@mutmutco/claude-plugin 4.5.158 → 4.5.160

package/cli/dist/main.cjs

@@ -589,6 +589,54 @@ var init_github_client = __esm({
   }
 });
 
+// src/gh-read-route.ts
+function isViewerFreeGhRead(args) {
+  if (args.some((a) => VIEWER.test(a))) return false;
+  const [group, verb] = args;
+  if (group === "api") return isReadOnlyApi(args.slice(1));
+  return Boolean(group && verb && READ_VERBS.get(group)?.has(verb));
+}
+function isReadOnlyApi(rest) {
+  let path2;
+  for (let i = 0; i < rest.length; i++) {
+    const a = rest[i];
+    if (a === "-X" || a === "--method") {
+      if ((rest[i + 1] ?? "").toUpperCase() !== "GET") return false;
+      i++;
+    } else if (/^--method=/.test(a)) {
+      if (a.slice(9).toUpperCase() !== "GET") return false;
+    } else if (a === "-f" || a === "-F" || a === "--field" || a === "--raw-field") {
+      const field = rest[i + 1] ?? "";
+      if (path2 !== "graphql" || !/^query=\s*(query\b|\{)/.test(field) || /projectV2|projectsV2/.test(field)) return false;
+      i++;
+    } else if (a === "--input" || a.startsWith("--input=")) {
+      return false;
+    } else if (a === "-H" || a === "--header" || a === "-q" || a === "--jq" || a === "-t" || a === "--template" || a === "--hostname" || a === "--cache") {
+      i++;
+    } else if (!a.startsWith("-") && path2 === void 0) {
+      path2 = a.replace(/^\//, "");
+    }
+  }
+  if (!path2) return false;
+  if (path2 === "graphql") return rest.some((a) => /^query=\s*(query\b|\{)/.test(a));
+  return !/^(user|users\/[^/]+\/|notifications|search\/|orgs\/[^/]+\/projectsV2|graphql)/.test(path2);
+}
+var READ_VERBS, VIEWER;
+var init_gh_read_route = __esm({
+  "src/gh-read-route.ts"() {
+    "use strict";
+    READ_VERBS = /* @__PURE__ */ new Map([
+      ["pr", /* @__PURE__ */ new Set(["view", "list", "checks", "diff"])],
+      ["issue", /* @__PURE__ */ new Set(["view", "list"])],
+      ["run", /* @__PURE__ */ new Set(["view", "list", "watch"])],
+      ["label", /* @__PURE__ */ new Set(["list"])],
+      ["release", /* @__PURE__ */ new Set(["view", "list"])],
+      ["repo", /* @__PURE__ */ new Set(["view"])]
+    ]);
+    VIEWER = /@me\b|viewer|project/i;
+  }
+});
+
 // src/github-quota.ts
 function hubQuotaResetWaitMs(resetAt, nowMs, capMs = RATE_LIMIT_WAIT_CAP_MS, jitterMs = 0) {
   if (typeof resetAt !== "string" || !resetAt) return void 0;
@@ -959,6 +1007,8 @@ var init_house_map = __esm({
       pr: "devops",
       read: "devops",
       // closed typed GitHub reads on the App pool (run/pr/issue broker, #8042)
+      github: "devops",
+      // personal and App allowance visibility
       api: "devops",
       // allowlisted GitHub REST GET reads for automation (pull files, compare, contents)
       ci: "devops",
@@ -1110,8 +1160,18 @@ __export(cli_shared_exports, {
   rawValue: () => rawValue,
   readStdin: () => readStdin,
   repoProject: () => repoProject,
+  setGhReadTokenProvider: () => setGhReadTokenProvider,
   setInjectedStdin: () => setInjectedStdin
 });
+function setGhReadTokenProvider(provider) {
+  ghReadTokenProvider = provider;
+}
+async function ghReadAppEnv(file, args) {
+  if (!ghReadTokenProvider || !/(^|[\\/])gh(\.exe)?$/i.test(file) || process.env.MMI_ACTOR?.trim() === "personal") return void 0;
+  if (!isViewerFreeGhRead(args)) return void 0;
+  const token = await ghReadTokenProvider().catch(() => void 0);
+  return token ? { ...process.env, GH_TOKEN: token } : void 0;
+}
 function killProcessTree(pid) {
   try {
     if (process.platform === "win32") {
@@ -1280,7 +1340,7 @@ function printLine(value) {
   (0, import_node_fs5.writeSync)(1, `${value}
 `);
 }
-var import_node_child_process2, import_node_fs5, import_node_util3, rawExecFileP, DEFAULT_EXEC_TIMEOUT_MS, execFileP, GIT_TIMEOUT_MS, ExecDeadlineError, cachedGithubLogin, gitOut, consoleIo;
+var import_node_child_process2, import_node_fs5, import_node_util3, rawExecFileP, DEFAULT_EXEC_TIMEOUT_MS, execFileP, ghReadTokenProvider, GIT_TIMEOUT_MS, ExecDeadlineError, cachedGithubLogin, gitOut, consoleIo;
 var init_cli_shared = __esm({
   "src/cli-shared.ts"() {
     "use strict";
@@ -1292,16 +1352,27 @@ var init_cli_shared = __esm({
     init_clean_exit();
     init_error_codes();
     init_github_client();
+    init_gh_read_route();
     init_hub_auth();
     init_house_map();
     init_stdin_inject();
     rawExecFileP = (0, import_node_util3.promisify)(import_node_child_process2.execFile);
     DEFAULT_EXEC_TIMEOUT_MS = 1e4;
-    execFileP = (file, args, options = {}) => (
-      // encoding 'utf8' guarantees string stdout/stderr at runtime; the cast pins the type because
-      // promisify(execFile)'s overloads widen to string|Buffer when options is spread in.
-      rawExecFileP(file, args, { encoding: "utf8", windowsHide: true, timeout: DEFAULT_EXEC_TIMEOUT_MS, killSignal: "SIGTERM", ...options })
-    );
+    execFileP = async (file, args, options = {}) => {
+      const run = (env) => (
+        // encoding 'utf8' guarantees string stdout/stderr at runtime; the cast pins the type because
+        // promisify(execFile)'s overloads widen to string|Buffer when options is spread in.
+        rawExecFileP(file, args, { encoding: "utf8", windowsHide: true, timeout: DEFAULT_EXEC_TIMEOUT_MS, killSignal: "SIGTERM", ...options, ...env ? { env } : {} })
+      );
+      const appEnv = options.env ? void 0 : await ghReadAppEnv(file, args);
+      if (!appEnv) return run();
+      try {
+        return await run(appEnv);
+      } catch (e) {
+        if (/Resource not accessible by integration/i.test(String(e.stderr ?? ""))) return run();
+        throw e;
+      }
+    };
     GIT_TIMEOUT_MS = DEFAULT_EXEC_TIMEOUT_MS;
     ExecDeadlineError = class extends Error {
       constructor(step, timeoutMs, elapsedMs, killed) {
@@ -4755,7 +4826,7 @@ function useColor() {
 var program = new Command();
 
 // src/command-composition.ts
-var import_node_fs58 = require("node:fs");
+var import_node_fs59 = require("node:fs");
 init_clean_exit();
 init_cli_shared();
 
@@ -6949,7 +7020,7 @@ var import_node_os25 = require("node:os");
 var import_node_path57 = require("node:path");
 
 // src/board-read.ts
-var import_node_fs16 = require("node:fs");
+var import_node_fs17 = require("node:fs");
 var import_node_os10 = require("node:os");
 var import_node_path14 = require("node:path");
 init_cli_shared();
@@ -7068,6 +7139,8 @@ var import_node_crypto5 = require("node:crypto");
 var APP_ACTOR_ENV = "MMI_ACTOR";
 var APP_VAULT_REPO = "mutmutco/MMI-Hub";
 var APP_VAULT_KEYS = ["GITHUB_APP_ID", "GITHUB_APP_INSTALLATION_ID", "GITHUB_APP_PRIVATE_KEY"];
+var APP2_VAULT_KEYS = ["GITHUB_APP2_ID", "GITHUB_APP2_INSTALLATION_ID", "GITHUB_APP2_PRIVATE_KEY"];
+var APP_POOL_MEMBERS = [APP_VAULT_KEYS, APP2_VAULT_KEYS];
 var APP_ELIGIBLE_COMMANDS = /* @__PURE__ */ new Set([
   "pr checks-wait",
   // #8042: App-native required-only read (`pr checks-required`) — REST check/status rows scoped by
@@ -7165,6 +7238,19 @@ async function readAppVaultSecret(read) {
 async function mintInstallationToken(deps) {
   return mintScopedInstallationToken(deps, APP_POLL_PERMISSIONS);
 }
+var APP_WRITE_COMMANDS = /* @__PURE__ */ new Map([
+  ["issue comment", { metadata: "read", issues: "write", pull_requests: "write" }]
+]);
+async function mintCommandWriteToken(deps, commandPath3) {
+  const permissions = APP_WRITE_COMMANDS.get(commandPath3);
+  if (!permissions) throw new AppActorError(`app actor: '${commandPath3}' has no App write profile`);
+  try {
+    return await mintFromMember(deps, permissions, APP_VAULT_KEYS);
+  } catch (e) {
+    if (e instanceof AppActorError) throw e;
+    throw new AppActorError(`app actor: write token mint failed (${e?.constructor?.name ?? "Error"})`);
+  }
+}
 async function mintStatusWriteToken(deps) {
   return mintScopedInstallationToken(deps, { metadata: "read", statuses: "write" });
 }
@@ -7184,10 +7270,55 @@ async function fleetStatusWriteEnv(args) {
   }
 }
 async function mintScopedInstallationToken(deps, permissions) {
-  const [appId, installationId, privateKey] = await Promise.all(APP_VAULT_KEYS.map((k) => deps.fetchSecret(k)));
+  const start = Math.floor((deps.random ?? Math.random)() * APP_POOL_MEMBERS.length) % APP_POOL_MEMBERS.length;
+  const order = APP_POOL_MEMBERS.map((_, i) => APP_POOL_MEMBERS[(start + i) % APP_POOL_MEMBERS.length]);
+  let firstError;
+  let exhausted;
+  let absent = 0;
+  for (const [i, keys] of order.entries()) {
+    try {
+      const minted = await mintFromMember(deps, permissions, keys);
+      if (i === order.length - 1 || !await allowanceSpent(deps, minted.token)) return minted;
+      exhausted ??= minted;
+    } catch (e) {
+      if (e instanceof AppActorError && e.code === "vault-denied") {
+        absent += 1;
+        continue;
+      }
+      firstError ??= e;
+    }
+  }
+  if (exhausted) return exhausted;
+  if (firstError) throw firstError;
+  if (absent === order.length) {
+    throw new AppActorError(
+      `app actor: vault denied all App credentials (${APP_VAULT_REPO} tier) \u2014 not an automation host, or no vault access`,
+      "vault-denied"
+    );
+  }
+  throw new AppActorError("app actor: no App pool member minted \u2014 automation fails closed");
+}
+async function allowanceSpent(deps, token) {
+  try {
+    const res = await deps.fetch("https://api.github.com/rate_limit", {
+      method: "GET",
+      headers: { authorization: `Bearer ${token}`, accept: "application/vnd.github+json", "user-agent": "mmi-cli-app-actor" }
+    });
+    if (!res.ok) return false;
+    const body = await res.json();
+    return body.resources?.core?.remaining === 0 || body.resources?.graphql?.remaining === 0;
+  } catch {
+    return false;
+  }
+}
+function mintBudgetToken(deps, keys) {
+  return mintFromMember(deps, { metadata: "read" }, keys);
+}
+async function mintFromMember(deps, permissions, keys) {
+  const [appId, installationId, privateKey] = await Promise.all(keys.map((k) => deps.fetchSecret(k)));
   if (!appId || !installationId || !privateKey) {
-    const missing = APP_VAULT_KEYS.filter((_, i) => ![appId, installationId, privateKey][i]);
-    if (missing.length === APP_VAULT_KEYS.length) {
+    const missing = keys.filter((_, i) => ![appId, installationId, privateKey][i]);
+    if (missing.length === keys.length) {
       throw new AppActorError(
         `app actor: vault denied all App credentials (${APP_VAULT_REPO} tier) \u2014 not an automation host, or no vault access`,
         "vault-denied"
@@ -7250,7 +7381,7 @@ async function activateAppActor(commandPath3, env, mint, note = (line) => proces
   if (requested && requested !== "app") {
     throw new AppActorError(`app actor: unknown ${APP_ACTOR_ENV} value \u2014 only 'app' and 'personal' are supported; refusing to guess an identity`);
   }
-  if (!APP_ELIGIBLE_COMMANDS.has(commandPath3)) {
+  if (!APP_ELIGIBLE_COMMANDS.has(commandPath3) && !APP_WRITE_COMMANDS.has(commandPath3)) {
     if (requested === "app" && !notedIneligibleCommand) {
       notedIneligibleCommand = true;
       note(`app actor: '${commandPath3}' is personal-only (viewer/@me/authorship) \u2014 running on the personal token despite ${APP_ACTOR_ENV}=app`);
@@ -11257,6 +11388,7 @@ init_clean_exit();
 
 // src/gh-create.ts
 var import_promises = require("node:fs/promises");
+var import_node_fs16 = require("node:fs");
 var import_node_os8 = require("node:os");
 var import_node_path13 = require("node:path");
 var import_node_crypto7 = require("node:crypto");
@@ -11522,18 +11654,23 @@ async function preflightPrCreateRemoteHead(args, deps) {
   if (compared !== "unknown" && compared.aheadBy <= 0) return emptyCompareMessage(base, head);
   return void 0;
 }
+function retryBodyFile(args) {
+  const file = flagValue(args, "--body-file");
+  if (file !== void 0) return file;
+  const body = flagValue(args, "--body");
+  if (body === void 0) return void 0;
+  const path2 = (0, import_node_path13.join)((0, import_node_fs16.mkdtempSync)((0, import_node_path13.join)((0, import_node_os8.tmpdir)(), "mmi-create-retry-")), "body.md");
+  (0, import_node_fs16.writeFileSync)(path2, body, "utf8");
+  return path2;
+}
 function buildPrCreateRetryCommand(args) {
   const parts = ["mmi-cli", "devops", "pr", "create"];
   for (const flag of ["--repo", "--base", "--head", "--title"]) {
     const v = flagValue(args, flag);
     if (v !== void 0) parts.push(flag, shellQuote(v));
   }
-  const bodyFile = flagValue(args, "--body-file");
+  const bodyFile = retryBodyFile(args);
   if (bodyFile !== void 0) parts.push("--body-file", shellQuote(bodyFile));
-  else {
-    const body = flagValue(args, "--body");
-    if (body !== void 0) parts.push("--body", shellQuote(body));
-  }
   if (args.includes("--draft")) parts.push("--draft");
   return parts.join(" ");
 }
@@ -11556,12 +11693,8 @@ function buildIssueCreateRetryCommand(args) {
   if (type) parts.push("--type", type);
   const title = flagValue(args, "--title");
   if (title !== void 0) parts.push("--title", shellQuote(title));
-  const bodyFile = flagValue(args, "--body-file");
+  const bodyFile = retryBodyFile(args);
   if (bodyFile !== void 0) parts.push("--body-file", shellQuote(bodyFile));
-  else {
-    const body = flagValue(args, "--body");
-    if (body !== void 0) parts.push("--body", shellQuote(body));
-  }
   for (const label of labels) {
     if (label === type) continue;
     parts.push("--label", shellQuote(label));
@@ -14518,11 +14651,11 @@ function probeLocalClaimSession(marker, now = Date.now()) {
     const pending = [root];
     while (pending.length) {
       const dir = pending.pop();
-      for (const entry of (0, import_node_fs16.readdirSync)(dir, { withFileTypes: true })) {
+      for (const entry of (0, import_node_fs17.readdirSync)(dir, { withFileTypes: true })) {
         const path2 = (0, import_node_path14.join)(dir, entry.name);
         if (entry.isDirectory()) pending.push(path2);
         else if (entry.isFile() && entry.name.toLowerCase() === wanted) {
-          return remember(now - (0, import_node_fs16.statSync)(path2).mtimeMs <= CLAIM_SESSION_ACTIVITY_MS ? "live" : "dead");
+          return remember(now - (0, import_node_fs17.statSync)(path2).mtimeMs <= CLAIM_SESSION_ACTIVITY_MS ? "live" : "dead");
         }
       }
     }
@@ -16027,12 +16160,12 @@ function planManagedGitignore(current) {
 }
 
 // src/docs-index-command.ts
-var import_node_fs18 = require("node:fs");
+var import_node_fs19 = require("node:fs");
 var import_node_path16 = require("node:path");
 
 // src/doc-refs-core.ts
 var import_node_child_process6 = require("node:child_process");
-var import_node_fs17 = require("node:fs");
+var import_node_fs18 = require("node:fs");
 var import_node_path15 = require("node:path");
 var PIN_RE = /<!--\s*pinned by\s+([^:]+?)\s*:\s*"([^"]+)"[^"]*-->/;
 var PIN_MENTION_RE = /<!--\s*pinned by\b/;
@@ -16405,12 +16538,12 @@ function checkSeedRunbookReview(root, base, readFile10, git3) {
   return findings;
 }
 function readFileOrNull(path2) {
-  return (0, import_node_fs17.existsSync)(path2) ? (0, import_node_fs17.readFileSync)(path2, "utf8") : null;
+  return (0, import_node_fs18.existsSync)(path2) ? (0, import_node_fs18.readFileSync)(path2, "utf8") : null;
 }
 function walk(dir, root, out) {
-  for (const entry of (0, import_node_fs17.readdirSync)(dir)) {
+  for (const entry of (0, import_node_fs18.readdirSync)(dir)) {
     const full = (0, import_node_path15.join)(dir, entry);
-    if ((0, import_node_fs17.statSync)(full).isDirectory()) walk(full, root, out);
+    if ((0, import_node_fs18.statSync)(full).isDirectory()) walk(full, root, out);
     else if (entry.endsWith(".md")) out.push(full.slice(root.length + 1).replaceAll("\\", "/"));
   }
   return out;
@@ -16418,11 +16551,11 @@ function walk(dir, root, out) {
 function defaultListDocs(root) {
   const docs = ["docs", "skills/org-guide", "skills/mmi-help"].flatMap((path2) => {
     const directory = (0, import_node_path15.join)(root, path2);
-    return (0, import_node_fs17.existsSync)(directory) ? walk(directory, root, []) : [];
+    return (0, import_node_fs18.existsSync)(directory) ? walk(directory, root, []) : [];
   }).filter(
     (rel) => !SKIP_WALK.some((skip) => rel.startsWith(skip))
   );
-  return [...ROOT_DOCS.filter((rel) => (0, import_node_fs17.existsSync)((0, import_node_path15.join)(root, rel))), ...docs];
+  return [...ROOT_DOCS.filter((rel) => (0, import_node_fs18.existsSync)((0, import_node_path15.join)(root, rel))), ...docs];
 }
 var CHECK_IGNORE_MAX_BUFFER = 32 * 1024 * 1024;
 function defaultIsIgnored(root, relPaths, exec3 = import_node_child_process6.execFileSync) {
@@ -16503,7 +16636,7 @@ function mergeGroupRunbookMessages(root, deps, readFile10, warnings) {
 }
 function runDocRefs(root, deps = {}) {
   const readFile10 = deps.readFile ?? readFileOrNull;
-  const exists = deps.exists ?? import_node_fs17.existsSync;
+  const exists = deps.exists ?? import_node_fs18.existsSync;
   const listDocs = deps.listDocs ?? defaultListDocs;
   const isIgnored = deps.isIgnored ?? ((paths) => defaultIsIgnored(root, paths));
   const trackedFirstSegments = deps.trackedFirstSegments ?? ((segs) => defaultTrackedFirstSegments(root, segs));
@@ -16636,7 +16769,7 @@ function walkMarkdown(dir) {
   const stack = [dir];
   while (stack.length) {
     const current = stack.pop();
-    for (const entry of (0, import_node_fs18.readdirSync)(current, { withFileTypes: true })) {
+    for (const entry of (0, import_node_fs19.readdirSync)(current, { withFileTypes: true })) {
       const full = (0, import_node_path16.join)(current, entry.name);
       if (entry.isDirectory()) {
         stack.push(full);
@@ -16652,15 +16785,15 @@ function createDocsIndexDeps(repoRoot2) {
   const indexPath = (0, import_node_path16.join)(repoRoot2, DOCS_INDEX_PATH);
   return {
     listDocs: () => {
-      if (!(0, import_node_fs18.existsSync)(docsDir)) return [];
+      if (!(0, import_node_fs19.existsSync)(docsDir)) return [];
       const walked = walkMarkdown(docsDir).filter(isRoutableDocsPath);
       if (!walked.length) return [];
       const ignored = defaultIsIgnored(repoRoot2, walked.map((rel) => `docs/${rel}`));
       return walked.filter((rel) => !ignored.has(`docs/${rel}`)).sort();
     },
-    readDoc: (relPath) => (0, import_node_fs18.readFileSync)((0, import_node_path16.join)(docsDir, relPath), "utf8"),
-    readIndex: () => (0, import_node_fs18.existsSync)(indexPath) ? (0, import_node_fs18.readFileSync)(indexPath, "utf8") : null,
-    writeIndex: (content) => (0, import_node_fs18.writeFileSync)(indexPath, content, "utf8")
+    readDoc: (relPath) => (0, import_node_fs19.readFileSync)((0, import_node_path16.join)(docsDir, relPath), "utf8"),
+    readIndex: () => (0, import_node_fs19.existsSync)(indexPath) ? (0, import_node_fs19.readFileSync)(indexPath, "utf8") : null,
+    writeIndex: (content) => (0, import_node_fs19.writeFileSync)(indexPath, content, "utf8")
   };
 }
 
@@ -17579,7 +17712,7 @@ function contentPutInputArgs(repo, path2, inputFile) {
 }
 
 // src/train-apply-contracts.ts
-var import_node_fs19 = require("node:fs");
+var import_node_fs20 = require("node:fs");
 var import_node_path17 = require("node:path");
 function reduceFollowUpOutcomes(outcomes) {
   if (outcomes.includes("failure")) return "failure";
@@ -17660,7 +17793,7 @@ async function resolveFoldPaths(deps, model) {
   if (model === "vercel") return [];
   const helper = "scripts/release-distribution.mjs";
   if (model === "hub-serverless" || model === "registry-publish") {
-    if ((0, import_node_fs19.existsSync)(helper)) {
+    if ((0, import_node_fs20.existsSync)(helper)) {
       let out;
       try {
         out = await deps.run("node", [helper, "changed-files"]);
@@ -17809,7 +17942,7 @@ async function restoreMainNpmPackIdentities(deps, version) {
   if (mainBom.version !== version) return void 0;
   let localBom;
   try {
-    localBom = JSON.parse((0, import_node_fs19.readFileSync)(bomPath, "utf8"));
+    localBom = JSON.parse((0, import_node_fs20.readFileSync)(bomPath, "utf8"));
   } catch (e) {
     throw new Error(
       `version fold refused: ${bomPath} written by this fold's prepare is unreadable (${describeReadError(e)}) \u2014 cannot restore the published ${version} npm-pack identities from origin/main (#4503/#4713).`
@@ -17827,14 +17960,14 @@ async function restoreMainNpmPackIdentities(deps, version) {
     restored += 1;
   }
   if (restored === 0) return void 0;
-  (0, import_node_fs19.writeFileSync)(bomPath, `${JSON.stringify(localBom, null, 2)}
+  (0, import_node_fs20.writeFileSync)(bomPath, `${JSON.stringify(localBom, null, 2)}
 `);
   return `restored ${restored} npm-pack BOM identit${restored === 1 ? "y" : "ies"} from origin/main (#4503)`;
 }
 function publishVisibilityFor(surfaceId) {
   let raw;
   try {
-    raw = (0, import_node_fs19.readFileSync)("surfaces.json", "utf8");
+    raw = (0, import_node_fs20.readFileSync)("surfaces.json", "utf8");
   } catch (e) {
     if (e.code === "ENOENT") return "unknown";
     throw trainReadFailure(
@@ -17855,7 +17988,7 @@ function publishVisibilityFor(surfaceId) {
 }
 function npmPackArtifactName(packagePath) {
   try {
-    const pkg = JSON.parse((0, import_node_fs19.readFileSync)((0, import_node_path17.join)(packagePath, "package.json"), "utf8"));
+    const pkg = JSON.parse((0, import_node_fs20.readFileSync)((0, import_node_path17.join)(packagePath, "package.json"), "utf8"));
     return pkg.name || void 0;
   } catch {
     return void 0;
@@ -17864,7 +17997,7 @@ function npmPackArtifactName(packagePath) {
 async function refuseDivergentPublishedNpmPack(deps, version) {
   let localBom;
   try {
-    localBom = JSON.parse((0, import_node_fs19.readFileSync)("distribution-bom.json", "utf8"));
+    localBom = JSON.parse((0, import_node_fs20.readFileSync)("distribution-bom.json", "utf8"));
   } catch (e) {
     throw new Error(
       `version fold refused: distribution-bom.json written by this fold's prepare is unreadable (${e instanceof Error ? e.message.split("\n")[0] : String(e)}) \u2014 cannot compare the same-PATCH ${version} npm-pack identities against published npm (#4503/#4662).`
@@ -18009,7 +18142,7 @@ function assertGitBashOnWindowsForJervHubRelease(repo, platform2 = process.platf
 }
 
 // src/train-apply-correlation.ts
-var import_node_fs21 = require("node:fs");
+var import_node_fs22 = require("node:fs");
 init_github_quota();
 var import_node_path19 = require("node:path");
 
@@ -18776,10 +18909,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.5.158",
-    tag: "v4.5.158",
-    commit: "21733e84802e",
-    npm: "@mutmutco/cli@4.5.158"
+    version: "4.5.160",
+    tag: "v4.5.160",
+    commit: "05c3cc8d56ee",
+    npm: "@mutmutco/cli@4.5.160"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -18796,14 +18929,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.5.158"
+          v3Target: "v4.5.160"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.5.158 and redeploy the Hub Lambda from tag v4.5.158 (21733e84802e); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.5.158 (@mutmutco/cli@4.5.158, tag commit 21733e84802e \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.5.160 and redeploy the Hub Lambda from tag v4.5.160 (05c3cc8d56ee); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.5.160 (@mutmutco/cli@4.5.160, tag commit 05c3cc8d56ee \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -19137,13 +19270,13 @@ function resolveIssueViewGhFields(normalized) {
 }
 
 // src/utf8-receipt.ts
-var import_node_fs20 = require("node:fs");
+var import_node_fs21 = require("node:fs");
 var import_node_path18 = require("node:path");
 function writeUtf8Receipt(path2, text) {
-  (0, import_node_fs20.mkdirSync)((0, import_node_path18.dirname)(path2), { recursive: true });
+  (0, import_node_fs21.mkdirSync)((0, import_node_path18.dirname)(path2), { recursive: true });
   const body = text.endsWith("\n") ? text : `${text}
 `;
-  (0, import_node_fs20.writeFileSync)(path2, body, "utf8");
+  (0, import_node_fs21.writeFileSync)(path2, body, "utf8");
   return Buffer.byteLength(body, "utf8");
 }
 
@@ -21029,7 +21162,7 @@ function resolveReleaseAbortNpmPackage(meta, repo) {
   if (isHubControlRepo(repo)) return "@mutmutco/cli";
   const publishDir = typeof meta.publishDir === "string" && meta.publishDir.trim() ? meta.publishDir.trim() : ".";
   try {
-    const pkg = JSON.parse((0, import_node_fs21.readFileSync)((0, import_node_path19.join)(publishDir, "package.json"), "utf8"));
+    const pkg = JSON.parse((0, import_node_fs22.readFileSync)((0, import_node_path19.join)(publishDir, "package.json"), "utf8"));
     const name = pkg.name?.trim();
     if (!name) throw new Error("missing name field");
     return name;
@@ -21965,7 +22098,7 @@ function parseVerifyBroker(stdout) {
 }
 
 // src/train-apply-deploy.ts
-var import_node_fs22 = require("node:fs");
+var import_node_fs23 = require("node:fs");
 var import_node_os11 = require("node:os");
 var import_node_path20 = require("node:path");
 
@@ -22106,7 +22239,7 @@ function mmiGetRedeployCommand(repo) {
 }
 function readLocalLauncherVersion(root = process.cwd()) {
   try {
-    const raw = (0, import_node_fs22.readFileSync)((0, import_node_path20.join)(root, "cli", "package.json"), "utf8");
+    const raw = (0, import_node_fs23.readFileSync)((0, import_node_path20.join)(root, "cli", "package.json"), "utf8");
     const version = JSON.parse(raw).version;
     return typeof version === "string" && version.trim() ? version.trim() : null;
   } catch {
@@ -22115,7 +22248,7 @@ function readLocalLauncherVersion(root = process.cwd()) {
 }
 function readServedChannelUrl(product = HUB_SERVED_PRODUCT, root = process.cwd()) {
   try {
-    const raw = (0, import_node_fs22.readFileSync)((0, import_node_path20.join)(root, "config", `product.${product}.json`), "utf8");
+    const raw = (0, import_node_fs23.readFileSync)((0, import_node_path20.join)(root, "config", `product.${product}.json`), "utf8");
     const host = JSON.parse(raw).host;
     if (typeof host !== "string" || !host.trim()) return null;
     return `${host.trim().replace(/\/+$/, "")}/release/version`;
@@ -22549,13 +22682,13 @@ async function runTaggedJervGatewayLocalWrapper(deps, tag, tagSha) {
     const reason = error instanceof Error ? error.message : String(error);
     throw new Error(`could not extract ${JERV_GATEWAY_RELEASE_DEPLOY_SCRIPT} from tagged commit ${tagSha.slice(0, 12)}: ${reason}`);
   }
-  const dir = (0, import_node_fs22.mkdtempSync)((0, import_node_path20.join)((0, import_node_os11.tmpdir)(), "jerv-gateway-release-deploy-"));
+  const dir = (0, import_node_fs23.mkdtempSync)((0, import_node_path20.join)((0, import_node_os11.tmpdir)(), "jerv-gateway-release-deploy-"));
   const extracted = (0, import_node_path20.join)(dir, "jerv-gateway-release-deploy.sh");
   try {
-    (0, import_node_fs22.writeFileSync)(extracted, script, "utf8");
+    (0, import_node_fs23.writeFileSync)(extracted, script, "utf8");
     return await deps.run("bash", [extracted, "--tag", tag]);
   } finally {
-    (0, import_node_fs22.rmSync)(dir, { recursive: true, force: true });
+    (0, import_node_fs23.rmSync)(dir, { recursive: true, force: true });
   }
 }
 async function appendJervGatewayReleaseDeploy(deps, repo, tag, tagSha, dispatch) {
@@ -23131,7 +23264,7 @@ function renderTenantControl(r) {
 }
 
 // src/train-apply-phases.ts
-var import_node_fs28 = require("node:fs");
+var import_node_fs29 = require("node:fs");
 var import_promises4 = require("node:fs/promises");
 var import_node_path27 = require("node:path");
 
@@ -23450,12 +23583,12 @@ function assertPreOneZero(repo, meta, tag) {
 
 // src/train-doctor.ts
 var import_node_child_process9 = require("node:child_process");
-var import_node_fs26 = require("node:fs");
+var import_node_fs27 = require("node:fs");
 var import_node_os15 = require("node:os");
 var import_node_path26 = require("node:path");
 
 // src/doctor-io.ts
-var import_node_fs23 = require("node:fs");
+var import_node_fs24 = require("node:fs");
 var import_node_os12 = require("node:os");
 var import_node_path21 = require("node:path");
 var import_node_child_process7 = require("node:child_process");
@@ -23470,8 +23603,8 @@ function nodeDiscardSinkPath(platform2 = process.platform) {
 var execFileP2 = (0, import_node_util4.promisify)(import_node_child_process7.execFile);
 function execFileCapture(file, args, opts = {}) {
   const sink = nodeDiscardSinkPath();
-  const inFd = (0, import_node_fs23.openSync)(sink, "r");
-  const errFd = (0, import_node_fs23.openSync)(sink, "w");
+  const inFd = (0, import_node_fs24.openSync)(sink, "r");
+  const errFd = (0, import_node_fs24.openSync)(sink, "w");
   try {
     return (0, import_node_child_process7.execFileSync)(file, args, {
       ...opts,
@@ -23479,17 +23612,17 @@ function execFileCapture(file, args, opts = {}) {
       stdio: [inFd, "pipe", errFd]
     });
   } finally {
-    (0, import_node_fs23.closeSync)(inFd);
-    (0, import_node_fs23.closeSync)(errFd);
+    (0, import_node_fs24.closeSync)(inFd);
+    (0, import_node_fs24.closeSync)(errFd);
   }
 }
 var MMI_PLUGIN_ID2 = "mmi@mutmutco";
 function stagedClaudePluginVersion() {
   try {
     const stagingRoot = (0, import_node_path21.join)((0, import_node_os12.homedir)(), ".claude", "plugins", "staging");
-    const record = JSON.parse((0, import_node_fs23.readFileSync)((0, import_node_path21.join)(stagingRoot, "launch-target.json"), "utf8"));
+    const record = JSON.parse((0, import_node_fs24.readFileSync)((0, import_node_path21.join)(stagingRoot, "launch-target.json"), "utf8"));
     if (typeof record.target !== "string" || typeof record.incoming !== "string") return void 0;
-    const manifest = JSON.parse((0, import_node_fs23.readFileSync)((0, import_node_path21.join)(record.incoming, ".claude-plugin", "plugin.json"), "utf8"));
+    const manifest = JSON.parse((0, import_node_fs24.readFileSync)((0, import_node_path21.join)(record.incoming, ".claude-plugin", "plugin.json"), "utf8"));
     if (typeof manifest.version !== "string") return void 0;
     return manifest.version === record.target ? record.target : void 0;
   } catch {
@@ -23499,7 +23632,7 @@ function stagedClaudePluginVersion() {
 function installedClaudePluginVersion() {
   try {
     const file = JSON.parse(
-      (0, import_node_fs23.readFileSync)((0, import_node_path21.join)((0, import_node_os12.homedir)(), ".claude", "plugins", "installed_plugins.json"), "utf8")
+      (0, import_node_fs24.readFileSync)((0, import_node_path21.join)((0, import_node_os12.homedir)(), ".claude", "plugins", "installed_plugins.json"), "utf8")
     );
     const versions = (file.plugins?.[MMI_PLUGIN_ID2] ?? []).map((r) => r.version).filter((v) => Boolean(v));
     if (versions.length === 0) return void 0;
@@ -23511,12 +23644,12 @@ function installedClaudePluginVersion() {
 function readHermesPluginEvidence(env = process.env) {
   const host = hermesConfigRoot(env);
   const root = hermesPluginRoot(env);
-  const installRecordPresent = (0, import_node_fs23.existsSync)(root);
+  const installRecordPresent = (0, import_node_fs24.existsSync)(root);
   const manifestPath = (0, import_node_path21.join)(root, "plugin.yaml");
   let installedVersion;
   let manifest = "missing";
   try {
-    const text = (0, import_node_fs23.readFileSync)(manifestPath, "utf8");
+    const text = (0, import_node_fs24.readFileSync)(manifestPath, "utf8");
     let version;
     try {
       const parsed = JSON.parse(text).version;
@@ -23530,25 +23663,25 @@ function readHermesPluginEvidence(env = process.env) {
     if (version) {
       installedVersion = version;
       manifest = "valid";
-    } else if ((0, import_node_fs23.existsSync)(manifestPath)) manifest = "invalid";
+    } else if ((0, import_node_fs24.existsSync)(manifestPath)) manifest = "invalid";
   } catch {
-    if ((0, import_node_fs23.existsSync)(manifestPath)) manifest = "invalid";
+    if ((0, import_node_fs24.existsSync)(manifestPath)) manifest = "invalid";
   }
   let skills = false;
   try {
-    skills = (0, import_node_fs23.existsSync)((0, import_node_path21.join)(root, "skills")) && (0, import_node_fs23.statSync)((0, import_node_path21.join)(root, "skills")).isDirectory();
+    skills = (0, import_node_fs24.existsSync)((0, import_node_path21.join)(root, "skills")) && (0, import_node_fs24.statSync)((0, import_node_path21.join)(root, "skills")).isDirectory();
   } catch {
   }
   let provisioned = false;
   const provisionedRoot = (0, import_node_path21.join)(host, "skills", "mmi");
   try {
-    provisioned = (0, import_node_fs23.existsSync)(provisionedRoot) && (0, import_node_fs23.statSync)(provisionedRoot).isDirectory();
+    provisioned = (0, import_node_fs24.existsSync)(provisionedRoot) && (0, import_node_fs24.statSync)(provisionedRoot).isDirectory();
   } catch {
   }
-  const treeOk = (0, import_node_fs23.existsSync)((0, import_node_path21.join)(root, "__init__.py")) && skills && manifest === "valid";
+  const treeOk = (0, import_node_fs24.existsSync)((0, import_node_path21.join)(root, "__init__.py")) && skills && manifest === "valid";
   const receipt = treeOk && !provisioned ? `hermes-skills-unprovisioned:${provisionedRoot}` : void 0;
   return {
-    hostPresent: (0, import_node_fs23.existsSync)(host),
+    hostPresent: (0, import_node_fs24.existsSync)(host),
     installRecordPresent,
     manifest,
     payloadPresent: treeOk && provisioned,
@@ -23600,7 +23733,7 @@ function readGitignore() {
   const path2 = gitignorePath();
   if (path2 === null) return null;
   try {
-    return (0, import_node_fs23.readFileSync)(path2, "utf8");
+    return (0, import_node_fs24.readFileSync)(path2, "utf8");
   } catch {
     return null;
   }
@@ -23609,14 +23742,14 @@ function writeGitignore(content) {
   const path2 = gitignorePath();
   if (path2 === null) return false;
   try {
-    (0, import_node_fs23.writeFileSync)(path2, content, "utf8");
+    (0, import_node_fs24.writeFileSync)(path2, content, "utf8");
     return true;
   } catch {
     return false;
   }
 }
 function lineEndingState(root) {
-  const attributesPresent = (0, import_node_fs23.existsSync)((0, import_node_path21.join)(root, ".gitattributes"));
+  const attributesPresent = (0, import_node_fs24.existsSync)((0, import_node_path21.join)(root, ".gitattributes"));
   try {
     const output = execFileCapture("git", ["-C", root, "ls-files", "--eol", "--", ":(glob)**/*.sh"], {
       windowsHide: true
@@ -23659,7 +23792,7 @@ function compatHolds(range, version) {
 }
 
 // src/claude-binary-doctor.ts
-var import_node_fs24 = require("node:fs");
+var import_node_fs25 = require("node:fs");
 var import_node_os14 = require("node:os");
 var import_node_path23 = require("node:path");
 
@@ -23769,16 +23902,16 @@ function globalNodeModulesRoots(host) {
 function readHead(path2) {
   let fd;
   try {
-    fd = (0, import_node_fs24.openSync)(path2, "r");
+    fd = (0, import_node_fs25.openSync)(path2, "r");
     const buffer = new Uint8Array(MAGIC_HEAD_BYTES);
-    const read = (0, import_node_fs24.readSync)(fd, buffer, 0, MAGIC_HEAD_BYTES, 0);
+    const read = (0, import_node_fs25.readSync)(fd, buffer, 0, MAGIC_HEAD_BYTES, 0);
     return buffer.subarray(0, read);
   } catch {
     return void 0;
   } finally {
     if (fd !== void 0) {
       try {
-        (0, import_node_fs24.closeSync)(fd);
+        (0, import_node_fs25.closeSync)(fd);
       } catch {
       }
     }
@@ -23786,7 +23919,7 @@ function readHead(path2) {
 }
 function fileBytes(path2) {
   try {
-    return (0, import_node_fs24.statSync)(path2).size;
+    return (0, import_node_fs25.statSync)(path2).size;
   } catch {
     return void 0;
   }
@@ -23800,13 +23933,13 @@ function readClaudeBinaryState(host = {}) {
   const arch = host.arch ?? process.arch;
   const magic = EXECUTABLE_MAGIC[platform2];
   if (!magic) return void 0;
-  const packageRoot = globalNodeModulesRoots(host).map((root) => (0, import_node_path23.join)(root, ...PACKAGE.split("/"))).find((dir) => (0, import_node_fs24.existsSync)((0, import_node_path23.join)(dir, "package.json")));
+  const packageRoot = globalNodeModulesRoots(host).map((root) => (0, import_node_path23.join)(root, ...PACKAGE.split("/"))).find((dir) => (0, import_node_fs25.existsSync)((0, import_node_path23.join)(dir, "package.json")));
   if (!packageRoot) return void 0;
   const keys = platformPackageKeys(platform2, arch);
   const fallbackPackage = `${PACKAGE}-${keys[0]}`;
   let manifest;
   try {
-    manifest = JSON.parse((0, import_node_fs24.readFileSync)((0, import_node_path23.join)(packageRoot, "package.json"), "utf8"));
+    manifest = JSON.parse((0, import_node_fs25.readFileSync)((0, import_node_path23.join)(packageRoot, "package.json"), "utf8"));
   } catch (e) {
     return {
       state: "unreadable",
@@ -23837,7 +23970,7 @@ function readClaudeBinaryState(host = {}) {
     (0, import_node_path23.join)(packageRoot, "node_modules", ...name.split("/"), binName),
     (0, import_node_path23.join)((0, import_node_path23.dirname)((0, import_node_path23.dirname)(packageRoot)), ...name.split("/"), binName)
   ];
-  const found = published.map((name) => ({ name, path: binIn(name).find((file) => (0, import_node_fs24.existsSync)(file)) })).find((c) => c.path);
+  const found = published.map((name) => ({ name, path: binIn(name).find((file) => (0, import_node_fs25.existsSync)(file)) })).find((c) => c.path);
   const platformPackage = found?.name ?? published[0];
   let source;
   let sourceProblem;
@@ -23848,7 +23981,7 @@ function readClaudeBinaryState(host = {}) {
   } else {
     source = { path: found.path, bytes: fileBytes(found.path) ?? 0 };
   }
-  if (!(0, import_node_fs24.existsSync)(binPath)) {
+  if (!(0, import_node_fs25.existsSync)(binPath)) {
     return { state: "missing", binPath, expectedMagic: magic.name, platformPackage, ...source ? { source } : {}, ...sourceProblem ? { sourceProblem } : {} };
   }
   const head = readHead(binPath);
@@ -23891,9 +24024,9 @@ function healClaudeBinary(host = {}, onStep) {
   const platform2 = host.platform ?? process.platform;
   const aside = `${probe.binPath}.stub-${Date.now()}`;
   let renamed = false;
-  if ((0, import_node_fs24.existsSync)(probe.binPath)) {
+  if ((0, import_node_fs25.existsSync)(probe.binPath)) {
     try {
-      (0, import_node_fs24.renameSync)(probe.binPath, aside);
+      (0, import_node_fs25.renameSync)(probe.binPath, aside);
       renamed = true;
       onStep?.(`renamed the stub aside: ${aside}`);
     } catch (e) {
@@ -23902,12 +24035,12 @@ function healClaudeBinary(host = {}, onStep) {
   }
   try {
     onStep?.(`copying ${probe.source.path} \u2192 ${probe.binPath} (${(probe.source.bytes / 1e6).toFixed(0)} MB)`);
-    (0, import_node_fs24.copyFileSync)(probe.source.path, probe.binPath);
-    if (platform2 !== "win32") (0, import_node_fs24.chmodSync)(probe.binPath, 493);
+    (0, import_node_fs25.copyFileSync)(probe.source.path, probe.binPath);
+    if (platform2 !== "win32") (0, import_node_fs25.chmodSync)(probe.binPath, 493);
   } catch (e) {
     if (renamed) {
       try {
-        (0, import_node_fs24.renameSync)(aside, probe.binPath);
+        (0, import_node_fs25.renameSync)(aside, probe.binPath);
       } catch {
         return { ok: false, detail: `copy failed (${e.message}) and the stub could not be restored \u2014 the original is at ${aside}` };
       }
@@ -23921,7 +24054,7 @@ function healClaudeBinary(host = {}, onStep) {
   let kept = false;
   if (renamed) {
     try {
-      (0, import_node_fs24.rmSync)(aside);
+      (0, import_node_fs25.rmSync)(aside);
     } catch {
       kept = true;
     }
@@ -24280,7 +24413,7 @@ function checkLineEndings(probe) {
 }
 
 // src/release-ledger.ts
-var import_node_fs25 = require("node:fs");
+var import_node_fs26 = require("node:fs");
 var import_node_path25 = require("node:path");
 var import_node_crypto9 = require("node:crypto");
 
@@ -24455,8 +24588,8 @@ function attachOutputNote(note, suffix) {
 }
 function writeFailingLegOutput(artifactPath, output) {
   const fileLines = lastNonEmptyLines(output, LEDGER_OUTPUT_FILE_LINES);
-  (0, import_node_fs25.mkdirSync)((0, import_node_path25.dirname)(artifactPath), { recursive: true });
-  (0, import_node_fs25.writeFileSync)(artifactPath, `${fileLines.join("\n")}
+  (0, import_node_fs26.mkdirSync)((0, import_node_path25.dirname)(artifactPath), { recursive: true });
+  (0, import_node_fs26.writeFileSync)(artifactPath, `${fileLines.join("\n")}
 `, "utf8");
   const tail = fileLines.slice(-LEDGER_OUTPUT_NOTE_LINES).join("\n");
   const noteSuffix = truncate(`failing-leg output: ${artifactPath}
@@ -24624,7 +24757,7 @@ function resolvePrimaryGitDir(cwd) {
   }
   let common;
   try {
-    common = (0, import_node_fs25.readFileSync)((0, import_node_path25.join)(gitDir, "commondir"), "utf8").trim();
+    common = (0, import_node_fs26.readFileSync)((0, import_node_path25.join)(gitDir, "commondir"), "utf8").trim();
   } catch (e) {
     if (e.code !== "ENOENT") {
       throw new ReleaseLedgerError("unreadable", `release ledger: the worktree gitdir's commondir pointer could not be READ (${e instanceof Error ? e.message : String(e)}) \u2014 a failed read is unverified, not primary (#5987/#4713)`);
@@ -24633,7 +24766,7 @@ function resolvePrimaryGitDir(cwd) {
   if (!common) return gitDir;
   const commonDir = (0, import_node_path25.isAbsolute)(common) ? common : (0, import_node_path25.resolve)(gitDir, common);
   try {
-    (0, import_node_fs25.readFileSync)((0, import_node_path25.join)(commonDir, "HEAD"), "utf8");
+    (0, import_node_fs26.readFileSync)((0, import_node_path25.join)(commonDir, "HEAD"), "utf8");
   } catch (e) {
     throw new ReleaseLedgerError("no-checkout", `release ledger: the worktree's commondir pointer names ${commonDir}, which has no readable HEAD (${e instanceof Error ? e.message : String(e)}) \u2014 the primary checkout may have been removed; refusing to write the ledger into a doomed location`);
   }
@@ -24643,11 +24776,11 @@ function releaseLedgerPath(cwd) {
   return (0, import_node_path25.join)(resolvePrimaryGitDir(cwd), "mmi-runtime", "release", "phases.json");
 }
 function atomicWriteJson(path2, ledger) {
-  (0, import_node_fs25.mkdirSync)((0, import_node_path25.dirname)(path2), { recursive: true });
+  (0, import_node_fs26.mkdirSync)((0, import_node_path25.dirname)(path2), { recursive: true });
   const tmp = `${path2}.tmp-${process.pid}-${(0, import_node_crypto9.randomBytes)(4).toString("hex")}`;
-  (0, import_node_fs25.writeFileSync)(tmp, `${JSON.stringify(ledger, null, 2)}
+  (0, import_node_fs26.writeFileSync)(tmp, `${JSON.stringify(ledger, null, 2)}
 `, "utf8");
-  (0, import_node_fs25.renameSync)(tmp, path2);
+  (0, import_node_fs26.renameSync)(tmp, path2);
 }
 var LEDGER_LOCK_OPTS = { label: "release ledger", staleMs: 18e4, deadHolderSteal: true };
 async function withLedgerLock(path2, fn, opts = {}) {
@@ -24694,7 +24827,7 @@ function describeTrainWriterToken(token) {
 function liveTrainWriterHolder(cwd) {
   let token;
   try {
-    token = (0, import_node_fs25.readFileSync)(trainWriterLockPath(cwd), "utf8");
+    token = (0, import_node_fs26.readFileSync)(trainWriterLockPath(cwd), "utf8");
   } catch {
     return void 0;
   }
@@ -24716,7 +24849,7 @@ async function acquireTrainWriterLock(cwd, verb) {
       if (heldTrainWriter) heldTrainWriter.depth -= 1;
     };
   }
-  (0, import_node_fs25.mkdirSync)((0, import_node_path25.dirname)(lockPath), { recursive: true });
+  (0, import_node_fs26.mkdirSync)((0, import_node_path25.dirname)(lockPath), { recursive: true });
   const opts = resolveFileLockOpts({ label: "train writer", staleMs: TRAIN_WRITER_STALE_MS, deadHolderSteal: true, maxWaitMs: 0, holder: verb });
   let guard;
   try {
@@ -24725,7 +24858,7 @@ async function acquireTrainWriterLock(cwd, verb) {
     if (!(e instanceof FileLockBusyError)) throw e;
     let token = "";
     try {
-      token = (0, import_node_fs25.readFileSync)(lockPath, "utf8");
+      token = (0, import_node_fs26.readFileSync)(lockPath, "utf8");
     } catch {
       token = "";
     }
@@ -24760,7 +24893,7 @@ async function withReleaseLedger(path2, expected, fn, opts = {}) {
     let current;
     let raw;
     try {
-      raw = (0, import_node_fs25.readFileSync)(path2, "utf8");
+      raw = (0, import_node_fs26.readFileSync)(path2, "utf8");
     } catch (e) {
       if (e.code !== "ENOENT") {
         throw new ReleaseLedgerError("unreadable", `release ledger at ${path2} could not be READ (${e instanceof Error ? e.message : String(e)}) \u2014 a failed read is unverified, not absent (#5987)`);
@@ -25429,7 +25562,7 @@ async function clearLedgerFile(path2, anchors, maxWaitMs) {
   return withLedgerLock(path2, async (fence) => {
     let raw;
     try {
-      raw = (0, import_node_fs25.readFileSync)(path2, "utf8");
+      raw = (0, import_node_fs26.readFileSync)(path2, "utf8");
     } catch (e) {
       if (e.code === "ENOENT") return { cleared: false };
       return { cleared: false, note: `release ledger at ${path2} could not be read for clearing (${e instanceof Error ? e.message : String(e)}) \u2014 left in place` };
@@ -25445,7 +25578,7 @@ async function clearLedgerFile(path2, anchors, maxWaitMs) {
     } catch (e) {
       return { cleared: false, note: `release ledger at ${path2} belongs to ${ledger.tag} @ ${ledger.tagSha.slice(0, 12)} \u2014 not this release; left in place (${e instanceof Error ? e.message : String(e)})` };
     }
-    await fence(() => (0, import_node_fs25.unlinkSync)(path2));
+    await fence(() => (0, import_node_fs26.unlinkSync)(path2));
     return { cleared: true, note: `cleared the release ledger at ${path2} for the live-proven aborted ${anchors.tag}` };
   }, { maxWaitMs });
 }
@@ -25605,7 +25738,7 @@ async function healStaleAlignmentLeg(deps, cwd, expected) {
   return withLedgerLock(path2, async (fence) => {
     let prior;
     try {
-      prior = parseReleaseLedger((0, import_node_fs25.readFileSync)(path2, "utf8"));
+      prior = parseReleaseLedger((0, import_node_fs26.readFileSync)(path2, "utf8"));
     } catch {
       return void 0;
     }
@@ -25630,7 +25763,7 @@ async function healUnfoldedRunLegs(deps, cwd, model) {
   const path2 = releaseLedgerPath(cwd);
   let prior;
   try {
-    prior = parseReleaseLedger((0, import_node_fs25.readFileSync)(path2, "utf8"));
+    prior = parseReleaseLedger((0, import_node_fs26.readFileSync)(path2, "utf8"));
   } catch {
     return void 0;
   }
@@ -25699,7 +25832,7 @@ async function supersedeContentCausedDeployLeg(deps, cwd) {
   return withLedgerLock(path2, async (fence) => {
     let prior;
     try {
-      prior = parseReleaseLedger((0, import_node_fs25.readFileSync)(path2, "utf8"));
+      prior = parseReleaseLedger((0, import_node_fs26.readFileSync)(path2, "utf8"));
     } catch (e) {
       throw new ReleaseLedgerError(
         "unreadable",
@@ -25797,10 +25930,10 @@ async function proveOriginPromotionOrArchived(deps, prior, path2, label, ref, fe
     throw new Error(`${label}: origin no longer has ${prior.tag} but its GitHub Release still exists \u2014 resolve the mixed external state before closing the ledger; nothing was written (${ref})`);
   }
   const archivePath = (0, import_node_path25.join)((0, import_node_path25.dirname)(path2), `phases.archive-${prior.tag}.json`);
-  if ((0, import_node_fs25.existsSync)(archivePath)) {
+  if ((0, import_node_fs26.existsSync)(archivePath)) {
     throw new Error(`${label}: archive already exists at ${archivePath} \u2014 preserving both ledger records; resolve the collision by hand; nothing was written (${ref})`);
   }
-  await fence(() => (0, import_node_fs25.renameSync)(path2, archivePath));
+  await fence(() => (0, import_node_fs26.renameSync)(path2, archivePath));
   return "deleted";
 }
 async function supersedeContentCausedPublishLeg(deps, cwd) {
@@ -25808,7 +25941,7 @@ async function supersedeContentCausedPublishLeg(deps, cwd) {
   return withLedgerLock(path2, async (fence) => {
     let prior;
     try {
-      prior = parseReleaseLedger((0, import_node_fs25.readFileSync)(path2, "utf8"));
+      prior = parseReleaseLedger((0, import_node_fs26.readFileSync)(path2, "utf8"));
     } catch (e) {
       throw new ReleaseLedgerError(
         "unreadable",
@@ -25890,7 +26023,7 @@ async function supersedeContentCausedDeployAndPublishLegs(deps, cwd) {
   return withLedgerLock(path2, async (fence) => {
     let prior;
     try {
-      prior = parseReleaseLedger((0, import_node_fs25.readFileSync)(path2, "utf8"));
+      prior = parseReleaseLedger((0, import_node_fs26.readFileSync)(path2, "utf8"));
     } catch (e) {
       throw new ReleaseLedgerError(
         "unreadable",
@@ -25995,7 +26128,7 @@ async function supersedeContentCausedDeployAndPublishLegs(deps, cwd) {
 async function reverifyPriorRunLegs(deps, path2, targetTag) {
   let prior;
   try {
-    prior = parseReleaseLedger((0, import_node_fs25.readFileSync)(path2, "utf8"));
+    prior = parseReleaseLedger((0, import_node_fs26.readFileSync)(path2, "utf8"));
   } catch {
     return;
   }
@@ -26015,7 +26148,7 @@ async function beginReleaseLedger(deps, cwd, targetTag) {
   return withLedgerLock(path2, async (fence) => {
     let raw;
     try {
-      raw = (0, import_node_fs25.readFileSync)(path2, "utf8");
+      raw = (0, import_node_fs26.readFileSync)(path2, "utf8");
     } catch (e) {
       if (e.code === "ENOENT") return { ok: true };
       return { ok: false, error: `the release ledger at ${path2} could not be READ (${e instanceof Error ? e.message : String(e)}) \u2014 a failed read is unverified, not absent (#5987/#4713)` };
@@ -26055,13 +26188,13 @@ async function beginReleaseLedger(deps, cwd, targetTag) {
     }
     const archivePath = (0, import_node_path25.join)((0, import_node_path25.dirname)(path2), `phases.archive-${prior.tag}.json`);
     try {
-      await fence(() => (0, import_node_fs25.unlinkSync)(archivePath));
+      await fence(() => (0, import_node_fs26.unlinkSync)(archivePath));
     } catch (e) {
       if (e.code !== "ENOENT") {
         return { ok: false, error: `could not clear the stale archive at ${archivePath} (${e instanceof Error ? e.message : String(e)}) \u2014 the ledger for ${prior.tag} stays active (#5987)` };
       }
     }
-    await fence(() => (0, import_node_fs25.renameSync)(path2, archivePath));
+    await fence(() => (0, import_node_fs26.renameSync)(path2, archivePath));
     return { ok: true, note: `archived the completed release ledger ${prior.tag} to ${archivePath} (live-proven at ${prior.tagSha.slice(0, 12)})` };
   });
 }
@@ -26089,7 +26222,7 @@ async function retryHotfixDeployLegs(deps, cwd, opts = {}) {
   return withLedgerLock(path2, async (fence) => {
     let prior;
     try {
-      prior = parseReleaseLedger((0, import_node_fs25.readFileSync)(path2, "utf8"));
+      prior = parseReleaseLedger((0, import_node_fs26.readFileSync)(path2, "utf8"));
     } catch (e) {
       throw new ReleaseLedgerError(
         "unreadable",
@@ -26282,10 +26415,10 @@ function readOriginWorkflowsDefault(root, ref) {
 }
 var NPM_REGISTRY = "https://registry.npmjs.org";
 async function probeRegistryWhoami(train) {
-  const dir = (0, import_node_fs26.mkdtempSync)((0, import_node_path26.join)((0, import_node_os15.tmpdir)(), "mmi-npmrc-"));
+  const dir = (0, import_node_fs27.mkdtempSync)((0, import_node_path26.join)((0, import_node_os15.tmpdir)(), "mmi-npmrc-"));
   const rc = (0, import_node_path26.join)(dir, "npmrc");
   try {
-    (0, import_node_fs26.writeFileSync)(rc, "//registry.npmjs.org/:_authToken=${NPM_TOKEN}\n");
+    (0, import_node_fs27.writeFileSync)(rc, "//registry.npmjs.org/:_authToken=${NPM_TOKEN}\n");
     await train.runSelf(["secrets", "use", "npm/NPM_TOKEN", "--slug", "_org", "--", "npm", "whoami", "--registry", NPM_REGISTRY, "--userconfig", rc]);
     return { kind: "ok", detail: "the registry answered a login" };
   } catch (e) {
@@ -26296,7 +26429,7 @@ async function probeRegistryWhoami(train) {
     if (/\bE401\b|401 Unauthorized/.test(stderr)) return { kind: "rejected", detail: "npm whoami answered 401 Unauthorized" };
     return { kind: "unverified", detail: first };
   } finally {
-    (0, import_node_fs26.rmSync)(dir, { recursive: true, force: true });
+    (0, import_node_fs27.rmSync)(dir, { recursive: true, force: true });
   }
 }
 var REGISTRY_TOKEN_ENV = /\b(NODE_AUTH_TOKEN|NPM_TOKEN)\b/;
@@ -26314,7 +26447,7 @@ var defaultDeps2 = {
   ledgerPath: releaseLedgerPath,
   readLedgerRaw: (path2) => {
     try {
-      return (0, import_node_fs26.readFileSync)(path2, "utf8");
+      return (0, import_node_fs27.readFileSync)(path2, "utf8");
     } catch (e) {
       if (e.code === "ENOENT") return void 0;
       throw e;
@@ -26325,7 +26458,7 @@ var defaultDeps2 = {
   trainWriterHolder: liveTrainWriterHolder,
   readSurfacesRaw: (cwd) => {
     try {
-      return (0, import_node_fs26.readFileSync)((0, import_node_path26.join)(cwd, "surfaces.json"), "utf8");
+      return (0, import_node_fs27.readFileSync)((0, import_node_path26.join)(cwd, "surfaces.json"), "utf8");
     } catch {
       return void 0;
     }
@@ -26964,7 +27097,7 @@ function formatTrainDoctor(v) {
 
 // src/release-plain-words.ts
 var import_promises3 = require("node:fs/promises");
-var import_node_fs27 = require("node:fs");
+var import_node_fs28 = require("node:fs");
 function releaseCutByNotes(cutBy) {
   return `## Internal
 Cut by ${formatSessionIdentity(cutBy)}
@@ -27070,7 +27203,7 @@ function validateSuiteReleaseSummary(path2, pathTr) {
   for (const [lang, file] of files) {
     let content;
     try {
-      content = (0, import_node_fs27.readFileSync)(file, "utf8");
+      content = (0, import_node_fs28.readFileSync)(file, "utf8");
     } catch (e) {
       throw new Error(`could not read summary file ${file}: ${e.message} \u2014 see ${SUMMARY_GUIDE}`);
     }
@@ -27285,14 +27418,14 @@ function readLocalGateWorkflows() {
   const dir = (0, import_node_path27.join)(".github", "workflows");
   let names;
   try {
-    names = (0, import_node_fs28.readdirSync)(dir);
+    names = (0, import_node_fs29.readdirSync)(dir);
   } catch {
     return null;
   }
   const files = [];
   for (const name of names.filter(isGateWorkflowPath)) {
     try {
-      files.push({ path: `${dir}/${name}`.replace(/\\/g, "/"), body: (0, import_node_fs28.readFileSync)((0, import_node_path27.join)(dir, name), "utf8") });
+      files.push({ path: `${dir}/${name}`.replace(/\\/g, "/"), body: (0, import_node_fs29.readFileSync)((0, import_node_path27.join)(dir, name), "utf8") });
     } catch {
     }
   }
@@ -27302,14 +27435,14 @@ function readLocalWorkflows() {
   const dir = (0, import_node_path27.join)(".github", "workflows");
   let names;
   try {
-    names = (0, import_node_fs28.readdirSync)(dir);
+    names = (0, import_node_fs29.readdirSync)(dir);
   } catch {
     return null;
   }
   const files = [];
   for (const name of names.filter((n) => /\.ya?ml$/i.test(n))) {
     try {
-      files.push({ path: `${dir}/${name}`.replace(/\\/g, "/"), body: (0, import_node_fs28.readFileSync)((0, import_node_path27.join)(dir, name), "utf8") });
+      files.push({ path: `${dir}/${name}`.replace(/\\/g, "/"), body: (0, import_node_fs29.readFileSync)((0, import_node_path27.join)(dir, name), "utf8") });
     } catch {
     }
   }
@@ -28191,7 +28324,7 @@ async function activeRcandLedgerCandidate(deps, cwd) {
   }
   let prior;
   try {
-    prior = parseReleaseLedger((0, import_node_fs28.readFileSync)(path2, "utf8"));
+    prior = parseReleaseLedger((0, import_node_fs29.readFileSync)(path2, "utf8"));
   } catch {
     return void 0;
   }
@@ -30807,7 +30940,7 @@ var PRIMARY_GROUPS = [
   ["Setup and support", ["bootstrap", "secrets", "docs", "tests", "spawn", "dist"]],
   ["Coordinate and improve", ["wave", "report", "skill-lesson", "closure-rate"]]
 ];
-var OPERATIONAL_TOP_LEVEL = /* @__PURE__ */ new Set(["org", "runtime", "plugin", "packages", "archive-prune"]);
+var OPERATIONAL_TOP_LEVEL = /* @__PURE__ */ new Set(["org", "runtime", "plugin", "packages", "github", "archive-prune"]);
 var CAMPAIGN_ORCHESTRATOR_TOP_LEVEL = /* @__PURE__ */ new Set(["pickup", "read"]);
 var SUPPORT_PRIMARY = /* @__PURE__ */ new Set(["doctor", "whoami", "commands", "explain", "docs", "tests", "spawn", "dist", "wave", "report", "skill-lesson", "closure-rate"]);
 var TOP_LEVEL_ORDER = /* @__PURE__ */ new Map();
@@ -30848,6 +30981,7 @@ var COMMAND_OWNERSHIP = {
   stage: { module_owner: "cli/src/stage-commands.ts", consumer: "agent-workflow" },
   pr: { module_owner: "cli/src/pr-commands.ts", consumer: "agent-workflow" },
   api: { module_owner: "cli/src/api-read.ts", consumer: "agent-workflow" },
+  github: { module_owner: "cli/src/github-budget.ts", consumer: "release-operator" },
   read: { module_owner: "cli/src/app-read-broker.ts", consumer: "agent-workflow" },
   ci: { module_owner: "cli/src/ci-audit.ts", consumer: "release-operator" },
   rcand: { module_owner: "cli/src/train-commands.ts", consumer: "release-operator" },
@@ -31587,6 +31721,55 @@ function renderPluginCachePlan(plan, applied) {
   return lines2.join("\n");
 }
 
+// src/github-budget.ts
+init_cli_shared();
+function allowance(value) {
+  const v = value;
+  return v && [v.remaining, v.limit, v.reset].every((n) => typeof n === "number" && Number.isFinite(n)) ? { remaining: v.remaining, limit: v.limit, reset: v.reset } : null;
+}
+async function readGithubBudget(deps) {
+  async function read(token) {
+    try {
+      const credential = await token();
+      if (!credential) throw new Error("No identity");
+      const res = await deps.fetch("https://api.github.com/rate_limit", {
+        method: "GET",
+        headers: { authorization: `Bearer ${credential}`, accept: "application/vnd.github+json", "user-agent": "mmi-cli" }
+      });
+      if (!res.ok) throw new Error("Unreadable");
+      const body = await res.json();
+      return { core: allowance(body.resources?.core), graphql: allowance(body.resources?.graphql) };
+    } catch {
+      return { core: null, graphql: null };
+    }
+  }
+  const [personal, app1, app2] = await Promise.all([
+    read(async () => {
+      const env = { ...process.env };
+      delete env.GH_TOKEN;
+      delete env.GITHUB_TOKEN;
+      return (await execFileP("gh", ["auth", "token"], { env })).stdout.trim();
+    }),
+    ...APP_POOL_MEMBERS.map((keys) => read(async () => (await mintBudgetToken(deps, keys)).token))
+  ]);
+  const pools = { personal, app1, app2 };
+  const count = (v) => v ? `${v.remaining}/${v.limit}` : "unknown";
+  const resets = [...new Set(Object.values(pools).flatMap((pool) => [pool.core, pool.graphql]).filter((v) => v !== null).map((v) => new Intl.DateTimeFormat("en-GB", {
+    timeZone: "Europe/Istanbul",
+    hour: "2-digit",
+    minute: "2-digit",
+    hourCycle: "h23"
+  }).format(new Date(v.reset * 1e3))))].sort();
+  const line = `GitHub budget \xB7 ${Object.entries(pools).map(([name, pool]) => `${name} core ${count(pool.core)} gql ${count(pool.graphql)}`).join(" \xB7 ")} \xB7 resets ${resets.join(", ") || "unknown"} (Istanbul)`;
+  return { ...pools, line };
+}
+function registerGithubBudgetCommand(program3, deps) {
+  program3.command("github").description("GitHub allowance visibility").command("budget").description("read personal and both App budgets (no allowance cost)").option("--json", "machine-readable output").action(async (options) => {
+    const budget = await readGithubBudget(deps());
+    console.log(options.json ? JSON.stringify(budget, null, 2) : budget.line);
+  });
+}
+
 // src/board-commands.ts
 init_cli_shared();
 
@@ -32088,7 +32271,7 @@ function registerBoardCommands(program3) {
 }
 
 // src/bootstrap-commands.ts
-var import_node_fs32 = require("node:fs");
+var import_node_fs33 = require("node:fs");
 var import_node_os18 = require("node:os");
 var import_node_path31 = require("node:path");
 init_cli_shared();
@@ -32274,7 +32457,7 @@ init_github_client();
 init_cli_shared();
 
 // src/port-registry.ts
-var import_node_fs29 = require("node:fs");
+var import_node_fs30 = require("node:fs");
 var import_node_path28 = require("node:path");
 
 // ../infra/port-geometry.mjs
@@ -32289,8 +32472,8 @@ function nextPortBlock(registry2) {
   return [base, base + PORT_SPAN];
 }
 function loadPortRegistry(path2) {
-  if (!(0, import_node_fs29.existsSync)(path2)) return {};
-  const raw = JSON.parse((0, import_node_fs29.readFileSync)(path2, "utf8"));
+  if (!(0, import_node_fs30.existsSync)(path2)) return {};
+  const raw = JSON.parse((0, import_node_fs30.readFileSync)(path2, "utf8"));
   const out = {};
   for (const [key, value] of Object.entries(raw)) {
     if (Array.isArray(value) && value.length === 2 && value.every((n) => typeof n === "number")) {
@@ -32320,7 +32503,7 @@ function existingPortRange(repo, registry2) {
 function portRangeInfraAt(root, source) {
   const registryPath = (0, import_node_path28.join)(root, "infra", "port-ranges.json");
   const ddbScriptPath = (0, import_node_path28.join)(root, "infra", "port-ddb.mjs");
-  if (!(0, import_node_fs29.existsSync)(registryPath) || !(0, import_node_fs29.existsSync)(ddbScriptPath)) return null;
+  if (!(0, import_node_fs30.existsSync)(registryPath) || !(0, import_node_fs30.existsSync)(ddbScriptPath)) return null;
   return { root, source, registryPath, ddbScriptPath };
 }
 function resolvePortRangeInfra(cwd, packageDir) {
@@ -32402,7 +32585,7 @@ async function assignPersistedPortRange(repo, slug, reg, opts) {
 }
 
 // src/box-commands.ts
-var import_node_fs31 = require("node:fs");
+var import_node_fs32 = require("node:fs");
 var import_node_child_process10 = require("node:child_process");
 var import_node_os17 = require("node:os");
 var import_node_path30 = require("node:path");
@@ -32536,7 +32719,7 @@ function applyRemoteScript(items, date) {
 init_clean_exit();
 
 // src/secrets-commands.ts
-var import_node_fs30 = require("node:fs");
+var import_node_fs31 = require("node:fs");
 var import_node_path29 = require("node:path");
 var import_node_os16 = require("node:os");
 init_cli_shared();
@@ -33686,8 +33869,8 @@ async function decryptRailsCredentials(input) {
     MMI_RAILS_CREDENTIALS_FILE: credentialsPath,
     MMI_RAILS_MASTER_KEY_FILE: masterKeyPath
   };
-  if ((0, import_node_fs30.existsSync)(masterKeyPath)) {
-    env.RAILS_MASTER_KEY = (0, import_node_fs30.readFileSync)(masterKeyPath, "utf8").trim();
+  if ((0, import_node_fs31.existsSync)(masterKeyPath)) {
+    env.RAILS_MASTER_KEY = (0, import_node_fs31.readFileSync)(masterKeyPath, "utf8").trim();
   }
   const script = [
     'require "json"',
@@ -33697,9 +33880,9 @@ async function decryptRailsCredentials(input) {
     'config = ActiveSupport::EncryptedConfiguration.new(config_path: config_path, key_path: key_path, env_key: "RAILS_MASTER_KEY", raise_if_missing_key: true)',
     "puts JSON.generate(config.config)"
   ].join("\n");
-  const scriptDir = (0, import_node_fs30.mkdtempSync)((0, import_node_path29.join)((0, import_node_os16.tmpdir)(), "mmi-rails-decrypt-"));
+  const scriptDir = (0, import_node_fs31.mkdtempSync)((0, import_node_path29.join)((0, import_node_os16.tmpdir)(), "mmi-rails-decrypt-"));
   const scriptPath = (0, import_node_path29.join)(scriptDir, "decrypt.rb");
-  (0, import_node_fs30.writeFileSync)(scriptPath, script, "utf8");
+  (0, import_node_fs31.writeFileSync)(scriptPath, script, "utf8");
   try {
     const args = ["exec", "ruby", scriptPath];
     const cmd = process.platform === "win32" ? "cmd.exe" : "bundle";
@@ -33711,7 +33894,7 @@ async function decryptRailsCredentials(input) {
     });
     return JSON.parse(stdout);
   } finally {
-    (0, import_node_fs30.rmSync)(scriptDir, { recursive: true, force: true });
+    (0, import_node_fs31.rmSync)(scriptDir, { recursive: true, force: true });
   }
 }
 async function readSecretStdin() {
@@ -33801,7 +33984,7 @@ function registerSecretsCommands(program3) {
     let body;
     if (o.file) {
       try {
-        body = (0, import_node_fs30.readFileSync)((0, import_node_path29.resolve)(o.file), "utf8");
+        body = (0, import_node_fs31.readFileSync)((0, import_node_path29.resolve)(o.file), "utf8");
       } catch (e) {
         return fail(`secrets org-catalog: cannot read --file ${o.file}: ${e.message}`);
       }
@@ -33937,7 +34120,7 @@ function registerSecretsCommands(program3) {
       {
         ...d,
         decryptRailsCredentials,
-        removeFile: (path2) => (0, import_node_fs30.unlinkSync)((0, import_node_path29.resolve)(o.appDir ?? process.cwd(), path2))
+        removeFile: (path2) => (0, import_node_fs31.unlinkSync)((0, import_node_path29.resolve)(o.appDir ?? process.cwd(), path2))
       },
       {
         repo: o.repo,
@@ -34193,7 +34376,7 @@ function registerBoxCommands(program3) {
       }
       const remote = command && command.length ? command.join(" ") : void 0;
       const wroteScript = o.ssh && o.script ? o.script : null;
-      if (wroteScript) (0, import_node_fs31.writeFileSync)(wroteScript, sshRecipeScript(found, remote), "utf8");
+      if (wroteScript) (0, import_node_fs32.writeFileSync)(wroteScript, sshRecipeScript(found, remote), "utf8");
       if (o.json) {
         console.log(JSON.stringify({
           box: found,
@@ -34267,17 +34450,17 @@ function hubGitShow(ref) {
   return (path2) => git3(["show", `${ref}:${path2}`]);
 }
 function runOnBox(found, script) {
-  const dir = (0, import_node_fs31.mkdtempSync)((0, import_node_path30.join)((0, import_node_os17.tmpdir)(), "mmi-box-control-"));
+  const dir = (0, import_node_fs32.mkdtempSync)((0, import_node_path30.join)((0, import_node_os17.tmpdir)(), "mmi-box-control-"));
   try {
     const recipe = (0, import_node_path30.join)(dir, "recipe.sh");
-    (0, import_node_fs31.writeFileSync)(recipe, sshRecipeScript(found, "sh -s"), "utf8");
+    (0, import_node_fs32.writeFileSync)(recipe, sshRecipeScript(found, "sh -s"), "utf8");
     const r = (0, import_node_child_process10.spawnSync)("bash", [recipe], { input: script, encoding: "utf8", maxBuffer: 16 * 1024 * 1024, timeout: 18e4, windowsHide: true });
     if (r.status !== 0) {
       throw new UnreadableError(`box control: the ssh session to ${found.name} failed (exit ${r.status ?? r.signal}): ${(r.stderr || "").trim().split("\n").slice(-3).join(" | ")}`);
     }
     return r.stdout;
   } finally {
-    (0, import_node_fs31.rmSync)(dir, { recursive: true, force: true });
+    (0, import_node_fs32.rmSync)(dir, { recursive: true, force: true });
   }
 }
 function formatControl(mode, box, rows) {
@@ -35912,12 +36095,12 @@ async function verifyTargetedSeedPr(repo, number, plan, target, expected, client
 // src/bootstrap-commands.ts
 var execGitForSeedSource = async (args) => (await execFileP("git", args, { timeout: GIT_TIMEOUT_MS })).stdout;
 async function gateRenderDiff(current, rendered) {
-  const dir = (0, import_node_fs32.mkdtempSync)((0, import_node_path31.join)((0, import_node_os18.tmpdir)(), "mmi-gate-diff-"));
+  const dir = (0, import_node_fs33.mkdtempSync)((0, import_node_path31.join)((0, import_node_os18.tmpdir)(), "mmi-gate-diff-"));
   const before = (0, import_node_path31.join)(dir, "committed-gate.yml");
   const after = (0, import_node_path31.join)(dir, "registry-render.yml");
   try {
-    (0, import_node_fs32.writeFileSync)(before, current);
-    (0, import_node_fs32.writeFileSync)(after, rendered);
+    (0, import_node_fs33.writeFileSync)(before, current);
+    (0, import_node_fs33.writeFileSync)(after, rendered);
     try {
       return (await execFileP("git", ["diff", "--no-index", "--", before, after], { timeout: GIT_TIMEOUT_MS })).stdout;
     } catch (e) {
@@ -35926,7 +36109,7 @@ async function gateRenderDiff(current, rendered) {
       throw e;
     }
   } finally {
-    (0, import_node_fs32.rmSync)(dir, { recursive: true, force: true });
+    (0, import_node_fs33.rmSync)(dir, { recursive: true, force: true });
   }
 }
 function bootstrapTrainDoctorDeps() {
@@ -35986,13 +36169,13 @@ function registerBootstrapCommands(program3) {
       })),
       pushAllowlistOwners: verifyOwners,
       pushAllowlistOwnersRead: verifyOwnersRead,
-      readLocalFile: (path2) => path2 === "projects.json" && apiProjects != null ? apiProjects : (0, import_node_fs32.existsSync)(path2) ? (0, import_node_fs32.readFileSync)(path2, "utf8") : null,
+      readLocalFile: (path2) => path2 === "projects.json" && apiProjects != null ? apiProjects : (0, import_node_fs33.existsSync)(path2) ? (0, import_node_fs33.readFileSync)(path2, "utf8") : null,
       // requiredGcpApis is stored as an array by a JSON write, but `org project set --var KEY=VALUE` stores a raw
       // comma-string — accept either so the seeded value verifies regardless of how it was written.
       // #3689: the same committed map the org access audit reads (#3664), so a sanctioned admin is not a
       // permanent bootstrap failure on one surface and an intended state on the other. Absent file → no
       // sanction, which is the pre-#3664 behaviour.
-      sanctionedAdmins: (0, import_node_fs32.existsSync)("access-matrix.json") ? entriesValueByCanonicalRepo(loadSanctionedAdmins((0, import_node_fs32.readFileSync)("access-matrix.json", "utf8")), repo) : void 0,
+      sanctionedAdmins: (0, import_node_fs33.existsSync)("access-matrix.json") ? entriesValueByCanonicalRepo(loadSanctionedAdmins((0, import_node_fs33.readFileSync)("access-matrix.json", "utf8")), repo) : void 0,
       requiredGcpApis: (() => {
         const v = meta?.requiredGcpApis;
         if (Array.isArray(v)) return v;
@@ -36070,14 +36253,14 @@ function registerBootstrapCommands(program3) {
   bootstrap.command("drift").description("#3818: compare every org-owned whole-file seed against MMI-Hub's copy across the registry roster; read-only").option("--repo <owner/repo>", "audit one repo instead of the roster (never a fleet verdict)").option("--json", "machine-readable output").action(async () => {
     const o = { repo: rawValue("--repo", ""), json: rawFlag("--json") };
     const manifestPath = "skills/bootstrap/seeds/manifest.json";
-    if (!(0, import_node_fs32.existsSync)(manifestPath)) return fail(`bootstrap drift: ${manifestPath} not found; run from the MMI-Hub repo root \u2014 the Hub's copies ARE the reference this compares against`);
+    if (!(0, import_node_fs33.existsSync)(manifestPath)) return fail(`bootstrap drift: ${manifestPath} not found; run from the MMI-Hub repo root \u2014 the Hub's copies ARE the reference this compares against`);
     const seedSource = await resolveHubSeedSource(execGitForSeedSource);
     if (!seedSource.ok) return fail(`bootstrap drift: ${seedSource.reason}`);
-    const manifest = loadBootstrapSeeds((0, import_node_fs32.readFileSync)(manifestPath, "utf8"));
+    const manifest = loadBootstrapSeeds((0, import_node_fs33.readFileSync)(manifestPath, "utf8"));
     const hubContents = /* @__PURE__ */ new Map();
     for (const s of manifest.seeds) {
       if (s.ownership !== "org" || s.source !== "self") continue;
-      hubContents.set(s.target, (0, import_node_fs32.existsSync)(s.target) ? (0, import_node_fs32.readFileSync)(s.target, "utf8") : null);
+      hubContents.set(s.target, (0, import_node_fs33.existsSync)(s.target) ? (0, import_node_fs33.readFileSync)(s.target, "utf8") : null);
     }
     let targets;
     let classOf = (_repo) => "deployable";
@@ -36285,24 +36468,24 @@ function registerBootstrapCommands(program3) {
       return;
     }
     const manifestPath = "skills/bootstrap/seeds/manifest.json";
-    if (!(0, import_node_fs32.existsSync)(manifestPath)) return fail(`bootstrap apply: ${manifestPath} not found; bootstrap runs from the MMI-Hub repo root by design \u2014 it stamps org-level resources (Project, Ruleset, secrets, access) through the GitHub App, which is only authorized from the Hub checkout`);
+    if (!(0, import_node_fs33.existsSync)(manifestPath)) return fail(`bootstrap apply: ${manifestPath} not found; bootstrap runs from the MMI-Hub repo root by design \u2014 it stamps org-level resources (Project, Ruleset, secrets, access) through the GitHub App, which is only authorized from the Hub checkout`);
     const seedSource = await resolveHubSeedSource(execGitForSeedSource);
     if (!seedSource.ok) return fail(`bootstrap apply: ${seedSource.reason}`);
-    const manifest = loadBootstrapSeeds((0, import_node_fs32.readFileSync)(manifestPath, "utf8"));
+    const manifest = loadBootstrapSeeds((0, import_node_fs33.readFileSync)(manifestPath, "utf8"));
     const baseBranch = o.class === "content" ? "main" : "development";
     const slug = parsedRepo.slug;
     const onlyTarget = o.fromConfig && o.only.trim() === "gate.yml" ? ".github/workflows/gate.yml" : o.only.trim();
     const gh2 = async (args) => execFileP("gh", args, { timeout: 2e4 });
-    const readFile10 = (p) => (0, import_node_fs32.existsSync)(p) ? (0, import_node_fs32.readFileSync)(p, "utf8") : null;
+    const readFile10 = (p) => (0, import_node_fs33.existsSync)(p) ? (0, import_node_fs33.readFileSync)(p, "utf8") : null;
     const enc = (p) => p.split("/").map(encodeURIComponent).join("/");
     const putSeed = async (target, content, ref, sha) => {
       const tmp = (0, import_node_path31.join)((0, import_node_os18.tmpdir)(), `mmi-seed-${process.pid}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}.json`);
-      (0, import_node_fs32.writeFileSync)(tmp, JSON.stringify(contentPutBody(target, content, ref, sha)), "utf8");
+      (0, import_node_fs33.writeFileSync)(tmp, JSON.stringify(contentPutBody(target, content, ref, sha)), "utf8");
       try {
         await gh2(contentPutInputArgs(repo, target, tmp));
       } finally {
         try {
-          (0, import_node_fs32.unlinkSync)(tmp);
+          (0, import_node_fs33.unlinkSync)(tmp);
         } catch {
         }
       }
@@ -36938,10 +37121,10 @@ LIVE apply to ${repo}:
   bootstrap.command("propagate").description("#4238: re-entrant canary\u2192wave tick \u2014 plan (or, with --execute, open) per-repo PRs fanning an org-owned seed out to the fleet").option("--target <path>", "the manifest target to propagate (an org-owned whole file or declared Hub-managed block)").option("--execute", "LIVE tick via gh (master-gated) \u2014 opens/reuses per-repo seed-propagate PRs; dry-run prints the plan only").option("--json", "machine-readable output").action(async () => {
     const o = { target: rawValue("--target", ""), execute: rawFlag("--execute"), json: rawFlag("--json") };
     const manifestPath = "skills/bootstrap/seeds/manifest.json";
-    if (!(0, import_node_fs32.existsSync)(manifestPath)) return fail(`bootstrap propagate: ${manifestPath} not found; run from the MMI-Hub repo root \u2014 the Hub's copies ARE the desired state this tick propagates`);
+    if (!(0, import_node_fs33.existsSync)(manifestPath)) return fail(`bootstrap propagate: ${manifestPath} not found; run from the MMI-Hub repo root \u2014 the Hub's copies ARE the desired state this tick propagates`);
     const seedSource = await resolveHubSeedSource(execGitForSeedSource);
     if (!seedSource.ok) return fail(`bootstrap propagate: ${seedSource.reason}`);
-    const manifest = loadBootstrapSeeds((0, import_node_fs32.readFileSync)(manifestPath, "utf8"));
+    const manifest = loadBootstrapSeeds((0, import_node_fs33.readFileSync)(manifestPath, "utf8"));
     const propagatable = manifest.seeds.filter(isPropagatableSeed);
     if (!o.target) {
       return fail(`bootstrap propagate: --target <path> is required \u2014 one of:
@@ -36950,9 +37133,9 @@ LIVE apply to ${repo}:
     const seed = propagatable.find((s) => s.target === o.target);
     if (!seed) return fail(`bootstrap propagate: --target '${o.target}' names no centrally propagatable seed in ${manifestPath}. Propagatable targets:
   ${propagatable.map((s) => s.target).join("\n  ")}`);
-    if (!seed.managedBlock && !(0, import_node_fs32.existsSync)(seed.target)) return fail(`bootstrap propagate: the Hub's own copy of '${seed.target}' is missing \u2014 nothing to propagate`);
-    const hubContent = seed.managedBlock ? null : (0, import_node_fs32.readFileSync)(seed.target, "utf8");
-    const readSeedFile2 = (path2) => (0, import_node_fs32.existsSync)(path2) ? (0, import_node_fs32.readFileSync)(path2, "utf8") : null;
+    if (!seed.managedBlock && !(0, import_node_fs33.existsSync)(seed.target)) return fail(`bootstrap propagate: the Hub's own copy of '${seed.target}' is missing \u2014 nothing to propagate`);
+    const hubContent = seed.managedBlock ? null : (0, import_node_fs33.readFileSync)(seed.target, "utf8");
+    const readSeedFile2 = (path2) => (0, import_node_fs33.existsSync)(path2) ? (0, import_node_fs33.readFileSync)(path2, "utf8") : null;
     const isWorkflowSeed = seed.target.startsWith(".github/workflows/");
     const cfg = await loadConfig();
     const projects = await fetchProjectsList(registryClientDeps(cfg));
@@ -36961,9 +37144,9 @@ LIVE apply to ${repo}:
     }
     const rosterRepos = collectRegistryRepos(projects).filter((r) => r.toLowerCase() !== "mutmutco/mmi-hub");
     let independentCount = rosterRepos.length;
-    if ((0, import_node_fs32.existsSync)("projects.json")) {
+    if ((0, import_node_fs33.existsSync)("projects.json")) {
       try {
-        const local = JSON.parse((0, import_node_fs32.readFileSync)("projects.json", "utf8"));
+        const local = JSON.parse((0, import_node_fs33.readFileSync)("projects.json", "utf8"));
         const localRepos = /* @__PURE__ */ new Set();
         for (const p of local.projects ?? []) for (const r of p.repos ?? []) {
           const full = (r.includes("/") ? r : `mutmutco/${r}`).toLowerCase();
@@ -37113,7 +37296,7 @@ LIVE apply to ${repo}:
       if (plan.refusedNoCanary) return fail("bootstrap propagate --execute: no canary declared for this target \u2014 refusing to write (set seedCanary:true on exactly one registry repo)");
       const headSha = seedSource.sha;
       const sourceBlob = (await execGitForSeedSource(["rev-parse", `${headSha}:${seedSourcePath(seed)}`])).trim();
-      const runbookUnaffected = (0, import_node_fs32.existsSync)(RUNBOOK_UNAFFECTED_PATH) ? runbookUnaffectedReason(JSON.parse((0, import_node_fs32.readFileSync)(RUNBOOK_UNAFFECTED_PATH, "utf8")), seed.target, sourceBlob) : void 0;
+      const runbookUnaffected = (0, import_node_fs33.existsSync)(RUNBOOK_UNAFFECTED_PATH) ? runbookUnaffectedReason(JSON.parse((0, import_node_fs33.readFileSync)(RUNBOOK_UNAFFECTED_PATH, "utf8")), seed.target, sourceBlob) : void 0;
       for (const rec of plan.records) {
         if (rec.action !== "open-pr") continue;
         const baseBranch = classOf(rec.repo) === "content" ? "main" : "development";
@@ -37138,12 +37321,12 @@ LIVE apply to ${repo}:
         const tmp = (0, import_node_path31.join)((0, import_node_os18.tmpdir)(), `mmi-propagate-${process.pid}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}.json`);
         const desiredContent = desiredByRepo.get(rec.repo);
         if (desiredContent == null) return fail(`bootstrap propagate: no resolved content for ${rec.repo} ${seed.target} \u2014 refusing to write`);
-        (0, import_node_fs32.writeFileSync)(tmp, JSON.stringify(contentPutBody(seed.target, desiredContent, branch, existingSha, runbookUnaffected)), "utf8");
+        (0, import_node_fs33.writeFileSync)(tmp, JSON.stringify(contentPutBody(seed.target, desiredContent, branch, existingSha, runbookUnaffected)), "utf8");
         try {
           await gh2(contentPutInputArgs(rec.repo, seed.target, tmp));
         } finally {
           try {
-            (0, import_node_fs32.unlinkSync)(tmp);
+            (0, import_node_fs33.unlinkSync)(tmp);
           } catch {
           }
         }
@@ -37212,10 +37395,10 @@ Rollback: \`mmi-cli devops bootstrap rollback ${rec.repo} --target ${seed.target
       return fail(`bootstrap rollback: ${e.message}`);
     }
     const manifestPath = "skills/bootstrap/seeds/manifest.json";
-    if (!(0, import_node_fs32.existsSync)(manifestPath)) return fail(`bootstrap rollback: ${manifestPath} not found; run from the MMI-Hub repo root \u2014 the manifest names which targets are org-owned and therefore propagated (and rollback-able)`);
+    if (!(0, import_node_fs33.existsSync)(manifestPath)) return fail(`bootstrap rollback: ${manifestPath} not found; run from the MMI-Hub repo root \u2014 the manifest names which targets are org-owned and therefore propagated (and rollback-able)`);
     const seedSource = await resolveHubSeedSource(execGitForSeedSource);
     if (!seedSource.ok) return fail(`bootstrap rollback: ${seedSource.reason}`);
-    const manifest = loadBootstrapSeeds((0, import_node_fs32.readFileSync)(manifestPath, "utf8"));
+    const manifest = loadBootstrapSeeds((0, import_node_fs33.readFileSync)(manifestPath, "utf8"));
     const propagatable = manifest.seeds.filter(isPropagatableSeed);
     if (!o.target) {
       return fail(`bootstrap rollback: --target <path> is required \u2014 one of:
@@ -37232,10 +37415,10 @@ Rollback: \`mmi-cli devops bootstrap rollback ${rec.repo} --target ${seed.target
     const enc = (p) => p.split("/").map(encodeURIComponent).join("/");
     let candidates;
     if (o.record) {
-      if (!(0, import_node_fs32.existsSync)(o.record)) return fail(`bootstrap rollback: --record '${o.record}' not found`);
+      if (!(0, import_node_fs33.existsSync)(o.record)) return fail(`bootstrap rollback: --record '${o.record}' not found`);
       let parsed;
       try {
-        parsed = JSON.parse((0, import_node_fs32.readFileSync)(o.record, "utf8"));
+        parsed = JSON.parse((0, import_node_fs33.readFileSync)(o.record, "utf8"));
       } catch (e) {
         return fail(`bootstrap rollback: --record '${o.record}' is not valid JSON: ${e.message}`);
       }
@@ -37313,12 +37496,12 @@ Rollback: \`mmi-cli devops bootstrap rollback ${rec.repo} --target ${seed.target
         existingSha = void 0;
       }
       const tmp = (0, import_node_path31.join)((0, import_node_os18.tmpdir)(), `mmi-rollback-${process.pid}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}.json`);
-      (0, import_node_fs32.writeFileSync)(tmp, JSON.stringify(contentPutBody(seed.target, preSeedContent, plan.branch, existingSha)), "utf8");
+      (0, import_node_fs33.writeFileSync)(tmp, JSON.stringify(contentPutBody(seed.target, preSeedContent, plan.branch, existingSha)), "utf8");
       try {
         await gh2(contentPutInputArgs(repo, seed.target, tmp));
       } finally {
         try {
-          (0, import_node_fs32.unlinkSync)(tmp);
+          (0, import_node_fs33.unlinkSync)(tmp);
         } catch {
         }
       }
@@ -37775,7 +37958,7 @@ async function waitSuiteDev(deps, opts) {
 }
 
 // src/suite-train.ts
-var import_node_fs33 = require("node:fs");
+var import_node_fs34 = require("node:fs");
 var import_node_path32 = require("node:path");
 var import_node_crypto15 = require("node:crypto");
 
@@ -37862,7 +38045,7 @@ function suiteReleaseTag(rc) {
 function readSuiteCut(path2) {
   let raw;
   try {
-    raw = (0, import_node_fs33.readFileSync)(path2, "utf8");
+    raw = (0, import_node_fs34.readFileSync)(path2, "utf8");
   } catch (e) {
     if (e.code === "ENOENT") return void 0;
     throw e;
@@ -37878,11 +38061,11 @@ function readSuiteCut(path2) {
   return record;
 }
 function writeSuiteCut(path2, record) {
-  (0, import_node_fs33.mkdirSync)((0, import_node_path32.dirname)(path2), { recursive: true });
+  (0, import_node_fs34.mkdirSync)((0, import_node_path32.dirname)(path2), { recursive: true });
   const temp = `${path2}.${(0, import_node_crypto15.randomBytes)(8).toString("hex")}.tmp`;
   try {
-    (0, import_node_fs33.writeFileSync)(temp, JSON.stringify(record, null, 2), { flag: "wx" });
-    (0, import_node_fs33.renameSync)(temp, path2);
+    (0, import_node_fs34.writeFileSync)(temp, JSON.stringify(record, null, 2), { flag: "wx" });
+    (0, import_node_fs34.renameSync)(temp, path2);
   } catch (e) {
     throw new Error(`suite cut record write failed at ${path2}: ${e.message}; stop, verify the file before retrying`);
   }
@@ -37931,25 +38114,25 @@ async function suiteMarkAbandoned(deps, ownerGo = false) {
   return tags.map((t) => `${t.repo}@${t.tag}`);
 }
 async function retireFailedLeadRcLedger(deps, ownerGo) {
-  if (!(0, import_node_fs33.existsSync)(deps.ledgerPath)) return void 0;
+  if (!(0, import_node_fs34.existsSync)(deps.ledgerPath)) return void 0;
   return withLedgerLock(deps.ledgerPath, async (fence) => {
-    const ledger = parseReleaseLedger((0, import_node_fs33.readFileSync)(deps.ledgerPath, "utf8"));
+    const ledger = parseReleaseLedger((0, import_node_fs34.readFileSync)(deps.ledgerPath, "utf8"));
     const states = Object.values(ledger.phases).map((p) => p.state);
     if (ledger.repo !== SUITE_REPO || ledger.lane !== "rcand" || ledger.phases.promotion.state === "complete" || !states.includes("failed")) return void 0;
     if (!ownerGo) throw new Error(`the lead's failed rcand ledger for ${ledger.tag} blocks every train; retire it with suite abandon --owner-go`);
     if ((await deps.rcHead())?.toLowerCase() === ledger.tagSha.toLowerCase()) throw new Error(`origin rc already points at ${ledger.tag}; it was promoted, so its ledger is not retired`);
     const archive = (0, import_node_path32.join)((0, import_node_path32.dirname)(deps.ledgerPath), `phases.archive-${ledger.tag}.json`);
-    if ((0, import_node_fs33.existsSync)(archive)) throw new Error(`ledger archive already exists at ${archive}; inspect before retiring again`);
+    if ((0, import_node_fs34.existsSync)(archive)) throw new Error(`ledger archive already exists at ${archive}; inspect before retiring again`);
     await deps.markAbandoned(SUITE_REPO, ledger.tag, ledger.tagSha);
-    await fence(() => (0, import_node_fs33.renameSync)(deps.ledgerPath, archive));
+    await fence(() => (0, import_node_fs34.renameSync)(deps.ledgerPath, archive));
     return `${ledger.tag} (ledger archived to ${archive})`;
   });
 }
 function suiteAbandon(recordPath, ownerGo = false, now = /* @__PURE__ */ new Date()) {
   const record = abandonableCut(recordPath, ownerGo);
   const archive = `${recordPath}.abandoned-${record.leadDevelopment.slice(0, 12)}-${now.toISOString().replace(/[:.]/g, "")}.json`;
-  if ((0, import_node_fs33.existsSync)(archive)) throw new Error(`abandoned-cut archive already exists at ${archive}; inspect before abandoning again`);
-  (0, import_node_fs33.renameSync)(recordPath, archive);
+  if ((0, import_node_fs34.existsSync)(archive)) throw new Error(`abandoned-cut archive already exists at ${archive}; inspect before abandoning again`);
+  (0, import_node_fs34.renameSync)(recordPath, archive);
   return { archive, orphanTags: record.members.filter((m) => m.tag).map((m) => `${m.repo}@${m.tag}`) };
 }
 async function suiteRestoreMainPins(deps) {
@@ -38032,12 +38215,12 @@ async function suiteRcandRun(deps, opts) {
   }
   if ((record?.announcement === "sent" || record?.announcement === "skipped") && record.leadReleased) {
     const archive = `${deps.recordPath}.${record.leadRcTag}.json`;
-    if ((0, import_node_fs33.existsSync)(archive)) throw new Error(`suite cut archive already exists at ${archive}; inspect before a new cut`);
-    (0, import_node_fs33.renameSync)(deps.recordPath, archive);
+    if ((0, import_node_fs34.existsSync)(archive)) throw new Error(`suite cut archive already exists at ${archive}; inspect before a new cut`);
+    (0, import_node_fs34.renameSync)(deps.recordPath, archive);
     record = void 0;
   }
   if (record && !record.pinPr && !record.leadRcTag && record.members.every((m) => !m.tag)) {
-    (0, import_node_fs33.rmSync)(deps.recordPath, { force: true });
+    (0, import_node_fs34.rmSync)(deps.recordPath, { force: true });
     record = void 0;
   }
   if (!record) {
@@ -38091,7 +38274,7 @@ async function suiteRcandRun(deps, opts) {
     quiet.push(member);
   }
   if (record.members.every((m) => m.carried || quiet.includes(m)) && await deps.contains(SUITE_REPO, record.leadDevelopment, record.leadPreviousRc)) {
-    (0, import_node_fs33.rmSync)(deps.recordPath, { force: true });
+    (0, import_node_fs34.rmSync)(deps.recordPath, { force: true });
     throw new Error("nothing to promote: neither MM-Work nor any module has new development commits since its rc; no suite cut started");
   }
   for (const member of quiet) {
@@ -38109,7 +38292,7 @@ async function suiteRcandRun(deps, opts) {
   }
   if (refusals.length) {
     const untouched = record.members.every((m) => !m.tag) && !record.pinPr;
-    if (untouched) (0, import_node_fs33.rmSync)(deps.recordPath, { force: true });
+    if (untouched) (0, import_node_fs34.rmSync)(deps.recordPath, { force: true });
     throw new Error(`module rc serving is not ready; ${untouched ? "no suite cut started" : "no new tag was cut"}:
 ${refusals.join("\n")}
 Each module must ship a live release that bind-mounts <deployPath>/data read-only and serves <data>/rc/module.js at /rc/module.js (docs/Guides/suite-trains.md).`);
@@ -38305,7 +38488,7 @@ var hotfixRecordPath = (deps) => (0, import_node_path32.join)((0, import_node_pa
 function readSuiteHotfix(path2) {
   let raw;
   try {
-    raw = (0, import_node_fs33.readFileSync)(path2, "utf8");
+    raw = (0, import_node_fs34.readFileSync)(path2, "utf8");
   } catch (e) {
     if (e.code === "ENOENT") return void 0;
     throw e;
@@ -38348,7 +38531,7 @@ async function suiteHotfix(deps, opts) {
   if (completed) record = void 0;
   if (record && record.repo !== found.repo) throw new Error(`an unfinished suite hotfix for ${record.repo} is recorded; finish it (rerun with that member) first`);
   if (!record?.tag) await deps.validateHotfixSummary();
-  if (completed) (0, import_node_fs33.renameSync)(path2, `${path2}.${completed.leadTag}.json`);
+  if (completed) (0, import_node_fs34.renameSync)(path2, `${path2}.${completed.leadTag}.json`);
   const rec = record ?? { schema: "mmi-suite-hotfix/v1", member: found.id, repo: found.repo, from: opts.from, ...opts.ack?.length ? { ack: opts.ack } : {} };
   const save = () => writeSuiteHotfix(path2, rec);
   save();
@@ -38617,7 +38800,7 @@ async function runRcDataSwitch(deps, opts) {
 // src/suite-train-io.ts
 var import_node_child_process18 = require("node:child_process");
 var import_node_path45 = require("node:path");
-var import_node_fs46 = require("node:fs");
+var import_node_fs47 = require("node:fs");
 var import_node_path46 = require("node:path");
 init_cli_shared();
 
@@ -40294,7 +40477,7 @@ function checkHotfixCarries(options) {
 }
 
 // src/merge-cleanup.ts
-var import_node_fs35 = require("node:fs");
+var import_node_fs36 = require("node:fs");
 var import_node_path34 = require("node:path");
 var import_node_os19 = require("node:os");
 init_cli_shared();
@@ -40723,7 +40906,7 @@ function renderPrLandTable(entries) {
 
 // src/test-policy-core.ts
 var import_node_child_process13 = require("node:child_process");
-var import_node_fs34 = require("node:fs");
+var import_node_fs35 = require("node:fs");
 var import_node_path33 = require("node:path");
 
 // src/test-command-policy-shared.mjs
@@ -41293,7 +41476,7 @@ function loadPolicySource(root, explicitRef, diffBase) {
 }
 function readFileOrNull2(path2) {
   try {
-    return (0, import_node_fs34.readFileSync)(path2, "utf8");
+    return (0, import_node_fs35.readFileSync)(path2, "utf8");
   } catch {
     return null;
   }
@@ -41321,10 +41504,10 @@ function classify(changed, policy, present = () => false) {
   const removedProtected = [...removed].filter((p) => protectedBy.has(p)).map((p) => ({ path: p, why: protectedBy.get(p) ?? "" }));
   return { mandatoryHits, untestedHits, testChanges, meaningfulTestChanges, addedTests, removedProtected };
 }
-function unresolvedProtectedEntries(policy, root, exists = (path2) => (0, import_node_fs34.existsSync)(path2)) {
+function unresolvedProtectedEntries(policy, root, exists = (path2) => (0, import_node_fs35.existsSync)(path2)) {
   return (policy.protected ?? []).map((p) => p.path).filter((p) => !exists((0, import_node_path33.join)(root, p)));
 }
-function unresolvedSatisfiers(policy, root, exists = (path2) => (0, import_node_fs34.existsSync)(path2)) {
+function unresolvedSatisfiers(policy, root, exists = (path2) => (0, import_node_fs35.existsSync)(path2)) {
   const declared = (policy.mandatory ?? []).flatMap((m) => m.satisfiedBy ?? []);
   return [...new Set(declared)].filter((p) => !exists((0, import_node_path33.join)(root, p)));
 }
@@ -41465,7 +41648,7 @@ function runTestPolicy(root, deps = {}) {
   }
   const loaded = deps.policy ? { policy: deps.policy, source: { ref: null, sha: null, path: POLICY_FILE } } : loadPolicySource(root, deps.policyRef, deps.base);
   const { policy, source: policySource } = loaded;
-  const exists = deps.exists ?? ((path2) => (0, import_node_fs34.existsSync)(path2));
+  const exists = deps.exists ?? ((path2) => (0, import_node_fs35.existsSync)(path2));
   const counts = { mandatoryCount: (policy.mandatory ?? []).length, protectedCount: (policy.protected ?? []).length };
   const base = deps.changed ? "(injected)" : deps.policyRef ? resolveHotfixBase(root) : resolveBase(root, deps.base);
   const refusal = deps.changed ? null : untrustworthyRange(root, base);
@@ -41763,13 +41946,13 @@ function resolveSquashMergeBodyText(commits, allowedClosing, cwd) {
   return rewritten === base ? null : rewritten;
 }
 function writeSquashBodyFile(body) {
-  const dir = (0, import_node_fs35.mkdtempSync)((0, import_node_path34.join)((0, import_node_os19.tmpdir)(), "mmi-squash-body-"));
+  const dir = (0, import_node_fs36.mkdtempSync)((0, import_node_path34.join)((0, import_node_os19.tmpdir)(), "mmi-squash-body-"));
   const path2 = (0, import_node_path34.join)(dir, "body.txt");
-  (0, import_node_fs35.writeFileSync)(path2, body.endsWith("\n") ? body : `${body}
+  (0, import_node_fs36.writeFileSync)(path2, body.endsWith("\n") ? body : `${body}
 `, "utf8");
   return { path: path2, cleanup: () => {
     try {
-      (0, import_node_fs35.rmSync)(dir, { recursive: true, force: true });
+      (0, import_node_fs36.rmSync)(dir, { recursive: true, force: true });
     } catch {
     }
   } };
@@ -42058,7 +42241,7 @@ function prMergeQueueLine(result) {
 }
 
 // src/project-info-sync.ts
-var import_node_fs36 = require("node:fs");
+var import_node_fs37 = require("node:fs");
 var import_node_path35 = require("node:path");
 var UPDATE_PROJECT_INFO = `mutation($projectId: ID!, $shortDescription: String!, $readme: String!) {
   updateProjectV2(input: { projectId: $projectId, shortDescription: $shortDescription, readme: $readme }) {
@@ -42107,13 +42290,13 @@ function sharedName(entries, fallback) {
 function buildProjectInfoSyncPlan(targetRepo2, project2, projects, repoRoot2) {
   if (!project2.projectId) throw new Error(`org project sync-info: ${targetRepo2} registry META has no projectId`);
   const readmePath = (0, import_node_path35.join)(repoRoot2, "README.md");
-  if (!(0, import_node_fs36.existsSync)(readmePath)) throw new Error(`org project sync-info: ${targetRepo2} has no README.md`);
+  if (!(0, import_node_fs37.existsSync)(readmePath)) throw new Error(`org project sync-info: ${targetRepo2} has no README.md`);
   const entries = entriesFor(project2, projects);
   const memberRepos = [...new Set(entries.flatMap((entry) => entry.repos ?? []))].filter((repo) => /^[^/]+\/[^/]+$/.test(repo)).sort((a, b) => a.localeCompare(b));
   const projectName = sharedName(entries, project2.name?.trim() || targetRepo2.split("/").pop() || targetRepo2);
   if (!memberRepos.length) throw new Error(`org project sync-info: project ${projectName} has no registered member repos`);
   const entryNames = entries.map((entry) => entry.name?.trim()).filter((name) => Boolean(name));
-  const shortDescription = memberRepos.length === 1 ? shortDescriptionFromReadme((0, import_node_fs36.readFileSync)(readmePath, "utf8")) : `Shared work across ${new Intl.ListFormat("en", { type: "conjunction" }).format(entryNames)}.`;
+  const shortDescription = memberRepos.length === 1 ? shortDescriptionFromReadme((0, import_node_fs37.readFileSync)(readmePath, "utf8")) : `Shared work across ${new Intl.ListFormat("en", { type: "conjunction" }).format(entryNames)}.`;
   const lines2 = [
     `# ${projectName}`,
     "",
@@ -42132,8 +42315,8 @@ function buildProjectInfoSyncPlan(targetRepo2, project2, projects, repoRoot2) {
   const targetBase = `https://github.com/${targetRepo2}`;
   const targetBranch = branchFor(targetRepo2, projects);
   const orgDocs = [
-    (0, import_node_fs36.existsSync)((0, import_node_path35.join)(repoRoot2, "architecture.md")) ? `- [Hub architecture](${targetBase}/blob/${targetBranch}/architecture.md)` : "",
-    (0, import_node_fs36.existsSync)((0, import_node_path35.join)(repoRoot2, "docs", "Architecture", "agentic-dev-environment.md")) ? `- [Agentic development environment](${targetBase}/blob/${targetBranch}/docs/Architecture/agentic-dev-environment.md)` : ""
+    (0, import_node_fs37.existsSync)((0, import_node_path35.join)(repoRoot2, "architecture.md")) ? `- [Hub architecture](${targetBase}/blob/${targetBranch}/architecture.md)` : "",
+    (0, import_node_fs37.existsSync)((0, import_node_path35.join)(repoRoot2, "docs", "Architecture", "agentic-dev-environment.md")) ? `- [Agentic development environment](${targetBase}/blob/${targetBranch}/docs/Architecture/agentic-dev-environment.md)` : ""
   ].filter(Boolean);
   if (orgDocs.length) lines2.push("", "## Organisation docs", "", ...orgDocs);
   return { projectId: project2.projectId, projectName, targetRepo: targetRepo2, memberRepos, shortDescription, readme: `${lines2.join("\n")}
@@ -42155,7 +42338,7 @@ async function syncProjectInfo(plan, client, apply) {
 }
 
 // src/train-commands.ts
-var import_node_fs37 = require("node:fs");
+var import_node_fs38 = require("node:fs");
 var import_node_path36 = require("node:path");
 init_cli_shared();
 init_clean_exit();
@@ -42171,7 +42354,7 @@ function resolveReleaseBumpIntent(raw) {
 }
 function readRepoVersion() {
   try {
-    return JSON.parse((0, import_node_fs37.readFileSync)((0, import_node_path36.join)(process.cwd(), ".claude-plugin", "plugin.json"), "utf8")).version || void 0;
+    return JSON.parse((0, import_node_fs38.readFileSync)((0, import_node_path36.join)(process.cwd(), ".claude-plugin", "plugin.json"), "utf8")).version || void 0;
   } catch {
     return void 0;
   }
@@ -42536,7 +42719,7 @@ async function openSuitePinPr(deps, input) {
 
 // src/command-register-collaboration.ts
 var import_node_child_process17 = require("node:child_process");
-var import_node_fs45 = require("node:fs");
+var import_node_fs46 = require("node:fs");
 var import_promises8 = require("node:fs/promises");
 init_clean_exit();
 init_cli_shared();
@@ -42670,7 +42853,7 @@ init_github_client();
 init_github_quota();
 
 // src/issue-commands.ts
-var import_node_fs38 = require("node:fs");
+var import_node_fs39 = require("node:fs");
 var import_node_crypto16 = require("node:crypto");
 init_cli_shared();
 init_clean_exit();
@@ -42863,7 +43046,7 @@ async function editIssue(client, options, deps = {}) {
   const url = `https://github.com/${repo}/issues/${parsed.number}`;
   const patch = {};
   let bodyChanged = false;
-  const textDeps = () => deps.textDeps ?? { readFile: (p, e) => Promise.resolve((0, import_node_fs38.readFileSync)(p, e)), readStdin: () => Promise.resolve("") };
+  const textDeps = () => deps.textDeps ?? { readFile: (p, e) => Promise.resolve((0, import_node_fs39.readFileSync)(p, e)), readStdin: () => Promise.resolve("") };
   if (options.titleFile !== void 0) {
     patch.title = await resolveIssueTitle({ title: options.title, titleFile: options.titleFile }, textDeps());
   } else if (options.title !== void 0) {
@@ -43526,7 +43709,7 @@ function extendCreateCommand(issue, batchAttach) {
     if (opts.batch) {
       let specs;
       try {
-        const raw = (0, import_node_fs38.readFileSync)(opts.batch, "utf8");
+        const raw = (0, import_node_fs39.readFileSync)(opts.batch, "utf8");
         specs = JSON.parse(raw);
         if (!Array.isArray(specs)) {
           const top = specs === null ? "null" : typeof specs === "object" ? `an object with keys: ${Object.keys(specs).join(", ") || "(none)"}` : `a ${typeof specs}`;
@@ -43603,7 +43786,7 @@ ${lines2}`, {
 }
 
 // src/post-merge-recon.ts
-var import_node_fs39 = require("node:fs");
+var import_node_fs40 = require("node:fs");
 var import_node_path38 = require("node:path");
 
 // src/cross-repo-filing-issue.ts
@@ -43773,16 +43956,16 @@ function buildPostMergeReconRecovery(input) {
 }
 function writePostMergeReconRecovery(cwd, recovery) {
   const path2 = postMergeReconStatePath(cwd, recovery.repo, recovery.pr);
-  (0, import_node_fs39.mkdirSync)((0, import_node_path38.dirname)(path2), { recursive: true });
-  (0, import_node_fs39.writeFileSync)(path2, `${JSON.stringify(recovery, null, 2)}
+  (0, import_node_fs40.mkdirSync)((0, import_node_path38.dirname)(path2), { recursive: true });
+  (0, import_node_fs40.writeFileSync)(path2, `${JSON.stringify(recovery, null, 2)}
 `, "utf8");
   return path2;
 }
 function clearPostMergeReconRecovery(cwd, repo, pr) {
   const path2 = postMergeReconStatePath(cwd, repo, pr);
-  if (!(0, import_node_fs39.existsSync)(path2)) return;
+  if (!(0, import_node_fs40.existsSync)(path2)) return;
   try {
-    (0, import_node_fs39.unlinkSync)(path2);
+    (0, import_node_fs40.unlinkSync)(path2);
   } catch {
   }
 }
@@ -44258,7 +44441,7 @@ function registerPrLifecycleCommands(program3) {
 
 // src/review-verdict.ts
 var import_node_child_process14 = require("node:child_process");
-var import_node_fs40 = require("node:fs");
+var import_node_fs41 = require("node:fs");
 var import_node_os21 = require("node:os");
 var import_node_path39 = require("node:path");
 init_cli_shared();
@@ -44425,15 +44608,15 @@ async function readPrIssueComments(number, repo) {
   return comments;
 }
 async function postPrCommentFromFile(number, repo, body) {
-  const dir = (0, import_node_fs40.mkdtempSync)((0, import_node_path39.join)((0, import_node_os21.tmpdir)(), "mmi-review-verdict-"));
+  const dir = (0, import_node_fs41.mkdtempSync)((0, import_node_path39.join)((0, import_node_os21.tmpdir)(), "mmi-review-verdict-"));
   const path2 = (0, import_node_path39.join)(dir, "body.md");
   try {
-    (0, import_node_fs40.writeFileSync)(path2, body, "utf8");
+    (0, import_node_fs41.writeFileSync)(path2, body, "utf8");
     const { stdout } = await execFileP("gh", ["pr", "comment", number, "--repo", repo, "--body-file", path2], { timeout: GH_MUTATION_TIMEOUT_MS });
     return stdout.trim();
   } finally {
     try {
-      (0, import_node_fs40.rmSync)(dir, { recursive: true, force: true });
+      (0, import_node_fs41.rmSync)(dir, { recursive: true, force: true });
     } catch {
     }
   }
@@ -44667,17 +44850,17 @@ async function prCreateClaimRefusal(body, repoOption, deps = {}) {
 }
 
 // src/worktree-residue-sweep.ts
-var import_node_fs44 = require("node:fs");
+var import_node_fs45 = require("node:fs");
 var import_node_path43 = require("node:path");
 
 // src/worktree-merge-cleanup.ts
-var import_node_fs43 = require("node:fs");
+var import_node_fs44 = require("node:fs");
 var import_node_path42 = require("node:path");
 init_cli_shared();
 
 // src/stage-runner.ts
 var import_node_child_process16 = require("node:child_process");
-var import_node_fs42 = require("node:fs");
+var import_node_fs43 = require("node:fs");
 var import_node_path41 = require("node:path");
 var import_node_net = require("node:net");
 var import_node_util5 = require("node:util");
@@ -44688,7 +44871,7 @@ function normalizeEol2(s) {
 }
 
 // src/env-detection.ts
-var import_node_fs41 = require("node:fs");
+var import_node_fs42 = require("node:fs");
 var import_node_path40 = require("node:path");
 var SKIPPED_DIRS = /* @__PURE__ */ new Set([".git", "node_modules", "dist", ".jerv", ".pi", ".venv", "venv"]);
 function isEnvBaseName(name) {
@@ -44699,7 +44882,7 @@ function findEnvFiles(root) {
   const walk2 = (dir, rel) => {
     let entries;
     try {
-      entries = (0, import_node_fs41.readdirSync)(dir, { withFileTypes: true });
+      entries = (0, import_node_fs42.readdirSync)(dir, { withFileTypes: true });
     } catch {
       return;
     }
@@ -44713,7 +44896,7 @@ function findEnvFiles(root) {
       if (isEnvBaseName(entry.name)) {
         let isDir = false;
         try {
-          isDir = (0, import_node_fs41.lstatSync)((0, import_node_path40.join)(dir, entry.name)).isDirectory();
+          isDir = (0, import_node_fs42.lstatSync)((0, import_node_path40.join)(dir, entry.name)).isDirectory();
         } catch {
         }
         if (!isDir) found.push(relPath);
@@ -44852,12 +45035,12 @@ var DOCKER_TIMEOUT_MS = 15e3;
 function stageBash() {
   if (process.platform !== "win32") return "bash";
   const configured = process.env.SHELL;
-  if (configured && (0, import_node_path41.isAbsolute)(configured) && /[/\\]bash(?:\.exe)?$/i.test(configured) && !/[/\\](?:System32|Sysnative)[/\\]bash(?:\.exe)?$/i.test(configured) && (0, import_node_fs42.existsSync)(configured)) return configured;
+  if (configured && (0, import_node_path41.isAbsolute)(configured) && /[/\\]bash(?:\.exe)?$/i.test(configured) && !/[/\\](?:System32|Sysnative)[/\\]bash(?:\.exe)?$/i.test(configured) && (0, import_node_fs43.existsSync)(configured)) return configured;
   const candidates = [
     (0, import_node_path41.join)(process.env.ProgramFiles || "C:\\Program Files", "Git", "bin", "bash.exe"),
     ...process.env.LOCALAPPDATA ? [(0, import_node_path41.join)(process.env.LOCALAPPDATA, "Programs", "Git", "bin", "bash.exe")] : []
   ];
-  const bash = candidates.find((path2) => (0, import_node_fs42.existsSync)(path2));
+  const bash = candidates.find((path2) => (0, import_node_fs43.existsSync)(path2));
   if (!bash) throw new Error("Local stages require Git Bash on Windows. Install Git for Windows or set SHELL to its absolute bash.exe path.");
   return bash;
 }
@@ -45213,7 +45396,7 @@ function stageProcessEnv(stagePort, extraEnv) {
 function composeResolvesPort(cwd) {
   if (process.env.PORT) return true;
   const envFile = (0, import_node_path41.join)(cwd, ".env");
-  return (0, import_node_fs42.existsSync)(envFile) && envFileKeys((0, import_node_fs42.readFileSync)(envFile, "utf8")).has("PORT");
+  return (0, import_node_fs43.existsSync)(envFile) && envFileKeys((0, import_node_fs43.readFileSync)(envFile, "utf8")).has("PORT");
 }
 function stageComposeEnv(config, stagePort, vaultEnvMerge, cwd) {
   const composeProject = config.env?.COMPOSE_PROJECT_NAME ?? vaultEnvMerge?.COMPOSE_PROJECT_NAME ?? stageComposeProjectName(cwd);
@@ -45228,13 +45411,13 @@ function stageComposeEnv(config, stagePort, vaultEnvMerge, cwd) {
 function stageComposeFiles(cwd) {
   const files = ["docker-compose.yml"];
   for (const conventional of ["docker-compose.override.yml", "docker-compose.override.yaml"]) {
-    if ((0, import_node_fs42.existsSync)((0, import_node_path41.join)(cwd, conventional))) files.push(conventional);
+    if ((0, import_node_fs43.existsSync)((0, import_node_path41.join)(cwd, conventional))) files.push(conventional);
   }
   return [...files, RUNTIME_ENV_OVERRIDE_RELPATH];
 }
 async function prepareRuntimeEnvPassthrough(cwd, composeEnv, vaultEnvMerge) {
   const keys = Object.keys(vaultEnvMerge ?? {});
-  if (!keys.length || !(0, import_node_fs42.existsSync)((0, import_node_path41.join)(cwd, "docker-compose.yml"))) return {};
+  if (!keys.length || !(0, import_node_fs43.existsSync)((0, import_node_path41.join)(cwd, "docker-compose.yml"))) return {};
   let configJson;
   try {
     const { stdout } = await execFileP3("docker", ["compose", "config", "--format", "json"], {
@@ -45251,20 +45434,20 @@ async function prepareRuntimeEnvPassthrough(cwd, composeEnv, vaultEnvMerge) {
   const body = renderRuntimeEnvOverride(runtimeEnvMarkedServices(configJson), keys, runtimeEnvExcludes(configJson), runtimeEnvSelects(configJson));
   if (!body) return {};
   const overridePath = (0, import_node_path41.join)(cwd, RUNTIME_ENV_OVERRIDE_RELPATH);
-  (0, import_node_fs42.mkdirSync)((0, import_node_path41.join)(cwd, "tmp", "stage"), { recursive: true });
-  (0, import_node_fs42.writeFileSync)(overridePath, body, "utf8");
+  (0, import_node_fs43.mkdirSync)((0, import_node_path41.join)(cwd, "tmp", "stage"), { recursive: true });
+  (0, import_node_fs43.writeFileSync)(overridePath, body, "utf8");
   return stageComposeFileEnv(stageComposeFiles(cwd));
 }
 async function ensureStageRuntimeEnv(config, opts, cwd) {
   if (!config.ensureEnv) return;
   const target = (0, import_node_path41.join)(cwd, config.ensureEnv.target);
   const example = (0, import_node_path41.join)(cwd, config.ensureEnv.example);
-  if (!(0, import_node_fs42.existsSync)(target) && (0, import_node_fs42.existsSync)(example)) {
-    (0, import_node_fs42.copyFileSync)(example, target);
-  } else if ((0, import_node_fs42.existsSync)(target) && (0, import_node_fs42.existsSync)(example)) {
-    const stale = detectStaleEnvFile((0, import_node_fs42.readFileSync)(example, "utf8"), (0, import_node_fs42.readFileSync)(target, "utf8"), {
-      exampleMtimeMs: (0, import_node_fs42.statSync)(example).mtimeMs,
-      targetMtimeMs: (0, import_node_fs42.statSync)(target).mtimeMs
+  if (!(0, import_node_fs43.existsSync)(target) && (0, import_node_fs43.existsSync)(example)) {
+    (0, import_node_fs43.copyFileSync)(example, target);
+  } else if ((0, import_node_fs43.existsSync)(target) && (0, import_node_fs43.existsSync)(example)) {
+    const stale = detectStaleEnvFile((0, import_node_fs43.readFileSync)(example, "utf8"), (0, import_node_fs43.readFileSync)(target, "utf8"), {
+      exampleMtimeMs: (0, import_node_fs43.statSync)(example).mtimeMs,
+      targetMtimeMs: (0, import_node_fs43.statSync)(target).mtimeMs
     });
     if (stale) {
       const msg = `stale ${config.ensureEnv.target} (${stale}) \u2014 delete it or refresh from ${config.ensureEnv.example} before re-running /stage`;
@@ -45272,8 +45455,8 @@ async function ensureStageRuntimeEnv(config, opts, cwd) {
       console.error(`mmi-cli stage: ${msg} (allowed via --allow-stale-env)`);
     }
   }
-  if (opts.vaultEnvMerge && Object.keys(opts.vaultEnvMerge).length && (0, import_node_fs42.existsSync)(target)) {
-    (0, import_node_fs42.writeFileSync)(target, mergeEnvSecretsIntoFile((0, import_node_fs42.readFileSync)(target, "utf8"), opts.vaultEnvMerge), "utf8");
+  if (opts.vaultEnvMerge && Object.keys(opts.vaultEnvMerge).length && (0, import_node_fs43.existsSync)(target)) {
+    (0, import_node_fs43.writeFileSync)(target, mergeEnvSecretsIntoFile((0, import_node_fs43.readFileSync)(target, "utf8"), opts.vaultEnvMerge), "utf8");
   }
 }
 async function gitText(cwd, args) {
@@ -45303,20 +45486,20 @@ async function resolveGlobalStatePath(cwd, explicit) {
   return void 0;
 }
 function readState(path2) {
-  if (!(0, import_node_fs42.existsSync)(path2)) return null;
+  if (!(0, import_node_fs43.existsSync)(path2)) return null;
   try {
-    return JSON.parse((0, import_node_fs42.readFileSync)(path2, "utf8"));
+    return JSON.parse((0, import_node_fs43.readFileSync)(path2, "utf8"));
   } catch {
     return null;
   }
 }
 function mkdirFor(path2) {
   const dir = path2.slice(0, Math.max(path2.lastIndexOf("/"), path2.lastIndexOf("\\")));
-  (0, import_node_fs42.mkdirSync)(dir, { recursive: true });
+  (0, import_node_fs43.mkdirSync)(dir, { recursive: true });
 }
 function writeState(path2, state) {
   mkdirFor(path2);
-  (0, import_node_fs42.writeFileSync)(path2, JSON.stringify(state, null, 2), "utf8");
+  (0, import_node_fs43.writeFileSync)(path2, JSON.stringify(state, null, 2), "utf8");
 }
 function writeStagePortReservation(port, cwd, statePath, globalStatePath, now) {
   const reservation = {
@@ -45345,7 +45528,7 @@ async function cleanupStageState(state, paths, timeoutMs, fallbackCwd, currentEn
     );
   }
   for (const path2 of [...new Set(paths.filter((p) => Boolean(p)))]) {
-    (0, import_node_fs42.rmSync)(path2, { force: true });
+    (0, import_node_fs43.rmSync)(path2, { force: true });
   }
 }
 async function killTree(pid) {
@@ -45592,8 +45775,8 @@ async function runStage(config = {}, opts = {}) {
       });
     }
   } catch (e) {
-    (0, import_node_fs42.rmSync)(statePath, { force: true });
-    if (globalStatePath && globalStatePath !== statePath) (0, import_node_fs42.rmSync)(globalStatePath, { force: true });
+    (0, import_node_fs43.rmSync)(statePath, { force: true });
+    if (globalStatePath && globalStatePath !== statePath) (0, import_node_fs43.rmSync)(globalStatePath, { force: true });
     throw e;
   }
   const started = await startStage(config, {
@@ -45614,7 +45797,7 @@ function normPath2(p) {
 function unlinkNodeModulesJunction(wtPath) {
   const nm = (0, import_node_path42.join)(wtPath, "node_modules");
   try {
-    if ((0, import_node_fs43.lstatSync)(nm).isSymbolicLink()) (0, import_node_fs43.rmdirSync)(nm);
+    if ((0, import_node_fs44.lstatSync)(nm).isSymbolicLink()) (0, import_node_fs44.rmdirSync)(nm);
     return { ok: true };
   } catch (e) {
     if (e.code === "ENOENT") return { ok: true };
@@ -45625,8 +45808,8 @@ function defaultSleep2(ms) {
   return new Promise((resolve8) => setTimeout(resolve8, ms));
 }
 async function removeResidueDirectory(wtPath, options = {}) {
-  const { sleep: sleep2 = defaultSleep2, removeEmptyDir = import_node_fs43.rmdirSync, exists = import_node_fs43.existsSync } = options;
-  const removeRecursive = options.removeRecursive ?? ((path2) => (0, import_node_fs43.rmSync)(path2, { recursive: true, force: true, maxRetries: 10, retryDelay: 100 }));
+  const { sleep: sleep2 = defaultSleep2, removeEmptyDir = import_node_fs44.rmdirSync, exists = import_node_fs44.existsSync } = options;
+  const removeRecursive = options.removeRecursive ?? ((path2) => (0, import_node_fs44.rmSync)(path2, { recursive: true, force: true, maxRetries: 10, retryDelay: 100 }));
   const junction = unlinkNodeModulesJunction(wtPath);
   if (!junction.ok) return junction;
   try {
@@ -45752,21 +45935,21 @@ async function listNestedIgnoredNodeModules(wtPath, execGit) {
   return out.split(/\r?\n/).map((line) => line.trim()).filter((line) => line.endsWith("node_modules/") && line !== "node_modules/").map((line) => (0, import_node_path42.join)(wtPath, line.slice(0, -1)));
 }
 function safeRemoveTree(path2) {
-  const stat4 = (0, import_node_fs43.lstatSync)(path2);
+  const stat4 = (0, import_node_fs44.lstatSync)(path2);
   if (stat4.isSymbolicLink()) {
     try {
-      (0, import_node_fs43.rmdirSync)(path2);
+      (0, import_node_fs44.rmdirSync)(path2);
     } catch {
-      (0, import_node_fs43.unlinkSync)(path2);
+      (0, import_node_fs44.unlinkSync)(path2);
     }
     return;
   }
   if (stat4.isDirectory()) {
-    for (const entry of (0, import_node_fs43.readdirSync)(path2)) safeRemoveTree((0, import_node_path42.join)(path2, entry));
-    (0, import_node_fs43.rmdirSync)(path2);
+    for (const entry of (0, import_node_fs44.readdirSync)(path2)) safeRemoveTree((0, import_node_path42.join)(path2, entry));
+    (0, import_node_fs44.rmdirSync)(path2);
     return;
   }
-  (0, import_node_fs43.unlinkSync)(path2);
+  (0, import_node_fs44.unlinkSync)(path2);
 }
 async function removeWorktreeNodeModules(wtPath) {
   try {
@@ -45782,7 +45965,7 @@ function errorMessage(e) {
 }
 function resolvedOrRaw(path2) {
   try {
-    return normPath2((0, import_node_fs43.realpathSync)(path2));
+    return normPath2((0, import_node_fs44.realpathSync)(path2));
   } catch {
     return normPath2(path2);
   }
@@ -45790,10 +45973,10 @@ function resolvedOrRaw(path2) {
 function unlinkEscapingReparsePoints(root, primaryRoot) {
   let realRoot;
   try {
-    if ((0, import_node_fs43.lstatSync)(root).isSymbolicLink()) {
+    if ((0, import_node_fs44.lstatSync)(root).isSymbolicLink()) {
       return { ok: false, error: `delete root ${normPath2(root)} is a reparse point resolving to ${resolvedOrRaw(root)}` };
     }
-    realRoot = normPath2((0, import_node_fs43.realpathSync)(root));
+    realRoot = normPath2((0, import_node_fs44.realpathSync)(root));
   } catch (e) {
     if (e.code === "ENOENT") return { ok: true, unlinked: [] };
     return { ok: false, error: `cannot resolve delete root ${normPath2(root)}: ${errorMessage(e)}` };
@@ -45809,7 +45992,7 @@ function unlinkEscapingReparsePoints(root, primaryRoot) {
     const dir = stack.pop();
     let entries;
     try {
-      entries = (0, import_node_fs43.readdirSync)(dir, { withFileTypes: true });
+      entries = (0, import_node_fs44.readdirSync)(dir, { withFileTypes: true });
     } catch (e) {
       if (e.code === "ENOENT") continue;
       return { ok: false, error: `cannot scan ${normPath2(dir)} for reparse points: ${errorMessage(e)}` };
@@ -45819,7 +46002,7 @@ function unlinkEscapingReparsePoints(root, primaryRoot) {
       if (entry.isSymbolicLink()) {
         let target = "";
         try {
-          target = normPath2((0, import_node_fs43.realpathSync)(child2));
+          target = normPath2((0, import_node_fs44.realpathSync)(child2));
         } catch {
           target = "";
         }
@@ -46002,7 +46185,7 @@ async function cleanupPrMergeLocalBranch(branch, options) {
     return report;
   }
   const execGit = options.execGit ?? (async (args) => (await execFileP("git", args, { timeout: GIT_TIMEOUT_MS })).stdout);
-  const pathExists = options.pathExists ?? import_node_fs43.existsSync;
+  const pathExists = options.pathExists ?? import_node_fs44.existsSync;
   let afterWorktrees = [];
   try {
     afterWorktrees = parseGitWorktreePorcelain(await execGit(["worktree", "list", "--porcelain"]));
@@ -46289,7 +46472,7 @@ function residueLedgerPath(gitCommonDir) {
 }
 function readPaths(file, deps) {
   try {
-    const parsed = JSON.parse((deps.readLedger ?? ((f) => (0, import_node_fs44.readFileSync)(f, "utf8")))(file));
+    const parsed = JSON.parse((deps.readLedger ?? ((f) => (0, import_node_fs45.readFileSync)(f, "utf8")))(file));
     return Array.isArray(parsed) ? parsed.filter((p) => typeof p === "string") : [];
   } catch {
     return [];
@@ -46298,8 +46481,8 @@ function readPaths(file, deps) {
 function writePaths(file, paths, deps) {
   try {
     const write = deps.writeLedger ?? ((f, t) => {
-      (0, import_node_fs44.mkdirSync)((0, import_node_path43.dirname)(f), { recursive: true });
-      (0, import_node_fs44.writeFileSync)(f, t, "utf8");
+      (0, import_node_fs45.mkdirSync)((0, import_node_path43.dirname)(f), { recursive: true });
+      (0, import_node_fs45.writeFileSync)(f, t, "utf8");
     });
     write(file, `${JSON.stringify([...new Set(paths)], null, 1)}
 `);
@@ -46313,17 +46496,17 @@ function recordResidue(gitCommonDir, path2, deps = {}) {
   writePaths(file, paths, deps);
 }
 async function sweepWorktreeResidue(gitCommonDir, registered, deps = {}) {
-  const exists = deps.exists ?? import_node_fs44.existsSync;
-  const readDir = deps.readDir ?? ((p) => (0, import_node_fs44.readdirSync)(p));
+  const exists = deps.exists ?? import_node_fs45.existsSync;
+  const readDir = deps.readDir ?? ((p) => (0, import_node_fs45.readdirSync)(p));
   const isDir = deps.isDir ?? ((p) => {
     try {
-      return (0, import_node_fs44.statSync)(p).isDirectory();
+      return (0, import_node_fs45.statSync)(p).isDirectory();
     } catch {
       return false;
     }
   });
   const removeRecorded = deps.removeRecorded ?? ((p) => removeResidueDirectory(p));
-  const removeEmpty = deps.removeEmpty ?? ((p) => (0, import_node_fs44.rmdirSync)(p));
+  const removeEmpty = deps.removeEmpty ?? ((p) => (0, import_node_fs45.rmdirSync)(p));
   const report = { swept: [], kept: [], dropped: [], emptyRemoved: [], unrecorded: [] };
   const live = new Set(registered.map(norm));
   const primary = registered[0] ? norm(registered[0]) : void 0;
@@ -46403,8 +46586,8 @@ function argvWantsJson2() {
 function hubRoot() {
   const fromPkg = (0, import_node_path44.join)(__dirname, "..", "..");
   const marker = "skills/bootstrap/seeds/manifest.json";
-  if ((0, import_node_fs45.existsSync)((0, import_node_path44.join)(fromPkg, marker))) return fromPkg;
-  if ((0, import_node_fs45.existsSync)((0, import_node_path44.join)(process.cwd(), marker))) return process.cwd();
+  if ((0, import_node_fs46.existsSync)((0, import_node_path44.join)(fromPkg, marker))) return fromPkg;
+  if ((0, import_node_fs46.existsSync)((0, import_node_path44.join)(process.cwd(), marker))) return process.cwd();
   return null;
 }
 function ciAuditDeps() {
@@ -46417,7 +46600,7 @@ function ciAuditDeps() {
     readSeedFile: (path2) => {
       if (!root) return null;
       const fullPath = (0, import_node_path44.join)(root, path2);
-      return (0, import_node_fs45.existsSync)(fullPath) ? (0, import_node_fs45.readFileSync)(fullPath, "utf8") : null;
+      return (0, import_node_fs46.existsSync)(fullPath) ? (0, import_node_fs46.readFileSync)(fullPath, "utf8") : null;
     }
   };
 }
@@ -47181,10 +47364,10 @@ ${list}`);
   });
   async function listCiWorkflowPaths(cwd = process.cwd()) {
     const wfDir = (0, import_node_path44.join)(cwd, ".github", "workflows");
-    if (!(0, import_node_fs45.existsSync)(wfDir)) return [];
-    return (0, import_node_fs45.readdirSync)(wfDir).filter((name) => /\.(ya?ml)$/i.test(name)).filter((name) => {
+    if (!(0, import_node_fs46.existsSync)(wfDir)) return [];
+    return (0, import_node_fs46.readdirSync)(wfDir).filter((name) => /\.(ya?ml)$/i.test(name)).filter((name) => {
       try {
-        return workflowReportsPrChecks((0, import_node_fs45.readFileSync)((0, import_node_path44.join)(wfDir, name), "utf8"));
+        return workflowReportsPrChecks((0, import_node_fs46.readFileSync)((0, import_node_path44.join)(wfDir, name), "utf8"));
       } catch {
         return true;
       }
@@ -47389,7 +47572,7 @@ ${list}`);
   jsonParity(pr.command("review-verdict <number>").description("post an explicit review verdict comment: computes the PR diff patch-id and head sha, renders the v1 contract body, and posts it as a PR comment").requiredOption("--repo <owner/repo>", "target repo").requiredOption("--verdict <verdict>", `one of ${REVIEW_VERDICTS.join("|")}`).requiredOption("--scope <text>", "one line: what was reviewed").requiredOption("--risk <text>", "one line: the residual risk").option("--unverified <text>", "a claim the reviewer could not verify (repeatable)", (v, acc) => [...acc, v], []).requiredOption("--reviewer <id>", "reviewer seat or model id").option("--findings-file <path>", "Markdown findings appended after the JSON block")).action(async (number, o) => {
     if (!isReviewVerdict(o.verdict)) return fail(`pr review-verdict: --verdict must be one of ${REVIEW_VERDICTS.join("|")} (got ${o.verdict})`);
     const verdict = o.verdict;
-    const findings = o.findingsFile ? (0, import_node_fs45.readFileSync)(o.findingsFile, "utf8") : void 0;
+    const findings = o.findingsFile ? (0, import_node_fs46.readFileSync)(o.findingsFile, "utf8") : void 0;
     let patch;
     let head;
     try {
@@ -47645,7 +47828,7 @@ ${list}`);
     const cleanupMerged = async (r) => {
       if (opts.preserveWorktree) return "cleanup skipped (--preserve-worktree)";
       const ran = await execFileP(process.execPath, [process.argv[1], ...canonicalArgvFor(["pr", "merge", r.pr, "--repo", r.repo])], {
-        cwd: (0, import_node_fs45.existsSync)(cwd0) ? cwd0 : primaryRoot0,
+        cwd: (0, import_node_fs46.existsSync)(cwd0) ? cwd0 : primaryRoot0,
         timeout: GH_MUTATION_TIMEOUT_MS * 3
       }).then((x) => ({ stdout: x.stdout, stderr: x.stderr }), (e) => ({ stdout: e.stdout ?? "", stderr: e.stderr ?? "" }));
       const json = ran.stdout.split("\n").reverse().find((l) => l.startsWith("{"));
@@ -47715,7 +47898,7 @@ ${list}`);
     const mergeSquashBody = squashBodyTextForMerge(
       closingGuardInput,
       method === "--squash",
-      o.squashBodyFile ? (0, import_node_fs45.readFileSync)(o.squashBodyFile, "utf8") : void 0
+      o.squashBodyFile ? (0, import_node_fs46.readFileSync)(o.squashBodyFile, "utf8") : void 0
     );
     if (!o.squashBodyFile) warnSquashBodyClosingStrip("pr merge", closingGuardInput, mergeSquashBody);
     const closingGuardVerdict = evaluateClosingGuard(closingGuardInput, {
@@ -47866,7 +48049,7 @@ ${list}`);
         }
         if (!repoForPostCleanup) throw e;
         console.warn(`pr merge: gh GraphQL rate-limited \u2014 merging PR #${number} via REST PUT instead (#4588).`);
-        const commitMessage = bodyFile ? (0, import_node_fs45.readFileSync)(bodyFile, "utf8") : void 0;
+        const commitMessage = bodyFile ? (0, import_node_fs46.readFileSync)(bodyFile, "utf8") : void 0;
         await defaultGitHubClient().rest("PUT", `repos/${repoForPostCleanup}/pulls/${number}/merge`, {
           body: { merge_method: method.slice(2), ...commitMessage ? { commit_message: commitMessage } : {} },
           timeoutMs: GH_MUTATION_TIMEOUT_MS
@@ -47999,7 +48182,7 @@ ${list}`);
           preserveWorktree: o.preserveWorktree,
           gcAcknowledged: o.gc,
           expectedHeadOid: headRefOid,
-          pathExists: (p) => (0, import_node_fs45.existsSync)(p),
+          pathExists: (p) => (0, import_node_fs46.existsSync)(p),
           // #5899: pin cleanup git calls to the main checkout — the task worktree this process may be
           // standing in is removed mid-cleanup, so a cwd-relative invocation fails with
           // 'fatal: not a git repository' and leaves a spurious partial-cleanup exit.
@@ -49299,11 +49482,11 @@ function suiteTrainIo(root, summaryFile, memberSummaryFiles = {}, summaryFileTr,
   const checkout = async (repo) => {
     if (repo === SUITE_REPO) return root;
     const target = (0, import_node_path46.join)(base, repo.split("/")[1]);
-    if (!(0, import_node_fs46.existsSync)(target)) {
-      (0, import_node_fs46.mkdirSync)(base, { recursive: true });
+    if (!(0, import_node_fs47.existsSync)(target)) {
+      (0, import_node_fs47.mkdirSync)(base, { recursive: true });
       await exec("git", ["clone", "--quiet", "--branch", "development", `https://github.com/${repo}.git`, target], root, WATCH_TIMEOUT);
     }
-    if (!(0, import_node_fs46.existsSync)((0, import_node_path46.join)(target, ".git"))) throw new Error(`${repo}: suite checkout has no .git at ${target}; stop`);
+    if (!(0, import_node_fs47.existsSync)((0, import_node_path46.join)(target, ".git"))) throw new Error(`${repo}: suite checkout has no .git at ${target}; stop`);
     const origin = await exec("git", ["remote", "get-url", "origin"], target);
     if (!origin.toLowerCase().endsWith(`/${repo.toLowerCase()}.git`) && !origin.toLowerCase().endsWith(`/${repo.toLowerCase()}`))
       throw new Error(`${repo}: suite checkout origin mismatch at ${target}; stop`);
@@ -49610,9 +49793,9 @@ function suiteTrainIo(root, summaryFile, memberSummaryFiles = {}, summaryFileTr,
       const body = await gh(["release", "view", leadTag, "--repo", SUITE_REPO, "--json", "body", "--jq", ".body"]);
       if (parseSuiteMapping(body)) return;
       const dir = suiteStateDir(root);
-      (0, import_node_fs46.mkdirSync)(dir, { recursive: true });
+      (0, import_node_fs47.mkdirSync)(dir, { recursive: true });
       const file = (0, import_node_path46.join)(dir, `notes-${leadTag}.md`);
-      (0, import_node_fs46.writeFileSync)(file, `${body}
+      (0, import_node_fs47.writeFileSync)(file, `${body}
 
 ${suiteMappingBlock(leadTag, mapping)}`);
       await gh(["release", "edit", leadTag, "--repo", SUITE_REPO, "--notes-file", file]);
@@ -49653,7 +49836,7 @@ ${suiteMappingBlock(leadTag, mapping)}`);
 
 // src/suite-commands.ts
 init_cli_shared();
-var import_node_fs47 = require("node:fs");
+var import_node_fs48 = require("node:fs");
 function parseMemberSummaryFiles(entries) {
   const memberSummaryFiles = {};
   for (const entry of entries) {
@@ -49747,7 +49930,7 @@ function registerSuiteCommands(program3) {
       try {
         const io = suiteTrainIo(root);
         retired = await retireFailedLeadRcLedger({ ledgerPath: releaseLedgerPath(root), rcHead: () => io.head(SUITE_REPO, "rc").then((h) => h ?? void 0), markAbandoned: io.markAbandoned }, o.ownerGo === true);
-        if (retired && !(0, import_node_fs47.existsSync)(io.recordPath)) {
+        if (retired && !(0, import_node_fs48.existsSync)(io.recordPath)) {
           console.log(o.json ? JSON.stringify({ retiredLeadRc: retired }, null, 2) : `suite abandon: retired the lead's failed, never-promoted rc candidate ${retired}; marked abandoned on origin (#7854)`);
           return;
         }
@@ -49936,7 +50119,7 @@ function suiteStatusDeps(github, registry2) {
 
 // src/packages-adopt-export.ts
 var import_node_child_process19 = require("node:child_process");
-var import_node_fs48 = require("node:fs");
+var import_node_fs49 = require("node:fs");
 var import_node_os22 = require("node:os");
 var import_node_path47 = require("node:path");
 var import_node_util6 = require("node:util");
@@ -50560,36 +50743,36 @@ async function adoptExport(opts, deps) {
   if (!/^sha256:[0-9a-f]{64}$/.test(opts.digest)) throw new Error("--digest must be sha256:<64 hex>, from the export run summary");
   const packagePath = (0, import_node_path47.join)(opts.dir, "package.json");
   const lockPath = (0, import_node_path47.join)(opts.dir, "package-lock.json");
-  const packageText = (0, import_node_fs48.readFileSync)(packagePath, "utf8");
-  const lockText = (0, import_node_fs48.readFileSync)(lockPath, "utf8");
-  const work = (0, import_node_fs48.mkdtempSync)((0, import_node_path47.join)((0, import_node_os22.tmpdir)(), "mmi-adopt-export-"));
+  const packageText = (0, import_node_fs49.readFileSync)(packagePath, "utf8");
+  const lockText = (0, import_node_fs49.readFileSync)(lockPath, "utf8");
+  const work = (0, import_node_fs49.mkdtempSync)((0, import_node_path47.join)((0, import_node_os22.tmpdir)(), "mmi-adopt-export-"));
   try {
     const run = JSON.parse((await deps.ghApi(`repos/${EXPORT_REPO}/actions/runs/${opts.run}`)).toString("utf8"));
-    (0, import_node_fs48.writeFileSync)((0, import_node_path47.join)(work, "expected.json"), JSON.stringify(expectedFromRun(run, opts)));
-    (0, import_node_fs48.writeFileSync)((0, import_node_path47.join)(work, "provider.json"), await deps.ghApi(`repos/${EXPORT_REPO}/actions/artifacts/${opts.artifact}`));
-    (0, import_node_fs48.writeFileSync)((0, import_node_path47.join)(work, "artifact.zip"), await deps.ghApi(`repos/${EXPORT_REPO}/actions/artifacts/${opts.artifact}/zip`));
+    (0, import_node_fs49.writeFileSync)((0, import_node_path47.join)(work, "expected.json"), JSON.stringify(expectedFromRun(run, opts)));
+    (0, import_node_fs49.writeFileSync)((0, import_node_path47.join)(work, "provider.json"), await deps.ghApi(`repos/${EXPORT_REPO}/actions/artifacts/${opts.artifact}`));
+    (0, import_node_fs49.writeFileSync)((0, import_node_path47.join)(work, "artifact.zip"), await deps.ghApi(`repos/${EXPORT_REPO}/actions/artifacts/${opts.artifact}/zip`));
     const script = (0, import_node_path47.join)(work, "package_export.py");
-    (0, import_node_fs48.writeFileSync)(script, package_export_default);
+    (0, import_node_fs49.writeFileSync)(script, package_export_default);
     await deps.python(script, ["verify", work, opts.ds, opts.screens]);
     const verified = (0, import_node_path47.join)(work, "verified");
-    const metadata = Object.fromEntries(PACKAGES.map(({ name, short: short3 }) => [name, JSON.parse((0, import_node_fs48.readFileSync)((0, import_node_path47.join)(verified, `${short3}.metadata.json`), "utf8"))]));
+    const metadata = Object.fromEntries(PACKAGES.map(({ name, short: short3 }) => [name, JSON.parse((0, import_node_fs49.readFileSync)((0, import_node_path47.join)(verified, `${short3}.metadata.json`), "utf8"))]));
     const plan = planAdoption(packageText, lockText, metadata);
     for (const { name } of plan.result.adopted) {
       const short3 = PACKAGES.find((p) => p.name === name).short;
       await deps.npm(["cache", "add", (0, import_node_path47.join)(verified, `${short3}.tgz`)], opts.dir);
     }
-    (0, import_node_fs48.writeFileSync)(packagePath, plan.packageText);
-    (0, import_node_fs48.writeFileSync)(lockPath, plan.lockText);
+    (0, import_node_fs49.writeFileSync)(packagePath, plan.packageText);
+    (0, import_node_fs49.writeFileSync)(lockPath, plan.lockText);
     try {
       await deps.npm(["ci", "--offline", "--ignore-scripts", "--no-audit", "--no-fund"], opts.dir);
     } catch (error) {
-      (0, import_node_fs48.writeFileSync)(packagePath, packageText);
-      (0, import_node_fs48.writeFileSync)(lockPath, lockText);
+      (0, import_node_fs49.writeFileSync)(packagePath, packageText);
+      (0, import_node_fs49.writeFileSync)(lockPath, lockText);
       throw new Error(`npm ci --offline failed, package.json and package-lock.json restored: ${error.message}`);
     }
     return plan.result;
   } finally {
-    (0, import_node_fs48.rmSync)(work, { recursive: true, force: true });
+    (0, import_node_fs49.rmSync)(work, { recursive: true, force: true });
   }
 }
 var execFileBuffer = (0, import_node_util6.promisify)(import_node_child_process19.execFile);
@@ -50654,12 +50837,12 @@ function registerPackagesCommands(program3) {
 init_cli_shared();
 
 // src/wave-status.ts
-var import_node_fs49 = require("node:fs");
+var import_node_fs50 = require("node:fs");
 function readStageSummary(worktreePath) {
   const statePath = stageStatePath(worktreePath);
-  if (!(0, import_node_fs49.existsSync)(statePath)) return void 0;
+  if (!(0, import_node_fs50.existsSync)(statePath)) return void 0;
   try {
-    const state = JSON.parse((0, import_node_fs49.readFileSync)(statePath, "utf8"));
+    const state = JSON.parse((0, import_node_fs50.readFileSync)(statePath, "utf8"));
     const port = typeof state.port === "number" ? state.port : void 0;
     if (port == null || !Number.isInteger(port) || port <= 0) return void 0;
     return { port, url: typeof state.url === "string" ? state.url : void 0 };
@@ -50716,7 +50899,7 @@ async function collectWaveStatus(deps) {
 // src/discovery-commands.ts
 init_github_client();
 init_cli_shared();
-var import_node_fs50 = require("node:fs");
+var import_node_fs51 = require("node:fs");
 var import_node_os23 = require("node:os");
 var import_node_path48 = require("node:path");
 var GC_GH_TIMEOUT_MS3 = 2e4;
@@ -50909,8 +51092,8 @@ async function collectOnboardStatus(opts = {}) {
   }
   const home = (0, import_node_os23.homedir)();
   const plugin = onboardPluginGate({
-    readKnown: () => readFileSyncSafe((0, import_node_path48.join)(home, ...KNOWN_MARKETPLACES_RELATIVE), import_node_fs50.readFileSync),
-    readSettings: () => readFileSyncSafe((0, import_node_path48.join)(home, ".claude", "settings.json"), import_node_fs50.readFileSync)
+    readKnown: () => readFileSyncSafe((0, import_node_path48.join)(home, ...KNOWN_MARKETPLACES_RELATIVE), import_node_fs51.readFileSync),
+    readSettings: () => readFileSyncSafe((0, import_node_path48.join)(home, ".claude", "settings.json"), import_node_fs51.readFileSync)
   });
   return {
     guide: "Read the MMI org-guide skill before project work; load only the relevant topic. Use mmi-help for a short introduction.",
@@ -53104,7 +53287,7 @@ function registerOrgHealthQuery(program3, deps = defaultOrgHealthQueryDeps()) {
 }
 
 // src/api-read.ts
-var import_node_fs51 = require("node:fs");
+var import_node_fs52 = require("node:fs");
 
 // src/run-log-read.ts
 init_cli_shared();
@@ -53705,7 +53888,7 @@ function registerApiReadCommands(program3, overrides) {
         o.accept
       );
       if (zip) {
-        (0, import_node_fs51.writeFileSync)(o.out, body, "latin1");
+        (0, import_node_fs52.writeFileSync)(o.out, body, "latin1");
         return;
       }
     } catch (e) {
@@ -54580,7 +54763,7 @@ function registerSessionReport(program3) {
 }
 
 // src/stage-commands.ts
-var import_node_fs52 = require("node:fs");
+var import_node_fs53 = require("node:fs");
 var import_node_path49 = require("node:path");
 init_cli_shared();
 init_clean_exit();
@@ -54829,8 +55012,8 @@ function registerStageCommands(program3) {
     const repo = Array.isArray(project2?.repos) && typeof project2.repos[0] === "string" ? project2.repos[0] : slug;
     const resolution = decideStage({
       registry: { deployModel: project2?.deployModel, portRange, error: read.ok ? void 0 : read.error },
-      hasCompose: (0, import_node_fs52.existsSync)((0, import_node_path49.join)(process.cwd(), "docker-compose.yml")),
-      hasEnvExample: (0, import_node_fs52.existsSync)((0, import_node_path49.join)(process.cwd(), ".env.example")),
+      hasCompose: (0, import_node_fs53.existsSync)((0, import_node_path49.join)(process.cwd(), "docker-compose.yml")),
+      hasEnvExample: (0, import_node_fs53.existsSync)((0, import_node_path49.join)(process.cwd(), ".env.example")),
       repo
     });
     if (resolution.source === "derived" && resolution.derived) {
@@ -55123,14 +55306,14 @@ vercel preview (${preview.branch}): ${d.state}${d.url ? ` \u2014 ${d.url}` : ""}
 
 // src/tenant-artifact.ts
 var import_node_crypto17 = require("node:crypto");
-var import_node_fs53 = require("node:fs");
+var import_node_fs54 = require("node:fs");
 var import_promises11 = require("node:fs/promises");
 var import_node_path50 = require("node:path");
 var ARTIFACT_ID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
 var MAX_BYTES2 = 5 * 1024 * 1024 * 1024;
 async function sha256File(path2) {
   const hash = (0, import_node_crypto17.createHash)("sha256");
-  for await (const chunk of (0, import_node_fs53.createReadStream)(path2)) hash.update(chunk);
+  for await (const chunk of (0, import_node_fs54.createReadStream)(path2)) hash.update(chunk);
   return hash.digest("hex");
 }
 async function putTenantArtifact(repo, stage, inputPath, deps) {
@@ -55153,7 +55336,7 @@ async function putTenantArtifact(repo, stage, inputPath, deps) {
     return [key, value];
   }));
   headers["content-length"] = String(info.size);
-  const stream = (0, import_node_fs53.createReadStream)(path2);
+  const stream = (0, import_node_fs54.createReadStream)(path2);
   let uploaded;
   try {
     uploaded = await fetch(body.uploadUrl, {
@@ -55292,7 +55475,7 @@ function renderVerifySecrets(body) {
 }
 
 // src/command-register-developer.ts
-var import_node_fs57 = require("node:fs");
+var import_node_fs58 = require("node:fs");
 init_clean_exit();
 init_cli_shared();
 init_error_codes();
@@ -55360,13 +55543,13 @@ async function executeWaveLand(plan, deps) {
 // src/dist-drift.ts
 var import_node_child_process20 = require("node:child_process");
 var import_node_crypto19 = require("node:crypto");
-var import_node_fs55 = require("node:fs");
+var import_node_fs56 = require("node:fs");
 var import_node_os24 = require("node:os");
 var import_node_path52 = require("node:path");
 
 // ../scripts/distribution-digest.mjs
 var import_node_crypto18 = require("node:crypto");
-var import_node_fs54 = require("node:fs");
+var import_node_fs55 = require("node:fs");
 var import_node_path51 = require("node:path");
 var slash = (value) => value.replaceAll("\\", "/");
 function repoPath(root, declaredPath, label) {
@@ -55380,7 +55563,7 @@ function repoPath(root, declaredPath, label) {
 function digestFiles(files) {
   const hash = (0, import_node_crypto18.createHash)("sha256");
   for (const file of [...files].sort((a, b) => a.relative.localeCompare(b.relative))) {
-    const content = file.stat.isSymbolicLink() ? Buffer.from((0, import_node_fs54.readlinkSync)(file.absolute), "utf8") : (0, import_node_fs54.readFileSync)(file.absolute);
+    const content = file.stat.isSymbolicLink() ? Buffer.from((0, import_node_fs55.readlinkSync)(file.absolute), "utf8") : (0, import_node_fs55.readFileSync)(file.absolute);
     hash.update(file.relative, "utf8");
     hash.update("\0");
     hash.update(file.stat.isSymbolicLink() ? "symlink" : "file", "utf8");
@@ -55395,8 +55578,8 @@ function digestFiles(files) {
 function digestPackedFiles(packageRoot, packedFiles) {
   return digestFiles(packedFiles.map((path2) => {
     const absolute = repoPath(packageRoot, path2, "packed artifact identity path");
-    if (!(0, import_node_fs54.existsSync)(absolute)) throw new Error(`packed artifact identity path ${path2} does not exist`);
-    return { absolute, relative: slash(path2), stat: (0, import_node_fs54.lstatSync)(absolute) };
+    if (!(0, import_node_fs55.existsSync)(absolute)) throw new Error(`packed artifact identity path ${path2} does not exist`);
+    return { absolute, relative: slash(path2), stat: (0, import_node_fs55.lstatSync)(absolute) };
   }));
 }
 
@@ -55481,12 +55664,12 @@ function renderDistDriftReceipt(receipt) {
   return lines2;
 }
 function readOrNull(path2) {
-  return (0, import_node_fs55.existsSync)(path2) ? (0, import_node_fs55.readFileSync)(path2) : null;
+  return (0, import_node_fs56.existsSync)(path2) ? (0, import_node_fs56.readFileSync)(path2) : null;
 }
 function walkFiles(root) {
   const files = [];
   const walk2 = (directory) => {
-    for (const entry of (0, import_node_fs55.readdirSync)(directory, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
+    for (const entry of (0, import_node_fs56.readdirSync)(directory, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
       const child2 = (0, import_node_path52.join)(directory, entry.name);
       if (entry.isDirectory()) walk2(child2);
       else files.push(child2);
@@ -55497,7 +55680,7 @@ function walkFiles(root) {
 }
 function bomPathFor(root) {
   try {
-    const registry2 = JSON.parse((0, import_node_fs55.readFileSync)((0, import_node_path52.join)(root, "surfaces.json"), "utf8"));
+    const registry2 = JSON.parse((0, import_node_fs56.readFileSync)((0, import_node_path52.join)(root, "surfaces.json"), "utf8"));
     return (0, import_node_path52.join)(root, registry2?.sharedAgentCore?.releaseMetadata?.bomPath ?? "distribution-bom.json");
   } catch {
     return (0, import_node_path52.join)(root, "distribution-bom.json");
@@ -55513,7 +55696,7 @@ function rebuildTo(packageRoot, outDir) {
   });
 }
 function runDistStatus(root) {
-  const stage = (0, import_node_fs55.mkdtempSync)((0, import_node_path52.join)((0, import_node_os24.tmpdir)(), "mmi-dist-drift-"));
+  const stage = (0, import_node_fs56.mkdtempSync)((0, import_node_path52.join)((0, import_node_os24.tmpdir)(), "mmi-dist-drift-"));
   let overlayCount = 0;
   try {
     const cliOut = (0, import_node_path52.join)(stage, "cli-dist");
@@ -55529,19 +55712,19 @@ function runDistStatus(root) {
     const tree = (path2) => readOrNull((0, import_node_path52.join)(root, path2));
     const distRoot = (0, import_node_path52.join)(root, "cli", "dist");
     const distTree = () => walkFiles(distRoot).map((absolute) => `cli/dist/${(0, import_node_path52.relative)(distRoot, absolute).replaceAll("\\", "/")}`);
-    const bom = JSON.parse((0, import_node_fs55.readFileSync)(bomPathFor(root), "utf8"));
+    const bom = JSON.parse((0, import_node_fs56.readFileSync)(bomPathFor(root), "utf8"));
     const digest = (entries) => {
       const overlay = (0, import_node_path52.join)(stage, `overlay-${overlayCount++}`);
       for (const entry of entries) {
         const target = (0, import_node_path52.join)(overlay, entry.path);
-        (0, import_node_fs55.mkdirSync)((0, import_node_path52.dirname)(target), { recursive: true });
-        (0, import_node_fs55.writeFileSync)(target, entry.bytes);
+        (0, import_node_fs56.mkdirSync)((0, import_node_path52.dirname)(target), { recursive: true });
+        (0, import_node_fs56.writeFileSync)(target, entry.bytes);
       }
       return digestPackedFiles(overlay, entries.map((entry) => entry.path));
     };
     return computeDistDriftReceipt({ committed, tree, rebuilt, distTree, bom, digest });
   } finally {
-    (0, import_node_fs55.rmSync)(stage, { recursive: true, force: true });
+    (0, import_node_fs56.rmSync)(stage, { recursive: true, force: true });
   }
 }
 
@@ -55871,7 +56054,7 @@ function registerSchedulesLiftCommand(program3, deps = {}) {
 
 // src/spawn-policy-core.ts
 var import_node_child_process22 = require("node:child_process");
-var import_node_fs56 = require("node:fs");
+var import_node_fs57 = require("node:fs");
 var import_node_path55 = require("node:path");
 var SPAWNERS = ["spawn", "spawnSync", "exec", "execSync", "execFile", "execFileSync"];
 var CALL_SOURCE = String.raw`(^|[^.\w$])(${SPAWNERS.join("|")})\s*\(`;
@@ -55958,7 +56141,7 @@ function runSpawnPolicy(root) {
   for (const file of files) {
     let raw;
     try {
-      raw = (0, import_node_fs56.readFileSync)((0, import_node_path55.join)(root, file), "utf8");
+      raw = (0, import_node_fs57.readFileSync)((0, import_node_path55.join)(root, file), "utf8");
     } catch {
       continue;
     }
@@ -55979,18 +56162,18 @@ function registerDeveloperCommands(program3) {
   const rules = program3.command("rules").description("org-managed .gitignore delivery");
   rules.command("gitignore").option("--write", "upsert the managed block into .gitignore (default: check only, non-zero exit on drift)").option("--json", "machine-readable output").description("verify (or --write) this repo's org-managed .gitignore block matches the SSOT").action((opts) => {
     const path2 = (0, import_node_path56.join)(process.cwd(), ".gitignore");
-    const current = (0, import_node_fs57.existsSync)(path2) ? (0, import_node_fs57.readFileSync)(path2, "utf8") : null;
+    const current = (0, import_node_fs58.existsSync)(path2) ? (0, import_node_fs58.readFileSync)(path2, "utf8") : null;
     const plan = planManagedGitignore(current);
     const drift = [...plan.added.map((l) => `+${l}`), ...plan.removed.map((l) => `-${l}`)].join(", ") || "block normalize";
     if (opts.json) {
-      if (opts.write && plan.changed) (0, import_node_fs57.writeFileSync)(path2, plan.content, "utf8");
+      if (opts.write && plan.changed) (0, import_node_fs58.writeFileSync)(path2, plan.content, "utf8");
       console.log(JSON.stringify(plan, null, 2));
       if (!opts.write && plan.changed) process.exitCode = 1;
       return;
     }
     if (opts.write) {
       if (plan.changed) {
-        (0, import_node_fs57.writeFileSync)(path2, plan.content, "utf8");
+        (0, import_node_fs58.writeFileSync)(path2, plan.content, "utf8");
         console.log(`mmi-cli devops org rules gitignore: updated .gitignore (${drift})`);
       } else {
         console.log("mmi-cli devops org rules gitignore: up to date");
@@ -56199,17 +56382,18 @@ function registerDeveloperCommands(program3) {
     }
   });
   const tests = program3.command("tests").description("a repo's test-policy.json \u2014 the opt-in test contract and its enforcement");
-  tests.command("policy").description("enforce this repo's test-policy.json against the diff: a mandatory-zone change must carry a test, an unrequested new test file is refused, a `protected` test file may not be deleted or renamed away, and a `protected` entry naming a missing file is refused. Override any of them with a `Test-Policy-Override: <reason>` commit trailer (#3605)").option("--json", "machine-readable result: { ok, base, policySource: { ref, sha, path }, root, changedCount, mandatoryCount, matchedMandatoryCount, matchedMandatoryGlobs, testCommandsAllowed, testCommandNote, commandClasses, findings[] }").option("--base <ref>", "comparison base (default: TEST_POLICY_BASE, then origin/development, then origin/main)").option("--policy-ref <commit>", "load test-policy.json from the exact fetched origin/development commit and audit its protected/satisfiedBy paths against that commit's tree, not this checkout; valid only with --base origin/main").addOption(new Option("--repo <owner/repo>", "not accepted \u2014 tests policy reads the current checkout").hideHelp()).action(async (o) => {
+  tests.command("policy").description("enforce this repo's test-policy.json against the diff: a mandatory-zone change must carry a test, an unrequested new test file is refused, a `protected` test file may not be deleted or renamed away, and a `protected` entry naming a missing file is refused. Override any of them with a `Test-Policy-Override: <reason>` commit trailer (#3605)").option("--json", "compact machine-readable result: { ok, testCommandsAllowed, commandClasses, findings[] }").option("--verbose", "include the full policy result in --json output").option("--base <ref>", "comparison base (default: TEST_POLICY_BASE, then origin/development, then origin/main)").option("--policy-ref <commit>", "load test-policy.json from the exact fetched origin/development commit and audit its protected/satisfiedBy paths against that commit's tree, not this checkout; valid only with --base origin/main").addOption(new Option("--repo <owner/repo>", "not accepted \u2014 tests policy reads the current checkout").hideHelp()).action(async (o) => {
     try {
       if (o.repo) {
-        const rerun = `mmi-cli tests policy${o.base ? ` --base ${o.base}` : ""}${o.policyRef ? ` --policy-ref ${o.policyRef}` : ""}${o.json ? " --json" : ""}`;
+        const rerun = `mmi-cli tests policy${o.base ? ` --base ${o.base}` : ""}${o.policyRef ? ` --policy-ref ${o.policyRef}` : ""}${o.json ? " --json" : ""}${o.verbose ? " --verbose" : ""}`;
         const guard = planTrainApplyRepoGuard(o.repo, await resolveRepo(), rerun, "tests policy");
         if (!guard.ok) return failGraceful(guard.message);
       }
       const root = await repoRoot();
       const result = runTestPolicy(root, { base: o.base, policyRef: o.policyRef });
       if (o.json) {
-        consoleIo.log(JSON.stringify(result, null, 2));
+        const { ok, testCommandsAllowed, commandClasses, findings } = result;
+        consoleIo.log(o.verbose ? JSON.stringify(result, null, 2) : JSON.stringify({ ok, testCommandsAllowed, commandClasses, findings }));
         if (!result.ok) process.exitCode = 1;
         return;
       }
@@ -56407,7 +56591,7 @@ function mmiDoctorDeps(opts = {}) {
       );
       const result = applyPluginCachePlan(
         plan,
-        (p) => (0, import_node_fs58.rmSync)(p, { recursive: true }),
+        (p) => (0, import_node_fs59.rmSync)(p, { recursive: true }),
         stagingApplyFsGuard(configRoot)
       );
       return {
@@ -56442,7 +56626,7 @@ function mmiDoctorDeps(opts = {}) {
     // has no generated routing index would
     // get a permanent — demanding an artifact it never asked for.
     docsIndexState: (root) => {
-      if (!(0, import_node_fs58.existsSync)((0, import_node_path57.join)(root, DOCS_INDEX_PATH))) return void 0;
+      if (!(0, import_node_fs59.existsSync)((0, import_node_path57.join)(root, DOCS_INDEX_PATH))) return void 0;
       const real = createDocsIndexDeps(root);
       let docs;
       const listDocs = () => docs ??= real.listDocs();
@@ -56451,7 +56635,7 @@ function mmiDoctorDeps(opts = {}) {
     },
     // #4168: working-tree heal — write if drifted, then re-check. Commit remains the operator's step.
     healDocsIndex: (root) => {
-      if (!(0, import_node_fs58.existsSync)((0, import_node_path57.join)(root, DOCS_INDEX_PATH))) return { drift: false, docCount: 0 };
+      if (!(0, import_node_fs59.existsSync)((0, import_node_path57.join)(root, DOCS_INDEX_PATH))) return { drift: false, docCount: 0 };
       const real = createDocsIndexDeps(root);
       let docs;
       const listDocs = () => docs ??= real.listDocs();
@@ -56811,6 +56995,7 @@ function appActorDeps() {
   };
 }
 setPollTokenProvider(async () => activeAppToken() ?? pollTokenOrUndefined(appActorDeps()));
+setGhReadTokenProvider(pollToken);
 setStatusWriteTokenProvider(() => mintStatusWriteToken(appActorDeps()));
 var registerPreAction = Reflect.get(program2, ["h", "ook"].join(""));
 registerPreAction.call(program2, "preAction", async (_thisCommand, actionCommand) => {
@@ -56818,7 +57003,7 @@ registerPreAction.call(program2, "preAction", async (_thisCommand, actionCommand
   appActorCommand = commandPath3;
   emitCliCallTelemetry(commandPath3);
   try {
-    await activateAppActor(commandPath3, process.env, () => mintInstallationToken(appActorDeps()));
+    await activateAppActor(commandPath3, process.env, () => APP_WRITE_COMMANDS.has(commandPath3) ? mintCommandWriteToken(appActorDeps(), commandPath3) : mintInstallationToken(appActorDeps()));
   } catch (e) {
     if (e instanceof AppActorError) return fail(e.message);
     throw e;
@@ -57176,7 +57361,7 @@ project.command("set [owner/repo]").description("upsert project META (idempotent
   if (dupe) return fail(`org project set: KEY "${dupe}" was passed to both --var and --set; --set is an alias of --var, so pass each KEY once`);
   if (o.secretsFile) {
     try {
-      vars.push(`secrets=${(0, import_node_fs58.readFileSync)(o.secretsFile, "utf8")}`);
+      vars.push(`secrets=${(0, import_node_fs59.readFileSync)(o.secretsFile, "utf8")}`);
     } catch (e) {
       return fail(`org project set: cannot read --secrets-file ${o.secretsFile}: ${e.message}`);
     }
@@ -57568,15 +57753,15 @@ function ciAuditDeps2() {
     readSeedFile: (path2) => {
       if (!root) return null;
       const fullPath = (0, import_node_path57.join)(root, path2);
-      return (0, import_node_fs58.existsSync)(fullPath) ? (0, import_node_fs58.readFileSync)(fullPath, "utf8") : null;
+      return (0, import_node_fs59.existsSync)(fullPath) ? (0, import_node_fs59.readFileSync)(fullPath, "utf8") : null;
     }
   };
 }
 function hubRoot2() {
   const fromPkg = (0, import_node_path57.join)(__dirname, "..", "..");
   const marker = "skills/bootstrap/seeds/manifest.json";
-  if ((0, import_node_fs58.existsSync)((0, import_node_path57.join)(fromPkg, marker))) return fromPkg;
-  if ((0, import_node_fs58.existsSync)((0, import_node_path57.join)(process.cwd(), marker))) return process.cwd();
+  if ((0, import_node_fs59.existsSync)((0, import_node_path57.join)(fromPkg, marker))) return fromPkg;
+  if ((0, import_node_fs59.existsSync)((0, import_node_path57.join)(process.cwd(), marker))) return process.cwd();
   return null;
 }
 registerQueryCommands(program2);
@@ -57590,6 +57775,7 @@ registerDiscoveryCommands(program2);
 registerExplainCommand(program2);
 registerPrLifecycleCommands(program2);
 registerApiReadCommands(program2);
+registerGithubBudgetCommand(program2, appActorDeps);
 registerAppReadBrokerCommands(program2, async (repo) => requireRepo(repo));
 var prBrokerRoot = program2.commands.find((c) => c.name() === "pr");
 if (!prBrokerRoot) throw new Error("read broker: pr root must be registered before pr checks-required");
@@ -57706,10 +57892,10 @@ access.command("audit").description("audit collaborator roles + train-branch pus
     targets = resolution.targets;
   }
   const derivedMatrix = registryProjects ? accessMatrixFromProjects(registryProjects) : {};
-  const fileMatrix = (0, import_node_fs58.existsSync)("access-matrix.json") ? loadAccessMatrix((0, import_node_fs58.readFileSync)("access-matrix.json", "utf8")) : {};
+  const fileMatrix = (0, import_node_fs59.existsSync)("access-matrix.json") ? loadAccessMatrix((0, import_node_fs59.readFileSync)("access-matrix.json", "utf8")) : {};
   const matrix = mergeAccessMatrix(fileMatrix, derivedMatrix);
   const dataAccess = registryProjects ? dataAccessContractsFromProjects(registryProjects) : { consumers: {} };
-  const sanctioned = (0, import_node_fs58.existsSync)("access-matrix.json") ? loadSanctionedAdmins((0, import_node_fs58.readFileSync)("access-matrix.json", "utf8")) : {};
+  const sanctioned = (0, import_node_fs59.existsSync)("access-matrix.json") ? loadSanctionedAdmins((0, import_node_fs59.readFileSync)("access-matrix.json", "utf8")) : {};
   const report = await auditOrgAccess(targets, deps, matrix, dataAccess, sanctioned);
   console.log(o.json ? JSON.stringify(report, null, 2) : renderAccessReport(report));
   if (!report.ok) process.exitCode = 1;
@@ -57740,7 +57926,7 @@ function directoryBytes(path2) {
   let total = 0;
   let entries;
   try {
-    entries = (0, import_node_fs58.readdirSync)(path2, { withFileTypes: true });
+    entries = (0, import_node_fs59.readdirSync)(path2, { withFileTypes: true });
   } catch {
     return 0;
   }
@@ -57749,7 +57935,7 @@ function directoryBytes(path2) {
     if (entry.isDirectory()) total += directoryBytes(child2);
     else {
       try {
-        total += (0, import_node_fs58.statSync)(child2).size;
+        total += (0, import_node_fs59.statSync)(child2).size;
       } catch {
       }
     }
@@ -57757,25 +57943,25 @@ function directoryBytes(path2) {
   return total;
 }
 function listDirEntries(dir) {
-  return (0, import_node_fs58.readdirSync)(dir, { withFileTypes: true }).map((d) => ({ name: d.name, isDirectory: d.isDirectory() }));
+  return (0, import_node_fs59.readdirSync)(dir, { withFileTypes: true }).map((d) => ({ name: d.name, isDirectory: d.isDirectory() }));
 }
 function readInstalledPluginRefs(configRoot) {
   const p = installedPluginsPathForConfig(configRoot);
-  if (!(0, import_node_fs58.existsSync)(p)) return [];
+  if (!(0, import_node_fs59.existsSync)(p)) return [];
   try {
-    return installedPluginPaths((0, import_node_fs58.readFileSync)(p, "utf8"));
+    return installedPluginPaths((0, import_node_fs59.readFileSync)(p, "utf8"));
   } catch {
     return null;
   }
 }
 function pluginCacheFsDeps(configRoot, dirBytes) {
   return {
-    exists: (p) => (0, import_node_fs58.existsSync)(p),
-    listVersionDirs: (root) => (0, import_node_fs58.readdirSync)(root, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name),
+    exists: (p) => (0, import_node_fs59.existsSync)(p),
+    listVersionDirs: (root) => (0, import_node_fs59.readdirSync)(root, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name),
     dirBytes,
-    listStagingDirs: (root) => (0, import_node_fs58.readdirSync)(root, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => {
+    listStagingDirs: (root) => (0, import_node_fs59.readdirSync)(root, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => {
       try {
-        return { name: d.name, mtimeMs: newestMtimeMs((0, import_node_path57.join)(root, d.name), listDirEntries, (p) => (0, import_node_fs58.statSync)(p).mtimeMs) };
+        return { name: d.name, mtimeMs: newestMtimeMs((0, import_node_path57.join)(root, d.name), listDirEntries, (p) => (0, import_node_fs59.statSync)(p).mtimeMs) };
       } catch {
         return { name: d.name, mtimeMs: Date.now() };
       }
@@ -57790,9 +57976,9 @@ function stagingApplyFsGuard(configRoot) {
     referencedPaths: () => readInstalledPluginRefs(configRoot),
     mtimeMs: (name) => {
       const p = (0, import_node_path57.join)(stagingRoot, name);
-      if (!(0, import_node_fs58.existsSync)(p)) return null;
+      if (!(0, import_node_fs59.existsSync)(p)) return null;
       try {
-        return newestMtimeMs(p, listDirEntries, (q) => (0, import_node_fs58.statSync)(q).mtimeMs);
+        return newestMtimeMs(p, listDirEntries, (q) => (0, import_node_fs59.statSync)(q).mtimeMs);
       } catch {
         return null;
       }
@@ -57818,7 +58004,7 @@ program2.command("plugin-prune").description(`prune stale cached MMI plugin vers
     { withBytes: true, configRoot, includeStaging: surface !== "codex" }
   );
   const anythingToDelete = plan.prune.length > 0 || plan.staging.length > 0;
-  const result = o.apply && anythingToDelete ? applyPluginCachePlan(plan, (p) => (0, import_node_fs58.rmSync)(p, { recursive: true, force: true }), stagingApplyFsGuard(configRoot)) : void 0;
+  const result = o.apply && anythingToDelete ? applyPluginCachePlan(plan, (p) => (0, import_node_fs59.rmSync)(p, { recursive: true, force: true }), stagingApplyFsGuard(configRoot)) : void 0;
   const warnings = plan.prune.length > 0 ? [CONCURRENT_SESSION_WARNING] : [];
   if (o.json) console.log(JSON.stringify({ ...plan, warnings, applied: result ?? null }));
   else console.log(renderPluginCachePlan(plan, result));