@mutmutco/cli 3.10.0 → 3.12.0

package/dist/main.cjs

@@ -3408,7 +3408,7 @@ var program = new Command();
 
 // src/index.ts
 var import_promises3 = require("node:fs/promises");
-var import_node_fs20 = require("node:fs");
+var import_node_fs21 = require("node:fs");
 
 // src/bootstrap-org-ruleset.ts
 var ORG_NO_AGENT_FILES_RULESET_NAME = "mmi-no-agent-files-org";
@@ -3540,7 +3540,6 @@ function resolveClientVersionManifestCandidates(distDir = __dirname) {
   return [
     (0, import_node_path2.join)(distDir, "..", "..", ".claude-plugin", "plugin.json"),
     (0, import_node_path2.join)(distDir, "..", "..", ".cursor-plugin", "plugin.json"),
-    (0, import_node_path2.join)(distDir, "..", "..", ".codex-plugin", "plugin.json"),
     (0, import_node_path2.join)(distDir, "..", "package.json")
   ];
 }
@@ -4521,7 +4520,10 @@ function buildSessionStartPlan(verbs) {
       // Identity reads are memoized process-wide, so this adds no extra gh/Hub round-trip.
       { name: "whoami", run: verbs.whoami },
       // board slice (#1230): assigned + claimable glance, 3s cap, fail-soft — flushed after whoami.
-      { name: "board slice", run: verbs.boardSlice }
+      { name: "board slice", run: verbs.boardSlice },
+      // command-ladder hint (#2609): compact gh→mmi-cli cheat sheet so agents reach for mmi-cli first,
+      // not after a denied gh call. <1KB, fail-soft — never blocks the banner.
+      { name: "command ladder", run: verbs.commandLadderHint }
     ],
     sequential: [
       // local train sync (#2582): fast-forward local development/main/rc to origin BEFORE doctor + before
@@ -4955,7 +4957,7 @@ function parseIssueSelector(selector, defaultRepo) {
   throw new Error(`expected an issue selector like 123, #123, owner/repo#123, or a GitHub issue URL`);
 }
 function partitionBoardItems(items, viewer, currentRepo, writableRepos) {
-  const empty = () => ({ userOwned: [], claimable: [], taken: [] });
+  const empty = () => ({ userOwned: [], claimable: [], taken: [], unownedInFlight: [] });
   const groups = { primary: empty(), secondary: empty() };
   const viewerKey = viewer.toLowerCase();
   const repoKey = currentRepo.toLowerCase();
@@ -4970,6 +4972,8 @@ function partitionBoardItems(items, viewer, currentRepo, writableRepos) {
       groups[scope].claimable.push(item);
     } else if (item.assignees.length > 0) {
       groups[scope].taken.push(item);
+    } else {
+      groups[scope].unownedInFlight.push(item);
     }
   }
   sortBuckets(groups.primary);
@@ -5640,6 +5644,7 @@ function renderScope(lines, label, title, buckets) {
   lines.push("", `${label} \xB7 ${title}`);
   renderOwned(lines, buckets.userOwned);
   renderClaimable(lines, buckets.claimable);
+  renderUnowned(lines, buckets.unownedInFlight);
   renderTaken(lines, buckets.taken);
 }
 function renderOwned(lines, items) {
@@ -5662,17 +5667,23 @@ function renderTaken(lines, items) {
   lines.push("Taken");
   for (const item of items) lines.push(`  ${item.ref} \xB7 ${item.status} \xB7 @${item.assignees.join(", @")}`);
 }
+function renderUnowned(lines, items) {
+  if (!items.length) return;
+  lines.push("Unowned in-flight (unassigned \u2014 needs an owner)");
+  for (const item of items) lines.push(`  ${item.status} \xB7 ${renderTitledItem(item)}`);
+}
 function renderTitledItem(item) {
   const pri = item.priority ? ` \xB7 ${item.priority}` : "";
   return `${item.ref} - [${item.type ?? "item"}]${pri} ${item.title}`;
 }
 function hasItems(buckets) {
-  return buckets.userOwned.length > 0 || buckets.claimable.length > 0 || buckets.taken.length > 0;
+  return buckets.userOwned.length > 0 || buckets.claimable.length > 0 || buckets.taken.length > 0 || buckets.unownedInFlight.length > 0;
 }
 function sortBuckets(buckets) {
   buckets.userOwned.sort(compareItems);
   buckets.claimable.sort(compareItems);
   buckets.taken.sort(compareItems);
+  buckets.unownedInFlight.sort(compareItems);
 }
 function compareItems(a, b) {
   return (STATUS_ORDER.get(a.status) ?? 99) - (STATUS_ORDER.get(b.status) ?? 99) || a.repository.localeCompare(b.repository) || a.number - b.number;
@@ -5838,9 +5849,31 @@ async function refreshBoardSliceCache(deps) {
   }
 }
 
-// src/worktree.ts
+// src/hook-activity.ts
 var import_node_fs9 = require("node:fs");
 var import_node_path9 = require("node:path");
+var DEFAULT_SURFACE = "claude";
+function activityLogPath(cwd) {
+  return repoRuntimeStatePath(cwd, "hooks", "activity.jsonl");
+}
+function appendHookActivity(cwd, entry) {
+  try {
+    const path2 = activityLogPath(cwd);
+    const line = {
+      ts: (/* @__PURE__ */ new Date()).toISOString(),
+      surface: DEFAULT_SURFACE,
+      ...entry
+    };
+    (0, import_node_fs9.mkdirSync)((0, import_node_path9.dirname)(path2), { recursive: true });
+    (0, import_node_fs9.appendFileSync)(path2, `${JSON.stringify(line)}
+`, "utf8");
+  } catch {
+  }
+}
+
+// src/worktree.ts
+var import_node_fs10 = require("node:fs");
+var import_node_path10 = require("node:path");
 var LOCAL_ONLY_FILES = [".claude/settings.local.json"];
 var PKG = "package.json";
 var LOCKFILE = "package-lock.json";
@@ -5848,21 +5881,21 @@ var NODE_MODULES = "node_modules";
 var realFsProbe = {
   isDir: (p) => {
     try {
-      return (0, import_node_fs9.statSync)(p).isDirectory();
+      return (0, import_node_fs10.statSync)(p).isDirectory();
     } catch {
       return false;
     }
   },
   isFile: (p) => {
     try {
-      return (0, import_node_fs9.statSync)(p).isFile();
+      return (0, import_node_fs10.statSync)(p).isFile();
     } catch {
       return false;
     }
   },
   listDirs: (p) => {
     try {
-      return (0, import_node_fs9.readdirSync)(p, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name);
+      return (0, import_node_fs10.readdirSync)(p, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name);
     } catch {
       return [];
     }
@@ -5870,12 +5903,12 @@ var realFsProbe = {
 };
 function scanInstallDirs(root, fs2 = realFsProbe) {
   const factsFor = (dir) => {
-    const abs = dir ? (0, import_node_path9.join)(root, dir) : root;
+    const abs = dir ? (0, import_node_path10.join)(root, dir) : root;
     return {
       dir,
-      hasPackageJson: fs2.isFile((0, import_node_path9.join)(abs, PKG)),
-      hasLockfile: fs2.isFile((0, import_node_path9.join)(abs, LOCKFILE)),
-      hasNodeModules: fs2.isDir((0, import_node_path9.join)(abs, NODE_MODULES))
+      hasPackageJson: fs2.isFile((0, import_node_path10.join)(abs, PKG)),
+      hasLockfile: fs2.isFile((0, import_node_path10.join)(abs, LOCKFILE)),
+      hasNodeModules: fs2.isDir((0, import_node_path10.join)(abs, NODE_MODULES))
     };
   };
   const children = fs2.listDirs(root).filter((name) => name !== NODE_MODULES && name !== ".git");
@@ -5885,7 +5918,7 @@ function npmInstallTargets(dirs) {
   return dirs.filter((d) => d.hasPackageJson && !d.hasNodeModules).map((d) => ({ dir: d.dir, command: d.hasLockfile ? "npm ci" : "npm install" }));
 }
 function isLinkedWorktree(root, fs2 = realFsProbe) {
-  return fs2.isFile((0, import_node_path9.join)(root, ".git"));
+  return fs2.isFile((0, import_node_path10.join)(root, ".git"));
 }
 function worktreeAutoProvisionBanner(root, fs2 = realFsProbe) {
   if (!isLinkedWorktree(root, fs2)) return null;
@@ -5895,8 +5928,8 @@ function worktreeAutoProvisionBanner(root, fs2 = realFsProbe) {
   return `[worktree] provisioning tooling in the background (deps in ${where} + local config) \u2014 \`mmi-cli worktree setup\` to redo`;
 }
 function defaultCopyFile(from, to) {
-  (0, import_node_fs9.mkdirSync)((0, import_node_path9.dirname)(to), { recursive: true });
-  (0, import_node_fs9.copyFileSync)(from, to);
+  (0, import_node_fs10.mkdirSync)((0, import_node_path10.dirname)(to), { recursive: true });
+  (0, import_node_fs10.copyFileSync)(from, to);
 }
 async function provisionWorktree(worktreeRoot, deps) {
   const fs2 = deps.fs ?? realFsProbe;
@@ -5908,7 +5941,7 @@ async function provisionWorktree(worktreeRoot, deps) {
   const skippedInstall = allDirs.filter((d) => d.hasPackageJson && d.hasNodeModules).map((d) => d.dir);
   const installed = [];
   for (const target of targets) {
-    const cwd = target.dir ? (0, import_node_path9.join)(worktreeRoot, target.dir) : worktreeRoot;
+    const cwd = target.dir ? (0, import_node_path10.join)(worktreeRoot, target.dir) : worktreeRoot;
     log(`installing deps: ${target.command} in ${target.dir || "."}`);
     await deps.runInstall(target.command, cwd);
     installed.push(target);
@@ -5917,7 +5950,7 @@ async function provisionWorktree(worktreeRoot, deps) {
   const copySkipped = [];
   const primary = await deps.primaryCheckout();
   for (const rel of LOCAL_ONLY_FILES) {
-    const dest = (0, import_node_path9.join)(worktreeRoot, rel);
+    const dest = (0, import_node_path10.join)(worktreeRoot, rel);
     if (fs2.isFile(dest)) {
       copySkipped.push({ file: rel, reason: "already-present" });
       continue;
@@ -5926,11 +5959,11 @@ async function provisionWorktree(worktreeRoot, deps) {
       copySkipped.push({ file: rel, reason: "no-primary" });
       continue;
     }
-    if (!fs2.isFile((0, import_node_path9.join)(primary, rel))) {
+    if (!fs2.isFile((0, import_node_path10.join)(primary, rel))) {
       copySkipped.push({ file: rel, reason: "absent-in-primary" });
       continue;
     }
-    copyFile((0, import_node_path9.join)(primary, rel), dest);
+    copyFile((0, import_node_path10.join)(primary, rel), dest);
     copied.push(rel);
     log(`copied local config: ${rel}`);
   }
@@ -5938,13 +5971,50 @@ async function provisionWorktree(worktreeRoot, deps) {
 }
 function defaultWorktreePath(repoRoot, branch) {
   const safe = branch.replace(/[/\\]+/g, "-");
-  return (0, import_node_path9.join)((0, import_node_path9.dirname)(repoRoot), "mmi-worktrees", safe);
+  return (0, import_node_path10.join)((0, import_node_path10.dirname)(repoRoot), "mmi-worktrees", safe);
 }
 function resolveWorktreeBase(from, remote) {
   const remotePrefix = `${remote}/`;
   const fetchBranch = from.startsWith(remotePrefix) ? from.slice(remotePrefix.length) : void 0;
   return { base: from, fetchBranch };
 }
+var GIT_CONFIG_LOCK_RE = /could not lock config file|unable to write upstream branch configuration/i;
+function isGitConfigLockError(error) {
+  return GIT_CONFIG_LOCK_RE.test(error instanceof Error ? error.message : String(error));
+}
+var ADD_WORKTREE_BACKOFF_MS = [100, 250, 500, 750, 1e3];
+var ADD_WORKTREE_MAX_ATTEMPTS = 6;
+async function cleanupOrphanBranch(branch, base, preExistingOid, deps) {
+  if (preExistingOid !== void 0) return;
+  const currentOid = await deps.revParse(`refs/heads/${branch}`);
+  if (currentOid === void 0) return;
+  const baseOid = await deps.revParse(base);
+  if (baseOid !== void 0 && currentOid !== baseOid) return;
+  await deps.deleteBranch(branch);
+}
+async function addWorktreeRobust(wtPath, branch, base, deps) {
+  const maxAttempts = deps.maxAttempts ?? ADD_WORKTREE_MAX_ATTEMPTS;
+  const backoff = deps.backoffMs ?? ADD_WORKTREE_BACKOFF_MS;
+  const log = deps.log ?? (() => {
+  });
+  const preExistingOid = await deps.revParse(`refs/heads/${branch}`);
+  for (let i = 0; i < maxAttempts; i++) {
+    try {
+      await deps.git(["worktree", "add", wtPath, "-b", branch, base]);
+      return;
+    } catch (e) {
+      await cleanupOrphanBranch(branch, base, preExistingOid, deps).catch(() => {
+      });
+      const retriesLeft = i < maxAttempts - 1;
+      if (retriesLeft && isGitConfigLockError(e)) {
+        log(`worktree add: .git/config lock busy, retrying (${i + 1}/${maxAttempts - 1})`);
+        await deps.sleep(backoff[Math.min(i, backoff.length - 1)]);
+        continue;
+      }
+      throw e;
+    }
+  }
+}
 
 // src/whoami.ts
 async function resolveWhoami(deps) {
@@ -5969,8 +6039,39 @@ function whoamiLine(report) {
   return `current human: ${report.login} (source: ${report.source}) \u2014 act for this login (e.g. claim --for ${report.login}); do not ask who the user is.`;
 }
 
+// src/command-ladder-hint.ts
+var COMMAND_LADDER_WRITES = [
+  { gh: "gh issue create", replacement: "mmi-cli issue create" },
+  { gh: "gh issue comment", replacement: "mmi-cli issue comment" },
+  { gh: "gh pr create", replacement: "mmi-cli pr create" },
+  { gh: "gh pr merge", replacement: "mmi-cli pr merge (or mmi-cli pr land)" }
+];
+var COMMAND_LADDER_READS = [
+  { gh: "gh issue view <N>", replacement: "mmi-cli issue view <N>" },
+  { gh: "gh pr view <N>", replacement: "mmi-cli pr view <N>" },
+  { gh: "gh pr checks <N>", replacement: "mmi-cli pr checks-wait <N>" }
+];
+var COMMAND_LADDER_BOARD = [
+  { gh: "gh issue list / project", replacement: "mmi-cli board read" }
+];
+function commandLadderHint() {
+  const pad = 28;
+  const lines = [];
+  lines.push("[mmi] Command ladder (#2609): reach for mmi-cli first");
+  for (const e of COMMAND_LADDER_WRITES) {
+    lines.push(`${e.gh.padEnd(pad)} \u2192 ${e.replacement}`);
+  }
+  for (const e of COMMAND_LADDER_READS) {
+    lines.push(`${e.gh.padEnd(pad)} \u2192 ${e.replacement}`);
+  }
+  for (const e of COMMAND_LADDER_BOARD) {
+    lines.push(`${e.gh.padEnd(pad)} \u2192 ${e.replacement}`);
+  }
+  return lines.join("\n");
+}
+
 // src/index.ts
-var import_node_path20 = require("node:path");
+var import_node_path21 = require("node:path");
 
 // src/merge-ci-policy.ts
 function resolveMergeCiPolicy(input) {
@@ -6912,7 +7013,7 @@ async function auditRepoCi(repo, deps) {
       ok: hasRequiredChecks,
       label: "product required status checks active",
       detail: hasRequiredChecks ? void 0 : `no required status checks active \u2014 activate ${PRODUCT_RULESET_REF} as a repo ruleset`,
-      remediation: hasRequiredChecks ? void 0 : `Import ${PRODUCT_RULESET_REF} as an active repository ruleset (GitHub \u2192 Settings \u2192 Rules \u2192 Rulesets) \u2014 target: bootstrap --apply automation (#1440)`
+      remediation: hasRequiredChecks ? void 0 : `Import ${PRODUCT_RULESET_REF} as an active repository ruleset (GitHub \u2192 Settings \u2192 Rules \u2192 Rulesets) \u2014 target: bootstrap apply --execute automation (#1440)`
     });
     if (hasGateWorkflow) {
       const emitted = registryRequiredContexts(meta) ?? await getEmittedPrContexts();
@@ -7221,6 +7322,13 @@ async function runPrLand(prNumber, options, deps) {
       error: `checks-wait ${checksWait.status}${checksWait.detail ? `: ${checksWait.detail}` : ""}`
     };
   }
+  const prState = await deps.readPrState(prNumber, repo);
+  if (prState.mergeStateStatus === "DIRTY" || prState.mergeable === "CONFLICTING") {
+    return {
+      ...base,
+      error: `pr land #${prNumber}: branch conflicts with base \u2014 rebase/merge development, rebuild any checked-in artifacts, then re-push before landing`
+    };
+  }
   const merge = await mergeAutoWithTransientRetry(prNumber, repo, deps);
   base.mergeStatus = merge.mergeStatus;
   if (merge.mergeStatus === "failed") {
@@ -7241,10 +7349,10 @@ async function runPrLand(prNumber, options, deps) {
 }
 
 // src/wave-status.ts
-var import_node_fs11 = require("node:fs");
+var import_node_fs12 = require("node:fs");
 
 // src/gc.ts
-var import_node_path10 = require("node:path");
+var import_node_path11 = require("node:path");
 var DEFERRED_SWEEP_COMMAND = "mmi-cli gc sweep-deferred";
 var DEFERRED_NOTE = "Worktree cleanup queued (IDE lock). Detached sweep will retry automatically \u2014 no human action required.";
 var PRESERVED_WORKTREE_CONFIG = "mmi.preservedWorktreeBranch";
@@ -7515,8 +7623,8 @@ function resolveSafeSiblingWorktreeCleanupTarget(worktreePath, siblingRoot, deps
   return { ok: true, path: worktreePath };
 }
 function siblingMmiWorktreesRoot(repoRoot) {
-  const parent = (0, import_node_path10.dirname)(repoRoot);
-  return (0, import_node_path10.basename)(parent).toLowerCase() === "mmi-worktrees" ? parent : (0, import_node_path10.join)(parent, "mmi-worktrees");
+  const parent = (0, import_node_path11.dirname)(repoRoot);
+  return (0, import_node_path11.basename)(parent).toLowerCase() === "mmi-worktrees" ? parent : (0, import_node_path11.join)(parent, "mmi-worktrees");
 }
 function classifySiblingWorktreeDir(entry) {
   if (!entry.ownedByCurrentRepo) {
@@ -8177,8 +8285,8 @@ function formatGcPlan(plan, apply) {
 
 // src/stage-runner.ts
 var import_node_child_process6 = require("node:child_process");
-var import_node_fs10 = require("node:fs");
-var import_node_path11 = require("node:path");
+var import_node_fs11 = require("node:fs");
+var import_node_path12 = require("node:path");
 var import_node_net = require("node:net");
 var import_node_util6 = require("node:util");
 var execFileP4 = (0, import_node_util6.promisify)(import_node_child_process6.execFile);
@@ -8295,11 +8403,11 @@ function appendForceRecreate(up) {
   return `${up.trimEnd()} --force-recreate`;
 }
 function stageStatePath(cwd = process.cwd()) {
-  return (0, import_node_path11.join)(cwd, "tmp", "stage", "state.json");
+  return (0, import_node_path12.join)(cwd, "tmp", "stage", "state.json");
 }
 function stageGlobalStatePath(cwd = process.cwd(), gitCommonDir = ".git") {
-  const dir = (0, import_node_path11.isAbsolute)(gitCommonDir) ? gitCommonDir : (0, import_node_path11.resolve)(cwd, gitCommonDir);
-  return (0, import_node_path11.join)(dir, "mmi", "stage", "state.json");
+  const dir = (0, import_node_path12.isAbsolute)(gitCommonDir) ? gitCommonDir : (0, import_node_path12.resolve)(cwd, gitCommonDir);
+  return (0, import_node_path12.join)(dir, "mmi", "stage", "state.json");
 }
 function normPath2(path2) {
   return path2.replace(/\\/g, "/").replace(/\/+$/, "").toLowerCase();
@@ -8523,14 +8631,14 @@ function stageProcessEnv(stagePort, extraEnv) {
 }
 async function ensureStageRuntimeEnv(config, opts, cwd) {
   if (!config.ensureEnv) return;
-  const target = (0, import_node_path11.join)(cwd, config.ensureEnv.target);
-  const example = (0, import_node_path11.join)(cwd, config.ensureEnv.example);
-  if (!(0, import_node_fs10.existsSync)(target) && (0, import_node_fs10.existsSync)(example)) {
-    (0, import_node_fs10.copyFileSync)(example, target);
-  } else if ((0, import_node_fs10.existsSync)(target) && (0, import_node_fs10.existsSync)(example)) {
-    const stale = detectStaleEnvFile((0, import_node_fs10.readFileSync)(example, "utf8"), (0, import_node_fs10.readFileSync)(target, "utf8"), {
-      exampleMtimeMs: (0, import_node_fs10.statSync)(example).mtimeMs,
-      targetMtimeMs: (0, import_node_fs10.statSync)(target).mtimeMs
+  const target = (0, import_node_path12.join)(cwd, config.ensureEnv.target);
+  const example = (0, import_node_path12.join)(cwd, config.ensureEnv.example);
+  if (!(0, import_node_fs11.existsSync)(target) && (0, import_node_fs11.existsSync)(example)) {
+    (0, import_node_fs11.copyFileSync)(example, target);
+  } else if ((0, import_node_fs11.existsSync)(target) && (0, import_node_fs11.existsSync)(example)) {
+    const stale = detectStaleEnvFile((0, import_node_fs11.readFileSync)(example, "utf8"), (0, import_node_fs11.readFileSync)(target, "utf8"), {
+      exampleMtimeMs: (0, import_node_fs11.statSync)(example).mtimeMs,
+      targetMtimeMs: (0, import_node_fs11.statSync)(target).mtimeMs
     });
     if (stale) {
       const msg = `stale ${config.ensureEnv.target} (${stale}) \u2014 delete it or refresh from ${config.ensureEnv.example} before re-running /stage`;
@@ -8538,8 +8646,8 @@ async function ensureStageRuntimeEnv(config, opts, cwd) {
       console.error(`mmi-cli stage: ${msg} (allowed via --allow-stale-env)`);
     }
   }
-  if (opts.vaultEnvMerge && Object.keys(opts.vaultEnvMerge).length && (0, import_node_fs10.existsSync)(target)) {
-    (0, import_node_fs10.writeFileSync)(target, mergeEnvSecretsIntoFile((0, import_node_fs10.readFileSync)(target, "utf8"), opts.vaultEnvMerge), "utf8");
+  if (opts.vaultEnvMerge && Object.keys(opts.vaultEnvMerge).length && (0, import_node_fs11.existsSync)(target)) {
+    (0, import_node_fs11.writeFileSync)(target, mergeEnvSecretsIntoFile((0, import_node_fs11.readFileSync)(target, "utf8"), opts.vaultEnvMerge), "utf8");
   }
 }
 async function gitText(cwd, args) {
@@ -8569,20 +8677,20 @@ async function resolveGlobalStatePath(cwd, explicit) {
   return void 0;
 }
 function readState(path2) {
-  if (!(0, import_node_fs10.existsSync)(path2)) return null;
+  if (!(0, import_node_fs11.existsSync)(path2)) return null;
   try {
-    return JSON.parse((0, import_node_fs10.readFileSync)(path2, "utf8"));
+    return JSON.parse((0, import_node_fs11.readFileSync)(path2, "utf8"));
   } catch {
     return null;
   }
 }
 function mkdirFor(path2) {
   const dir = path2.slice(0, Math.max(path2.lastIndexOf("/"), path2.lastIndexOf("\\")));
-  (0, import_node_fs10.mkdirSync)(dir, { recursive: true });
+  (0, import_node_fs11.mkdirSync)(dir, { recursive: true });
 }
 function writeState(path2, state) {
   mkdirFor(path2);
-  (0, import_node_fs10.writeFileSync)(path2, JSON.stringify(state, null, 2), "utf8");
+  (0, import_node_fs11.writeFileSync)(path2, JSON.stringify(state, null, 2), "utf8");
 }
 function writeStagePortReservation(port, cwd, statePath, globalStatePath, now) {
   const reservation = {
@@ -8602,7 +8710,7 @@ async function cleanupStageState(state, paths, timeoutMs, fallbackCwd) {
     await shell(state.teardown.command.trim(), state.teardown.cwd || state.cwd || fallbackCwd, timeoutMs);
   }
   for (const path2 of [...new Set(paths.filter((p) => Boolean(p)))]) {
-    (0, import_node_fs10.rmSync)(path2, { force: true });
+    (0, import_node_fs11.rmSync)(path2, { force: true });
   }
 }
 async function killTree(pid) {
@@ -8684,6 +8792,7 @@ async function startStage(config = {}, opts = {}) {
   if (!opts.envPrepared) await ensureStageRuntimeEnv(config, opts, cwd);
   if (stagePort != null && portGuard) await ensureStagePortAvailable(stagePort, cwd, portGuard);
   const extraEnv = stageExtraEnv(config, stagePort);
+  const vaultProcessEnv = opts.vaultEnvMerge ?? {};
   let up = sub(config.up.trim());
   if (opts.forceRecreate) up = appendForceRecreate(up);
   const identity = await resolveStageIdentity(cwd);
@@ -8696,7 +8805,8 @@ async function startStage(config = {}, opts = {}) {
     detached: process.platform !== "win32",
     windowsHide: true,
     stdio: "ignore",
-    env: { ...process.env, ...stageProcessEnv(stagePort, extraEnv) }
+    // Vault secrets first so the stage-selection contract (MMI_STAGE/MMI_PORT/…) always wins on any collision.
+    env: { ...process.env, ...vaultProcessEnv, ...stageProcessEnv(stagePort, extraEnv) }
   });
   const state = {
     pid: child.pid ?? 0,
@@ -8758,8 +8868,8 @@ async function runStage(config = {}, opts = {}) {
     await ensureStageRuntimeEnv(config, opts, cwd);
     if (build) await shell(sub(build), cwd, timeoutMs, stageProcessEnv(stagePort, extraEnv));
   } catch (e) {
-    (0, import_node_fs10.rmSync)(statePath, { force: true });
-    if (globalStatePath && globalStatePath !== statePath) (0, import_node_fs10.rmSync)(globalStatePath, { force: true });
+    (0, import_node_fs11.rmSync)(statePath, { force: true });
+    if (globalStatePath && globalStatePath !== statePath) (0, import_node_fs11.rmSync)(globalStatePath, { force: true });
     throw e;
   }
   const started = await startStage(config, {
@@ -8784,9 +8894,9 @@ function parseNextFromHead(headText) {
 }
 function readStageSummary(worktreePath) {
   const statePath = stageStatePath(worktreePath);
-  if (!(0, import_node_fs11.existsSync)(statePath)) return void 0;
+  if (!(0, import_node_fs12.existsSync)(statePath)) return void 0;
   try {
-    const state = JSON.parse((0, import_node_fs11.readFileSync)(statePath, "utf8"));
+    const state = JSON.parse((0, import_node_fs12.readFileSync)(statePath, "utf8"));
     const port = typeof state.port === "number" ? state.port : void 0;
     if (port == null || !Number.isInteger(port) || port <= 0) return void 0;
     return { port, url: typeof state.url === "string" ? state.url : void 0 };
@@ -8902,7 +9012,7 @@ async function resolveAutoAddBoardAttach(client, cfg, selector, priority, warn =
 // src/gh-create.ts
 var import_promises = require("node:fs/promises");
 var import_node_os3 = require("node:os");
-var import_node_path12 = require("node:path");
+var import_node_path13 = require("node:path");
 var import_node_crypto3 = require("node:crypto");
 var ISSUE_TYPES = ["bug", "feature", "task"];
 var GH_MUTATION_TIMEOUT_MS = 12e4;
@@ -8945,8 +9055,8 @@ async function bodyArgsViaFile(args, deps = {}) {
   const remove = deps.remove ?? import_promises.unlink;
   const ensureDir = deps.ensureDir ?? import_promises.mkdir;
   const dir = deps.dir ?? (0, import_node_os3.tmpdir)();
-  const file = (0, import_node_path12.join)(dir, `mmi-gh-body-${process.pid}-${(0, import_node_crypto3.randomBytes)(4).toString("hex")}.md`);
-  await ensureDir((0, import_node_path12.dirname)(file), { recursive: true }).catch(() => {
+  const file = (0, import_node_path13.join)(dir, `mmi-gh-body-${process.pid}-${(0, import_node_crypto3.randomBytes)(4).toString("hex")}.md`);
+  await ensureDir((0, import_node_path13.dirname)(file), { recursive: true }).catch(() => {
   });
   await write(file, args[i + 1], "utf8");
   return {
@@ -8983,12 +9093,13 @@ function parseAddedItemId(stdout) {
 function isAlreadyOnBoardError(stderr) {
   return /already exists in (?:this|the) project/i.test(stderr);
 }
-function buildPrArgs({ title, body, base, head, repo }) {
+function buildPrArgs({ title, body, base, head, repo, draft }) {
   const args = ["pr", "create"];
   if (repo) args.push("--repo", repo);
   args.push("--title", title, "--body", body);
   if (base) args.push("--base", base);
   if (head) args.push("--head", head);
+  if (draft) args.push("--draft");
   return args;
 }
 
@@ -9683,7 +9794,6 @@ function deriveStageGap(inputs) {
     return `local stage default applies to central-container repos only (tenant-container/solo-container; registry deployModel = ${inputs.deployModel ?? "unset"})`;
   }
   if (!inputs.hasCompose) missing.push("docker-compose.yml");
-  if (!inputs.hasEnvExample) missing.push(".env.example");
   if (!inputs.portRange) missing.push("Hub registry portRange");
   return missing.length ? `cannot derive a default local stage \u2014 missing: ${missing.join(", ")}` : null;
 }
@@ -9699,7 +9809,9 @@ function deriveStage(inputs) {
     // answered" — any HTTP status — is the health signal, not a 2xx on the bare root.
     healthAnyStatus: true,
     portRange: inputs.portRange,
-    ensureEnv: { example: ".env.example", target: ".env" },
+    // #2655: only bootstrap a `.env` when the repo ships `.env.example` (legacy). Without it, the stage is
+    // vault-native — the runner injects the declared dev secrets into the compose process env (no disk file).
+    ...inputs.hasEnvExample ? { ensureEnv: { example: ".env.example", target: ".env" } } : {},
     // MMI_PORT is the host-published port (the free STAGE_PORT); PORT is intentionally absent so compose
     // reads the container's bind port from .env rather than this overriding it to the publish port (#1505).
     env: {
@@ -9777,7 +9889,9 @@ async function runStageLiveUp(deps, t) {
     ref: t.ref,
     ip,
     dispatched: ["tenant-deploy.yml", "tenant-control.yml"],
-    message: `dispatched the dev deploy of ${t.ref} and the Cloudflare edge gate for ${t.host} \u2192 ${ip}; watch the runs in ${STAGE_LIVE_HUB_REPO} Actions \u2014 tear down with: mmi-cli stage --live --down --apply`
+    // #2656: the gate now writes a skip+block pair and self-verifies from the runner (a non-allowed vantage),
+    // so a gate that failed to close fails the run RED. The stage is private only once that gate run is green.
+    message: `dispatched the dev deploy of ${t.ref} and the Cloudflare edge gate for ${t.host} \u2192 ${ip}; watch the runs in ${STAGE_LIVE_HUB_REPO} Actions and treat the stage as private ONLY once the cf-gate-allow run is green (it self-verifies the host is blocked) \u2014 tear down with: mmi-cli stage --live --down --apply`
   };
 }
 async function runStageLiveDown(deps, t) {
@@ -10446,7 +10560,16 @@ async function probeRemoteTag(deps, tag) {
   const remoteOut = await runGitRemoteRead(deps, ["ls-remote", "origin", `refs/tags/${tag}`]);
   return clean2(remoteOut).split(/\s+/)[0] || "";
 }
-async function ensureTagPushed(deps, tag, sha, probed) {
+async function isStrayUnreleasedTag(deps, tag, remoteSha, repo) {
+  try {
+    await deps.run("git", ["merge-base", "--is-ancestor", remoteSha, "origin/main"]);
+    return false;
+  } catch (e) {
+    if (e.code !== 1) return false;
+  }
+  return deps.run("gh", ["release", "view", tag, "--repo", repo, "--json", "tagName"]).then(() => false).catch((e) => /not found|HTTP 404/i.test(e instanceof Error ? e.message : String(e)));
+}
+async function ensureTagPushed(deps, tag, sha, probed, releaseRepo) {
   const remoteSha = probed ? probed.remoteSha : await probeRemoteTag(deps, tag);
   let localSha = "";
   try {
@@ -10455,8 +10578,14 @@ async function ensureTagPushed(deps, tag, sha, probed) {
   }
   if (remoteSha) {
     if (remoteSha !== sha) {
+      const mismatch = `tag ${tag} already exists on origin at ${remoteSha}, but this run intends ${sha}`;
+      if (releaseRepo && await isStrayUnreleasedTag(deps, tag, remoteSha, releaseRepo)) {
+        throw new Error(
+          `${mismatch}. The existing tag is not reachable from origin/main and has no GitHub Release \u2014 it was pushed outside the train, not by a completed release. Sanctioned recovery: delete the stray tag (git push origin --delete ${tag}; git tag -d ${tag} if it exists locally), check the repo's Actions for any workflow the stray tag already triggered, then rerun mmi-cli release --apply (if a publish already ran off the stray tag, mint the next version instead of reusing this one). Never complete the release by hand \u2014 a manual GitHub Release or branch push bypasses the train and leaves main behind.`
+        );
+      }
       throw new Error(
-        `tag ${tag} already exists on origin at ${remoteSha}, but this run intends ${sha} \u2014 refusing to touch a pushed tag. Repair manually: either release the existing tagged commit (reset the local branch to ${remoteSha} and rerun), or mint the next candidate version so a fresh tag is used. Never force-move or delete a pushed tag.`
+        `${mismatch} \u2014 refusing to touch a pushed tag. Repair manually: either release the existing tagged commit (reset the local branch to ${remoteSha} and rerun), or mint the next candidate version so a fresh tag is used. Never force-move or delete a pushed tag.`
       );
     }
     if (localSha && localSha !== sha) {
@@ -10823,7 +10952,7 @@ async function runFoldStage(deps, startBranch, preFold, fn) {
 async function completeMainRelease(deps, ctx, meta, deployModel, watch, options, tag, releaseSha, startBranch, preFold, tagProbe) {
   let tagPush;
   try {
-    tagPush = await ensureTagPushed(deps, tag, releaseSha, tagProbe);
+    tagPush = await ensureTagPushed(deps, tag, releaseSha, tagProbe, ctx.repo);
   } catch (e) {
     throw await recoverFailedFold(deps, e, startBranch, preFold.mainSha);
   }
@@ -12000,8 +12129,8 @@ async function announceRelease(deps, args) {
 }
 
 // src/port-registry.ts
-var import_node_fs12 = require("node:fs");
-var import_node_path13 = require("node:path");
+var import_node_fs13 = require("node:fs");
+var import_node_path14 = require("node:path");
 
 // ../infra/port-geometry.mjs
 var PORT_BLOCK = 100;
@@ -12015,8 +12144,8 @@ function nextPortBlock(registry2) {
   return [base, base + PORT_SPAN];
 }
 function loadPortRegistry(path2) {
-  if (!(0, import_node_fs12.existsSync)(path2)) return {};
-  const raw = JSON.parse((0, import_node_fs12.readFileSync)(path2, "utf8"));
+  if (!(0, import_node_fs13.existsSync)(path2)) return {};
+  const raw = JSON.parse((0, import_node_fs13.readFileSync)(path2, "utf8"));
   const out = {};
   for (const [key, value] of Object.entries(raw)) {
     if (Array.isArray(value) && value.length === 2 && value.every((n) => typeof n === "number")) {
@@ -12030,9 +12159,9 @@ function ensurePortRange(repo, path2) {
   const existing = registry2[repo];
   if (existing) return existing;
   const range = nextPortBlock(registry2);
-  const raw = (0, import_node_fs12.existsSync)(path2) ? JSON.parse((0, import_node_fs12.readFileSync)(path2, "utf8")) : {};
+  const raw = (0, import_node_fs13.existsSync)(path2) ? JSON.parse((0, import_node_fs13.readFileSync)(path2, "utf8")) : {};
   raw[repo] = range;
-  (0, import_node_fs12.writeFileSync)(path2, JSON.stringify(raw, null, 2) + "\n", "utf8");
+  (0, import_node_fs13.writeFileSync)(path2, JSON.stringify(raw, null, 2) + "\n", "utf8");
   return range;
 }
 function portCursorSeed(registry2) {
@@ -12054,20 +12183,26 @@ function existingPortRange(repo, registry2) {
   return registry2[repo] ?? null;
 }
 function portRangeInfraAt(root, source) {
-  const registryPath = (0, import_node_path13.join)(root, "infra", "port-ranges.json");
-  const ddbScriptPath = (0, import_node_path13.join)(root, "infra", "port-ddb.mjs");
-  if (!(0, import_node_fs12.existsSync)(registryPath) || !(0, import_node_fs12.existsSync)(ddbScriptPath)) return null;
+  const registryPath = (0, import_node_path14.join)(root, "infra", "port-ranges.json");
+  const ddbScriptPath = (0, import_node_path14.join)(root, "infra", "port-ddb.mjs");
+  if (!(0, import_node_fs13.existsSync)(registryPath) || !(0, import_node_fs13.existsSync)(ddbScriptPath)) return null;
   return { root, source, registryPath, ddbScriptPath };
 }
-function resolvePortRangeInfra(cwd) {
+function resolvePortRangeInfra(cwd, packageDir) {
   const direct = portRangeInfraAt(cwd, "cwd");
   if (direct) return direct;
-  for (let dir = cwd; ; dir = (0, import_node_path13.dirname)(dir)) {
-    const sibling = portRangeInfraAt((0, import_node_path13.join)(dir, "MMI-Hub"), "sibling-hub");
+  for (let dir = cwd; ; dir = (0, import_node_path14.dirname)(dir)) {
+    const sibling = portRangeInfraAt((0, import_node_path14.join)(dir, "MMI-Hub"), "sibling-hub");
     if (sibling) return sibling;
-    const parent = (0, import_node_path13.dirname)(dir);
-    if (parent === dir) return null;
+    const parent = (0, import_node_path14.dirname)(dir);
+    if (parent === dir) break;
+  }
+  if (packageDir) {
+    const pkgRoot = (0, import_node_path14.join)(packageDir, "..", "..");
+    const pkgFrom = portRangeInfraAt(pkgRoot, "pkg-root");
+    if (pkgFrom) return pkgFrom;
   }
+  return null;
 }
 async function ensurePortRangeAtomic(repo, path2, allocate, opts = {}) {
   const registry2 = loadPortRegistry(path2);
@@ -12954,27 +13089,39 @@ async function tenantDeploy(payload, deps) {
 // src/wiki-publish-command.ts
 async function wikiPublish(deps, opts) {
   if (!opts.pagesDir) {
-    deps.err("wiki publish: <pages-dir> is required");
+    if (opts.json) {
+      deps.log(JSON.stringify({ ok: false, error: "pages-dir is required" }, null, 2));
+    } else {
+      deps.err("wiki publish: <pages-dir> is required");
+    }
     return false;
   }
   const minted = await deps.mint(opts.repo);
   if (!minted.ok) {
-    deps.err(`wiki publish failed: could not mint a scoped wiki token for ${opts.repo}: ${minted.error}`);
+    if (opts.json) {
+      deps.log(JSON.stringify({ ok: false, error: minted.error }, null, 2));
+    } else {
+      deps.err(`wiki publish failed: could not mint a scoped wiki token for ${opts.repo}: ${minted.error}`);
+    }
     return false;
   }
-  const ok = deps.publish({ repo: opts.repo, token: minted.mint.token, pagesDir: opts.pagesDir });
+  const ok = deps.publish({ repo: opts.repo, token: minted.mint.token, pagesDir: opts.pagesDir, json: opts.json });
   if (!ok) {
     return false;
   }
-  deps.log(`wiki published for ${opts.repo} (scoped token, expired/discarded)`);
+  if (opts.json) {
+    deps.log(JSON.stringify({ ok: true, repo: opts.repo }, null, 2));
+  } else {
+    deps.log(`wiki published for ${opts.repo} (scoped token, expired/discarded)`);
+  }
   return true;
 }
 
 // src/wiki-publish-git.ts
 var import_node_child_process8 = require("node:child_process");
-var import_node_fs13 = require("node:fs");
+var import_node_fs14 = require("node:fs");
 var import_node_os5 = require("node:os");
-var import_node_path14 = require("node:path");
+var import_node_path15 = require("node:path");
 var WIKI_STAMP_FILE = ".wiki-state.json";
 function redactWikiSecrets(msg) {
   return msg.replace(/x-access-token:[^@\s]+@/gi, "x-access-token:***@").replace(/(AUTHORIZATION:\s*basic\s+)[A-Za-z0-9+/=]+/gi, "$1***");
@@ -12986,6 +13133,7 @@ function publishWikiViaGit(deps, opts) {
   const dir = deps.mkdtemp();
   const url = `https://github.com/${opts.repo}.wiki.git`;
   const authArgs = wikiAuthArgs(opts.token);
+  const json = opts.json ?? false;
   try {
     deps.gitRun(["init", "-q"], dir);
     deps.gitRun(["remote", "add", "origin", url], dir);
@@ -12995,20 +13143,20 @@ function publishWikiViaGit(deps, opts) {
     let copied = 0;
     for (const f of deps.readdir(opts.pagesDir)) {
       if (f.endsWith(".md")) {
-        deps.copyFile((0, import_node_path14.join)(opts.pagesDir, f), (0, import_node_path14.join)(dir, f));
+        deps.copyFile((0, import_node_path15.join)(opts.pagesDir, f), (0, import_node_path15.join)(dir, f));
         copied++;
       }
     }
     if (!copied) {
-      deps.err(`wiki publish: no .md pages found in ${opts.pagesDir}`);
+      if (!json) deps.err(`wiki publish: no .md pages found in ${opts.pagesDir}`);
       return false;
     }
-    if (deps.fileExists((0, import_node_path14.join)(opts.pagesDir, WIKI_STAMP_FILE))) {
-      deps.copyFile((0, import_node_path14.join)(opts.pagesDir, WIKI_STAMP_FILE), (0, import_node_path14.join)(dir, WIKI_STAMP_FILE));
+    if (deps.fileExists((0, import_node_path15.join)(opts.pagesDir, WIKI_STAMP_FILE))) {
+      deps.copyFile((0, import_node_path15.join)(opts.pagesDir, WIKI_STAMP_FILE), (0, import_node_path15.join)(dir, WIKI_STAMP_FILE));
     }
     deps.gitRun(["add", "-A"], dir);
     if (deps.gitProbe(["diff", "--cached", "--quiet"], dir)) {
-      deps.log("wiki publish: already up to date");
+      if (!json) deps.log("wiki publish: already up to date");
       return true;
     }
     deps.gitRun(
@@ -13026,15 +13174,15 @@ function publishWikiViaGit(deps, opts) {
     try {
       deps.gitRun([...authArgs, "push", "origin", "HEAD:master"], dir);
     } catch (e) {
-      deps.err(
+      if (!json) deps.err(
         `wiki publish failed: push to ${opts.repo}.wiki.git rejected: ${redactWikiSecrets(e.message)} \u2014 if the wiki advanced before this push, re-run wiki publish to pick up the latest wiki state`
       );
       return false;
     }
-    deps.log(`wiki publish: published ${copied} page(s) to ${opts.repo} wiki`);
+    if (!json) deps.log(`wiki publish: published ${copied} page(s) to ${opts.repo} wiki`);
     return true;
   } catch (e) {
-    deps.err(`wiki publish failed: ${redactWikiSecrets(e.message)}`);
+    if (!json) deps.err(`wiki publish failed: ${redactWikiSecrets(e.message)}`);
     return false;
   } finally {
     deps.rm(dir);
@@ -13054,7 +13202,7 @@ function readWikiStampViaGit(deps, opts) {
       return { ok: true, stamp: {} };
     }
     deps.gitRun(["reset", "--hard", "FETCH_HEAD"], dir);
-    const stampPath = (0, import_node_path14.join)(dir, WIKI_STAMP_FILE);
+    const stampPath = (0, import_node_path15.join)(dir, WIKI_STAMP_FILE);
     if (!deps.fileExists(stampPath)) return { ok: true, stamp: {} };
     const parsed = JSON.parse(deps.readFile(stampPath));
     return { ok: true, stamp: parsed && typeof parsed === "object" ? parsed : {} };
@@ -13066,12 +13214,12 @@ function readWikiStampViaGit(deps, opts) {
 }
 function realWikiGitPublishDeps() {
   return {
-    mkdtemp: () => (0, import_node_fs13.mkdtempSync)((0, import_node_path14.join)((0, import_node_os5.tmpdir)(), "wiki-")),
-    readdir: (dir) => (0, import_node_fs13.readdirSync)(dir),
-    copyFile: (src, dest) => (0, import_node_fs13.copyFileSync)(src, dest),
-    fileExists: (p) => (0, import_node_fs13.existsSync)(p),
-    readFile: (p) => (0, import_node_fs13.readFileSync)(p, "utf8"),
-    rm: (p) => (0, import_node_fs13.rmSync)(p, { recursive: true, force: true }),
+    mkdtemp: () => (0, import_node_fs14.mkdtempSync)((0, import_node_path15.join)((0, import_node_os5.tmpdir)(), "wiki-")),
+    readdir: (dir) => (0, import_node_fs14.readdirSync)(dir),
+    copyFile: (src, dest) => (0, import_node_fs14.copyFileSync)(src, dest),
+    fileExists: (p) => (0, import_node_fs14.existsSync)(p),
+    readFile: (p) => (0, import_node_fs14.readFileSync)(p, "utf8"),
+    rm: (p) => (0, import_node_fs14.rmSync)(p, { recursive: true, force: true }),
     gitProbe: (args, cwd) => {
       try {
         (0, import_node_child_process8.execFileSync)("git", args, { cwd, stdio: "pipe" });
@@ -13090,8 +13238,8 @@ function realWikiGitPublishDeps() {
 
 // src/wiki-pages.ts
 var import_node_crypto4 = require("node:crypto");
-var import_node_fs14 = require("node:fs");
-var import_node_path15 = require("node:path");
+var import_node_fs15 = require("node:fs");
+var import_node_path16 = require("node:path");
 var MARKER_RE = /<!--\s*wiki:page\s+([^>]*?)-->/g;
 var attr = (raw, key) => {
   const m = new RegExp(`${key}\\s*=\\s*"([^"]*)"`).exec(raw);
@@ -13117,15 +13265,15 @@ var DURABLE_GLOBS = [
   "docs/org-readme.md"
 ];
 var walkMarkdown = (root, rel) => {
-  const abs = (0, import_node_path15.join)(root, rel);
+  const abs = (0, import_node_path16.join)(root, rel);
   let st;
   try {
-    st = (0, import_node_fs14.statSync)(abs);
+    st = (0, import_node_fs15.statSync)(abs);
   } catch {
     return [];
   }
   if (st.isFile()) return rel.endsWith(".md") ? [rel] : [];
-  return (0, import_node_fs14.readdirSync)(abs).flatMap((name) => walkMarkdown(root, (0, import_node_path15.join)(rel, name)));
+  return (0, import_node_fs15.readdirSync)(abs).flatMap((name) => walkMarkdown(root, (0, import_node_path16.join)(rel, name)));
 };
 function collectFeaturePages({ listDocs, readDoc }) {
   const seen = /* @__PURE__ */ new Set();
@@ -13144,7 +13292,7 @@ function fsReaders(rootDir) {
     listDocs: () => DURABLE_GLOBS.flatMap((g) => walkMarkdown(rootDir, g)),
     readDoc: (p) => {
       try {
-        return (0, import_node_fs14.readFileSync)((0, import_node_path15.join)(rootDir, p), "utf8");
+        return (0, import_node_fs15.readFileSync)((0, import_node_path16.join)(rootDir, p), "utf8");
       } catch {
         return "";
       }
@@ -14473,7 +14621,12 @@ async function targetRepo(deps, opts) {
   return opts.repo ?? repoOf(await vaultSlug(deps, opts));
 }
 async function secretsWhere(deps, opts) {
-  deps.log(formatVaultPointer(vaultPointer(await vaultSlug(deps, opts))));
+  const p = vaultPointer(await vaultSlug(deps, opts));
+  if (opts.json) {
+    deps.log(JSON.stringify(p, null, 2));
+    return;
+  }
+  deps.log(formatVaultPointer(p));
 }
 async function readErr(res) {
   try {
@@ -14536,6 +14689,10 @@ async function secretsList(deps, opts) {
     return;
   }
   const { secrets } = await res.json();
+  if (opts.json) {
+    deps.log(JSON.stringify({ secrets: secrets ?? [] }, null, 2));
+    return;
+  }
   deps.log(formatSecretList(secrets ?? []));
 }
 var CAPABILITIES_TIMEOUT_MS = 2e4;
@@ -14751,6 +14908,13 @@ function requiredRuntimeSecretNames(stage2, contract, opts = {}) {
 function stageKey2(stage2, key) {
   return key.includes("/") ? key : `${stage2}/${key}`;
 }
+function keyDeclaredPerStage(declaredSecrets, key) {
+  if (!declaredSecrets) return void 0;
+  const entry = declaredSecrets[key];
+  if (!entry) return void 0;
+  if (!Array.isArray(entry.stages) || entry.stages.length === 0) return false;
+  return true;
+}
 async function secretsPreflight(deps, opts) {
   const repo = await targetRepo(deps, opts);
   const qs = new URLSearchParams({ repo }).toString();
@@ -14771,9 +14935,23 @@ async function secretsPreflight(deps, opts) {
   }
   const { secrets } = await res.json();
   const present = new Set((secrets ?? []).map((s) => s.key));
-  const missing = opts.required.filter(
-    (key) => !present.has(stageKey2(opts.stage, key)) && !(key.includes("/") ? false : present.has(key))
-  );
+  const missing = opts.required.filter((key) => {
+    const perStage = keyDeclaredPerStage(opts.declaredSecrets, key);
+    if (key.includes("/")) {
+      return !present.has(key);
+    }
+    if (perStage === false) {
+      return !present.has(key);
+    }
+    if (perStage === true) {
+      return !present.has(stageKey2(opts.stage, key));
+    }
+    return !present.has(stageKey2(opts.stage, key)) && !present.has(key);
+  });
+  if (opts.json) {
+    deps.log(JSON.stringify({ ok: missing.length === 0, stage: opts.stage, required: opts.required, missing, present: Array.from(present) }, null, 2));
+    return missing.length === 0;
+  }
   if (missing.length) {
     deps.log(`missing ${missing.map((key) => key.includes("/") ? key : `${stageKey2(opts.stage, key)} (and no stageless ${key})`).join(", ")}`);
     return false;
@@ -14998,9 +15176,6 @@ async function secretsImportRailsCredentials(deps, opts) {
   }
   return true;
 }
-async function secretsEdit(deps, key, opts) {
-  return secretsSet(deps, key, opts);
-}
 async function secretsRemove(deps, key, opts) {
   if (!isValidSecretKey(key)) return deps.err(`invalid secret key ${JSON.stringify(key)}`);
   const repo = await targetRepo(deps, opts);
@@ -15096,8 +15271,12 @@ async function secretsCopy(deps, opts) {
   }
   return true;
 }
+function resolveSpawnTarget(command, args, platform2 = process.platform) {
+  return platform2 === "win32" ? { cmd: "cmd.exe", args: ["/d", "/s", "/c", command, ...args] } : { cmd: command, args };
+}
 function defaultSpawn(command, args, env) {
-  const r = (0, import_node_child_process9.spawnSync)(command, args, { stdio: "inherit", env });
+  const target = resolveSpawnTarget(command, args);
+  const r = (0, import_node_child_process9.spawnSync)(target.cmd, target.args, { stdio: "inherit", env });
   if (r.error) throw r.error;
   return r.status ?? 1;
 }
@@ -15157,8 +15336,8 @@ async function secretsUse(deps, key, opts) {
 }
 
 // src/secrets-commands.ts
-var import_node_fs15 = require("node:fs");
-var import_node_path16 = require("node:path");
+var import_node_fs16 = require("node:fs");
+var import_node_path17 = require("node:path");
 var RAILS_CREDENTIALS_DECRYPT_TIMEOUT_MS = 3e4;
 var DEFAULT_RAILS_CREDENTIALS_FILE = "config/credentials.yml.enc";
 var DEFAULT_RAILS_MASTER_KEY_FILE = "config/master.key";
@@ -15166,18 +15345,18 @@ function collectMap(value, previous = []) {
   return [...previous, value];
 }
 async function decryptRailsCredentials(input) {
-  const appDir = (0, import_node_path16.resolve)(input.appDir ?? process.cwd());
+  const appDir = (0, import_node_path17.resolve)(input.appDir ?? process.cwd());
   const credentialsFile = input.credentialsFile ?? DEFAULT_RAILS_CREDENTIALS_FILE;
   const masterKeyFile = input.masterKeyFile ?? DEFAULT_RAILS_MASTER_KEY_FILE;
-  const credentialsPath = (0, import_node_path16.resolve)(appDir, credentialsFile);
-  const masterKeyPath = (0, import_node_path16.resolve)(appDir, masterKeyFile);
+  const credentialsPath = (0, import_node_path17.resolve)(appDir, credentialsFile);
+  const masterKeyPath = (0, import_node_path17.resolve)(appDir, masterKeyFile);
   const env = {
     ...process.env,
     MMI_RAILS_CREDENTIALS_FILE: credentialsPath,
     MMI_RAILS_MASTER_KEY_FILE: masterKeyPath
   };
-  if ((0, import_node_fs15.existsSync)(masterKeyPath)) {
-    env.RAILS_MASTER_KEY = (0, import_node_fs15.readFileSync)(masterKeyPath, "utf8").trim();
+  if ((0, import_node_fs16.existsSync)(masterKeyPath)) {
+    env.RAILS_MASTER_KEY = (0, import_node_fs16.readFileSync)(masterKeyPath, "utf8").trim();
   }
   const script = [
     'require "json"',
@@ -15231,8 +15410,8 @@ async function withSecrets(run) {
 }
 function registerSecretsCommands(program3) {
   const secrets = program3.command("secrets").description("two-tier project secrets \u2014 self-serve your repo dev/* tier; org tier is master-gated");
-  secrets.command("where").description("print where this repo's secrets live \u2014 the two-tier vault layout + well-known keys (no values)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").action((o) => withSecrets((d) => secretsWhere(d, o)));
-  secrets.command("list").description("list secret NAMES + tier for this repo (never values)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").action((o) => withSecrets((d) => secretsList(d, o)));
+  secrets.command("where").description("print where this repo's secrets live \u2014 the two-tier vault layout + well-known keys (no values)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--json", "machine-readable output").action((o) => withSecrets((d) => secretsWhere(d, o)));
+  secrets.command("list").description("list secret NAMES + tier for this repo (never values)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--json", "machine-readable output").action((o) => withSecrets((d) => secretsList(d, o)));
   secrets.command("find <intent>").description("resolve a plain-language intent to the canonical secret(s) + the exact get command (master-only, #2244)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--json", "machine-readable output").action((intent, o) => withSecrets(async (d) => {
     if (!await secretsFind(d, intent, o)) process.exitCode = 1;
   }));
@@ -15243,13 +15422,13 @@ function registerSecretsCommands(program3) {
   secrets.command("org-catalog").description("MASTER-ONLY: set the _org/<provider>/* catalog declarations from a JSON file (#2244)").requiredOption("--file <path>", 'JSON file: { "entries": { "<provider>/<KEY>": {key,purpose,group,owner,provider,stages[],consumers[]} } }').action((o) => withSecrets(async (d) => {
     let body;
     try {
-      body = (0, import_node_fs15.readFileSync)((0, import_node_path16.resolve)(o.file), "utf8");
+      body = (0, import_node_fs16.readFileSync)((0, import_node_path17.resolve)(o.file), "utf8");
     } catch (e) {
       return fail(`secrets org-catalog: cannot read --file ${o.file}: ${e.message}`);
     }
     if (!await secretsOrgCatalogSet(d, body)) process.exitCode = 1;
   }));
-  secrets.command("preflight").description("check required stage secret names for a deploy/train without reading values").requiredOption("--stage <dev|rc|main>", "stage to check").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--required <KEY...>", "required keys; bare keys are scoped under --stage").action(async (o) => {
+  secrets.command("preflight").description("check required stage secret names for a deploy/train without reading values").requiredOption("--stage <dev|rc|main>", "stage to check").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--required <KEY...>", "required keys; bare keys are scoped under --stage").option("--json", "machine-readable output").action(async (o) => {
     if (!["dev", "rc", "main"].includes(o.stage)) {
       return fail("secrets preflight: --stage must be dev, rc, or main");
     }
@@ -15270,7 +15449,7 @@ function registerSecretsCommands(program3) {
     if (!o.required?.length && centralContainer && meta && !hasRuntimeSecretContract(meta.requiredRuntimeSecrets)) {
       d.err('secrets preflight: requiredRuntimeSecrets is unset: treating as an empty contract (no required keys). Declare an explicit {"dev":[],"rc":[],"main":[]} in registry META to silence this warning.');
     }
-    const ok = await secretsPreflight(d, { repo: o.repo, stage: o.stage, required });
+    const ok = await secretsPreflight(d, { repo: o.repo, stage: o.stage, required, json: o.json, declaredSecrets: meta?.secrets });
     if (!ok) process.exitCode = 1;
   });
   secrets.command("get <key>").description("print one secret value, RAW \u2014 MASTER-ONLY (WS6 #2184); non-master: `secrets use` to consume keyless or `secrets verify` to validate").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--slug <slug>", "vault slug override for org-infra namespaces (cloudflare, shared, \u2026) \u2014 master-gated").action((key, o) => withSecrets(async (d) => {
@@ -15285,14 +15464,12 @@ function registerSecretsCommands(program3) {
     const ok = await secretsVerify(d, key, o);
     if (!ok) process.exitCode = 1;
   }));
-  secrets.command("set <key>").description("write/rotate a secret; value from stdin (never an argument). DECLARE-FIRST (#2528): the key must be a declared catalog coordinate \u2014 bare <KEY> = the stageless canonical, <stage>/<KEY> = a declared per-stage override; undeclared writes are rejected with the fix").option("--repo <owner/repo>", "target repo (defaults to the current repo)").action((key, o) => withSecrets(async (d) => {
+  const setHandler = (key, o) => withSecrets(async (d) => {
     const ok = await secretsSet(d, key, o);
     if (!ok) process.exitCode = 1;
-  }));
-  secrets.command("edit <key>").description("alias for set \u2014 replace a secret value (read from stdin)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").action((key, o) => withSecrets(async (d) => {
-    const ok = await secretsEdit(d, key, o);
-    if (!ok) process.exitCode = 1;
-  }));
+  });
+  secrets.command("set <key>").description("write/rotate a secret; value from stdin (never an argument). DECLARE-FIRST (#2528): the key must be a declared catalog coordinate \u2014 bare <KEY> = the stageless canonical, <stage>/<KEY> = a declared per-stage override; undeclared writes are rejected with the fix").option("--repo <owner/repo>", "target repo (defaults to the current repo)").action(setHandler);
+  secrets.command("edit <key>").description("alias for set \u2014 replace a secret value (read from stdin)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").action(setHandler);
   secrets.command("copy").description("copy provider keys between vault tiers (audit-logged; org-tier source is master-gated)").requiredOption("--from <stage>", "source tier: dev, rc, or main").requiredOption("--to <stage>", "destination tier: dev, rc, or main").requiredOption("--keys <names>", "comma-separated secret names (encryption keys blocked)").option("--dry-run", "report copies without writing").option("--repo <owner/repo>", "target repo (defaults to the current repo)").action((o) => withSecrets(async (d) => {
     const stages = ["dev", "rc", "main"];
     if (!stages.includes(o.from) || !stages.includes(o.to)) {
@@ -15318,7 +15495,7 @@ function registerSecretsCommands(program3) {
       {
         ...d,
         decryptRailsCredentials,
-        removeFile: (path2) => (0, import_node_fs15.unlinkSync)((0, import_node_path16.resolve)(o.appDir ?? process.cwd(), path2))
+        removeFile: (path2) => (0, import_node_fs16.unlinkSync)((0, import_node_path17.resolve)(o.appDir ?? process.cwd(), path2))
       },
       {
         repo: o.repo,
@@ -15407,10 +15584,10 @@ function registerEdgeCommands(program3) {
 }
 
 // src/doctor-run.ts
-var import_node_fs19 = require("node:fs");
+var import_node_fs20 = require("node:fs");
 var import_node_child_process11 = require("node:child_process");
 var import_promises2 = require("node:fs/promises");
-var import_node_path19 = require("node:path");
+var import_node_path20 = require("node:path");
 var import_node_os7 = require("node:os");
 
 // src/plugin-guard.ts
@@ -15433,13 +15610,14 @@ function buildGuardSessionStartLine(state, opts = {}) {
 
 // src/cursor-plugin-seed.ts
 var import_node_child_process10 = require("node:child_process");
-var import_node_fs16 = require("node:fs");
+var import_node_fs17 = require("node:fs");
 var import_node_os6 = require("node:os");
-var import_node_path17 = require("node:path");
+var import_node_path18 = require("node:path");
 var import_node_util7 = require("node:util");
 
 // src/doctor.ts
 var GH_PROJECT_LOGIN_FIX = 'run: gh auth login --hostname github.com --git-protocol https --web --scopes "project"';
+var GITHUB_AUTH_LABEL = "GitHub auth identity (gh ops)";
 var AWS_CROSS_ACCOUNT_LABEL = "AWS cross-account identity (master-agent audits)";
 var AWS_CROSS_ACCOUNT_FIX = "use a non-root IAM user/session profile for master-agent AWS checks; set AWS_PROFILE or AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY (plus AWS_SESSION_TOKEN for temporary credentials), then verify `aws sts get-caller-identity` does not end in :root";
 var MMI_AGENTIC_ONBOARDING_GUIDE = {
@@ -15453,7 +15631,7 @@ function buildGithubAuthCheck(input) {
   const ok = Boolean(input.login?.trim());
   return {
     ok,
-    label: "GitHub auth identity (gh ops)",
+    label: GITHUB_AUTH_LABEL,
     fix: input.ghInstalled ? GH_PROJECT_LOGIN_FIX : `install GitHub CLI (https://cli.github.com), then: ${GH_PROJECT_LOGIN_FIX.replace(/^run: /, "")}`
   };
 }
@@ -15631,6 +15809,136 @@ function buildRepoLocalWorktreeCheck(input) {
     fix: REPO_LOCAL_WORKTREE_FIX
   };
 }
+var LOCKFILE_OPTIONALS_LABEL = "npm lockfile keeps optionalDependencies across platforms (Windows lockfile drop #2594)";
+var LOCKFILE_OPTIONALS_FIX = "regenerate the lockfile without platform filtering: `rm package-lock.json && npm install` on a machine that resolves every optionalDependency, then commit it (a Windows-only lockfile drops Linux-only optionals on CI)";
+function buildLockfileOptionalsCheck(input) {
+  const base = {
+    ok: true,
+    label: LOCKFILE_OPTIONALS_LABEL,
+    fix: LOCKFILE_OPTIONALS_FIX,
+    missingOptionals: []
+  };
+  if (!input.isOrgRepo) return base;
+  const optionalDeps = input.packageJsonOptionalDeps ?? {};
+  const packages = input.lockfilePackages ?? {};
+  const missingOptionals = Object.keys(optionalDeps).filter((name) => !(`node_modules/${name}` in packages));
+  if (missingOptionals.length === 0) return base;
+  return {
+    ...base,
+    ok: false,
+    missingOptionals,
+    detail: `${missingOptionals.length} optionalDependency entr${missingOptionals.length === 1 ? "y" : "ies"} missing from the lockfile packages map: ${missingOptionals.join(", ")}`
+  };
+}
+var FILE_ENCODING_LABEL = "managed file encoding (UTF-8, no BOM, no mojibake)";
+var FILE_ENCODING_FIX = 're-save the flagged file(s) as UTF-8 without BOM (VS Code: status-bar encoding button \u2192 "Save with Encoding" \u2192 UTF-8), and set `PYTHONUTF8=1` for Python tooling on Windows so it never falls back to cp1252';
+function inspectFileEncoding(bytes) {
+  const bom = bytes.length >= 3 && bytes[0] === 239 && bytes[1] === 187 && bytes[2] === 191;
+  let invalidUtf8 = false;
+  let replacementChars = false;
+  try {
+    const text = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+    replacementChars = text.includes("\uFFFD");
+  } catch {
+    invalidUtf8 = true;
+    replacementChars = new TextDecoder("utf-8", { fatal: false }).decode(bytes).includes("\uFFFD");
+  }
+  return { bom, invalidUtf8, replacementChars };
+}
+function buildManagedFileEncodingCheck(input) {
+  const base = {
+    ok: true,
+    label: FILE_ENCODING_LABEL,
+    fix: FILE_ENCODING_FIX,
+    findings: []
+  };
+  if (!input.isOrgRepo) return base;
+  const defective = input.findings.filter((f) => f.bom || f.invalidUtf8 || f.replacementChars);
+  if (defective.length === 0) return base;
+  return {
+    ...base,
+    ok: false,
+    severityOverride: "advisory",
+    findings: defective,
+    detail: `${defective.length} managed file(s) not clean UTF-8: ${defective.map((f) => f.path).join(", ")}`
+  };
+}
+var LOCAL_BEHIND_ORIGIN_LABEL = "local release branches current with origin (development/main/rc)";
+var LOCAL_BEHIND_ORIGIN_FIX = "run `git fetch origin && git switch <branch> && git pull --ff-only` for each flagged branch (purely behind, so the fast-forward is safe)";
+var RELEASE_TRACKING_BRANCHES = /* @__PURE__ */ new Set(["development", "main", "master", "rc", "release"]);
+function isReleaseTrackingBranch(name) {
+  if (!name) return false;
+  const base = name.split("/").pop() ?? name;
+  if (RELEASE_TRACKING_BRANCHES.has(base)) return true;
+  return name.split("/")[0] === "release";
+}
+function buildStaleLocalBranchCheck(input) {
+  const base = {
+    ok: true,
+    label: LOCAL_BEHIND_ORIGIN_LABEL,
+    fix: LOCAL_BEHIND_ORIGIN_FIX,
+    stale: []
+  };
+  if (!input.isOrgRepo) return base;
+  const stale = input.branches.filter((b) => isReleaseTrackingBranch(b.name) && b.behind > 0 && b.ahead === 0).map((b) => ({ name: b.name, behind: b.behind }));
+  if (stale.length === 0) return base;
+  return {
+    ...base,
+    ok: false,
+    severityOverride: "advisory",
+    stale,
+    detail: `${stale.length} release branch(es) behind origin: ${stale.map((s) => `${s.name} (-${s.behind})`).join(", ")}`
+  };
+}
+var REDACTOR_LIVENESS_LABEL = "secret-redact hook liveness (PostToolUse redactor crashes)";
+var REDACTOR_LIVENESS_FIX = 'grep the hook activity log for \'"script":"secret-redact","outcome":"failed"\' (path: `git rev-parse --git-path mmi-runtime/hooks/activity.jsonl`); reinstall the MMI plugin or run `mmi-cli doctor --apply` to repair, then reopen the session \u2014 the redactor stayed fail-open so tool calls proceeded, but secrets may have passed through unredacted while it was down';
+function summarizeRedactorFailures(lines) {
+  const parsed = [];
+  for (const raw of lines) {
+    const trimmed = raw.trim();
+    if (!trimmed) continue;
+    try {
+      parsed.push(JSON.parse(trimmed));
+    } catch {
+    }
+  }
+  let sessionStartIdx = -1;
+  for (let i = 0; i < parsed.length; i += 1) {
+    if (parsed[i].event === "SessionStart") sessionStartIdx = i;
+  }
+  const start = sessionStartIdx >= 0 ? sessionStartIdx : 0;
+  let failedCount = 0;
+  let lastFailedTs;
+  let lastFailedAction;
+  for (let i = start; i < parsed.length; i += 1) {
+    const e = parsed[i];
+    if (e.script === "secret-redact" && e.outcome === "failed") {
+      failedCount += 1;
+      lastFailedTs = e.ts;
+      lastFailedAction = e.action;
+    }
+  }
+  return { failedCount, lastFailedTs, lastFailedAction };
+}
+function buildRedactorLivenessCheck(input) {
+  const base = {
+    ok: true,
+    label: REDACTOR_LIVENESS_LABEL,
+    fix: REDACTOR_LIVENESS_FIX,
+    failedCount: 0
+  };
+  if (!input.isOrgRepo) return base;
+  if (input.failedCount === 0) return base;
+  const when = input.lastFailedTs ? ` (most recent ${input.lastFailedTs})` : "";
+  const reason = input.lastFailedAction ? `: ${input.lastFailedAction}` : "";
+  return {
+    ok: false,
+    label: REDACTOR_LIVENESS_LABEL,
+    fix: `secret-redact crashed ${input.failedCount} time(s) this session${when}${reason}. ${REDACTOR_LIVENESS_FIX}`,
+    failedCount: input.failedCount,
+    lastFailedTs: input.lastFailedTs
+  };
+}
 var SCRATCH_GC_LABEL = "scratch housekeeping (tmp/, plans/, browser artifacts)";
 var SCRATCH_GC_FIX = "run `mmi-cli gc --scratch --dry-run` to inspect; run `mmi-cli gc --scratch --apply` to prune safe scratch; for kept plans run `mmi-cli northstar status` or `mmi-cli northstar sync --wait` first";
 function buildScratchGcCheck(plan) {
@@ -16089,7 +16397,16 @@ function buildDoctorJsonPayload(input) {
   return {
     ok: doctorExitCode(input.checks) === 0,
     hasAdvisories: input.checks.some((c) => !c.ok && isAdvisoryDoctorCheck(c)),
-    checks: input.checks,
+    checks: input.checks.map((check) => {
+      const metadata = doctorMetadataForCheck(check);
+      return {
+        ...check,
+        ...metadata,
+        label: check.label,
+        metadata,
+        durationMs: check.durationMs ?? 0
+      };
+    }),
     updateReport: input.updateReport,
     ...input.resources.length ? { resources: input.resources } : {}
   };
@@ -16148,6 +16465,25 @@ function buildInstalledPluginVersionCheck(input) {
     staleSurfaces: stale
   };
 }
+var CLI_VERSION_DRIFT_LABEL = "mmi-cli version drift (installed vs latest published)";
+var CLI_VERSION_DRIFT_FIX = "run: mmi-cli doctor --apply --no-repo-writes (or npm install -g @mutmutco/cli@latest)";
+function buildCliVersionDriftCheck(input) {
+  const base = {
+    ok: true,
+    label: CLI_VERSION_DRIFT_LABEL,
+    fix: CLI_VERSION_DRIFT_FIX,
+    currentVersion: input.currentVersion,
+    releasedVersion: input.releasedVersion
+  };
+  if (!input.releasedVersion || !isSemverVersion(input.releasedVersion) || !isSemverVersion(input.currentVersion)) return base;
+  if (compareVersions(input.currentVersion, input.releasedVersion) >= 0) return base;
+  return {
+    ...base,
+    ok: false,
+    label: `${CLI_VERSION_DRIFT_LABEL}: ${input.currentVersion} < ${input.releasedVersion}`,
+    fix: `${CLI_VERSION_DRIFT_FIX} (installed ${input.currentVersion} is behind published ${input.releasedVersion})`
+  };
+}
 var OPENCODE_VERSION_LABEL = "installed OpenCode MMI adapter version (vs latest release)";
 function buildOpencodeVersionCheck(input) {
   const fix = pluginRecoveryFix("opencode");
@@ -16445,13 +16781,13 @@ function buildCursorHookCliCheck(input) {
   return base;
 }
 var HUB_COMPAT_FIX = "update mmi-cli (npm i -g @mutmutco/cli) / refresh the MMI plugin, then rerun doctor";
+var HUB_COMPAT_LABEL = "Hub compatibility (client version vs Hub minimum)";
 function buildHubCompatCheck(input) {
-  const label = "Hub compatibility (client version vs Hub minimum)";
   const min = input.versionInfo?.minClientVersion;
   if (!input.isOrgRepo || !min || !parseSemver(min) || !parseSemver(input.installedVersion)) {
-    return { ok: true, label, fix: HUB_COMPAT_FIX };
+    return { ok: true, label: HUB_COMPAT_LABEL, fix: HUB_COMPAT_FIX };
   }
-  return { ok: versionAtLeast(input.installedVersion, min), label: `${label}: requires >= ${min}`, fix: HUB_COMPAT_FIX };
+  return { ok: versionAtLeast(input.installedVersion, min), label: `${HUB_COMPAT_LABEL}: requires >= ${min}`, fix: HUB_COMPAT_FIX };
 }
 var HUB_DEPLOY_FRESHNESS_LABEL = "Hub deploy freshness (x-hub-version vs CLI / release)";
 var HUB_DEPLOY_FRESHNESS_FIX = "prod Hub updates on /release (MMI-Hub is direct-track); lag vs development is expected between releases";
@@ -16486,8 +16822,6 @@ function buildHubDeployFreshnessCheck(input) {
     staleAgainst
   };
 }
-var PLAYWRIGHT_MCP_VISION_CAP_LABEL = "Playwright MCP vision caps (--caps=vision prohibited)";
-var PLAYWRIGHT_MCP_OUTPUT_DIR_LABEL = "Playwright MCP output dir (use tmp/playwright-mcp)";
 function textHasPlaywrightMcp(content) {
   const normalized = content.replace(/\r\n/g, "\n");
   return /@playwright\/mcp/.test(normalized) || /mcp_servers\.playwright/.test(normalized) || /"playwright"\s*:\s*\{/.test(normalized) || /\bmcpServers\b/.test(normalized);
@@ -16545,7 +16879,7 @@ function buildSelfUpdateHaltPayload(input) {
     checks: input.checks
   };
 }
-var DOCTOR_SELF_UPDATE_HALT_EXIT_CODE = 3;
+var DOCTOR_SELF_UPDATE_HALT_EXIT_CODE = 2;
 var DOCTOR_SELF_UPDATE_HALT_SENTINEL = "MMI_DOCTOR_SELF_UPDATE_HALT";
 function selfUpdateHaltSentinelLine(input) {
   const to = input.report.releasedVersion ?? "latest";
@@ -16555,8 +16889,11 @@ var DOCTOR_POST_SELF_UPDATE_ENV = "MMI_DOCTOR_POST_SELF_UPDATE";
 function buildSelfUpdateReexecArgs(opts) {
   const args = ["doctor"];
   if (opts.banner) args.push("--banner");
+  if (opts.fast) args.push("--fast");
   if (opts.preflight) args.push("--preflight");
   if (opts.verbose) args.push("--verbose");
+  if (opts.ci) args.push("--ci");
+  if (opts.strictAdvisory) args.push("--strict-advisory");
   if (opts.guide) args.push("--guide");
   if (opts.json) args.push("--json");
   if (opts.apply) args.push("--apply");
@@ -16577,28 +16914,12 @@ function preflightOutcome(input) {
 function pluginAutonomousHaltLine(reloadHint) {
   return `\u26A0 PLUGIN RELOAD REQUIRED \u2014 mmi:* skills and agent types are unavailable until you ${reloadHint}. Halt autonomous /grind and /build until then.`;
 }
-var DOCTOR_EXTENDED_CHECK_LABELS = /* @__PURE__ */ new Set([
-  AWS_CROSS_ACCOUNT_LABEL,
-  HUB_DEPLOY_FRESHNESS_LABEL,
-  PLAYWRIGHT_MCP_VISION_CAP_LABEL,
-  PLAYWRIGHT_MCP_OUTPUT_DIR_LABEL,
-  BROWSER_ARTIFACTS_LABEL,
-  SCRATCH_GC_LABEL,
-  GIT_GC_LABEL,
-  OPENCODE_VERSION_LABEL,
-  OPENCODE_DESKTOP_BOOTSTRAP_LABEL
-]);
-function isDoctorExtendedCheck(label) {
-  if (DOCTOR_EXTENDED_CHECK_LABELS.has(label)) return true;
-  if (label.startsWith(HUB_DEPLOY_FRESHNESS_LABEL)) return true;
-  if (label.startsWith("@mutmutco design-system") || label.startsWith("@mutmutco registry components")) return true;
-  return false;
-}
 function isAdvisoryDoctorCheck(check) {
   if (check.severityOverride) return check.severityOverride === "advisory";
-  return isDoctorExtendedCheck(check.label);
+  return (check.metadata ?? doctorMetadataForLabel(check.label)).severity === "advisory";
 }
-function doctorExitCode(checks) {
+function doctorExitCode(checks, opts = {}) {
+  if (opts.doctorError) return 2;
   return checks.some((c) => !c.ok && !isAdvisoryDoctorCheck(c)) ? 1 : 0;
 }
 function renderPluginUpdateReportStaleOnly(report, allChecksPass = false) {
@@ -16624,6 +16945,7 @@ function doctorVerdictLine(input) {
   const gaps = input.checks.filter((c) => !c.ok);
   const hardGaps = gaps.filter((c) => !isAdvisoryDoctorCheck(c));
   const softGaps = gaps.filter((c) => isAdvisoryDoctorCheck(c));
+  const skipSuffix = input.skippedSlowChecks ? ` \xB7 skipped ${input.skippedSlowChecks} slow checks` : "";
   if (input.shouldApply) {
     if (hardGaps.length > 0) {
       return `\u2717 ${hardGaps.length} repair${hardGaps.length === 1 ? "" : "s"} failed \u2014 see the items above.`;
@@ -16637,19 +16959,30 @@ function doctorVerdictLine(input) {
   }
   const attention = gaps.length;
   if (attention > 0) {
-    return `\u26A0 ${attention} item${attention === 1 ? " needs" : "s need"} attention \u2014 run \`mmi-cli doctor --apply\` to heal.`;
+    return `\u26A0 ${attention} item${attention === 1 ? " needs" : "s need"} attention \u2014 run \`mmi-cli doctor --apply\` to heal${skipSuffix}.`;
   }
-  return "\u2713 Everything healthy.";
+  return `\u2713 healthy \xB7 ${input.checks.length} checks \xB7 0 gaps${skipSuffix}`;
+}
+function doctorCheckSummaryLine(check) {
+  const meta = doctorMetadataForCheck(check);
+  return `  ${doctorCheckGlyph(check)} ${meta.id} \u2014 ${meta.protects.join("; ")} \u2014 ${check.fix}`;
 }
 function doctorHumanLines(input) {
   const gaps = input.checks.filter((c) => !c.ok);
+  const healthyCount = input.checks.length - gaps.length;
   const lines = [
-    doctorVerdictLine({ checks: input.checks, shouldApply: input.shouldApply, healedCount: input.healedCount }),
-    "",
-    "Checks",
-    ...input.checks.map((c) => `  ${doctorCheckGlyph(c)} ${c.label}`)
+    doctorVerdictLine({ checks: input.checks, shouldApply: input.shouldApply, healedCount: input.healedCount, skippedSlowChecks: input.skippedSlowChecks })
   ];
-  if (gaps.length > 0) {
+  if (gaps.length > 0 || input.verbose) {
+    lines.push("", "Checks");
+    if (input.verbose) {
+      lines.push(...input.checks.map((c) => `  ${doctorCheckGlyph(c)} ${doctorMetadataForCheck(c).id} \u2014 ${c.label}`));
+    } else {
+      lines.push(...gaps.map(doctorCheckSummaryLine));
+      if (healthyCount > 0) lines.push(`  \u2713 ${healthyCount} healthy check${healthyCount === 1 ? "" : "s"} collapsed`);
+    }
+  }
+  if (gaps.length > 0 && input.verbose) {
     lines.push("", input.shouldApply ? "Repairs" : "Will fix on --apply");
     for (const c of gaps) {
       const mark = input.shouldApply ? isAdvisoryDoctorCheck(c) ? "\u26A0" : "\u2717" : "\u2192";
@@ -16659,10 +16992,10 @@ function doctorHumanLines(input) {
   if (input.shouldApply && input.pluginReloadRequired) {
     lines.push("", `\u21BB ${input.reloadHint ?? "reload"} so the healed plugin/MCP installs load.`);
   }
-  const stale = renderPluginUpdateReportStaleOnly(input.updateReport, gaps.length === 0);
+  const stale = input.verbose || gaps.length > 0 ? renderPluginUpdateReportStaleOnly(input.updateReport, gaps.length === 0) : [];
   if (stale.length) {
     lines.push("", ...stale);
-  } else if (!input.verbose) {
+  } else if (!input.verbose && gaps.length > 0) {
     lines.push("", DOCTOR_VERBOSE_HINT);
   }
   if (!input.verbose) return lines;
@@ -16710,6 +17043,100 @@ function doctorAuditLines(input) {
   return lines;
 }
 var PLUGIN_RESOLVABILITY_LABEL = "MMI plugin resolvability (marketplace + cache present)";
+var MMI_CLI_ON_PATH_LABEL = "mmi-cli on PATH";
+var PLUGIN_CLONE_LABEL = "plugin git clone (SSH\u2192HTTPS rewrite)";
+var MCP_RECONCILE_LABEL = "MCP server registrations (org-managed Playwright)";
+var CURSOR_ENABLED_PIN_LABEL = "Cursor Team Marketplace enabled plugin pin";
+var DOCTOR_CHECK_METADATA = [
+  { id: "github.auth", category: "auth", severity: "hard", cost: "fast", heal: "none", label: GITHUB_AUTH_LABEL, protects: ["GitHub issue, PR, project, and registry operations use a resolved viewer identity"] },
+  { id: "cli.path", category: "repo", severity: "hard", cost: "fast", heal: "auto", label: MMI_CLI_ON_PATH_LABEL, protects: ["Session hooks and surface commands can invoke mmi-cli"] },
+  { id: "hub.compat", category: "hub", severity: "hard", cost: "fast", heal: "auto", label: HUB_COMPAT_LABEL, protects: ["Client stays above the Hub minimum version floor"] },
+  { id: "hub.deploy-freshness", category: "hub", severity: "advisory", cost: "slow", heal: "none", label: HUB_DEPLOY_FRESHNESS_LABEL, protects: ["Operators can see prod Hub lag against release and local CLI versions"] },
+  { id: "cli.version-drift", category: "repo", severity: "advisory", cost: "slow", heal: "none", label: CLI_VERSION_DRIFT_LABEL, protects: ["The installed mmi-cli is not behind the npm-published version (stale installs miss commands)"] },
+  { id: "aws.cross-account", category: "aws", severity: "advisory", cost: "slow", heal: "none", label: AWS_CROSS_ACCOUNT_LABEL, protects: ["Master-agent AWS audits do not start from root credentials"] },
+  { id: "plugin.clone-rewrite", category: "plugin", severity: "hard", cost: "fast", heal: "none", label: PLUGIN_CLONE_LABEL, protects: ["Plugin marketplace clones can use the HTTPS rewrite expected on this machine"] },
+  { id: "plugin.install-record", category: "plugin", severity: "hard", cost: "fast", heal: "auto", label: PLUGIN_LABEL, protects: ["Claude/Codex plugin loader sees mmi@mutmutco installed for this project"] },
+  { id: "plugin.legacy-id", category: "plugin", severity: "hard", cost: "fast", heal: "surface", label: LEGACY_PLUGIN_ID_LABEL, protects: ["Legacy mmi@mmi rows cannot mask the canonical mmi@mutmutco install"] },
+  { id: "plugin.config-drift", category: "plugin", severity: "hard", cost: "fast", heal: "auto", label: PLUGIN_DRIFT_LABEL, protects: ["Duplicate or stale plugin rows collapse to one current user-scope row"] },
+  { id: "plugin.resolvability", category: "plugin", severity: "hard", cost: "fast", heal: "surface", label: PLUGIN_RESOLVABILITY_LABEL, protects: ["Marketplace clone and plugin cache both exist for the active surface"] },
+  { id: "plugin.installed-version", category: "plugin", severity: "hard", cost: "fast", heal: "surface", label: INSTALLED_PLUGIN_VERSION_LABEL, protects: ["Claude/Codex installed plugin records reach the latest release"] },
+  { id: "plugin.cache-cleanup", category: "plugin", severity: "hard", cost: "fast", heal: "auto", label: MMI_PLUGIN_CACHE_CLEANUP_LABEL, protects: ["Stale Claude/Codex cache directories do not shadow current installs"] },
+  { id: "plugin.nested-cache", category: "plugin", severity: "hard", cost: "fast", heal: "surface", label: NESTED_PLUGIN_TREE_LABEL, protects: ["Self-nested plugin cache trees do not exceed host path limits"] },
+  { id: "codex.active-cache", category: "plugin", severity: "hard", cost: "fast", heal: "surface", label: CODEX_ACTIVE_CACHE_LABEL, protects: ["Codex actually loads the released plugin cache"] },
+  { id: "session.skill-root", category: "plugin", severity: "advisory", cost: "fast", heal: "none", label: SESSION_SKILL_ROOT_LABEL, protects: ["Running sessions know when a restart is needed to load current skills"] },
+  { id: "repo.gitignore-block", category: "repo", severity: "hard", cost: "fast", heal: "auto", label: GITIGNORE_BLOCK_LABEL, protects: ["Org-managed ignore entries keep generated and scratch files out of git"] },
+  { id: "repo.worktree-location", category: "repo", severity: "hard", cost: "fast", heal: "none", label: REPO_LOCAL_WORKTREE_LABEL, protects: ["Worktrees stay in the canonical sibling root"] },
+  { id: "hooks.redactor-liveness", category: "hooks", severity: "advisory", cost: "fast", heal: "none", label: REDACTOR_LIVENESS_LABEL, protects: ["A crashed secret-redactor cannot silently pass secrets into model context forever"] },
+  { id: "repo.scratch-gc", category: "repo", severity: "advisory", cost: "slow", heal: "auto", label: SCRATCH_GC_LABEL, protects: ["Scratch, plan, and browser artifact clutter stays bounded"] },
+  { id: "repo.git-gc", category: "git", severity: "advisory", cost: "slow", heal: "auto", label: GIT_GC_LABEL, protects: ["Merged branches, stale refs, and dead worktree metadata stay bounded"] },
+  { id: "browser.artifacts", category: "browser", severity: "advisory", cost: "slow", heal: "none", label: BROWSER_ARTIFACTS_LABEL, protects: ["Playwright/browser output stays under tmp/playwright-mcp"] },
+  { id: "mcp.playwright-registration", category: "browser", severity: "hard", cost: "fast", heal: "auto", label: MCP_RECONCILE_LABEL, protects: ["Org-managed Playwright MCP registrations exist and stay drift-free"] },
+  { id: "opencode.version", category: "opencode", severity: "hard", cost: "fast", heal: "surface", label: OPENCODE_VERSION_LABEL, protects: ["OpenCode loads the released MMI adapter"] },
+  { id: "opencode.hook-active", category: "opencode", severity: "hard", cost: "fast", heal: "surface", label: OPENCODE_HOOK_ACTIVE_LABEL, protects: ["OpenCode shell hooks stamp the active MMI adapter surface"] },
+  { id: "opencode.config-plugin", category: "opencode", severity: "hard", cost: "fast", heal: "auto", label: OPENCODE_CONFIG_PLUGIN_LABEL, protects: ["OpenCode config includes the MMI npm adapter"] },
+  { id: "opencode.surface-assets", category: "opencode", severity: "hard", cost: "fast", heal: "auto", label: OPENCODE_SURFACE_ASSETS_LABEL, protects: ["OpenCode commands and skills are materialized"] },
+  { id: "opencode.desktop-bootstrap", category: "opencode", severity: "advisory", cost: "slow", heal: "none", label: OPENCODE_DESKTOP_BOOTSTRAP_LABEL, protects: ["OpenCode Desktop is not pinned to a deleted project bootstrap"] },
+  { id: "opencode.legacy-config", category: "opencode", severity: "hard", cost: "fast", heal: "none", label: OPENCODE_LEGACY_CONFIG_LABEL, protects: ["Legacy OpenCode config cannot load stale bare plugin ids"] },
+  { id: "cursor.install", category: "cursor", severity: "hard", cost: "fast", heal: "auto", label: CURSOR_PLUGIN_INSTALL_LABEL, protects: ["Cursor Team Marketplace cache exists and is complete"] },
+  { id: "cursor.cache-cleanup", category: "cursor", severity: "advisory", cost: "fast", heal: "none", label: CURSOR_PLUGIN_CACHE_CLEANUP_LABEL, protects: ["Old Cursor cache pins are visible without unsafe automatic deletion"] },
+  { id: "cursor.enabled-pin", category: "cursor", severity: "hard", cost: "fast", heal: "none", label: CURSOR_ENABLED_PIN_LABEL, protects: ["Cursor Team Marketplace enabled pin matches the healthy cache"] },
+  { id: "cursor.third-party-extensibility", category: "cursor", severity: "hard", cost: "fast", heal: "none", label: CURSOR_THIRD_PARTY_EXTENSIBILITY_LABEL, protects: ["Cursor does not import third-party hooks that break the Team Marketplace plugin"] },
+  { id: "cursor.hook-cli", category: "cursor", severity: "hard", cost: "fast", heal: "surface", label: CURSOR_HOOK_CLI_LABEL, protects: ["Cursor hooks can reach a bundled or PATH mmi-cli"] },
+  // Incident coverage (#2594) — three real incident classes that previously had zero doctor coverage.
+  { id: "repo-hygiene.lockfile-platform-optionals", category: "repo-hygiene", severity: "hard", cost: "fast", heal: "surface", label: LOCKFILE_OPTIONALS_LABEL, protects: ["A Windows-generated lockfile does not silently drop Linux-only optionalDependencies before CI"] },
+  { id: "repo-hygiene.file-encoding", category: "repo-hygiene", severity: "advisory", cost: "slow", heal: "surface", label: FILE_ENCODING_LABEL, protects: ["Managed source and config files stay clean UTF-8 without BOM or mojibake"] },
+  { id: "repo-hygiene.local-behind-origin", category: "repo-hygiene", severity: "advisory", cost: "slow", heal: "surface", label: LOCAL_BEHIND_ORIGIN_LABEL, protects: ["Local release branches (development/main/rc) do not fall behind origin after a release"] }
+];
+var DOCTOR_CHECK_METADATA_BY_LABEL = Object.fromEntries(
+  DOCTOR_CHECK_METADATA.map((meta) => [meta.label, meta])
+);
+var DOCTOR_EXTENDED_CHECK_LABELS = new Set(
+  DOCTOR_CHECK_METADATA.filter((meta) => meta.cost === "slow").map((meta) => meta.label)
+);
+function derivedDoctorCheckMetadata(label) {
+  if (label.startsWith(HUB_COMPAT_LABEL)) return { ...DOCTOR_CHECK_METADATA_BY_LABEL[HUB_COMPAT_LABEL], label };
+  if (label.startsWith(HUB_DEPLOY_FRESHNESS_LABEL)) return { ...DOCTOR_CHECK_METADATA_BY_LABEL[HUB_DEPLOY_FRESHNESS_LABEL], label };
+  if (label.startsWith("@mutmutco design-system")) {
+    return {
+      id: "registry.design-system-components",
+      category: "hub",
+      severity: "advisory",
+      cost: "slow",
+      heal: "none",
+      label,
+      protects: ["Design-system component cache can be compared against the live registry"]
+    };
+  }
+  if (label.startsWith("@mutmutco registry components")) {
+    return {
+      id: "registry.components",
+      category: "hub",
+      severity: "advisory",
+      cost: "slow",
+      heal: "none",
+      label,
+      protects: ["Repo component cache can be compared against the live registry"]
+    };
+  }
+  return void 0;
+}
+function fallbackDoctorCheckMetadata(label) {
+  return {
+    id: `legacy.${label.toLowerCase().replace(/[^a-z0-9]+/g, ".").replace(/(^\.|\.$)/g, "") || "unknown"}`,
+    category: "repo",
+    severity: "hard",
+    cost: "fast",
+    heal: "none",
+    label,
+    protects: ["Legacy check without catalog metadata"]
+  };
+}
+function doctorMetadataForLabel(label) {
+  return DOCTOR_CHECK_METADATA_BY_LABEL[label] ?? derivedDoctorCheckMetadata(label) ?? fallbackDoctorCheckMetadata(label);
+}
+function doctorMetadataForCheck(check) {
+  return check.metadata ?? doctorMetadataForLabel(check.label);
+}
 function buildPluginResolvabilityCheck(input) {
   const { state } = buildPluginGuardDecision(input);
   const surface = input.surface ?? "shell";
@@ -16755,17 +17182,17 @@ function ghReleaseTarballApiArgs(tag) {
 }
 function cursorUserGlobalStatePath() {
   if (process.platform === "win32") {
-    const base = process.env.APPDATA || (0, import_node_path17.join)((0, import_node_os6.homedir)(), "AppData", "Roaming");
-    return (0, import_node_path17.join)(base, "Cursor", "User", "globalStorage", "state.vscdb");
+    const base = process.env.APPDATA || (0, import_node_path18.join)((0, import_node_os6.homedir)(), "AppData", "Roaming");
+    return (0, import_node_path18.join)(base, "Cursor", "User", "globalStorage", "state.vscdb");
   }
   if (process.platform === "darwin") {
-    return (0, import_node_path17.join)((0, import_node_os6.homedir)(), "Library", "Application Support", "Cursor", "User", "globalStorage", "state.vscdb");
+    return (0, import_node_path18.join)((0, import_node_os6.homedir)(), "Library", "Application Support", "Cursor", "User", "globalStorage", "state.vscdb");
   }
-  return (0, import_node_path17.join)((0, import_node_os6.homedir)(), ".config", "Cursor", "User", "globalStorage", "state.vscdb");
+  return (0, import_node_path18.join)((0, import_node_os6.homedir)(), ".config", "Cursor", "User", "globalStorage", "state.vscdb");
 }
 async function readCursorThirdPartyExtensibilityEnabled(execFileP5) {
   const dbPath = cursorUserGlobalStatePath();
-  if (!(0, import_node_fs16.existsSync)(dbPath)) return void 0;
+  if (!(0, import_node_fs17.existsSync)(dbPath)) return void 0;
   try {
     const { stdout } = await execFileP5("sqlite3", [dbPath, `SELECT value FROM ItemTable WHERE key = '${CURSOR_THIRD_PARTY_STATE_KEY}';`], {
       timeout: 5e3
@@ -16779,57 +17206,57 @@ async function readCursorThirdPartyExtensibilityEnabled(execFileP5) {
   }
 }
 function syncDirContents(src, dest) {
-  (0, import_node_fs16.mkdirSync)(dest, { recursive: true });
-  for (const name of (0, import_node_fs16.readdirSync)(dest)) {
-    (0, import_node_fs16.rmSync)((0, import_node_path17.join)(dest, name), { recursive: true, force: true });
+  (0, import_node_fs17.mkdirSync)(dest, { recursive: true });
+  for (const name of (0, import_node_fs17.readdirSync)(dest)) {
+    (0, import_node_fs17.rmSync)((0, import_node_path18.join)(dest, name), { recursive: true, force: true });
   }
-  (0, import_node_fs16.cpSync)(src, dest, { recursive: true });
+  (0, import_node_fs17.cpSync)(src, dest, { recursive: true });
 }
 function releaseTag(releasedVersion) {
   return releasedVersion.startsWith("v") ? releasedVersion : `v${releasedVersion}`;
 }
 async function extractPluginMmiFromHubCheckout(hubCheckout, tag, tmpRoot, execFileP5) {
-  const tarFile = (0, import_node_path17.join)(tmpRoot, "archive.tar");
+  const tarFile = (0, import_node_path18.join)(tmpRoot, "archive.tar");
   try {
     await execFileP5("git", gitFetchReleaseTagArgs(hubCheckout, tag), { timeout: 6e4 });
     await execFileP5("git", ["-C", hubCheckout, "archive", "--format=tar", `--output=${tarFile}`, tag, "plugins/mmi"], {
       timeout: 6e4
     });
     await execFileP5("tar", ["-xf", tarFile, "-C", tmpRoot], { timeout: 6e4 });
-    const pluginMmi = (0, import_node_path17.join)(tmpRoot, "plugins", "mmi");
-    return (0, import_node_fs16.existsSync)((0, import_node_path17.join)(pluginMmi, PLUGIN_JSON_REL)) ? pluginMmi : void 0;
+    const pluginMmi = (0, import_node_path18.join)(tmpRoot, "plugins", "mmi");
+    return (0, import_node_fs17.existsSync)((0, import_node_path18.join)(pluginMmi, PLUGIN_JSON_REL)) ? pluginMmi : void 0;
   } catch {
     return void 0;
   }
 }
 async function downloadPluginMmiViaGh(tag, tmpRoot) {
-  const tarPath = (0, import_node_path17.join)(tmpRoot, "repo.tgz");
+  const tarPath = (0, import_node_path18.join)(tmpRoot, "repo.tgz");
   try {
-    (0, import_node_fs16.mkdirSync)(tmpRoot, { recursive: true });
+    (0, import_node_fs17.mkdirSync)(tmpRoot, { recursive: true });
     const { stdout } = await execFileBuffer("gh", ghReleaseTarballApiArgs(tag), {
       timeout: 12e4,
       maxBuffer: 100 * 1024 * 1024,
       encoding: "buffer",
       windowsHide: true
     });
-    (0, import_node_fs16.writeFileSync)(tarPath, stdout);
+    (0, import_node_fs17.writeFileSync)(tarPath, stdout);
     await execFileBuffer("tar", ["-xzf", tarPath, "-C", tmpRoot], { timeout: 12e4, windowsHide: true });
-    const top = (0, import_node_fs16.readdirSync)(tmpRoot).find((entry) => entry !== "repo.tgz");
+    const top = (0, import_node_fs17.readdirSync)(tmpRoot).find((entry) => entry !== "repo.tgz");
     if (!top) return void 0;
-    const pluginMmi = (0, import_node_path17.join)(tmpRoot, top, "plugins", "mmi");
-    return (0, import_node_fs16.existsSync)((0, import_node_path17.join)(pluginMmi, PLUGIN_JSON_REL)) ? pluginMmi : void 0;
+    const pluginMmi = (0, import_node_path18.join)(tmpRoot, top, "plugins", "mmi");
+    return (0, import_node_fs17.existsSync)((0, import_node_path18.join)(pluginMmi, PLUGIN_JSON_REL)) ? pluginMmi : void 0;
   } catch {
     return void 0;
   }
 }
 async function resolvePluginMmiSource(releasedVersion, hubCheckout, tmpRoot, execFileP5) {
-  (0, import_node_fs16.mkdirSync)(tmpRoot, { recursive: true });
+  (0, import_node_fs17.mkdirSync)(tmpRoot, { recursive: true });
   const tag = releaseTag(releasedVersion);
   if (hubCheckout) {
     const fromHub = await extractPluginMmiFromHubCheckout(hubCheckout, tag, tmpRoot, execFileP5);
     if (fromHub) return fromHub;
   }
-  return downloadPluginMmiViaGh(tag, (0, import_node_path17.join)(tmpRoot, "gh"));
+  return downloadPluginMmiViaGh(tag, (0, import_node_path18.join)(tmpRoot, "gh"));
 }
 function cursorPluginPinsNeedingSeed(pins, releasedVersion) {
   if (!isSemverVersion2(releasedVersion)) return pins.filter((pin) => !pin.hasPluginJson || !pin.hasHooksJson || pin.isEmpty);
@@ -16843,7 +17270,7 @@ function cursorPluginCacheSeedTargets(pins, releasedVersion, cacheRoot, cacheRoo
   const needing = cursorPluginPinsNeedingSeed(pins, releasedVersion);
   if (needing.length > 0) return needing.map((pin) => pin.path);
   if (pins.length === 0 && cacheRoot && cacheRootExists && isSemverVersion2(releasedVersion)) {
-    return [(0, import_node_path17.join)(cacheRoot, `v${releasedVersion.replace(/^v/, "")}`)];
+    return [(0, import_node_path18.join)(cacheRoot, `v${releasedVersion.replace(/^v/, "")}`)];
   }
   return [];
 }
@@ -16858,10 +17285,10 @@ async function applyCursorPluginCacheSeed(input) {
   for (const dest of targets) {
     syncDirContents(source, dest);
   }
-  (0, import_node_fs16.rmSync)(tmpRoot, { recursive: true, force: true });
+  (0, import_node_fs17.rmSync)(tmpRoot, { recursive: true, force: true });
   return true;
 }
-var CURSOR_ENABLED_PIN_LABEL = "Cursor Team Marketplace enabled plugin pin";
+var CURSOR_ENABLED_PIN_LABEL2 = "Cursor Team Marketplace enabled plugin pin";
 function cursorSplitBrainCapabilities() {
   const skills = OPENCODE_WORKFLOW_COMMANDS.map((c) => `/${c}`).join(", ");
   return `org skills (${skills}) and SessionStart hooks`;
@@ -16881,7 +17308,7 @@ function parseCursorPluginLog(text) {
   return { enabledPin, loadSucceeded, loadFailed };
 }
 function buildCursorEnabledPinCheck(input) {
-  const label = CURSOR_ENABLED_PIN_LABEL;
+  const label = CURSOR_ENABLED_PIN_LABEL2;
   const healthy = { ok: true, label, fix: "" };
   if (!input.isOrgRepo) return healthy;
   if (!input.enabledPin && !input.loadFailed) return healthy;
@@ -16916,7 +17343,7 @@ var PLAYWRIGHT_MCP_SPEC = {
   args: ["-y", "@playwright/mcp@latest", "--output-dir", "tmp/playwright-mcp"],
   legacyNames: []
 };
-var MCP_RECONCILE_LABEL = "MCP server registrations (org-managed Playwright)";
+var MCP_RECONCILE_LABEL2 = "MCP server registrations (org-managed Playwright)";
 var MCP_RECONCILE_FIX = "register/reconcile the org Playwright MCP server (npx -y @playwright/mcp@latest --output-dir tmp/playwright-mcp) \u2014 run `mmi-cli doctor --apply`; see skills/browser-automation/SKILL.md and bootstrap seed mcp-playwright.template.json";
 function extractServerBlock(content, format, spec) {
   return format === "json" ? extractJsonServer(content, spec) : extractTomlServer(content, spec);
@@ -17030,7 +17457,7 @@ function planClaudeCliMcpHeal(item, spec) {
 function buildMcpReconcileCheck(plan) {
   const base = {
     ok: true,
-    label: MCP_RECONCILE_LABEL,
+    label: MCP_RECONCILE_LABEL2,
     fix: MCP_RECONCILE_FIX,
     severityOverride: "advisory"
   };
@@ -17217,9 +17644,9 @@ ${block}
 }
 
 // src/cli-doctor-shared.ts
-var import_node_fs17 = require("node:fs");
-var import_node_path18 = require("node:path");
 var import_node_fs18 = require("node:fs");
+var import_node_path19 = require("node:path");
+var import_node_fs19 = require("node:fs");
 var GC_GH_TIMEOUT_MS = 2e4;
 async function awsCallerArn() {
   try {
@@ -17265,7 +17692,7 @@ async function localBranchHeads() {
 }
 async function currentRepoWorktreeGitRoot(repoRoot) {
   const gitCommonDir = (await execFileP2("git", ["rev-parse", "--git-common-dir"], { timeout: GIT_TIMEOUT_MS }).catch(() => ({ stdout: "" }))).stdout.trim();
-  return gitCommonDir ? (0, import_node_path18.resolve)(repoRoot, gitCommonDir, "worktrees") : "";
+  return gitCommonDir ? (0, import_node_path19.resolve)(repoRoot, gitCommonDir, "worktrees") : "";
 }
 async function worktreeBranches() {
   const { stdout } = await execFileP2("git", ["worktree", "list", "--porcelain"], { timeout: GIT_TIMEOUT_MS });
@@ -17285,18 +17712,18 @@ function resolveGitdirForWorktreeFile(worktreePath, content) {
   const match = /^gitdir:\s*(.+)\s*$/im.exec(content);
   if (!match?.[1]) return void 0;
   const raw = match[1].trim();
-  return (0, import_node_path18.isAbsolute)(raw) ? raw : (0, import_node_path18.resolve)(worktreePath, raw);
+  return (0, import_node_path19.isAbsolute)(raw) ? raw : (0, import_node_path19.resolve)(worktreePath, raw);
 }
 function metadataOwnsMissingWorktreeDir(worktreePath, worktreeGitRoot) {
   if (!worktreeGitRoot) return false;
   try {
-    const entries = (0, import_node_fs18.readdirSync)(worktreeGitRoot, { withFileTypes: true });
+    const entries = (0, import_node_fs19.readdirSync)(worktreeGitRoot, { withFileTypes: true });
     for (const ent of entries) {
       if (!ent.isDirectory()) continue;
       try {
-        const gitdirPath = (0, import_node_fs17.readFileSync)((0, import_node_path18.join)(worktreeGitRoot, ent.name, "gitdir"), "utf8").trim();
-        const resolvedGitdir = (0, import_node_path18.isAbsolute)(gitdirPath) ? gitdirPath : (0, import_node_path18.resolve)(worktreeGitRoot, ent.name, gitdirPath);
-        if (sameWorktreeMetadataPath((0, import_node_path18.dirname)(resolvedGitdir), worktreePath)) return true;
+        const gitdirPath = (0, import_node_fs18.readFileSync)((0, import_node_path19.join)(worktreeGitRoot, ent.name, "gitdir"), "utf8").trim();
+        const resolvedGitdir = (0, import_node_path19.isAbsolute)(gitdirPath) ? gitdirPath : (0, import_node_path19.resolve)(worktreeGitRoot, ent.name, gitdirPath);
+        if (sameWorktreeMetadataPath((0, import_node_path19.dirname)(resolvedGitdir), worktreePath)) return true;
       } catch {
       }
     }
@@ -17306,7 +17733,7 @@ function metadataOwnsMissingWorktreeDir(worktreePath, worktreeGitRoot) {
 }
 function pathExistsKnown(path2) {
   try {
-    (0, import_node_fs18.statSync)(path2);
+    (0, import_node_fs19.statSync)(path2);
     return true;
   } catch (e) {
     const code = typeof e === "object" && e && "code" in e ? String(e.code ?? "") : "";
@@ -17315,10 +17742,10 @@ function pathExistsKnown(path2) {
   }
 }
 function inspectSiblingWorktreeDir(path2, worktreeGitRoot) {
-  const gitPath = (0, import_node_path18.join)(path2, ".git");
+  const gitPath = (0, import_node_path19.join)(path2, ".git");
   let st;
   try {
-    st = (0, import_node_fs18.lstatSync)(gitPath);
+    st = (0, import_node_fs19.lstatSync)(gitPath);
   } catch (e) {
     const code = typeof e === "object" && e && "code" in e ? String(e.code ?? "") : "";
     if (code === "ENOENT" || code === "ENOTDIR") {
@@ -17335,7 +17762,7 @@ function inspectSiblingWorktreeDir(path2, worktreeGitRoot) {
   if (st.isDirectory()) return { path: path2, gitType: "dir" };
   if (!st.isFile()) return { path: path2, gitType: "other" };
   try {
-    const gitFileContent = (0, import_node_fs17.readFileSync)(gitPath, "utf8");
+    const gitFileContent = (0, import_node_fs18.readFileSync)(gitPath, "utf8");
     const gitdir = resolveGitdirForWorktreeFile(path2, gitFileContent);
     const gitDirExists = gitdir ? pathExistsKnown(gitdir) : false;
     return {
@@ -17352,7 +17779,7 @@ function inspectSiblingWorktreeDir(path2, worktreeGitRoot) {
 }
 function inspectDeadWorktreeDirContent(path2) {
   try {
-    return { entries: (0, import_node_fs18.readdirSync)(path2) };
+    return { entries: (0, import_node_fs19.readdirSync)(path2) };
   } catch (e) {
     const code = typeof e === "object" && e && "code" in e ? String(e.code ?? "") : "";
     return { error: code ? `unable to inspect directory contents (${code})` : "unable to inspect directory contents" };
@@ -17371,8 +17798,8 @@ async function siblingWorktreeDirs() {
   const worktreeGitRoot = await currentRepoWorktreeGitRoot(repoRoot);
   const siblingRoot = siblingMmiWorktreesRoot(repoRoot);
   try {
-    const entries = (0, import_node_fs18.readdirSync)(siblingRoot, { withFileTypes: true });
-    return entries.filter((ent) => ent.isDirectory()).map((ent) => inspectSiblingWorktreeDir((0, import_node_path18.join)(siblingRoot, ent.name), worktreeGitRoot)).filter((entry) => Boolean(entry));
+    const entries = (0, import_node_fs19.readdirSync)(siblingRoot, { withFileTypes: true });
+    return entries.filter((ent) => ent.isDirectory()).map((ent) => inspectSiblingWorktreeDir((0, import_node_path19.join)(siblingRoot, ent.name), worktreeGitRoot)).filter((entry) => Boolean(entry));
   } catch {
     return [];
   }
@@ -17422,7 +17849,7 @@ async function fetchHubVersionInfo(baseUrl) {
 }
 function readRepoVersion() {
   try {
-    return JSON.parse((0, import_node_fs19.readFileSync)((0, import_node_path19.join)(process.cwd(), ".claude-plugin", "plugin.json"), "utf8")).version || void 0;
+    return JSON.parse((0, import_node_fs20.readFileSync)((0, import_node_path20.join)(process.cwd(), ".claude-plugin", "plugin.json"), "utf8")).version || void 0;
   } catch {
     return void 0;
   }
@@ -17574,11 +18001,11 @@ async function applyPluginHeal(token, surface, log, opts) {
 }
 var installedPluginsPath = (surface = detectSurface(process.env)) => {
   const homeDir = surface === "codex" ? ".codex" : ".claude";
-  return (0, import_node_path19.join)((0, import_node_os7.homedir)(), homeDir, "plugins", "installed_plugins.json");
+  return (0, import_node_path20.join)((0, import_node_os7.homedir)(), homeDir, "plugins", "installed_plugins.json");
 };
 function readInstalledPlugins(surface = detectSurface(process.env)) {
   try {
-    return JSON.parse((0, import_node_fs19.readFileSync)(installedPluginsPath(surface), "utf8"));
+    return JSON.parse((0, import_node_fs20.readFileSync)(installedPluginsPath(surface), "utf8"));
   } catch {
     return null;
   }
@@ -17586,13 +18013,13 @@ function readInstalledPlugins(surface = detectSurface(process.env)) {
 function marketplaceCloneCandidates(surface, home) {
   if (surface === "codex") {
     return [
-      (0, import_node_path19.join)(home, ".codex", ".tmp", "marketplaces", "mutmutco"),
-      (0, import_node_path19.join)(home, ".codex", "plugins", "marketplaces", "mutmutco")
+      (0, import_node_path20.join)(home, ".codex", ".tmp", "marketplaces", "mutmutco"),
+      (0, import_node_path20.join)(home, ".codex", "plugins", "marketplaces", "mutmutco")
     ];
   }
-  return [(0, import_node_path19.join)(home, ".claude", "plugins", "marketplaces", "mutmutco")];
+  return [(0, import_node_path20.join)(home, ".claude", "plugins", "marketplaces", "mutmutco")];
 }
-function marketplaceClonePresent(surface, home, exists = import_node_fs19.existsSync) {
+function marketplaceClonePresent(surface, home, exists = import_node_fs20.existsSync) {
   return marketplaceCloneCandidates(surface, home).some(exists);
 }
 function snapshotPluginGuardInput(surface = detectSurface(process.env), isOrgRepo = false) {
@@ -17602,14 +18029,14 @@ function snapshotPluginGuardInput(surface = detectSurface(process.env), isOrgRep
     isOrgRepo,
     installRecordPresent: hasUserInstallRecord(installed, MMI_PLUGIN_ID) || hasProjectInstallRecord(installed, MMI_PLUGIN_ID, process.cwd()),
     marketplaceClonePresent: marketplaceClonePresent(surface, (0, import_node_os7.homedir)()),
-    pluginCachePresent: (0, import_node_fs19.existsSync)((0, import_node_path19.join)((0, import_node_os7.homedir)(), homeDir, "plugins", "cache", "mutmutco", "mmi"))
+    pluginCachePresent: (0, import_node_fs20.existsSync)((0, import_node_path20.join)((0, import_node_os7.homedir)(), homeDir, "plugins", "cache", "mutmutco", "mmi"))
   };
 }
 function installedPluginSources() {
   return ["claude", "codex"].map((surface) => {
-    const recordPath = (0, import_node_path19.join)((0, import_node_os7.homedir)(), `.${surface}`, "plugins", "installed_plugins.json");
+    const recordPath = (0, import_node_path20.join)((0, import_node_os7.homedir)(), `.${surface}`, "plugins", "installed_plugins.json");
     try {
-      return { surface, installed: JSON.parse((0, import_node_fs19.readFileSync)(recordPath, "utf8")), recordPath };
+      return { surface, installed: JSON.parse((0, import_node_fs20.readFileSync)(recordPath, "utf8")), recordPath };
     } catch {
       return { surface, installed: null, recordPath };
     }
@@ -17617,7 +18044,7 @@ function installedPluginSources() {
 }
 function readClaudeSettings() {
   try {
-    return JSON.parse((0, import_node_fs19.readFileSync)((0, import_node_path19.join)(process.cwd(), ".claude", "settings.json"), "utf8"));
+    return JSON.parse((0, import_node_fs20.readFileSync)((0, import_node_path20.join)(process.cwd(), ".claude", "settings.json"), "utf8"));
   } catch {
     return null;
   }
@@ -17639,7 +18066,7 @@ function writeProjectInstallRecord(record) {
     const list = file.plugins[MMI_PLUGIN_ID] ?? [];
     list.push(record);
     file.plugins[MMI_PLUGIN_ID] = list;
-    (0, import_node_fs19.writeFileSync)(installedPluginsPath(), `${JSON.stringify(file, null, 2)}
+    (0, import_node_fs20.writeFileSync)(installedPluginsPath(), `${JSON.stringify(file, null, 2)}
 `, "utf8");
     return true;
   } catch {
@@ -17652,9 +18079,9 @@ function backupAndWriteInstalledPlugins(records, pluginId) {
     if (!file) return false;
     if (!file.plugins) file.plugins = {};
     const path2 = installedPluginsPath();
-    (0, import_node_fs19.copyFileSync)(path2, `${path2}.bak`);
+    (0, import_node_fs20.copyFileSync)(path2, `${path2}.bak`);
     file.plugins[pluginId] = records;
-    (0, import_node_fs19.writeFileSync)(path2, `${JSON.stringify(file, null, 2)}
+    (0, import_node_fs20.writeFileSync)(path2, `${JSON.stringify(file, null, 2)}
 `, "utf8");
     return true;
   } catch {
@@ -17662,22 +18089,22 @@ function backupAndWriteInstalledPlugins(records, pluginId) {
   }
 }
 function opencodeConfigDir() {
-  return (0, import_node_path19.join)((0, import_node_os7.homedir)(), ".config", "opencode");
+  return (0, import_node_path20.join)((0, import_node_os7.homedir)(), ".config", "opencode");
 }
 function opencodeConfigPath() {
-  return (0, import_node_path19.join)(opencodeConfigDir(), "opencode.jsonc");
+  return (0, import_node_path20.join)(opencodeConfigDir(), "opencode.jsonc");
 }
 function opencodeCommandsDir() {
-  return (0, import_node_path19.join)(opencodeConfigDir(), "commands");
+  return (0, import_node_path20.join)(opencodeConfigDir(), "commands");
 }
 function opencodeSkillsPath() {
-  return (0, import_node_path19.join)(opencodeConfigDir(), "node_modules", "@mutmutco", "opencode-mmi", "skills");
+  return (0, import_node_path20.join)(opencodeConfigDir(), "node_modules", "@mutmutco", "opencode-mmi", "skills");
 }
 function opencodeConfigSnapshot() {
   const path2 = opencodeConfigPath();
-  if (!(0, import_node_fs19.existsSync)(path2)) return { path: path2, hasConfig: false, hasPluginField: false, parseOk: true };
+  if (!(0, import_node_fs20.existsSync)(path2)) return { path: path2, hasConfig: false, hasPluginField: false, parseOk: true };
   try {
-    const raw = (0, import_node_fs19.readFileSync)(path2, "utf8");
+    const raw = (0, import_node_fs20.readFileSync)(path2, "utf8");
     const parsed = JSON.parse(stripJsonc(raw));
     const hasPluginField = Object.prototype.hasOwnProperty.call(parsed, "plugin");
     const skillsPaths = Array.isArray(parsed.skills?.paths) ? parsed.skills.paths.filter((p) => typeof p === "string") : void 0;
@@ -17700,9 +18127,9 @@ function writeOpencodeConfigPlugin(snapshot) {
     const plan = planOpencodeConfigWrite(snapshot.hasConfig ? snapshot.raw : void 0);
     if (plan.action === "already") return true;
     if (!plan.text || plan.action === "unsafe") return false;
-    (0, import_node_fs19.mkdirSync)((0, import_node_path19.dirname)(path2), { recursive: true });
-    if (snapshot.hasConfig) (0, import_node_fs19.copyFileSync)(path2, `${path2}.bak`);
-    (0, import_node_fs19.writeFileSync)(path2, plan.text, "utf8");
+    (0, import_node_fs20.mkdirSync)((0, import_node_path20.dirname)(path2), { recursive: true });
+    if (snapshot.hasConfig) (0, import_node_fs20.copyFileSync)(path2, `${path2}.bak`);
+    (0, import_node_fs20.writeFileSync)(path2, plan.text, "utf8");
     return true;
   } catch {
     return false;
@@ -17717,9 +18144,9 @@ function writeOpencodeSkillsPath(snapshot, skillsPath) {
     const normalized = skillsPath.replace(/\\/g, "/");
     if (!paths.some((p) => p.replace(/\\/g, "/") === normalized)) paths.push(skillsPath.replace(/\\/g, "/"));
     parsed.skills = { ...skills, paths };
-    (0, import_node_fs19.mkdirSync)((0, import_node_path19.dirname)(snapshot.path), { recursive: true });
-    if (snapshot.hasConfig && (0, import_node_fs19.existsSync)(snapshot.path)) (0, import_node_fs19.copyFileSync)(snapshot.path, `${snapshot.path}.bak`);
-    (0, import_node_fs19.writeFileSync)(snapshot.path, `${JSON.stringify(parsed, null, 2)}
+    (0, import_node_fs20.mkdirSync)((0, import_node_path20.dirname)(snapshot.path), { recursive: true });
+    if (snapshot.hasConfig && (0, import_node_fs20.existsSync)(snapshot.path)) (0, import_node_fs20.copyFileSync)(snapshot.path, `${snapshot.path}.bak`);
+    (0, import_node_fs20.writeFileSync)(snapshot.path, `${JSON.stringify(parsed, null, 2)}
 `, "utf8");
     return true;
   } catch {
@@ -17728,7 +18155,7 @@ function writeOpencodeSkillsPath(snapshot, skillsPath) {
 }
 function opencodeExistingCommands() {
   try {
-    return (0, import_node_fs19.readdirSync)(opencodeCommandsDir(), { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".md")).map((entry) => entry.name.slice(0, -3).toLowerCase());
+    return (0, import_node_fs20.readdirSync)(opencodeCommandsDir(), { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".md")).map((entry) => entry.name.slice(0, -3).toLowerCase());
   } catch {
     return [];
   }
@@ -17736,9 +18163,9 @@ function opencodeExistingCommands() {
 function writeOpencodeCommandFiles() {
   try {
     const dir = opencodeCommandsDir();
-    (0, import_node_fs19.mkdirSync)(dir, { recursive: true });
+    (0, import_node_fs20.mkdirSync)(dir, { recursive: true });
     for (const command of OPENCODE_WORKFLOW_COMMANDS) {
-      (0, import_node_fs19.writeFileSync)((0, import_node_path19.join)(dir, `${command}.md`), opencodeCommandMarkdown(command), "utf8");
+      (0, import_node_fs20.writeFileSync)((0, import_node_path20.join)(dir, `${command}.md`), opencodeCommandMarkdown(command), "utf8");
     }
     return true;
   } catch {
@@ -17747,12 +18174,12 @@ function writeOpencodeCommandFiles() {
 }
 function readOpencodeAdapterDiskVersion() {
   const candidates = [
-    (0, import_node_path19.join)(opencodeConfigDir(), "node_modules", "@mutmutco", "opencode-mmi", "package.json"),
-    (0, import_node_path19.join)((0, import_node_os7.homedir)(), ".cache", "opencode", "node_modules", "@mutmutco", "opencode-mmi", "package.json")
+    (0, import_node_path20.join)(opencodeConfigDir(), "node_modules", "@mutmutco", "opencode-mmi", "package.json"),
+    (0, import_node_path20.join)((0, import_node_os7.homedir)(), ".cache", "opencode", "node_modules", "@mutmutco", "opencode-mmi", "package.json")
   ];
   for (const path2 of candidates) {
     try {
-      const parsed = JSON.parse((0, import_node_fs19.readFileSync)(path2, "utf8"));
+      const parsed = JSON.parse((0, import_node_fs20.readFileSync)(path2, "utf8"));
       if (typeof parsed.version === "string" && parsed.version.trim()) return parsed.version.trim();
     } catch {
       continue;
@@ -17768,7 +18195,7 @@ async function forceInstallOpencodeMmiPlugins(snapshot, log) {
   try {
     const specs = opencodeMmiPluginSpecs(snapshot);
     log(`  \u21BB force-refreshing OpenCode MMI npm plugin(s): ${specs.join(", ")}\u2026`);
-    (0, import_node_fs19.mkdirSync)(opencodeConfigDir(), { recursive: true });
+    (0, import_node_fs20.mkdirSync)(opencodeConfigDir(), { recursive: true });
     await runHostBin("npm", ["install", "--prefix", opencodeConfigDir(), "--force", ...specs], { timeout: NPM_UPDATE_TIMEOUT_MS });
     return true;
   } catch {
@@ -17776,12 +18203,12 @@ async function forceInstallOpencodeMmiPlugins(snapshot, log) {
   }
 }
 function opencodePackagesRoot() {
-  return (0, import_node_path19.join)((0, import_node_os7.homedir)(), ".cache", "opencode", "packages", "@mutmutco");
+  return (0, import_node_path20.join)((0, import_node_os7.homedir)(), ".cache", "opencode", "packages", "@mutmutco");
 }
 function opencodePluginCacheDirs() {
   const root = opencodePackagesRoot();
   try {
-    return (0, import_node_fs19.readdirSync)(root, { withFileTypes: true }).filter((e) => e.isDirectory() && e.name.startsWith("opencode-mmi@") && !e.name.startsWith(".")).map((e) => (0, import_node_path19.join)(root, e.name));
+    return (0, import_node_fs20.readdirSync)(root, { withFileTypes: true }).filter((e) => e.isDirectory() && e.name.startsWith("opencode-mmi@") && !e.name.startsWith(".")).map((e) => (0, import_node_path20.join)(root, e.name));
   } catch {
     return [];
   }
@@ -17789,7 +18216,7 @@ function opencodePluginCacheDirs() {
 function readOpencodeCacheDirVersion(cacheDir) {
   try {
     const parsed = JSON.parse(
-      (0, import_node_fs19.readFileSync)((0, import_node_path19.join)(cacheDir, "node_modules", "@mutmutco", "opencode-mmi", "package.json"), "utf8")
+      (0, import_node_fs20.readFileSync)((0, import_node_path20.join)(cacheDir, "node_modules", "@mutmutco", "opencode-mmi", "package.json"), "utf8")
     );
     return typeof parsed.version === "string" && parsed.version.trim() ? parsed.version.trim() : void 0;
   } catch {
@@ -17812,9 +18239,9 @@ function quarantineStaleOpencodePluginCaches(releasedVersion, log) {
     });
     if (!plan.quarantine) continue;
     try {
-      const quarantineRoot = (0, import_node_path19.join)(opencodePackagesRoot(), ".mmi-quarantine", stamp);
-      (0, import_node_fs19.mkdirSync)(quarantineRoot, { recursive: true });
-      (0, import_node_fs19.renameSync)(cacheDir, (0, import_node_path19.join)(quarantineRoot, (0, import_node_path19.basename)(cacheDir)));
+      const quarantineRoot = (0, import_node_path20.join)(opencodePackagesRoot(), ".mmi-quarantine", stamp);
+      (0, import_node_fs20.mkdirSync)(quarantineRoot, { recursive: true });
+      (0, import_node_fs20.renameSync)(cacheDir, (0, import_node_path20.join)(quarantineRoot, (0, import_node_path20.basename)(cacheDir)));
       log(`  \u21BB quarantined stale OpenCode plugin cache ${plan.cacheVersion} (< ${plan.releasedVersion}) \u2014 OpenCode reinstalls the current adapter on next start`);
       moved = true;
     } catch {
@@ -17840,30 +18267,30 @@ function opencodePluginVersionsForReport() {
 }
 function opencodeDesktopLogsRoot() {
   if (process.platform === "win32") {
-    const base = process.env.APPDATA || (0, import_node_path19.join)((0, import_node_os7.homedir)(), "AppData", "Roaming");
-    return (0, import_node_path19.join)(base, "ai.opencode.desktop", "logs");
+    const base = process.env.APPDATA || (0, import_node_path20.join)((0, import_node_os7.homedir)(), "AppData", "Roaming");
+    return (0, import_node_path20.join)(base, "ai.opencode.desktop", "logs");
   }
   if (process.platform === "darwin") {
-    return (0, import_node_path19.join)((0, import_node_os7.homedir)(), "Library", "Application Support", "ai.opencode.desktop", "logs");
+    return (0, import_node_path20.join)((0, import_node_os7.homedir)(), "Library", "Application Support", "ai.opencode.desktop", "logs");
   }
-  return (0, import_node_path19.join)((0, import_node_os7.homedir)(), ".config", "ai.opencode.desktop", "logs");
+  return (0, import_node_path20.join)((0, import_node_os7.homedir)(), ".config", "ai.opencode.desktop", "logs");
 }
 function opencodeDesktopBootstrapSnapshot() {
   const root = opencodeDesktopLogsRoot();
   try {
-    const sessionDirs = (0, import_node_fs19.readdirSync)(root, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => (0, import_node_path19.join)(root, entry.name)).sort((a, b) => (0, import_node_fs19.statSync)(b).mtimeMs - (0, import_node_fs19.statSync)(a).mtimeMs);
+    const sessionDirs = (0, import_node_fs20.readdirSync)(root, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => (0, import_node_path20.join)(root, entry.name)).sort((a, b) => (0, import_node_fs20.statSync)(b).mtimeMs - (0, import_node_fs20.statSync)(a).mtimeMs);
     const newest = sessionDirs[0];
     if (!newest) return [];
-    const logPath = (0, import_node_path19.join)(newest, "renderer.log");
-    const text = (0, import_node_fs19.readFileSync)(logPath, "utf8");
-    return opencodeAgentDirectoriesFromLog(text).filter((directory) => !(0, import_node_fs19.existsSync)(directory)).map((directory) => ({ directory, logPath }));
+    const logPath = (0, import_node_path20.join)(newest, "renderer.log");
+    const text = (0, import_node_fs20.readFileSync)(logPath, "utf8");
+    return opencodeAgentDirectoriesFromLog(text).filter((directory) => !(0, import_node_fs20.existsSync)(directory)).map((directory) => ({ directory, logPath }));
   } catch {
     return [];
   }
 }
 function opencodeLegacyConfigSnapshot() {
-  const legacyPath = (0, import_node_path19.join)((0, import_node_os7.homedir)(), ".opencode", "opencode.json");
-  if (!(0, import_node_fs19.existsSync)(legacyPath)) return {};
+  const legacyPath = (0, import_node_path20.join)((0, import_node_os7.homedir)(), ".opencode", "opencode.json");
+  if (!(0, import_node_fs20.existsSync)(legacyPath)) return {};
   const content = readTextFile(legacyPath);
   if (content == null) return {};
   const plugins = parseOpencodeLegacyConfigPlugins(content);
@@ -17875,24 +18302,24 @@ function opencodeLegacyConfigSnapshot() {
 function quarantineOpencodeLegacyConfig(legacyPath) {
   try {
     const backupPath = `${legacyPath}.bak`;
-    if ((0, import_node_fs19.existsSync)(backupPath)) return false;
-    (0, import_node_fs19.renameSync)(legacyPath, backupPath);
+    if ((0, import_node_fs20.existsSync)(backupPath)) return false;
+    (0, import_node_fs20.renameSync)(legacyPath, backupPath);
     return true;
   } catch {
     return false;
   }
 }
 function cursorPluginCacheRoot() {
-  return (0, import_node_path19.join)((0, import_node_os7.homedir)(), ".cursor", "plugins", "cache", "mutmutco", "mmi");
+  return (0, import_node_path20.join)((0, import_node_os7.homedir)(), ".cursor", "plugins", "cache", "mutmutco", "mmi");
 }
 function cursorLogsRoot() {
-  if (process.platform === "win32") return (0, import_node_path19.join)((0, import_node_os7.homedir)(), "AppData", "Roaming", "Cursor", "logs");
-  if (process.platform === "darwin") return (0, import_node_path19.join)((0, import_node_os7.homedir)(), "Library", "Application Support", "Cursor", "logs");
-  return (0, import_node_path19.join)((0, import_node_os7.homedir)(), ".config", "Cursor", "logs");
+  if (process.platform === "win32") return (0, import_node_path20.join)((0, import_node_os7.homedir)(), "AppData", "Roaming", "Cursor", "logs");
+  if (process.platform === "darwin") return (0, import_node_path20.join)((0, import_node_os7.homedir)(), "Library", "Application Support", "Cursor", "logs");
+  return (0, import_node_path20.join)((0, import_node_os7.homedir)(), ".config", "Cursor", "logs");
 }
 function safeReaddirNames(dir) {
   try {
-    return (0, import_node_fs19.readdirSync)(dir, { withFileTypes: true }).map((e) => e.name);
+    return (0, import_node_fs20.readdirSync)(dir, { withFileTypes: true }).map((e) => e.name);
   } catch {
     return [];
   }
@@ -17901,15 +18328,15 @@ function readCursorPluginLogText() {
   const root = cursorLogsRoot();
   const sessions = safeReaddirNames(root).sort().reverse();
   for (const session of sessions.slice(0, 5)) {
-    const sessionDir = (0, import_node_path19.join)(root, session);
+    const sessionDir = (0, import_node_path20.join)(root, session);
     const texts = [];
     for (const win of safeReaddirNames(sessionDir).filter((n) => n.startsWith("window"))) {
-      const dir = (0, import_node_path19.join)(sessionDir, win, "exthost", "anysphere.cursor-agent-exec");
+      const dir = (0, import_node_path20.join)(sessionDir, win, "exthost", "anysphere.cursor-agent-exec");
       for (const file of safeReaddirNames(dir)) {
         if (!/^Cursor Plugins.*\.log$/i.test(file)) continue;
-        const path2 = (0, import_node_path19.join)(dir, file);
+        const path2 = (0, import_node_path20.join)(dir, file);
         try {
-          texts.push({ text: (0, import_node_fs19.readFileSync)(path2, "utf8"), mtime: (0, import_node_fs19.statSync)(path2).mtimeMs });
+          texts.push({ text: (0, import_node_fs20.readFileSync)(path2, "utf8"), mtime: (0, import_node_fs20.statSync)(path2).mtimeMs });
         } catch {
         }
       }
@@ -17923,32 +18350,32 @@ function readCursorPluginLogText() {
 function cursorPluginCachePinSnapshots() {
   const root = cursorPluginCacheRoot();
   try {
-    return (0, import_node_fs19.readdirSync)(root, { withFileTypes: true }).filter((entry) => entry.isDirectory() && !entry.name.startsWith(".")).map((entry) => {
-      const path2 = (0, import_node_path19.join)(root, entry.name);
-      const pluginJson = (0, import_node_path19.join)(path2, ".cursor-plugin", "plugin.json");
-      const hooksJson = (0, import_node_path19.join)(path2, "hooks", "hooks.json");
-      const cliBundle = (0, import_node_path19.join)(path2, "cli", "dist", "index.cjs");
-      const cursorHook = (0, import_node_path19.join)(path2, "scripts", "cursor-hook.mjs");
+    return (0, import_node_fs20.readdirSync)(root, { withFileTypes: true }).filter((entry) => entry.isDirectory() && !entry.name.startsWith(".")).map((entry) => {
+      const path2 = (0, import_node_path20.join)(root, entry.name);
+      const pluginJson = (0, import_node_path20.join)(path2, ".cursor-plugin", "plugin.json");
+      const hooksJson = (0, import_node_path20.join)(path2, "hooks", "hooks.json");
+      const cliBundle = (0, import_node_path20.join)(path2, "cli", "dist", "index.cjs");
+      const cursorHook = (0, import_node_path20.join)(path2, "scripts", "cursor-hook.mjs");
       let version;
       try {
-        const raw = JSON.parse((0, import_node_fs19.readFileSync)(pluginJson, "utf8"));
+        const raw = JSON.parse((0, import_node_fs20.readFileSync)(pluginJson, "utf8"));
         version = typeof raw.version === "string" ? raw.version : void 0;
       } catch {
         version = void 0;
       }
       let isEmpty = true;
       try {
-        isEmpty = (0, import_node_fs19.readdirSync)(path2).length === 0;
+        isEmpty = (0, import_node_fs20.readdirSync)(path2).length === 0;
       } catch {
         isEmpty = true;
       }
       return {
         name: entry.name,
         path: path2,
-        hasPluginJson: (0, import_node_fs19.existsSync)(pluginJson),
-        hasHooksJson: (0, import_node_fs19.existsSync)(hooksJson),
-        hasCliBundle: (0, import_node_fs19.existsSync)(cliBundle),
-        hasCursorHookScript: (0, import_node_fs19.existsSync)(cursorHook),
+        hasPluginJson: (0, import_node_fs20.existsSync)(pluginJson),
+        hasHooksJson: (0, import_node_fs20.existsSync)(hooksJson),
+        hasCliBundle: (0, import_node_fs20.existsSync)(cliBundle),
+        hasCursorHookScript: (0, import_node_fs20.existsSync)(cursorHook),
         isEmpty,
         version
       };
@@ -17958,19 +18385,19 @@ function cursorPluginCachePinSnapshots() {
   }
 }
 function hubCheckoutForCursorSeed() {
-  const manifest = (0, import_node_path19.join)(process.cwd(), "plugins", "mmi", ".cursor-plugin", "plugin.json");
-  return (0, import_node_fs19.existsSync)(manifest) ? process.cwd() : void 0;
+  const manifest = (0, import_node_path20.join)(process.cwd(), "plugins", "mmi", ".cursor-plugin", "plugin.json");
+  return (0, import_node_fs20.existsSync)(manifest) ? process.cwd() : void 0;
 }
 function mmiPluginCacheRootSnapshots() {
   const roots = [
-    { surface: "claude", root: (0, import_node_path19.join)((0, import_node_os7.homedir)(), ".claude", "plugins", "cache", "mutmutco", "mmi") },
-    { surface: "codex", root: (0, import_node_path19.join)((0, import_node_os7.homedir)(), ".codex", "plugins", "cache", "mutmutco", "mmi") }
+    { surface: "claude", root: (0, import_node_path20.join)((0, import_node_os7.homedir)(), ".claude", "plugins", "cache", "mutmutco", "mmi") },
+    { surface: "codex", root: (0, import_node_path20.join)((0, import_node_os7.homedir)(), ".codex", "plugins", "cache", "mutmutco", "mmi") }
   ];
   return roots.flatMap(({ surface, root }) => {
     try {
-      const entries = (0, import_node_fs19.readdirSync)(root, { withFileTypes: true }).map((entry) => ({
+      const entries = (0, import_node_fs20.readdirSync)(root, { withFileTypes: true }).map((entry) => ({
         name: entry.name,
-        path: (0, import_node_path19.join)(root, entry.name),
+        path: (0, import_node_path20.join)(root, entry.name),
         isDirectory: entry.isDirectory()
       }));
       return [{ surface, root, entries }];
@@ -17981,7 +18408,7 @@ function mmiPluginCacheRootSnapshots() {
 }
 function hasNestedMmiChild(versionDir) {
   try {
-    return (0, import_node_fs19.statSync)((0, import_node_path19.join)(versionDir, "mmi")).isDirectory();
+    return (0, import_node_fs20.statSync)((0, import_node_path20.join)(versionDir, "mmi")).isDirectory();
   } catch {
     return false;
   }
@@ -17992,10 +18419,10 @@ function nestedPluginTreeSnapshot() {
   );
 }
 function uniqueQuarantineTarget(path2) {
-  if (!(0, import_node_fs19.existsSync)(path2)) return path2;
+  if (!(0, import_node_fs20.existsSync)(path2)) return path2;
   for (let i = 1; i < 100; i += 1) {
     const candidate = `${path2}-${i}`;
-    if (!(0, import_node_fs19.existsSync)(candidate)) return candidate;
+    if (!(0, import_node_fs20.existsSync)(candidate)) return candidate;
   }
   return `${path2}-${Date.now()}`;
 }
@@ -18004,10 +18431,10 @@ function quarantinePluginCacheDirs(plan) {
   const failed = [];
   for (const move of plan) {
     try {
-      if (!(0, import_node_fs19.existsSync)(move.from)) continue;
+      if (!(0, import_node_fs20.existsSync)(move.from)) continue;
       const target = uniqueQuarantineTarget(move.to);
-      (0, import_node_fs19.mkdirSync)((0, import_node_path19.dirname)(target), { recursive: true });
-      (0, import_node_fs19.renameSync)(move.from, target);
+      (0, import_node_fs20.mkdirSync)((0, import_node_path20.dirname)(target), { recursive: true });
+      (0, import_node_fs20.renameSync)(move.from, target);
       moved += 1;
     } catch {
       failed.push(move);
@@ -18026,23 +18453,23 @@ async function robocopyMirrorEmpty(emptyDir, target) {
 }
 async function clearNestedPluginTreeDir(targetPath) {
   try {
-    if (!(0, import_node_fs19.existsSync)(targetPath)) return true;
+    if (!(0, import_node_fs20.existsSync)(targetPath)) return true;
     if (isWin) {
-      const emptyDir = (0, import_node_path19.join)((0, import_node_os7.tmpdir)(), `mmi-empty-${Date.now()}`);
-      (0, import_node_fs19.mkdirSync)(emptyDir, { recursive: true });
+      const emptyDir = (0, import_node_path20.join)((0, import_node_os7.tmpdir)(), `mmi-empty-${Date.now()}`);
+      (0, import_node_fs20.mkdirSync)(emptyDir, { recursive: true });
       try {
         await robocopyMirrorEmpty(emptyDir, targetPath);
-        (0, import_node_fs19.rmSync)(targetPath, { recursive: true, force: true });
+        (0, import_node_fs20.rmSync)(targetPath, { recursive: true, force: true });
       } finally {
         try {
-          (0, import_node_fs19.rmSync)(emptyDir, { recursive: true, force: true });
+          (0, import_node_fs20.rmSync)(emptyDir, { recursive: true, force: true });
         } catch {
         }
       }
-      return !(0, import_node_fs19.existsSync)(targetPath);
+      return !(0, import_node_fs20.existsSync)(targetPath);
     }
-    (0, import_node_fs19.rmSync)(targetPath, { recursive: true, force: true });
-    return !(0, import_node_fs19.existsSync)(targetPath);
+    (0, import_node_fs20.rmSync)(targetPath, { recursive: true, force: true });
+    return !(0, import_node_fs20.existsSync)(targetPath);
   } catch {
     return false;
   }
@@ -18055,18 +18482,18 @@ async function applyNestedPluginTreeCleanup(paths, log) {
   }
   return true;
 }
-var gitignorePath = () => (0, import_node_path19.join)(process.cwd(), ".gitignore");
+var gitignorePath = () => (0, import_node_path20.join)(process.cwd(), ".gitignore");
 function readTextFile(path2) {
   try {
-    if (!(0, import_node_fs19.existsSync)(path2)) return null;
-    return (0, import_node_fs19.readFileSync)(path2, "utf8");
+    if (!(0, import_node_fs20.existsSync)(path2)) return null;
+    return (0, import_node_fs20.readFileSync)(path2, "utf8");
   } catch {
     return null;
   }
 }
 function mcpDirExists(path2) {
   try {
-    return (0, import_node_fs19.existsSync)(path2);
+    return (0, import_node_fs20.existsSync)(path2);
   } catch {
     return false;
   }
@@ -18074,60 +18501,60 @@ function mcpDirExists(path2) {
 function mcpConfigTargets() {
   const cwd = process.cwd();
   const home = (0, import_node_os7.homedir)();
-  const cursorProjectDir = (0, import_node_path19.join)(cwd, ".cursor");
-  const cursorUserDir = (0, import_node_path19.join)(home, ".cursor");
-  const codexDir = (0, import_node_path19.join)(home, ".codex");
+  const cursorProjectDir = (0, import_node_path20.join)(cwd, ".cursor");
+  const cursorUserDir = (0, import_node_path20.join)(home, ".cursor");
+  const codexDir = (0, import_node_path20.join)(home, ".codex");
   return [
     // Claude Code project MCP — reconciled if present, never conjured (org seeds .cursor/mcp.json, not this).
     {
       host: "claude-code",
       label: "Claude Code project MCP",
-      path: (0, import_node_path19.join)(cwd, ".mcp.json"),
+      path: (0, import_node_path20.join)(cwd, ".mcp.json"),
       format: "json",
       present: true,
       // parent is the repo root (cwd); the caller gates the whole reconcile on isOrgRepo
       isRepoFile: true,
       createWhenFileAbsent: false,
-      content: readTextFile((0, import_node_path19.join)(cwd, ".mcp.json"))
+      content: readTextFile((0, import_node_path20.join)(cwd, ".mcp.json"))
     },
     // Cursor project MCP — the bootstrap-seeded surface; restored if its .cursor dir exists but the file is gone.
     {
       host: "cursor-project",
       label: "Cursor project MCP",
-      path: (0, import_node_path19.join)(cursorProjectDir, "mcp.json"),
+      path: (0, import_node_path20.join)(cursorProjectDir, "mcp.json"),
       format: "json",
       present: mcpDirExists(cursorProjectDir),
       isRepoFile: true,
       createWhenFileAbsent: true,
-      content: readTextFile((0, import_node_path19.join)(cursorProjectDir, "mcp.json"))
+      content: readTextFile((0, import_node_path20.join)(cursorProjectDir, "mcp.json"))
     },
     // Cursor user MCP — global; written only when Cursor is installed (~/.cursor exists).
     {
       host: "cursor-user",
       label: "Cursor user MCP",
-      path: (0, import_node_path19.join)(cursorUserDir, "mcp.json"),
+      path: (0, import_node_path20.join)(cursorUserDir, "mcp.json"),
       format: "json",
       present: mcpDirExists(cursorUserDir),
       isRepoFile: false,
       createWhenFileAbsent: true,
-      content: readTextFile((0, import_node_path19.join)(cursorUserDir, "mcp.json"))
+      content: readTextFile((0, import_node_path20.join)(cursorUserDir, "mcp.json"))
     },
     // Codex user config (TOML) — global; written only when Codex is installed (~/.codex exists).
     {
       host: "codex",
       label: "Codex user config",
-      path: (0, import_node_path19.join)(codexDir, "config.toml"),
+      path: (0, import_node_path20.join)(codexDir, "config.toml"),
       format: "toml",
       present: mcpDirExists(codexDir),
       isRepoFile: false,
       createWhenFileAbsent: true,
-      content: readTextFile((0, import_node_path19.join)(codexDir, "config.toml"))
+      content: readTextFile((0, import_node_path20.join)(codexDir, "config.toml"))
     }
   ];
 }
 function writeMcpConfigFile(path2, content) {
   try {
-    (0, import_node_fs19.writeFileSync)(path2, content, "utf8");
+    (0, import_node_fs20.writeFileSync)(path2, content, "utf8");
     return true;
   } catch {
     return false;
@@ -18207,7 +18634,7 @@ function strayBrowserArtifactPaths() {
   const cwd = process.cwd();
   return STRAY_BROWSER_ARTIFACT_DIRS.filter((rel) => {
     try {
-      return (0, import_node_fs19.existsSync)((0, import_node_path19.join)(cwd, rel));
+      return (0, import_node_fs20.existsSync)((0, import_node_path20.join)(cwd, rel));
     } catch {
       return false;
     }
@@ -18215,37 +18642,119 @@ function strayBrowserArtifactPaths() {
 }
 function readGitignore() {
   try {
-    return (0, import_node_fs19.readFileSync)(gitignorePath(), "utf8");
+    return (0, import_node_fs20.readFileSync)(gitignorePath(), "utf8");
   } catch {
     return null;
   }
 }
 function writeGitignore(content) {
   try {
-    (0, import_node_fs19.writeFileSync)(gitignorePath(), content, "utf8");
+    (0, import_node_fs20.writeFileSync)(gitignorePath(), content, "utf8");
     return true;
   } catch {
     return false;
   }
 }
+function readRepoJson(rel) {
+  try {
+    return JSON.parse((0, import_node_fs20.readFileSync)((0, import_node_path20.join)(process.cwd(), rel), "utf8"));
+  } catch {
+    return null;
+  }
+}
+var ENCODING_SCAN_ROOT_FILES = ["AGENTS.md", "README.md", "CLAUDE.md", "package.json", "opencode.json"];
+var ENCODING_SCAN_DIRS = [".claude", "hooks", "scripts"];
+var ENCODING_SCAN_EXTS = /* @__PURE__ */ new Set([".md", ".json", ".jsonc", ".ts", ".js", ".cjs", ".mjs", ".sh", ".ps1", ".py", ".txt"]);
+var ENCODING_SCAN_MAX_FILES = 400;
+function listTextFilesUnder(dirRel, out, budget) {
+  let entries;
+  try {
+    entries = (0, import_node_fs20.readdirSync)((0, import_node_path20.join)(process.cwd(), dirRel), { withFileTypes: true });
+  } catch {
+    return;
+  }
+  for (const ent of entries) {
+    if (budget.count >= ENCODING_SCAN_MAX_FILES) return;
+    const rel = `${dirRel}/${ent.name}`;
+    if (ent.isDirectory()) {
+      if (ent.name === "node_modules" || ent.name === "dist" || ent.name === ".git" || ent.name.startsWith(".")) continue;
+      listTextFilesUnder(rel, out, budget);
+    } else if (ent.isFile()) {
+      const ext = ent.name.slice(ent.name.lastIndexOf("."));
+      if (ENCODING_SCAN_EXTS.has(ext)) {
+        out.push(rel);
+        budget.count++;
+      }
+    }
+  }
+}
+function managedFileEncodingFindings() {
+  const cwd = process.cwd();
+  const paths = [];
+  for (const f of ENCODING_SCAN_ROOT_FILES) {
+    try {
+      if ((0, import_node_fs20.existsSync)((0, import_node_path20.join)(cwd, f))) paths.push(f);
+    } catch {
+    }
+  }
+  const budget = { count: 0 };
+  for (const d of ENCODING_SCAN_DIRS) listTextFilesUnder(d, paths, budget);
+  const findings = [];
+  for (const rel of paths) {
+    try {
+      const probe = inspectFileEncoding((0, import_node_fs20.readFileSync)((0, import_node_path20.join)(cwd, rel)));
+      if (probe.bom || probe.invalidUtf8 || probe.replacementChars) findings.push({ path: rel, ...probe });
+    } catch {
+    }
+  }
+  return findings;
+}
+async function branchAheadBehind(branch) {
+  const spec = `origin/${branch}...${branch}`;
+  try {
+    const { stdout } = await execFileP2("git", ["rev-list", "--left-right", "--count", spec], { timeout: GIT_TIMEOUT_MS });
+    const [behind, ahead] = stdout.trim().split(/\s+/).map((n) => Number.parseInt(n, 10));
+    if (Number.isNaN(behind) || Number.isNaN(ahead)) return null;
+    return { behind, ahead };
+  } catch {
+    return null;
+  }
+}
+async function localReleaseBranchSnapshots() {
+  let local;
+  try {
+    const { stdout } = await execFileP2("git", ["for-each-ref", "--format=%(refname:short)", "refs/heads"], { timeout: GIT_TIMEOUT_MS });
+    local = stdout.split(/\r?\n/).map((b) => b.trim()).filter(Boolean);
+  } catch {
+    return [];
+  }
+  const releaseBranches = local.filter((b) => b === "development" || b === "main" || b === "master" || b === "rc" || b.startsWith("release/"));
+  const rows = [];
+  for (const branch of releaseBranches) {
+    const ab = await branchAheadBehind(branch);
+    if (ab) rows.push({ name: branch, ...ab });
+  }
+  return rows;
+}
 async function runDoctor(opts, io = consoleIo, readOrigin) {
   if (opts.guide) {
     if (opts.json) io.log(JSON.stringify({ resources: [MMI_AGENTIC_ONBOARDING_GUIDE] }, null, 2));
     else io.log(MMI_AGENTIC_ONBOARDING_GUIDE.url);
     return;
   }
-  const repairLocal = !opts.json || Boolean(opts.apply) || Boolean(opts.preflight);
+  const repairLocal = !opts.fast && (!opts.json || Boolean(opts.apply) || Boolean(opts.preflight));
   const repoWritesAllowed = !opts.noRepoWrites;
-  const runExtended = Boolean(opts.verbose) || Boolean(opts.json);
+  const runExtended = !opts.fast && (Boolean(opts.verbose) || Boolean(opts.json));
+  const slowSkippedCount = opts.fast ? DOCTOR_EXTENDED_CHECK_LABELS.size : 0;
   const checks = [];
   const REWRITE_KEY = "url.https://github.com/.insteadOf";
   const CLONE_FIX = 'run: git config --global url."https://github.com/".insteadOf "git@github.com:"';
   const [login, pathProbe, releasedVersionResolution, cfg, callerArn, cloneProbe, isOrgRepo] = await Promise.all([
-    githubLogin(),
+    opts.fast ? Promise.resolve(void 0) : githubLogin(),
     execFileP2(isWin ? "where" : "which", ["mmi-cli"]).then(() => true).catch(() => false),
-    fetchReleasedVersion(),
+    opts.fast ? Promise.resolve({ version: void 0, source: "unavailable" }) : fetchReleasedVersion(),
     loadConfig(),
-    awsCallerArn(),
+    opts.fast ? Promise.resolve(void 0) : awsCallerArn(),
     execFileP2("git", ["config", "--global", "--get-all", REWRITE_KEY]).then(({ stdout }) => stdout.split("\n").some((l) => l.trim() === "git@github.com:")).catch(() => false),
     // unset → repair below
     // hub-v3 step-back: org-membership gates the repo-local checks/repairs by the git `origin` remote,
@@ -18264,7 +18773,7 @@ async function runDoctor(opts, io = consoleIo, readOrigin) {
   const semverPrefix = /^\d+\.\d+\.\d+/;
   const isBehind = (installed2, released) => Boolean(installed2 && released && semverPrefix.test(installed2) && semverPrefix.test(released) && compareVersions(installed2, released) < 0);
   const opencodeAdapterStale = isBehind(opencodeInstalledVersionForDoctor(), releasedVersion);
-  const cursorCacheStale = (0, import_node_fs19.existsSync)(cursorPluginCacheRoot()) && (cursorPluginCachePinSnapshots() ?? []).some((p) => isBehind(p.version, releasedVersion));
+  const cursorCacheStale = (0, import_node_fs20.existsSync)(cursorPluginCacheRoot()) && (cursorPluginCachePinSnapshots() ?? []).some((p) => isBehind(p.version, releasedVersion));
   const healPlan = doctorHealPlan({
     isOrgRepo,
     surface,
@@ -18286,20 +18795,22 @@ async function runDoctor(opts, io = consoleIo, readOrigin) {
   if (opts.preflight && !healPlan.needsEagerHeal) return;
   const eagerHeal = Boolean(opts.preflight) || Boolean(opts.banner) && healPlan.needsEagerHeal;
   if (eagerHeal && healPlan.needsEagerHeal) io.err(DOCTOR_PREFLIGHT_NOTICE);
-  const repairFull = !opts.json && !opts.banner || Boolean(opts.apply) || Boolean(opts.preflight) || Boolean(opts.banner) && healPlan.needsEagerHeal;
-  let ghInstalled = true;
-  if (!login) {
-    try {
-      await execFileP2("gh", ["--version"]);
-    } catch {
-      ghInstalled = false;
+  const repairFull = !opts.fast && (!opts.json && !opts.banner || Boolean(opts.apply) || Boolean(opts.preflight) || Boolean(opts.banner) && healPlan.needsEagerHeal);
+  if (!opts.fast) {
+    let ghInstalled = true;
+    if (!login) {
+      try {
+        await execFileP2("gh", ["--version"]);
+      } catch {
+        ghInstalled = false;
+      }
     }
+    checks.push(buildGithubAuthCheck({ login, ghInstalled }));
   }
-  checks.push(buildGithubAuthCheck({ login, ghInstalled }));
   let onPath = pathProbe;
   if (!onPath) {
     const root = process.env.CLAUDE_PLUGIN_ROOT;
-    if (root && (0, import_node_fs19.existsSync)(`${root}/bin/mmi-cli${isWin ? ".cmd" : ""}`)) onPath = true;
+    if (root && (0, import_node_fs20.existsSync)(`${root}/bin/mmi-cli${isWin ? ".cmd" : ""}`)) onPath = true;
   }
   checks.push({ ok: onPath, label: "mmi-cli on PATH", fix: "auto-provisioned at session start \u2014 reopen the session, or install the MMI plugin" });
   const reloadHint = reloadAction(surface);
@@ -18342,7 +18853,7 @@ async function runDoctor(opts, io = consoleIo, readOrigin) {
     return;
   }
   checks.push({ ok: Boolean(cfg.sagaApiUrl), label: "Hub API URL configured", fix: "set MMI_HUB_URL or use a current MMI CLI/plugin build" });
-  const hubVersionInfo = await fetchHubVersionInfo(cfg.sagaApiUrl);
+  const hubVersionInfo = opts.fast ? null : await fetchHubVersionInfo(cfg.sagaApiUrl);
   const installedVersion = resolveClientVersion();
   checks.push(
     buildHubCompatCheck({
@@ -18360,6 +18871,12 @@ async function runDoctor(opts, io = consoleIo, readOrigin) {
         releasedVersion
       })
     );
+    checks.push(
+      buildCliVersionDriftCheck({
+        currentVersion: installedVersion,
+        releasedVersion
+      })
+    );
   }
   if (runExtended) {
     checks.push(buildAwsCrossAccountCheck({ callerArn }));
@@ -18446,8 +18963,19 @@ async function runDoctor(opts, io = consoleIo, readOrigin) {
   checks.push(gitignoreCheck);
   checks.push(buildRepoLocalWorktreeCheck({
     isOrgRepo,
-    hasRepoLocalWorktrees: (0, import_node_fs19.existsSync)((0, import_node_path19.join)(process.cwd(), ".worktrees"))
+    hasRepoLocalWorktrees: (0, import_node_fs20.existsSync)((0, import_node_path20.join)(process.cwd(), ".worktrees"))
   }));
+  if (isOrgRepo) {
+    const pkg = readRepoJson("package.json");
+    const lock = readRepoJson("package-lock.json");
+    checks.push(buildLockfileOptionalsCheck({
+      isOrgRepo,
+      packageJsonOptionalDeps: pkg?.optionalDependencies ?? null,
+      lockfilePackages: lock?.packages ?? null
+    }));
+  } else {
+    checks.push(buildLockfileOptionalsCheck({ isOrgRepo, packageJsonOptionalDeps: null, lockfilePackages: null }));
+  }
   let driftCheck = buildPluginConfigDriftCheck({ isOrgRepo, installed, surface });
   if (!driftCheck.ok && driftCheck.recordsToWrite && repairLocal) {
     if (backupAndWriteInstalledPlugins(driftCheck.recordsToWrite, driftCheck.pluginId)) {
@@ -18632,7 +19160,7 @@ async function runDoctor(opts, io = consoleIo, readOrigin) {
     return versions.sort((a, b) => compareVersions(b, a))[0];
   };
   const codexCacheVersions = () => mmiPluginCacheRootSnapshots().filter((r) => r.surface === "codex").flatMap((r) => r.entries.filter((e) => e.isDirectory).map((e) => e.name));
-  const codexActiveVersion = () => isOrgRepo && releasedVersion ? codexEnabledMmiVersion() : Promise.resolve(void 0);
+  const codexActiveVersion = () => !opts.fast && isOrgRepo && releasedVersion ? codexEnabledMmiVersion() : Promise.resolve(void 0);
   let cacheCleanupCheck = buildMmiPluginCacheCleanupCheck({
     isOrgRepo,
     roots: mmiPluginCacheRootSnapshots(),
@@ -18735,7 +19263,7 @@ async function runDoctor(opts, io = consoleIo, readOrigin) {
   }
   checks.push(nestedPluginTreeCheck);
   const cursorCacheRoot = cursorPluginCacheRoot();
-  const cursorCacheRootExists = (0, import_node_fs19.existsSync)(cursorCacheRoot);
+  const cursorCacheRootExists = (0, import_node_fs20.existsSync)(cursorCacheRoot);
   let cursorPins = cursorPluginCachePinSnapshots() ?? [];
   checks.push(
     buildCursorPluginCacheCleanupCheck({
@@ -18763,7 +19291,7 @@ async function runDoctor(opts, io = consoleIo, readOrigin) {
       cacheRootExists: cursorCacheRootExists,
       hubCheckout: hubCheckoutForCursorSeed(),
       execFileP: execFileP2,
-      mkdtemp: (prefix) => (0, import_promises2.mkdtemp)((0, import_node_path19.join)((0, import_node_os7.tmpdir)(), prefix)),
+      mkdtemp: (prefix) => (0, import_promises2.mkdtemp)((0, import_node_path20.join)((0, import_node_os7.tmpdir)(), prefix)),
       log: (m) => io.err(m)
     });
     if (seeded) {
@@ -18840,6 +19368,23 @@ async function runDoctor(opts, io = consoleIo, readOrigin) {
       cacheVersions: sessionCacheVersions
     })
   );
+  {
+    let redactorFailureLines = [];
+    try {
+      redactorFailureLines = (0, import_node_fs20.readFileSync)(activityLogPath(process.cwd()), "utf8").split("\n");
+    } catch {
+      redactorFailureLines = [];
+    }
+    const redactorSummary = summarizeRedactorFailures(redactorFailureLines);
+    checks.push(
+      buildRedactorLivenessCheck({
+        isOrgRepo,
+        failedCount: redactorSummary.failedCount,
+        lastFailedTs: redactorSummary.lastFailedTs,
+        lastFailedAction: redactorSummary.lastFailedAction
+      })
+    );
+  }
   if (runExtended) {
     checks.push(
       buildBrowserArtifactsCheck({
@@ -18864,6 +19409,14 @@ async function runDoctor(opts, io = consoleIo, readOrigin) {
         checks.push(buildGitGcCheck(await gcPlan("origin", 200)));
       } catch {
       }
+      try {
+        checks.push(buildManagedFileEncodingCheck({ isOrgRepo, findings: managedFileEncodingFindings() }));
+      } catch {
+      }
+      try {
+        checks.push(buildStaleLocalBranchCheck({ isOrgRepo, branches: await localReleaseBranchSnapshots() }));
+      } catch {
+      }
     } else if (opts.apply && repoWritesAllowed) {
       const scratchRun = executeScratchGc(repoRoot, { apply: true });
       if (scratchRun.applied?.pruned.length) {
@@ -18884,6 +19437,7 @@ async function runDoctor(opts, io = consoleIo, readOrigin) {
     healedCount,
     pluginReloadRequired,
     reloadHint,
+    slowSkippedCount,
     // Surface-aware update report (#865): the per-surface version snapshot + copy-paste update recipes, so
     // an agent told "make sure the CLI and plugin are up to date" can run the right command per surface and
     // echo back an unambiguous version line (CLI / Claude plugin / Codex marketplace / Codex active cache).
@@ -18909,6 +19463,7 @@ function emitDoctorReport(opts, io, ctx) {
   const { checks, surface, healedCount, pluginReloadRequired, reloadHint } = ctx;
   const gaps = checks.filter((c) => !c.ok);
   if (opts.preflight) {
+    process.exitCode = doctorExitCode(checks);
     const outcome = preflightOutcome({ gaps, needsEagerHeal: ctx.needsEagerHeal, surface });
     if (outcome.line) io.err(outcome.line);
     if (pluginReloadRequired) io.err(pluginAutonomousHaltLine(reloadHint));
@@ -18935,7 +19490,8 @@ function emitDoctorReport(opts, io, ctx) {
     healedCount,
     pluginReloadRequired,
     reloadHint,
-    verbose: Boolean(opts.verbose)
+    verbose: Boolean(opts.verbose),
+    skippedSlowChecks: ctx.slowSkippedCount
   })) io.log(line);
   for (const r of resources) io.log(`Resource: ${r.label} \u2014 ${r.url}`);
 }
@@ -18958,23 +19514,23 @@ function mergeGuardHook(settings) {
   next.hooks = hooks;
   return next;
 }
-var userScopeSettingsPath = (surface = detectSurface(process.env)) => (0, import_node_path19.join)((0, import_node_os7.homedir)(), surface === "codex" ? ".codex" : ".claude", "settings.json");
+var userScopeSettingsPath = (surface = detectSurface(process.env)) => (0, import_node_path20.join)((0, import_node_os7.homedir)(), surface === "codex" ? ".codex" : ".claude", "settings.json");
 function ensureUserScopeGuardHook(opts = {}) {
   const path2 = opts.settingsPath ?? userScopeSettingsPath();
   try {
     let current = null;
-    if ((0, import_node_fs19.existsSync)(path2)) {
+    if ((0, import_node_fs20.existsSync)(path2)) {
       try {
-        current = JSON.parse((0, import_node_fs19.readFileSync)(path2, "utf8"));
+        current = JSON.parse((0, import_node_fs20.readFileSync)(path2, "utf8"));
       } catch {
         return "failed";
       }
     }
     if (settingsHasGuardHook(current)) return "already";
     const merged = mergeGuardHook(current);
-    (0, import_node_fs19.mkdirSync)((0, import_node_path19.dirname)(path2), { recursive: true });
-    if ((0, import_node_fs19.existsSync)(path2)) (0, import_node_fs19.copyFileSync)(path2, `${path2}.bak`);
-    (0, import_node_fs19.writeFileSync)(path2, `${JSON.stringify(merged, null, 2)}
+    (0, import_node_fs20.mkdirSync)((0, import_node_path20.dirname)(path2), { recursive: true });
+    if ((0, import_node_fs20.existsSync)(path2)) (0, import_node_fs20.copyFileSync)(path2, `${path2}.bak`);
+    (0, import_node_fs20.writeFileSync)(path2, `${JSON.stringify(merged, null, 2)}
 `, "utf8");
     return "written";
   } catch {
@@ -19111,7 +19667,7 @@ async function applyGcPlan(plan, remote) {
     cleanupBranch: (branch, expectedHeadOid) => cleanupPrMergeLocalBranch(branch.branch, {
       beforeWorktrees,
       startingPath: branch.worktreePath,
-      pathExists: (p) => (0, import_node_fs20.existsSync)(p),
+      pathExists: (p) => (0, import_node_fs21.existsSync)(p),
       execGit: async (args) => (await execFileP2("git", args, { timeout: GIT_TIMEOUT_MS })).stdout,
       teardownWorktreeStage,
       deferredStore,
@@ -19134,7 +19690,7 @@ async function applyGcPlan(plan, remote) {
   for (const wt of plan.worktreeDirs) {
     try {
       const cleanupTarget = resolveSafeSiblingWorktreeCleanupTarget(wt.path, siblingRoot, {
-        realpath: (path2) => (0, import_node_fs20.realpathSync)(path2)
+        realpath: (path2) => (0, import_node_fs21.realpathSync)(path2)
       });
       if (!cleanupTarget.ok) {
         result.failed.push(`${wt.path}: ${cleanupTarget.reason}`);
@@ -19174,16 +19730,21 @@ async function requireFreshTrainCli(commandName) {
   throw new Error(staleTrainCliMessage(report, commandName));
 }
 var program2 = new Command();
-program2.name("mmi-cli").description("MMI Future CLI \u2014 org rules delivery, Jervaise-only continuity. The engine the plugin SessionStart hook drives.").version(resolveClientVersion()).showHelpAfterError("(run `mmi-cli commands` to list every subcommand + its flags, or `mmi-cli commands --json` to ground against it)");
+program2.name("mmi-cli").description("MMI Future CLI \u2014 org rules delivery, Jervaise-only continuity. The engine the plugin SessionStart hook drives.").version(resolveClientVersion()).showHelpAfterError("(run `mmi-cli commands` to list every subcommand + its flags, or `mmi-cli commands --json` to ground against it). If you expected this command to exist, your installed mmi-cli may be stale \u2014 update it (see: mmi-cli doctor)");
 var rules = program2.command("rules").description("org-managed .gitignore delivery");
-rules.command("gitignore").option("--write", "upsert the managed block into .gitignore (default: check only, non-zero exit on drift)").description("verify (or --write) this repo's org-managed .gitignore block matches the SSOT").action((opts) => {
-  const path2 = (0, import_node_path20.join)(process.cwd(), ".gitignore");
-  const current = (0, import_node_fs20.existsSync)(path2) ? (0, import_node_fs20.readFileSync)(path2, "utf8") : null;
+rules.command("gitignore").option("--write", "upsert the managed block into .gitignore (default: check only, non-zero exit on drift)").option("--json", "machine-readable output").description("verify (or --write) this repo's org-managed .gitignore block matches the SSOT").action((opts) => {
+  const path2 = (0, import_node_path21.join)(process.cwd(), ".gitignore");
+  const current = (0, import_node_fs21.existsSync)(path2) ? (0, import_node_fs21.readFileSync)(path2, "utf8") : null;
   const plan = planManagedGitignore(current);
   const drift = [...plan.added.map((l) => `+${l}`), ...plan.removed.map((l) => `-${l}`)].join(", ") || "block normalize";
+  if (opts.json) {
+    console.log(JSON.stringify(plan, null, 2));
+    if (!opts.write && plan.changed) process.exitCode = 1;
+    return;
+  }
   if (opts.write) {
     if (plan.changed) {
-      (0, import_node_fs20.writeFileSync)(path2, plan.content, "utf8");
+      (0, import_node_fs21.writeFileSync)(path2, plan.content, "utf8");
       console.log(`mmi-cli rules gitignore: updated .gitignore (${drift})`);
     } else {
       console.log("mmi-cli rules gitignore: up to date");
@@ -19348,7 +19909,7 @@ function runWorktreeInstall(command, cwd, quiet) {
 async function primaryCheckoutRoot(worktreeRoot) {
   try {
     const out = (await execFileP2("git", ["-C", worktreeRoot, "rev-parse", "--path-format=absolute", "--git-common-dir"], { timeout: GIT_TIMEOUT_MS })).stdout.trim();
-    return out ? (0, import_node_path20.dirname)(out) : void 0;
+    return out ? (0, import_node_path21.dirname)(out) : void 0;
   } catch {
     return void 0;
   }
@@ -19363,26 +19924,26 @@ function makeProvisionDeps(worktreeRoot, quiet, log) {
 function acquireWorktreeSetupLock(worktreeRoot) {
   const lockPath = repoRuntimeStatePath(worktreeRoot, "worktree-setup.lock");
   const take = () => {
-    const fd = (0, import_node_fs20.openSync)(lockPath, "wx");
+    const fd = (0, import_node_fs21.openSync)(lockPath, "wx");
     try {
-      (0, import_node_fs20.writeSync)(fd, String(Date.now()));
+      (0, import_node_fs21.writeSync)(fd, String(Date.now()));
     } finally {
-      (0, import_node_fs20.closeSync)(fd);
+      (0, import_node_fs21.closeSync)(fd);
     }
     return () => {
       try {
-        (0, import_node_fs20.rmSync)(lockPath, { force: true });
+        (0, import_node_fs21.rmSync)(lockPath, { force: true });
       } catch {
       }
     };
   };
   try {
-    (0, import_node_fs20.mkdirSync)((0, import_node_path20.dirname)(lockPath), { recursive: true });
+    (0, import_node_fs21.mkdirSync)((0, import_node_path21.dirname)(lockPath), { recursive: true });
     return take();
   } catch {
     try {
-      if (Date.now() - (0, import_node_fs20.statSync)(lockPath).mtimeMs > WORKTREE_SETUP_LOCK_TTL_MS) {
-        (0, import_node_fs20.rmSync)(lockPath, { force: true });
+      if (Date.now() - (0, import_node_fs21.statSync)(lockPath).mtimeMs > WORKTREE_SETUP_LOCK_TTL_MS) {
+        (0, import_node_fs21.rmSync)(lockPath, { force: true });
         return take();
       }
     } catch {
@@ -19400,7 +19961,21 @@ worktree.command("create <branch>").description("create a worktree from a base r
       const fetchErr = await execFileP2("git", ["fetch", o.remote, fetchBranch], { timeout: GH_MUTATION_TIMEOUT_MS }).then(() => void 0).catch((e) => (e instanceof Error ? e.message : String(e)).split("\n")[0]);
       if (fetchErr) console.error(`  warning: could not fetch ${o.remote}/${fetchBranch} (${fetchErr}); base ${base} may be stale`);
     }
-    await execFileP2("git", ["worktree", "add", wtPath, "-b", branch, base], { timeout: GH_MUTATION_TIMEOUT_MS });
+    await addWorktreeRobust(wtPath, branch, base, {
+      git: async (args) => (await execFileP2("git", args, { timeout: GH_MUTATION_TIMEOUT_MS })).stdout,
+      revParse: async (ref) => {
+        try {
+          return (await execFileP2("git", ["rev-parse", "--verify", ref], { timeout: GIT_TIMEOUT_MS })).stdout.trim() || void 0;
+        } catch {
+          return void 0;
+        }
+      },
+      deleteBranch: (b) => execFileP2("git", ["branch", "-D", b], { timeout: GIT_TIMEOUT_MS }).then(() => void 0),
+      sleep: (ms) => new Promise((resolve5) => setTimeout(resolve5, ms)),
+      log: (m) => {
+        if (!o.json) console.error(`  ${m}`);
+      }
+    });
     const report = await provisionWorktree(wtPath, makeProvisionDeps(wtPath, Boolean(o.json), (m) => {
       if (!o.json) console.error(`  ${m}`);
     }));
@@ -19519,7 +20094,7 @@ async function attachToProject(issueNumber, repo, priority) {
 var ghRunner = async (args, timeoutMs) => (await execFileP2("gh", args, { timeout: timeoutMs })).stdout;
 function scheduleRelatedDiscovery(o) {
   try {
-    const args = ["issue", "discover-related", "--number", String(o.number), "--title", o.title, "--body", o.body];
+    const args = ["issue", "discover-related", "--number", String(o.number), "--title", o.title, "--body", o.body, "--fail-soft"];
     if (o.repo) args.push("--repo", o.repo);
     spawnDetachedSelf(args, { spawn: import_node_child_process12.spawn, execPath: process.execPath, scriptPath: process.argv[1] }, { cwd: process.cwd() });
   } catch {
@@ -19872,7 +20447,7 @@ project.command("set [owner/repo]").description("upsert project META (idempotent
   const vars = rawValues("--var");
   if (o.secretsFile) {
     try {
-      vars.push(`secrets=${(0, import_node_fs20.readFileSync)(o.secretsFile, "utf8")}`);
+      vars.push(`secrets=${(0, import_node_fs21.readFileSync)(o.secretsFile, "utf8")}`);
     } catch (e) {
       return fail(`project set: cannot read --secrets-file ${o.secretsFile}: ${e.message}`);
     }
@@ -20176,7 +20751,7 @@ issue.command("view <number>").description("read an issue as structured JSON \u2
     return fail(`issue view: ${raw}${argvNote}`);
   }
 });
-issue.command("discover-related").description("find related issues for an existing issue and post only high-confidence links").requiredOption("--number <number>", "created issue number").requiredOption("--title <title>", "created issue title").requiredOption("--body <body>", "created issue body").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--json", "print candidates instead of posting").action(async (o) => {
+issue.command("discover-related").description("find related issues for an existing issue and post only high-confidence links").requiredOption("--number <number>", "created issue number").requiredOption("--title <title>", "created issue title").requiredOption("--body <body>", "created issue body").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--json", "print candidates instead of posting").option("--fail-soft", "suppress errors (used by the background auto-caller; direct runs fail loudly)").action(async (o) => {
   const number = Number(o.number);
   if (!Number.isInteger(number) || number <= 0) return fail("issue discover-related: --number must be a positive integer");
   const repo = await resolveRepo(o.repo);
@@ -20208,7 +20783,10 @@ issue.command("discover-related").description("find related issues for an existi
     ]);
     if (viewed.comments.some((comment) => comment.body.includes(relatedMarker(number)))) return;
     await execFileP2("gh", ["issue", "comment", String(number), "--repo", repo, "--body", buildRelatedComment(number, candidates)], { timeout: GH_MUTATION_TIMEOUT_MS });
-  } catch {
+  } catch (e) {
+    if (o.failSoft) return;
+    const err = e;
+    return fail(`issue discover-related: ${(err.stderr || err.message || String(e)).trim()}`);
   }
 });
 issue.command("link-child <parent> <child>").description("link an existing issue as a native sub-issue of a parent and print {parentNumber,subIssueNumber,totalCount} JSON").option("--repo <owner/repo>", "repo for bare refs on either side (defaults to the current repo)").action(async (parentRef, childRef, o) => {
@@ -20415,7 +20993,7 @@ program2.command("skill-lesson").description("file a skill-lesson on the Hub boa
   console.log(JSON.stringify({ ...created, deduped: false, label: SKILL_LESSON_LABEL, skill, priority, projectItemId, onBoard }));
 });
 var pr = program2.command("pr").description("pull requests \u2014 reliable create with structured output");
-pr.command("create").description("create a PR and print {number,url} JSON").option("--title <title>", "PR title").option("--title-file <path|->", "read the PR title from a UTF-8 file, or from stdin with -").option("--body <body>", "PR body (markdown)").option("--body-file <path|->", "read PR body from a UTF-8 file, or from stdin with -").option("--base <branch>", "base branch (defaults to the repo default)").option("--head <branch>", "head branch (defaults to the current branch)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").action(async (o) => {
+pr.command("create").description("create a PR and print {number,url} JSON").option("--title <title>", "PR title").option("--title-file <path|->", "read the PR title from a UTF-8 file, or from stdin with -").option("--body <body>", "PR body (markdown)").option("--body-file <path|->", "read PR body from a UTF-8 file, or from stdin with -").option("--base <branch>", "base branch (defaults to the repo default)").option("--head <branch>", "head branch (defaults to the current branch)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--draft", "open the PR in draft state (#2667)").action(async (o) => {
   let body;
   let title;
   try {
@@ -20424,17 +21002,19 @@ pr.command("create").description("create a PR and print {number,url} JSON").opti
   } catch (e) {
     return fail(`pr create: ${e.message}`);
   }
-  const created = await ghCreate(buildPrArgs({ title, body, base: o.base, head: o.head, repo: o.repo }));
+  const created = await ghCreate(buildPrArgs({ title, body, base: o.base, head: o.head, repo: o.repo, draft: o.draft }));
   console.log(JSON.stringify(created));
 });
-pr.command("view <number>").description("read a PR as structured JSON (merged state, head/base, URL, merge commit) \u2014 the mmi-cli read path (#2347)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--json <fields>", "comma-separated gh --json field list (overrides the default field set)").action(async (number, o) => {
+pr.command("view <number>").description("read a PR as structured JSON (merged state, head/base, URL, merge commit) \u2014 the mmi-cli read path (#2347)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--json [fields...]", 'gh --json field list (overrides the default field set). Accepts commas, spaces, or repeated --json flags \u2014 in PowerShell an unquoted comma list is an array literal, so QUOTE it: --json "state,baseRefName,mergeCommit"').action(async (number, o) => {
   const n = Number(number);
   if (!Number.isInteger(n) || n <= 0) return fail("pr view: <number> must be a positive integer");
   const repo = await resolveRepo(o.repo);
   if (!repo) return fail("pr view: could not resolve repo (pass --repo <owner/repo>)");
-  const fields = o.json && o.json.trim() ? o.json.trim() : "number,title,state,url,isDraft,mergeable,mergedAt,mergeCommit,headRefName,baseRefName,author,labels";
+  const fields = normalizeIssueViewJsonFields(o.json);
+  const defaultPrFields = "number,title,state,url,isDraft,mergeable,mergedAt,mergeCommit,headRefName,baseRefName,author,labels";
+  const effective = fields === normalizeIssueViewJsonFields(void 0) ? defaultPrFields : fields;
   try {
-    const data = await ghJson(["pr", "view", String(n), "--repo", repo, "--json", fields]);
+    const data = await ghJson(["pr", "view", String(n), "--repo", repo, "--json", effective]);
     console.log(JSON.stringify(data));
   } catch (e) {
     const err = e;
@@ -20442,9 +21022,9 @@ pr.command("view <number>").description("read a PR as structured JSON (merged st
   }
 });
 async function listCiWorkflowPaths(cwd = process.cwd()) {
-  const wfDir = (0, import_node_path20.join)(cwd, ".github", "workflows");
-  if (!(0, import_node_fs20.existsSync)(wfDir)) return [];
-  return (0, import_node_fs20.readdirSync)(wfDir).filter((name) => /\.(ya?ml)$/i.test(name)).map((name) => `.github/workflows/${name}`);
+  const wfDir = (0, import_node_path21.join)(cwd, ".github", "workflows");
+  if (!(0, import_node_fs21.existsSync)(wfDir)) return [];
+  return (0, import_node_fs21.readdirSync)(wfDir).filter((name) => /\.(ya?ml)$/i.test(name)).map((name) => `.github/workflows/${name}`);
 }
 async function resolveMergeCiPolicyForCheckout(repoOpt) {
   const repo = repoOpt ?? await resolveRepo();
@@ -20456,16 +21036,29 @@ async function resolveMergeCiPolicyForCheckout(repoOpt) {
 }
 function ciAuditDeps() {
   const cfgPromise = loadConfig();
+  const root = hubRoot();
   return {
     client: defaultGitHubClient(),
     listProjects: async () => fetchProjectsList(registryClientDeps(await cfgPromise)),
     getProjectMeta: async (slug) => fetchProjectBySlug(slug, registryClientDeps(await cfgPromise)),
-    // Continuous CI delivery (#1550): the gate re-seed renders from the Hub's on-disk seed templates. The
-    // reconcile runs IN the Hub checkout, so this is local-file I/O (no network fetch). Path is relative to
-    // the repo root (e.g. skills/bootstrap/seeds/gate.template.yml).
-    readSeedFile: (path2) => (0, import_node_fs20.existsSync)(path2) ? (0, import_node_fs20.readFileSync)(path2, "utf8") : null
+    // Continuous CI delivery (#1550): the gate re-seed renders from the Hub's on-disk seed templates.
+    // Resolve from the installed package root so the reconcile works from any org repo checkout; when the
+    // Hub root is not locatable (e.g. a global npm install without a local checkout), return null so the
+    // gate re-seed step is skipped gracefully rather than failing mid-run.
+    readSeedFile: (path2) => {
+      if (!root) return null;
+      const fullPath = (0, import_node_path21.join)(root, path2);
+      return (0, import_node_fs21.existsSync)(fullPath) ? (0, import_node_fs21.readFileSync)(fullPath, "utf8") : null;
+    }
   };
 }
+function hubRoot() {
+  const fromPkg = (0, import_node_path21.join)(__dirname, "..", "..");
+  const marker = "skills/bootstrap/seeds/manifest.json";
+  if ((0, import_node_fs21.existsSync)((0, import_node_path21.join)(fromPkg, marker))) return fromPkg;
+  if ((0, import_node_fs21.existsSync)((0, import_node_path21.join)(process.cwd(), marker))) return process.cwd();
+  return null;
+}
 pr.command("ci-policy").description("report merge CI policy: wait-for-checks vs no-ci (for grind/build agents)").option("--json", "machine-readable output").option("--repo <owner/repo>", "target repo (defaults to the current checkout)").action(async (o) => {
   const result = await resolveMergeCiPolicyForCheckout(o.repo);
   if (o.json) return printLine(JSON.stringify(result));
@@ -20539,6 +21132,12 @@ pr.command("land <number>").description("agent merge path (#1440): train probe \
         checksPassing: checks === "success" || checks === "no-checks-reported"
       };
     },
+    readPrState: async (prNumber, repo) => {
+      const args = repo ? ["--repo", repo] : [];
+      const result2 = await readGhPrStateWithRetry(async () => (await execFileP2("gh", ["pr", "view", prNumber, ...args, "--json", "mergeStateStatus,mergeable,state"], { timeout: GC_GH_TIMEOUT_MS2 })).stdout);
+      if (!result2.ok) throw new Error(`could not read PR state: ${result2.error}`);
+      return JSON.parse(result2.state);
+    },
     mergeAuto: async (prNumber, repo) => {
       const args = repo ? ["--repo", repo] : [];
       const readMergeState = () => readGhPrStateWithRetry(async () => (await execFileP2("gh", ["pr", "view", prNumber, ...args, "--json", "state", "--jq", ".state"], { timeout: GC_GH_TIMEOUT_MS2 })).stdout);
@@ -20633,7 +21232,7 @@ async function createDeferredWorktreeStore() {
       },
       write: async (entries) => {
         try {
-          await (0, import_promises3.mkdir)((0, import_node_path20.dirname)(registryPath), { recursive: true });
+          await (0, import_promises3.mkdir)((0, import_node_path21.dirname)(registryPath), { recursive: true });
           await (0, import_promises3.writeFile)(registryPath, serializeDeferredWorktrees(entries), "utf8");
         } catch {
         }
@@ -20647,13 +21246,13 @@ var realWorktreeDirRemover = {
   probe: (p) => {
     let st;
     try {
-      st = (0, import_node_fs20.lstatSync)(p);
+      st = (0, import_node_fs21.lstatSync)(p);
     } catch {
       return null;
     }
     if (st.isSymbolicLink()) return "link";
     try {
-      (0, import_node_fs20.readlinkSync)(p);
+      (0, import_node_fs21.readlinkSync)(p);
       return "link";
     } catch {
     }
@@ -20661,7 +21260,7 @@ var realWorktreeDirRemover = {
   },
   readdir: (p) => {
     try {
-      return (0, import_node_fs20.readdirSync)(p);
+      return (0, import_node_fs21.readdirSync)(p);
     } catch {
       return [];
     }
@@ -20670,9 +21269,9 @@ var realWorktreeDirRemover = {
   // leaving the target); a file symlink with unlink. rmdir first, fall back to unlink.
   detachLink: (p) => {
     try {
-      (0, import_node_fs20.rmdirSync)(p);
+      (0, import_node_fs21.rmdirSync)(p);
     } catch {
-      (0, import_node_fs20.unlinkSync)(p);
+      (0, import_node_fs21.unlinkSync)(p);
     }
   },
   removeTree: (p) => (0, import_promises3.rm)(p, { recursive: true, force: true, maxRetries: 5, retryDelay: 200 })
@@ -20702,9 +21301,9 @@ async function worktreeHasStageState(worktreePath) {
   }
 }
 function stageStateFileBelongsToWorktree(statePath, worktreePath) {
-  if (!(0, import_node_fs20.existsSync)(statePath)) return false;
+  if (!(0, import_node_fs21.existsSync)(statePath)) return false;
   try {
-    const state = JSON.parse((0, import_node_fs20.readFileSync)(statePath, "utf8"));
+    const state = JSON.parse((0, import_node_fs21.readFileSync)(statePath, "utf8"));
     const recordedCwd = typeof state.identity?.cwd === "string" ? state.identity.cwd : typeof state.cwd === "string" ? state.cwd : "";
     return Boolean(recordedCwd && isPathUnderDirectory(recordedCwd, worktreePath));
   } catch {
@@ -20776,7 +21375,7 @@ pr.command("merge <number>").description("merge a PR (squash by default) and cle
     localCleanup = await cleanupPrMergeLocalBranch(headRef, {
       beforeWorktrees,
       startingPath,
-      pathExists: (p) => (0, import_node_fs20.existsSync)(p),
+      pathExists: (p) => (0, import_node_fs21.existsSync)(p),
       execGit: async (args) => (await execFileP2("git", args, { timeout: GIT_TIMEOUT_MS })).stdout,
       teardownWorktreeStage,
       deferredStore,
@@ -20997,7 +21596,7 @@ function stageScopedRunOpts(o) {
   };
 }
 function printLine(value) {
-  (0, import_node_fs20.writeSync)(1, `${value}
+  (0, import_node_fs21.writeSync)(1, `${value}
 `);
 }
 function stageKeepAlive() {
@@ -21011,8 +21610,8 @@ async function resolveStage() {
   const portRange = portRangeMeta && typeof portRangeMeta.start === "number" && typeof portRangeMeta.end === "number" ? [portRangeMeta.start, portRangeMeta.end] : void 0;
   return decideStage({
     registry: { deployModel: project2?.deployModel, portRange, error: read.ok ? void 0 : read.error },
-    hasCompose: (0, import_node_fs20.existsSync)((0, import_node_path20.join)(process.cwd(), "docker-compose.yml")),
-    hasEnvExample: (0, import_node_fs20.existsSync)((0, import_node_path20.join)(process.cwd(), ".env.example"))
+    hasCompose: (0, import_node_fs21.existsSync)((0, import_node_path21.join)(process.cwd(), "docker-compose.yml")),
+    hasEnvExample: (0, import_node_fs21.existsSync)((0, import_node_path21.join)(process.cwd(), ".env.example"))
   });
 }
 async function fetchStageVaultEnvMerge() {
@@ -21053,10 +21652,10 @@ program2.command("port-range <repo>").description("assign (idempotently) + print
     printLine(o.json ? JSON.stringify({ repo, portRange: [start2, end2], source: "meta" }) : `${repo}: stage.portRange [${start2}, ${end2}]`);
     return;
   }
-  const infra = resolvePortRangeInfra(process.cwd());
+  const infra = resolvePortRangeInfra(process.cwd(), __dirname);
   if (!infra) {
     return failGraceful(
-      `port-range: no MMI-Hub allocator files found from ${process.cwd()}; run from an MMI-Hub checkout instead: mmi-cli port-range ${repo}${o.json ? " --json" : ""}`
+      `port-range: no MMI-Hub allocator files found (checked cwd ${process.cwd()}, sibling MMI-Hub dirs, and the installed package location); ensure the Hub's infra/port-ranges.json and infra/port-ddb.mjs are reachable`
     );
   }
   const path2 = infra.registryPath;
@@ -21450,7 +22049,7 @@ ${r.repo}: applied=[${r.applied.join("; ")}] skipped=[${r.skipped.join("; ")}]${
   if (!audit.ok) process.exitCode = 1;
 });
 var wiki = program2.command("wiki").description("release wiki lane \u2014 publish generated pages via a short-lived, repo-scoped minted token");
-wiki.command("publish <pages-dir>").description("mint a 1h repo-scoped contents:write token (master-gated) and publish the generated .md pages to <repo>.wiki.git; the token stays in memory (never printed/committed). Runs from any org repo checkout \u2014 the publisher ships inside mmi-cli, no repo-local script required. Fails loud on the credential gap \u2014 never a silent skip").option("--repo <owner/repo>", "target repo (defaults to the cwd repo)").action(async (pagesDir, o) => {
+wiki.command("publish <pages-dir>").description("mint a 1h repo-scoped contents:write token (master-gated) and publish the generated .md pages to <repo>.wiki.git; the token stays in memory (never printed/committed). Runs from any org repo checkout \u2014 the publisher ships inside mmi-cli, no repo-local script required. Fails loud on the credential gap \u2014 never a silent skip").option("--repo <owner/repo>", "target repo (defaults to the cwd repo)").option("--json", "machine-readable output").action(async (pagesDir, o) => {
   const repo = await resolveRepo(o.repo);
   if (!repo) return fail("wiki publish: could not determine the target repo (pass --repo owner/name)");
   const cfg = await loadConfig();
@@ -21461,7 +22060,7 @@ wiki.command("publish <pages-dir>").description("mint a 1h repo-scoped contents:
       log: (msg) => console.log(msg),
       err: (msg) => console.error(msg)
     },
-    { repo, pagesDir }
+    { repo, pagesDir, json: o.json }
   );
   if (!ok) process.exitCode = 1;
 });
@@ -21486,9 +22085,8 @@ wiki.command("plan").description("compute the release wiki plan for the cwd repo
   );
   if (!ok) process.exitCode = 1;
 });
-var bootstrap = program2.command("bootstrap").description("plan repo bootstrap operations; mutations require master-admin approval").option("--repo <owner/repo>", "target repo").option("--class <class>", "deployable | content", "deployable").option("--json", "machine-readable output").option("--apply", "reserved for future bootstrap execution after explicit master-admin approval").action((o) => {
+var bootstrap = program2.command("bootstrap").description("plan repo bootstrap operations; mutations require master-admin approval").option("--repo <owner/repo>", "target repo").option("--class <class>", "deployable | content", "deployable").option("--json", "machine-readable output").action((o) => {
   if (!o.repo) return fail("bootstrap: required option --repo <owner/repo> not specified");
-  if (o.apply) return fail("bootstrap: execution is not implemented yet; use the dry-run plan and the existing /bootstrap skill");
   if (o.class !== "deployable" && o.class !== "content") return fail("bootstrap: --class must be deployable or content");
   const steps = bootstrapPlan(o.repo, o.class);
   console.log(o.json ? JSON.stringify({ command: "bootstrap", repo: o.repo, class: o.class, steps }, null, 2) : renderSteps(`mmi-cli bootstrap: dry-run plan for ${o.repo}`, steps));
@@ -21505,7 +22103,7 @@ bootstrap.command("verify <repo>").description("audit whether an existing repo i
     client: defaultGitHubClient(),
     projectMeta: meta,
     deployModel: typeof meta?.deployModel === "string" ? meta.deployModel : void 0,
-    readLocalFile: (path2) => path2 === "projects.json" && apiProjects != null ? apiProjects : (0, import_node_fs20.existsSync)(path2) ? (0, import_node_fs20.readFileSync)(path2, "utf8") : null,
+    readLocalFile: (path2) => path2 === "projects.json" && apiProjects != null ? apiProjects : (0, import_node_fs21.existsSync)(path2) ? (0, import_node_fs21.readFileSync)(path2, "utf8") : null,
     // requiredGcpApis is stored as an array by a JSON write, but `project set --var KEY=VALUE` stores a raw
     // comma-string — accept either so the seeded value verifies regardless of how it was written.
     requiredGcpApis: (() => {
@@ -21538,7 +22136,7 @@ bootstrap.command("org-ruleset").description("drift-check the codified org no-ag
   else console.log(renderOrgRulesetDriftReport(plan));
   if (plan.action !== "noop") process.exitCode = 1;
 });
-bootstrap.command("apply <repo>").description("idempotent seed apply from skills/bootstrap/seeds/manifest.json; dry-run unless --execute (live, master-gated)").option("--class <class>", "deployable | content", "deployable").option("--project-type <type>", `${PROJECT_TYPES.join(" | ")} (v2 capability shape)`).option("--deploy-model <model>", `${DEPLOY_MODELS.join(" | ")} (release/deploy path)`).option("--release-track <track>", `${RELEASE_TRACKS.join(" | ")} (branch topology; direct skips rc)`).option("--execute", "LIVE apply via gh (master-gated) \u2014 stamps seed files + labels into the repo").option("--var <KEY=VALUE...>", "placeholder values for repo-owned templates (repeatable)").option("--json", "machine-readable output").action(async (repo) => {
+bootstrap.command("apply <repo>").description("run from the MMI-Hub repo root: idempotent seed apply from skills/bootstrap/seeds/manifest.json; dry-run unless --execute (live, master-gated)").option("--class <class>", "deployable | content", "deployable").option("--project-type <type>", `${PROJECT_TYPES.join(" | ")} (v2 capability shape)`).option("--deploy-model <model>", `${DEPLOY_MODELS.join(" | ")} (release/deploy path)`).option("--release-track <track>", `${RELEASE_TRACKS.join(" | ")} (branch topology; direct skips rc)`).option("--execute", "LIVE apply via gh (master-gated) \u2014 stamps seed files + labels into the repo").option("--var <KEY=VALUE...>", "placeholder values for repo-owned templates (repeatable)").option("--json", "machine-readable output").action(async (repo) => {
   const o = {
     class: rawValue("--class", "deployable"),
     projectType: rawValue("--project-type", ""),
@@ -21556,12 +22154,12 @@ bootstrap.command("apply <repo>").description("idempotent seed apply from skills
     return fail(`bootstrap apply: ${e.message}`);
   }
   const manifestPath = "skills/bootstrap/seeds/manifest.json";
-  if (!(0, import_node_fs20.existsSync)(manifestPath)) return fail(`bootstrap apply: ${manifestPath} not found; run from the MMI-Hub repo root`);
-  const manifest = loadBootstrapSeeds((0, import_node_fs20.readFileSync)(manifestPath, "utf8"));
+  if (!(0, import_node_fs21.existsSync)(manifestPath)) return fail(`bootstrap apply: ${manifestPath} not found; bootstrap runs from the MMI-Hub repo root by design \u2014 it stamps org-level resources (Project, Ruleset, secrets, access) through the GitHub App, which is only authorized from the Hub checkout`);
+  const manifest = loadBootstrapSeeds((0, import_node_fs21.readFileSync)(manifestPath, "utf8"));
   const baseBranch = o.class === "content" ? "main" : "development";
   const slug = parsedRepo.slug;
   const gh = async (args) => execFileP2("gh", args, { timeout: 2e4 });
-  const readFile2 = (p) => (0, import_node_fs20.existsSync)(p) ? (0, import_node_fs20.readFileSync)(p, "utf8") : null;
+  const readFile2 = (p) => (0, import_node_fs21.existsSync)(p) ? (0, import_node_fs21.readFileSync)(p, "utf8") : null;
   const enc = (p) => p.split("/").map(encodeURIComponent).join("/");
   const rawVars = {};
   for (const value of rawValues("--var")) {
@@ -21858,16 +22456,16 @@ access.command("audit").description("audit collaborator roles + train-branch pus
     const repoClass = o.class;
     targets = [{ repo: o.repo, class: repoClass, releaseTrack: repoClass === "content" ? "trunk" : resolveReleaseTrack(meta, void 0, o.repo) }];
   } else {
-    const projectsJson = registryProjects ? JSON.stringify({ projects: registryProjects }) : (0, import_node_fs20.existsSync)("projects.json") ? (0, import_node_fs20.readFileSync)("projects.json", "utf8") : null;
+    const projectsJson = registryProjects ? JSON.stringify({ projects: registryProjects }) : (0, import_node_fs21.existsSync)("projects.json") ? (0, import_node_fs21.readFileSync)("projects.json", "utf8") : null;
     if (!projectsJson) return failGraceful("access audit: no project registry \u2014 Hub API unreachable and projects.json not found; run from the MMI-Hub repo root or pass --repo <owner/repo>");
-    const fanoutJson = (0, import_node_fs20.existsSync)(".github/fanout-targets.json") ? (0, import_node_fs20.readFileSync)(".github/fanout-targets.json", "utf8") : null;
+    const fanoutJson = (0, import_node_fs21.existsSync)(".github/fanout-targets.json") ? (0, import_node_fs21.readFileSync)(".github/fanout-targets.json", "utf8") : null;
     targets = loadAccessTargets(projectsJson, fanoutJson);
   }
   const derivedMatrix = registryProjects ? accessMatrixFromProjects(registryProjects) : {};
-  const fileMatrix = (0, import_node_fs20.existsSync)("access-matrix.json") ? loadAccessMatrix((0, import_node_fs20.readFileSync)("access-matrix.json", "utf8")) : {};
+  const fileMatrix = (0, import_node_fs21.existsSync)("access-matrix.json") ? loadAccessMatrix((0, import_node_fs21.readFileSync)("access-matrix.json", "utf8")) : {};
   const matrix = mergeAccessMatrix(fileMatrix, derivedMatrix);
   const derivedContracts = registryProjects ? dataAccessContractsFromProjects(registryProjects) : { consumers: {} };
-  const fileContracts = (0, import_node_fs20.existsSync)("data-access-contracts.json") ? loadDataAccessContracts((0, import_node_fs20.readFileSync)("data-access-contracts.json", "utf8")) : { consumers: {} };
+  const fileContracts = (0, import_node_fs21.existsSync)("data-access-contracts.json") ? loadDataAccessContracts((0, import_node_fs21.readFileSync)("data-access-contracts.json", "utf8")) : { consumers: {} };
   const dataAccess = mergeDataAccessContracts(fileContracts, derivedContracts);
   const report = await auditOrgAccess(targets, deps, matrix, dataAccess);
   console.log(o.json ? JSON.stringify(report, null, 2) : renderAccessReport(report));
@@ -21875,7 +22473,7 @@ access.command("audit").description("audit collaborator roles + train-branch pus
 });
 access.command("capabilities").description("enumerate your effective vault reach \u2014 every credential NAME + tier + scope you can read/use across project + org/master tiers (names only, no values) (#1615)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--json", "machine-readable output").action((o) => withSecrets((d) => secretsCapabilities(d, o)));
 var isWin2 = process.platform === "win32";
-program2.command("doctor").description("check onboarding gates and auto-heal CLI/plugin wiring; use --verbose for the full audit checklist").option("--banner", "one-line resume summary; silent when all gates pass").option("--preflight", "eager version/plugin heal with upfront notice when stale; silent when healthy (#1871)").option("--verbose", "run extended audit checks and print the full checklist + version report (#1989)").option("--guide", "print the MMI Agentic Onboarding guide URL").option("--json", "machine-readable output (read-only inspection \u2014 performs no repairs)").option("--apply", "perform the same auto-repairs as the interactive run (combine with --json for a machine-readable repair run)").option("--no-repo-writes", "env/plugin repairs only \u2014 never mutate the repo working tree; report pending managed .gitignore repairs with the follow-up command (for train preflights)").action((opts) => (
+program2.command("doctor").description("check onboarding gates and auto-heal CLI/plugin wiring; use --verbose for the full audit checklist").option("--banner", "one-line resume summary; silent when all gates pass").option("--fast", "offline-safe fast lane; skips slow checks and network probes").option("--preflight", "eager version/plugin heal with upfront notice when stale; silent when healthy (#1871)").option("--verbose", "run extended audit checks and print the full checklist + version report (#1989)").option("--ci", "stable CI output contract; no color, exit 0 for clear/advisory-only, 1 for hard gaps, 2 for doctor/tool failure").option("--guide", "print the MMI Agentic Onboarding guide URL").option("--json", "machine-readable output (read-only inspection \u2014 performs no repairs)").option("--apply", "perform the same auto-repairs as the interactive run (combine with --json for a machine-readable repair run)").option("--no-repo-writes", "env/plugin repairs only \u2014 never mutate the repo working tree; report pending managed .gitignore repairs with the follow-up command (for train preflights)").addHelpText("after", "\nExit codes:\n  0  no hard gaps remain; advisory gaps may exist\n  1  one or more included hard checks failed\n  2  doctor/tool execution failed before a normal verdict\n\n--banner keeps the legacy SessionStart contract and returns 0 unless the process crashes.\n").action((opts) => (
   // Commander maps `--no-repo-writes` to `repoWrites: false`; translate to the explicit `noRepoWrites` flag.
   runDoctor({ ...opts, noRepoWrites: opts.repoWrites === false })
 ));
@@ -21884,9 +22482,13 @@ program2.command("plugin-heal").description("reinstall + re-enable the MMI plugi
 program2.command("session-start").description("run the SessionStart verbs (whoami, board slice, doctor) in one process").action(async () => {
   if (isInsideRepoSubdir(process.cwd())) {
     console.error("[mmi-hook] session-start: cwd is a repository SUBDIRECTORY \u2014 skipping the SessionStart hook (spine/docs/plan/saga delivery); run it from the repo root.");
+    appendHookActivity(process.cwd(), { event: "SessionStart", script: "session-start", outcome: "ran", action: "skip (repo subdirectory)" });
+    return;
+  }
+  if (!await isOrgRepoRoot()) {
+    appendHookActivity(process.cwd(), { event: "SessionStart", script: "session-start", outcome: "ran", action: "skip (non-org repo)" });
     return;
   }
-  if (!await isOrgRepoRoot()) return;
   spawnDeferredGcSweep();
   const { parallel, sequential } = buildSessionStartPlan({
     // whoami (#879): surface the resolved human so agents act --for them without asking. Silent
@@ -21906,6 +22508,12 @@ program2.command("session-start").description("run the SessionStart verbs (whoam
       // never costs banner time and next session's glance renders instantly within budget.
       scheduleRefresh: () => spawnDetachedSelf(["board", "slice-refresh", "--quiet"], { spawn: import_node_child_process12.spawn, execPath: process.execPath, scriptPath: process.argv[1] })
     }),
+    // command-ladder hint (#2609): compact gh→mmi-cli cheat sheet so agents reach for mmi-cli first,
+    // not after a denied gh call. <1KB, pure in-memory — no network, no fs, fail-soft.
+    commandLadderHint: async (io) => {
+      const hint = commandLadderHint();
+      if (hint) io.log(hint);
+    },
     // local train sync (#2582): ff local development/main/rc to origin so this checkout never lags a
     // release pushed to origin (incl. the deferred main -> development alignment merge). Bounded git,
     // fail-soft, silent unless a branch moved.
@@ -21924,6 +22532,7 @@ program2.command("session-start").description("run the SessionStart verbs (whoam
     spawnDetachedSelf(["worktree", "setup", "--quiet"], { spawn: import_node_child_process12.spawn, execPath: process.execPath, scriptPath: process.argv[1] });
     consoleIo.log(worktreeBanner);
   }
+  appendHookActivity(process.cwd(), { event: "SessionStart", script: "session-start", outcome: "ran", action: "session-start hook completed" });
 });
 installProcessBackstop();
 program2.parseAsync().catch((e) => failGraceful(e.message));