@mutmutco/cli 2.39.0 → 2.40.0

package/dist/main.cjs

@@ -3391,8 +3391,8 @@ function useColor() {
 var program = new Command();
 
 // src/index.ts
-var import_promises6 = require("node:fs/promises");
-var import_node_fs19 = require("node:fs");
+var import_promises7 = require("node:fs/promises");
+var import_node_fs22 = require("node:fs");
 
 // src/rules-sync.ts
 function normalizeEol(s) {
@@ -3423,7 +3423,7 @@ function resolveRulesBase(orgRulesSource, defaultBase) {
 }
 
 // src/index.ts
-var import_node_child_process10 = require("node:child_process");
+var import_node_child_process12 = require("node:child_process");
 
 // src/cli-shared.ts
 var import_promises = require("node:fs/promises");
@@ -3509,7 +3509,7 @@ async function fetchWithRetry(fetchImpl, url, init, opts = {}) {
   const attempts = opts.attempts ?? 3;
   const baseDelayMs = opts.baseDelayMs ?? 250;
   const retryOn = opts.retryOn ?? ((res) => res.status >= 500);
-  const sleep = opts.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+  const sleep2 = opts.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
   let lastErr;
   for (let i = 0; i < attempts; i++) {
     const isLast = i === attempts - 1;
@@ -3517,26 +3517,25 @@ async function fetchWithRetry(fetchImpl, url, init, opts = {}) {
     try {
       const res = await fetchImpl(url, attemptInit);
       if (!isLast && retryOn(res)) {
-        await sleep(baseDelayMs * 2 ** i);
+        await sleep2(baseDelayMs * 2 ** i);
         continue;
       }
       return res;
     } catch (e) {
       lastErr = e;
       if (isLast) throw e;
-      await sleep(baseDelayMs * 2 ** i);
+      await sleep2(baseDelayMs * 2 ** i);
     }
   }
   throw lastErr;
 }
 
 // src/clean-exit.ts
+var UNDICI_GLOBAL_DISPATCHER_SYMBOL = Object.getOwnPropertySymbols(globalThis).find(
+  (s) => s.description === "undici.globalDispatcher.1" || s.description?.startsWith("undici.globalDispatcher.")
+) ?? /* @__PURE__ */ Symbol.for("undici.globalDispatcher.1");
 function globalDispatcher() {
-  const g = globalThis;
-  const sym = Object.getOwnPropertySymbols(g).find(
-    (s) => s.description === "undici.globalDispatcher.1" || s.description?.startsWith("undici.globalDispatcher.")
-  );
-  return sym ? g[sym] : void 0;
+  return globalThis[UNDICI_GLOBAL_DISPATCHER_SYMBOL];
 }
 function destroyHttpPool() {
   try {
@@ -4361,15 +4360,18 @@ function cursorProjectSlug(workspaceRoot) {
 function cursorProjectsRoot(env) {
   return (0, import_node_path6.join)(env.USERPROFILE ?? env.HOME ?? (0, import_node_os3.homedir)(), ".cursor", "projects");
 }
-function resolveClaudeTranscriptPath(hook, env = process.env) {
+function claudeTranscriptCandidate(hook, env = process.env) {
   const sessionId = hook.session_id?.trim();
   if (!sessionId || !/^[A-Za-z0-9_-]+$/.test(sessionId)) return void 0;
   const cwd = hook.cwd?.trim() || env.CLAUDE_PROJECT_DIR?.trim();
   if (!cwd) return void 0;
   const encoded = cwd.replace(/[^A-Za-z0-9]/g, "-");
   const root = (0, import_node_path6.join)(env.USERPROFILE ?? env.HOME ?? (0, import_node_os3.homedir)(), ".claude", "projects");
-  const candidate = (0, import_node_path6.join)(root, encoded, `${sessionId}.jsonl`);
-  return (0, import_node_fs8.existsSync)(candidate) ? candidate : void 0;
+  return (0, import_node_path6.join)(root, encoded, `${sessionId}.jsonl`);
+}
+function resolveClaudeTranscriptPath(hook, env = process.env) {
+  const candidate = claudeTranscriptCandidate(hook, env);
+  return candidate && (0, import_node_fs8.existsSync)(candidate) ? candidate : void 0;
 }
 function resolveCursorTranscriptPath(hook, env = process.env) {
   const conversationId = (hook.conversation_id ?? hook.conversationId ?? hook.session_id)?.trim();
@@ -5451,9 +5453,16 @@ function clearIngestSkip() {
   } catch {
   }
 }
+var INGEST_SKIP_REASON_MESSAGES = {
+  "no-transcript": "no transcript path \u2014 hook payload lacks transcript_path and adapter found no file",
+  "transcript-empty": "transcript had no user/assistant text",
+  "transcript-unreadable": "transcript unreadable",
+  "note-empty": "note source was empty"
+};
 function formatIngestSkip(record) {
   if (!record) return void 0;
-  const base2 = record.reason === "no-transcript" ? `last ingest skipped (${record.surface}): no transcript path \u2014 hook payload lacks transcript_path and adapter found no file` : record.reason === "transcript-empty" ? `last ingest skipped (${record.surface}): transcript had no user/assistant text` : record.reason === "transcript-unreadable" ? `last ingest skipped (${record.surface}): transcript unreadable` : record.reason === "note-empty" ? `last ingest skipped (${record.surface}): note source was empty` : `last ingest skipped (${record.surface}): ${record.reason}`;
+  const suffix = INGEST_SKIP_REASON_MESSAGES[record.reason] ?? record.reason;
+  const base2 = `last ingest skipped (${record.surface}): ${suffix}`;
   return record.detail ? `${base2} \u2014 ${record.detail}` : base2;
 }
 
@@ -5630,8 +5639,54 @@ async function secretsList(deps, opts) {
     deps.err(await upgradeMessage(res) ?? `secrets list failed: HTTP ${res.status}${await readErr(res)}`);
     return;
   }
-  const { secrets: secrets2 } = await res.json();
-  deps.log(formatSecretList(secrets2 ?? []));
+  const { secrets } = await res.json();
+  deps.log(formatSecretList(secrets ?? []));
+}
+function formatCapabilities(r) {
+  const head = `@${r.login} on ${r.repo} \u2014 ${r.role}`;
+  const items = [...r.capabilities ?? []].sort((a, b) => a.scope.localeCompare(b.scope));
+  if (!items.length) return `${head}
+
+no vault credentials visible`;
+  const width = Math.max(...items.map((i) => i.scope.length));
+  const lines = items.map(
+    (i) => `${i.accessible ? "+" : " "} ${i.scope.padEnd(width)}  ${i.tier.padEnd(7)} ${i.reason}`
+  );
+  const reachable = items.filter((i) => i.accessible).length;
+  return [
+    head,
+    "",
+    `${reachable}/${items.length} vault credential(s) reachable (names + tier + scope \u2014 values are never shown):`,
+    "",
+    ...lines,
+    "",
+    "+ = readable/usable now. Read one value: `mmi-cli secrets get <stage>/<KEY>` (only `get` prints a value)."
+  ].join("\n");
+}
+async function secretsCapabilities(deps, opts) {
+  const repo = await targetRepo(deps, opts);
+  const qs = new URLSearchParams({ repo }).toString();
+  let res;
+  try {
+    res = await deps.fetch(`${deps.apiUrl}/secrets/capabilities?${qs}`, {
+      method: "GET",
+      headers: await deps.headers(),
+      signal: AbortSignal.timeout(TIMEOUT_MS)
+    });
+  } catch (e) {
+    deps.err(`access capabilities: ${e.message}`);
+    return;
+  }
+  if (!res.ok) {
+    deps.err(await upgradeMessage(res) ?? `access capabilities failed: HTTP ${res.status}${await readErr(res)}`);
+    return;
+  }
+  const report = await res.json();
+  if (opts.json) {
+    deps.log(JSON.stringify(report, null, 2));
+    return;
+  }
+  deps.log(formatCapabilities(report));
 }
 var DEFAULT_RUNTIME_SECRET_NAMES = ["GOOGLE_CLIENT_ID", "GOOGLE_CLIENT_SECRET"];
 function stringList(v) {
@@ -5663,8 +5718,8 @@ async function secretsPreflight(deps, opts) {
     deps.err(await upgradeMessage(res) ?? `secrets preflight failed: HTTP ${res.status}${await readErr(res)}`);
     return false;
   }
-  const { secrets: secrets2 } = await res.json();
-  const present = new Set((secrets2 ?? []).map((s) => s.key));
+  const { secrets } = await res.json();
+  const present = new Set((secrets ?? []).map((s) => s.key));
   const required = opts.required.map((key) => stageKey(opts.stage, key));
   const missing = required.filter((key) => !present.has(key));
   if (missing.length) {
@@ -6104,9 +6159,16 @@ function parseHonchoQueueStatus(json) {
   const inProgressRaw = o.in_progress_work_units;
   const pending = typeof pendingRaw === "number" ? pendingRaw : null;
   const inProgress = typeof inProgressRaw === "number" ? inProgressRaw : null;
-  const stalled = (pending ?? 0) > 0 && (inProgress ?? 0) === 0;
+  const stalled = isDeriverStalledSnapshot(pending, inProgress);
   return { pending, inProgress, stalled };
 }
+function isDeriverStalledSnapshot(pending, inProgress) {
+  return (pending ?? 0) > 0 && (inProgress ?? 0) === 0;
+}
+var DERIVER_STALL_CONFIRM_MS = 750;
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
 var enc = encodeURIComponent;
 var base = (apiUrl) => apiUrl.replace(/\/+$/, "");
 var honchoRoutes = {
@@ -6131,8 +6193,9 @@ async function request(cfg, fetchImpl, method, path2, body, timeoutMs) {
     signal: AbortSignal.timeout(timeoutMs)
   });
 }
+var HONCHO_CORRELATION_MARKER = /\bHONCHO_\d/;
 function formatPeerCardLines(lines, maxChars = DEFAULT_HONCHO_CARD_MAX_CHARS) {
-  const card = Array.isArray(lines) ? lines.filter((s) => typeof s === "string" && s.trim().length > 0).join("\n").trim() : "";
+  const card = Array.isArray(lines) ? lines.filter((s) => typeof s === "string" && s.trim().length > 0 && !HONCHO_CORRELATION_MARKER.test(s)).join("\n").trim() : "";
   if (!card) return null;
   return capContent(card, maxChars);
 }
@@ -6239,6 +6302,23 @@ async function probeHoncho(cfg, fetchImpl = fetch, timeoutMs = 3e3, opts = {}) {
         }
       }
     }
+    if (queue.stalled) {
+      await sleep(DERIVER_STALL_CONFIRM_MS);
+      const confirmRes = await request(
+        cfg,
+        fetchImpl,
+        "GET",
+        honchoRoutes.queueStatus(cfg.workspace),
+        void 0,
+        timeoutMs
+      );
+      if (confirmRes.ok) {
+        try {
+          queue = parseHonchoQueueStatus(await confirmRes.json());
+        } catch {
+        }
+      }
+    }
     return { reachable: true, status: healthRes.status, authOk, authStatus: authRes.status, queue };
   } catch {
     return { reachable: false, authOk: false, queue: emptyQueue };
@@ -6351,11 +6431,14 @@ async function runHonchoIngest(opts) {
       }
     }
     if (!messages.length) {
+      const hint = ingestTranscriptFallbackHint(surface);
+      const tried = !transcriptPath && surface !== "cursor" ? claudeTranscriptCandidate(hook) : void 0;
+      const detail = [hint, tried ? `tried: ${tried}` : void 0].filter(Boolean).join(" \u2014 ") || void 0;
       recordIngestSkip({
         reason: transcriptPath ? "transcript-empty" : "no-transcript",
         surface,
         ts: (/* @__PURE__ */ new Date()).toISOString(),
-        detail: ingestTranscriptFallbackHint(surface)
+        detail
       });
       return;
     }
@@ -6571,9 +6654,24 @@ function registerHonchoCommands(program3) {
 }
 
 // src/throttle-commands.ts
+var import_node_child_process6 = require("node:child_process");
 var import_node_fs11 = require("node:fs");
 var import_node_path9 = require("node:path");
-var THROTTLE_TRACE_PATH = (0, import_node_path9.join)(".mmi", "throttle", "trace.jsonl");
+var THROTTLE_TRACE_REL = (0, import_node_path9.join)(".mmi", "throttle", "trace.jsonl");
+function resolveRepoGitRoot(cwd = process.cwd()) {
+  try {
+    const root = (0, import_node_child_process6.execFileSync)("git", ["-C", cwd, "rev-parse", "--show-toplevel"], {
+      encoding: "utf8",
+      timeout: 5e3
+    }).trim();
+    return root || cwd;
+  } catch {
+    return cwd;
+  }
+}
+function resolveThrottleTracePath(cwd = process.cwd()) {
+  return (0, import_node_path9.join)(resolveRepoGitRoot(cwd), THROTTLE_TRACE_REL);
+}
 function resolveModeFromEnv() {
   const v = String(process.env.MMI_THROTTLE_MODE ?? "block").trim().toLowerCase();
   if (v === "observe") return "observe";
@@ -6615,7 +6713,7 @@ function summarizeTrace(entries) {
   }
   return { denials, readBytesWouldBlock, byTool, byReason, bySurface, byMode };
 }
-function runThrottleReport(io, tracePath = THROTTLE_TRACE_PATH) {
+function runThrottleReport(io, tracePath = resolveThrottleTracePath()) {
   const mode = resolveModeFromEnv();
   if (!(0, import_node_fs11.existsSync)(tracePath)) {
     io.log(`Throttle: no trace at ${tracePath} (gates have not denied anything yet).`);
@@ -6840,7 +6938,7 @@ function applyScratchGc(plan2, mmiRoot, now = Date.now()) {
 function collectScratchSnapshot(repoRoot, deps = {}) {
   const readdir = deps.readdir ?? import_node_fs12.readdirSync;
   const stat = deps.stat ?? import_node_fs12.statSync;
-  const readFile6 = deps.readFile ?? import_node_fs12.readFileSync;
+  const readFile7 = deps.readFile ?? import_node_fs12.readFileSync;
   const mmiRoot = (0, import_node_path10.join)(repoRoot, ".mmi");
   const plansRoot = (0, import_node_path10.join)(repoRoot, "plans");
   const mmiFiles = [];
@@ -6873,7 +6971,7 @@ function collectScratchSnapshot(repoRoot, deps = {}) {
   let syncQueueSlugs = null;
   let queueRaw;
   try {
-    queueRaw = readFile6((0, import_node_path10.join)(plansRoot, ".sync-queue.json"), "utf8");
+    queueRaw = readFile7((0, import_node_path10.join)(plansRoot, ".sync-queue.json"), "utf8");
   } catch {
     syncQueueSlugs = /* @__PURE__ */ new Set();
   }
@@ -6995,7 +7093,7 @@ function northstarPointer(injected = false) {
 }
 
 // src/board.ts
-var import_node_child_process6 = require("node:child_process");
+var import_node_child_process7 = require("node:child_process");
 var import_node_util5 = require("node:util");
 
 // src/board-priority.ts
@@ -7103,7 +7201,7 @@ async function filterDependencyBlockedClaimables(items, client, opts = {}) {
 var BOARD_STATUSES = ["Todo", "In Progress", "In Review", "Done"];
 
 // src/board.ts
-var rawExecFileP3 = (0, import_node_util5.promisify)(import_node_child_process6.execFile);
+var rawExecFileP3 = (0, import_node_util5.promisify)(import_node_child_process7.execFile);
 var BOARD_GIT_TIMEOUT_MS = 1e4;
 var WRITE_PROBE_CONCURRENCY = 8;
 var CLAIM_CONCURRENCY = 5;
@@ -8292,7 +8390,7 @@ async function runNorthstarContext(io, deps) {
 }
 
 // src/index.ts
-var import_node_path17 = require("node:path");
+var import_node_path19 = require("node:path");
 
 // src/merge-ci-policy.ts
 function resolveMergeCiPolicy(input) {
@@ -8363,31 +8461,49 @@ async function waitForPrChecks(deps) {
 
 // src/bootstrap-ruleset.ts
 var PRODUCT_RULESET_NAME = "mmi-product-required-checks";
-var PRODUCT_GATE_CONTEXT = "gate";
 function stripRulesetComment(raw) {
   const parsed = JSON.parse(raw);
   delete parsed._comment;
   return parsed;
 }
-function rulesetHasGateContext(ruleset, context = PRODUCT_GATE_CONTEXT) {
+function rulesetRequiredContexts(ruleset) {
+  const contexts = [];
   for (const rule of ruleset.rules ?? []) {
     if (rule.type !== "required_status_checks") continue;
     for (const check of rule.parameters?.required_status_checks ?? []) {
-      if (check.context === context) return true;
+      if (check.context) contexts.push(check.context);
     }
   }
-  return false;
+  return contexts;
+}
+function patchRulesetRequiredContexts(body, contexts) {
+  const sorted = [...new Set(contexts)].sort((a, b) => a.localeCompare(b));
+  const rules2 = (body.rules ?? []).map((rule) => {
+    const r = rule;
+    if (r.type !== "required_status_checks") return rule;
+    return {
+      ...r,
+      parameters: {
+        ...r.parameters,
+        strict_required_status_checks_policy: r.parameters?.strict_required_status_checks_policy ?? false,
+        required_status_checks: sorted.map((context) => ({ context }))
+      }
+    };
+  });
+  return { ...body, rules: rules2 };
 }
 function findProductRuleset(rulesets) {
   return rulesets.find((r) => r.name === PRODUCT_RULESET_NAME);
 }
 async function activateProductRuleset(repo, rulesetBody, client) {
+  const want = new Set(rulesetRequiredContexts({ rules: rulesetBody.rules }));
   const list = await client.rest("GET", `repos/${repo}/rulesets`, { timeoutMs: 2e4 });
   const existing = findProductRuleset(list ?? []);
   if (existing?.id != null) {
     const detail = await client.rest("GET", `repos/${repo}/rulesets/${existing.id}`, { timeoutMs: 2e4 });
-    if (detail.enforcement === "active" && rulesetHasGateContext(detail)) {
-      return { action: "skipped", detail: "active ruleset already requires gate" };
+    const have = new Set(rulesetRequiredContexts(detail));
+    if (detail.enforcement === "active" && have.size === want.size && [...want].every((c) => have.has(c))) {
+      return { action: "skipped", detail: "active ruleset already matches required contexts" };
     }
     await client.rest("PUT", `repos/${repo}/rulesets/${existing.id}`, { body: rulesetBody, timeoutMs: 2e4 });
     return { action: "updated", detail: `ruleset ${existing.id}` };
@@ -8396,6 +8512,75 @@ async function activateProductRuleset(repo, rulesetBody, client) {
   return { action: "created" };
 }
 
+// src/workflow-context.ts
+function parseWorkflowJobIds(yaml) {
+  const lines = yaml.split(/\r?\n/);
+  let inJobs = false;
+  let jobIndent = -1;
+  const ids = [];
+  for (const line of lines) {
+    if (!inJobs) {
+      if (/^jobs:\s*$/.test(line)) inJobs = true;
+      continue;
+    }
+    if (/^\S/.test(line) && !line.startsWith("#")) break;
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith("#")) continue;
+    const match = line.match(/^(\s+)([A-Za-z0-9_-]+):\s*$/);
+    if (!match) continue;
+    const indent = match[1].length;
+    if (jobIndent < 0) {
+      jobIndent = indent;
+      ids.push(match[2]);
+      continue;
+    }
+    if (indent === jobIndent) ids.push(match[2]);
+    else if (indent < jobIndent) break;
+  }
+  return ids;
+}
+function workflowTriggersPullRequest(yaml) {
+  const onBlock = extractOnBlock(yaml);
+  if (!onBlock) return false;
+  return /\bpull_request\b/.test(onBlock);
+}
+function extractOnBlock(yaml) {
+  const lines = yaml.split(/\r?\n/);
+  let inOn = false;
+  let onIndent = -1;
+  const block = [];
+  for (const line of lines) {
+    if (!inOn) {
+      if (/^on:\s*$/.test(line)) {
+        inOn = true;
+        onIndent = 0;
+      } else if (/^on:\s+\S/.test(line)) {
+        return line;
+      }
+      continue;
+    }
+    if (/^\S/.test(line) && !line.startsWith("#")) break;
+    const match = line.match(/^(\s+)/);
+    const indent = match ? match[1].length : 0;
+    if (onIndent >= 0 && indent === 0 && line.trim()) break;
+    block.push(line);
+  }
+  return block.length ? block.join("\n") : null;
+}
+function collectPullRequestWorkflowContexts(workflows) {
+  const contexts = /* @__PURE__ */ new Set();
+  for (const wf of workflows) {
+    if (!workflowTriggersPullRequest(wf.body)) continue;
+    for (const id of parseWorkflowJobIds(wf.body)) contexts.add(id);
+  }
+  return [...contexts].sort((a, b) => a.localeCompare(b));
+}
+function contextsMatchRuleset(required, emitted) {
+  if (required.size !== emitted.size) return false;
+  for (const c of required) if (!emitted.has(c)) return false;
+  return true;
+}
+
 // src/bootstrap-seeds.ts
 var PLACEHOLDER_RE = /\{\{([A-Z0-9_]+)\}\}/g;
 function loadBootstrapSeeds(manifestJson) {
@@ -8435,6 +8620,8 @@ var MANAGED_GITIGNORE_LINES = [
   '# Org-wide cleanliness (AGENTS.md "Repo cleanliness") \u2014 enforced by `mmi-cli doctor`.',
   "# Do not edit inside these markers; this block is regenerated on the next doctor run.",
   "/tmp/",
+  // Ad-hoc agent scratch at repo root (e.g. tmp_diff.txt) — same class as /tmp/ (#1676).
+  "/tmp_*",
   // Plan scratch at ANY depth (root plans/, cli/plans/, .cursor/plans/) — AI planning docs are S3-synced
   // via `mmi-cli plan push`, never git-tracked (AGENTS.md "Repo cleanliness", #1550).
   "**/plans/",
@@ -8660,6 +8847,10 @@ function seedMatchesDeployModel(seed, deployModel) {
   if (!seed.deployModels?.length) return true;
   return deployModel != null && seed.deployModels.includes(deployModel);
 }
+function seedMatchesDashboard(seed, isDashboard) {
+  if (!seed.dashboard) return true;
+  return isDashboard;
+}
 function planSeedAction(seed, exists) {
   if (seed.source === "fanout") {
     return { target: seed.target, action: "skip", ownership: "fanout", reason: "delivered by the fanout pipeline" };
@@ -8707,10 +8898,10 @@ function labelsToPrune(orgLabelNames) {
   const org = new Set(orgLabelNames);
   return GITHUB_DEFAULT_LABELS.filter((name) => !org.has(name));
 }
-function resolveSeedContent(seed, vars, readFile6) {
-  if (seed.source === "self") return readFile6(seed.target);
+function resolveSeedContent(seed, vars, readFile7) {
+  if (seed.source === "self") return readFile7(seed.target);
   if (seed.source.startsWith("seed:")) {
-    const tmpl = readFile6(`skills/bootstrap/seeds/${seed.source.slice("seed:".length)}`);
+    const tmpl = readFile7(`skills/bootstrap/seeds/${seed.source.slice("seed:".length)}`);
     return tmpl == null ? null : renderSeed(tmpl, vars);
   }
   return null;
@@ -8767,6 +8958,9 @@ function buildRegisterPayload(repo, cls, vars, options = {}) {
     class: cls,
     projectType,
     deployModel,
+    // #1452: opt-in dashboard flag — only emitted when set (undefined keys are dropped below), so a
+    // non-dashboard repo's META is byte-identical to before. Gates the @mutmutco components.json seed.
+    dashboard: options.dashboard ? true : void 0,
     // #1359: always persist an explicit track so release tooling never guesses from absence alone.
     releaseTrack: resolveBootstrapReleaseTrack(cls, options.releaseTrack),
     // Board coords (from GraphQL at bootstrap, passed as --var by the skill).
@@ -8894,7 +9088,6 @@ function contentPutArgs(repo, path2, content, branch, sha) {
 
 // src/ci-audit.ts
 var HUB_REPO = "mutmutco/MMI-Hub";
-var PRODUCT_GATE_CONTEXT2 = "gate";
 var HUB_GATE_CONTEXTS = ["cli", "infra", "docs"];
 var PRODUCT_GATE_PATH = ".github/workflows/gate.yml";
 var PRODUCT_RULESET_REF = ".github/rulesets/mmi-product-required-checks.json";
@@ -8931,6 +9124,45 @@ async function rulesetDetails(deps, repo, list) {
   }
   return details;
 }
+async function fetchFileContent(deps, repo, branch, path2) {
+  try {
+    const encodedPath = path2.split("/").map(encodeURIComponent).join("/");
+    const file = await deps.client.rest(
+      "GET",
+      `repos/${repo}/contents/${encodedPath}?ref=${encodeURIComponent(branch)}`
+    );
+    if (file.encoding !== "base64" || typeof file.content !== "string") return null;
+    return Buffer.from(file.content, "base64").toString("utf8");
+  } catch {
+    return null;
+  }
+}
+async function listWorkflowPaths(deps, repo, branch) {
+  try {
+    const encodedPath = ".github/workflows".split("/").map(encodeURIComponent).join("/");
+    const entries = await deps.client.rest(
+      "GET",
+      `repos/${repo}/contents/${encodedPath}?ref=${encodeURIComponent(branch)}`
+    );
+    return (entries ?? []).filter((e) => e.type === "file" && /\.ya?ml$/i.test(e.name ?? "")).map((e) => `.github/workflows/${e.name}`);
+  } catch {
+    return [];
+  }
+}
+async function resolveEmittedPrContexts(deps, repo, branch) {
+  const paths = await listWorkflowPaths(deps, repo, branch);
+  const workflows = [];
+  for (const path2 of paths) {
+    const body = await fetchFileContent(deps, repo, branch, path2);
+    if (body) workflows.push({ path: path2, body });
+  }
+  return collectPullRequestWorkflowContexts(workflows);
+}
+function registryRequiredContexts(meta) {
+  const raw = meta?.requiredChecks;
+  if (!Array.isArray(raw) || raw.length === 0) return null;
+  return raw.filter((c) => typeof c === "string" && c.length > 0);
+}
 async function contentExists(deps, repo, branch, path2) {
   try {
     const encodedPath = path2.split("/").map(encodeURIComponent).join("/");
@@ -9030,13 +9262,25 @@ async function auditRepoCi(repo, deps) {
       detail: missing.length ? `missing: ${missing.join(", ")}` : void 0
     });
   } else if (deployableGated) {
-    const missing = [PRODUCT_GATE_CONTEXT2].filter((c) => !statusChecks.has(c));
+    const hasRequiredChecks = statusChecks.size > 0;
     checks.push({
-      ok: missing.length === 0,
-      label: "product gate status check active",
-      detail: missing.length ? `missing context: ${PRODUCT_GATE_CONTEXT2} \u2014 activate ${PRODUCT_RULESET_REF} as a repo ruleset` : void 0,
-      remediation: missing.length ? `Import ${PRODUCT_RULESET_REF} as an active repository ruleset (GitHub \u2192 Settings \u2192 Rules \u2192 Rulesets) \u2014 target: bootstrap --apply automation (#1440)` : void 0
+      ok: hasRequiredChecks,
+      label: "product required status checks active",
+      detail: hasRequiredChecks ? void 0 : `no required status checks active \u2014 activate ${PRODUCT_RULESET_REF} as a repo ruleset`,
+      remediation: hasRequiredChecks ? void 0 : `Import ${PRODUCT_RULESET_REF} as an active repository ruleset (GitHub \u2192 Settings \u2192 Rules \u2192 Rulesets) \u2014 target: bootstrap --apply automation (#1440)`
     });
+    if (hasGateWorkflow) {
+      const emitted = registryRequiredContexts(meta) ?? await resolveEmittedPrContexts(deps, repo, baseBranch);
+      if (emitted.length > 0) {
+        const aligned = contextsMatchRuleset(statusChecks, new Set(emitted));
+        checks.push({
+          ok: aligned,
+          label: "required check contexts match PR workflows",
+          detail: aligned ? void 0 : `ruleset requires [${[...statusChecks].sort().join(", ")}] but workflows emit [${emitted.join(", ")}]`,
+          remediation: aligned ? void 0 : `mmi-cli ci reconcile --repo ${repo} --apply`
+        });
+      }
+    }
   }
   const workflowPaths = hasGateWorkflow && repoClass === "deployable" ? [PRODUCT_GATE_PATH] : [];
   const { policy, reason } = resolveMergeCiPolicy({
@@ -9230,9 +9474,10 @@ async function applyCiReconcileRepo(repo, deps) {
   const report = await auditRepoCi(repo, deps);
   if (report.class !== "deployable") return merge;
   await seedGateYml(repo, deps, meta, merge);
-  const gateCheck = report.checks.find((c) => c.label === "product gate status check active");
-  if (gateCheck?.ok) {
-    merge.skipped.push("product ruleset already active");
+  const driftCheck = report.checks.find((c) => c.label === "required check contexts match PR workflows");
+  const requiredCheck = report.checks.find((c) => c.label === "product required status checks active");
+  if (requiredCheck?.ok && (driftCheck?.ok ?? true)) {
+    merge.skipped.push("product ruleset already active and aligned");
     return merge;
   }
   const raw = await fetchRulesetSeedBody(deps, repo);
@@ -9241,7 +9486,27 @@ async function applyCiReconcileRepo(repo, deps) {
     return merge;
   }
   try {
-    const body = stripRulesetComment(raw);
+    let body = stripRulesetComment(raw);
+    if (!driftCheck?.ok) {
+      const baseBranch = "development";
+      const emitted = registryRequiredContexts(meta) ?? await resolveEmittedPrContexts(deps, repo, baseBranch);
+      if (!emitted.length) {
+        merge.errors.push("cannot reconcile ruleset contexts \u2014 no PR workflow job ids found");
+        return merge;
+      }
+      body = patchRulesetRequiredContexts(body, emitted);
+      const activation2 = await activateProductRuleset(repo, body, deps.client);
+      if (activation2.action === "skipped") merge.skipped.push(activation2.detail ?? "product ruleset");
+      else merge.applied.push(`product ruleset ${activation2.action}${activation2.detail ? `: ${activation2.detail}` : ""}`);
+      try {
+        await putSeedFile(deps, repo, PRODUCT_RULESET_REF, `${JSON.stringify(body, null, 2)}
+`, baseBranch);
+        merge.applied.push(`reconciled ${PRODUCT_RULESET_REF} contexts \u2192 [${emitted.join(", ")}]`);
+      } catch (e) {
+        merge.errors.push(`ruleset reference commit failed (live ruleset updated): ${e.message}`);
+      }
+      return merge;
+    }
     const activation = await activateProductRuleset(repo, body, deps.client);
     if (activation.action === "skipped") merge.skipped.push(activation.detail ?? "product ruleset");
     else merge.applied.push(`product ruleset ${activation.action}${activation.detail ? `: ${activation.detail}` : ""}`);
@@ -9254,6 +9519,25 @@ async function applyCiReconcileRepo(repo, deps) {
 // src/pr-land.ts
 var PR_LAND_POLL_MS = 3e4;
 var PR_LAND_ENQUEUE_TIMEOUT_MS = 10 * 6e4;
+var PR_LAND_STATE_READ_RETRIES = 3;
+var PR_LAND_STATE_READ_DELAY_MS = 2e3;
+async function readGhPrStateWithRetry(fetchState2, options) {
+  const retries = options?.retries ?? PR_LAND_STATE_READ_RETRIES;
+  const delayMs = options?.delayMs ?? PR_LAND_STATE_READ_DELAY_MS;
+  const sleep2 = options?.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+  let lastError = "empty state";
+  for (let attempt = 0; attempt < retries; attempt++) {
+    try {
+      const state = (await fetchState2()).trim();
+      if (state) return { ok: true, state };
+      lastError = "empty state";
+    } catch (e) {
+      lastError = String(e.message || "gh pr view failed");
+    }
+    if (attempt < retries - 1) await sleep2(delayMs);
+  }
+  return { ok: false, error: lastError };
+}
 async function runPrLand(prNumber, options, deps) {
   const repo = await deps.resolveRepo(prNumber, options.repo);
   const base2 = { status: "failed", repo, pr: prNumber };
@@ -9461,22 +9745,15 @@ function formatManifestHuman(manifest) {
 // src/config-discovery.ts
 function stripMutableBoardConfig(cfg) {
   const {
-    projectOwner,
-    projectNumber,
-    projectId,
-    statusFieldId,
-    statusOptions,
-    priorityFieldId,
-    priorityOptions,
+    projectOwner: _projectOwner,
+    projectNumber: _projectNumber,
+    projectId: _projectId,
+    statusFieldId: _statusFieldId,
+    statusOptions: _statusOptions,
+    priorityFieldId: _priorityFieldId,
+    priorityOptions: _priorityOptions,
     ...rest
   } = cfg;
-  void projectOwner;
-  void projectNumber;
-  void projectId;
-  void statusFieldId;
-  void statusOptions;
-  void priorityFieldId;
-  void priorityOptions;
   return rest;
 }
 function boardConfigFromProject(meta, floor = {}) {
@@ -10160,7 +10437,7 @@ function buildRemoteBranchCleanupReport(branch, input) {
   return { name: branch, status: "not-attempted", reason: input.reason ?? "remote-check-unavailable" };
 }
 async function buildPrMergeRemoteBranchCleanupReport(branch, deps, input, options = {}) {
-  const sleep = options.sleep ?? defaultSleep;
+  const sleep2 = options.sleep ?? defaultSleep;
   const maxAttempts = options.maxAttempts ?? 5;
   const backoff = [500, 1e3, 1500, 2e3];
   if (!input.attempted) {
@@ -10171,7 +10448,7 @@ async function buildPrMergeRemoteBranchCleanupReport(branch, deps, input, option
   }
   let existsAfter = await deps.exists(branch, { prune: true });
   for (let i = 1; i < maxAttempts && existsAfter === true; i++) {
-    await sleep(backoff[Math.min(i - 1, backoff.length - 1)]);
+    await sleep2(backoff[Math.min(i - 1, backoff.length - 1)]);
     existsAfter = await deps.exists(branch, { prune: true });
   }
   return buildRemoteBranchCleanupReport(branch, {
@@ -10456,6 +10733,39 @@ function safeWorktreeRemoveCommand(safeCwd, targetPath) {
 function errorMessage(error) {
   return error instanceof Error ? error.message : String(error);
 }
+async function fastForwardCurrentBranch(git) {
+  try {
+    const before = (await git(["rev-parse", "HEAD"])).trim();
+    await git(["pull", "--ff-only"]);
+    const after = (await git(["rev-parse", "HEAD"])).trim();
+    return { status: before === after ? "up-to-date" : "fast-forwarded" };
+  } catch (e) {
+    return { status: "failed", error: errorMessage(e) };
+  }
+}
+async function returnCheckoutToBase(git, base2, mergedBranch, currentBranch) {
+  if (currentBranch === mergedBranch) {
+    const dirty = (await git(["status", "--porcelain"]).catch(() => "dirty") || "").trim().length > 0;
+    if (dirty) {
+      return { report: { branch: base2, switched: false, sync: "skipped", reason: "dirty-worktree" }, canDeleteBranch: false };
+    }
+    try {
+      await git(["checkout", base2]);
+    } catch (e) {
+      return {
+        report: { branch: base2, switched: false, sync: "skipped", reason: "checkout-failed", error: errorMessage(e) },
+        canDeleteBranch: false
+      };
+    }
+    const ff2 = await fastForwardCurrentBranch(git);
+    return { report: { branch: base2, switched: true, sync: ff2.status, ...ff2.error ? { error: ff2.error } : {} }, canDeleteBranch: true };
+  }
+  if (currentBranch !== base2) {
+    return { report: { branch: base2, switched: false, sync: "skipped", reason: "not-on-base" }, canDeleteBranch: true };
+  }
+  const ff = await fastForwardCurrentBranch(git);
+  return { report: { branch: base2, switched: false, sync: ff.status, ...ff.error ? { error: ff.error } : {} }, canDeleteBranch: true };
+}
 async function cleanupPrMergeLocalBranch(branch, options) {
   const report = {
     branch,
@@ -10549,7 +10859,19 @@ async function cleanupPrMergeLocalBranch(branch, options) {
     }
   }
   const current = (await git(["rev-parse", "--abbrev-ref", "HEAD"]).catch(() => "") || "").trim();
-  if (branch === current) {
+  if (options.returnToBranch && options.returnToBranch !== branch) {
+    const { report: checkout, canDeleteBranch } = await returnCheckoutToBase(
+      git,
+      options.returnToBranch,
+      branch,
+      current
+    );
+    report.checkout = checkout;
+    if (!canDeleteBranch) {
+      report.localBranch = { name: branch, status: "not-attempted", reason: checkout.reason ?? "current-branch" };
+      return report;
+    }
+  } else if (branch === current) {
     report.localBranch = { name: branch, status: "not-attempted", reason: "current-branch" };
     return report;
   }
@@ -10736,10 +11058,10 @@ function trainPlan(command, options = {}) {
     { label: "no residue: development already has the fix; the next /release fold + back-merge re-aligns version manifests" }
   ];
 }
-function bootstrapPlan(repo, repoClass) {
+function bootstrapPlan(repo, repoClass, opts = {}) {
   const branchModel = repoClass === "content" ? "content repo: main only" : "deployable repo: development, rc, main";
   const protectedBranches = repoClass === "content" ? "main" : "development, rc, main";
-  return [
+  const steps = [
     { label: `create or inspect ${repo}` },
     { label: `provision branch model: ${branchModel}`, gated: true },
     { label: `apply branch protection / allowlist: ${protectedBranches}`, gated: true },
@@ -10748,6 +11070,13 @@ function bootstrapPlan(repo, repoClass) {
     { label: "commit .claude/settings.json and .cursor/rules/<repo>.mdc", gated: true },
     { label: `register fanout target on ${repoClass === "content" ? "main" : "development"}`, gated: true }
   ];
+  if (opts.dashboard) {
+    steps.push({
+      label: "seed components.json wired to the @mutmutco registry; scaffold the app from the MMD-UI apps/starter",
+      gated: true
+    });
+  }
+  return steps;
 }
 
 // src/stage-default.ts
@@ -10863,7 +11192,7 @@ function decideStage(inputs) {
 }
 
 // src/cursor-plugin-seed.ts
-var import_node_child_process7 = require("node:child_process");
+var import_node_child_process8 = require("node:child_process");
 var import_node_fs15 = require("node:fs");
 var import_node_os5 = require("node:os");
 var import_node_path14 = require("node:path");
@@ -10874,7 +11203,7 @@ function isSemverVersion(v) {
 var MMI_HUB_REPO = "mutmutco/MMI-Hub";
 var CURSOR_THIRD_PARTY_STATE_KEY = "cursor/thirdPartyExtensibilityEnabled";
 var PLUGIN_JSON_REL = ".cursor-plugin/plugin.json";
-var execFileBuffer = (0, import_node_util6.promisify)(import_node_child_process7.execFile);
+var execFileBuffer = (0, import_node_util6.promisify)(import_node_child_process8.execFile);
 function gitFetchReleaseTagArgs(hubCheckout, tag) {
   return ["-C", hubCheckout, "fetch", "origin", "tag", tag, "--quiet"];
 }
@@ -11008,8 +11337,10 @@ function buildAwsCrossAccountCheck(input) {
     fix: AWS_CROSS_ACCOUNT_FIX
   };
 }
-var MMI_PLUGIN_ID = "mmi@mmi";
-var PLUGIN_LABEL = "plugin install record (mmi@mmi for this project)";
+var MMI_PLUGIN_ID = "mmi@mutmutco";
+var LEGACY_MMI_PLUGIN_ID = "mmi@mmi";
+var LEGACY_MMI_MARKETPLACE = "mmi";
+var PLUGIN_LABEL = "plugin install record (mmi@mutmutco for this project)";
 function pluginInstallManualFix(projectPath, surface = "claude-cli") {
   const register = surface === "codex" ? `\`codex plugin add ${MMI_PLUGIN_ID}\`` : surface === "cursor" ? `import the MMI Team Marketplace in Cursor Dashboard \u2192 Settings \u2192 Plugins (or enable the MMI plugin from the marketplace panel)` : surface === "shell" ? `enable the MMI plugin in your client` : surface === "claude-vscode" ? `\`claude plugin enable ${MMI_PLUGIN_ID}\`` : `\`/plugin install ${MMI_PLUGIN_ID}\``;
   return `run ${register} then ${reloadAction(surface)} to register the install record for ${projectPath}`;
@@ -11027,6 +11358,10 @@ function hasUserInstallRecord(file, pluginId) {
   if (!Array.isArray(records)) return false;
   return records.some((r) => r.scope === "user");
 }
+function hasAnyPluginRecords(file, pluginId) {
+  const records = file?.plugins?.[pluginId];
+  return Array.isArray(records) && records.length > 0;
+}
 function buildPluginInstallRecordCheck(input) {
   const pluginId = input.pluginId ?? MMI_PLUGIN_ID;
   const base2 = {
@@ -11036,6 +11371,13 @@ function buildPluginInstallRecordCheck(input) {
     pluginId
   };
   if (!input.isOrgRepo || !isMmiPluginEnabled(input.settings)) return base2;
+  if (hasAnyPluginRecords(input.installed, LEGACY_MMI_PLUGIN_ID) && !hasAnyPluginRecords(input.installed, pluginId)) {
+    return {
+      ...base2,
+      ok: false,
+      fix: `${CLAUDE_PLUGIN_RECOVERY}   # then ${reloadAction("claude-cli")}`
+    };
+  }
   if (hasProjectInstallRecord(input.installed, pluginId, input.projectPath) || hasUserInstallRecord(input.installed, pluginId)) return base2;
   const now = input.now ?? (/* @__PURE__ */ new Date()).toISOString();
   const recordToInsert = input.mirrorFrom ? {
@@ -11053,7 +11395,35 @@ function buildPluginInstallRecordCheck(input) {
     recordToInsert
   };
 }
-var PLUGIN_DRIFT_LABEL = "plugin config drift (mmi@mmi duplicate rows / stale gitCommitSha)";
+var LEGACY_PLUGIN_ID_LABEL = "legacy MMI plugin ID (mmi@mmi \u2192 mmi@mutmutco)";
+function buildLegacyPluginInstallCheck(input) {
+  const base2 = {
+    ok: true,
+    label: LEGACY_PLUGIN_ID_LABEL,
+    fix: pluginRecoveryFix(input.surface ?? "claude-cli"),
+    legacyPluginId: LEGACY_MMI_PLUGIN_ID
+  };
+  if (!input.isOrgRepo) return base2;
+  const staleSurfaces = [];
+  for (const source of input.sources) {
+    if (hasAnyPluginRecords(source.installed, LEGACY_MMI_PLUGIN_ID)) staleSurfaces.push(source.surface);
+  }
+  if (staleSurfaces.length === 0) return base2;
+  const fixParts = [];
+  if (staleSurfaces.includes("claude")) {
+    fixParts.push(`${CLAUDE_PLUGIN_RECOVERY}   # then ${reloadAction("claude-cli")}`);
+  }
+  if (staleSurfaces.includes("codex")) {
+    fixParts.push(`${CODEX_PLUGIN_RECOVERY}   # then ${reloadAction("codex")}`);
+  }
+  return {
+    ...base2,
+    ok: false,
+    staleSurfaces,
+    fix: fixParts.join(" ; ") || base2.fix
+  };
+}
+var PLUGIN_DRIFT_LABEL = "plugin config drift (mmi@mutmutco duplicate rows / stale gitCommitSha)";
 function recordFreshness(r) {
   return r.lastUpdated ?? r.installedAt ?? "";
 }
@@ -11226,18 +11596,20 @@ function reloadAction(surface) {
       return "restart Claude Code (or run /reload-plugins)";
   }
 }
-var CLAUDE_PLUGIN_RECOVERY = "claude plugin marketplace remove mmi && claude plugin marketplace add mutmutco/MMI-Hub && claude plugin install mmi@mmi";
+var CLAUDE_PLUGIN_RECOVERY = `claude plugin marketplace remove ${LEGACY_MMI_MARKETPLACE} && claude plugin marketplace remove mutmutco && claude plugin marketplace add mutmutco/MMI-Hub && claude plugin install mmi@mutmutco`;
 var CLAUDE_PLUGIN_HEAL_STEPS = [
-  { args: ["plugin", "marketplace", "remove", "mmi"], gated: false },
+  { args: ["plugin", "marketplace", "remove", LEGACY_MMI_MARKETPLACE], gated: false },
+  { args: ["plugin", "marketplace", "remove", "mutmutco"], gated: false },
   { args: ["plugin", "marketplace", "add", "mutmutco/MMI-Hub"], gated: true },
-  { args: ["plugin", "install", "mmi@mmi"], gated: true },
-  { args: ["plugin", "enable", "mmi@mmi"], gated: false }
+  { args: ["plugin", "install", "mmi@mutmutco"], gated: true },
+  { args: ["plugin", "enable", "mmi@mutmutco"], gated: false }
 ];
-var CODEX_PLUGIN_RECOVERY = "codex plugin marketplace remove mmi && codex plugin marketplace add mutmutco/MMI-Hub --ref main && codex plugin add mmi@mmi";
+var CODEX_PLUGIN_RECOVERY = `codex plugin marketplace remove ${LEGACY_MMI_MARKETPLACE} && codex plugin marketplace remove mutmutco && codex plugin marketplace add mutmutco/MMI-Hub --ref main && codex plugin add mmi@mutmutco`;
 var CODEX_PLUGIN_HEAL_STEPS = [
-  { args: ["plugin", "marketplace", "remove", "mmi"], gated: false },
+  { args: ["plugin", "marketplace", "remove", LEGACY_MMI_MARKETPLACE], gated: false },
+  { args: ["plugin", "marketplace", "remove", "mutmutco"], gated: false },
   { args: ["plugin", "marketplace", "add", "mutmutco/MMI-Hub", "--ref", "main"], gated: true },
-  { args: ["plugin", "add", "mmi@mmi"], gated: true }
+  { args: ["plugin", "add", "mmi@mutmutco"], gated: true }
 ];
 function healStepAborts(step, ok) {
   return !ok && step.gated;
@@ -11259,7 +11631,7 @@ function pluginRecoveryFix(surface) {
 }
 var PLUGIN_UPDATE_RECIPES = {
   claude: [CLAUDE_PLUGIN_RECOVERY],
-  codex: [CODEX_PLUGIN_RECOVERY, "codex plugin list   # verify mmi@mmi shows the released version"],
+  codex: [CODEX_PLUGIN_RECOVERY, "codex plugin list   # verify mmi@mutmutco shows the released version"],
   cli: ["npm install -g @mutmutco/cli@latest"]
 };
 function highestSemver(versions) {
@@ -11589,82 +11961,401 @@ async function runStageLiveDown(deps, t) {
   };
 }
 
-// src/stage-runner.ts
-var import_node_child_process8 = require("node:child_process");
+// src/design-system.ts
 var import_node_fs16 = require("node:fs");
 var import_node_path15 = require("node:path");
-var import_node_net2 = require("node:net");
-var import_node_util7 = require("node:util");
-var execFileP4 = (0, import_node_util7.promisify)(import_node_child_process8.execFile);
-var EARLY_EXIT_GRACE_MS = 2e3;
-function waitForProcessStability(child, graceMs = EARLY_EXIT_GRACE_MS) {
-  return new Promise((resolve, reject) => {
-    let settled = false;
-    const finish = (fn) => {
-      if (settled) return;
-      settled = true;
-      clearTimeout(timer);
-      child.removeAllListeners("error");
-      child.removeAllListeners("exit");
-      fn();
+var UI_PACKAGE_CANDIDATES = ["@mutmutco/ui-dashboard", "@mutmutco/ui", "@mutmutco/theme"];
+var DESIGN_SYSTEM_VERSION_LABEL = "@mutmutco design-system npm package (vs @latest)";
+function dashboardConsumerRegistryFix(error) {
+  return `Hub registry read failed (${error}) \u2014 could not verify dashboard UI state; likely transient (cold start, network, or auth blip) \u2014 retry shortly`;
+}
+var DESIGN_SYSTEM_FIX = (pkg) => `run \`npm update ${pkg}\` (or \`mmi-cli doctor --apply\` to update automatically)`;
+function buildDesignSystemVersionCheck(input) {
+  const base2 = {
+    ok: true,
+    label: DESIGN_SYSTEM_VERSION_LABEL,
+    fix: `install a current @mutmutco UI package \u2014 see MM-KB kb/guides/dashboard-ui.md`
+  };
+  if (!input.isConsumerRepo || !input.packageName) return base2;
+  if (!input.installedVersion) {
+    return {
+      ok: false,
+      label: DESIGN_SYSTEM_VERSION_LABEL,
+      fix: `add ${input.packageName} to package.json, then npm install \u2014 see kb/guides/dashboard-ui.md`,
+      packageName: input.packageName,
+      latestVersion: input.latestVersion
     };
-    const timer = setTimeout(() => finish(resolve), graceMs);
-    child.on("error", (err) => finish(() => reject(new Error(`stage process failed to start: ${err.message}`))));
-    child.on("exit", (code, signal) => {
-      const detail = code != null ? `code ${code}` : signal ? `signal ${signal}` : "unknown reason";
-      finish(() => reject(new Error(`stage process exited before health check (${detail})`)));
-    });
-  });
+  }
+  if (!input.latestVersion) {
+    return {
+      ...base2,
+      packageName: input.packageName,
+      installedVersion: input.installedVersion
+    };
+  }
+  if (compareVersions(input.installedVersion, input.latestVersion) < 0) {
+    return {
+      ok: false,
+      label: DESIGN_SYSTEM_VERSION_LABEL,
+      fix: DESIGN_SYSTEM_FIX(input.packageName),
+      packageName: input.packageName,
+      installedVersion: input.installedVersion,
+      latestVersion: input.latestVersion
+    };
+  }
+  return {
+    ...base2,
+    packageName: input.packageName,
+    installedVersion: input.installedVersion,
+    latestVersion: input.latestVersion
+  };
 }
-function envFileKeys(content) {
-  const keys = /* @__PURE__ */ new Set();
-  for (const line of content.split(/\r?\n/)) {
-    const trimmed = line.trim();
-    if (!trimmed || trimmed.startsWith("#")) continue;
-    const eq = trimmed.indexOf("=");
-    if (eq > 0) keys.add(trimmed.slice(0, eq).trim());
+function readJsonFile(path2) {
+  try {
+    return JSON.parse((0, import_node_fs16.readFileSync)(path2, "utf8"));
+  } catch {
+    return void 0;
   }
-  return keys;
 }
-function detectStaleEnvFile(exampleContent, targetContent, mtimes) {
-  const example = normalizeEol(exampleContent);
-  const target = normalizeEol(targetContent);
-  const exampleKeys = envFileKeys(example);
-  const targetKeys = envFileKeys(target);
-  for (const key of exampleKeys) {
-    if (!targetKeys.has(key)) return `missing key ${key} from .env.example`;
+function isUiFactoryCheckout(root) {
+  const pkg = readJsonFile((0, import_node_path15.join)(root, "package.json"));
+  return pkg?.name === "mmd-ui" && pkg?.private === true;
+}
+function resolveDeclaredUiPackage(root) {
+  const pkg = readJsonFile((0, import_node_path15.join)(root, "package.json"));
+  if (!pkg) return void 0;
+  const deps = { ...pkg.dependencies, ...pkg.devDependencies };
+  for (const name of UI_PACKAGE_CANDIDATES) {
+    const spec = deps[name];
+    if (spec && spec !== "*" && !spec.startsWith("workspace:")) return name;
   }
   return void 0;
 }
-function stageStatePath(cwd = process.cwd()) {
-  return (0, import_node_path15.join)(cwd, "tmp", "stage", "state.json");
+function readLockfileInstalledVersion(root, packageName) {
+  const lockPath = (0, import_node_path15.join)(root, "package-lock.json");
+  if (!(0, import_node_fs16.existsSync)(lockPath)) return void 0;
+  const lock = readJsonFile(lockPath);
+  const node = lock?.packages?.[`node_modules/${packageName}`];
+  const version = node?.version?.trim();
+  return version && /^\d+\.\d+\.\d+/.test(version) ? version : void 0;
 }
-function mergeEnvSecretsIntoFile(content, secrets2) {
-  const lines = content.split(/\r?\n/);
-  const indexByKey = /* @__PURE__ */ new Map();
-  for (let i = 0; i < lines.length; i++) {
-    const trimmed = lines[i].trim();
-    if (!trimmed || trimmed.startsWith("#")) continue;
-    const eq = trimmed.indexOf("=");
-    if (eq === -1) continue;
-    indexByKey.set(trimmed.slice(0, eq).trim(), i);
-  }
-  for (const [key, value] of Object.entries(secrets2)) {
-    const escaped = /[\s#"'\\]/.test(value) ? `"${value.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"` : value;
-    const line = `${key}=${escaped}`;
-    const idx = indexByKey.get(key);
-    if (idx != null) lines[idx] = line;
-    else lines.push(line);
+function npmUiPackageLatestArgs(packageName) {
+  return ["view", packageName, "version"];
+}
+function parseNpmViewVersion(stdout) {
+  const v = stdout.trim();
+  return /^\d+\.\d+\.\d+(-[0-9A-Za-z.-]+)?$/.test(v) ? v : void 0;
+}
+function isDashboardMetaConsumer(meta) {
+  return meta?.dashboard === true;
+}
+function designSystemSnapshot(root) {
+  if (isUiFactoryCheckout(root)) {
+    return {};
   }
-  const body = lines.join("\n");
-  return body.endsWith("\n") ? body : `${body}
-`;
+  const packageName = resolveDeclaredUiPackage(root);
+  return {
+    packageName,
+    installedVersion: packageName ? readLockfileInstalledVersion(root, packageName) : void 0
+  };
 }
-var POSIX_ONLY_VERBS = ["cp", "mv", "rm", "ln", "cat", "touch", "chmod", "export"];
-function posixOnlyShellProblems(command, field, platform2 = process.platform) {
-  if (platform2 !== "win32" || !command?.trim()) return [];
-  const problems = [];
-  if (/(^|&&|\||;)\s*[A-Za-z_][A-Za-z0-9_]*=\S/.test(command)) {
+
+// src/design-system-registry.ts
+var import_node_crypto7 = require("node:crypto");
+var import_node_fs18 = require("node:fs");
+var import_node_path16 = require("node:path");
+
+// src/atomic-write.ts
+var import_node_fs17 = require("node:fs");
+function atomicWriteFileSync(path2, content) {
+  const tmp = `${path2}.${process.pid}.tmp`;
+  (0, import_node_fs17.writeFileSync)(tmp, content, "utf8");
+  (0, import_node_fs17.renameSync)(tmp, path2);
+}
+
+// src/design-system-registry.ts
+var DESIGN_SYSTEM_CACHE_DIR = ".mmi/design-system/components";
+var DESIGN_SYSTEM_MANIFEST_PATH = ".mmi/design-system/manifest.json";
+var REGISTRY_COMPONENTS_LABEL = "@mutmutco registry components (.mmi cache vs live registry)";
+var REGISTRY_FIX = "run `mmi-cli doctor --apply` to pull registry components into `.mmi/design-system/components` \u2014 wire imports via `design-system.paths.json` (see kb/guides/dashboard-ui.md)";
+var REGISTRY_UNREACHABLE_FIX = "live @mutmutco registry unreachable \u2014 verify `components.json` `@mutmutco` registry URL and network, then retry `mmi-cli doctor`";
+function readJsonFile2(path2) {
+  try {
+    return JSON.parse((0, import_node_fs18.readFileSync)(path2, "utf8"));
+  } catch {
+    return void 0;
+  }
+}
+function readComponentsJson(root) {
+  return readJsonFile2((0, import_node_path16.join)(root, "components.json"));
+}
+function hasMutmutcoRegistry(root) {
+  const url = readComponentsJson(root)?.registries?.["@mutmutco"];
+  return typeof url === "string" && url.includes("{name}");
+}
+function resolveCacheDir(root) {
+  const custom = readComponentsJson(root)?.mmi?.cacheDir;
+  return (0, import_node_path16.join)(root, custom ?? DESIGN_SYSTEM_CACHE_DIR);
+}
+function resolveRegistryUrlTemplate(root) {
+  return readComponentsJson(root)?.registries?.["@mutmutco"];
+}
+function registryItemUrl(template, name) {
+  return template.replace("{name}", name);
+}
+function readDesignSystemManifest(root) {
+  const raw = readJsonFile2((0, import_node_path16.join)(root, DESIGN_SYSTEM_MANIFEST_PATH));
+  if (!raw || !Array.isArray(raw.components)) return void 0;
+  return raw;
+}
+function listInstalledRegistryComponents(root) {
+  const fromCfg = readComponentsJson(root)?.mmi?.installed?.filter((n) => typeof n === "string" && n.trim());
+  if (fromCfg?.length) return [...new Set(fromCfg.map((n) => n.trim()))];
+  const manifest = readDesignSystemManifest(root);
+  if (manifest?.components?.length) return [...manifest.components];
+  return scanCachedComponentNames(resolveCacheDir(root));
+}
+function scanCachedComponentNames(cacheDir) {
+  if (!(0, import_node_fs18.existsSync)(cacheDir)) return [];
+  const names = /* @__PURE__ */ new Set();
+  const walk = (dir) => {
+    for (const ent of (0, import_node_fs18.readdirSync)(dir, { withFileTypes: true })) {
+      const p = (0, import_node_path16.join)(dir, ent.name);
+      if (ent.isDirectory()) walk(p);
+      else if (ent.isFile() && /\.(tsx?|jsx?)$/.test(ent.name)) {
+        names.add(ent.name.replace(/\.(tsx|ts|jsx|js)$/, ""));
+      }
+    }
+  };
+  try {
+    walk(cacheDir);
+  } catch {
+  }
+  return [...names].sort();
+}
+function contentHash(content) {
+  return (0, import_node_crypto7.createHash)("sha256").update(content, "utf8").digest("hex");
+}
+function buildRegistryComponentsCheck(input) {
+  const base2 = {
+    ok: true,
+    label: REGISTRY_COMPONENTS_LABEL,
+    fix: "registry components are current in `.mmi/design-system/components`"
+  };
+  if (!input.isConsumerRepo || input.components.length === 0) return base2;
+  if (input.registryUnreachable) {
+    return {
+      ok: false,
+      label: REGISTRY_COMPONENTS_LABEL,
+      fix: REGISTRY_UNREACHABLE_FIX,
+      components: input.components,
+      cacheVersion: input.cacheVersion,
+      targetVersion: input.targetVersion
+    };
+  }
+  const missing = input.missingComponents ?? [];
+  const stale = input.staleComponents ?? [];
+  const versionBehind = Boolean(input.targetVersion) && (!input.cacheVersion || compareVersions(input.cacheVersion, input.targetVersion) < 0);
+  if (missing.length || stale.length || versionBehind) {
+    return {
+      ok: false,
+      label: REGISTRY_COMPONENTS_LABEL,
+      fix: REGISTRY_FIX,
+      components: input.components,
+      cacheVersion: input.cacheVersion,
+      targetVersion: input.targetVersion,
+      staleComponents: [.../* @__PURE__ */ new Set([...missing, ...stale])]
+    };
+  }
+  return {
+    ...base2,
+    components: input.components,
+    cacheVersion: input.cacheVersion,
+    targetVersion: input.targetVersion
+  };
+}
+function cacheRelativePath(target) {
+  const prefix = "components/";
+  return target.startsWith(prefix) ? target.slice(prefix.length) : target;
+}
+async function fetchRegistryItem(url, deps) {
+  try {
+    const res = await deps.fetch(url, { signal: AbortSignal.timeout(8e3) });
+    if (!res.ok) return void 0;
+    const json = await res.json();
+    if (!json?.name || !Array.isArray(json.files)) return void 0;
+    return json;
+  } catch {
+    return void 0;
+  }
+}
+async function gatherRegistryComponentsState(root, targetVersion, deps) {
+  const template = resolveRegistryUrlTemplate(root);
+  const components = listInstalledRegistryComponents(root);
+  if (!hasMutmutcoRegistry(root)) return { isConsumerRepo: false, components: [] };
+  if (components.length === 0) return { isConsumerRepo: true, components: [] };
+  if (!template) return { isConsumerRepo: true, components, registryUnreachable: true };
+  const cacheDir = resolveCacheDir(root);
+  const manifest = readDesignSystemManifest(root);
+  const missing = [];
+  const stale = [];
+  let fetchFailed = false;
+  for (const name of components) {
+    const item = await fetchRegistryItem(registryItemUrl(template, name), deps);
+    if (!item) {
+      fetchFailed = true;
+      continue;
+    }
+    let componentStale = false;
+    for (const file of item.files) {
+      if (!file.target || file.content == null) continue;
+      const cachePath = (0, import_node_path16.join)(cacheDir, cacheRelativePath(file.target));
+      if (!(0, import_node_fs18.existsSync)(cachePath)) {
+        componentStale = true;
+        break;
+      }
+      try {
+        if (contentHash((0, import_node_fs18.readFileSync)(cachePath, "utf8")) !== contentHash(file.content)) {
+          componentStale = true;
+          break;
+        }
+      } catch {
+        componentStale = true;
+        break;
+      }
+    }
+    if (componentStale) {
+      if ((0, import_node_fs18.existsSync)((0, import_node_path16.join)(cacheDir, "ui", `${name}.tsx`)) || (0, import_node_fs18.existsSync)((0, import_node_path16.join)(cacheDir, `${name}.tsx`))) {
+        stale.push(name);
+      } else {
+        missing.push(name);
+      }
+    }
+  }
+  return {
+    isConsumerRepo: true,
+    components,
+    cacheVersion: manifest?.version,
+    targetVersion,
+    missingComponents: missing,
+    staleComponents: stale,
+    registryUnreachable: fetchFailed && missing.length === 0 && stale.length === 0
+  };
+}
+async function applyRegistryComponentsSync(root, components, targetVersion, log, deps) {
+  const template = resolveRegistryUrlTemplate(root);
+  if (!template || components.length === 0) return { ok: true };
+  const cacheDir = resolveCacheDir(root);
+  deps.mkdir(cacheDir);
+  for (const name of components) {
+    log(`  \u21BB syncing registry component @mutmutco/${name}\u2026`);
+    const item = await fetchRegistryItem(registryItemUrl(template, name), deps);
+    if (!item) return { ok: false };
+    for (const file of item.files) {
+      if (!file.target || file.content == null) continue;
+      const outPath = (0, import_node_path16.join)(cacheDir, cacheRelativePath(file.target));
+      deps.mkdir((0, import_node_path16.dirname)(outPath));
+      const body = file.content.endsWith("\n") ? file.content : `${file.content}
+`;
+      deps.writeFile(outPath, body);
+    }
+  }
+  const manifestPath = (0, import_node_path16.join)(root, DESIGN_SYSTEM_MANIFEST_PATH);
+  deps.mkdir((0, import_node_path16.dirname)(manifestPath));
+  const manifest = {
+    version: targetVersion,
+    syncedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    components: [...components],
+    registryUrl: template
+  };
+  deps.writeFile(manifestPath, `${JSON.stringify(manifest, null, 2)}
+`);
+  return { ok: true, cacheVersion: targetVersion };
+}
+function defaultRegistrySyncDeps() {
+  return {
+    fetch,
+    writeFile: (path2, content) => atomicWriteFileSync(path2, content),
+    mkdir: (path2) => (0, import_node_fs18.mkdirSync)(path2, { recursive: true })
+  };
+}
+
+// src/stage-runner.ts
+var import_node_child_process9 = require("node:child_process");
+var import_node_fs19 = require("node:fs");
+var import_node_path17 = require("node:path");
+var import_node_net2 = require("node:net");
+var import_node_util7 = require("node:util");
+var execFileP4 = (0, import_node_util7.promisify)(import_node_child_process9.execFile);
+var EARLY_EXIT_GRACE_MS = 2e3;
+function waitForProcessStability(child, graceMs = EARLY_EXIT_GRACE_MS) {
+  return new Promise((resolve, reject) => {
+    let settled = false;
+    const finish = (fn) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      child.removeAllListeners("error");
+      child.removeAllListeners("exit");
+      fn();
+    };
+    const timer = setTimeout(() => finish(resolve), graceMs);
+    child.on("error", (err) => finish(() => reject(new Error(`stage process failed to start: ${err.message}`))));
+    child.on("exit", (code, signal) => {
+      const detail = code != null ? `code ${code}` : signal ? `signal ${signal}` : "unknown reason";
+      finish(() => reject(new Error(`stage process exited before health check (${detail})`)));
+    });
+  });
+}
+function envFileKeys(content) {
+  const keys = /* @__PURE__ */ new Set();
+  for (const line of content.split(/\r?\n/)) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith("#")) continue;
+    const eq = trimmed.indexOf("=");
+    if (eq > 0) keys.add(trimmed.slice(0, eq).trim());
+  }
+  return keys;
+}
+function detectStaleEnvFile(exampleContent, targetContent, mtimes) {
+  const example = normalizeEol(exampleContent);
+  const target = normalizeEol(targetContent);
+  const exampleKeys = envFileKeys(example);
+  const targetKeys = envFileKeys(target);
+  for (const key of exampleKeys) {
+    if (!targetKeys.has(key)) return `missing key ${key} from .env.example`;
+  }
+  return void 0;
+}
+function stageStatePath(cwd = process.cwd()) {
+  return (0, import_node_path17.join)(cwd, "tmp", "stage", "state.json");
+}
+function mergeEnvSecretsIntoFile(content, secrets) {
+  const lines = content.split(/\r?\n/);
+  const indexByKey = /* @__PURE__ */ new Map();
+  for (let i = 0; i < lines.length; i++) {
+    const trimmed = lines[i].trim();
+    if (!trimmed || trimmed.startsWith("#")) continue;
+    const eq = trimmed.indexOf("=");
+    if (eq === -1) continue;
+    indexByKey.set(trimmed.slice(0, eq).trim(), i);
+  }
+  for (const [key, value] of Object.entries(secrets)) {
+    const escaped = /[\s#"'\\]/.test(value) ? `"${value.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"` : value;
+    const line = `${key}=${escaped}`;
+    const idx = indexByKey.get(key);
+    if (idx != null) lines[idx] = line;
+    else lines.push(line);
+  }
+  const body = lines.join("\n");
+  return body.endsWith("\n") ? body : `${body}
+`;
+}
+var POSIX_ONLY_VERBS = ["cp", "mv", "rm", "ln", "cat", "touch", "chmod", "export"];
+function posixOnlyShellProblems(command, field, platform2 = process.platform) {
+  if (platform2 !== "win32" || !command?.trim()) return [];
+  const problems = [];
+  if (/(^|&&|\||;)\s*[A-Za-z_][A-Za-z0-9_]*=\S/.test(command)) {
     problems.push(
       `stage.${field} uses POSIX inline env assignment (VAR=value command) which fails in cmd.exe on Windows; use 'set VAR=value && command' or a cross-platform launcher`
     );
@@ -11720,9 +12411,9 @@ async function shell(command, cwd, timeoutMs) {
   });
 }
 function readState(path2) {
-  if (!(0, import_node_fs16.existsSync)(path2)) return null;
+  if (!(0, import_node_fs19.existsSync)(path2)) return null;
   try {
-    return JSON.parse((0, import_node_fs16.readFileSync)(path2, "utf8"));
+    return JSON.parse((0, import_node_fs19.readFileSync)(path2, "utf8"));
   } catch {
     return null;
   }
@@ -11774,7 +12465,7 @@ async function stopStage(opts = {}) {
     return { ok: true, action: "stop", statePath, message: "no previous stage state found" };
   }
   await killTree(state.pid);
-  (0, import_node_fs16.rmSync)(statePath, { force: true });
+  (0, import_node_fs19.rmSync)(statePath, { force: true });
   return { ok: true, action: "stop", statePath, pid: state.pid, message: `stopped previous stage pid ${state.pid}` };
 }
 async function startStage(config = {}, opts = {}) {
@@ -11783,7 +12474,7 @@ async function startStage(config = {}, opts = {}) {
   const cwd = opts.cwd ?? process.cwd();
   const statePath = opts.statePath ?? stageStatePath(cwd);
   const dir = statePath.slice(0, Math.max(statePath.lastIndexOf("/"), statePath.lastIndexOf("\\")));
-  (0, import_node_fs16.mkdirSync)(dir, { recursive: true });
+  (0, import_node_fs19.mkdirSync)(dir, { recursive: true });
   let stagePort;
   if (config.portRange) {
     const [s, e] = config.portRange;
@@ -11793,14 +12484,14 @@ async function startStage(config = {}, opts = {}) {
   }
   const sub = (s) => s != null && stagePort != null ? s.replace(/\$\{?STAGE_PORT\}?/g, String(stagePort)) : s;
   if (config.ensureEnv) {
-    const target = (0, import_node_path15.join)(cwd, config.ensureEnv.target);
-    const example = (0, import_node_path15.join)(cwd, config.ensureEnv.example);
-    if (!(0, import_node_fs16.existsSync)(target) && (0, import_node_fs16.existsSync)(example)) {
-      (0, import_node_fs16.copyFileSync)(example, target);
-    } else if ((0, import_node_fs16.existsSync)(target) && (0, import_node_fs16.existsSync)(example)) {
-      const stale = detectStaleEnvFile((0, import_node_fs16.readFileSync)(example, "utf8"), (0, import_node_fs16.readFileSync)(target, "utf8"), {
-        exampleMtimeMs: (0, import_node_fs16.statSync)(example).mtimeMs,
-        targetMtimeMs: (0, import_node_fs16.statSync)(target).mtimeMs
+    const target = (0, import_node_path17.join)(cwd, config.ensureEnv.target);
+    const example = (0, import_node_path17.join)(cwd, config.ensureEnv.example);
+    if (!(0, import_node_fs19.existsSync)(target) && (0, import_node_fs19.existsSync)(example)) {
+      (0, import_node_fs19.copyFileSync)(example, target);
+    } else if ((0, import_node_fs19.existsSync)(target) && (0, import_node_fs19.existsSync)(example)) {
+      const stale = detectStaleEnvFile((0, import_node_fs19.readFileSync)(example, "utf8"), (0, import_node_fs19.readFileSync)(target, "utf8"), {
+        exampleMtimeMs: (0, import_node_fs19.statSync)(example).mtimeMs,
+        targetMtimeMs: (0, import_node_fs19.statSync)(target).mtimeMs
       });
       if (stale) {
         const msg = `stale ${config.ensureEnv.target} (${stale}) \u2014 delete it or refresh from ${config.ensureEnv.example} before re-running /stage`;
@@ -11808,14 +12499,14 @@ async function startStage(config = {}, opts = {}) {
         console.error(`mmi-cli stage: ${msg} (allowed via --allow-stale-env)`);
       }
     }
-    if (opts.vaultEnvMerge && Object.keys(opts.vaultEnvMerge).length && (0, import_node_fs16.existsSync)(target)) {
-      (0, import_node_fs16.writeFileSync)(target, mergeEnvSecretsIntoFile((0, import_node_fs16.readFileSync)(target, "utf8"), opts.vaultEnvMerge), "utf8");
+    if (opts.vaultEnvMerge && Object.keys(opts.vaultEnvMerge).length && (0, import_node_fs19.existsSync)(target)) {
+      (0, import_node_fs19.writeFileSync)(target, mergeEnvSecretsIntoFile((0, import_node_fs19.readFileSync)(target, "utf8"), opts.vaultEnvMerge), "utf8");
     }
   }
   const extraEnv = {};
   for (const [k, v] of Object.entries(config.env ?? {})) extraEnv[k] = sub(v) ?? v;
   const up = sub(config.up.trim());
-  const child = (0, import_node_child_process8.spawn)(up, {
+  const child = (0, import_node_child_process9.spawn)(up, {
     cwd,
     shell: true,
     // POSIX-only: the process group exists for the group-kill in stopStage. On win32 teardown is
@@ -11834,13 +12525,13 @@ async function startStage(config = {}, opts = {}) {
     healthUrl: sub(config.healthUrl?.trim()) || void 0,
     port: stagePort
   };
-  (0, import_node_fs16.writeFileSync)(statePath, JSON.stringify(state, null, 2), "utf8");
+  (0, import_node_fs19.writeFileSync)(statePath, JSON.stringify(state, null, 2), "utf8");
   try {
     if (state.healthUrl) await waitForHealth(state.healthUrl, opts.timeoutMs ?? 6e4, config.healthAnyStatus);
     else await waitForProcessStability(child);
   } catch (e) {
     await killTree(state.pid);
-    (0, import_node_fs16.rmSync)(statePath, { force: true });
+    (0, import_node_fs19.rmSync)(statePath, { force: true });
     throw e;
   }
   const result = { ok: true, action: "start", statePath, pid: state.pid, port: stagePort, message: `started stage pid ${state.pid}${stagePort != null ? ` on port ${stagePort}` : ""}` };
@@ -11884,7 +12575,10 @@ async function reconcileDirtyOrgSpineBeforePull(deps, branch, options = {}) {
 // src/git-clean-tree.ts
 function isAgentScratchPath(path2) {
   const normalized = path2.replace(/\\/g, "/").trim();
-  return normalized === ".mmi" || normalized.startsWith(".mmi/");
+  if (normalized === ".mmi" || normalized.startsWith(".mmi/")) {
+    return true;
+  }
+  return /^tmp_[^/]+$/.test(normalized);
 }
 function porcelainHasBlockingChanges(porcelain) {
   return porcelain.split("\n").some((line) => {
@@ -11895,6 +12589,35 @@ function porcelainHasBlockingChanges(porcelain) {
   });
 }
 
+// src/tenant-control-parse.ts
+var OUTPUT_BEGIN = "mmi-control-output-begin";
+var OUTPUT_END = "mmi-control-output-end";
+function extractControlOutputFromLog(log) {
+  const lines = log.split(/\r?\n/);
+  const start = lines.findIndex((l) => l.trim() === OUTPUT_BEGIN);
+  if (start < 0) return "";
+  const end = lines.findIndex((l, i) => i > start && l.trim() === OUTPUT_END);
+  const slice = end < 0 ? lines.slice(start + 1) : lines.slice(start + 1, end);
+  return slice.join("\n").trim();
+}
+function parseStatusSnippet(stdout) {
+  const t = stdout.toLowerCase();
+  const m = t.match(/service[:=]\s*(running|stopped|missing|up|down|absent)/);
+  if (!m) return { serviceState: "unknown" };
+  const token = m[1];
+  if (token === "running" || token === "up") return { serviceState: "running" };
+  if (token === "stopped" || token === "down") return { serviceState: "stopped" };
+  return { serviceState: "missing" };
+}
+function parseVerifySecrets(stdout) {
+  const out = [];
+  for (const line of stdout.split("\n")) {
+    const m = /^(\S+):\s*(match|mismatch|missing)\b/.exec(line.trim());
+    if (m) out.push({ key: m[1], status: m[2] });
+  }
+  return out;
+}
+
 // src/train-apply.ts
 function resolveDeployModel2(meta, repo) {
   const m = meta?.deployModel;
@@ -11969,7 +12692,8 @@ var ORG_SPINE_FILES = [
   ".claude/settings.json",
   ".claude/output-styles/mmi-plain.md",
   ".cursor/rules/mmi-plain-language.mdc",
-  ".cursor/rules/mmi-tool-economy.mdc"
+  ".cursor/rules/mmi-tool-economy.mdc",
+  ".cursor/rules/mmi-code-economy.mdc"
 ];
 function isSpinePath(path2) {
   return ORG_SPINE_FILES.includes(path2);
@@ -12101,53 +12825,23 @@ function requireProjectMetaForTrain(load, repo) {
 var CORRELATE_ATTEMPTS = 5;
 var CORRELATE_DELAY_MS = 1500;
 var CORRELATE_SKEW_SLACK_MS = 1e4;
+var defaultSleep2 = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+function resolveSleep(deps) {
+  return deps.sleep ?? defaultSleep2;
+}
 var TRAIN_CHECK_RUNS_JQ = "[.check_runs[]|{name:.name,status:.status,conclusion:.conclusion}]";
 var TRAIN_COMMIT_STATUS_JQ = "[.statuses[]|{context:.context,state:.state}]";
 var TRAIN_PROTECTION_CONTEXTS_JQ = "[.contexts[]]";
 var TRAIN_RULES_CONTEXTS_JQ = '[.[]|select(.type=="required_status_checks")|.parameters.required_status_checks[].context]';
 var TRAIN_CHECK_ATTEMPTS = 40;
 var TRAIN_CHECK_DELAY_MS = 15e3;
-async function correlateDispatchedRun(deps, workflow, since) {
-  const sleep = deps.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
-  const threshold = since - CORRELATE_SKEW_SLACK_MS;
-  for (let attempt = 0; attempt < CORRELATE_ATTEMPTS; attempt++) {
-    if (attempt > 0) await sleep(CORRELATE_DELAY_MS);
-    let rows;
-    try {
-      const out = await deps.run("gh", [
-        "run",
-        "list",
-        "--repo",
-        HUB_REPO3,
-        "--workflow",
-        workflow,
-        "--limit",
-        "10",
-        "--json",
-        "databaseId,url,event,createdAt"
-      ]);
-      rows = JSON.parse(out);
-    } catch {
-      continue;
-    }
-    const match = rows.filter((r) => r.event === "workflow_dispatch" && typeof r.databaseId === "number").map((r) => ({ row: r, created: Date.parse(r.createdAt ?? "") })).filter((c) => Number.isFinite(c.created) && c.created >= threshold).sort((a, b) => b.created - a.created)[0];
-    if (match) return { runId: match.row.databaseId, runUrl: match.row.url };
-  }
-  return {};
-}
-function correlateTenantRun(deps, since) {
-  return correlateDispatchedRun(deps, "tenant-deploy.yml", since);
-}
-function correlatePublishRun(deps, since) {
-  return correlateDispatchedRun(deps, "tenant-publish.yml", since);
-}
-async function correlateWorkflowRun(deps, args) {
-  const sleep = deps.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+async function correlateRun(deps, args) {
+  const sleep2 = resolveSleep(deps);
   const threshold = args.since - CORRELATE_SKEW_SLACK_MS;
   let lastError;
   let parsedAnyResponse = false;
   for (let attempt = 0; attempt < CORRELATE_ATTEMPTS; attempt++) {
-    if (attempt > 0) await sleep(CORRELATE_DELAY_MS);
+    if (attempt > 0) await sleep2(CORRELATE_DELAY_MS);
     const listArgs = [
       "run",
       "list",
@@ -12155,28 +12849,43 @@ async function correlateWorkflowRun(deps, args) {
       HUB_REPO3,
       "--workflow",
       args.workflow,
-      "--event",
-      args.event,
-      ...args.branch ? ["--branch", args.branch] : [],
+      ...args.mode === "workflow" ? ["--event", args.event] : [],
+      ...args.mode === "workflow" && args.branch ? ["--branch", args.branch] : [],
       "--limit",
       "10",
       "--json",
-      "databaseId,url,event,createdAt,status,conclusion,headSha"
+      args.mode === "dispatch" ? "databaseId,url,event,createdAt" : "databaseId,url,event,createdAt,status,conclusion,headSha"
     ];
     let rows;
     try {
       rows = JSON.parse(await deps.run("gh", listArgs));
       parsedAnyResponse = true;
     } catch {
-      lastError = new Error(`could not list ${args.workflow} runs`);
+      if (args.mode === "workflow") lastError = new Error(`could not list ${args.workflow} runs`);
       continue;
     }
-    const match = rows.filter((r) => r.event === args.event && r.headSha === args.headSha && typeof r.databaseId === "number").map((r) => ({ row: r, created: Date.parse(r.createdAt ?? "") })).filter((c) => Number.isFinite(c.created) && c.created >= threshold).sort((a, b) => b.created - a.created)[0];
+    const match = rows.filter((r) => {
+      if (typeof r.databaseId !== "number") return false;
+      if (args.mode === "dispatch") return r.event === "workflow_dispatch";
+      return r.event === args.event && r.headSha === args.headSha;
+    }).map((r) => ({ row: r, created: Date.parse(r.createdAt ?? "") })).filter((c) => Number.isFinite(c.created) && c.created >= threshold).sort((a, b) => b.created - a.created)[0];
     if (match) return { runId: match.row.databaseId, runUrl: match.row.url };
   }
-  if (!parsedAnyResponse && lastError) throw lastError;
+  if (args.mode === "workflow" && !parsedAnyResponse && lastError) throw lastError;
   return {};
 }
+function correlateTenantRun(deps, since) {
+  return correlateRun(deps, { workflow: "tenant-deploy.yml", since, mode: "dispatch" });
+}
+function correlatePublishRun(deps, since) {
+  return correlateRun(deps, { workflow: "tenant-publish.yml", since, mode: "dispatch" });
+}
+function correlateControlRun(deps, since) {
+  return correlateRun(deps, { workflow: "tenant-control.yml", since, mode: "dispatch" });
+}
+async function correlateWorkflowRun(deps, args) {
+  return correlateRun(deps, { ...args, mode: "workflow" });
+}
 async function watchTenantRun(deps, runId) {
   if (runId == null) return "pending";
   try {
@@ -12186,6 +12895,13 @@ async function watchTenantRun(deps, runId) {
     return "failure";
   }
 }
+async function fetchControlRunLog(deps, runId) {
+  try {
+    return await deps.run("gh", ["run", "view", String(runId), "--repo", HUB_REPO3, "--log"]);
+  } catch {
+    return "";
+  }
+}
 async function watchWorkflowRun(deps, workflow, run) {
   if (run.runId == null) return { workflow, conclusion: "pending" };
   const conclusion = await watchTenantRun(deps, run.runId);
@@ -12286,11 +13002,11 @@ async function waitForRequiredTrainChecks(deps, ctx, sha, required) {
   if (required.length === 0) {
     return "no required status checks configured on the target branch \u2014 check wait skipped (GitHub push gate is the backstop)";
   }
-  const sleep = deps.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+  const sleep2 = resolveSleep(deps);
   let lastStatus = "not checked";
   let lastError;
   for (let attempt = 0; attempt < TRAIN_CHECK_ATTEMPTS; attempt++) {
-    if (attempt > 0) await sleep(TRAIN_CHECK_DELAY_MS);
+    if (attempt > 0) await sleep2(TRAIN_CHECK_DELAY_MS);
     let checkRuns;
     let statuses;
     try {
@@ -12366,18 +13082,77 @@ function isTransientDispatchFailure(e) {
   return /timed? ?out|timeout|aborted|network|fetch failed|ECONNRESET|ECONNREFUSED|EAI_AGAIN/i.test(msg);
 }
 async function dispatchTenantDeployWithRetry(deps, input) {
-  const sleep = deps.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+  const sleep2 = resolveSleep(deps);
   for (let attempt = 1; ; attempt++) {
     try {
       await deps.dispatchTenantDeploy(input);
       return;
     } catch (e) {
       if (attempt >= DISPATCH_ATTEMPTS || !isTransientDispatchFailure(e)) throw e;
-      await sleep(DISPATCH_RETRY_DELAY_MS * attempt);
+      await sleep2(DISPATCH_RETRY_DELAY_MS * attempt);
     }
   }
 }
-async function dispatchDeploy(deps, ctx, stage2, ref, model, watch, autoRunSince, autoRunHeadSha, dispatchFailure = "throw") {
+function tenantPublishRecoveryCommand(slug, repo, ref, stage2, publishDir) {
+  const parts = [
+    `gh workflow run tenant-publish.yml --repo ${HUB_REPO3}`,
+    `-f slug=${slug}`,
+    `-f repo=${repo}`,
+    `-f ref=${ref}`,
+    `-f stage=${stage2}`
+  ];
+  if (publishDir && publishDir !== ".") parts.push(`-f publishDir=${publishDir}`);
+  return parts.join(" ");
+}
+async function dispatchTenantPublish(deps, ctx, stage2, ref, watch, dispatchFailure = "throw", publishDir) {
+  const since = (deps.now ?? Date.now)();
+  const dispatchArgs = [
+    "workflow",
+    "run",
+    "tenant-publish.yml",
+    "--repo",
+    HUB_REPO3,
+    "-f",
+    `slug=${ctx.slug}`,
+    "-f",
+    `repo=${ctx.repo}`,
+    "-f",
+    `ref=${ref}`,
+    "-f",
+    `stage=${stage2}`
+  ];
+  if (publishDir && publishDir !== ".") dispatchArgs.push("-f", `publishDir=${publishDir}`);
+  try {
+    await deps.run("gh", dispatchArgs);
+  } catch (e) {
+    if (dispatchFailure === "throw") throw e;
+    const msg = e instanceof Error ? e.message : String(e);
+    const recovery = tenantPublishRecoveryCommand(ctx.slug, ctx.repo, ref, stage2, publishDir);
+    return {
+      note: `tenant-publish dispatch FAILED: ${msg}. The promotion itself landed \u2014 recover with \`${recovery}\``,
+      deployStatus: "failure"
+    };
+  }
+  const { runId, runUrl } = await correlatePublishRun(deps, since);
+  const deployStatus = watch ? await watchTenantRun(deps, runId) : "pending";
+  return { note: `dispatched tenant-publish.yml (slug=${ctx.slug}, ref=${ref}, stage=${stage2})`, runId, runUrl, deployStatus };
+}
+async function dispatchPublishIfRequired(deps, ctx, meta, model, stage2, publishRef, watch, dispatchFailure) {
+  if (!meta.publishRequired || stage2 !== "main") return null;
+  if (model !== "tenant-container" && model !== "solo-container") return null;
+  return dispatchTenantPublish(deps, ctx, stage2, publishRef, watch, dispatchFailure, meta.publishDir);
+}
+function appendPublishDispatch(deploy, publish) {
+  if (!publish) return deploy;
+  return {
+    note: `${deploy.note}; ${publish.note}`,
+    runId: deploy.runId,
+    runUrl: deploy.runUrl,
+    workflowRuns: [...deploy.workflowRuns ?? [], ...publish.workflowRuns ?? [{ workflow: "tenant-publish.yml", runId: publish.runId, runUrl: publish.runUrl, conclusion: publish.deployStatus }]],
+    deployStatus: deploy.deployStatus === "failure" || publish.deployStatus === "failure" ? "failure" : deploy.deployStatus === "pending" || publish.deployStatus === "pending" ? "pending" : "success"
+  };
+}
+async function dispatchDeploy(deps, ctx, stage2, ref, model, watch, autoRunSince, autoRunHeadSha, dispatchFailure = "throw", publishDir) {
   if (model === "tenant-container" || model === "solo-container") {
     const since = (deps.now ?? Date.now)();
     try {
@@ -12395,25 +13170,7 @@ async function dispatchDeploy(deps, ctx, stage2, ref, model, watch, autoRunSince
     return { note: `dispatched tenant-deploy.yml (slug=${ctx.slug}, ref=${ref}, stage=${stage2})`, runId, runUrl, deployStatus };
   }
   if (model === "registry-publish") {
-    const since = (deps.now ?? Date.now)();
-    await deps.run("gh", [
-      "workflow",
-      "run",
-      "tenant-publish.yml",
-      "--repo",
-      HUB_REPO3,
-      "-f",
-      `slug=${ctx.slug}`,
-      "-f",
-      `repo=${ctx.repo}`,
-      "-f",
-      `ref=${ref}`,
-      "-f",
-      `stage=${stage2}`
-    ]);
-    const { runId, runUrl } = await correlatePublishRun(deps, since);
-    const deployStatus = watch ? await watchTenantRun(deps, runId) : "pending";
-    return { note: `dispatched tenant-publish.yml (slug=${ctx.slug}, ref=${ref}, stage=${stage2})`, runId, runUrl, deployStatus };
+    return dispatchTenantPublish(deps, ctx, stage2, ref, watch, dispatchFailure, publishDir);
   }
   if (model === "hub-serverless") {
     const note = ref === "rc" ? "no manual dispatch: deploy.yml auto-fires on the rc push (rc stage)" : "no manual dispatch: deploy.yml + publish.yml auto-fire on the published Release (prod)";
@@ -12455,107 +13212,99 @@ async function preflight(deps, ctx, stage2, meta) {
   await deps.runSelf(["secrets", "preflight", "--stage", stage2, "--repo", ctx.repo]);
   return model;
 }
-async function runTrainApply(command, deps, options = {}) {
-  const watch = options.watch ?? false;
-  const ctx = await buildTrainApplyContext(deps);
-  await requireCleanTree(deps);
-  await deps.run("git", ["fetch", "origin"]);
-  const meta = requireProjectMetaForTrain(await loadProjectMeta(deps, ctx), ctx.repo);
-  const branchHints = await loadReleaseTrackBranchHints(deps);
-  const directTrack = isHubControlRepo(ctx.repo) || resolveReleaseTrack(meta, branchHints) === "direct";
-  if (command === "rcand") {
-    await requireBranch(deps, "development");
-    if (directTrack) {
-      throw new Error("direct-track repos release straight to main (no rc); run `mmi-cli release --apply` from development instead of rcand");
-    }
-    await ffOnlyPull(deps, "development");
-    ensurePositiveCount(
-      await deps.run("git", ["rev-list", "--count", "origin/rc..origin/development"]),
-      "nothing to promote: origin/development is not ahead of origin/rc"
-    );
-    const deployModel2 = await preflight(deps, ctx, "rc", meta);
-    const releaseBase = requireValue(clean2(await deps.run("node", ["scripts/next-version.mjs", "cycle"])), "release base");
-    await deps.run("git", ["checkout", "rc"]);
-    await ffOnlyPull(deps, "rc");
-    await deps.run("git", ["merge", "development", "--no-edit"]);
-    const rcSha = requireValue(clean2(await deps.run("git", ["rev-parse", "rc"])), "rc sha");
-    const resume = await resolveRcResumeTag(deps, releaseBase, rcSha);
-    const tag2 = resume.tag ?? requireValue(clean2(await deps.run("node", ["scripts/next-version.mjs", "rc"])), "rc tag");
-    const resumeNote = resume.tag ? resume.note : void 0;
-    await ensureTagPushed(deps, tag2, rcSha);
-    const requiredChecks2 = await discoverRequiredCheckContexts(deps, ctx, "rc");
-    const checks2 = await waitForRequiredTrainChecks(deps, ctx, rcSha, requiredChecks2);
-    const autoRunSince2 = (deps.now ?? Date.now)();
-    await deps.run("git", ["push", "origin", "rc"]);
-    const d2 = await dispatchDeploy(deps, ctx, "rc", "rc", deployModel2, watch, autoRunSince2, rcSha);
-    return { ...ctx, command, stage: "rc", ref: "rc", tag: tag2, deployModel: deployModel2, promoted: true, checks: checks2, resumeNote, dispatch: d2.note, runId: d2.runId, runUrl: d2.runUrl, workflowRuns: d2.workflowRuns, deployStatus: d2.deployStatus };
+async function preflightMergeToMain(deps, deployModel, remoteRef, blockingPrefix, realignMessage) {
+  const foldPaths = await resolveFoldPaths(deps, deployModel);
+  const tolerated = [...foldPaths, ...RELEASE_TOLERATED_PATHS];
+  const predicted = await predictMergeConflicts(deps, "origin/main", remoteRef);
+  const predictedBlocking = predicted.filter((f) => !isSpinePath(f) && !tolerated.includes(f));
+  if (predictedBlocking.length > 0) {
+    throw new Error(`${blockingPrefix}: ${predictedBlocking.join(", ")} \u2014 no merge was started. ${realignMessage}`);
   }
-  if (directTrack) {
-    await requireBranch(deps, "development");
-    await ffOnlyPull(deps, "development");
-    ensurePositiveCount(
-      await deps.run("git", ["rev-list", "--count", "origin/main..origin/development"]),
-      "nothing to release: origin/development is not ahead of origin/main"
-    );
-    const deployModel2 = await preflight(deps, ctx, "main", meta);
-    const tag2 = requireValue(clean2(await deps.run("node", ["scripts/next-version.mjs", "cycle"])), "release tag");
-    const foldPaths2 = await resolveFoldPaths(deps, deployModel2);
-    const tolerated2 = [...foldPaths2, ...RELEASE_TOLERATED_PATHS];
-    const predicted2 = await predictMergeConflicts(deps, "origin/main", "origin/development");
-    const predictedBlocking2 = predicted2.filter((f) => !isSpinePath(f) && !tolerated2.includes(f));
-    if (predictedBlocking2.length > 0) {
-      throw new Error(
-        `development -> main merge would conflict on non-spine path(s): ${predictedBlocking2.join(", ")} \u2014 no merge was started. The train is misaligned: reconcile main and development via an approved alignment PR, then rerun release.`
-      );
-    }
-    await deps.run("git", ["checkout", "main"]);
-    await ffOnlyPull(deps, "main");
-    if (predicted2.length === 0) {
-      await deps.run("git", ["merge", "development", "--no-edit"]);
-    } else {
-      await mergeWithSpineResolution(deps, "development", "development -> main", "theirs", tolerated2);
-    }
-    const versionFold2 = await foldReleaseVersion(deps, deployModel2, tag2, foldPaths2);
-    const releaseSha2 = requireValue(clean2(await deps.run("git", ["rev-parse", "main"])), "release sha");
-    await ensureTagPushed(deps, tag2, releaseSha2);
-    const requiredChecks2 = await discoverRequiredCheckContexts(deps, ctx, "main");
-    const checks2 = await waitForRequiredTrainChecks(deps, ctx, releaseSha2, requiredChecks2);
-    await deps.run("git", ["push", "origin", "main"]);
-    const releaseUrl2 = clean2(await deps.run("gh", ["release", "create", tag2, "--target", "main", "--generate-notes", "--latest", "--repo", ctx.repo])) || void 0;
-    await verifyPublishedRelease(deps, ctx.repo, tag2, "main", releaseSha2);
-    const announceNote2 = deps.announce ? (await deps.announce({ repo: ctx.repo, tag: tag2, summaryFile: options.announceSummaryFile })).note : void 0;
-    const autoRunSince2 = (deps.now ?? Date.now)();
-    const d2 = await dispatchDeploy(deps, ctx, "main", "main", deployModel2, watch, autoRunSince2, releaseSha2, "report");
-    const devRollForward2 = await rollDevelopmentForward(deps, ctx, tag2);
-    return {
-      ...ctx,
-      command,
-      stage: "main",
-      ref: "main",
-      tag: tag2,
-      deployModel: deployModel2,
-      promoted: true,
-      checks: checks2,
-      versionFold: versionFold2,
-      dispatch: d2.note,
-      runId: d2.runId,
-      runUrl: d2.runUrl,
-      workflowRuns: d2.workflowRuns,
-      deployStatus: d2.deployStatus,
-      rcRetirement: "not-applicable",
-      rcRetirementNote: "direct-track release skips rc; no rc runtime to retire",
-      devRollForward: devRollForward2,
-      announceNote: announceNote2,
-      // #1062: --dev on a direct-track repo is a friendly no-op — it already releases from development.
-      devNote: options.dev ? "--dev is a no-op on a direct-track repo \u2014 it already releases development -> main" : void 0,
-      release: { tag: tag2, url: releaseUrl2, targetSha: releaseSha2 }
+  return { foldPaths, tolerated, predicted };
+}
+async function executeMergeToMain(deps, sourceRef, mergeLabel, tolerated, predicted) {
+  await deps.run("git", ["checkout", "main"]);
+  await ffOnlyPull(deps, "main");
+  if (predicted.length === 0) {
+    await deps.run("git", ["merge", sourceRef, "--no-edit"]);
+  } else {
+    await mergeWithSpineResolution(deps, sourceRef, mergeLabel, "theirs", tolerated);
+  }
+}
+async function mergeSourceToMain(deps, deployModel, args) {
+  const { foldPaths, tolerated, predicted } = await preflightMergeToMain(
+    deps,
+    deployModel,
+    args.remoteRef,
+    args.blockingPrefix,
+    args.realignMessage
+  );
+  await executeMergeToMain(deps, args.sourceRef, args.mergeLabel, tolerated, predicted);
+  return { foldPaths };
+}
+async function completeMainRelease(deps, ctx, meta, deployModel, watch, options, tag, releaseSha) {
+  await ensureTagPushed(deps, tag, releaseSha);
+  const requiredChecks = await discoverRequiredCheckContexts(deps, ctx, "main");
+  const checks = await waitForRequiredTrainChecks(deps, ctx, releaseSha, requiredChecks);
+  await deps.run("git", ["push", "origin", "main"]);
+  const releaseUrl = clean2(await deps.run("gh", ["release", "create", tag, "--target", "main", "--generate-notes", "--latest", "--repo", ctx.repo])) || void 0;
+  await verifyPublishedRelease(deps, ctx.repo, tag, "main", releaseSha);
+  const announceNote = deps.announce ? (await deps.announce({ repo: ctx.repo, tag, summaryFile: options.announceSummaryFile })).note : void 0;
+  const autoRunSince = (deps.now ?? Date.now)();
+  const deployDispatch = await dispatchDeploy(deps, ctx, "main", "main", deployModel, watch, autoRunSince, releaseSha, "report", meta.publishDir);
+  const publishDispatch = deployDispatch.deployStatus === "failure" ? null : await dispatchPublishIfRequired(deps, ctx, meta, deployModel, "main", tag, watch, "report");
+  let dispatch = appendPublishDispatch(deployDispatch, publishDispatch);
+  if (!publishDispatch && deployDispatch.deployStatus === "failure" && meta.publishRequired && (deployModel === "tenant-container" || deployModel === "solo-container")) {
+    dispatch = {
+      ...dispatch,
+      note: `${dispatch.note}; tenant-publish.yml skipped (box deploy failed \u2014 redeploy the box before publishing)`
     };
   }
-  if (command === "release" && options.dev) {
+  return { checks, releaseUrl, announceNote, dispatch };
+}
+async function pushRcAlignment(deps) {
+  try {
+    await deps.run("git", ["push", "origin", "main:rc"]);
+    return "origin/rc aligned to the released main";
+  } catch (e) {
+    return `rc alignment push failed \u2014 align manually with \`git push origin main:rc\`: ${e instanceof Error ? e.message : String(e)}`;
+  }
+}
+async function runTrainApplyPipeline(mode, input) {
+  const { deps, ctx, command, meta, branchHints, watch, options } = input;
+  const directTrack = input.directTrack ?? false;
+  if (mode === "rcand") {
+    await requireBranch(deps, "development");
+    if (directTrack) {
+      throw new Error("direct-track repos release straight to main (no rc); run `mmi-cli release --apply` from development instead of rcand");
+    }
+    await ffOnlyPull(deps, "development");
+    ensurePositiveCount(
+      await deps.run("git", ["rev-list", "--count", "origin/rc..origin/development"]),
+      "nothing to promote: origin/development is not ahead of origin/rc"
+    );
+    const deployModel2 = await preflight(deps, ctx, "rc", meta);
+    const releaseBase = requireValue(clean2(await deps.run("node", ["scripts/next-version.mjs", "cycle"])), "release base");
+    await deps.run("git", ["checkout", "rc"]);
+    await ffOnlyPull(deps, "rc");
+    await deps.run("git", ["merge", "development", "--no-edit"]);
+    const rcSha = requireValue(clean2(await deps.run("git", ["rev-parse", "rc"])), "rc sha");
+    const resume = await resolveRcResumeTag(deps, releaseBase, rcSha);
+    const tag2 = resume.tag ?? requireValue(clean2(await deps.run("node", ["scripts/next-version.mjs", "rc"])), "rc tag");
+    const resumeNote = resume.tag ? resume.note : void 0;
+    await ensureTagPushed(deps, tag2, rcSha);
+    const requiredChecks = await discoverRequiredCheckContexts(deps, ctx, "rc");
+    const checks2 = await waitForRequiredTrainChecks(deps, ctx, rcSha, requiredChecks);
+    const autoRunSince = (deps.now ?? Date.now)();
+    await deps.run("git", ["push", "origin", "rc"]);
+    const d2 = await dispatchDeploy(deps, ctx, "rc", "rc", deployModel2, watch, autoRunSince, rcSha);
+    return { ...ctx, command, stage: "rc", ref: "rc", tag: tag2, deployModel: deployModel2, promoted: true, checks: checks2, resumeNote, dispatch: d2.note, runId: d2.runId, runUrl: d2.runUrl, workflowRuns: d2.workflowRuns, deployStatus: d2.deployStatus };
+  }
+  if (mode === "release-dev") {
     await requireBranch(deps, "development");
     await ffOnlyPull(deps, "development");
     const hasRcBranch = branchHints.hasRcBranch ?? false;
-    if (hasRcBranch) {
+    if (!directTrack && hasRcBranch) {
       const rcOnlyOut = (await deps.run("git", ["rev-list", "--count", "--right-only", "--cherry-pick", "--no-merges", "origin/development...origin/rc"])).trim();
       const rcOnly = Number.parseInt(rcOnlyOut, 10);
       if (!Number.isFinite(rcOnly)) throw new Error(`release --dev: could not count rc-only commits for the guard: ${rcOnlyOut || "(empty)"}`);
@@ -12571,47 +13320,44 @@ async function runTrainApply(command, deps, options = {}) {
     );
     const deployModel2 = await preflight(deps, ctx, "main", meta);
     const tag2 = requireValue(clean2(await deps.run("node", ["scripts/next-version.mjs", "cycle"])), "release tag");
-    const rcShaAtRelease = hasRcBranch ? clean2(await deps.run("git", ["rev-parse", "origin/rc"])) : "";
-    const foldPaths2 = await resolveFoldPaths(deps, deployModel2);
-    const tolerated2 = [...foldPaths2, ...RELEASE_TOLERATED_PATHS];
-    const predicted2 = await predictMergeConflicts(deps, "origin/main", "origin/development");
-    const predictedBlocking2 = predicted2.filter((f) => !isSpinePath(f) && !tolerated2.includes(f));
-    if (predictedBlocking2.length > 0) {
-      throw new Error(
-        `development -> main merge would conflict on non-spine path(s): ${predictedBlocking2.join(", ")} \u2014 no merge was started. The train is misaligned: reconcile main and development via an approved alignment PR, then rerun release.`
-      );
-    }
-    await deps.run("git", ["checkout", "main"]);
-    await ffOnlyPull(deps, "main");
-    if (predicted2.length === 0) {
-      await deps.run("git", ["merge", "development", "--no-edit"]);
-    } else {
-      await mergeWithSpineResolution(deps, "development", "development -> main", "theirs", tolerated2);
-    }
+    const rcShaAtRelease = !directTrack && hasRcBranch ? clean2(await deps.run("git", ["rev-parse", "origin/rc"])) : "";
+    const { foldPaths: foldPaths2 } = await mergeSourceToMain(deps, deployModel2, {
+      sourceRef: "development",
+      remoteRef: "origin/development",
+      mergeLabel: "development -> main",
+      blockingPrefix: "development -> main merge would conflict on non-spine path(s)",
+      realignMessage: "The train is misaligned: reconcile main and development via an approved alignment PR, then rerun release."
+    });
     const versionFold2 = await foldReleaseVersion(deps, deployModel2, tag2, foldPaths2);
     const releaseSha2 = requireValue(clean2(await deps.run("git", ["rev-parse", "main"])), "release sha");
-    await ensureTagPushed(deps, tag2, releaseSha2);
-    const requiredChecks2 = await discoverRequiredCheckContexts(deps, ctx, "main");
-    const checks2 = await waitForRequiredTrainChecks(deps, ctx, releaseSha2, requiredChecks2);
-    await deps.run("git", ["push", "origin", "main"]);
-    const releaseUrl2 = clean2(await deps.run("gh", ["release", "create", tag2, "--target", "main", "--generate-notes", "--latest", "--repo", ctx.repo])) || void 0;
-    await verifyPublishedRelease(deps, ctx.repo, tag2, "main", releaseSha2);
-    const announceNote2 = deps.announce ? (await deps.announce({ repo: ctx.repo, tag: tag2, summaryFile: options.announceSummaryFile })).note : void 0;
-    const autoRunSince2 = (deps.now ?? Date.now)();
-    const d2 = await dispatchDeploy(deps, ctx, "main", "main", deployModel2, watch, autoRunSince2, releaseSha2, "report");
-    const retirement2 = hasRcBranch ? await retireRcRuntime(deps, ctx, deployModel2, d2.deployStatus, rcShaAtRelease) : { status: "not-applicable", note: "no origin/rc branch \u2014 rc runtime retirement skipped" };
+    const { checks: checks2, releaseUrl: releaseUrl2, announceNote: announceNote2, dispatch: d2 } = await completeMainRelease(deps, ctx, meta, deployModel2, watch, options, tag2, releaseSha2);
     const devRollForward2 = await rollDevelopmentForward(deps, ctx, tag2);
-    let rcAlignment2;
-    if (hasRcBranch) {
-      try {
-        await deps.run("git", ["push", "origin", "main:rc"]);
-        rcAlignment2 = "origin/rc aligned to the released main";
-      } catch (e) {
-        rcAlignment2 = `rc alignment push failed \u2014 align manually with \`git push origin main:rc\`: ${e instanceof Error ? e.message : String(e)}`;
-      }
-    } else {
-      rcAlignment2 = "no origin/rc branch \u2014 rc alignment skipped";
+    if (directTrack) {
+      return {
+        ...ctx,
+        command,
+        stage: "main",
+        ref: "main",
+        tag: tag2,
+        deployModel: deployModel2,
+        promoted: true,
+        checks: checks2,
+        versionFold: versionFold2,
+        dispatch: d2.note,
+        runId: d2.runId,
+        runUrl: d2.runUrl,
+        workflowRuns: d2.workflowRuns,
+        deployStatus: d2.deployStatus,
+        rcRetirement: "not-applicable",
+        rcRetirementNote: "direct-track release skips rc; no rc runtime to retire",
+        devRollForward: devRollForward2,
+        announceNote: announceNote2,
+        devNote: options.dev ? "--dev is a no-op on a direct-track repo \u2014 it already releases development -> main" : void 0,
+        release: { tag: tag2, url: releaseUrl2, targetSha: releaseSha2 }
+      };
     }
+    const retirement2 = hasRcBranch ? await retireRcRuntime(deps, ctx, deployModel2, d2.deployStatus, rcShaAtRelease) : { status: "not-applicable", note: "no origin/rc branch \u2014 rc runtime retirement skipped" };
+    const rcAlignment2 = hasRcBranch ? await pushRcAlignment(deps) : "no origin/rc branch \u2014 rc alignment skipped";
     const environments2 = await buildEnvironments(deps, ctx, deployModel2, d2.deployStatus, retirement2);
     return {
       ...ctx,
@@ -12645,15 +13391,13 @@ async function runTrainApply(command, deps, options = {}) {
     "nothing to release: origin/rc is not ahead of origin/main"
   );
   const deployModel = await preflight(deps, ctx, "main", meta);
-  const foldPaths = await resolveFoldPaths(deps, deployModel);
-  const tolerated = [...foldPaths, ...RELEASE_TOLERATED_PATHS];
-  const predicted = await predictMergeConflicts(deps, "origin/main", "origin/rc");
-  const predictedBlocking = predicted.filter((f) => !isSpinePath(f) && !tolerated.includes(f));
-  if (predictedBlocking.length > 0) {
-    throw new Error(
-      `rc -> main merge would conflict on non-spine path(s): ${predictedBlocking.join(", ")} \u2014 no merge was started. The train is misaligned: reconcile main and rc via an approved alignment PR (do not hand-resolve on main), then rerun release.`
-    );
-  }
+  const { foldPaths, tolerated, predicted } = await preflightMergeToMain(
+    deps,
+    deployModel,
+    "origin/rc",
+    "rc -> main merge would conflict on non-spine path(s)",
+    "The train is misaligned: reconcile main and rc via an approved alignment PR (do not hand-resolve on main), then rerun release."
+  );
   const coverage = deps.hotfixCoverage({ mainRef: "origin/main", rcRef: "origin/rc", ack: options.ack ?? [] });
   if (!coverage.ok) {
     const list = coverage.uncovered.map((c) => `${c.sha.slice(0, 8)} ${c.subject}`).join("; ");
@@ -12662,34 +13406,14 @@ async function runTrainApply(command, deps, options = {}) {
     );
   }
   const releasedRcSha = clean2(await deps.run("git", ["rev-parse", "origin/rc"]));
-  await deps.run("git", ["checkout", "main"]);
-  await ffOnlyPull(deps, "main");
-  if (predicted.length === 0) {
-    await deps.run("git", ["merge", "rc", "--no-edit"]);
-  } else {
-    await mergeWithSpineResolution(deps, "rc", "rc -> main", "theirs", tolerated);
-  }
+  await executeMergeToMain(deps, "rc", "rc -> main", tolerated, predicted);
   const tag = requireValue(clean2(await deps.run("node", ["scripts/next-version.mjs", "release"])), "release tag");
   const versionFold = await foldReleaseVersion(deps, deployModel, tag, foldPaths);
   const releaseSha = requireValue(clean2(await deps.run("git", ["rev-parse", "main"])), "release sha");
-  await ensureTagPushed(deps, tag, releaseSha);
-  const requiredChecks = await discoverRequiredCheckContexts(deps, ctx, "main");
-  const checks = await waitForRequiredTrainChecks(deps, ctx, releaseSha, requiredChecks);
-  await deps.run("git", ["push", "origin", "main"]);
-  const autoRunSince = (deps.now ?? Date.now)();
-  const releaseUrl = clean2(await deps.run("gh", ["release", "create", tag, "--target", "main", "--generate-notes", "--latest", "--repo", ctx.repo])) || void 0;
-  await verifyPublishedRelease(deps, ctx.repo, tag, "main", releaseSha);
-  const announceNote = deps.announce ? (await deps.announce({ repo: ctx.repo, tag, summaryFile: options.announceSummaryFile })).note : void 0;
-  const d = await dispatchDeploy(deps, ctx, "main", "main", deployModel, watch, autoRunSince, releaseSha, "report");
+  const { checks, releaseUrl, announceNote, dispatch: d } = await completeMainRelease(deps, ctx, meta, deployModel, watch, options, tag, releaseSha);
   const retirement = await retireRcRuntime(deps, ctx, deployModel, d.deployStatus, releasedRcSha);
   const devRollForward = await rollDevelopmentForward(deps, ctx, tag);
-  let rcAlignment;
-  try {
-    await deps.run("git", ["push", "origin", "main:rc"]);
-    rcAlignment = "origin/rc aligned to the released main";
-  } catch (e) {
-    rcAlignment = `rc alignment push failed \u2014 align manually with \`git push origin main:rc\`: ${e instanceof Error ? e.message : String(e)}`;
-  }
+  const rcAlignment = await pushRcAlignment(deps);
   const environments = await buildEnvironments(deps, ctx, deployModel, d.deployStatus, retirement);
   return {
     ...ctx,
@@ -12716,6 +13440,29 @@ async function runTrainApply(command, deps, options = {}) {
     environments
   };
 }
+async function runTrainApply(command, deps, options = {}) {
+  const watch = options.watch ?? false;
+  const ctx = await buildTrainApplyContext(deps);
+  await requireCleanTree(deps);
+  await deps.run("git", ["fetch", "origin"]);
+  const meta = requireProjectMetaForTrain(await loadProjectMeta(deps, ctx), ctx.repo);
+  const branchHints = await loadReleaseTrackBranchHints(deps);
+  const directTrack = isHubControlRepo(ctx.repo) || resolveReleaseTrack(meta, branchHints) === "direct";
+  const pipelineInput = { deps, ctx, command, meta, branchHints, watch, options };
+  if (command === "rcand") {
+    if (directTrack) {
+      throw new Error("direct-track repos release straight to main (no rc); run `mmi-cli release --apply` from development instead of rcand");
+    }
+    return runTrainApplyPipeline("rcand", pipelineInput);
+  }
+  if (directTrack) {
+    return runTrainApplyPipeline("release-dev", { ...pipelineInput, directTrack: true });
+  }
+  if (command === "release" && options.dev) {
+    return runTrainApplyPipeline("release-dev", pipelineInput);
+  }
+  return runTrainApplyPipeline("release-full", pipelineInput);
+}
 async function buildEnvironments(deps, ctx, model, deployStatus, retirement) {
   if (model !== "tenant-container") return void 0;
   const domains = deps.fetchEdgeDomains ? await deps.fetchEdgeDomains(ctx.slug).catch(() => null) : null;
@@ -12732,63 +13479,25 @@ async function buildEnvironments(deps, ctx, model, deployStatus, retirement) {
   if (rcDomains?.length) rc.domains = rcDomains;
   return { main, rc };
 }
-var RETIRE_CATEGORIES = /* @__PURE__ */ new Set([
-  "retired",
-  "retired-edge-pending",
-  "ssm-command-failed",
-  "wait-timeout",
-  "transport-failed"
-]);
-function retireCategoryFrom(text) {
-  try {
-    const c = JSON.parse(text).category;
-    return typeof c === "string" && RETIRE_CATEGORIES.has(c) ? c : void 0;
-  } catch {
-    return void 0;
-  }
-}
-var TRANSPORT_REASONS = /* @__PURE__ */ new Set(["invalid-instance", "invalid-document", "throttled", "timeout", "other"]);
-function retireReasonFrom(text) {
-  try {
-    const r = JSON.parse(text).reason;
-    return typeof r === "string" && TRANSPORT_REASONS.has(r) ? r : void 0;
-  } catch {
-    return void 0;
-  }
-}
-function isRetryableTransport(reason) {
-  return reason === void 0 || reason === "throttled" || reason === "timeout" || reason === "other";
-}
 var RETIRE_MAX_ATTEMPTS = 3;
 var RETIRE_BACKOFF_MS = 1500;
 async function attemptRetire(deps, ctx) {
-  try {
-    const out = await deps.runSelf(["tenant", "control", ctx.repo, "rc", "retire"]);
-    let commandId = "";
-    let category = retireCategoryFrom(out);
-    try {
-      commandId = String(JSON.parse(out).commandId ?? "");
-    } catch {
-    }
-    if (category === "retired-edge-pending") {
-      return { result: {
-        status: "retired",
-        category,
-        note: `rc runtime retired; edge vhost reconcile pending (tenant control retire${commandId ? `, command ${commandId}` : ""}) \u2014 registry coords kept`
-      } };
-    }
-    category = category ?? "retired";
-    return { result: {
+  const r = await runTenantControl(deps, { repo: ctx.repo, stage: "rc", action: "retire", watch: true });
+  if (r.category === "retired") {
+    return {
       status: "retired",
-      category,
-      note: `rc runtime retired (tenant control retire${commandId ? `, command ${commandId}` : ""}) \u2014 registry coords kept; /rcand or tenant redeploy recreates rc next cycle`
-    } };
-  } catch (e) {
-    const err = e;
-    const category = retireCategoryFrom(err.stdout ?? "") ?? "transport-failed";
-    const reason = retireReasonFrom(err.stdout ?? "");
-    return { result: { status: "failed", category, note: `rc retirement failed (the release itself succeeded): ${err.message}` }, reason, message: err.message };
+      category: "retired",
+      note: `rc runtime retired (tenant-control.yml${r.runUrl ? `, ${r.runUrl}` : ""}) \u2014 registry coords kept; /rcand or tenant redeploy recreates rc next cycle`
+    };
+  }
+  if (r.category === "wait-timeout") {
+    return {
+      status: "failed",
+      category: "wait-timeout",
+      note: `rc retire dispatched but the run could not be observed \u2014 verify with: mmi-cli tenant control ${ctx.repo} rc status${r.runUrl ? ` (run ${r.runUrl})` : ""}`
+    };
   }
+  return { status: "failed", category: r.category ?? "transport-failed", note: r.note };
 }
 async function retireRcRuntime(deps, ctx, model, deployStatus, releasedRcSha) {
   if (model !== "tenant-container") {
@@ -12812,19 +13521,18 @@ async function retireRcRuntime(deps, ctx, model, deployStatus, releasedRcSha) {
         note: `origin/rc moved past the released candidate (${releasedRcSha.slice(0, 7)} -> ${rcNow.slice(0, 7)}) \u2014 a new candidate is in flight; rc runtime left untouched`
       };
     }
-    const sleep = deps.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+    const sleep2 = resolveSleep(deps);
     let last;
     for (let attempt = 1; attempt <= RETIRE_MAX_ATTEMPTS; attempt++) {
       last = await attemptRetire(deps, ctx);
-      if (last.result.status === "retired") return last.result;
-      const retryable = last.result.category === "transport-failed" && isRetryableTransport(last.reason);
-      if (!retryable || attempt === RETIRE_MAX_ATTEMPTS) break;
-      await sleep(RETIRE_BACKOFF_MS * attempt);
+      if (last.status === "retired") return last;
+      if (last.category !== "transport-failed" || attempt === RETIRE_MAX_ATTEMPTS) break;
+      await sleep2(RETIRE_BACKOFF_MS * attempt);
     }
     const f = last;
-    const reasonSuffix = f.reason ? ` [reason: ${f.reason}]` : "";
-    const note = `rc retirement failed (the release itself succeeded)${reasonSuffix}: ${f.message ?? f.result.note}. The rc runtime may be orphaned on the box \u2014 retire it with: mmi-cli tenant control ${ctx.repo} rc retire (or sweep all: mmi-cli tenant sweep-rc --retire --yes)`;
-    return { status: "failed", category: f.result.category, note };
+    if (f.category === "wait-timeout") return f;
+    const note = `rc retirement failed (the release itself succeeded): ${f.note}. The rc runtime may be orphaned on the box \u2014 retire it with: mmi-cli tenant control ${ctx.repo} rc retire (or sweep all: mmi-cli tenant sweep-rc --retire --yes)`;
+    return { status: "failed", category: f.category, note };
   } catch (e) {
     const err = e;
     return { status: "failed", category: "transport-failed", note: `rc retirement failed (the release itself succeeded): ${err.message}` };
@@ -12850,14 +13558,82 @@ async function runTenantRedeploy(deps, options) {
   const d = await dispatchDeploy(deps, ctx, stage2, ref, deployModel, watch);
   return { ...ctx, command: "tenant-redeploy", stage: stage2, ref, deployModel, dispatch: d.note, runId: d.runId, runUrl: d.runUrl, workflowRuns: d.workflowRuns, deployStatus: d.deployStatus };
 }
+function tenantControlWatches(action) {
+  return action === "status" || action === "retire" || action === "verify-secrets";
+}
+async function runTenantControl(deps, options) {
+  const { repo, stage: stage2, action } = options;
+  const watch = options.watch ?? tenantControlWatches(action);
+  const base2 = { command: "tenant-control", repo, stage: stage2, action };
+  const since = (deps.now ?? Date.now)();
+  const d = await deps.dispatchTenantControl({ repo, stage: stage2, action });
+  if (!d.ok) {
+    const transport = d.category === "transport-failed";
+    return {
+      ...base2,
+      dispatched: false,
+      conclusion: "failure",
+      category: action === "retire" ? transport ? "transport-failed" : "dispatch-rejected" : void 0,
+      note: transport ? `tenant control ${action} dispatch failed (transport) \u2014 safe to retry` : `tenant control ${action} rejected: ${d.error ?? "request rejected by the Hub"}`
+    };
+  }
+  const { runId, runUrl } = await correlateControlRun(deps, since);
+  const conclusion = watch ? await watchTenantRun(deps, runId) : "pending";
+  const result = { ...base2, dispatched: true, runId, runUrl, conclusion, note: "" };
+  if (action === "retire") {
+    result.category = conclusion === "success" ? "retired" : conclusion === "failure" ? "control-run-failed" : "wait-timeout";
+  }
+  if (watch && runId != null && conclusion === "success" && (action === "status" || action === "verify-secrets")) {
+    const output = extractControlOutputFromLog(await fetchControlRunLog(deps, runId));
+    if (action === "status") {
+      result.serviceState = parseStatusSnippet(output).serviceState;
+    } else {
+      result.secrets = parseVerifySecrets(output);
+    }
+  }
+  result.note = conclusion === "success" ? `tenant-control ${action} run succeeded` : conclusion === "failure" ? `tenant-control ${action} run failed \u2014 inspect the run` : runId == null ? `dispatched tenant-control.yml (${action}) \u2014 run not correlated; check the Actions tab` : `dispatched tenant-control.yml (${action}) \u2014 not watched`;
+  return result;
+}
+function renderTenantControl(r) {
+  const head = `tenant control ${r.repo} ${r.stage} ${r.action}: ${r.conclusion}${r.category ? ` (${r.category})` : ""}`;
+  const lines = [head];
+  if (r.runUrl) lines.push(`  run: ${r.runUrl}`);
+  if (r.serviceState) lines.push(`  serviceState: ${r.serviceState}`);
+  if (r.secrets?.length) {
+    for (const s of r.secrets) lines.push(`  ${s.key}: ${s.status}`);
+  }
+  lines.push(`  ${r.note}`);
+  return lines.join("\n");
+}
+
+// src/tenant-verify-secrets.ts
+function renderVerifySecrets(body) {
+  const secrets = body?.secrets ?? [];
+  const counts = {
+    match: secrets.filter((s) => s.status === "match").length,
+    mismatch: secrets.filter((s) => s.status === "mismatch").length,
+    missing: secrets.filter((s) => s.status === "missing").length
+  };
+  const lines = secrets.map((s) => `${s.key}: ${s.status}`);
+  lines.push(`verify-secrets: ${counts.match} match, ${counts.mismatch} mismatch, ${counts.missing} missing`);
+  const ssmStatus = body?.ssmStatus ?? "pending";
+  if (ssmStatus !== "Success") {
+    return { lines, failure: `verify-secrets did not complete (ssm status ${ssmStatus})${body?.commandId ? ` \u2014 command ${body.commandId}` : ""}` };
+  }
+  const bad = counts.mismatch + counts.missing;
+  if (bad > 0) {
+    return { lines, failure: `${bad} of ${secrets.length} required secret(s) not matching the vault (${counts.mismatch} mismatch, ${counts.missing} missing)` };
+  }
+  return { lines, failure: null };
+}
 
 // src/hotfix-coverage.ts
-var import_node_child_process9 = require("node:child_process");
+var import_node_child_process10 = require("node:child_process");
 var CHERRY_TRAILER = /\(cherry picked from commit ([0-9a-f]{7,40})\)/g;
 function checkHotfixCoverage(options = {}) {
   const { cwd = process.cwd(), mainRef = "origin/main", rcRef = "origin/rc", manifestPaths = [] } = options;
   const ack = (options.ack ?? []).filter(Boolean);
-  const git = options.git ?? ((args, opts) => (0, import_node_child_process9.execFileSync)("git", args, { cwd, encoding: "utf8", input: opts?.input, stdio: ["pipe", "pipe", "pipe"] }));
+  const git = options.git ?? ((args, opts) => (0, import_node_child_process10.execFileSync)("git", args, { cwd, encoding: "utf8", input: opts?.input, stdio: ["pipe", "pipe", "pipe"] }));
   const revList = (range) => {
     const out = git(["rev-list", "--no-merges", range]).trim();
     return out ? out.split("\n") : [];
@@ -12984,6 +13760,10 @@ function renderSweep(r) {
   if (r.running > 0 && !r.retireAttempted) {
     lines.push("Retire an orphan with: mmi-cli tenant control <owner/repo> rc retire (or sweep all running: mmi-cli tenant sweep-rc --retire --yes)");
   }
+  const undetermined = r.stages.filter((s) => s.serviceState === "unknown").length;
+  if (undetermined > 0) {
+    lines.push(`WARNING: rc running-state could not be determined for ${undetermined} of ${r.scanned} tenant(s) \u2014 the "${r.running} running" count is a floor, not a clear bill. Reconcile the box assets (tenant-reconcile.yml) or inspect the tenant-control run log.`);
+  }
   return lines.join("\n");
 }
 
@@ -13017,7 +13797,7 @@ function hotfixBranch(tag) {
 }
 async function resolveHotfixDeployModel(deps, ctx) {
   const load = await loadProjectMeta(deps, ctx);
-  const meta = load.status === "ok" ? load.meta : null;
+  const meta = requireProjectMetaForTrain(load, ctx.repo);
   return resolveDeployModel2(meta, ctx.repo);
 }
 async function findHotfixPr(deps, ctx, tag) {
@@ -13132,9 +13912,9 @@ Merge this PR (human-initiated), then run \`mmi-cli hotfix release ${tag}\`.`
   return { ...ctx, command: "hotfix-start", tag, version, branch, source: label, prUrl, reused: Boolean(remoteBranch), notes };
 }
 async function watchReleaseRun(deps, ctx, workflow, sha) {
-  const sleep = sleeper(deps);
+  const sleep2 = sleeper(deps);
   for (let attempt = 0; attempt < HOTFIX_RUN_FIND_ATTEMPTS; attempt++) {
-    if (attempt > 0) await sleep(HOTFIX_RUN_FIND_DELAY_MS);
+    if (attempt > 0) await sleep2(HOTFIX_RUN_FIND_DELAY_MS);
     let rows;
     try {
       const out = await deps.run("gh", [
@@ -13209,8 +13989,9 @@ async function runHotfixRelease(deps, versionInput, options = {}) {
       runs.push(await watchReleaseRun(deps, ctx, workflow, mergedSha));
     }
     deployNote = "watched release-triggered deploy.yml + publish.yml";
-  } else if (deployModel === "tenant-container" || deployModel === "solo-container") {
-    const dispatch = await dispatchDeploy(
+  } else if (deployModel === "tenant-container" || deployModel === "solo-container" || deployModel === "registry-publish") {
+    const meta = requireProjectMetaForTrain(await loadProjectMeta(deps, ctx), ctx.repo);
+    const deploy = await dispatchDeploy(
       deps,
       ctx,
       "main",
@@ -13219,14 +14000,38 @@ async function runHotfixRelease(deps, versionInput, options = {}) {
       true,
       (deps.now ?? Date.now)(),
       mergedSha,
-      "report"
+      "report",
+      meta.publishDir
     );
+    const publish = deploy.deployStatus === "failure" ? null : await dispatchPublishIfRequired(deps, ctx, meta, deployModel, "main", tag, true, "report");
+    let dispatch = appendPublishDispatch(deploy, publish);
+    if (!publish && deploy.deployStatus === "failure" && meta.publishRequired && (deployModel === "tenant-container" || deployModel === "solo-container")) {
+      dispatch = {
+        ...dispatch,
+        note: `${dispatch.note}; tenant-publish.yml skipped (box deploy failed \u2014 redeploy the box before publishing)`
+      };
+    }
     deployNote = dispatch.note;
-    runs.push({
-      workflow: "tenant-deploy.yml",
-      url: dispatch.runUrl,
-      conclusion: dispatch.deployStatus === "success" ? "success" : dispatch.deployStatus === "failure" ? "failure" : dispatch.deployStatus ?? "pending"
-    });
+    if (deployModel !== "registry-publish") {
+      runs.push({
+        workflow: "tenant-deploy.yml",
+        url: deploy.runUrl,
+        conclusion: deploy.deployStatus === "success" ? "success" : deploy.deployStatus === "failure" ? "failure" : deploy.deployStatus ?? "pending"
+      });
+    }
+    if (publish?.runUrl) {
+      runs.push({
+        workflow: "tenant-publish.yml",
+        url: publish.runUrl,
+        conclusion: publish.deployStatus === "success" ? "success" : publish.deployStatus === "failure" ? "failure" : publish.deployStatus ?? "pending"
+      });
+    } else if (deployModel === "registry-publish") {
+      runs.push({
+        workflow: "tenant-publish.yml",
+        url: deploy.runUrl,
+        conclusion: deploy.deployStatus === "success" ? "success" : deploy.deployStatus === "failure" ? "failure" : deploy.deployStatus ?? "pending"
+      });
+    }
   } else {
     deployNote = `no hotfix deploy dispatch for deployModel=${deployModel} \u2014 prod deploy is repo-specific`;
   }
@@ -13237,7 +14042,7 @@ async function runHotfixRelease(deps, versionInput, options = {}) {
     try {
       await deps.run("git", ["-c", "advice.detachedHead=false", "checkout", tag]);
       const verifyArgs = ["scripts/release-distribution.mjs", "verify", version, ...publishSucceeded ? [] : ["--skip-npm-view"]];
-      const sleep = sleeper(deps);
+      const sleep2 = sleeper(deps);
       let attempt = 0;
       for (; ; ) {
         attempt++;
@@ -13246,7 +14051,7 @@ async function runHotfixRelease(deps, versionInput, options = {}) {
           break;
         } catch (err) {
           if (attempt >= HOTFIX_VERIFY_ATTEMPTS) throw err;
-          await sleep(HOTFIX_VERIFY_RETRY_MS);
+          await sleep2(HOTFIX_VERIFY_RETRY_MS);
         }
       }
       const retried = attempt > 1 ? `, after ${attempt} attempts (npm propagation lag)` : "";
@@ -13295,6 +14100,7 @@ async function runHotfixStatus(deps, versionInput) {
   await deps.run("git", ["fetch", "origin", "--tags"]);
   let tag;
   let version;
+  let warnings = [];
   if (versionInput) {
     ({ tag, version } = normalizeHotfixVersion(versionInput));
   } else {
@@ -13303,18 +14109,19 @@ async function runHotfixStatus(deps, versionInput) {
       const latestFacts = await gatherHotfixFacts(deps, ctx, latest, latest.slice(1));
       const latestDerived = deriveHotfixState(latestFacts);
       if (latestDerived.state !== "complete") {
-        return { ...ctx, command: "hotfix-status", ...latestFacts, ...latestDerived };
+        return { ...ctx, command: "hotfix-status", ...latestFacts, ...latestDerived, warnings };
       }
     }
-    const inFlight = await findInFlightHotfixVersion(deps, ctx);
-    if (inFlight) {
-      const facts2 = await gatherHotfixFacts(deps, ctx, inFlight.tag, inFlight.version);
-      return { ...ctx, command: "hotfix-status", ...facts2, ...deriveHotfixState(facts2) };
+    const found = await findInFlightHotfixVersion(deps, ctx, latest);
+    warnings = supersededHotfixWarnings(found.superseded, latest);
+    if (found.inFlight) {
+      ({ tag, version } = found.inFlight);
+    } else {
+      ({ tag, version } = await deriveHotfixVersion(deps));
     }
-    ({ tag, version } = await deriveHotfixVersion(deps));
   }
   const facts = await gatherHotfixFacts(deps, ctx, tag, version);
-  return { ...ctx, command: "hotfix-status", ...facts, ...deriveHotfixState(facts) };
+  return { ...ctx, command: "hotfix-status", ...facts, ...deriveHotfixState(facts), warnings };
 }
 async function gatherHotfixFacts(deps, ctx, tag, version) {
   const branchExists = Boolean(clean3(await deps.run("git", ["ls-remote", "origin", `refs/heads/${hotfixBranch(tag)}`])));
@@ -13356,7 +14163,19 @@ async function gatherHotfixFacts(deps, ctx, tag, version) {
   const npmVersion = await deps.run("npm", ["view", "@mutmutco/cli", "version", "--silent"]).then(clean3, () => "unknown");
   return { tag, version, branchExists, pr: pr2 ? { number: pr2.number, state: pr2.state, url: pr2.url } : null, tagPushed, releaseExists, runs, npmVersion };
 }
-async function findInFlightHotfixVersion(deps, ctx) {
+function compareHotfixVersions(a, b) {
+  const pa = a.replace(/^v/, "").split(".").map(Number);
+  const pb = b.replace(/^v/, "").split(".").map(Number);
+  for (let i = 0; i < 3; i++) {
+    if ((pa[i] ?? 0) !== (pb[i] ?? 0)) return (pa[i] ?? 0) - (pb[i] ?? 0);
+  }
+  return 0;
+}
+function supersededHotfixWarnings(superseded, latestMainTag) {
+  if (superseded.length === 0) return [];
+  return [`skipped superseded hotfix marker(s) ${superseded.join(", ")} \u2014 merged to main but never released and at/below the latest released tag ${latestMainTag ?? "(none)"}; later releases already absorbed them (#976). Not actionable \u2014 run mmi-cli hotfix start for a new fix.`];
+}
+async function findInFlightHotfixVersion(deps, ctx, latestMainTag) {
   const tags = /* @__PURE__ */ new Set();
   const out = await deps.run("gh", [
     "pr",
@@ -13382,20 +14201,20 @@ async function findInFlightHotfixVersion(deps, ctx) {
     const m = /^refs\/heads\/hotfix\/(v\d+\.\d+\.\d+)/.exec(ref);
     if (m) tags.add(m[1]);
   }
-  const sorted = [...tags].sort((a, b) => {
-    const pa = a.slice(1).split(".").map(Number);
-    const pb = b.slice(1).split(".").map(Number);
-    for (let i = 0; i < 3; i++) {
-      if (pa[i] !== pb[i]) return pb[i] - pa[i];
-    }
-    return 0;
-  });
-  for (const tag of sorted) {
+  const sorted = [...tags].sort((a, b) => compareHotfixVersions(b, a));
+  const fresh = latestMainTag ? sorted.filter((t) => compareHotfixVersions(t, latestMainTag) > 0) : sorted;
+  for (const tag of fresh) {
     const version = tag.slice(1);
     const facts = await gatherHotfixFacts(deps, ctx, tag, version);
-    if (deriveHotfixState(facts).state !== "complete") return { tag, version };
+    if (deriveHotfixState(facts).state !== "complete") return { inFlight: { tag, version }, superseded: [] };
   }
-  return null;
+  const stale = latestMainTag ? sorted.filter((t) => compareHotfixVersions(t, latestMainTag) <= 0) : [];
+  const superseded = [];
+  for (const tag of stale) {
+    const facts = await gatherHotfixFacts(deps, ctx, tag, tag.slice(1));
+    if (deriveHotfixState(facts).state !== "complete") superseded.push(tag);
+  }
+  return { inFlight: null, superseded };
 }
 
 // src/release-announce.ts
@@ -13525,7 +14344,7 @@ async function announceRelease(deps, args) {
 }
 
 // src/port-registry.ts
-var import_node_fs17 = require("node:fs");
+var import_node_fs20 = require("node:fs");
 
 // ../infra/port-geometry.mjs
 var PORT_BLOCK = 100;
@@ -13539,8 +14358,8 @@ function nextPortBlock(registry2) {
   return [base2, base2 + PORT_SPAN];
 }
 function loadPortRegistry(path2) {
-  if (!(0, import_node_fs17.existsSync)(path2)) return {};
-  const raw = JSON.parse((0, import_node_fs17.readFileSync)(path2, "utf8"));
+  if (!(0, import_node_fs20.existsSync)(path2)) return {};
+  const raw = JSON.parse((0, import_node_fs20.readFileSync)(path2, "utf8"));
   const out = {};
   for (const [key, value] of Object.entries(raw)) {
     if (Array.isArray(value) && value.length === 2 && value.every((n) => typeof n === "number")) {
@@ -13554,9 +14373,9 @@ function ensurePortRange(repo, path2) {
   const existing = registry2[repo];
   if (existing) return existing;
   const range = nextPortBlock(registry2);
-  const raw = (0, import_node_fs17.existsSync)(path2) ? JSON.parse((0, import_node_fs17.readFileSync)(path2, "utf8")) : {};
+  const raw = (0, import_node_fs20.existsSync)(path2) ? JSON.parse((0, import_node_fs20.readFileSync)(path2, "utf8")) : {};
   raw[repo] = range;
-  (0, import_node_fs17.writeFileSync)(path2, JSON.stringify(raw, null, 2) + "\n", "utf8");
+  (0, import_node_fs20.writeFileSync)(path2, JSON.stringify(raw, null, 2) + "\n", "utf8");
   return range;
 }
 function portCursorSeed(registry2) {
@@ -14279,17 +15098,16 @@ function renderBootstrapVerifyReport(report) {
 var PROJECTS_LIST_PATH = "/projects/list";
 var ORG_CONFIG_PATH = "/org/config";
 var PROJECTS_ENVELOPE_KEY = "projects";
+var REGISTRY_FETCH_TIMEOUT_MS = 8e3;
 
 // src/registry-client.ts
-var DEFAULT_TIMEOUT_MS2 = 8e3;
-var WAITED_TENANT_CONTROL_TIMEOUT_MS = 13e3;
 var TENANT_DEPLOY_TIMEOUT_MS = 12e4;
 var RETRY_ATTEMPTS = 3;
 function retriedFetch(deps, url, init) {
   const headers = { ...clientVersionHeaders(), ...init.headers };
   return fetchWithRetry(deps.fetch ?? fetch, url, { ...init, headers }, {
     attempts: RETRY_ATTEMPTS,
-    timeoutMs: deps.timeoutMs ?? DEFAULT_TIMEOUT_MS2
+    timeoutMs: deps.timeoutMs ?? REGISTRY_FETCH_TIMEOUT_MS
   });
 }
 async function fetchTrainAuthority(repo, deps) {
@@ -14389,7 +15207,7 @@ async function postJson(pathSuffix, payload, deps, method = "POST", opts = {}) {
   if (!deps.baseUrl) return { ok: false, status: 0, body: null, error: "no Hub API URL (set MMI_HUB_URL or use a current MMI CLI/plugin build)" };
   const token = await deps.token();
   if (!token) return { ok: false, status: 0, body: null, error: "no Hub session token (run `gh auth login`)" };
-  const timeoutMs = opts.timeoutMs ?? deps.timeoutMs ?? DEFAULT_TIMEOUT_MS2;
+  const timeoutMs = opts.timeoutMs ?? deps.timeoutMs ?? REGISTRY_FETCH_TIMEOUT_MS;
   const sendOnce = (url, init) => fetchWithRetry(deps.fetch ?? fetch, url, init, { attempts: 1, timeoutMs });
   const send = opts.noRetry ? sendOnce : (url, init) => fetchWithRetry(deps.fetch ?? fetch, url, init, { attempts: RETRY_ATTEMPTS, timeoutMs });
   try {
@@ -14418,38 +15236,12 @@ async function attestAppGaps(slug, repo, deps) {
   return postJson(`/projects/${encodeURIComponent(slug)}/attest-app`, { repo }, deps);
 }
 async function tenantControl(payload, deps) {
-  const noRetry = payload.action === "retire";
-  const timeoutMs = payload.wait ? WAITED_TENANT_CONTROL_TIMEOUT_MS : void 0;
-  return postJson("/tenant-control", payload, deps, "POST", { noRetry, timeoutMs });
+  return postJson("/tenant-control", payload, deps, "POST", { noRetry: true });
 }
 async function tenantDeploy(payload, deps) {
   return postJson("/tenant-deploy", payload, deps, "POST", { noRetry: true, timeoutMs: TENANT_DEPLOY_TIMEOUT_MS });
 }
 
-// src/tenant-verify-secrets.ts
-function tenantControlWait(action) {
-  return action === "status" || action === "retire" || action === "verify-secrets";
-}
-function renderVerifySecrets(body) {
-  const secrets2 = body?.secrets ?? [];
-  const counts = {
-    match: secrets2.filter((s) => s.status === "match").length,
-    mismatch: secrets2.filter((s) => s.status === "mismatch").length,
-    missing: secrets2.filter((s) => s.status === "missing").length
-  };
-  const lines = secrets2.map((s) => `${s.key}: ${s.status}`);
-  lines.push(`verify-secrets: ${counts.match} match, ${counts.mismatch} mismatch, ${counts.missing} missing`);
-  const ssmStatus = body?.ssmStatus ?? "pending";
-  if (ssmStatus !== "Success") {
-    return { lines, failure: `verify-secrets did not complete (ssm status ${ssmStatus})${body?.commandId ? ` \u2014 command ${body.commandId}` : ""}` };
-  }
-  const bad = counts.mismatch + counts.missing;
-  if (bad > 0) {
-    return { lines, failure: `${bad} of ${secrets2.length} required secret(s) not matching the vault (${counts.mismatch} mismatch, ${counts.missing} missing)` };
-  }
-  return { lines, failure: null };
-}
-
 // src/project-readiness.ts
 function stagesForTrack(meta) {
   return branchesForTrack(resolveReleaseTrack(meta)).map((b) => b === "development" ? "dev" : b);
@@ -14771,14 +15563,14 @@ async function buildV2Doctor(repoOrSlug, deps) {
     const required = stageInTrack(meta, stage2) && projectRequiresDeployState(model, stage2);
     return [stage2, { required, ok: required ? await deps.hasDeployState(slug, stage2) : true }];
   })));
-  const secrets2 = Object.fromEntries(STAGES.map((stage2) => {
+  const secrets = Object.fromEntries(STAGES.map((stage2) => {
     const required = stageInTrack(meta, stage2) ? stageRequiredSecrets(stage2, meta).map((key) => stageKey2(stage2, key)) : [];
     const present = required.filter((key) => presentSecrets.has(key));
     const missing = required.filter((key) => !presentSecrets.has(key));
     return [stage2, { required, present, missing }];
   }));
   const metaMissing = ["class", "projectType", "deployModel", "vaultPath", "kbPointer"].filter((key) => meta[key] === void 0).concat(boardRegistryGaps(meta));
-  const ok = !secretsError && metaMissing.length === 0 && Object.values(deployCoords).every((v) => v.ok) && Object.values(secrets2).every((v) => v.missing.length === 0);
+  const ok = !secretsError && metaMissing.length === 0 && Object.values(deployCoords).every((v) => v.ok) && Object.values(secrets).every((v) => v.missing.length === 0);
   const edgeDomainWarnings = deps.resolveDns ? await probeEdgeDomains(meta, deps.resolveDns) : [];
   return {
     ok,
@@ -14787,7 +15579,7 @@ async function buildV2Doctor(repoOrSlug, deps) {
     class: meta.class,
     projectType,
     deployModel: model,
-    hubOwned: { meta: { ok: metaMissing.length === 0, missing: metaMissing }, deployCoords, deployState, secrets: secrets2 },
+    hubOwned: { meta: { ok: metaMissing.length === 0, missing: metaMissing }, deployCoords, deployState, secrets },
     secretsError,
     autoHealAvailable: Object.keys(autoHeal.patch),
     appOwnedGaps: autoHeal.appOwnedGaps,
@@ -14837,7 +15629,7 @@ ${section}`.trim();
 }
 
 // src/project-set.ts
-var UNSET_KEYS = ["oauth", "requiredRuntimeSecrets", "edgeDomains", "requiredGcpApis", "publishRequired", "ci", "requiredChecks", "gate"];
+var UNSET_KEYS = ["oauth", "requiredRuntimeSecrets", "edgeDomains", "requiredGcpApis", "publishRequired", "publishDir", "dashboard", "ci", "requiredChecks", "gate"];
 var UNSET_KEY_SET = new Set(UNSET_KEYS);
 var RUNTIME_SECRET_STAGES = ["dev", "rc", "main"];
 function parseRuntimeSecretsVar(raw) {
@@ -14996,6 +15788,21 @@ function parsePublishRequiredVar(raw) {
   if (raw === "false") return false;
   throw new Error("project set: publishRequired must be true or false");
 }
+function parseDashboardVar(raw) {
+  if (raw === "true") return true;
+  if (raw === "false") return false;
+  throw new Error("project set: dashboard must be true or false");
+}
+function parsePublishDirVar(raw) {
+  const v = raw.trim();
+  if (v === "" || v === ".") {
+    throw new Error("project set: publishDir must be a non-empty relative subpath, e.g. packages/ui (omit it or --unset publishDir for the repo root)");
+  }
+  if (!/^[A-Za-z0-9._-]+(\/[A-Za-z0-9._-]+)*$/.test(v) || /(^|\/)\.\.(\/|$)/.test(v)) {
+    throw new Error('project set: publishDir must be a safe relative subpath \u2014 no leading slash, no ".." segment');
+  }
+  return v;
+}
 function parseRequiredChecksVar(raw) {
   let parsed;
   try {
@@ -15046,6 +15853,8 @@ var SETTABLE_VAR_KEYS = [
   "repos",
   "oauth",
   "publishRequired",
+  "publishDir",
+  "dashboard",
   "requiredGcpApis",
   "requiredRuntimeSecrets",
   "edgeDomains",
@@ -15062,6 +15871,8 @@ var SETTABLE_VAR_KEY_SET = new Set(SETTABLE_VAR_KEYS);
 var SETTABLE_VAR_HINTS = {
   projectNumber: "numeric",
   publishRequired: "true|false",
+  publishDir: "relative subpath, e.g. packages/ui",
+  dashboard: "true|false",
   repos: 'JSON array, e.g. ["mutmutco/mm-foo"]',
   oauth: "JSON {subdomains,domains,callbackPath}",
   requiredGcpApis: "comma-string",
@@ -15135,6 +15946,10 @@ function buildProjectSetPatch(input) {
       patch[key] = parseReposVar(raw);
     } else if (key === "publishRequired") {
       patch[key] = parsePublishRequiredVar(raw);
+    } else if (key === "dashboard") {
+      patch[key] = parseDashboardVar(raw);
+    } else if (key === "publishDir") {
+      patch[key] = parsePublishDirVar(raw);
     } else if (key === "ci") {
       if (raw !== "none") throw new Error('project set: ci must be "none" (or use --unset ci to require checks)');
       patch[key] = raw;
@@ -15199,11 +16014,16 @@ function parseKbTree(stdout, prefix) {
   return tree.filter((t) => t.type === "blob" && typeof t.path === "string" && t.path.startsWith("kb/")).map((t) => t.path).filter((p) => pre ? p.startsWith(pre) : true).sort();
 }
 
+// src/northstar-commands.ts
+var import_node_fs21 = require("node:fs");
+var import_node_child_process11 = require("node:child_process");
+var import_promises6 = require("node:fs/promises");
+
 // src/plan.ts
-var import_node_path16 = require("node:path");
+var import_node_path18 = require("node:path");
 var PLANS_DIR = "plans";
-var META_FILE = (0, import_node_path16.join)(PLANS_DIR, ".plan-meta.json");
-var planPath = (slug) => (0, import_node_path16.join)(PLANS_DIR, `${slug}.md`);
+var META_FILE = (0, import_node_path18.join)(PLANS_DIR, ".plan-meta.json");
+var planPath = (slug) => (0, import_node_path18.join)(PLANS_DIR, `${slug}.md`);
 var metaKey = (project2, slug) => `${project2}/${slug}`;
 function parseMeta(raw) {
   if (!raw) return {};
@@ -15228,7 +16048,7 @@ function hashContent(s) {
 function staleHint(slug) {
   return `remote "${slug}" is newer \u2014 run \`mmi-cli northstar pull ${slug}\` first (your local is based on an older version), or re-push with \`--force\` to overwrite`;
 }
-var INDEX_FILE = (0, import_node_path16.join)(PLANS_DIR, ".index.json");
+var INDEX_FILE = (0, import_node_path18.join)(PLANS_DIR, ".index.json");
 var INDEX_TTL_MS = 6e4;
 function parseIndex(raw) {
   if (!raw) return null;
@@ -15257,7 +16077,7 @@ function mergeIndex(idx, scope, plans, now) {
   const mergedScope = idx.scope === null ? null : [.../* @__PURE__ */ new Set([...idx.scope, ...scope])];
   return { fetchedAt: now, scope: mergedScope, plans: [...kept, ...plans] };
 }
-var QUEUE_FILE = (0, import_node_path16.join)(PLANS_DIR, ".sync-queue.json");
+var QUEUE_FILE = (0, import_node_path18.join)(PLANS_DIR, ".sync-queue.json");
 var QUEUE_MAX_ATTEMPTS = 10;
 function isValidQueueEntry(e) {
   if (!e || typeof e !== "object") return false;
@@ -15716,23 +16536,298 @@ async function planGraduate(deps, slug, opts = {}) {
   if (pushed) deps.log(`graduated ${slug}`);
 }
 
-// src/atomic-write.ts
-var import_node_fs18 = require("node:fs");
-function atomicWriteFileSync(path2, content) {
-  const tmp = `${path2}.${process.pid}.tmp`;
-  (0, import_node_fs18.writeFileSync)(tmp, content, "utf8");
-  (0, import_node_fs18.renameSync)(tmp, path2);
-}
-
-// src/oauth.ts
-var DEFAULT_DOMAINS = ["mutatismutandis.co", "mutmut.co"];
-var DEFAULT_CALLBACK_PATH = "/api/auth/callback";
-var ENV_PREFIXES = ["", "dev", "rc"];
-var LOOPBACK = ["http://localhost", "http://127.0.0.1"];
-var SSM_ENVS = ["dev", "rc", "main"];
-var SSM_NAMES = ["GOOGLE_CLIENT_ID", "GOOGLE_CLIENT_SECRET"];
-var uniq = (xs) => [...new Set(xs)];
-function defaultSubdomain2(slug) {
+// src/northstar-commands.ts
+var planSyncDetached = false;
+function detachPlanSync() {
+  if (planSyncDetached) return;
+  planSyncDetached = true;
+  try {
+    (0, import_node_child_process11.spawn)(process.execPath, [process.argv[1], "northstar", "sync", "--quiet"], {
+      detached: true,
+      stdio: "ignore",
+      windowsHide: true,
+      cwd: process.cwd()
+    }).unref();
+  } catch {
+  }
+}
+function makePlanDeps(cfg, io = consoleIo) {
+  const ensureDir = () => (0, import_node_fs21.mkdirSync)(PLANS_DIR, { recursive: true });
+  return {
+    apiUrl: cfg.sagaApiUrl,
+    fetch: (url, init = {}) => fetch(url, { ...init, signal: init.signal ?? AbortSignal.timeout(1e4) }),
+    headers: (extra) => hubHeaders(extra),
+    project: async () => (await sagaKey(cfg)).project,
+    readLocal: (slug) => {
+      try {
+        return (0, import_node_fs21.readFileSync)(planPath(slug), "utf8");
+      } catch {
+        return null;
+      }
+    },
+    writeLocal: (slug, content) => {
+      ensureDir();
+      (0, import_node_fs21.writeFileSync)(planPath(slug), content, "utf8");
+    },
+    removeLocal: (slug) => {
+      try {
+        (0, import_node_fs21.rmSync)(planPath(slug));
+      } catch {
+      }
+    },
+    readMetaRaw: () => {
+      try {
+        return (0, import_node_fs21.readFileSync)(META_FILE, "utf8");
+      } catch {
+        return null;
+      }
+    },
+    writeMetaRaw: (raw) => {
+      ensureDir();
+      atomicWriteFileSync(META_FILE, raw);
+    },
+    readIndexRaw: () => {
+      try {
+        return (0, import_node_fs21.readFileSync)(INDEX_FILE, "utf8");
+      } catch {
+        return null;
+      }
+    },
+    writeIndexRaw: (raw) => {
+      ensureDir();
+      atomicWriteFileSync(INDEX_FILE, raw);
+    },
+    readQueueRaw: () => {
+      try {
+        return (0, import_node_fs21.readFileSync)(QUEUE_FILE, "utf8");
+      } catch {
+        return null;
+      }
+    },
+    writeQueueRaw: (raw) => {
+      ensureDir();
+      atomicWriteFileSync(QUEUE_FILE, raw);
+    },
+    detachSync: detachPlanSync,
+    log: (m) => io.log(m),
+    err: (m) => io.err(m),
+    now: () => (/* @__PURE__ */ new Date()).toISOString()
+  };
+}
+function openInEditor(path2) {
+  const editor = process.env.EDITOR || process.env.VISUAL;
+  if (!editor) {
+    console.log(`plan at ${path2} (set $EDITOR to open it automatically)`);
+    return;
+  }
+  try {
+    (0, import_node_child_process11.spawn)(editor, [path2], { stdio: "inherit" });
+  } catch {
+    console.log(`open ${path2} manually`);
+  }
+}
+async function withPlan(quiet, run, io = consoleIo) {
+  const cfg = await loadConfig();
+  if (!cfg.sagaApiUrl) {
+    if (!quiet) fail("plan: Hub API URL not configured");
+    return;
+  }
+  await run(makePlanDeps(cfg, io));
+}
+async function gatherRelevanceSignals() {
+  const branch = await gitOut(["rev-parse", "--abbrev-ref", "HEAD"]).catch(() => "") || void 0;
+  const changed = (await gitOut(["diff", "--name-only", "HEAD"]).catch(() => "")).split("\n").map((s) => s.trim()).filter(Boolean);
+  const signals = { branch, changedFiles: changed.length ? changed : void 0 };
+  const issueNum = branch?.match(/\b(\d{2,})\b/)?.[1];
+  if (issueNum) {
+    try {
+      const { stdout } = await execFileP2(
+        "gh",
+        ["issue", "view", issueNum, "--json", "title,labels", "--jq", "{title:.title,labels:[.labels[].name]}"],
+        { timeout: 1e4 }
+      );
+      const j = JSON.parse(stdout);
+      if (j.title) signals.issueTitle = j.title;
+      if (j.labels?.length) signals.issueLabels = j.labels;
+    } catch {
+    }
+  }
+  return signals;
+}
+function registerNorthStarCommands(cmd) {
+  cmd.command("push <slug>").description("push a North Star plan to the server (from plans/<slug>.md or --body-file)").option("--project <name>", "override the project key").option("--body-file <path|->", "read plan markdown from a UTF-8 file, or from stdin with -").option("--force", "overwrite the remote even if it changed since your last sync").option("--wait", "push synchronously (block until the server write lands)").action(async (slug, o) => {
+    let content;
+    if (o.bodyFile) {
+      try {
+        content = await resolveTextArg({ file: o.bodyFile }, { readFile: import_promises6.readFile, readStdin }, {
+          value: "inline content",
+          file: "--body-file",
+          noun: "plan"
+        });
+      } catch (e) {
+        console.error(e.message);
+        process.exitCode = 1;
+        return;
+      }
+    }
+    return withPlan(false, async (d) => {
+      const ok = await planPush(d, slug, { project: o.project, force: o.force, wait: o.wait, content });
+      if (!ok) process.exitCode = 1;
+    });
+  });
+  cmd.command("pull <slug>").description("pull a North Star plan from the server into plans/<slug>.md").option("--project <name>", "override the project key").option("--force", "overwrite local even if it has unpushed edits").action((slug, o) => withPlan(false, async (d) => {
+    const ok = await planPull(d, slug, o);
+    if (!ok) process.exitCode = 1;
+  }));
+  cmd.command("show <slug>").alias("get").description("print a North Star plan to stdout, read-only (no local copy written \u2014 mirrors `kb get`)").option("--project <name>", "override the project key").action((slug, o) => withPlan(false, async (d) => {
+    const ok = await planShow(d, slug, o);
+    if (!ok) process.exitCode = 1;
+  }));
+  cmd.command("list").description("list your North Star plans (cross-device)").option("--project <name>", "filter by project").option("--json", "machine-readable output").option("--quiet", "silent when unconfigured/empty/unreachable (SessionStart hook)").option("--fresh", "bypass the local cache and read from the server").action((o) => withPlan(o.quiet ?? false, (d) => planList(d, o)));
+  cmd.command("relevant").description("list North Stars relevant to your current task (branch + claimed issue + changed files)").option("--project <name>", "override the project key").option("--all", "include superseded/graduated and recent non-matching plans").option("--limit <n>", "max results (default 5)").option("--fresh", "bypass the local cache and read from the server").option("--json", "machine-readable output").action((o) => withPlan(false, async (d) => {
+    const signals = await gatherRelevanceSignals();
+    await relevantPlans(d, signals, { project: o.project, includeAll: o.all, limit: o.limit ? Number(o.limit) : void 0, fresh: o.fresh, json: o.json });
+  }));
+  cmd.command("sync").description("drain queued background pushes and refresh the local plan index").option("--quiet", "silent (background worker)").option("--wait", "durable confirmation: drain, then report unresolved pushes and exit non-zero if any remain").action((o) => withPlan(o.quiet ?? false, async (d) => {
+    const unresolved = await planSync(d, o);
+    if (!o.wait) return;
+    if (unresolved.length) {
+      for (const e of unresolved) d.err(`${e.slug}: ${e.conflict ?? e.deadLettered ?? "still pending"}`);
+      process.exitCode = 1;
+    } else if (!o.quiet) {
+      d.log("north star: all queued pushes landed");
+    }
+  }));
+  cmd.command("status").description("show pending/conflicted background pushes and the plan-cache age").option("--json", "machine-readable output").action((o) => withPlan(false, (d) => planStatus(d, o)));
+  cmd.command("reconcile").description("refresh stale local etags from the server without --force (recovers from an object-store re-stamp)").action(() => withPlan(false, (d) => planReconcile(d)));
+  cmd.command("open <slug>").description("pull if needed, then open plans/<slug>.md in $EDITOR").option("--project <name>", "override the project key").action(
+    (slug, o) => withPlan(false, async (d) => {
+      const ok = await planPull(d, slug, { project: o.project });
+      if (!ok) {
+        process.exitCode = 1;
+        return;
+      }
+      openInEditor(planPath(slug));
+    })
+  );
+  cmd.command("delete <slug>").description("delete a North Star plan from the server and the local copy").option("--project <name>", "override the project key").action((slug, o) => withPlan(false, (d) => planDelete(d, slug, o)));
+  cmd.command("graduate <slug>").description("mark a built-and-merged North Star plan as org-visible and push it").requiredOption("--merged-pr <url|number>", "merged PR URL or number proving the plan shipped").option("--org-visible", "confirm this plan is safe to queue for org KB curation").option("--project <name>", "override the project key").option("--force", "overwrite the remote even if it changed since your last sync").action(
+    (slug, o) => withPlan(false, (d) => planGraduate(d, slug, o))
+  );
+}
+
+// src/secrets-commands.ts
+async function readSecretStdin() {
+  if (process.stdin.isTTY) {
+    process.stderr.write(
+      'secrets set: pipe the value on stdin (it is never an argument) \u2014 e.g.\n  printf %s "$VALUE" | mmi-cli secrets set <KEY>\n'
+    );
+    return "";
+  }
+  const chunks = [];
+  for await (const chunk of process.stdin) chunks.push(chunk);
+  return Buffer.concat(chunks).toString("utf8").replace(/\r?\n$/, "");
+}
+function makeSecretsDeps(cfg) {
+  return {
+    apiUrl: cfg.sagaApiUrl,
+    fetch: (url, init = {}) => fetch(url, { ...init, signal: init.signal ?? AbortSignal.timeout(1e4) }),
+    headers: (extra) => hubHeaders(extra),
+    // Vault paths are lowercase kebab (AGENTS.md naming); sagaKey carries the repo name's original
+    // casing, which leaked mixed-case into `secrets where` output (#681).
+    slug: async () => (await sagaKey(cfg)).project.toLowerCase(),
+    readSecretValue: () => readSecretStdin(),
+    log: (m) => console.log(m),
+    err: (m) => console.error(m)
+  };
+}
+async function withSecrets(run) {
+  const cfg = await loadConfig();
+  if (!cfg.sagaApiUrl) {
+    fail("secrets: Hub API URL not configured");
+    return;
+  }
+  await run(makeSecretsDeps(cfg));
+}
+function registerSecretsCommands(program3) {
+  const secrets = program3.command("secrets").description("two-tier project secrets \u2014 self-serve your repo dev/* tier; org tier is master-gated");
+  secrets.command("where").description("print where this repo's secrets live \u2014 the two-tier vault layout + well-known keys (no values)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").action((o) => withSecrets((d) => secretsWhere(d, o)));
+  secrets.command("list").description("list secret NAMES + tier for this repo (never values)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").action((o) => withSecrets((d) => secretsList(d, o)));
+  secrets.command("preflight").description("check required stage secret names for a deploy/train without reading values").requiredOption("--stage <dev|rc|main>", "stage to check").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--required <KEY...>", "required keys; bare keys are scoped under --stage").action(async (o) => {
+    if (!["dev", "rc", "main"].includes(o.stage)) {
+      return fail("secrets preflight: --stage must be dev, rc, or main");
+    }
+    const cfg = await loadConfig();
+    if (!cfg.sagaApiUrl) {
+      fail("secrets: Hub API URL not configured");
+      return;
+    }
+    const d = makeSecretsDeps(cfg);
+    const regDeps = { baseUrl: cfg.sagaApiUrl, token: () => hubAuthToken({ baseUrl: cfg.sagaApiUrl, githubToken }) };
+    const slug = (o.repo ? o.repo.split("/").pop() : await d.slug()).toLowerCase();
+    const repo = o.repo ?? `mutmutco/${slug}`;
+    const meta = await fetchProjectBySlug(slug, regDeps);
+    const required = o.required?.length ? o.required : requiredRuntimeSecretNames(o.stage, meta?.requiredRuntimeSecrets, {
+      includeGoogleOAuth: projectRequiresGoogleOAuth(meta, meta?.deployModel)
+    });
+    const centralContainer = meta?.deployModel === "tenant-container" || meta?.deployModel === "solo-container";
+    if (!o.required?.length && centralContainer && meta && !hasRuntimeSecretContract(meta.requiredRuntimeSecrets)) {
+      d.err("secrets preflight: requiredRuntimeSecrets is unset for this deployable tenant \u2014 declare the per-stage contract in registry META (or an explicit empty map) before promoting");
+      process.exitCode = 1;
+      return;
+    }
+    const ok = await secretsPreflight(d, { repo: o.repo, stage: o.stage, required });
+    if (!ok) process.exitCode = 1;
+  });
+  secrets.command("get <key>").description("print one secret value over TLS (prints once, raw \u2014 do not log/paste it)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").action((key, o) => withSecrets(async (d) => {
+    const ok = await secretsGet(d, key, o);
+    if (!ok) process.exitCode = 1;
+  }));
+  secrets.command("request <key>").description("approved escalation: create a Hub issue + admin DM for a missing secret (no value)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--priority <priority>", "urgent | high | medium | low (default: medium)").option("--reason <text>", "why the secret is needed; safe metadata only").option("--context <text>", "lookup command/context; safe metadata only").option("--json", "machine-readable output").action((key, o) => withSecrets(async (d) => {
+    const ok = await secretsRequest(d, key, o);
+    if (!ok) process.exitCode = 1;
+  }));
+  secrets.command("verify <key>").description("validate a known provider secret without printing its value").option("--repo <owner/repo>", "target repo (defaults to the current repo)").action((key, o) => withSecrets(async (d) => {
+    const ok = await secretsVerify(d, key, o);
+    if (!ok) process.exitCode = 1;
+  }));
+  secrets.command("set <key>").description("write/rotate a secret; value is read from stdin (never an argument)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").action((key, o) => withSecrets(async (d) => {
+    const ok = await secretsSet(d, key, o);
+    if (!ok) process.exitCode = 1;
+  }));
+  secrets.command("edit <key>").description("alias for set \u2014 replace a secret value (read from stdin)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").action((key, o) => withSecrets(async (d) => {
+    const ok = await secretsEdit(d, key, o);
+    if (!ok) process.exitCode = 1;
+  }));
+  secrets.command("copy").description("copy provider keys between vault tiers (audit-logged; org-tier source is master-gated)").requiredOption("--from <stage>", "source tier: dev, rc, or main").requiredOption("--to <stage>", "destination tier: dev, rc, or main").requiredOption("--keys <names>", "comma-separated secret names (encryption keys blocked)").option("--dry-run", "report copies without writing").option("--repo <owner/repo>", "target repo (defaults to the current repo)").action((o) => withSecrets(async (d) => {
+    const stages = ["dev", "rc", "main"];
+    if (!stages.includes(o.from) || !stages.includes(o.to)) {
+      return fail("secrets copy: --from and --to must be dev, rc, or main");
+    }
+    const ok = await secretsCopy(d, {
+      repo: o.repo,
+      from: o.from,
+      to: o.to,
+      keys: o.keys.split(","),
+      dryRun: o.dryRun
+    });
+    if (!ok) process.exitCode = 1;
+  }));
+  secrets.command("rm <key>").description("remove a secret (project tier self-serve; org tier needs a grant)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").action((key, o) => withSecrets((d) => secretsRemove(d, key, o)));
+  secrets.command("use <key>").description("print guidance on consuming a secret without committing it (no value)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").action((key, o) => withSecrets((d) => secretsUse(d, key, o)));
+  secrets.command("grant <repo> <login> <key>").description("MASTER-ONLY: grant a project-admin standing access to a specific org-tier secret").action((repo, login, key) => withSecrets((d) => secretsGrant(d, repo, login, key, {})));
+  secrets.command("revoke <repo> <login> <key>").description("MASTER-ONLY: withdraw a previously granted org-tier secret access").action((repo, login, key) => withSecrets((d) => secretsRevoke(d, repo, login, key, {})));
+}
+
+// src/oauth.ts
+var DEFAULT_DOMAINS = ["mutatismutandis.co", "mutmut.co"];
+var DEFAULT_CALLBACK_PATH = "/api/auth/callback";
+var ENV_PREFIXES = ["", "dev", "rc"];
+var LOOPBACK = ["http://localhost", "http://127.0.0.1"];
+var SSM_ENVS = ["dev", "rc", "main"];
+var SSM_NAMES = ["GOOGLE_CLIENT_ID", "GOOGLE_CLIENT_SECRET"];
+var uniq = (xs) => [...new Set(xs)];
+function defaultSubdomain2(slug) {
   const i = slug.indexOf("-");
   return i === -1 ? slug : slug.slice(i + 1);
 }
@@ -15952,7 +17047,7 @@ async function fetchHubVersionInfo(baseUrl) {
 }
 function readRepoVersion() {
   try {
-    return JSON.parse((0, import_node_fs19.readFileSync)((0, import_node_path17.join)(process.cwd(), ".claude-plugin", "plugin.json"), "utf8")).version || void 0;
+    return JSON.parse((0, import_node_fs22.readFileSync)((0, import_node_path19.join)(process.cwd(), ".claude-plugin", "plugin.json"), "utf8")).version || void 0;
   } catch {
     return void 0;
   }
@@ -15998,6 +17093,53 @@ async function fetchNpmReleasedVersion() {
     return void 0;
   }
 }
+async function fetchUiPackageLatestVersion(packageName) {
+  try {
+    const { stdout } = await runHostBin("npm", npmUiPackageLatestArgs(packageName), { timeout: NPM_VIEW_TIMEOUT_MS });
+    return parseNpmViewVersion(stdout);
+  } catch {
+    return void 0;
+  }
+}
+async function applyDesignSystemUpdate(check, log) {
+  if (check.ok || !check.packageName) return check;
+  try {
+    log(`  \u21BB updating ${check.packageName} ${check.installedVersion ?? "(missing)"} \u2192 ${check.latestVersion ?? "latest"}\u2026`);
+    await runHostBin("npm", ["update", check.packageName], { timeout: NPM_UPDATE_TIMEOUT_MS });
+    const installedVersion = designSystemSnapshot(process.cwd()).installedVersion ?? check.latestVersion;
+    if (check.latestVersion && installedVersion && compareVersions(installedVersion, check.latestVersion) >= 0) {
+      return { ...check, ok: true, installedVersion };
+    }
+    return { ...check, installedVersion };
+  } catch {
+    return check;
+  }
+}
+async function applyRegistryComponentsSyncCheck(check, targetVersion, log) {
+  if (check.ok || !check.components?.length) return check;
+  const result = await applyRegistryComponentsSync(
+    process.cwd(),
+    check.components,
+    targetVersion ?? check.targetVersion,
+    log,
+    defaultRegistrySyncDeps()
+  );
+  if (!result.ok) return check;
+  const state = await gatherRegistryComponentsState(process.cwd(), targetVersion ?? check.targetVersion, { fetch });
+  return buildRegistryComponentsCheck({ ...state, isConsumerRepo: true });
+}
+async function resolveDashboardConsumer(cfg) {
+  if (!cfg.sagaApiUrl || isUiFactoryCheckout(process.cwd())) return { isConsumer: false };
+  const read = await fetchProjectBySlugChecked(await repoSlug(), registryClientDeps(cfg));
+  if (!read.ok) return { isConsumer: false, registryReadFailed: read.error };
+  return { isConsumer: isDashboardMetaConsumer(read.project) };
+}
+function buildDesignSystemRegistryReadCheck(error) {
+  return { ok: false, label: DESIGN_SYSTEM_VERSION_LABEL, fix: dashboardConsumerRegistryFix(error) };
+}
+function buildRegistryComponentsRegistryReadCheck(error) {
+  return { ok: false, label: REGISTRY_COMPONENTS_LABEL, fix: dashboardConsumerRegistryFix(error) };
+}
 async function requireFreshTrainCli(commandName) {
   if (process.env.MMI_TRAIN_FRESH_OVERRIDE === "1") return;
   const report = buildVersionLagReport({
@@ -16019,8 +17161,8 @@ async function runClaudePlugin(args) {
     return false;
   }
 }
-async function applyClaudePluginHeal(surface, log) {
-  if (surface !== "claude-cli" && surface !== "claude-vscode") return false;
+async function applyClaudePluginHeal(surface, log, opts) {
+  if (!opts?.force && surface !== "claude-cli" && surface !== "claude-vscode") return false;
   log("  \u21BB reinstalling the MMI plugin via `claude plugin` (marketplace remove \u2192 add \u2192 install)\u2026");
   for (const step of CLAUDE_PLUGIN_HEAL_STEPS) {
     if (healStepAborts(step, await runClaudePlugin([...step.args]))) return false;
@@ -16035,8 +17177,8 @@ async function runCodexPlugin(args) {
     return false;
   }
 }
-async function applyCodexPluginHeal(surface, log) {
-  if (surface !== "codex") return false;
+async function applyCodexPluginHeal(surface, log, opts) {
+  if (!opts?.force && surface !== "codex") return false;
   log("  \u21BB reinstalling the MMI plugin via `codex plugin` (marketplace remove \u2192 add --ref main \u2192 add)\u2026");
   for (const step of CODEX_PLUGIN_HEAL_STEPS) {
     if (healStepAborts(step, await runCodexPlugin([...step.args]))) return false;
@@ -16060,7 +17202,8 @@ async function runRulesSync(opts, io = consoleIo) {
     ".claude/settings.json",
     ".claude/output-styles/mmi-plain.md",
     ".cursor/rules/mmi-plain-language.mdc",
-    ".cursor/rules/mmi-tool-economy.mdc"
+    ".cursor/rules/mmi-tool-economy.mdc",
+    ".cursor/rules/mmi-code-economy.mdc"
   ];
   const fetched = await Promise.all(files.map(async (file) => {
     try {
@@ -16079,11 +17222,11 @@ async function runRulesSync(opts, io = consoleIo) {
   for (const entry of fetched) {
     if ("error" in entry) continue;
     const { file, source } = entry;
-    const current = (0, import_node_fs19.existsSync)(file) ? await (0, import_promises6.readFile)(file, "utf8") : null;
+    const current = (0, import_node_fs22.existsSync)(file) ? await (0, import_promises7.readFile)(file, "utf8") : null;
     if (needsUpdate(source, current)) {
       const slash = file.lastIndexOf("/");
-      if (slash > 0) (0, import_node_fs19.mkdirSync)(file.slice(0, slash), { recursive: true });
-      await (0, import_promises6.writeFile)(file, normalizeEol(source), "utf8");
+      if (slash > 0) (0, import_node_fs22.mkdirSync)(file.slice(0, slash), { recursive: true });
+      await (0, import_promises7.writeFile)(file, normalizeEol(source), "utf8");
       changed++;
       if (!opts.quiet) io.log(`mmi-cli rules: updated ${file}`);
     }
@@ -16108,9 +17251,9 @@ async function runDocsSync(opts, io = consoleIo) {
         return null;
       }
     },
-    localContent: async (f) => (0, import_node_fs19.existsSync)(f) ? await (0, import_promises6.readFile)(f, "utf8") : null,
+    localContent: async (f) => (0, import_node_fs22.existsSync)(f) ? await (0, import_promises7.readFile)(f, "utf8") : null,
     writeDoc: async (f, c) => {
-      await (0, import_promises6.writeFile)(f, c, "utf8");
+      await (0, import_promises7.writeFile)(f, c, "utf8");
     }
   });
   for (const f of result.updated) io.log(`mmi-cli docs: updated ${f} (from origin/${def})`);
@@ -16185,7 +17328,7 @@ function runWorktreeInstall(command, cwd, quiet) {
   const file = isWin ? "cmd.exe" : bin;
   const spawnArgs = isWin ? ["/c", bin, ...args] : args;
   return new Promise((resolve, reject) => {
-    const child = (0, import_node_child_process10.spawn)(file, spawnArgs, { cwd, stdio: quiet ? "ignore" : "inherit", windowsHide: true });
+    const child = (0, import_node_child_process12.spawn)(file, spawnArgs, { cwd, stdio: quiet ? "ignore" : "inherit", windowsHide: true });
     const timer = setTimeout(() => {
       try {
         child.kill();
@@ -16207,7 +17350,7 @@ function runWorktreeInstall(command, cwd, quiet) {
 async function primaryCheckoutRoot(worktreeRoot) {
   try {
     const out = (await execFileP2("git", ["-C", worktreeRoot, "rev-parse", "--path-format=absolute", "--git-common-dir"], { timeout: GIT_TIMEOUT_MS })).stdout.trim();
-    return out ? (0, import_node_path17.dirname)(out) : void 0;
+    return out ? (0, import_node_path19.dirname)(out) : void 0;
   } catch {
     return void 0;
   }
@@ -16220,28 +17363,28 @@ function makeProvisionDeps(worktreeRoot, quiet, log) {
   };
 }
 function acquireWorktreeSetupLock(worktreeRoot) {
-  const lockPath = (0, import_node_path17.join)(worktreeRoot, ".mmi", "worktree-setup.lock");
+  const lockPath = (0, import_node_path19.join)(worktreeRoot, ".mmi", "worktree-setup.lock");
   const take = () => {
-    const fd = (0, import_node_fs19.openSync)(lockPath, "wx");
+    const fd = (0, import_node_fs22.openSync)(lockPath, "wx");
     try {
-      (0, import_node_fs19.writeSync)(fd, String(Date.now()));
+      (0, import_node_fs22.writeSync)(fd, String(Date.now()));
     } finally {
-      (0, import_node_fs19.closeSync)(fd);
+      (0, import_node_fs22.closeSync)(fd);
     }
     return () => {
       try {
-        (0, import_node_fs19.rmSync)(lockPath, { force: true });
+        (0, import_node_fs22.rmSync)(lockPath, { force: true });
       } catch {
       }
     };
   };
   try {
-    (0, import_node_fs19.mkdirSync)((0, import_node_path17.dirname)(lockPath), { recursive: true });
+    (0, import_node_fs22.mkdirSync)((0, import_node_path19.dirname)(lockPath), { recursive: true });
     return take();
   } catch {
     try {
-      if (Date.now() - (0, import_node_fs19.statSync)(lockPath).mtimeMs > WORKTREE_SETUP_LOCK_TTL_MS) {
-        (0, import_node_fs19.rmSync)(lockPath, { force: true });
+      if (Date.now() - (0, import_node_fs22.statSync)(lockPath).mtimeMs > WORKTREE_SETUP_LOCK_TTL_MS) {
+        (0, import_node_fs22.rmSync)(lockPath, { force: true });
         return take();
       }
     } catch {
@@ -16320,361 +17463,90 @@ async function ghCreate(args) {
   try {
     const { stdout } = await execFileP2("gh", swapped.args, { timeout: GH_MUTATION_TIMEOUT_MS });
     return parseCreatedUrl(stdout);
-  } catch (e) {
-    await swapped.cleanup();
-    const err = e;
-    const note = timeoutKillNote(e, GH_MUTATION_TIMEOUT_MS);
-    fail(`gh ${args[0]} create failed: ${(err.stderr || err.message || String(e)).trim()}${note ? ` (${note})` : ""}`);
-  } finally {
-    await swapped.cleanup();
-  }
-}
-async function ghJson(args, timeout = 1e4) {
-  const { stdout } = await execFileP2("gh", args, { timeout });
-  return JSON.parse(stdout);
-}
-async function resolveRepo(repo) {
-  if (repo) return repo;
-  const fromOrigin = repoFromRemoteUrl(await gitOut(["remote", "get-url", "origin"]));
-  if (fromOrigin) return fromOrigin;
-  try {
-    const { stdout } = await execFileP2("gh", ["repo", "view", "--json", "nameWithOwner", "--jq", ".nameWithOwner"], { timeout: 5e3 });
-    return stdout.trim() || void 0;
-  } catch {
-    return void 0;
-  }
-}
-async function attachToProject(issueNumber, repo, priority) {
-  const targetRepo2 = await resolveRepo(repo);
-  let cfg;
-  try {
-    cfg = await loadConfigForRepo(targetRepo2);
-  } catch (e) {
-    console.error(`issue create: board attach skipped \u2014 ${e.message}`);
-    return void 0;
-  }
-  if (!cfg.projectId) {
-    console.error(`issue create: board attach skipped \u2014 no Hub registry board META for ${targetRepo2 ?? "current repo"}; run \`mmi-cli project get ${targetRepo2 ?? "<owner/repo>"}\` and backfill board coords`);
-    return void 0;
-  }
-  try {
-    const viewArgs = ["issue", "view", String(issueNumber), "--json", "id", "--jq", ".id"];
-    if (targetRepo2) viewArgs.push("--repo", targetRepo2);
-    const { stdout: idOut } = await execFileP2("gh", viewArgs, { timeout: 1e4 });
-    const contentId = idOut.trim();
-    if (!contentId) throw new Error("could not resolve issue node id");
-    const { stdout } = await execFileP2("gh", buildAddToProjectArgs(cfg.projectId, contentId), { timeout: GH_MUTATION_TIMEOUT_MS });
-    const projectItemId = parseAddedItemId(stdout);
-    if (projectItemId && priority) {
-      try {
-        await setBoardItemPriority(defaultGitHubClient(), cfg, projectItemId, priority);
-      } catch (e) {
-        const err = e;
-        process.stderr.write(`warning: issue #${issueNumber} board Priority not set: ${(err.stderr || err.message || String(e)).trim()}
-`);
-      }
-    }
-    return projectItemId;
-  } catch (e) {
-    const err = e;
-    process.stderr.write(`warning: issue #${issueNumber} created but NOT added to the project board: ${(err.stderr || err.message || String(e)).trim()}
-`);
-    return void 0;
-  }
-}
-var ghRunner = async (args, timeoutMs) => (await execFileP2("gh", args, { timeout: timeoutMs })).stdout;
-function scheduleRelatedDiscovery(o) {
-  try {
-    const args = ["issue", "discover-related", "--number", String(o.number), "--title", o.title, "--body", o.body];
-    if (o.repo) args.push("--repo", o.repo);
-    (0, import_node_child_process10.spawn)(process.execPath, [process.argv[1], ...args], {
-      detached: true,
-      stdio: "ignore",
-      windowsHide: true,
-      cwd: process.cwd()
-    }).unref();
-  } catch {
-  }
-}
-var planSyncDetached = false;
-function detachPlanSync() {
-  if (planSyncDetached) return;
-  planSyncDetached = true;
-  try {
-    (0, import_node_child_process10.spawn)(process.execPath, [process.argv[1], "northstar", "sync", "--quiet"], {
-      detached: true,
-      stdio: "ignore",
-      windowsHide: true,
-      cwd: process.cwd()
-    }).unref();
-  } catch {
-  }
-}
-function makePlanDeps(cfg, io = consoleIo) {
-  const ensureDir = () => (0, import_node_fs19.mkdirSync)(PLANS_DIR, { recursive: true });
-  return {
-    apiUrl: cfg.sagaApiUrl,
-    fetch: (url, init = {}) => fetch(url, { ...init, signal: init.signal ?? AbortSignal.timeout(1e4) }),
-    headers: (extra) => hubHeaders(extra),
-    project: async () => (await sagaKey(cfg)).project,
-    readLocal: (slug) => {
-      try {
-        return (0, import_node_fs19.readFileSync)(planPath(slug), "utf8");
-      } catch {
-        return null;
-      }
-    },
-    writeLocal: (slug, content) => {
-      ensureDir();
-      (0, import_node_fs19.writeFileSync)(planPath(slug), content, "utf8");
-    },
-    removeLocal: (slug) => {
-      try {
-        (0, import_node_fs19.rmSync)(planPath(slug));
-      } catch {
-      }
-    },
-    readMetaRaw: () => {
-      try {
-        return (0, import_node_fs19.readFileSync)(META_FILE, "utf8");
-      } catch {
-        return null;
-      }
-    },
-    writeMetaRaw: (raw) => {
-      ensureDir();
-      atomicWriteFileSync(META_FILE, raw);
-    },
-    readIndexRaw: () => {
-      try {
-        return (0, import_node_fs19.readFileSync)(INDEX_FILE, "utf8");
-      } catch {
-        return null;
-      }
-    },
-    writeIndexRaw: (raw) => {
-      ensureDir();
-      atomicWriteFileSync(INDEX_FILE, raw);
-    },
-    readQueueRaw: () => {
-      try {
-        return (0, import_node_fs19.readFileSync)(QUEUE_FILE, "utf8");
-      } catch {
-        return null;
-      }
-    },
-    writeQueueRaw: (raw) => {
-      ensureDir();
-      atomicWriteFileSync(QUEUE_FILE, raw);
-    },
-    detachSync: detachPlanSync,
-    log: (m) => io.log(m),
-    err: (m) => io.err(m),
-    now: () => (/* @__PURE__ */ new Date()).toISOString()
-  };
-}
-function openInEditor(path2) {
-  const editor = process.env.EDITOR || process.env.VISUAL;
-  if (!editor) {
-    console.log(`plan at ${path2} (set $EDITOR to open it automatically)`);
-    return;
+  } catch (e) {
+    await swapped.cleanup();
+    const err = e;
+    const note = timeoutKillNote(e, GH_MUTATION_TIMEOUT_MS);
+    fail(`gh ${args[0]} create failed: ${(err.stderr || err.message || String(e)).trim()}${note ? ` (${note})` : ""}`);
+  } finally {
+    await swapped.cleanup();
   }
+}
+async function ghJson(args, timeout = 1e4) {
+  const { stdout } = await execFileP2("gh", args, { timeout });
+  return JSON.parse(stdout);
+}
+async function resolveRepo(repo) {
+  if (repo) return repo;
+  const fromOrigin = repoFromRemoteUrl(await gitOut(["remote", "get-url", "origin"]));
+  if (fromOrigin) return fromOrigin;
   try {
-    (0, import_node_child_process10.spawn)(editor, [path2], { stdio: "inherit" });
+    const { stdout } = await execFileP2("gh", ["repo", "view", "--json", "nameWithOwner", "--jq", ".nameWithOwner"], { timeout: 5e3 });
+    return stdout.trim() || void 0;
   } catch {
-    console.log(`open ${path2} manually`);
+    return void 0;
   }
 }
-async function withPlan(quiet, run, io = consoleIo) {
-  const cfg = await loadConfig();
-  if (!cfg.sagaApiUrl) {
-    if (!quiet) fail("plan: Hub API URL not configured");
-    return;
+async function attachToProject(issueNumber, repo, priority) {
+  const targetRepo2 = await resolveRepo(repo);
+  let cfg;
+  try {
+    cfg = await loadConfigForRepo(targetRepo2);
+  } catch (e) {
+    console.error(`issue create: board attach skipped \u2014 ${e.message}`);
+    return void 0;
   }
-  await run(makePlanDeps(cfg, io));
-}
-async function gatherRelevanceSignals() {
-  const branch = await gitOut(["rev-parse", "--abbrev-ref", "HEAD"]).catch(() => "") || void 0;
-  const changed = (await gitOut(["diff", "--name-only", "HEAD"]).catch(() => "")).split("\n").map((s) => s.trim()).filter(Boolean);
-  const signals = { branch, changedFiles: changed.length ? changed : void 0 };
-  const issueNum = branch?.match(/\b(\d{2,})\b/)?.[1];
-  if (issueNum) {
-    try {
-      const { stdout } = await execFileP2(
-        "gh",
-        ["issue", "view", issueNum, "--json", "title,labels", "--jq", "{title:.title,labels:[.labels[].name]}"],
-        { timeout: 1e4 }
-      );
-      const j = JSON.parse(stdout);
-      if (j.title) signals.issueTitle = j.title;
-      if (j.labels?.length) signals.issueLabels = j.labels;
-    } catch {
-    }
+  if (!cfg.projectId) {
+    console.error(`issue create: board attach skipped \u2014 no Hub registry board META for ${targetRepo2 ?? "current repo"}; run \`mmi-cli project get ${targetRepo2 ?? "<owner/repo>"}\` and backfill board coords`);
+    return void 0;
   }
-  return signals;
-}
-function registerNorthStarCommands(cmd) {
-  cmd.command("push <slug>").description("push a North Star plan to the server (from plans/<slug>.md or --body-file)").option("--project <name>", "override the project key").option("--body-file <path|->", "read plan markdown from a UTF-8 file, or from stdin with -").option("--force", "overwrite the remote even if it changed since your last sync").option("--wait", "push synchronously (block until the server write lands)").action(async (slug, o) => {
-    let content;
-    if (o.bodyFile) {
+  try {
+    const viewArgs = ["issue", "view", String(issueNumber), "--json", "id", "--jq", ".id"];
+    if (targetRepo2) viewArgs.push("--repo", targetRepo2);
+    const { stdout: idOut } = await execFileP2("gh", viewArgs, { timeout: 1e4 });
+    const contentId = idOut.trim();
+    if (!contentId) throw new Error("could not resolve issue node id");
+    const { stdout } = await execFileP2("gh", buildAddToProjectArgs(cfg.projectId, contentId), { timeout: GH_MUTATION_TIMEOUT_MS });
+    const projectItemId = parseAddedItemId(stdout);
+    if (projectItemId && priority) {
       try {
-        content = await resolveTextArg({ file: o.bodyFile }, { readFile: import_promises6.readFile, readStdin }, {
-          value: "inline content",
-          file: "--body-file",
-          noun: "plan"
-        });
+        await setBoardItemPriority(defaultGitHubClient(), cfg, projectItemId, priority);
       } catch (e) {
-        console.error(e.message);
-        process.exitCode = 1;
-        return;
+        const err = e;
+        process.stderr.write(`warning: issue #${issueNumber} board Priority not set: ${(err.stderr || err.message || String(e)).trim()}
+`);
       }
     }
-    return withPlan(false, async (d) => {
-      const ok = await planPush(d, slug, { project: o.project, force: o.force, wait: o.wait, content });
-      if (!ok) process.exitCode = 1;
-    });
-  });
-  cmd.command("pull <slug>").description("pull a North Star plan from the server into plans/<slug>.md").option("--project <name>", "override the project key").option("--force", "overwrite local even if it has unpushed edits").action((slug, o) => withPlan(false, async (d) => {
-    const ok = await planPull(d, slug, o);
-    if (!ok) process.exitCode = 1;
-  }));
-  cmd.command("show <slug>").alias("get").description("print a North Star plan to stdout, read-only (no local copy written \u2014 mirrors `kb get`)").option("--project <name>", "override the project key").action((slug, o) => withPlan(false, async (d) => {
-    const ok = await planShow(d, slug, o);
-    if (!ok) process.exitCode = 1;
-  }));
-  cmd.command("list").description("list your North Star plans (cross-device)").option("--project <name>", "filter by project").option("--json", "machine-readable output").option("--quiet", "silent when unconfigured/empty/unreachable (SessionStart hook)").option("--fresh", "bypass the local cache and read from the server").action((o) => withPlan(o.quiet ?? false, (d) => planList(d, o)));
-  cmd.command("relevant").description("list North Stars relevant to your current task (branch + claimed issue + changed files)").option("--project <name>", "override the project key").option("--all", "include superseded/graduated and recent non-matching plans").option("--limit <n>", "max results (default 5)").option("--fresh", "bypass the local cache and read from the server").option("--json", "machine-readable output").action((o) => withPlan(false, async (d) => {
-    const signals = await gatherRelevanceSignals();
-    await relevantPlans(d, signals, { project: o.project, includeAll: o.all, limit: o.limit ? Number(o.limit) : void 0, fresh: o.fresh, json: o.json });
-  }));
-  cmd.command("sync").description("drain queued background pushes and refresh the local plan index").option("--quiet", "silent (background worker)").option("--wait", "durable confirmation: drain, then report unresolved pushes and exit non-zero if any remain").action((o) => withPlan(o.quiet ?? false, async (d) => {
-    const unresolved = await planSync(d, o);
-    if (!o.wait) return;
-    if (unresolved.length) {
-      for (const e of unresolved) d.err(`${e.slug}: ${e.conflict ?? e.deadLettered ?? "still pending"}`);
-      process.exitCode = 1;
-    } else if (!o.quiet) {
-      d.log("north star: all queued pushes landed");
-    }
-  }));
-  cmd.command("status").description("show pending/conflicted background pushes and the plan-cache age").option("--json", "machine-readable output").action((o) => withPlan(false, (d) => planStatus(d, o)));
-  cmd.command("reconcile").description("refresh stale local etags from the server without --force (recovers from an object-store re-stamp)").action(() => withPlan(false, (d) => planReconcile(d)));
-  cmd.command("open <slug>").description("pull if needed, then open plans/<slug>.md in $EDITOR").option("--project <name>", "override the project key").action(
-    (slug, o) => withPlan(false, async (d) => {
-      const ok = await planPull(d, slug, { project: o.project });
-      if (!ok) {
-        process.exitCode = 1;
-        return;
-      }
-      openInEditor(planPath(slug));
-    })
-  );
-  cmd.command("delete <slug>").description("delete a North Star plan from the server and the local copy").option("--project <name>", "override the project key").action((slug, o) => withPlan(false, (d) => planDelete(d, slug, o)));
-  cmd.command("graduate <slug>").description("mark a built-and-merged North Star plan as org-visible and push it").requiredOption("--merged-pr <url|number>", "merged PR URL or number proving the plan shipped").option("--org-visible", "confirm this plan is safe to queue for org KB curation").option("--project <name>", "override the project key").option("--force", "overwrite the remote even if it changed since your last sync").action(
-    (slug, o) => withPlan(false, (d) => planGraduate(d, slug, o))
-  );
-}
-var northstar = program2.command("northstar").description("North Star \u2014 your cross-device plans/SSOTs (S3-backed, git-clean)");
-registerNorthStarCommands(northstar);
-var plan = program2.command("plan").description("Alias for `northstar` (kept for compatibility)");
-registerNorthStarCommands(plan);
-async function readSecretStdin() {
-  if (process.stdin.isTTY) {
-    process.stderr.write(
-      'secrets set: pipe the value on stdin (it is never an argument) \u2014 e.g.\n  printf %s "$VALUE" | mmi-cli secrets set <KEY>\n'
-    );
-    return "";
+    return projectItemId;
+  } catch (e) {
+    const err = e;
+    process.stderr.write(`warning: issue #${issueNumber} created but NOT added to the project board: ${(err.stderr || err.message || String(e)).trim()}
+`);
+    return void 0;
   }
-  const chunks = [];
-  for await (const chunk of process.stdin) chunks.push(chunk);
-  return Buffer.concat(chunks).toString("utf8").replace(/\r?\n$/, "");
-}
-function makeSecretsDeps(cfg) {
-  return {
-    apiUrl: cfg.sagaApiUrl,
-    fetch: (url, init = {}) => fetch(url, { ...init, signal: init.signal ?? AbortSignal.timeout(1e4) }),
-    headers: (extra) => hubHeaders(extra),
-    // Vault paths are lowercase kebab (AGENTS.md naming); sagaKey carries the repo name's original
-    // casing, which leaked mixed-case into `secrets where` output (#681).
-    slug: async () => (await sagaKey(cfg)).project.toLowerCase(),
-    readSecretValue: () => readSecretStdin(),
-    log: (m) => console.log(m),
-    err: (m) => console.error(m)
-  };
 }
-async function withSecrets(run) {
-  const cfg = await loadConfig();
-  if (!cfg.sagaApiUrl) {
-    fail("secrets: Hub API URL not configured");
-    return;
+var ghRunner = async (args, timeoutMs) => (await execFileP2("gh", args, { timeout: timeoutMs })).stdout;
+function scheduleRelatedDiscovery(o) {
+  try {
+    const args = ["issue", "discover-related", "--number", String(o.number), "--title", o.title, "--body", o.body];
+    if (o.repo) args.push("--repo", o.repo);
+    (0, import_node_child_process12.spawn)(process.execPath, [process.argv[1], ...args], {
+      detached: true,
+      stdio: "ignore",
+      windowsHide: true,
+      cwd: process.cwd()
+    }).unref();
+  } catch {
   }
-  await run(makeSecretsDeps(cfg));
 }
-var secrets = program2.command("secrets").description("two-tier project secrets \u2014 self-serve your repo dev/* tier; org tier is master-gated");
-secrets.command("where").description("print where this repo\u2019s secrets live \u2014 the two-tier vault layout + well-known keys (no values)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").action((o) => withSecrets((d) => secretsWhere(d, o)));
-secrets.command("list").description("list secret NAMES + tier for this repo (never values)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").action((o) => withSecrets((d) => secretsList(d, o)));
-secrets.command("preflight").description("check required stage secret names for a deploy/train without reading values").requiredOption("--stage <dev|rc|main>", "stage to check").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--required <KEY...>", "required keys; bare keys are scoped under --stage").action(async (o) => {
-  if (!["dev", "rc", "main"].includes(o.stage)) {
-    return fail("secrets preflight: --stage must be dev, rc, or main");
-  }
-  const cfg = await loadConfig();
-  if (!cfg.sagaApiUrl) {
-    fail("secrets: Hub API URL not configured");
-    return;
-  }
-  const d = makeSecretsDeps(cfg);
-  const repo = o.repo ?? `mutmutco/${await d.slug()}`;
-  const meta = await fetchProjectBySlug(slugOf(repo), registryClientDeps(cfg));
-  const required = o.required?.length ? o.required : requiredRuntimeSecretNames(o.stage, meta?.requiredRuntimeSecrets, {
-    includeGoogleOAuth: projectRequiresGoogleOAuth(meta, meta?.deployModel)
-  });
-  const centralContainer = meta?.deployModel === "tenant-container" || meta?.deployModel === "solo-container";
-  if (!o.required?.length && centralContainer && meta && !hasRuntimeSecretContract(meta.requiredRuntimeSecrets)) {
-    d.err("secrets preflight: requiredRuntimeSecrets is unset for this deployable tenant \u2014 declare the per-stage contract in registry META (or an explicit empty map) before promoting");
-    process.exitCode = 1;
-    return;
-  }
-  const ok = await secretsPreflight(d, { repo: o.repo, stage: o.stage, required });
-  if (!ok) process.exitCode = 1;
+var northstar = program2.command("northstar").description("North Star \u2014 your cross-device plans/SSOTs (S3-backed, git-clean)");
+registerNorthStarCommands(northstar);
+var plan = program2.command("plan").description("Alias for `northstar` (deprecated \u2014 use `northstar`)");
+plan.hook("preAction", () => {
+  process.stderr.write("warning: `plan` is deprecated; use `northstar` instead\n");
 });
-secrets.command("get <key>").description("print one secret value over TLS (prints once, raw \u2014 do not log/paste it)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").action((key, o) => withSecrets(async (d) => {
-  const ok = await secretsGet(d, key, o);
-  if (!ok) process.exitCode = 1;
-}));
-secrets.command("request <key>").description("approved escalation: create a Hub issue + admin DM for a missing secret (no value)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--priority <priority>", "urgent | high | medium | low (default: medium)").option("--reason <text>", "why the secret is needed; safe metadata only").option("--context <text>", "lookup command/context; safe metadata only").option("--json", "machine-readable output").action((key, o) => withSecrets(async (d) => {
-  const ok = await secretsRequest(d, key, o);
-  if (!ok) process.exitCode = 1;
-}));
-secrets.command("verify <key>").description("validate a known provider secret without printing its value").option("--repo <owner/repo>", "target repo (defaults to the current repo)").action((key, o) => withSecrets(async (d) => {
-  const ok = await secretsVerify(d, key, o);
-  if (!ok) process.exitCode = 1;
-}));
-secrets.command("set <key>").description("write/rotate a secret; value is read from stdin (never an argument)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").action((key, o) => withSecrets(async (d) => {
-  const ok = await secretsSet(d, key, o);
-  if (!ok) process.exitCode = 1;
-}));
-secrets.command("edit <key>").description("alias for set \u2014 replace a secret value (read from stdin)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").action((key, o) => withSecrets(async (d) => {
-  const ok = await secretsEdit(d, key, o);
-  if (!ok) process.exitCode = 1;
-}));
-secrets.command("copy").description("copy provider keys between vault tiers (audit-logged; org-tier source is master-gated)").requiredOption("--from <stage>", "source tier: dev, rc, or main").requiredOption("--to <stage>", "destination tier: dev, rc, or main").requiredOption("--keys <names>", "comma-separated secret names (encryption keys blocked)").option("--dry-run", "report copies without writing").option("--repo <owner/repo>", "target repo (defaults to the current repo)").action((o) => withSecrets(async (d) => {
-  const stages = ["dev", "rc", "main"];
-  if (!stages.includes(o.from) || !stages.includes(o.to)) {
-    return fail("secrets copy: --from and --to must be dev, rc, or main");
-  }
-  const ok = await secretsCopy(d, {
-    repo: o.repo,
-    from: o.from,
-    to: o.to,
-    keys: o.keys.split(","),
-    dryRun: o.dryRun
-  });
-  if (!ok) process.exitCode = 1;
-}));
-secrets.command("rm <key>").description("remove a secret (project tier self-serve; org tier needs a grant)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").action((key, o) => withSecrets((d) => secretsRemove(d, key, o)));
-secrets.command("use <key>").description("print guidance on consuming a secret without committing it (no value)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").action((key, o) => withSecrets((d) => secretsUse(d, key, o)));
-secrets.command("grant <repo> <login> <key>").description("MASTER-ONLY: grant a project-admin standing access to a specific org-tier secret").action((repo, login, key) => withSecrets((d) => secretsGrant(d, repo, login, key, {})));
-secrets.command("revoke <repo> <login> <key>").description("MASTER-ONLY: withdraw a previously granted org-tier secret access").action((repo, login, key) => withSecrets((d) => secretsRevoke(d, repo, login, key, {})));
+registerNorthStarCommands(plan);
+registerSecretsCommands(program2);
 function registryClientDeps(cfg) {
   return { baseUrl: cfg.sagaApiUrl, token: () => hubAuthToken({ baseUrl: cfg.sagaApiUrl, githubToken }) };
 }
@@ -16691,23 +17563,23 @@ async function reportWrite(label, res) {
   return failGraceful(`${label}: HTTP ${res.status}${detail ? ` \u2014 ${detail}` : ""}`);
 }
 var tenant = program2.command("tenant").description("tenant runtime control through Hub authority");
-tenant.command("control <owner/repo> <stage> <action>").description("run bounded service control (status/start/stop/restart, plus rc-only retire and read-only verify-secrets) for a tenant; project-admin dev/rc, master main").option("--json", "machine-readable output").action(async (repo, stage2, action, o) => {
-  const cfg = await loadConfig();
-  const wait = tenantControlWait(action);
-  const res = await tenantControl({ repo, stage: stage2, action, wait }, registryClientDeps(cfg));
-  const body = res.body;
-  if (!res.ok && body?.category) {
-    console.log(JSON.stringify(body));
-    return failGraceful(`tenant control ${stage2} ${action}: ${body.category}`);
-  }
-  if (res.ok && action === "verify-secrets") {
-    const { lines, failure } = renderVerifySecrets(res.body);
-    if (o.json) console.log(JSON.stringify(res.body));
-    else lines.forEach((l) => console.log(l));
-    if (failure) return failGraceful(`tenant control ${stage2} verify-secrets: ${failure}`);
-    return;
+tenant.command("control <owner/repo> <stage> <action>").description("run bounded service control (status/start/stop/restart, rc-only retire, read-only verify-secrets) for a tenant via the central tenant-control.yml workflow; project-admin dev/rc, master main").option("--watch", "block on the dispatched run and report its conclusion (status/retire/verify-secrets watch by default)").option("--json", "machine-readable output").action(async (repo, stage2, action, o) => {
+  try {
+    const result = await runTenantControl(trainApplyDeps(), { repo, stage: stage2, action, watch: o.watch });
+    if (!o.json && action === "verify-secrets" && result.secrets) {
+      const body = { ok: result.conclusion === "success", secrets: result.secrets, ssmStatus: result.conclusion === "success" ? "Success" : "Failed" };
+      const { lines, failure } = renderVerifySecrets(body);
+      for (const line of lines) printLine(line);
+      if (failure) return failGraceful(`tenant control ${stage2} verify-secrets: ${failure}`);
+    } else {
+      printLine(o.json ? JSON.stringify(result, null, 2) : renderTenantControl(result));
+    }
+    if (result.conclusion === "failure") {
+      return failGraceful(`tenant control ${stage2} ${action}: ${result.category ?? "failed"} \u2014 ${result.note}`);
+    }
+  } catch (e) {
+    return failGraceful(`tenant control: ${e.message}`);
   }
-  return reportWrite("tenant control", res);
 });
 tenant.command("redeploy <owner/repo> <stage>").description("re-dispatch the central tenant-deploy.yml for an already-promoted ref (no re-tag/merge); train-authority gated").option("--ref <ref>", "ref to deploy (defaults to the stage branch rc/main \u2014 the promoted ref)").option("--watch", "block on the dispatched run and report its outcome (gh run watch --exit-status)").option("--json", "machine-readable output").action(async (repo, stage2, o) => {
   if (stage2 !== "rc" && stage2 !== "main") return fail("tenant redeploy: <stage> must be rc or main");
@@ -16724,18 +17596,18 @@ tenant.command("sweep-rc").description("discover (and optionally retire) running
   }
   const cfg = await loadConfig();
   const cdeps = registryClientDeps(cfg);
+  const tdeps = trainApplyDeps();
   try {
     const result = await sweepRcOrphans({
       listProjects: () => fetchProjectsList(cdeps),
       status: async (repo) => {
-        const res = await tenantControl({ repo, stage: "rc", action: "status", wait: true }, cdeps);
-        const b = res.body;
-        return { serviceState: b?.serviceState ?? "unknown" };
+        const r = await runTenantControl(tdeps, { repo, stage: "rc", action: "status", watch: true });
+        const serviceState = r.conclusion === "success" ? r.serviceState ?? "unknown" : "error";
+        return { serviceState };
       },
       retire: async (repo) => {
-        const res = await tenantControl({ repo, stage: "rc", action: "retire", wait: true }, cdeps);
-        const b = res.body;
-        return { ok: res.ok, category: b?.category, reason: b?.reason };
+        const r = await runTenantControl(tdeps, { repo, stage: "rc", action: "retire", watch: true });
+        return { ok: r.category === "retired", category: r.category };
       }
     }, { retire: !!o.retire });
     return printLine(o.json ? JSON.stringify(result) : renderSweep(result));
@@ -16922,7 +17794,7 @@ project.command("attest [owner/repo]").description("attest this repo's app-owned
   const res = await attestAppGaps(slugOf(target), repo, registryClientDeps(cfg));
   return reportWrite("project attest", res);
 });
-project.command("set [owner/repo]").description("MASTER-ONLY: upsert a project META (idempotent merge; defaults to the current repo; no clobber of unspecified fields)").option("--class <class>", "deployable | content").option("--project-type <type>", `${PROJECT_TYPES.join(" | ")} (v2 capability shape)`).option("--deploy-model <model>", `${DEPLOY_MODELS.join(" | ")} (release/deploy path; none means no Hub deploy registration)`).option("--release-track <track>", `${RELEASE_TRACKS.join(" | ")} (branch topology; direct skips rc)`).option("--var <KEY=VALUE...>", settableVarHelp()).option("--unset <KEY...>", "META field to remove (repeatable): oauth, requiredRuntimeSecrets, edgeDomains, requiredGcpApis, publishRequired").option("--clear-web-profile", "remove web-only registry fields (oauth, edgeDomains) for non-web/content projects").option("--json", "machine-readable output").action(async (repoOrSlug, o) => {
+project.command("set [owner/repo]").description("upsert project META (idempotent merge; master for most fields; project-admin may set/unset dashboard only)").option("--class <class>", "deployable | content").option("--project-type <type>", `${PROJECT_TYPES.join(" | ")} (v2 capability shape)`).option("--deploy-model <model>", `${DEPLOY_MODELS.join(" | ")} (release/deploy path; none means no Hub deploy registration)`).option("--release-track <track>", `${RELEASE_TRACKS.join(" | ")} (branch topology; direct skips rc)`).option("--var <KEY=VALUE...>", settableVarHelp()).option("--unset <KEY...>", "META field to remove (repeatable): oauth, requiredRuntimeSecrets, edgeDomains, requiredGcpApis, publishRequired, dashboard").option("--clear-web-profile", "remove web-only registry fields (oauth, edgeDomains) for non-web/content projects").option("--json", "machine-readable output").action(async (repoOrSlug, o) => {
   const cfg = await loadConfig();
   let target;
   try {
@@ -16931,6 +17803,7 @@ project.command("set [owner/repo]").description("MASTER-ONLY: upsert a project M
     return fail(e.message);
   }
   const slug = slugOf(target);
+  const repo = target.includes("/") ? target : `mutmutco/${slug}`;
   let patch;
   try {
     patch = buildProjectSetPatch({
@@ -16948,7 +17821,7 @@ project.command("set [owner/repo]").description("MASTER-ONLY: upsert a project M
   const existing = await fetchProjectBySlug(slug, registryClientDeps(cfg));
   const boardError = boardLinkWriteError(patch, existing);
   if (boardError) return fail(`project set: ${boardError}`);
-  const res = await upsertProject(slug, patch, registryClientDeps(cfg));
+  const res = await upsertProject(slug, { ...patch, repo }, registryClientDeps(cfg));
   return reportWrite("project set", res);
 });
 var registry = program2.command("registry").description("the DDB org registry \u2014 org-level constants");
@@ -17053,8 +17926,8 @@ issue.command("create").description("create an issue (type \u2192 label) and pri
   let body;
   let title;
   try {
-    title = await resolveIssueTitle({ title: o.title, titleFile: o.titleFile }, { readFile: import_promises6.readFile, readStdin });
-    body = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises6.readFile, readStdin });
+    title = await resolveIssueTitle({ title: o.title, titleFile: o.titleFile }, { readFile: import_promises7.readFile, readStdin });
+    body = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises7.readFile, readStdin });
     if (o.priority === void 0) throw new Error("missing --priority <priority> \u2014 expected one of: urgent, high, medium, low");
     priority = normalizePriority(o.priority);
     args = buildIssueArgs({ type: o.type, title, body, priority, repo: o.repo, labels: o.label });
@@ -17141,8 +18014,8 @@ program2.command("report").description("file a friction report on the Hub board
   const targetRepo2 = o.repo ?? HUB_REPO2;
   const sourceRepo = await resolveRepo(void 0);
   try {
-    title = await resolveIssueTitle({ title: o.title, titleFile: o.titleFile }, { readFile: import_promises6.readFile, readStdin });
-    body = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises6.readFile, readStdin });
+    title = await resolveIssueTitle({ title: o.title, titleFile: o.titleFile }, { readFile: import_promises7.readFile, readStdin });
+    body = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises7.readFile, readStdin });
     priority = normalizePriority(o.priority);
     args = buildIssueArgs({
       type: o.type,
@@ -17208,8 +18081,8 @@ verify.command("panel").description("plan a fresh-eyes lens panel \u2014 print j
   try {
     const routing = assertVerifyRouting(o.routing);
     const lenses = o.lenses.split(",").map((s) => assertGrindLens(s.trim()));
-    const criteria = await (0, import_promises6.readFile)(o.criteriaFile, "utf8");
-    const diff = await (0, import_promises6.readFile)(o.diffFile, "utf8");
+    const criteria = await (0, import_promises7.readFile)(o.criteriaFile, "utf8");
+    const diff = await (0, import_promises7.readFile)(o.diffFile, "utf8");
     const plan2 = buildPanelPlan({ routing, lenses, criteria, diff });
     console.log(JSON.stringify(plan2));
   } catch (e) {
@@ -17218,7 +18091,7 @@ verify.command("panel").description("plan a fresh-eyes lens panel \u2014 print j
 });
 verify.command("synthesize").description("merge lens JSON array into a PanelReport").option("--input-file <path|->", "JSON lens array (use - for stdin)", "-").action(async (o) => {
   try {
-    const raw = o.inputFile === "-" ? await readStdin() : await (0, import_promises6.readFile)(o.inputFile, "utf8");
+    const raw = o.inputFile === "-" ? await readStdin() : await (0, import_promises7.readFile)(o.inputFile, "utf8");
     const lenses = parseLensResults(JSON.parse(raw));
     console.log(JSON.stringify(synthesizePanelReport(lenses)));
   } catch (e) {
@@ -17291,7 +18164,7 @@ build.command("frontier").description("Evaluate external frontier exhaustion + L
     iterationCapOverride: opts.iterationCap
   };
   if (opts.jsonFile) {
-    const raw = await (0, import_promises6.readFile)(opts.jsonFile, "utf8");
+    const raw = await (0, import_promises7.readFile)(opts.jsonFile, "utf8");
     state = { ...state, ...JSON.parse(raw) };
   }
   const result = evaluateBuildFrontier(state);
@@ -17345,8 +18218,8 @@ program2.command("skill-lesson").description("file a skill-lesson on the Hub boa
   let args;
   try {
     skill = assertSkillName(o.skill);
-    rawBody = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises6.readFile, readStdin });
-    const rawTitle = await resolveIssueTitle({ title: o.title, titleFile: o.titleFile }, { readFile: import_promises6.readFile, readStdin });
+    rawBody = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises7.readFile, readStdin });
+    const rawTitle = await resolveIssueTitle({ title: o.title, titleFile: o.titleFile }, { readFile: import_promises7.readFile, readStdin });
     title = buildSkillLessonTitle(skill, rawTitle);
     priority = normalizePriority(o.priority);
     body = buildSkillLessonBody(rawBody, sourceRepo, pluginSha);
@@ -17397,8 +18270,8 @@ pr.command("create").description("create a PR and print {number,url} JSON").opti
   let body;
   let title;
   try {
-    title = await resolveIssueTitle({ title: o.title, titleFile: o.titleFile }, { readFile: import_promises6.readFile, readStdin });
-    body = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises6.readFile, readStdin });
+    title = await resolveIssueTitle({ title: o.title, titleFile: o.titleFile }, { readFile: import_promises7.readFile, readStdin });
+    body = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises7.readFile, readStdin });
   } catch (e) {
     return fail(`pr create: ${e.message}`);
   }
@@ -17406,9 +18279,9 @@ pr.command("create").description("create a PR and print {number,url} JSON").opti
   console.log(JSON.stringify(created));
 });
 async function listCiWorkflowPaths(cwd = process.cwd()) {
-  const wfDir = (0, import_node_path17.join)(cwd, ".github", "workflows");
-  if (!(0, import_node_fs19.existsSync)(wfDir)) return [];
-  return (0, import_node_fs19.readdirSync)(wfDir).filter((name) => /\.(ya?ml)$/i.test(name)).map((name) => `.github/workflows/${name}`);
+  const wfDir = (0, import_node_path19.join)(cwd, ".github", "workflows");
+  if (!(0, import_node_fs22.existsSync)(wfDir)) return [];
+  return (0, import_node_fs22.readdirSync)(wfDir).filter((name) => /\.(ya?ml)$/i.test(name)).map((name) => `.github/workflows/${name}`);
 }
 async function resolveMergeCiPolicyForCheckout(repoOpt) {
   const repo = repoOpt ?? await resolveRepo();
@@ -17427,7 +18300,7 @@ function ciAuditDeps() {
     // Continuous CI delivery (#1550): the gate re-seed renders from the Hub's on-disk seed templates. The
     // reconcile runs IN the Hub checkout, so this is local-file I/O (no network fetch). Path is relative to
     // the repo root (e.g. skills/bootstrap/seeds/gate.template.yml).
-    readSeedFile: (path2) => (0, import_node_fs19.existsSync)(path2) ? (0, import_node_fs19.readFileSync)(path2, "utf8") : null
+    readSeedFile: (path2) => (0, import_node_fs22.existsSync)(path2) ? (0, import_node_fs22.readFileSync)(path2, "utf8") : null
   };
 }
 pr.command("ci-policy").description("report merge CI policy: wait-for-checks vs no-ci (for grind/build agents)").option("--json", "machine-readable output").option("--repo <owner/repo>", "target repo (defaults to the current checkout)").action(async (o) => {
@@ -17467,12 +18340,13 @@ pr.command("land <number>").description("agent merge path (#1440): train probe \
   const repoArgs = o.repo ? ["--repo", o.repo] : [];
   const result = await runPrLand(number, { repo: o.repo, requireTrain: o.requireTrain !== false }, {
     resolveRepo: async (prNumber, repoOpt) => {
-      if (repoOpt) return repoOpt;
-      const viewed = (await execFileP2("gh", ["pr", "view", prNumber, ...repoArgs, "--json", "headRepository,baseRefName", "--jq", '.headRepository.nameWithOwner + " " + .baseRefName'], { timeout: GC_GH_TIMEOUT_MS })).stdout.trim();
-      const [repo, base2] = viewed.split(/\s+/);
+      const args = repoOpt ? ["--repo", repoOpt] : repoArgs;
+      const viewed = (await execFileP2("gh", ["pr", "view", prNumber, ...args, "--json", "headRepository,baseRefName", "--jq", '.headRepository.nameWithOwner + " " + .baseRefName'], { timeout: GC_GH_TIMEOUT_MS })).stdout.trim();
+      const [repoFromGh, base2] = viewed.split(/\s+/);
       if (base2 && base2 !== "development") {
         throw new Error(`pr land: base branch must be development (got ${base2}) \u2014 promotion merges stay human-only`);
       }
+      const repo = repoOpt ?? repoFromGh;
       if (!repo) throw new Error("pr land: could not resolve PR repo");
       return repo;
     },
@@ -17497,32 +18371,50 @@ pr.command("land <number>").description("agent merge path (#1440): train probe \
         }
         return { mergeStatus: "failed", error: `merge blocked: ${message.split("\n")[0]} \u2014 ensure checks are green` };
       }
-      const state = (await execFileP2("gh", ["pr", "view", prNumber, ...args, "--json", "state", "--jq", ".state"], { timeout: GC_GH_TIMEOUT_MS }).catch(() => ({ stdout: "" }))).stdout.trim();
-      return { mergeStatus: state === "MERGED" ? "merged" : "auto-merge-enqueued" };
+      const stateRead = await readGhPrStateWithRetry(async () => (await execFileP2("gh", ["pr", "view", prNumber, ...args, "--json", "state", "--jq", ".state"], { timeout: GC_GH_TIMEOUT_MS })).stdout);
+      if (!stateRead.ok) {
+        return { mergeStatus: "failed", error: `could not read PR state after merge: ${stateRead.error}` };
+      }
+      return { mergeStatus: stateRead.state === "MERGED" ? "merged" : "auto-merge-enqueued" };
     },
     pollMerged: async (prNumber, repo, deadlineMs) => {
       const args = repo ? ["--repo", repo] : [];
       while (Date.now() < deadlineMs) {
-        const state = (await execFileP2("gh", ["pr", "view", prNumber, ...args, "--json", "state", "--jq", ".state"], { timeout: GC_GH_TIMEOUT_MS }).catch(() => ({ stdout: "" }))).stdout.trim();
-        if (state === "MERGED") return true;
+        const stateRead = await readGhPrStateWithRetry(async () => (await execFileP2("gh", ["pr", "view", prNumber, ...args, "--json", "state", "--jq", ".state"], { timeout: GC_GH_TIMEOUT_MS })).stdout, { retries: 2, delayMs: 1e3 });
+        if (stateRead.ok && stateRead.state === "MERGED") return true;
         await new Promise((resolve) => setTimeout(resolve, PR_LAND_POLL_MS));
       }
       return false;
     }
   });
+  if (result.status !== "failed") {
+    try {
+      const { stdout } = await execFileP2(process.execPath, [
+        process.argv[1],
+        "pr",
+        "merge",
+        number,
+        ...o.repo ? ["--repo", o.repo] : [],
+        "--squash"
+      ], { timeout: GH_MUTATION_TIMEOUT_MS });
+      const trimmed = stdout.trim();
+      if (trimmed) {
+        try {
+          result.cleanup = JSON.parse(trimmed);
+        } catch {
+          result.cleanupError = "cleanup output was not JSON";
+        }
+      }
+    } catch (e) {
+      result.cleanupError = String(e.message || "pr merge cleanup failed");
+    }
+  }
   if (o.json) printLine(JSON.stringify(result));
-  else printLine(`pr land: ${result.status}${result.error ? ` \u2014 ${result.error}` : ""}`);
-  if (result.status === "failed") process.exitCode = 1;
   else {
-    await execFileP2(process.execPath, [
-      process.argv[1],
-      "pr",
-      "merge",
-      number,
-      ...o.repo ? ["--repo", o.repo] : [],
-      "--squash"
-    ], { timeout: GH_MUTATION_TIMEOUT_MS }).catch(() => void 0);
+    printLine(`pr land: ${result.status}${result.error ? ` \u2014 ${result.error}` : ""}`);
+    if (result.cleanupError) printLine(`pr land cleanup: ${result.cleanupError}`);
   }
+  if (result.status === "failed" || result.cleanupError) process.exitCode = 1;
 });
 async function remoteBranchExists2(branch, options = {}) {
   return checkRemoteBranchExists(branch, {
@@ -17537,15 +18429,15 @@ async function createDeferredWorktreeStore() {
     return {
       read: async () => {
         try {
-          return parseDeferredWorktreesFile(await (0, import_promises6.readFile)(registryPath, "utf8"));
+          return parseDeferredWorktreesFile(await (0, import_promises7.readFile)(registryPath, "utf8"));
         } catch {
           return [];
         }
       },
       write: async (entries) => {
         try {
-          await (0, import_promises6.mkdir)((0, import_node_path17.dirname)(registryPath), { recursive: true });
-          await (0, import_promises6.writeFile)(registryPath, serializeDeferredWorktrees(entries), "utf8");
+          await (0, import_promises7.mkdir)((0, import_node_path19.dirname)(registryPath), { recursive: true });
+          await (0, import_promises7.writeFile)(registryPath, serializeDeferredWorktrees(entries), "utf8");
         } catch {
         }
       }
@@ -17558,13 +18450,13 @@ var realWorktreeDirRemover = {
   probe: (p) => {
     let st;
     try {
-      st = (0, import_node_fs19.lstatSync)(p);
+      st = (0, import_node_fs22.lstatSync)(p);
     } catch {
       return null;
     }
     if (st.isSymbolicLink()) return "link";
     try {
-      (0, import_node_fs19.readlinkSync)(p);
+      (0, import_node_fs22.readlinkSync)(p);
       return "link";
     } catch {
     }
@@ -17572,7 +18464,7 @@ var realWorktreeDirRemover = {
   },
   readdir: (p) => {
     try {
-      return (0, import_node_fs19.readdirSync)(p);
+      return (0, import_node_fs22.readdirSync)(p);
     } catch {
       return [];
     }
@@ -17581,12 +18473,12 @@ var realWorktreeDirRemover = {
   // leaving the target); a file symlink with unlink. rmdir first, fall back to unlink.
   detachLink: (p) => {
     try {
-      (0, import_node_fs19.rmdirSync)(p);
+      (0, import_node_fs22.rmdirSync)(p);
     } catch {
-      (0, import_node_fs19.unlinkSync)(p);
+      (0, import_node_fs22.unlinkSync)(p);
     }
   },
-  removeTree: (p) => (0, import_promises6.rm)(p, { recursive: true, force: true, maxRetries: 5, retryDelay: 200 })
+  removeTree: (p) => (0, import_promises7.rm)(p, { recursive: true, force: true, maxRetries: 5, retryDelay: 200 })
 };
 async function resolvePrimaryCheckout(execGit) {
   try {
@@ -17604,7 +18496,7 @@ function worktreeRemoveDeps(execGit) {
 }
 function teardownWorktreeStage(worktreePath) {
   return runWorktreeStageTeardown(worktreePath, {
-    hasStageState: (wt) => (0, import_node_fs19.existsSync)(stageStatePath(wt)),
+    hasStageState: (wt) => (0, import_node_fs22.existsSync)(stageStatePath(wt)),
     stopRecordedStage: async (wt) => (await stopStage({ cwd: wt })).pid,
     listComposeProjects: async () => {
       const { stdout } = await execFileP2("docker", ["compose", "ls", "--all", "--format", "json"], { timeout: GC_GH_TIMEOUT_MS });
@@ -17618,7 +18510,7 @@ function teardownWorktreeStage(worktreePath) {
 pr.command("merge <number>").description("merge a PR (squash by default) and clean up its branch + worktree \u2014 no leftover local branch; on no-ci repos run pr ci-policy / checks-wait first (#1432)").option("--squash", "squash merge (default)").option("--merge", "create a merge commit").option("--rebase", "rebase merge").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--auto", "enable auto-merge \u2014 merge once the base-branch policy is satisfied (use for policy-gated repos)").action(async (number, o) => {
   const method = o.rebase ? "--rebase" : o.merge ? "--merge" : "--squash";
   const repoArgs = o.repo ? ["--repo", o.repo] : [];
-  const headRef = (await execFileP2("gh", ["pr", "view", number, ...repoArgs, "--json", "headRefName", "--jq", ".headRefName"], { timeout: GC_GH_TIMEOUT_MS })).stdout.trim();
+  const [headRef, baseRef] = (await execFileP2("gh", ["pr", "view", number, ...repoArgs, "--json", "headRefName,baseRefName", "--jq", '.headRefName + " " + .baseRefName'], { timeout: GC_GH_TIMEOUT_MS })).stdout.trim().split(/\s+/);
   const startingPath = (await execFileP2("git", ["rev-parse", "--show-toplevel"], { timeout: GIT_TIMEOUT_MS }).catch(() => ({ stdout: "" }))).stdout.trim();
   const beforeWorktrees = parseWorktreePorcelain(
     (await execFileP2("git", ["worktree", "list", "--porcelain"], { timeout: GIT_TIMEOUT_MS }).catch(() => ({ stdout: "" }))).stdout
@@ -17667,11 +18559,14 @@ pr.command("merge <number>").description("merge a PR (squash by default) and cle
     } : await cleanupPrMergeLocalBranch(headRef, {
       beforeWorktrees,
       startingPath,
-      pathExists: (p) => (0, import_node_fs19.existsSync)(p),
+      pathExists: (p) => (0, import_node_fs22.existsSync)(p),
       execGit: async (args) => (await execFileP2("git", args, { timeout: GIT_TIMEOUT_MS })).stdout,
       teardownWorktreeStage,
       deferredStore,
-      removeWorktreeDir: worktreeRemoveDeps(async (args) => (await execFileP2("git", args, { timeout: GIT_TIMEOUT_MS })).stdout).removeWorktreeDir
+      removeWorktreeDir: worktreeRemoveDeps(async (args) => (await execFileP2("git", args, { timeout: GIT_TIMEOUT_MS })).stdout).removeWorktreeDir,
+      // After merge, return the local checkout to the (fast-forwarded) branch the PR merged into so
+      // grind/build never leave the primary parked on a dead feature branch (#1606).
+      returnToBranch: baseRef
     });
   } catch (e) {
     localCleanup = {
@@ -17839,7 +18734,7 @@ function rawValues(flag) {
   return out;
 }
 function printLine(value) {
-  (0, import_node_fs19.writeSync)(1, `${value}
+  (0, import_node_fs22.writeSync)(1, `${value}
 `);
 }
 function stageKeepAlive() {
@@ -17856,8 +18751,8 @@ async function resolveStage() {
     local,
     shell: shellFor(),
     registry: { deployModel: project2?.deployModel, portRange, error: read.ok ? void 0 : read.error },
-    hasCompose: (0, import_node_fs19.existsSync)((0, import_node_path17.join)(process.cwd(), "docker-compose.yml")),
-    hasEnvExample: (0, import_node_fs19.existsSync)((0, import_node_path17.join)(process.cwd(), ".env.example"))
+    hasCompose: (0, import_node_fs22.existsSync)((0, import_node_path19.join)(process.cwd(), "docker-compose.yml")),
+    hasEnvExample: (0, import_node_fs22.existsSync)((0, import_node_path19.join)(process.cwd(), ".env.example"))
   });
 }
 async function fetchStageVaultEnvMerge() {
@@ -17909,9 +18804,9 @@ program2.command("port-range <repo>").description("assign (idempotently) + print
     printLine(o.json ? JSON.stringify({ repo, portRange: [start2, end2], source: "meta" }) : `${repo}: stage.portRange [${start2}, ${end2}]`);
     return;
   }
-  const path2 = (0, import_node_path17.join)(process.cwd(), "infra", "port-ranges.json");
+  const path2 = (0, import_node_path19.join)(process.cwd(), "infra", "port-ranges.json");
   const allocate = async (seed) => {
-    const { stdout } = await execFileP2("node", [(0, import_node_path17.join)(process.cwd(), "infra", "port-ddb.mjs"), String(seed)], { timeout: 15e3 });
+    const { stdout } = await execFileP2("node", [(0, import_node_path19.join)(process.cwd(), "infra", "port-ddb.mjs"), String(seed)], { timeout: 15e3 });
     const parsed = JSON.parse(stdout);
     if (!Array.isArray(parsed.range) || parsed.range.length !== 2) throw new Error("port-ddb: no range in output");
     return parsed.range;
@@ -18097,6 +18992,15 @@ function trainApplyDeps() {
         throw new Error(`tenant deploy dispatch failed: ${detail}`);
       }
     },
+    // Hub-App-authority dispatch of the central tenant-control.yml (#1717) — the Hub fires the
+    // workflow_dispatch with its App token. Never throws for an expected rejection: it returns the dispatch
+    // outcome so runTenantControl can map a 5xx (transport-failed, retryable) vs a 4xx (rejected) vs ok.
+    dispatchTenantControl: async ({ repo, stage: stage2, action }) => {
+      const res = await tenantControl({ repo, stage: stage2, action }, registryClientDeps(await loadConfig()));
+      if (res.ok) return { ok: true };
+      const body = res.body;
+      return { ok: false, category: body?.category, error: body?.error ?? res.error };
+    },
     // Hotfix-coverage guard (#958): runs against the local clone via real git. manifestPaths exempts the
     // release version fold (#976) — a main-only commit touching ONLY the root package manifest is the
     // fold's version metadata, which the candidate replaces with its own. (The Hub's wider distribution
@@ -18105,7 +19009,7 @@ function trainApplyDeps() {
     // Slack release announcement (#883): Hub-only + best-effort inside announceRelease itself.
     announce: (args) => announceRelease({
       run: async (file, cmdArgs) => (await execFileP2(file, cmdArgs, { timeout: GH_TRAIN_TIMEOUT_MS })).stdout,
-      readFile: (path2) => (0, import_promises6.readFile)(path2, "utf8")
+      readFile: (path2) => (0, import_promises7.readFile)(path2, "utf8")
     }, args),
     fetchEdgeDomains: async (slug) => {
       const proj = await fetchProjectBySlug(slug, registryClientDeps(await loadConfig()));
@@ -18215,7 +19119,8 @@ function renderHotfixStatus(r) {
     `  - branch: ${r.branchExists ? "pushed" : "absent"} \xB7 PR: ${r.pr ? `#${r.pr.number} ${r.pr.state}` : "none"} \xB7 tag: ${r.tagPushed ? "pushed" : "absent"} \xB7 Release: ${r.releaseExists ? "exists" : "absent"}`,
     ...r.runs.map((run) => `  - ${run.workflow}: ${run.conclusion}${run.url ? ` (${run.url})` : ""}`),
     `  - npm @mutmutco/cli: ${r.npmVersion}`,
-    `  - next: ${r.next}`
+    `  - next: ${r.next}`,
+    ...r.warnings.map((w) => `  - warning: ${w}`)
   ].join("\n");
 }
 async function runHotfixSub(sub, body, json, render) {
@@ -18273,12 +19178,12 @@ ${r.repo}: applied=[${r.applied.join("; ")}] skipped=[${r.skipped.join("; ")}]${
   }
   if (!audit.ok) process.exitCode = 1;
 });
-var bootstrap = program2.command("bootstrap").description("plan repo bootstrap operations; mutations require master-admin approval").option("--repo <owner/repo>", "target repo").option("--class <class>", "deployable | content", "deployable").option("--json", "machine-readable output").option("--apply", "reserved for future bootstrap execution after explicit master-admin approval").action((o) => {
+var bootstrap = program2.command("bootstrap").description("plan repo bootstrap operations; mutations require master-admin approval").option("--repo <owner/repo>", "target repo").option("--class <class>", "deployable | content", "deployable").option("--dashboard", "dashboard repo \u2014 also seeds components.json wired to the @mutmutco registry (#1452)").option("--json", "machine-readable output").option("--apply", "reserved for future bootstrap execution after explicit master-admin approval").action((o) => {
   if (!o.repo) return fail("bootstrap: required option --repo <owner/repo> not specified");
   if (o.apply) return fail("bootstrap: execution is not implemented yet; use the dry-run plan and the existing /bootstrap skill");
   if (o.class !== "deployable" && o.class !== "content") return fail("bootstrap: --class must be deployable or content");
-  const steps = bootstrapPlan(o.repo, o.class);
-  console.log(o.json ? JSON.stringify({ command: "bootstrap", repo: o.repo, class: o.class, steps }, null, 2) : renderSteps(`mmi-cli bootstrap: dry-run plan for ${o.repo}`, steps));
+  const steps = bootstrapPlan(o.repo, o.class, { dashboard: o.dashboard });
+  console.log(o.json ? JSON.stringify({ command: "bootstrap", repo: o.repo, class: o.class, dashboard: o.dashboard === true, steps }, null, 2) : renderSteps(`mmi-cli bootstrap: dry-run plan for ${o.repo}`, steps));
 });
 bootstrap.command("verify <repo>").description("audit whether an existing repo is bootstrapped correctly; no mutations").option("--class <class>", "deployable | content", "deployable").option("--json", "machine-readable output").action(async (repo) => {
   const o = { class: rawValue("--class", "deployable"), json: rawFlag("--json") };
@@ -18292,7 +19197,7 @@ bootstrap.command("verify <repo>").description("audit whether an existing repo i
     client: defaultGitHubClient(),
     projectMeta: meta,
     deployModel: typeof meta?.deployModel === "string" ? meta.deployModel : void 0,
-    readLocalFile: (path2) => path2 === "projects.json" && apiProjects != null ? apiProjects : (0, import_node_fs19.existsSync)(path2) ? (0, import_node_fs19.readFileSync)(path2, "utf8") : null,
+    readLocalFile: (path2) => path2 === "projects.json" && apiProjects != null ? apiProjects : (0, import_node_fs22.existsSync)(path2) ? (0, import_node_fs22.readFileSync)(path2, "utf8") : null,
     // requiredGcpApis is stored as an array by a JSON write, but `project set --var KEY=VALUE` stores a raw
     // comma-string — accept either so the seeded value verifies regardless of how it was written.
     requiredGcpApis: (() => {
@@ -18317,12 +19222,13 @@ bootstrap.command("verify <repo>").description("audit whether an existing repo i
   console.log(o.json ? JSON.stringify(report, null, 2) : renderBootstrapVerifyReport(report));
   if (!report.ok) process.exitCode = 1;
 });
-bootstrap.command("apply <repo>").description("idempotent seed apply from skills/bootstrap/seeds/manifest.json; dry-run unless --execute (live, master-gated)").option("--class <class>", "deployable | content", "deployable").option("--project-type <type>", `${PROJECT_TYPES.join(" | ")} (v2 capability shape)`).option("--deploy-model <model>", `${DEPLOY_MODELS.join(" | ")} (release/deploy path)`).option("--release-track <track>", `${RELEASE_TRACKS.join(" | ")} (branch topology; direct skips rc)`).option("--execute", "LIVE apply via gh (master-gated) \u2014 stamps seed files + labels into the repo").option("--var <KEY=VALUE...>", "placeholder values for repo-owned templates (repeatable)").option("--json", "machine-readable output").action(async (repo) => {
+bootstrap.command("apply <repo>").description("idempotent seed apply from skills/bootstrap/seeds/manifest.json; dry-run unless --execute (live, master-gated)").option("--class <class>", "deployable | content", "deployable").option("--project-type <type>", `${PROJECT_TYPES.join(" | ")} (v2 capability shape)`).option("--deploy-model <model>", `${DEPLOY_MODELS.join(" | ")} (release/deploy path)`).option("--release-track <track>", `${RELEASE_TRACKS.join(" | ")} (branch topology; direct skips rc)`).option("--dashboard", "dashboard repo \u2014 seeds components.json wired to the @mutmutco registry (#1452); changes no other axis").option("--execute", "LIVE apply via gh (master-gated) \u2014 stamps seed files + labels into the repo").option("--var <KEY=VALUE...>", "placeholder values for repo-owned templates (repeatable)").option("--json", "machine-readable output").action(async (repo) => {
   const o = {
     class: rawValue("--class", "deployable"),
     projectType: rawValue("--project-type", ""),
     deployModel: rawValue("--deploy-model", ""),
     releaseTrack: rawValue("--release-track", ""),
+    dashboard: rawFlag("--dashboard"),
     execute: rawFlag("--execute"),
     json: rawFlag("--json")
   };
@@ -18335,20 +19241,22 @@ bootstrap.command("apply <repo>").description("idempotent seed apply from skills
     return fail(`bootstrap apply: ${e.message}`);
   }
   const manifestPath = "skills/bootstrap/seeds/manifest.json";
-  if (!(0, import_node_fs19.existsSync)(manifestPath)) return fail(`bootstrap apply: ${manifestPath} not found; run from the MMI-Hub repo root`);
-  const manifest = loadBootstrapSeeds((0, import_node_fs19.readFileSync)(manifestPath, "utf8"));
+  if (!(0, import_node_fs22.existsSync)(manifestPath)) return fail(`bootstrap apply: ${manifestPath} not found; run from the MMI-Hub repo root`);
+  const manifest = loadBootstrapSeeds((0, import_node_fs22.readFileSync)(manifestPath, "utf8"));
   const baseBranch = o.class === "content" ? "main" : "development";
   const slug = parsedRepo.slug;
   const gh = async (args) => execFileP2("gh", args, { timeout: 2e4 });
-  const readFile6 = (p) => (0, import_node_fs19.existsSync)(p) ? (0, import_node_fs19.readFileSync)(p, "utf8") : null;
+  const readFile7 = (p) => (0, import_node_fs22.existsSync)(p) ? (0, import_node_fs22.readFileSync)(p, "utf8") : null;
   const enc2 = (p) => p.split("/").map(encodeURIComponent).join("/");
   const rawVars = {};
   for (const value of rawValues("--var")) {
     const eq = value.indexOf("=");
     if (eq > 0) rawVars[value.slice(0, eq)] = value.slice(eq + 1);
   }
+  let registryMetaDashboard = false;
   try {
     const meta = await fetchProjectBySlug(slug, registryClientDeps(await loadConfig()));
+    registryMetaDashboard = meta?.dashboard === true;
     for (const [k, v] of Object.entries(gateConfigToVars(meta?.gate))) if (rawVars[k] == null) rawVars[k] = v;
   } catch {
   }
@@ -18365,16 +19273,20 @@ bootstrap.command("apply <repo>").description("idempotent seed apply from skills
   const applied = [];
   let applyDeployModel;
   try {
-    applyDeployModel = buildRegisterPayload(repo, o.class, vars, {
+    const payload = buildRegisterPayload(repo, o.class, vars, {
       projectType: o.projectType || void 0,
       deployModel: o.deployModel || void 0,
-      releaseTrack: o.releaseTrack || void 0
-    }).deployModel;
+      releaseTrack: o.releaseTrack || void 0,
+      dashboard: o.dashboard
+    });
+    applyDeployModel = payload.deployModel;
   } catch {
   }
+  const applyDashboard = o.dashboard === true || !rawFlag("--dashboard") && registryMetaDashboard;
   for (const seed of manifest.seeds) {
     if (!seed.classes.includes(o.class)) continue;
     if (!seedMatchesDeployModel(seed, applyDeployModel)) continue;
+    if (!seedMatchesDashboard(seed, applyDashboard)) continue;
     const resolved = { ...seed, target: seed.target.replace("{{REPO_SLUG}}", slug) };
     let exists = false;
     let sha;
@@ -18397,7 +19309,7 @@ bootstrap.command("apply <repo>").description("idempotent seed apply from skills
     }
     const planned = planSeedAction(resolved, exists);
     const isBlock = resolved.source === "managed-block";
-    const content = planned.action === "create" || planned.action === "update" ? isBlock ? upsertManagedGitignoreBlock(remoteContent).content : resolveSeedContent(resolved, vars, readFile6) : null;
+    const content = planned.action === "create" || planned.action === "update" ? isBlock ? upsertManagedGitignoreBlock(remoteContent).content : resolveSeedContent(resolved, vars, readFile7) : null;
     const action = reconcileSeedAction(planned, content, isBlock);
     actions.push(action);
     if (o.execute && (action.action === "create" || action.action === "update")) {
@@ -18414,7 +19326,7 @@ bootstrap.command("apply <repo>").description("idempotent seed apply from skills
     }
     const rulesetSeed = manifest.seeds.find((s) => s.target === ".github/rulesets/mmi-product-required-checks.json");
     if (rulesetSeed) {
-      const rulesetContent = resolveSeedContent({ ...rulesetSeed, target: rulesetSeed.target.replace("{{REPO_SLUG}}", slug) }, vars, readFile6);
+      const rulesetContent = resolveSeedContent({ ...rulesetSeed, target: rulesetSeed.target.replace("{{REPO_SLUG}}", slug) }, vars, readFile7);
       if (rulesetContent) {
         try {
           const activation = await activateProductRuleset(repo, stripRulesetComment(rulesetContent), defaultGitHubClient());
@@ -18450,7 +19362,8 @@ bootstrap.command("apply <repo>").description("idempotent seed apply from skills
     registerPayload = buildRegisterPayload(repo, o.class, vars, {
       projectType: o.projectType || void 0,
       deployModel: o.deployModel || void 0,
-      releaseTrack: bootstrapReleaseTrack
+      releaseTrack: bootstrapReleaseTrack,
+      dashboard: o.dashboard
     });
   } catch (e) {
     return fail(`bootstrap apply: ${e.message}`);
@@ -18584,38 +19497,39 @@ access.command("audit").description("audit collaborator roles + train-branch pus
     if (o.class !== "deployable" && o.class !== "content") return failGraceful("access audit: --class must be deployable or content");
     targets = [{ repo: o.repo, class: o.class }];
   } else {
-    const projectsJson = registryProjects ? JSON.stringify({ projects: registryProjects }) : (0, import_node_fs19.existsSync)("projects.json") ? (0, import_node_fs19.readFileSync)("projects.json", "utf8") : null;
+    const projectsJson = registryProjects ? JSON.stringify({ projects: registryProjects }) : (0, import_node_fs22.existsSync)("projects.json") ? (0, import_node_fs22.readFileSync)("projects.json", "utf8") : null;
     if (!projectsJson) return failGraceful("access audit: no project registry \u2014 Hub API unreachable and projects.json not found; run from the MMI-Hub repo root or pass --repo <owner/repo>");
-    const fanoutJson = (0, import_node_fs19.existsSync)(".github/fanout-targets.json") ? (0, import_node_fs19.readFileSync)(".github/fanout-targets.json", "utf8") : null;
+    const fanoutJson = (0, import_node_fs22.existsSync)(".github/fanout-targets.json") ? (0, import_node_fs22.readFileSync)(".github/fanout-targets.json", "utf8") : null;
     targets = loadAccessTargets(projectsJson, fanoutJson);
   }
   const derivedMatrix = registryProjects ? accessMatrixFromProjects(registryProjects) : {};
-  const fileMatrix = (0, import_node_fs19.existsSync)("access-matrix.json") ? loadAccessMatrix((0, import_node_fs19.readFileSync)("access-matrix.json", "utf8")) : {};
+  const fileMatrix = (0, import_node_fs22.existsSync)("access-matrix.json") ? loadAccessMatrix((0, import_node_fs22.readFileSync)("access-matrix.json", "utf8")) : {};
   const matrix = mergeAccessMatrix(fileMatrix, derivedMatrix);
   const derivedContracts = registryProjects ? dataAccessContractsFromProjects(registryProjects) : { consumers: {} };
-  const fileContracts = (0, import_node_fs19.existsSync)("data-access-contracts.json") ? loadDataAccessContracts((0, import_node_fs19.readFileSync)("data-access-contracts.json", "utf8")) : { consumers: {} };
+  const fileContracts = (0, import_node_fs22.existsSync)("data-access-contracts.json") ? loadDataAccessContracts((0, import_node_fs22.readFileSync)("data-access-contracts.json", "utf8")) : { consumers: {} };
   const dataAccess = mergeDataAccessContracts(fileContracts, derivedContracts);
   const report = await auditOrgAccess(targets, deps, matrix, dataAccess);
   console.log(o.json ? JSON.stringify(report, null, 2) : renderAccessReport(report));
   if (!report.ok) process.exitCode = 1;
 });
+access.command("capabilities").description("enumerate your effective vault reach \u2014 every credential NAME + tier + scope you can read/use across project + org/master tiers (names only, no values) (#1615)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--json", "machine-readable output").action((o) => withSecrets((d) => secretsCapabilities(d, o)));
 var isWin = process.platform === "win32";
 var installedPluginsPath = (surface = detectSurface(process.env)) => {
   const homeDir = surface === "codex" ? ".codex" : ".claude";
-  return (0, import_node_path17.join)((0, import_node_os6.homedir)(), homeDir, "plugins", "installed_plugins.json");
+  return (0, import_node_path19.join)((0, import_node_os6.homedir)(), homeDir, "plugins", "installed_plugins.json");
 };
 function readInstalledPlugins() {
   try {
-    return JSON.parse((0, import_node_fs19.readFileSync)(installedPluginsPath(), "utf8"));
+    return JSON.parse((0, import_node_fs22.readFileSync)(installedPluginsPath(), "utf8"));
   } catch {
     return null;
   }
 }
 function installedPluginSources() {
   return ["claude", "codex"].map((surface) => {
-    const recordPath = (0, import_node_path17.join)((0, import_node_os6.homedir)(), `.${surface}`, "plugins", "installed_plugins.json");
+    const recordPath = (0, import_node_path19.join)((0, import_node_os6.homedir)(), `.${surface}`, "plugins", "installed_plugins.json");
     try {
-      return { surface, installed: JSON.parse((0, import_node_fs19.readFileSync)(recordPath, "utf8")), recordPath };
+      return { surface, installed: JSON.parse((0, import_node_fs22.readFileSync)(recordPath, "utf8")), recordPath };
     } catch {
       return { surface, installed: null, recordPath };
     }
@@ -18623,7 +19537,7 @@ function installedPluginSources() {
 }
 function readClaudeSettings() {
   try {
-    return JSON.parse((0, import_node_fs19.readFileSync)((0, import_node_path17.join)(process.cwd(), ".claude", "settings.json"), "utf8"));
+    return JSON.parse((0, import_node_fs22.readFileSync)((0, import_node_path19.join)(process.cwd(), ".claude", "settings.json"), "utf8"));
   } catch {
     return null;
   }
@@ -18645,7 +19559,7 @@ function writeProjectInstallRecord(record) {
     const list = file.plugins[MMI_PLUGIN_ID] ?? [];
     list.push(record);
     file.plugins[MMI_PLUGIN_ID] = list;
-    (0, import_node_fs19.writeFileSync)(installedPluginsPath(), `${JSON.stringify(file, null, 2)}
+    (0, import_node_fs22.writeFileSync)(installedPluginsPath(), `${JSON.stringify(file, null, 2)}
 `, "utf8");
     return true;
   } catch {
@@ -18658,9 +19572,9 @@ function backupAndWriteInstalledPlugins(records, pluginId) {
     if (!file) return false;
     if (!file.plugins) file.plugins = {};
     const path2 = installedPluginsPath();
-    (0, import_node_fs19.copyFileSync)(path2, `${path2}.bak`);
+    (0, import_node_fs22.copyFileSync)(path2, `${path2}.bak`);
     file.plugins[pluginId] = records;
-    (0, import_node_fs19.writeFileSync)(path2, `${JSON.stringify(file, null, 2)}
+    (0, import_node_fs22.writeFileSync)(path2, `${JSON.stringify(file, null, 2)}
 `, "utf8");
     return true;
   } catch {
@@ -18668,35 +19582,35 @@ function backupAndWriteInstalledPlugins(records, pluginId) {
   }
 }
 function cursorPluginCacheRoot() {
-  return (0, import_node_path17.join)((0, import_node_os6.homedir)(), ".cursor", "plugins", "cache", "mmi", "mmi");
+  return (0, import_node_path19.join)((0, import_node_os6.homedir)(), ".cursor", "plugins", "cache", "mutmutco", "mmi");
 }
 function cursorPluginCachePinSnapshots() {
   const root = cursorPluginCacheRoot();
   try {
-    return (0, import_node_fs19.readdirSync)(root, { withFileTypes: true }).filter((entry) => entry.isDirectory() && !entry.name.startsWith(".")).map((entry) => {
-      const path2 = (0, import_node_path17.join)(root, entry.name);
-      const pluginJson = (0, import_node_path17.join)(path2, ".cursor-plugin", "plugin.json");
-      const hooksJson = (0, import_node_path17.join)(path2, "hooks", "hooks.json");
-      const cliBundle = (0, import_node_path17.join)(path2, "cli", "dist", "index.cjs");
+    return (0, import_node_fs22.readdirSync)(root, { withFileTypes: true }).filter((entry) => entry.isDirectory() && !entry.name.startsWith(".")).map((entry) => {
+      const path2 = (0, import_node_path19.join)(root, entry.name);
+      const pluginJson = (0, import_node_path19.join)(path2, ".cursor-plugin", "plugin.json");
+      const hooksJson = (0, import_node_path19.join)(path2, "hooks", "hooks.json");
+      const cliBundle = (0, import_node_path19.join)(path2, "cli", "dist", "index.cjs");
       let version;
       try {
-        const raw = JSON.parse((0, import_node_fs19.readFileSync)(pluginJson, "utf8"));
+        const raw = JSON.parse((0, import_node_fs22.readFileSync)(pluginJson, "utf8"));
         version = typeof raw.version === "string" ? raw.version : void 0;
       } catch {
         version = void 0;
       }
       let isEmpty = true;
       try {
-        isEmpty = (0, import_node_fs19.readdirSync)(path2).length === 0;
+        isEmpty = (0, import_node_fs22.readdirSync)(path2).length === 0;
       } catch {
         isEmpty = true;
       }
       return {
         name: entry.name,
         path: path2,
-        hasPluginJson: (0, import_node_fs19.existsSync)(pluginJson),
-        hasHooksJson: (0, import_node_fs19.existsSync)(hooksJson),
-        hasCliBundle: (0, import_node_fs19.existsSync)(cliBundle),
+        hasPluginJson: (0, import_node_fs22.existsSync)(pluginJson),
+        hasHooksJson: (0, import_node_fs22.existsSync)(hooksJson),
+        hasCliBundle: (0, import_node_fs22.existsSync)(cliBundle),
         isEmpty,
         version
       };
@@ -18706,19 +19620,19 @@ function cursorPluginCachePinSnapshots() {
   }
 }
 function hubCheckoutForCursorSeed() {
-  const manifest = (0, import_node_path17.join)(process.cwd(), "plugins", "mmi", ".cursor-plugin", "plugin.json");
-  return (0, import_node_fs19.existsSync)(manifest) ? process.cwd() : void 0;
+  const manifest = (0, import_node_path19.join)(process.cwd(), "plugins", "mmi", ".cursor-plugin", "plugin.json");
+  return (0, import_node_fs22.existsSync)(manifest) ? process.cwd() : void 0;
 }
 function mmiPluginCacheRootSnapshots() {
   const roots = [
-    { surface: "claude", root: (0, import_node_path17.join)((0, import_node_os6.homedir)(), ".claude", "plugins", "cache", "mmi", "mmi") },
-    { surface: "codex", root: (0, import_node_path17.join)((0, import_node_os6.homedir)(), ".codex", "plugins", "cache", "mmi", "mmi") }
+    { surface: "claude", root: (0, import_node_path19.join)((0, import_node_os6.homedir)(), ".claude", "plugins", "cache", "mutmutco", "mmi") },
+    { surface: "codex", root: (0, import_node_path19.join)((0, import_node_os6.homedir)(), ".codex", "plugins", "cache", "mutmutco", "mmi") }
   ];
   return roots.flatMap(({ surface, root }) => {
     try {
-      const entries = (0, import_node_fs19.readdirSync)(root, { withFileTypes: true }).map((entry) => ({
+      const entries = (0, import_node_fs22.readdirSync)(root, { withFileTypes: true }).map((entry) => ({
         name: entry.name,
-        path: (0, import_node_path17.join)(root, entry.name),
+        path: (0, import_node_path19.join)(root, entry.name),
         isDirectory: entry.isDirectory()
       }));
       return [{ surface, root, entries }];
@@ -18729,7 +19643,7 @@ function mmiPluginCacheRootSnapshots() {
 }
 function hasNestedMmiChild(versionDir) {
   try {
-    return (0, import_node_fs19.statSync)((0, import_node_path17.join)(versionDir, "mmi")).isDirectory();
+    return (0, import_node_fs22.statSync)((0, import_node_path19.join)(versionDir, "mmi")).isDirectory();
   } catch {
     return false;
   }
@@ -18740,10 +19654,10 @@ function nestedPluginTreeSnapshot() {
   );
 }
 function uniqueQuarantineTarget(path2) {
-  if (!(0, import_node_fs19.existsSync)(path2)) return path2;
+  if (!(0, import_node_fs22.existsSync)(path2)) return path2;
   for (let i = 1; i < 100; i += 1) {
     const candidate = `${path2}-${i}`;
-    if (!(0, import_node_fs19.existsSync)(candidate)) return candidate;
+    if (!(0, import_node_fs22.existsSync)(candidate)) return candidate;
   }
   return `${path2}-${Date.now()}`;
 }
@@ -18752,10 +19666,10 @@ function quarantinePluginCacheDirs(plan2) {
   const failed = [];
   for (const move of plan2) {
     try {
-      if (!(0, import_node_fs19.existsSync)(move.from)) continue;
+      if (!(0, import_node_fs22.existsSync)(move.from)) continue;
       const target = uniqueQuarantineTarget(move.to);
-      (0, import_node_fs19.mkdirSync)((0, import_node_path17.dirname)(target), { recursive: true });
-      (0, import_node_fs19.renameSync)(move.from, target);
+      (0, import_node_fs22.mkdirSync)((0, import_node_path19.dirname)(target), { recursive: true });
+      (0, import_node_fs22.renameSync)(move.from, target);
       moved += 1;
     } catch {
       failed.push(move);
@@ -18774,23 +19688,23 @@ async function robocopyMirrorEmpty(emptyDir, target) {
 }
 async function clearNestedPluginTreeDir(targetPath) {
   try {
-    if (!(0, import_node_fs19.existsSync)(targetPath)) return true;
+    if (!(0, import_node_fs22.existsSync)(targetPath)) return true;
     if (isWin) {
-      const emptyDir = (0, import_node_path17.join)((0, import_node_os6.tmpdir)(), `mmi-empty-${Date.now()}`);
-      (0, import_node_fs19.mkdirSync)(emptyDir, { recursive: true });
+      const emptyDir = (0, import_node_path19.join)((0, import_node_os6.tmpdir)(), `mmi-empty-${Date.now()}`);
+      (0, import_node_fs22.mkdirSync)(emptyDir, { recursive: true });
       try {
         await robocopyMirrorEmpty(emptyDir, targetPath);
-        (0, import_node_fs19.rmSync)(targetPath, { recursive: true, force: true });
+        (0, import_node_fs22.rmSync)(targetPath, { recursive: true, force: true });
       } finally {
         try {
-          (0, import_node_fs19.rmSync)(emptyDir, { recursive: true, force: true });
+          (0, import_node_fs22.rmSync)(emptyDir, { recursive: true, force: true });
         } catch {
         }
       }
-      return !(0, import_node_fs19.existsSync)(targetPath);
+      return !(0, import_node_fs22.existsSync)(targetPath);
     }
-    (0, import_node_fs19.rmSync)(targetPath, { recursive: true, force: true });
-    return !(0, import_node_fs19.existsSync)(targetPath);
+    (0, import_node_fs22.rmSync)(targetPath, { recursive: true, force: true });
+    return !(0, import_node_fs22.existsSync)(targetPath);
   } catch {
     return false;
   }
@@ -18803,11 +19717,11 @@ async function applyNestedPluginTreeCleanup(paths, log) {
   }
   return true;
 }
-var gitignorePath = () => (0, import_node_path17.join)(process.cwd(), ".gitignore");
+var gitignorePath = () => (0, import_node_path19.join)(process.cwd(), ".gitignore");
 function readTextFile(path2) {
   try {
-    if (!(0, import_node_fs19.existsSync)(path2)) return null;
-    return (0, import_node_fs19.readFileSync)(path2, "utf8");
+    if (!(0, import_node_fs22.existsSync)(path2)) return null;
+    return (0, import_node_fs22.readFileSync)(path2, "utf8");
   } catch {
     return null;
   }
@@ -18816,9 +19730,9 @@ function playwrightMcpConfigSnapshots() {
   const cwd = process.cwd();
   const home = (0, import_node_os6.homedir)();
   const candidates = [
-    (0, import_node_path17.join)(cwd, ".cursor", "mcp.json"),
-    (0, import_node_path17.join)(home, ".cursor", "mcp.json"),
-    (0, import_node_path17.join)(home, ".codex", "config.toml")
+    (0, import_node_path19.join)(cwd, ".cursor", "mcp.json"),
+    (0, import_node_path19.join)(home, ".cursor", "mcp.json"),
+    (0, import_node_path19.join)(home, ".codex", "config.toml")
   ];
   const out = [];
   for (const path2 of candidates) {
@@ -18831,7 +19745,7 @@ function strayBrowserArtifactPaths() {
   const cwd = process.cwd();
   return STRAY_BROWSER_ARTIFACT_DIRS.filter((rel) => {
     try {
-      return (0, import_node_fs19.existsSync)((0, import_node_path17.join)(cwd, rel));
+      return (0, import_node_fs22.existsSync)((0, import_node_path19.join)(cwd, rel));
     } catch {
       return false;
     }
@@ -18839,14 +19753,14 @@ function strayBrowserArtifactPaths() {
 }
 function readGitignore() {
   try {
-    return (0, import_node_fs19.readFileSync)(gitignorePath(), "utf8");
+    return (0, import_node_fs22.readFileSync)(gitignorePath(), "utf8");
   } catch {
     return null;
   }
 }
 function writeGitignore(content) {
   try {
-    (0, import_node_fs19.writeFileSync)(gitignorePath(), content, "utf8");
+    (0, import_node_fs22.writeFileSync)(gitignorePath(), content, "utf8");
     return true;
   } catch {
     return false;
@@ -18885,7 +19799,7 @@ async function runDoctor(opts, io = consoleIo) {
   let onPath = pathProbe;
   if (!onPath) {
     const root = process.env.CLAUDE_PLUGIN_ROOT;
-    if (root && (0, import_node_fs19.existsSync)(`${root}/bin/mmi-cli${isWin ? ".cmd" : ""}`)) onPath = true;
+    if (root && (0, import_node_fs22.existsSync)(`${root}/bin/mmi-cli${isWin ? ".cmd" : ""}`)) onPath = true;
   }
   checks.push({ ok: onPath, label: "mmi-cli on PATH", fix: "auto-provisioned at session start \u2014 reopen the session, or install the MMI plugin" });
   const surface = detectSurface(process.env);
@@ -18929,10 +19843,40 @@ async function runDoctor(opts, io = consoleIo) {
   if (!pluginCheck.ok && pluginCheck.recordToInsert && repairLocal) {
     if (writeProjectInstallRecord(pluginCheck.recordToInsert)) {
       pluginCheck = { ...pluginCheck, ok: true };
-      io.err(`  \u21BB repaired: registered mmi@mmi project install record \u2014 ${reloadHint} to load MMI commands`);
+      io.err(`  \u21BB repaired: registered mmi@mutmutco project install record \u2014 ${reloadHint} to load MMI commands`);
     }
   }
   checks.push(pluginCheck);
+  let legacyPluginCheck = buildLegacyPluginInstallCheck({
+    isOrgRepo: Boolean(cfg.sagaApiUrl),
+    sources: installedPluginSources(),
+    surface
+  });
+  if (!legacyPluginCheck.ok && repairLocal) {
+    const claudeLegacy = legacyPluginCheck.staleSurfaces?.includes("claude") ?? false;
+    const codexLegacy = legacyPluginCheck.staleSurfaces?.includes("codex") ?? false;
+    if (claudeLegacy && await applyClaudePluginHeal(surface, (m) => io.err(m), { force: true })) {
+      legacyPluginCheck = buildLegacyPluginInstallCheck({
+        isOrgRepo: Boolean(cfg.sagaApiUrl),
+        sources: installedPluginSources(),
+        surface
+      });
+      if (legacyPluginCheck.ok) {
+        io.err(`  \u21BB migrated legacy mmi@mmi \u2192 mmi@mutmutco via claude plugin \u2014 ${reloadHint} to load MMI commands`);
+      }
+    }
+    if (!legacyPluginCheck.ok && codexLegacy && await applyCodexPluginHeal(surface, (m) => io.err(m), { force: true })) {
+      legacyPluginCheck = buildLegacyPluginInstallCheck({
+        isOrgRepo: Boolean(cfg.sagaApiUrl),
+        sources: installedPluginSources(),
+        surface
+      });
+      if (legacyPluginCheck.ok) {
+        io.err(`  \u21BB migrated legacy mmi@mmi \u2192 mmi@mutmutco via codex plugin \u2014 ${reloadHint} to load MMI commands`);
+      }
+    }
+  }
+  checks.push(legacyPluginCheck);
   let gitignoreCheck = buildGitignoreManagedBlockCheck({ isOrgRepo: Boolean(cfg.sagaApiUrl), content: readGitignore() });
   const gitignoreDecision = decideGitignoreRepair(gitignoreCheck, { repoWritesAllowed, repairFull });
   gitignoreCheck = gitignoreDecision.check;
@@ -18955,7 +19899,7 @@ async function runDoctor(opts, io = consoleIo) {
   if (!driftCheck.ok && driftCheck.recordsToWrite && repairLocal) {
     if (backupAndWriteInstalledPlugins(driftCheck.recordsToWrite, driftCheck.pluginId)) {
       driftCheck = { ...driftCheck, ok: true };
-      io.err(`  \u21BB repaired: collapsed mmi@mmi to one user-scope entry (backup at installed_plugins.json.bak) \u2014 ${reloadHint} to load MMI commands`);
+      io.err(`  \u21BB repaired: collapsed mmi@mutmutco to one user-scope entry (backup at installed_plugins.json.bak) \u2014 ${reloadHint} to load MMI commands`);
     }
   }
   checks.push(driftCheck);
@@ -19057,7 +20001,7 @@ async function runDoctor(opts, io = consoleIo) {
     isOrgRepo: Boolean(cfg.sagaApiUrl),
     surface,
     cacheRoot: cursorCacheRoot,
-    cacheRootExists: (0, import_node_fs19.existsSync)(cursorCacheRoot),
+    cacheRootExists: (0, import_node_fs22.existsSync)(cursorCacheRoot),
     pins: cursorPins,
     hubCheckout: hubCheckoutForCursorSeed(),
     releasedVersion
@@ -19068,7 +20012,7 @@ async function runDoctor(opts, io = consoleIo) {
       releasedVersion,
       hubCheckout: hubCheckoutForCursorSeed(),
       execFileP: execFileP2,
-      mkdtemp: (prefix) => (0, import_promises6.mkdtemp)((0, import_node_path17.join)((0, import_node_os6.tmpdir)(), prefix)),
+      mkdtemp: (prefix) => (0, import_promises7.mkdtemp)((0, import_node_path19.join)((0, import_node_os6.tmpdir)(), prefix)),
       log: (m) => io.err(m)
     });
     if (seeded) {
@@ -19077,7 +20021,7 @@ async function runDoctor(opts, io = consoleIo) {
         isOrgRepo: Boolean(cfg.sagaApiUrl),
         surface,
         cacheRoot: cursorCacheRoot,
-        cacheRootExists: (0, import_node_fs19.existsSync)(cursorCacheRoot),
+        cacheRootExists: (0, import_node_fs22.existsSync)(cursorCacheRoot),
         pins: cursorPins,
         hubCheckout: hubCheckoutForCursorSeed(),
         releasedVersion
@@ -19116,6 +20060,38 @@ async function runDoctor(opts, io = consoleIo) {
       strayPaths: strayBrowserArtifactPaths()
     })
   );
+  const dashboardConsumer = await resolveDashboardConsumer(cfg);
+  const isDashboardConsumer = dashboardConsumer.isConsumer;
+  const uiSnapshot = designSystemSnapshot(process.cwd());
+  const uiLatestVersion = isDashboardConsumer && uiSnapshot.packageName ? await fetchUiPackageLatestVersion(uiSnapshot.packageName) : void 0;
+  let designSystemCheck = dashboardConsumer.registryReadFailed ? buildDesignSystemRegistryReadCheck(dashboardConsumer.registryReadFailed) : buildDesignSystemVersionCheck({
+    ...uiSnapshot,
+    isConsumerRepo: isDashboardConsumer,
+    latestVersion: uiLatestVersion
+  });
+  if (!designSystemCheck.ok && (repairFull || repairLocal) && designSystemCheck.packageName) {
+    designSystemCheck = await applyDesignSystemUpdate(designSystemCheck, (m) => io.err(m));
+    if (designSystemCheck.ok) {
+      io.err(`  \u21BB updated ${designSystemCheck.packageName} \u2192 ${designSystemCheck.installedVersion ?? designSystemCheck.latestVersion ?? "latest"}`);
+    }
+  }
+  checks.push(designSystemCheck);
+  const registryTargetVersion = designSystemCheck.latestVersion ?? designSystemCheck.installedVersion ?? uiLatestVersion;
+  let registryComponentsCheck = dashboardConsumer.registryReadFailed ? buildRegistryComponentsRegistryReadCheck(dashboardConsumer.registryReadFailed) : buildRegistryComponentsCheck({
+    ...await gatherRegistryComponentsState(process.cwd(), registryTargetVersion, { fetch }),
+    isConsumerRepo: isDashboardConsumer
+  });
+  if (!registryComponentsCheck.ok && (repairFull || repairLocal) && repoWritesAllowed && registryComponentsCheck.components?.length) {
+    registryComponentsCheck = await applyRegistryComponentsSyncCheck(
+      registryComponentsCheck,
+      registryTargetVersion,
+      (m) => io.err(m)
+    );
+    if (registryComponentsCheck.ok) {
+      io.err(`  \u21BB synced ${registryComponentsCheck.components?.length ?? 0} registry component(s) \u2192 .mmi/design-system/components`);
+    }
+  }
+  checks.push(registryComponentsCheck);
   const gaps = checks.filter((c) => !c.ok);
   if (opts.banner) {
     if (gaps.length) io.log(`\u26A0 MMI setup needed \u2014 ${gaps.map((g) => g.fix).join(" \xB7 ")} \xB7 guide: ${MMI_AGENTIC_ONBOARDING_GUIDE.url}`);
@@ -19144,7 +20120,82 @@ async function runDoctor(opts, io = consoleIo) {
   io.log(gaps.length ? `
 ${gaps.length} item(s) need attention.` : "\nAll set \u2014 you are ready.");
 }
-program2.command("doctor").description("check onboarding gates (GitHub auth, mmi-cli on PATH, Hub API default, plugin git clone, plugin install record, .gitignore managed block, plugin config drift, installed plugin version, Cursor Team Marketplace plugin install, Playwright MCP vision caps, browser artifact hygiene), print fixes, and report per-surface versions + update recipes").option("--banner", "one-line resume summary; silent when all gates pass").option("--guide", "print the MMI Agentic Onboarding guide URL").option("--json", "machine-readable output (read-only inspection \u2014 performs no repairs)").option("--apply", "perform the same auto-repairs as the interactive run (combine with --json for a machine-readable repair run)").option("--no-repo-writes", "env/plugin repairs only \u2014 never mutate the repo working tree; report pending managed .gitignore repairs with the follow-up command (for train preflights)").action((opts) => (
+var designSystem = program2.command("design-system").description("@mutmutco UI npm package + registry component freshness for dashboard consumers (#1633, #1635)");
+designSystem.command("status").description("compare the installed @mutmutco/ui-dashboard (or legacy @mutmutco/ui) semver in this repo vs npm @latest").option("--json", "machine-readable output").option("--apply", "run npm update when behind (same as doctor --apply for this check)").action(async (opts) => {
+  const cfg = await loadConfig();
+  const dashboardConsumer = await resolveDashboardConsumer(cfg);
+  if (dashboardConsumer.registryReadFailed) {
+    const check2 = buildDesignSystemRegistryReadCheck(dashboardConsumer.registryReadFailed);
+    if (opts.json) {
+      console.log(JSON.stringify(check2, null, 2));
+    } else {
+      console.log(`\u2717 ${check2.label}`);
+      console.log(`  fix: ${check2.fix}`);
+    }
+    process.exitCode = 1;
+    return;
+  }
+  const isDashboardConsumer = dashboardConsumer.isConsumer;
+  const snapshot = designSystemSnapshot(process.cwd());
+  let check = buildDesignSystemVersionCheck({
+    ...snapshot,
+    isConsumerRepo: isDashboardConsumer,
+    latestVersion: isDashboardConsumer && snapshot.packageName ? await fetchUiPackageLatestVersion(snapshot.packageName) : void 0
+  });
+  if (!check.ok && opts.apply && check.packageName) {
+    check = await applyDesignSystemUpdate(check, (m) => console.error(m));
+  }
+  if (opts.json) {
+    console.log(JSON.stringify(check, null, 2));
+    process.exitCode = check.ok ? 0 : 1;
+    return;
+  }
+  console.log(check.ok ? `\u2713 ${check.label}` : `\u2717 ${check.label}`);
+  if (check.packageName) console.log(`  package: ${check.packageName}`);
+  if (check.installedVersion) console.log(`  installed: ${check.installedVersion}`);
+  if (check.latestVersion) console.log(`  latest: ${check.latestVersion}`);
+  if (!check.ok) console.log(`  fix: ${check.fix}`);
+  process.exitCode = check.ok ? 0 : 1;
+});
+designSystem.command("registry").description("compare .mmi/design-system/components cache vs the live @mutmutco registry").option("--json", "machine-readable output").option("--apply", "pull registry components into .mmi/ (same as doctor --apply for this check)").action(async (opts) => {
+  const cfg = await loadConfig();
+  const dashboardConsumer = await resolveDashboardConsumer(cfg);
+  if (dashboardConsumer.registryReadFailed) {
+    const check2 = buildRegistryComponentsRegistryReadCheck(dashboardConsumer.registryReadFailed);
+    if (opts.json) {
+      console.log(JSON.stringify(check2, null, 2));
+    } else {
+      console.log(`\u2717 ${check2.label}`);
+      console.log(`  fix: ${check2.fix}`);
+    }
+    process.exitCode = 1;
+    return;
+  }
+  const isDashboardConsumer = dashboardConsumer.isConsumer;
+  const snapshot = designSystemSnapshot(process.cwd());
+  const targetVersion = isDashboardConsumer && snapshot.packageName ? await fetchUiPackageLatestVersion(snapshot.packageName) : void 0;
+  const state = await gatherRegistryComponentsState(process.cwd(), targetVersion, { fetch });
+  let check = buildRegistryComponentsCheck({
+    ...state,
+    isConsumerRepo: isDashboardConsumer
+  });
+  if (!check.ok && opts.apply && check.components?.length) {
+    check = await applyRegistryComponentsSyncCheck(check, targetVersion, (m) => console.error(m));
+  }
+  if (opts.json) {
+    console.log(JSON.stringify(check, null, 2));
+    process.exitCode = check.ok ? 0 : 1;
+    return;
+  }
+  console.log(check.ok ? `\u2713 ${check.label}` : `\u2717 ${check.label}`);
+  if (check.components?.length) console.log(`  components: ${check.components.join(", ")}`);
+  if (check.cacheVersion) console.log(`  cache version: ${check.cacheVersion}`);
+  if (check.targetVersion) console.log(`  target version: ${check.targetVersion}`);
+  if (check.staleComponents?.length) console.log(`  stale: ${check.staleComponents.join(", ")}`);
+  if (!check.ok) console.log(`  fix: ${check.fix}`);
+  process.exitCode = check.ok ? 0 : 1;
+});
+program2.command("doctor").description("check onboarding gates (GitHub auth, mmi-cli on PATH, Hub API default, plugin git clone, plugin install record, .gitignore managed block, plugin config drift, installed plugin version, Cursor Team Marketplace plugin install, @mutmutco UI npm package freshness, @mutmutco registry component cache, Playwright MCP vision caps, browser artifact hygiene), print fixes, and report per-surface versions + update recipes").option("--banner", "one-line resume summary; silent when all gates pass").option("--guide", "print the MMI Agentic Onboarding guide URL").option("--json", "machine-readable output (read-only inspection \u2014 performs no repairs)").option("--apply", "perform the same auto-repairs as the interactive run (combine with --json for a machine-readable repair run)").option("--no-repo-writes", "env/plugin repairs only \u2014 never mutate the repo working tree; report pending managed .gitignore repairs with the follow-up command (for train preflights)").action((opts) => (
   // Commander maps `--no-repo-writes` to `repoWrites: false`; translate to the explicit `noRepoWrites` flag.
   runDoctor({ ...opts, noRepoWrites: opts.repoWrites === false })
 ));
@@ -19159,7 +20210,7 @@ program2.command("session-start").description("run the SessionStart verbs (rules
   } catch (e) {
     console.error(`[mmi-hook] saga session failed: ${e.message}`);
   }
-  spawnDetachedSelf(["docs", "sync", "--quiet"], { spawn: import_node_child_process10.spawn, execPath: process.execPath, scriptPath: process.argv[1] });
+  spawnDetachedSelf(["docs", "sync", "--quiet"], { spawn: import_node_child_process12.spawn, execPath: process.execPath, scriptPath: process.argv[1] });
   let northstarInjected = false;
   const { parallel, sequential } = buildSessionStartPlan({
     rulesSync: (io) => runRulesSync({ quiet: true }, io),
@@ -19201,7 +20252,7 @@ program2.command("session-start").description("run the SessionStart verbs (rules
   for (const line of scratchGcLines(process.cwd())) consoleIo.log(line);
   const worktreeBanner = worktreeAutoProvisionBanner(process.cwd());
   if (worktreeBanner) {
-    spawnDetachedSelf(["worktree", "setup", "--quiet"], { spawn: import_node_child_process10.spawn, execPath: process.execPath, scriptPath: process.argv[1] });
+    spawnDetachedSelf(["worktree", "setup", "--quiet"], { spawn: import_node_child_process12.spawn, execPath: process.execPath, scriptPath: process.argv[1] });
     consoleIo.log(worktreeBanner);
   }
 });