@mutmutco/cli 2.35.0 → 2.37.0

package/dist/main.cjs

@@ -2160,10 +2160,10 @@ Expecting one of '${allowedValues.join("', '")}'`);
   _executeSubCommand(subcommand, args) {
     args = args.slice();
     const sourceExt = [".js", ".ts", ".tsx", ".mjs", ".cjs"];
-    function findFile(baseDir, baseName) {
-      const localBin = import_node_path.default.resolve(baseDir, baseName);
+    function findFile(baseDir, baseName2) {
+      const localBin = import_node_path.default.resolve(baseDir, baseName2);
       if (import_node_fs.default.existsSync(localBin)) return localBin;
-      if (sourceExt.includes(import_node_path.default.extname(baseName))) return void 0;
+      if (sourceExt.includes(import_node_path.default.extname(baseName2))) return void 0;
       const foundExt = sourceExt.find(
         (ext) => import_node_fs.default.existsSync(`${localBin}${ext}`)
       );
@@ -3391,8 +3391,8 @@ function useColor() {
 var program = new Command();
 
 // src/index.ts
-var import_promises5 = require("node:fs/promises");
-var import_node_fs16 = require("node:fs");
+var import_promises6 = require("node:fs/promises");
+var import_node_fs19 = require("node:fs");
 
 // src/rules-sync.ts
 function normalizeEol(s) {
@@ -3833,6 +3833,7 @@ function createGitHubClient(options = {}) {
   const token = options.token ?? githubToken;
   const defaultTimeoutMs = options.defaultTimeoutMs ?? DEFAULT_TIMEOUT_MS;
   const fetchImpl = options.fetchImpl ?? fetch;
+  const externalSignal = options.signal;
   async function request2(method, url, init = {}) {
     const t = await token();
     const headers = {
@@ -3843,11 +3844,12 @@ function createGitHubClient(options = {}) {
       ...init.body !== void 0 ? { "Content-Type": "application/json" } : {},
       ...init.headers
     };
+    const timeoutSignal = AbortSignal.timeout(init.timeoutMs ?? defaultTimeoutMs);
     const res = await fetchImpl(url, {
       method,
       headers,
       body: init.body !== void 0 ? JSON.stringify(init.body) : void 0,
-      signal: AbortSignal.timeout(init.timeoutMs ?? defaultTimeoutMs)
+      signal: externalSignal ? AbortSignal.any([externalSignal, timeoutSignal]) : timeoutSignal
     });
     if (!res.ok) throw await errorFromResponse(res);
     return res;
@@ -3905,9 +3907,9 @@ var HEAD_MIN_INTERVAL_MS = 5 * 60 * 1e3;
 var HEAD_ENGINE_TIMEOUT_MS = 15e3;
 var HEAD_PROMPT_ACTION_LIMIT = 50;
 var HEAD_PROMPT_DECISION_LIMIT = 80;
-function resolveEngine(platform, custom) {
+function resolveEngine(platform2, custom) {
   if (custom) return { cmd: custom, args: [], shell: true };
-  return { cmd: "claude", args: ["-p", "--no-session-persistence"], shell: platform === "win32" };
+  return { cmd: "claude", args: ["-p", "--no-session-persistence"], shell: platform2 === "win32" };
 }
 function headTsPath(key) {
   const safe = (s) => s.replace(/[^A-Za-z0-9._-]/g, "_");
@@ -4263,6 +4265,13 @@ var import_node_crypto3 = require("node:crypto");
 var import_promises2 = require("node:fs/promises");
 
 // src/issue-body.ts
+var import_node_os2 = require("node:os");
+function emptyStdinMessage(fileFlag) {
+  if ((0, import_node_os2.platform)() === "win32") {
+    return `${fileFlag} - read empty stdin (on Windows, ${fileFlag} - is unreliable through the npm .cmd shim \u2014 use ${fileFlag} <path>, or pipe to \`node cli/dist/index.cjs\` directly)`;
+  }
+  return `${fileFlag} - read empty stdin (nothing piped \u2014 pass a heredoc/pipe, or ${fileFlag} <path>)`;
+}
 async function resolveTextArg(input, deps, labels) {
   const hasValue = input.value !== void 0;
   const hasFile = input.file !== void 0;
@@ -4277,7 +4286,7 @@ async function resolveTextArg(input, deps, labels) {
   const text = source === "-" ? await deps.readStdin() : await deps.readFile(source, "utf8");
   if (text.trim().length === 0) {
     throw new Error(
-      source === "-" ? `${labels.file} - read empty stdin (nothing piped \u2014 pass a heredoc/pipe, or ${labels.file} <path>)` : `${labels.file} produced an empty ${labels.noun}`
+      source === "-" ? emptyStdinMessage(labels.file) : `${labels.file} produced an empty ${labels.noun}`
     );
   }
   return text;
@@ -4299,7 +4308,7 @@ function resolveIssueTitle(input, deps) {
 
 // src/saga-capture.ts
 var import_node_fs8 = require("node:fs");
-var import_node_os2 = require("node:os");
+var import_node_os3 = require("node:os");
 var import_node_path6 = require("node:path");
 function parseHookInput(stdin) {
   try {
@@ -4315,7 +4324,17 @@ function cursorProjectSlug(workspaceRoot) {
   return p.replace(/[^A-Za-z0-9]+/g, "-").replace(/^-+|-+$/g, "").toLowerCase();
 }
 function cursorProjectsRoot(env) {
-  return (0, import_node_path6.join)(env.USERPROFILE ?? env.HOME ?? (0, import_node_os2.homedir)(), ".cursor", "projects");
+  return (0, import_node_path6.join)(env.USERPROFILE ?? env.HOME ?? (0, import_node_os3.homedir)(), ".cursor", "projects");
+}
+function resolveClaudeTranscriptPath(hook, env = process.env) {
+  const sessionId = hook.session_id?.trim();
+  if (!sessionId || !/^[A-Za-z0-9_-]+$/.test(sessionId)) return void 0;
+  const cwd = hook.cwd?.trim() || env.CLAUDE_PROJECT_DIR?.trim();
+  if (!cwd) return void 0;
+  const encoded = cwd.replace(/[^A-Za-z0-9]/g, "-");
+  const root = (0, import_node_path6.join)(env.USERPROFILE ?? env.HOME ?? (0, import_node_os3.homedir)(), ".claude", "projects");
+  const candidate = (0, import_node_path6.join)(root, encoded, `${sessionId}.jsonl`);
+  return (0, import_node_fs8.existsSync)(candidate) ? candidate : void 0;
 }
 function resolveCursorTranscriptPath(hook, env = process.env) {
   const conversationId = (hook.conversation_id ?? hook.conversationId ?? hook.session_id)?.trim();
@@ -4339,7 +4358,7 @@ function resolveTranscriptPath(hook, env = process.env) {
   if (surface === "cursor" || env.CURSOR_TRACE_ID || env.CURSOR_SESSION_ID) {
     return resolveCursorTranscriptPath(hook, env);
   }
-  return void 0;
+  return resolveClaudeTranscriptPath(hook, env);
 }
 function ingestTranscriptFallbackHint(surface) {
   if (surface === "cursor") {
@@ -4348,6 +4367,9 @@ function ingestTranscriptFallbackHint(surface) {
   if (surface === "codex") {
     return 'Codex Stop hook may omit transcript_path \u2014 run: mmi-cli honcho ingest --source note --summary "<turn summary>"';
   }
+  if (surface === "claude") {
+    return 'Claude Stop hook omitted transcript_path and no transcript file was found \u2014 run: mmi-cli honcho ingest --source note --summary "<turn summary>"';
+  }
   return void 0;
 }
 
@@ -4447,6 +4469,7 @@ function buildNoteCapture(summary, o, id, evidence) {
     next: o.next,
     decision: o.decision,
     queueOp,
+    handoffClose: o.handoffClose,
     state,
     source,
     evidence: Object.keys(ev).length ? ev : void 0,
@@ -5080,9 +5103,276 @@ function registerSagaCommands(program3) {
   });
 }
 
+// src/handoff-commands.ts
+var import_node_crypto4 = require("node:crypto");
+var import_promises3 = require("node:fs/promises");
+
+// src/handoff.ts
+var HANDOFF_PREFIX = "handoff:";
+function clean(value) {
+  return value?.trim() ?? "";
+}
+function normalizeHandoffKey(value) {
+  const key = clean(value);
+  if (!key) throw new Error("handoff key is required");
+  return key;
+}
+function serializeHandoff(record) {
+  return `${HANDOFF_PREFIX}${JSON.stringify(record)}`;
+}
+function parseHandoffText(text) {
+  if (!text.startsWith(HANDOFF_PREFIX)) return null;
+  try {
+    const raw = JSON.parse(text.slice(HANDOFF_PREFIX.length));
+    const state = raw.state;
+    const key = clean(raw.key);
+    const northStarSlug = clean(raw.northStarSlug);
+    const summary = clean(raw.summary);
+    const sourceSessionId = clean(raw.sourceSessionId);
+    const createdAt = clean(raw.createdAt);
+    if (state !== "open" && state !== "claimed" && state !== "cancelled") return null;
+    if (!key || !northStarSlug || !summary || !sourceSessionId || !createdAt) return null;
+    return {
+      state,
+      key,
+      northStarSlug,
+      summary,
+      sourceSessionId,
+      createdAt,
+      claimedBySessionId: clean(raw.claimedBySessionId) || void 0,
+      closedAt: clean(raw.closedAt) || void 0
+    };
+  } catch {
+    return null;
+  }
+}
+function listHandoffs(head, opts = {}) {
+  const parsed = (head.queued ?? []).map((item, index) => ({ done: item.done, index, record: parseHandoffText(item.text) })).filter((x) => x.record !== null);
+  return parsed.filter((x) => opts.includeClosed || x.record.state === "open" && !x.done).map((x) => ({ index: x.index, done: x.done, record: x.record }));
+}
+function findOpenHandoff(head, key) {
+  const normalized = normalizeHandoffKey(key).toLowerCase();
+  return listHandoffs(head).find((item) => item.record.key.toLowerCase() === normalized || item.record.northStarSlug.toLowerCase() === normalized);
+}
+function planOpenHandoff(input) {
+  const key = normalizeHandoffKey(input.key);
+  const northStarSlug = clean(input.northStarSlug);
+  const summary = clean(input.summary);
+  const sourceSessionId = clean(input.sourceSessionId);
+  if (!northStarSlug) throw new Error("north star slug is required");
+  if (!summary) throw new Error("handoff summary is required");
+  if (!sourceSessionId) throw new Error("source session id is required");
+  return {
+    state: "open",
+    key,
+    northStarSlug,
+    summary,
+    sourceSessionId,
+    createdAt: input.createdAt
+  };
+}
+function closeHandoff(record, state, at, claimedBySessionId) {
+  return {
+    ...record,
+    state,
+    closedAt: at,
+    claimedBySessionId: claimedBySessionId || record.claimedBySessionId
+  };
+}
+function formatHandoffLine(item) {
+  const r = item.record;
+  const suffix = r.state === "claimed" && r.claimedBySessionId ? ` -> ${r.claimedBySessionId}` : "";
+  return `${r.key} [${r.state}] northstar:${r.northStarSlug} source:${r.sourceSessionId}${suffix} - ${r.summary}`;
+}
+
+// src/handoff-commands.ts
+var FOREGROUND_FETCH = { attempts: 2, timeoutMs: 8e3 };
+var SESSION_START_FETCH = { attempts: 1, timeoutMs: 3e3 };
+async function fetchState(url, qs, retry = FOREGROUND_FETCH) {
+  const res = await fetchWithRetry(fetch, `${url}/saga/state?${qs}`, { headers: await hubHeaders() }, retry);
+  if (!res.ok) return null;
+  const body = await res.json();
+  if ("state" in body) return body;
+  return { key: null, state: { head: body.head } };
+}
+async function fetchScopedSessions(url, project2, branch, retry = FOREGROUND_FETCH) {
+  const qs = new URLSearchParams({ project: project2, branch });
+  const res = await fetchWithRetry(fetch, `${url}/saga/sessions?${qs}`, { headers: await hubHeaders() }, retry);
+  if (!res.ok) return [];
+  const body = await res.json();
+  return body.sessions ?? [];
+}
+async function fetchSessionHead(url, key, retry = FOREGROUND_FETCH) {
+  const qs = new URLSearchParams(key);
+  const got = await fetchState(url, qs, retry);
+  return got?.state?.head ?? null;
+}
+async function fetchCurrentState() {
+  const cfg = await loadConfig();
+  if (!cfg.sagaApiUrl) return null;
+  const key = await sagaKey(cfg);
+  const got = await fetchState(cfg.sagaApiUrl, new URLSearchParams(key));
+  return got ? { key, head: got.state?.head ?? {} } : null;
+}
+async function collectScopedHandoffs(opts = {}) {
+  const cfg = await loadConfig();
+  if (!cfg.sagaApiUrl) return { handoffs: [], sessions: [] };
+  const key = await sagaKey(cfg);
+  const retry = opts.retry ?? FOREGROUND_FETCH;
+  const sessions = await fetchScopedSessions(cfg.sagaApiUrl, key.project, key.branch, retry);
+  const seen = /* @__PURE__ */ new Set();
+  const handoffs = [];
+  for (const session of sessions) {
+    const head = await fetchSessionHead(cfg.sagaApiUrl, session, retry);
+    if (!head) continue;
+    for (const item of listHandoffs(head, { includeClosed: opts.includeClosed })) {
+      const dedupe = `${item.record.sourceSessionId}:${item.record.key}:${item.record.state}`;
+      if (seen.has(dedupe)) continue;
+      seen.add(dedupe);
+      handoffs.push(item);
+    }
+  }
+  return { handoffs, sessions };
+}
+async function locateOpenHandoff(key, retry = FOREGROUND_FETCH) {
+  const cfg = await loadConfig();
+  if (!cfg.sagaApiUrl) return null;
+  const scopeKey = await sagaKey(cfg);
+  const sessions = await fetchScopedSessions(cfg.sagaApiUrl, scopeKey.project, scopeKey.branch, retry);
+  for (const session of sessions) {
+    const head = await fetchSessionHead(cfg.sagaApiUrl, session, retry);
+    if (!head) continue;
+    const item = findOpenHandoff(head, key);
+    if (item) {
+      return {
+        key: { project: session.project, branch: session.branch, sessionId: session.sessionId },
+        item
+      };
+    }
+  }
+  return null;
+}
+async function locateClaimedHandoff(key, claimedBySessionId, retry = FOREGROUND_FETCH) {
+  const { handoffs } = await collectScopedHandoffs({ includeClosed: true, retry });
+  const normalized = key.toLowerCase();
+  return handoffs.find((item) => {
+    const r = item.record;
+    return r.state === "claimed" && r.claimedBySessionId === claimedBySessionId && (r.key.toLowerCase() === normalized || r.northStarSlug.toLowerCase() === normalized);
+  }) ?? null;
+}
+async function postKeyedNote(key, summary, options) {
+  const cfg = await loadConfig();
+  if (!cfg.sagaApiUrl) fail("handoff: Hub API URL not configured");
+  const sha = await gitOut(["rev-parse", "--short", "HEAD"]);
+  const capture = buildNoteCapture(summary, options, (0, import_node_crypto4.randomUUID)(), { sha: sha || void 0, branch: key.branch });
+  const result = await postCaptureOnce(cfg.sagaApiUrl, { ...capture, ...key });
+  if (!result.ok) fail(`handoff: write failed${result.status ? ` (HTTP ${result.status})` : ""}${result.message ? `: ${result.message}` : ""}`);
+}
+function deriveOpenFields(summary, opts, head, key) {
+  const northStarSlug = opts.northStarSlug ?? head.anchor?.slug;
+  const handoffKey = opts.key ?? northStarSlug;
+  const text = summary?.trim() || head.next?.trim() || head.anchor?.intent?.trim();
+  return planOpenHandoff({
+    key: handoffKey ?? "",
+    northStarSlug: northStarSlug ?? "",
+    summary: text ?? "",
+    sourceSessionId: key.sessionId,
+    createdAt: (/* @__PURE__ */ new Date()).toISOString()
+  });
+}
+async function runHandoffOpen(summary, opts, io = consoleIo) {
+  let resolvedSummary = summary;
+  if (summary !== void 0 || opts.messageFile !== void 0) {
+    try {
+      resolvedSummary = await resolveTextArg({ value: summary, file: opts.messageFile }, { readFile: import_promises3.readFile, readStdin }, {
+        value: "a summary argument",
+        file: "--message-file",
+        noun: "message"
+      });
+    } catch (e) {
+      return fail(`handoff open: ${e.message}`);
+    }
+  }
+  const current = await fetchCurrentState();
+  if (!current) return fail("handoff open: saga state unavailable");
+  let record;
+  try {
+    record = deriveOpenFields(resolvedSummary, opts, current.head, current.key);
+  } catch (e) {
+    return fail(`handoff open: ${e.message}`);
+  }
+  await postKeyedNote(current.key, `handoff opened ${record.key}`, { queueAdd: serializeHandoff(record), anchorSlug: record.northStarSlug });
+  if (opts.json) return io.log(JSON.stringify({ ok: true, handoff: record }));
+  io.log(`handoff open: ${formatHandoffLine({ index: -1, done: false, record })}`);
+}
+async function runHandoffList(opts, io = consoleIo) {
+  const { handoffs } = await collectScopedHandoffs({ includeClosed: opts.all });
+  if (opts.json) {
+    io.log(JSON.stringify({ handoffs }, null, 2));
+  } else if (!handoffs.length) {
+    io.log("handoff list: none");
+  } else {
+    for (const h of handoffs) io.log(formatHandoffLine(h));
+  }
+  return handoffs;
+}
+async function runHandoffOffer(io = consoleIo, opts = {}) {
+  const retry = opts.fast ? SESSION_START_FETCH : FOREGROUND_FETCH;
+  const { handoffs } = await collectScopedHandoffs({ retry });
+  if (!handoffs.length) return;
+  io.log("Open handoffs:");
+  for (const h of handoffs) io.log(`- ${formatHandoffLine(h)}`);
+  io.log("Use `mmi-cli handoff accept <key>` to claim, `mmi-cli handoff cancel <key>` to close, or decline in chat to leave it open.");
+}
+async function closeSourceHandoff(key, state, opts = {}, io = consoleIo) {
+  const current = await sagaKey(await loadConfig(), resolveSessionId());
+  const located = await locateOpenHandoff(key);
+  if (!located) {
+    if (state === "claimed") {
+      const prior = await locateClaimedHandoff(key, current.sessionId);
+      if (prior) {
+        if (opts.json) return io.log(JSON.stringify({ ok: true, handoff: prior.record, idempotent: true }));
+        return io.log(`handoff claimed: ${formatHandoffLine(prior)} (already accepted)`);
+      }
+    }
+    return fail(`handoff ${state}: no open handoff matching ${key}`);
+  }
+  const closed = closeHandoff(located.item.record, state, (/* @__PURE__ */ new Date()).toISOString(), state === "claimed" ? current.sessionId : void 0);
+  await postKeyedNote(located.key, `handoff ${state} ${located.item.record.key}`, {
+    handoffClose: { index: located.item.index, closedText: serializeHandoff(closed) }
+  });
+  if (state === "claimed") {
+    await postKeyedNote(current, `handoff accepted ${located.item.record.key}`, {
+      anchor: located.item.record.summary,
+      anchorSlug: located.item.record.northStarSlug,
+      anchorForce: true,
+      decision: `accepted handoff ${located.item.record.key} from session ${located.item.record.sourceSessionId}; northstar ${located.item.record.northStarSlug}`,
+      verified: true
+    });
+  }
+  if (opts.json) return io.log(JSON.stringify({ ok: true, handoff: closed }));
+  io.log(`handoff ${state}: ${formatHandoffLine({ index: located.item.index, done: true, record: closed })}`);
+}
+async function runHandoffDecline(key, opts = {}, io = consoleIo) {
+  const located = await locateOpenHandoff(key);
+  if (!located) return fail(`handoff decline: no open handoff matching ${key}`);
+  if (opts.json) return io.log(JSON.stringify({ ok: true, unchanged: true, handoff: located.item.record }));
+  io.log(`handoff decline: left open for re-offer \u2014 ${formatHandoffLine(located.item)}`);
+}
+function registerHandoffCommands(program3) {
+  const handoff = program3.command("handoff").description("explicit saga + North Star handoff lifecycle");
+  handoff.command("open [summary]").description("open a handoff bound to the current North Star slug").option("--key <slug|#issue>", "handoff key (defaults to the current North Star slug)").option("--north-star-slug <slug>", "North Star slug to bind (defaults to current saga anchor slug)").option("--message-file <path|->", "read the handoff summary from a UTF-8 file, or from stdin with - (avoids cmd.exe quoting)").option("--json", "machine-readable output").action((summary, opts) => runHandoffOpen(summary, opts));
+  handoff.command("list").description("list open handoffs for the current repo/branch").option("--all", "include claimed/cancelled records").option("--json", "machine-readable output").action(async (opts) => {
+    await runHandoffList(opts);
+  });
+  handoff.command("accept <key>").description("claim an open handoff and bind this session to its North Star").option("--json", "machine-readable output").action((key, opts) => closeSourceHandoff(key, "claimed", opts));
+  handoff.command("cancel <key>").description("close an open handoff without claiming it").option("--json", "machine-readable output").action((key, opts) => closeSourceHandoff(key, "cancelled", opts));
+  handoff.command("decline <key>").description("leave an open handoff unchanged so it is re-offered later").option("--json", "machine-readable output").action((key, opts) => runHandoffDecline(key, opts));
+}
+
 // src/honcho-commands.ts
 var import_node_child_process5 = require("node:child_process");
-var import_promises3 = require("node:fs/promises");
+var import_promises4 = require("node:fs/promises");
 var import_node_fs10 = require("node:fs");
 var import_node_path8 = require("node:path");
 
@@ -5631,6 +5921,28 @@ async function honchoApiKey(env = process.env, fetcher = vaultKeyFetcher) {
   cachedVaultKey ??= fetcher().catch(() => null);
   return cachedVaultKey;
 }
+function honchoKeyReasonFromStatus(status) {
+  if (status >= 200 && status < 300) return "ok";
+  if (status === 401 || status === 403) return "forbidden";
+  if (status === 404) return "missing";
+  return "unreachable";
+}
+async function diagnoseHonchoKey(env = process.env, fetchImpl = fetch) {
+  if ((env.HONCHO_API_KEY || "").trim()) return { reason: "ok" };
+  const cfg = await loadConfig();
+  if (!cfg.sagaApiUrl) return { reason: "unreachable" };
+  try {
+    const res = await fetchImpl(`${cfg.sagaApiUrl}/secrets/get`, {
+      method: "POST",
+      headers: await hubHeaders({ "content-type": "application/json" }),
+      body: JSON.stringify({ repo: HONCHO_SECRET_REPO, key: HONCHO_SECRET_KEY }),
+      signal: AbortSignal.timeout(8e3)
+    });
+    return { reason: honchoKeyReasonFromStatus(res.status), httpStatus: res.status };
+  } catch {
+    return { reason: "unreachable" };
+  }
+}
 async function resolveHonchoConfig(cfg = {}, opts = {}) {
   const { apiUrl, workspace } = honchoEndpoint(cfg, opts.env);
   if (!apiUrl) return null;
@@ -5640,7 +5952,7 @@ async function resolveHonchoConfig(cfg = {}, opts = {}) {
 }
 
 // src/honcho-ingest.ts
-var import_node_crypto4 = require("node:crypto");
+var import_node_crypto5 = require("node:crypto");
 var DEFAULT_HONCHO_MAX_CHARS = 4e3;
 var DEFAULT_HONCHO_CARD_MAX_CHARS = 1200;
 var REDACTED = "[REDACTED]";
@@ -5726,7 +6038,7 @@ function buildIngestPayload(args) {
   const maxChars = args.maxChars ?? DEFAULT_HONCHO_MAX_CHARS;
   const messages = args.messages.map((m) => ({ role: m.role, content: capContent(redactSecrets(m.content), maxChars) })).filter((m) => m.content.trim().length > 0);
   return {
-    id: args.id ?? (0, import_node_crypto4.randomUUID)(),
+    id: args.id ?? (0, import_node_crypto5.randomUUID)(),
     workspace: args.workspace,
     peer: args.peer,
     session: args.session,
@@ -5950,7 +6262,7 @@ async function resolveSummaryText(summary, messageFile) {
   if (summary && summary.trim()) return summary.trim();
   if (messageFile) {
     try {
-      return (messageFile === "-" ? await readStdin() : await (0, import_promises3.readFile)(messageFile, "utf8")).trim();
+      return (messageFile === "-" ? await readStdin() : await (0, import_promises4.readFile)(messageFile, "utf8")).trim();
     } catch {
       return "";
     }
@@ -5978,7 +6290,7 @@ async function runHonchoIngest(opts) {
     const transcriptPath = resolveTranscriptPath(hook);
     if (transcriptPath) {
       try {
-        messages = extractTurnMessages(await (0, import_promises3.readFile)(transcriptPath, "utf8"));
+        messages = extractTurnMessages(await (0, import_promises4.readFile)(transcriptPath, "utf8"));
       } catch {
         recordIngestSkip({
           reason: "transcript-unreadable",
@@ -6127,6 +6439,7 @@ async function runHonchoHealth(o, io = consoleIo) {
   const { apiUrl, workspace } = honchoEndpoint(cfg);
   const apiKey = await honchoApiKey();
   const hc = apiKey ? { apiUrl, apiKey, workspace } : null;
+  const keyReason = apiKey ? "ok" : (await diagnoseHonchoKey()).reason;
   const peer = honchoPeerId(await honchoLogin(cfg), cfg);
   const liveness = hc ? await probeHoncho(hc, fetch, 3e3, { peer: peer ?? void 0 }) : {
     reachable: false,
@@ -6144,6 +6457,7 @@ async function runHonchoHealth(o, io = consoleIo) {
     configured: !!hc,
     apiUrl,
     apiKeyConfigured: !!apiKey,
+    keyReason,
     reachable: liveness.reachable,
     authOk: liveness.authOk,
     status: liveness.status,
@@ -6168,7 +6482,11 @@ async function runHonchoHealth(o, io = consoleIo) {
     return;
   }
   io.log(`honcho health: ${report.ok ? "OK" : "NOT OK"}`);
-  if (!apiKey) io.log(" - no client key available from the vault \u2014 honcho is off");
+  if (!apiKey) {
+    if (keyReason === "forbidden") io.log(" - off: client key forbidden (401/403) \u2014 your account lacks Honcho access");
+    else if (keyReason === "missing") io.log(" - off: client key not found in the vault (404)");
+    else io.log(" - off: vault unreachable \u2014 could not fetch the client key");
+  }
   if (report.configured && !report.reachable) io.log(" - service unreachable");
   if (report.configured && report.reachable && !report.authOk) io.log(" - API key rejected (401/403) \u2014 rotate or fix vault path");
   if (!report.peer) io.log(" - no peer identity resolved (gh login) \u2014 ingest will be skipped");
@@ -6203,6 +6521,89 @@ function registerHonchoCommands(program3) {
   honcho.command("key").option("--json", "machine-readable output").description("print the resolved honcho identity (workspace, peer, session) \u2014 no write, no key").action((o) => runHonchoKey(o));
 }
 
+// src/scrooge-commands.ts
+var import_node_fs11 = require("node:fs");
+var import_node_path9 = require("node:path");
+var SCROOGE_TRACE_PATH = (0, import_node_path9.join)(".mmi", "scrooge", "trace.jsonl");
+function resolveModeFromEnv() {
+  const v = String(process.env.MMI_SCROOGE ?? "conservative").trim().toLowerCase();
+  if (!v || v === "conservative") return "conservative";
+  if (v === "0" || v === "off" || v === "false") return "off";
+  if (v === "normal") return "normal";
+  if (v === "spike") return "spike";
+  return "conservative";
+}
+function parseTraceLines(raw) {
+  const out = [];
+  for (const line of raw.split(/\r?\n/)) {
+    const t = line.trim();
+    if (!t) continue;
+    try {
+      const o = JSON.parse(t);
+      if (o && typeof o === "object") out.push(o);
+    } catch {
+    }
+  }
+  return out;
+}
+function summarizeTrace(entries) {
+  let tools = 0;
+  let charsIn = 0;
+  let charsOut = 0;
+  const passCounts = {};
+  for (const e of entries) {
+    tools += 1;
+    charsIn += Number(e.charsIn) || 0;
+    charsOut += Number(e.charsOut) || 0;
+    for (const p of e.passes ?? []) passCounts[p] = (passCounts[p] ?? 0) + 1;
+  }
+  const saved = Math.max(0, charsIn - charsOut);
+  return {
+    tools,
+    charsIn,
+    charsOut,
+    charsSaved: saved,
+    estTokensSaved: Math.round(saved / 4),
+    passCounts
+  };
+}
+function runScroogeReport(io, tracePath = SCROOGE_TRACE_PATH) {
+  const mode = resolveModeFromEnv();
+  if (!(0, import_node_fs11.existsSync)(tracePath)) {
+    io.log(`Scrooge: no trace at ${tracePath} (hook has not compacted anything yet).`);
+    io.log(`Active mode: ${mode} (MMI_SCROOGE env; default conservative).`);
+    return 0;
+  }
+  let raw = "";
+  try {
+    raw = (0, import_node_fs11.readFileSync)(tracePath, "utf8");
+  } catch (e) {
+    io.err(`Scrooge: could not read trace: ${e.message}`);
+    return 1;
+  }
+  const entries = parseTraceLines(raw);
+  const s = summarizeTrace(entries);
+  io.log("Scrooge session summary");
+  io.log(`  mode (current env): ${mode}`);
+  io.log(`  compacted tool results: ${s.tools}`);
+  io.log(`  chars in / out: ${s.charsIn} / ${s.charsOut}`);
+  io.log(`  chars saved: ${s.charsSaved}`);
+  io.log(`  est tokens saved (chars/4): ~${s.estTokensSaved}`);
+  const passes = Object.entries(s.passCounts).sort((a, b) => b[1] - a[1]);
+  if (passes.length) {
+    io.log("  passes:");
+    for (const [name, count] of passes) io.log(`    ${name}: ${count}`);
+  }
+  return 0;
+}
+function registerScroogeCommands(program3) {
+  const scrooge = program3.command("scrooge").description("Scrooge \u2014 org tool-output compaction (trace + report)");
+  scrooge.command("report").description("print char/token savings from .mmi/scrooge/trace.jsonl").action(() => {
+    const code = runScroogeReport({ log: (s) => console.log(s), err: (s) => console.error(s) });
+    process.exit(code);
+  });
+}
+
 // src/docs-sync.ts
 var SYNCED_DOCS = ["README.md", "architecture.md"];
 async function syncDocs(deps, docs2 = SYNCED_DOCS) {
@@ -6225,8 +6626,205 @@ async function syncDocs(deps, docs2 = SYNCED_DOCS) {
 }
 
 // src/session-start.ts
-var import_node_fs11 = require("node:fs");
-var import_node_path9 = require("node:path");
+var import_node_fs13 = require("node:fs");
+var import_node_path11 = require("node:path");
+
+// src/scratch-gc.ts
+var import_node_fs12 = require("node:fs");
+var import_node_path10 = require("node:path");
+var TMP_STALE_MS = 6e4;
+var FLUSH_LOCK_GC_MS = 6e5;
+var HEAD_TS_STALE_MS = 48 * 36e5;
+var LAST_SKIP_STALE_MS = 24 * 36e5;
+var CONFLICT_COPY_STALE_MS = 24 * 36e5;
+var PLAN_ADVISORY_AGE_MS = 30 * 24 * 36e5;
+var SCRATCH_GC_THROTTLE_MS = 24 * 36e5;
+function scratchGcThrottlePath(mmiRoot) {
+  return (0, import_node_path10.join)(mmiRoot, "head-ts", ".scratch-gc-last");
+}
+function scratchGcDue(stampPath, now = Date.now(), read = import_node_fs12.readFileSync) {
+  try {
+    return now - (Number(read(stampPath, "utf8").trim()) || 0) >= SCRATCH_GC_THROTTLE_MS;
+  } catch {
+    return true;
+  }
+}
+function markScratchGcRun(stampPath, now = Date.now()) {
+  try {
+    (0, import_node_fs12.mkdirSync)((0, import_node_path10.dirname)(stampPath), { recursive: true });
+    (0, import_node_fs12.writeFileSync)(stampPath, String(now), "utf8");
+  } catch {
+  }
+}
+function executeScratchGc(repoRoot, opts, now = Date.now()) {
+  const snap = collectScratchSnapshot(repoRoot);
+  const plan2 = planScratchGc(snap, now);
+  if (!opts.apply) return { plan: plan2 };
+  return { plan: plan2, applied: applyScratchGc(plan2, snap.mmiRoot, now) };
+}
+var NEVER_BASENAMES = /* @__PURE__ */ new Set([".session", "config.json", "saga-pending.jsonl"]);
+var TMP_SIDECAR_BASES = ["saga-pending.jsonl", "last-skip.json"];
+var CONFLICT_COPY_ALLOWLIST = /* @__PURE__ */ new Set(["saga-pending.jsonl", "last-skip.json"]);
+function conflictCopyOriginal(name) {
+  const m = /^(.+) \d+(\.[^.]+)$/.exec(name);
+  return m ? `${m[1]}${m[2]}` : null;
+}
+function isTmpSidecar(name) {
+  return name.endsWith(".tmp") && TMP_SIDECAR_BASES.some((b) => name.startsWith(`${b}.`));
+}
+function planScratchGc(snap, now = Date.now()) {
+  const candidates = [];
+  const normalizePath = (p) => p.replace(/\\/g, "/");
+  const mmiPaths = new Set(snap.mmiFiles.map((f) => normalizePath(f.path)));
+  const headTsPrefix = `${snap.mmiRoot.replace(/[\\/]+$/, "")}/head-ts/`.replace(/\\/g, "/");
+  const days = (ms) => `${Math.floor(ms / 864e5)}d`;
+  for (const f of snap.mmiFiles) {
+    const age = now - f.mtimeMs;
+    const add = (family, reason) => candidates.push({ path: f.path, family, tier: "safe-auto", reason, bytes: f.bytes });
+    if (isTmpSidecar(f.name)) {
+      if (age > TMP_STALE_MS) add("tmp-sidecar", `crashed atomic-write sidecar (${days(age)} old)`);
+      continue;
+    }
+    if (f.name === "saga-flush.lock") {
+      if (age > FLUSH_LOCK_GC_MS) add("flush-lock", `abandoned flush lock (${days(age)} old)`);
+      continue;
+    }
+    if (NEVER_BASENAMES.has(f.name)) continue;
+    if (f.path.replace(/\\/g, "/").startsWith(headTsPrefix) && !f.name.startsWith(".")) {
+      if (age > HEAD_TS_STALE_MS) add("head-ts", `stale throttle stamp (${days(age)} old)`);
+      continue;
+    }
+    if (f.name === "last-skip.json") {
+      if (age > LAST_SKIP_STALE_MS) add("last-skip", `stale ingest-skip hint (${days(age)} old)`);
+      continue;
+    }
+    const orig = conflictCopyOriginal(f.name);
+    if (orig && CONFLICT_COPY_ALLOWLIST.has(orig) && mmiPaths.has(normalizePath((0, import_node_path10.join)(f.dir, orig))) && age > CONFLICT_COPY_STALE_MS) {
+      add("conflict-copy", `cloud-sync conflict copy of ${orig} (${days(age)} old)`);
+    }
+  }
+  if (snap.syncQueueSlugs) {
+    for (const f of snap.planMdFiles) {
+      const slug = f.name.replace(/\.md$/, "");
+      if (snap.syncQueueSlugs.has(slug)) continue;
+      if (now - f.mtimeMs > PLAN_ADVISORY_AGE_MS) {
+        candidates.push({
+          path: f.path,
+          family: "plan",
+          tier: "advisory",
+          reason: `synced plan older than ${Math.floor(PLAN_ADVISORY_AGE_MS / 864e5)}d`,
+          bytes: f.bytes
+        });
+      }
+    }
+  }
+  return {
+    candidates,
+    safeAuto: candidates.filter((c) => c.tier === "safe-auto"),
+    advisory: candidates.filter((c) => c.tier === "advisory")
+  };
+}
+function formatScratchGcPlan(plan2, applied) {
+  if (plan2.candidates.length === 0) return "scratch GC: nothing to prune \u2014 local saga/plan/honcho scratch is clean.";
+  const lines = [];
+  const bytes = plan2.safeAuto.reduce((n, c) => n + c.bytes, 0);
+  lines.push(
+    `scratch GC: ${applied ? "pruned" : "would prune"} ${plan2.safeAuto.length} stale file(s) (${bytes} bytes)` + (plan2.advisory.length ? `; ${plan2.advisory.length} advisory (kept):` : ":")
+  );
+  for (const c of plan2.safeAuto.slice(0, 40)) lines.push(`  - [${c.family}] ${c.path} \u2014 ${c.reason}`);
+  if (plan2.safeAuto.length > 40) lines.push(`  ... +${plan2.safeAuto.length - 40} more`);
+  for (const c of plan2.advisory.slice(0, 20)) lines.push(`  \xB7 [advisory] ${c.path} \u2014 ${c.reason} (kept; review manually)`);
+  return lines.join("\n");
+}
+function scratchGcBannerLine(safeAutoPruned, advisory) {
+  const parts = [];
+  if (safeAutoPruned > 0) parts.push(`pruned ${safeAutoPruned} stale local file(s)`);
+  if (advisory > 0) parts.push(`${advisory} old synced plan(s) prunable \u2014 \`mmi-cli gc --scratch --dry-run\` to review`);
+  return parts.length ? `[cleanup] ${parts.join("; ")}` : void 0;
+}
+function applyScratchGc(plan2, mmiRoot, now = Date.now()) {
+  const result = { pruned: [], skipped: 0, bytes: 0 };
+  let anchor;
+  try {
+    anchor = (0, import_node_fs12.realpathSync)(mmiRoot).replace(/\\/g, "/").replace(/\/+$/, "");
+  } catch {
+    return result;
+  }
+  for (const c of plan2.safeAuto) {
+    try {
+      const real = (0, import_node_fs12.realpathSync)(c.path).replace(/\\/g, "/");
+      if (real !== anchor && !real.startsWith(`${anchor}/`)) {
+        result.skipped += 1;
+        continue;
+      }
+      const st = (0, import_node_fs12.statSync)(c.path);
+      const floor = c.family === "flush-lock" ? FLUSH_LOCK_GC_MS : c.family === "tmp-sidecar" ? TMP_STALE_MS : c.family === "head-ts" ? HEAD_TS_STALE_MS : c.family === "last-skip" ? LAST_SKIP_STALE_MS : CONFLICT_COPY_STALE_MS;
+      if (now - st.mtimeMs <= floor) {
+        result.skipped += 1;
+        continue;
+      }
+      (0, import_node_fs12.unlinkSync)(c.path);
+      result.pruned.push(c.path);
+      result.bytes += c.bytes;
+    } catch {
+      result.skipped += 1;
+    }
+  }
+  return result;
+}
+function collectScratchSnapshot(repoRoot, deps = {}) {
+  const readdir = deps.readdir ?? import_node_fs12.readdirSync;
+  const stat = deps.stat ?? import_node_fs12.statSync;
+  const readFile6 = deps.readFile ?? import_node_fs12.readFileSync;
+  const mmiRoot = (0, import_node_path10.join)(repoRoot, ".mmi");
+  const plansRoot = (0, import_node_path10.join)(repoRoot, "plans");
+  const mmiFiles = [];
+  try {
+    for (const ent of readdir(mmiRoot, { recursive: true, withFileTypes: true })) {
+      if (!ent.isFile()) continue;
+      const dir = ent.parentPath ?? ent.path ?? mmiRoot;
+      const full = (0, import_node_path10.join)(dir, ent.name);
+      try {
+        const st = stat(full);
+        mmiFiles.push({ path: full, dir, name: ent.name, mtimeMs: st.mtimeMs, bytes: st.size });
+      } catch {
+      }
+    }
+  } catch {
+  }
+  const planMdFiles = [];
+  try {
+    for (const ent of readdir(plansRoot, { withFileTypes: true })) {
+      if (!ent.isFile() || !ent.name.endsWith(".md")) continue;
+      const full = (0, import_node_path10.join)(plansRoot, ent.name);
+      try {
+        const st = stat(full);
+        planMdFiles.push({ path: full, dir: plansRoot, name: ent.name, mtimeMs: st.mtimeMs, bytes: st.size });
+      } catch {
+      }
+    }
+  } catch {
+  }
+  let syncQueueSlugs = null;
+  let queueRaw;
+  try {
+    queueRaw = readFile6((0, import_node_path10.join)(plansRoot, ".sync-queue.json"), "utf8");
+  } catch {
+    syncQueueSlugs = /* @__PURE__ */ new Set();
+  }
+  if (queueRaw !== void 0) {
+    try {
+      const parsed = JSON.parse(queueRaw);
+      const entries = Array.isArray(parsed) ? parsed : parsed.entries ?? [];
+      syncQueueSlugs = new Set(entries.map((e) => e.slug).filter((s) => typeof s === "string"));
+    } catch {
+      syncQueueSlugs = null;
+    }
+  }
+  return { mmiRoot, mmiFiles, planMdFiles, syncQueueSlugs };
+}
+
+// src/session-start.ts
 async function runBufferedStep(step) {
   const lines = [];
   const io = {
@@ -6254,6 +6852,7 @@ function buildSessionStartPlan(verbs) {
     parallel: [
       { name: "rules sync", run: verbs.rulesSync },
       { name: "saga show", run: verbs.sagaShow },
+      { name: "handoff offer", run: verbs.handoffOffer },
       // honcho profile (#1162): the behavioral-memory prior, flushed right after the saga resume. A fast
       // peer-card GET, fail-soft + silent when off/empty — it never hangs or noises the banner.
       { name: "honcho profile", run: verbs.honchoContext },
@@ -6275,14 +6874,24 @@ function spawnDetachedSelf(args, deps) {
   } catch {
   }
 }
+function isInsideRepoSubdir(cwd, exists = import_node_fs13.existsSync) {
+  if (exists((0, import_node_path11.join)(cwd, ".git"))) return false;
+  let dir = cwd;
+  for (; ; ) {
+    const parent = (0, import_node_path11.dirname)(dir);
+    if (parent === dir) return false;
+    if (exists((0, import_node_path11.join)(parent, ".git"))) return true;
+    dir = parent;
+  }
+}
 function planStoreLines(cwd) {
   const mdFiles = (dir, minSize = 0) => {
-    const p = (0, import_node_path9.join)(cwd, dir);
-    if (!(0, import_node_fs11.existsSync)(p)) return [];
+    const p = (0, import_node_path11.join)(cwd, dir);
+    if (!(0, import_node_fs13.existsSync)(p)) return [];
     try {
-      return (0, import_node_fs11.readdirSync)(p).filter((f) => f.toLowerCase().endsWith(".md")).filter((f) => {
+      return (0, import_node_fs13.readdirSync)(p).filter((f) => f.toLowerCase().endsWith(".md")).filter((f) => {
         try {
-          return (0, import_node_fs11.statSync)((0, import_node_path9.join)(p, f)).size >= minSize;
+          return (0, import_node_fs13.statSync)((0, import_node_path11.join)(p, f)).size >= minSize;
         } catch {
           return false;
         }
@@ -6300,6 +6909,19 @@ function planStoreLines(cwd) {
     out.push(`[plan-store] ${localPlans.length} local plan(s) in plans/ \u2014 ensure new/changed ones are \`mmi-cli plan push\`ed (S3-backed, not git).`);
   return out;
 }
+function scratchGcLines(cwd, env = process.env, now = Date.now()) {
+  if (env.MMI_NO_AUTO_GC) return [];
+  try {
+    const stamp = scratchGcThrottlePath((0, import_node_path11.join)(cwd, ".mmi"));
+    if (!scratchGcDue(stamp, now)) return [];
+    const run = executeScratchGc(cwd, { apply: true }, now);
+    markScratchGcRun(stamp, now);
+    const line = scratchGcBannerLine(run.applied?.pruned.length ?? 0, run.plan.advisory.length);
+    return line ? [line] : [];
+  } catch {
+    return [];
+  }
+}
 function northstarPointer(injected = false) {
   if (injected) {
     return "North Stars: `mmi-cli northstar relevant` for more matches; `northstar pull <slug>` for the full SSOT.";
@@ -6347,6 +6969,71 @@ function recoverPriorityFromEvents(events) {
   return found;
 }
 
+// src/board-dependency.ts
+var DEPENDS_ON_LINE = /^\s*[-*]?\s*\*\*Depends on:\*\*\s*(.+)$/im;
+var ISSUE_REF = /([a-zA-Z0-9_.-]+\/[a-zA-Z0-9_.-]+)#(\d+)/g;
+function parseDependsOnRefs(body) {
+  const match = body.match(DEPENDS_ON_LINE);
+  if (!match) return [];
+  const refs = [];
+  for (const m of match[1].matchAll(ISSUE_REF)) {
+    refs.push({ repo: m[1], number: Number(m[2]) });
+  }
+  return refs;
+}
+async function issueOpen(client, repo, number) {
+  try {
+    const data = await client.rest("GET", `repos/${repo}/issues/${number}`);
+    return data?.state === "OPEN";
+  } catch {
+    return void 0;
+  }
+}
+async function dependencyBlocksClaim(client, body) {
+  const refs = parseDependsOnRefs(body);
+  if (!refs.length) return { blocked: false, openDependencies: [] };
+  const openDependencies = [];
+  for (const ref of refs) {
+    const open = await issueOpen(client, ref.repo, ref.number);
+    if (open === true) openDependencies.push(`${ref.repo}#${ref.number}`);
+  }
+  return { blocked: openDependencies.length > 0, openDependencies };
+}
+async function filterDependencyBlockedClaimables(items, client, opts = {}) {
+  const claimable = [];
+  const blocked = [];
+  const warnings = [];
+  for (const item of items) {
+    if (item.contentType !== "Issue") {
+      claimable.push(item);
+      continue;
+    }
+    let body = item.details?.body;
+    if (body === void 0) {
+      if (opts.requireBundledBody) {
+        claimable.push(item);
+        continue;
+      }
+      try {
+        const data = await client.rest("GET", `repos/${item.repository}/issues/${item.number}`);
+        body = data?.body ?? "";
+      } catch (e) {
+        warnings.push(`dependency check skipped for ${item.ref}: ${e.message}`);
+        claimable.push(item);
+        continue;
+      }
+    }
+    const gate = await dependencyBlocksClaim(client, body);
+    if (gate.blocked) {
+      blocked.push(item);
+      warnings.push(`${item.ref} blocked on open ${gate.openDependencies.join(", ")}`);
+    } else {
+      claimable.push(item);
+    }
+  }
+  return { claimable, blocked, warnings };
+}
+
 // ../infra/board-vocab.mjs
 var BOARD_STATUSES = ["Todo", "In Progress", "In Review", "Done"];
 
@@ -6670,6 +7357,13 @@ async function readBoard(options, deps = {}) {
   if (options.includeBundleDetails) {
     await attachBundleDetails(report, client, options.allowPartial ?? false);
   }
+  for (const scope of ["primary", "secondary"]) {
+    const filtered = await filterDependencyBlockedClaimables(report[scope].claimable, client, {
+      requireBundledBody: Boolean(options.includeBundleDetails)
+    });
+    report[scope].claimable = filtered.claimable;
+    report.warnings.push(...filtered.warnings);
+  }
   return report;
 }
 function findBoardItem(items, selector) {
@@ -6751,6 +7445,11 @@ async function prepareClaimContext(options, selectors, deps, collected) {
     warnings: collected.warnings,
     partial: collected.partial
   };
+  for (const scope of ["primary", "secondary"]) {
+    const filtered = await filterDependencyBlockedClaimables(report[scope].claimable, client);
+    report[scope].claimable = filtered.claimable;
+    report.warnings.push(...filtered.warnings);
+  }
   return { cfg, client, items: collected.items, writable: writable.repos, report };
 }
 async function claimOneBoardItem(ctx, selector, options) {
@@ -6759,6 +7458,21 @@ async function claimOneBoardItem(ctx, selector, options) {
   if (flatItem.status === "Todo" && flatItem.assignees.length === 0 && !ctx.writable.has(flatItem.repository.toLowerCase())) {
     throw new Error(`${flatItem.ref} is not claimable: viewer does not have write access to ${flatItem.repository}`);
   }
+  if (flatItem.contentType === "Issue") {
+    let body = flatItem.details?.body;
+    if (body === void 0) {
+      try {
+        const data = await client.rest("GET", `repos/${flatItem.repository}/issues/${flatItem.number}`);
+        body = data?.body ?? "";
+      } catch {
+        body = "";
+      }
+    }
+    const gate = await dependencyBlocksClaim(client, body);
+    if (gate.blocked) {
+      throw new Error(`${flatItem.ref} is not claimable: blocked on open ${gate.openDependencies.join(", ")}`);
+    }
+  }
   let item = findClaimableItem(report, selector);
   if (item.contentType !== "Issue") throw new Error(`${item.ref} is not an issue`);
   const fresh = (await fetchIssueProjectItem(client, cfg, { repo: item.repository, number: item.number })).item;
@@ -7195,33 +7909,142 @@ async function withTimeout(promise, ms) {
   }
 }
 async function runBoardSlice(io, deps, opts) {
+  const budget = deps.timeoutMs ?? SESSION_START_BOARD_TIMEOUT_MS;
+  const controller = new AbortController();
+  const deadline = setTimeout(() => controller.abort(), budget);
   try {
     const cfg = await deps.loadConfig();
     if (!boardMetaConfigured(cfg)) return;
+    const client = deps.client ?? createGitHubClient({ defaultTimeoutMs: budget, signal: controller.signal });
     const report = await withTimeout(
-      deps.readBoard({ config: cfg, allowPartial: true }),
-      deps.timeoutMs ?? SESSION_START_BOARD_TIMEOUT_MS
+      deps.readBoard({ config: cfg, allowPartial: true }, { client }),
+      budget
     );
     if (opts?.expectedLogin && report.viewer && opts.expectedLogin !== report.viewer) return;
     const block = renderBoardSlice(report);
     if (block) io.log(block);
   } catch {
+  } finally {
+    clearTimeout(deadline);
   }
 }
 
-// src/frontmatter.ts
-function splitFrontmatter(content) {
-  const match = /^---\n([\s\S]*?)\n---(?:\n|$)/.exec(content);
-  if (!match) return { entries: [], body: content };
-  return { entries: match[1].split(/\r?\n/).filter((line) => line.trim()), body: content.slice(match[0].length) };
-}
-function entryKeyValue(line) {
-  const i = line.indexOf(":");
-  if (i < 0) return null;
-  return { key: line.slice(0, i).trim().toLowerCase(), value: line.slice(i + 1).trim() };
-}
-function frontmatterValue(content, key) {
-  const want = key.trim().toLowerCase();
+// src/worktree.ts
+var import_node_fs14 = require("node:fs");
+var import_node_path12 = require("node:path");
+var LOCAL_ONLY_FILES = [".claude/settings.local.json"];
+var PKG = "package.json";
+var LOCKFILE = "package-lock.json";
+var NODE_MODULES = "node_modules";
+var realFsProbe = {
+  isDir: (p) => {
+    try {
+      return (0, import_node_fs14.statSync)(p).isDirectory();
+    } catch {
+      return false;
+    }
+  },
+  isFile: (p) => {
+    try {
+      return (0, import_node_fs14.statSync)(p).isFile();
+    } catch {
+      return false;
+    }
+  },
+  listDirs: (p) => {
+    try {
+      return (0, import_node_fs14.readdirSync)(p, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name);
+    } catch {
+      return [];
+    }
+  }
+};
+function scanInstallDirs(root, fs2 = realFsProbe) {
+  const factsFor = (dir) => {
+    const abs = dir ? (0, import_node_path12.join)(root, dir) : root;
+    return {
+      dir,
+      hasPackageJson: fs2.isFile((0, import_node_path12.join)(abs, PKG)),
+      hasLockfile: fs2.isFile((0, import_node_path12.join)(abs, LOCKFILE)),
+      hasNodeModules: fs2.isDir((0, import_node_path12.join)(abs, NODE_MODULES))
+    };
+  };
+  const children = fs2.listDirs(root).filter((name) => name !== NODE_MODULES && name !== ".git");
+  return [factsFor(""), ...children.map(factsFor).filter((f) => f.hasPackageJson)];
+}
+function npmInstallTargets(dirs) {
+  return dirs.filter((d) => d.hasPackageJson && !d.hasNodeModules).map((d) => ({ dir: d.dir, command: d.hasLockfile ? "npm ci" : "npm install" }));
+}
+function isLinkedWorktree(root, fs2 = realFsProbe) {
+  return fs2.isFile((0, import_node_path12.join)(root, ".git"));
+}
+function worktreeAutoProvisionBanner(root, fs2 = realFsProbe) {
+  if (!isLinkedWorktree(root, fs2)) return null;
+  const pending = npmInstallTargets(scanInstallDirs(root, fs2));
+  if (!pending.length) return null;
+  const where = pending.map((t) => t.dir || ".").join(", ");
+  return `[worktree] provisioning tooling in the background (deps in ${where} + local config) \u2014 \`mmi-cli worktree setup\` to redo`;
+}
+function defaultCopyFile(from, to) {
+  (0, import_node_fs14.mkdirSync)((0, import_node_path12.dirname)(to), { recursive: true });
+  (0, import_node_fs14.copyFileSync)(from, to);
+}
+async function provisionWorktree(worktreeRoot, deps) {
+  const fs2 = deps.fs ?? realFsProbe;
+  const copyFile = deps.copyFile ?? defaultCopyFile;
+  const log = deps.log ?? (() => {
+  });
+  const allDirs = scanInstallDirs(worktreeRoot, fs2);
+  const targets = npmInstallTargets(allDirs);
+  const skippedInstall = allDirs.filter((d) => d.hasPackageJson && d.hasNodeModules).map((d) => d.dir);
+  const installed = [];
+  for (const target of targets) {
+    const cwd = target.dir ? (0, import_node_path12.join)(worktreeRoot, target.dir) : worktreeRoot;
+    log(`installing deps: ${target.command} in ${target.dir || "."}`);
+    await deps.runInstall(target.command, cwd);
+    installed.push(target);
+  }
+  const copied = [];
+  const copySkipped = [];
+  const primary = await deps.primaryCheckout();
+  for (const rel of LOCAL_ONLY_FILES) {
+    const dest = (0, import_node_path12.join)(worktreeRoot, rel);
+    if (fs2.isFile(dest)) {
+      copySkipped.push({ file: rel, reason: "already-present" });
+      continue;
+    }
+    if (!primary) {
+      copySkipped.push({ file: rel, reason: "no-primary" });
+      continue;
+    }
+    if (!fs2.isFile((0, import_node_path12.join)(primary, rel))) {
+      copySkipped.push({ file: rel, reason: "absent-in-primary" });
+      continue;
+    }
+    copyFile((0, import_node_path12.join)(primary, rel), dest);
+    copied.push(rel);
+    log(`copied local config: ${rel}`);
+  }
+  return { worktree: worktreeRoot, installed, skippedInstall, copied, copySkipped };
+}
+function defaultWorktreePath(repoRoot, branch) {
+  const safe = branch.replace(/[/\\]+/g, "-");
+  return (0, import_node_path12.join)((0, import_node_path12.dirname)(repoRoot), "mmi-worktrees", safe);
+}
+
+// src/frontmatter.ts
+function splitFrontmatter(content) {
+  const match = /^---\n([\s\S]*?)\n---(?:\n|$)/.exec(content);
+  if (!match) return { entries: [], body: content };
+  return { entries: match[1].split(/\r?\n/).filter((line) => line.trim()), body: content.slice(match[0].length) };
+}
+function entryKeyValue(line) {
+  const i = line.indexOf(":");
+  if (i < 0) return null;
+  return { key: line.slice(0, i).trim().toLowerCase(), value: line.slice(i + 1).trim() };
+}
+function frontmatterValue(content, key) {
+  const want = key.trim().toLowerCase();
   for (const line of splitFrontmatter(content).entries) {
     const kv = entryKeyValue(line);
     if (kv && kv.key === want) return kv.value || void 0;
@@ -7404,7 +8227,7 @@ async function runNorthstarContext(io, deps) {
 }
 
 // src/index.ts
-var import_node_path14 = require("node:path");
+var import_node_path17 = require("node:path");
 
 // src/merge-ci-policy.ts
 function resolveMergeCiPolicy(input) {
@@ -7441,6 +8264,13 @@ function parseGhPrChecksOutput(stdout) {
   }
   return anyPending ? "pending" : "success";
 }
+function parseGhPrChecksResult(stdout, stderr) {
+  if (stdout.trim()) return parseGhPrChecksOutput(stdout);
+  const err = (stderr ?? "").trim();
+  if (/no checks reported/i.test(err)) return "no-checks-reported";
+  if (!err) return "no-checks-reported";
+  return "error";
+}
 var PR_CHECKS_POLL_MS = 3e4;
 var PR_CHECKS_TIMEOUT_MS = 10 * 6e4;
 async function waitForPrChecks(deps) {
@@ -7501,12 +8331,500 @@ async function activateProductRuleset(repo, rulesetBody, client) {
   return { action: "created" };
 }
 
+// src/bootstrap-seeds.ts
+var PLACEHOLDER_RE = /\{\{([A-Z0-9_]+)\}\}/g;
+function loadBootstrapSeeds(manifestJson) {
+  let parsed;
+  try {
+    parsed = JSON.parse(manifestJson);
+  } catch {
+    throw new Error("bootstrap seed manifest is not valid JSON");
+  }
+  const obj = parsed ?? {};
+  const seeds = obj.seeds ?? [];
+  for (const s of seeds) {
+    if (!s || !s.target || !s.source || !Array.isArray(s.classes)) {
+      throw new Error(`invalid seed entry (needs target, source, classes): ${JSON.stringify(s)}`);
+    }
+    if (s.ownership !== "org" && s.ownership !== "repo") {
+      throw new Error(`invalid seed ownership '${s.ownership}' for ${s.target} (must be 'org' or 'repo')`);
+    }
+  }
+  return {
+    seeds,
+    labels: obj.labels ?? [],
+    placeholders: obj.placeholders ?? []
+  };
+}
+function renderSeed(template, vars) {
+  return template.replace(PLACEHOLDER_RE, (match, key) => key in vars ? vars[key] : match);
+}
+function missingPlaceholders(rendered) {
+  const out = /* @__PURE__ */ new Set();
+  for (const m of rendered.matchAll(PLACEHOLDER_RE)) out.add(m[1]);
+  return [...out];
+}
+var GITIGNORE_MANAGED_BEGIN = "# >>> mmi-managed >>>";
+var GITIGNORE_MANAGED_END = "# <<< mmi-managed <<<";
+var MANAGED_GITIGNORE_LINES = [
+  '# Org-wide cleanliness (AGENTS.md "Repo cleanliness") \u2014 enforced by `mmi-cli doctor`.',
+  "# Do not edit inside these markers; this block is regenerated on the next doctor run.",
+  "/tmp/",
+  // Plan scratch at ANY depth (root plans/, cli/plans/, .cursor/plans/) — AI planning docs are S3-synced
+  // via `mmi-cli plan push`, never git-tracked (AGENTS.md "Repo cleanliness", #1550).
+  "**/plans/",
+  ".playwright-mcp/",
+  ".claude/worktrees/",
+  // .mmi is agent/CI scratch — ignore the WHOLE tree at any depth (root + cli/.mmi, .github/workflows/.mmi,
+  // and any future feature's subdir) so new scratch NEVER needs a new ignore line. `**/.mmi/*` ignores the
+  // dir's contents (not the dir itself), so the one tracked file is re-included on the next line (#1550).
+  // This replaces the brittle per-path enumeration (saga/honcho/head-ts/scrooge/… — #1472 was one such miss).
+  "**/.mmi/*",
+  // The single tracked .mmi file. A NEW tracked .mmi file would add its own `!` line here; everything else
+  // under .mmi stays ignored automatically.
+  "!**/.mmi/config.json",
+  ".aws-sam/",
+  "/*.png",
+  // Runtime secrets/config are vault-only (AGENTS.md "Privileged ops") — never commit a local .env. The
+  // .env.example reference file stays tracked.
+  ".env",
+  ".env.*",
+  "!.env.example"
+];
+function renderManagedGitignoreBlock() {
+  return [GITIGNORE_MANAGED_BEGIN, ...MANAGED_GITIGNORE_LINES, GITIGNORE_MANAGED_END].join("\n");
+}
+function upsertManagedGitignoreBlock(current) {
+  const block = renderManagedGitignoreBlock();
+  const src = (current ?? "").replace(/\r\n/g, "\n");
+  if (src.trim() === "") {
+    const next2 = `${block}
+`;
+    return { content: next2, changed: src !== next2 };
+  }
+  const managed = /* @__PURE__ */ new Set([GITIGNORE_MANAGED_BEGIN, GITIGNORE_MANAGED_END, ...MANAGED_GITIGNORE_LINES]);
+  const lines = src.split("\n");
+  const beginAt = lines.findIndex((l) => l === GITIGNORE_MANAGED_BEGIN);
+  const endAt = beginAt === -1 ? -1 : lines.findIndex((l, i) => i > beginAt && l === GITIGNORE_MANAGED_END);
+  let next;
+  if (beginAt !== -1 && endAt !== -1) {
+    const before = lines.slice(0, beginAt).filter((l) => !managed.has(l.trim()));
+    const after = lines.slice(endAt + 1).filter((l) => !managed.has(l.trim()));
+    next = `${[...before, ...block.split("\n"), ...after].join("\n").replace(/\n+$/, "")}
+`;
+  } else {
+    const kept = lines.filter((l) => !managed.has(l.trim())).join("\n").replace(/\n+$/, "");
+    next = kept === "" ? `${block}
+` : `${kept}
+
+${block}
+`;
+  }
+  return { content: next, changed: src !== next };
+}
+function diffManagedGitignoreBlock(current) {
+  const lines = (current ?? "").replace(/\r\n/g, "\n").split("\n");
+  const beginAt = lines.findIndex((l) => l === GITIGNORE_MANAGED_BEGIN);
+  const endAt = beginAt === -1 ? -1 : lines.findIndex((l, i) => i > beginAt && l === GITIGNORE_MANAGED_END);
+  const hasMarker = beginAt !== -1 || lines.some((l) => l === GITIGNORE_MANAGED_END);
+  if (!hasMarker) return { added: [], removed: [], seeded: true };
+  const wellOrdered = beginAt !== -1 && endAt !== -1;
+  if (!wellOrdered) return { added: [], removed: [], seeded: false };
+  const isRule = (l) => l.trim() !== "" && !l.trim().startsWith("#");
+  const oldBody = lines.slice(beginAt + 1, endAt).filter(isRule);
+  const newBody = MANAGED_GITIGNORE_LINES.filter(isRule);
+  return {
+    added: newBody.filter((l) => !oldBody.includes(l)),
+    removed: oldBody.filter((l) => !newBody.includes(l)),
+    seeded: false
+  };
+}
+
+// src/project-model.ts
+var PROJECT_TYPES = ["web-app", "hub-service", "content", "desktop-game", "non-deployable", "cli-tool", "worker"];
+var DEPLOY_MODELS = ["hub-serverless", "serverless", "tenant-container", "solo-container", "registry-publish", "content", "none"];
+var RELEASE_TRACKS = ["full", "direct", "trunk"];
+var PROJECT_TYPE_SET = new Set(PROJECT_TYPES);
+var DEPLOY_MODEL_SET = new Set(DEPLOY_MODELS);
+var RELEASE_TRACK_SET = new Set(RELEASE_TRACKS);
+function isProjectType(value) {
+  return Boolean(value && PROJECT_TYPE_SET.has(value));
+}
+function isDeployModel(value) {
+  return Boolean(value && DEPLOY_MODEL_SET.has(value));
+}
+function isReleaseTrack(value) {
+  return Boolean(value && RELEASE_TRACK_SET.has(value));
+}
+function repoIsHub(repo) {
+  return repo.toLowerCase().endsWith("/mmi-hub") || repo.toLowerCase() === "mmi-hub";
+}
+function resolveProjectTypeConfident(meta, repo) {
+  const rawType = typeof meta?.projectType === "string" ? meta.projectType : void 0;
+  if (isProjectType(rawType)) return rawType;
+  if (meta?.class === "content" || meta?.deployModel === "content") return "content";
+  if (meta?.deployModel === "hub-serverless" || repoIsHub(repo)) return "hub-service";
+  if (meta?.deployModel === "registry-publish") return "cli-tool";
+  if (meta?.deployModel === "solo-container") return "worker";
+  if (meta?.deployModel === "none") return "non-deployable";
+  return void 0;
+}
+function resolveProjectType(meta, repo) {
+  return resolveProjectTypeConfident(meta, repo) ?? "web-app";
+}
+function resolveDeployModel(meta, repo) {
+  const rawModel = typeof meta?.deployModel === "string" ? meta.deployModel : void 0;
+  if (isDeployModel(rawModel)) return rawModel;
+  const projectType = resolveProjectType(meta, repo);
+  if (projectType === "content" || meta?.class === "content") return "content";
+  if (projectType === "hub-service" || repoIsHub(repo)) return "hub-serverless";
+  if (projectType === "desktop-game" || projectType === "non-deployable") return "none";
+  if (projectType === "cli-tool") return "registry-publish";
+  return "tenant-container";
+}
+function projectTypeClearsWebProfile(projectType, deployModel) {
+  return projectType === "content" || projectType === "desktop-game" || projectType === "non-deployable" || projectType === "cli-tool" || deployModel === "content" || deployModel === "none" || deployModel === "registry-publish";
+}
+function inferReleaseTrackFromBranches(hints) {
+  if (hints.hasRcBranch) return void 0;
+  if (hints.hasDevelopmentBranch && hints.hasMainBranch) return "direct";
+  return void 0;
+}
+function resolveBootstrapReleaseTrack(cls, explicit) {
+  if (isReleaseTrack(explicit)) return explicit;
+  if (cls === "content") return "trunk";
+  return "full";
+}
+function resolveReleaseTrack(meta, hints) {
+  const raw = typeof meta?.releaseTrack === "string" ? meta.releaseTrack : void 0;
+  if (isReleaseTrack(raw)) return raw;
+  if (meta?.class === "content" || meta?.deployModel === "content") return "trunk";
+  const inferred = hints ? inferReleaseTrackFromBranches(hints) : void 0;
+  if (inferred) return inferred;
+  return "full";
+}
+function branchesForTrack(track) {
+  if (track === "trunk") return ["main"];
+  if (track === "direct") return ["development", "main"];
+  return ["development", "rc", "main"];
+}
+
+// src/bootstrap-apply.ts
+function parseOwnerRepo(repo) {
+  const trimmed = repo.trim();
+  const parts = trimmed.split("/");
+  if (parts.length !== 2 || !parts[0]?.trim() || !parts[1]?.trim()) {
+    throw new Error("repo must be owner/repo");
+  }
+  const owner = parts[0].trim();
+  const name = parts[1].trim();
+  if (owner.includes("\\") || name.includes("\\")) throw new Error("repo must be owner/repo");
+  return { owner, name, slug: name.toLowerCase(), fullName: `${owner}/${name}` };
+}
+var DEFAULT_INSTALL_CMD = "npm ci";
+var DEFAULT_GATE_CMD = "npm run check";
+var DEFAULT_GATE_PY_VERSION = "3.11";
+var GATE_RUNTIME_DEFAULTS = {
+  node: { cmd: DEFAULT_GATE_CMD, install: DEFAULT_INSTALL_CMD },
+  python: { cmd: "pytest", install: 'pip install -e ".[dev]"' }
+};
+function gateSeedVars(cls, releaseTrack, runtime = "node") {
+  const rt = GATE_RUNTIME_DEFAULTS[runtime] ?? GATE_RUNTIME_DEFAULTS.node;
+  const runtimeVars = {
+    GATE_RUNTIME: runtime,
+    GATE_CMD: rt.cmd,
+    GATE_INSTALL_CMD: rt.install,
+    GATE_WORKDIR: ".",
+    GATE_CACHE_DEP_PATH: "package-lock.json",
+    GATE_PY_VERSION: DEFAULT_GATE_PY_VERSION
+  };
+  const track = releaseTrack ?? (cls === "content" ? "trunk" : "full");
+  if (track === "trunk") {
+    return {
+      ...runtimeVars,
+      GATE_PUSH_BRANCHES_YAML: "[main]",
+      GATE_FULL_RUN_BRANCH: "main",
+      GATE_RULESET_BRANCH_REFS_JSON: '["refs/heads/main"]'
+    };
+  }
+  if (track === "direct") {
+    return {
+      ...runtimeVars,
+      GATE_PUSH_BRANCHES_YAML: "[development, main]",
+      GATE_FULL_RUN_BRANCH: "development",
+      GATE_RULESET_BRANCH_REFS_JSON: '["refs/heads/development", "refs/heads/main"]'
+    };
+  }
+  return {
+    ...runtimeVars,
+    GATE_PUSH_BRANCHES_YAML: "[development, rc, main]",
+    GATE_FULL_RUN_BRANCH: "development",
+    GATE_RULESET_BRANCH_REFS_JSON: '["refs/heads/development", "refs/heads/rc", "refs/heads/main"]'
+  };
+}
+function withDerivedRepoVars(vars, parsed, cls, releaseTrack) {
+  const out = { ...vars };
+  out.REPO_NAME ??= parsed.name;
+  out.REPO_SLUG ??= parsed.slug;
+  out.CLASS ??= cls;
+  out.INSTALL_CMD ??= DEFAULT_INSTALL_CMD;
+  const track = releaseTrack ?? resolveBootstrapReleaseTrack(cls);
+  const runtime = out.GATE_RUNTIME === "python" ? "python" : "node";
+  for (const [key, value] of Object.entries(gateSeedVars(cls, track, runtime))) {
+    out[key] ??= value;
+  }
+  return out;
+}
+function gateConfigToVars(gate) {
+  const out = {};
+  if (!gate || typeof gate !== "object") return out;
+  if (gate.runtime === "node" || gate.runtime === "python") out.GATE_RUNTIME = gate.runtime;
+  if (typeof gate.cmd === "string" && gate.cmd.trim()) out.GATE_CMD = gate.cmd;
+  if (typeof gate.workdir === "string" && gate.workdir.trim()) out.GATE_WORKDIR = gate.workdir;
+  if (typeof gate.cacheDepPath === "string" && gate.cacheDepPath.trim()) out.GATE_CACHE_DEP_PATH = gate.cacheDepPath;
+  if (typeof gate.pyVersion === "string" && gate.pyVersion.trim()) out.GATE_PY_VERSION = gate.pyVersion;
+  return out;
+}
+function planSeedAction(seed, exists) {
+  if (seed.source === "fanout") {
+    return { target: seed.target, action: "skip", ownership: "fanout", reason: "delivered by the fanout pipeline" };
+  }
+  if (seed.source === "managed-block") {
+    return exists ? { target: seed.target, action: "update", ownership: "org", reason: "org-managed block merged in-place (repo-owned lines preserved)" } : { target: seed.target, action: "create", ownership: "org", reason: "org-managed block; .gitignore absent, created" };
+  }
+  if (seed.ownership === "repo") {
+    return exists ? { target: seed.target, action: "skip", ownership: "repo", reason: "repo-owned, already present (never clobbered)" } : { target: seed.target, action: "create", ownership: "repo", reason: "repo-owned, missing" };
+  }
+  return exists ? { target: seed.target, action: "update", ownership: "org", reason: "org-owned, refresh to current" } : { target: seed.target, action: "create", ownership: "org", reason: "org-owned, missing" };
+}
+function reconcileSeedAction(action, content, isManagedBlock) {
+  if (action.action === "skip") return action;
+  if (content == null) {
+    return { ...action, action: "skip", reason: "no resolvable content" };
+  }
+  if (isManagedBlock) return action;
+  const unfilled = missingPlaceholders(content);
+  if (unfilled.length) {
+    return { ...action, action: "skip", reason: `unfilled: ${unfilled.join(", ")} \u2014 pass --var` };
+  }
+  return action;
+}
+function renderSeedPlan(actions) {
+  const lines = ["bootstrap apply \u2014 seed plan (dry-run; no mutations):"];
+  for (const a of actions) {
+    lines.push(`  ${a.action.toUpperCase().padEnd(6)} ${a.target}  (${a.ownership}: ${a.reason})`);
+  }
+  const order = ["create", "update", "skip"];
+  lines.push(`  \u2014 ${order.map((k) => `${actions.filter((a) => a.action === k).length} ${k}`).join(", ")}`);
+  return lines.join("\n");
+}
+var GITHUB_DEFAULT_LABELS = [
+  "documentation",
+  "duplicate",
+  "enhancement",
+  "good first issue",
+  "help wanted",
+  "invalid",
+  "question",
+  "wontfix"
+];
+function labelsToPrune(orgLabelNames) {
+  const org = new Set(orgLabelNames);
+  return GITHUB_DEFAULT_LABELS.filter((name) => !org.has(name));
+}
+function resolveSeedContent(seed, vars, readFile6) {
+  if (seed.source === "self") return readFile6(seed.target);
+  if (seed.source.startsWith("seed:")) {
+    const tmpl = readFile6(`skills/bootstrap/seeds/${seed.source.slice("seed:".length)}`);
+    return tmpl == null ? null : renderSeed(tmpl, vars);
+  }
+  return null;
+}
+function buildRegisterPayload(repo, cls, vars, options = {}) {
+  const parsedRepo = parseOwnerRepo(repo);
+  const slug = parsedRepo.slug;
+  if (options.projectType && !isProjectType(options.projectType)) {
+    throw new Error(`projectType must be one of: ${PROJECT_TYPES.join(", ")}`);
+  }
+  if (options.deployModel && !isDeployModel(options.deployModel)) {
+    throw new Error(`deployModel must be one of: ${DEPLOY_MODELS.join(", ")}`);
+  }
+  if (options.releaseTrack && !isReleaseTrack(options.releaseTrack)) {
+    throw new Error("releaseTrack must be full, direct, or trunk");
+  }
+  const shape = {
+    class: cls,
+    projectType: options.projectType,
+    deployModel: options.deployModel
+  };
+  const projectType = resolveProjectTypeConfident(shape, parsedRepo.fullName);
+  if (!projectType) {
+    throw new Error(
+      `Project type for ${parsedRepo.fullName} is unset and not derivable \u2014 pass --project-type <${PROJECT_TYPES.join("|")}> and --deploy-model <${DEPLOY_MODELS.join("|")}> (prevents defaulting a non-web repo to tenant-container).`
+    );
+  }
+  const deployModel = resolveDeployModel({ ...shape, projectType }, parsedRepo.fullName);
+  const num = (v) => {
+    if (v == null || v === "") return void 0;
+    const n = Number(v);
+    return Number.isFinite(n) ? n : void 0;
+  };
+  const statusOptions = vars.STATUS_TODO || vars.STATUS_IN_PROGRESS || vars.STATUS_IN_REVIEW || vars.STATUS_DONE ? {
+    Todo: vars.STATUS_TODO,
+    "In Progress": vars.STATUS_IN_PROGRESS,
+    "In Review": vars.STATUS_IN_REVIEW,
+    Done: vars.STATUS_DONE
+  } : void 0;
+  const priorityOptions = vars.PRIORITY_URGENT || vars.PRIORITY_HIGH || vars.PRIORITY_MEDIUM || vars.PRIORITY_LOW ? {
+    Urgent: vars.PRIORITY_URGENT,
+    High: vars.PRIORITY_HIGH,
+    Medium: vars.PRIORITY_MEDIUM,
+    Low: vars.PRIORITY_LOW
+  } : void 0;
+  const payload = {
+    slug,
+    // Identity. name/division default off the repo name when the skill didn't pass them.
+    name: vars.NAME || parsedRepo.name,
+    division: vars.DIVISION || parsedRepo.name.split("-")[0] || void 0,
+    repos: [`${parsedRepo.owner}/${slug}`],
+    wikiRepo: vars.WIKI_REPO || parsedRepo.fullName,
+    branch: vars.BRANCH || (cls === "content" ? "main" : "development"),
+    class: cls,
+    projectType,
+    deployModel,
+    // #1359: always persist an explicit track so release tooling never guesses from absence alone.
+    releaseTrack: resolveBootstrapReleaseTrack(cls, options.releaseTrack),
+    // Board coords (from GraphQL at bootstrap, passed as --var by the skill).
+    projectOwner: vars.PROJECT_OWNER || void 0,
+    projectNumber: num(vars.PROJECT_NUMBER),
+    projectId: vars.PROJECT_ID || void 0,
+    statusFieldId: vars.STATUS_FIELD_ID || void 0,
+    statusOptions,
+    priorityFieldId: vars.PRIORITY_FIELD_ID || void 0,
+    priorityOptions,
+    // Pointers. vaultPath is explicit + canonical; kbPointer is the per-project KB doc path.
+    vaultPath: `/mmi-future/${slug}`,
+    kbPointer: `kb/projects/${slug}.md`
+  };
+  for (const k of Object.keys(payload)) if (payload[k] === void 0) delete payload[k];
+  if (payload.projectId && payload.projectNumber == null) {
+    throw new Error(
+      "bootstrap apply: PROJECT_ID is set but PROJECT_NUMBER is missing \u2014 pass --var PROJECT_NUMBER=<N> or ensure the live board GraphQL query succeeds"
+    );
+  }
+  return payload;
+}
+var BOARD_FIELD_VAR_MAP = {
+  Status: {
+    fieldIdVar: "STATUS_FIELD_ID",
+    options: { Todo: "STATUS_TODO", "In Progress": "STATUS_IN_PROGRESS", "In Review": "STATUS_IN_REVIEW", Done: "STATUS_DONE" }
+  },
+  Priority: {
+    fieldIdVar: "PRIORITY_FIELD_ID",
+    options: { Urgent: "PRIORITY_URGENT", High: "PRIORITY_HIGH", Medium: "PRIORITY_MEDIUM", Low: "PRIORITY_LOW" }
+  }
+};
+function projectV2BoardNode(fieldsJson) {
+  if (Array.isArray(fieldsJson)) return { fields: { nodes: fieldsJson } };
+  const wrapped = fieldsJson;
+  return wrapped?.data?.node ?? wrapped?.node;
+}
+function extractBoardFieldVars(fieldsJson) {
+  const out = {};
+  const projectNode = projectV2BoardNode(fieldsJson);
+  if (typeof projectNode?.number === "number" && Number.isFinite(projectNode.number)) {
+    out.PROJECT_NUMBER = String(projectNode.number);
+  }
+  const nodes = projectNode?.fields?.nodes;
+  if (!Array.isArray(nodes)) return out;
+  for (const node of nodes) {
+    const field = node;
+    const name = typeof field.name === "string" ? field.name : void 0;
+    const map = name ? BOARD_FIELD_VAR_MAP[name] : void 0;
+    if (!map || typeof field.id !== "string" || !field.id) continue;
+    out[map.fieldIdVar] = field.id;
+    const options = Array.isArray(field.options) ? field.options : [];
+    for (const opt of options) {
+      const o = opt;
+      const varName = typeof o.name === "string" ? map.options[o.name] : void 0;
+      if (varName && typeof o.id === "string" && o.id) out[varName] = o.id;
+    }
+  }
+  return out;
+}
+function boardFieldsQueryArgs(projectId) {
+  const query = "query($id: ID!) { node(id: $id) { ... on ProjectV2 { number fields(first: 50) { nodes { ... on ProjectV2SingleSelectField { id name options { id name } } } } } } }";
+  return ["api", "graphql", "-f", `query=${query}`, "-f", `id=${projectId}`];
+}
+function serializeRegistry(obj) {
+  return `${JSON.stringify(obj, null, 2)}
+`;
+}
+function planFanoutRegistration(fanoutTargetsRaw, projectsRaw, entry) {
+  const fanout = JSON.parse(fanoutTargetsRaw);
+  const projects = JSON.parse(projectsRaw);
+  const fanoutRepos = Array.isArray(fanout.repos) ? fanout.repos : [];
+  const projectEntries = Array.isArray(projects.projects) ? projects.projects : [];
+  const name = entry.name ?? entry.repo;
+  const canonName = entry.repo.toLowerCase();
+  const inFanout = fanoutRepos.some((r) => typeof r.repo === "string" && r.repo.toLowerCase() === canonName);
+  const inProjects = projectEntries.some(
+    (p) => p.slug === entry.slug || Array.isArray(p.repos) && p.repos.some((full) => String(full).split("/").pop()?.toLowerCase() === canonName)
+  );
+  if (inFanout || inProjects) {
+    return { changed: false, fanoutTargets: fanoutTargetsRaw, projects: projectsRaw };
+  }
+  const projectEntry = {
+    name,
+    slug: entry.slug,
+    projectId: entry.projectId,
+    wikiRepo: entry.wikiRepo,
+    repos: [`mutmutco/${entry.repo}`]
+  };
+  if (entry.cls === "content") projectEntry.branch = "main";
+  for (const k of Object.keys(projectEntry)) if (projectEntry[k] === void 0) delete projectEntry[k];
+  const nextProjects = { ...projects, projects: [...projectEntries, projectEntry] };
+  const fanoutEntry = { repo: entry.repo, branch: entry.branch, class: entry.cls };
+  const nextFanout = { ...fanout, repos: [...fanoutRepos, fanoutEntry] };
+  return {
+    changed: true,
+    fanoutTargets: serializeRegistry(nextFanout),
+    projects: serializeRegistry(nextProjects)
+  };
+}
+function decideFanoutPrAction(openPrs) {
+  const list = Array.isArray(openPrs) ? openPrs : [];
+  for (const pr2 of list) {
+    const url = pr2?.url;
+    if (typeof url === "string" && url.trim()) return { action: "reuse", url: url.trim() };
+  }
+  return { action: "create" };
+}
+function contentPutArgs(repo, path2, content, branch, sha) {
+  const args = [
+    "api",
+    "-X",
+    "PUT",
+    `repos/${repo}/contents/${path2.split("/").map(encodeURIComponent).join("/")}`,
+    "-f",
+    `message=bootstrap: seed ${path2}`,
+    "-f",
+    `content=${Buffer.from(content, "utf8").toString("base64")}`,
+    "-f",
+    `branch=${branch}`
+  ];
+  if (sha) args.push("-f", `sha=${sha}`);
+  return args;
+}
+
 // src/ci-audit.ts
 var HUB_REPO = "mutmutco/MMI-Hub";
 var PRODUCT_GATE_CONTEXT2 = "gate";
 var HUB_GATE_CONTEXTS = ["cli", "infra", "docs"];
 var PRODUCT_GATE_PATH = ".github/workflows/gate.yml";
 var PRODUCT_RULESET_REF = ".github/rulesets/mmi-product-required-checks.json";
+var GATE_TEMPLATE_SEED = "seed:gate.template.yml";
+var RULESET_TEMPLATE_SEED = "seed:mmi-product-required-checks.template.json";
 function slugFromRepo(repo) {
   return (repo.includes("/") ? repo.split("/")[1] : repo).toLowerCase();
 }
@@ -7737,10 +9055,76 @@ async function fetchRulesetSeedBody(deps, repo) {
     return null;
   }
 }
+async function contentSha(deps, repo, branch, path2) {
+  try {
+    const encodedPath = path2.split("/").map(encodeURIComponent).join("/");
+    const file = await deps.client.rest("GET", `repos/${repo}/contents/${encodedPath}?ref=${encodeURIComponent(branch)}`);
+    return typeof file?.sha === "string" ? file.sha : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function renderSeedBody(deps, seedSource, target, vars) {
+  if (deps.renderSeed) return deps.renderSeed(seedSource, target, vars);
+  if (!deps.readSeedFile) return null;
+  return resolveSeedContent({ target, source: seedSource, ownership: "org", classes: ["deployable"] }, vars, deps.readSeedFile);
+}
+async function putSeedFile(deps, repo, path2, content, branch) {
+  const sha = await contentSha(deps, repo, branch, path2);
+  const encodedPath = path2.split("/").map(encodeURIComponent).join("/");
+  const body = {
+    message: `ci reconcile: re-seed ${path2} (#1550)`,
+    content: Buffer.from(content, "utf8").toString("base64"),
+    branch
+  };
+  if (sha) body.sha = sha;
+  await deps.client.rest("PUT", `repos/${repo}/contents/${encodedPath}`, { body });
+}
+async function seedGateYml(repo, deps, meta, result) {
+  const baseBranch = "development";
+  if (await contentExists(deps, repo, baseBranch, PRODUCT_GATE_PATH)) return;
+  if (!deps.readSeedFile && !deps.renderSeed) {
+    result.skipped.push(`gate.yml missing but no seed-template source wired \u2014 run bootstrap apply`);
+    return;
+  }
+  const gate = meta?.gate;
+  if (!gate || typeof gate === "object" && Object.keys(gate).length === 0) {
+    result.skipped.push(`gate.yml missing \u2014 no registry gate config; set \`mmi-cli project set ${repo} --var gate={...}\` first, then re-run reconcile`);
+    return;
+  }
+  const releaseTrack = isReleaseTrack(meta?.releaseTrack) ? meta?.releaseTrack : void 0;
+  const parsed = parseOwnerRepo(repo);
+  const derivedVars = withDerivedRepoVars({ ...gateConfigToVars(gate), REPO_SLUG: parsed.slug }, parsed, "deployable", releaseTrack);
+  const rendered = renderSeedBody(deps, GATE_TEMPLATE_SEED, PRODUCT_GATE_PATH, derivedVars);
+  if (rendered == null) {
+    result.errors.push(`gate.yml re-seed: could not render ${GATE_TEMPLATE_SEED} (template unreadable or unfilled)`);
+    return;
+  }
+  try {
+    await putSeedFile(deps, repo, PRODUCT_GATE_PATH, rendered, baseBranch);
+    result.applied.push(`seeded ${PRODUCT_GATE_PATH}`);
+  } catch (e) {
+    result.errors.push(`gate.yml re-seed failed: ${e.message}`);
+    return;
+  }
+  if (!await contentExists(deps, repo, baseBranch, PRODUCT_RULESET_REF)) {
+    const rulesetBody = renderSeedBody(deps, RULESET_TEMPLATE_SEED, PRODUCT_RULESET_REF, derivedVars);
+    if (rulesetBody != null) {
+      try {
+        await putSeedFile(deps, repo, PRODUCT_RULESET_REF, rulesetBody, baseBranch);
+        result.applied.push(`seeded ${PRODUCT_RULESET_REF}`);
+      } catch (e) {
+        result.errors.push(`ruleset reference re-seed failed: ${e.message}`);
+      }
+    }
+  }
+}
 async function applyCiReconcileRepo(repo, deps) {
   const merge = await applyCiReconcileMergeSettings(repo, deps);
+  const meta = await deps.getProjectMeta(slugFromRepo(repo));
   const report = await auditRepoCi(repo, deps);
   if (report.class !== "deployable") return merge;
+  await seedGateYml(repo, deps, meta, merge);
   const gateCheck = report.checks.find((c) => c.label === "product gate status check active");
   if (gateCheck?.ok) {
     merge.skipped.push("product ruleset already active");
@@ -7811,13 +9195,13 @@ async function runPrLand(prNumber, options, deps) {
 }
 
 // src/index.ts
-var import_node_os5 = require("node:os");
+var import_node_os6 = require("node:os");
 
 // src/gh-create.ts
-var import_promises4 = require("node:fs/promises");
-var import_node_os3 = require("node:os");
-var import_node_path10 = require("node:path");
-var import_node_crypto5 = require("node:crypto");
+var import_promises5 = require("node:fs/promises");
+var import_node_os4 = require("node:os");
+var import_node_path13 = require("node:path");
+var import_node_crypto6 = require("node:crypto");
 var ISSUE_TYPES = ["bug", "feature", "task"];
 var GH_MUTATION_TIMEOUT_MS = 12e4;
 function timeoutKillNote(err, timeoutMs) {
@@ -7855,9 +9239,9 @@ async function bodyArgsViaFile(args, deps = {}) {
   const i = args.indexOf("--body");
   if (i === -1 || i + 1 >= args.length) return { args, cleanup: async () => {
   } };
-  const write = deps.write ?? import_promises4.writeFile;
-  const remove = deps.remove ?? import_promises4.unlink;
-  const file = (0, import_node_path10.join)(deps.dir ?? (0, import_node_os3.tmpdir)(), `mmi-gh-body-${process.pid}-${(0, import_node_crypto5.randomBytes)(4).toString("hex")}.md`);
+  const write = deps.write ?? import_promises5.writeFile;
+  const remove = deps.remove ?? import_promises5.unlink;
+  const file = (0, import_node_path13.join)(deps.dir ?? (0, import_node_os4.tmpdir)(), `mmi-gh-body-${process.pid}-${(0, import_node_crypto6.randomBytes)(4).toString("hex")}.md`);
   await write(file, args[i + 1], "utf8");
   return {
     args: [...args.slice(0, i), "--body-file", file, ...args.slice(i + 2)],
@@ -7899,6 +9283,76 @@ function buildPrArgs({ title, body, base: base2, head, repo }) {
   return args;
 }
 
+// src/command-manifest.ts
+function buildArgument(arg) {
+  const out = { name: arg.name(), required: arg.required, variadic: arg.variadic };
+  if (arg.description) out.description = arg.description;
+  return out;
+}
+function buildOption(opt) {
+  const out = {
+    flags: opt.flags,
+    mandatory: Boolean(opt.mandatory),
+    valueRequired: Boolean(opt.required),
+    optional: Boolean(opt.optional),
+    takesValue: Boolean(opt.required || opt.optional),
+    variadic: Boolean(opt.variadic),
+    negate: Boolean(opt.negate)
+  };
+  if (opt.description) out.description = opt.description;
+  if (opt.defaultValue !== void 0) out.default = opt.defaultValue;
+  return out;
+}
+function buildCommand(cmd, path2) {
+  const out = {
+    name: cmd.name(),
+    path: path2,
+    arguments: cmd.registeredArguments.map(buildArgument),
+    options: cmd.options.map(buildOption),
+    subcommands: cmd.commands.map(
+      (child) => buildCommand(child, path2 ? `${path2} ${child.name()}` : child.name())
+    )
+  };
+  const description = cmd.description();
+  if (description) out.description = description;
+  return out;
+}
+function collectLeaves(node, acc) {
+  if (node.subcommands.length === 0) {
+    if (node.path) acc.push(node);
+    return;
+  }
+  for (const child of node.subcommands) collectLeaves(child, acc);
+}
+function buildCommandManifest(program3) {
+  const tree = buildCommand(program3, "");
+  const index = [];
+  collectLeaves(tree, index);
+  const manifest = { name: tree.name, tree, index };
+  const version = program3.version();
+  if (version) manifest.version = version;
+  return manifest;
+}
+function argSignature(arg) {
+  const inner = arg.variadic ? `${arg.name}...` : arg.name;
+  return arg.required ? `<${inner}>` : `[${inner}]`;
+}
+function formatManifestHuman(manifest) {
+  const lines = [];
+  const render = (node, depth) => {
+    const indent = "  ".repeat(depth);
+    const args = node.arguments.map(argSignature).join(" ");
+    const head = depth === 0 ? `${node.name}${manifest.version ? ` v${manifest.version}` : ""}` : node.name + (args ? ` ${args}` : "");
+    lines.push(node.description ? `${indent}${head} \u2014 ${node.description}` : `${indent}${head}`);
+    for (const opt of node.options) {
+      lines.push(`${indent}    ${opt.flags}${opt.description ? `  ${opt.description}` : ""}`);
+    }
+    for (const child of node.subcommands) render(child, depth + 1);
+  };
+  render(manifest.tree, 0);
+  return lines.join("\n");
+}
+
 // src/config-discovery.ts
 function stripMutableBoardConfig(cfg) {
   const {
@@ -8182,7 +9636,7 @@ ${buildReportBody(body, sourceRepo)}`;
 
 // src/skill-lesson.ts
 var SKILL_LESSON_LABEL = "skill-lesson";
-var SKILL_NAMES = ["bootstrap", "browser-automation", "build", "grind", "hotfix", "mmi", "rcand", "release", "secrets", "stage"];
+var SKILL_NAMES = ["bootstrap", "browser-automation", "build", "grind", "handoff", "hotfix", "mmi", "rcand", "release", "secrets", "stage"];
 function assertSkillName(name) {
   const match = SKILL_NAMES.find((skill) => skill === name);
   if (!match) throw new Error(`unknown skill "${name}" \u2014 expected one of: ${SKILL_NAMES.join(", ")}`);
@@ -8563,6 +10017,36 @@ async function removeWorktreeWithRecovery(wtPath, deps) {
   }
   return { status: "failed", attempts, error: errorMessage(lastError) };
 }
+var NO_NESTED_LINKS = /* @__PURE__ */ new Set(["node_modules", ".git"]);
+function baseName(p) {
+  return p.replace(/[/\\]+$/, "").split(/[/\\]/).pop() ?? "";
+}
+function assertSafeWorktreeTarget(worktreePath, primaryCheckout) {
+  const wt = normPath(worktreePath);
+  if (!wt) throw new Error("worktree teardown refused: empty target path");
+  if (!primaryCheckout) return;
+  const primary = normPath(primaryCheckout);
+  if (wt === primary) throw new Error(`worktree teardown refused: target is the primary checkout (${worktreePath})`);
+  if (primary.startsWith(`${wt}/`)) {
+    throw new Error(`worktree teardown refused: target ${worktreePath} contains the primary checkout`);
+  }
+}
+function detachReparsePoints(path2, rmv) {
+  const kind = rmv.probe(path2);
+  if (kind === "link") {
+    rmv.detachLink(path2);
+    return;
+  }
+  if (kind !== "dir") return;
+  if (NO_NESTED_LINKS.has(baseName(path2))) return;
+  const dir = path2.replace(/[/\\]+$/, "");
+  for (const name of rmv.readdir(path2)) detachReparsePoints(`${dir}/${name}`, rmv);
+}
+async function removeWorktreeTree(worktreePath, primaryCheckout, rmv) {
+  assertSafeWorktreeTarget(worktreePath, primaryCheckout);
+  detachReparsePoints(worktreePath, rmv);
+  await rmv.removeTree(worktreePath);
+}
 function buildRemoteBranchCleanupReport(branch, input) {
   if (!input.attempted) return { name: branch, status: "not-attempted", reason: input.reason };
   if (input.existsAfter === true) return { name: branch, status: "failed", reason: "still-present-after-delete" };
@@ -8682,12 +10166,12 @@ function buildGcPlan(inputs) {
       skipped.push({ branch, reason: "current-branch" });
       continue;
     }
-    const worktree = worktrees.get(branch);
-    if (worktree?.dirty) {
-      skipped.push({ branch, reason: "dirty-worktree", detail: worktree.path });
+    const worktree2 = worktrees.get(branch);
+    if (worktree2?.dirty) {
+      skipped.push({ branch, reason: "dirty-worktree", detail: worktree2.path });
       continue;
     }
-    branches.push({ branch, prState: state.state, prNumbers: state.numbers, worktreePath: worktree?.path });
+    branches.push({ branch, prState: state.state, prNumbers: state.numbers, worktreePath: worktree2?.path });
   }
   const trackingRefs = [...new Set(inputs.staleTrackingRefs ?? [])].map((ref) => {
     const branch = branchForTrackingRef(ref, remote);
@@ -9050,8 +10534,8 @@ function stagePlan(stage2 = {}, stops = true) {
 }
 function derivedStagePlan(derived, shell2, stops = true) {
   const { port } = derived;
-  const envOrder = ["MMI_STAGE", "MMI_PORT", "PORT", "COMPOSE_PROFILES"];
-  const resolved = { MMI_STAGE: "development", MMI_PORT: String(port), PORT: String(port), COMPOSE_PROFILES: "local" };
+  const envOrder = ["MMI_STAGE", "MMI_PORT", "COMPOSE_PROFILES"];
+  const resolved = { MMI_STAGE: "development", MMI_PORT: String(port), COMPOSE_PROFILES: "local" };
   const ensureEnv = shell2 === "powershell" ? `if (-not (Test-Path -LiteralPath '.env')) { Copy-Item -LiteralPath '.env.example' -Destination '.env' }` : `[ -f .env ] || cp .env.example .env`;
   const up = shell2 === "powershell" ? `${envOrder.map((k) => `$env:${k}='${resolved[k]}'`).join("; ")}; docker compose up -d --build` : `${envOrder.map((k) => `${k}=${resolved[k]}`).join(" ")} docker compose up -d --build`;
   const health = shell2 === "powershell" ? `curl.exe --fail ${derived.url}` : `curl --fail ${derived.url}`;
@@ -9162,8 +10646,8 @@ function bootstrapPlan(repo, repoClass) {
 }
 
 // src/stage-default.ts
-function shellFor(platform = process.platform) {
-  return platform === "win32" ? "powershell" : "bash";
+function shellFor(platform2 = process.platform) {
+  return platform2 === "win32" ? "powershell" : "bash";
 }
 function isCentralContainerModel(model) {
   return model === "tenant-container" || model === "solo-container";
@@ -9189,10 +10673,11 @@ function deriveStage(inputs) {
     healthAnyStatus: true,
     portRange: inputs.portRange,
     ensureEnv: { example: ".env.example", target: ".env" },
+    // MMI_PORT is the host-published port (the free STAGE_PORT); PORT is intentionally absent so compose
+    // reads the container's bind port from .env rather than this overriding it to the publish port (#1505).
     env: {
       MMI_STAGE: "development",
       MMI_PORT: "$STAGE_PORT",
-      PORT: "$STAGE_PORT",
       COMPOSE_PROFILES: "local"
     }
   };
@@ -9226,9 +10711,9 @@ function stalePosixFields(config, shell2) {
 }
 function sanitizeLocalStage(local, stale) {
   if (!stale.length) return local;
-  const clean3 = { ...local };
-  for (const field of stale) delete clean3[field];
-  return clean3;
+  const clean4 = { ...local };
+  for (const field of stale) delete clean4[field];
+  return clean4;
 }
 function staleNote(staleFields, outcome) {
   const list = staleFields.join(", ");
@@ -9274,9 +10759,9 @@ function decideStage(inputs) {
 
 // src/cursor-plugin-seed.ts
 var import_node_child_process7 = require("node:child_process");
-var import_node_fs12 = require("node:fs");
-var import_node_os4 = require("node:os");
-var import_node_path11 = require("node:path");
+var import_node_fs15 = require("node:fs");
+var import_node_os5 = require("node:os");
+var import_node_path14 = require("node:path");
 var import_node_util6 = require("node:util");
 function isSemverVersion(v) {
   return typeof v === "string" && /^v?\d+\.\d+\.\d+/.test(v.trim());
@@ -9293,17 +10778,17 @@ function ghReleaseTarballApiArgs(tag) {
 }
 function cursorUserGlobalStatePath() {
   if (process.platform === "win32") {
-    const base2 = process.env.APPDATA || (0, import_node_path11.join)((0, import_node_os4.homedir)(), "AppData", "Roaming");
-    return (0, import_node_path11.join)(base2, "Cursor", "User", "globalStorage", "state.vscdb");
+    const base2 = process.env.APPDATA || (0, import_node_path14.join)((0, import_node_os5.homedir)(), "AppData", "Roaming");
+    return (0, import_node_path14.join)(base2, "Cursor", "User", "globalStorage", "state.vscdb");
   }
   if (process.platform === "darwin") {
-    return (0, import_node_path11.join)((0, import_node_os4.homedir)(), "Library", "Application Support", "Cursor", "User", "globalStorage", "state.vscdb");
+    return (0, import_node_path14.join)((0, import_node_os5.homedir)(), "Library", "Application Support", "Cursor", "User", "globalStorage", "state.vscdb");
   }
-  return (0, import_node_path11.join)((0, import_node_os4.homedir)(), ".config", "Cursor", "User", "globalStorage", "state.vscdb");
+  return (0, import_node_path14.join)((0, import_node_os5.homedir)(), ".config", "Cursor", "User", "globalStorage", "state.vscdb");
 }
 async function readCursorThirdPartyExtensibilityEnabled(execFileP5) {
   const dbPath = cursorUserGlobalStatePath();
-  if (!(0, import_node_fs12.existsSync)(dbPath)) return void 0;
+  if (!(0, import_node_fs15.existsSync)(dbPath)) return void 0;
   try {
     const { stdout } = await execFileP5("sqlite3", [dbPath, `SELECT value FROM ItemTable WHERE key = '${CURSOR_THIRD_PARTY_STATE_KEY}';`], {
       timeout: 5e3
@@ -9317,57 +10802,57 @@ async function readCursorThirdPartyExtensibilityEnabled(execFileP5) {
   }
 }
 function syncDirContents(src, dest) {
-  (0, import_node_fs12.mkdirSync)(dest, { recursive: true });
-  for (const name of (0, import_node_fs12.readdirSync)(dest)) {
-    (0, import_node_fs12.rmSync)((0, import_node_path11.join)(dest, name), { recursive: true, force: true });
+  (0, import_node_fs15.mkdirSync)(dest, { recursive: true });
+  for (const name of (0, import_node_fs15.readdirSync)(dest)) {
+    (0, import_node_fs15.rmSync)((0, import_node_path14.join)(dest, name), { recursive: true, force: true });
   }
-  (0, import_node_fs12.cpSync)(src, dest, { recursive: true });
+  (0, import_node_fs15.cpSync)(src, dest, { recursive: true });
 }
 function releaseTag(releasedVersion) {
   return releasedVersion.startsWith("v") ? releasedVersion : `v${releasedVersion}`;
 }
 async function extractPluginMmiFromHubCheckout(hubCheckout, tag, tmpRoot, execFileP5) {
-  const tarFile = (0, import_node_path11.join)(tmpRoot, "archive.tar");
+  const tarFile = (0, import_node_path14.join)(tmpRoot, "archive.tar");
   try {
     await execFileP5("git", gitFetchReleaseTagArgs(hubCheckout, tag), { timeout: 6e4 });
     await execFileP5("git", ["-C", hubCheckout, "archive", "--format=tar", `--output=${tarFile}`, tag, "plugins/mmi"], {
       timeout: 6e4
     });
     await execFileP5("tar", ["-xf", tarFile, "-C", tmpRoot], { timeout: 6e4 });
-    const pluginMmi = (0, import_node_path11.join)(tmpRoot, "plugins", "mmi");
-    return (0, import_node_fs12.existsSync)((0, import_node_path11.join)(pluginMmi, PLUGIN_JSON_REL)) ? pluginMmi : void 0;
+    const pluginMmi = (0, import_node_path14.join)(tmpRoot, "plugins", "mmi");
+    return (0, import_node_fs15.existsSync)((0, import_node_path14.join)(pluginMmi, PLUGIN_JSON_REL)) ? pluginMmi : void 0;
   } catch {
     return void 0;
   }
 }
 async function downloadPluginMmiViaGh(tag, tmpRoot) {
-  const tarPath = (0, import_node_path11.join)(tmpRoot, "repo.tgz");
+  const tarPath = (0, import_node_path14.join)(tmpRoot, "repo.tgz");
   try {
-    (0, import_node_fs12.mkdirSync)(tmpRoot, { recursive: true });
+    (0, import_node_fs15.mkdirSync)(tmpRoot, { recursive: true });
     const { stdout } = await execFileBuffer("gh", ghReleaseTarballApiArgs(tag), {
       timeout: 12e4,
       maxBuffer: 100 * 1024 * 1024,
       encoding: "buffer",
       windowsHide: true
     });
-    (0, import_node_fs12.writeFileSync)(tarPath, stdout);
+    (0, import_node_fs15.writeFileSync)(tarPath, stdout);
     await execFileBuffer("tar", ["-xzf", tarPath, "-C", tmpRoot], { timeout: 12e4, windowsHide: true });
-    const top = (0, import_node_fs12.readdirSync)(tmpRoot).find((entry) => entry !== "repo.tgz");
+    const top = (0, import_node_fs15.readdirSync)(tmpRoot).find((entry) => entry !== "repo.tgz");
     if (!top) return void 0;
-    const pluginMmi = (0, import_node_path11.join)(tmpRoot, top, "plugins", "mmi");
-    return (0, import_node_fs12.existsSync)((0, import_node_path11.join)(pluginMmi, PLUGIN_JSON_REL)) ? pluginMmi : void 0;
+    const pluginMmi = (0, import_node_path14.join)(tmpRoot, top, "plugins", "mmi");
+    return (0, import_node_fs15.existsSync)((0, import_node_path14.join)(pluginMmi, PLUGIN_JSON_REL)) ? pluginMmi : void 0;
   } catch {
     return void 0;
   }
 }
 async function resolvePluginMmiSource(releasedVersion, hubCheckout, tmpRoot, execFileP5) {
-  (0, import_node_fs12.mkdirSync)(tmpRoot, { recursive: true });
+  (0, import_node_fs15.mkdirSync)(tmpRoot, { recursive: true });
   const tag = releaseTag(releasedVersion);
   if (hubCheckout) {
     const fromHub = await extractPluginMmiFromHubCheckout(hubCheckout, tag, tmpRoot, execFileP5);
     if (fromHub) return fromHub;
   }
-  return downloadPluginMmiViaGh(tag, (0, import_node_path11.join)(tmpRoot, "gh"));
+  return downloadPluginMmiViaGh(tag, (0, import_node_path14.join)(tmpRoot, "gh"));
 }
 function cursorPluginPinsNeedingSeed(pins, releasedVersion) {
   if (!isSemverVersion(releasedVersion)) return pins.filter((pin) => !pin.hasPluginJson || !pin.hasHooksJson || pin.isEmpty);
@@ -9388,115 +10873,10 @@ async function applyCursorPluginCacheSeed(input) {
   for (const pin of pinsToSeed) {
     syncDirContents(source, pin.path);
   }
-  (0, import_node_fs12.rmSync)(tmpRoot, { recursive: true, force: true });
+  (0, import_node_fs15.rmSync)(tmpRoot, { recursive: true, force: true });
   return true;
 }
 
-// src/bootstrap-seeds.ts
-var PLACEHOLDER_RE = /\{\{([A-Z0-9_]+)\}\}/g;
-function loadBootstrapSeeds(manifestJson) {
-  let parsed;
-  try {
-    parsed = JSON.parse(manifestJson);
-  } catch {
-    throw new Error("bootstrap seed manifest is not valid JSON");
-  }
-  const obj = parsed ?? {};
-  const seeds = obj.seeds ?? [];
-  for (const s of seeds) {
-    if (!s || !s.target || !s.source || !Array.isArray(s.classes)) {
-      throw new Error(`invalid seed entry (needs target, source, classes): ${JSON.stringify(s)}`);
-    }
-    if (s.ownership !== "org" && s.ownership !== "repo") {
-      throw new Error(`invalid seed ownership '${s.ownership}' for ${s.target} (must be 'org' or 'repo')`);
-    }
-  }
-  return {
-    seeds,
-    labels: obj.labels ?? [],
-    placeholders: obj.placeholders ?? []
-  };
-}
-function renderSeed(template, vars) {
-  return template.replace(PLACEHOLDER_RE, (match, key) => key in vars ? vars[key] : match);
-}
-function missingPlaceholders(rendered) {
-  const out = /* @__PURE__ */ new Set();
-  for (const m of rendered.matchAll(PLACEHOLDER_RE)) out.add(m[1]);
-  return [...out];
-}
-var GITIGNORE_MANAGED_BEGIN = "# >>> mmi-managed >>>";
-var GITIGNORE_MANAGED_END = "# <<< mmi-managed <<<";
-var MANAGED_GITIGNORE_LINES = [
-  '# Org-wide cleanliness (AGENTS.md "Repo cleanliness") \u2014 enforced by `mmi-cli doctor`.',
-  "# Do not edit inside these markers; this block is regenerated on the next doctor run.",
-  "/tmp/",
-  "/plans/",
-  ".playwright-mcp/",
-  ".claude/worktrees/",
-  ".mmi/.session",
-  ".mmi/head-ts/",
-  // Recursive so any reuse of the parameterized queue engine in a new .mmi subdir (honcho today, others
-  // later) is ignored too — `**` matches zero dirs, so this still covers the root saga queue.
-  ".mmi/**/saga-pending.jsonl*",
-  ".mmi/**/saga-flush.lock",
-  ".aws-sam/",
-  "/*.png",
-  // Runtime secrets/config are vault-only (AGENTS.md "Privileged ops") — never commit a local .env. The
-  // .env.example reference file stays tracked.
-  ".env",
-  ".env.*",
-  "!.env.example"
-];
-function renderManagedGitignoreBlock() {
-  return [GITIGNORE_MANAGED_BEGIN, ...MANAGED_GITIGNORE_LINES, GITIGNORE_MANAGED_END].join("\n");
-}
-function upsertManagedGitignoreBlock(current) {
-  const block = renderManagedGitignoreBlock();
-  const src = (current ?? "").replace(/\r\n/g, "\n");
-  if (src.trim() === "") {
-    const next2 = `${block}
-`;
-    return { content: next2, changed: src !== next2 };
-  }
-  const managed = /* @__PURE__ */ new Set([GITIGNORE_MANAGED_BEGIN, GITIGNORE_MANAGED_END, ...MANAGED_GITIGNORE_LINES]);
-  const lines = src.split("\n");
-  const beginAt = lines.findIndex((l) => l === GITIGNORE_MANAGED_BEGIN);
-  const endAt = beginAt === -1 ? -1 : lines.findIndex((l, i) => i > beginAt && l === GITIGNORE_MANAGED_END);
-  let next;
-  if (beginAt !== -1 && endAt !== -1) {
-    const before = lines.slice(0, beginAt).filter((l) => !managed.has(l.trim()));
-    const after = lines.slice(endAt + 1).filter((l) => !managed.has(l.trim()));
-    next = `${[...before, ...block.split("\n"), ...after].join("\n").replace(/\n+$/, "")}
-`;
-  } else {
-    const kept = lines.filter((l) => !managed.has(l.trim())).join("\n").replace(/\n+$/, "");
-    next = kept === "" ? `${block}
-` : `${kept}
-
-${block}
-`;
-  }
-  return { content: next, changed: src !== next };
-}
-function diffManagedGitignoreBlock(current) {
-  const lines = (current ?? "").replace(/\r\n/g, "\n").split("\n");
-  const beginAt = lines.findIndex((l) => l === GITIGNORE_MANAGED_BEGIN);
-  const endAt = beginAt === -1 ? -1 : lines.findIndex((l, i) => i > beginAt && l === GITIGNORE_MANAGED_END);
-  const hasMarker = beginAt !== -1 || lines.some((l) => l === GITIGNORE_MANAGED_END);
-  if (!hasMarker) return { added: [], removed: [], seeded: true };
-  const wellOrdered = beginAt !== -1 && endAt !== -1;
-  if (!wellOrdered) return { added: [], removed: [], seeded: false };
-  const isRule = (l) => l.trim() !== "" && !l.trim().startsWith("#");
-  const oldBody = lines.slice(beginAt + 1, endAt).filter(isRule);
-  const newBody = MANAGED_GITIGNORE_LINES.filter(isRule);
-  return {
-    added: newBody.filter((l) => !oldBody.includes(l)),
-    removed: oldBody.filter((l) => !newBody.includes(l)),
-    seeded: false
-  };
-}
-
 // src/doctor.ts
 var GH_PROJECT_LOGIN_FIX = 'run: gh auth login --hostname github.com --git-protocol https --web --scopes "project"';
 var AWS_CROSS_ACCOUNT_FIX = "use a non-root IAM user/session profile for master-agent AWS checks; set AWS_PROFILE or AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY (plus AWS_SESSION_TOKEN for temporary credentials), then verify `aws sts get-caller-identity` does not end in :root";
@@ -10106,8 +11486,8 @@ async function runStageLiveDown(deps, t) {
 
 // src/stage-runner.ts
 var import_node_child_process8 = require("node:child_process");
-var import_node_fs13 = require("node:fs");
-var import_node_path12 = require("node:path");
+var import_node_fs16 = require("node:fs");
+var import_node_path15 = require("node:path");
 var import_node_net2 = require("node:net");
 var import_node_util7 = require("node:util");
 var execFileP4 = (0, import_node_util7.promisify)(import_node_child_process8.execFile);
@@ -10152,7 +11532,7 @@ function detectStaleEnvFile(exampleContent, targetContent, mtimes) {
   return void 0;
 }
 function stageStatePath(cwd = process.cwd()) {
-  return (0, import_node_path12.join)(cwd, "tmp", "stage", "state.json");
+  return (0, import_node_path15.join)(cwd, "tmp", "stage", "state.json");
 }
 function mergeEnvSecretsIntoFile(content, secrets2) {
   const lines = content.split(/\r?\n/);
@@ -10176,8 +11556,8 @@ function mergeEnvSecretsIntoFile(content, secrets2) {
 `;
 }
 var POSIX_ONLY_VERBS = ["cp", "mv", "rm", "ln", "cat", "touch", "chmod", "export"];
-function posixOnlyShellProblems(command, field, platform = process.platform) {
-  if (platform !== "win32" || !command?.trim()) return [];
+function posixOnlyShellProblems(command, field, platform2 = process.platform) {
+  if (platform2 !== "win32" || !command?.trim()) return [];
   const problems = [];
   if (/(^|&&|\||;)\s*[A-Za-z_][A-Za-z0-9_]*=\S/.test(command)) {
     problems.push(
@@ -10235,9 +11615,9 @@ async function shell(command, cwd, timeoutMs) {
   });
 }
 function readState(path2) {
-  if (!(0, import_node_fs13.existsSync)(path2)) return null;
+  if (!(0, import_node_fs16.existsSync)(path2)) return null;
   try {
-    return JSON.parse((0, import_node_fs13.readFileSync)(path2, "utf8"));
+    return JSON.parse((0, import_node_fs16.readFileSync)(path2, "utf8"));
   } catch {
     return null;
   }
@@ -10289,7 +11669,7 @@ async function stopStage(opts = {}) {
     return { ok: true, action: "stop", statePath, message: "no previous stage state found" };
   }
   await killTree(state.pid);
-  (0, import_node_fs13.rmSync)(statePath, { force: true });
+  (0, import_node_fs16.rmSync)(statePath, { force: true });
   return { ok: true, action: "stop", statePath, pid: state.pid, message: `stopped previous stage pid ${state.pid}` };
 }
 async function startStage(config = {}, opts = {}) {
@@ -10298,7 +11678,7 @@ async function startStage(config = {}, opts = {}) {
   const cwd = opts.cwd ?? process.cwd();
   const statePath = opts.statePath ?? stageStatePath(cwd);
   const dir = statePath.slice(0, Math.max(statePath.lastIndexOf("/"), statePath.lastIndexOf("\\")));
-  (0, import_node_fs13.mkdirSync)(dir, { recursive: true });
+  (0, import_node_fs16.mkdirSync)(dir, { recursive: true });
   let stagePort;
   if (config.portRange) {
     const [s, e] = config.portRange;
@@ -10308,14 +11688,14 @@ async function startStage(config = {}, opts = {}) {
   }
   const sub = (s) => s != null && stagePort != null ? s.replace(/\$\{?STAGE_PORT\}?/g, String(stagePort)) : s;
   if (config.ensureEnv) {
-    const target = (0, import_node_path12.join)(cwd, config.ensureEnv.target);
-    const example = (0, import_node_path12.join)(cwd, config.ensureEnv.example);
-    if (!(0, import_node_fs13.existsSync)(target) && (0, import_node_fs13.existsSync)(example)) {
-      (0, import_node_fs13.copyFileSync)(example, target);
-    } else if ((0, import_node_fs13.existsSync)(target) && (0, import_node_fs13.existsSync)(example)) {
-      const stale = detectStaleEnvFile((0, import_node_fs13.readFileSync)(example, "utf8"), (0, import_node_fs13.readFileSync)(target, "utf8"), {
-        exampleMtimeMs: (0, import_node_fs13.statSync)(example).mtimeMs,
-        targetMtimeMs: (0, import_node_fs13.statSync)(target).mtimeMs
+    const target = (0, import_node_path15.join)(cwd, config.ensureEnv.target);
+    const example = (0, import_node_path15.join)(cwd, config.ensureEnv.example);
+    if (!(0, import_node_fs16.existsSync)(target) && (0, import_node_fs16.existsSync)(example)) {
+      (0, import_node_fs16.copyFileSync)(example, target);
+    } else if ((0, import_node_fs16.existsSync)(target) && (0, import_node_fs16.existsSync)(example)) {
+      const stale = detectStaleEnvFile((0, import_node_fs16.readFileSync)(example, "utf8"), (0, import_node_fs16.readFileSync)(target, "utf8"), {
+        exampleMtimeMs: (0, import_node_fs16.statSync)(example).mtimeMs,
+        targetMtimeMs: (0, import_node_fs16.statSync)(target).mtimeMs
       });
       if (stale) {
         const msg = `stale ${config.ensureEnv.target} (${stale}) \u2014 delete it or refresh from ${config.ensureEnv.example} before re-running /stage`;
@@ -10323,8 +11703,8 @@ async function startStage(config = {}, opts = {}) {
         console.error(`mmi-cli stage: ${msg} (allowed via --allow-stale-env)`);
       }
     }
-    if (opts.vaultEnvMerge && Object.keys(opts.vaultEnvMerge).length && (0, import_node_fs13.existsSync)(target)) {
-      (0, import_node_fs13.writeFileSync)(target, mergeEnvSecretsIntoFile((0, import_node_fs13.readFileSync)(target, "utf8"), opts.vaultEnvMerge), "utf8");
+    if (opts.vaultEnvMerge && Object.keys(opts.vaultEnvMerge).length && (0, import_node_fs16.existsSync)(target)) {
+      (0, import_node_fs16.writeFileSync)(target, mergeEnvSecretsIntoFile((0, import_node_fs16.readFileSync)(target, "utf8"), opts.vaultEnvMerge), "utf8");
     }
   }
   const extraEnv = {};
@@ -10349,13 +11729,13 @@ async function startStage(config = {}, opts = {}) {
     healthUrl: sub(config.healthUrl?.trim()) || void 0,
     port: stagePort
   };
-  (0, import_node_fs13.writeFileSync)(statePath, JSON.stringify(state, null, 2), "utf8");
+  (0, import_node_fs16.writeFileSync)(statePath, JSON.stringify(state, null, 2), "utf8");
   try {
     if (state.healthUrl) await waitForHealth(state.healthUrl, opts.timeoutMs ?? 6e4, config.healthAnyStatus);
     else await waitForProcessStability(child);
   } catch (e) {
     await killTree(state.pid);
-    (0, import_node_fs13.rmSync)(statePath, { force: true });
+    (0, import_node_fs16.rmSync)(statePath, { force: true });
     throw e;
   }
   const result = { ok: true, action: "start", statePath, pid: state.pid, port: stagePort, message: `started stage pid ${state.pid}${stagePort != null ? ` on port ${stagePort}` : ""}` };
@@ -10374,75 +11754,6 @@ async function runStage(config = {}, opts = {}) {
   return { ...started, action: "run", message: `built and ${started.message}` };
 }
 
-// src/project-model.ts
-var PROJECT_TYPES = ["web-app", "hub-service", "content", "desktop-game", "non-deployable", "cli-tool", "worker"];
-var DEPLOY_MODELS = ["hub-serverless", "serverless", "tenant-container", "solo-container", "registry-publish", "content", "none"];
-var RELEASE_TRACKS = ["full", "direct", "trunk"];
-var PROJECT_TYPE_SET = new Set(PROJECT_TYPES);
-var DEPLOY_MODEL_SET = new Set(DEPLOY_MODELS);
-var RELEASE_TRACK_SET = new Set(RELEASE_TRACKS);
-function isProjectType(value) {
-  return Boolean(value && PROJECT_TYPE_SET.has(value));
-}
-function isDeployModel(value) {
-  return Boolean(value && DEPLOY_MODEL_SET.has(value));
-}
-function isReleaseTrack(value) {
-  return Boolean(value && RELEASE_TRACK_SET.has(value));
-}
-function repoIsHub(repo) {
-  return repo.toLowerCase().endsWith("/mmi-hub") || repo.toLowerCase() === "mmi-hub";
-}
-function resolveProjectTypeConfident(meta, repo) {
-  const rawType = typeof meta?.projectType === "string" ? meta.projectType : void 0;
-  if (isProjectType(rawType)) return rawType;
-  if (meta?.class === "content" || meta?.deployModel === "content") return "content";
-  if (meta?.deployModel === "hub-serverless" || repoIsHub(repo)) return "hub-service";
-  if (meta?.deployModel === "registry-publish") return "cli-tool";
-  if (meta?.deployModel === "solo-container") return "worker";
-  if (meta?.deployModel === "none") return "non-deployable";
-  return void 0;
-}
-function resolveProjectType(meta, repo) {
-  return resolveProjectTypeConfident(meta, repo) ?? "web-app";
-}
-function resolveDeployModel(meta, repo) {
-  const rawModel = typeof meta?.deployModel === "string" ? meta.deployModel : void 0;
-  if (isDeployModel(rawModel)) return rawModel;
-  const projectType = resolveProjectType(meta, repo);
-  if (projectType === "content" || meta?.class === "content") return "content";
-  if (projectType === "hub-service" || repoIsHub(repo)) return "hub-serverless";
-  if (projectType === "desktop-game" || projectType === "non-deployable") return "none";
-  if (projectType === "cli-tool") return "registry-publish";
-  return "tenant-container";
-}
-function projectTypeClearsWebProfile(projectType, deployModel) {
-  return projectType === "content" || projectType === "desktop-game" || projectType === "non-deployable" || projectType === "cli-tool" || deployModel === "content" || deployModel === "none" || deployModel === "registry-publish";
-}
-function inferReleaseTrackFromBranches(hints) {
-  if (hints.hasRcBranch) return void 0;
-  if (hints.hasDevelopmentBranch && hints.hasMainBranch) return "direct";
-  return void 0;
-}
-function resolveBootstrapReleaseTrack(cls, explicit) {
-  if (isReleaseTrack(explicit)) return explicit;
-  if (cls === "content") return "trunk";
-  return "full";
-}
-function resolveReleaseTrack(meta, hints) {
-  const raw = typeof meta?.releaseTrack === "string" ? meta.releaseTrack : void 0;
-  if (isReleaseTrack(raw)) return raw;
-  if (meta?.class === "content" || meta?.deployModel === "content") return "trunk";
-  const inferred = hints ? inferReleaseTrackFromBranches(hints) : void 0;
-  if (inferred) return inferred;
-  return "full";
-}
-function branchesForTrack(track) {
-  if (track === "trunk") return ["main"];
-  if (track === "direct") return ["development", "main"];
-  return ["development", "rc", "main"];
-}
-
 // src/org-spine-pull.ts
 async function reconcileDirtyOrgSpineBeforePull(deps, branch, options = {}) {
   await deps.run("git", ["fetch", "origin", branch]).catch(() => "");
@@ -10471,7 +11782,7 @@ function resolveDeployModel2(meta, repo) {
   if (isDeployModel(m)) return m;
   return resolveDeployModel(meta, repo);
 }
-function clean(out) {
+function clean2(out) {
   return out.trim();
 }
 function requireValue(value, label) {
@@ -10522,11 +11833,11 @@ async function verifyPublishedRelease(deps, repo, tag, expectedTarget, expectedS
   if (release.targetCommitish !== expectedTarget) {
     throw new Error(`Release ${tag} targetCommitish is ${String(release.targetCommitish || "(missing)")}, expected ${expectedTarget}`);
   }
-  const tagSha = requireValue(clean(await deps.run("git", ["rev-parse", `${tag}^{commit}`])), "release tag sha");
+  const tagSha = requireValue(clean2(await deps.run("git", ["rev-parse", `${tag}^{commit}`])), "release tag sha");
   if (tagSha !== expectedSha) {
     throw new Error(`Release ${tag} tag points at ${tagSha}, expected ${expectedSha}`);
   }
-  const branchOut = clean(await deps.run("git", ["ls-remote", "origin", `refs/heads/${expectedTarget}`]));
+  const branchOut = clean2(await deps.run("git", ["ls-remote", "origin", `refs/heads/${expectedTarget}`]));
   const branchSha = requireValue(branchOut.split(/\s+/)[0] ?? "", `origin/${expectedTarget} sha`);
   if (branchSha !== expectedSha) {
     throw new Error(`origin/${expectedTarget} points at ${branchSha}, expected ${expectedSha}`);
@@ -10586,7 +11897,7 @@ function ensurePositiveCount(out, emptyMessage) {
   if (count <= 0) throw new Error(emptyMessage);
 }
 async function remoteBranchExists(deps, branch) {
-  const out = clean(await deps.run("git", ["ls-remote", "origin", `refs/heads/${branch}`]));
+  const out = clean2(await deps.run("git", ["ls-remote", "origin", `refs/heads/${branch}`]));
   return out.length > 0;
 }
 async function loadReleaseTrackBranchHints(deps) {
@@ -10598,10 +11909,10 @@ async function loadReleaseTrackBranchHints(deps) {
   return { hasDevelopmentBranch, hasMainBranch, hasRcBranch };
 }
 async function buildTrainApplyContext(deps) {
-  const repo = requireValue(clean(await deps.run("gh", ["repo", "view", "--json", "nameWithOwner", "--jq", ".nameWithOwner"])), "repo");
+  const repo = requireValue(clean2(await deps.run("gh", ["repo", "view", "--json", "nameWithOwner", "--jq", ".nameWithOwner"])), "repo");
   const [owner, name] = repo.split("/");
   if (!owner || !name) throw new Error(`repo must be owner/name, got ${repo}`);
-  const login = requireValue(clean(await deps.run("gh", ["api", "user", "--jq", ".login"])), "GitHub login");
+  const login = requireValue(clean2(await deps.run("gh", ["api", "user", "--jq", ".login"])), "GitHub login");
   const verdict = await deps.trainAuthority(repo);
   if (!verdict.ok) throw new Error(`${commandAuthorityLabel(owner)}: train authority could not be verified (${verdict.error})`);
   if (!verdict.train) {
@@ -10622,7 +11933,7 @@ async function requireCleanTree(deps) {
   if (status.trim()) throw new Error("working tree must be clean before train apply");
 }
 async function requireBranch(deps, branch) {
-  const current = clean(await deps.run("git", ["rev-parse", "--abbrev-ref", "HEAD"]));
+  const current = clean2(await deps.run("git", ["rev-parse", "--abbrev-ref", "HEAD"]));
   if (current !== branch) throw new Error(`must run from ${branch}, currently on ${current || "(unknown)"}`);
 }
 var HUB_REPO3 = "mutmutco/MMI-Hub";
@@ -10791,7 +12102,7 @@ async function discoverRequiredCheckContexts(deps, ctx, branch) {
   return [...contexts];
 }
 async function findOpenAlignmentPr(deps, ctx) {
-  const out = clean(await deps.run("gh", ["pr", "list", "--repo", ctx.repo, "--base", "development", "--head", "main", "--state", "open", "--json", "number,url"]));
+  const out = clean2(await deps.run("gh", ["pr", "list", "--repo", ctx.repo, "--base", "development", "--head", "main", "--state", "open", "--json", "number,url"]));
   if (!out) return void 0;
   const rows = JSON.parse(out);
   const row = rows.find((r) => typeof r.number === "number" && typeof r.url === "string");
@@ -10819,14 +12130,14 @@ async function rollDevelopmentForward(deps, ctx, tag) {
       note: `alignment PR already open: ${existing.url} \u2014 land it with \`gh pr merge ${existing.number} --merge\``
     };
   }
-  const ahead = clean(await deps.run("git", ["rev-list", "--count", "origin/development..main"]));
+  const ahead = clean2(await deps.run("git", ["rev-list", "--count", "origin/development..main"]));
   if (ahead === "0") {
     return { status: "aligned", note: "development already contains the released main; nothing to roll forward" };
   }
   const body = `Carries the ${tag} release (including the version fold) from \`main\` back to \`development\`.
 
 \`development\` requires status checks, so the release train opens this alignment PR instead of a direct push of the un-checked merge commit (#1143). Land it with a **true merge** (\`gh pr merge --merge\`, not squash) so the merge parentage survives and the misalignment guard stays satisfied.`;
-  const url = clean(await deps.run("gh", ["pr", "create", "--repo", ctx.repo, "--base", "development", "--head", "main", "--title", `chore(release): align development to ${tag}`, "--body", body]));
+  const url = clean2(await deps.run("gh", ["pr", "create", "--repo", ctx.repo, "--base", "development", "--head", "main", "--title", `chore(release): align development to ${tag}`, "--body", body]));
   const number = parsePrNumber(url);
   return {
     status: "pr-pending",
@@ -10892,10 +12203,10 @@ async function waitForRequiredTrainChecks(deps, ctx, sha, required) {
 }
 async function ensureTagPushed(deps, tag, sha) {
   const remoteOut = await deps.run("git", ["ls-remote", "origin", `refs/tags/${tag}`]);
-  const remoteSha = clean(remoteOut).split(/\s+/)[0] || "";
+  const remoteSha = clean2(remoteOut).split(/\s+/)[0] || "";
   let localSha = "";
   try {
-    localSha = clean(await deps.run("git", ["rev-parse", "--verify", `refs/tags/${tag}^{commit}`]));
+    localSha = clean2(await deps.run("git", ["rev-parse", "--verify", `refs/tags/${tag}^{commit}`]));
   } catch {
   }
   if (remoteSha) {
@@ -10918,7 +12229,7 @@ async function ensureTagPushed(deps, tag, sha) {
 }
 async function resolveRcResumeTag(deps, base2, sha) {
   const out = await deps.run("git", ["ls-remote", "--tags", "origin", `refs/tags/${base2}-rc.*`]);
-  const onSha = clean(out).split("\n").map((line) => line.trim()).filter(Boolean).map((line) => line.split(/\s+/)).filter(([refSha]) => refSha === sha).map(([, ref]) => ref.replace(/^refs\/tags\//, "").replace(/\^\{\}$/, "")).filter((ref) => new RegExp(`^${base2.replace(/\./g, "\\.")}-rc\\.\\d+$`).test(ref));
+  const onSha = clean2(out).split("\n").map((line) => line.trim()).filter(Boolean).map((line) => line.split(/\s+/)).filter(([refSha]) => refSha === sha).map(([, ref]) => ref.replace(/^refs\/tags\//, "").replace(/\^\{\}$/, "")).filter((ref) => new RegExp(`^${base2.replace(/\./g, "\\.")}-rc\\.\\d+$`).test(ref));
   const unique = [...new Set(onSha)];
   if (unique.length === 0) return { tag: null };
   const rcNum = (t) => Number.parseInt(t.replace(/^.*-rc\./, ""), 10);
@@ -11043,13 +12354,13 @@ async function runTrainApply(command, deps, options = {}) {
       "nothing to promote: origin/development is not ahead of origin/rc"
     );
     const deployModel2 = await preflight(deps, ctx, "rc", meta);
-    const releaseBase = requireValue(clean(await deps.run("node", ["scripts/next-version.mjs", "cycle"])), "release base");
+    const releaseBase = requireValue(clean2(await deps.run("node", ["scripts/next-version.mjs", "cycle"])), "release base");
     await deps.run("git", ["checkout", "rc"]);
     await ffOnlyPull(deps, "rc");
     await deps.run("git", ["merge", "development", "--no-edit"]);
-    const rcSha = requireValue(clean(await deps.run("git", ["rev-parse", "rc"])), "rc sha");
+    const rcSha = requireValue(clean2(await deps.run("git", ["rev-parse", "rc"])), "rc sha");
     const resume = await resolveRcResumeTag(deps, releaseBase, rcSha);
-    const tag2 = resume.tag ?? requireValue(clean(await deps.run("node", ["scripts/next-version.mjs", "rc"])), "rc tag");
+    const tag2 = resume.tag ?? requireValue(clean2(await deps.run("node", ["scripts/next-version.mjs", "rc"])), "rc tag");
     const resumeNote = resume.tag ? resume.note : void 0;
     await ensureTagPushed(deps, tag2, rcSha);
     const requiredChecks2 = await discoverRequiredCheckContexts(deps, ctx, "rc");
@@ -11067,7 +12378,7 @@ async function runTrainApply(command, deps, options = {}) {
       "nothing to release: origin/development is not ahead of origin/main"
     );
     const deployModel2 = await preflight(deps, ctx, "main", meta);
-    const tag2 = requireValue(clean(await deps.run("node", ["scripts/next-version.mjs", "cycle"])), "release tag");
+    const tag2 = requireValue(clean2(await deps.run("node", ["scripts/next-version.mjs", "cycle"])), "release tag");
     const foldPaths2 = await resolveFoldPaths(deps, deployModel2);
     const tolerated2 = [...foldPaths2, ...RELEASE_TOLERATED_PATHS];
     const predicted2 = await predictMergeConflicts(deps, "origin/main", "origin/development");
@@ -11085,12 +12396,12 @@ async function runTrainApply(command, deps, options = {}) {
       await mergeWithSpineResolution(deps, "development", "development -> main", "theirs", tolerated2);
     }
     const versionFold2 = await foldReleaseVersion(deps, deployModel2, tag2, foldPaths2);
-    const releaseSha2 = requireValue(clean(await deps.run("git", ["rev-parse", "main"])), "release sha");
+    const releaseSha2 = requireValue(clean2(await deps.run("git", ["rev-parse", "main"])), "release sha");
     await ensureTagPushed(deps, tag2, releaseSha2);
     const requiredChecks2 = await discoverRequiredCheckContexts(deps, ctx, "main");
     const checks2 = await waitForRequiredTrainChecks(deps, ctx, releaseSha2, requiredChecks2);
     await deps.run("git", ["push", "origin", "main"]);
-    const releaseUrl2 = clean(await deps.run("gh", ["release", "create", tag2, "--target", "main", "--generate-notes", "--latest", "--repo", ctx.repo])) || void 0;
+    const releaseUrl2 = clean2(await deps.run("gh", ["release", "create", tag2, "--target", "main", "--generate-notes", "--latest", "--repo", ctx.repo])) || void 0;
     await verifyPublishedRelease(deps, ctx.repo, tag2, "main", releaseSha2);
     const announceNote2 = deps.announce ? (await deps.announce({ repo: ctx.repo, tag: tag2, summaryFile: options.announceSummaryFile })).note : void 0;
     const autoRunSince2 = (deps.now ?? Date.now)();
@@ -11139,8 +12450,8 @@ async function runTrainApply(command, deps, options = {}) {
       "nothing to release: origin/development is not ahead of origin/main"
     );
     const deployModel2 = await preflight(deps, ctx, "main", meta);
-    const tag2 = requireValue(clean(await deps.run("node", ["scripts/next-version.mjs", "cycle"])), "release tag");
-    const rcShaAtRelease = hasRcBranch ? clean(await deps.run("git", ["rev-parse", "origin/rc"])) : "";
+    const tag2 = requireValue(clean2(await deps.run("node", ["scripts/next-version.mjs", "cycle"])), "release tag");
+    const rcShaAtRelease = hasRcBranch ? clean2(await deps.run("git", ["rev-parse", "origin/rc"])) : "";
     const foldPaths2 = await resolveFoldPaths(deps, deployModel2);
     const tolerated2 = [...foldPaths2, ...RELEASE_TOLERATED_PATHS];
     const predicted2 = await predictMergeConflicts(deps, "origin/main", "origin/development");
@@ -11158,12 +12469,12 @@ async function runTrainApply(command, deps, options = {}) {
       await mergeWithSpineResolution(deps, "development", "development -> main", "theirs", tolerated2);
     }
     const versionFold2 = await foldReleaseVersion(deps, deployModel2, tag2, foldPaths2);
-    const releaseSha2 = requireValue(clean(await deps.run("git", ["rev-parse", "main"])), "release sha");
+    const releaseSha2 = requireValue(clean2(await deps.run("git", ["rev-parse", "main"])), "release sha");
     await ensureTagPushed(deps, tag2, releaseSha2);
     const requiredChecks2 = await discoverRequiredCheckContexts(deps, ctx, "main");
     const checks2 = await waitForRequiredTrainChecks(deps, ctx, releaseSha2, requiredChecks2);
     await deps.run("git", ["push", "origin", "main"]);
-    const releaseUrl2 = clean(await deps.run("gh", ["release", "create", tag2, "--target", "main", "--generate-notes", "--latest", "--repo", ctx.repo])) || void 0;
+    const releaseUrl2 = clean2(await deps.run("gh", ["release", "create", tag2, "--target", "main", "--generate-notes", "--latest", "--repo", ctx.repo])) || void 0;
     await verifyPublishedRelease(deps, ctx.repo, tag2, "main", releaseSha2);
     const announceNote2 = deps.announce ? (await deps.announce({ repo: ctx.repo, tag: tag2, summaryFile: options.announceSummaryFile })).note : void 0;
     const autoRunSince2 = (deps.now ?? Date.now)();
@@ -11230,7 +12541,7 @@ async function runTrainApply(command, deps, options = {}) {
       `hotfix-coverage: ${coverage.uncovered.length} main-only commit(s) not proven in origin/rc \u2014 the candidate would revert a prod hotfix: ${list}. Re-cut /rcand from development, or have the authorized human verify the content is in the candidate and rerun release with --ack <sha>[,<sha>\u2026].`
     );
   }
-  const releasedRcSha = clean(await deps.run("git", ["rev-parse", "origin/rc"]));
+  const releasedRcSha = clean2(await deps.run("git", ["rev-parse", "origin/rc"]));
   await deps.run("git", ["checkout", "main"]);
   await ffOnlyPull(deps, "main");
   if (predicted.length === 0) {
@@ -11238,15 +12549,15 @@ async function runTrainApply(command, deps, options = {}) {
   } else {
     await mergeWithSpineResolution(deps, "rc", "rc -> main", "theirs", tolerated);
   }
-  const tag = requireValue(clean(await deps.run("node", ["scripts/next-version.mjs", "release"])), "release tag");
+  const tag = requireValue(clean2(await deps.run("node", ["scripts/next-version.mjs", "release"])), "release tag");
   const versionFold = await foldReleaseVersion(deps, deployModel, tag, foldPaths);
-  const releaseSha = requireValue(clean(await deps.run("git", ["rev-parse", "main"])), "release sha");
+  const releaseSha = requireValue(clean2(await deps.run("git", ["rev-parse", "main"])), "release sha");
   await ensureTagPushed(deps, tag, releaseSha);
   const requiredChecks = await discoverRequiredCheckContexts(deps, ctx, "main");
   const checks = await waitForRequiredTrainChecks(deps, ctx, releaseSha, requiredChecks);
   await deps.run("git", ["push", "origin", "main"]);
   const autoRunSince = (deps.now ?? Date.now)();
-  const releaseUrl = clean(await deps.run("gh", ["release", "create", tag, "--target", "main", "--generate-notes", "--latest", "--repo", ctx.repo])) || void 0;
+  const releaseUrl = clean2(await deps.run("gh", ["release", "create", tag, "--target", "main", "--generate-notes", "--latest", "--repo", ctx.repo])) || void 0;
   await verifyPublishedRelease(deps, ctx.repo, tag, "main", releaseSha);
   const announceNote = deps.announce ? (await deps.announce({ repo: ctx.repo, tag, summaryFile: options.announceSummaryFile })).note : void 0;
   const d = await dispatchDeploy(deps, ctx, "main", "main", deployModel, watch, autoRunSince, releaseSha, "report");
@@ -11374,7 +12685,7 @@ async function retireRcRuntime(deps, ctx, model, deployStatus, releasedRcSha) {
   }
   try {
     await deps.run("git", ["fetch", "origin", "rc"]);
-    const rcNow = clean(await deps.run("git", ["rev-parse", "origin/rc"]));
+    const rcNow = clean2(await deps.run("git", ["rev-parse", "origin/rc"]));
     if (rcNow !== releasedRcSha) {
       return {
         status: "skipped",
@@ -11406,7 +12717,7 @@ async function runTenantRedeploy(deps, options) {
   const repo = options.repo;
   const [owner, name] = repo.split("/");
   if (!owner || !name) throw new Error(`repo must be owner/name, got ${repo}`);
-  const login = requireValue(clean(await deps.run("gh", ["api", "user", "--jq", ".login"])), "GitHub login");
+  const login = requireValue(clean2(await deps.run("gh", ["api", "user", "--jq", ".login"])), "GitHub login");
   const verdict = await deps.trainAuthority(repo);
   if (!verdict.ok) throw new Error(`${commandAuthorityLabel(owner)}: train authority could not be verified (${verdict.error})`);
   if (!verdict.train) throw new Error(`${commandAuthorityLabel(owner)}: @${login} is ${verdict.role} \u2014 no train authority on ${repo}`);
@@ -11562,7 +12873,7 @@ var HOTFIX_RUN_FIND_ATTEMPTS = 10;
 var HOTFIX_RUN_FIND_DELAY_MS = 15e3;
 var HOTFIX_VERIFY_ATTEMPTS = 5;
 var HOTFIX_VERIFY_RETRY_MS = 6e3;
-function clean2(out) {
+function clean3(out) {
   return out.trim();
 }
 function sleeper(deps) {
@@ -11620,7 +12931,7 @@ async function resolveHotfixSource(deps, ctx, from) {
     if (!sha2) throw new Error(`PR #${num} has no merge commit recorded \u2014 name the commit SHA explicitly`);
     return { sha: sha2, label: `PR #${num} (${sha2.slice(0, 7)})` };
   }
-  const sha = clean2(await deps.run("git", ["rev-parse", "--verify", `${from}^{commit}`]));
+  const sha = clean3(await deps.run("git", ["rev-parse", "--verify", `${from}^{commit}`]));
   if (!sha) throw new Error(`could not resolve commit ${from}`);
   return { sha, label: sha.slice(0, 7) };
 }
@@ -11648,7 +12959,7 @@ async function runHotfixStart(deps, options) {
     };
   }
   const { sha, label } = await resolveHotfixSource(deps, ctx, options.from);
-  const remoteBranch = clean2(await deps.run("git", ["ls-remote", "origin", `refs/heads/${branch}`]));
+  const remoteBranch = clean3(await deps.run("git", ["ls-remote", "origin", `refs/heads/${branch}`]));
   if (remoteBranch) {
     await deps.run("git", ["checkout", branch]);
     const isRulesSource2 = deps.isRulesSource ? await deps.isRulesSource() : false;
@@ -11681,7 +12992,7 @@ async function runHotfixStart(deps, options) {
     await deps.run("git", ["push", "-u", "origin", branch]);
   }
   const bumpNote = deployModel === "hub-serverless" ? " with the locked distribution bump" : "";
-  const prUrl = clean2(await deps.run("gh", [
+  const prUrl = clean3(await deps.run("gh", [
     "pr",
     "create",
     "--repo",
@@ -11801,7 +13112,7 @@ async function runHotfixRelease(deps, versionInput, options = {}) {
   }
   let verifyNote;
   if (deployModel === "hub-serverless") {
-    const previousRef = clean2(await deps.run("git", ["rev-parse", "--abbrev-ref", "HEAD"]));
+    const previousRef = clean3(await deps.run("git", ["rev-parse", "--abbrev-ref", "HEAD"]));
     const publishSucceeded = runs.find((r) => r.workflow === "publish.yml")?.conclusion === "success";
     try {
       await deps.run("git", ["-c", "advice.detachedHead=false", "checkout", tag]);
@@ -11886,9 +13197,9 @@ async function runHotfixStatus(deps, versionInput) {
   return { ...ctx, command: "hotfix-status", ...facts, ...deriveHotfixState(facts) };
 }
 async function gatherHotfixFacts(deps, ctx, tag, version) {
-  const branchExists = Boolean(clean2(await deps.run("git", ["ls-remote", "origin", `refs/heads/${hotfixBranch(tag)}`])));
+  const branchExists = Boolean(clean3(await deps.run("git", ["ls-remote", "origin", `refs/heads/${hotfixBranch(tag)}`])));
   const pr2 = await findHotfixPr(deps, ctx, tag);
-  const remoteTag = clean2(await deps.run("git", ["ls-remote", "origin", `refs/tags/${tag}`]));
+  const remoteTag = clean3(await deps.run("git", ["ls-remote", "origin", `refs/tags/${tag}`]));
   const tagPushed = Boolean(remoteTag);
   const tagSha = remoteTag.split(/\s+/)[0] || "";
   let releaseExists = false;
@@ -11922,7 +13233,7 @@ async function gatherHotfixFacts(deps, ctx, tag, version) {
       }
     }
   }
-  const npmVersion = await deps.run("npm", ["view", "@mutmutco/cli", "version", "--silent"]).then(clean2, () => "unknown");
+  const npmVersion = await deps.run("npm", ["view", "@mutmutco/cli", "version", "--silent"]).then(clean3, () => "unknown");
   return { tag, version, branchExists, pr: pr2 ? { number: pr2.number, state: pr2.state, url: pr2.url } : null, tagPushed, releaseExists, runs, npmVersion };
 }
 async function findInFlightHotfixVersion(deps, ctx) {
@@ -11945,7 +13256,7 @@ async function findInFlightHotfixVersion(deps, ctx) {
     const m = typeof row.headRefName === "string" && /^hotfix\/(v\d+\.\d+\.\d+)/.exec(row.headRefName);
     if (m) tags.add(m[1]);
   }
-  const branchOut = clean2(await deps.run("git", ["ls-remote", "origin", "refs/heads/hotfix/v*"]));
+  const branchOut = clean3(await deps.run("git", ["ls-remote", "origin", "refs/heads/hotfix/v*"]));
   for (const line of branchOut.split("\n").filter(Boolean)) {
     const ref = line.split(/\s+/)[1] ?? "";
     const m = /^refs\/heads\/hotfix\/(v\d+\.\d+\.\d+)/.exec(ref);
@@ -12094,7 +13405,7 @@ async function announceRelease(deps, args) {
 }
 
 // src/port-registry.ts
-var import_node_fs14 = require("node:fs");
+var import_node_fs17 = require("node:fs");
 
 // ../infra/port-geometry.mjs
 var PORT_BLOCK = 100;
@@ -12108,8 +13419,8 @@ function nextPortBlock(registry2) {
   return [base2, base2 + PORT_SPAN];
 }
 function loadPortRegistry(path2) {
-  if (!(0, import_node_fs14.existsSync)(path2)) return {};
-  const raw = JSON.parse((0, import_node_fs14.readFileSync)(path2, "utf8"));
+  if (!(0, import_node_fs17.existsSync)(path2)) return {};
+  const raw = JSON.parse((0, import_node_fs17.readFileSync)(path2, "utf8"));
   const out = {};
   for (const [key, value] of Object.entries(raw)) {
     if (Array.isArray(value) && value.length === 2 && value.every((n) => typeof n === "number")) {
@@ -12123,9 +13434,9 @@ function ensurePortRange(repo, path2) {
   const existing = registry2[repo];
   if (existing) return existing;
   const range = nextPortBlock(registry2);
-  const raw = (0, import_node_fs14.existsSync)(path2) ? JSON.parse((0, import_node_fs14.readFileSync)(path2, "utf8")) : {};
+  const raw = (0, import_node_fs17.existsSync)(path2) ? JSON.parse((0, import_node_fs17.readFileSync)(path2, "utf8")) : {};
   raw[repo] = range;
-  (0, import_node_fs14.writeFileSync)(path2, JSON.stringify(raw, null, 2) + "\n", "utf8");
+  (0, import_node_fs17.writeFileSync)(path2, JSON.stringify(raw, null, 2) + "\n", "utf8");
   return range;
 }
 function portCursorSeed(registry2) {
@@ -12417,7 +13728,13 @@ var HUB_REPO4 = "mutmutco/MMI-Hub";
 var requiredLabels = ["bug", "feature", "task"];
 var requiredPriorityOptions = ["Urgent", "High", "Medium", "Low"];
 var strayDefaultLabels = ["documentation", "duplicate", "enhancement", "good first issue", "help wanted", "invalid", "question", "wontfix"];
+var retiredPriorityLabels = ["priority:urgent", "priority:high", "priority:medium", "priority:low"];
 var requiredStatusOptions = ["Todo", "In Progress", "In Review", "Done"];
+var canonicalStatusColors = { Todo: "GRAY", "In Progress": "YELLOW", "In Review": "ORANGE", Done: "GREEN" };
+var canonicalPriorityColors = { Urgent: "RED", High: "ORANGE", Medium: "YELLOW", Low: "GRAY" };
+function miscoloredOptions(options, canon) {
+  return (options ?? []).filter((o) => canon[o.name] != null && o.color != null && o.color !== canon[o.name]).map((o) => `${o.name}=${o.color} (want ${canon[o.name]})`);
+}
 var requiredProjectWorkflows = [
   "Auto-add sub-issues to project",
   "Auto-archive items",
@@ -12537,6 +13854,23 @@ function localRegistryCheck(deps, path2, predicate) {
   if (text == null) return null;
   return predicate(safeJson2(text, null));
 }
+var DOC_PLACEHOLDER_PROMPTS = [
+  "languages, frameworks, major services",
+  "install, dev server",
+  "lint, typecheck, repo gate script",
+  "ports, env from vault not files",
+  "Describe the product/service",
+  "How to run, build, and test locally",
+  "System shape: components, data flow, deploy model",
+  "Build/test commands, CI gate, deploy target"
+];
+function unfilledDocPlaceholders(text) {
+  if (!text) return [];
+  const found = /* @__PURE__ */ new Set();
+  for (const m of text.match(/\{\{[A-Za-z0-9_]+\}\}/g) ?? []) found.add(m);
+  for (const prompt of DOC_PLACEHOLDER_PROMPTS) if (text.includes(prompt)) found.add(prompt);
+  return [...found];
+}
 async function verifyBootstrap(repo, repoClass, deps, releaseTrack) {
   const branchesWanted = expectedBranches(repoClass, releaseTrack);
   const baseBranch = releaseTrack === "trunk" || repoClass === "content" ? "main" : "development";
@@ -12600,6 +13934,19 @@ async function verifyBootstrap(repo, repoClass, deps, releaseTrack) {
     label: "README has Agent context section",
     detail: readme === null ? "README.md not readable via API" : void 0
   });
+  const readmePlaceholders = unfilledDocPlaceholders(readme);
+  checks.push({
+    ok: readmePlaceholders.length === 0,
+    label: "README Agent context is filled (no template placeholders)",
+    detail: readmePlaceholders.length ? `unfilled: ${readmePlaceholders.join(", ")}` : void 0
+  });
+  const architecture = await contentText(deps, repo, baseBranch, "architecture.md");
+  const archPlaceholders = unfilledDocPlaceholders(architecture);
+  checks.push({
+    ok: archPlaceholders.length === 0,
+    label: "architecture.md is filled (no template placeholders)",
+    detail: archPlaceholders.length ? `unfilled: ${archPlaceholders.join(", ")}` : void 0
+  });
   const agentRulesPath = `.cursor/rules/${repoSlugFromFullName(repo)}.mdc`;
   const agentRulesOk = await contentExists2(deps, repo, baseBranch, agentRulesPath);
   checks.push({
@@ -12614,6 +13961,8 @@ async function verifyBootstrap(repo, repoClass, deps, releaseTrack) {
   }
   const strays = strayDefaultLabels.filter((l) => labelNames.has(l));
   checks.push({ ok: strays.length === 0, label: "no stray GitHub-default labels", detail: presentDetail(strays) });
+  const priorityStrays = retiredPriorityLabels.filter((l) => labelNames.has(l));
+  checks.push({ ok: priorityStrays.length === 0, label: "no retired priority:* labels (#416)", detail: presentDetail(priorityStrays) });
   const actions = await restJson3(deps, `repos/${repo}/actions/permissions`, {});
   checks.push({ ok: actions.enabled === true, label: "GitHub Actions enabled" });
   const config = deps.projectMeta ?? null;
@@ -12629,7 +13978,7 @@ async function verifyBootstrap(repo, repoClass, deps, releaseTrack) {
     });
   }
   if (config?.projectOwner && config.projectNumber != null) {
-    const fieldsQuery = `query($login: String!, $number: Int!) { organization(login: $login) { projectV2(number: $number) { fields(first: 50) { nodes { ... on ProjectV2FieldCommon { id name } ... on ProjectV2SingleSelectField { id name options { id name } } } } } } }`;
+    const fieldsQuery = `query($login: String!, $number: Int!) { organization(login: $login) { projectV2(number: $number) { fields(first: 50) { nodes { ... on ProjectV2FieldCommon { id name } ... on ProjectV2SingleSelectField { id name options { id name color } } } } } } }`;
     const fields = await (async () => {
       try {
         const data = await deps.client.graphql(fieldsQuery, {
@@ -12670,6 +14019,12 @@ async function verifyBootstrap(repo, repoClass, deps, releaseTrack) {
           label: `registry status option matches project: ${optionName}`
         });
       }
+      const statusColorDrift = miscoloredOptions(statusField.options, canonicalStatusColors);
+      checks.push({
+        ok: statusColorDrift.length === 0,
+        label: "Project Status option colors canonical (#1543)",
+        detail: statusColorDrift.length ? `drifted: ${statusColorDrift.join(", ")}` : void 0
+      });
     }
     const priorityField = fields.find((field) => field.name === "Priority" && (field.options?.length ?? 0) > 0);
     checks.push({
@@ -12695,6 +14050,12 @@ async function verifyBootstrap(repo, repoClass, deps, releaseTrack) {
           label: `registry priority option matches project: ${optionName}`
         });
       }
+      const priorityColorDrift = miscoloredOptions(priorityField.options, canonicalPriorityColors);
+      checks.push({
+        ok: priorityColorDrift.length === 0,
+        label: "Project Priority option colors canonical (#1543)",
+        detail: priorityColorDrift.length ? `drifted: ${priorityColorDrift.join(", ")}` : void 0
+      });
     }
     const workflowQuery = "query($login: String!, $number: Int!) { organization(login: $login) { projectV2(number: $number) { workflows(first: 30) { nodes { name enabled } } } } }";
     const workflowResponse = await (async () => {
@@ -12732,340 +14093,57 @@ async function verifyBootstrap(repo, repoClass, deps, releaseTrack) {
     detail: orgRuleset ? void 0 : activeOrgRulesets.length === 0 ? "no active Organization-sourced branch ruleset targets this repo" : `missing rule types: ${missingOrgRuleTypes.join(", ")}`
   });
   if (repo === HUB_REPO4) {
-    const statusChecks = rulesetStatusChecks2(rulesets.filter((r) => r.target === "branch" && r.enforcement === "active"));
-    const missing = requiredHubStatusChecks.filter((check) => !statusChecks.has(check));
-    checks.push({
-      ok: missing.length === 0,
-      label: "Hub required status checks configured",
-      detail: optionDetail(missing)
-    });
-  } else if (repoClass === "deployable") {
-    const statusChecks = rulesetStatusChecks2(rulesets.filter((r) => r.target === "branch" && r.enforcement === "active"));
-    const missing = requiredProductStatusChecks.filter((check) => !statusChecks.has(check));
-    checks.push({
-      ok: missing.length === 0,
-      label: "product required status checks configured",
-      detail: missing.length ? `missing contexts: ${missing.join(", ")} \u2014 apply ${requiredProductRulesetRef} as an active repo ruleset` : void 0
-    });
-  }
-  const declaredApis = (deps.requiredGcpApis ?? []).filter((a) => a && a.trim());
-  if (declaredApis.length > 0) {
-    const slug = (repo.includes("/") ? repo.split("/")[1] : repo).toLowerCase();
-    const gcpProject = gcpProjectForSlug(slug);
-    const enabled = deps.listEnabledGcpApis ? await deps.listEnabledGcpApis(gcpProject) : null;
-    if (enabled == null) {
-      checks.push({
-        ok: false,
-        label: `required GCP APIs enabled in ${gcpProject}`,
-        detail: `could not list enabled APIs (gcloud unavailable, not authed, or no project ${gcpProject})`
-      });
-    } else {
-      const missing = findMissingGcpApis(declaredApis, enabled);
-      checks.push({
-        ok: missing.length === 0,
-        label: `required GCP APIs enabled in ${gcpProject}`,
-        detail: missing.length ? `disabled: ${missing.join(", ")}` : void 0
-      });
-    }
-  }
-  const waived = applyWaivers(checks, config?.verifyWaivers ?? []);
-  return { ok: waived.every((c) => c.ok || c.waived), repo, class: repoClass, baseBranch, checks: waived };
-}
-function applyWaivers(checks, waivers) {
-  if (!waivers?.length) return checks;
-  const set = new Set(waivers);
-  return checks.map((c) => !c.ok && set.has(c.label) ? { ...c, waived: true } : c);
-}
-function renderBootstrapVerifyReport(report) {
-  const lines = [`mmi-cli bootstrap verify: ${report.ok ? "OK" : "CHECK"} ${report.repo} (${report.class}, ${report.baseBranch})`];
-  for (const check of report.checks) {
-    const status = check.ok ? "OK" : check.waived ? "WAIVE" : "FAIL";
-    lines.push(`${status} ${check.label}${check.detail ? ` - ${check.detail}` : ""}`);
-  }
-  return lines.join("\n");
-}
-
-// src/bootstrap-apply.ts
-function parseOwnerRepo(repo) {
-  const trimmed = repo.trim();
-  const parts = trimmed.split("/");
-  if (parts.length !== 2 || !parts[0]?.trim() || !parts[1]?.trim()) {
-    throw new Error("repo must be owner/repo");
-  }
-  const owner = parts[0].trim();
-  const name = parts[1].trim();
-  if (owner.includes("\\") || name.includes("\\")) throw new Error("repo must be owner/repo");
-  return { owner, name, slug: name.toLowerCase(), fullName: `${owner}/${name}` };
-}
-var DEFAULT_INSTALL_CMD = "npm ci";
-var DEFAULT_GATE_CMD = "npm run check";
-function gateSeedVars(cls, releaseTrack) {
-  const track = releaseTrack ?? (cls === "content" ? "trunk" : "full");
-  if (track === "trunk") {
-    return {
-      GATE_CMD: DEFAULT_GATE_CMD,
-      GATE_PUSH_BRANCHES_YAML: "[main]",
-      GATE_FULL_RUN_BRANCH: "main",
-      GATE_RULESET_BRANCH_REFS_JSON: '["refs/heads/main"]'
-    };
-  }
-  if (track === "direct") {
-    return {
-      GATE_CMD: DEFAULT_GATE_CMD,
-      GATE_PUSH_BRANCHES_YAML: "[development, main]",
-      GATE_FULL_RUN_BRANCH: "development",
-      GATE_RULESET_BRANCH_REFS_JSON: '["refs/heads/development", "refs/heads/main"]'
-    };
-  }
-  return {
-    GATE_CMD: DEFAULT_GATE_CMD,
-    GATE_PUSH_BRANCHES_YAML: "[development, rc, main]",
-    GATE_FULL_RUN_BRANCH: "development",
-    GATE_RULESET_BRANCH_REFS_JSON: '["refs/heads/development", "refs/heads/rc", "refs/heads/main"]'
-  };
-}
-function withDerivedRepoVars(vars, parsed, cls, releaseTrack) {
-  const out = { ...vars };
-  out.REPO_NAME ??= parsed.name;
-  out.REPO_SLUG ??= parsed.slug;
-  out.CLASS ??= cls;
-  out.INSTALL_CMD ??= DEFAULT_INSTALL_CMD;
-  const track = releaseTrack ?? resolveBootstrapReleaseTrack(cls);
-  for (const [key, value] of Object.entries(gateSeedVars(cls, track))) {
-    out[key] ??= value;
-  }
-  return out;
-}
-function planSeedAction(seed, exists) {
-  if (seed.source === "fanout") {
-    return { target: seed.target, action: "skip", ownership: "fanout", reason: "delivered by the fanout pipeline" };
-  }
-  if (seed.source === "managed-block") {
-    return exists ? { target: seed.target, action: "update", ownership: "org", reason: "org-managed block merged in-place (repo-owned lines preserved)" } : { target: seed.target, action: "create", ownership: "org", reason: "org-managed block; .gitignore absent, created" };
-  }
-  if (seed.ownership === "repo") {
-    return exists ? { target: seed.target, action: "skip", ownership: "repo", reason: "repo-owned, already present (never clobbered)" } : { target: seed.target, action: "create", ownership: "repo", reason: "repo-owned, missing" };
-  }
-  return exists ? { target: seed.target, action: "update", ownership: "org", reason: "org-owned, refresh to current" } : { target: seed.target, action: "create", ownership: "org", reason: "org-owned, missing" };
-}
-function reconcileSeedAction(action, content, isManagedBlock) {
-  if (action.action === "skip") return action;
-  if (content == null) {
-    return { ...action, action: "skip", reason: "no resolvable content" };
-  }
-  if (isManagedBlock) return action;
-  const unfilled = missingPlaceholders(content);
-  if (unfilled.length) {
-    return { ...action, action: "skip", reason: `unfilled: ${unfilled.join(", ")} \u2014 pass --var` };
-  }
-  return action;
-}
-function renderSeedPlan(actions) {
-  const lines = ["bootstrap apply \u2014 seed plan (dry-run; no mutations):"];
-  for (const a of actions) {
-    lines.push(`  ${a.action.toUpperCase().padEnd(6)} ${a.target}  (${a.ownership}: ${a.reason})`);
-  }
-  const order = ["create", "update", "skip"];
-  lines.push(`  \u2014 ${order.map((k) => `${actions.filter((a) => a.action === k).length} ${k}`).join(", ")}`);
-  return lines.join("\n");
-}
-var GITHUB_DEFAULT_LABELS = [
-  "documentation",
-  "duplicate",
-  "enhancement",
-  "good first issue",
-  "help wanted",
-  "invalid",
-  "question",
-  "wontfix"
-];
-function labelsToPrune(orgLabelNames) {
-  const org = new Set(orgLabelNames);
-  return GITHUB_DEFAULT_LABELS.filter((name) => !org.has(name));
-}
-function resolveSeedContent(seed, vars, readFile5) {
-  if (seed.source === "self") return readFile5(seed.target);
-  if (seed.source.startsWith("seed:")) {
-    const tmpl = readFile5(`skills/bootstrap/seeds/${seed.source.slice("seed:".length)}`);
-    return tmpl == null ? null : renderSeed(tmpl, vars);
-  }
-  return null;
-}
-function buildRegisterPayload(repo, cls, vars, options = {}) {
-  const parsedRepo = parseOwnerRepo(repo);
-  const slug = parsedRepo.slug;
-  if (options.projectType && !isProjectType(options.projectType)) {
-    throw new Error(`projectType must be one of: ${PROJECT_TYPES.join(", ")}`);
-  }
-  if (options.deployModel && !isDeployModel(options.deployModel)) {
-    throw new Error(`deployModel must be one of: ${DEPLOY_MODELS.join(", ")}`);
-  }
-  if (options.releaseTrack && !isReleaseTrack(options.releaseTrack)) {
-    throw new Error("releaseTrack must be full, direct, or trunk");
-  }
-  const shape = {
-    class: cls,
-    projectType: options.projectType,
-    deployModel: options.deployModel
-  };
-  const projectType = resolveProjectTypeConfident(shape, parsedRepo.fullName);
-  if (!projectType) {
-    throw new Error(
-      `Project type for ${parsedRepo.fullName} is unset and not derivable \u2014 pass --project-type <${PROJECT_TYPES.join("|")}> and --deploy-model <${DEPLOY_MODELS.join("|")}> (prevents defaulting a non-web repo to tenant-container).`
-    );
-  }
-  const deployModel = resolveDeployModel({ ...shape, projectType }, parsedRepo.fullName);
-  const num = (v) => {
-    if (v == null || v === "") return void 0;
-    const n = Number(v);
-    return Number.isFinite(n) ? n : void 0;
-  };
-  const statusOptions = vars.STATUS_TODO || vars.STATUS_IN_PROGRESS || vars.STATUS_IN_REVIEW || vars.STATUS_DONE ? {
-    Todo: vars.STATUS_TODO,
-    "In Progress": vars.STATUS_IN_PROGRESS,
-    "In Review": vars.STATUS_IN_REVIEW,
-    Done: vars.STATUS_DONE
-  } : void 0;
-  const priorityOptions = vars.PRIORITY_URGENT || vars.PRIORITY_HIGH || vars.PRIORITY_MEDIUM || vars.PRIORITY_LOW ? {
-    Urgent: vars.PRIORITY_URGENT,
-    High: vars.PRIORITY_HIGH,
-    Medium: vars.PRIORITY_MEDIUM,
-    Low: vars.PRIORITY_LOW
-  } : void 0;
-  const payload = {
-    slug,
-    // Identity. name/division default off the repo name when the skill didn't pass them.
-    name: vars.NAME || parsedRepo.name,
-    division: vars.DIVISION || parsedRepo.name.split("-")[0] || void 0,
-    repos: [`${parsedRepo.owner}/${slug}`],
-    wikiRepo: vars.WIKI_REPO || parsedRepo.fullName,
-    branch: vars.BRANCH || (cls === "content" ? "main" : "development"),
-    class: cls,
-    projectType,
-    deployModel,
-    // #1359: always persist an explicit track so release tooling never guesses from absence alone.
-    releaseTrack: resolveBootstrapReleaseTrack(cls, options.releaseTrack),
-    // Board coords (from GraphQL at bootstrap, passed as --var by the skill).
-    projectOwner: vars.PROJECT_OWNER || void 0,
-    projectNumber: num(vars.PROJECT_NUMBER),
-    projectId: vars.PROJECT_ID || void 0,
-    statusFieldId: vars.STATUS_FIELD_ID || void 0,
-    statusOptions,
-    priorityFieldId: vars.PRIORITY_FIELD_ID || void 0,
-    priorityOptions,
-    // Pointers. vaultPath is explicit + canonical; kbPointer is the per-project KB doc path.
-    vaultPath: `/mmi-future/${slug}`,
-    kbPointer: `kb/projects/${slug}.md`
-  };
-  for (const k of Object.keys(payload)) if (payload[k] === void 0) delete payload[k];
-  if (payload.projectId && payload.projectNumber == null) {
-    throw new Error(
-      "bootstrap apply: PROJECT_ID is set but PROJECT_NUMBER is missing \u2014 pass --var PROJECT_NUMBER=<N> or ensure the live board GraphQL query succeeds"
-    );
-  }
-  return payload;
-}
-var BOARD_FIELD_VAR_MAP = {
-  Status: {
-    fieldIdVar: "STATUS_FIELD_ID",
-    options: { Todo: "STATUS_TODO", "In Progress": "STATUS_IN_PROGRESS", "In Review": "STATUS_IN_REVIEW", Done: "STATUS_DONE" }
-  },
-  Priority: {
-    fieldIdVar: "PRIORITY_FIELD_ID",
-    options: { Urgent: "PRIORITY_URGENT", High: "PRIORITY_HIGH", Medium: "PRIORITY_MEDIUM", Low: "PRIORITY_LOW" }
-  }
-};
-function projectV2BoardNode(fieldsJson) {
-  if (Array.isArray(fieldsJson)) return { fields: { nodes: fieldsJson } };
-  const wrapped = fieldsJson;
-  return wrapped?.data?.node ?? wrapped?.node;
-}
-function extractBoardFieldVars(fieldsJson) {
-  const out = {};
-  const projectNode = projectV2BoardNode(fieldsJson);
-  if (typeof projectNode?.number === "number" && Number.isFinite(projectNode.number)) {
-    out.PROJECT_NUMBER = String(projectNode.number);
+    const statusChecks = rulesetStatusChecks2(rulesets.filter((r) => r.target === "branch" && r.enforcement === "active"));
+    const missing = requiredHubStatusChecks.filter((check) => !statusChecks.has(check));
+    checks.push({
+      ok: missing.length === 0,
+      label: "Hub required status checks configured",
+      detail: optionDetail(missing)
+    });
+  } else if (repoClass === "deployable") {
+    const statusChecks = rulesetStatusChecks2(rulesets.filter((r) => r.target === "branch" && r.enforcement === "active"));
+    const missing = requiredProductStatusChecks.filter((check) => !statusChecks.has(check));
+    checks.push({
+      ok: missing.length === 0,
+      label: "product required status checks configured",
+      detail: missing.length ? `missing contexts: ${missing.join(", ")} \u2014 apply ${requiredProductRulesetRef} as an active repo ruleset` : void 0
+    });
   }
-  const nodes = projectNode?.fields?.nodes;
-  if (!Array.isArray(nodes)) return out;
-  for (const node of nodes) {
-    const field = node;
-    const name = typeof field.name === "string" ? field.name : void 0;
-    const map = name ? BOARD_FIELD_VAR_MAP[name] : void 0;
-    if (!map || typeof field.id !== "string" || !field.id) continue;
-    out[map.fieldIdVar] = field.id;
-    const options = Array.isArray(field.options) ? field.options : [];
-    for (const opt of options) {
-      const o = opt;
-      const varName = typeof o.name === "string" ? map.options[o.name] : void 0;
-      if (varName && typeof o.id === "string" && o.id) out[varName] = o.id;
+  const declaredApis = (deps.requiredGcpApis ?? []).filter((a) => a && a.trim());
+  if (declaredApis.length > 0) {
+    const slug = (repo.includes("/") ? repo.split("/")[1] : repo).toLowerCase();
+    const gcpProject = gcpProjectForSlug(slug);
+    const enabled = deps.listEnabledGcpApis ? await deps.listEnabledGcpApis(gcpProject) : null;
+    if (enabled == null) {
+      checks.push({
+        ok: false,
+        label: `required GCP APIs enabled in ${gcpProject}`,
+        detail: `could not list enabled APIs (gcloud unavailable, not authed, or no project ${gcpProject})`
+      });
+    } else {
+      const missing = findMissingGcpApis(declaredApis, enabled);
+      checks.push({
+        ok: missing.length === 0,
+        label: `required GCP APIs enabled in ${gcpProject}`,
+        detail: missing.length ? `disabled: ${missing.join(", ")}` : void 0
+      });
     }
   }
-  return out;
-}
-function boardFieldsQueryArgs(projectId) {
-  const query = "query($id: ID!) { node(id: $id) { ... on ProjectV2 { number fields(first: 50) { nodes { ... on ProjectV2SingleSelectField { id name options { id name } } } } } } }";
-  return ["api", "graphql", "-f", `query=${query}`, "-f", `id=${projectId}`];
-}
-function serializeRegistry(obj) {
-  return `${JSON.stringify(obj, null, 2)}
-`;
+  const waived = applyWaivers(checks, config?.verifyWaivers ?? []);
+  return { ok: waived.every((c) => c.ok || c.waived), repo, class: repoClass, baseBranch, checks: waived };
 }
-function planFanoutRegistration(fanoutTargetsRaw, projectsRaw, entry) {
-  const fanout = JSON.parse(fanoutTargetsRaw);
-  const projects = JSON.parse(projectsRaw);
-  const fanoutRepos = Array.isArray(fanout.repos) ? fanout.repos : [];
-  const projectEntries = Array.isArray(projects.projects) ? projects.projects : [];
-  const name = entry.name ?? entry.repo;
-  const canonName = entry.repo.toLowerCase();
-  const inFanout = fanoutRepos.some((r) => typeof r.repo === "string" && r.repo.toLowerCase() === canonName);
-  const inProjects = projectEntries.some(
-    (p) => p.slug === entry.slug || Array.isArray(p.repos) && p.repos.some((full) => String(full).split("/").pop()?.toLowerCase() === canonName)
-  );
-  if (inFanout || inProjects) {
-    return { changed: false, fanoutTargets: fanoutTargetsRaw, projects: projectsRaw };
-  }
-  const projectEntry = {
-    name,
-    slug: entry.slug,
-    projectId: entry.projectId,
-    wikiRepo: entry.wikiRepo,
-    repos: [`mutmutco/${entry.repo}`]
-  };
-  if (entry.cls === "content") projectEntry.branch = "main";
-  for (const k of Object.keys(projectEntry)) if (projectEntry[k] === void 0) delete projectEntry[k];
-  const nextProjects = { ...projects, projects: [...projectEntries, projectEntry] };
-  const fanoutEntry = { repo: entry.repo, branch: entry.branch, class: entry.cls };
-  const nextFanout = { ...fanout, repos: [...fanoutRepos, fanoutEntry] };
-  return {
-    changed: true,
-    fanoutTargets: serializeRegistry(nextFanout),
-    projects: serializeRegistry(nextProjects)
-  };
+function applyWaivers(checks, waivers) {
+  if (!waivers?.length) return checks;
+  const set = new Set(waivers);
+  return checks.map((c) => !c.ok && set.has(c.label) ? { ...c, waived: true } : c);
 }
-function decideFanoutPrAction(openPrs) {
-  const list = Array.isArray(openPrs) ? openPrs : [];
-  for (const pr2 of list) {
-    const url = pr2?.url;
-    if (typeof url === "string" && url.trim()) return { action: "reuse", url: url.trim() };
+function renderBootstrapVerifyReport(report) {
+  const lines = [`mmi-cli bootstrap verify: ${report.ok ? "OK" : "CHECK"} ${report.repo} (${report.class}, ${report.baseBranch})`];
+  for (const check of report.checks) {
+    const status = check.ok ? "OK" : check.waived ? "WAIVE" : "FAIL";
+    lines.push(`${status} ${check.label}${check.detail ? ` - ${check.detail}` : ""}`);
   }
-  return { action: "create" };
-}
-function contentPutArgs(repo, path2, content, branch, sha) {
-  const args = [
-    "api",
-    "-X",
-    "PUT",
-    `repos/${repo}/contents/${path2.split("/").map(encodeURIComponent).join("/")}`,
-    "-f",
-    `message=bootstrap: seed ${path2}`,
-    "-f",
-    `content=${Buffer.from(content, "utf8").toString("base64")}`,
-    "-f",
-    `branch=${branch}`
-  ];
-  if (sha) args.push("-f", `sha=${sha}`);
-  return args;
+  return lines.join("\n");
 }
 
 // ../infra/registry-endpoints.mjs
@@ -13244,6 +14322,12 @@ function renderVerifySecrets(body) {
 }
 
 // src/project-readiness.ts
+function stagesForTrack(meta) {
+  return branchesForTrack(resolveReleaseTrack(meta)).map((b) => b === "development" ? "dev" : b);
+}
+function stageInTrack(meta, stage2) {
+  return stagesForTrack(meta).includes(stage2);
+}
 function dnsErrorToResolution(code) {
   return code === "ENOTFOUND" || code === "EAI_NONAME" ? false : void 0;
 }
@@ -13551,15 +14635,15 @@ async function buildV2Doctor(repoOrSlug, deps) {
     secretsError = e?.message || "secrets list failed";
   }
   const deployCoords = Object.fromEntries(await Promise.all(STAGES.map(async (stage2) => {
-    const required = projectRequiresDeployCoords(model, stage2, meta);
+    const required = stageInTrack(meta, stage2) && projectRequiresDeployCoords(model, stage2, meta);
     return [stage2, { required, ok: required ? await deps.hasDeployCoords(slug, stage2) : true }];
   })));
   const deployState = Object.fromEntries(await Promise.all(STAGES.map(async (stage2) => {
-    const required = projectRequiresDeployState(model, stage2);
+    const required = stageInTrack(meta, stage2) && projectRequiresDeployState(model, stage2);
     return [stage2, { required, ok: required ? await deps.hasDeployState(slug, stage2) : true }];
   })));
   const secrets2 = Object.fromEntries(STAGES.map((stage2) => {
-    const required = stageRequiredSecrets(stage2, meta).map((key) => stageKey2(stage2, key));
+    const required = stageInTrack(meta, stage2) ? stageRequiredSecrets(stage2, meta).map((key) => stageKey2(stage2, key)) : [];
     const present = required.filter((key) => presentSecrets.has(key));
     const missing = required.filter((key) => !presentSecrets.has(key));
     return [stage2, { required, present, missing }];
@@ -13624,7 +14708,7 @@ ${section}`.trim();
 }
 
 // src/project-set.ts
-var UNSET_KEYS = ["oauth", "requiredRuntimeSecrets", "edgeDomains", "requiredGcpApis", "publishRequired"];
+var UNSET_KEYS = ["oauth", "requiredRuntimeSecrets", "edgeDomains", "requiredGcpApis", "publishRequired", "ci", "requiredChecks", "gate"];
 var UNSET_KEY_SET = new Set(UNSET_KEYS);
 var RUNTIME_SECRET_STAGES = ["dev", "rc", "main"];
 function parseRuntimeSecretsVar(raw) {
@@ -13783,6 +14867,43 @@ function parsePublishRequiredVar(raw) {
   if (raw === "false") return false;
   throw new Error("project set: publishRequired must be true or false");
 }
+function parseRequiredChecksVar(raw) {
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    throw new Error('project set: requiredChecks must be a JSON array, e.g. ["gate"] or [] for an intentional no-ci repo');
+  }
+  if (!Array.isArray(parsed) || parsed.some((c) => typeof c !== "string" || !c.trim())) {
+    throw new Error("project set: requiredChecks must be a JSON array of non-empty check-context strings (use [] for none)");
+  }
+  return parsed.map((c) => c.trim());
+}
+function parseGateVar(raw) {
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    throw new Error('project set: gate must be JSON, e.g. {"runtime":"python","cmd":"pytest","workdir":"app"}');
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new Error("project set: gate must be a {runtime,cmd,workdir,cacheDepPath,pyVersion} object");
+  }
+  const map = parsed;
+  const out = {};
+  for (const [key, value] of Object.entries(map)) {
+    if (key === "runtime") {
+      if (value !== "node" && value !== "python") throw new Error('project set: gate.runtime must be "node" or "python"');
+      out.runtime = value;
+    } else if (key === "cmd" || key === "workdir" || key === "cacheDepPath" || key === "pyVersion") {
+      if (typeof value !== "string" || !value.trim()) throw new Error(`project set: gate.${key} must be a non-empty string`);
+      out[key] = value.trim();
+    } else {
+      throw new Error(`project set: gate key "${key}" \u2014 expected only runtime/cmd/workdir/cacheDepPath/pyVersion`);
+    }
+  }
+  return out;
+}
 var SETTABLE_VAR_KEYS = [
   "name",
   "division",
@@ -13803,7 +14924,10 @@ var SETTABLE_VAR_KEYS = [
   "statusOptions",
   "priorityFieldId",
   "priorityOptions",
-  "portRange"
+  "portRange",
+  "ci",
+  "requiredChecks",
+  "gate"
 ];
 var SETTABLE_VAR_KEY_SET = new Set(SETTABLE_VAR_KEYS);
 var SETTABLE_VAR_HINTS = {
@@ -13816,7 +14940,10 @@ var SETTABLE_VAR_HINTS = {
   edgeDomains: "JSON {dev,rc,main} domain map",
   statusOptions: "JSON name\u2192id map",
   priorityOptions: "JSON {Urgent,High,Medium,Low}\u2192id map",
-  portRange: "JSON {start,end} or [start,end]"
+  portRange: "JSON {start,end} or [start,end]",
+  ci: "none \u2014 declare intentional no-ci",
+  requiredChecks: 'JSON array, e.g. ["gate"] or [] for no-ci',
+  gate: "JSON {runtime,cmd,workdir,cacheDepPath,pyVersion}"
 };
 function settableVarHelp() {
   const keys = SETTABLE_VAR_KEYS.map((k) => {
@@ -13879,6 +15006,13 @@ function buildProjectSetPatch(input) {
       patch[key] = parseReposVar(raw);
     } else if (key === "publishRequired") {
       patch[key] = parsePublishRequiredVar(raw);
+    } else if (key === "ci") {
+      if (raw !== "none") throw new Error('project set: ci must be "none" (or use --unset ci to require checks)');
+      patch[key] = raw;
+    } else if (key === "requiredChecks") {
+      patch[key] = parseRequiredChecksVar(raw);
+    } else if (key === "gate") {
+      patch[key] = parseGateVar(raw);
     } else {
       patch[key] = raw;
     }
@@ -13919,8 +15053,8 @@ function resolveKbSource(rawBase) {
   return { owner: m[1], repo: m[2], ref: m[3] };
 }
 function buildKbGetArgs(src, path2) {
-  const clean3 = path2.replace(/^\/+/, "");
-  return ["api", `repos/${src.owner}/${src.repo}/contents/${clean3}?ref=${src.ref}`, "-H", "Accept: application/vnd.github.raw"];
+  const clean4 = path2.replace(/^\/+/, "");
+  return ["api", `repos/${src.owner}/${src.repo}/contents/${clean4}?ref=${src.ref}`, "-H", "Accept: application/vnd.github.raw"];
 }
 function buildKbTreeArgs(src) {
   return ["api", `repos/${src.owner}/${src.repo}/git/trees/${src.ref}?recursive=1`];
@@ -13937,10 +15071,10 @@ function parseKbTree(stdout, prefix) {
 }
 
 // src/plan.ts
-var import_node_path13 = require("node:path");
+var import_node_path16 = require("node:path");
 var PLANS_DIR = "plans";
-var META_FILE = (0, import_node_path13.join)(PLANS_DIR, ".plan-meta.json");
-var planPath = (slug) => (0, import_node_path13.join)(PLANS_DIR, `${slug}.md`);
+var META_FILE = (0, import_node_path16.join)(PLANS_DIR, ".plan-meta.json");
+var planPath = (slug) => (0, import_node_path16.join)(PLANS_DIR, `${slug}.md`);
 var metaKey = (project2, slug) => `${project2}/${slug}`;
 function parseMeta(raw) {
   if (!raw) return {};
@@ -13965,7 +15099,7 @@ function hashContent(s) {
 function staleHint(slug) {
   return `remote "${slug}" is newer \u2014 run \`mmi-cli northstar pull ${slug}\` first (your local is based on an older version), or re-push with \`--force\` to overwrite`;
 }
-var INDEX_FILE = (0, import_node_path13.join)(PLANS_DIR, ".index.json");
+var INDEX_FILE = (0, import_node_path16.join)(PLANS_DIR, ".index.json");
 var INDEX_TTL_MS = 6e4;
 function parseIndex(raw) {
   if (!raw) return null;
@@ -13994,7 +15128,7 @@ function mergeIndex(idx, scope, plans, now) {
   const mergedScope = idx.scope === null ? null : [.../* @__PURE__ */ new Set([...idx.scope, ...scope])];
   return { fetchedAt: now, scope: mergedScope, plans: [...kept, ...plans] };
 }
-var QUEUE_FILE = (0, import_node_path13.join)(PLANS_DIR, ".sync-queue.json");
+var QUEUE_FILE = (0, import_node_path16.join)(PLANS_DIR, ".sync-queue.json");
 var QUEUE_MAX_ATTEMPTS = 10;
 function isValidQueueEntry(e) {
   if (!e || typeof e !== "object") return false;
@@ -14163,6 +15297,16 @@ async function planPull(deps, slug, opts = {}) {
     deps.err(`local ${planPath(slug)} has unpushed edits \u2014 push it, or pull with --force to overwrite`);
     return false;
   }
+  if (local != null && !opts.force) {
+    const queued = parseQueue(deps.readQueueRaw()).find((e) => e.project === project2 && e.slug === slug);
+    if (queued) {
+      const state = queued.conflict ?? queued.deadLettered ?? "still pending";
+      deps.err(
+        `local ${planPath(slug)} has an unpushed edit queued (${state}) \u2014 land it with \`mmi-cli northstar push ${slug} --wait\`, or pull with --force to discard your local edit`
+      );
+      return false;
+    }
+  }
   const qs = new URLSearchParams({ project: project2, slug }).toString();
   const res = await deps.fetch(`${deps.apiUrl}/plan/get?${qs}`, {
     method: "GET",
@@ -14372,6 +15516,7 @@ async function planSync(deps, opts = {}) {
   } catch (e) {
     if (!opts.quiet) deps.err(`northstar sync: list refresh failed: ${e.message}`);
   }
+  return kept;
 }
 async function planStatus(deps, opts = {}) {
   const queue = parseQueue(deps.readQueueRaw());
@@ -14443,11 +15588,11 @@ async function planGraduate(deps, slug, opts = {}) {
 }
 
 // src/atomic-write.ts
-var import_node_fs15 = require("node:fs");
+var import_node_fs18 = require("node:fs");
 function atomicWriteFileSync(path2, content) {
   const tmp = `${path2}.${process.pid}.tmp`;
-  (0, import_node_fs15.writeFileSync)(tmp, content, "utf8");
-  (0, import_node_fs15.renameSync)(tmp, path2);
+  (0, import_node_fs18.writeFileSync)(tmp, content, "utf8");
+  (0, import_node_fs18.renameSync)(tmp, path2);
 }
 
 // src/oauth.ts
@@ -14678,7 +15823,7 @@ async function fetchHubVersionInfo(baseUrl) {
 }
 function readRepoVersion() {
   try {
-    return JSON.parse((0, import_node_fs16.readFileSync)((0, import_node_path14.join)(process.cwd(), ".claude-plugin", "plugin.json"), "utf8")).version || void 0;
+    return JSON.parse((0, import_node_fs19.readFileSync)((0, import_node_path17.join)(process.cwd(), ".claude-plugin", "plugin.json"), "utf8")).version || void 0;
   } catch {
     return void 0;
   }
@@ -14770,7 +15915,7 @@ async function applyCodexPluginHeal(surface, log) {
   return true;
 }
 var program2 = new Command();
-program2.name("mmi-cli").description("MMI Future CLI \u2014 org rules delivery, saga, KB. The engine the plugin SessionStart hook drives.").version(resolveClientVersion());
+program2.name("mmi-cli").description("MMI Future CLI \u2014 org rules delivery, saga, KB. The engine the plugin SessionStart hook drives.").version(resolveClientVersion()).showHelpAfterError("(run `mmi-cli commands` to list every subcommand + its flags, or `mmi-cli commands --json` to ground against it)");
 async function runRulesSync(opts, io = consoleIo) {
   const cfg = await loadConfig();
   if (isRulesSource(cfg.orgRulesSource)) {
@@ -14804,11 +15949,11 @@ async function runRulesSync(opts, io = consoleIo) {
   for (const entry of fetched) {
     if ("error" in entry) continue;
     const { file, source } = entry;
-    const current = (0, import_node_fs16.existsSync)(file) ? await (0, import_promises5.readFile)(file, "utf8") : null;
+    const current = (0, import_node_fs19.existsSync)(file) ? await (0, import_promises6.readFile)(file, "utf8") : null;
     if (needsUpdate(source, current)) {
       const slash = file.lastIndexOf("/");
-      if (slash > 0) (0, import_node_fs16.mkdirSync)(file.slice(0, slash), { recursive: true });
-      await (0, import_promises5.writeFile)(file, normalizeEol(source), "utf8");
+      if (slash > 0) (0, import_node_fs19.mkdirSync)(file.slice(0, slash), { recursive: true });
+      await (0, import_promises6.writeFile)(file, normalizeEol(source), "utf8");
       changed++;
       if (!opts.quiet) io.log(`mmi-cli rules: updated ${file}`);
     }
@@ -14833,9 +15978,9 @@ async function runDocsSync(opts, io = consoleIo) {
         return null;
       }
     },
-    localContent: async (f) => (0, import_node_fs16.existsSync)(f) ? await (0, import_promises5.readFile)(f, "utf8") : null,
+    localContent: async (f) => (0, import_node_fs19.existsSync)(f) ? await (0, import_promises6.readFile)(f, "utf8") : null,
     writeDoc: async (f, c) => {
-      await (0, import_promises5.writeFile)(f, c, "utf8");
+      await (0, import_promises6.writeFile)(f, c, "utf8");
     }
   });
   for (const f of result.updated) io.log(`mmi-cli docs: updated ${f} (from origin/${def})`);
@@ -14845,7 +15990,13 @@ async function runDocsSync(opts, io = consoleIo) {
 var docs = program2.command("docs").description("repo-owned authoritative docs");
 docs.command("sync").option("--quiet", "stay silent unless something changed or errored").description("refresh README.md / architecture.md from the repo default branch (keeper-authored); never clobbers uncommitted edits").action((opts) => runDocsSync(opts));
 registerSagaCommands(program2);
+registerHandoffCommands(program2);
 registerHonchoCommands(program2);
+registerScroogeCommands(program2);
+program2.command("commands").description("print the command manifest \u2014 every subcommand + its flags (ground against this instead of guessing)").option("--json", "machine-readable JSON: { name, version, tree, index } \u2014 index is a flat list of every leaf command path").action((o) => {
+  const manifest = buildCommandManifest(program2);
+  consoleIo.log(o.json ? JSON.stringify(manifest, null, 2) : formatManifestHuman(manifest));
+});
 async function runWhoami(io = consoleIo) {
   const cfg = await loadConfig();
   const report = await resolveWhoami({
@@ -14858,8 +16009,18 @@ async function runWhoami(io = consoleIo) {
 program2.command("whoami").description('resolve the logged-in human: {login, source, sessionExpiresAt} JSON; source "unknown" (exit 0) when neither the Hub session nor gh can name them').option("--json", "machine-readable output (default)").action(async () => {
   await runWhoami();
 });
-program2.command("gc").description("dry-run cleanup for merged/closed PR branches and stale tracking refs").option("--dry-run", "show what would be deleted (default)").option("--apply", "delete only the listed clean merged/closed PR branches and stale tracking refs").option("--json", "machine-readable output").option("--remote <name>", "remote name", "origin").option("--limit <n>", "PRs to inspect per state", "200").action(async (o) => {
+program2.command("gc").description("dry-run cleanup for merged/closed PR branches and stale tracking refs (--scratch: stale local saga/plan/honcho files)").option("--dry-run", "show what would be deleted (default)").option("--apply", "delete only the listed clean merged/closed PR branches and stale tracking refs").option("--json", "machine-readable output").option("--scratch", "prune stale local saga/plan/honcho scratch already recorded remotely (#1474) instead of git branches/refs").option("--remote <name>", "remote name", "origin").option("--limit <n>", "PRs to inspect per state", "200").action(async (o) => {
   if (o.apply && o.dryRun) return fail("gc: choose either --dry-run or --apply");
+  if (o.scratch) {
+    try {
+      const root = (await execFileP2("git", ["rev-parse", "--show-toplevel"], { timeout: GIT_TIMEOUT_MS }).catch(() => ({ stdout: "" }))).stdout.trim() || process.cwd();
+      const run = executeScratchGc(root, { apply: Boolean(o.apply) });
+      if (o.json) return console.log(JSON.stringify({ dryRun: !o.apply, ...run }, null, 2));
+      return console.log(formatScratchGcPlan(run.plan, Boolean(o.apply)));
+    } catch (e) {
+      return fail(`gc --scratch: ${e.message}`);
+    }
+  }
   const limit = Number.parseInt(o.limit, 10);
   if (!Number.isFinite(limit) || limit < 1) return fail("gc: --limit must be a positive integer");
   try {
@@ -14887,6 +16048,120 @@ ${renderGcApplyResult(applyResult)}`);
     fail(`gc: ${e.message}`);
   }
 });
+var NPM_PROVISION_TIMEOUT_MS = 3e5;
+var WORKTREE_SETUP_LOCK_TTL_MS = 10 * 6e4;
+function runWorktreeInstall(command, cwd, quiet) {
+  const [bin, ...args] = command.split(" ");
+  const file = isWin ? "cmd.exe" : bin;
+  const spawnArgs = isWin ? ["/c", bin, ...args] : args;
+  return new Promise((resolve, reject) => {
+    const child = (0, import_node_child_process10.spawn)(file, spawnArgs, { cwd, stdio: quiet ? "ignore" : "inherit", windowsHide: true });
+    const timer = setTimeout(() => {
+      try {
+        child.kill();
+      } catch {
+      }
+      reject(new Error(`${command} timed out after ${NPM_PROVISION_TIMEOUT_MS}ms in ${cwd}`));
+    }, NPM_PROVISION_TIMEOUT_MS);
+    child.on("error", (e) => {
+      clearTimeout(timer);
+      reject(e);
+    });
+    child.on("exit", (code) => {
+      clearTimeout(timer);
+      if (code === 0) resolve();
+      else reject(new Error(`${command} exited ${code} in ${cwd}`));
+    });
+  });
+}
+async function primaryCheckoutRoot(worktreeRoot) {
+  try {
+    const out = (await execFileP2("git", ["-C", worktreeRoot, "rev-parse", "--path-format=absolute", "--git-common-dir"], { timeout: GIT_TIMEOUT_MS })).stdout.trim();
+    return out ? (0, import_node_path17.dirname)(out) : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function makeProvisionDeps(worktreeRoot, quiet, log) {
+  return {
+    runInstall: (command, cwd) => runWorktreeInstall(command, cwd, quiet),
+    primaryCheckout: () => primaryCheckoutRoot(worktreeRoot),
+    log
+  };
+}
+function acquireWorktreeSetupLock(worktreeRoot) {
+  const lockPath = (0, import_node_path17.join)(worktreeRoot, ".mmi", "worktree-setup.lock");
+  const take = () => {
+    const fd = (0, import_node_fs19.openSync)(lockPath, "wx");
+    try {
+      (0, import_node_fs19.writeSync)(fd, String(Date.now()));
+    } finally {
+      (0, import_node_fs19.closeSync)(fd);
+    }
+    return () => {
+      try {
+        (0, import_node_fs19.rmSync)(lockPath, { force: true });
+      } catch {
+      }
+    };
+  };
+  try {
+    (0, import_node_fs19.mkdirSync)((0, import_node_path17.dirname)(lockPath), { recursive: true });
+    return take();
+  } catch {
+    try {
+      if (Date.now() - (0, import_node_fs19.statSync)(lockPath).mtimeMs > WORKTREE_SETUP_LOCK_TTL_MS) {
+        (0, import_node_fs19.rmSync)(lockPath, { force: true });
+        return take();
+      }
+    } catch {
+    }
+    return null;
+  }
+}
+var worktree = program2.command("worktree").description("self-provisioning worktrees \u2014 install deps + copy local-only config");
+worktree.command("create <branch>").description("create a worktree from a base ref and provision it (install deps + copy local-only config)").option("--from <ref>", "base ref to branch from", "origin/development").option("--path <path>", "worktree path (default: ../mmi-worktrees/<branch>)").option("--remote <name>", "remote to fetch the base from", "origin").option("--json", "machine-readable output").action(async (branch, o) => {
+  try {
+    const repoRoot = (await execFileP2("git", ["rev-parse", "--show-toplevel"], { timeout: GIT_TIMEOUT_MS }).catch(() => ({ stdout: "" }))).stdout.trim() || process.cwd();
+    const wtPath = o.path ?? defaultWorktreePath(repoRoot, branch);
+    const baseBranch = o.from.startsWith(`${o.remote}/`) ? o.from.slice(o.remote.length + 1) : void 0;
+    if (baseBranch) await execFileP2("git", ["fetch", o.remote, baseBranch], { timeout: GH_MUTATION_TIMEOUT_MS }).catch(() => void 0);
+    await execFileP2("git", ["worktree", "add", wtPath, "-b", branch, o.from], { timeout: GH_MUTATION_TIMEOUT_MS });
+    const report = await provisionWorktree(wtPath, makeProvisionDeps(wtPath, Boolean(o.json), (m) => {
+      if (!o.json) console.error(`  ${m}`);
+    }));
+    if (o.json) return console.log(JSON.stringify({ branch, path: wtPath, base: o.from, ...report }, null, 2));
+    console.log(`worktree ready: ${wtPath} (branch ${branch} from ${o.from})`);
+    console.log(`  installed: ${report.installed.map((i) => i.dir || ".").join(", ") || "none"}`);
+    console.log(`  copied: ${report.copied.join(", ") || "none"}`);
+  } catch (e) {
+    fail(`worktree create: ${e.message}`);
+  }
+});
+worktree.command("setup [path]").description("provision an existing worktree (install missing deps + copy local-only config); fired automatically by SessionStart").option("--quiet", "no output on success (for the detached SessionStart auto-fire worker)").option("--json", "machine-readable output").action(async (path2, o) => {
+  const root = path2 ?? process.cwd();
+  const release = acquireWorktreeSetupLock(root);
+  if (!release) {
+    if (!o.quiet && !o.json) console.log("worktree setup: another provision is in progress \u2014 skipping");
+    return;
+  }
+  try {
+    const report = await provisionWorktree(root, makeProvisionDeps(root, Boolean(o.quiet), (m) => {
+      if (!o.quiet && !o.json) console.error(`  ${m}`);
+    }));
+    if (o.json) return console.log(JSON.stringify({ path: root, ...report }, null, 2));
+    if (!o.quiet) {
+      console.log(`worktree provisioned: ${root}`);
+      console.log(`  installed: ${report.installed.map((i) => i.dir || ".").join(", ") || "none"}`);
+      console.log(`  copied: ${report.copied.join(", ") || "none"}`);
+    }
+  } catch (e) {
+    if (o.quiet) return void console.error(`[worktree-setup] ${e.message}`);
+    fail(`worktree setup: ${e.message}`);
+  } finally {
+    release();
+  }
+});
 var kb = program2.command("kb").description("org knowledgebase (read-only)");
 kb.command("get <path>").description("print a KB document by path").action(async (path2) => {
   const src = resolveKbSource((await loadConfig()).kbSource);
@@ -15006,7 +16281,7 @@ function detachPlanSync() {
   }
 }
 function makePlanDeps(cfg, io = consoleIo) {
-  const ensureDir = () => (0, import_node_fs16.mkdirSync)(PLANS_DIR, { recursive: true });
+  const ensureDir = () => (0, import_node_fs19.mkdirSync)(PLANS_DIR, { recursive: true });
   return {
     apiUrl: cfg.sagaApiUrl,
     fetch: (url, init = {}) => fetch(url, { ...init, signal: init.signal ?? AbortSignal.timeout(1e4) }),
@@ -15014,24 +16289,24 @@ function makePlanDeps(cfg, io = consoleIo) {
     project: async () => (await sagaKey(cfg)).project,
     readLocal: (slug) => {
       try {
-        return (0, import_node_fs16.readFileSync)(planPath(slug), "utf8");
+        return (0, import_node_fs19.readFileSync)(planPath(slug), "utf8");
       } catch {
         return null;
       }
     },
     writeLocal: (slug, content) => {
       ensureDir();
-      (0, import_node_fs16.writeFileSync)(planPath(slug), content, "utf8");
+      (0, import_node_fs19.writeFileSync)(planPath(slug), content, "utf8");
     },
     removeLocal: (slug) => {
       try {
-        (0, import_node_fs16.rmSync)(planPath(slug));
+        (0, import_node_fs19.rmSync)(planPath(slug));
       } catch {
       }
     },
     readMetaRaw: () => {
       try {
-        return (0, import_node_fs16.readFileSync)(META_FILE, "utf8");
+        return (0, import_node_fs19.readFileSync)(META_FILE, "utf8");
       } catch {
         return null;
       }
@@ -15042,7 +16317,7 @@ function makePlanDeps(cfg, io = consoleIo) {
     },
     readIndexRaw: () => {
       try {
-        return (0, import_node_fs16.readFileSync)(INDEX_FILE, "utf8");
+        return (0, import_node_fs19.readFileSync)(INDEX_FILE, "utf8");
       } catch {
         return null;
       }
@@ -15053,7 +16328,7 @@ function makePlanDeps(cfg, io = consoleIo) {
     },
     readQueueRaw: () => {
       try {
-        return (0, import_node_fs16.readFileSync)(QUEUE_FILE, "utf8");
+        return (0, import_node_fs19.readFileSync)(QUEUE_FILE, "utf8");
       } catch {
         return null;
       }
@@ -15113,7 +16388,7 @@ function registerNorthStarCommands(cmd) {
     let content;
     if (o.bodyFile) {
       try {
-        content = await resolveTextArg({ file: o.bodyFile }, { readFile: import_promises5.readFile, readStdin }, {
+        content = await resolveTextArg({ file: o.bodyFile }, { readFile: import_promises6.readFile, readStdin }, {
           value: "inline content",
           file: "--body-file",
           noun: "plan"
@@ -15142,7 +16417,16 @@ function registerNorthStarCommands(cmd) {
     const signals = await gatherRelevanceSignals();
     await relevantPlans(d, signals, { project: o.project, includeAll: o.all, limit: o.limit ? Number(o.limit) : void 0, fresh: o.fresh, json: o.json });
   }));
-  cmd.command("sync").description("drain queued background pushes and refresh the local plan index").option("--quiet", "silent (background worker)").action((o) => withPlan(o.quiet ?? false, (d) => planSync(d, o)));
+  cmd.command("sync").description("drain queued background pushes and refresh the local plan index").option("--quiet", "silent (background worker)").option("--wait", "durable confirmation: drain, then report unresolved pushes and exit non-zero if any remain").action((o) => withPlan(o.quiet ?? false, async (d) => {
+    const unresolved = await planSync(d, o);
+    if (!o.wait) return;
+    if (unresolved.length) {
+      for (const e of unresolved) d.err(`${e.slug}: ${e.conflict ?? e.deadLettered ?? "still pending"}`);
+      process.exitCode = 1;
+    } else if (!o.quiet) {
+      d.log("north star: all queued pushes landed");
+    }
+  }));
   cmd.command("status").description("show pending/conflicted background pushes and the plan-cache age").option("--json", "machine-readable output").action((o) => withPlan(false, (d) => planStatus(d, o)));
   cmd.command("reconcile").description("refresh stale local etags from the server without --force (recovers from an object-store re-stamp)").action(() => withPlan(false, (d) => planReconcile(d)));
   cmd.command("open <slug>").description("pull if needed, then open plans/<slug>.md in $EDITOR").option("--project <name>", "override the project key").action(
@@ -15425,6 +16709,17 @@ project.command("get [owner/repo]").description("a project's META (board ids + p
     return failGraceful(`project get: no registry META for ${target} (unknown or unbootstrapped)`);
   }
   console.log(JSON.stringify(read.project));
+  if (!o.json) {
+    const m = read.project;
+    const track = resolveReleaseTrack(m);
+    const stages = branchesForTrack(track).join(" -> ");
+    const note = track === "direct" ? " (direct \u2014 no rc; /rcand refuses, /release ships development -> main)" : track === "trunk" ? " (trunk \u2014 main only)" : "";
+    console.error(
+      `${m.name ?? target} \xB7 class ${m.class ?? "?"} \xB7 deploy ${m.deployModel ?? "?"}
+release track: ${track} \u2014 stages: ${stages}${note}
+deploys run centrally (tenant-deploy.yml); product repos carry no deploy files. Deploy coords are OIDC-gated \u2014 see \`project resolve\`.`
+    );
+  }
 });
 project.command("resolve <owner/repo>").description("deploy coords for a stage \u2014 for diagnosis. NOTE: /deploy-coords is OIDC-gated (a deploy job\u2019s id-token), so a gh-token CLI cannot read it from a dev machine").option("--stage <main|rc>", "deploy stage", "main").option("--json", "machine-readable output").action((_repoOrRepo, o) => {
   const msg = "project resolve: deploy coords are served only to a deploy workflow (GitHub OIDC id-token, repo-scoped). A gh-token CLI on a dev machine cannot read /deploy-coords; inspect the DEPLOY# item via the AWS console / a master DDB read instead.";
@@ -15622,14 +16917,15 @@ oauth.command("verify").description("probe Google authorize with an arbitrary po
   if (mismatch) process.exitCode = 1;
 });
 var issue = program2.command("issue").description("issues \u2014 reliable create with structured output");
-issue.command("create").description("create an issue (type \u2192 label) and print {number,url,label} JSON").requiredOption("--type <type>", "bug | feature | task (sets the matching label)").option("--title <title>", "issue title").option("--title-file <path|->", "read the issue title from a UTF-8 file, or from stdin with -").option("--body <body>", "issue body (markdown)").option("--body-file <path|->", "read issue body from a UTF-8 file, or from stdin with -").requiredOption("--priority <priority>", "urgent | high | medium | low (sets the board Priority field only \u2014 never a priority:* label, #416)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--label <label...>", "extra label(s) to attach (repeatable; auto-created if missing)").option("--parent <ref>", "file as a native sub-issue of this parent (#123, owner/repo#123, or URL)").option("--no-related", "skip the auto related-issues comment").action(async (o) => {
+issue.command("create").description("create an issue (type \u2192 label) and print {number,url,label} JSON").requiredOption("--type <type>", "bug | feature | task (sets the matching label)").option("--title <title>", "issue title").option("--title-file <path|->", "read the issue title from a UTF-8 file, or from stdin with -").option("--body <body>", "issue body (markdown)").option("--body-file <path|->", "read issue body from a UTF-8 file, or from stdin with -").option("--priority <priority>", "urgent | high | medium | low (sets the board Priority field only \u2014 never a priority:* label, #416)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--label <label...>", "extra label(s) to attach (repeatable; auto-created if missing)").option("--parent <ref>", "file as a native sub-issue of this parent (#123, owner/repo#123, or URL)").option("--no-related", "skip the auto related-issues comment").action(async (o) => {
   let args;
   let priority;
   let body;
   let title;
   try {
-    title = await resolveIssueTitle({ title: o.title, titleFile: o.titleFile }, { readFile: import_promises5.readFile, readStdin });
-    body = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises5.readFile, readStdin });
+    title = await resolveIssueTitle({ title: o.title, titleFile: o.titleFile }, { readFile: import_promises6.readFile, readStdin });
+    body = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises6.readFile, readStdin });
+    if (o.priority === void 0) throw new Error("missing --priority <priority> \u2014 expected one of: urgent, high, medium, low");
     priority = normalizePriority(o.priority);
     args = buildIssueArgs({ type: o.type, title, body, priority, repo: o.repo, labels: o.label });
     if (o.parent !== void 0) parseIssueRef(o.parent);
@@ -15715,8 +17011,8 @@ program2.command("report").description("file a friction report on the Hub board
   const targetRepo2 = o.repo ?? HUB_REPO2;
   const sourceRepo = await resolveRepo(void 0);
   try {
-    title = await resolveIssueTitle({ title: o.title, titleFile: o.titleFile }, { readFile: import_promises5.readFile, readStdin });
-    body = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises5.readFile, readStdin });
+    title = await resolveIssueTitle({ title: o.title, titleFile: o.titleFile }, { readFile: import_promises6.readFile, readStdin });
+    body = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises6.readFile, readStdin });
     priority = normalizePriority(o.priority);
     args = buildIssueArgs({
       type: o.type,
@@ -15782,8 +17078,8 @@ verify.command("panel").description("plan a fresh-eyes lens panel \u2014 print j
   try {
     const routing = assertVerifyRouting(o.routing);
     const lenses = o.lenses.split(",").map((s) => assertGrindLens(s.trim()));
-    const criteria = await (0, import_promises5.readFile)(o.criteriaFile, "utf8");
-    const diff = await (0, import_promises5.readFile)(o.diffFile, "utf8");
+    const criteria = await (0, import_promises6.readFile)(o.criteriaFile, "utf8");
+    const diff = await (0, import_promises6.readFile)(o.diffFile, "utf8");
     const plan2 = buildPanelPlan({ routing, lenses, criteria, diff });
     console.log(JSON.stringify(plan2));
   } catch (e) {
@@ -15792,7 +17088,7 @@ verify.command("panel").description("plan a fresh-eyes lens panel \u2014 print j
 });
 verify.command("synthesize").description("merge lens JSON array into a PanelReport").option("--input-file <path|->", "JSON lens array (use - for stdin)", "-").action(async (o) => {
   try {
-    const raw = o.inputFile === "-" ? await readStdin() : await (0, import_promises5.readFile)(o.inputFile, "utf8");
+    const raw = o.inputFile === "-" ? await readStdin() : await (0, import_promises6.readFile)(o.inputFile, "utf8");
     const lenses = parseLensResults(JSON.parse(raw));
     console.log(JSON.stringify(synthesizePanelReport(lenses)));
   } catch (e) {
@@ -15865,7 +17161,7 @@ build.command("frontier").description("Evaluate external frontier exhaustion + L
     iterationCapOverride: opts.iterationCap
   };
   if (opts.jsonFile) {
-    const raw = await (0, import_promises5.readFile)(opts.jsonFile, "utf8");
+    const raw = await (0, import_promises6.readFile)(opts.jsonFile, "utf8");
     state = { ...state, ...JSON.parse(raw) };
   }
   const result = evaluateBuildFrontier(state);
@@ -15919,8 +17215,8 @@ program2.command("skill-lesson").description("file a skill-lesson on the Hub boa
   let args;
   try {
     skill = assertSkillName(o.skill);
-    rawBody = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises5.readFile, readStdin });
-    const rawTitle = await resolveIssueTitle({ title: o.title, titleFile: o.titleFile }, { readFile: import_promises5.readFile, readStdin });
+    rawBody = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises6.readFile, readStdin });
+    const rawTitle = await resolveIssueTitle({ title: o.title, titleFile: o.titleFile }, { readFile: import_promises6.readFile, readStdin });
     title = buildSkillLessonTitle(skill, rawTitle);
     priority = normalizePriority(o.priority);
     body = buildSkillLessonBody(rawBody, sourceRepo, pluginSha);
@@ -15971,8 +17267,8 @@ pr.command("create").description("create a PR and print {number,url} JSON").opti
   let body;
   let title;
   try {
-    title = await resolveIssueTitle({ title: o.title, titleFile: o.titleFile }, { readFile: import_promises5.readFile, readStdin });
-    body = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises5.readFile, readStdin });
+    title = await resolveIssueTitle({ title: o.title, titleFile: o.titleFile }, { readFile: import_promises6.readFile, readStdin });
+    body = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises6.readFile, readStdin });
   } catch (e) {
     return fail(`pr create: ${e.message}`);
   }
@@ -15980,9 +17276,9 @@ pr.command("create").description("create a PR and print {number,url} JSON").opti
   console.log(JSON.stringify(created));
 });
 async function listCiWorkflowPaths(cwd = process.cwd()) {
-  const wfDir = (0, import_node_path14.join)(cwd, ".github", "workflows");
-  if (!(0, import_node_fs16.existsSync)(wfDir)) return [];
-  return (0, import_node_fs16.readdirSync)(wfDir).filter((name) => /\.(ya?ml)$/i.test(name)).map((name) => `.github/workflows/${name}`);
+  const wfDir = (0, import_node_path17.join)(cwd, ".github", "workflows");
+  if (!(0, import_node_fs19.existsSync)(wfDir)) return [];
+  return (0, import_node_fs19.readdirSync)(wfDir).filter((name) => /\.(ya?ml)$/i.test(name)).map((name) => `.github/workflows/${name}`);
 }
 async function resolveMergeCiPolicyForCheckout(repoOpt) {
   const repo = repoOpt ?? await resolveRepo();
@@ -15997,7 +17293,11 @@ function ciAuditDeps() {
   return {
     client: defaultGitHubClient(),
     listProjects: async () => fetchProjectsList(registryClientDeps(await cfgPromise)),
-    getProjectMeta: async (slug) => fetchProjectBySlug(slug, registryClientDeps(await cfgPromise))
+    getProjectMeta: async (slug) => fetchProjectBySlug(slug, registryClientDeps(await cfgPromise)),
+    // Continuous CI delivery (#1550): the gate re-seed renders from the Hub's on-disk seed templates. The
+    // reconcile runs IN the Hub checkout, so this is local-file I/O (no network fetch). Path is relative to
+    // the repo root (e.g. skills/bootstrap/seeds/gate.template.yml).
+    readSeedFile: (path2) => (0, import_node_fs19.existsSync)(path2) ? (0, import_node_fs19.readFileSync)(path2, "utf8") : null
   };
 }
 pr.command("ci-policy").description("report merge CI policy: wait-for-checks vs no-ci (for grind/build agents)").option("--json", "machine-readable output").option("--repo <owner/repo>", "target repo (defaults to the current checkout)").action(async (o) => {
@@ -16005,14 +17305,28 @@ pr.command("ci-policy").description("report merge CI policy: wait-for-checks vs
   if (o.json) return printLine(JSON.stringify(result));
   printLine(`merge CI policy: ${result.policy} (${result.reason})`);
 });
+async function pollGhPrChecks(prNumber, repoArgs) {
+  let stdout = "";
+  let stderr = "";
+  try {
+    ({ stdout, stderr } = await execFileP2("gh", ["pr", "checks", prNumber, ...repoArgs], { timeout: GC_GH_TIMEOUT_MS }));
+  } catch (e) {
+    const err = e;
+    if (err.killed || err.stdout == null && err.stderr == null) throw e;
+    stdout = err.stdout ?? "";
+    stderr = err.stderr ?? "";
+  }
+  const state = parseGhPrChecksResult(stdout, stderr);
+  if (state === "error") {
+    throw new Error(`gh pr checks ${prNumber}: ${(stderr || stdout).trim() || "unknown error"}`);
+  }
+  return state;
+}
 pr.command("checks-wait <number>").description("bounded wait for PR checks; skips immediately on no-ci repos (#1432)").option("--json", "machine-readable output").option("--repo <owner/repo>", "target repo (defaults to the current repo)").action(async (number, o) => {
   const repoArgs = o.repo ? ["--repo", o.repo] : [];
   const result = await waitForPrChecks({
     resolvePolicy: () => resolveMergeCiPolicyForCheckout(o.repo),
-    pollChecks: async () => {
-      const { stdout } = await execFileP2("gh", ["pr", "checks", number, ...repoArgs], { timeout: GC_GH_TIMEOUT_MS });
-      return parseGhPrChecksOutput(stdout);
-    },
+    pollChecks: () => pollGhPrChecks(number, repoArgs),
     sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms))
   });
   if (o.json) printLine(JSON.stringify(result));
@@ -16036,11 +17350,7 @@ pr.command("land <number>").description("agent merge path (#1440): train probe \
     resolveCiPolicy: (repo) => resolveRepoMergeCiPolicy(repo, ciAuditDeps()),
     waitForChecks: (prNumber, repo) => waitForPrChecks({
       resolvePolicy: () => resolveRepoMergeCiPolicy(repo, ciAuditDeps()),
-      pollChecks: async () => {
-        const args = repo ? ["--repo", repo] : [];
-        const { stdout } = await execFileP2("gh", ["pr", "checks", prNumber, ...args], { timeout: GC_GH_TIMEOUT_MS });
-        return parseGhPrChecksOutput(stdout);
-      },
+      pollChecks: () => pollGhPrChecks(prNumber, repo ? ["--repo", repo] : []),
       sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms))
     }),
     mergeAuto: async (prNumber, repo) => {
@@ -16097,15 +17407,15 @@ async function createDeferredWorktreeStore() {
     return {
       read: async () => {
         try {
-          return parseDeferredWorktreesFile(await (0, import_promises5.readFile)(registryPath, "utf8"));
+          return parseDeferredWorktreesFile(await (0, import_promises6.readFile)(registryPath, "utf8"));
         } catch {
           return [];
         }
       },
       write: async (entries) => {
         try {
-          await (0, import_promises5.mkdir)((0, import_node_path14.dirname)(registryPath), { recursive: true });
-          await (0, import_promises5.writeFile)(registryPath, serializeDeferredWorktrees(entries), "utf8");
+          await (0, import_promises6.mkdir)((0, import_node_path17.dirname)(registryPath), { recursive: true });
+          await (0, import_promises6.writeFile)(registryPath, serializeDeferredWorktrees(entries), "utf8");
         } catch {
         }
       }
@@ -16114,16 +17424,57 @@ async function createDeferredWorktreeStore() {
     return void 0;
   }
 }
+var realWorktreeDirRemover = {
+  probe: (p) => {
+    let st;
+    try {
+      st = (0, import_node_fs19.lstatSync)(p);
+    } catch {
+      return null;
+    }
+    if (st.isSymbolicLink()) return "link";
+    try {
+      (0, import_node_fs19.readlinkSync)(p);
+      return "link";
+    } catch {
+    }
+    return st.isDirectory() ? "dir" : "file";
+  },
+  readdir: (p) => {
+    try {
+      return (0, import_node_fs19.readdirSync)(p);
+    } catch {
+      return [];
+    }
+  },
+  // A directory reparse point (junction / dir-symlink) is detached with rmdir (unlinks the mount point,
+  // leaving the target); a file symlink with unlink. rmdir first, fall back to unlink.
+  detachLink: (p) => {
+    try {
+      (0, import_node_fs19.rmdirSync)(p);
+    } catch {
+      (0, import_node_fs19.unlinkSync)(p);
+    }
+  },
+  removeTree: (p) => (0, import_promises6.rm)(p, { recursive: true, force: true, maxRetries: 5, retryDelay: 200 })
+};
+async function resolvePrimaryCheckout(execGit) {
+  try {
+    return parseWorktreePorcelain(await execGit(["worktree", "list", "--porcelain"]))[0]?.path;
+  } catch {
+    return void 0;
+  }
+}
 function worktreeRemoveDeps(execGit) {
   return {
     git: execGit,
     sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
-    removeWorktreeDir: async (worktreePath) => (0, import_promises5.rm)(worktreePath, { recursive: true, force: true, maxRetries: 5, retryDelay: 200 })
+    removeWorktreeDir: async (worktreePath) => removeWorktreeTree(worktreePath, await resolvePrimaryCheckout(execGit), realWorktreeDirRemover)
   };
 }
 function teardownWorktreeStage(worktreePath) {
   return runWorktreeStageTeardown(worktreePath, {
-    hasStageState: (wt) => (0, import_node_fs16.existsSync)(stageStatePath(wt)),
+    hasStageState: (wt) => (0, import_node_fs19.existsSync)(stageStatePath(wt)),
     stopRecordedStage: async (wt) => (await stopStage({ cwd: wt })).pid,
     listComposeProjects: async () => {
       const { stdout } = await execFileP2("docker", ["compose", "ls", "--all", "--format", "json"], { timeout: GC_GH_TIMEOUT_MS });
@@ -16186,7 +17537,7 @@ pr.command("merge <number>").description("merge a PR (squash by default) and cle
     } : await cleanupPrMergeLocalBranch(headRef, {
       beforeWorktrees,
       startingPath,
-      pathExists: (p) => (0, import_node_fs16.existsSync)(p),
+      pathExists: (p) => (0, import_node_fs19.existsSync)(p),
       execGit: async (args) => (await execFileP2("git", args, { timeout: GIT_TIMEOUT_MS })).stdout,
       teardownWorktreeStage,
       deferredStore,
@@ -16358,7 +17709,7 @@ function rawValues(flag) {
   return out;
 }
 function printLine(value) {
-  (0, import_node_fs16.writeSync)(1, `${value}
+  (0, import_node_fs19.writeSync)(1, `${value}
 `);
 }
 function stageKeepAlive() {
@@ -16375,8 +17726,8 @@ async function resolveStage() {
     local,
     shell: shellFor(),
     registry: { deployModel: project2?.deployModel, portRange, error: read.ok ? void 0 : read.error },
-    hasCompose: (0, import_node_fs16.existsSync)((0, import_node_path14.join)(process.cwd(), "docker-compose.yml")),
-    hasEnvExample: (0, import_node_fs16.existsSync)((0, import_node_path14.join)(process.cwd(), ".env.example"))
+    hasCompose: (0, import_node_fs19.existsSync)((0, import_node_path17.join)(process.cwd(), "docker-compose.yml")),
+    hasEnvExample: (0, import_node_fs19.existsSync)((0, import_node_path17.join)(process.cwd(), ".env.example"))
   });
 }
 async function fetchStageVaultEnvMerge() {
@@ -16428,9 +17779,9 @@ program2.command("port-range <repo>").description("assign (idempotently) + print
     printLine(o.json ? JSON.stringify({ repo, portRange: [start2, end2], source: "meta" }) : `${repo}: stage.portRange [${start2}, ${end2}]`);
     return;
   }
-  const path2 = (0, import_node_path14.join)(process.cwd(), "infra", "port-ranges.json");
+  const path2 = (0, import_node_path17.join)(process.cwd(), "infra", "port-ranges.json");
   const allocate = async (seed) => {
-    const { stdout } = await execFileP2("node", [(0, import_node_path14.join)(process.cwd(), "infra", "port-ddb.mjs"), String(seed)], { timeout: 15e3 });
+    const { stdout } = await execFileP2("node", [(0, import_node_path17.join)(process.cwd(), "infra", "port-ddb.mjs"), String(seed)], { timeout: 15e3 });
     const parsed = JSON.parse(stdout);
     if (!Array.isArray(parsed.range) || parsed.range.length !== 2) throw new Error("port-ddb: no range in output");
     return parsed.range;
@@ -16624,7 +17975,7 @@ function trainApplyDeps() {
     // Slack release announcement (#883): Hub-only + best-effort inside announceRelease itself.
     announce: (args) => announceRelease({
       run: async (file, cmdArgs) => (await execFileP2(file, cmdArgs, { timeout: GH_TRAIN_TIMEOUT_MS })).stdout,
-      readFile: (path2) => (0, import_promises5.readFile)(path2, "utf8")
+      readFile: (path2) => (0, import_promises6.readFile)(path2, "utf8")
     }, args),
     fetchEdgeDomains: async (slug) => {
       const proj = await fetchProjectBySlug(slug, registryClientDeps(await loadConfig()));
@@ -16697,7 +18048,16 @@ for (const commandName of ["rcand", "release"]) {
     }
     const repo = await resolveRepo();
     const targets = commandName === "rcand" ? await resolveRcandPlanTargets() : void 0;
-    const steps = trainPlan(commandName, { ...targets ?? {}, repo, dev: o.dev });
+    let releaseTrack;
+    if (repo) {
+      try {
+        const read = await fetchProjectBySlugChecked(slugOf(repo), registryClientDeps(await loadConfig()));
+        const raw = read.ok ? read.project?.releaseTrack : void 0;
+        if (isReleaseTrack(raw)) releaseTrack = raw;
+      } catch {
+      }
+    }
+    const steps = trainPlan(commandName, { ...targets ?? {}, repo, dev: o.dev, releaseTrack });
     console.log(
       o.json ? JSON.stringify({ command: commandName, ...targets ?? {}, repo, steps }, null, 2) : renderSteps(`mmi-cli ${commandName}: dry-run plan`, steps)
     );
@@ -16801,7 +18161,7 @@ bootstrap.command("verify <repo>").description("audit whether an existing repo i
   const report = await verifyBootstrap(repo, o.class, {
     client: defaultGitHubClient(),
     projectMeta: meta,
-    readLocalFile: (path2) => path2 === "projects.json" && apiProjects != null ? apiProjects : (0, import_node_fs16.existsSync)(path2) ? (0, import_node_fs16.readFileSync)(path2, "utf8") : null,
+    readLocalFile: (path2) => path2 === "projects.json" && apiProjects != null ? apiProjects : (0, import_node_fs19.existsSync)(path2) ? (0, import_node_fs19.readFileSync)(path2, "utf8") : null,
     // requiredGcpApis is stored as an array by a JSON write, but `project set --var KEY=VALUE` stores a raw
     // comma-string — accept either so the seeded value verifies regardless of how it was written.
     requiredGcpApis: (() => {
@@ -16844,18 +18204,23 @@ bootstrap.command("apply <repo>").description("idempotent seed apply from skills
     return fail(`bootstrap apply: ${e.message}`);
   }
   const manifestPath = "skills/bootstrap/seeds/manifest.json";
-  if (!(0, import_node_fs16.existsSync)(manifestPath)) return fail(`bootstrap apply: ${manifestPath} not found; run from the MMI-Hub repo root`);
-  const manifest = loadBootstrapSeeds((0, import_node_fs16.readFileSync)(manifestPath, "utf8"));
+  if (!(0, import_node_fs19.existsSync)(manifestPath)) return fail(`bootstrap apply: ${manifestPath} not found; run from the MMI-Hub repo root`);
+  const manifest = loadBootstrapSeeds((0, import_node_fs19.readFileSync)(manifestPath, "utf8"));
   const baseBranch = o.class === "content" ? "main" : "development";
   const slug = parsedRepo.slug;
   const gh = async (args) => execFileP2("gh", args, { timeout: 2e4 });
-  const readFile5 = (p) => (0, import_node_fs16.existsSync)(p) ? (0, import_node_fs16.readFileSync)(p, "utf8") : null;
+  const readFile6 = (p) => (0, import_node_fs19.existsSync)(p) ? (0, import_node_fs19.readFileSync)(p, "utf8") : null;
   const enc2 = (p) => p.split("/").map(encodeURIComponent).join("/");
   const rawVars = {};
   for (const value of rawValues("--var")) {
     const eq = value.indexOf("=");
     if (eq > 0) rawVars[value.slice(0, eq)] = value.slice(eq + 1);
   }
+  try {
+    const meta = await fetchProjectBySlug(slug, registryClientDeps(await loadConfig()));
+    for (const [k, v] of Object.entries(gateConfigToVars(meta?.gate))) if (rawVars[k] == null) rawVars[k] = v;
+  } catch {
+  }
   const vars = withDerivedRepoVars(rawVars, parsedRepo, o.class, bootstrapReleaseTrack);
   if (vars.PROJECT_ID) {
     try {
@@ -16891,7 +18256,7 @@ bootstrap.command("apply <repo>").description("idempotent seed apply from skills
     }
     const planned = planSeedAction(resolved, exists);
     const isBlock = resolved.source === "managed-block";
-    const content = planned.action === "create" || planned.action === "update" ? isBlock ? upsertManagedGitignoreBlock(remoteContent).content : resolveSeedContent(resolved, vars, readFile5) : null;
+    const content = planned.action === "create" || planned.action === "update" ? isBlock ? upsertManagedGitignoreBlock(remoteContent).content : resolveSeedContent(resolved, vars, readFile6) : null;
     const action = reconcileSeedAction(planned, content, isBlock);
     actions.push(action);
     if (o.execute && (action.action === "create" || action.action === "update")) {
@@ -16908,7 +18273,7 @@ bootstrap.command("apply <repo>").description("idempotent seed apply from skills
     }
     const rulesetSeed = manifest.seeds.find((s) => s.target === ".github/rulesets/mmi-product-required-checks.json");
     if (rulesetSeed) {
-      const rulesetContent = resolveSeedContent({ ...rulesetSeed, target: rulesetSeed.target.replace("{{REPO_SLUG}}", slug) }, vars, readFile5);
+      const rulesetContent = resolveSeedContent({ ...rulesetSeed, target: rulesetSeed.target.replace("{{REPO_SLUG}}", slug) }, vars, readFile6);
       if (rulesetContent) {
         try {
           const activation = await activateProductRuleset(repo, stripRulesetComment(rulesetContent), defaultGitHubClient());
@@ -17078,16 +18443,16 @@ access.command("audit").description("audit collaborator roles + train-branch pus
     if (o.class !== "deployable" && o.class !== "content") return failGraceful("access audit: --class must be deployable or content");
     targets = [{ repo: o.repo, class: o.class }];
   } else {
-    const projectsJson = registryProjects ? JSON.stringify({ projects: registryProjects }) : (0, import_node_fs16.existsSync)("projects.json") ? (0, import_node_fs16.readFileSync)("projects.json", "utf8") : null;
+    const projectsJson = registryProjects ? JSON.stringify({ projects: registryProjects }) : (0, import_node_fs19.existsSync)("projects.json") ? (0, import_node_fs19.readFileSync)("projects.json", "utf8") : null;
     if (!projectsJson) return failGraceful("access audit: no project registry \u2014 Hub API unreachable and projects.json not found; run from the MMI-Hub repo root or pass --repo <owner/repo>");
-    const fanoutJson = (0, import_node_fs16.existsSync)(".github/fanout-targets.json") ? (0, import_node_fs16.readFileSync)(".github/fanout-targets.json", "utf8") : null;
+    const fanoutJson = (0, import_node_fs19.existsSync)(".github/fanout-targets.json") ? (0, import_node_fs19.readFileSync)(".github/fanout-targets.json", "utf8") : null;
     targets = loadAccessTargets(projectsJson, fanoutJson);
   }
   const derivedMatrix = registryProjects ? accessMatrixFromProjects(registryProjects) : {};
-  const fileMatrix = (0, import_node_fs16.existsSync)("access-matrix.json") ? loadAccessMatrix((0, import_node_fs16.readFileSync)("access-matrix.json", "utf8")) : {};
+  const fileMatrix = (0, import_node_fs19.existsSync)("access-matrix.json") ? loadAccessMatrix((0, import_node_fs19.readFileSync)("access-matrix.json", "utf8")) : {};
   const matrix = mergeAccessMatrix(fileMatrix, derivedMatrix);
   const derivedContracts = registryProjects ? dataAccessContractsFromProjects(registryProjects) : { consumers: {} };
-  const fileContracts = (0, import_node_fs16.existsSync)("data-access-contracts.json") ? loadDataAccessContracts((0, import_node_fs16.readFileSync)("data-access-contracts.json", "utf8")) : { consumers: {} };
+  const fileContracts = (0, import_node_fs19.existsSync)("data-access-contracts.json") ? loadDataAccessContracts((0, import_node_fs19.readFileSync)("data-access-contracts.json", "utf8")) : { consumers: {} };
   const dataAccess = mergeDataAccessContracts(fileContracts, derivedContracts);
   const report = await auditOrgAccess(targets, deps, matrix, dataAccess);
   console.log(o.json ? JSON.stringify(report, null, 2) : renderAccessReport(report));
@@ -17096,20 +18461,20 @@ access.command("audit").description("audit collaborator roles + train-branch pus
 var isWin = process.platform === "win32";
 var installedPluginsPath = (surface = detectSurface(process.env)) => {
   const homeDir = surface === "codex" ? ".codex" : ".claude";
-  return (0, import_node_path14.join)((0, import_node_os5.homedir)(), homeDir, "plugins", "installed_plugins.json");
+  return (0, import_node_path17.join)((0, import_node_os6.homedir)(), homeDir, "plugins", "installed_plugins.json");
 };
 function readInstalledPlugins() {
   try {
-    return JSON.parse((0, import_node_fs16.readFileSync)(installedPluginsPath(), "utf8"));
+    return JSON.parse((0, import_node_fs19.readFileSync)(installedPluginsPath(), "utf8"));
   } catch {
     return null;
   }
 }
 function installedPluginSources() {
   return ["claude", "codex"].map((surface) => {
-    const recordPath = (0, import_node_path14.join)((0, import_node_os5.homedir)(), `.${surface}`, "plugins", "installed_plugins.json");
+    const recordPath = (0, import_node_path17.join)((0, import_node_os6.homedir)(), `.${surface}`, "plugins", "installed_plugins.json");
     try {
-      return { surface, installed: JSON.parse((0, import_node_fs16.readFileSync)(recordPath, "utf8")), recordPath };
+      return { surface, installed: JSON.parse((0, import_node_fs19.readFileSync)(recordPath, "utf8")), recordPath };
     } catch {
       return { surface, installed: null, recordPath };
     }
@@ -17117,7 +18482,7 @@ function installedPluginSources() {
 }
 function readClaudeSettings() {
   try {
-    return JSON.parse((0, import_node_fs16.readFileSync)((0, import_node_path14.join)(process.cwd(), ".claude", "settings.json"), "utf8"));
+    return JSON.parse((0, import_node_fs19.readFileSync)((0, import_node_path17.join)(process.cwd(), ".claude", "settings.json"), "utf8"));
   } catch {
     return null;
   }
@@ -17139,7 +18504,7 @@ function writeProjectInstallRecord(record) {
     const list = file.plugins[MMI_PLUGIN_ID] ?? [];
     list.push(record);
     file.plugins[MMI_PLUGIN_ID] = list;
-    (0, import_node_fs16.writeFileSync)(installedPluginsPath(), `${JSON.stringify(file, null, 2)}
+    (0, import_node_fs19.writeFileSync)(installedPluginsPath(), `${JSON.stringify(file, null, 2)}
 `, "utf8");
     return true;
   } catch {
@@ -17152,9 +18517,9 @@ function backupAndWriteInstalledPlugins(records, pluginId) {
     if (!file) return false;
     if (!file.plugins) file.plugins = {};
     const path2 = installedPluginsPath();
-    (0, import_node_fs16.copyFileSync)(path2, `${path2}.bak`);
+    (0, import_node_fs19.copyFileSync)(path2, `${path2}.bak`);
     file.plugins[pluginId] = records;
-    (0, import_node_fs16.writeFileSync)(path2, `${JSON.stringify(file, null, 2)}
+    (0, import_node_fs19.writeFileSync)(path2, `${JSON.stringify(file, null, 2)}
 `, "utf8");
     return true;
   } catch {
@@ -17162,35 +18527,35 @@ function backupAndWriteInstalledPlugins(records, pluginId) {
   }
 }
 function cursorPluginCacheRoot() {
-  return (0, import_node_path14.join)((0, import_node_os5.homedir)(), ".cursor", "plugins", "cache", "mmi", "mmi");
+  return (0, import_node_path17.join)((0, import_node_os6.homedir)(), ".cursor", "plugins", "cache", "mmi", "mmi");
 }
 function cursorPluginCachePinSnapshots() {
   const root = cursorPluginCacheRoot();
   try {
-    return (0, import_node_fs16.readdirSync)(root, { withFileTypes: true }).filter((entry) => entry.isDirectory() && !entry.name.startsWith(".")).map((entry) => {
-      const path2 = (0, import_node_path14.join)(root, entry.name);
-      const pluginJson = (0, import_node_path14.join)(path2, ".cursor-plugin", "plugin.json");
-      const hooksJson = (0, import_node_path14.join)(path2, "hooks", "hooks.json");
-      const cliBundle = (0, import_node_path14.join)(path2, "cli", "dist", "index.cjs");
+    return (0, import_node_fs19.readdirSync)(root, { withFileTypes: true }).filter((entry) => entry.isDirectory() && !entry.name.startsWith(".")).map((entry) => {
+      const path2 = (0, import_node_path17.join)(root, entry.name);
+      const pluginJson = (0, import_node_path17.join)(path2, ".cursor-plugin", "plugin.json");
+      const hooksJson = (0, import_node_path17.join)(path2, "hooks", "hooks.json");
+      const cliBundle = (0, import_node_path17.join)(path2, "cli", "dist", "index.cjs");
       let version;
       try {
-        const raw = JSON.parse((0, import_node_fs16.readFileSync)(pluginJson, "utf8"));
+        const raw = JSON.parse((0, import_node_fs19.readFileSync)(pluginJson, "utf8"));
         version = typeof raw.version === "string" ? raw.version : void 0;
       } catch {
         version = void 0;
       }
       let isEmpty = true;
       try {
-        isEmpty = (0, import_node_fs16.readdirSync)(path2).length === 0;
+        isEmpty = (0, import_node_fs19.readdirSync)(path2).length === 0;
       } catch {
         isEmpty = true;
       }
       return {
         name: entry.name,
         path: path2,
-        hasPluginJson: (0, import_node_fs16.existsSync)(pluginJson),
-        hasHooksJson: (0, import_node_fs16.existsSync)(hooksJson),
-        hasCliBundle: (0, import_node_fs16.existsSync)(cliBundle),
+        hasPluginJson: (0, import_node_fs19.existsSync)(pluginJson),
+        hasHooksJson: (0, import_node_fs19.existsSync)(hooksJson),
+        hasCliBundle: (0, import_node_fs19.existsSync)(cliBundle),
         isEmpty,
         version
       };
@@ -17200,19 +18565,19 @@ function cursorPluginCachePinSnapshots() {
   }
 }
 function hubCheckoutForCursorSeed() {
-  const manifest = (0, import_node_path14.join)(process.cwd(), "plugins", "mmi", ".cursor-plugin", "plugin.json");
-  return (0, import_node_fs16.existsSync)(manifest) ? process.cwd() : void 0;
+  const manifest = (0, import_node_path17.join)(process.cwd(), "plugins", "mmi", ".cursor-plugin", "plugin.json");
+  return (0, import_node_fs19.existsSync)(manifest) ? process.cwd() : void 0;
 }
 function mmiPluginCacheRootSnapshots() {
   const roots = [
-    { surface: "claude", root: (0, import_node_path14.join)((0, import_node_os5.homedir)(), ".claude", "plugins", "cache", "mmi", "mmi") },
-    { surface: "codex", root: (0, import_node_path14.join)((0, import_node_os5.homedir)(), ".codex", "plugins", "cache", "mmi", "mmi") }
+    { surface: "claude", root: (0, import_node_path17.join)((0, import_node_os6.homedir)(), ".claude", "plugins", "cache", "mmi", "mmi") },
+    { surface: "codex", root: (0, import_node_path17.join)((0, import_node_os6.homedir)(), ".codex", "plugins", "cache", "mmi", "mmi") }
   ];
   return roots.flatMap(({ surface, root }) => {
     try {
-      const entries = (0, import_node_fs16.readdirSync)(root, { withFileTypes: true }).map((entry) => ({
+      const entries = (0, import_node_fs19.readdirSync)(root, { withFileTypes: true }).map((entry) => ({
         name: entry.name,
-        path: (0, import_node_path14.join)(root, entry.name),
+        path: (0, import_node_path17.join)(root, entry.name),
         isDirectory: entry.isDirectory()
       }));
       return [{ surface, root, entries }];
@@ -17223,7 +18588,7 @@ function mmiPluginCacheRootSnapshots() {
 }
 function hasNestedMmiChild(versionDir) {
   try {
-    return (0, import_node_fs16.statSync)((0, import_node_path14.join)(versionDir, "mmi")).isDirectory();
+    return (0, import_node_fs19.statSync)((0, import_node_path17.join)(versionDir, "mmi")).isDirectory();
   } catch {
     return false;
   }
@@ -17234,26 +18599,28 @@ function nestedPluginTreeSnapshot() {
   );
 }
 function uniqueQuarantineTarget(path2) {
-  if (!(0, import_node_fs16.existsSync)(path2)) return path2;
+  if (!(0, import_node_fs19.existsSync)(path2)) return path2;
   for (let i = 1; i < 100; i += 1) {
     const candidate = `${path2}-${i}`;
-    if (!(0, import_node_fs16.existsSync)(candidate)) return candidate;
+    if (!(0, import_node_fs19.existsSync)(candidate)) return candidate;
   }
   return `${path2}-${Date.now()}`;
 }
 function quarantinePluginCacheDirs(plan2) {
   let moved = 0;
+  const failed = [];
   for (const move of plan2) {
     try {
-      if (!(0, import_node_fs16.existsSync)(move.from)) continue;
+      if (!(0, import_node_fs19.existsSync)(move.from)) continue;
       const target = uniqueQuarantineTarget(move.to);
-      (0, import_node_fs16.mkdirSync)((0, import_node_path14.dirname)(target), { recursive: true });
-      (0, import_node_fs16.renameSync)(move.from, target);
+      (0, import_node_fs19.mkdirSync)((0, import_node_path17.dirname)(target), { recursive: true });
+      (0, import_node_fs19.renameSync)(move.from, target);
       moved += 1;
     } catch {
+      failed.push(move);
     }
   }
-  return moved;
+  return { moved, failed };
 }
 async function robocopyMirrorEmpty(emptyDir, target) {
   try {
@@ -17266,23 +18633,23 @@ async function robocopyMirrorEmpty(emptyDir, target) {
 }
 async function clearNestedPluginTreeDir(targetPath) {
   try {
-    if (!(0, import_node_fs16.existsSync)(targetPath)) return true;
+    if (!(0, import_node_fs19.existsSync)(targetPath)) return true;
     if (isWin) {
-      const emptyDir = (0, import_node_path14.join)((0, import_node_os5.tmpdir)(), `mmi-empty-${Date.now()}`);
-      (0, import_node_fs16.mkdirSync)(emptyDir, { recursive: true });
+      const emptyDir = (0, import_node_path17.join)((0, import_node_os6.tmpdir)(), `mmi-empty-${Date.now()}`);
+      (0, import_node_fs19.mkdirSync)(emptyDir, { recursive: true });
       try {
         await robocopyMirrorEmpty(emptyDir, targetPath);
-        (0, import_node_fs16.rmSync)(targetPath, { recursive: true, force: true });
+        (0, import_node_fs19.rmSync)(targetPath, { recursive: true, force: true });
       } finally {
         try {
-          (0, import_node_fs16.rmSync)(emptyDir, { recursive: true, force: true });
+          (0, import_node_fs19.rmSync)(emptyDir, { recursive: true, force: true });
         } catch {
         }
       }
-      return !(0, import_node_fs16.existsSync)(targetPath);
+      return !(0, import_node_fs19.existsSync)(targetPath);
     }
-    (0, import_node_fs16.rmSync)(targetPath, { recursive: true, force: true });
-    return !(0, import_node_fs16.existsSync)(targetPath);
+    (0, import_node_fs19.rmSync)(targetPath, { recursive: true, force: true });
+    return !(0, import_node_fs19.existsSync)(targetPath);
   } catch {
     return false;
   }
@@ -17295,22 +18662,22 @@ async function applyNestedPluginTreeCleanup(paths, log) {
   }
   return true;
 }
-var gitignorePath = () => (0, import_node_path14.join)(process.cwd(), ".gitignore");
+var gitignorePath = () => (0, import_node_path17.join)(process.cwd(), ".gitignore");
 function readTextFile(path2) {
   try {
-    if (!(0, import_node_fs16.existsSync)(path2)) return null;
-    return (0, import_node_fs16.readFileSync)(path2, "utf8");
+    if (!(0, import_node_fs19.existsSync)(path2)) return null;
+    return (0, import_node_fs19.readFileSync)(path2, "utf8");
   } catch {
     return null;
   }
 }
 function playwrightMcpConfigSnapshots() {
   const cwd = process.cwd();
-  const home = (0, import_node_os5.homedir)();
+  const home = (0, import_node_os6.homedir)();
   const candidates = [
-    (0, import_node_path14.join)(cwd, ".cursor", "mcp.json"),
-    (0, import_node_path14.join)(home, ".cursor", "mcp.json"),
-    (0, import_node_path14.join)(home, ".codex", "config.toml")
+    (0, import_node_path17.join)(cwd, ".cursor", "mcp.json"),
+    (0, import_node_path17.join)(home, ".cursor", "mcp.json"),
+    (0, import_node_path17.join)(home, ".codex", "config.toml")
   ];
   const out = [];
   for (const path2 of candidates) {
@@ -17323,7 +18690,7 @@ function strayBrowserArtifactPaths() {
   const cwd = process.cwd();
   return STRAY_BROWSER_ARTIFACT_DIRS.filter((rel) => {
     try {
-      return (0, import_node_fs16.existsSync)((0, import_node_path14.join)(cwd, rel));
+      return (0, import_node_fs19.existsSync)((0, import_node_path17.join)(cwd, rel));
     } catch {
       return false;
     }
@@ -17331,14 +18698,14 @@ function strayBrowserArtifactPaths() {
 }
 function readGitignore() {
   try {
-    return (0, import_node_fs16.readFileSync)(gitignorePath(), "utf8");
+    return (0, import_node_fs19.readFileSync)(gitignorePath(), "utf8");
   } catch {
     return null;
   }
 }
 function writeGitignore(content) {
   try {
-    (0, import_node_fs16.writeFileSync)(gitignorePath(), content, "utf8");
+    (0, import_node_fs19.writeFileSync)(gitignorePath(), content, "utf8");
     return true;
   } catch {
     return false;
@@ -17377,7 +18744,7 @@ async function runDoctor(opts, io = consoleIo) {
   let onPath = pathProbe;
   if (!onPath) {
     const root = process.env.CLAUDE_PLUGIN_ROOT;
-    if (root && (0, import_node_fs16.existsSync)(`${root}/bin/mmi-cli${isWin ? ".cmd" : ""}`)) onPath = true;
+    if (root && (0, import_node_fs19.existsSync)(`${root}/bin/mmi-cli${isWin ? ".cmd" : ""}`)) onPath = true;
   }
   checks.push({ ok: onPath, label: "mmi-cli on PATH", fix: "auto-provisioned at session start \u2014 reopen the session, or install the MMI plugin" });
   const surface = detectSurface(process.env);
@@ -17494,7 +18861,8 @@ async function runDoctor(opts, io = consoleIo) {
     installedVersions: installedPluginVersions(installed)
   });
   if (!cacheCleanupCheck.ok && cacheCleanupCheck.quarantinePlan && repairLocal) {
-    const moved = quarantinePluginCacheDirs(cacheCleanupCheck.quarantinePlan);
+    const { moved, failed } = quarantinePluginCacheDirs(cacheCleanupCheck.quarantinePlan);
+    const attempted = moved + failed.length;
     if (moved > 0) {
       const surfaces = [...new Set(cacheCleanupCheck.leftovers?.map((entry) => entry.surface) ?? [])].join("/");
       const names = cacheCleanupCheck.leftovers?.map((entry) => entry.name).join(", ");
@@ -17505,8 +18873,12 @@ async function runDoctor(opts, io = consoleIo) {
         isOrgRepo: Boolean(cfg.sagaApiUrl),
         roots: mmiPluginCacheRootSnapshots(),
         activeVersion: resolveClientVersion(),
-        releasedVersion
+        releasedVersion,
+        installedVersions: installedPluginVersions(installed)
       }),
+      attemptedCount: attempted,
+      failedCount: failed.length,
+      ...failed.length > 0 ? { failedMoves: failed } : {},
       ...moved > 0 ? { cleanedCount: moved } : {}
     };
   }
@@ -17544,7 +18916,7 @@ async function runDoctor(opts, io = consoleIo) {
     isOrgRepo: Boolean(cfg.sagaApiUrl),
     surface,
     cacheRoot: cursorCacheRoot,
-    cacheRootExists: (0, import_node_fs16.existsSync)(cursorCacheRoot),
+    cacheRootExists: (0, import_node_fs19.existsSync)(cursorCacheRoot),
     pins: cursorPins,
     hubCheckout: hubCheckoutForCursorSeed(),
     releasedVersion
@@ -17555,7 +18927,7 @@ async function runDoctor(opts, io = consoleIo) {
       releasedVersion,
       hubCheckout: hubCheckoutForCursorSeed(),
       execFileP: execFileP2,
-      mkdtemp: (prefix) => (0, import_promises5.mkdtemp)((0, import_node_path14.join)((0, import_node_os5.tmpdir)(), prefix)),
+      mkdtemp: (prefix) => (0, import_promises6.mkdtemp)((0, import_node_path17.join)((0, import_node_os6.tmpdir)(), prefix)),
       log: (m) => io.err(m)
     });
     if (seeded) {
@@ -17564,7 +18936,7 @@ async function runDoctor(opts, io = consoleIo) {
         isOrgRepo: Boolean(cfg.sagaApiUrl),
         surface,
         cacheRoot: cursorCacheRoot,
-        cacheRootExists: (0, import_node_fs16.existsSync)(cursorCacheRoot),
+        cacheRootExists: (0, import_node_fs19.existsSync)(cursorCacheRoot),
         pins: cursorPins,
         hubCheckout: hubCheckoutForCursorSeed(),
         releasedVersion
@@ -17636,6 +19008,10 @@ program2.command("doctor").description("check onboarding gates (GitHub auth, mmi
   runDoctor({ ...opts, noRepoWrites: opts.repoWrites === false })
 ));
 program2.command("session-start").description("run the SessionStart verbs (rules sync, saga session+show, saga health, whoami, doctor, plan-store check) in one process; docs sync runs detached").action(async () => {
+  if (isInsideRepoSubdir(process.cwd())) {
+    console.error("[mmi-hook] session-start: cwd is a repository SUBDIRECTORY \u2014 skipping the SessionStart hook (spine/docs/plan/saga delivery); run it from the repo root.");
+    return;
+  }
   try {
     const hook = parseHookInput(await readStdin());
     if (hook.session_id) persistSession(hook.session_id);
@@ -17647,6 +19023,7 @@ program2.command("session-start").description("run the SessionStart verbs (rules
   const { parallel, sequential } = buildSessionStartPlan({
     rulesSync: (io) => runRulesSync({ quiet: true }, io),
     sagaShow: (io) => runSagaShow({ quiet: true }, io),
+    handoffOffer: (io) => runHandoffOffer(io, { fast: true }),
     // honcho profile (#1162): inject the behavioral-memory prior (peer card). Bounded + fail-soft +
     // silent when off/empty, so it never delays or noises the session banner.
     honchoContext: (io) => runHonchoContext({ quiet: true, banner: true }, io),
@@ -17680,6 +19057,12 @@ program2.command("session-start").description("run the SessionStart verbs (rules
   await runSessionStart(parallel, sequential, consoleIo);
   consoleIo.log(northstarPointer(northstarInjected));
   for (const line of planStoreLines(process.cwd())) consoleIo.log(line);
+  for (const line of scratchGcLines(process.cwd())) consoleIo.log(line);
+  const worktreeBanner = worktreeAutoProvisionBanner(process.cwd());
+  if (worktreeBanner) {
+    spawnDetachedSelf(["worktree", "setup", "--quiet"], { spawn: import_node_child_process10.spawn, execPath: process.execPath, scriptPath: process.argv[1] });
+    consoleIo.log(worktreeBanner);
+  }
 });
 installProcessBackstop();
 program2.parseAsync().catch((e) => failGraceful(e.message));