@mutmutco/cli 2.68.0 → 3.0.0

package/dist/main.cjs

@@ -3407,42 +3407,104 @@ function useColor() {
 var program = new Command();
 
 // src/index.ts
-var import_promises4 = require("node:fs/promises");
+var import_promises3 = require("node:fs/promises");
 var import_node_fs18 = require("node:fs");
 
-// src/rules-sync.ts
-function normalizeEol(s) {
-  return s.replace(/\r\n/g, "\n");
-}
-function needsUpdate(source, current) {
-  if (current === null) return true;
-  return normalizeEol(source) !== normalizeEol(current);
+// src/bootstrap-org-ruleset.ts
+var ORG_NO_AGENT_FILES_RULESET_NAME = "mmi-no-agent-files-org";
+var ORG_LOGIN = "mutmutco";
+var ORG_NO_AGENT_FILES_EXCLUDED_REPOS = ["Jerv-PowerTools"];
+var NO_AGENT_FILES_GLOBS = [
+  "AGENTS.md",
+  "**/AGENTS.md",
+  "CLAUDE.md",
+  "**/CLAUDE.md",
+  "GEMINI.md",
+  "**/GEMINI.md",
+  ".claude/**",
+  "**/.claude/**",
+  ".cursor/rules/**",
+  "**/.cursor/rules/**",
+  ".codex/**",
+  "**/.codex/**",
+  ".agents/**",
+  "**/.agents/**"
+];
+function orgNoAgentFilesRulesetDesired() {
+  return {
+    name: ORG_NO_AGENT_FILES_RULESET_NAME,
+    target: "push",
+    enforcement: "active",
+    bypass_actors: [],
+    conditions: { repository_name: { include: ["~ALL"], exclude: [...ORG_NO_AGENT_FILES_EXCLUDED_REPOS] } },
+    rules: [{ type: "file_path_restriction", parameters: { restricted_file_paths: [...NO_AGENT_FILES_GLOBS] } }]
+  };
 }
-function isRulesSource(orgRulesSource) {
-  return orgRulesSource === "self";
+function sameSet(a, b) {
+  const A = new Set(a ?? []);
+  const B = new Set(b ?? []);
+  if (A.size !== B.size) return false;
+  for (const v of A) if (!B.has(v)) return false;
+  return true;
 }
-function rulesSourceAuthHeaders(sourceUrl, token) {
-  if (!token) return void 0;
-  try {
-    const host = new URL(sourceUrl).hostname.toLowerCase();
-    if (host === "raw.githubusercontent.com" || host === "api.github.com") {
-      return { Authorization: `Bearer ${token}` };
-    }
-  } catch {
-    return void 0;
-  }
-  return void 0;
+function diffOrgRuleset(live, desired = orgNoAgentFilesRulesetDesired()) {
+  const drift = [];
+  if (!live) return [`ruleset '${desired.name}' is absent`];
+  if (live.name !== desired.name) drift.push(`name: '${live.name}' != '${desired.name}'`);
+  if (live.target !== desired.target) drift.push(`target: '${live.target}' != '${desired.target}'`);
+  if (live.enforcement !== desired.enforcement) drift.push(`enforcement: '${live.enforcement}' != '${desired.enforcement}'`);
+  const bypass = Array.isArray(live.bypass_actors) ? live.bypass_actors : [];
+  if (bypass.length !== 0) drift.push(`bypass_actors: ${bypass.length} actor(s) present \u2014 must be empty (no bypass)`);
+  const include = live.conditions?.repository_name?.include;
+  const exclude = live.conditions?.repository_name?.exclude;
+  if (!sameSet(include, desired.conditions.repository_name.include)) {
+    drift.push(`conditions.include: [${(include ?? []).join(", ")}] != [${desired.conditions.repository_name.include.join(", ")}]`);
+  }
+  if (!sameSet(exclude, desired.conditions.repository_name.exclude)) {
+    drift.push(`conditions.exclude: [${(exclude ?? []).join(", ")}] != [${desired.conditions.repository_name.exclude.join(", ")}]`);
+  }
+  const rules2 = Array.isArray(live.rules) ? live.rules : [];
+  const fpr = rules2.filter((r) => r?.type === "file_path_restriction");
+  if (fpr.length !== 1) {
+    drift.push(`rules: expected exactly 1 file_path_restriction, found ${fpr.length}`);
+  } else if (!sameSet(fpr[0]?.parameters?.restricted_file_paths, desired.rules[0].parameters.restricted_file_paths)) {
+    const got = fpr[0]?.parameters?.restricted_file_paths ?? [];
+    drift.push(`restricted_file_paths: ${got.length} glob(s) differ from the codified ${desired.rules[0].parameters.restricted_file_paths.length}`);
+  }
+  return drift;
+}
+function planOrgNoAgentFilesRuleset(live) {
+  const desired = orgNoAgentFilesRulesetDesired();
+  if (!live) return { action: "create", drift: [`ruleset '${desired.name}' is absent`], desired };
+  const drift = diffOrgRuleset(live, desired);
+  return { action: drift.length === 0 ? "noop" : "update", drift, desired, id: live.id };
+}
+function renderOrgRulesetDriftReport(plan) {
+  const head = `mmi-cli bootstrap org-ruleset: ${ORG_NO_AGENT_FILES_RULESET_NAME} (org ${ORG_LOGIN})`;
+  if (plan.action === "noop") {
+    return `${head}
+OK \u2014 live ruleset matches the codified IaC (${NO_AGENT_FILES_GLOBS.length} globs, include ~ALL, empty bypass, exclude ${ORG_NO_AGENT_FILES_EXCLUDED_REPOS.join(", ")}).`;
+  }
+  const verb = plan.action === "create" ? "MISSING \u2014 codified IaC would CREATE it" : "DRIFT \u2014 live ruleset diverges from the codified IaC";
+  return [
+    `${head}`,
+    verb,
+    ...plan.drift.map((d) => `  - ${d}`),
+    "This command is read-only; it never mutates the live ruleset. Recreate/repair via the GitHub UI or a",
+    "deliberate POST/PUT of orgNoAgentFilesRulesetDesired() \u2014 see cli/src/bootstrap-org-ruleset.ts."
+  ].join("\n");
 }
-function resolveRulesBase(orgRulesSource, defaultBase) {
-  const isUrl = typeof orgRulesSource === "string" && /^https?:\/\//i.test(orgRulesSource);
-  return (isUrl ? orgRulesSource : defaultBase).replace(/\/$/, "");
+async function fetchOrgNoAgentFilesRuleset(client, org = ORG_LOGIN) {
+  const list = await client.rest("GET", `orgs/${org}/rulesets`, { timeoutMs: 2e4 });
+  const summary = (list ?? []).find((r) => r?.name === ORG_NO_AGENT_FILES_RULESET_NAME);
+  if (summary?.id == null) return null;
+  return await client.rest("GET", `orgs/${org}/rulesets/${summary.id}`, { timeoutMs: 2e4 }) ?? null;
 }
 
 // src/index.ts
 var import_node_child_process11 = require("node:child_process");
 
 // src/cli-shared.ts
-var import_promises = require("node:fs/promises");
 var import_node_child_process3 = require("node:child_process");
 var import_node_util4 = require("node:util");
 
@@ -3887,16 +3949,8 @@ async function hubHeaders(extra = {}) {
   const base = { ...clientVersionHeaders(), ...extra };
   return t ? { ...base, Authorization: `Bearer ${t}` } : base;
 }
-var CONFIG_FILE = ".mmi/config.json";
 async function loadConfig() {
-  let file = {};
-  try {
-    file = JSON.parse(await (0, import_promises.readFile)(CONFIG_FILE, "utf8"));
-  } catch {
-    file = {};
-  }
-  if (!file.sagaApiUrl) file.sagaApiUrl = defaultHubUrl();
-  return file;
+  return { sagaApiUrl: defaultHubUrl() };
 }
 async function originRemoteUrl() {
   return gitOut(["config", "--get", "remote.origin.url"]);
@@ -3922,29 +3976,8 @@ function fail(msg) {
   hardExit(1);
 }
 function installProcessBackstop() {
-  process.on("unhandledRejection", (reason) => fail(reason instanceof Error ? reason.message : String(reason)));
-  process.on("uncaughtException", (err) => fail(err instanceof Error ? err.message : String(err)));
-}
-
-// src/docs-sync.ts
-var SYNCED_DOCS = ["README.md", "architecture.md"];
-async function syncDocs(deps, docs2 = SYNCED_DOCS) {
-  const updated = [];
-  const skippedDirty = [];
-  for (const file of docs2) {
-    if (await deps.isDirty(file)) {
-      skippedDirty.push(file);
-      continue;
-    }
-    const origin = await deps.originContent(file);
-    if (origin === null) continue;
-    const local = await deps.localContent(file);
-    if (needsUpdate(origin, local)) {
-      await deps.writeDoc(file, normalizeEol(origin));
-      updated.push(file);
-    }
-  }
-  return { updated, skippedDirty };
+  process.on("unhandledRejection", (reason) => void failGraceful(reason instanceof Error ? reason.message : String(reason)));
+  process.on("uncaughtException", (err) => void failGraceful(err instanceof Error ? err.message : String(err)));
 }
 
 // src/session-start.ts
@@ -3979,8 +4012,12 @@ function hashContent(s) {
   return (h >>> 0).toString(16);
 }
 
+// src/rules-sync.ts
+function normalizeEol(s) {
+  return s.replace(/\r\n/g, "\n");
+}
+
 // src/scratch-gc.ts
-var HEAD_TS_STALE_MS = 48 * 36e5;
 var PLAN_ADVISORY_AGE_MS = 30 * 24 * 36e5;
 var ROOT_SCRATCH_STALE_MS = 24 * 36e5;
 var SCRATCH_GC_THROTTLE_MS = 24 * 36e5;
@@ -4002,16 +4039,16 @@ function markScratchGcRun(stampPath, now = Date.now()) {
   }
 }
 function executeScratchGc(repoRoot, opts, now = Date.now()) {
-  const snap = collectScratchSnapshot(repoRoot);
+  const snap = collectScratchSnapshot(repoRoot, { project: opts.project });
   const plan = planScratchGc(snap, now);
   if (!opts.apply) return { plan };
-  return { plan, applied: applyScratchGc(plan, snap.mmiRoot, now) };
+  return { plan, applied: applyScratchGc(plan, repoRoot, now, opts.project) };
 }
-function buildPrMergeScratchHousekeeping(repoRoot, deps = {}) {
+function buildPrMergeScratchHousekeeping(repoRoot, deps = {}, project2) {
   const runScratchGc = deps.runScratchGc ?? executeScratchGc;
   try {
-    const scratchApply = runScratchGc(repoRoot, { apply: true });
-    const scratchAfter = runScratchGc(repoRoot, { apply: false });
+    const scratchApply = runScratchGc(repoRoot, { apply: true, project: project2 });
+    const scratchAfter = runScratchGc(repoRoot, { apply: false, project: project2 });
     const applied = scratchApply.applied;
     const pruned = applied?.pruned.length ?? 0;
     const skipped = applied?.skipped ?? 0;
@@ -4043,13 +4080,10 @@ function buildPrMergeScratchHousekeeping(repoRoot, deps = {}) {
 }
 var ROOT_SCRATCH_DIRS = /* @__PURE__ */ new Set(["tmp", ".playwright-mcp", "test-results", "playwright-report"]);
 var ROOT_SCRATCH_FILE_PREFIXES = ["tmp_"];
-var NEVER_BASENAMES = /* @__PURE__ */ new Set([".session", "config.json"]);
 function planScratchGc(snap, now = Date.now()) {
   const candidates = [];
   const normalizePath = (p) => p.replace(/\\/g, "/");
-  const repoRoot = normalizePath((snap.repoRoot ?? (0, import_node_path5.dirname)(snap.mmiRoot)).replace(/[\\/]+$/, ""));
-  const headTsPrefix = `${snap.mmiRoot.replace(/[\\/]+$/, "")}/head-ts/`.replace(/\\/g, "/");
-  const days = (ms) => `${Math.floor(ms / 864e5)}d`;
+  const repoRoot = normalizePath(snap.repoRoot.replace(/[\\/]+$/, ""));
   for (const f of snap.rootScratchFiles ?? []) {
     const dir = normalizePath(f.dir).replace(/\/+$/, "");
     const age = now - f.mtimeMs;
@@ -4078,15 +4112,6 @@ function planScratchGc(snap, now = Date.now()) {
       });
     }
   }
-  for (const f of snap.mmiFiles) {
-    const age = now - f.mtimeMs;
-    const add = (family, reason) => candidates.push({ path: f.path, family, kind: "file", tier: "safe-auto", reason, bytes: f.bytes });
-    if (NEVER_BASENAMES.has(f.name)) continue;
-    if (f.path.replace(/\\/g, "/").startsWith(headTsPrefix) && !f.name.startsWith(".")) {
-      if (age > HEAD_TS_STALE_MS) add("head-ts", `stale throttle stamp (${days(age)} old)`);
-      continue;
-    }
-  }
   if (snap.syncQueueSlugs === null) {
     for (const f of snap.planMdFiles) {
       if (now - f.mtimeMs <= PLAN_ADVISORY_AGE_MS) continue;
@@ -4151,14 +4176,6 @@ function syncedPlanMetaEntry(meta, project2, slug, hash) {
   const entry = meta[metaKey(project2, slug)];
   return Boolean(entry?.hash === hash && entry.syncedAt);
 }
-function readProject(repoRoot) {
-  try {
-    const cfg = JSON.parse((0, import_node_fs5.readFileSync)((0, import_node_path5.join)(repoRoot, ".mmi", "config.json"), "utf8"));
-    if (typeof cfg.project === "string" && cfg.project.trim()) return cfg.project.trim();
-  } catch {
-  }
-  return void 0;
-}
 function readPlanMeta(plansRoot) {
   try {
     return parseMeta((0, import_node_fs5.readFileSync)((0, import_node_path5.join)(plansRoot, ".plan-meta.json"), "utf8"));
@@ -4196,7 +4213,7 @@ function physicalPlanCandidateStillAllowed(candidatePath, repoAnchor, lstat = im
   }
 }
 function formatScratchGcPlan(plan, applied, applyResult) {
-  if (plan.candidates.length === 0) return "scratch GC: nothing to prune \u2014 local saga/plan scratch is clean.";
+  if (plan.candidates.length === 0) return "scratch GC: nothing to prune \u2014 local scratch is clean.";
   const lines = [];
   const bytes = applyResult?.bytes ?? plan.safeAuto.reduce((n, c) => n + c.bytes, 0);
   const safeCount = applyResult ? applyResult.pruned.length : plan.safeAuto.length;
@@ -4240,34 +4257,22 @@ function treeOlderThan(root, now, floor) {
   }
   return true;
 }
-function applyScratchGc(plan, mmiRoot, now = Date.now()) {
+function applyScratchGc(plan, repoRoot, now = Date.now(), project2) {
   const result = { pruned: [], skipped: 0, bytes: 0 };
   let repoAnchor;
-  let anchor;
   try {
-    repoAnchor = (0, import_node_fs5.realpathSync)((0, import_node_path5.dirname)(mmiRoot)).replace(/\\/g, "/").replace(/\/+$/, "");
+    repoAnchor = (0, import_node_fs5.realpathSync)(repoRoot).replace(/\\/g, "/").replace(/\/+$/, "");
   } catch {
     return result;
   }
-  try {
-    anchor = (0, import_node_fs5.realpathSync)(mmiRoot).replace(/\\/g, "/").replace(/\/+$/, "");
-  } catch {
-    anchor = void 0;
-  }
   for (const c of plan.safeAuto) {
     try {
       const real = (0, import_node_fs5.realpathSync)(c.path).replace(/\\/g, "/");
-      const rootScoped = c.family === "scratch-dir" || c.family === "scratch-file" || c.family === "plan";
-      if (!rootScoped && !anchor) {
+      if (!pathContained(real, repoAnchor) || !rootCandidateStillAllowed(c, repoAnchor)) {
         result.skipped += 1;
         continue;
       }
-      const containment = rootScoped ? repoAnchor : anchor;
-      if (!containment || !pathContained(real, containment) || rootScoped && !rootCandidateStillAllowed(c, repoAnchor)) {
-        result.skipped += 1;
-        continue;
-      }
-      if (rootScoped && trackedPathStatus(c, repoAnchor) !== false) {
+      if (trackedPathStatus(c, repoAnchor) !== false) {
         result.skipped += 1;
         continue;
       }
@@ -4298,14 +4303,13 @@ function applyScratchGc(plan, mmiRoot, now = Date.now()) {
           result.skipped += 1;
           continue;
         }
-        const project2 = readProject(repoAnchor);
         const meta = readPlanMeta(plansRoot);
         if (!meta || !syncedPlanMetaEntry(meta, project2, slug, currentHash)) {
           result.skipped += 1;
           continue;
         }
       }
-      const floor = c.family === "head-ts" ? HEAD_TS_STALE_MS : c.family === "plan" ? PLAN_ADVISORY_AGE_MS : c.family === "scratch-dir" || c.family === "scratch-file" ? ROOT_SCRATCH_STALE_MS : 0;
+      const floor = c.family === "plan" ? PLAN_ADVISORY_AGE_MS : c.family === "scratch-dir" || c.family === "scratch-file" ? ROOT_SCRATCH_STALE_MS : 0;
       if (floor > 0 && now - st.mtimeMs <= floor) {
         result.skipped += 1;
         continue;
@@ -4389,8 +4393,7 @@ function rootScratchDirSnapshot(root, readdir, stat) {
 function collectScratchSnapshot(repoRoot, deps = {}) {
   const readdir = deps.readdir ?? import_node_fs5.readdirSync;
   const stat = deps.stat ?? import_node_fs5.statSync;
-  const readFile3 = deps.readFile ?? import_node_fs5.readFileSync;
-  const mmiRoot = (0, import_node_path5.join)(repoRoot, ".mmi");
+  const readFile2 = deps.readFile ?? import_node_fs5.readFileSync;
   const plansRoot = (0, import_node_path5.join)(repoRoot, "plans");
   const rootScratchFiles = [];
   try {
@@ -4414,20 +4417,6 @@ function collectScratchSnapshot(repoRoot, deps = {}) {
     }
   } catch {
   }
-  const mmiFiles = [];
-  try {
-    for (const ent of readdir(mmiRoot, { recursive: true, withFileTypes: true })) {
-      if (!ent.isFile()) continue;
-      const dir = ent.parentPath ?? ent.path ?? mmiRoot;
-      const full = (0, import_node_path5.join)(dir, ent.name);
-      try {
-        const st = stat(full);
-        mmiFiles.push({ path: full, dir, name: ent.name, mtimeMs: st.mtimeMs, bytes: st.size });
-      } catch {
-      }
-    }
-  } catch {
-  }
   const planMdFiles = [];
   try {
     for (const ent of readdir(plansRoot, { withFileTypes: true })) {
@@ -4435,7 +4424,7 @@ function collectScratchSnapshot(repoRoot, deps = {}) {
       const full = (0, import_node_path5.join)(plansRoot, ent.name);
       try {
         const st = stat(full);
-        const raw = readFile3(full, "utf8");
+        const raw = readFile2(full, "utf8");
         planMdFiles.push({ path: full, dir: plansRoot, name: ent.name, mtimeMs: st.mtimeMs, bytes: st.size, kind: "file", hash: hashContent(normalizeEol(raw)) });
       } catch {
       }
@@ -4444,20 +4433,15 @@ function collectScratchSnapshot(repoRoot, deps = {}) {
   }
   let planMeta = {};
   try {
-    planMeta = parseMeta(readFile3((0, import_node_path5.join)(plansRoot, ".plan-meta.json"), "utf8"));
+    planMeta = parseMeta(readFile2((0, import_node_path5.join)(plansRoot, ".plan-meta.json"), "utf8"));
   } catch {
     planMeta = {};
   }
-  let project2;
-  try {
-    const cfg = JSON.parse(readFile3((0, import_node_path5.join)(repoRoot, ".mmi", "config.json"), "utf8"));
-    if (typeof cfg.project === "string" && cfg.project.trim()) project2 = cfg.project.trim();
-  } catch {
-  }
+  const project2 = deps.project?.trim() || void 0;
   const syncQueueSlugs = (() => {
     let queueRaw;
     try {
-      queueRaw = readFile3((0, import_node_path5.join)(plansRoot, ".sync-queue.json"), "utf8");
+      queueRaw = readFile2((0, import_node_path5.join)(plansRoot, ".sync-queue.json"), "utf8");
     } catch (e) {
       const code = typeof e === "object" && e && "code" in e ? String(e.code ?? "") : "";
       return code === "ENOENT" || code === "ENOTDIR" ? /* @__PURE__ */ new Set() : null;
@@ -4470,7 +4454,7 @@ function collectScratchSnapshot(repoRoot, deps = {}) {
       return null;
     }
   })();
-  return { repoRoot, mmiRoot, mmiFiles, rootScratchFiles, planMdFiles, planMeta, project: project2, syncQueueSlugs };
+  return { repoRoot, rootScratchFiles, planMdFiles, planMeta, project: project2, syncQueueSlugs };
 }
 
 // src/repo-runtime-state.ts
@@ -5062,7 +5046,6 @@ async function moveBoardItem(options, deps = {}) {
   const lookup = await fetchIssueProjectItem(client, cfg, selector);
   const item = lookup.item;
   if (!item) throw new Error(`${selector.repo}#${selector.number} is not on this project board`);
-  if (item.contentType !== "Issue") throw new Error(`${item.ref} is not an issue`);
   const optionId = cfg.statusOptions[options.status];
   try {
     await updateItemSingleSelect(client, cfg.projectId, item.itemId, cfg.statusFieldId, optionId);
@@ -5252,6 +5235,36 @@ async function setBoardItemPriority(client, cfg, itemId, priority) {
   await updateItemSingleSelect(client, cfg.projectId, itemId, cfg.priorityFieldId, optionId);
   return cliPriorityToFieldName(priority);
 }
+var defaultRetrySleep = (ms) => new Promise((resolve6) => setTimeout(resolve6, ms));
+async function resolveProjectItemIdWithRetry(client, cfg, selector, opts = {}) {
+  const attempts = Math.max(1, opts.attempts ?? 5);
+  const delayMs = opts.delayMs ?? 300;
+  const sleep = opts.sleep ?? defaultRetrySleep;
+  for (let attempt = 0; attempt < attempts; attempt += 1) {
+    const itemId = (await fetchIssueProjectItem(client, cfg, selector)).item?.itemId;
+    if (itemId) return itemId;
+    if (attempt < attempts - 1) await sleep(delayMs * (attempt + 1));
+  }
+  return void 0;
+}
+async function setBoardPriorityForSelector(options, deps = {}) {
+  const cfg = resolveBoardConfig(options.config);
+  if (!isPriorityFieldConfigured(cfg)) {
+    throw new Error("priority field is not configured in Hub registry META (priorityFieldId + priorityOptions)");
+  }
+  const client = deps.client ?? defaultGitHubClient();
+  const itemId = await resolveProjectItemIdWithRetry(client, cfg, options.selector, options.retry);
+  if (!itemId) {
+    throw new Error(
+      `issue #${options.selector.number} is not on the ${options.selector.repo} board yet (no Project v2 item) \u2014 add it to the board first, then retry`
+    );
+  }
+  const priority = await setBoardItemPriority(client, cfg, itemId, options.priority);
+  if (!priority) {
+    throw new Error("priority field is not configured in Hub registry META (priorityFieldId + priorityOptions)");
+  }
+  return { ref: `${options.selector.repo}#${options.selector.number}`, itemId, priority };
+}
 async function backfillBoardPriorities(options, deps = {}) {
   const cfg = resolveBoardConfig(options.config);
   if (!isPriorityFieldConfigured(cfg)) {
@@ -5872,6 +5885,8 @@ function parseGhPrChecksResult(stdout, stderr) {
 }
 var PR_CHECKS_POLL_MS = 3e4;
 var PR_CHECKS_TIMEOUT_MS = 10 * 6e4;
+var PR_CHECKS_SUCCESS_CONFIRMATIONS = 2;
+var PR_CHECKS_CONFIRM_MS = 5e3;
 async function waitForPrChecks(deps) {
   const { policy, reason } = await deps.resolvePolicy();
   if (policy === "no-ci") {
@@ -5880,10 +5895,20 @@ async function waitForPrChecks(deps) {
   const now = deps.now ?? (() => Date.now());
   const deadline = now() + PR_CHECKS_TIMEOUT_MS;
   let lastDetail = "pending";
+  let successStreak = 0;
   while (now() < deadline) {
     const state = await deps.pollChecks();
-    if (state === "success") return { policy, status: "success", detail: "checks-success" };
     if (state === "failure") return { policy, status: "failure", detail: lastDetail };
+    if (state === "success") {
+      successStreak += 1;
+      if (successStreak >= PR_CHECKS_SUCCESS_CONFIRMATIONS) {
+        return { policy, status: "success", detail: "checks-success" };
+      }
+      lastDetail = "confirming-success";
+      await deps.sleep(PR_CHECKS_CONFIRM_MS);
+      continue;
+    }
+    successStreak = 0;
     if (state === "no-checks-reported") {
       lastDetail = "no-checks-reported (waiting for workflow to queue)";
       await deps.sleep(PR_CHECKS_POLL_MS);
@@ -6065,6 +6090,10 @@ var MANAGED_GITIGNORE_LINES = [
   "docs/superpowers/",
   ".playwright-mcp/",
   ".claude/worktrees/",
+  // #2321 doctrine: the canonical worktree home is the SIBLING `../mmi-worktrees/<branch>` (outside the tree,
+  // via `mmi-cli worktree create`), so a repo-local `.worktrees/` is NOT un-ignored org-wide — `mmi-cli
+  // doctor` flags one explicitly instead (buildRepoLocalWorktreeCheck) rather than baking the fallback path
+  // into every repo's .gitignore.
   ".aws-sam/",
   "/*.png",
   // Runtime secrets/config are vault-only (AGENTS.md "Privileged ops") — never commit a local .env. The
@@ -6329,10 +6358,10 @@ function labelsToPrune(orgLabelNames) {
   const org = new Set(orgLabelNames);
   return GITHUB_DEFAULT_LABELS.filter((name) => !org.has(name));
 }
-function resolveSeedContent(seed, vars, readFile3) {
-  if (seed.source === "self") return readFile3(seed.target);
+function resolveSeedContent(seed, vars, readFile2) {
+  if (seed.source === "self") return readFile2(seed.target);
   if (seed.source.startsWith("seed:")) {
-    const tmpl = readFile3(`skills/bootstrap/seeds/${seed.source.slice("seed:".length)}`);
+    const tmpl = readFile2(`skills/bootstrap/seeds/${seed.source.slice("seed:".length)}`);
     return tmpl == null ? null : renderSeed(tmpl, vars);
   }
   return null;
@@ -6496,6 +6525,23 @@ function decideFanoutPrAction(openPrs) {
   }
   return { action: "create" };
 }
+function decideSeedDelivery(branchRules) {
+  const rules2 = Array.isArray(branchRules) ? branchRules : [];
+  const types = new Set(
+    rules2.map((r) => r?.type).filter((t) => typeof t === "string")
+  );
+  const gating = ["pull_request", "required_status_checks"].filter((t) => types.has(t));
+  if (gating.length) return { mode: "pr", reason: `base branch is protected (${gating.join(", ")}) \u2014 seed via a branch + PR` };
+  return { mode: "direct", reason: "base branch is unprotected \u2014 direct PUT is safe" };
+}
+function planSeedDelivery(branchRules, slug, baseBranch) {
+  const decision = decideSeedDelivery(branchRules);
+  if (decision.mode === "pr") {
+    const branch = `bootstrap-seed-${slug}`;
+    return { mode: "pr", ref: branch, branch, reason: decision.reason };
+  }
+  return { mode: "direct", ref: baseBranch, reason: decision.reason };
+}
 function contentPutArgs(repo, path2, content, branch, sha) {
   const args = [
     "api",
@@ -8599,7 +8645,7 @@ async function collectWaveStatus(deps) {
     } catch {
       dirty = true;
     }
-    const headText = await deps.fetchSagaHeadText?.(wt.branch).catch(() => void 0);
+    const headText = await deps.fetchHeadText?.(wt.branch).catch(() => void 0);
     rows.push({
       path: wt.path,
       branch: wt.branch,
@@ -8641,12 +8687,11 @@ async function executeWaveLand(plan, deps, opts = { preserveWorktree: true }) {
 }
 
 // src/attach-to-project.ts
-async function resolveAutoAddBoardAttach(client, cfg, selector, priority, warn = (m) => process.stderr.write(m)) {
+async function resolveAutoAddBoardAttach(client, cfg, selector, priority, warn = (m) => process.stderr.write(m), retry = {}) {
   let projectItemId;
   try {
     const boardCfg = resolveBoardConfig(cfg);
-    const lookup = await fetchIssueProjectItem(client, boardCfg, selector);
-    projectItemId = lookup.item?.itemId;
+    projectItemId = await resolveProjectItemIdWithRetry(client, boardCfg, selector, retry);
   } catch (e) {
     warn(`warning: issue #${selector.number} board item lookup failed after auto-add: ${e.message}
 `);
@@ -8671,7 +8716,7 @@ async function resolveAutoAddBoardAttach(client, cfg, selector, priority, warn =
 }
 
 // src/gh-create.ts
-var import_promises2 = require("node:fs/promises");
+var import_promises = require("node:fs/promises");
 var import_node_os3 = require("node:os");
 var import_node_path12 = require("node:path");
 var import_node_crypto3 = require("node:crypto");
@@ -8712,9 +8757,13 @@ async function bodyArgsViaFile(args, deps = {}) {
   const i = args.indexOf("--body");
   if (i === -1 || i + 1 >= args.length) return { args, cleanup: async () => {
   } };
-  const write = deps.write ?? import_promises2.writeFile;
-  const remove = deps.remove ?? import_promises2.unlink;
-  const file = (0, import_node_path12.join)(deps.dir ?? (0, import_node_os3.tmpdir)(), `mmi-gh-body-${process.pid}-${(0, import_node_crypto3.randomBytes)(4).toString("hex")}.md`);
+  const write = deps.write ?? import_promises.writeFile;
+  const remove = deps.remove ?? import_promises.unlink;
+  const ensureDir = deps.ensureDir ?? import_promises.mkdir;
+  const dir = deps.dir ?? (0, import_node_os3.tmpdir)();
+  const file = (0, import_node_path12.join)(dir, `mmi-gh-body-${process.pid}-${(0, import_node_crypto3.randomBytes)(4).toString("hex")}.md`);
+  await ensureDir((0, import_node_path12.dirname)(file), { recursive: true }).catch(() => {
+  });
   await write(file, args[i + 1], "utf8");
   return {
     args: [...args.slice(0, i), "--body-file", file, ...args.slice(i + 2)],
@@ -9133,6 +9182,9 @@ function parseNpmVersion(stdout) {
   const v = stdout.trim();
   return /^\d+\.\d+\.\d+(-[0-9A-Za-z.-]+)?$/.test(v) ? v : void 0;
 }
+function staleTrainCliMessage(report, commandName) {
+  return `running mmi-cli ${report.currentVersion} is stale against released ${report.releasedVersion}; this is recoverable \u2014 run \`mmi-cli doctor --apply --no-repo-writes\` to update to ${report.releasedVersion}, then rerun ${commandName} so it uses the current train path`;
+}
 function versionAutoUpdateAction(report, hasPluginRoot) {
   if (report.ok || report.staleAgainst !== "released") return "none";
   return hasPluginRoot ? "plugin-pull" : "npm";
@@ -9296,14 +9348,6 @@ function trainPlanTargetsFromTags(tags, explicitRaw) {
   }
   return targets;
 }
-function stagePlan(stage2 = {}, stops = true) {
-  return [
-    ...stops ? [{ label: "force-kill previous local stage", command: "mmi-cli stage stop --apply" }] : [],
-    { label: "run local build", command: stage2.build || "(no stage.build configured)" },
-    { label: "start local stage", command: stage2.up || "(no stage.up configured)" },
-    { label: "check health", command: stage2.healthUrl ? `curl --fail ${stage2.healthUrl}` : "(no stage.healthUrl configured)" }
-  ];
-}
 function derivedStagePlan(derived, shell2, stops = true) {
   const { port } = derived;
   const envOrder = ["MMI_STAGE", "MMI_PORT", "COMPOSE_PROFILES"];
@@ -9463,55 +9507,8 @@ function deriveStage(inputs) {
 function stageUrlForPort(port) {
   return `http://127.0.0.1:${port}/`;
 }
-var POSIX_ONLY = [
-  /(^|[^&|])&&([^&]|$)/,
-  // && chaining (cmd.exe uses it too, but PowerShell <7 / the typical agent shell does not)
-  /\|\|/,
-  // || chaining
-  // `VAR=value cmd` LEADING env prefix only — anchored to a command boundary (start-of-string or after a
-  // ; & | separator) so it never fires on a flag value mid-command (`-e DEBUG=true app`, `--env X=y svc`),
-  // which are valid cross-shell. The value excludes separators so it can't span past the command boundary.
-  /(?:^|[;&|])\s*[A-Za-z_][A-Za-z0-9_]*=[^\s;&|]+\s+\S/,
-  /(^|[\s;&|])(cp|rm|mv|ln|cat|touch|export)\s/
-  // bare POSIX file/env builtins
-];
-function looksPosixOnly(command) {
-  if (!command?.trim()) return false;
-  return POSIX_ONLY.some((re) => re.test(command));
-}
-function stalePosixFields(config, shell2) {
-  if (shell2 !== "powershell") return [];
-  const fields = [];
-  if (looksPosixOnly(config?.build)) fields.push("build");
-  if (looksPosixOnly(config?.up)) fields.push("up");
-  return fields;
-}
-function sanitizeLocalStage(local, stale) {
-  if (!stale.length) return local;
-  const clean3 = { ...local };
-  for (const field of stale) delete clean3[field];
-  return clean3;
-}
-function staleNote(staleFields, outcome) {
-  const list = staleFields.join(", ");
-  const plural = staleFields.length > 1 ? "fields" : "field";
-  return `local .mmi stage ${plural} ${list} ${staleFields.length > 1 ? "are" : "is"} POSIX-only and unusable on PowerShell \u2014 ${outcome}`;
-}
 function decideStage(inputs) {
-  const { local, shell: shell2, registry: registry2, hasCompose, hasEnvExample } = inputs;
-  const staleFields = stalePosixFields(local, shell2);
-  const stale = staleFields.length > 0;
-  const upStale = staleFields.includes("up");
-  if (local?.up?.trim() && !upStale) {
-    if (!stale) return { source: "local", config: local };
-    return {
-      source: "local",
-      config: sanitizeLocalStage(local, staleFields),
-      staleIgnored: true,
-      staleFields,
-      gap: staleNote(staleFields, `kept the cross-shell parts of the local recipe and ignored ${staleFields.join(", ")}`)
-    };
-  }
+  const { registry: registry2, hasCompose, hasEnvExample } = inputs;
   const deriveInputs = {
     portRange: registry2.portRange,
     deployModel: registry2.deployModel,
@@ -9519,19 +9516,10 @@ function decideStage(inputs) {
     hasEnvExample
   };
   const derived = deriveStage(deriveInputs);
-  if (derived) {
-    return {
-      source: "derived",
-      derived,
-      registryError: registry2.error,
-      staleIgnored: stale || void 0,
-      staleFields: stale ? staleFields : void 0
-    };
-  }
+  if (derived) return { source: "derived", derived, registryError: registry2.error };
   const registryGap = registry2.error ? `Hub registry read failed (${registry2.error}) \u2014 cannot derive a default local stage` : null;
-  const baseGap = registryGap ?? deriveStageGap(deriveInputs);
-  const gap = stale ? `local .mmi stage recipe is POSIX-only (${staleFields.join(", ")}) and unusable on PowerShell; ${baseGap ?? "no registry-derived default available"}` : baseGap ?? "no stage.up configured and no registry-derived default available";
-  return { source: "none", gap, staleIgnored: stale || void 0, staleFields: stale ? staleFields : void 0, registryError: registry2.error };
+  const gap = registryGap ?? deriveStageGap(deriveInputs) ?? "no registry-derived default available";
+  return { source: "none", gap, registryError: registry2.error };
 }
 
 // src/stage-live.ts
@@ -9661,6 +9649,14 @@ function requireValue(value, label) {
   if (!value) throw new Error(`${label} could not be resolved`);
   return value;
 }
+function planTrainApplyRepoGuard(applyRepo, cwdRepo, rerun) {
+  if (cwdRepo && cwdRepo.toLowerCase() === applyRepo.toLowerCase()) return { ok: true };
+  const where = cwdRepo ? `this checkout is ${cwdRepo}` : "this checkout could not be identified";
+  return {
+    ok: false,
+    message: `--apply runs from the current checkout, not --repo (${where}). cd into the ${applyRepo} checkout and rerun without --repo: ${rerun}`
+  };
+}
 async function resolveFoldPaths(deps, model) {
   if (model === "hub-serverless") {
     return (await deps.run("node", ["scripts/release-distribution.mjs", "changed-files"])).split("\n").map((s) => s.trim()).filter(Boolean);
@@ -9672,12 +9668,17 @@ async function resolveFoldPaths(deps, model) {
   }
   return ["package.json", "package-lock.json"];
 }
+async function installAppFoldDeps(deps) {
+  const hasLock = await deps.run("git", ["cat-file", "-e", "HEAD:package-lock.json"]).then(() => true).catch(() => false);
+  await deps.run("npm", hasLock ? ["ci"] : ["install"]);
+}
 async function foldReleaseVersion(deps, model, tag, foldPaths) {
   if (foldPaths.length === 0) return "no version manifest to fold \u2014 the tag is the version";
   const version = tag.replace(/^v/, "");
   if (model === "hub-serverless") {
     await deps.run("node", ["scripts/release-distribution.mjs", "prepare", version]);
   } else {
+    await installAppFoldDeps(deps);
     await deps.run("npm", ["version", version, "--no-git-tag-version", "--allow-same-version"]);
   }
   for (const path2 of foldPaths) {
@@ -9981,8 +9982,8 @@ async function correlateRun(deps, args) {
 function correlateTenantRun(deps, since, titleIncludes) {
   return correlateRun(deps, { workflow: "tenant-deploy.yml", since, mode: "dispatch", titleIncludes });
 }
-function correlatePublishRun(deps, since) {
-  return correlateRun(deps, { workflow: "tenant-publish.yml", since, mode: "dispatch" });
+function correlatePublishRun(deps, since, titleIncludes) {
+  return correlateRun(deps, { workflow: "tenant-publish.yml", since, mode: "dispatch", titleIncludes });
 }
 function correlateControlRun(deps, since, titleIncludes) {
   return correlateRun(deps, { workflow: "tenant-control.yml", since, mode: "dispatch", titleIncludes });
@@ -10268,7 +10269,7 @@ async function dispatchTenantPublish(deps, ctx, stage2, ref, watch, dispatchFail
       deployStatus: "failure"
     };
   }
-  const { runId, runUrl } = await correlatePublishRun(deps, since);
+  const { runId, runUrl } = await correlatePublishRun(deps, since, [ctx.slug, stage2]);
   const deployStatus = watch ? await watchTenantRun(deps, runId) : "pending";
   return { note: `dispatched tenant-publish.yml (slug=${ctx.slug}, ref=${ref}, stage=${stage2})`, runId, runUrl, deployStatus };
 }
@@ -10408,7 +10409,7 @@ async function pushRcAlignment(deps) {
     await deps.run("git", ["push", "origin", "main:rc"]);
     return "origin/rc aligned to the released main";
   } catch (e) {
-    return `rc alignment push failed \u2014 align manually with \`git push origin main:rc\`: ${e instanceof Error ? e.message : String(e)}`;
+    return `rc alignment push failed \u2014 do NOT bare-push rc (Step 5 forbids it; branch protection rejects it). rc realigns on the next \`mmi-cli rcand\`, or rerun via the train: ${e instanceof Error ? e.message : String(e)}`;
   }
 }
 async function runTrainApplyPipeline(mode, input) {
@@ -11612,9 +11613,7 @@ async function ensurePortRangeAtomic(repo, path2, allocate, opts = {}) {
 var OWNER = "mutmutco";
 var LOCKED_APP = "mmi-github-app";
 var OVERGRANT_ROLES = /* @__PURE__ */ new Set(["admin", "maintain"]);
-var REQUIRED_DATA_ACCESS = {
-  "mutmutco/MM-Chat": [{ name: "kb-projection-reader", dbRole: "kb_reader", vaultParamNeedle: "KB_READ_DB_URL" }]
-};
+var REQUIRED_DATA_ACCESS = {};
 function lockedBranches(repoClass, releaseTrack) {
   if (releaseTrack) return branchesForTrack(releaseTrack);
   return repoClass === "content" ? ["main"] : ["development", "rc", "main"];
@@ -14326,7 +14325,7 @@ async function secretsUse(deps, key, opts) {
         `  \u2022 Keyless run: \`mmi-cli secrets use ${key}${opts.slug ? ` --slug ${opts.slug}` : ""} -- <command>\` injects it into the command's env (never printed). A granted non-master can USE an org secret this way.`,
         `  \u2022 Runtime / agents: read it keylessly at runtime via the box's OIDC role. Never bake it into an image or commit it.`,
         `  \u2022 CI (GitHub Actions): the workflow assumes its OIDC role and runs \`aws ssm get-parameter --with-decryption --name ${path2}\` \u2014 no GitHub secret.`,
-        tier === "project" ? "  \u2022 Bare keys default to dev/. Use an explicit rc/<KEY> or main/<KEY> when the stage needs its own value." : "  \u2022 For your own product repo, project-admins self-serve this stage key. Org-infra/cross-slug keys remain master-gated unless granted."
+        tier === "project" ? "  \u2022 One stageless value per repo (/mmi-future/<slug>/<KEY>) \u2014 no dev/rc/main copies. Project-admins self-serve their repo keys." : "  \u2022 Org-infra/cross-slug keys remain master-gated unless granted; project-admins self-serve their own repo keys."
       ].join("\n")
     );
     return;
@@ -14620,7 +14619,7 @@ function registerEdgeCommands(program3) {
 // src/doctor-run.ts
 var import_node_fs17 = require("node:fs");
 var import_node_child_process10 = require("node:child_process");
-var import_promises3 = require("node:fs/promises");
+var import_promises2 = require("node:fs/promises");
 var import_node_path17 = require("node:path");
 var import_node_os6 = require("node:os");
 
@@ -14945,6 +14944,15 @@ function buildGitignoreManagedBlockCheck(input) {
   const { added, removed, seeded } = diffManagedGitignoreBlock(input.content);
   return { ...base, ok: false, contentToWrite: content, added, removed, seeded };
 }
+var REPO_LOCAL_WORKTREE_LABEL = "worktree location (canonical sibling path)";
+var REPO_LOCAL_WORKTREE_FIX = "repo-local `.worktrees/` is not the canonical worktree path (#2321) \u2014 use `mmi-cli worktree create <branch>`, which provisions the sibling `../mmi-worktrees/<branch>` outside the tree. Move your work there, then remove the in-repo `.worktrees/`.";
+function buildRepoLocalWorktreeCheck(input) {
+  return {
+    ok: !(input.isOrgRepo && input.hasRepoLocalWorktrees),
+    label: REPO_LOCAL_WORKTREE_LABEL,
+    fix: REPO_LOCAL_WORKTREE_FIX
+  };
+}
 var SCRATCH_GC_LABEL = "scratch housekeeping (tmp/, plans/, browser artifacts)";
 var SCRATCH_GC_FIX = "run `mmi-cli gc --scratch --dry-run` to inspect; run `mmi-cli gc --scratch --apply` to prune safe scratch; for kept plans run `mmi-cli northstar status` or `mmi-cli northstar sync --wait` first";
 function buildScratchGcCheck(plan) {
@@ -15118,10 +15126,6 @@ var OPENCODE_WORKFLOW_COMMANDS = [
   "release",
   "hotfix",
   "bootstrap",
-  "grind",
-  "build",
-  "handoff",
-  "coop",
   "browser-automation"
 ];
 function opencodeCommandDescription(command) {
@@ -15377,6 +15381,21 @@ function buildOpencodeVersionCheck(input) {
   }
   return { ...base, ok: false, installedVersion: input.installedVersion, releasedVersion: input.releasedVersion };
 }
+function pickOpencodeActiveVersion(input) {
+  for (const value of [input.envStamp, input.cacheVersion, input.diskVersion]) {
+    const trimmed = value?.trim();
+    if (trimmed) return trimmed;
+  }
+  return void 0;
+}
+function planOpencodePluginCacheQuarantine(input) {
+  if (!input.cacheExists) return { quarantine: false };
+  if (!isSemverVersion2(input.cacheVersion) || !isSemverVersion2(input.releasedVersion)) return { quarantine: false };
+  if (compareVersions(input.cacheVersion, input.releasedVersion) < 0) {
+    return { quarantine: true, cacheVersion: input.cacheVersion, releasedVersion: input.releasedVersion };
+  }
+  return { quarantine: false };
+}
 var OPENCODE_HOOK_ACTIVE_LABEL = "OpenCode MMI adapter hooks active (shell.env stamp)";
 function buildOpencodeHookActiveCheck(input) {
   const base = { ok: true, label: OPENCODE_HOOK_ACTIVE_LABEL, fix: OPENCODE_RECOVERY };
@@ -16381,8 +16400,59 @@ async function forceInstallOpencodeMmiPlugins(snapshot, log) {
     return false;
   }
 }
+function opencodePackagesRoot() {
+  return (0, import_node_path17.join)((0, import_node_os6.homedir)(), ".cache", "opencode", "packages", "@mutmutco");
+}
+function opencodePluginCacheDirs() {
+  const root = opencodePackagesRoot();
+  try {
+    return (0, import_node_fs17.readdirSync)(root, { withFileTypes: true }).filter((e) => e.isDirectory() && e.name.startsWith("opencode-mmi@") && !e.name.startsWith(".")).map((e) => (0, import_node_path17.join)(root, e.name));
+  } catch {
+    return [];
+  }
+}
+function readOpencodeCacheDirVersion(cacheDir) {
+  try {
+    const parsed = JSON.parse(
+      (0, import_node_fs17.readFileSync)((0, import_node_path17.join)(cacheDir, "node_modules", "@mutmutco", "opencode-mmi", "package.json"), "utf8")
+    );
+    return typeof parsed.version === "string" && parsed.version.trim() ? parsed.version.trim() : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function readOpencodeLoadedCacheVersion() {
+  const versions = opencodePluginCacheDirs().map(readOpencodeCacheDirVersion).filter((v) => Boolean(v));
+  if (!versions.length) return void 0;
+  return versions.reduce((lowest, v) => compareVersions(v, lowest) < 0 ? v : lowest);
+}
+function quarantineStaleOpencodePluginCaches(releasedVersion, log) {
+  let moved = false;
+  const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+  for (const cacheDir of opencodePluginCacheDirs()) {
+    const plan = planOpencodePluginCacheQuarantine({
+      cacheExists: true,
+      cacheVersion: readOpencodeCacheDirVersion(cacheDir),
+      releasedVersion
+    });
+    if (!plan.quarantine) continue;
+    try {
+      const quarantineRoot = (0, import_node_path17.join)(opencodePackagesRoot(), ".mmi-quarantine", stamp);
+      (0, import_node_fs17.mkdirSync)(quarantineRoot, { recursive: true });
+      (0, import_node_fs17.renameSync)(cacheDir, (0, import_node_path17.join)(quarantineRoot, (0, import_node_path17.basename)(cacheDir)));
+      log(`  \u21BB quarantined stale OpenCode plugin cache ${plan.cacheVersion} (< ${plan.releasedVersion}) \u2014 OpenCode reinstalls the current adapter on next start`);
+      moved = true;
+    } catch {
+    }
+  }
+  return moved;
+}
 function opencodeInstalledVersionForDoctor() {
-  return process.env.MMI_OPENCODE_PLUGIN_VERSION || readOpencodeAdapterDiskVersion();
+  return pickOpencodeActiveVersion({
+    envStamp: process.env.MMI_OPENCODE_PLUGIN_VERSION,
+    cacheVersion: readOpencodeLoadedCacheVersion(),
+    diskVersion: readOpencodeAdapterDiskVersion()
+  });
 }
 function opencodePluginVersionsForReport() {
   return [process.env.MMI_OPENCODE_PLUGIN_VERSION, readOpencodeAdapterDiskVersion()].filter((v) => Boolean(v));
@@ -16820,6 +16890,10 @@ async function runDoctor(opts, io = consoleIo, readOrigin) {
     }
   }
   checks.push(gitignoreCheck);
+  checks.push(buildRepoLocalWorktreeCheck({
+    isOrgRepo,
+    hasRepoLocalWorktrees: (0, import_node_fs17.existsSync)((0, import_node_path17.join)(process.cwd(), ".worktrees"))
+  }));
   let driftCheck = buildPluginConfigDriftCheck({ isOrgRepo, installed, surface });
   if (!driftCheck.ok && driftCheck.recordsToWrite && repairLocal) {
     if (backupAndWriteInstalledPlugins(driftCheck.recordsToWrite, driftCheck.pluginId)) {
@@ -16906,8 +16980,10 @@ async function runDoctor(opts, io = consoleIo, readOrigin) {
       releasedVersion
     });
     if (!opencodeVersionCheck.ok && repairFull) {
-      if (await forceInstallOpencodeMmiPlugins(openCodeConfigSnapshot, (m) => io.err(m))) {
-        opencodeInstalledVersion = readOpencodeAdapterDiskVersion() ?? opencodeInstalledVersion;
+      const refreshed = await forceInstallOpencodeMmiPlugins(openCodeConfigSnapshot, (m) => io.err(m));
+      const quarantined = quarantineStaleOpencodePluginCaches(releasedVersion, (m) => io.err(m));
+      if (refreshed || quarantined) {
+        opencodeInstalledVersion = opencodeInstalledVersionForDoctor() ?? opencodeInstalledVersion;
         opencodeVersionCheck = buildOpencodeVersionCheck({
           isOrgRepo,
           installedVersion: opencodeInstalledVersion,
@@ -17080,7 +17156,7 @@ async function runDoctor(opts, io = consoleIo, readOrigin) {
       releasedVersion,
       hubCheckout: hubCheckoutForCursorSeed(),
       execFileP: execFileP2,
-      mkdtemp: (prefix) => (0, import_promises3.mkdtemp)((0, import_node_path17.join)((0, import_node_os6.tmpdir)(), prefix)),
+      mkdtemp: (prefix) => (0, import_promises2.mkdtemp)((0, import_node_path17.join)((0, import_node_os6.tmpdir)(), prefix)),
       log: (m) => io.err(m)
     });
     if (seeded) {
@@ -17323,7 +17399,6 @@ function repoFromSelector(selector) {
 async function loadConfigForBoardSelector(selector, repoOption) {
   return loadConfigForRepo(repoFromSelector(selector) ?? repoOption);
 }
-var DEFAULT_RULES_SOURCE = "https://raw.githubusercontent.com/mutmutco/MMI-Hub/development";
 function renderGcApplyResult(result) {
   const lines = ["gc apply result:"];
   lines.push(`  branches removed: ${result.removedBranches.length ? result.removedBranches.join(", ") : "none"}`);
@@ -17439,65 +17514,11 @@ async function requireFreshTrainCli(commandName) {
     releasedVersion: await fetchNpmReleasedVersion()
   });
   if (report.ok) return;
-  throw new Error(`running mmi-cli ${report.currentVersion} is stale against released ${report.releasedVersion}; run doctor/update first so ${commandName} uses the current train path`);
+  throw new Error(staleTrainCliMessage(report, commandName));
 }
 var program2 = new Command();
 program2.name("mmi-cli").description("MMI Future CLI \u2014 org rules delivery, Jervaise-only continuity. The engine the plugin SessionStart hook drives.").version(resolveClientVersion()).showHelpAfterError("(run `mmi-cli commands` to list every subcommand + its flags, or `mmi-cli commands --json` to ground against it)");
-async function runRulesSync(opts, io = consoleIo) {
-  const cfg = await loadConfig();
-  if (isRulesSource(cfg.orgRulesSource)) {
-    if (!opts.quiet) io.log('mmi-cli rules: source repo (orgRulesSource: "self") \u2014 skipping self-sync');
-    return true;
-  }
-  if (!await isOrgRegisteredRepo(cfg)) {
-    if (!opts.quiet) io.log("mmi-cli rules: not an org repo \u2014 skipping spine delivery");
-    return true;
-  }
-  const base = resolveRulesBase(cfg.orgRulesSource, DEFAULT_RULES_SOURCE);
-  const token = await githubToken();
-  let changed = 0;
-  const files = [
-    "AGENTS.md",
-    "CLAUDE.md",
-    ".claude/settings.json",
-    ".claude/output-styles/mmi-plain.md",
-    ".cursor/rules/mmi-plain-language.mdc",
-    ".cursor/rules/mmi-tool-economy.mdc",
-    ".cursor/rules/mmi-code-economy.mdc"
-  ];
-  const fetched = await Promise.all(files.map(async (file) => {
-    try {
-      const url = `${base}/${file}`;
-      const res = await fetch(url, { headers: rulesSourceAuthHeaders(url, token), signal: AbortSignal.timeout(1e4) });
-      if (!res.ok) throw new Error(`HTTP ${res.status}`);
-      return { file, source: await res.text() };
-    } catch (e) {
-      return { file, error: e.message };
-    }
-  }));
-  const failures = fetched.filter((entry) => "error" in entry);
-  for (const failure of failures) {
-    io.err(`mmi-cli rules: could not fetch ${failure.file} (${failure.error}); left it untouched`);
-  }
-  for (const entry of fetched) {
-    if ("error" in entry) continue;
-    const { file, source } = entry;
-    const current = (0, import_node_fs18.existsSync)(file) ? await (0, import_promises4.readFile)(file, "utf8") : null;
-    if (needsUpdate(source, current)) {
-      const slash = file.lastIndexOf("/");
-      if (slash > 0) (0, import_node_fs18.mkdirSync)(file.slice(0, slash), { recursive: true });
-      await (0, import_promises4.writeFile)(file, normalizeEol(source), "utf8");
-      changed++;
-      if (!opts.quiet) io.log(`mmi-cli rules: updated ${file}`);
-    }
-  }
-  if (!opts.quiet && changed === 0) io.log("mmi-cli rules: up to date");
-  return failures.length === 0;
-}
-var rules = program2.command("rules").description("org rules delivery");
-rules.command("sync").option("--quiet", "stay silent unless something changed or errored").description("fetch the org-delivered files (AGENTS.md / CLAUDE.md / .claude/settings.json / output style / Cursor rule) from MMI-Hub and write them verbatim (org-owned, whole-file)").action(async (opts) => {
-  if (!await runRulesSync(opts)) process.exitCode = 1;
-});
+var rules = program2.command("rules").description("org-managed .gitignore delivery");
 rules.command("gitignore").option("--write", "upsert the managed block into .gitignore (default: check only, non-zero exit on drift)").description("verify (or --write) this repo's org-managed .gitignore block matches the SSOT").action((opts) => {
   const path2 = (0, import_node_path18.join)(process.cwd(), ".gitignore");
   const current = (0, import_node_fs18.existsSync)(path2) ? (0, import_node_fs18.readFileSync)(path2, "utf8") : null;
@@ -17519,30 +17540,6 @@ rules.command("gitignore").option("--write", "upsert the managed block into .git
     console.log("mmi-cli rules gitignore: up to date");
   }
 });
-async function runDocsSync(opts, io = consoleIo) {
-  const ref = await gitOut(["symbolic-ref", "--quiet", "--short", "refs/remotes/origin/HEAD"]);
-  const def = (ref.startsWith("origin/") ? ref.slice("origin/".length) : ref) || "development";
-  await gitOut(["fetch", "origin", def, "--quiet"]);
-  const result = await syncDocs({
-    isDirty: async (f) => await gitOut(["status", "--porcelain", "--", f]) !== "",
-    originContent: async (f) => {
-      try {
-        return (await execFileP2("git", ["show", `origin/${def}:${f}`], { maxBuffer: 10 * 1024 * 1024 })).stdout;
-      } catch {
-        return null;
-      }
-    },
-    localContent: async (f) => (0, import_node_fs18.existsSync)(f) ? await (0, import_promises4.readFile)(f, "utf8") : null,
-    writeDoc: async (f, c) => {
-      await (0, import_promises4.writeFile)(f, c, "utf8");
-    }
-  });
-  for (const f of result.updated) io.log(`mmi-cli docs: updated ${f} (from origin/${def})`);
-  if (!opts.quiet && result.skippedDirty.length) io.log(`mmi-cli docs: kept local edits in ${result.skippedDirty.join(", ")}`);
-  if (!opts.quiet && result.updated.length === 0 && result.skippedDirty.length === 0) io.log("mmi-cli docs: up to date");
-}
-var docs = program2.command("docs").description("repo-owned authoritative docs");
-docs.command("sync").option("--quiet", "stay silent unless something changed or errored").description("refresh README.md / architecture.md from the repo default branch; never clobbers uncommitted edits").action((opts) => runDocsSync(opts));
 program2.command("commands").description("print the command manifest \u2014 every subcommand + its flags (ground against this instead of guessing)").option("--json", "machine-readable JSON: { name, version, tree, index } \u2014 index is a flat list of every leaf command path").action((o) => {
   const manifest = buildCommandManifest(program2);
   consoleIo.log(o.json ? JSON.stringify(manifest, null, 2) : formatManifestHuman(manifest));
@@ -18453,8 +18450,8 @@ issue.command("create").description("create an issue (type \u2192 label) and pri
   let northStarSlug;
   let extraLabels = [];
   try {
-    title = await resolveIssueTitle({ title: o.title, titleFile: o.titleFile }, { readFile: import_promises4.readFile, readStdin });
-    body = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises4.readFile, readStdin });
+    title = await resolveIssueTitle({ title: o.title, titleFile: o.titleFile }, { readFile: import_promises3.readFile, readStdin });
+    body = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises3.readFile, readStdin });
     if (o.northStar !== void 0) {
       northStarSlug = normalizeNorthStarSlug(o.northStar);
       body = appendNorthStarLine(body, northStarSlug);
@@ -18511,6 +18508,20 @@ issue.command("create").description("create an issue (type \u2192 label) and pri
     ...parentLinkFields(parent, parentLinkError)
   }));
 });
+issue.command("view <number>").description("read an issue as structured JSON \u2014 the mmi-cli path for non-board issue reads (#2347)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--json <fields>", "comma-separated gh --json field list (overrides the default field set)").action(async (number, o) => {
+  const n = Number(number);
+  if (!Number.isInteger(n) || n <= 0) return fail("issue view: <number> must be a positive integer");
+  const repo = await resolveRepo(o.repo);
+  if (!repo) return fail("issue view: could not resolve repo (pass --repo <owner/repo>)");
+  const fields = o.json && o.json.trim() ? o.json.trim() : "number,title,state,url,labels,author,assignees,milestone,body";
+  try {
+    const data = await ghJson(["issue", "view", String(n), "--repo", repo, "--json", fields]);
+    console.log(JSON.stringify(data));
+  } catch (e) {
+    const err = e;
+    return fail(`issue view: ${(err.stderr || err.message || String(e)).trim()}`);
+  }
+});
 issue.command("discover-related").description("find related issues for an existing issue and post only high-confidence links").requiredOption("--number <number>", "created issue number").requiredOption("--title <title>", "created issue title").requiredOption("--body <body>", "created issue body").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--json", "print candidates instead of posting").action(async (o) => {
   const number = Number(o.number);
   if (!Number.isInteger(number) || number <= 0) return fail("issue discover-related: --number must be a positive integer");
@@ -18566,7 +18577,7 @@ issue.command("comment <ref>").description("post a Markdown comment to an issue
   }
   let body;
   try {
-    body = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises4.readFile, readStdin });
+    body = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises3.readFile, readStdin });
   } catch (e) {
     return fail(`issue comment: ${e.message}`);
   }
@@ -18628,8 +18639,8 @@ program2.command("report").description("file a friction report on the Hub board
   const targetRepo2 = o.repo ?? HUB_REPO2;
   const sourceRepo = await resolveRepo(void 0);
   try {
-    title = await resolveIssueTitle({ title: o.title, titleFile: o.titleFile }, { readFile: import_promises4.readFile, readStdin });
-    body = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises4.readFile, readStdin });
+    title = await resolveIssueTitle({ title: o.title, titleFile: o.titleFile }, { readFile: import_promises3.readFile, readStdin });
+    body = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises3.readFile, readStdin });
     priority = normalizePriority(o.priority);
     args = buildIssueArgs({
       type: o.type,
@@ -18702,8 +18713,8 @@ program2.command("skill-lesson").description("file a skill-lesson on the Hub boa
   let args;
   try {
     skill = assertSkillName(o.skill);
-    rawBody = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises4.readFile, readStdin });
-    const rawTitle = await resolveIssueTitle({ title: o.title, titleFile: o.titleFile }, { readFile: import_promises4.readFile, readStdin });
+    rawBody = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises3.readFile, readStdin });
+    const rawTitle = await resolveIssueTitle({ title: o.title, titleFile: o.titleFile }, { readFile: import_promises3.readFile, readStdin });
     title = buildSkillLessonTitle(skill, rawTitle);
     priority = normalizePriority(o.priority);
     body = buildSkillLessonBody(rawBody, sourceRepo, pluginSha);
@@ -18754,14 +18765,28 @@ pr.command("create").description("create a PR and print {number,url} JSON").opti
   let body;
   let title;
   try {
-    title = await resolveIssueTitle({ title: o.title, titleFile: o.titleFile }, { readFile: import_promises4.readFile, readStdin });
-    body = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises4.readFile, readStdin });
+    title = await resolveIssueTitle({ title: o.title, titleFile: o.titleFile }, { readFile: import_promises3.readFile, readStdin });
+    body = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises3.readFile, readStdin });
   } catch (e) {
     return fail(`pr create: ${e.message}`);
   }
   const created = await ghCreate(buildPrArgs({ title, body, base: o.base, head: o.head, repo: o.repo }));
   console.log(JSON.stringify(created));
 });
+pr.command("view <number>").description("read a PR as structured JSON (merged state, head/base, URL, merge commit) \u2014 the mmi-cli read path (#2347)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--json <fields>", "comma-separated gh --json field list (overrides the default field set)").action(async (number, o) => {
+  const n = Number(number);
+  if (!Number.isInteger(n) || n <= 0) return fail("pr view: <number> must be a positive integer");
+  const repo = await resolveRepo(o.repo);
+  if (!repo) return fail("pr view: could not resolve repo (pass --repo <owner/repo>)");
+  const fields = o.json && o.json.trim() ? o.json.trim() : "number,title,state,url,isDraft,mergeable,mergedAt,mergeCommit,headRefName,baseRefName,author,labels";
+  try {
+    const data = await ghJson(["pr", "view", String(n), "--repo", repo, "--json", fields]);
+    console.log(JSON.stringify(data));
+  } catch (e) {
+    const err = e;
+    return fail(`pr view: ${(err.stderr || err.message || String(e)).trim()}`);
+  }
+});
 async function listCiWorkflowPaths(cwd = process.cwd()) {
   const wfDir = (0, import_node_path18.join)(cwd, ".github", "workflows");
   if (!(0, import_node_fs18.existsSync)(wfDir)) return [];
@@ -18930,15 +18955,15 @@ async function createDeferredWorktreeStore() {
     return {
       read: async () => {
         try {
-          return parseDeferredWorktreesFile(await (0, import_promises4.readFile)(registryPath, "utf8"));
+          return parseDeferredWorktreesFile(await (0, import_promises3.readFile)(registryPath, "utf8"));
         } catch {
           return [];
         }
       },
       write: async (entries) => {
         try {
-          await (0, import_promises4.mkdir)((0, import_node_path18.dirname)(registryPath), { recursive: true });
-          await (0, import_promises4.writeFile)(registryPath, serializeDeferredWorktrees(entries), "utf8");
+          await (0, import_promises3.mkdir)((0, import_node_path18.dirname)(registryPath), { recursive: true });
+          await (0, import_promises3.writeFile)(registryPath, serializeDeferredWorktrees(entries), "utf8");
         } catch {
         }
       }
@@ -18979,7 +19004,7 @@ var realWorktreeDirRemover = {
       (0, import_node_fs18.unlinkSync)(p);
     }
   },
-  removeTree: (p) => (0, import_promises4.rm)(p, { recursive: true, force: true, maxRetries: 5, retryDelay: 200 })
+  removeTree: (p) => (0, import_promises3.rm)(p, { recursive: true, force: true, maxRetries: 5, retryDelay: 200 })
 };
 async function resolvePrimaryCheckout(execGit) {
   try {
@@ -19037,9 +19062,9 @@ pr.command("merge <number>").description("merge a PR (squash by default) and cle
   const beforeWorktrees = parseWorktreePorcelain(
     (await execFileP2("git", ["worktree", "list", "--porcelain"], { timeout: GIT_TIMEOUT_MS }).catch(() => ({ stdout: "" }))).stdout
   );
-  const remoteBefore = repoArgs.length ? void 0 : await remoteBranchExists2(headRef);
+  const remoteBefore = await remoteBranchExists2(headRef);
   let remoteDeleteAttempted = false;
-  let remoteNotAttemptedReason = repoArgs.length ? "repo-option" : void 0;
+  let remoteNotAttemptedReason;
   await execFileP2("gh", buildPrMergeArgs({ number, repoArgs, method, auto: o.auto }), { timeout: GH_MUTATION_TIMEOUT_MS }).catch((e) => {
     const message = String(e.message || "");
     if (/already been merged/i.test(message)) {
@@ -19061,10 +19086,7 @@ pr.command("merge <number>").description("merge a PR (squash by default) and cle
     }
   }
   if (!remoteNotAttemptedReason) remoteDeleteAttempted = true;
-  const remoteBranch = repoArgs.length ? buildRemoteBranchCleanupReport(headRef, {
-    attempted: false,
-    reason: remoteNotAttemptedReason
-  }) : await buildPrMergeRemoteBranchCleanupReport(headRef, {
+  const remoteBranch = await buildPrMergeRemoteBranchCleanupReport(headRef, {
     exists: remoteBranchExists2
   }, {
     attempted: remoteDeleteAttempted,
@@ -19074,11 +19096,7 @@ pr.command("merge <number>").description("merge a PR (squash by default) and cle
   const deferredStore = await createDeferredWorktreeStore();
   let localCleanup;
   try {
-    localCleanup = repoArgs.length ? {
-      branch: headRef,
-      localBranch: { name: headRef, status: "not-attempted", reason: "repo-option" },
-      worktree: void 0
-    } : await cleanupPrMergeLocalBranch(headRef, {
+    localCleanup = await cleanupPrMergeLocalBranch(headRef, {
       beforeWorktrees,
       startingPath,
       pathExists: (p) => (0, import_node_fs18.existsSync)(p),
@@ -19205,6 +19223,30 @@ board.command("backfill-priority").description("set board Priority from priority
     return failGraceful(`board backfill-priority failed: ${e.message}`);
   }
 });
+board.command("set-priority <issue> <priority>").description(`set a board item's Priority field (${CLI_PRIORITIES.join("|")}) \u2014 recovers a Priority lost on the create-time auto-add race (#2349)`).option("--json", "machine-readable output").option("--repo <owner/repo>", "current repo for local issue numbers (defaults to git origin)").action(async (issueRef, priorityArg, o) => {
+  let priority;
+  try {
+    priority = normalizePriority(priorityArg);
+  } catch (e) {
+    return fail(`board set-priority failed: ${e.message}`);
+  }
+  try {
+    const defaultRepo = await resolveRepo(o.repo) ?? "";
+    const selector = parseIssueSelector(issueRef, defaultRepo);
+    if (!selector.repo) {
+      return fail("board set-priority failed: could not resolve the repo \u2014 pass owner/repo#123 or use --repo");
+    }
+    const result = await setBoardPriorityForSelector({
+      config: await loadConfigForBoardSelector(issueRef, o.repo),
+      selector,
+      priority
+    });
+    if (o.json) return console.log(JSON.stringify(result));
+    console.log(`Set ${result.ref} Priority -> ${result.priority}`);
+  } catch (e) {
+    return failGraceful(`board set-priority failed: ${e.message}`);
+  }
+});
 board.command("prune-priority-labels").description("remove retired priority:* labels (#416) from issues whose board Priority field is already set").option("--json", "machine-readable output").option("--repo <owner/repo>", "current repo (defaults to git origin)").option("--dry-run", "report what would be removed without writing").option("--concurrency <n>", "parallel issue edits (default 8)", "8").action(async (o) => {
   try {
     const result = await prunePriorityLabels({
@@ -19286,14 +19328,11 @@ function stageKeepAlive() {
 }
 async function resolveStage() {
   const cfg = await loadConfig();
-  const local = cfg.stage;
   const read = await fetchProjectBySlugChecked(await repoSlug(), registryClientDeps(cfg)).catch((e) => ({ ok: false, error: e.message }));
   const project2 = read.ok ? read.project : null;
   const portRangeMeta = project2?.portRange ?? void 0;
   const portRange = portRangeMeta && typeof portRangeMeta.start === "number" && typeof portRangeMeta.end === "number" ? [portRangeMeta.start, portRangeMeta.end] : void 0;
   return decideStage({
-    local,
-    shell: shellFor(),
     registry: { deployModel: project2?.deployModel, portRange, error: read.ok ? void 0 : read.error },
     hasCompose: (0, import_node_fs18.existsSync)((0, import_node_path18.join)(process.cwd(), "docker-compose.yml")),
     hasEnvExample: (0, import_node_fs18.existsSync)((0, import_node_path18.join)(process.cwd(), ".env.example"))
@@ -19317,19 +19356,8 @@ async function fetchStageVaultEnvMerge() {
 }
 function stageStepsFor(res, stops = true) {
   if (res.source === "derived" && res.derived) return derivedStagePlan(res.derived, shellFor(), stops);
-  if (res.source === "local") return stagePlan(res.config ?? {}, stops);
   return [{ label: `no local stage to run \u2014 ${res.gap ?? "stage config gap"}` }];
 }
-function staleStageNote(res) {
-  if (!res.staleIgnored) return null;
-  const fields = res.staleFields ?? [];
-  const list = fields.join(", ");
-  const label = fields.length > 1 ? `fields ${list}` : `field ${list || "build/up"}`;
-  if (res.source === "local") {
-    return `note: POSIX-only .mmi stage ${label} ignored on PowerShell \u2014 kept the rest of the local recipe`;
-  }
-  return `note: stale POSIX-only .mmi stage ${label} ignored on PowerShell \u2014 using the registry-derived default`;
-}
 function reportedStageUrl(res, result) {
   if (!res.derived) return void 0;
   return result.port != null ? stageUrlForPort(result.port) : res.derived.url;
@@ -19420,7 +19448,7 @@ var stage = program2.command("stage").description("plan or run the repo local st
   const res = await resolveStage();
   if (o.apply) {
     if (res.source === "none") return failGraceful(`stage: ${res.gap}`);
-    const cfg = res.config ?? res.derived.config;
+    const cfg = res.derived.config;
     const hold = stageKeepAlive();
     try {
       const result = await runStage(cfg, stageScopedRunOpts({ timeoutMs: o.timeoutMs }));
@@ -19434,9 +19462,7 @@ var stage = program2.command("stage").description("plan or run the repo local st
     }
   }
   const steps = stageStepsFor(res);
-  if (o.json) return console.log(JSON.stringify({ command: "stage", source: res.source, url: res.derived?.url, staleIgnored: res.staleIgnored, staleFields: res.staleFields, registryError: res.registryError, steps }, null, 2));
-  const note = staleStageNote(res);
-  if (note) printLine(note);
+  if (o.json) return console.log(JSON.stringify({ command: "stage", source: res.source, url: res.derived?.url, registryError: res.registryError, steps }, null, 2));
   console.log(renderSteps("mmi-cli stage: dry-run plan", steps));
 });
 stage.command("stop").description("stop the previous local stage process recorded in tmp/stage/state.json").option("--json", "machine-readable output").option("--apply", "kill the recorded process tree and remove the state file").action(async () => {
@@ -19457,14 +19483,12 @@ stage.command("start").description("start the configured local stage process and
   const res = await resolveStage();
   if (!o.apply) {
     const steps = stageStepsFor(res, false);
-    if (o.json) return printLine(JSON.stringify({ command: "stage start", source: res.source, url: res.derived?.url, staleIgnored: res.staleIgnored, staleFields: res.staleFields, registryError: res.registryError, steps }, null, 2));
-    const note = staleStageNote(res);
-    if (note) printLine(note);
+    if (o.json) return printLine(JSON.stringify({ command: "stage start", source: res.source, url: res.derived?.url, registryError: res.registryError, steps }, null, 2));
     return printLine(renderSteps("mmi-cli stage start: dry-run plan", steps));
   }
   if (res.source === "none") return failGraceful(`stage start: ${res.gap}`);
-  const cfg = res.config ?? res.derived.config;
-  const vaultEnvMerge = res.source === "derived" ? await fetchStageVaultEnvMerge() : void 0;
+  const cfg = res.derived.config;
+  const vaultEnvMerge = await fetchStageVaultEnvMerge();
   try {
     const hold = stageKeepAlive();
     let printed = false;
@@ -19492,14 +19516,12 @@ stage.command("run").description("force-stop previous stage, build, start, and h
   const res = await resolveStage();
   if (!o.apply) {
     const steps = stageStepsFor(res);
-    if (o.json) return printLine(JSON.stringify({ command: "stage run", source: res.source, url: res.derived?.url, staleIgnored: res.staleIgnored, staleFields: res.staleFields, registryError: res.registryError, steps }, null, 2));
-    const note = staleStageNote(res);
-    if (note) printLine(note);
+    if (o.json) return printLine(JSON.stringify({ command: "stage run", source: res.source, url: res.derived?.url, registryError: res.registryError, steps }, null, 2));
     return printLine(renderSteps("mmi-cli stage run: dry-run plan", steps));
   }
   if (res.source === "none") return failGraceful(`stage run: ${res.gap}`);
-  const cfg = res.config ?? res.derived.config;
-  const vaultEnvMerge = res.source === "derived" ? await fetchStageVaultEnvMerge() : void 0;
+  const cfg = res.derived.config;
+  const vaultEnvMerge = await fetchStageVaultEnvMerge();
   try {
     const hold = stageKeepAlive();
     let printed = false;
@@ -19569,8 +19591,8 @@ function trainApplyDeps() {
     // Slack release announcement (#883): Hub-only + best-effort inside announceRelease itself.
     announce: (args) => announceRelease({
       run: async (file, cmdArgs) => (await execFileP2(file, cmdArgs, { timeout: GH_TRAIN_TIMEOUT_MS })).stdout,
-      readFile: (path2) => (0, import_promises4.readFile)(path2, "utf8"),
-      removeFile: (path2) => (0, import_promises4.unlink)(path2)
+      readFile: (path2) => (0, import_promises3.readFile)(path2, "utf8"),
+      removeFile: (path2) => (0, import_promises3.unlink)(path2)
     }, args),
     fetchEdgeDomains: async (slug) => {
       const proj = await fetchProjectBySlug(slug, registryClientDeps(await loadConfig()));
@@ -19635,7 +19657,9 @@ for (const commandName of ["rcand", "release"]) {
       return fail("--dev applies only to release: it ships development -> main skipping rc, which rcand cannot do");
     }
     if (o.apply && o.repo) {
-      return fail(`${commandName}: --repo is read-only for dry-run planning; --apply must run from the target repo checkout`);
+      const rerun = `mmi-cli ${commandName} --apply${o.watch ? " --watch" : ""}${o.dev ? " --dev" : ""}${o.json ? " --json" : ""}`;
+      const guard = planTrainApplyRepoGuard(o.repo, await resolveRepo(), rerun);
+      if (!guard.ok) return fail(`${commandName}: ${guard.message}`);
     }
     if (o.apply) {
       try {
@@ -19788,6 +19812,14 @@ bootstrap.command("verify <repo>").description("audit whether an existing repo i
   console.log(o.json ? JSON.stringify(report, null, 2) : renderBootstrapVerifyReport(report));
   if (!report.ok) process.exitCode = 1;
 });
+bootstrap.command("org-ruleset").description("drift-check the codified org no-agent-files push ruleset (mmi-no-agent-files-org) against live; read-only, never mutates (#2196)").option("--json", "machine-readable output").action(async () => {
+  const json = rawFlag("--json");
+  const live = await fetchOrgNoAgentFilesRuleset(defaultGitHubClient());
+  const plan = planOrgNoAgentFilesRuleset(live);
+  if (json) console.log(JSON.stringify({ action: plan.action, id: plan.id, drift: plan.drift, desired: plan.desired }, null, 2));
+  else console.log(renderOrgRulesetDriftReport(plan));
+  if (plan.action !== "noop") process.exitCode = 1;
+});
 bootstrap.command("apply <repo>").description("idempotent seed apply from skills/bootstrap/seeds/manifest.json; dry-run unless --execute (live, master-gated)").option("--class <class>", "deployable | content", "deployable").option("--project-type <type>", `${PROJECT_TYPES.join(" | ")} (v2 capability shape)`).option("--deploy-model <model>", `${DEPLOY_MODELS.join(" | ")} (release/deploy path)`).option("--release-track <track>", `${RELEASE_TRACKS.join(" | ")} (branch topology; direct skips rc)`).option("--execute", "LIVE apply via gh (master-gated) \u2014 stamps seed files + labels into the repo").option("--var <KEY=VALUE...>", "placeholder values for repo-owned templates (repeatable)").option("--json", "machine-readable output").action(async (repo) => {
   const o = {
     class: rawValue("--class", "deployable"),
@@ -19811,7 +19843,7 @@ bootstrap.command("apply <repo>").description("idempotent seed apply from skills
   const baseBranch = o.class === "content" ? "main" : "development";
   const slug = parsedRepo.slug;
   const gh = async (args) => execFileP2("gh", args, { timeout: 2e4 });
-  const readFile3 = (p) => (0, import_node_fs18.existsSync)(p) ? (0, import_node_fs18.readFileSync)(p, "utf8") : null;
+  const readFile2 = (p) => (0, import_node_fs18.existsSync)(p) ? (0, import_node_fs18.readFileSync)(p, "utf8") : null;
   const enc = (p) => p.split("/").map(encodeURIComponent).join("/");
   const rawVars = {};
   for (const value of rawValues("--var")) {
@@ -19844,6 +19876,25 @@ bootstrap.command("apply <repo>").description("idempotent seed apply from skills
     applyDeployModel = payload.deployModel;
   } catch {
   }
+  let seedPlan = { mode: "direct", ref: baseBranch, reason: "dry-run (no protection probe)" };
+  let seededToBranch = 0;
+  if (o.execute) {
+    let branchRules = [];
+    try {
+      branchRules = JSON.parse((await gh(["api", `repos/${repo}/rules/branches/${baseBranch}`])).stdout || "[]");
+    } catch {
+      branchRules = [];
+    }
+    seedPlan = planSeedDelivery(branchRules, slug, baseBranch);
+    if (seedPlan.branch) {
+      const headSha = (await gh(["api", `repos/${repo}/git/ref/heads/${baseBranch}`, "--jq", ".object.sha"])).stdout.trim();
+      try {
+        await gh(["api", "-X", "POST", `repos/${repo}/git/refs`, "-f", `ref=refs/heads/${seedPlan.branch}`, "-f", `sha=${headSha}`]);
+      } catch (e) {
+        if (!/Reference already exists|already exists/i.test(String(e.message ?? ""))) throw e;
+      }
+    }
+  }
   for (const seed of manifest.seeds) {
     if (!seed.classes.includes(o.class)) continue;
     if (!seedMatchesDeployModel(seed, applyDeployModel)) continue;
@@ -19853,7 +19904,7 @@ bootstrap.command("apply <repo>").description("idempotent seed apply from skills
     let remoteContent = null;
     if (resolved.source !== "fanout") {
       try {
-        const r = await gh(["api", `repos/${repo}/contents/${enc(resolved.target)}?ref=${baseBranch}`]);
+        const r = await gh(["api", `repos/${repo}/contents/${enc(resolved.target)}?ref=${seedPlan.ref}`]);
         exists = true;
         try {
           const parsed = JSON.parse(r.stdout);
@@ -19869,13 +19920,44 @@ bootstrap.command("apply <repo>").description("idempotent seed apply from skills
     }
     const planned = planSeedAction(resolved, exists);
     const isBlock = resolved.source === "managed-block";
-    const content = planned.action === "create" || planned.action === "update" ? isBlock ? upsertManagedGitignoreBlock(remoteContent).content : resolveSeedContent(resolved, vars, readFile3) : null;
+    const content = planned.action === "create" || planned.action === "update" ? isBlock ? upsertManagedGitignoreBlock(remoteContent).content : resolveSeedContent(resolved, vars, readFile2) : null;
     const action = reconcileSeedAction(planned, content, isBlock);
     actions.push(action);
     if (o.execute && (action.action === "create" || action.action === "update")) {
-      await gh(contentPutArgs(repo, resolved.target, content, baseBranch, action.action === "update" ? sha : void 0));
+      await gh(contentPutArgs(repo, resolved.target, content, seedPlan.ref, action.action === "update" ? sha : void 0));
       applied.push(`${action.action} ${resolved.target}`);
+      if (seedPlan.mode === "pr") seededToBranch++;
+    }
+  }
+  let seedPrUrl;
+  if (o.execute && seedPlan.mode === "pr" && seedPlan.branch && seededToBranch > 0) {
+    await gh(["api", "-X", "PATCH", `repos/${repo}`, "-f", "allow_auto_merge=true", "-f", "allow_squash_merge=true", "-f", "delete_branch_on_merge=true"]).catch(() => {
+    });
+    const openPrs = await gh(["pr", "list", "--repo", repo, "--head", seedPlan.branch, "--base", baseBranch, "--state", "open", "--json", "number,url"]);
+    const prDecision = decideFanoutPrAction(JSON.parse(openPrs.stdout || "[]"));
+    if (prDecision.action === "reuse") {
+      seedPrUrl = prDecision.url;
+    } else {
+      const created = await ghCreate([
+        "pr",
+        "create",
+        "--repo",
+        repo,
+        "--base",
+        baseBranch,
+        "--head",
+        seedPlan.branch,
+        "--title",
+        `bootstrap: seed ${parsedRepo.name} (${baseBranch} is protected)`,
+        "--body",
+        `Auto-opened by \`mmi-cli bootstrap apply --execute ${repo}\` (#2286): \`${baseBranch}\` is protected (${seedPlan.reason}), so the org-managed seed files are delivered via this branch + PR \u2014 a direct contents PUT 409s on a protected base ("N of N required status checks are expected").`
+      ]);
+      seedPrUrl = created.url;
     }
+    await gh(["pr", "merge", seedPrUrl, "--repo", repo, "--auto", "--squash"]).catch((e) => {
+      if (!/already/i.test(String(e.message ?? ""))) throw e;
+    });
+    applied.push(`seed: PR ${seedPrUrl} (base ${baseBranch} protected; auto-merge enabled)`);
   }
   if (o.execute && o.class === "deployable") {
     try {
@@ -19886,7 +19968,7 @@ bootstrap.command("apply <repo>").description("idempotent seed apply from skills
     }
     const rulesetSeed = manifest.seeds.find((s) => s.target === ".github/rulesets/mmi-product-required-checks.json");
     if (rulesetSeed) {
-      const rulesetContent = resolveSeedContent({ ...rulesetSeed, target: rulesetSeed.target.replace("{{REPO_SLUG}}", slug) }, vars, readFile3);
+      const rulesetContent = resolveSeedContent({ ...rulesetSeed, target: rulesetSeed.target.replace("{{REPO_SLUG}}", slug) }, vars, readFile2);
       if (rulesetContent) {
         try {
           const activation = await activateProductRuleset(repo, stripRulesetComment(rulesetContent), defaultGitHubClient());
@@ -19999,9 +20081,9 @@ bootstrap.command("apply <repo>").description("idempotent seed apply from skills
             "--head",
             branchName,
             "--title",
-            `bootstrap: register ${parsedRepo.name} for org-spine fanout`,
+            `bootstrap: register ${parsedRepo.name} for the org-managed .gitignore fanout`,
             "--body",
-            `Auto-opened by \`mmi-cli bootstrap apply --execute ${repo}\` (#933): adds ${parsedRepo.name} to projects.json + .github/fanout-targets.json so the spine fans out to it.`
+            `Auto-opened by \`mmi-cli bootstrap apply --execute ${repo}\` (#933): adds ${parsedRepo.name} to projects.json + .github/fanout-targets.json so the org-managed .gitignore block reaches it (hub-v3 retired the whole-spine fanout).`
           ]);
           fanoutPrUrl = created.url;
         }
@@ -20014,7 +20096,7 @@ bootstrap.command("apply <repo>").description("idempotent seed apply from skills
       return failGraceful(`bootstrap apply: fanout registration failed: ${e.message}`);
     }
   }
-  if (o.json) console.log(JSON.stringify({ repo, class: o.class, execute: o.execute, actions, applied, ddbWrites, fanoutPrUrl }, null, 2));
+  if (o.json) console.log(JSON.stringify({ repo, class: o.class, execute: o.execute, seedDelivery: seedPlan.mode, seedPrUrl, actions, applied, ddbWrites, fanoutPrUrl }, null, 2));
   else {
     console.log(renderSeedPlan(actions));
     if (o.execute) console.log(`
@@ -20081,13 +20163,12 @@ program2.command("doctor").description("check onboarding gates and auto-heal CLI
 ));
 program2.command("guard").description("detect a pruned/unresolved MMI plugin on disk; loud one-line stderr at session start").option("--session-start", "run in user-scope SessionStart mode").action((opts) => runGuard({ sessionStart: opts.sessionStart }));
 program2.command("plugin-heal").description("reinstall + re-enable the MMI plugin (recover from a marketplace prune)").action(() => runPluginHeal());
-program2.command("session-start").description("run the SessionStart verbs (whoami, board slice, doctor) in one process; docs sync runs detached").action(async () => {
+program2.command("session-start").description("run the SessionStart verbs (whoami, board slice, doctor) in one process").action(async () => {
   if (isInsideRepoSubdir(process.cwd())) {
     console.error("[mmi-hook] session-start: cwd is a repository SUBDIRECTORY \u2014 skipping the SessionStart hook (spine/docs/plan/saga delivery); run it from the repo root.");
     return;
   }
   if (!await isOrgRepoRoot()) return;
-  spawnDetachedSelf(["docs", "sync", "--quiet"], { spawn: import_node_child_process11.spawn, execPath: process.execPath, scriptPath: process.argv[1] });
   spawnDeferredGcSweep();
   const { parallel, sequential } = buildSessionStartPlan({
     // whoami (#879): surface the resolved human so agents act --for them without asking. Silent
@@ -20103,7 +20184,7 @@ program2.command("session-start").description("run the SessionStart verbs (whoam
     boardSlice: (io) => runBoardSlice(io, {
       loadConfig: () => loadConfigForRepo(),
       readBoard,
-      // #1813: warm the slice cache out-of-band (detached, like docs sync) so the ~20s live read
+      // #1813: warm the slice cache out-of-band (detached) so the ~20s live read
       // never costs banner time and next session's glance renders instantly within budget.
       scheduleRefresh: () => spawnDetachedSelf(["board", "slice-refresh", "--quiet"], { spawn: import_node_child_process11.spawn, execPath: process.execPath, scriptPath: process.argv[1] })
     }),