@mutmutco/claude-plugin 4.5.161 → 4.5.162

package/cli/dist/main.cjs

@@ -76,19 +76,19 @@ function hardExit(code) {
   process.exit(code);
 }
 function flushStream(stream) {
-  return new Promise((resolve8) => {
+  return new Promise((resolve7) => {
     try {
-      stream.write("", () => resolve8());
+      stream.write("", () => resolve7());
     } catch {
-      resolve8();
+      resolve7();
     }
   });
 }
 async function flushStdio(timeoutMs = STDIO_FLUSH_TIMEOUT_MS) {
   await Promise.race([
     Promise.all([flushStream(process.stdout), flushStream(process.stderr)]),
-    new Promise((resolve8) => {
-      setTimeout(resolve8, timeoutMs).unref?.();
+    new Promise((resolve7) => {
+      setTimeout(resolve7, timeoutMs).unref?.();
     })
   ]);
 }
@@ -96,7 +96,7 @@ async function cleanExit(code) {
   process.exitCode = code;
   await closeHttpPool();
   await flushStdio();
-  await new Promise((resolve8) => setImmediate(resolve8));
+  await new Promise((resolve7) => setImmediate(resolve7));
   return void 0;
 }
 async function finishCliRun(watchdogMs = CLI_EXIT_WATCHDOG_MS) {
@@ -590,6 +590,11 @@ var init_github_client = __esm({
 });
 
 // src/gh-read-route.ts
+function isAppFilingWrite(args) {
+  if (args.some((a) => VIEWER.test(a))) return false;
+  const [group, verb] = args;
+  return (group === "issue" || group === "label") && verb === "create";
+}
 function isViewerFreeGhRead(args) {
   if (args.some((a) => VIEWER.test(a))) return false;
   const [group, verb] = args;
@@ -692,7 +697,7 @@ function rateLimitedReceipt(opts) {
   };
 }
 async function runWithRateLimitBackoff(operation, opts) {
-  const sleep2 = opts.sleep ?? ((ms) => new Promise((resolve8) => setTimeout(resolve8, ms)));
+  const sleep2 = opts.sleep ?? ((ms) => new Promise((resolve7) => setTimeout(resolve7, ms)));
   const now = opts.now ?? Date.now;
   const log = opts.log ?? ((message2) => console.warn(message2));
   const capMs = opts.capMs ?? RATE_LIMIT_WAIT_CAP_MS;
@@ -782,7 +787,7 @@ async function fetchWithRetry(fetchImpl, url, init, opts = {}) {
   const attempts = opts.attempts ?? 3;
   const baseDelayMs = opts.baseDelayMs ?? 250;
   const retryOn = opts.retryOn ?? ((res) => res.status >= 500);
-  const sleep2 = opts.sleep ?? ((ms) => new Promise((resolve8) => setTimeout(resolve8, ms)));
+  const sleep2 = opts.sleep ?? ((ms) => new Promise((resolve7) => setTimeout(resolve7, ms)));
   let lastErr;
   for (let i = 0; i < attempts; i++) {
     const isLast = i === attempts - 1;
@@ -1109,8 +1114,8 @@ async function readStdin(opts = {}) {
   })().catch(() => {
   });
   let timer;
-  const timeout = new Promise((resolve8) => {
-    timer = setTimeout(resolve8, timeoutMs);
+  const timeout = new Promise((resolve7) => {
+    timer = setTimeout(resolve7, timeoutMs);
   });
   try {
     await Promise.race([drain, timeout]);
@@ -1161,11 +1166,21 @@ __export(cli_shared_exports, {
   readStdin: () => readStdin,
   repoProject: () => repoProject,
   setGhReadTokenProvider: () => setGhReadTokenProvider,
+  setGhWriteTokenProvider: () => setGhWriteTokenProvider,
   setInjectedStdin: () => setInjectedStdin
 });
 function setGhReadTokenProvider(provider) {
   ghReadTokenProvider = provider;
 }
+function setGhWriteTokenProvider(provider) {
+  ghWriteTokenProvider = provider;
+}
+async function ghFilingAppEnv(file, args) {
+  if (!ghWriteTokenProvider || !/(^|[\\/])gh(\.exe)?$/i.test(file) || process.env.MMI_ACTOR?.trim() === "personal") return void 0;
+  if (!isAppFilingWrite(args)) return void 0;
+  const token = await ghWriteTokenProvider().catch(() => void 0);
+  return token ? { ...process.env, GH_TOKEN: token } : void 0;
+}
 async function ghReadAppEnv(file, args) {
   if (!ghReadTokenProvider || !/(^|[\\/])gh(\.exe)?$/i.test(file) || process.env.MMI_ACTOR?.trim() === "personal") return void 0;
   if (!isViewerFreeGhRead(args)) return void 0;
@@ -1187,12 +1202,12 @@ function killProcessTree(pid) {
 function execFileHard(file, args, options) {
   const { timeout, step, ...rest } = options;
   const started = Date.now();
-  return new Promise((resolve8, reject) => {
+  return new Promise((resolve7, reject) => {
     const child2 = (0, import_node_child_process2.execFile)(file, args, { encoding: "utf8", windowsHide: true, ...rest, timeout: 0 }, (error, stdout, stderr) => {
       clearTimeout(timer);
       if (expired) return;
       if (error) reject(error);
-      else resolve8({ stdout: String(stdout), stderr: String(stderr) });
+      else resolve7({ stdout: String(stdout), stderr: String(stderr) });
     });
     let expired = false;
     const timer = setTimeout(() => {
@@ -1340,7 +1355,7 @@ function printLine(value) {
   (0, import_node_fs5.writeSync)(1, `${value}
 `);
 }
-var import_node_child_process2, import_node_fs5, import_node_util3, rawExecFileP, DEFAULT_EXEC_TIMEOUT_MS, execFileP, ghReadTokenProvider, GIT_TIMEOUT_MS, ExecDeadlineError, cachedGithubLogin, gitOut, consoleIo;
+var import_node_child_process2, import_node_fs5, import_node_util3, rawExecFileP, DEFAULT_EXEC_TIMEOUT_MS, execFileP, ghReadTokenProvider, ghWriteTokenProvider, GIT_TIMEOUT_MS, ExecDeadlineError, cachedGithubLogin, gitOut, consoleIo;
 var init_cli_shared = __esm({
   "src/cli-shared.ts"() {
     "use strict";
@@ -1364,7 +1379,7 @@ var init_cli_shared = __esm({
         // promisify(execFile)'s overloads widen to string|Buffer when options is spread in.
         rawExecFileP(file, args, { encoding: "utf8", windowsHide: true, timeout: DEFAULT_EXEC_TIMEOUT_MS, killSignal: "SIGTERM", ...options, ...env ? { env } : {} })
       );
-      const appEnv = options.env ? void 0 : await ghReadAppEnv(file, args);
+      const appEnv = options.env ? void 0 : await ghReadAppEnv(file, args) ?? await ghFilingAppEnv(file, args);
       if (!appEnv) return run();
       try {
         return await run(appEnv);
@@ -6664,7 +6679,6 @@ var import_node_fs14 = require("node:fs");
 var import_node_path11 = require("node:path");
 var PLAN_ADVISORY_AGE_MS = 30 * 24 * 36e5;
 var ROOT_SCRATCH_STALE_MS = 24 * 36e5;
-var SCRATCH_GC_THROTTLE_MS = 24 * 36e5;
 function executeScratchGc(repoRoot2, opts, now = Date.now()) {
   const snap = collectScratchSnapshot(repoRoot2);
   const plan = planScratchGc(snap, now);
@@ -7239,7 +7253,9 @@ async function mintInstallationToken(deps) {
   return mintScopedInstallationToken(deps, APP_POLL_PERMISSIONS);
 }
 var APP_WRITE_COMMANDS = /* @__PURE__ */ new Map([
-  ["issue comment", { metadata: "read", issues: "write", pull_requests: "write" }]
+  ["issue comment", { metadata: "read", issues: "write", pull_requests: "write" }],
+  // #8401: the detached related-issue lookup (issue list/view reads + one marker comment) — no identity contract.
+  ["issue discover-related", { metadata: "read", issues: "write" }]
 ]);
 async function mintCommandWriteToken(deps, commandPath3) {
   const permissions = APP_WRITE_COMMANDS.get(commandPath3);
@@ -7251,6 +7267,14 @@ async function mintCommandWriteToken(deps, commandPath3) {
     throw new AppActorError(`app actor: write token mint failed (${e?.constructor?.name ?? "Error"})`);
   }
 }
+async function mintFilingWriteToken(deps) {
+  try {
+    return await mintFromMember(deps, { metadata: "read", issues: "write" }, APP_VAULT_KEYS);
+  } catch (e) {
+    if (e instanceof AppActorError) throw e;
+    throw new AppActorError(`app actor: filing token mint failed (${e?.constructor?.name ?? "Error"})`);
+  }
+}
 async function mintStatusWriteToken(deps) {
   return mintScopedInstallationToken(deps, { metadata: "read", statuses: "write" });
 }
@@ -8201,7 +8225,7 @@ async function readRestPrSnapshotWithRetry(prNumber, repo, gh2 = defaultGhApi, o
   const retries = options?.retries ?? PR_SNAPSHOT_READ_RETRIES;
   const untilMs = options?.retryTransientUntilMs;
   const delayMs = options?.delayMs ?? (untilMs !== void 0 ? PR_CHECKS_POLL_MS : PR_SNAPSHOT_READ_DELAY_MS);
-  const sleep2 = options?.sleep ?? ((ms) => new Promise((resolve8) => setTimeout(resolve8, ms)));
+  const sleep2 = options?.sleep ?? ((ms) => new Promise((resolve7) => setTimeout(resolve7, ms)));
   const now = options?.now ?? (() => Date.now());
   let lastError = "no attempt completed";
   let attempt = 0;
@@ -10181,15 +10205,15 @@ async function postJson(pathSuffix, payload, deps, method = "POST", opts = {}) {
     return { ok: false, status: 0, body: null, error: e.message, unreachable: "transport" };
   }
 }
-async function edgeDnsForStage(slug, stage, deps, ensure = false) {
+async function edgeDnsForStage(slug, stage, deps, ensure = false, deletion) {
   if (!deps.baseUrl) throw new Error("Hub API URL unavailable");
   const token = await deps.token();
   if (!token) throw new Error("Hub session token unavailable");
   const path2 = `/projects/${encodeURIComponent(slug)}/edge-dns/${stage}`;
   let body;
-  if (ensure) {
-    const write = await postJson(path2, {}, deps, "POST", { noRetry: true });
-    if (!write.ok) throw new Error(`Hub edge dns ensure failed: ${write.error ?? `HTTP ${write.status}`}`);
+  if (ensure || deletion) {
+    const write = await postJson(path2, deletion ?? {}, deps, deletion ? "DELETE" : "POST", { noRetry: true });
+    if (!write.ok) throw new Error(`Hub edge dns ${deletion ? "delete" : "ensure"} failed: ${write.error ?? `HTTP ${write.status}`}`);
     body = write.body;
   } else {
     const res = await retriedFetch(
@@ -10203,6 +10227,20 @@ async function edgeDnsForStage(slug, stage, deps, ensure = false) {
   if (typeof body?.required !== "boolean") throw new Error("Hub edge dns response invalid");
   return body;
 }
+async function boxPreviewsForHost(box, opts, deps) {
+  const payload = {
+    box,
+    ...opts.portStart !== void 0 ? { portStart: opts.portStart } : {},
+    ...opts.cap !== void 0 ? { cap: opts.cap } : {},
+    apply: opts.apply === true
+  };
+  const write = await postJson("/projects/box-previews", payload, deps, "POST", { noRetry: opts.apply === true });
+  if (!write.ok) {
+    const detail = write.body?.error;
+    throw new Error(`Hub box previews failed: ${detail ?? write.error ?? `HTTP ${write.status}`}`);
+  }
+  return write.body;
+}
 async function edgeCertificateForStage(slug, stage, deps, ensure = false) {
   if (!deps.baseUrl) throw new Error("Hub API URL unavailable");
   const token = await deps.token();
@@ -12063,7 +12101,7 @@ async function createPrViaRestFallback(args, swappedArgs, deps, knownPools) {
 }
 async function ghCreate(args, deps = {}) {
   const exec3 = deps.exec ?? execFileP;
-  const sleep2 = deps.sleep ?? ((ms) => new Promise((resolve8) => setTimeout(resolve8, ms)));
+  const sleep2 = deps.sleep ?? ((ms) => new Promise((resolve7) => setTimeout(resolve7, ms)));
   const now = deps.now ?? Date.now;
   const read = deps.readFile ?? import_promises.readFile;
   const restCreatePr = deps.restCreatePr ?? ((input) => defaultRestCreatePr(exec3, input));
@@ -12891,8 +12929,8 @@ var PRE_SPAWN_DRAIN_TIMEOUT_MS = 2e3;
 async function drainHttpPoolBeforeSpawn() {
   const drained = await Promise.race([
     closeHttpPool().then(() => true),
-    new Promise((resolve8) => {
-      setTimeout(() => resolve8(false), PRE_SPAWN_DRAIN_TIMEOUT_MS).unref?.();
+    new Promise((resolve7) => {
+      setTimeout(() => resolve7(false), PRE_SPAWN_DRAIN_TIMEOUT_MS).unref?.();
     })
   ]);
   if (!drained) destroyHttpPool();
@@ -15580,7 +15618,7 @@ async function setBoardItemPriority(client, cfg, itemId, priority) {
   await updateItemSingleSelect(client, cfg.projectId, itemId, cfg.priorityFieldId, optionId);
   return cliPriorityToFieldName(priority);
 }
-var defaultRetrySleep = (ms) => new Promise((resolve8) => setTimeout(resolve8, ms));
+var defaultRetrySleep = (ms) => new Promise((resolve7) => setTimeout(resolve7, ms));
 async function resolveProjectItemIdWithRetry(client, cfg, selector, opts = {}) {
   const attempts = Math.max(1, opts.attempts ?? 5);
   const delayMs = opts.delayMs ?? 300;
@@ -16500,7 +16538,7 @@ function checkRunbookCoverage(docs, base, git3) {
       const globs = lines2.slice(heading.start, markerEnd - 1).flatMap((text) => /<!--\s*runbook-covers:\s*(.*?)\s*-->/.exec(text)?.[1].split(",").map((s) => s.trim()) ?? []);
       const affected = changed.filter((path2) => globs.some((glob) => matches(glob, path2)));
       if (affected.length && !ranges.some((r) => r.count > 0 && r.start < end && r.start + r.count > heading.start)) {
-        findings.push({ kind: "runbook-section-stale", doc, line: heading.start, detail: `${heading.title}: changed ${affected.join(", ")}; update this section or declare Runbook-Unaffected: <reason>` });
+        findings.push({ kind: "runbook-section-stale", doc, line: heading.start, detail: `${heading.title}: changed ${affected.join(", ")}; update this section or declare Runbook-Unaffected: <reason>`, section: { heading: heading.title, level: heading.level, startLine: heading.start, endLine: end - 1 }, sources: affected });
       }
     }
   }
@@ -18919,10 +18957,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.5.161",
-    tag: "v4.5.161",
-    commit: "236dbfae4af2",
-    npm: "@mutmutco/cli@4.5.161"
+    version: "4.5.162",
+    tag: "v4.5.162",
+    commit: "5d12949c1714",
+    npm: "@mutmutco/cli@4.5.162"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -18939,14 +18977,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.5.161"
+          v3Target: "v4.5.162"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.5.161 and redeploy the Hub Lambda from tag v4.5.161 (236dbfae4af2); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.5.161 (@mutmutco/cli@4.5.161, tag commit 236dbfae4af2 \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.5.162 and redeploy the Hub Lambda from tag v4.5.162 (5d12949c1714); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.5.162 (@mutmutco/cli@4.5.162, tag commit 5d12949c1714 \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -21033,7 +21071,7 @@ async function runMergeTreePreflight(deps, ours, theirs) {
 async function predictMergeConflicts(deps, ours, theirs) {
   return runMergeTreePreflight(deps, ours, theirs);
 }
-async function mergeWithToleratedResolution(deps, sourceRef, label, resolve8, extraTolerated = []) {
+async function mergeWithToleratedResolution(deps, sourceRef, label, resolve7, extraTolerated = []) {
   try {
     await deps.run("git", ["merge", sourceRef, "--no-edit"]);
     return;
@@ -21047,7 +21085,7 @@ async function mergeWithToleratedResolution(deps, sourceRef, label, resolve8, ex
       unmerged.length === 0 ? `${label} merge failed without conflicted paths \u2014 merge aborted; inspect the repo state and rerun` : `${label} merge conflicts on untolerated path(s): ${blocking.join(", ")} \u2014 merge aborted (the train is misaligned; reconcile the branches via an approved alignment PR, then rerun)`
     );
   }
-  await deps.run("git", ["checkout", `--${resolve8}`, "--", ...unmerged]);
+  await deps.run("git", ["checkout", `--${resolve7}`, "--", ...unmerged]);
   await deps.run("git", ["add", "--", ...unmerged]);
   await deps.run("git", ["commit", "--no-edit"]);
 }
@@ -21241,7 +21279,7 @@ var CORRELATE_SKEW_SLACK_MS = 1e4;
 var CORRELATE_PAGE_LIMIT = 50;
 var RUN_CONFIRM_ATTEMPTS = 3;
 var RUN_CONFIRM_DELAY_MS = 1e3;
-var defaultSleep = (ms) => new Promise((resolve8) => setTimeout(resolve8, ms));
+var defaultSleep = (ms) => new Promise((resolve7) => setTimeout(resolve7, ms));
 function resolveSleep(deps) {
   return deps.sleep ?? defaultSleep;
 }
@@ -21545,7 +21583,7 @@ async function enqueueAlignmentAutoMerge(deps, ctx, prNumber, prUrl, openedNote)
   }
   return { ...base, note: manual };
 }
-var ALIGNMENT_LAND_POLL_MS = 15e3;
+var ALIGNMENT_LAND_POLL_MS = 6e4;
 var ALIGNMENT_LAND_TIMEOUT_MS = 20 * 6e4;
 async function awaitAlignmentLanded(deps, ctx, leg, base, opts = {}) {
   if (leg.status !== "pr-pending" || !leg.autoMergeEnqueued || leg.prNumber === void 0) return leg;
@@ -23162,7 +23200,7 @@ async function runTenantReconcile(deps, options) {
   };
 }
 function tenantControlWatches(action) {
-  return action === "status" || action === "retire" || action === "verify-secrets" || action === "verify-broker" || action === "logs" || action === "run-task";
+  return action === "status" || action === "retire" || action === "undo" || action === "verify-secrets" || action === "verify-broker" || action === "logs" || action === "run-task";
 }
 async function runTenantControl(deps, options) {
   const { repo, stage, action } = options;
@@ -23809,8 +23847,6 @@ var import_node_path23 = require("node:path");
 // src/jerv-cli-spawn.ts
 var import_node_os13 = require("node:os");
 var import_node_path22 = require("node:path");
-init_cli_shared();
-var JERV_CLI_ENTRY = (0, import_node_path22.join)("node_modules", "@jervaise", "jerv-cli", "dist", "index.cjs");
 function pathEnvEntries(pathEnv, platform2 = process.platform) {
   if (platform2 !== "win32") {
     return pathEnv.split(import_node_path22.delimiter).map((e) => e.trim()).filter(Boolean);
@@ -24444,7 +24480,7 @@ function lockTokenPid(token) {
   const m = /^(\d+)-/.exec(token);
   return m ? Number(m[1]) : void 0;
 }
-var sleep = (ms) => new Promise((resolve8) => setTimeout(resolve8, ms));
+var sleep = (ms) => new Promise((resolve7) => setTimeout(resolve7, ms));
 var IMMEDIATE_RETRY_BUDGET = 3;
 var FileLockBusyError = class extends Error {
   lockPath;
@@ -25320,7 +25356,7 @@ async function defaultWatchRun(deps, runId, repo) {
   }
   let confirmError;
   for (let attempt = 0; attempt < RUN_CONFIRM_ATTEMPTS2; attempt++) {
-    if (attempt > 0) await new Promise((resolve8) => setTimeout(resolve8, RUN_CONFIRM_DELAY_MS2));
+    if (attempt > 0) await new Promise((resolve7) => setTimeout(resolve7, RUN_CONFIRM_DELAY_MS2));
     try {
       const parsed = JSON.parse(await deps.run("gh", ["run", "view", String(runId), "--repo", repo, "--json", "status,conclusion"]));
       if (parsed.status === "completed") return parsed.conclusion === "success" ? "success" : "failure";
@@ -26362,11 +26398,11 @@ var defaultDeps = {
   // #5813: the caller supplies that command line. `process.argv` is NOT it — the house shim splices
   // the house root out in place, so re-reading it here re-ran the removed flat alias (`release …`
   // instead of `devops release …`) and the converged child refused with exit 2.
-  reexec: (argv) => new Promise((resolve8) => {
+  reexec: (argv) => new Promise((resolve7) => {
     const args = [...argv];
     const child2 = isWin2 ? (0, import_node_child_process8.spawn)("cmd.exe", ["/c", "mmi-cli", ...args], { stdio: "inherit", windowsHide: true }) : (0, import_node_child_process8.spawn)("mmi-cli", args, { stdio: "inherit", windowsHide: true });
-    child2.on("exit", (code) => resolve8(code ?? 1));
-    child2.on("error", () => resolve8(1));
+    child2.on("exit", (code) => resolve7(code ?? 1));
+    child2.on("error", () => resolve7(1));
   }),
   // stderr only — stdout may be carrying --json output.
   warn: (line) => console.error(line)
@@ -26474,7 +26510,7 @@ var defaultDeps2 = {
     }
   },
   registryWhoami: probeRegistryWhoami,
-  sleep: (ms) => new Promise((resolve8) => setTimeout(resolve8, ms)),
+  sleep: (ms) => new Promise((resolve7) => setTimeout(resolve7, ms)),
   env: process.env
 };
 function message(e) {
@@ -32728,6 +32764,7 @@ function applyRemoteScript(items, date) {
 
 // src/box-commands.ts
 init_clean_exit();
+init_cli_shared();
 
 // src/secrets-commands.ts
 var import_node_fs31 = require("node:fs");
@@ -33603,6 +33640,14 @@ function buildSetDeployPatch(_slug, input) {
     if (!DEPLOY_DOMAIN_RE.test(a)) throw new Error(`org project set-deploy: --alias must be a DNS hostname, got ${JSON.stringify(a)}`);
   }
   const uniqueAliases = [...new Set(aliases)];
+  const redirectFrom = [...new Set((input.redirectFrom ?? []).map((a) => clean4(a)).filter((a) => a !== void 0))];
+  for (const entry of redirectFrom) {
+    const [host, target, extra] = entry.split("=");
+    if (!host || !DEPLOY_DOMAIN_RE.test(host) || extra !== void 0 || target !== void 0 && !DEPLOY_DOMAIN_RE.test(target)) throw new Error(`org project set-deploy: invalid --redirect-from ${JSON.stringify(entry)}`);
+    const serving = [domain, ...uniqueAliases].map((a) => a?.toLowerCase());
+    if (serving.includes(host.toLowerCase())) throw new Error("org project set-deploy: --redirect-from must not equal the primary domain or an alias");
+    if (target !== void 0 && domain !== void 0 && (input.aliases !== void 0 || input.clearAliases) && !serving.includes(target.toLowerCase())) throw new Error("org project set-deploy: --redirect-from target must be the primary domain or an alias");
+  }
   if (input.clearAliases && uniqueAliases.length) {
     throw new Error("org project set-deploy: --clear-aliases cannot be combined with --alias (they contradict)");
   }
@@ -33642,6 +33687,7 @@ function buildSetDeployPatch(_slug, input) {
     // #2986: an explicit `[]` is what the route reads as "clear them"; omitting the key is what it reads as
     // "keep them". Those are different instructions and they now have different flags.
     ...input.clearAliases ? { aliases: [] } : uniqueAliases.length ? { aliases: uniqueAliases } : {},
+    ...input.redirectFrom !== void 0 ? { redirectFrom } : {},
     ...input.noEnvFile !== void 0 ? { noEnvFile: input.noEnvFile } : {},
     // #7353: an explicit `[]` is what the route reads as "clear them"; omitting the key is what it reads as
     // "keep them" — same patch contract as aliases (#2986/#2984).
@@ -34404,6 +34450,48 @@ ${SSH_RECIPE_AGENT_NOTE}`);
       await failGraceful(e.message);
     }
   });
+  box.command("previews <name>").description("inspect or configure a box preview port range in BOX#<sshHost>/META (#8444; master-only, dry-run unless --apply)").option("--port-start <port>", "first port in the dedicated preview interval (>= 1024)", (v) => Number(v)).option("--cap <n>", "maximum concurrent PR previews on this box (1..20, default 3)", (v) => Number(v)).option("--apply", "write the preview port range to BOX#<sshHost>/META (default: dry-run)").option("--json", "machine-readable output").action(async (name, o) => {
+    try {
+      const { boxes, incomplete } = await fetchInventory();
+      const result = lookupBox(name, boxes, incomplete);
+      if (result.kind === "unknown") {
+        warnIncomplete(result.reasons);
+        await failGraceful(
+          `runtime box: cannot confirm whether '${name}' exists \u2014 part of the inventory could not be read (see above). Refusing to answer "no such box" from a list I know is incomplete.`
+        );
+        return;
+      }
+      if (result.kind === "absent") {
+        await failGraceful(`runtime box: no box named '${name}'. Known boxes: ${result.known.join(", ") || "(none)"}`);
+        return;
+      }
+      const found = result.box;
+      if (!found.address) {
+        await failGraceful(`runtime box previews: box '${found.name}' has no public IPv4 address`);
+        return;
+      }
+      const status = await boxPreviewsForHost(
+        found.address,
+        { portStart: o.portStart, cap: o.cap, apply: o.apply === true },
+        registryClientDeps(await loadConfig())
+      );
+      const fmt = (r) => r ? `${r.ports.start}..${r.ports.end} (portStart=${r.previewPortStart}, cap=${r.previewCap})` : "(unconfigured)";
+      if (o.json) {
+        console.log(JSON.stringify({ ...status, box: found.name, address: found.address, incomplete }, null, 2));
+      } else {
+        console.log(
+          `${found.name} (${found.address}) \u2014 ${status.apply ? "applied" : "dry-run"}
+  current: ${fmt(status.current)}
+  planned: ${fmt(status.planned)}
+  live reservations: ${status.activeReservations}`
+        );
+        warnIncomplete(incomplete);
+      }
+      if (incomplete.length) process.exitCode = 1;
+    } catch (e) {
+      await failGraceful(e.message);
+    }
+  });
   box.command("control <name>").description("box-side control files (#7402): --plan (default, read-only) reports drift from the repo; --apply --only <src> installs with backups").option("--plan", "read-only drift report (the default)").option("--apply", "install the files named by --only on this box, backing up each previous copy").option("--only <src>", "with --apply: a manifest src to install (repeatable; approval is file by file)", (v, acc) => [...acc, v], []).option("--dest <path>", "with --apply: a destination of a multi-target --only source to install (repeatable, #7409)", (v, acc) => [...acc, v], []).option("--all-targets", "with --apply: install a multi-target --only source to every one of its destinations on this box").option("--ref <ref>", "git ref the repo content is read from", "origin/development").option("--json", "machine-readable output").action(async (name, o) => {
     try {
       if (o.apply && o.plan) throw new UsageError("box control: --plan and --apply are exclusive");
@@ -38327,7 +38415,7 @@ Each module must ship a live release that bind-mounts <deployPath>/data read-onl
   let running = 0;
   const waiting = [];
   const results = await Promise.allSettled(record.members.map(async (member) => {
-    if (running >= 4) await new Promise((resolve8) => waiting.push(resolve8));
+    if (running >= 4) await new Promise((resolve7) => waiting.push(resolve7));
     else running++;
     try {
       if ((await deps.head(member.repo, "development"))?.toLowerCase() !== member.development.toLowerCase())
@@ -38998,7 +39086,7 @@ function clean3(out) {
   return out.trim();
 }
 function sleeper(deps) {
-  return deps.sleep ?? ((ms) => new Promise((resolve8) => setTimeout(resolve8, ms)));
+  return deps.sleep ?? ((ms) => new Promise((resolve7) => setTimeout(resolve7, ms)));
 }
 function normalizeHotfixVersion(input) {
   const m = /^v?(\d+\.\d+\.\d+)$/.exec(input.trim());
@@ -40672,7 +40760,7 @@ async function updatePrHeadFromBase(input) {
   } catch (e) {
     throw new Error(`GitHub could not update ${input.head} from ${input.base} (${e.message.trim()}) \u2014 ${remedy}`);
   }
-  const sleep2 = input.sleep ?? ((ms) => new Promise((resolve8) => setTimeout(resolve8, ms)));
+  const sleep2 = input.sleep ?? ((ms) => new Promise((resolve7) => setTimeout(resolve7, ms)));
   for (let attempt = 0; attempt < PR_HEAD_UPDATE_API_READ_RETRIES; attempt++) {
     const to = await readHead2();
     if (to && to !== from) return { from, to, base: input.base, via: "update-branch-api" };
@@ -40697,7 +40785,7 @@ async function mergeAutoWithTransientRetry(prNumber, repo, deps) {
   if (first.mergeStatus !== "failed") return first;
   const ready = await deps.probeMergeReady(prNumber, repo).catch(() => ({ open: false, mergeable: false, checksPassing: false }));
   if (!ready.open || !ready.mergeable || !ready.checksPassing) return first;
-  const sleep2 = deps.sleep ?? ((ms) => new Promise((resolve8) => setTimeout(resolve8, ms)));
+  const sleep2 = deps.sleep ?? ((ms) => new Promise((resolve7) => setTimeout(resolve7, ms)));
   await sleep2(PR_LAND_MERGE_RETRY_DELAY_MS);
   const retried = await deps.mergeAuto(prNumber, repo);
   if (retried.mergeStatus !== "failed") return retried;
@@ -40708,7 +40796,7 @@ var AUTO_MERGE_CONFIRM_DELAY_MS = 15e3;
 async function confirmAutoMergeEnqueued(deps, options) {
   const retries = options?.retries ?? AUTO_MERGE_CONFIRM_RETRIES;
   const delayMs = options?.delayMs ?? AUTO_MERGE_CONFIRM_DELAY_MS;
-  const sleep2 = deps.sleep ?? ((ms) => new Promise((resolve8) => setTimeout(resolve8, ms)));
+  const sleep2 = deps.sleep ?? ((ms) => new Promise((resolve7) => setTimeout(resolve7, ms)));
   for (let attempt = 0; attempt < retries; attempt++) {
     if (await deps.readMerged().catch(() => false)) return "merged";
     const stuck = await deps.readAutoMergeRequest().then((s) => s.trim()).catch(() => "");
@@ -40725,7 +40813,7 @@ async function confirmAutoMergeEnqueued(deps, options) {
 async function readGhPrStateWithRetry(fetchState, options) {
   const retries = options?.retries ?? PR_LAND_STATE_READ_RETRIES;
   const delayMs = options?.delayMs ?? PR_LAND_STATE_READ_DELAY_MS;
-  const sleep2 = options?.sleep ?? ((ms) => new Promise((resolve8) => setTimeout(resolve8, ms)));
+  const sleep2 = options?.sleep ?? ((ms) => new Promise((resolve7) => setTimeout(resolve7, ms)));
   let lastError = "empty state";
   for (let attempt = 0; attempt < retries; attempt++) {
     try {
@@ -40809,7 +40897,7 @@ async function runPrLand(prNumber, options, deps) {
       return queueMerged(base, deps);
     }
     const deadline = (deps.now ?? (() => Date.now()))() + (options.queueTimeoutMs ?? PR_LAND_QUEUE_TIMEOUT_MS);
-    await (deps.sleep ?? ((ms) => new Promise((resolve8) => setTimeout(resolve8, ms))))(deps.pollDelayMs?.(0) ?? PR_LAND_POLL_MS);
+    await (deps.sleep ?? ((ms) => new Promise((resolve7) => setTimeout(resolve7, ms))))(deps.pollDelayMs?.(0) ?? PR_LAND_POLL_MS);
     return pollPrMergeQueue(prNumber, options, deps, base, void 0, deadline);
   }
   if (merge.mergeStatus === "merged") {
@@ -40847,7 +40935,7 @@ function queueMerged(base, deps) {
 }
 async function pollPrMergeQueue(pr, options, deps, base, snapshot, deadlineMs) {
   const now = deps.now ?? (() => Date.now());
-  const sleep2 = deps.sleep ?? ((ms) => new Promise((resolve8) => setTimeout(resolve8, ms)));
+  const sleep2 = deps.sleep ?? ((ms) => new Promise((resolve7) => setTimeout(resolve7, ms)));
   const timeoutMs = options.queueTimeoutMs ?? PR_LAND_QUEUE_TIMEOUT_MS;
   const deadline = deadlineMs ?? now() + timeoutMs;
   let attempt = 0;
@@ -41990,7 +42078,7 @@ async function composeOverrideBodyFile(prNumber, repoArgs, gh2, opts) {
 async function ghAdminTrueMergeWhenClean(prNumber, repo, opts = {}) {
   const io = opts.io ?? defaultGhMergeAutoIo;
   const sleep2 = opts.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
-  const pollMs = opts.pollMs ?? 15e3;
+  const pollMs = opts.pollMs ?? 6e4;
   const deadline = Date.now() + (opts.timeoutMs ?? 20 * 6e4);
   for (; ; ) {
     const raw = await io.gh(["pr", "view", prNumber, "--repo", repo, "--json", "state,mergeStateStatus"], GC_GH_TIMEOUT_MS).catch(() => "");
@@ -44017,7 +44105,7 @@ var import_promises7 = require("node:fs/promises");
 init_cli_shared();
 init_error_codes();
 var GC_GH_TIMEOUT_MS2 = 2e4;
-var CHECKS_WATCH_POLL_MS = 15e3;
+var CHECKS_WATCH_POLL_MS = 6e4;
 var CHECKS_WATCH_TIMEOUT_MS = 10 * 6e4;
 function prCommentMarker(markerId) {
   return `<!-- mmi-pr-marker:${markerId} -->`;
@@ -44556,7 +44644,7 @@ async function checkPrReview(number, repo, head, deps = {
   }
 }
 function computePrPatchId(number, repo) {
-  return new Promise((resolve8, reject) => {
+  return new Promise((resolve7, reject) => {
     const gh2 = (0, import_node_child_process14.spawn)("gh", ["pr", "diff", number, "--repo", repo], { windowsHide: true, stdio: ["ignore", "pipe", "pipe"] });
     const git3 = (0, import_node_child_process14.spawn)("git", ["patch-id", "--stable"], { windowsHide: true, stdio: ["pipe", "pipe", "pipe"] });
     let out = "";
@@ -44594,7 +44682,7 @@ function computePrPatchId(number, repo) {
       if (gitCode !== 0) return reject(new Error(`git patch-id --stable exited ${gitCode}: ${gitErr.trim()}`));
       const id = out.trim().split(/\s+/)[0];
       if (!/^[0-9a-f]{40}$/.test(id ?? "")) return reject(new Error(`patch-id: PR #${number} diff is empty or unreadable (gh: ${ghErr.trim() || "no stderr"})`));
-      resolve8(id);
+      resolve7(id);
     };
     gh2.on("close", (code) => {
       ghCode = code;
@@ -44645,7 +44733,7 @@ init_cli_shared();
 var GIT_TIMEOUT_MS2 = 15e3;
 function catFileBatch(root, ref, paths) {
   if (paths.length === 0) return Promise.resolve([]);
-  return new Promise((resolve8) => {
+  return new Promise((resolve7) => {
     const chunks = [];
     let settled = false;
     const child2 = (0, import_node_child_process15.spawn)("git", ["-C", root, "cat-file", "--batch", "--buffer"], { windowsHide: true });
@@ -44653,7 +44741,7 @@ function catFileBatch(root, ref, paths) {
       if (settled) return;
       settled = true;
       clearTimeout(timer);
-      resolve8(parseCatFileBatch(Buffer.concat(chunks), paths.length));
+      resolve7(parseCatFileBatch(Buffer.concat(chunks), paths.length));
     };
     const timer = setTimeout(() => {
       child2.kill("SIGKILL");
@@ -45078,7 +45166,7 @@ function healthPollIntervalMs() {
   return HEALTH_POLL_INTERVAL_MS;
 }
 function waitForProcessStability(child2, graceMs = earlyExitGraceMs()) {
-  return new Promise((resolve8, reject) => {
+  return new Promise((resolve7, reject) => {
     let settled = false;
     const finish = (fn) => {
       if (settled) return;
@@ -45088,7 +45176,7 @@ function waitForProcessStability(child2, graceMs = earlyExitGraceMs()) {
       child2.removeAllListeners("exit");
       fn();
     };
-    const timer = setTimeout(() => finish(resolve8), graceMs);
+    const timer = setTimeout(() => finish(resolve7), graceMs);
     child2.on("error", (err) => finish(() => reject(new Error(`stage process failed to start: ${err.message}`))));
     child2.on("exit", (code, signal) => {
       const detail = code != null ? `code ${code}` : signal ? `signal ${signal}` : "unknown reason";
@@ -45281,10 +45369,10 @@ function pickStagePort(range, isFree) {
   throw new Error(`no free stage port in range ${start}-${end} \u2014 every port is in use`);
 }
 function isPortFree(port) {
-  return new Promise((resolve8) => {
+  return new Promise((resolve7) => {
     const srv = (0, import_node_net.createServer)();
-    srv.once("error", () => resolve8(false));
-    srv.once("listening", () => srv.close(() => resolve8(true)));
+    srv.once("error", () => resolve7(false));
+    srv.once("listening", () => srv.close(() => resolve7(true)));
     srv.listen(port, "127.0.0.1");
   });
 }
@@ -45562,7 +45650,7 @@ async function killTree(pid) {
     } catch {
     }
   }
-  await new Promise((resolve8) => setTimeout(resolve8, 500));
+  await new Promise((resolve7) => setTimeout(resolve7, 500));
   try {
     process.kill(-pid, "SIGKILL");
   } catch {
@@ -45635,7 +45723,7 @@ async function waitForHealth(url, timeoutMs, anyStatus = false) {
     } catch (e) {
       last = e.message;
     }
-    await new Promise((resolve8) => setTimeout(resolve8, healthPollIntervalMs()));
+    await new Promise((resolve7) => setTimeout(resolve7, healthPollIntervalMs()));
   }
   throw new Error(`stage health check timed out for ${url}${last ? ` (${last})` : ""}`);
 }
@@ -45822,7 +45910,7 @@ function unlinkNodeModulesJunction(wtPath) {
   }
 }
 function defaultSleep2(ms) {
-  return new Promise((resolve8) => setTimeout(resolve8, ms));
+  return new Promise((resolve7) => setTimeout(resolve7, ms));
 }
 async function removeResidueDirectory(wtPath, options = {}) {
   const { sleep: sleep2 = defaultSleep2, removeEmptyDir = import_node_fs44.rmdirSync, exists = import_node_fs44.existsSync } = options;
@@ -47572,7 +47660,7 @@ ${list}`);
       // #5400: after grace, name "GitHub delivered zero runs" instead of burning the full budget as pending.
       pollHeadWorkflowRunCount: () => waitLoopHeadWorkflowRunCount("pr checks-wait", number, repo),
       baseBranch,
-      sleep: (ms) => new Promise((resolve8) => setTimeout(resolve8, ms)),
+      sleep: (ms) => new Promise((resolve7) => setTimeout(resolve7, ms)),
       log: (message2) => console.warn(message2),
       timeoutMs: Math.max(1, budgetMs - (Date.now() - waitStarted)),
       // Liveness on stderr, one line per poll. A silent bounded wait is indistinguishable from a hang, and
@@ -47742,7 +47830,7 @@ ${list}`);
             // #5400: same zero-runs delivery probe as checks-wait — do not burn the land budget on silence.
             pollHeadWorkflowRunCount: () => waitLoopHeadWorkflowRunCount("pr land", prNumber, repo),
             baseBranch: "development",
-            sleep: (ms) => new Promise((resolve8) => setTimeout(resolve8, ms)),
+            sleep: (ms) => new Promise((resolve7) => setTimeout(resolve7, ms)),
             log: (message2) => console.warn(message2),
             // `pr land` inherits the same (raised) checks budget, so it needs the same liveness — otherwise the
             // 30m wait is SILENT and reads exactly like the hang #2940 was filed about, only three times longer.
@@ -47794,7 +47882,7 @@ ${list}`);
             } else {
               lastFailure = void 0;
             }
-            await new Promise((resolve8) => setTimeout(resolve8, PR_LAND_POLL_MS));
+            await new Promise((resolve7) => setTimeout(resolve7, PR_LAND_POLL_MS));
           }
           if (lastFailure) {
             throw new Error(
@@ -47985,7 +48073,7 @@ ${list}`);
         checksDiagnosticCommand: `gh pr checks ${number} --repo ${repo}`,
         pollHeadWorkflowRunCount: () => waitLoopHeadWorkflowRunCount("pr merge --wait", number, repo),
         baseBranch,
-        sleep: (ms) => new Promise((resolve8) => setTimeout(resolve8, ms)),
+        sleep: (ms) => new Promise((resolve7) => setTimeout(resolve7, ms)),
         log: (message2) => console.warn(message2),
         timeoutMs: Math.max(1, budgetMs - (Date.now() - waitStarted)),
         progress: ({ state, elapsedMs, remainingMs }) => console.warn(`pr merge: --wait checks \u2014 ${state}, ${Math.round(elapsedMs / 1e3)}s elapsed, ${Math.round(remainingMs / 6e4)}m left`)
@@ -48075,7 +48163,7 @@ ${list}`);
       }
       if (!o.auto && mergeRejectedBaseBranchModified(message2)) {
         console.warn(`pr merge: the base branch was modified by a concurrent merge \u2014 waiting ${PR_MERGE_BASE_RACE_RETRY_DELAY_MS / 1e3}s and retrying PR #${number}'s merge once (#6052).`);
-        await new Promise((resolve8) => setTimeout(resolve8, PR_MERGE_BASE_RACE_RETRY_DELAY_MS));
+        await new Promise((resolve7) => setTimeout(resolve7, PR_MERGE_BASE_RACE_RETRY_DELAY_MS));
         await execFileP("gh", buildPrMergeArgs({ number, repoArgs, method, auto: false, deleteBranch: false, bodyFile }), { timeout: GH_MUTATION_TIMEOUT_MS }).catch((e2) => {
           const m2 = String(e2.message || "");
           if (/already been merged/i.test(m2)) {
@@ -48337,7 +48425,7 @@ ${list}`);
           console.warn(`ci checks-wait: zero-runs probe FAILED (${read.error}) \u2014 not treating as delivery failure this cycle`);
           return null;
         },
-        sleep: (ms) => new Promise((resolve8) => setTimeout(resolve8, ms)),
+        sleep: (ms) => new Promise((resolve7) => setTimeout(resolve7, ms)),
         log: (message2) => console.warn(message2),
         timeoutMs: timeoutMs ?? PR_CHECKS_TIMEOUT_MS,
         progress: ({ state, elapsedMs, remainingMs }) => console.warn(`ci checks-wait: ${state} \u2014 ${Math.round(elapsedMs / 1e3)}s elapsed, ${Math.round(remainingMs / 6e4)}m left`)
@@ -48714,7 +48802,7 @@ function hotfixFollowUpLegs(runs, foldPort, alignment, foldNote, deployNote) {
   }
   return legs;
 }
-async function runProjectInfoSyncLeg(cb, repo, sleep2 = (ms) => new Promise((resolve8) => setTimeout(resolve8, ms))) {
+async function runProjectInfoSyncLeg(cb, repo, sleep2 = (ms) => new Promise((resolve7) => setTimeout(resolve7, ms))) {
   for (let attempt = 0; ; attempt++) {
     try {
       return await cb(repo, true);
@@ -49639,7 +49727,7 @@ function suiteTrainIo(root, summaryFile, memberSummaryFiles = {}, summaryFileTr,
     if (!reuse) await gh(["workflow", "run", "module-rc-publish.yml", "--repo", "mutmutco/MMI-Hub", ...fields.flatMap((f) => ["--field", f])]);
     let candidate = reuse;
     for (let i = 0; !candidate && i < 25; i++) {
-      await new Promise((resolve8) => setTimeout(resolve8, 1e3));
+      await new Promise((resolve7) => setTimeout(resolve7, 1e3));
       candidate = (await rcRuns()).find((r) => r.displayTitle === title && Date.parse(r.createdAt) >= since);
     }
     if (!candidate) throw new Error(`workflow dispatch outcome ambiguous for "${title}"; inspect Actions before retrying`);
@@ -49795,7 +49883,7 @@ function suiteTrainIo(root, summaryFile, memberSummaryFiles = {}, summaryFileTr,
       for (let i = 0; ; i++) {
         const pin = await openSuitePinPr({ root, run: (file, args, cwd) => exec(file, args, cwd, GIT_TIMEOUT_MS) }, { repo, tag, stage: "main" });
         if (pin.status !== "pending" || i >= 40) return pin;
-        await new Promise((resolve8) => setTimeout(resolve8, 3e4));
+        await new Promise((resolve7) => setTimeout(resolve7, 3e4));
       }
     },
     suiteMapping: async (leadTag) => {
@@ -49877,7 +49965,7 @@ function suiteRcDataProdDeps() {
       const rc = facts.stages.rc;
       return rc?.present ? rc.substrate ?? "an unnamed substrate" : null;
     },
-    sleep: (ms) => new Promise((resolve8) => setTimeout(resolve8, ms))
+    sleep: (ms) => new Promise((resolve7) => setTimeout(resolve7, ms))
   };
 }
 function registerSuiteCommands(program3) {
@@ -52665,6 +52753,12 @@ async function runDoctorClean(opts, io, deps) {
 init_cli_shared();
 init_error_codes();
 init_house_map();
+var PR_PREFLIGHT_STEPS = [
+  { label: "Review the docs and runbook sections affected by the code" },
+  { label: "Update affected instructions, or record a precise Runbook-Unaffected explanation when they genuinely remain unchanged" },
+  { label: "Commit code and documentation first (coverage compares committed base...HEAD)", command: "git commit" },
+  { label: "Run the repository's existing fast local preflight (check:local where declared, otherwise its documented equivalent)", command: "npm run check:local" }
+];
 var LOOP_PLAYBOOKS = {
   agent: {
     title: "Agent",
@@ -52676,7 +52770,8 @@ var LOOP_PLAYBOOKS = {
       { label: "Claim board work (board mutation only \u2014 never `oracle issue claim` or the flat `board claim`; ground unknown write routes via `commands` / `explain` first)", command: "mmi-cli oracle board claim <ref>" },
       { label: "Prepare the local workspace through the host surface" },
       { label: "Before broad docs rewrites, follow docs/Guides/doc-ceremony-cut.md" },
-      { label: "Apply the repository test policy, then build the touched package", command: "mmi-cli tests policy --base origin/development && npm run build" },
+      { label: "Apply the repository test policy and run only its permitted focused checks, without a broad local build or full suite", command: "mmi-cli tests policy --base origin/development" },
+      ...PR_PREFLIGHT_STEPS,
       { label: "Publish the branch", command: "git push origin <branch>:<branch>" },
       { label: "Open the development-base PR", command: 'mmi-cli devops pr create --title "<title>" --body-file .jerv/PR_BODY.md --base development' },
       { label: "Land to development (waits for checks itself)", command: "mmi-cli devops pr land <PR-number>" },
@@ -52698,6 +52793,7 @@ var LOOP_PLAYBOOKS = {
   "ship-pr": {
     title: "Ship PR",
     steps: [
+      ...PR_PREFLIGHT_STEPS,
       { label: "Publish the branch", command: "git push origin <branch>:<branch>" },
       { label: "Open the development-base PR", command: 'mmi-cli devops pr create --title "<title>" --body-file .jerv/PR_BODY.md --base development' },
       { label: "Land the PR (merge to development \u2014 waits for checks itself)", command: "mmi-cli devops pr land <PR-number>" }
@@ -55856,7 +55952,7 @@ function createRunbookLiveDeps(cliBin) {
       };
       const first = await probe().catch(() => 599);
       if (first < 500) return first;
-      await new Promise((resolve8) => setTimeout(resolve8, 2e4));
+      await new Promise((resolve7) => setTimeout(resolve7, 2e4));
       return probe();
     }
   };
@@ -55929,11 +56025,13 @@ function registerEdgeCommands(program3) {
       process.exitCode = 1;
     }
   });
-  edge.command("dns <action> <owner/repo> <stage>").description("read (`status`) or create-when-missing (`ensure`, master-only) the proxied Cloudflare A records for a registered DEPLOY# row; existing records are never modified").action(async (action, repo, stage) => {
-    if (action !== "status" && action !== "ensure") return fail("runtime edge dns: <action> must be status or ensure");
+  edge.command("dns <action> <owner/repo> <stage>").description("read (`status`), create missing (`ensure`) or guarded delete (`delete`, dry-run unless --apply) stage DNS; writes are master-only").option("--host <host>", "declared stage host to delete").option("--apply", "apply the guarded DNS deletion").action(async (action, repo, stage, options) => {
+    if (!["status", "ensure", "delete"].includes(action)) return fail("runtime edge dns: <action> must be status, ensure or delete");
+    if (action === "delete" && !options.host) return fail("runtime edge dns delete: --host is required");
+    if (action !== "delete" && (options.host || options.apply)) return fail("runtime edge dns: --host and --apply are only for delete");
     if (stage !== "dev" && stage !== "rc" && stage !== "main") return fail("runtime edge dns: <stage> must be dev, rc, or main");
     try {
-      const result = await edgeDnsForStage(slugOf(repo), stage, registryClientDeps(await loadConfig()), action === "ensure");
+      const result = await edgeDnsForStage(slugOf(repo), stage, registryClientDeps(await loadConfig()), action === "ensure", action === "delete" ? { host: options.host, apply: options.apply === true } : void 0);
       console.log(JSON.stringify(result, null, 2));
       if (result.required && result.complete === false) process.exitCode = 1;
     } catch (e) {
@@ -56673,8 +56771,8 @@ function mmiDoctorDeps(opts = {}) {
         });
         const raced = await Promise.race([
           work.then((r) => ({ ...r, timedOut: false })),
-          new Promise((resolve8) => {
-            ceiling = setTimeout(() => resolve8({ timedOut: true, scanned: 0, findings: 0, fixed: 0, failed: 0 }), BOARD_DOCTOR_TIMEOUT_MS);
+          new Promise((resolve7) => {
+            ceiling = setTimeout(() => resolve7({ timedOut: true, scanned: 0, findings: 0, fixed: 0, failed: 0 }), BOARD_DOCTOR_TIMEOUT_MS);
           })
         ]);
         if (raced.timedOut) return { scanned: 0, findings: 0, fixed: 0, failed: 0, timedOut: true };
@@ -56707,8 +56805,8 @@ function mmiDoctorDeps(opts = {}) {
             incomplete: nb.incomplete,
             timedOut: false
           })),
-          new Promise((resolve8) => {
-            ceiling = setTimeout(() => resolve8({ driftLines: [], incomplete: [], timedOut: true }), SCHEDULES_DRIFT_TIMEOUT_MS);
+          new Promise((resolve7) => {
+            ceiling = setTimeout(() => resolve7({ driftLines: [], incomplete: [], timedOut: true }), SCHEDULES_DRIFT_TIMEOUT_MS);
           })
         ]);
         if (!raced.timedOut && raced.incomplete.length === 0) writeSchedulesDriftCache(cachePath, raced.driftLines);
@@ -56988,7 +57086,6 @@ function envelopeAwareWriteErr(str2) {
   }
   writeHumanParseError(str2);
 }
-var INVOKED_ARGV3 = process.argv.slice(2);
 var program2 = new Command();
 program2.name("mmi-cli").description("MMI Future Hub CLI \u2014 the org control plane for agentic coding.").version(resolveClientVersion()).configureOutput({ writeErr: envelopeAwareWriteErr }).showHelpAfterError(PARSE_HINT_SENTINEL);
 program2.addHelpText(
@@ -57013,6 +57110,8 @@ function appActorDeps() {
 }
 setPollTokenProvider(async () => activeAppToken() ?? pollTokenOrUndefined(appActorDeps()));
 setGhReadTokenProvider(pollToken);
+var filingToken;
+setGhWriteTokenProvider(() => filingToken ??= mintFilingWriteToken(appActorDeps()).then((t) => t.token, () => void 0));
 setStatusWriteTokenProvider(() => mintStatusWriteToken(appActorDeps()));
 var registerPreAction = Reflect.get(program2, ["h", "ook"].join(""));
 registerPreAction.call(program2, "preAction", async (_thisCommand, actionCommand) => {
@@ -57090,6 +57189,15 @@ Dry run: pass --confirm-data-loss ${repo}/${stage} to decommission.`);
     return failGraceful(`runtime tenant control: ${e.message}`);
   }
 });
+tenant.command("undo <owner/repo> <stage>").description("switch a tenant stage back to its previous release (warm standby: seconds; else recreated from the retained release, no rebuild); watches by default").option("--json", "machine-readable output").action(async (repo, stage, o) => {
+  try {
+    const result = await runTenantControl(trainApplyDeps(), { repo, stage, action: "undo", watch: true });
+    printLine(o.json ? JSON.stringify(result, null, 2) : renderTenantControl(result));
+    if (result.conclusion === "failure") return failGraceful(`runtime tenant undo ${stage}: ${result.category ?? "failed"} \u2014 ${result.note}`);
+  } catch (e) {
+    return failGraceful(`runtime tenant undo: ${e.message}`);
+  }
+});
 var tenantArtifact = tenant.command("artifact").description("private stage-bound inputs for declared tenant tasks");
 tenantArtifact.command("put <owner/repo> <stage> <path>").description("upload a private file through a short-lived Hub grant; prints only an opaque artifact id").option("--json", "machine-readable output").action(async (repo, stage, path2, o) => {
   try {
@@ -57532,7 +57640,7 @@ fullTrack.command("readiness <owner/repo>").description("aggregate branch topolo
   console.log(JSON.stringify(report, null, 2));
   if (!report.rcand.canApply) process.exitCode = 1;
 });
-project.command("set-deploy [owner/repo]").description("patch a tenant DEPLOY row \u2014 project-admin may set only --no-env-file/--compose-profiles on their own existing dev/rc row; master may seed/change all coords and main; defaults to the current repo").addOption(new Option("--stage <stage>", "dev | rc | main").makeOptionMandatory().choices(["dev", "rc", "main"])).option("--ssh-host <host>", "the box address the deploy ssh-es into; omit to keep the stored value (required only for a NEW hetzner-ssh row \u2014 `mmi-cli devops runtime box list` finds it)").option("--ssh-user <user>", "ssh user; omit to leave the row unchanged (default root on a new row)").option("--port <port>", "loopback port the container binds / Caddy upstream (1..65535); omit to leave the row unchanged").addOption(new Option("--substrate <substrate>", "hetzner-ssh | s3-cloudfront; omit to leave the row unchanged").choices([...DEPLOY_SUBSTRATES])).option("--deploy-role-arn <arn>", "s3-cloudfront: the scoped OIDC deployer role tenant-deploy.yml assumes for this stage").option("--app-bucket <bucket>", "s3-cloudfront: the S3 bucket the built dist/ is synced into").option("--distribution-id <id>", "s3-cloudfront: the CloudFront distribution invalidated after the sync").option("--distribution-domain <domain>", "s3-cloudfront: the host the post-deploy security-header proof is measured against").option("--deploy-path <path>", "on-box per-stage release root; omit to leave the row unchanged (default /opt/mmi/<slug>/<stage> on a new row)").option("--service <name>", "systemd/compose service name; omit to leave the row unchanged (default the slug on a new row)").option("--domain <domain>", "canonical serving host; omit to leave the row unchanged").option("--alias <domain...>", "extra serving hostname the box Caddy answers (repeatable); omit to leave the stored aliases unchanged").option("--clear-aliases", "remove EVERY serving alias from the row (#2986) \u2014 omitting --alias preserves them, so clearing needs saying out loud").option("--no-env-file <bool>", "set the DEPLOY# fileless flag (true|false) \u2014 own-repo project-admin dev/rc; master main; true = env passthrough with no .env symlink").option("--compose-profiles <profiles>", "comma-separated compose profiles to enable for this stage (e.g. huddles,slack-bridge); omit to leave unchanged").option("--clear-compose-profiles", "remove EVERY compose profile from the row \u2014 omitting --compose-profiles preserves them, so clearing needs saying out loud").option("--force", "explicit recovery override: skip fileless-compose verification only after independent proof").option("--json", "machine-readable output").action(async (repoOrSlug, o) => {
+project.command("set-deploy [owner/repo]").description("patch a tenant DEPLOY row \u2014 project-admin may set only --no-env-file/--compose-profiles on their own existing dev/rc row; master may seed/change all coords and main; defaults to the current repo").addOption(new Option("--stage <stage>", "dev | rc | main").makeOptionMandatory().choices(["dev", "rc", "main"])).option("--ssh-host <host>", "the box address the deploy ssh-es into; omit to keep the stored value (required only for a NEW hetzner-ssh row \u2014 `mmi-cli devops runtime box list` finds it)").option("--ssh-user <user>", "ssh user; omit to leave the row unchanged (default root on a new row)").option("--port <port>", "loopback port the container binds / Caddy upstream (1..65535); omit to leave the row unchanged").addOption(new Option("--substrate <substrate>", "hetzner-ssh | s3-cloudfront; omit to leave the row unchanged").choices([...DEPLOY_SUBSTRATES])).option("--deploy-role-arn <arn>", "s3-cloudfront: the scoped OIDC deployer role tenant-deploy.yml assumes for this stage").option("--app-bucket <bucket>", "s3-cloudfront: the S3 bucket the built dist/ is synced into").option("--distribution-id <id>", "s3-cloudfront: the CloudFront distribution invalidated after the sync").option("--distribution-domain <domain>", "s3-cloudfront: the host the post-deploy security-header proof is measured against").option("--deploy-path <path>", "on-box per-stage release root; omit to leave the row unchanged (default /opt/mmi/<slug>/<stage> on a new row)").option("--service <name>", "systemd/compose service name; omit to leave the row unchanged (default the slug on a new row)").option("--domain <domain>", "canonical serving host; omit to leave the row unchanged").option("--alias <domain...>", "extra serving hostname the box Caddy answers (repeatable); omit to leave the stored aliases unchanged").option("--redirect-from <host>", "permanent redirect host or host=target (primary or alias); repeatable", (host, hosts) => [...hosts, host], []).option("--clear-aliases", "remove EVERY serving alias from the row (#2986) \u2014 omitting --alias preserves them, so clearing needs saying out loud").option("--no-env-file <bool>", "set the DEPLOY# fileless flag (true|false) \u2014 own-repo project-admin dev/rc; master main; true = env passthrough with no .env symlink").option("--compose-profiles <profiles>", "comma-separated compose profiles to enable for this stage (e.g. huddles,slack-bridge); omit to leave unchanged").option("--clear-compose-profiles", "remove EVERY compose profile from the row \u2014 omitting --compose-profiles preserves them, so clearing needs saying out loud").option("--force", "explicit recovery override: skip fileless-compose verification only after independent proof").option("--json", "machine-readable output").action(async (repoOrSlug, o) => {
   const cfg = await loadConfig();
   let target;
   try {
@@ -57587,6 +57695,7 @@ ${filelessTransitionGuide(target, o.stage)}`
       distributionId: o.distributionId,
       distributionDomain: o.distributionDomain,
       aliases: o.alias,
+      redirectFrom: o.redirectFrom?.length ? o.redirectFrom : void 0,
       clearAliases: o.clearAliases,
       noEnvFile,
       composeProfiles,