@mutmutco/claude-plugin 4.6.35 → 4.6.37

package/cli/dist/main.cjs

@@ -1229,8 +1229,6 @@ var init_house_map = __esm({
       // --- harbour — declared lanes -------------------------------------------------------------------
       "org schedules": "harbour",
       // register/run/park schedule rows under the one lane contract
-      intercom: "harbour",
-      // #9184: the guest coordination lane to the MM Coordinator — a bounded lane, not a claim on org truth
       // --- devops — shipping --------------------------------------------------------------------------
       pr: "devops",
       read: "devops",
@@ -1279,6 +1277,11 @@ var init_house_map = __esm({
       pickup: "learning",
       // cloud-agent adoption gate (#5708)
       // --- core — the front door itself ---------------------------------------------------------------
+      // #9993: `intercom` is the guest's own coordination door, not a declared org lane — it reads and
+      // writes nothing of this org's truth (no schedules, no registry, no board), it talks to the Jerv
+      // Gateway as this caller's own GitHub identity. So it is core: `mmi-cli intercom guest …`, unprefixed.
+      // The old `harbour intercom guest …` spelling still runs through HOUSE_ALIASES below.
+      intercom: "core",
       commands: "core",
       whoami: "core",
       spawn: "core",
@@ -1303,7 +1306,9 @@ var init_house_map = __esm({
     HOUSE_ALIASES = {
       issue: ["devops"],
       // filing/managing issues is oracle, but reads as shipping work
-      "issue create": ["devops"]
+      "issue create": ["devops"],
+      intercom: ["harbour"]
+      // #9993: `intercom` moved out of harbour to core; the old spelling still routes
     };
   }
 });
@@ -13690,7 +13695,7 @@ function isAgentScratchPath(path2) {
   return /^tmp_[^/]+$/.test(normalized);
 }
 var PUSH_WALL_AGENT_CONFIG_DIRS = [".cursor/rules/", ".codex/", ".agents/"];
-var LIVE_SESSION_DIRS = [".jerv/", ".pi/"];
+var LIVE_SESSION_DIRS = [".jerv/", ".pi/", "review-state/"];
 function pathUnderDirPrefix(path2, dir) {
   return path2 === dir || path2 === dir.slice(0, -1) || path2.startsWith(dir) || path2.includes(`/${dir}`);
 }
@@ -14549,7 +14554,7 @@ function scanWorktreeTmpEvidence(worktreePath, newerThanMs, deps = {}) {
 function archiveWorktreeTmpArtifacts(args, deps = {}) {
   const copyFile = deps.copyFile ?? import_node_fs12.copyFileSync;
   const fileSize = deps.fileSize ?? ((path2) => (0, import_node_fs12.statSync)(path2).size);
-  const writeFile4 = deps.writeFile ?? ((path2, text) => (0, import_node_fs12.writeFileSync)(path2, text));
+  const writeFile5 = deps.writeFile ?? ((path2, text) => (0, import_node_fs12.writeFileSync)(path2, text));
   const mkdirp = deps.mkdirp ?? ((path2) => {
     (0, import_node_fs12.mkdirSync)(path2, { recursive: true });
   });
@@ -14576,7 +14581,7 @@ function archiveWorktreeTmpArtifacts(args, deps = {}) {
       bytes += copied;
     }
     const manifest = (0, import_node_path9.join)((0, import_node_path9.dirname)(dest), "tmp-manifest.json");
-    writeFile4(manifest, `${JSON.stringify({ files: scan.entries.map(({ relPath, bytes: b }) => ({ relPath, bytes: b })), bytes, excluded: scan.excluded, skippedLinks: scan.links }, null, 2)}
+    writeFile5(manifest, `${JSON.stringify({ files: scan.entries.map(({ relPath, bytes: b }) => ({ relPath, bytes: b })), bytes, excluded: scan.excluded, skippedLinks: scan.links }, null, 2)}
 `);
     return { status: "archived", path: dest, runScope, entries: scan.entries.length, bytes, manifest, excluded: scan.excluded, skippedLinks: scan.links };
   } catch (e) {
@@ -15261,8 +15266,8 @@ function resolveVerbAliasShim(argv) {
 }
 
 // src/command-composition.ts
-var import_node_os28 = require("node:os");
-var import_node_path64 = require("node:path");
+var import_node_os29 = require("node:os");
+var import_node_path65 = require("node:path");
 
 // src/board-read.ts
 var import_node_fs18 = require("node:fs");
@@ -15366,13 +15371,6 @@ async function fetchHubBoardSnapshot(request, deps) {
 // src/board-read.ts
 init_github_quota();
 
-// src/claim-marker-client.ts
-init_github_client();
-init_github_quota();
-
-// src/pr-checks-rest.ts
-init_cli_shared();
-
 // ../shared/github-quota-scope.ts
 var import_node_crypto4 = require("node:crypto");
 function appQuotaScope(appId, installationId, origin = "https://api.github.com", resource = "graphql") {
@@ -15737,6 +15735,13 @@ async function activateAppActor(commandPath4, env, mint, note = (line) => proces
   return "app";
 }
 
+// src/claim-marker-client.ts
+init_github_client();
+init_github_quota();
+
+// src/pr-checks-rest.ts
+init_cli_shared();
+
 // src/merge-ci-policy.ts
 function resolveMergeCiPolicy(input) {
   if (input.registryCi === "none") {
@@ -17174,9 +17179,11 @@ async function fetchRestCorePool(gh2 = defaultGhApi, nowMs = Date.now()) {
 // src/claim-marker-client.ts
 var claimWriteTokenProvider;
 var claimWriteTokenOnce;
+var notedPersonalClaimWrite = false;
 function setClaimWriteTokenProvider(provider) {
   claimWriteTokenProvider = provider;
   claimWriteTokenOnce = void 0;
+  notedPersonalClaimWrite = false;
 }
 async function selectClaimWriteClient(client, appClient) {
   if (appClient) return appClient;
@@ -17187,15 +17194,26 @@ async function selectClaimWriteClient(client, appClient) {
     token = await claimWriteTokenOnce;
   } catch (e) {
     claimWriteTokenOnce = void 0;
+    if (e instanceof AppActorError && e.code === "vault-denied" && process.env.MMI_ACTOR?.trim() !== "app") return personalClaimWrite(client);
     const detail = e instanceof Error ? e.message : String(e);
     throw new Error(`${detail} \u2014 refusing personal-token fallback for claim write (#9511)`);
   }
   if (!token) {
     claimWriteTokenOnce = void 0;
-    throw new Error("app actor: claim write token unavailable \u2014 refusing personal-token fallback for claim write (#9511)");
+    if (process.env.MMI_ACTOR?.trim() === "app") {
+      throw new Error("app actor: claim write token unavailable \u2014 refusing personal-token fallback for claim write (#9511)");
+    }
+    return personalClaimWrite(client);
   }
   return createGitHubClient({ token: async () => token });
 }
+function personalClaimWrite(client) {
+  if (!notedPersonalClaimWrite) {
+    notedPersonalClaimWrite = true;
+    process.stderr.write("note: no App route on this host (no MMI-Hub vault access) \u2014 claim writes go as your own GitHub login\n");
+  }
+  return client;
+}
 async function selectLivenessClient(client, appClient) {
   if (appClient) return appClient;
   let token;
@@ -22745,6 +22763,7 @@ mutation($projectId: ID!, $itemId: ID!) {
     item { id }
   }
 }`;
+var BOARD_WRITE_REFUSAL_TYPES = /* @__PURE__ */ new Set(["INSUFFICIENT_SCOPES", "FORBIDDEN", "NOT_FOUND"]);
 async function updateItemSingleSelect(client, projectId, itemId, fieldId, optionId) {
   if (process.env.MMI_ACTOR?.trim() === "app") {
     const { writeHubBoardField: writeHubBoardField2 } = await Promise.resolve().then(() => (init_board_write(), board_write_exports));
@@ -22771,10 +22790,14 @@ async function updateItemSingleSelect(client, projectId, itemId, fieldId, option
     return { credential: "user" };
   } catch (error) {
     const errors = error.graphqlErrors;
-    if (errors?.length && errors.every((entry) => entry.type === "INSUFFICIENT_SCOPES")) {
+    if (errors?.length && errors.every((entry) => entry.type !== void 0 && BOARD_WRITE_REFUSAL_TYPES.has(entry.type))) {
       const { writeHubBoardField: writeHubBoardField2 } = await Promise.resolve().then(() => (init_board_write(), board_write_exports));
-      await writeHubBoardField2({ projectId, itemId, fieldId, optionId });
-      return { credential: "app_installation" };
+      try {
+        await writeHubBoardField2({ projectId, itemId, fieldId, optionId });
+        return { credential: "app_installation" };
+      } catch {
+        throw error;
+      }
     }
     if (isGitHubRateLimitError(error)) {
       const { writeHubBoardField: writeHubBoardField2 } = await Promise.resolve().then(() => (init_board_write(), board_write_exports));
@@ -25284,6 +25307,8 @@ var MANAGED_GITIGNORE_LINES = [
   // (measured on the v3.120.0 Hub train), with no legal resolution: committing another host's runtime
   // state is not an option, so the operator's only move was to park the directory outside the repo.
   ".pi/",
+  // #10003: reviewer worktrees — never committable, regenerate during review (same runtime class as `.pi/`).
+  "/review-state/",
   ".aws-sam/",
   // jerv-cli lease markers are ephemeral runtime state and never tracked. Hub#2586.
   ".jerv-lease.json",
@@ -25409,7 +25434,7 @@ function extractForwardRefs(markdown) {
   });
   return refs;
 }
-function checkPins(root, readFile10, docs) {
+function checkPins(root, readFile11, docs) {
   const findings = [];
   for (const [doc, markdown] of Object.entries(docs)) {
     for (const pin of extractPins(markdown)) {
@@ -25417,7 +25442,7 @@ function checkPins(root, readFile10, docs) {
         findings.push({ kind: "malformed-pin", doc, line: pin.line, detail: pin.text });
         continue;
       }
-      const source = readFile10((0, import_node_path16.join)(root, pin.file));
+      const source = readFile11((0, import_node_path16.join)(root, pin.file));
       if (source == null) {
         findings.push({ kind: "missing-test", doc, line: pin.line, detail: pin.file });
         continue;
@@ -25713,15 +25738,15 @@ function checkRunbookCoverage(docs, base, git3) {
   }
   return findings;
 }
-function checkSeedRunbookReview(root, base, readFile10, git3) {
-  const manifestJson = readFile10((0, import_node_path16.join)(root, "skills/bootstrap/seeds/manifest.json"));
+function checkSeedRunbookReview(root, base, readFile11, git3) {
+  const manifestJson = readFile11((0, import_node_path16.join)(root, "skills/bootstrap/seeds/manifest.json"));
   if (!manifestJson) return [];
   const changed = new Set(git3(["diff", "--name-only", `${base}...HEAD`]).split(/\r?\n/).filter(Boolean));
   const touched = loadBootstrapSeeds(manifestJson).seeds.filter((seed) => isPropagatableSeed(seed) && changed.has(seedSourcePath(seed)));
   if (!touched.length) return [];
   let declarations = null;
   try {
-    declarations = JSON.parse(readFile10((0, import_node_path16.join)(root, RUNBOOK_UNAFFECTED_PATH)) ?? "null");
+    declarations = JSON.parse(readFile11((0, import_node_path16.join)(root, RUNBOOK_UNAFFECTED_PATH)) ?? "null");
   } catch {
     declarations = null;
   }
@@ -25808,12 +25833,12 @@ function defaultTrackedFiles(root, firstSegments, exec3 = import_node_child_proc
     throw error;
   }
 }
-function mergeGroupRunbookMessages(root, deps, readFile10, warnings) {
+function mergeGroupRunbookMessages(root, deps, readFile11, warnings) {
   const env = deps.env ?? process.env;
   if (env.GITHUB_EVENT_NAME !== "merge_group") return "";
   let source = "merge_group event payload";
   try {
-    const event = JSON.parse(readFile10(env.GITHUB_EVENT_PATH ?? "") ?? "");
+    const event = JSON.parse(readFile11(env.GITHUB_EVENT_PATH ?? "") ?? "");
     const match = /^refs\/heads\/gh-readonly-queue\/.+\/pr-([1-9]\d*)-[a-f0-9]+$/.exec(event.merge_group?.head_ref ?? "");
     const repo = env.GITHUB_REPOSITORY;
     if (!match || !repo || !/^[\w.-]+\/[\w.-]+$/.test(repo)) throw new Error("invalid queue source");
@@ -25836,7 +25861,7 @@ function mergeGroupRunbookMessages(root, deps, readFile10, warnings) {
   }
 }
 function runDocRefs(root, deps = {}) {
-  const readFile10 = deps.readFile ?? readFileOrNull;
+  const readFile11 = deps.readFile ?? readFileOrNull;
   const exists = deps.exists ?? import_node_fs19.existsSync;
   const listDocs = deps.listDocs ?? defaultListDocs;
   const isIgnored = deps.isIgnored ?? ((paths) => defaultIsIgnored(root, paths));
@@ -25850,11 +25875,11 @@ function runDocRefs(root, deps = {}) {
   const walked = listDocs(root);
   const ignoredDocs = walked.length ? isIgnored(walked) : /* @__PURE__ */ new Set();
   const docs = Object.fromEntries(
-    walked.filter((rel) => !ignoredDocs.has(rel)).map((rel) => [rel, readFile10((0, import_node_path16.join)(root, rel))]).filter(([rel, body]) => body != null && (!deps.runbooksOnly || isRunbook(rel, body)))
+    walked.filter((rel) => !ignoredDocs.has(rel)).map((rel) => [rel, readFile11((0, import_node_path16.join)(root, rel))]).filter(([rel, body]) => body != null && (!deps.runbooksOnly || isRunbook(rel, body)))
   );
   const refResult = checkRefs(root, { exists, isIgnored, trackedFirstSegments }, docs);
   const findings = [
-    ...checkPins(root, readFile10, docs).findings,
+    ...checkPins(root, readFile11, docs).findings,
     ...refResult.findings
   ];
   if (commandPaths == null) {
@@ -25868,7 +25893,7 @@ function runDocRefs(root, deps = {}) {
     findings.push(...checkCommands(docs, commandPaths).findings);
   }
   const runbooks = Object.fromEntries(Object.entries(docs).filter(([doc, body]) => isRunbook(doc, body)));
-  findings.push(...checkRunbookClaims(root, runbooks, { readFile: readFile10, exists, isIgnored, trackedFirstSegments, commandPaths, commandOptions: deps.commandOptions, commandSource: deps.commandSource }));
+  findings.push(...checkRunbookClaims(root, runbooks, { readFile: readFile11, exists, isIgnored, trackedFirstSegments, commandPaths, commandOptions: deps.commandOptions, commandSource: deps.commandSource }));
   const warnings = [...refResult.warnings];
   if (deps.runbooksOnly && !Object.keys(runbooks).length) {
     warnings.push({ kind: "runbook-missing", doc: "docs/Guides/operator.md", line: 0, detail: "no operator runbook or <!-- runbook --> document exists" });
@@ -25876,9 +25901,9 @@ function runDocRefs(root, deps = {}) {
   if (deps.base) {
     const git3 = deps.git ?? ((args) => (0, import_node_child_process6.execFileSync)("git", args, { cwd: root, encoding: "utf8", maxBuffer: CHECK_IGNORE_MAX_BUFFER, windowsHide: true }));
     const stale = checkRunbookCoverage(runbooks, deps.base, git3);
-    const seedStale = checkSeedRunbookReview(root, deps.base, readFile10, git3);
+    const seedStale = checkSeedRunbookReview(root, deps.base, readFile11, git3);
     const messages = git3(["log", "--format=%B", `${deps.base}..HEAD`]);
-    const sourceMessages = stale.length || seedStale.length ? mergeGroupRunbookMessages(root, deps, readFile10, warnings) : "";
+    const sourceMessages = stale.length || seedStale.length ? mergeGroupRunbookMessages(root, deps, readFile11, warnings) : "";
     const allMessages = `${messages}
 ${sourceMessages}`;
     const override = /^Runbook-Unaffected:[ \t]*\S.*$/m.test(allMessages);
@@ -26837,22 +26862,22 @@ function renderBootstrapAncillaryPlan(labels, environments, exceptions = []) {
     ...exceptions.map(({ name, detail }) => `  OK environment ${name} (${detail})`)
   ].join("\n");
 }
-function resolveSeedContent(seed, vars, readFile10) {
-  if (seed.source === "self") return readFile10(seed.target);
+function resolveSeedContent(seed, vars, readFile11) {
+  if (seed.source === "self") return readFile11(seed.target);
   if (seed.source.startsWith("seed:")) {
-    const tmpl = readFile10(`skills/bootstrap/seeds/${seed.source.slice("seed:".length)}`);
+    const tmpl = readFile11(`skills/bootstrap/seeds/${seed.source.slice("seed:".length)}`);
     return tmpl == null ? null : renderSeed(tmpl, vars);
   }
   return null;
 }
-function resolveSeedWriteContent(seed, vars, readFile10, remoteContent) {
+function resolveSeedWriteContent(seed, vars, readFile11, remoteContent) {
   if (!seed.managedBlock) {
-    return { ok: true, content: resolveSeedContent(seed, vars, readFile10), managed: seed.source === "managed-block" };
+    return { ok: true, content: resolveSeedContent(seed, vars, readFile11), managed: seed.source === "managed-block" };
   }
-  const base = remoteContent ?? resolveSeedContent(seed, vars, readFile10);
+  const base = remoteContent ?? resolveSeedContent(seed, vars, readFile11);
   if (base == null) return { ok: true, content: null, managed: true };
   const blockSeed = { ...seed, source: seed.managedBlock.source, managedBlock: void 0 };
-  const desired = resolveSeedContent(blockSeed, vars, readFile10);
+  const desired = resolveSeedContent(blockSeed, vars, readFile11);
   if (desired == null) return { ok: true, content: null, managed: true };
   const result = upsertManagedSeedBlock(base, desired, seed.managedBlock.begin, seed.managedBlock.end);
   return result.ok ? { ok: true, content: result.content, managed: true } : { ok: false, reason: result.reason, managed: true };
@@ -28367,10 +28392,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.6.35",
-    tag: "v4.6.35",
-    commit: "2a54cf011975",
-    npm: "@mutmutco/cli@4.6.35"
+    version: "4.6.37",
+    tag: "v4.6.37",
+    commit: "94211a24e48a",
+    npm: "@mutmutco/cli@4.6.37"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -28387,14 +28412,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.6.35"
+          v3Target: "v4.6.37"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.6.35 and redeploy the Hub Lambda from tag v4.6.35 (2a54cf011975); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.6.35 (@mutmutco/cli@4.6.35, tag commit 2a54cf011975 \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.6.37 and redeploy the Hub Lambda from tag v4.6.37 (94211a24e48a); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.6.37 (@mutmutco/cli@4.6.37, tag commit 94211a24e48a \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -43417,8 +43442,8 @@ function annotateChangeMeaning(changed, policy, read) {
 function isMeaningfulRow(file) {
   return file.meaningful !== false;
 }
-function loadPolicy(root, readFile10 = readFileOrNull2) {
-  const raw = readFile10((0, import_node_path30.join)(root, POLICY_FILE));
+function loadPolicy(root, readFile11 = readFileOrNull2) {
+  const raw = readFile11((0, import_node_path30.join)(root, POLICY_FILE));
   if (raw == null) return { mandatory: [], declared: false };
   return parsePolicy(raw, POLICY_FILE);
 }
@@ -44155,12 +44180,16 @@ async function submitQueueAdmission(pr, repo, head, read, write, options, resume
     receipt = { ...receipt, state: "pending", uuid: details.uuid };
   }
   const sleep2 = options.sleep ?? ((ms) => new Promise((resolve8) => setTimeout(resolve8, ms)));
-  for (let attempt = 0; attempt < 3; attempt++) {
-    if (attempt) await sleep2(attempt * 1e3);
+  const confirmDelays = [0, 1e3, 2e3, 4e3, 8e3, 15e3, 15e3, 15e3];
+  let readFailure;
+  for (const delay of confirmDelays) {
+    if (delay) await sleep2(delay);
+    readFailure = void 0;
     try {
       response = admissionResponse(await read([`repos/${repo}/pulls/${pr}/merge-async/${receipt.uuid}`, "--include", ...ASYNC_HEADERS]));
     } catch {
-      return reconcile("the saved operation cannot be read (including expired results)");
+      readFailure = "the saved operation cannot be read (including expired results)";
+      continue;
     }
     if (response.code !== 200) return reconcile(`the saved operation returned HTTP ${response.code}`);
     const { status, details } = response.body;
@@ -44202,6 +44231,7 @@ async function submitQueueAdmission(pr, repo, head, read, write, options, resume
     if (receipt.head !== head) return reconcile("the previous head completed admission; inspect current head and membership before continuing");
     return reconcile(`operation ${receipt.uuid} reported ${status}, but matching-head membership or merged state is unconfirmed`, status === "enqueued");
   }
+  if (readFailure) return reconcile(readFailure);
   return markReenqueued({
     mergeStatus: "queue-admission-pending",
     retryable: false,
@@ -44424,8 +44454,8 @@ async function abandonQueueAdmission(pr, repo, options = {}) {
   }
   const receipt = journal.receipt;
   if (!receipt) return refuse("no queue-admission receipt exists for this PR; nothing to abandon");
-  if (!["pending", "enqueued"].includes(receipt.state)) {
-    return refuse(`the saved admission is '${receipt.state}', not a stuck non-terminal 'pending'/'enqueued' receipt; nothing to abandon`);
+  if (!["pending", "enqueued"].includes(receipt.state) && !(receipt.state === "dispatching" && !receipt.uuid)) {
+    return refuse(`the saved admission is '${receipt.state}'${receipt.uuid ? ` with operation ${receipt.uuid}` : ""}, not a stuck non-terminal 'pending'/'enqueued' receipt; nothing to abandon`);
   }
   let snapshot;
   try {
@@ -45759,20 +45789,20 @@ function buildPrLifecycle(state, manifest, joins) {
       if (member.pr !== state.number) continue;
       if (!member.admission_event_id) continue;
       const ep = episodes.find((x) => x.episode_id === member.admission_event_id);
-      const join54 = joins.find((j) => j.run_id === run.run_id && j.run_attempt === run.run_attempt && j.pr === member.pr && j.admission_event_id === member.admission_event_id);
-      if (!join54) continue;
+      const join55 = joins.find((j) => j.run_id === run.run_id && j.run_attempt === run.run_attempt && j.pr === member.pr && j.admission_event_id === member.admission_event_id);
+      if (!join55) continue;
       if (!ep) {
         if (state.status === "complete") {
-          join54.status = "unresolved";
-          join54.reason = "admission-event-not-in-history";
+          join55.status = "unresolved";
+          join55.reason = "admission-event-not-in-history";
         } else {
-          join54.status = "unresolved";
-          join54.reason = "history-incomplete";
+          join55.status = "unresolved";
+          join55.reason = "history-incomplete";
         }
         continue;
       }
-      join54.status = "joined";
-      delete join54.reason;
+      join55.status = "joined";
+      delete join55.reason;
       ep.runs.push({ run_id: run.run_id, run_attempt: run.run_attempt, head_sha: run.head_sha });
     }
   }
@@ -46149,6 +46179,15 @@ async function attachOnIntegrationRefusal(detail, cfg, contentNodeId, attach = a
     return { warning: `board attach refused: the gh login is an App installation token without Projects access (${detail}) and the Hub App leg failed (${e.message}). If the Hub reports the same refusal, ${PROJECTS_PERMISSION_HINT}` };
   }
 }
+var ATTACH_AUTHORITY_REFUSAL = /FORBIDDEN|NOT_FOUND|Resource not accessible|missing required scopes|insufficient (?:permissions?|scope)|Could not resolve to a node|does not have (?:access|permission)/i;
+async function attachOnAuthorityRefusal(detail, cfg, contentNodeId, attach = attachViaHubApp) {
+  if (!ATTACH_AUTHORITY_REFUSAL.test(detail)) return void 0;
+  try {
+    return { projectItemId: await attach(cfg, contentNodeId) };
+  } catch (e) {
+    return { warning: `${detail}; the Hub attach also refused (${e.message}) \u2014 attach needs org-owner, repo-admin or repository write authority on the board's repository` };
+  }
+}
 async function issueNodeIdForAttach(repo, number, ghView, client) {
   try {
     return (await ghView()).trim();
@@ -51627,7 +51666,7 @@ function registerBootstrapCommands(program3) {
     const slug = parsedRepo.slug;
     const onlyTarget = o.fromConfig && o.only.trim() === "gate.yml" ? ".github/workflows/gate.yml" : o.only.trim();
     const gh2 = async (args) => execFileP("gh", args, { timeout: 2e4 });
-    const readFile10 = (p) => (0, import_node_fs40.existsSync)(p) ? (0, import_node_fs40.readFileSync)(p, "utf8") : null;
+    const readFile11 = (p) => (0, import_node_fs40.existsSync)(p) ? (0, import_node_fs40.readFileSync)(p, "utf8") : null;
     const enc = (p) => p.split("/").map(encodeURIComponent).join("/");
     const putSeed = async (target, content, ref, sha) => {
       const tmp = (0, import_node_path37.join)((0, import_node_os21.tmpdir)(), `mmi-seed-${process.pid}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}.json`);
@@ -51799,7 +51838,7 @@ function registerBootstrapCommands(program3) {
             registryMeta?.requiredCheckBranches,
             registryMeta?.requiredChecks
           );
-          const rendered = resolveSeedContent(gateSeed, gateVars, readFile10);
+          const rendered = resolveSeedContent(gateSeed, gateVars, readFile11);
           if (rendered === null || missingPlaceholders(rendered).length) return failGraceful("bootstrap apply: registry gate template is unreadable or has unfilled placeholders");
           const base = (await readTargetedSeedFiles(repo, scopedPlan, onlyTarget, scopedPlan.baseSha, controlClient)).base?.content ?? null;
           configGateAction = planGateFromConfig(base, rendered);
@@ -51903,7 +51942,7 @@ function registerBootstrapCommands(program3) {
             ...vars,
             ...registryMeta?.requiredChecks?.length ? { GATE_RULESET_CONTEXTS_JSON: rulesetVars.GATE_RULESET_CONTEXTS_JSON } : {},
             ...registryMeta?.requiredCheckBranches?.length ? { GATE_RULESET_BRANCH_REFS_JSON: rulesetVars.GATE_RULESET_BRANCH_REFS_JSON } : {}
-          } : vars, readFile10, preservedContent);
+          } : vars, readFile11, preservedContent);
           if (!writeContent.ok) {
             return fail(`bootstrap apply: ${resolved.target}: ${writeContent.reason} \u2014 refusing to overwrite repo-owned content`);
           }
@@ -52049,7 +52088,7 @@ ${onlyManagedBlock ? `Only the marker-bounded Hub-managed block inside repo-owne
       }
       const rulesetSeed = repo.toLowerCase() === "mutmutco/mmi-hub" ? void 0 : manifest.seeds.find((s) => s.target === ".github/rulesets/mmi-product-required-checks.json");
       if (rulesetSeed) {
-        const rulesetContent = resolveSeedContent({ ...rulesetSeed, target: rulesetSeed.target.replace("{{REPO_SLUG}}", slug) }, vars, readFile10);
+        const rulesetContent = resolveSeedContent({ ...rulesetSeed, target: rulesetSeed.target.replace("{{REPO_SLUG}}", slug) }, vars, readFile11);
         if (rulesetContent) {
           try {
             const client = controlClient;
@@ -52841,32 +52880,183 @@ function registerDeployCommands(program3) {
 }
 
 // src/intercom-guest.ts
+var import_node_crypto19 = require("node:crypto");
+var import_promises5 = require("node:fs/promises");
+var import_node_os22 = require("node:os");
+var import_node_path38 = require("node:path");
+init_cli_shared();
 init_github_client();
-var CANONICAL_COMMAND = "mmi-cli harbour intercom guest";
+var CANONICAL_COMMAND = "mmi-cli intercom guest";
 var INTERCOM_GUEST_VERBS = ["register", "read", "send", "join", "leave"];
+var DELIVERIES_LIMIT_MAX = 100;
+var DELIVERIES_LIMIT_DEFAULT = 20;
+function deliveriesLimit(limit) {
+  if (limit === void 0 || !Number.isFinite(limit) || limit < 1) return DELIVERIES_LIMIT_DEFAULT;
+  return Math.min(Math.floor(limit), DELIVERIES_LIMIT_MAX);
+}
 var INTERCOM_GUEST_CONTRACT = {
-  source: "mutmutco/Jerv-Hub#2522 (Jerv Gateway guest principal, GitHub-token verification, allowlist)",
+  source: "mutmutco/Jerv-Hub#2727 published guest wire contract (gateway/v1: contract/operations.js, contract/authorization.json, src/http/handler.js)",
+  contractVersion: "gateway/v1",
+  baseUrl: "https://jerv-central.tail4ce549.ts.net",
   baseUrlEnv: "MMI_INTERCOM_GATEWAY_URL",
-  operations: null
+  discovery: {
+    operation: "intercom.directory",
+    method: "POST",
+    path: "/v1/intercom/directory",
+    mutation: false,
+    credential: "required",
+    // Idle endpoints are included on purpose: the Coordinator is reachable while it is idle, and the
+    // contract says to match its display name and take the id from the row, never to remember one.
+    body: () => ({ limit: 200, includeIdle: true })
+  },
+  operations: {
+    // #9993 — the guest's first contact. `displayName` is the gh login; the Gateway appends 8 hex of the
+    // endpoint id only when the name collides. HostKind/project are optional and omitted (the Gateway
+    // stores `remote`). With a stored credential this same call rotates and resumes the endpoint.
+    register: {
+      operation: "intercom.register",
+      method: "POST",
+      path: "/v1/intercom/register",
+      mutation: true,
+      credential: "optional",
+      needsLogin: true,
+      body: (_request, context) => ({ displayName: context.login ?? "" })
+    },
+    // #9993 — `read` is the inbox: pending deliveries. Accepting them (intercom.accept) or acking them
+    // (intercom.ack) is a separate, explicit call the contract documents under `cliVerbs.read.then`.
+    read: {
+      operation: "intercom.deliveries",
+      method: "POST",
+      path: "/v1/intercom/deliveries",
+      mutation: false,
+      credential: "required",
+      body: (request) => ({ state: "pending", limit: deliveriesLimit(request.limit) })
+    },
+    // #9993 — the wire field is `text`. A body field named `message` is `unknown_field` at the Gateway.
+    send: {
+      operation: "intercom.send",
+      method: "POST",
+      path: "/v1/intercom/send",
+      mutation: true,
+      credential: "required",
+      body: (request) => ({ to: request.to, text: request.message })
+    },
+    // #9993 — no Gateway operation admits a guest to a suite (Jerv-Hub#2524): a join is an ordinary
+    // `send` to the Coordinator carrying the suite message convention. The suite name travels inside the
+    // text because the convention carries no suite field.
+    join: {
+      operation: "intercom.send",
+      method: "POST",
+      path: "/v1/intercom/send",
+      mutation: true,
+      credential: "required",
+      needsCoordinator: true,
+      body: (request, context) => ({
+        to: context.coordinator,
+        text: `Suite join: ${context.endpointId ?? ""}, ${context.displayName ?? context.login ?? ""} guest, repo ${context.repo}, host ${context.host}, suite ${request.suite ?? ""}`
+      })
+    },
+    // #9993 — leaving is the same shape, and the Coordinator marks the seat left.
+    leave: {
+      operation: "intercom.send",
+      method: "POST",
+      path: "/v1/intercom/send",
+      mutation: true,
+      credential: "required",
+      needsCoordinator: true,
+      body: (_request, context) => ({
+        to: context.coordinator,
+        text: `Suite leave: ${context.endpointId ?? ""}`
+      })
+    }
+  }
 };
 var INTERCOM_GUEST_CONTRACT_MISSING = "intercom-guest-contract-missing";
 var INTERCOM_GUEST_BASE_URL_MISSING = "intercom-guest-base-url-missing";
 var INTERCOM_GUEST_NO_IDENTITY = "intercom-guest-no-identity";
+var INTERCOM_GUEST_INPUT_MISSING = "intercom-guest-input-missing";
+var INTERCOM_GUEST_NO_CREDENTIAL = "intercom-guest-no-credential";
+var INTERCOM_GUEST_COORDINATOR_MISSING = "intercom-guest-coordinator-missing";
+function intercomGuestStorePath(env = process.env) {
+  const home = env.MMI_INTERCOM_HOME?.trim();
+  return (0, import_node_path38.join)(home && home.length > 0 ? home : (0, import_node_path38.join)((0, import_node_os22.homedir)(), ".mmi", "intercom"), "guest.json");
+}
 function scrubToken(text, token) {
   if (!token) return text;
   return text.split(token).join("***");
 }
+function scrubSecrets(text, secrets) {
+  return secrets.reduce((acc, secret) => scrubToken(acc, secret), text);
+}
 function missingContractRefusal(verb) {
   return [
-    `${CANONICAL_COMMAND} ${verb}: not sent \u2014 the Jerv Gateway guest contract has not landed (${INTERCOM_GUEST_CONTRACT.source}).`,
-    `Its guest operations (${INTERCOM_GUEST_VERBS.join(", ")}) publish no method, path or field shape yet, so this client refuses`,
-    "instead of guessing an endpoint: a guessed call would come back 404/403 and read as a permission or allowlist answer",
-    "when the real answer is that the contract is missing.",
-    `To switch every verb on: land the guest principal operations in ${INTERCOM_GUEST_CONTRACT.source}, then fill`,
-    "`INTERCOM_GUEST_CONTRACT.operations` in cli/src/intercom-guest.ts \u2014 that object is the one place the wire shape lives.",
+    `${CANONICAL_COMMAND} ${verb}: not sent \u2014 this CLI build carries no Jerv Gateway operation for the '${verb}' verb (${INTERCOM_GUEST_CONTRACT.source}).`,
+    "The published guest contract publishes the method, path and field shape for every verb this client knows",
+    `(${INTERCOM_GUEST_VERBS.join(", ")}), so an empty entry means the contract moved and this build did not follow it \u2014`,
+    "this client refuses instead of guessing an endpoint: a guessed call would come back 404/403 and read as a permission",
+    "or allowlist answer when the real answer is that the operation is unknown here.",
+    "To fix it: check the published contract against `INTERCOM_GUEST_CONTRACT.operations` in cli/src/intercom-guest.ts",
+    "\u2014 that object is the one place the wire shape lives.",
     "Nothing was read and nothing was sent: no token was touched and no request was made."
   ].join(" ");
 }
+function missingInput(request) {
+  if (request.verb === "send") {
+    if (!request.to?.trim()) return "`--to <address>` is required";
+    if (!request.message?.trim()) return "`--message <text>` is required";
+  }
+  if (request.verb === "join" && !request.suite?.trim()) return "`--suite <name>` is required";
+  return void 0;
+}
+function coordinatorEndpointId(directoryBody) {
+  let parsed;
+  try {
+    parsed = JSON.parse(directoryBody);
+  } catch {
+    return void 0;
+  }
+  const data = parsed?.data ?? parsed;
+  const items = data?.items;
+  if (!Array.isArray(items)) return void 0;
+  const candidates = items.filter((item) => Boolean(item) && typeof item === "object");
+  const named = candidates.filter((item) => typeof item.displayName === "string" && /^Coordinator(\s|$)/.test(item.displayName) && item.self !== true);
+  const exact = named.find((item) => item.displayName === "Coordinator") ?? named[0];
+  return typeof exact?.endpointId === "string" && exact.endpointId.length > 0 ? exact.endpointId : void 0;
+}
+async function readStore(path2) {
+  try {
+    const parsed = JSON.parse(await (0, import_promises5.readFile)(path2, "utf8"));
+    return parsed && typeof parsed === "object" ? parsed : void 0;
+  } catch {
+    return void 0;
+  }
+}
+async function writeStore(path2, entry) {
+  await (0, import_promises5.mkdir)((0, import_node_path38.dirname)(path2), { recursive: true, mode: 448 });
+  await (0, import_promises5.writeFile)(path2, `${JSON.stringify(entry, null, 2)}
+`, { encoding: "utf8", mode: 384 });
+  await (0, import_promises5.chmod)(path2, 384).catch(() => {
+  });
+}
+function registrationEntry(gateway, body, previous) {
+  let parsed;
+  try {
+    parsed = JSON.parse(body);
+  } catch {
+    return void 0;
+  }
+  const data = parsed?.data ?? parsed;
+  const credential = typeof data?.credential === "string" ? data.credential : previous?.credential;
+  if (!credential) return void 0;
+  return {
+    gateway,
+    endpointId: typeof data?.endpointId === "string" ? data.endpointId : previous?.endpointId,
+    deviceId: typeof data?.deviceId === "string" ? data.deviceId : previous?.deviceId,
+    credential,
+    displayName: typeof data?.displayName === "string" ? data.displayName : previous?.displayName,
+    epoch: typeof data?.epoch === "number" ? data.epoch : previous?.epoch
+  };
+}
 async function runIntercomGuest(request, deps = {}) {
   const verb = request.verb;
   const contract = deps.contract ?? INTERCOM_GUEST_CONTRACT;
@@ -52874,61 +53064,156 @@ async function runIntercomGuest(request, deps = {}) {
   if (!operation) {
     return { ok: false, verb, code: INTERCOM_GUEST_CONTRACT_MISSING, message: missingContractRefusal(verb), tokenRead: false };
   }
+  const inputProblem = missingInput(request);
+  if (inputProblem) {
+    return {
+      ok: false,
+      verb,
+      code: INTERCOM_GUEST_INPUT_MISSING,
+      message: `${CANONICAL_COMMAND} ${verb}: not sent \u2014 ${inputProblem}. Nothing was read and no request was made.`,
+      tokenRead: false
+    };
+  }
   const env = deps.env ?? process.env;
-  const baseUrl = env[contract.baseUrlEnv]?.trim();
+  const baseUrl = (env[contract.baseUrlEnv]?.trim() || contract.baseUrl).replace(/\/+$/, "");
   if (!baseUrl) {
     return {
       ok: false,
       verb,
       code: INTERCOM_GUEST_BASE_URL_MISSING,
-      message: `${CANONICAL_COMMAND} ${verb}: not sent \u2014 ${contract.baseUrlEnv} is not set, and the Jerv Gateway base URL has no default while the contract is unlanded (${contract.source}). Nothing was read and no request was made.`,
+      message: `${CANONICAL_COMMAND} ${verb}: not sent \u2014 ${contract.baseUrlEnv} is empty and the published contract names no base URL either (${contract.source}). Nothing was read and no request was made.`,
       tokenRead: false
     };
   }
+  const storePath = deps.storePath ?? intercomGuestStorePath(env);
+  const store = await readStore(storePath);
   const identity = await (deps.readToken ?? githubKeyringTokenRead)();
   if (identity.state !== "ok") {
     return {
       ok: false,
       verb,
       code: INTERCOM_GUEST_NO_IDENTITY,
-      message: scrubToken(
-        `${CANONICAL_COMMAND} ${verb}: not sent \u2014 the guest identity is the caller's own \`gh\` login and it could not be read (${identity.detail}). Run \`gh auth login\`, then retry. No request was made.`
+      message: scrubSecrets(
+        `${CANONICAL_COMMAND} ${verb}: not sent \u2014 the guest identity is the caller's own \`gh\` login and it could not be read (${identity.detail}). Run \`gh auth login\`, then retry. No request was made.`,
+        []
       ),
       tokenRead: false
     };
   }
   const token = identity.token;
-  const fetchImpl = deps.fetchImpl ?? ((url, init2) => fetch(url, init2));
-  const headers = { accept: "application/json", authorization: `Bearer ${token}` };
-  const init = { method: operation.method, headers };
-  if (operation.body) {
-    headers["content-type"] = "application/json";
-    init.body = JSON.stringify(operation.body(request));
+  let login;
+  if (operation.needsLogin) {
+    login = await (deps.readLogin ?? githubLogin)();
+    if (!login) {
+      return {
+        ok: false,
+        verb,
+        code: INTERCOM_GUEST_NO_IDENTITY,
+        message: scrubSecrets(
+          `${CANONICAL_COMMAND} ${verb}: not sent \u2014 ${operation.operation} needs your GitHub login as \`displayName\` and \`gh api user\` returned none. Run \`gh auth login\`, then retry. No request was made.`,
+          [token]
+        ),
+        tokenRead: true
+      };
+    }
   }
-  let response;
-  try {
-    response = await fetchImpl(new URL(operation.path, baseUrl).toString(), init);
-  } catch (error) {
-    const detail = error instanceof Error ? error.message : String(error);
-    return { ok: false, verb, code: "intercom-guest-transport-failed", message: scrubToken(`${CANONICAL_COMMAND} ${verb}: the Gateway call failed in transport (${detail}).`, token), tokenRead: true };
+  const credential = store?.credential;
+  if (operation.credential === "required" && !credential) {
+    return {
+      ok: false,
+      verb,
+      code: INTERCOM_GUEST_NO_CREDENTIAL,
+      message: scrubSecrets(
+        `${CANONICAL_COMMAND} ${verb}: not sent \u2014 no intercom credential is stored for this machine (${storePath}). ${operation.operation} requires the \`Jerv-Intercom-Credential\` the Gateway returns exactly once, so run \`${CANONICAL_COMMAND} register\` first. Nothing was read and no request was made.`,
+        [token]
+      ),
+      tokenRead: true
+    };
   }
-  const text = await response.text().catch(() => "");
-  if (!response.ok) {
+  const fetchImpl = deps.fetchImpl ?? ((url, init) => fetch(url, init));
+  const newKey = deps.newIdempotencyKey ?? (() => (0, import_node_crypto19.randomUUID)());
+  const secrets = [token, credential].filter((secret) => Boolean(secret));
+  const callOne = async (op, body2) => {
+    const headers = {
+      accept: "application/json",
+      "content-type": "application/json",
+      "jerv-contract-version": contract.contractVersion,
+      "jerv-guest-github-token": token
+    };
+    if (credential && op.credential !== "never") headers["jerv-intercom-credential"] = credential;
+    if (op.mutation) headers["idempotency-key"] = newKey();
+    let response;
+    try {
+      response = await fetchImpl(new URL(op.path, baseUrl).toString(), { method: op.method, headers, body: JSON.stringify(body2) });
+    } catch (error) {
+      return { transport: error instanceof Error ? error.message : String(error) };
+    }
+    const text = await response.text().catch(() => "");
+    return { status: response.status, ok: response.ok, text };
+  };
+  let context = {
+    login,
+    credential,
+    endpointId: store?.endpointId,
+    displayName: store?.displayName,
+    repo: env.GITHUB_REPOSITORY?.trim() || "unknown",
+    host: (0, import_node_os22.hostname)()
+  };
+  if (operation.needsCoordinator) {
+    const directory = await callOne(contract.discovery, contract.discovery.body?.(request, context) ?? {});
+    if ("transport" in directory) {
+      return { ok: false, verb, code: "intercom-guest-transport-failed", message: scrubSecrets(`${CANONICAL_COMMAND} ${verb}: the Gateway call failed in transport (${directory.transport}).`, secrets), tokenRead: true };
+    }
+    if (!directory.ok) {
+      return {
+        ok: false,
+        verb,
+        code: `intercom-guest-http-${directory.status}`,
+        message: scrubSecrets(`${CANONICAL_COMMAND} ${verb}: ${contract.discovery.operation} answered HTTP ${directory.status}${directory.text ? ` \u2014 ${directory.text.slice(0, 600)}` : ""}`, secrets),
+        tokenRead: true
+      };
+    }
+    const coordinator = coordinatorEndpointId(directory.text);
+    if (!coordinator) {
+      return {
+        ok: false,
+        verb,
+        code: INTERCOM_GUEST_COORDINATOR_MISSING,
+        message: scrubSecrets(
+          `${CANONICAL_COMMAND} ${verb}: ${contract.discovery.operation} listed no live endpoint named \`Coordinator\`, so there is nobody to send to and nothing was sent. The Coordinator's endpoint id comes from that directory, never from this client.`,
+          secrets
+        ),
+        tokenRead: true
+      };
+    }
+    context = { ...context, coordinator };
+  }
+  const body = operation.body ? operation.body(request, context) : {};
+  const result = await callOne(operation, body);
+  if ("transport" in result) {
+    return { ok: false, verb, code: "intercom-guest-transport-failed", message: scrubSecrets(`${CANONICAL_COMMAND} ${verb}: the Gateway call failed in transport (${result.transport}).`, secrets), tokenRead: true };
+  }
+  if (!result.ok) {
     return {
       ok: false,
       verb,
-      code: `intercom-guest-http-${response.status}`,
-      message: scrubToken(`${CANONICAL_COMMAND} ${verb}: the Gateway answered HTTP ${response.status}${text ? ` \u2014 ${text.slice(0, 600)}` : ""}`, token),
+      code: `intercom-guest-http-${result.status}`,
+      message: scrubSecrets(`${CANONICAL_COMMAND} ${verb}: the Gateway answered HTTP ${result.status}${result.text ? ` \u2014 ${result.text.slice(0, 600)}` : ""}`, secrets),
       tokenRead: true
     };
   }
-  return { ok: true, verb, status: response.status, body: scrubToken(text, token) };
+  if (operation.operation === "intercom.register") {
+    const entry = registrationEntry(baseUrl, result.text, store);
+    if (entry) await writeStore(storePath, entry).catch(() => {
+    });
+  }
+  return { ok: true, verb, status: result.status, body: scrubSecrets(result.text, secrets) };
 }
 function renderIntercomGuestResult(result) {
   return result.ok ? result.body : result.message;
 }
 function registerIntercomGuestCommands(program3, io = {}) {
-  const guest = program3.command("intercom").description("Coordinate with the MM Coordinator through the Jerv Gateway intercom (guest identity; Jerv-Hub#2522)").command("guest").description("Guest coordination verbs: register, read, send, join, leave \u2014 coordination only, never orders");
+  const guest = program3.command("intercom").description("Coordinate with the MM Coordinator through the Jerv Gateway intercom (guest identity; Jerv-Hub#2727)").command("guest").description("Guest coordination verbs: register, read, send, join, leave \u2014 coordination only, never orders");
   const out = io.out ?? ((line) => process.stdout.write(`${line}
 `));
   const err = io.err ?? ((line) => process.stderr.write(`${line}
@@ -52943,19 +53228,21 @@ function registerIntercomGuestCommands(program3, io = {}) {
       return;
     }
     err(renderIntercomGuestResult(result));
-    setExitCode(result.code === INTERCOM_GUEST_CONTRACT_MISSING || result.code === INTERCOM_GUEST_BASE_URL_MISSING ? 2 : 1);
+    setExitCode(
+      result.code === INTERCOM_GUEST_CONTRACT_MISSING || result.code === INTERCOM_GUEST_BASE_URL_MISSING || result.code === INTERCOM_GUEST_NO_CREDENTIAL ? 2 : 1
+    );
   };
-  guest.command("register").description("Register this guest endpoint with the Gateway using your `gh auth` login").action(async () => {
+  guest.command("register").description("Register this guest endpoint with the Gateway, using your `gh` login as the display name").action(async () => {
     await run({ verb: "register" });
   });
-  guest.command("read").description("Read messages waiting for this guest (default 20)").option("--limit <n>", "how many messages to look at", "20").action(async (options) => {
-    const limit = Number(options.limit ?? 20);
-    await run({ verb: "read", limit: Number.isFinite(limit) && limit > 0 ? Math.min(limit, 200) : 20 });
+  guest.command("read").description(`Read the deliveries waiting for this guest endpoint (default ${DELIVERIES_LIMIT_DEFAULT}, at most ${DELIVERIES_LIMIT_MAX})`).option("--limit <n>", `how many deliveries to look at (1-${DELIVERIES_LIMIT_MAX})`, String(DELIVERIES_LIMIT_DEFAULT)).action(async (options) => {
+    const limit = Number(options.limit ?? DELIVERIES_LIMIT_DEFAULT);
+    await run({ verb: "read", limit: deliveriesLimit(limit) });
   });
-  guest.command("send").description("Send a coordination message to a peer endpoint (e.g. the MM Coordinator)").requiredOption("--to <address>", "peer endpoint address").requiredOption("--message <text>", "the coordination message").action(async (options) => {
+  guest.command("send").description("Send a coordination message to the MM Coordinator").requiredOption("--to <address>", "peer endpoint id or display name (the MM Coordinator)").requiredOption("--message <text>", "the coordination message").action(async (options) => {
     await run({ verb: "send", to: options.to, message: options.message });
   });
-  guest.command("join").description("Request to join a suite").requiredOption("--suite <name>", "suite name").action(async (options) => {
+  guest.command("join").description("Request to join a suite (a message to the MM Coordinator, who grants it)").requiredOption("--suite <name>", "suite name").action(async (options) => {
     await run({ verb: "join", suite: options.suite });
   });
   guest.command("leave").description("Leave the suite and withdraw this guest endpoint").action(async () => {
@@ -52970,7 +53257,7 @@ init_github_client();
 init_cli_shared();
 
 // src/suite-status.ts
-var import_node_crypto19 = require("node:crypto");
+var import_node_crypto20 = require("node:crypto");
 var SUITE_REPO = "mutmutco/MM-Work";
 var REPOS = {
   "mmi-scout": "mutmutco/MMI-Scout",
@@ -52998,7 +53285,7 @@ function parseSuiteMapping(body) {
     return void 0;
   }
 }
-var sha2562 = (b) => (0, import_node_crypto19.createHash)("sha256").update(b).digest("hex");
+var sha2562 = (b) => (0, import_node_crypto20.createHash)("sha256").update(b).digest("hex");
 async function proveBundle(url, tag, fetchUrl) {
   const get = async (u) => {
     try {
@@ -53254,8 +53541,8 @@ async function waitSuiteDev(deps, opts) {
 
 // src/suite-train.ts
 var import_node_fs41 = require("node:fs");
-var import_node_path38 = require("node:path");
-var import_node_crypto20 = require("node:crypto");
+var import_node_path39 = require("node:path");
+var import_node_crypto21 = require("node:crypto");
 
 // src/kit-version.ts
 var parse = (v) => /^(\d+)\.(\d+)\.(\d+)(-.+)?$/.exec(typeof v === "string" ? v.trim() : "");
@@ -53356,8 +53643,8 @@ function readSuiteCut(path2) {
   return record2;
 }
 function writeSuiteCut(path2, record2) {
-  (0, import_node_fs41.mkdirSync)((0, import_node_path38.dirname)(path2), { recursive: true });
-  const temp = `${path2}.${(0, import_node_crypto20.randomBytes)(8).toString("hex")}.tmp`;
+  (0, import_node_fs41.mkdirSync)((0, import_node_path39.dirname)(path2), { recursive: true });
+  const temp = `${path2}.${(0, import_node_crypto21.randomBytes)(8).toString("hex")}.tmp`;
   try {
     (0, import_node_fs41.writeFileSync)(temp, JSON.stringify(record2, null, 2), { flag: "wx" });
     (0, import_node_fs41.renameSync)(temp, path2);
@@ -53416,7 +53703,7 @@ async function retireFailedLeadRcLedger(deps, ownerGo) {
     if (ledger.repo !== SUITE_REPO || ledger.lane !== "rcand" || ledger.phases.promotion.state === "complete" || !states.includes("failed")) return void 0;
     if (!ownerGo) throw new Error(`the lead's failed rcand ledger for ${ledger.tag} blocks every train; retire it with suite abandon --owner-go`);
     if ((await deps.rcHead())?.toLowerCase() === ledger.tagSha.toLowerCase()) throw new Error(`origin rc already points at ${ledger.tag}; it was promoted, so its ledger is not retired`);
-    const archive = (0, import_node_path38.join)((0, import_node_path38.dirname)(deps.ledgerPath), `phases.archive-${ledger.tag}.json`);
+    const archive = (0, import_node_path39.join)((0, import_node_path39.dirname)(deps.ledgerPath), `phases.archive-${ledger.tag}.json`);
     if ((0, import_node_fs41.existsSync)(archive)) throw new Error(`ledger archive already exists at ${archive}; inspect before retiring again`);
     await deps.markAbandoned(SUITE_REPO, ledger.tag, ledger.tagSha);
     await fence(() => (0, import_node_fs41.renameSync)(deps.ledgerPath, archive));
@@ -53783,7 +54070,7 @@ Each member's live release must serve <data>/main/module.js at its main pin path
   }
   return record2;
 }
-var hotfixRecordPath = (deps) => (0, import_node_path38.join)((0, import_node_path38.dirname)(deps.recordPath), "hotfix.json");
+var hotfixRecordPath = (deps) => (0, import_node_path39.join)((0, import_node_path39.dirname)(deps.recordPath), "hotfix.json");
 function readSuiteHotfix(path2) {
   let raw;
   try {
@@ -54098,20 +54385,20 @@ async function runRcDataSwitch(deps, opts) {
 
 // src/suite-train-io.ts
 var import_node_child_process19 = require("node:child_process");
-var import_node_path51 = require("node:path");
-var import_node_fs55 = require("node:fs");
 var import_node_path52 = require("node:path");
+var import_node_fs55 = require("node:fs");
+var import_node_path53 = require("node:path");
 init_cli_shared();
 
 // src/command-register-train-operations.ts
-var import_promises9 = require("node:fs/promises");
+var import_promises10 = require("node:fs/promises");
 init_clean_exit();
 init_cli_shared();
 init_client_version();
 init_house_map();
 
 // src/hotfix-apply.ts
-var import_promises5 = require("node:fs/promises");
+var import_promises6 = require("node:fs/promises");
 
 // src/release-announce.ts
 var ANNOUNCE_REPO = "mutmutco/MMI-Hub";
@@ -54454,8 +54741,8 @@ async function preflightHotfixBatchPicks(deps, sources, pickTolerated) {
   if (sources.length === 0) return { failures: [], skipped: [] };
   const { mkdtemp: mkdtemp2, rm: rm2 } = await import("node:fs/promises");
   const { tmpdir: tmpdir13 } = await import("node:os");
-  const { join: join54 } = await import("node:path");
-  const dir = await mkdtemp2(join54(tmpdir13(), "mmi-hotfix-preflight-"));
+  const { join: join55 } = await import("node:path");
+  const dir = await mkdtemp2(join55(tmpdir13(), "mmi-hotfix-preflight-"));
   const wt = { run: (file, args) => deps.run(file, file === "git" ? ["-C", dir, ...args] : args) };
   const failures = [];
   const skipped = [];
@@ -55167,7 +55454,7 @@ async function runHotfixReleaseLocked(deps, versionInput, options, doctor) {
     }
     let lines2;
     try {
-      lines2 = summaryFileLines(await (deps.readFile ?? ((p) => (0, import_promises5.readFile)(p, "utf8")))(options.announceSummaryFile));
+      lines2 = summaryFileLines(await (deps.readFile ?? ((p) => (0, import_promises6.readFile)(p, "utf8")))(options.announceSummaryFile));
     } catch (e) {
       throw new Error(`could not read --announce-summary-file ${options.announceSummaryFile}: ${e.message} \u2014 see https://github.com/mutmutco/MMI-Hub/blob/development/docs/Guides/train-troubleshooting.md#announce-summary-missing`);
     }
@@ -55793,8 +56080,8 @@ function checkHotfixCarries(options) {
 
 // src/merge-cleanup.ts
 var import_node_fs42 = require("node:fs");
-var import_node_path39 = require("node:path");
-var import_node_os22 = require("node:os");
+var import_node_path40 = require("node:path");
+var import_node_os23 = require("node:os");
 init_cli_shared();
 init_github_client();
 
@@ -56201,8 +56488,8 @@ function resolveSquashMergeBodyText(commits, allowedClosing, cwd) {
   return rewritten === base ? null : rewritten;
 }
 function writeSquashBodyFile(body) {
-  const dir = (0, import_node_fs42.mkdtempSync)((0, import_node_path39.join)((0, import_node_os22.tmpdir)(), "mmi-squash-body-"));
-  const path2 = (0, import_node_path39.join)(dir, "body.txt");
+  const dir = (0, import_node_fs42.mkdtempSync)((0, import_node_path40.join)((0, import_node_os23.tmpdir)(), "mmi-squash-body-"));
+  const path2 = (0, import_node_path40.join)(dir, "body.txt");
   (0, import_node_fs42.writeFileSync)(path2, body.endsWith("\n") ? body : `${body}
 `, "utf8");
   return { path: path2, cleanup: () => {
@@ -56458,9 +56745,9 @@ async function deleteMergedRemoteBranch(options) {
 init_github_client();
 
 // src/release-custody.ts
-var import_node_crypto21 = require("node:crypto");
+var import_node_crypto22 = require("node:crypto");
 var import_node_fs43 = require("node:fs");
-var import_node_path40 = require("node:path");
+var import_node_path41 = require("node:path");
 init_github_client();
 
 // src/release-custody-bootstrap.ts
@@ -56682,7 +56969,7 @@ var ReleaseCustodyError = class extends Error {
     this.name = "ReleaseCustodyError";
   }
 };
-var custodyDigest = (value) => (0, import_node_crypto21.createHash)("sha256").update(value).digest("hex");
+var custodyDigest = (value) => (0, import_node_crypto22.createHash)("sha256").update(value).digest("hex");
 function parseCustody(raw, repo) {
   const s = JSON.parse(raw);
   if (s.schema !== "mmi-release-custody/v1" || s.repo !== repo || !s.precutId || !Number.isSafeInteger(s.revision) || s.revision < 1 || !s.controller || !Number.isSafeInteger(s.controller.runId) || s.controller.runId <= 0 || !Number.isSafeInteger(s.controller.runAttempt) || s.controller.runAttempt <= 0 || !s.controller.token || !(s.ledger === null || typeof s.ledger === "string") || !s.archives || !s.effects) {
@@ -56783,7 +57070,7 @@ var ReleaseCustodySession = class _ReleaseCustodySession {
       }
     }
     let state = {
-      ...found.state ?? { schema: "mmi-release-custody/v1", repo, precutId: (0, import_node_crypto21.randomUUID)(), effects: {}, ...await initialize() },
+      ...found.state ?? { schema: "mmi-release-custody/v1", repo, precutId: (0, import_node_crypto22.randomUUID)(), effects: {}, ...await initialize() },
       revision: (found.state?.revision ?? 0) + 1,
       controller
     };
@@ -56844,7 +57131,7 @@ var ReleaseCustodySession = class _ReleaseCustodySession {
           proof: { kind: "ledger-lifecycle", controller: state.controller }
         };
       }
-      return { ...state, ledger: raw, archives, precutId: state.ledger && !raw ? (0, import_node_crypto21.randomUUID)() : state.precutId };
+      return { ...state, ledger: raw, archives, precutId: state.ledger && !raw ? (0, import_node_crypto22.randomUUID)() : state.precutId };
     });
   }
   async preserveLocal(raw) {
@@ -56960,10 +57247,10 @@ function localRaw(path2) {
 function hydrateLocal(path2, raw) {
   const previous = localRaw(path2);
   if (previous === raw) return;
-  (0, import_node_fs43.mkdirSync)((0, import_node_path40.dirname)(path2), { recursive: true });
+  (0, import_node_fs43.mkdirSync)((0, import_node_path41.dirname)(path2), { recursive: true });
   if (previous !== null) {
     const ledger = parseReleaseLedger(previous);
-    const archive = (0, import_node_path40.join)((0, import_node_path40.dirname)(path2), `phases.local-${ledger.tagSha}-${custodyDigest(previous)}.json`);
+    const archive = (0, import_node_path41.join)((0, import_node_path41.dirname)(path2), `phases.local-${ledger.tagSha}-${custodyDigest(previous)}.json`);
     if (!(0, import_node_fs43.existsSync)(archive)) (0, import_node_fs43.writeFileSync)(archive, previous, { flag: "wx" });
     if (raw === null) (0, import_node_fs43.renameSync)(path2, `${path2}.retired-${custodyDigest(previous)}`);
   }
@@ -57078,7 +57365,7 @@ function withHubReleaseCustody(deps) {
         if (!authority.ok || !authority.train || authority.authenticatedDelegation !== true) {
           throw new ReleaseCustodyError("repository custody requires the server-verified owner-triggered train session");
         }
-        const controller = { ...runIdentity, token: (0, import_node_crypto21.randomUUID)(), ...process.env.GITHUB_JOB ? { job: process.env.GITHUB_JOB } : {} };
+        const controller = { ...runIdentity, token: (0, import_node_crypto22.randomUUID)(), ...process.env.GITHUB_JOB ? { job: process.env.GITHUB_JOB } : {} };
         const raw = localRaw(path2);
         const requiredContexts = () => discoverRequiredCheckContexts(
           deps,
@@ -57159,7 +57446,7 @@ function withHubReleaseCustody(deps) {
 
 // src/project-info-sync.ts
 var import_node_fs44 = require("node:fs");
-var import_node_path41 = require("node:path");
+var import_node_path42 = require("node:path");
 var UPDATE_PROJECT_INFO = `mutation($projectId: ID!, $shortDescription: String!, $readme: String!) {
   updateProjectV2(input: { projectId: $projectId, shortDescription: $shortDescription, readme: $readme }) {
     projectV2 { id }
@@ -57206,7 +57493,7 @@ function sharedName(entries, fallback) {
 }
 function buildProjectInfoSyncPlan(targetRepo2, project2, projects, repoRoot2) {
   if (!project2.projectId) throw new Error(`org project sync-info: ${targetRepo2} registry META has no projectId`);
-  const readmePath = (0, import_node_path41.join)(repoRoot2, "README.md");
+  const readmePath = (0, import_node_path42.join)(repoRoot2, "README.md");
   if (!(0, import_node_fs44.existsSync)(readmePath)) throw new Error(`org project sync-info: ${targetRepo2} has no README.md`);
   const entries = entriesFor(project2, projects);
   const memberRepos = [...new Set(entries.flatMap((entry) => entry.repos ?? []))].filter((repo) => /^[^/]+\/[^/]+$/.test(repo)).sort((a, b) => a.localeCompare(b));
@@ -57232,8 +57519,8 @@ function buildProjectInfoSyncPlan(targetRepo2, project2, projects, repoRoot2) {
   const targetBase = `https://github.com/${targetRepo2}`;
   const targetBranch = branchFor(targetRepo2, projects);
   const orgDocs = [
-    (0, import_node_fs44.existsSync)((0, import_node_path41.join)(repoRoot2, "architecture.md")) ? `- [Hub architecture](${targetBase}/blob/${targetBranch}/architecture.md)` : "",
-    (0, import_node_fs44.existsSync)((0, import_node_path41.join)(repoRoot2, "docs", "Architecture", "agentic-dev-environment.md")) ? `- [Agentic development environment](${targetBase}/blob/${targetBranch}/docs/Architecture/agentic-dev-environment.md)` : ""
+    (0, import_node_fs44.existsSync)((0, import_node_path42.join)(repoRoot2, "architecture.md")) ? `- [Hub architecture](${targetBase}/blob/${targetBranch}/architecture.md)` : "",
+    (0, import_node_fs44.existsSync)((0, import_node_path42.join)(repoRoot2, "docs", "Architecture", "agentic-dev-environment.md")) ? `- [Agentic development environment](${targetBase}/blob/${targetBranch}/docs/Architecture/agentic-dev-environment.md)` : ""
   ].filter(Boolean);
   if (orgDocs.length) lines2.push("", "## Organisation docs", "", ...orgDocs);
   return { projectId: project2.projectId, projectName, targetRepo: targetRepo2, memberRepos, shortDescription, readme: `${lines2.join("\n")}
@@ -57256,7 +57543,7 @@ async function syncProjectInfo(plan, client, apply) {
 
 // src/train-commands.ts
 var import_node_fs45 = require("node:fs");
-var import_node_path42 = require("node:path");
+var import_node_path43 = require("node:path");
 init_cli_shared();
 init_clean_exit();
 init_client_version();
@@ -57271,7 +57558,7 @@ function resolveReleaseBumpIntent(raw) {
 }
 function readRepoVersion() {
   try {
-    return JSON.parse((0, import_node_fs45.readFileSync)((0, import_node_path42.join)(process.cwd(), ".claude-plugin", "plugin.json"), "utf8")).version || void 0;
+    return JSON.parse((0, import_node_fs45.readFileSync)((0, import_node_path43.join)(process.cwd(), ".claude-plugin", "plugin.json"), "utf8")).version || void 0;
   } catch {
     return void 0;
   }
@@ -57381,8 +57668,8 @@ function releaseProgressVerdict(status, subject = "Release") {
 }
 
 // src/suite-pin.ts
-var import_promises6 = require("node:fs/promises");
-var import_node_path43 = require("node:path");
+var import_promises7 = require("node:fs/promises");
+var import_node_path44 = require("node:path");
 var SuitePinError = class _SuitePinError extends Error {
   diagnostic;
   constructor(repo, tag, error) {
@@ -57450,8 +57737,8 @@ async function openSuiteCutPinPr(deps, input) {
       if (input.carriedOnly) return { status: "unchanged" };
       throw new Error("pins already match without a merged cut PR \u2014 provenance unverified");
     }
-    await (0, import_promises6.mkdir)((0, import_node_path43.join)(deps.root, "tmp"), { recursive: true });
-    scratch = await (0, import_promises6.mkdtemp)((0, import_node_path43.join)(deps.root, "tmp", "suite-pin-"));
+    await (0, import_promises7.mkdir)((0, import_node_path44.join)(deps.root, "tmp"), { recursive: true });
+    scratch = await (0, import_promises7.mkdtemp)((0, import_node_path44.join)(deps.root, "tmp", "suite-pin-"));
     const run = (file, args) => deps.run(file, args, scratch);
     await run("git", ["clone", "--quiet", "--branch", prs.length ? branch : "development", "--single-branch", `https://github.com/${SUITE_REPO}.git`, "."]);
     if (prs.length) {
@@ -57463,8 +57750,8 @@ async function openSuiteCutPinPr(deps, input) {
       await run("git", ["switch", "-c", branch]);
     }
     for (const stage of ["rc", "main"]) {
-      const path2 = (0, import_node_path43.join)(scratch, `${stage}-pins.json`);
-      await (0, import_promises6.writeFile)(path2, JSON.stringify(input.pins.map((p) => ({ module: p.module, url: p[stage] }))));
+      const path2 = (0, import_node_path44.join)(scratch, `${stage}-pins.json`);
+      await (0, import_promises7.writeFile)(path2, JSON.stringify(input.pins.map((p) => ({ module: p.module, url: p[stage] }))));
       await run("node", ["scripts/pin-modules.mjs", "--stage", stage, "--pins", path2]);
     }
     await run("git", ["add", "seed/modules.json"]);
@@ -57494,7 +57781,7 @@ async function openSuiteCutPinPr(deps, input) {
   } catch (e) {
     throw new Error(`suite cut pin PR FAILED: ${e.message}; merge/verify the single ${SUITE_REPO} development pin PR, then rerun the cut (never recut member tags)`);
   } finally {
-    if (scratch) await (0, import_promises6.rm)(scratch, { recursive: true, force: true });
+    if (scratch) await (0, import_promises7.rm)(scratch, { recursive: true, force: true });
   }
 }
 async function openSuiteRestorePinPr(deps, input) {
@@ -57516,13 +57803,13 @@ async function openSuiteRestorePinPr(deps, input) {
       }
     });
     if (!todo.length) return void 0;
-    await (0, import_promises6.mkdir)((0, import_node_path43.join)(deps.root, "tmp"), { recursive: true });
-    scratch = await (0, import_promises6.mkdtemp)((0, import_node_path43.join)(deps.root, "tmp", "suite-pin-"));
+    await (0, import_promises7.mkdir)((0, import_node_path44.join)(deps.root, "tmp"), { recursive: true });
+    scratch = await (0, import_promises7.mkdtemp)((0, import_node_path44.join)(deps.root, "tmp", "suite-pin-"));
     const run = (file, args) => deps.run(file, args, scratch);
     await run("git", ["clone", "--quiet", "--branch", "development", "--single-branch", `https://github.com/${SUITE_REPO}.git`, "."]);
     await run("git", ["switch", "-c", branch]);
-    const path2 = (0, import_node_path43.join)(scratch, "main-pins.json");
-    await (0, import_promises6.writeFile)(path2, JSON.stringify(todo.map((p) => ({ module: p.module, url: p.prior }))));
+    const path2 = (0, import_node_path44.join)(scratch, "main-pins.json");
+    await (0, import_promises7.writeFile)(path2, JSON.stringify(todo.map((p) => ({ module: p.module, url: p.prior }))));
     await run("node", ["scripts/pin-modules.mjs", "--stage", "main", "--pins", path2]);
     await run("git", ["add", "seed/modules.json"]);
     await run("git", ["commit", "-m", `Restore main pins of abandoned suite cut ${input.cut.slice(0, 12)} (#7758)`]);
@@ -57547,7 +57834,7 @@ async function openSuiteRestorePinPr(deps, input) {
   } catch (e) {
     throw new Error(`suite restore pin PR FAILED: ${e.message}; rerun suite abandon --owner-go (the record is kept until the restore PR exists)`);
   } finally {
-    if (scratch) await (0, import_promises6.rm)(scratch, { recursive: true, force: true });
+    if (scratch) await (0, import_promises7.rm)(scratch, { recursive: true, force: true });
   }
 }
 async function openSuitePinPr(deps, input) {
@@ -57595,8 +57882,8 @@ async function openSuitePinPr(deps, input) {
     if (newer.length) return { status: "superseded", pr: newer[0].url, url: pin };
     const open2 = onBranch.find((p) => p.state === "OPEN");
     if (open2 && tagOf(open2.title ?? "") === tag) return { status: "pending", pr: open2.url, url: pin };
-    await (0, import_promises6.mkdir)((0, import_node_path43.join)(deps.root, "tmp"), { recursive: true });
-    scratch = await (0, import_promises6.mkdtemp)((0, import_node_path43.join)(deps.root, "tmp", "suite-pin-"));
+    await (0, import_promises7.mkdir)((0, import_node_path44.join)(deps.root, "tmp"), { recursive: true });
+    scratch = await (0, import_promises7.mkdtemp)((0, import_node_path44.join)(deps.root, "tmp", "suite-pin-"));
     const run = (file, args) => deps.run(file, args, scratch);
     await run("git", ["clone", "--quiet", "--branch", "development", "--single-branch", `https://github.com/${SUITE_REPO}.git`, "."]);
     await run("git", ["switch", "-c", branch]);
@@ -57623,7 +57910,7 @@ async function openSuitePinPr(deps, input) {
   } finally {
     if (scratch) {
       try {
-        await (0, import_promises6.rm)(scratch, { recursive: true, force: true });
+        await (0, import_promises7.rm)(scratch, { recursive: true, force: true });
       } catch (e) {
         const cleanupFailure = failure ?? new SuitePinError(repo, tag, e);
         cleanupFailure.diagnostic.cleanupFailed = true;
@@ -57649,7 +57936,7 @@ function prTitleRefusal(title) {
 // src/command-register-collaboration.ts
 var import_node_child_process18 = require("node:child_process");
 var import_node_fs54 = require("node:fs");
-var import_promises8 = require("node:fs/promises");
+var import_promises9 = require("node:fs/promises");
 init_clean_exit();
 init_cli_shared();
 init_error_codes();
@@ -57672,11 +57959,11 @@ function spawnDetachedSelf(args, deps, opts = {}) {
 }
 
 // src/command-register-collaboration.ts
-var import_node_path50 = require("node:path");
+var import_node_path51 = require("node:path");
 init_house_map();
 
 // src/issue-body.ts
-var import_node_os23 = require("node:os");
+var import_node_os24 = require("node:os");
 init_error_codes();
 var TextArgError = class extends Error {
   constructor(message2, code, offendingFlag) {
@@ -57689,7 +57976,7 @@ var TextArgError = class extends Error {
   offendingFlag;
 };
 function emptyStdinMessage(fileFlag) {
-  if ((0, import_node_os23.platform)() === "win32") {
+  if ((0, import_node_os24.platform)() === "win32") {
     return `${fileFlag} - read empty stdin (on Windows, ${fileFlag} - is unreliable through the npm .cmd shim \u2014 use ${fileFlag} <path>, or pipe to \`node cli/dist/index.cjs\` directly)`;
   }
   return `${fileFlag} - read empty stdin (nothing piped \u2014 pass a heredoc/pipe, or ${fileFlag} <path>)`;
@@ -57790,7 +58077,7 @@ init_github_quota();
 
 // src/issue-commands.ts
 var import_node_fs46 = require("node:fs");
-var import_node_crypto22 = require("node:crypto");
+var import_node_crypto23 = require("node:crypto");
 init_cli_shared();
 init_clean_exit();
 init_error_codes();
@@ -58267,7 +58554,7 @@ function rowIdempotencyKey(batchKey, spec) {
   const identity = `${spec.type}
 ${spec.title.trim()}
 ${spec.body ?? ""}`;
-  const hash = (0, import_node_crypto22.createHash)("sha256").update(identity).digest("hex").slice(0, 16);
+  const hash = (0, import_node_crypto23.createHash)("sha256").update(identity).digest("hex").slice(0, 16);
   return `${batchKey}:${hash}`;
 }
 var BATCH_SPEC_KEYS = /* @__PURE__ */ new Set(["type", "title", "body", "priority", "labels", "label", "parent", "repo", "surface"]);
@@ -58727,7 +59014,7 @@ ${lines2}`, {
 
 // src/post-merge-recon.ts
 var import_node_fs47 = require("node:fs");
-var import_node_path44 = require("node:path");
+var import_node_path45 = require("node:path");
 
 // src/cross-repo-filing-issue.ts
 init_github_client();
@@ -58897,7 +59184,7 @@ function buildPostMergeReconRecovery(input) {
 }
 function writePostMergeReconRecovery(cwd, recovery) {
   const path2 = postMergeReconStatePath(cwd, recovery.repo, recovery.pr);
-  (0, import_node_fs47.mkdirSync)((0, import_node_path44.dirname)(path2), { recursive: true });
+  (0, import_node_fs47.mkdirSync)((0, import_node_path45.dirname)(path2), { recursive: true });
   (0, import_node_fs47.writeFileSync)(path2, `${JSON.stringify(recovery, null, 2)}
 `, "utf8");
   return path2;
@@ -58937,7 +59224,7 @@ function postMergeReconWarnings(input) {
 }
 
 // src/pr-commands.ts
-var import_promises7 = require("node:fs/promises");
+var import_promises8 = require("node:fs/promises");
 init_cli_shared();
 
 // src/api-read.ts
@@ -60430,10 +60717,10 @@ function registerPrLifecycleCommands(program3) {
     let body;
     try {
       if (o.title || o.titleFile) {
-        title = await resolveIssueTitle({ title: o.title, titleFile: o.titleFile }, { readFile: import_promises7.readFile, readStdin });
+        title = await resolveIssueTitle({ title: o.title, titleFile: o.titleFile }, { readFile: import_promises8.readFile, readStdin });
       }
       if (o.body || o.bodyFile) {
-        body = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises7.readFile, readStdin });
+        body = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises8.readFile, readStdin });
       }
     } catch (e) {
       return fail(`pr edit: ${e.message}`);
@@ -60464,7 +60751,7 @@ function registerPrLifecycleCommands(program3) {
     }
     let body;
     try {
-      body = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises7.readFile, readStdin });
+      body = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises8.readFile, readStdin });
     } catch (e) {
       return fail(`pr comment: ${e.message}`);
     }
@@ -60749,8 +61036,8 @@ function registerPrLifecycleCommands(program3) {
 // src/review-verdict.ts
 var import_node_child_process15 = require("node:child_process");
 var import_node_fs49 = require("node:fs");
-var import_node_os24 = require("node:os");
-var import_node_path45 = require("node:path");
+var import_node_os25 = require("node:os");
+var import_node_path46 = require("node:path");
 init_cli_shared();
 var REVIEW_VERDICT_MARKER = "<!-- zeroci-review v1 -->";
 var REVIEW_VERDICTS = ["PROCEED", "CORRECT", "ESCALATE"];
@@ -60915,8 +61202,8 @@ async function readPrIssueComments(number, repo) {
   return comments;
 }
 async function postPrCommentFromFile(number, repo, body) {
-  const dir = (0, import_node_fs49.mkdtempSync)((0, import_node_path45.join)((0, import_node_os24.tmpdir)(), "mmi-review-verdict-"));
-  const path2 = (0, import_node_path45.join)(dir, "body.md");
+  const dir = (0, import_node_fs49.mkdtempSync)((0, import_node_path46.join)((0, import_node_os25.tmpdir)(), "mmi-review-verdict-"));
+  const path2 = (0, import_node_path46.join)(dir, "body.md");
   try {
     (0, import_node_fs49.writeFileSync)(path2, body, "utf8");
     const { stdout } = await execFileP("gh", ["pr", "comment", number, "--repo", repo, "--body-file", path2], { timeout: GH_MUTATION_TIMEOUT_MS });
@@ -61412,17 +61699,17 @@ function createPreparationDeps(input, io = {}) {
 
 // src/worktree-residue-sweep.ts
 var import_node_fs53 = require("node:fs");
-var import_node_path49 = require("node:path");
+var import_node_path50 = require("node:path");
 
 // src/worktree-merge-cleanup.ts
 var import_node_fs52 = require("node:fs");
-var import_node_path48 = require("node:path");
+var import_node_path49 = require("node:path");
 init_cli_shared();
 
 // src/stage-runner.ts
 var import_node_child_process17 = require("node:child_process");
 var import_node_fs51 = require("node:fs");
-var import_node_path47 = require("node:path");
+var import_node_path48 = require("node:path");
 var import_node_net = require("node:net");
 var import_node_util5 = require("node:util");
 
@@ -61433,7 +61720,7 @@ function normalizeEol2(s) {
 
 // src/env-detection.ts
 var import_node_fs50 = require("node:fs");
-var import_node_path46 = require("node:path");
+var import_node_path47 = require("node:path");
 var SKIPPED_DIRS = /* @__PURE__ */ new Set([".git", "node_modules", "dist", ".jerv", ".pi", ".venv", "venv"]);
 function isEnvBaseName(name) {
   return name.toLowerCase() === ".env";
@@ -61451,13 +61738,13 @@ function findEnvFiles(root) {
       const relPath = rel ? `${rel}/${entry.name}` : entry.name;
       if (entry.isDirectory()) {
         if (SKIPPED_DIRS.has(entry.name)) continue;
-        walk2((0, import_node_path46.join)(dir, entry.name), relPath);
+        walk2((0, import_node_path47.join)(dir, entry.name), relPath);
         continue;
       }
       if (isEnvBaseName(entry.name)) {
         let isDir = false;
         try {
-          isDir = (0, import_node_fs50.lstatSync)((0, import_node_path46.join)(dir, entry.name)).isDirectory();
+          isDir = (0, import_node_fs50.lstatSync)((0, import_node_path47.join)(dir, entry.name)).isDirectory();
         } catch {
         }
         if (!isDir) found.push(relPath);
@@ -61596,10 +61883,10 @@ var DOCKER_TIMEOUT_MS = 15e3;
 function stageBash() {
   if (process.platform !== "win32") return "bash";
   const configured = process.env.SHELL;
-  if (configured && (0, import_node_path47.isAbsolute)(configured) && /[/\\]bash(?:\.exe)?$/i.test(configured) && !/[/\\](?:System32|Sysnative)[/\\]bash(?:\.exe)?$/i.test(configured) && (0, import_node_fs51.existsSync)(configured)) return configured;
+  if (configured && (0, import_node_path48.isAbsolute)(configured) && /[/\\]bash(?:\.exe)?$/i.test(configured) && !/[/\\](?:System32|Sysnative)[/\\]bash(?:\.exe)?$/i.test(configured) && (0, import_node_fs51.existsSync)(configured)) return configured;
   const candidates = [
-    (0, import_node_path47.join)(process.env.ProgramFiles || "C:\\Program Files", "Git", "bin", "bash.exe"),
-    ...process.env.LOCALAPPDATA ? [(0, import_node_path47.join)(process.env.LOCALAPPDATA, "Programs", "Git", "bin", "bash.exe")] : []
+    (0, import_node_path48.join)(process.env.ProgramFiles || "C:\\Program Files", "Git", "bin", "bash.exe"),
+    ...process.env.LOCALAPPDATA ? [(0, import_node_path48.join)(process.env.LOCALAPPDATA, "Programs", "Git", "bin", "bash.exe")] : []
   ];
   const bash = candidates.find((path2) => (0, import_node_fs51.existsSync)(path2));
   if (!bash) throw new Error("Local stages require Git Bash on Windows. Install Git for Windows or set SHELL to its absolute bash.exe path.");
@@ -61739,7 +62026,7 @@ function appendForceRecreate(up) {
   return `${up.trimEnd()} --force-recreate`;
 }
 function stageStatePath(cwd = process.cwd()) {
-  return (0, import_node_path47.join)(cwd, "tmp", "stage", "state.json");
+  return (0, import_node_path48.join)(cwd, "tmp", "stage", "state.json");
 }
 function normPath(path2) {
   return path2.replace(/\\/g, "/").replace(/\/+$/, "").toLowerCase();
@@ -61956,7 +62243,7 @@ function stageProcessEnv(stagePort, extraEnv) {
 }
 function composeResolvesPort(cwd) {
   if (process.env.PORT) return true;
-  const envFile = (0, import_node_path47.join)(cwd, ".env");
+  const envFile = (0, import_node_path48.join)(cwd, ".env");
   return (0, import_node_fs51.existsSync)(envFile) && envFileKeys((0, import_node_fs51.readFileSync)(envFile, "utf8")).has("PORT");
 }
 function stageComposeEnv(config, stagePort, vaultEnvMerge, cwd) {
@@ -61972,13 +62259,13 @@ function stageComposeEnv(config, stagePort, vaultEnvMerge, cwd) {
 function stageComposeFiles(cwd) {
   const files = ["docker-compose.yml"];
   for (const conventional of ["docker-compose.override.yml", "docker-compose.override.yaml"]) {
-    if ((0, import_node_fs51.existsSync)((0, import_node_path47.join)(cwd, conventional))) files.push(conventional);
+    if ((0, import_node_fs51.existsSync)((0, import_node_path48.join)(cwd, conventional))) files.push(conventional);
   }
   return [...files, RUNTIME_ENV_OVERRIDE_RELPATH];
 }
 async function prepareRuntimeEnvPassthrough(cwd, composeEnv, vaultEnvMerge) {
   const keys = Object.keys(vaultEnvMerge ?? {});
-  if (!keys.length || !(0, import_node_fs51.existsSync)((0, import_node_path47.join)(cwd, "docker-compose.yml"))) return {};
+  if (!keys.length || !(0, import_node_fs51.existsSync)((0, import_node_path48.join)(cwd, "docker-compose.yml"))) return {};
   let configJson;
   try {
     const { stdout } = await execFileP3("docker", ["compose", "config", "--format", "json"], {
@@ -61994,15 +62281,15 @@ async function prepareRuntimeEnvPassthrough(cwd, composeEnv, vaultEnvMerge) {
   }
   const body = renderRuntimeEnvOverride(runtimeEnvMarkedServices(configJson), keys, runtimeEnvExcludes(configJson), runtimeEnvSelects(configJson));
   if (!body) return {};
-  const overridePath = (0, import_node_path47.join)(cwd, RUNTIME_ENV_OVERRIDE_RELPATH);
-  (0, import_node_fs51.mkdirSync)((0, import_node_path47.join)(cwd, "tmp", "stage"), { recursive: true });
+  const overridePath = (0, import_node_path48.join)(cwd, RUNTIME_ENV_OVERRIDE_RELPATH);
+  (0, import_node_fs51.mkdirSync)((0, import_node_path48.join)(cwd, "tmp", "stage"), { recursive: true });
   (0, import_node_fs51.writeFileSync)(overridePath, body, "utf8");
   return stageComposeFileEnv(stageComposeFiles(cwd));
 }
 async function ensureStageRuntimeEnv(config, opts, cwd) {
   if (!config.ensureEnv) return;
-  const target = (0, import_node_path47.join)(cwd, config.ensureEnv.target);
-  const example = (0, import_node_path47.join)(cwd, config.ensureEnv.example);
+  const target = (0, import_node_path48.join)(cwd, config.ensureEnv.target);
+  const example = (0, import_node_path48.join)(cwd, config.ensureEnv.example);
   if (!(0, import_node_fs51.existsSync)(target) && (0, import_node_fs51.existsSync)(example)) {
     (0, import_node_fs51.copyFileSync)(example, target);
   } else if ((0, import_node_fs51.existsSync)(target) && (0, import_node_fs51.existsSync)(example)) {
@@ -62356,7 +62643,7 @@ function normPath2(p) {
   return p.replace(/\\/g, "/").replace(/\/+$/, "");
 }
 function unlinkNodeModulesJunction(wtPath) {
-  const nm = (0, import_node_path48.join)(wtPath, "node_modules");
+  const nm = (0, import_node_path49.join)(wtPath, "node_modules");
   try {
     if ((0, import_node_fs52.lstatSync)(nm).isSymbolicLink()) (0, import_node_fs52.rmdirSync)(nm);
     return { ok: true };
@@ -62493,7 +62780,7 @@ async function preCleanWorktreeForRemoval(wtPath, execGit) {
 }
 async function listNestedIgnoredNodeModules(wtPath, execGit) {
   const out = await execGit(["-C", wtPath, "ls-files", "--others", "--ignored", "--exclude-standard", "--directory"]).catch(() => "");
-  return out.split(/\r?\n/).map((line) => line.trim()).filter((line) => line.endsWith("node_modules/") && line !== "node_modules/").map((line) => (0, import_node_path48.join)(wtPath, line.slice(0, -1)));
+  return out.split(/\r?\n/).map((line) => line.trim()).filter((line) => line.endsWith("node_modules/") && line !== "node_modules/").map((line) => (0, import_node_path49.join)(wtPath, line.slice(0, -1)));
 }
 function safeRemoveTree(path2) {
   const stat4 = (0, import_node_fs52.lstatSync)(path2);
@@ -62506,7 +62793,7 @@ function safeRemoveTree(path2) {
     return;
   }
   if (stat4.isDirectory()) {
-    for (const entry of (0, import_node_fs52.readdirSync)(path2)) safeRemoveTree((0, import_node_path48.join)(path2, entry));
+    for (const entry of (0, import_node_fs52.readdirSync)(path2)) safeRemoveTree((0, import_node_path49.join)(path2, entry));
     (0, import_node_fs52.rmdirSync)(path2);
     return;
   }
@@ -62514,7 +62801,7 @@ function safeRemoveTree(path2) {
 }
 async function removeWorktreeNodeModules(wtPath) {
   try {
-    safeRemoveTree((0, import_node_path48.join)(wtPath, "node_modules"));
+    safeRemoveTree((0, import_node_path49.join)(wtPath, "node_modules"));
     return { ok: true };
   } catch (e) {
     if (e.code === "ENOENT") return { ok: true };
@@ -62559,7 +62846,7 @@ function unlinkEscapingReparsePoints(root, primaryRoot) {
       return { ok: false, error: `cannot scan ${normPath2(dir)} for reparse points: ${errorMessage(e)}` };
     }
     for (const entry of entries) {
-      const child2 = (0, import_node_path48.join)(dir, entry.name);
+      const child2 = (0, import_node_path49.join)(dir, entry.name);
       if (entry.isSymbolicLink()) {
         let target = "";
         try {
@@ -62886,7 +63173,7 @@ async function cleanupPrMergeLocalBranch(branch, options) {
   const preHelperGuard = unlinkEscapingReparsePoints(wtPath, options.primaryRoot);
   if (!preHelperGuard.ok) return refuseReparseEscape(preHelperGuard.error);
   unlinkedReparsePoints.push(...preHelperGuard.unlinked);
-  if (pathExists((0, import_node_path48.join)(wtPath, "node_modules"))) {
+  if (pathExists((0, import_node_path49.join)(wtPath, "node_modules"))) {
     const nmRemoved = await (options.removeRealNodeModules ?? removeWorktreeNodeModules)(wtPath);
     if (!nmRemoved.ok) {
       report.worktree = {
@@ -63022,35 +63309,35 @@ function renderPrMergeCleanupLines(cleanup) {
 // src/worktree-residue-sweep.ts
 var RESIDUE_LEDGER_FILE = "mmi-worktree-residue.json";
 function canonicalWorktreeRoot(primary) {
-  return (0, import_node_path49.join)((0, import_node_path49.dirname)(primary), "mmi-worktrees", (0, import_node_path49.basename)(primary));
+  return (0, import_node_path50.join)((0, import_node_path50.dirname)(primary), "mmi-worktrees", (0, import_node_path50.basename)(primary));
 }
 function lastSegment(p) {
-  return (0, import_node_path49.basename)(p.split(/[\\/]+/).filter(Boolean).pop() ?? p);
+  return (0, import_node_path50.basename)(p.split(/[\\/]+/).filter(Boolean).pop() ?? p);
 }
 function readProvenance(folder, gitCommonDir, exists) {
   const found = {
     path: folder,
     gitdirPresent: false,
-    registrationId: (0, import_node_path49.basename)(folder),
+    registrationId: (0, import_node_path50.basename)(folder),
     registrationPresent: false
   };
   try {
-    const pointer = /^\s*gitdir:\s*(.+?)\s*$/m.exec((0, import_node_fs53.readFileSync)((0, import_node_path49.join)(folder, ".git"), "utf8"));
+    const pointer = /^\s*gitdir:\s*(.+?)\s*$/m.exec((0, import_node_fs53.readFileSync)((0, import_node_path50.join)(folder, ".git"), "utf8"));
     if (pointer) {
       const target = pointer[1];
-      found.gitdir = (0, import_node_path49.isAbsolute)(target) ? target : (0, import_node_path49.join)(folder, target);
+      found.gitdir = (0, import_node_path50.isAbsolute)(target) ? target : (0, import_node_path50.join)(folder, target);
       found.gitdirPresent = exists(found.gitdir);
       found.registrationId = lastSegment(found.gitdir);
     }
   } catch {
   }
   try {
-    found.registrationPresent = exists((0, import_node_path49.join)(gitCommonDir, "worktrees", found.registrationId));
+    found.registrationPresent = exists((0, import_node_path50.join)(gitCommonDir, "worktrees", found.registrationId));
   } catch {
   }
   if (found.gitdir && found.gitdirPresent) {
     try {
-      const head = (0, import_node_fs53.readFileSync)((0, import_node_path49.join)(found.gitdir, "HEAD"), "utf8").trim();
+      const head = (0, import_node_fs53.readFileSync)((0, import_node_path50.join)(found.gitdir, "HEAD"), "utf8").trim();
       const branch = /^ref:\s*(.+?)\s*$/.exec(head);
       if (branch) found.head = branch[1].startsWith("refs/heads/") ? branch[1].slice("refs/heads/".length) : `ref ${branch[1]}`;
       else if (/^[0-9a-f]{7,64}$/i.test(head)) found.head = `detached ${head.slice(0, 12)}`;
@@ -63069,7 +63356,7 @@ function norm2(p) {
   return process.platform === "win32" ? s.toLowerCase() : s;
 }
 function residueLedgerPath(gitCommonDir) {
-  return (0, import_node_path49.join)(gitCommonDir, RESIDUE_LEDGER_FILE);
+  return (0, import_node_path50.join)(gitCommonDir, RESIDUE_LEDGER_FILE);
 }
 function readPaths(file, deps) {
   try {
@@ -63082,7 +63369,7 @@ function readPaths(file, deps) {
 function writePaths(file, paths, deps) {
   try {
     const write = deps.writeLedger ?? ((f, t) => {
-      (0, import_node_fs53.mkdirSync)((0, import_node_path49.dirname)(f), { recursive: true });
+      (0, import_node_fs53.mkdirSync)((0, import_node_path50.dirname)(f), { recursive: true });
       (0, import_node_fs53.writeFileSync)(f, t, "utf8");
     });
     write(file, `${JSON.stringify([...new Set(paths)], null, 1)}
@@ -63142,7 +63429,7 @@ async function sweepWorktreeResidue(gitCommonDir, registered, deps = {}) {
     } catch {
     }
     for (const name of children) {
-      const child2 = (0, import_node_path49.join)(root, name);
+      const child2 = (0, import_node_path50.join)(root, name);
       const key = norm2(child2);
       if (live.has(key) || key === primary || keptKeys.has(key) || !isDir(child2)) continue;
       let entries;
@@ -63194,10 +63481,10 @@ function argvWantsJson2() {
   return process.argv.some((a) => a === "--json" || a.startsWith("--json="));
 }
 function hubRoot() {
-  const fromPkg = (0, import_node_path50.join)(__dirname, "..", "..");
+  const fromPkg = (0, import_node_path51.join)(__dirname, "..", "..");
   const marker = "skills/bootstrap/seeds/manifest.json";
-  if ((0, import_node_fs54.existsSync)((0, import_node_path50.join)(fromPkg, marker))) return fromPkg;
-  if ((0, import_node_fs54.existsSync)((0, import_node_path50.join)(process.cwd(), marker))) return process.cwd();
+  if ((0, import_node_fs54.existsSync)((0, import_node_path51.join)(fromPkg, marker))) return fromPkg;
+  if ((0, import_node_fs54.existsSync)((0, import_node_path51.join)(process.cwd(), marker))) return process.cwd();
   return null;
 }
 function ciAuditDeps() {
@@ -63209,7 +63496,7 @@ function ciAuditDeps() {
     getProjectMeta: async (slug) => fetchProjectBySlug(slug, registryClientDeps(await cfgPromise)),
     readSeedFile: (path2) => {
       if (!root) return null;
-      const fullPath = (0, import_node_path50.join)(root, path2);
+      const fullPath = (0, import_node_path51.join)(root, path2);
       return (0, import_node_fs54.existsSync)(fullPath) ? (0, import_node_fs54.readFileSync)(fullPath, "utf8") : null;
     }
   };
@@ -63338,6 +63625,24 @@ async function attachToProject(issueNumber, repo, priority) {
       }
       return boardAttachRateLimitedReceipt(resetEpochSeconds);
     }
+    const authority = contentId ? await attachOnAuthorityRefusal(detail, cfg, contentId) : void 0;
+    if (authority && "projectItemId" in authority) {
+      if (priority) {
+        try {
+          await setBoardItemPriority(defaultGitHubClient(), cfg, authority.projectItemId, priority);
+        } catch (pe) {
+          const perr = pe;
+          process.stderr.write(`warning: issue #${issueNumber} board Priority not set: ${(perr.stderr || perr.message || String(pe)).trim()}
+`);
+        }
+      }
+      return { projectItemId: authority.projectItemId, onBoard: true, credential: "app_installation" };
+    }
+    if (authority) {
+      process.stderr.write(`warning: issue #${issueNumber} created but NOT added to the project board: ${authority.warning}
+`);
+      return { onBoard: false };
+    }
     process.stderr.write(`warning: issue #${issueNumber} created but NOT added to the project board: ${detail}
 `);
     return { onBoard: false };
@@ -63416,7 +63721,7 @@ function registerCollaborationCommands(program3) {
       try {
         title = await resolveIssueTitle(
           { title: opts.title, titleFile: opts.titleFile },
-          { readFile: import_promises8.readFile, readStdin }
+          { readFile: import_promises9.readFile, readStdin }
         );
       } catch (e) {
         return fail(
@@ -63470,8 +63775,8 @@ function registerCollaborationCommands(program3) {
     let surfaceInferred;
     try {
       issueType = resolveCreateType(o.type, "issue create", o.label);
-      title = await resolveIssueTitle({ title: o.title, titleFile: o.titleFile }, { readFile: import_promises8.readFile, readStdin });
-      body = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises8.readFile, readStdin });
+      title = await resolveIssueTitle({ title: o.title, titleFile: o.titleFile }, { readFile: import_promises9.readFile, readStdin });
+      body = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises9.readFile, readStdin });
       if (o.idempotencyKey) body = appendIdempotencyMarker(body, o.idempotencyKey);
       priority = resolveCreatePriority(o.priority, "issue create");
       extraLabels = [...o.label ?? []];
@@ -63786,7 +64091,7 @@ function registerCollaborationCommands(program3) {
     }
     let body;
     try {
-      body = o.edit !== void 0 ? "" : await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises8.readFile, readStdin });
+      body = o.edit !== void 0 ? "" : await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises9.readFile, readStdin });
     } catch (e) {
       return fail(`issue comment: ${e.message}`);
     }
@@ -63865,8 +64170,8 @@ ${list}`);
     let title;
     const sourceRepo = o.repo ?? await resolveRepo(void 0);
     try {
-      title = await resolveIssueTitle({ title: o.title, titleFile: o.titleFile }, { readFile: import_promises8.readFile, readStdin });
-      body = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises8.readFile, readStdin });
+      title = await resolveIssueTitle({ title: o.title, titleFile: o.titleFile }, { readFile: import_promises9.readFile, readStdin });
+      body = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises9.readFile, readStdin });
       priority = resolveCreatePriority(o.priority, "report");
       if (!ISSUE_TYPES.includes(o.type)) {
         throw new Error(`unknown issue type "${o.type}" \u2014 expected one of: ${ISSUE_TYPES.join(", ")}`);
@@ -63920,8 +64225,8 @@ ${list}`);
     let args;
     try {
       skill = assertSkillName(o.skill);
-      rawBody = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises8.readFile, readStdin });
-      const rawTitle = await resolveIssueTitle({ title: o.title, titleFile: o.titleFile }, { readFile: import_promises8.readFile, readStdin });
+      rawBody = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises9.readFile, readStdin });
+      const rawTitle = await resolveIssueTitle({ title: o.title, titleFile: o.titleFile }, { readFile: import_promises9.readFile, readStdin });
       title = buildSkillLessonTitle(skill, rawTitle);
       priority = resolveCreatePriority(o.priority, "skill-lesson");
       body = buildSkillLessonBody(rawBody, sourceRepo, pluginSha);
@@ -63982,8 +64287,8 @@ ${list}`);
     let body;
     let title;
     try {
-      title = await resolveIssueTitle({ title: o.title, titleFile: o.titleFile }, { readFile: import_promises8.readFile, readStdin });
-      body = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises8.readFile, readStdin });
+      title = await resolveIssueTitle({ title: o.title, titleFile: o.titleFile }, { readFile: import_promises9.readFile, readStdin });
+      body = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises9.readFile, readStdin });
     } catch (e) {
       return fail(`pr create: ${e.message}`, e instanceof TextArgError ? { code: e.code, offending_flag: e.offendingFlag } : void 0);
     }
@@ -64077,11 +64382,11 @@ ${preparation.findings.map((finding) => `[${finding.check}/${finding.state}] ${f
     }
   });
   async function listCiWorkflowPaths(cwd = process.cwd()) {
-    const wfDir = (0, import_node_path50.join)(cwd, ".github", "workflows");
+    const wfDir = (0, import_node_path51.join)(cwd, ".github", "workflows");
     if (!(0, import_node_fs54.existsSync)(wfDir)) return [];
     return (0, import_node_fs54.readdirSync)(wfDir).filter((name) => /\.(ya?ml)$/i.test(name)).filter((name) => {
       try {
-        return workflowReportsPrChecks((0, import_node_fs54.readFileSync)((0, import_node_path50.join)(wfDir, name), "utf8"));
+        return workflowReportsPrChecks((0, import_node_fs54.readFileSync)((0, import_node_path51.join)(wfDir, name), "utf8"));
       } catch {
         return true;
       }
@@ -64336,7 +64641,7 @@ ${preparation.findings.map((finding) => `[${finding.check}/${finding.state}] ${f
   }
   class PrHeadBehindBaseError extends Error {
   }
-  pr.command("land <numbers...>").description("agent merge path (#1440): train probe \u2014 checks-wait \u2014 merge --auto \u2014 poll enqueued \u2014 development PRs only. Several PR numbers land together (#8322): all are enqueued, waited on together, a queue-ejected PR is updated and re-enqueued once, a queue merge is followed by worktree/branch cleanup and board Done, and one table (or --json) reports each outcome").option("--json", "machine-readable output").option("--repo <owner/repo>", "target repo (defaults to the PR repo)").option("--enqueue-only", "return once queue membership is confirmed; without a merge queue, land normally").option("--abandon-admission", "one stuck-receipt recovery, one PR per call: journal the saved non-terminal (pending/enqueued) queue-admission receipt terminal ONLY after positively observing the PR OPEN at the receipt head and absent from the queue; any unprovable observation refuses and changes nothing (#9951). The next pr land then submits a new intent with no new head").option("--no-require-train", "skip train-authority preflight (not recommended for autonomous agents)").option("--force", "silence the leftover-scratch warning (scratch never blocks, #8785) and acknowledge a negated-closing-keyword (#3718) or ambiguous-cross-repo-closing (#4279) refusal").option("--without-review <reason>", "compatibility option; shared merge helpers do not require a review verdict").option("--timeout <minutes>", `merge-queue wait per PR (default ${PR_LAND_QUEUE_TIMEOUT_MS / 6e4} minutes, one window per ${PR_LAND_QUEUE_BATCH_SIZE} PRs \u2014 per-repo ruleset check_response_timeout_minutes is 15 default with 30/45/60 overrides in .github/rulesets/mmi-development-merge-queue.json; agents never edit the ruleset to shorten a queue wait)`).option("--preserve-worktree", "after a queue merge keep the local worktree and branch (skips the post-merge cleanup)").option("--expect-head <sha>", "pin the PR head to this full 40-hex SHA (#8456): checked before landing, after checks and by GitHub at enqueue (--match-head-commit); never updates a BEHIND head and never retries an ejection \u2014 it stops with pinnedHead.refused instead. One PR only").action(async (numbers, opts) => {
+  pr.command("land <numbers...>").description("agent merge path (#1440): train probe \u2014 checks-wait \u2014 merge --auto \u2014 poll enqueued \u2014 development PRs only. Several PR numbers land together (#8322): all are enqueued, waited on together, a queue-ejected PR is updated and re-enqueued once, a queue merge is followed by worktree/branch cleanup and board Done, and one table (or --json) reports each outcome").option("--json", "machine-readable output").option("--repo <owner/repo>", "target repo (defaults to the PR repo)").option("--enqueue-only", "return once queue membership is confirmed; without a merge queue, land normally").option("--abandon-admission", "one stuck-receipt recovery, one PR per call: journal the saved non-terminal (pending/enqueued, or a dispatching send that saved no operation UUID after its sender died \u2014 #9995) queue-admission receipt terminal ONLY after positively observing the PR OPEN at the receipt head and absent from the queue; any unprovable observation refuses and changes nothing (#9951). The next pr land then submits a new intent with no new head").option("--no-require-train", "skip train-authority preflight (not recommended for autonomous agents)").option("--force", "silence the leftover-scratch warning (scratch never blocks, #8785) and acknowledge a negated-closing-keyword (#3718) or ambiguous-cross-repo-closing (#4279) refusal").option("--without-review <reason>", "compatibility option; shared merge helpers do not require a review verdict").option("--timeout <minutes>", `merge-queue wait per PR (default ${PR_LAND_QUEUE_TIMEOUT_MS / 6e4} minutes, one window per ${PR_LAND_QUEUE_BATCH_SIZE} PRs \u2014 per-repo ruleset check_response_timeout_minutes is 15 default with 30/45/60 overrides in .github/rulesets/mmi-development-merge-queue.json; agents never edit the ruleset to shorten a queue wait)`).option("--preserve-worktree", "after a queue merge keep the local worktree and branch (skips the post-merge cleanup)").option("--expect-head <sha>", "pin the PR head to this full 40-hex SHA (#8456): checked before landing, after checks and by GitHub at enqueue (--match-head-commit); never updates a BEHIND head and never retries an ejection \u2014 it stops with pinnedHead.refused instead. One PR only").action(async (numbers, opts) => {
     const timeoutMinutes = opts.timeout === void 0 ? void 0 : Number(opts.timeout);
     if (timeoutMinutes !== void 0 && !(timeoutMinutes > 0)) return fail("pr land: --timeout must be a positive number of minutes");
     if (opts.abandonAdmission) {
@@ -64677,7 +64982,7 @@ ${preparation.findings.map((finding) => `[${finding.check}/${finding.state}] ${f
     const remote = foreignCwd ? `https://github.com/${targetRepo2}.git` : "origin";
     let foreignCheckout;
     if (foreignCwd) {
-      const sibling = (0, import_node_path50.join)((0, import_node_path50.dirname)(beforeWorktrees[0]?.path || startingPath || process.cwd()), targetRepo2.split("/")[1]);
+      const sibling = (0, import_node_path51.join)((0, import_node_path51.dirname)(beforeWorktrees[0]?.path || startingPath || process.cwd()), targetRepo2.split("/")[1]);
       const siblingRepo = repoFromRemoteUrl(await gitOut(["-C", sibling, "remote", "get-url", "origin"]).catch(() => ""));
       if (siblingRepo?.toLowerCase() === targetRepo2.toLowerCase()) {
         const siblingWorktrees = await execFileP("git", ["-C", sibling, "worktree", "list", "--porcelain"], { timeout: GIT_TIMEOUT_MS }).then((r) => parseGitWorktreePorcelain(r.stdout)).catch(() => void 0);
@@ -64911,7 +65216,7 @@ ${preparation.findings.map((finding) => `[${finding.check}/${finding.state}] ${f
     let residueSweep;
     if (!(foreignCwd && !foreignCheckout)) {
       try {
-        gitCommonDir = (0, import_node_path50.resolve)(primaryRoot, (await execFileP("git", ["-C", primaryRoot, "rev-parse", "--git-common-dir"], { timeout: GIT_TIMEOUT_MS })).stdout.trim());
+        gitCommonDir = (0, import_node_path51.resolve)(primaryRoot, (await execFileP("git", ["-C", primaryRoot, "rev-parse", "--git-common-dir"], { timeout: GIT_TIMEOUT_MS })).stdout.trim());
         residueSweep = await sweepWorktreeResidue(gitCommonDir, beforeWorktrees.map((w) => w.path));
       } catch {
       }
@@ -65131,7 +65436,7 @@ function trainGitArgs(args) {
 async function announceSummaryLineCountRefusal(path2) {
   let content;
   try {
-    content = await (0, import_promises9.readFile)(path2, "utf8");
+    content = await (0, import_promises10.readFile)(path2, "utf8");
   } catch (e) {
     return `release: could not read --announce-summary-file ${path2}: ${e.message} \u2014 see https://github.com/mutmutco/MMI-Hub/blob/development/docs/Guides/train-troubleshooting.md#announce-summary-missing`;
   }
@@ -65143,7 +65448,7 @@ async function announceSummaryLineCountRefusal(path2) {
 async function announceSummaryRefusal(path2, isHub = false, isWorkSuite = false) {
   let lines2;
   try {
-    lines2 = summaryFileLines(await (0, import_promises9.readFile)(path2, "utf8"));
+    lines2 = summaryFileLines(await (0, import_promises10.readFile)(path2, "utf8"));
   } catch (e) {
     return `release: could not read --announce-summary-file ${path2}: ${e.message} \u2014 see https://github.com/mutmutco/MMI-Hub/blob/development/docs/Guides/train-troubleshooting.md#announce-summary-missing`;
   }
@@ -65281,8 +65586,8 @@ function trainApplyDeps() {
         }
         return body.status;
       },
-      readFile: (path2) => (0, import_promises9.readFile)(path2, "utf8"),
-      removeFile: (path2) => (0, import_promises9.unlink)(path2),
+      readFile: (path2) => (0, import_promises10.readFile)(path2, "utf8"),
+      removeFile: (path2) => (0, import_promises10.unlink)(path2),
       // #6521/#6523: the project's own release channel AND releaseLanguage, read from registry META in ONE
       // checked read. Same shape as fetchEdgeDomains below: a FAILED read refuses by name so the announce
       // note reports a failed read, never a project that configured nothing.
@@ -66210,7 +66515,7 @@ function rcRunCauseFromLog(log) {
 function memberAnnounceSummaryFile(repo, summaryFile, memberSummaryFiles) {
   return repo === SUITE_REPO ? summaryFile : memberSummaryFiles[repo];
 }
-var suiteStateDir = (root) => (0, import_node_path52.join)(resolvePrimaryGitDir(root), "mmi-runtime", "suite");
+var suiteStateDir = (root) => (0, import_node_path53.join)(resolvePrimaryGitDir(root), "mmi-runtime", "suite");
 async function runSuiteMemberRcand(repo, previousRc, rcWasAbsent) {
   const deps = trainApplyDeps();
   deps.suiteCut = suiteCutContext(repo, SUITE_REPO);
@@ -66257,16 +66562,16 @@ async function rcandInCheckout(repo, deps, previousRc, rcWasAbsent) {
   }
 }
 function suiteTrainIo(root, summaryFile, memberSummaryFiles = {}, summaryFileTr, memberSummaryFilesTr = {}) {
-  const recordPath = (0, import_node_path52.join)(suiteStateDir(root), "cut.json");
-  const base = (0, import_node_path52.join)(suiteStateDir(root), "checkouts");
+  const recordPath = (0, import_node_path53.join)(suiteStateDir(root), "cut.json");
+  const base = (0, import_node_path53.join)(suiteStateDir(root), "checkouts");
   const checkout = async (repo) => {
     if (repo === SUITE_REPO) return root;
-    const target = (0, import_node_path52.join)(base, repo.split("/")[1]);
+    const target = (0, import_node_path53.join)(base, repo.split("/")[1]);
     if (!(0, import_node_fs55.existsSync)(target)) {
       (0, import_node_fs55.mkdirSync)(base, { recursive: true });
       await exec("git", ["clone", "--quiet", "--branch", "development", `https://github.com/${repo}.git`, target], root, WATCH_TIMEOUT);
     }
-    if (!(0, import_node_fs55.existsSync)((0, import_node_path52.join)(target, ".git"))) throw new Error(`${repo}: suite checkout has no .git at ${target}; stop`);
+    if (!(0, import_node_fs55.existsSync)((0, import_node_path53.join)(target, ".git"))) throw new Error(`${repo}: suite checkout has no .git at ${target}; stop`);
     const origin = await exec("git", ["remote", "get-url", "origin"], target);
     if (!origin.toLowerCase().endsWith(`/${repo.toLowerCase()}.git`) && !origin.toLowerCase().endsWith(`/${repo.toLowerCase()}`))
       throw new Error(`${repo}: suite checkout origin mismatch at ${target}; stop`);
@@ -66330,7 +66635,7 @@ function suiteTrainIo(root, summaryFile, memberSummaryFiles = {}, summaryFileTr,
     if (repo === SUITE_REPO) return inTrain(repo, (deps) => rcandInCheckout(repo, deps, previousRc, rcWasAbsent));
     const target = await checkout(repo);
     return new Promise((resolveResult, reject2) => {
-      const child2 = (0, import_node_child_process19.fork)((0, import_node_path51.resolve)(process.argv[1]), ["devops", "suite", "member-rcand-internal", repo, previousRc ?? "", ...rcWasAbsent ? ["--rc-was-absent"] : []], {
+      const child2 = (0, import_node_child_process19.fork)((0, import_node_path52.resolve)(process.argv[1]), ["devops", "suite", "member-rcand-internal", repo, previousRc ?? "", ...rcWasAbsent ? ["--rc-was-absent"] : []], {
         cwd: target,
         stdio: ["ignore", "inherit", "inherit", "ipc"],
         execArgv: []
@@ -66574,7 +66879,7 @@ function suiteTrainIo(root, summaryFile, memberSummaryFiles = {}, summaryFileTr,
       if (parseSuiteMapping(body)) return;
       const dir = suiteStateDir(root);
       (0, import_node_fs55.mkdirSync)(dir, { recursive: true });
-      const file = (0, import_node_path52.join)(dir, `notes-${leadTag}.md`);
+      const file = (0, import_node_path53.join)(dir, `notes-${leadTag}.md`);
       (0, import_node_fs55.writeFileSync)(file, `${body}
 
 ${suiteMappingBlock(leadTag, mapping)}`);
@@ -66951,8 +67256,8 @@ function registerJevCommands(program3) {
 // src/packages-adopt-export.ts
 var import_node_child_process20 = require("node:child_process");
 var import_node_fs57 = require("node:fs");
-var import_node_os25 = require("node:os");
-var import_node_path53 = require("node:path");
+var import_node_os26 = require("node:os");
+var import_node_path54 = require("node:path");
 var import_node_util6 = require("node:util");
 init_cli_shared();
 
@@ -67572,25 +67877,25 @@ function expectedFromRun(run, opts) {
 }
 async function adoptExport(opts, deps) {
   if (!/^sha256:[0-9a-f]{64}$/.test(opts.digest)) throw new Error("--digest must be sha256:<64 hex>, from the export run summary");
-  const packagePath = (0, import_node_path53.join)(opts.dir, "package.json");
-  const lockPath = (0, import_node_path53.join)(opts.dir, "package-lock.json");
+  const packagePath = (0, import_node_path54.join)(opts.dir, "package.json");
+  const lockPath = (0, import_node_path54.join)(opts.dir, "package-lock.json");
   const packageText = (0, import_node_fs57.readFileSync)(packagePath, "utf8");
   const lockText = (0, import_node_fs57.readFileSync)(lockPath, "utf8");
-  const work = (0, import_node_fs57.mkdtempSync)((0, import_node_path53.join)((0, import_node_os25.tmpdir)(), "mmi-adopt-export-"));
+  const work = (0, import_node_fs57.mkdtempSync)((0, import_node_path54.join)((0, import_node_os26.tmpdir)(), "mmi-adopt-export-"));
   try {
     const run = JSON.parse((await deps.ghApi(`repos/${EXPORT_REPO}/actions/runs/${opts.run}`)).toString("utf8"));
-    (0, import_node_fs57.writeFileSync)((0, import_node_path53.join)(work, "expected.json"), JSON.stringify(expectedFromRun(run, opts)));
-    (0, import_node_fs57.writeFileSync)((0, import_node_path53.join)(work, "provider.json"), await deps.ghApi(`repos/${EXPORT_REPO}/actions/artifacts/${opts.artifact}`));
-    (0, import_node_fs57.writeFileSync)((0, import_node_path53.join)(work, "artifact.zip"), await deps.ghApi(`repos/${EXPORT_REPO}/actions/artifacts/${opts.artifact}/zip`));
-    const script = (0, import_node_path53.join)(work, "package_export.py");
+    (0, import_node_fs57.writeFileSync)((0, import_node_path54.join)(work, "expected.json"), JSON.stringify(expectedFromRun(run, opts)));
+    (0, import_node_fs57.writeFileSync)((0, import_node_path54.join)(work, "provider.json"), await deps.ghApi(`repos/${EXPORT_REPO}/actions/artifacts/${opts.artifact}`));
+    (0, import_node_fs57.writeFileSync)((0, import_node_path54.join)(work, "artifact.zip"), await deps.ghApi(`repos/${EXPORT_REPO}/actions/artifacts/${opts.artifact}/zip`));
+    const script = (0, import_node_path54.join)(work, "package_export.py");
     (0, import_node_fs57.writeFileSync)(script, package_export_default);
     await deps.python(script, ["verify", work, opts.ds, opts.screens]);
-    const verified = (0, import_node_path53.join)(work, "verified");
-    const metadata = Object.fromEntries(PACKAGES.map(({ name, short: short3 }) => [name, JSON.parse((0, import_node_fs57.readFileSync)((0, import_node_path53.join)(verified, `${short3}.metadata.json`), "utf8"))]));
+    const verified = (0, import_node_path54.join)(work, "verified");
+    const metadata = Object.fromEntries(PACKAGES.map(({ name, short: short3 }) => [name, JSON.parse((0, import_node_fs57.readFileSync)((0, import_node_path54.join)(verified, `${short3}.metadata.json`), "utf8"))]));
     const plan = planAdoption(packageText, lockText, metadata);
     for (const { name } of plan.result.adopted) {
       const short3 = PACKAGES.find((p) => p.name === name).short;
-      await deps.npm(["cache", "add", (0, import_node_path53.join)(verified, `${short3}.tgz`)], opts.dir);
+      await deps.npm(["cache", "add", (0, import_node_path54.join)(verified, `${short3}.tgz`)], opts.dir);
     }
     (0, import_node_fs57.writeFileSync)(packagePath, plan.packageText);
     (0, import_node_fs57.writeFileSync)(lockPath, plan.lockText);
@@ -67780,8 +68085,8 @@ async function collectWaveStatus(deps) {
 init_github_client();
 init_cli_shared();
 var import_node_fs59 = require("node:fs");
-var import_node_os26 = require("node:os");
-var import_node_path54 = require("node:path");
+var import_node_os27 = require("node:os");
+var import_node_path55 = require("node:path");
 var GC_GH_TIMEOUT_MS3 = 2e4;
 var defaultStatusDeps = {
   repo: resolveRepo,
@@ -68000,10 +68305,10 @@ async function collectOnboardStatus(opts = {}) {
     else if (top) nextCommand = `mmi-cli oracle board claim ${top.number}  # ${top.title}`;
     else nextCommand = "mmi-cli oracle board read \u2014 no claimable items found";
   }
-  const home = (0, import_node_os26.homedir)();
+  const home = (0, import_node_os27.homedir)();
   const plugin = onboardPluginGate({
-    readKnown: () => readFileSyncSafe((0, import_node_path54.join)(home, ...KNOWN_MARKETPLACES_RELATIVE), import_node_fs59.readFileSync),
-    readSettings: () => readFileSyncSafe((0, import_node_path54.join)(home, ".claude", "settings.json"), import_node_fs59.readFileSync)
+    readKnown: () => readFileSyncSafe((0, import_node_path55.join)(home, ...KNOWN_MARKETPLACES_RELATIVE), import_node_fs59.readFileSync),
+    readSettings: () => readFileSyncSafe((0, import_node_path55.join)(home, ".claude", "settings.json"), import_node_fs59.readFileSync)
   });
   return {
     guide: "Read the MMI org-guide skill before project work; load only the relevant topic. Use mmi-help for a short introduction.",
@@ -70640,7 +70945,7 @@ function registerConnectionsOauth(program3, deps) {
 }
 
 // src/schedules-commands.ts
-var import_promises10 = require("node:fs/promises");
+var import_promises11 = require("node:fs/promises");
 init_clean_exit();
 init_github_client();
 init_cli_shared();
@@ -70820,9 +71125,9 @@ function registerSchedulesCommands(program3) {
           await failGraceful("org schedules --doc: refusing to regenerate the doc from an incomplete read (see warnings above).");
           return;
         }
-        const docText = await (0, import_promises10.readFile)(o.doc, "utf8");
+        const docText = await (0, import_promises11.readFile)(o.doc, "utf8");
         const spliced = spliceDoc(docText, renderDocSection(entries, now.toISOString()));
-        await (0, import_promises10.writeFile)(o.doc, spliced, "utf8");
+        await (0, import_promises11.writeFile)(o.doc, spliced, "utf8");
         reportParked(parkedLines);
         reportDrift(drift);
         console.log(`org schedules: wrote ${entries.length} entries into ${o.doc}`);
@@ -71135,7 +71440,7 @@ function registerSessionReport(program3) {
 
 // src/stage-commands.ts
 var import_node_fs60 = require("node:fs");
-var import_node_path55 = require("node:path");
+var import_node_path56 = require("node:path");
 init_cli_shared();
 init_clean_exit();
 
@@ -71383,8 +71688,8 @@ function registerStageCommands(program3) {
     const repo = Array.isArray(project2?.repos) && typeof project2.repos[0] === "string" ? project2.repos[0] : slug;
     const resolution = decideStage({
       registry: { deployModel: project2?.deployModel, portRange, error: read.ok ? void 0 : read.error },
-      hasCompose: (0, import_node_fs60.existsSync)((0, import_node_path55.join)(process.cwd(), "docker-compose.yml")),
-      hasEnvExample: (0, import_node_fs60.existsSync)((0, import_node_path55.join)(process.cwd(), ".env.example")),
+      hasCompose: (0, import_node_fs60.existsSync)((0, import_node_path56.join)(process.cwd(), "docker-compose.yml")),
+      hasEnvExample: (0, import_node_fs60.existsSync)((0, import_node_path56.join)(process.cwd(), ".env.example")),
       repo
     });
     if (resolution.source === "derived" && resolution.derived) {
@@ -71676,21 +71981,21 @@ vercel preview (${preview.branch}): ${d.state}${d.url ? ` \u2014 ${d.url}` : ""}
 }
 
 // src/tenant-artifact.ts
-var import_node_crypto23 = require("node:crypto");
+var import_node_crypto24 = require("node:crypto");
 var import_node_fs61 = require("node:fs");
-var import_promises11 = require("node:fs/promises");
-var import_node_path56 = require("node:path");
+var import_promises12 = require("node:fs/promises");
+var import_node_path57 = require("node:path");
 var ARTIFACT_ID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
 var MAX_BYTES2 = 5 * 1024 * 1024 * 1024;
 async function sha256File(path2) {
-  const hash = (0, import_node_crypto23.createHash)("sha256");
+  const hash = (0, import_node_crypto24.createHash)("sha256");
   for await (const chunk of (0, import_node_fs61.createReadStream)(path2)) hash.update(chunk);
   return hash.digest("hex");
 }
 async function putTenantArtifact(repo, stage, inputPath, deps) {
   if (!["dev", "rc", "main"].includes(stage)) throw new Error("tenant artifact put: <stage> must be dev, rc, or main");
-  const path2 = (0, import_node_path56.resolve)(inputPath);
-  const info = await (0, import_promises11.stat)(path2);
+  const path2 = (0, import_node_path57.resolve)(inputPath);
+  const info = await (0, import_promises12.stat)(path2);
   if (!info.isFile()) throw new Error("tenant artifact put: input path must be a file");
   if (!Number.isSafeInteger(info.size) || info.size < 1 || info.size > MAX_BYTES2) throw new Error(`tenant artifact put: file must be 1..${MAX_BYTES2} bytes`);
   const sha2564 = await sha256File(path2);
@@ -72169,12 +72474,12 @@ async function resolveWhoami(deps) {
 }
 
 // src/command-register-developer.ts
-var import_node_path63 = require("node:path");
+var import_node_path64 = require("node:path");
 
 // src/doc-refs-command-source.ts
 var import_node_child_process21 = require("node:child_process");
 var import_node_fs62 = require("node:fs");
-var import_node_path57 = require("node:path");
+var import_node_path58 = require("node:path");
 var IN_PROCESS_SOURCE = "in-process";
 var BUNDLE_MANIFEST_TIMEOUT_MS = 12e4;
 var BUNDLE_MANIFEST_MAX_BUFFER = 64 * 1024 * 1024;
@@ -72196,7 +72501,7 @@ function inventoryFromManifest(manifest, source) {
 function readBundleManifest(bundle, exec3 = import_node_child_process21.execFileSync) {
   try {
     const text = exec3(process.execPath, [bundle, "commands", "--all", "--json"], {
-      cwd: (0, import_node_path57.dirname)(bundle),
+      cwd: (0, import_node_path58.dirname)(bundle),
       encoding: "utf8",
       windowsHide: true,
       timeout: BUNDLE_MANIFEST_TIMEOUT_MS,
@@ -72212,16 +72517,16 @@ function readBundleManifest(bundle, exec3 = import_node_child_process21.execFile
 function isRunningBundle(bundle, argv1 = process.argv[1], platform2 = process.platform) {
   if (!argv1) return false;
   const norm3 = (path2) => {
-    const absolute = (0, import_node_path57.resolve)(path2);
+    const absolute = (0, import_node_path58.resolve)(path2);
     return platform2 === "win32" ? absolute.toLowerCase() : absolute;
   };
   const running = norm3(argv1);
-  if (!["main.cjs", "index.cjs"].includes((0, import_node_path57.basename)(running))) return false;
-  return (0, import_node_path57.dirname)(running) === (0, import_node_path57.dirname)(norm3(bundle));
+  if (!["main.cjs", "index.cjs"].includes((0, import_node_path58.basename)(running))) return false;
+  return (0, import_node_path58.dirname)(running) === (0, import_node_path58.dirname)(norm3(bundle));
 }
 function nameUnknownCommandSources(findings, source, root) {
-  const checkoutBundle = (0, import_node_path57.resolve)(root, "cli", "dist", "main.cjs");
-  const recovery = source !== IN_PROCESS_SOURCE && (0, import_node_path57.resolve)(source) === checkoutBundle ? "; rebuild with `npm --prefix cli run build` and retry, or pass `--commands-from <bundle>`" : "";
+  const checkoutBundle = (0, import_node_path58.resolve)(root, "cli", "dist", "main.cjs");
+  const recovery = source !== IN_PROCESS_SOURCE && (0, import_node_path58.resolve)(source) === checkoutBundle ? "; rebuild with `npm --prefix cli run build` and retry, or pass `--commands-from <bundle>`" : "";
   for (const finding of findings) {
     if (finding.kind !== "unknown-command") continue;
     finding.commandSource = source;
@@ -72233,7 +72538,7 @@ function resolveCommandInventory(deps) {
   const read = deps.read ?? ((bundle) => readBundleManifest(bundle));
   const warnings = [];
   if (deps.from) {
-    const bundle = (0, import_node_path57.isAbsolute)(deps.from) ? deps.from : (0, import_node_path57.resolve)(deps.root, deps.from);
+    const bundle = (0, import_node_path58.isAbsolute)(deps.from) ? deps.from : (0, import_node_path58.resolve)(deps.root, deps.from);
     if (!exists(bundle)) {
       throw new Error(`docs refs --commands-from: ${bundle} does not exist \u2014 name the CLI bundle to read commands from (usually cli/dist/main.cjs)`);
     }
@@ -72243,7 +72548,7 @@ function resolveCommandInventory(deps) {
     }
     return { inventory: inventory2, warnings };
   }
-  const treeBundle = (0, import_node_path57.join)(deps.root, "cli", "dist", "main.cjs");
+  const treeBundle = (0, import_node_path58.join)(deps.root, "cli", "dist", "main.cjs");
   if (!exists(treeBundle)) {
     return { inventory: deps.inProcess(), warnings };
   }
@@ -72363,26 +72668,26 @@ async function executeWaveLand(plan, deps) {
 
 // src/dist-drift.ts
 var import_node_child_process22 = require("node:child_process");
-var import_node_crypto25 = require("node:crypto");
+var import_node_crypto26 = require("node:crypto");
 var import_node_fs64 = require("node:fs");
-var import_node_os27 = require("node:os");
-var import_node_path59 = require("node:path");
+var import_node_os28 = require("node:os");
+var import_node_path60 = require("node:path");
 
 // ../scripts/distribution-digest.mjs
-var import_node_crypto24 = require("node:crypto");
+var import_node_crypto25 = require("node:crypto");
 var import_node_fs63 = require("node:fs");
-var import_node_path58 = require("node:path");
+var import_node_path59 = require("node:path");
 var slash = (value) => value.replaceAll("\\", "/");
 function repoPath(root, declaredPath, label) {
-  const absoluteRoot = (0, import_node_path58.resolve)(root);
-  const target = (0, import_node_path58.resolve)(root, declaredPath);
-  if (target !== absoluteRoot && !target.startsWith(`${absoluteRoot}${import_node_path58.sep}`)) {
+  const absoluteRoot = (0, import_node_path59.resolve)(root);
+  const target = (0, import_node_path59.resolve)(root, declaredPath);
+  if (target !== absoluteRoot && !target.startsWith(`${absoluteRoot}${import_node_path59.sep}`)) {
     throw new Error(`${label} ${declaredPath} escapes the repository root`);
   }
   return target;
 }
 function digestFiles(files) {
-  const hash = (0, import_node_crypto24.createHash)("sha256");
+  const hash = (0, import_node_crypto25.createHash)("sha256");
   for (const file of [...files].sort((a, b) => a.relative.localeCompare(b.relative))) {
     const content = file.stat.isSymbolicLink() ? Buffer.from((0, import_node_fs63.readlinkSync)(file.absolute), "utf8") : (0, import_node_fs63.readFileSync)(file.absolute);
     hash.update(file.relative, "utf8");
@@ -72413,7 +72718,7 @@ var DIST_ARTIFACTS = [
 ];
 var BOM_DIST_TREE_ID = "mmi-cli-dist";
 var ABSENT = "absent";
-var sha2563 = (bytes) => `sha256:${(0, import_node_crypto25.createHash)("sha256").update(bytes).digest("hex")}`;
+var sha2563 = (bytes) => `sha256:${(0, import_node_crypto26.createHash)("sha256").update(bytes).digest("hex")}`;
 function artifactDrift(path2, committedBytes, rebuiltBytes) {
   const committed = committedBytes ? sha2563(committedBytes) : ABSENT;
   const rebuiltExpected = rebuiltBytes ? sha2563(rebuiltBytes) : ABSENT;
@@ -72491,7 +72796,7 @@ function walkFiles(root) {
   const files = [];
   const walk2 = (directory) => {
     for (const entry of (0, import_node_fs64.readdirSync)(directory, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
-      const child2 = (0, import_node_path59.join)(directory, entry.name);
+      const child2 = (0, import_node_path60.join)(directory, entry.name);
       if (entry.isDirectory()) walk2(child2);
       else files.push(child2);
     }
@@ -72501,10 +72806,10 @@ function walkFiles(root) {
 }
 function bomPathFor(root) {
   try {
-    const registry2 = JSON.parse((0, import_node_fs64.readFileSync)((0, import_node_path59.join)(root, "surfaces.json"), "utf8"));
-    return (0, import_node_path59.join)(root, registry2?.sharedAgentCore?.releaseMetadata?.bomPath ?? "distribution-bom.json");
+    const registry2 = JSON.parse((0, import_node_fs64.readFileSync)((0, import_node_path60.join)(root, "surfaces.json"), "utf8"));
+    return (0, import_node_path60.join)(root, registry2?.sharedAgentCore?.releaseMetadata?.bomPath ?? "distribution-bom.json");
   } catch {
-    return (0, import_node_path59.join)(root, "distribution-bom.json");
+    return (0, import_node_path60.join)(root, "distribution-bom.json");
   }
 }
 function rebuildTo(packageRoot, outDir) {
@@ -72517,28 +72822,28 @@ function rebuildTo(packageRoot, outDir) {
   });
 }
 function runDistStatus(root) {
-  const stage = (0, import_node_fs64.mkdtempSync)((0, import_node_path59.join)((0, import_node_os27.tmpdir)(), "mmi-dist-drift-"));
+  const stage = (0, import_node_fs64.mkdtempSync)((0, import_node_path60.join)((0, import_node_os28.tmpdir)(), "mmi-dist-drift-"));
   let overlayCount = 0;
   try {
-    const cliOut = (0, import_node_path59.join)(stage, "cli-dist");
-    const hubOut = (0, import_node_path59.join)(stage, "hub-dist");
-    rebuildTo((0, import_node_path59.join)(root, "cli"), cliOut);
-    rebuildTo((0, import_node_path59.join)(root, "updater"), hubOut);
+    const cliOut = (0, import_node_path60.join)(stage, "cli-dist");
+    const hubOut = (0, import_node_path60.join)(stage, "hub-dist");
+    rebuildTo((0, import_node_path60.join)(root, "cli"), cliOut);
+    rebuildTo((0, import_node_path60.join)(root, "updater"), hubOut);
     const outDirFor = (packageDir) => packageDir === "cli" ? cliOut : hubOut;
     const rebuilt = (path2) => {
       const spec = DIST_ARTIFACTS.find((entry) => entry.path === path2);
-      return spec ? readOrNull((0, import_node_path59.join)(outDirFor(spec.packageDir), spec.output)) : null;
+      return spec ? readOrNull((0, import_node_path60.join)(outDirFor(spec.packageDir), spec.output)) : null;
     };
-    const committed = (path2) => readOrNull((0, import_node_path59.join)(root, path2));
-    const tree = (path2) => readOrNull((0, import_node_path59.join)(root, path2));
-    const distRoot = (0, import_node_path59.join)(root, "cli", "dist");
-    const distTree = () => walkFiles(distRoot).map((absolute) => `cli/dist/${(0, import_node_path59.relative)(distRoot, absolute).replaceAll("\\", "/")}`);
+    const committed = (path2) => readOrNull((0, import_node_path60.join)(root, path2));
+    const tree = (path2) => readOrNull((0, import_node_path60.join)(root, path2));
+    const distRoot = (0, import_node_path60.join)(root, "cli", "dist");
+    const distTree = () => walkFiles(distRoot).map((absolute) => `cli/dist/${(0, import_node_path60.relative)(distRoot, absolute).replaceAll("\\", "/")}`);
     const bom = JSON.parse((0, import_node_fs64.readFileSync)(bomPathFor(root), "utf8"));
     const digest = (entries) => {
-      const overlay = (0, import_node_path59.join)(stage, `overlay-${overlayCount++}`);
+      const overlay = (0, import_node_path60.join)(stage, `overlay-${overlayCount++}`);
       for (const entry of entries) {
-        const target = (0, import_node_path59.join)(overlay, entry.path);
-        (0, import_node_fs64.mkdirSync)((0, import_node_path59.dirname)(target), { recursive: true });
+        const target = (0, import_node_path60.join)(overlay, entry.path);
+        (0, import_node_fs64.mkdirSync)((0, import_node_path60.dirname)(target), { recursive: true });
         (0, import_node_fs64.writeFileSync)(target, entry.bytes);
       }
       return digestPackedFiles(overlay, entries.map((entry) => entry.path));
@@ -72550,7 +72855,7 @@ function runDistStatus(root) {
 }
 
 // src/doc-refs-live.ts
-var import_node_path60 = require("node:path");
+var import_node_path61 = require("node:path");
 var concrete = (value) => !!value && !/[<>{}$]/.test(value);
 var liveOption = (tokens2, flag) => {
   const index = tokens2.indexOf(flag);
@@ -72623,7 +72928,7 @@ async function runLiveDocRefs(root, deps, live) {
   const offline = runDocRefs(root, { ...deps, runbooksOnly: true });
   const read = deps.readFile ?? readFileOrNull;
   const docs = Object.fromEntries((deps.listDocs ?? defaultListDocs)(root).flatMap((doc) => {
-    const body = read((0, import_node_path60.join)(root, doc));
+    const body = read((0, import_node_path61.join)(root, doc));
     return body !== null && isRunbook(doc, body) && !deps.isIgnored?.([doc]).has(doc) ? [[doc, body]] : [];
   }));
   const remote = await checkRunbookLive(docs, live);
@@ -72672,13 +72977,13 @@ init_cli_shared();
 // src/edge-tunnel.ts
 var HOSTNAME_RE = /^(?=.{1,253}$)([a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)(\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)+$/;
 var UPSTREAM_RE = /^https?:\/\/[^/\s]+(?::\d+)?(?:\/.*)?$/;
-function tunnelNameFromHostname(hostname4) {
-  return hostname4.replace(/\./g, "-").slice(0, 63);
+function tunnelNameFromHostname(hostname5) {
+  return hostname5.replace(/\./g, "-").slice(0, 63);
 }
-function planInfraTunnel(hostname4, upstream) {
-  const host = hostname4.trim().toLowerCase();
+function planInfraTunnel(hostname5, upstream) {
+  const host = hostname5.trim().toLowerCase();
   const origin = upstream.trim();
-  if (!HOSTNAME_RE.test(host)) throw new Error(`invalid hostname ${JSON.stringify(hostname4)}`);
+  if (!HOSTNAME_RE.test(host)) throw new Error(`invalid hostname ${JSON.stringify(hostname5)}`);
   if (!UPSTREAM_RE.test(origin)) throw new Error(`invalid upstream ${JSON.stringify(upstream)} \u2014 expected http(s)://host:port`);
   const tunnelName = tunnelNameFromHostname(host);
   const configYaml = [
@@ -72833,8 +73138,8 @@ async function diagnoseHub(deps) {
 }
 
 // src/schedules-lift-command.ts
-var import_promises12 = require("node:fs/promises");
-var import_node_path61 = require("node:path");
+var import_promises13 = require("node:fs/promises");
+var import_node_path62 = require("node:path");
 init_clean_exit();
 init_cli_shared();
 var DEFAULT_WORKFLOWS_DIR = ".github/workflows";
@@ -72856,14 +73161,14 @@ var RegistryUnreachableError = class extends Error {
 async function readWorkflowFiles(dir) {
   let names;
   try {
-    names = await (0, import_promises12.readdir)(dir);
+    names = await (0, import_promises13.readdir)(dir);
   } catch {
     return [];
   }
   const files = [];
   for (const name of names.sort()) {
     if (!/\.ya?ml$/.test(name)) continue;
-    files.push({ path: `.github/workflows/${name}`, text: await (0, import_promises12.readFile)((0, import_node_path61.join)(dir, name), "utf8") });
+    files.push({ path: `.github/workflows/${name}`, text: await (0, import_promises13.readFile)((0, import_node_path62.join)(dir, name), "utf8") });
   }
   return files;
 }
@@ -72947,7 +73252,7 @@ function registerSchedulesLiftCommand(program3, deps = {}) {
 // src/spawn-policy-core.ts
 var import_node_child_process24 = require("node:child_process");
 var import_node_fs65 = require("node:fs");
-var import_node_path62 = require("node:path");
+var import_node_path63 = require("node:path");
 var SPAWNERS = ["spawn", "spawnSync", "exec", "execSync", "execFile", "execFileSync"];
 var CALL_SOURCE = String.raw`(^|[^.\w$])(${SPAWNERS.join("|")})\s*\(`;
 var SOURCE_EXT = /\.(ts|mts|cts|js|mjs|cjs)$/;
@@ -73033,7 +73338,7 @@ function runSpawnPolicy(root) {
   for (const file of files) {
     let raw;
     try {
-      raw = (0, import_node_fs65.readFileSync)((0, import_node_path62.join)(root, file), "utf8");
+      raw = (0, import_node_fs65.readFileSync)((0, import_node_path63.join)(root, file), "utf8");
     } catch {
       continue;
     }
@@ -73053,7 +73358,7 @@ function runSpawnPolicy(root) {
 function registerDeveloperCommands(program3) {
   const rules = program3.command("rules").description("org-managed .gitignore delivery");
   rules.command("gitignore").option("--write", "upsert the managed block into .gitignore (default: check only, non-zero exit on drift)").option("--json", "machine-readable output").description("verify (or --write) this repo's org-managed .gitignore block matches the SSOT").action((opts) => {
-    const path2 = (0, import_node_path63.join)(process.cwd(), ".gitignore");
+    const path2 = (0, import_node_path64.join)(process.cwd(), ".gitignore");
     const current = (0, import_node_fs66.existsSync)(path2) ? (0, import_node_fs66.readFileSync)(path2, "utf8") : null;
     const plan = planManagedGitignore(current);
     const drift = [...plan.added.map((l) => `+${l}`), ...plan.removed.map((l) => `-${l}`)].join(", ") || "block normalize";
@@ -73383,12 +73688,12 @@ ${r.stderr ?? ""}`).catch(() => "");
 var ENV_HEAL_LOCK_STALE_MS = 10 * 6e4;
 var ENV_HEAL_LOCK_MAX_WAIT_MS = 2 * 6e4;
 function envHealLockPath(home) {
-  return (0, import_node_path64.join)(home, ".claude", "plugins", ".mmi-env-heal.lock");
+  return (0, import_node_path65.join)(home, ".claude", "plugins", ".mmi-env-heal.lock");
 }
 async function withEnvHealLock(what, run) {
   try {
     return await withFileLock(
-      envHealLockPath((0, import_node_os28.homedir)()),
+      envHealLockPath((0, import_node_os29.homedir)()),
       { staleMs: ENV_HEAL_LOCK_STALE_MS, maxWaitMs: ENV_HEAL_LOCK_MAX_WAIT_MS, label: "mmi env-heal lock" },
       run
     );
@@ -73486,7 +73791,7 @@ function mmiDoctorDeps(opts = {}) {
       const configRoot = surfaceConfigRoot(surface);
       const running = surface === "codex" ? installedActivePluginVersion(surface) : runningPluginVersion(process.env, resolveClientVersion());
       const plan = buildPluginCachePlan(
-        (0, import_node_os28.homedir)(),
+        (0, import_node_os29.homedir)(),
         running,
         pluginCacheFsDeps(configRoot, () => 0),
         { configRoot, includeStaging: surface !== "codex" }
@@ -73514,7 +73819,7 @@ function mmiDoctorDeps(opts = {}) {
       const running = surface === "codex" ? installedActivePluginVersion(surface) : runningPluginVersion(process.env, resolveClientVersion());
       const installed = installedActivePluginVersion(surface);
       const plan = buildPluginCachePlan(
-        (0, import_node_os28.homedir)(),
+        (0, import_node_os29.homedir)(),
         running,
         pluginCacheFsDeps(configRoot, () => 0),
         { configRoot, includeStaging: surface !== "codex", installedVersion: installed }
@@ -73556,7 +73861,7 @@ function mmiDoctorDeps(opts = {}) {
     // has no generated routing index would
     // get a permanent — demanding an artifact it never asked for.
     docsIndexState: (root) => {
-      if (!(0, import_node_fs67.existsSync)((0, import_node_path64.join)(root, DOCS_INDEX_PATH))) return void 0;
+      if (!(0, import_node_fs67.existsSync)((0, import_node_path65.join)(root, DOCS_INDEX_PATH))) return void 0;
       const real = createDocsIndexDeps(root);
       let docs;
       const listDocs = () => docs ??= real.listDocs();
@@ -73565,7 +73870,7 @@ function mmiDoctorDeps(opts = {}) {
     },
     // #4168: working-tree heal — write if drifted, then re-check. Commit remains the operator's step.
     healDocsIndex: (root) => {
-      if (!(0, import_node_fs67.existsSync)((0, import_node_path64.join)(root, DOCS_INDEX_PATH))) return { drift: false, docCount: 0 };
+      if (!(0, import_node_fs67.existsSync)((0, import_node_path65.join)(root, DOCS_INDEX_PATH))) return { drift: false, docCount: 0 };
       const real = createDocsIndexDeps(root);
       let docs;
       const listDocs = () => docs ??= real.listDocs();
@@ -73948,7 +74253,16 @@ setGhWriteTokenProvider(() => {
     throw e;
   });
 });
-setClaimWriteTokenProvider(() => mintFilingWriteToken(appActorDeps()).then((t) => t.token));
+var claimWriteToken;
+setClaimWriteTokenProvider(() => {
+  if (process.env.MMI_ACTOR?.trim() === "app") {
+    return mintFilingWriteToken(appActorDeps()).then((t) => t.token);
+  }
+  return claimWriteToken ??= mintFilingWriteToken(appActorDeps()).then((t) => t.token, (e) => {
+    if (e instanceof AppActorError && e.code === "vault-denied") return void 0;
+    throw e;
+  });
+});
 setStatusWriteTokenProvider(() => mintStatusWriteToken(appActorDeps()));
 var registerPreAction = Reflect.get(program2, ["h", "ook"].join(""));
 registerPreAction.call(program2, "preAction", async (_thisCommand, actionCommand) => {
@@ -74787,16 +75101,16 @@ function ciAuditDeps2() {
     // gate re-seed step is skipped gracefully rather than failing mid-run.
     readSeedFile: (path2) => {
       if (!root) return null;
-      const fullPath = (0, import_node_path64.join)(root, path2);
+      const fullPath = (0, import_node_path65.join)(root, path2);
       return (0, import_node_fs67.existsSync)(fullPath) ? (0, import_node_fs67.readFileSync)(fullPath, "utf8") : null;
     }
   };
 }
 function hubRoot2() {
-  const fromPkg = (0, import_node_path64.join)(__dirname, "..", "..");
+  const fromPkg = (0, import_node_path65.join)(__dirname, "..", "..");
   const marker = "skills/bootstrap/seeds/manifest.json";
-  if ((0, import_node_fs67.existsSync)((0, import_node_path64.join)(fromPkg, marker))) return fromPkg;
-  if ((0, import_node_fs67.existsSync)((0, import_node_path64.join)(process.cwd(), marker))) return process.cwd();
+  if ((0, import_node_fs67.existsSync)((0, import_node_path65.join)(fromPkg, marker))) return fromPkg;
+  if ((0, import_node_fs67.existsSync)((0, import_node_path65.join)(process.cwd(), marker))) return process.cwd();
   return null;
 }
 registerQueryCommands(program2);
@@ -75010,7 +75324,7 @@ function directoryBytes(path2) {
     return 0;
   }
   for (const entry of entries) {
-    const child2 = (0, import_node_path64.join)(path2, entry.name);
+    const child2 = (0, import_node_path65.join)(path2, entry.name);
     if (entry.isDirectory()) total += directoryBytes(child2);
     else {
       try {
@@ -75040,7 +75354,7 @@ function pluginCacheFsDeps(configRoot, dirBytes) {
     dirBytes,
     listStagingDirs: (root) => (0, import_node_fs67.readdirSync)(root, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => {
       try {
-        return { name: d.name, mtimeMs: newestMtimeMs((0, import_node_path64.join)(root, d.name), listDirEntries, (p) => (0, import_node_fs67.statSync)(p).mtimeMs) };
+        return { name: d.name, mtimeMs: newestMtimeMs((0, import_node_path65.join)(root, d.name), listDirEntries, (p) => (0, import_node_fs67.statSync)(p).mtimeMs) };
       } catch {
         return { name: d.name, mtimeMs: Date.now() };
       }
@@ -75054,7 +75368,7 @@ function stagingApplyFsGuard(configRoot) {
   return {
     referencedPaths: () => readInstalledPluginRefs(configRoot),
     mtimeMs: (name) => {
-      const p = (0, import_node_path64.join)(stagingRoot, name);
+      const p = (0, import_node_path65.join)(stagingRoot, name);
       if (!(0, import_node_fs67.existsSync)(p)) return null;
       try {
         return newestMtimeMs(p, listDirEntries, (q) => (0, import_node_fs67.statSync)(q).mtimeMs);
@@ -75077,7 +75391,7 @@ program2.command("plugin-prune").description(`prune stale cached MMI plugin vers
     return;
   }
   const plan = buildPluginCachePlan(
-    (0, import_node_os28.homedir)(),
+    (0, import_node_os29.homedir)(),
     running,
     pluginCacheFsDeps(configRoot, directoryBytes),
     { withBytes: true, configRoot, includeStaging: surface !== "codex" }
@@ -75093,7 +75407,7 @@ program2.command("archive-prune").description("inventory worktree evidence archi
   let primary = o.repoRoot;
   if (!primary) {
     const common = await gitOut(["rev-parse", "--path-format=absolute", "--git-common-dir"]);
-    primary = common ? (0, import_node_path64.dirname)(common) : "";
+    primary = common ? (0, import_node_path65.dirname)(common) : "";
   }
   if (!primary) {
     const detail = "archive-prune: not inside a git checkout (pass --repo-root <primary checkout>)";