@mutmutco/cli 3.106.0 → 3.107.0

package/dist/main.cjs

@@ -5020,6 +5020,20 @@ var import_node_path2 = require("node:path");
 
 // ../infra/compat.mjs
 var CLIENT_VERSION_HEADER = "x-client-version";
+function parseSemver(s) {
+  if (typeof s !== "string") return null;
+  const m = /^(\d+)\.(\d+)\.(\d+)(?:[-+]|$)/.exec(s.trim());
+  if (!m) return null;
+  return { major: Number(m[1]), minor: Number(m[2]), patch: Number(m[3]) };
+}
+function versionAtLeast(v, min) {
+  const a = parseSemver(v);
+  const b = parseSemver(min);
+  if (!a || !b) return false;
+  if (a.major !== b.major) return a.major > b.major;
+  if (a.minor !== b.minor) return a.minor > b.minor;
+  return a.patch >= b.patch;
+}
 
 // src/client-version.ts
 function resolveClientVersionManifestCandidates(distDir = __dirname) {
@@ -9814,7 +9828,7 @@ var LINK_RE = /\]\(([^)#\s]+?\.md)(?:#[^)]*)?\)/g;
 var CMD_RE = /`mmi-cli ((?:[a-z][a-z-]*)(?: [a-z][a-z-]*){0,3})/g;
 var RETIRED_RE = /\b(retired|historical|removed|deleted|gone|no longer|superseded|legacy)\b/i;
 var ROOT_DOCS = ["README.md", "architecture.md"];
-var SKIP_WALK = ["docs/Archive/", "docs/incidents/", "docs/research/"];
+var SKIP_WALK = ["docs/Archive/", "docs/incidents/", "docs/research/", "docs/decisions/"];
 function refFirstSegment(ref) {
   return ref.replace(/^(\.\/)+/, "").split("/")[0];
 }
@@ -10117,7 +10131,7 @@ function isRoutableDocsPath(relPath) {
   const normalized = relPath.replace(/\\/g, "/");
   return normalized !== "index.md" && normalized.split("/")[0]?.toLowerCase() !== "archive";
 }
-var GENERATED_HEADER = "<!-- Generated by `mmi-cli docs index --write`. Do not edit by hand. -->";
+var GENERATED_HEADER = "<!-- Generated by `mmi-cli oracle docs index --write`. Do not edit by hand. -->";
 function plainInline(text) {
   return text.replace(/\r?\n/g, " ").replace(/!\[([^\]]*)\]\([^)]*\)/g, "$1").replace(/\[([^\]]+)\]\([^)]*\)/g, "$1").replace(/`/g, "").replace(/\*+/g, "").replace(/~~/g, "").replace(/__([^_]+)__/g, "$1").replace(/(^|[\s(])_([^_]+)_($|[\s).,!?:;])/g, "$1$2$3").replace(/^>\s*/, "").replace(/\\([\\`*_\[\]{}()#+.!|>-])/g, "$1").replace(/\s+/g, " ").trim();
 }
@@ -10162,7 +10176,7 @@ function renderDocsIndex(entries) {
     "",
     "# Documentation index",
     "",
-    "Generated from the `docs/` tree by `mmi-cli docs index --write`. `--check` fails on drift, so this index",
+    "Generated from the `docs/` tree by `mmi-cli oracle docs index --write`. `--check` fails on drift, so this index",
     "can never diverge from the records it lists.",
     ""
   ];
@@ -19706,9 +19720,15 @@ async function claimOneBoardItem(ctx, selector, options) {
       const contest = await checkLaneContest(client, item);
       if (contest.contested) throw new Error(laneContestMessage(item.ref, contest, "claim"));
     }
+    if (options.check) {
+      return { item, viewer: report.viewer, repo: report.repo, status: "In Progress", partial: false, alreadyClaimed: true, checked: true };
+    }
     await postClaimMarkerComment(client, item);
     return { item, viewer: report.viewer, repo: report.repo, status: "In Progress", partial: false, alreadyClaimed: true };
   }
+  if (options.check) {
+    return { item, viewer: report.viewer, repo: report.repo, status: item.status, partial: false, checked: true };
+  }
   try {
     await client.rest("POST", `repos/${item.repository}/issues/${item.number}/assignees`, { body: { assignees: [assignedLogin] } });
   } catch (e) {
@@ -19764,7 +19784,7 @@ async function claimBoardIssues(options, deps = {}) {
       const ref = `${selector.repo}#${selector.number}`;
       try {
         const result = await claimOneBoardItem(ctx, selector, options);
-        results[index] = { ref: result.item.ref, claimed: true, item: result.item, status: result.status, partial: result.partial, warning: result.warning, alreadyClaimed: result.alreadyClaimed };
+        results[index] = { ref: result.item.ref, claimed: true, item: result.item, status: result.status, partial: result.partial, warning: result.warning, alreadyClaimed: result.alreadyClaimed, checked: result.checked };
       } catch (e) {
         results[index] = { ref, claimed: false, reason: e.message };
       }
@@ -20748,7 +20768,7 @@ function isHouseRoot(token) {
   return HOUSE_ROOTS.includes(token);
 }
 var COMPAT_SHIM_DEATH_WAVE = "Wave 3";
-var COMPAT_SHIM_NOTE = `compatibility shim \u2014 the flat Wave 0 path; use the canonical house-prefixed form; dies in ${COMPAT_SHIM_DEATH_WAVE} (#4316)`;
+var FLAT_ALIAS_CUT_NOTE = `flat Wave 0 alias \u2014 removed in ${COMPAT_SHIM_DEATH_WAVE} (#4316, #4438); only the canonical house-prefixed path parses`;
 var HOUSE_QUESTIONS = {
   oracle: "Is it live?",
   harbour: "Is it bounded?",
@@ -20808,6 +20828,8 @@ var HOUSE_MAP = {
   report: "learning",
   // friction reports
   "skill-lesson": "learning",
+  "closure-rate": "learning",
+  // closure rate per loop kind, computed at read (#4440)
   // --- core — the front door itself ---------------------------------------------------------------
   commands: "core",
   whoami: "core",
@@ -20842,6 +20864,11 @@ function canonicalPathFor(path2) {
   if (!house) return void 0;
   return house === "core" ? path2 : `${house} ${path2}`;
 }
+function canonicalArgvFor(args) {
+  const lookup = args.filter((tok) => !tok.startsWith("-")).slice(0, 2).join(" ");
+  const house = houseForPath(lookup);
+  return house && house !== "core" ? [house, ...args] : args;
+}
 
 // src/command-taxonomy.ts
 var COMMAND_METADATA = /* @__PURE__ */ Symbol.for("mmi.commandTaxonomy.metadata");
@@ -20853,10 +20880,10 @@ var PRIMARY_GROUPS = [
   // step invokes (`docs refs`, `tests policy`), not org-plane operations (#3605). `spawn policy`
   // joins them on the same footing (#3979).
   ["Setup and support", ["bootstrap", "secrets", "docs", "repo-index", "tests", "spawn"]],
-  ["Coordinate and improve", ["wave", "report", "skill-lesson"]]
+  ["Coordinate and improve", ["wave", "report", "skill-lesson", "closure-rate"]]
 ];
 var OPERATIONAL_TOP_LEVEL = /* @__PURE__ */ new Set(["org", "runtime", "plugin"]);
-var SUPPORT_PRIMARY = /* @__PURE__ */ new Set(["doctor", "whoami", "commands", "explain", "docs", "repo-index", "find", "tests", "spawn", "wave", "report", "skill-lesson"]);
+var SUPPORT_PRIMARY = /* @__PURE__ */ new Set(["doctor", "whoami", "commands", "explain", "docs", "repo-index", "find", "tests", "spawn", "wave", "report", "skill-lesson", "closure-rate"]);
 var TOP_LEVEL_ORDER = /* @__PURE__ */ new Map();
 var HELP_GROUP_ORDER = /* @__PURE__ */ new Map();
 var topLevelPosition = 0;
@@ -20906,6 +20933,7 @@ var COMMAND_OWNERSHIP = {
   wave: { module_owner: "cli/src/wave-land.ts", consumer: "campaign-orchestrator" },
   report: { module_owner: "cli/src/report.ts", consumer: "campaign-orchestrator" },
   "skill-lesson": { module_owner: "cli/src/skill-lesson.ts", consumer: "campaign-orchestrator" },
+  "closure-rate": { module_owner: "cli/src/learning-closure-rate.ts", consumer: "campaign-orchestrator" },
   org: { module_owner: "cli/src/command-consolidation.ts", consumer: "org-operator" },
   runtime: { module_owner: "cli/src/command-consolidation.ts", consumer: "runtime-operator" },
   plugin: { module_owner: "cli/src/plugin-guard-io.ts", consumer: "host-runtime" }
@@ -21121,7 +21149,7 @@ function buildCommand(cmd, path2) {
     ...metadata
   };
   if (cmd._allowUnknownOption) out.parses_own_argv = true;
-  if (path2 && house !== "core") out.shim = true;
+  if (path2 && house !== "core") out.flat_removed = true;
   const description = cmd.description();
   if (description) out.description = description;
   const examples = readExamples(cmd);
@@ -21170,19 +21198,23 @@ function buildCommandManifest(program3) {
   const primaryTree = primaryCopy(tree, true);
   const primaryIndex = [];
   collectLeaves(primaryTree, primaryIndex);
+  const houses = buildHouses(tree);
   const manifest = {
     schema_version: 2,
     scope: "all",
     name: tree.name,
     tree,
     index,
-    houses: buildHouses(tree),
+    houses,
     doors: buildDoorsCatalog(tree),
-    shim_contract: {
+    flat_alias_cut: {
       canonical: "mmi-cli <house> <command> \u2026",
-      shim: "mmi-cli <command> \u2026",
-      dies: COMPAT_SHIM_DEATH_WAVE,
-      note: COMPAT_SHIM_NOTE
+      removed: "mmi-cli <command> \u2026",
+      wave: COMPAT_SHIM_DEATH_WAVE,
+      note: FLAT_ALIAS_CUT_NOTE,
+      // The cut record names every removed alias by path — the same entry points the houses block
+      // presents, so the record can never drift from what actually refuses.
+      removed_aliases: [...new Set(houses.flatMap((house) => house.commands.map((entry) => entry.path)))].sort()
     },
     primary_tree: primaryTree,
     primary_index: primaryIndex,
@@ -21280,8 +21312,8 @@ function formatManifestHuman(manifest, options = {}) {
   }
   lines.push(
     "",
-    `Canonical form: \`mmi-cli <house> <command> \u2026\`. The flat paths above are compatibility shims,`,
-    `kept for one window so fleet scripts keep working \u2014 they die in ${COMPAT_SHIM_DEATH_WAVE} (#4316).`,
+    `Canonical form: \`mmi-cli <house> <command> \u2026\`. The paths above are house-relative \u2014 their flat`,
+    `Wave 0 aliases were removed in ${COMPAT_SHIM_DEATH_WAVE} (#4316, #4438); core stays unprefixed.`,
     "",
     options.all ? "Use `mmi-cli explain <group|command>` for a focused map." : "Use `mmi-cli explain <group|command>` for detail or `mmi-cli commands --all` for operational depth."
   );
@@ -28658,7 +28690,7 @@ function registerBootstrapCommands(program3) {
         target: DOCS_INDEX_PATH,
         action: indexAction,
         ownership: "org",
-        reason: indexCurrent === null ? "generated routing index (#3545)" : "routing index present \u2014 regenerate with `mmi-cli docs index --write`, which sees the whole tree"
+        reason: indexCurrent === null ? "generated routing index (#3545)" : "routing index present \u2014 regenerate with `mmi-cli oracle docs index --write`, which sees the whole tree"
       });
       if (o.execute && indexAction === "create") {
         await putSeed(DOCS_INDEX_PATH, indexContent, seedPlan.ref, void 0);
@@ -29668,10 +29700,13 @@ function registerBoardCommands(program3) {
       return failGraceful(`board read failed: ${withDiscoverMissDetail(e.message)}`);
     }
   }
+  function checkVerdict(ref, alreadyClaimed) {
+    return alreadyClaimed ? `Check ${ref}: claimed and In Progress, no live contest - claim would renew the lease (nothing written)` : `Check ${ref}: free - claim would proceed (nothing written)`;
+  }
   const board = program3.command("board").description("read, claim, show, and move Project v2 work items for the current repo");
   board.command("read", { isDefault: true }).description("read the board and print user-owned, claimable, and taken items").option("--json", "machine-readable output").option("--repo <owner/repo>", "current repo (defaults to git origin)").option("--bundle-details", "fetch body/comments only for user-owned and claimable issues").option("--allow-partial", "return partial board results when later page/detail reads fail").option("--live", "bypass the projection and read the authoritative GitHub Project v2 board").addHelpText("after", "\nBy default, read uses the explicitly-stale Hub projection and prints its watermark. --live is authoritative.\n--allow-partial applies to the live paginated path and detail reads; the projection row itself is atomic.\n").action((o) => runBoardRead(o));
   withExamples(mutating(
-    board.command("claim <issues...>").description("claim issues: assign them and move their Project v2 Status to In Progress \u2014 idempotent, so an item already yours and In Progress succeeds unchanged (one or more refs)").option("--json", "machine-readable output").option("--repo <owner/repo>", "current repo for local issue numbers (defaults to git origin)").option("--for <login>", "assign to this login instead of @me \u2014 agent claims on behalf of the master").option("--force", "take an item already claimed by another lane that shows live evidence of active work (#3727)").option("--allow-partial", "return success JSON if assignment succeeds but the status move fails"),
+    board.command("claim <issues...>").description("claim issues: assign them and move their Project v2 Status to In Progress \u2014 idempotent, so an item already yours and In Progress succeeds unchanged (one or more refs)").option("--json", "machine-readable output").option("--repo <owner/repo>", "current repo for local issue numbers (defaults to git origin)").option("--for <login>", "assign to this login instead of @me \u2014 agent claims on behalf of the master").option("--force", "take an item already claimed by another lane that shows live evidence of active work (#3727)").option("--check", "read-only: run every claim gate and report the verdict, writing nothing \u2014 exits 1 with the same refusal a real claim would raise (#4511)").option("--allow-partial", "return success JSON if assignment succeeds but the status move fails"),
     (_opts, args) => ({ command: "board claim", issues: args[0] ?? [] })
   ).action(async (issueRefs, o) => {
     if (issueRefs.length === 1) {
@@ -29683,11 +29718,12 @@ function registerBoardCommands(program3) {
           repo: o.repo,
           assignee: o.for,
           force: o.force,
+          check: o.check,
           allowPartial: o.allowPartial
         });
-        invalidateStatuslineBoardCache();
+        if (!result.checked) invalidateStatuslineBoardCache();
         if (o.json) return console.log(JSON.stringify(result));
-        console.log(result.partial ? `Partially claimed ${result.item.ref}: ${result.warning}` : result.alreadyClaimed ? `Already claimed ${result.item.ref} - In Progress (no change)` : `Claimed ${result.item.ref} - In Progress`);
+        console.log(result.checked ? checkVerdict(result.item.ref, result.alreadyClaimed) : result.partial ? `Partially claimed ${result.item.ref}: ${result.warning}` : result.alreadyClaimed ? `Already claimed ${result.item.ref} - In Progress (no change)` : `Claimed ${result.item.ref} - In Progress`);
       } catch (e) {
         return failGraceful(`board claim failed: ${e.message}`);
       }
@@ -29700,14 +29736,15 @@ function registerBoardCommands(program3) {
         repo: o.repo,
         assignee: o.for,
         force: o.force,
+        check: o.check,
         allowPartial: o.allowPartial
       });
-      if (bulk.results.some((r) => r.claimed)) invalidateStatuslineBoardCache();
+      if (bulk.results.some((r) => r.claimed && !r.checked)) invalidateStatuslineBoardCache();
       if (o.json) {
         console.log(JSON.stringify(bulk.results));
       } else {
         for (const result of bulk.results) {
-          console.log(result.claimed ? result.partial ? `Partially claimed ${result.ref}: ${result.warning}` : result.alreadyClaimed ? `Already claimed ${result.ref} - In Progress (no change)` : `Claimed ${result.ref} - In Progress` : `Skipped ${result.ref}: ${result.reason}`);
+          console.log(result.claimed ? result.checked ? checkVerdict(result.ref, result.alreadyClaimed) : result.partial ? `Partially claimed ${result.ref}: ${result.warning}` : result.alreadyClaimed ? `Already claimed ${result.ref} - In Progress (no change)` : `Claimed ${result.ref} - In Progress` : `Skipped ${result.ref}: ${result.reason}`);
         }
       }
       if (bulk.failed > 0) process.exitCode = 1;
@@ -29716,11 +29753,13 @@ function registerBoardCommands(program3) {
     }
   }), [
     "mmi-cli board claim 2680",
-    "mmi-cli board claim 2680 2681 --for teammate-login"
+    "mmi-cli board claim 2680 2681 --for teammate-login",
+    "mmi-cli board claim 2680 --check"
   ], [
     "Pass raw issue numbers/refs, not URLs.",
     "Claim already assigns and moves Status to In Progress, so do not also board move it.",
-    "Multiple refs are handled as a batch and return per-item results."
+    "Multiple refs are handled as a batch and return per-item results.",
+    "--check is the live gate read (it calls GitHub); --dry-run only echoes the parsed argv plan."
   ]);
   board.command("show <issue>").description("print one board item (status, assignees, type, url) with its body and comments").option("--json", "machine-readable output").option("--repo <owner/repo>", "current repo for local issue numbers (defaults to git origin)").option("--allow-partial", "return the item even if its body/comments fetch fails").action(async (issueRef, o) => {
     try {
@@ -32635,6 +32674,392 @@ function registerTrainCommands(program3) {
   });
 }
 
+// src/fleet-track-inventory.ts
+var NO_DEPLOY_SURFACE_MODELS = /* @__PURE__ */ new Set(["none", "content"]);
+function ghErrorText(e) {
+  const err = e;
+  return String(err?.stderr || err?.message || e).trim().replace(/\s+/g, " ");
+}
+function isGhNotFound2(e) {
+  const err = e;
+  return /\bNOT[_ ]FOUND\b|HTTP 404/i.test(`${err?.stderr ?? ""} ${err?.message ?? ""} ${err?.stdout ?? ""}`);
+}
+async function readFleetPluginProbe(deps, repo, branch) {
+  const [owner, name] = repo.split("/");
+  const ref = branch ? `?ref=${encodeURIComponent(branch)}` : "";
+  try {
+    const raw = await deps.ghJson([
+      "api",
+      `repos/${encodeURIComponent(owner ?? "")}/${encodeURIComponent(name ?? "")}/contents/.claude-plugin/plugin.json${ref}`
+    ]);
+    if (raw.encoding !== "base64" || typeof raw.content !== "string") {
+      return { repo, state: "unknown", unknown: "plugin.json contents read returned no base64 content" };
+    }
+    const decoded = Buffer.from(raw.content.replace(/\s/g, ""), "base64").toString("utf8");
+    const manifest = JSON.parse(decoded);
+    return {
+      repo,
+      state: "present",
+      version: typeof manifest.version === "string" && manifest.version.trim() ? manifest.version.trim() : void 0
+    };
+  } catch (e) {
+    return isGhNotFound2(e) ? { repo, state: "absent" } : { repo, state: "unknown", unknown: `plugin surface read failed: ${ghErrorText(e)}` };
+  }
+}
+async function mapBounded2(values, limit, read) {
+  const results = new Array(values.length);
+  let next = 0;
+  const worker = async () => {
+    while (next < values.length) {
+      const index = next++;
+      results[index] = await read(values[index]);
+    }
+  };
+  await Promise.all(Array.from({ length: Math.min(limit, values.length) }, () => worker()));
+  return results;
+}
+function validRepo2(repo) {
+  return typeof repo === "string" && /^[^/\s]+\/[^/\s]+$/.test(repo.trim());
+}
+function classifySurfaces(project2, plugin) {
+  const board = project2?.projectId && project2.projectNumber !== void 0 && project2.statusFieldId ? "present" : "absent";
+  const vault = typeof project2?.vaultPath === "string" && project2.vaultPath.trim() ? "present" : "absent";
+  const deployModel = typeof project2?.deployModel === "string" ? project2.deployModel : void 0;
+  const deploy = deployModel && !NO_DEPLOY_SURFACE_MODELS.has(deployModel) ? "present" : "absent";
+  return { board, vault, deploy, plugin: plugin?.state ?? "unknown" };
+}
+function classificationsOf(surfaces) {
+  const classes = [];
+  if (surfaces.board === "absent") classes.push("no-board");
+  if (surfaces.vault === "absent") classes.push("no-vault");
+  if (surfaces.plugin === "absent") classes.push("no-plugin");
+  if (surfaces.deploy === "absent") classes.push("no-deploy-surface");
+  return classes;
+}
+function buildFleetTrackInventory(projects, releaseProbes, pluginProbes, generatedAt) {
+  const releaseByRepo = new Map(releaseProbes.map((p) => [p.repo.toLowerCase(), p]));
+  const pluginByRepo = new Map(pluginProbes.map((p) => [p.repo.toLowerCase(), p]));
+  const projectByRepo = /* @__PURE__ */ new Map();
+  const anomalies = [];
+  for (const project2 of projects) {
+    const repos2 = (project2.repos ?? []).filter(validRepo2);
+    if (!repos2.length) {
+      anomalies.push({
+        kind: "project-without-repo",
+        slug: String(project2.slug ?? "?"),
+        name: String(project2.name ?? project2.slug ?? "?")
+      });
+    }
+    for (const repo of repos2) {
+      const key = repo.trim().toLowerCase();
+      projectByRepo.set(key, projectByRepo.get(key) ?? project2);
+    }
+  }
+  const repos = orgVersionRepos(projects).map((repo) => {
+    const project2 = projectByRepo.get(repo.toLowerCase());
+    const release = releaseByRepo.get(repo.toLowerCase());
+    const plugin = pluginByRepo.get(repo.toLowerCase());
+    const surfaces = classifySurfaces(project2, plugin);
+    const unknowns = [...release?.unknowns ?? []];
+    if (!release) unknowns.push("GitHub release evidence was not collected");
+    if (plugin?.unknown) unknowns.push(plugin.unknown);
+    if (!plugin) unknowns.push("plugin surface was not probed");
+    return {
+      repo,
+      slug: String(project2?.slug ?? repo.split("/")[1] ?? repo).toLowerCase(),
+      track: resolveReleaseTrack(project2, void 0, repo),
+      declaredTrack: typeof project2?.releaseTrack === "string" ? project2.releaseTrack : null,
+      branch: typeof project2?.branch === "string" ? project2.branch : null,
+      repoClass: typeof project2?.class === "string" ? project2.class : null,
+      deployModel: typeof project2?.deployModel === "string" ? project2.deployModel : null,
+      surfaces,
+      classifications: classificationsOf(surfaces),
+      pluginVersion: plugin?.version ?? null,
+      release: {
+        tag: release?.releaseTag ?? null,
+        version: release?.releasedVersion ?? null,
+        at: release?.releasedAt ?? null,
+        coordinatedVersion: release?.coordinatedVersion ?? null,
+        coordinatedSource: release?.coordinatedSource ?? null
+      },
+      ci: {
+        declared: typeof project2?.ci === "string" ? project2.ci : null,
+        requiredChecks: Array.isArray(project2?.requiredChecks) ? project2.requiredChecks : null,
+        exemptReason: typeof project2?.ciExemptReason === "string" ? project2.ciExemptReason : null
+      },
+      source: { registry: "hub-registry-live", release: "github-releases-live", plugin: "github-contents-live" },
+      freshness: { readAt: generatedAt, releasedAt: release?.releasedAt ?? null },
+      unknowns
+    };
+  });
+  const tracks = { full: 0, direct: 0, trunk: 0 };
+  for (const row of repos) tracks[row.track] += 1;
+  return {
+    generatedAt,
+    source: {
+      roster: "hub-registry-live",
+      releases: "github-releases-live",
+      plugin: "github-contents-live",
+      committedInventory: "never"
+    },
+    counts: {
+      projects: projects.length,
+      registeredRepos: repos.length,
+      tracks,
+      noBoard: repos.filter((r) => r.classifications.includes("no-board")).length,
+      noVault: repos.filter((r) => r.classifications.includes("no-vault")).length,
+      noPlugin: repos.filter((r) => r.classifications.includes("no-plugin")).length,
+      noDeploySurface: repos.filter((r) => r.classifications.includes("no-deploy-surface")).length,
+      unknownRows: repos.filter((r) => r.unknowns.length > 0).length,
+      anomalies: anomalies.length
+    },
+    repos,
+    anomalies
+  };
+}
+function defaultFleetTrackInventoryDeps() {
+  return {
+    projects: async () => {
+      const cfg = await loadConfig();
+      const projects = await fetchProjectsList(registryClientDeps(cfg));
+      if (!projects) throw new Error("live Hub registry roster is unavailable \u2014 a committed inventory is never current truth, so there is no fallback; retry when the Hub API is reachable");
+      return projects;
+    },
+    query: queryDeps(),
+    now: () => /* @__PURE__ */ new Date()
+  };
+}
+async function readFleetTrackInventory(deps = defaultFleetTrackInventoryDeps()) {
+  const projects = await deps.projects();
+  const repos = orgVersionRepos(projects);
+  const branchByRepo = /* @__PURE__ */ new Map();
+  for (const project2 of projects) {
+    for (const repo of (project2.repos ?? []).filter(validRepo2)) {
+      const key = repo.trim().toLowerCase();
+      if (!branchByRepo.has(key)) {
+        branchByRepo.set(key, typeof project2.branch === "string" ? project2.branch : void 0);
+      }
+    }
+  }
+  const [releaseProbes, pluginProbes] = await Promise.all([
+    mapBounded2(repos, 6, (repo) => readOrgVersionProbe(deps.query, repo)),
+    mapBounded2(repos, 6, (repo) => readFleetPluginProbe(deps.query, repo, branchByRepo.get(repo.toLowerCase())))
+  ]);
+  return buildFleetTrackInventory(projects, releaseProbes, pluginProbes, deps.now().toISOString());
+}
+function formatFleetTrackInventory(report) {
+  const { counts } = report;
+  const lines = [
+    `fleet version-track inventory \u2014 ${counts.registeredRepos} registered repositories (${counts.projects} registry projects)`,
+    `source: live Hub registry + live GitHub releases/contents \xB7 read ${report.generatedAt} \xB7 committed inventory: never`,
+    `tracks: ${counts.tracks.full} full \xB7 ${counts.tracks.direct} direct \xB7 ${counts.tracks.trunk} trunk`,
+    `classified: ${counts.noBoard} no-board \xB7 ${counts.noVault} no-vault \xB7 ${counts.noPlugin} no-plugin \xB7 ${counts.noDeploySurface} no-deploy-surface \xB7 ${counts.unknownRows} rows with unknowns`,
+    "",
+    "repository | track | deploy model | released | plugin | classifications"
+  ];
+  for (const row of report.repos) {
+    lines.push(
+      `${row.repo} | ${row.track}${row.declaredTrack ? "" : " (derived)"} | ${row.deployModel ?? "UNDECLARED"} | ${row.release.version ?? "UNKNOWN"} | ${row.pluginVersion ?? (row.surfaces.plugin === "present" ? "present" : row.surfaces.plugin)} | ${row.classifications.join(", ") || "none"}`
+    );
+    for (const unknown of row.unknowns) lines.push(`  ? ${unknown}`);
+  }
+  if (report.anomalies.length) {
+    lines.push("", "anomalies:");
+    for (const anomaly of report.anomalies) {
+      lines.push(`  ? ${anomaly.slug} (${anomaly.name}) \u2014 registry project has no registered repository`);
+    }
+  }
+  return lines.join("\n");
+}
+function registerFleetTrackInventory(program3) {
+  const train = program3.commands.find((c) => c.name() === "train");
+  if (!train) throw new Error("train inventory registration requires the train command group");
+  train.command("inventory").description("live fleet version-track inventory (#4451) \u2014 every registered repo's track, deploy model, CI contract, release evidence, and explicit no-board/no-vault/no-plugin/no-deploy-surface classification").option("--json", "machine-readable output (the typed D2b input shape)").action(async (o) => {
+    try {
+      const report = await readFleetTrackInventory();
+      console.log(o.json ? JSON.stringify(report, null, 2) : formatFleetTrackInventory(report));
+    } catch (e) {
+      return failGraceful(`train inventory: ${e.message}`);
+    }
+  });
+}
+
+// ../infra/src/version-gate.ts
+var HUB_REPO5 = "mutmutco/mmi-hub";
+var NO_RELEASE_UNKNOWN = "no published GitHub Release";
+function semverEqual(a, b) {
+  return versionAtLeast(a, b) && versionAtLeast(b, a);
+}
+function semverRelation(a, b) {
+  if (!parseSemver(a) || !parseSemver(b)) return null;
+  if (semverEqual(a, b)) return "equal";
+  return versionAtLeast(a, b) ? "ahead" : "behind";
+}
+function classifyRow(row) {
+  const findings = [];
+  const reasons = /* @__PURE__ */ new Set();
+  const releaseRequired = row.track !== "trunk";
+  for (const unknown of row.unknowns) {
+    if (!releaseRequired && unknown === NO_RELEASE_UNKNOWN) continue;
+    reasons.add(unknown);
+  }
+  const { version, coordinatedVersion, coordinatedSource, tag } = row.release;
+  if (releaseRequired && !version && ![...reasons].some((r) => /release/i.test(r))) {
+    reasons.add(NO_RELEASE_UNKNOWN);
+  }
+  if (releaseRequired && version && !coordinatedVersion && ![...reasons].some((r) => /version lock|distribution-bom|package\.json/i.test(r))) {
+    reasons.add(`coordinated version pointer unknown at ${tag ?? "the release tag"}`);
+  }
+  if (version && coordinatedVersion) {
+    const relation = semverRelation(version, coordinatedVersion);
+    if (relation === null) {
+      reasons.add(`released ${version} and ${coordinatedSource ?? "version lock"} ${coordinatedVersion} are not comparable semver`);
+    } else if (relation !== "equal") {
+      findings.push(`released ${version} is ${relation === "ahead" ? "ahead of" : "behind"} the tag-scoped version lock ${coordinatedVersion} (${coordinatedSource ?? "unknown source"})`);
+    }
+  }
+  if (row.pluginVersion && version) {
+    const relation = semverRelation(row.pluginVersion, version);
+    if (relation === null) {
+      reasons.add(`plugin surface version ${row.pluginVersion} and released ${version} are not comparable semver`);
+    } else if (relation === "behind") {
+      findings.push(`plugin surface ships ${row.pluginVersion}, behind the released ${version}`);
+    }
+  }
+  const unknownReasons = [...reasons].sort((a, b) => a.localeCompare(b));
+  return {
+    repo: row.repo,
+    track: row.track,
+    deployModel: row.deployModel,
+    verdict: findings.length > 0 ? "drift" : unknownReasons.length > 0 ? "unknown" : "conforming",
+    findings,
+    unknownReasons,
+    checkedAt: row.freshness.readAt
+  };
+}
+function canaryOrder(a, b) {
+  const rank = { conforming: 0, unknown: 1, drift: 2 };
+  if (rank[a.result.verdict] !== rank[b.result.verdict]) return rank[a.result.verdict] - rank[b.result.verdict];
+  const aAt = a.releasedAt ? Date.parse(a.releasedAt) : Number.NEGATIVE_INFINITY;
+  const bAt = b.releasedAt ? Date.parse(b.releasedAt) : Number.NEGATIVE_INFINITY;
+  if (aAt !== bAt) return bAt - aAt;
+  return a.result.repo.localeCompare(b.result.repo);
+}
+function buildCanaryClasses(rows, resultByRepo) {
+  const byModel = /* @__PURE__ */ new Map();
+  for (const row of rows) {
+    const model = row.deployModel ?? "undeclared";
+    const result = resultByRepo.get(row.repo);
+    if (!result) continue;
+    const bucket = byModel.get(model) ?? [];
+    bucket.push({ result, releasedAt: row.freshness.releasedAt });
+    byModel.set(model, bucket);
+  }
+  return [...byModel.entries()].sort(([a], [b]) => a.localeCompare(b)).map(([deployModel, members]) => {
+    const ordered = [...members].sort(canaryOrder);
+    return {
+      deployModel,
+      canary: ordered[0]?.result.repo ?? null,
+      cohort: ordered.slice(1).map((m) => m.result.repo),
+      conforming: members.filter((m) => m.result.verdict === "conforming").length,
+      drift: members.filter((m) => m.result.verdict === "drift").length,
+      unknown: members.filter((m) => m.result.verdict === "unknown").length
+    };
+  });
+}
+function evaluateFleetLockstepGate(rows, evaluatedAt) {
+  const results = rows.map(classifyRow);
+  const resultByRepo = new Map(results.map((r) => [r.repo, r]));
+  const drift = results.filter((r) => r.verdict === "drift").map((r) => ({ repo: r.repo, findings: [...r.findings] }));
+  const unknowns = results.filter((r) => r.verdict === "unknown").map((r) => ({ repo: r.repo, reasons: [...r.unknownReasons] }));
+  const conformingRepos = results.filter((r) => r.verdict === "conforming").map((r) => r.repo);
+  const hubOnly = rows.length > 0 && rows.every((row) => row.repo.trim().toLowerCase() === HUB_REPO5);
+  const failReasons = [];
+  if (rows.length === 0) failReasons.push("empty roster: no registered repositories were evaluated");
+  if (hubOnly) failReasons.push("hub-only coverage: the fleet gate refuses a result covering only mutmutco/MMI-Hub");
+  if (drift.length > 0) failReasons.push(`${drift.length} repositor${drift.length === 1 ? "y" : "ies"} with drift`);
+  if (unknowns.length > 0) failReasons.push(`${unknowns.length} repositor${unknowns.length === 1 ? "y" : "ies"} with unknown evidence`);
+  return {
+    gate: "fleet-lockstep-conformance",
+    mode: "dry-run",
+    enforcement: "none",
+    verdict: failReasons.length === 0 && conformingRepos.length === rows.length ? "pass" : "fail",
+    failReasons,
+    denominator: rows.length,
+    conforming: conformingRepos.length,
+    conformingRepos,
+    drift,
+    unknowns,
+    canaryClasses: buildCanaryClasses(rows, resultByRepo),
+    hubOnly,
+    repos: results,
+    evaluatedAt
+  };
+}
+
+// src/fleet-lockstep-gate.ts
+async function runFleetLockstepGate(deps = defaultFleetTrackInventoryDeps()) {
+  const inventory = await readFleetTrackInventory(deps);
+  return evaluateFleetLockstepGate(inventory.repos, inventory.generatedAt);
+}
+function fleetGateConformanceEvidence(result) {
+  return result.repos.map((row) => ({
+    repo: row.repo,
+    verdict: row.verdict,
+    checkedAt: row.checkedAt,
+    findings: row.findings.length ? [...row.findings] : void 0,
+    unknownEvidence: row.unknownReasons.length ? [...row.unknownReasons] : void 0
+  }));
+}
+function formatFleetLockstepGate(result) {
+  const lines = [
+    `fleet lockstep gate (dry-run) \u2014 ${result.conforming}/${result.denominator} conforming \xB7 ${result.verdict.toUpperCase()}`,
+    `evaluated ${result.evaluatedAt} \xB7 live D2a inventory \xB7 enforcement: none (D2c #4453)`
+  ];
+  if (result.failReasons.length) {
+    lines.push("", "fail reasons:");
+    for (const reason of result.failReasons) lines.push(`  ! ${reason}`);
+  }
+  if (result.conformingRepos.length) {
+    lines.push("", `conforming set (${result.conformingRepos.length}):`);
+    for (const repo of result.conformingRepos) lines.push(`  = ${repo}`);
+  }
+  if (result.drift.length) {
+    lines.push("", `drift (${result.drift.length}):`);
+    for (const row of result.drift) {
+      lines.push(`  x ${row.repo}`);
+      for (const finding of row.findings) lines.push(`      ${finding}`);
+    }
+  }
+  if (result.unknowns.length) {
+    lines.push("", `unknown evidence (${result.unknowns.length}):`);
+    for (const row of result.unknowns) {
+      lines.push(`  ? ${row.repo}`);
+      for (const reason of row.reasons) lines.push(`      ${reason}`);
+    }
+  }
+  lines.push("", "canary classes by deploy model (canary -> cohort):");
+  for (const cls of result.canaryClasses) {
+    lines.push(
+      `  ${cls.deployModel}: canary ${cls.canary ?? "NONE"}` + (cls.cohort.length ? ` -> ${cls.cohort.join(", ")}` : "") + ` (${cls.conforming} conforming \xB7 ${cls.drift} drift \xB7 ${cls.unknown} unknown)`
+    );
+  }
+  return lines.join("\n");
+}
+function registerFleetLockstepGate(program3) {
+  const train = program3.commands.find((c) => c.name() === "train");
+  if (!train) throw new Error("train gate registration requires the train command group");
+  train.command("gate").description("fleet lockstep N-of-N conformance DRY-RUN gate (#4452) \u2014 live D2a inventory in, fail-closed verdict out: denominator, conforming set, exact drift, canary classes by deploy model, named unknowns; no ruleset enforcement (D2c #4453)").option("--json", "machine-readable output (the typed gate result)").action(async (o) => {
+    try {
+      const result = await runFleetLockstepGate();
+      console.log(o.json ? JSON.stringify(result, null, 2) : formatFleetLockstepGate(result));
+      process.exitCode = result.verdict === "pass" ? 0 : 1;
+    } catch (e) {
+      return failGraceful(`train gate: ${e.message}`);
+    }
+  });
+}
+
 // src/deploy-status.ts
 function buildDeployStatusReport(input) {
   const deploy = input.deployFacts?.stages[input.stage] ?? null;
@@ -33619,6 +34044,12 @@ function parseWorktreePorcelain2(stdout) {
 var CLOSING_MENTION_RE = /\b(close[sd]?|fix(?:e[sd])?|resolve[sd]?)\s+#(\d+)/gi;
 var NEGATION_RE = /\b(?:not|never|cannot|can't|don't|doesn't|didn't|won't|wouldn't|shouldn't|mustn't|without)\b/i;
 var CLAUSE_WINDOW = 120;
+var NEGATED_CLOSING_PHRASE_RE = /\b(?:(?:does|do|did|will|would|should|must|can)\s+not|(?:is|was|are|were)\s+not|doesn't|don't|didn't|won't|wouldn't|shouldn't|mustn't|can't|cannot|never|without|not)\s+(?:close[sd]?|fix(?:e[sd])?|resolve[sd]?)\s+#(\d+)/gi;
+function rewriteNegatedClosingPhrases(text) {
+  if (!text.includes("#")) return text;
+  const segments = text.split(/(```[\s\S]*?```|~~~[\s\S]*?~~~|`[^`\n]*`)/g);
+  return segments.map((seg, i) => i % 2 === 1 ? seg : seg.replace(NEGATED_CLOSING_PHRASE_RE, (_m, n) => `leaves #${n} open`)).join("");
+}
 function findClosingMentions(text) {
   const mentions = [];
   for (const match of text.matchAll(CLOSING_MENTION_RE)) {
@@ -33692,11 +34123,12 @@ ${typeof body === "string" ? body : ""}`;
 function negatedClosingRefusalMessage(negated, context = "pr merge") {
   const named = negated.map((n) => `#${n}`).join(", ");
   const first = `#${negated[0] ?? "N"}`;
-  return `${context}: REFUSED \u2014 GitHub will close ${named} on merge, but the PR body says it does not (GitHub's closing-keyword parser is negation-blind: "does not close ${first}" still closes it). Reword the body so the keyword is gone (e.g. "leaves ${first} open"), or re-run with --force to merge anyway and let ${named} close.`;
+  return `${context}: REFUSED \u2014 GitHub will close ${named} on merge, but the PR body says it does not (GitHub's closing-keyword parser is negation-blind: "does not close ${first}" still closes it). Reword so the keyword is gone \u2014 use "Part of ${first}", "Refs ${first}", or "leaves ${first} open"; never "does not close ${first}". Or re-run with --force to merge anyway and let ${named} close.`;
 }
 function commitClosingRefusalMessage(closing, context = "pr merge") {
   const named = closing.map((n) => `#${n}`).join(", ");
-  return `${context}: REFUSED \u2014 commit messages will close ${named} through the squash body, but GitHub omitted ${named} from closingIssuesReferences. Remove the closing keyword from the commit message, or re-run with --force to merge anyway and let ${named} close.`;
+  const first = `#${closing[0] ?? "N"}`;
+  return `${context}: REFUSED \u2014 commit messages will close ${named} through the squash body, but GitHub omitted ${named} from closingIssuesReferences. Remove close/fix/resolve + ${first} from the commit message (if the issue must stay open, use "Part of ${first}" / "Refs ${first}" / "leaves ${first} open" \u2014 never "does not close ${first}"), or re-run with --force to merge anyway and let ${named} close.`;
 }
 function alreadyClosedCommitClosingMessage(closed, context = "pr merge") {
   const named = closed.map((n) => `#${n}`).join(", ");
@@ -33887,6 +34319,297 @@ function registerSessionReport(program3) {
   });
 }
 
+// src/learning-closure-rate.ts
+var CLOSURE_RATE_TIMEOUT_MS = 2e4;
+var LOOP_ITEM_CAP = 100;
+var EVIDENCE_CONCURRENCY = 4;
+var RED_TEAM_FINDING_LABEL2 = "red-team";
+var RULING_LOOP_STATE_LABELS = ["loop-state:closed-deferred", "loop-state:closed-invalid"];
+var CLOSED_MERGED_LOOP_STATE_LABEL = "loop-state:closed-merged";
+var LOOP_KINDS2 = [
+  { kind: "friction", label: REPORT_LABEL },
+  { kind: "lesson", label: SKILL_LESSON_LABEL },
+  { kind: "red-team", label: RED_TEAM_FINDING_LABEL2 }
+];
+function prIsMerged(pr2) {
+  return String(pr2.state ?? "").toUpperCase() === "MERGED";
+}
+function mergedPrsOf(linkedPrs) {
+  return linkedPrs.filter(prIsMerged);
+}
+function hasRecordedRuling(labels) {
+  return labels.some((label) => RULING_LOOP_STATE_LABELS.includes(label));
+}
+function classifyLoopClosure(item, evidence) {
+  if (String(item.state ?? "").toUpperCase() !== "CLOSED") return "open";
+  if (mergedPrsOf(evidence.linkedPrs).length > 0) return "closed";
+  if (item.labels.includes(CLOSED_MERGED_LOOP_STATE_LABEL)) return "closed";
+  if (hasRecordedRuling(item.labels)) return "closed";
+  return "closed-no-evidence";
+}
+var round3 = (x) => Math.round(x * 1e3) / 1e3;
+function computeLoopKindRate(spec, verdicts) {
+  const numerator = verdicts.filter((v) => v === "closed").length;
+  const unknownEvidence = verdicts.filter((v) => v === "closed-no-evidence").length;
+  const denominator = verdicts.length;
+  return {
+    kind: spec.kind,
+    label: spec.label,
+    numerator,
+    denominator,
+    unknownEvidence,
+    rate: denominator > 0 ? round3(numerator / denominator) : null
+  };
+}
+function fmtRate(rate) {
+  return rate === null ? "\u2014" : rate.toFixed(3);
+}
+function formatClosureSummary(report) {
+  const kindWidth = Math.max(...report.kinds.map((k) => k.kind.length));
+  const labelWidth = Math.max(...report.kinds.map((k) => k.label.length));
+  const lines = [`learning closure rate \u2014 ${report.repo} (computed at read; #4440)`];
+  for (const k of report.kinds) {
+    const head = `${k.kind.padEnd(kindWidth)}  (label ${k.label.padEnd(labelWidth)})`;
+    const body = k.denominator === 0 ? "no loop items" : `${k.numerator}/${k.denominator} closed \xB7 ${k.unknownEvidence} unknown evidence \xB7 rate ${fmtRate(k.rate)}`;
+    lines.push(`  ${head}: ${body}`);
+  }
+  const t = report.totals;
+  lines.push(
+    `  ${"total".padEnd(kindWidth)}: ${t.numerator}/${t.denominator} closed \xB7 ${t.unknownEvidence} unknown evidence \xB7 rate ${fmtRate(t.rate)}`,
+    "A closed loop without a merged PR or a recorded ruling reads as open."
+  );
+  if (report.evidencePartial) {
+    lines.push("note: at least one closed item had an unreadable linked-PR read \u2014 counted open (unknown evidence).");
+  }
+  return lines.join("\n");
+}
+function buildClosureReport(repo, perKind, evidencePartial) {
+  const kinds = perKind.map(({ spec, verdicts }) => computeLoopKindRate(spec, verdicts));
+  const numerator = kinds.reduce((acc, k) => acc + k.numerator, 0);
+  const denominator = kinds.reduce((acc, k) => acc + k.denominator, 0);
+  const unknownEvidence = kinds.reduce((acc, k) => acc + k.unknownEvidence, 0);
+  const report = {
+    repo,
+    kinds,
+    totals: {
+      numerator,
+      denominator,
+      unknownEvidence,
+      rate: denominator > 0 ? round3(numerator / denominator) : null
+    },
+    evidencePartial,
+    summary: ""
+  };
+  report.summary = formatClosureSummary(report);
+  return report;
+}
+function splitRepo2(repo) {
+  const parts = repo.split("/");
+  if (parts.length !== 2 || !parts[0] || !parts[1]) {
+    throw new QueryReadError("BAD_INPUT", `invalid repo "${repo}" (expected owner/repo)`);
+  }
+  return { owner: parts[0], name: parts[1] };
+}
+async function mapPooled(items, limit, worker) {
+  const out = new Array(items.length);
+  let next = 0;
+  const runners = Array.from({ length: Math.min(limit, items.length) }, async () => {
+    while (next < items.length) {
+      const index = next;
+      next += 1;
+      out[index] = await worker(items[index]);
+    }
+  });
+  await Promise.all(runners);
+  return out;
+}
+async function readEvidence(deps, owner, name, item) {
+  try {
+    const resp = await deps.ghJson(prForIssueGraphqlArgs(owner, name, item.number), CLOSURE_RATE_TIMEOUT_MS);
+    return { linkedPrs: extractPrForIssueResponse(resp), readFailed: false };
+  } catch (e) {
+    if (e instanceof QueryReadError && e.code === "NOT_FOUND") {
+      return { linkedPrs: [], readFailed: false };
+    }
+    return { linkedPrs: [], readFailed: true };
+  }
+}
+async function runLearningClosureRate(deps, opts = {}) {
+  const repo = opts.repo ?? HUB_REPO3;
+  const { owner, name } = splitRepo2(repo);
+  let evidencePartial = false;
+  const perKind = [];
+  for (const spec of LOOP_KINDS2) {
+    const rows = await deps.ghJson(
+      buildIssueListArgs({ label: spec.label, state: "all", limit: LOOP_ITEM_CAP }, repo),
+      CLOSURE_RATE_TIMEOUT_MS
+    );
+    const items = shapeIssueList(rows);
+    const closed = items.filter((item) => String(item.state ?? "").toUpperCase() === "CLOSED");
+    const evidence = await mapPooled(closed, EVIDENCE_CONCURRENCY, (item) => readEvidence(deps, owner, name, item));
+    if (evidence.some((ev) => ev.readFailed)) evidencePartial = true;
+    const evidenceByNumber = new Map(closed.map((item, i) => [item.number, evidence[i]]));
+    const verdicts = items.map(
+      (item) => classifyLoopClosure(item, evidenceByNumber.get(item.number) ?? { linkedPrs: [], readFailed: false })
+    );
+    perKind.push({ spec, verdicts });
+  }
+  return buildClosureReport(repo, perKind, evidencePartial);
+}
+function closureRateFail(e) {
+  if (e instanceof QueryReadError) {
+    const code = e.code === "NOT_FOUND" ? ERROR_CODES.ERR_NOT_FOUND : e.code === "NO_AUTH" ? ERROR_CODES.ERR_NO_AUTH : ERROR_CODES.ERR_BAD_ENUM;
+    return fail(`closure-rate: ${e.message}`, code === ERROR_CODES.ERR_BAD_ENUM ? void 0 : { code });
+  }
+  const err = e;
+  return fail(`closure-rate: ${(err.stderr || err.message || String(e)).trim()}`);
+}
+function registerLearningClosureRateCommand(program3) {
+  const deps = queryDeps();
+  withExamples(
+    program3.command("closure-rate").description(
+      "learning closure rate per loop kind (friction, lesson, red-team) computed at read from board + linked-PR/ruling evidence \u2014 a closed loop without a merged PR or a recorded ruling reads as open (#4440)"
+    ).option("--repo <owner/repo>", `repo holding the loop items (defaults to ${HUB_REPO3}, the central Hub board)`).option("--json", "print the structured LearningClosureReport JSON (default is the human summary)").action(async (o) => {
+      try {
+        const report = await runLearningClosureRate(deps, { repo: o.repo });
+        if (o.json) console.log(JSON.stringify(report, null, 2));
+        else console.log(report.summary);
+      } catch (e) {
+        closureRateFail(e);
+      }
+    }),
+    [
+      "mmi-cli learning closure-rate",
+      "mmi-cli learning closure-rate --repo mutmutco/MMI-Hub --json"
+    ],
+    "loop items are read newest-first with a bounded cap of 100 per kind \u2014 a rate over a longer history needs the cap raised, never an unbounded scan"
+  );
+}
+
+// ../infra/src/fleet-health.ts
+function uniqueRepos(repos) {
+  const unique = /* @__PURE__ */ new Map();
+  for (const raw of repos) {
+    const repo = raw.trim();
+    if (repo) unique.set(repo.toLowerCase(), unique.get(repo.toLowerCase()) ?? repo);
+  }
+  return [...unique.values()].sort((a, b) => a.localeCompare(b));
+}
+function buildFleetHealthReport(registeredRepos, evidence, asOf, maxAgeMs = 24 * 60 * 60 * 1e3) {
+  const repos = uniqueRepos(registeredRepos);
+  const evidenceByRepo = new Map(evidence.map((row) => [row.repo.trim().toLowerCase(), row]));
+  const nowMs = Date.parse(asOf);
+  const drift = [];
+  const unknownEvidence = [];
+  let conforming = 0;
+  let fresh = 0;
+  let stale = 0;
+  let freshnessUnknown = 0;
+  for (const repo of repos) {
+    const row = evidenceByRepo.get(repo.toLowerCase());
+    const reasons = [...row?.unknownEvidence ?? []];
+    let isFresh = false;
+    if (!row) {
+      reasons.push("no #4318 dry-run conformance evidence");
+      freshnessUnknown += 1;
+    } else if (!row.checkedAt) {
+      reasons.push("conformance freshness is unknown");
+      freshnessUnknown += 1;
+    } else {
+      const checkedMs = Date.parse(row.checkedAt);
+      if (!Number.isFinite(checkedMs) || !Number.isFinite(nowMs) || checkedMs > nowMs) {
+        reasons.push(`invalid conformance timestamp: ${row.checkedAt}`);
+        freshnessUnknown += 1;
+      } else if (nowMs - checkedMs > maxAgeMs) {
+        reasons.push(`conformance evidence is stale (${row.checkedAt})`);
+        stale += 1;
+      } else {
+        isFresh = true;
+        fresh += 1;
+      }
+    }
+    if (row?.verdict === "drift") {
+      drift.push({
+        repo,
+        findings: row.findings?.length ? [...row.findings] : ["#4318 verdict reported drift without a finding"]
+      });
+    }
+    if (row?.verdict === "unknown" && reasons.length === 0) reasons.push("#4318 verdict is unknown");
+    if (row?.verdict === "conforming" && isFresh && reasons.length === 0) conforming += 1;
+    if (reasons.length > 0) unknownEvidence.push({ repo, reasons });
+  }
+  const verdict = drift.length > 0 ? "drift" : repos.length > 0 && conforming === repos.length && unknownEvidence.length === 0 ? "conforming" : "unknown";
+  return {
+    verdict,
+    source: "#4318-dry-run-conformance",
+    denominator: repos.length,
+    conforming,
+    drift,
+    freshness: {
+      asOf,
+      maxAgeSeconds: Math.floor(maxAgeMs / 1e3),
+      fresh,
+      stale,
+      unknown: freshnessUnknown
+    },
+    unknownEvidence,
+    readOnly: true
+  };
+}
+function fleetHealthExitCode(report) {
+  return report.verdict === "conforming" ? 0 : 1;
+}
+
+// src/org-health-query.ts
+var DEFAULT_MAX_AGE_MS = 24 * 60 * 60 * 1e3;
+function defaultOrgHealthQueryDeps() {
+  return {
+    registeredRepos: async () => {
+      const cfg = await loadConfig();
+      const projects = await fetchProjectsList(registryClientDeps(cfg));
+      if (!projects) throw new Error("live Hub registry roster is unavailable");
+      return orgVersionRepos(projects);
+    },
+    conformanceEvidence: async () => fleetGateConformanceEvidence(await runFleetLockstepGate()),
+    now: () => /* @__PURE__ */ new Date()
+  };
+}
+async function runOrgHealthQuery(deps, maxAgeMs = DEFAULT_MAX_AGE_MS) {
+  const repos = await deps.registeredRepos();
+  const evidence = await deps.conformanceEvidence(repos);
+  return buildFleetHealthReport(repos, evidence, deps.now().toISOString(), maxAgeMs);
+}
+function formatOrgHealth(report) {
+  const lines = [
+    `org health \u2014 ${report.conforming}/${report.denominator} conforming \xB7 ${report.verdict.toUpperCase()}`,
+    `source: ${report.source} \xB7 read ${report.freshness.asOf}`,
+    `freshness: ${report.freshness.fresh} fresh \xB7 ${report.freshness.stale} stale \xB7 ${report.freshness.unknown} unknown`
+  ];
+  if (report.drift.length) {
+    lines.push("", "drift:");
+    for (const row of report.drift) lines.push(`  ${row.repo}: ${row.findings.join("; ")}`);
+  }
+  if (report.unknownEvidence.length) {
+    lines.push("", "unknown evidence:");
+    for (const row of report.unknownEvidence) lines.push(`  ${row.repo}: ${row.reasons.join("; ")}`);
+  }
+  return lines.join("\n");
+}
+function registerOrgHealthQuery(program3, deps = defaultOrgHealthQueryDeps()) {
+  const org = program3.commands.find((command) => command.name() === "org");
+  if (!org) throw new Error("org health registration requires consolidated command namespaces");
+  org.command("health").description("live read of #4318 fleet lockstep evidence \u2014 N-of-N, named drift, freshness, and unknowns; never writes state").option("--json", "machine-readable output").action(async (options) => {
+    try {
+      const report = await runOrgHealthQuery(deps);
+      console.log(options.json ? JSON.stringify(report, null, 2) : formatOrgHealth(report));
+      process.exitCode = fleetHealthExitCode(report);
+    } catch (error) {
+      console.error(`org health: ${error.message}`);
+      process.exitCode = 1;
+    }
+  });
+}
+
 // src/plugin-release-catchup.ts
 var import_node_fs43 = require("node:fs");
 var import_node_path40 = require("node:path");
@@ -36838,9 +37561,9 @@ program2.name("mmi-cli").description("MMI Future Hub CLI ? the org control plane
 program2.addHelpText(
   "before",
   `Houses (canonical roots): oracle \xB7 harbour \xB7 devops \xB7 vault \xB7 learning
-  \`mmi-cli <house> <command> \u2026\` is the canonical form; the flat \`mmi-cli <command> \u2026\` paths below
-  are compatibility shims that die in ${COMPAT_SHIM_DEATH_WAVE} (#4316). \`mmi-cli commands\` shows the
-  house-shaped tree; \`mmi-cli <house> --help\` lists one house.
+  \`mmi-cli <house> <command> \u2026\` is the only invocation form for the paths below \u2014 their flat
+  \`mmi-cli <command> \u2026\` aliases were removed in ${COMPAT_SHIM_DEATH_WAVE} (#4316, #4438); core commands stay
+  unprefixed. \`mmi-cli commands\` shows the house-shaped tree; \`mmi-cli <house> --help\` lists one house.
 `
 );
 function appActorDeps() {
@@ -37722,7 +38445,11 @@ docs.command("index").description("regenerate docs/index.md from the docs/ tree
 docs.command("refs").description("deterministic doc reference gate: every backticked repo path, relative .md link, `mmi-cli` command ref, and `<!-- pinned by ? -->` comment across docs/** + README.md + architecture.md must resolve, or exit 1 (fleet-portable port of the Hub gate scripts/check-doc-refs.mjs, #3339)").option("--json", "machine-readable findings list: { ok, docCount, findings[], warnings[] }").action(async (o) => {
   try {
     const root = await repoRoot();
-    const commandPaths = new Set(buildCommandManifest(program2).index.map((entry) => entry.path));
+    const commandPaths = new Set(
+      buildCommandManifest(program2).index.map(
+        (entry) => entry.house && entry.house !== "core" ? `${entry.house} ${entry.path}` : entry.path
+      )
+    );
     const result = runDocRefs(root, { commandPaths });
     if (o.json) {
       consoleIo.log(JSON.stringify({ ok: result.ok, docCount: result.docCount, findings: result.findings, warnings: result.warnings }, null, 2));
@@ -38749,6 +39476,7 @@ withExamples(pr.command("create").description("create a PR and print {number,url
     return fail(`pr create: ${e.message}`, e instanceof TextArgError ? { code: e.code, offending_flag: e.offendingFlag } : void 0);
   }
   body = normalizeClosingDirectives(body);
+  body = rewriteNegatedClosingPhrases(body);
   const docsCheck = await checkDocsIndexAtHead({ repo: o.repo, head: o.head }, createPrCreateDocsIndexDeps());
   if (docsCheck && !docsCheck.ok) {
     return fail(`pr create: ${docsCheck.detail} ? ${docsCheck.fix}`);
@@ -39216,11 +39944,14 @@ registerQueryCommands(program2);
 registerWorktreeCommands(program2);
 registerIssueLifecycleCommands(program2, { attach: attachToProject });
 registerTrainCommands(program2);
+registerFleetTrackInventory(program2);
+registerFleetLockstepGate(program2);
 registerDeployCommands(program2);
 registerDiscoveryCommands(program2);
 registerExplainCommand(program2);
 registerPrLifecycleCommands(program2);
 registerSessionReport(program2);
+registerLearningClosureRateCommand(program2);
 registerBoardCommands(program2);
 registerStageCommands(program2);
 var GH_TRAIN_TIMEOUT_MS = 3e4;
@@ -39237,7 +39968,10 @@ function trainApplyDeps() {
         throw surfaceTrainSubprocessFailure(e, file, args);
       }
     },
-    runSelf: async (args) => (await execFileP2(process.execPath, [process.argv[1], ...args], { timeout: 3e4 })).stdout,
+    // canonicalArgvFor (#4438): callers hand this seam house-relative paths (`org project get`,
+    // `secrets preflight`); since the Wave 3 flat-alias cut only the canonical house-prefixed form
+    // parses, so the ONE self-spawn seam derives the prefix through the same rule the refusal names.
+    runSelf: async (args) => (await execFileP2(process.execPath, [process.argv[1], ...canonicalArgvFor(args)], { timeout: 3e4 })).stdout,
     trainAuthority: async (repo) => {
       const verdict = await fetchTrainAuthority(repo, registryClientDeps(await loadConfig()));
       return verdict.ok ? { ok: true, role: verdict.authority.role, train: verdict.authority.train } : verdict;
@@ -39917,12 +40651,21 @@ program2.command("session-start").description("run the SessionStart verbs (whoam
 });
 installProcessBackstop();
 consolidateCommandNamespaces(program2);
+registerOrgHealthQuery(program2);
 applyCommandTaxonomy(program2);
 function resolveHouseShim(argv) {
   const houseToken = argv[2];
   if (!houseToken) return;
   if (!isHouseRoot(houseToken)) {
-    return;
+    const flatTokens = argv.slice(2, 4).filter((tok) => !tok.startsWith("-"));
+    const flatPath = flatTokens.join(" ");
+    const flatHouse = houseForPath(flatPath);
+    if (!flatHouse || flatHouse === "core") return;
+    process.stderr.write(
+      `mmi-cli: the flat '${flatPath}' alias was removed in ${COMPAT_SHIM_DEATH_WAVE} (#4316) \u2014 run: mmi-cli ${canonicalPathFor(flatPath)} \u2026
+`
+    );
+    hardExit(2);
   }
   const remainder = argv.slice(3);
   const first = remainder[0];
@@ -39941,10 +40684,9 @@ function resolveHouseShim(argv) {
     argv.splice(2, 1);
     return;
   }
-  const canonical = actual ? `mmi-cli ${actual === "core" ? "" : `${actual} `}${lookupPath}`.replace(/\s+/g, " ").trim() : void 0;
   if (actual) {
     process.stderr.write(
-      `mmi-cli ${houseToken}: '${lookupPath}' lives in house '${actual}' \u2014 run: ${canonical} \u2026
+      `mmi-cli ${houseToken}: '${lookupPath}' lives in house '${actual}' \u2014 run: mmi-cli ${canonicalPathFor(lookupPath)} \u2026
 `
     );
   } else {
@@ -39967,8 +40709,8 @@ function printHouseRootHelp(house) {
   }
   lines.push(
     "",
-    `Canonical: \`mmi-cli ${house} <command> \u2026\`. The flat \`mmi-cli <command> \u2026\` form is a compatibility`,
-    `shim keeping fleet scripts working for one window \u2014 shims die in ${COMPAT_SHIM_DEATH_WAVE} (#4316).`
+    `Canonical: \`mmi-cli ${house} <command> \u2026\`. The flat \`mmi-cli <command> \u2026\` compatibility shims`,
+    `were removed in ${COMPAT_SHIM_DEATH_WAVE} (#4316, #4438) \u2014 only the canonical house-prefixed form parses.`
   );
   consoleIo.log(lines.join("\n"));
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "3.106.0",
+  "version": "3.107.0",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",