com";
-var ARM_SCOPE7 = "https://management.azure.com/.default";
-var STORAGE_API = "2023-05-01";
-async function discoverStampStorage(opts) {
-  const list = await authedJson({
-    credential: opts.credential,
-    scope: ARM_SCOPE7,
-    method: "GET",
-    url: `${ARM3}/subscriptions/${opts.subscriptionId}/resourceGroups/${opts.resourceGroup}/providers/Microsoft.Storage/storageAccounts?api-version=${STORAGE_API}`
-  }) ?? {};
-  const accounts = (list.value ?? []).filter((a) => a.properties?.primaryEndpoints?.table);
-  const chosen = accounts.find((a) => a.tags?.m8t === "storage") ?? accounts.find((a) => a.tags?.["m8t:role"] === "gateway" || a.tags?.["m8t:role"] === "ledger") ?? (accounts.length === 1 ? accounts[0] : void 0);
-  const tableEndpoint = chosen?.properties?.primaryEndpoints?.table?.replace(/\/$/, "");
-  if (!tableEndpoint || !chosen?.id || !chosen.name) {
-    throw new LocalCliError({
-      code: "PLATFORM_STAMP_STORAGE_NOT_FOUND",
-      message: `No table-capable storage account found in resource group ${opts.resourceGroup}.`,
-      hint: `Found: ${accounts.map((a) => a.name).join(", ") || "(none)"}.`
-    });
-  }
-  return { tableEndpoint, accountResourceId: chosen.id, accountName: chosen.name };
-}
-
-// src/lib/metadata-table-write.ts
-import { TableClient, AzureNamedKeyCredential } from "@azure/data-tables";
-init_errors();
-init_rbac();
-function is403(e) {
-  return e.statusCode === 403;
-}
-function is404(e) {
-  return e.statusCode === 404;
-}
-function sleep2(ms) {
-  return new Promise((r) => setTimeout(r, ms));
-}
-async function makeSharedKeyClient(opts) {
-  const rg = /\/resourceGroups\/([^/]+)\//i.exec(opts.accountResourceId)?.[1];
-  if (!rg) return null;
-  const key2 = (await runAz(["storage", "account", "keys", "list", "--account-name", opts.accountName, "-g", rg, "--query", "[0].value", "-o", "tsv"])).trim();
-  if (!key2) return null;
-  return new TableClient(opts.tableEndpoint, TABLE, new AzureNamedKeyCredential(opts.accountName, key2));
-}
-async function upsertMetadataEntity(opts) {
-  const discover = opts.discoverImpl ?? discoverStampStorage;
-  const makeAad = opts.aadClientImpl ?? ((endpoint, credential2) => new TableClient(endpoint, TABLE, credential2));
-  const makeShared = opts.sharedClientImpl ?? makeSharedKeyClient;
-  const nap = opts.sleepImpl ?? sleep2;
-  const { tableEndpoint, accountResourceId, accountName } = await discover({
-    credential: opts.credential,
-    subscriptionId: opts.subscriptionId,
-    resourceGroup: opts.resourceGroup
-  });
-  const aad = makeAad(tableEndpoint, opts.credential);
-  await aad.createTable().catch(() => void 0);
-  try {
-    await aad.upsertEntity(opts.entity, "Replace");
-    return;
-  } catch (e) {
-    if (!is403(e)) throw e;
-  }
-  opts.onProgress?.(`writing the ${opts.label} with the account key \u2014 your identity lacks the Storage Table data role.`);
-  const shared = await makeShared({ tableEndpoint, accountResourceId, accountName });
-  if (shared) {
-    await shared.createTable().catch(() => void 0);
-    await shared.upsertEntity(opts.entity, "Replace");
-    return;
-  }
-  opts.onProgress?.("shared-key access is disabled \u2014 granting Storage Table Data Contributor to your identity (one-time)\u2026");
-  try {
-    const oid = await getCallerObjectId();
-    await grantStorageTableDataContributor({
-      credential: opts.credential,
-      subscriptionId: opts.subscriptionId,
-      scope: accountResourceId,
-      principalId: oid
-    });
-  } catch (e) {
-    throw new LocalCliError({
-      code: opts.errorCode,
-      message: `Cannot write the ${opts.label}: AAD lacks the Storage Table data role for ${accountName}, shared-key access is disabled, and self-granting the role failed.`,
-      hint: "Grant yourself 'Storage Table Data Contributor' on the storage account and retry.",
-      cause: e
-    });
-  }
-  for (let i = 0; i < 6; i++) {
-    await nap(1e4);
-    try {
-      await aad.upsertEntity(opts.entity, "Replace");
-      return;
-    } catch (e) {
-      if (!is403(e)) throw e;
-    }
-  }
-  throw new LocalCliError({
-    code: opts.errorCode,
-    message: `Cannot write the ${opts.label}: granted 'Storage Table Data Contributor' on ${accountName}, but the data-plane role has not propagated yet.`,
-    hint: opts.retryHint
-  });
-}
-
-// src/lib/platform-stamp.ts
-async function writeStamp(opts) {
-  const entity = stampToEntity(opts.stamp);
-  await upsertMetadataEntity({
-    credential: opts.credential,
-    subscriptionId: opts.subscriptionId,
-    resourceGroup: opts.resourceGroup,
-    entity,
-    label: "platform stamp",
-    errorCode: "PLATFORM_STAMP_NO_ACCESS",
-    retryHint: "The role assignment persists \u2014 retry 'm8t platform update' in a few minutes.",
-    ...opts.onProgress ? { onProgress: opts.onProgress } : {}
-  });
-}
-async function readStampOutcome(opts) {
-  const { tableEndpoint, accountResourceId, accountName } = await discoverStampStorage(opts);
-  const aad = new TableClient2(tableEndpoint, TABLE, opts.credential);
-  try {
-    const row = await aad.getEntity(PK, RK);
-    const stamp = entityToStamp(row);
-    return stamp ? { source: "explicit", stamp } : { source: "unreadable" };
-  } catch (e) {
-    if (is404(e)) return { source: "absent" };
-    if (!is403(e)) return { source: "unreadable" };
-  }
-  try {
-    const shared = await makeSharedKeyClient({ tableEndpoint, accountResourceId, accountName });
-    if (!shared) return { source: "unreadable" };
-    const row = await shared.getEntity(PK, RK);
-    const stamp = entityToStamp(row);
-    return stamp ? { source: "explicit", stamp } : { source: "unreadable" };
-  } catch {
-    return { source: "unreadable" };
-  }
-}
-async function readStamp(opts) {
-  const result2 = await readStampOutcome(opts);
-  return result2.source === "explicit" ? result2.stamp : null;
-}
-
 // src/lib/platform-converge.ts
 init_esm();
 import * as fs26 from "fs";
@@ -21115,6 +21388,9 @@ async function applyPlan(plan, deps, ctx) {
       stamp.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
       await deps.writeStamp(stamp);
     }
+    if (deps.reconcileEmail) {
+      await deps.reconcileEmail();
+    }
     await deps.healthGate(ctx, applied);
     stamp.lastResult = "success";
     delete stamp.lastError;
@@ -21594,6 +21870,73 @@ import { DefaultAzureCredential as DefaultAzureCredential17 } from "@azure/ident
 // src/lib/platform-converge-cli.ts
 import * as path31 from "path";
 
+// src/lib/executor-email-env.ts
+init_foundry_agent_get();
+init_foundry_agent_version();
+var EMAIL_ENV_KEYS = ["M8T_ACS_ENDPOINT", "M8T_ACS_SENDER", "M8T_EMAIL_ENABLED"];
+var FOUNDRY_HOSTED_HEADER = { "Foundry-Features": "HostedAgents=V1Preview" };
+function applyEmailEnv(def, feature) {
+  const live = def.environment_variables ?? {};
+  const carried = Object.fromEntries(
+    Object.entries(live).filter(([k]) => !EMAIL_ENV_KEYS.includes(k))
+  );
+  if (feature !== null && isEmailFeatureUsable(feature)) {
+    return {
+      ...def,
+      environment_variables: {
+        ...carried,
+        M8T_ACS_ENDPOINT: feature.acsEndpoint,
+        M8T_ACS_SENDER: feature.acsSender,
+        M8T_EMAIL_ENABLED: "true"
+      }
+    };
+  }
+  return { ...def, environment_variables: carried };
+}
+async function reconcileExecutorEmailEnv(args) {
+  const { credential: credential2, projectEndpoint, agentName, feature, onProgress } = args;
+  let current;
+  try {
+    current = await getAgentVersion({ credential: credential2, projectEndpoint, agentName });
+  } catch (e) {
+    const code = e.code;
+    if (code === "AGENT_NOT_FOUND") return { changed: false, absent: true };
+    return { changed: false, absent: false, unreadable: e instanceof Error ? e.message : String(e) };
+  }
+  const next = applyEmailEnv(current.definition, feature);
+  const before = current.definition.environment_variables ?? {};
+  const after = next.environment_variables;
+  if (EMAIL_ENV_KEYS.every((k) => before[k] === after[k])) {
+    return { changed: false, absent: false };
+  }
+  onProgress?.(`reconciling outbound-email env on ${agentName}\u2026`);
+  const version = await createAgentVersion({
+    credential: credential2,
+    projectEndpoint,
+    agentName,
+    definition: next,
+    // Carry the live metadata through unchanged: it holds the a2a card and brain markers,
+    // and dropping those has bitten this repo before.
+    metadata: current.metadata ?? {},
+    extraHeaders: FOUNDRY_HOSTED_HEADER
+  });
+  return { changed: true, absent: false, version };
+}
+var EXECUTOR_PERSONA = "azure-executor";
+var EXECUTOR_AGENT_FALLBACK = "ezra-executor";
+async function resolveExecutorAgentName(args) {
+  if (typeof args.override === "string" && args.override.length > 0) {
+    return { agentName: args.override, provenance: "override" };
+  }
+  try {
+    const agents = await listM8tAgents({ credential: args.credential, projectEndpoint: args.projectEndpoint });
+    const hit = agents.find((a) => a.metadata.persona === EXECUTOR_PERSONA);
+    if (hit) return { agentName: hit.name, provenance: "discovered" };
+  } catch {
+  }
+  return { agentName: EXECUTOR_AGENT_FALLBACK, provenance: "fallback" };
+}
+
 // src/lib/platform-infra-params.ts
 import { TableClient as TableClient3 } from "@azure/data-tables";
 async function openInfraParamsTable(opts) {
@@ -22071,6 +22414,37 @@ async function buildConvergeDeps(args) {
     async applyGateway(a, ctx) {
       return applyGatewayImage(a, ctx, args.gatewayResourceId);
     },
+    async reconcileEmail() {
+      const dir2 = HOSTED_AGENT_PERSONA_DIR.azureExecutor;
+      const agentName = dir2 ? discovered[dir2] : void 0;
+      if (!agentName) return;
+      const outcome = await readStampOutcome({
+        credential: args.credential,
+        subscriptionId: args.subscriptionId,
+        resourceGroup: args.resourceGroup
+      }).catch(() => ({ source: "unreadable" }));
+      if (outcome.source === "unreadable") {
+        warn("skipped the outbound-email reconcile: the platform stamp could not be read, so the recorded intent is unknown.");
+        return;
+      }
+      const feature = outcome.source === "explicit" ? outcome.stamp.features?.email ?? null : null;
+      try {
+        const r = await reconcileExecutorEmailEnv({
+          credential: args.credential,
+          projectEndpoint: args.project.endpoint,
+          agentName,
+          feature,
+          onProgress: args.onProgress
+        });
+        if (r.unreadable !== void 0) {
+          warn(`could not read ${agentName} to reconcile outbound email (${r.unreadable}) \u2014 left untouched.`);
+        } else if (r.changed) {
+          args.onProgress?.(`outbound-email env reconciled on ${agentName} (version ${r.version ?? "?"}).`);
+        }
+      } catch (e) {
+        warn(`could not reconcile outbound-email env on ${agentName}: ${e instanceof Error ? e.message : String(e)}`);
+      }
+    },
     async applyInfra(a, ctx) {
       const target = infraTargetSha(ctx.manifest, args.tree);
       if (a.reason !== "forced") return applyInfraDeploy(a, ctx, target);
@@ -22335,6 +22709,27 @@ var PlatformUpdateCommand = class extends M8tCommand {
       return 0;
     }
     if (plan.actions.length === 0) {
+      if (only === void 0 || only === "azureExecutor") {
+        try {
+          const noDriftDeps = await buildConvergeDeps({
+            credential: credential2,
+            subscriptionId,
+            resourceGroup,
+            contentDir,
+            manifest,
+            tree,
+            project,
+            gatewayResourceId: gw.containerAppResourceId,
+            gatewayUrl: gw.gatewayUrl,
+            suffix,
+            onProgress,
+            onWarn
+          });
+          if (noDriftDeps.reconcileEmail) await noDriftDeps.reconcileEmail();
+        } catch (e) {
+          onWarn(`could not reconcile outbound email: ${e instanceof Error ? e.message : String(e)}`);
+        }
+      }
       if (mode === "json") this.context.stdout.write(renderJson({ ...plan, applied: false }) + "\n");
       else log(colors.success("already up to date \u2713"));
       return 0;
@@ -22741,9 +23136,9 @@ async function readBreaker(client) {
 
 // src/commands/platform/converge.ts
 init_errors();
-function isForwardTarget(target, installed) {
-  if (!installed) return true;
-  return comparePlatformVersion(target, installed) >= 0;
+function isForwardTarget(target, installed2) {
+  if (!installed2) return true;
+  return comparePlatformVersion(target, installed2) >= 0;
 }
 async function failIfStillInFlight(client, now, error, opts = {}) {
   const cur = await readApplyRequest(client);
@@ -22812,15 +23207,15 @@ var PlatformConvergeCommand = class extends M8tCommand {
       subscriptionId: ctx.subscriptionId,
       resourceGroup: ctx.resourceGroup
     });
-    const installed = stamp ? stamp.platformVersion : null;
-    if (!isForwardTarget(claimed.target, installed)) {
+    const installed2 = stamp ? stamp.platformVersion : null;
+    if (!isForwardTarget(claimed.target, installed2)) {
       await patchApplyRequest(client, (r) => ({
         ...r,
         status: "failed",
-        result: { appliedVersion: null, error: `refused downgrade ${installed ?? "(none)"} \u2192 ${claimed.target}` },
+        result: { appliedVersion: null, error: `refused downgrade ${installed2 ?? "(none)"} \u2192 ${claimed.target}` },
         updatedAt: now()
       }));
-      log(`refused: target ${claimed.target} is a downgrade from installed ${installed ?? "(none)"}.`);
+      log(`refused: target ${claimed.target} is a downgrade from installed ${installed2 ?? "(none)"}.`);
       return 1;
     }
     const manifest = await fetchManifest(targetManifestSource(ctx, claimed.target));
@@ -23669,46 +24064,222 @@ var PlatformEnableCostReportCommand = class extends M8tCommand {
   }
 };
 
-// src/commands/platform/enable-auto-update.ts
+// src/commands/platform/email.ts
 import { Command as Command42, Option as Option39 } from "clipanion";
-import { confirm as confirm6 } from "@inquirer/prompts";
 import { DefaultAzureCredential as DefaultAzureCredential22 } from "@azure/identity";
+import { CommunicationServiceManagementClient as CommunicationServiceManagementClient2 } from "@azure/arm-communication";
+init_errors();
+var PlatformEmailCommand = class extends M8tCommand {
+  static paths = [["platform", "email"]];
+  static usage = Command42.Usage({
+    description: "Turn outbound email (advisor handoffs) on or off for this install.",
+    details: "`on` resolves the ACS sender (reusing an existing one, provisioning only if there is none), records the decision in the platform stamp, and reconciles the executor's environment. `off` records the decision and strips the executor's email wiring, leaving the ACS resource in place so turning it back on is a flag flip. Idempotent \u2014 re-running either direction is safe, and no new agent version is posted when nothing changes.",
+    examples: [
+      ["Turn outbound email on", "m8t platform email on"],
+      ["Turn it off (a shared, public-facing deployment should stay off)", "m8t platform email off"]
+    ]
+  });
+  state = Option39.String({ required: true, name: "on|off" });
+  subscription = Option39.String("--subscription");
+  resourceGroup = Option39.String("--resource-group", {
+    description: "m8t resource group, to disambiguate in a multi-deployment subscription."
+  });
+  agent = Option39.String("--agent", { description: `Executor agent name. Resolved by persona when omitted (usually ${EXECUTOR_AGENT_FALLBACK}).` });
+  kvUri = Option39.String("--kv-uri", {
+    description: "Install's Key Vault URI. Only needed if no ACS is on record yet and one must be provisioned."
+  });
+  endpoint = Option39.String("--endpoint", {
+    description: "Foundry project endpoint, to disambiguate a subscription holding several."
+  });
+  output = Option39.String("--output");
+  async executeCommand() {
+    const wanted = this.state.trim().toLowerCase();
+    if (wanted !== "on" && wanted !== "off") {
+      throw new LocalCliError({
+        code: "USAGE",
+        message: `Expected 'on' or 'off', got '${this.state}'.`,
+        hint: "Run `m8t platform email on` or `m8t platform email off`."
+      });
+    }
+    const enable = wanted === "on";
+    const mode = resolveOutputMode(
+      this.output,
+      this.context.stdout
+    );
+    const onProgress = mode === "pretty" ? (m) => this.context.stderr.write(`  ${colors.dim(m)}
+`) : void 0;
+    const ctx = await resolveGatewayContext({
+      interactive: mode !== "json",
+      subscriptionId: this.subscription,
+      resourceGroup: this.resourceGroup
+    });
+    const { resourceGroup } = parseContainerAppResourceId(ctx.containerAppResourceId);
+    const subscriptionId = ctx.subscriptionId;
+    const credential2 = new DefaultAzureCredential22();
+    const stamp = await readStamp({ credential: credential2, subscriptionId, resourceGroup });
+    if (stamp === null) {
+      throw new LocalCliError({
+        code: "NO_PLATFORM_STAMP",
+        message: `No platform stamp found in ${resourceGroup} \u2014 there is nowhere to record the decision.`,
+        hint: "This command needs an install written by the current CLI. Check you are pointed at the right deployment with `m8t status`."
+      });
+    }
+    let feature;
+    if (enable) {
+      const suffix = this.resolveSuffix();
+      const resolution = await resolveAcs({
+        client: new CommunicationServiceManagementClient2(credential2, subscriptionId),
+        stamp,
+        subscriptionId,
+        resourceGroup,
+        suffix,
+        dataLocation: "United States",
+        onProgress
+      });
+      onProgress?.(`sender: ${resolution.acs.sender} (${resolution.source}).`);
+      feature = emailFeatureFrom(resolution.acs, true);
+    } else {
+      const prior = stamp.features?.email;
+      feature = { enabled: false, acsEndpoint: prior?.acsEndpoint ?? "", acsSender: prior?.acsSender ?? "" };
+    }
+    await writeStamp({
+      credential: credential2,
+      subscriptionId,
+      resourceGroup,
+      stamp: { ...stamp, features: { ...stamp.features, email: feature } },
+      onProgress
+    });
+    const project = await resolveFoundryProject({
+      credential: credential2,
+      subscriptionId,
+      interactive: mode !== "json",
+      ...typeof this.endpoint === "string" && this.endpoint.length > 0 ? { endpoint: this.endpoint } : {},
+      ...typeof this.resourceGroup === "string" && this.resourceGroup.length > 0 ? { resourceGroup: this.resourceGroup } : {}
+    });
+    const { agentName, provenance } = await resolveExecutorAgentName({
+      credential: credential2,
+      projectEndpoint: project.endpoint,
+      ...typeof this.agent === "string" && this.agent.length > 0 ? { override: this.agent } : {}
+    });
+    const reconciled = await reconcileExecutorEmailEnv({
+      credential: credential2,
+      projectEndpoint: project.endpoint,
+      agentName,
+      feature,
+      onProgress
+    });
+    if (mode === "json") {
+      this.context.stdout.write(
+        renderJson({
+          email: enable ? "on" : "off",
+          resourceGroup,
+          acsEndpoint: feature.acsEndpoint,
+          acsSender: feature.acsSender,
+          executor: agentName,
+          executorNameProvenance: provenance,
+          executorReconciled: reconciled.changed,
+          executorAbsent: reconciled.absent,
+          ...reconciled.unreadable !== void 0 ? { executorUnreadable: reconciled.unreadable } : {},
+          ...reconciled.version !== void 0 ? { executorVersion: reconciled.version } : {}
+        }) + "\n"
+      );
+      return reconciled.unreadable === void 0 ? 0 : 1;
+    }
+    this.context.stdout.write(
+      renderKeyValueBlock([
+        { key: "outbound email", value: enable ? "on" : "off" },
+        { key: "resource group", value: resourceGroup },
+        { key: "sender", value: feature.acsSender === "" ? "(none on record)" : feature.acsSender },
+        {
+          key: "executor",
+          // 🔴 `unreadable` MUST be its own branch. Falling through to "already correct" would
+          // have this command — the one an operator runs to FIX email — affirmatively claim
+          // success while having changed nothing, which is the exact conflation of broken with
+          // fine that this whole change exists to eliminate.
+          value: reconciled.unreadable !== void 0 ? `${agentName} (could NOT be read: ${reconciled.unreadable} \u2014 wiring NOT reconciled)` : reconciled.absent ? `${agentName} (not deployed \u2014 nothing to reconcile)` : reconciled.changed ? `${agentName} \u2192 version ${reconciled.version ?? "?"}` : `${agentName} (already correct)`
+        }
+      ]) + "\n"
+    );
+    if (reconciled.absent) {
+      this.context.stdout.write(
+        `  ${colors.hint("note:")} no executor is deployed here, so nothing can send yet. The decision is recorded and will apply when one is deployed.
+`
+      );
+    }
+    if (provenance === "fallback" && reconciled.absent) {
+      this.context.stdout.write(
+        `  ${colors.hint("note:")} '${agentName}' is a fallback name \u2014 the executor could not be discovered by persona. If yours is named differently, re-run with --agent <name>.
+`
+      );
+    }
+    if (reconciled.unreadable !== void 0) {
+      this.context.stdout.write(
+        colors.error(
+          `the decision is recorded, but ${agentName} was NOT reconciled \u2014 it exists and could not be read. Nothing about sending has changed yet; fix access and re-run.`
+        ) + "\n"
+      );
+      return 1;
+    }
+    this.context.stdout.write(
+      colors.success(enable ? "outbound email is on \u2713" : "outbound email is off \u2713") + "\n"
+    );
+    return 0;
+  }
+  /** The install's resource suffix, or null when it cannot be worked out.
+   *
+   *  Returns null rather than throwing: it is only needed if `resolveAcs` reaches its
+   *  provisioning leg, and failing the whole command over a missing AZURE_KEYVAULT_URI would
+   *  break the flip on every install that already has an ACS on record. */
+  resolveSuffix() {
+    try {
+      const explicit = typeof this.kvUri === "string" && this.kvUri.length > 0 ? this.kvUri : void 0;
+      return platformSuffixFromKvUri(discoverKvUri(process.env, explicit));
+    } catch {
+      return null;
+    }
+  }
+};
+
+// src/commands/platform/enable-auto-update.ts
+import { Command as Command43, Option as Option40 } from "clipanion";
+import { confirm as confirm6 } from "@inquirer/prompts";
+import { DefaultAzureCredential as DefaultAzureCredential23 } from "@azure/identity";
 init_errors();
 var PlatformEnableAutoUpdateCommand = class extends M8tCommand {
   static paths = [["platform", "enable-auto-update"]];
-  static usage = Command42.Usage({
+  static usage = Command43.Usage({
     category: "Platform",
     description: "Retrofit the auto-updater (MI + cron job + role assignments) onto an existing install.",
     details: "For an install that predates the Platform Update Framework: recovers the deployment's resource-name suffix (from the stamped system/infra-params row, or by verified derivation from the live gateway), recovers the other bicep params from live state (WITHOUT changing the deployed gateway image), and re-runs deploy/main.bicep with provisionUpdater=true \u2014 which provisions the updater managed identity, the cron Container Apps Job, and every role assignment (Owner@RG + Foundry User@account + Storage Table + Storage Blob + AcrPull), all scoped to the resource group. On success, backfills system/infra-params so future converges never have to re-derive the suffix. Idempotent \u2014 safe to re-run."
   });
-  subscription = Option39.String("--subscription");
-  resourceGroup = Option39.String("--resource-group", {
+  subscription = Option40.String("--subscription");
+  resourceGroup = Option40.String("--resource-group", {
     description: "m8t resource group to disambiguate the gateway (multi-deployment subscriptions)."
   });
-  suffix = Option39.String("--suffix", {
+  suffix = Option40.String("--suffix", {
     description: "The existing deployment's resource-name suffix. Required when it cannot be recovered from system/infra-params or the live gateway."
   });
-  installerImage = Option39.String("--installer-image", {
+  installerImage = Option40.String("--installer-image", {
     required: true,
     description: "Updater CA-Job image ref (the converge engine at the current release). Required \u2014 an empty image would skip provisioning."
   });
-  updateCron = Option39.String("--update-cron", {
+  updateCron = Option40.String("--update-cron", {
     description: "Cron schedule for the updater job (bicep default applies when omitted)."
   });
-  channelUrl = Option39.String("--channel-url", {
+  channelUrl = Option40.String("--channel-url", {
     description: "Release-channel URL the updater job polls (bicep default applies when omitted)."
   });
-  location = Option39.String("--location", {
+  location = Option40.String("--location", {
     description: "Region for the updater identity + job. Defaults to the resource group's existing resources."
   });
-  foundryTracing = Option39.String("--foundry-tracing", {
+  foundryTracing = Option40.String("--foundry-tracing", {
     description: "project | account | skip. Pass the value the install was deployed with \u2014 omitting it lets the bicep default (project) switch tracing on."
   });
-  endpoint = Option39.String("--endpoint", {
+  endpoint = Option40.String("--endpoint", {
     description: "Foundry project endpoint URL. Disambiguates the project in a multi-project subscription."
   });
-  yes = Option39.Boolean("--yes", false);
-  output = Option39.String("--output");
+  yes = Option40.Boolean("--yes", false);
+  output = Option40.String("--output");
   async executeCommand() {
     const mode = resolveOutputMode(
       this.output,
@@ -23727,7 +24298,7 @@ var PlatformEnableAutoUpdateCommand = class extends M8tCommand {
       resourceGroup: this.resourceGroup
     });
     const { resourceGroup, name: gatewayName } = parseContainerAppResourceId(gw.containerAppResourceId);
-    const credential2 = new DefaultAzureCredential22();
+    const credential2 = new DefaultAzureCredential23();
     const account = await getAzAccount();
     const subscriptionId = this.subscription ?? account.subscriptionId;
     const explicitSuffix = typeof this.suffix === "string" && this.suffix.length > 0 ? this.suffix : void 0;
@@ -23845,7 +24416,7 @@ var PlatformEnableAutoUpdateCommand = class extends M8tCommand {
 };
 
 // src/commands/deploy.ts
-import { Command as Command43, Option as Option40 } from "clipanion";
+import { Command as Command44, Option as Option41 } from "clipanion";
 
 // src/lib/app-reg.ts
 init_esm();
@@ -24322,6 +24893,14 @@ var KNOWN_NOISE = [
   //
   // REMOVE THESE TWO RULES when the deployment path stops regenerating the value.
   // Their presence is the marker that it still does.
+  // Storage RP defaults the bicep does not declare. what-if renders "the template
+  // omits this, so it would be removed", but the RP re-stamps them on every write
+  // and an apply is a verified no-op. Narrow on purpose: `deleteRetentionPolicy`
+  // and the two encryption-scope fields only. An unanchored `properties` rule on
+  // blobServices would swallow a real change to versioning, CORS or public access
+  // on the account that holds every conversation.
+  { resourceType: "Microsoft.Storage/storageAccounts/blobServices", pathPattern: /(^|\.)properties$/, reason: "RP-owned blob-service defaults (deleteRetentionPolicy); the bicep declares none" },
+  { resourceType: "Microsoft.Storage/storageAccounts/blobServices/containers", pathPattern: /(^|\.)(defaultEncryptionScope|denyEncryptionScopeOverride)$/, reason: "RP default ($account-encryption-key); the bicep declares no scope" },
   { resourceType: "Microsoft.App/containerApps", pathPattern: /(^|\.)configuration\.secrets$/, reason: "shared relay secret is regenerated on every deployment \u2014 owned elsewhere" },
   { resourceType: "Microsoft.App/containerApps", pathPattern: /(^|\.)configuration\.secrets\[\d+\]\.value$/, reason: "shared relay secret is regenerated on every deployment \u2014 owned elsewhere" }
 ];
@@ -24385,36 +24964,44 @@ function classifyWhatIf(changes) {
 var DEFAULT_IMAGE_REF = "ghcr.io/m8t-labs/m8t:latest";
 var DeployCommand = class extends M8tCommand {
   static paths = [["deploy"]];
-  static usage = Command43.Usage({
+  static usage = Command44.Usage({
     description: "Deploy (or update) the m8t gateway/webapp stack via Bicep.",
     details: "Ensures the Entra app reg (or pass --client-id to reuse an existing one \u2014 required if you can't create app regs), writes ~/.m8t/config.yaml, ensures the resource group, and runs deploy/main.bicep. The repo is located via ~/.m8t/repo-root."
   });
-  subscription = Option40.String("--subscription");
-  resourceGroup = Option40.String("--resource-group", "rg-m8t-stack");
-  location = Option40.String("--location", "eastus");
-  suffix = Option40.String("--suffix", "");
-  imageRef = Option40.String("--image-ref", DEFAULT_IMAGE_REF);
-  acrPullIdentity = Option40.String("--acrpull-identity");
-  acrResourceId = Option40.String("--acr-resource-id");
-  foundryEndpoint = Option40.String("--foundry-endpoint");
-  foundryResourceId = Option40.String("--foundry-resource-id");
-  foundryTracing = Option40.String("--foundry-tracing");
+  subscription = Option41.String("--subscription");
+  resourceGroup = Option41.String("--resource-group", "rg-m8t-stack");
+  location = Option41.String("--location", "eastus");
+  suffix = Option41.String("--suffix", "");
+  imageRef = Option41.String("--image-ref", DEFAULT_IMAGE_REF);
+  // Gateway-only override. Empty ⇒ the gateway uses --image-ref, which is the
+  // from-zero case. It exists because the gateway and the voice relay do NOT
+  // always run the same image: a converge preserves a BYOC gateway on its own
+  // ACR while the relay tracks the release on the public repo. A comparison
+  // (`--what-if`) that can only express one image therefore reports the other
+  // app as drift on every single run, forever — which is exactly what the
+  // infra-drift gate did from 2026-08-11.
+  gatewayImageRef = Option41.String("--gateway-image-ref", "");
+  acrPullIdentity = Option41.String("--acrpull-identity");
+  acrResourceId = Option41.String("--acr-resource-id");
+  foundryEndpoint = Option41.String("--foundry-endpoint");
+  foundryResourceId = Option41.String("--foundry-resource-id");
+  foundryTracing = Option41.String("--foundry-tracing");
   // project | account | skip (bicep default: project)
-  clientId = Option40.String("--client-id");
-  whatIf = Option40.Boolean("--what-if", false);
+  clientId = Option41.String("--client-id");
+  whatIf = Option41.Boolean("--what-if", false);
   // Only meaningful with --what-if. Routes the comparison through the
   // value-free renderers (see ./lib/whatif-redact.js) instead of the default
   // before/after renderer. Defaults false so a local, interactive run keeps
   // showing values — that is the whole diagnostic point of --what-if.
   // Automation that forwards this output anywhere non-private (a CI log, an
   // issue) MUST pass --redact.
-  redact = Option40.Boolean("--redact", false);
-  output = Option40.String("--output");
+  redact = Option41.Boolean("--redact", false);
+  output = Option41.String("--output");
   // Subscription-scoped role assignments. Omitted ⇒ the template default (true).
   // Pass false when deploying as a principal scoped to the resource group only:
   // it cannot deploy at subscription scope, and those assignments persist
   // idempotently from the initial deployment anyway.
-  assignSubscriptionRoles = Option40.String("--assign-subscription-roles");
+  assignSubscriptionRoles = Option41.String("--assign-subscription-roles");
   /**
    * The installer image the updater Container-Apps Job runs.
    *
@@ -24425,23 +25012,23 @@ var DeployCommand = class extends M8tCommand {
    * than that — the comparison proposes REMOVING an updater job that exists and
    * should, and reports it as drift on every single run.
    */
-  installerImage = Option40.String("--installer-image");
+  installerImage = Option41.String("--installer-image");
   // Referee — all optional, undefined by default ⇒ the bicep defaults
   // apply (dormant: gatewayCpu=0.25, gatewayMemory=0.5Gi, every referee/exam var
   // empty). Only pass these when explicitly enabling the referee exam stack.
-  gatewayCpu = Option40.String("--gateway-cpu");
-  gatewayMemory = Option40.String("--gateway-memory");
-  refereeEnabled = Option40.String("--referee-enabled");
-  refereeBrainRepos = Option40.String("--referee-brain-repos");
-  refereeFeedRepo = Option40.String("--referee-feed-repo");
-  refereeInstallationId = Option40.String("--referee-installation-id");
-  refereeWebhookHmacKvUri = Option40.String("--referee-webhook-hmac-kv-uri");
-  examKvUri = Option40.String("--exam-kv-uri");
-  examLaWorkspaceId = Option40.String("--exam-la-workspace-id");
-  brainEvalDeployment = Option40.String("--brain-eval-deployment");
-  brainAppLogin = Option40.String("--brain-app-login");
-  refereeCheckpointDir = Option40.String("--referee-checkpoint-dir");
-  examApiBase = Option40.String("--exam-api-base");
+  gatewayCpu = Option41.String("--gateway-cpu");
+  gatewayMemory = Option41.String("--gateway-memory");
+  refereeEnabled = Option41.String("--referee-enabled");
+  refereeBrainRepos = Option41.String("--referee-brain-repos");
+  refereeFeedRepo = Option41.String("--referee-feed-repo");
+  refereeInstallationId = Option41.String("--referee-installation-id");
+  refereeWebhookHmacKvUri = Option41.String("--referee-webhook-hmac-kv-uri");
+  examKvUri = Option41.String("--exam-kv-uri");
+  examLaWorkspaceId = Option41.String("--exam-la-workspace-id");
+  brainEvalDeployment = Option41.String("--brain-eval-deployment");
+  brainAppLogin = Option41.String("--brain-app-login");
+  refereeCheckpointDir = Option41.String("--referee-checkpoint-dir");
+  examApiBase = Option41.String("--exam-api-base");
   async executeCommand() {
     const mode = resolveOutputMode(
       this.output,
@@ -24483,6 +25070,7 @@ var DeployCommand = class extends M8tCommand {
           location: this.location,
           suffix: this.suffix,
           imageRef: this.imageRef,
+          ...this.gatewayImageRef ? { gatewayImageRef: this.gatewayImageRef } : {},
           tenantId: account2.tenantId,
           clientId,
           foundryResourceId: foundryResourceId2,
@@ -24552,6 +25140,7 @@ var DeployCommand = class extends M8tCommand {
       location: this.location,
       suffix: this.suffix,
       imageRef: this.imageRef,
+      ...this.gatewayImageRef ? { gatewayImageRef: this.gatewayImageRef } : {},
       tenantId: app.tenantId,
       clientId: app.clientId,
       foundryResourceId,
@@ -24622,7 +25211,7 @@ var DeployCommand = class extends M8tCommand {
 
 // src/commands/eval/skill.ts
 import { spawnSync as spawnSync4 } from "child_process";
-import { Command as Command44, Option as Option41 } from "clipanion";
+import { Command as Command45, Option as Option42 } from "clipanion";
 init_errors();
 var DECISIONS = /* @__PURE__ */ new Set(["promote", "reject", "needs_review"]);
 var JUDGE_STATUSES = /* @__PURE__ */ new Set(["ok", "skipped", "unavailable"]);
@@ -24647,14 +25236,14 @@ function parseVerdict(stdout) {
 }
 var EvalSkillCommand = class extends M8tCommand {
   static paths = [["eval", "skill"]];
-  static usage = Command44.Usage({
+  static usage = Command45.Usage({
     description: "Vet one inbox skill candidate: promote / reject / needs_review. Shells out to the Python `brain-eval` core (override its path with $BRAIN_EVAL_BIN)."
   });
-  candidate = Option41.String();
-  skillsDir = Option41.String("--skills-dir");
-  noJudge = Option41.Boolean("--no-judge", false);
-  deployment = Option41.String("--deployment");
-  output = Option41.String("--output");
+  candidate = Option42.String();
+  skillsDir = Option42.String("--skills-dir");
+  noJudge = Option42.Boolean("--no-judge", false);
+  deployment = Option42.String("--deployment");
+  output = Option42.String("--output");
   executeCommand() {
     return Promise.resolve(this._runCommand());
   }
@@ -24713,7 +25302,7 @@ var EvalSkillCommand = class extends M8tCommand {
 import { spawnSync as spawnSync5 } from "child_process";
 import { writeFileSync as writeFileSync8, mkdirSync as mkdirSync6, readFileSync as readFileSync21, existsSync as existsSync20, readdirSync as readdirSync3 } from "fs";
 import { join as join30 } from "path";
-import { Command as Command45, Option as Option42 } from "clipanion";
+import { Command as Command46, Option as Option43 } from "clipanion";
 init_errors();
 init_esm();
 function parseArmToken(tok, opts) {
@@ -24943,24 +25532,24 @@ function buildPlan(args) {
 }
 var EvalExamCommand = class extends M8tCommand {
   static paths = [["eval", "exam"]];
-  static usage = Command45.Usage({
+  static usage = Command46.Usage({
     description: "Run a brain exam: impact A/B + dream-delta. Resolves the plan, then shells out to the Python `brain-exam` orchestrator (override its path with $BRAIN_EXAM_BIN). Renders an ExamVerdict: three-valued verdict + power note + per-task flips."
   });
-  worker = Option42.String();
-  arms = Option42.String("--arms");
-  taskSet = Option42.String("--task-set");
-  examType = Option42.String("--exam-type");
-  skill = Option42.String("--skill");
-  reps = Option42.String("-n,--reps");
-  probes = Option42.String("--probes");
-  pool = Option42.String("--pool");
-  out = Option42.String("--out");
-  dryRun = Option42.Boolean("--dry-run", false);
-  keepArms = Option42.Boolean("--keep-arms", false);
-  allowStub = Option42.Boolean("--allow-stub", false);
-  deployment = Option42.String("--deployment");
-  output = Option42.String("--output");
-  observeWaitS = Option42.String("--observe-wait-s");
+  worker = Option43.String();
+  arms = Option43.String("--arms");
+  taskSet = Option43.String("--task-set");
+  examType = Option43.String("--exam-type");
+  skill = Option43.String("--skill");
+  reps = Option43.String("-n,--reps");
+  probes = Option43.String("--probes");
+  pool = Option43.String("--pool");
+  out = Option43.String("--out");
+  dryRun = Option43.Boolean("--dry-run", false);
+  keepArms = Option43.Boolean("--keep-arms", false);
+  allowStub = Option43.Boolean("--allow-stub", false);
+  deployment = Option43.String("--deployment");
+  output = Option43.String("--output");
+  observeWaitS = Option43.String("--observe-wait-s");
   async executeCommand() {
     await Promise.resolve();
     const worker = typeof this.worker === "string" ? this.worker : void 0;
@@ -25075,10 +25664,10 @@ var EvalExamCommand = class extends M8tCommand {
 };
 
 // src/commands/version.ts
-import { Command as Command46, Option as Option43 } from "clipanion";
+import { Command as Command47, Option as Option44 } from "clipanion";
 var VersionCommand = class extends M8tCommand {
   static paths = [["version"], ["--version"], ["-v"]];
-  static usage = Command46.Usage({
+  static usage = Command47.Usage({
     description: "Print the CLI version.",
     details: "Prints the m8t CLI version. With --verbose, also prints Node version and platform.",
     examples: [
@@ -25086,8 +25675,8 @@ var VersionCommand = class extends M8tCommand {
       ["Print as JSON", "$0 version --output json"]
     ]
   });
-  output = Option43.String("--output", { description: "pretty | json | auto (default)" });
-  verbose = Option43.Boolean("--verbose", false);
+  output = Option44.String("--output", { description: "pretty | json | auto (default)" });
+  verbose = Option44.Boolean("--verbose", false);
   executeCommand() {
     const mode = resolveOutputMode(
       this.output ?? "auto",
@@ -25118,18 +25707,18 @@ var VersionCommand = class extends M8tCommand {
 };
 
 // src/commands/whoami.ts
-import { Command as Command47, Option as Option44 } from "clipanion";
+import { Command as Command48, Option as Option45 } from "clipanion";
 var WhoamiCommand = class extends M8tCommand {
   static paths = [["whoami"]];
-  static usage = Command47.Usage({
+  static usage = Command48.Usage({
     description: "Show your identity + the gateway you'll talk to. Probes the backend."
   });
-  output = Option44.String("--output");
-  verbose = Option44.Boolean("--verbose", false);
-  subscription = Option44.String("--subscription", {
+  output = Option45.String("--output");
+  verbose = Option45.Boolean("--verbose", false);
+  subscription = Option45.String("--subscription", {
     description: "Azure subscription ID to discover gateway in (defaults to active az subscription)."
   });
-  resourceGroup = Option44.String("--resource-group", {
+  resourceGroup = Option45.String("--resource-group", {
     description: "m8t resource group to disambiguate the gateway (multi-deployment subscriptions)."
   });
   async executeCommand() {
@@ -25194,7 +25783,7 @@ var WhoamiCommand = class extends M8tCommand {
 };
 
 // src/commands/status.ts
-import { Command as Command48, Option as Option45 } from "clipanion";
+import { Command as Command49, Option as Option46 } from "clipanion";
 
 // src/lib/azd.ts
 init_errors();
@@ -25259,10 +25848,10 @@ async function resolveLocalContext() {
 // src/commands/status.ts
 var StatusCommand = class extends M8tCommand {
   static paths = [["status"]];
-  static usage = Command48.Usage({
+  static usage = Command49.Usage({
     description: "Show the local m8t context: identity, config.yaml, gateway cache, azd mode."
   });
-  output = Option45.String("--output");
+  output = Option46.String("--output");
   async executeCommand() {
     const mode = resolveOutputMode(
       this.output,
@@ -25300,8 +25889,8 @@ var StatusCommand = class extends M8tCommand {
 };
 
 // src/commands/doctor.ts
-import { Command as Command49, Option as Option46 } from "clipanion";
-import { DefaultAzureCredential as DefaultAzureCredential23 } from "@azure/identity";
+import { Command as Command50, Option as Option47 } from "clipanion";
+import { DefaultAzureCredential as DefaultAzureCredential24 } from "@azure/identity";
 import * as fs30 from "fs";
 import * as os12 from "os";
 import * as path33 from "path";
@@ -25505,6 +26094,43 @@ function checkLegacyStateDir(probe) {
     remediation: "review ~/.m8t-stack for anything you still need, then remove it"
   };
 }
+function checkOutboundEmail(probe) {
+  const name = "outbound email";
+  const intended = probe.stampFeature?.enabled === true;
+  if (!intended) {
+    return {
+      name,
+      status: "INFO",
+      detail: "off \u2014 advisor handoffs render but do not send",
+      remediation: "m8t platform email on"
+    };
+  }
+  if (probe.executorEnv === null) {
+    return {
+      name,
+      status: "WARN",
+      detail: `enabled in the stamp, but no ${probe.executorName} is deployed \u2014 nothing can send`,
+      remediation: `m8t azure-exec deploy ${probe.executorName} --resource-group <rg> --brain <owner/repo>`
+    };
+  }
+  const endpoint = probe.executorEnv.M8T_ACS_ENDPOINT ?? "";
+  const sender = probe.executorEnv.M8T_ACS_SENDER ?? "";
+  const flag = probe.executorEnv.M8T_EMAIL_ENABLED ?? "";
+  if (endpoint !== "" && sender !== "" && flag !== "") {
+    return { name, status: "PASS", detail: `on \u2014 sending as ${sender}` };
+  }
+  const missing = [
+    ...flag === "" ? ["M8T_EMAIL_ENABLED"] : [],
+    ...endpoint === "" ? ["M8T_ACS_ENDPOINT"] : [],
+    ...sender === "" ? ["M8T_ACS_SENDER"] : []
+  ];
+  return {
+    name,
+    status: "FAIL",
+    detail: `MISCONFIGURED \u2014 the stamp says email is on, but ${probe.executorName} is missing ${missing.join(", ")}. Ezra will refuse to send and report a platform bug.`,
+    remediation: "m8t platform email on"
+  };
+}
 
 // src/commands/doctor.ts
 init_foundry_agent_get();
@@ -25811,12 +26437,12 @@ function probeLegacyStateDir() {
 }
 var DoctorCommand = class extends M8tCommand {
   static paths = [["doctor"]];
-  static usage = Command49.Usage({
+  static usage = Command50.Usage({
     description: "Diagnose the local m8t setup: az login, config.yaml, gateway, Foundry data-plane."
   });
-  output = Option46.String("--output");
-  agent = Option46.String("--agent");
-  resourceGroup = Option46.String("--resource-group", {
+  output = Option47.String("--output");
+  agent = Option47.String("--agent");
+  resourceGroup = Option47.String("--resource-group", {
     description: "m8t resource group to disambiguate the gateway (multi-deployment subscriptions)."
   });
   async executeCommand() {
@@ -25889,7 +26515,7 @@ var DoctorCommand = class extends M8tCommand {
       let kvStatus = 0;
       if (kv) {
         try {
-          const token = await new DefaultAzureCredential23().getToken("https://vault.azure.net/.default");
+          const token = await new DefaultAzureCredential24().getToken("https://vault.azure.net/.default");
           const res = await fetch(`${kv.uri.replace(/\/$/, "")}/secrets?api-version=7.4&maxresults=1`, {
             headers: { Authorization: `Bearer ${token.token}` }
           });
@@ -25906,10 +26532,64 @@ var DoctorCommand = class extends M8tCommand {
       const region = foundryAccountId ? await resolveAccountLocation(foundryAccountId) : null;
       const usages = region ? await listModelQuota(region) : [];
       emit(checkModelQuota(deployments, usages));
+      checking("outbound email");
+      try {
+        const credential2 = new DefaultAzureCredential24();
+        const outcome = platformRg && platformSub ? await readStampOutcome({ credential: credential2, subscriptionId: platformSub, resourceGroup: platformRg }).catch(
+          () => ({ source: "unreadable" })
+        ) : { source: "unreadable" };
+        if (outcome.source === "unreadable") {
+          emit({
+            name: "outbound email",
+            status: "INFO",
+            detail: "could not read the recorded intent (platform stamp unreadable) \u2014 state unknown, not necessarily off"
+          });
+        } else {
+          const { agentName: executorName } = await resolveExecutorAgentName({
+            credential: credential2,
+            projectEndpoint: foundry.projectEndpoint
+          });
+          const stamp = outcome.source === "explicit" ? outcome.stamp : null;
+          let executorEnv = null;
+          let executorUnreadable = null;
+          try {
+            const cur = await getAgentVersion({
+              credential: credential2,
+              projectEndpoint: foundry.projectEndpoint,
+              agentName: executorName
+            });
+            executorEnv = cur.definition.environment_variables ?? {};
+          } catch (err) {
+            if (err.code === "AGENT_NOT_FOUND") executorEnv = null;
+            else executorUnreadable = err instanceof Error ? err.message : String(err);
+          }
+          if (executorUnreadable !== null) {
+            emit({
+              name: "outbound email",
+              status: "INFO",
+              detail: `could not read ${executorName} (${executorUnreadable}) \u2014 wiring unknown`
+            });
+          } else {
+            emit(
+              checkOutboundEmail({
+                stampFeature: stamp?.features?.email ?? null,
+                executorEnv,
+                executorName
+              })
+            );
+          }
+        }
+      } catch (e) {
+        emit({
+          name: "outbound email",
+          status: "INFO",
+          detail: `could not check: ${e instanceof Error ? e.message : String(e)}`
+        });
+      }
       if (typeof this.agent === "string" && this.agent) {
         checking(`delivery grant for ${this.agent}`);
         try {
-          const credential2 = new DefaultAzureCredential23();
+          const credential2 = new DefaultAzureCredential24();
           const cur = await getAgentVersion({
             credential: credential2,
             projectEndpoint: foundry.projectEndpoint,
@@ -25952,11 +26632,11 @@ var DoctorCommand = class extends M8tCommand {
 };
 
 // src/commands/prereqs.ts
-import { Command as Command50, Option as Option47 } from "clipanion";
+import { Command as Command51, Option as Option48 } from "clipanion";
 init_errors();
 
 // src/lib/prereq-deps.ts
-import { DefaultAzureCredential as DefaultAzureCredential24 } from "@azure/identity";
+import { DefaultAzureCredential as DefaultAzureCredential25 } from "@azure/identity";
 
 // src/lib/bootstrap-preflight.ts
 var ADMIN_DIRECTORY_ROLES = ["Global Administrator", "Application Administrator", "Cloud Application Administrator"];
@@ -26068,7 +26748,7 @@ function buildPrereqDeps(opts = {}) {
     probeRedirectUri,
     fixFoundryAccess,
     fixKeyVaultAccess,
-    credential: () => credentialSingleton2 ??= new DefaultAzureCredential24()
+    credential: () => credentialSingleton2 ??= new DefaultAzureCredential25()
   };
 }
 
@@ -26658,7 +27338,7 @@ function renderVerdict(v) {
 }
 var PrereqsCommand = class extends M8tCommand {
   static paths = [["prereqs"]];
-  static usage = Command50.Usage({
+  static usage = Command51.Usage({
     description: "Check (and optionally fix) everything m8t needs \u2014 to install, or for you to use it.",
     details: "Runs one of two phases. With no platform discoverable it checks INSTALL prerequisites: your Azure sign-in, subscription and directory rights, resource-provider registrations, soft-deleted Cognitive Services accounts (they hold their model quota until purged), and model quota. With a platform live it checks USAGE prerequisites for the signed-in account: the sign-in redirect URI, Foundry data-plane access, and Key Vault secrets access. Pass --fix to repair what is repairable, and --fix --for <upn> to set a teammate up (usage phase only). Read-only without --fix.",
     examples: [
@@ -26669,15 +27349,15 @@ var PrereqsCommand = class extends M8tCommand {
       ["Set a teammate up (needs role-assignment rights)", "$0 prereqs --fix --for alice@contoso.com"]
     ]
   });
-  fix = Option47.Boolean("--fix", false, { description: "Repair what is repairable. Without it the command only reports." });
-  for_ = Option47.String("--for", { description: "UPN or object id of another person. Usage phase only." });
-  phase = Option47.String("--phase", { description: "Force 'install' or 'usage' instead of auto-detecting." });
-  region = Option47.String("--region", { description: "Target region. Enables the install-phase quota check, and judges soft-deleted accounts against the region you will install into (without it, they only warn)." });
-  model = Option47.String("--model", { description: `Model whose quota the install needs (default ${INSTALL_REASONING_MODEL}).` });
-  clientId = Option47.String("--client-id", { description: "A ready app registration, in place of directory-admin rights." });
-  subscription = Option47.String("--subscription");
-  resourceGroup = Option47.String("--resource-group");
-  output = Option47.String("--output");
+  fix = Option48.Boolean("--fix", false, { description: "Repair what is repairable. Without it the command only reports." });
+  for_ = Option48.String("--for", { description: "UPN or object id of another person. Usage phase only." });
+  phase = Option48.String("--phase", { description: "Force 'install' or 'usage' instead of auto-detecting." });
+  region = Option48.String("--region", { description: "Target region. Enables the install-phase quota check, and judges soft-deleted accounts against the region you will install into (without it, they only warn)." });
+  model = Option48.String("--model", { description: `Model whose quota the install needs (default ${INSTALL_REASONING_MODEL}).` });
+  clientId = Option48.String("--client-id", { description: "A ready app registration, in place of directory-admin rights." });
+  subscription = Option48.String("--subscription");
+  resourceGroup = Option48.String("--resource-group");
+  output = Option48.String("--output");
   async executeCommand() {
     const mode = resolveOutputMode(this.output, this.context.stdout);
     const json = mode === "json";
@@ -26733,7 +27413,7 @@ var PrereqsCommand = class extends M8tCommand {
 };
 
 // src/commands/switch.ts
-import { Command as Command51, Option as Option48 } from "clipanion";
+import { Command as Command52, Option as Option49 } from "clipanion";
 
 // src/lib/profiles.ts
 import * as fs31 from "fs/promises";
@@ -26873,14 +27553,14 @@ async function profileSwitch(name, asName) {
 init_errors();
 var SwitchCommand = class extends M8tCommand {
   static paths = [["switch"]];
-  static usage = Command51.Usage({
+  static usage = Command52.Usage({
     description: "Re-point local config at another deployment: --subscription <id|name> (discovery) or <profile>."
   });
-  profile = Option48.String({ required: false });
-  subscription = Option48.String("--subscription");
-  list = Option48.Boolean("--list", false);
-  as = Option48.String("--as");
-  output = Option48.String("--output");
+  profile = Option49.String({ required: false });
+  subscription = Option49.String("--subscription");
+  list = Option49.Boolean("--list", false);
+  as = Option49.String("--as");
+  output = Option49.String("--output");
   async executeCommand() {
     const mode = resolveOutputMode(
       this.output,
@@ -26937,7 +27617,7 @@ var SwitchCommand = class extends M8tCommand {
 
 // src/commands/open.ts
 import { spawn as spawn5 } from "child_process";
-import { Command as Command52, Option as Option49 } from "clipanion";
+import { Command as Command53, Option as Option50 } from "clipanion";
 
 // src/lib/open-targets.ts
 init_errors();
@@ -26983,14 +27663,14 @@ function openUrl(url) {
 }
 var OpenCommand = class extends M8tCommand {
   static paths = [["open"]];
-  static usage = Command52.Usage({
+  static usage = Command53.Usage({
     description: "Open the deployed webapp (default), the Foundry portal, or the resource group.",
     details: "Targets: webapp (deployed app, default) | foundry (ai.azure.com) | portal (resource group in the Azure portal). Pass --print to emit the URL instead of launching a browser (also the default when stdout isn't a TTY)."
   });
-  target = Option49.String({ required: false });
-  print = Option49.Boolean("--print", false);
-  output = Option49.String("--output");
-  resourceGroup = Option49.String("--resource-group", {
+  target = Option50.String({ required: false });
+  print = Option50.Boolean("--print", false);
+  output = Option50.String("--output");
+  resourceGroup = Option50.String("--resource-group", {
     description: "m8t resource group to disambiguate the gateway (multi-deployment subscriptions)."
   });
   async executeCommand() {
@@ -27034,7 +27714,7 @@ var OpenCommand = class extends M8tCommand {
 };
 
 // src/commands/dream/run.ts
-import { Command as Command53, Option as Option50 } from "clipanion";
+import { Command as Command54, Option as Option51 } from "clipanion";
 import { AzureCliCredential } from "@azure/identity";
 import { TableClient as TableClient7 } from "@azure/data-tables";
 import { AIProjectClient as AIProjectClient3 } from "@azure/ai-projects";
@@ -29328,28 +30008,28 @@ function redactTranscripts(input) {
 }
 var DreamRunCommand = class extends M8tCommand {
   static paths = [["dream", "run"]];
-  static usage = Command53.Usage({
+  static usage = Command54.Usage({
     description: "Dry-run the brain consumption pipeline for one worker (no model call, no writes). Pass --live to actually run it.",
     details: "Builds AzureCliCredential + resolves the Foundry project, ledger table, and Log Analytics workspace, runs the consumption pipeline, and prints the skip-ledger, the partition invariant, and harvest stats. Transcripts are metadata-only unless --show-transcripts is passed.\n\nThe bare command is READ-ONLY. --live takes the other branch: a real model call and a commit to the worker's brain repo through a minted GitHub App token."
   });
-  worker = Option50.String("--worker", { description: "Worker (canonical name) to harvest. Required." });
+  worker = Option51.String("--worker", { description: "Worker (canonical name) to harvest. Required." });
   // Opting IN to the side effects, rather than opting out of them. This command's
   // own help has always described a dry run, but the bare invocation used to take
   // the live branch — a real model call and a commit to the brain repo — so anyone
   // acting on `--help` got the opposite of what they read.
-  live = Option50.Boolean("--live", false, { description: "Actually run it: model call + commit to the brain repo." });
-  dryRun = Option50.Boolean("--dry-run", false, { description: "Read-only harvest. This is the default; the flag is accepted for compatibility." });
-  since = Option50.String("--since", { description: "ISO-8601 start override (rejected if malformed or future)." });
-  reset = Option50.Boolean("--reset", false, { description: "Ignore the stored cursor; read from the beginning." });
-  showTranscripts = Option50.Boolean("--show-transcripts", false, {
+  live = Option51.Boolean("--live", false, { description: "Actually run it: model call + commit to the brain repo." });
+  dryRun = Option51.Boolean("--dry-run", false, { description: "Read-only harvest. This is the default; the flag is accepted for compatibility." });
+  since = Option51.String("--since", { description: "ISO-8601 start override (rejected if malformed or future)." });
+  reset = Option51.Boolean("--reset", false, { description: "Ignore the stored cursor; read from the beginning." });
+  showTranscripts = Option51.Boolean("--show-transcripts", false, {
     description: "Print transcript bodies (default: metadata only)."
   });
-  subscription = Option50.String("--subscription");
-  endpoint = Option50.String("--endpoint");
-  storageAccount = Option50.String("--storage-account", {
+  subscription = Option51.String("--subscription");
+  endpoint = Option51.String("--endpoint");
+  storageAccount = Option51.String("--storage-account", {
     description: "Ledger storage account name (skips tag-based discovery)"
   });
-  output = Option50.String("--output");
+  output = Option51.String("--output");
   // Resolution seam — overridden by tests; built lazily at runtime otherwise.
   deps;
   async executeCommand() {
@@ -29700,7 +30380,7 @@ function defaultDeps(overrides) {
 
 // src/commands/conversations/sweep.ts
 import { createHash as createHash4 } from "crypto";
-import { Command as Command54, Option as Option51 } from "clipanion";
+import { Command as Command55, Option as Option52 } from "clipanion";
 import { AzureCliCredential as AzureCliCredential2 } from "@azure/identity";
 import { TableClient as TableClient8 } from "@azure/data-tables";
 import { AIProjectClient as AIProjectClient4 } from "@azure/ai-projects";
@@ -29826,7 +30506,7 @@ function defaultDeps2() {
 }
 var ConversationsSweepCommand = class extends M8tCommand {
   static paths = [["conversations", "sweep"]];
-  static usage = Command54.Usage({
+  static usage = Command55.Usage({
     category: "Conversations",
     description: "Delete expired public-visitor conversations (dry run by default)",
     details: `
@@ -29842,22 +30522,22 @@ var ConversationsSweepCommand = class extends M8tCommand {
       ["Delete, capped at 50", "m8t conversations sweep --delete --max 50"]
     ]
   });
-  doDelete = Option51.Boolean("--delete", false, {
+  doDelete = Option52.Boolean("--delete", false, {
     description: "Perform deletions (without this flag the command only reports)"
   });
-  principal = Option51.String("--principal", {
+  principal = Option52.String("--principal", {
     description: "Service-principal oid whose end-user keys are known-ephemeral (required with --delete; a dry run without it reports candidates grouped by principal)"
   });
-  max = Option51.String("--max", "200", { description: "Maximum deletions per run" });
-  graceDays = Option51.String("--grace-days", "14", {
+  max = Option52.String("--max", "200", { description: "Maximum deletions per run" });
+  graceDays = Option52.String("--grace-days", "14", {
     description: "Days past the 30-day key life before a conversation is eligible"
   });
-  lookbackDays = Option51.String("--lookback-days", "180", {
+  lookbackDays = Option52.String("--lookback-days", "180", {
     description: "How far back to scan ledger activity for candidates"
   });
-  subscription = Option51.String("--subscription", { description: "Azure subscription id override" });
-  endpoint = Option51.String("--endpoint", { description: "Foundry project endpoint override" });
-  storageAccount = Option51.String("--storage-account", {
+  subscription = Option52.String("--subscription", { description: "Azure subscription id override" });
+  endpoint = Option52.String("--endpoint", { description: "Foundry project endpoint override" });
+  storageAccount = Option52.String("--storage-account", {
     description: "Ledger storage account name (skips tag-based discovery)"
   });
   deps = defaultDeps2();
@@ -29985,7 +30665,7 @@ var ConversationsSweepCommand = class extends M8tCommand {
 };
 
 // src/commands/foundry/create.ts
-import { Command as Command55, Option as Option52 } from "clipanion";
+import { Command as Command56, Option as Option53 } from "clipanion";
 
 // src/lib/foundry-create.ts
 init_errors();
@@ -30223,7 +30903,7 @@ async function createFoundryProject(args) {
 init_errors();
 var FoundryCreateCommand = class extends M8tCommand {
   static paths = [["foundry", "create"]];
-  static usage = Command55.Usage({
+  static usage = Command56.Usage({
     description: "Create an AI Foundry (AIServices) account + project + model deployment from scratch.",
     details: "Non-interactive and idempotent. Creates the AIServices account (custom subdomain + project management), a project, and a model deployment (default gpt-4.1-mini @ capacity 50). Region must be hosted-agent-eligible. Emits the project endpoint as structured output. Re-run is a clean no-op (account/project skipped if present; deployment capacity converges UP, never down).",
     examples: [
@@ -30232,16 +30912,16 @@ var FoundryCreateCommand = class extends M8tCommand {
       ["Higher capacity for a reasoning model", "$0 foundry create --resource-group rg-m8t-stack --location eastus2 --model gpt-5-mini --capacity 250"]
     ]
   });
-  resourceGroup = Option52.String("--resource-group");
-  location = Option52.String("--location");
-  account = Option52.String("--account");
-  project = Option52.String("--project", "m8t");
-  model = Option52.String("--model", "gpt-4.1-mini");
-  modelVersion = Option52.String("--model-version", "2025-04-14");
-  capacity = Option52.String("--capacity", "50");
-  subscription = Option52.String("--subscription");
-  skipQuotaCheck = Option52.Boolean("--skip-quota-check", false);
-  output = Option52.String("--output");
+  resourceGroup = Option53.String("--resource-group");
+  location = Option53.String("--location");
+  account = Option53.String("--account");
+  project = Option53.String("--project", "m8t");
+  model = Option53.String("--model", "gpt-4.1-mini");
+  modelVersion = Option53.String("--model-version", "2025-04-14");
+  capacity = Option53.String("--capacity", "50");
+  subscription = Option53.String("--subscription");
+  skipQuotaCheck = Option53.Boolean("--skip-quota-check", false);
+  output = Option53.String("--output");
   async executeCommand() {
     const mode = resolveOutputMode(
       this.output,
@@ -30313,22 +30993,22 @@ var FoundryCreateCommand = class extends M8tCommand {
 };
 
 // src/commands/foundry/await-ready.ts
-import { Command as Command56, Option as Option53 } from "clipanion";
+import { Command as Command57, Option as Option54 } from "clipanion";
 import { AzureCliCredential as AzureCliCredential3 } from "@azure/identity";
 init_errors();
 var FoundryAwaitReadyCommand = class extends M8tCommand {
   static paths = [["foundry", "await-ready"]];
-  static usage = Command56.Usage({
+  static usage = Command57.Usage({
     description: "Wait until a freshly-created Foundry project's data plane reliably serves it.",
     details: "Probes the project (GET /agents) until it returns 200 on a few consecutive tries, or fails clearly after a bounded budget. A newly-created account can serve intermittent 404 'Project not found' for minutes; run this after 'foundry create' and before deploying agents so the worker phase doesn't catch the unstable window.",
     examples: [["Wait for a project to be ready", "$0 foundry await-ready --endpoint https://acc.services.ai.azure.com/api/projects/m8t"]]
   });
-  endpoint = Option53.String("--endpoint");
-  consecutive = Option53.String("--consecutive", "3");
-  attempts = Option53.String("--attempts", "60");
-  interval = Option53.String("--interval", "5");
-  subscription = Option53.String("--subscription");
-  output = Option53.String("--output");
+  endpoint = Option54.String("--endpoint");
+  consecutive = Option54.String("--consecutive", "3");
+  attempts = Option54.String("--attempts", "60");
+  interval = Option54.String("--interval", "5");
+  subscription = Option54.String("--subscription");
+  output = Option54.String("--output");
   async executeCommand() {
     const mode = resolveOutputMode(this.output, this.context.stdout);
     const endpoint = typeof this.endpoint === "string" ? this.endpoint : void 0;
@@ -30362,7 +31042,7 @@ var FoundryAwaitReadyCommand = class extends M8tCommand {
 };
 
 // src/commands/bootstrap/preflight.ts
-import { Command as Command57, Option as Option54 } from "clipanion";
+import { Command as Command58, Option as Option55 } from "clipanion";
 
 // ../../packages/telemetry-contract/artifact/tier-map.ts
 var EVENT_TIERS = {
@@ -30414,7 +31094,7 @@ function preflightRenderable(results) {
 }
 var BootstrapPreflightCommand = class extends M8tCommand {
   static paths = [["bootstrap", "preflight"]];
-  static usage = Command57.Usage({
+  static usage = Command58.Usage({
     description: "Loudly verify you can install m8t (Owner/UAA + directory admin) and hard-stop if not.",
     details: "Step 1 of `m8t bootstrap`. Prints an unmissable admin-credentials notice, then checks: Owner or User Access Administrator at subscription scope (hard requirement), directory-admin capability to register the app (or pass --client-id), every Azure resource provider the install uses (registering any that are missing), soft-deleted Cognitive Services accounts (they keep their model quota until purged, so quota can read free and the model deployment still fail), and \u2014 with --location \u2014 model quota in the target region. Exits non-zero with the exact failing check + remedy. `m8t prereqs` runs the same substrate checks on their own.",
     examples: [
@@ -30423,9 +31103,9 @@ var BootstrapPreflightCommand = class extends M8tCommand {
       ["BYO app registration (directory guests)", "$0 bootstrap preflight --client-id <appId>"]
     ]
   });
-  clientId = Option54.String("--client-id");
-  subscription = Option54.String("--subscription");
-  location = Option54.String("--location", {
+  clientId = Option55.String("--client-id");
+  subscription = Option55.String("--subscription");
+  location = Option55.String("--location", {
     description: "Target region. Enables the model-quota check \u2014 without it, quota is not verified."
   });
   async executeCommand() {
@@ -30525,7 +31205,7 @@ ${colors.error("  " + why)}
 import * as fs34 from "fs";
 import * as os15 from "os";
 import * as path37 from "path";
-import { Command as Command58, Option as Option55 } from "clipanion";
+import { Command as Command59, Option as Option56 } from "clipanion";
 init_errors();
 
 // src/lib/bootstrap-mi.ts
@@ -30895,7 +31575,7 @@ var ACI_NAME = "m8t-installer";
 var MI_NAME = "m8t-installer-mi";
 var BootstrapLaunchCommand = class extends M8tCommand {
   static paths = [["bootstrap", "launch"]];
-  static usage = Command58.Usage({
+  static usage = Command59.Usage({
     description: "Create + authorize the installer managed identity, then kick the cloud installer.",
     details: "Step 2 of `m8t bootstrap` (run after `preflight`). Ensures the resource group, creates the m8t app registration (or uses --client-id), creates a user-assigned managed identity granted Owner at subscription scope, and launches the published m8t-installer image as an ACI run-to-completion job under that identity. Writes ~/.m8t/bootstrap.json for `status` and `reap`, and threads your Azure object id so the installer can grant you the platform's data-plane roles itself.",
     examples: [
@@ -30906,26 +31586,26 @@ var BootstrapLaunchCommand = class extends M8tCommand {
       ["Share a support contact", "$0 bootstrap launch --location eastus2 --contact-email you@example.com --company 'Acme'"]
     ]
   });
-  location = Option55.String("--location");
-  resourceGroup = Option55.String("--resource-group");
-  clientId = Option55.String("--client-id");
-  subscription = Option55.String("--subscription");
-  installerTag = Option55.String("--installer-tag");
+  location = Option56.String("--location");
+  resourceGroup = Option56.String("--resource-group");
+  clientId = Option56.String("--client-id");
+  subscription = Option56.String("--subscription");
+  installerTag = Option56.String("--installer-tag");
   // Full image ref override (registry + repo + tag) — an escape hatch when the
   // default org/tag is wrong for the current CLI (e.g. a stale published build).
   // Wins over --installer-tag / the pinned default.
-  installerImage = Option55.String("--installer-image");
-  gatewayImageRef = Option55.String("--gateway-image-ref");
-  githubAppCreds = Option55.String("--github-app-creds");
-  contactEmail = Option55.String("--contact-email", { description: "Share a contact email with m8t support. Not sent unless you pass it." });
-  company = Option55.String("--company", { description: "Share your company name with m8t support. Not sent unless you pass it." });
+  installerImage = Option56.String("--installer-image");
+  gatewayImageRef = Option56.String("--gateway-image-ref");
+  githubAppCreds = Option56.String("--github-app-creds");
+  contactEmail = Option56.String("--contact-email", { description: "Share a contact email with m8t support. Not sent unless you pass it." });
+  company = Option56.String("--company", { description: "Share your company name with m8t support. Not sent unless you pass it." });
   // Value-carrying on purpose: a bare --force would be cargo-culted into
   // runbooks and harness prompts and erode the protection, whereas a faithful
   // paste can never accidentally carry the victim group's name. It AUTHORIZES
   // the target; --resource-group is what CHOOSES it.
-  reinstallInto = Option55.String("--reinstall-into", { description: "Consent to installing into --resource-group even though it already holds resources. Must match the target group's name." });
-  org = Option55.String("--org", { description: "Assert the GitHub App on disk is installed on this org; refuses on a mismatch." });
-  noBrains = Option55.Boolean("--no-brains", false, { description: "Install without brain-backed workers. For test and CI rigs; the supported install creates brains." });
+  reinstallInto = Option56.String("--reinstall-into", { description: "Consent to installing into --resource-group even though it already holds resources. Must match the target group's name." });
+  org = Option56.String("--org", { description: "Assert the GitHub App on disk is installed on this org; refuses on a mismatch." });
+  noBrains = Option56.Boolean("--no-brains", false, { description: "Install without brain-backed workers. For test and CI rigs; the supported install creates brains." });
   async executeCommand() {
     const location = typeof this.location === "string" ? this.location : void 0;
     if (!location) {
@@ -31086,7 +31766,7 @@ var BootstrapLaunchCommand = class extends M8tCommand {
 };
 
 // src/commands/bootstrap/status.ts
-import { Command as Command60, Option as Option57 } from "clipanion";
+import { Command as Command61, Option as Option58 } from "clipanion";
 init_errors();
 
 // src/lib/bootstrap-aci-state.ts
@@ -32709,17 +33389,17 @@ async function statusCompanion(options) {
       reason: error instanceof Error ? error.message : "Unsafe owned directory"
     };
   }
-  let installed;
+  let installed2;
   try {
-    installed = await readInstalled(options);
+    installed2 = await readInstalled(options);
   } catch (error) {
     return {
       state: "needs-repair",
       reason: error instanceof Error ? error.message : "Invalid install manifest"
     };
   }
-  if (!installed) return { state: "not-installed" };
-  const { paths, install } = installed;
+  if (!installed2) return { state: "not-installed" };
+  const { paths, install } = installed2;
   if (install.platform !== options.platform || install.architecture !== options.architecture || install.ownedTargetRoot !== paths.targetRoot) {
     return {
       state: "needs-repair",
@@ -32960,9 +33640,9 @@ async function uninstallCompanion(options) {
   assertSupported(options);
   const expectedPaths = companionInstallPaths(options);
   await assertOwnedParents(options, expectedPaths);
-  const installed = await readInstalled(options);
-  if (!installed) return { state: "not-installed" };
-  const { paths, install } = installed;
+  const installed2 = await readInstalled(options);
+  if (!installed2) return { state: "not-installed" };
+  const { paths, install } = installed2;
   if (install.ownedTargetRoot !== paths.targetRoot) {
     throw new Error("Refusing to remove a non-owned companion target");
   }
@@ -32985,7 +33665,7 @@ async function uninstallCompanion(options) {
 // src/commands/companion/install.ts
 import * as os19 from "os";
 import * as path43 from "path";
-import { Command as Command59, Option as Option56 } from "clipanion";
+import { Command as Command60, Option as Option57 } from "clipanion";
 
 // src/lib/companion-channel.ts
 async function readCompanionRelease(source = { url: CHANNEL_LATEST_URL }, deps = {}) {
@@ -33143,7 +33823,7 @@ Version: ${state.version}
 }
 var CompanionInstallCommand = class extends M8tCommand {
   static paths = [["companion", "install"]];
-  static usage = Command59.Usage({
+  static usage = Command60.Usage({
     description: "Install the desktop companions for this user from the release channel.",
     examples: [
       ["Install the released build", "$0 companion install"],
@@ -33153,10 +33833,10 @@ var CompanionInstallCommand = class extends M8tCommand {
       ]
     ]
   });
-  from = Option56.String("--from", {
+  from = Option57.String("--from", {
     description: "A locally staged build directory instead of the released one."
   });
-  resourceGroup = Option56.String("--resource-group", {
+  resourceGroup = Option57.String("--resource-group", {
     description: "Which deployment to bind to, when the subscription holds more than one."
   });
   async executeCommand() {
@@ -33372,7 +34052,7 @@ var BootstrapStatusCommand = class extends M8tCommand {
   // runbooks and shakedown recipes that a founder may already be part-way
   // through — it prints a deprecation notice and does the right thing.
   static paths = [["bootstrap", "status"], ["bootstrap", "finish"]];
-  static usage = Command60.Usage({
+  static usage = Command61.Usage({
     description: "Show the cloud installer's live status (phase, progress, result) \u2014 and finish the local setup when it lands.",
     details: "Reads the durable status blob written by the installer. --watch polls until the install reaches done or failed.\n\nOn reaching done under --watch this also completes the local half of the install, which nothing else in the bootstrap path can do: it registers the webapp's sign-in redirect URI (the installer runs as a managed identity with no directory role, and at launch time the gateway FQDN did not exist yet), writes ~/.m8t/repo-root and the gateway discovery cache, and seeds your advisors' brains from the onboarding intake. Re-runnable \u2014 `m8t bootstrap finish` is a deprecated alias that does exactly this on an already-done install.",
     examples: [
@@ -33381,12 +34061,12 @@ var BootstrapStatusCommand = class extends M8tCommand {
       ["Redo the local setup on a finished install", "$0 bootstrap status --finalize --repo-root /path/to/m8t"]
     ]
   });
-  watch = Option57.Boolean("--watch", false);
-  output = Option57.String("--output");
-  repoRoot = Option57.String("--repo-root", { description: "The m8t clone to point local tools at (default: the current directory)." });
-  finalize = Option57.Boolean("--finalize", false, { description: "Complete the local setup against an already-done install, without watching." });
-  subscription = Option57.String("--subscription");
-  resourceGroup = Option57.String("--resource-group");
+  watch = Option58.Boolean("--watch", false);
+  output = Option58.String("--output");
+  repoRoot = Option58.String("--repo-root", { description: "The m8t clone to point local tools at (default: the current directory)." });
+  finalize = Option58.Boolean("--finalize", false, { description: "Complete the local setup against an already-done install, without watching." });
+  subscription = Option58.String("--subscription");
+  resourceGroup = Option58.String("--resource-group");
   async executeCommand() {
     const state = await readBootstrapState();
     if (!state) {
@@ -33519,7 +34199,7 @@ function formatStatus(d) {
 }
 
 // src/commands/bootstrap/reap.ts
-import { Command as Command61, Option as Option58 } from "clipanion";
+import { Command as Command62, Option as Option59 } from "clipanion";
 init_errors();
 
 // src/lib/bootstrap-reap.ts
@@ -33613,7 +34293,7 @@ async function reapInstaller(opts) {
 // src/commands/bootstrap/reap.ts
 var BootstrapReapCommand = class extends M8tCommand {
   static paths = [["bootstrap", "reap"]];
-  static usage = Command61.Usage({
+  static usage = Command62.Usage({
     description: "Tear down the installer scaffolding (ACI \u2192 MI \u2192 its role assignments) after a successful install.",
     details: "Runs locally on the 'done' signal (the installer can't delete its own identity). The platform RG and the gateway's own assignments persist. A failed install is left intact for diagnosis unless --force.\n\n--sweep-orphans is a DIFFERENT and much broader mode: instead of reaping this install, it scans the WHOLE SUBSCRIPTION for m8t role assignments left behind by installs whose resources are gone \u2014 orphaned installer Owner-at-subscription-scope grants and orphaned gateway subscription-scope roles. It is a dry run that only lists what it found unless you also pass --yes, which deletes them.",
     examples: [
@@ -33623,9 +34303,9 @@ var BootstrapReapCommand = class extends M8tCommand {
       ["\u2026and delete them", "$0 bootstrap reap --sweep-orphans --yes"]
     ]
   });
-  force = Option58.Boolean("--force", false, { description: "Reap even if the install failed or never reported a status." });
-  sweepOrphans = Option58.Boolean("--sweep-orphans", false, { description: "Subscription-wide: find m8t role assignments orphaned by earlier installs. Lists only, unless --yes." });
-  yes = Option58.Boolean("--yes", false, { description: "With --sweep-orphans, actually delete what the sweep found." });
+  force = Option59.Boolean("--force", false, { description: "Reap even if the install failed or never reported a status." });
+  sweepOrphans = Option59.Boolean("--sweep-orphans", false, { description: "Subscription-wide: find m8t role assignments orphaned by earlier installs. Lists only, unless --yes." });
+  yes = Option59.Boolean("--yes", false, { description: "With --sweep-orphans, actually delete what the sweep found." });
   async executeCommand() {
     if (this.sweepOrphans === true) {
       const { subscriptionId: sub } = await getAzAccount();
@@ -33719,7 +34399,7 @@ Found ${String(total)} orphaned assignment(s) (${breakdown}) (dry-run). ${colors
 };
 
 // src/commands/bootstrap/ui.ts
-import { Command as Command62, Option as Option59 } from "clipanion";
+import { Command as Command63, Option as Option60 } from "clipanion";
 
 // src/lib/bootstrap-ui.ts
 import * as fs40 from "fs";
@@ -33794,7 +34474,7 @@ function renderDeprecationNotice() {
 }
 var BootstrapUiCommand = class extends M8tCommand {
   static paths = [["bootstrap", "ui"]];
-  static usage = Command62.Usage({
+  static usage = Command63.Usage({
     description: "DEPRECATED \u2014 does nothing. Use `m8t bootstrap profile` instead.",
     details: [
       "The local onboarding chat has been retired. Your details are collected by",
@@ -33814,14 +34494,14 @@ var BootstrapUiCommand = class extends M8tCommand {
   // Accepted and ignored, deliberately: removing them would turn an old script's
   // harmless no-op into an "unknown option" failure mid-install. CLI-rewrite: drop
   // the whole surface when the rewrite lands.
-  repoRoot = Option59.String("--repo-root", { description: "Ignored (deprecated)." });
-  port = Option59.String("--port", "3000", { description: "Ignored (deprecated)." });
-  endpoint = Option59.String("--endpoint", { description: "Ignored (deprecated)." });
-  prepOnly = Option59.Boolean("--prep-only", false, { description: "Ignored (deprecated)." });
-  skipInstall = Option59.Boolean("--skip-install", false, { description: "Ignored (deprecated)." });
-  foreground = Option59.Boolean("--foreground", false, { description: "Ignored (deprecated)." });
-  voice = Option59.Boolean("--voice", false, { description: "Ignored (deprecated)." });
-  stop = Option59.Boolean("--stop", false, {
+  repoRoot = Option60.String("--repo-root", { description: "Ignored (deprecated)." });
+  port = Option60.String("--port", "3000", { description: "Ignored (deprecated)." });
+  endpoint = Option60.String("--endpoint", { description: "Ignored (deprecated)." });
+  prepOnly = Option60.Boolean("--prep-only", false, { description: "Ignored (deprecated)." });
+  skipInstall = Option60.Boolean("--skip-install", false, { description: "Ignored (deprecated)." });
+  foreground = Option60.Boolean("--foreground", false, { description: "Ignored (deprecated)." });
+  voice = Option60.Boolean("--voice", false, { description: "Ignored (deprecated)." });
+  stop = Option60.Boolean("--stop", false, {
     description: "Shut down a local chat UI left running by an earlier version of this command."
   });
   // Not `async`: there is nothing left to await. Everything this command used to
@@ -33843,7 +34523,7 @@ var BootstrapUiCommand = class extends M8tCommand {
 
 // src/commands/bootstrap/profile.ts
 import * as readline3 from "readline/promises";
-import { Command as Command63, Option as Option60 } from "clipanion";
+import { Command as Command64, Option as Option61 } from "clipanion";
 
 // src/lib/profile-collect.ts
 init_errors();
@@ -34012,7 +34692,7 @@ async function openChatInvite(deps = {}) {
 // src/commands/bootstrap/profile.ts
 var BootstrapProfileCommand = class extends M8tCommand {
   static paths = [["bootstrap", "profile"]];
-  static usage = Command63.Usage({
+  static usage = Command64.Usage({
     description: "Confirm your email + your Microsoft startup advisor, and open Ezra to talk to while the install runs.",
     details: [
       "Run after `m8t bootstrap launch`, in parallel with `status --watch`. Records the two",
@@ -34032,12 +34712,12 @@ var BootstrapProfileCommand = class extends M8tCommand {
       ["Skip the browser hand-off", "$0 bootstrap profile --founder-email you@example.com --print"]
     ]
   });
-  founderEmail = Option60.String("--founder-email", { description: "The founder's contact address \u2014 Ezra copies them on its outbound mail." });
-  advisorName = Option60.String("--advisor-name", { description: "Their Microsoft startup advisor's name." });
-  advisorEmail = Option60.String("--advisor-email", { description: "Their Microsoft startup advisor's email." });
-  noAdvisor = Option60.Boolean("--no-advisor", false, { description: "Record that they have no startup advisor to add (or don't know it yet)." });
-  noChat = Option60.Boolean("--no-chat", false, { description: "Record the answers without opening the hosted Ezra." });
-  print = Option60.Boolean("--print", false, { description: "Print the chat link instead of opening a browser (headless / SSH)." });
+  founderEmail = Option61.String("--founder-email", { description: "The founder's contact address \u2014 Ezra copies them on its outbound mail." });
+  advisorName = Option61.String("--advisor-name", { description: "Their Microsoft startup advisor's name." });
+  advisorEmail = Option61.String("--advisor-email", { description: "Their Microsoft startup advisor's email." });
+  noAdvisor = Option61.Boolean("--no-advisor", false, { description: "Record that they have no startup advisor to add (or don't know it yet)." });
+  noChat = Option61.Boolean("--no-chat", false, { description: "Record the answers without opening the hosted Ezra." });
+  print = Option61.Boolean("--print", false, { description: "Print the chat link instead of opening a browser (headless / SSH)." });
   async executeCommand() {
     const stdin = this.context.stdin;
     const stdout = this.context.stdout;
@@ -34130,10 +34810,10 @@ var BootstrapProfileCommand = class extends M8tCommand {
 };
 
 // src/commands/bootstrap/seed-profile.ts
-import { Command as Command64, Option as Option61 } from "clipanion";
+import { Command as Command65, Option as Option62 } from "clipanion";
 var BootstrapSeedProfileCommand = class extends M8tCommand {
   static paths = [["bootstrap", "seed-profile"]];
-  static usage = Command64.Usage({
+  static usage = Command65.Usage({
     description: "Seed your advisors' brains with how to reach you, from what you confirmed at `m8t bootstrap profile`.",
     details: [
       "Renders memory/founder.md + memory/company-profile.md (+ their MEMORY.md index lines)",
@@ -34150,11 +34830,11 @@ var BootstrapSeedProfileCommand = class extends M8tCommand {
       ["Seed now (idempotent)", "$0 bootstrap seed-profile"]
     ]
   });
-  endpoint = Option61.String("--endpoint", { description: "Override the Foundry endpoint (else read from the install status)." });
-  brain = Option61.String("--brain", { description: "Seed only this one brain repo, instead of both <org>/stacey-brain and <org>/ezra-brain." });
-  watch = Option61.Boolean("--watch", false, { description: "Poll until the intake completes (or --timeout)." });
-  timeout = Option61.String("--timeout", { description: "Watch timeout in minutes (default 20)." });
-  githubAppCreds = Option61.String("--github-app-creds");
+  endpoint = Option62.String("--endpoint", { description: "Override the Foundry endpoint (else read from the install status)." });
+  brain = Option62.String("--brain", { description: "Seed only this one brain repo, instead of both <org>/stacey-brain and <org>/ezra-brain." });
+  watch = Option62.Boolean("--watch", false, { description: "Poll until the intake completes (or --timeout)." });
+  timeout = Option62.String("--timeout", { description: "Watch timeout in minutes (default 20)." });
+  githubAppCreds = Option62.String("--github-app-creds");
   async executeCommand() {
     const ctx = await resolveSeedContext({
       endpointOverride: typeof this.endpoint === "string" ? this.endpoint : void 0,
@@ -34242,7 +34922,7 @@ var BootstrapSeedProfileCommand = class extends M8tCommand {
 import * as fs41 from "fs";
 import * as os22 from "os";
 import * as path46 from "path";
-import { Command as Command65, Option as Option62 } from "clipanion";
+import { Command as Command66, Option as Option63 } from "clipanion";
 init_errors();
 
 // src/lib/telemetry-enroll.ts
@@ -34324,7 +35004,7 @@ async function resolveKeyVaultName(containerAppResourceId) {
 }
 var TelemetryEnrollCommand = class extends M8tCommand {
   static paths = [["telemetry", "enroll"]];
-  static usage = Command65.Usage({
+  static usage = Command66.Usage({
     description: "Enroll this installation for operational telemetry (pre-existing installs).",
     details: "Generates an instance id + ingest key from the m8t telemetry ingest and stores the key in your platform Key Vault, the same place the installer writes it on a fresh install. Your installation is identified only by that random instance id \u2014 no contact, company, or subscription details are sent unless you pass them explicitly. Idempotent: refuses if a key already exists.",
     examples: [
@@ -34332,11 +35012,11 @@ var TelemetryEnrollCommand = class extends M8tCommand {
       ["Enroll and share a support contact", "$0 telemetry enroll --contact-email you@example.com --company 'Acme'"]
     ]
   });
-  company = Option62.String("--company", { description: "Share your company name with m8t support. Not sent unless you pass it." });
-  contactEmail = Option62.String("--contact-email", { description: "Share a contact email with m8t support. Not sent unless you pass it." });
-  subscription = Option62.String("--subscription", { description: "Azure subscription id used to find your deployment. Never sent to m8t." });
-  resourceGroup = Option62.String("--resource-group", { description: "Resource group to disambiguate discovery, if you have more than one m8t deployment." });
-  force = Option62.Boolean("--force", false, { description: "Enroll even when a key is already stored. Use only when m8t support asks you to." });
+  company = Option63.String("--company", { description: "Share your company name with m8t support. Not sent unless you pass it." });
+  contactEmail = Option63.String("--contact-email", { description: "Share a contact email with m8t support. Not sent unless you pass it." });
+  subscription = Option63.String("--subscription", { description: "Azure subscription id used to find your deployment. Never sent to m8t." });
+  resourceGroup = Option63.String("--resource-group", { description: "Resource group to disambiguate discovery, if you have more than one m8t deployment." });
+  force = Option63.Boolean("--force", false, { description: "Enroll even when a key is already stored. Use only when m8t support asks you to." });
   async executeCommand() {
     const account = await getAzAccount();
     const subscriptionId = (typeof this.subscription === "string" ? this.subscription : void 0) ?? account.subscriptionId;
@@ -34386,7 +35066,7 @@ var TelemetryEnrollCommand = class extends M8tCommand {
 };
 
 // src/commands/companion/bridge.ts
-import { Command as Command66, Option as Option63 } from "clipanion";
+import { Command as Command67, Option as Option64 } from "clipanion";
 
 // ../../packages/companion-bridge-contract/src/index.ts
 var COMPANION_MESSAGE_MAX_CODE_POINTS = 32768;
@@ -35148,9 +35828,9 @@ async function rosterCompanions(sink, deps = {}) {
       controller.signal
     );
     const now = (deps.now ?? Date.now)();
-    const installed = await (deps.installEpoch ?? readInstallEpoch)();
+    const installed2 = await (deps.installEpoch ?? readInstallEpoch)();
     const activeSince = new Date(
-      installed === null || installed > now ? now : installed
+      installed2 === null || installed2 > now ? now : installed2
     ).toISOString();
     const PRESENTABLE = [
       { personaKey: "startup-advisor", displayName: "Stacey", portraitKey: "stacey" },
@@ -35573,11 +36253,11 @@ async function fetchConversationTurns(request, sink, deps, decode) {
 
 // src/lib/companion-update-check.ts
 async function checkCompanionUpdate(options, deps = {}) {
-  const installed = await statusCompanion(options).then((state) => state.state === "installed" ? state.version : null).catch(() => null);
+  const installed2 = await statusCompanion(options).then((state) => state.state === "installed" ? state.version : null).catch(() => null);
   const release = await (deps.readRelease ?? readCompanionRelease)().catch(() => null);
   return {
     type: "update",
-    installed,
+    installed: installed2,
     available: release?.component.version ?? null,
     severity: release === null ? null : release.severity
   };
@@ -35842,14 +36522,14 @@ async function runCompanionBridge(stdin, stdout, stderr, deps = defaultDeps4) {
     return 3;
   }
 }
-var CompanionBridgeCommand = class extends Command66 {
+var CompanionBridgeCommand = class extends Command67 {
   static paths = [["companion", "_bridge"]];
   /**
    * One process serving many requests instead of one per request, so the
    * session keeps its authenticated context between them. A CLI predating the
    * flag rejects it outright, which is how the app knows to fall back.
    */
-  serve = Option63.Boolean("--serve", false);
+  serve = Option64.Boolean("--serve", false);
   async execute() {
     if (this.serve) {
       return runCompanionBridgeServe(
@@ -35867,7 +36547,7 @@ var CompanionBridgeCommand = class extends Command66 {
 };
 
 // src/commands/companion/status.ts
-import { Command as Command67 } from "clipanion";
+import { Command as Command68 } from "clipanion";
 async function withTimeout(work, ms) {
   let timer;
   try {
@@ -35939,7 +36619,7 @@ Run: m8t companion install
 }
 var CompanionStatusCommand = class extends M8tCommand {
   static paths = [["companion", "status"]];
-  static usage = Command67.Usage({
+  static usage = Command68.Usage({
     description: "Verify the installed desktop companion without launching it."
   });
   async executeCommand() {
@@ -35953,7 +36633,7 @@ var CompanionStatusCommand = class extends M8tCommand {
 };
 
 // src/commands/companion/repair.ts
-import { Command as Command68, Option as Option64 } from "clipanion";
+import { Command as Command69, Option as Option65 } from "clipanion";
 async function runCompanionRepairCommand(stdout, repair) {
   const state = await repair();
   if (state.state === "not-released") {
@@ -35972,10 +36652,10 @@ async function runCompanionRepairCommand(stdout, repair) {
 }
 var CompanionRepairCommand = class extends M8tCommand {
   static paths = [["companion", "repair"]];
-  static usage = Command68.Usage({
+  static usage = Command69.Usage({
     description: "Restore the desktop companions and start-at-login state."
   });
-  resourceGroup = Option64.String("--resource-group", {
+  resourceGroup = Option65.String("--resource-group", {
     description: "Which deployment to bind to, when the subscription holds more than one."
   });
   async executeCommand() {
@@ -35989,7 +36669,7 @@ var CompanionRepairCommand = class extends M8tCommand {
 };
 
 // src/commands/companion/uninstall.ts
-import { Command as Command69 } from "clipanion";
+import { Command as Command70 } from "clipanion";
 async function runCompanionUninstallCommand(stdout, uninstall) {
   const state = await uninstall();
   if (state.state !== "not-installed") {
@@ -36001,7 +36681,7 @@ async function runCompanionUninstallCommand(stdout, uninstall) {
 }
 var CompanionUninstallCommand = class extends M8tCommand {
   static paths = [["companion", "uninstall"]];
-  static usage = Command69.Usage({
+  static usage = Command70.Usage({
     description: "Remove only this user's desktop companion installation."
   });
   async executeCommand() {
@@ -36014,6 +36694,7 @@ var CompanionUninstallCommand = class extends M8tCommand {
 };
 
 // src/cli.ts
+installFoundryDnsShim();
 var cli = new Cli({
   binaryName: "m8t",
   binaryLabel: "m8t CLI \u2014 manage m8t deployments",
@@ -36063,6 +36744,7 @@ cli.register(PlatformRequestUpdateCommand);
 cli.register(PlatformSeedStampCommand);
 cli.register(PlatformPolicyCommand);
 cli.register(PlatformEnableCostReportCommand);
+cli.register(PlatformEmailCommand);
 cli.register(PlatformEnableAutoUpdateCommand);
 cli.register(DeployCommand);
 cli.register(AgentDeployAdvisorCommand);