@mutmutco/cli 3.113.0 → 3.115.0

package/dist/main.cjs

@@ -5001,7 +5001,7 @@ var program = new Command();
 // src/index.ts
 var import_promises11 = require("node:fs/promises");
 var import_node_fs46 = require("node:fs");
-var import_node_child_process19 = require("node:child_process");
+var import_node_child_process20 = require("node:child_process");
 
 // src/cli-shared.ts
 var import_node_child_process3 = require("node:child_process");
@@ -7602,26 +7602,32 @@ function branchForTrackingRef(ref, remote) {
 function sameWorktreeMetadataPath(a, b) {
   return a.replace(/\\/g, "/").replace(/\/+$/, "") === b.replace(/\\/g, "/").replace(/\/+$/, "");
 }
-function resolveSafeSiblingWorktreeCleanupTarget(worktreePath, siblingRoot, deps) {
-  let rootReal;
+function resolveSafeSiblingWorktreeCleanupTarget(worktreePath, siblingRoots, deps) {
   let worktreeReal;
-  try {
-    rootReal = deps.realpath(siblingRoot);
-  } catch {
-    return { ok: false, reason: "sibling root could not be resolved" };
-  }
-  if (!isPathUnderDirectory2(rootReal, siblingRoot) || !isPathUnderDirectory2(siblingRoot, rootReal)) {
-    return { ok: false, reason: "sibling root resolves outside expected path" };
-  }
   try {
     worktreeReal = deps.realpath(worktreePath);
   } catch {
     return { ok: false, reason: "worktree path could not be resolved" };
   }
-  if (!isPathUnderDirectory2(worktreeReal, rootReal)) {
-    return { ok: false, reason: "resolved worktree path outside sibling root" };
+  const reasons = [];
+  for (const siblingRoot of siblingRoots) {
+    let rootReal;
+    try {
+      rootReal = deps.realpath(siblingRoot);
+    } catch {
+      reasons.push(`${siblingRoot}: root could not be resolved`);
+      continue;
+    }
+    if (!isPathUnderDirectory2(rootReal, siblingRoot) || !isPathUnderDirectory2(siblingRoot, rootReal)) {
+      reasons.push(`${siblingRoot}: root resolves outside expected path`);
+      continue;
+    }
+    if (isPathUnderDirectory2(worktreeReal, rootReal)) {
+      return { ok: true, path: worktreePath };
+    }
+    reasons.push(`${siblingRoot}: resolved worktree path outside this root`);
   }
-  return { ok: true, path: worktreePath };
+  return { ok: false, reason: reasons.join("; ") || "no worktrees root to check against" };
 }
 function siblingMmiWorktreesRoot(repoRoot2) {
   const parent = (0, import_node_path9.dirname)(repoRoot2);
@@ -7630,6 +7636,9 @@ function siblingMmiWorktreesRoot(repoRoot2) {
   if ((0, import_node_path9.basename)(grandparent).toLowerCase() === "mmi-worktrees") return grandparent;
   return (0, import_node_path9.join)(parent, "mmi-worktrees");
 }
+function agentWorktreesRoot(repoRoot2) {
+  return (0, import_node_path9.join)(repoRoot2, ".claude", "worktrees");
+}
 function worktreeScanDirs(root, repoRoot2, listDirs, isRepoCheckout) {
   const projectsDir = (0, import_node_path9.dirname)(root);
   const ownName = (0, import_node_path9.basename)(repoRoot2).toLowerCase();
@@ -8820,6 +8829,12 @@ var AUTO_UPDATE_TOGGLE_STEPS = "`/plugin` \u2192 Marketplaces tab \u2192 select
 var CATALOG_CONTENT_REF = "main";
 var CATALOG_REF_PIN_STEPS = `add \`"ref": "${CATALOG_CONTENT_REF}"\` to this marketplace's \`source\` in ~/.claude/plugins/known_marketplaces.json, then restart Claude`;
 var PIN_HEAL_COMMAND = "run `mmi-cli doctor`";
+var HOST_RUNNING_REMEDY = "quit Claude Code, then run `mmi-cli doctor`";
+function marketplaceRemedyText(remedy, action, manualSteps) {
+  if (remedy === "manual") return manualSteps;
+  if (remedy === "host-running") return `${HOST_RUNNING_REMEDY} to ${action}`;
+  return `${PIN_HEAL_COMMAND} to ${action}`;
+}
 var ORG_MARKETPLACE_PINS = { autoUpdate: true, ref: CATALOG_CONTENT_REF };
 function resolveCatalogRef(probe) {
   const { name, registered, ref, autoUpdate } = probe;
@@ -8843,7 +8858,7 @@ function resolveCatalogRef(probe) {
     reason: `no ref pinned \u2014 the catalog is served from the repo's default branch while plugin content is pinned to ${CATALOG_CONTENT_REF}`
   };
 }
-function checkMarketplaceAutoUpdate(probe, healable = false) {
+function checkMarketplaceAutoUpdate(probe, remedy = "manual") {
   if (!probe) return null;
   const evidence = [`${probe.name}: auto-update ${probe.effective ? "on" : "off"} \u2014 ${probe.reason}`];
   if (probe.effective) {
@@ -8854,11 +8869,11 @@ function checkMarketplaceAutoUpdate(probe, healable = false) {
     ok: true,
     warn: true,
     label: `marketplace auto-update (${probe.name})`,
-    detail: `off \u2014 this machine will not pick up a new plugin release on its own; ${healable ? `${PIN_HEAL_COMMAND} to turn it on` : `turn it on with ${AUTO_UPDATE_TOGGLE_STEPS}`}`,
+    detail: `off \u2014 this machine will not pick up a new plugin release on its own; ${marketplaceRemedyText(remedy, "turn it on", `turn it on with ${AUTO_UPDATE_TOGGLE_STEPS}`)}`,
     verbose: evidence
   };
 }
-function checkMarketplaceCatalogRef(probe, healable = false) {
+function checkMarketplaceCatalogRef(probe, remedy = "manual") {
   if (!probe) return null;
   const label = `marketplace catalog ref (${probe.name})`;
   const evidence = [`${probe.name}: ${probe.reason}`, `auto-update: ${probe.autoUpdate ? "on" : "off"}`];
@@ -8875,7 +8890,7 @@ function checkMarketplaceCatalogRef(probe, healable = false) {
       // ✗ branch carried it in `fix` only because `renderCheckLine` discarded `detail` on failure — one
       // row, two conventions, decided by which field would actually print.
       detail: `${drift} while auto-update is ON`,
-      fix: `this machine installs plugin releases advertised by a branch nobody released; ${healable ? `${PIN_HEAL_COMMAND} to pin it` : CATALOG_REF_PIN_STEPS}`,
+      fix: `this machine installs plugin releases advertised by a branch nobody released; ${marketplaceRemedyText(remedy, "pin it", CATALOG_REF_PIN_STEPS)}`,
       verbose: evidence
     };
   }
@@ -8884,11 +8899,11 @@ function checkMarketplaceCatalogRef(probe, healable = false) {
     ok: true,
     warn: true,
     label,
-    detail: `${drift} \u2014 harmless while auto-update is off, and the thing to fix before turning it on; ${healable ? `${PIN_HEAL_COMMAND} to pin it` : CATALOG_REF_PIN_STEPS}`,
+    detail: `${drift} \u2014 harmless while auto-update is off, and the thing to fix before turning it on; ${marketplaceRemedyText(remedy, "pin it", CATALOG_REF_PIN_STEPS)}`,
     verbose: evidence
   };
 }
-function marketplaceRows(name, known, settings, healable = false) {
+function marketplaceRows(name, known, settings, remedy = "manual") {
   const { registered, declared, ref } = readKnownMarketplace(known, name);
   const autoUpdate = resolveAutoUpdate({
     name,
@@ -8896,9 +8911,9 @@ function marketplaceRows(name, known, settings, healable = false) {
     declared,
     settingsDeclared: readSettingsAutoUpdate(settings, name)
   });
-  const rows = [checkMarketplaceAutoUpdate(autoUpdate, healable), checkMarketplaceCatalogRef(
+  const rows = [checkMarketplaceAutoUpdate(autoUpdate, remedy), checkMarketplaceCatalogRef(
     resolveCatalogRef({ name, registered, ref, autoUpdate: autoUpdate.effective }),
-    healable
+    remedy
   )];
   return rows.filter((r) => r !== null);
 }
@@ -11210,11 +11225,114 @@ var import_node_path19 = require("node:path");
 
 // src/plugin-guard-io.ts
 var import_node_fs17 = require("node:fs");
-var import_node_child_process6 = require("node:child_process");
+var import_node_child_process7 = require("node:child_process");
 var import_node_path16 = require("node:path");
 var import_node_os5 = require("node:os");
 var import_proper_lockfile = __toESM(require_proper_lockfile(), 1);
 
+// src/npm-self-update.ts
+var import_node_child_process6 = require("node:child_process");
+var import_node_readline = require("node:readline");
+function npmSelfUpdateArgs(spec) {
+  return [
+    "install",
+    "-g",
+    spec,
+    "--no-audit",
+    "--no-fund",
+    "--progress=false",
+    "--loglevel=http",
+    "--prefer-offline"
+  ];
+}
+function packageFromFetchLine(line) {
+  const m = line.match(
+    /GET\s+(?:\d+\s+)?https?:\/\/\S*?\/((?:@[^/\s]+(?:\/|%2[fF]))?[^/\s]+)\/-\/[^/\s]*?-(\d+\.\d+\.\d+[^/\s]*?)\.tgz/u
+  );
+  if (!m) return void 0;
+  return `${m[1].replace(/%2[fF]/u, "/")}@${m[2]}`;
+}
+function narrateNpmLine(line) {
+  const text = line.trim();
+  if (!text) return void 0;
+  if (/^npm\s+warn\s+deprecated\b/iu.test(text)) return void 0;
+  if (/added \d+ packages?|removed \d+ packages?|changed \d+ packages?|up to date/iu.test(text)) return text;
+  const fetched = /\bhttp fetch\b/iu.test(text) ? packageFromFetchLine(text) : void 0;
+  if (fetched) return `downloading ${fetched}`;
+  if (/^npm\s+(warn|error)\b/iu.test(text)) return text;
+  if (/\b(idealTree|resolveWithNewModule|placeDep)\b/u.test(text)) return "resolving dependencies";
+  if (/\bhttp fetch\b/iu.test(text)) return "resolving dependencies";
+  if (/\b(reify|extract|ADDITION|CHANGE)\b/u.test(text)) return "installing packages";
+  if (/\baudit\b/iu.test(text)) return "finishing";
+  return void 0;
+}
+var NPM_LOG_POINTER = /^npm\s+(error|ERR!)\s+A complete log of this run can be found in/iu;
+function npmFailureTail(output, maxLines = 6, maxChars = 500) {
+  const lines = output.split(/\r?\n/u).map((l) => l.trimEnd()).filter((l) => l.trim().length > 0).filter((l) => !NPM_LOG_POINTER.test(l.trim())).filter((l) => !/^npm\s+notice\b/iu.test(l.trim()));
+  const tail = lines.slice(-maxLines).join(" \xB7 ");
+  if (!tail) return output.trim().replace(/\s+/gu, " ").slice(-maxChars) || "npm produced no output";
+  return tail.length > maxChars ? `\u2026${tail.slice(-maxChars)}` : tail;
+}
+async function runNpmStreaming(opts) {
+  const spawnFn = opts.spawnFn ?? import_node_child_process6.spawn;
+  return await new Promise((resolveRun) => {
+    const chunks = [];
+    let settled = false;
+    let child2;
+    const finish = (result) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      resolveRun(result);
+    };
+    const timer = setTimeout(() => {
+      child2?.kill("SIGTERM");
+      chunks.push(`npm install timed out after ${opts.timeoutMs}ms`);
+      finish({ ok: false, code: null, output: chunks.join("\n") });
+    }, opts.timeoutMs);
+    try {
+      child2 = spawnFn(opts.file, [...opts.args], {
+        env: opts.env ?? process.env,
+        stdio: ["ignore", "pipe", "pipe"],
+        shell: false,
+        windowsHide: true
+      });
+    } catch (e) {
+      chunks.push(e instanceof Error ? e.message : String(e));
+      finish({ ok: false, code: null, output: chunks.join("\n") });
+      return;
+    }
+    const onLine = (line) => {
+      chunks.push(line);
+      opts.onLine?.(line);
+    };
+    if (child2.stdout) (0, import_node_readline.createInterface)({ input: child2.stdout }).on("line", onLine);
+    if (child2.stderr) (0, import_node_readline.createInterface)({ input: child2.stderr }).on("line", onLine);
+    child2.on("error", (e) => {
+      chunks.push(e.message);
+      finish({ ok: false, code: null, output: chunks.join("\n") });
+    });
+    child2.on("close", (code) => finish({ ok: code === 0, code, output: chunks.join("\n") }));
+  });
+}
+async function verifyInstalledCli(probe, target) {
+  let stdout;
+  try {
+    stdout = await probe();
+  } catch (e) {
+    const message = e instanceof Error ? e.message : String(e);
+    return { ok: false, detail: `the installed mmi-cli does not run (${message.trim().split(/\r?\n/u)[0]})` };
+  }
+  const version = /(\d+\.\d+\.\d+[^\s]*)/u.exec(stdout.trim())?.[1];
+  if (!version) {
+    return { ok: false, detail: `the installed mmi-cli printed no version (${stdout.trim().slice(0, 80) || "no output"})` };
+  }
+  if (target && version !== target) {
+    return { ok: false, detail: `the installed mmi-cli reports ${version}, not the ${target} that was just installed` };
+  }
+  return { ok: true, detail: `verified: the installed mmi-cli runs ${version}` };
+}
+
 // src/plugin-guard.ts
 function buildPluginGuardDecision(i) {
   if (!i.isOrgRepo) return { state: "not-org" };
@@ -11448,12 +11566,12 @@ function marketplaceClonePresent(surface, home, exists = import_node_fs17.exists
   return marketplaceCloneCandidates(surface, home, env).some(exists);
 }
 function runHostBinSync(bin, args) {
-  return isWin ? (0, import_node_child_process6.execFileSync)("cmd.exe", ["/c", bin, ...args], {
+  return isWin ? (0, import_node_child_process7.execFileSync)("cmd.exe", ["/c", bin, ...args], {
     encoding: "utf8",
     stdio: ["ignore", "pipe", "ignore"],
     timeout: 15e3,
     windowsHide: true
-  }) : (0, import_node_child_process6.execFileSync)(bin, args, {
+  }) : (0, import_node_child_process7.execFileSync)(bin, args, {
     encoding: "utf8",
     stdio: ["ignore", "pipe", "ignore"],
     timeout: 15e3,
@@ -11521,15 +11639,28 @@ async function fetchNpmReleasedVersion() {
   }
 }
 var NPM_INSTALL_TIMEOUT_MS = 12e4;
-async function npmSelfUpdateCli(target, onStep) {
+var CLI_VERSION_PROBE_TIMEOUT_MS = 3e4;
+async function npmSelfUpdateCli(target, onStep, deps = {}) {
   const command = cliUpdateCommand(target);
-  try {
-    onStep?.(command);
-    await runHostBin("npm", ["install", "-g", `@mutmutco/cli@${target ?? "latest"}`], { timeout: NPM_INSTALL_TIMEOUT_MS });
-    return { ok: true, detail: `${command} exited 0` };
-  } catch (e) {
-    return { ok: false, detail: e.message.trim().slice(0, 200).replace(/\s+/g, " ") };
-  }
+  const args = npmSelfUpdateArgs(`@mutmutco/cli@${target ?? "latest"}`);
+  onStep?.(command);
+  let last = "";
+  const result = await (deps.run ?? runNpmStreaming)({
+    file: isWin ? "cmd.exe" : "npm",
+    args: isWin ? ["/c", "npm", ...args] : args,
+    timeoutMs: NPM_INSTALL_TIMEOUT_MS,
+    onLine: (line) => {
+      const message = narrateNpmLine(line);
+      if (!message || message === last) return;
+      last = message;
+      onStep?.(message);
+    }
+  });
+  if (!result.ok) return { ok: false, detail: npmFailureTail(result.output) };
+  const probe = deps.probeVersion ?? (async () => (await runHostBin("mmi-cli", ["--version"], { timeout: CLI_VERSION_PROBE_TIMEOUT_MS })).stdout);
+  const verified = await verifyInstalledCli(probe, target);
+  onStep?.(verified.detail);
+  return verified.ok ? { ok: true, detail: `${command} exited 0 \u2014 ${verified.detail}` } : { ok: false, detail: `${command} exited 0 but ${verified.detail}` };
 }
 function kiloConfigListsPlugin(configRoot, home = (0, import_node_os5.homedir)(), read = (p) => (0, import_node_fs17.readFileSync)(p, "utf8"), exists = import_node_fs17.existsSync) {
   const candidates = ["kilo.json", "kilo.jsonc", "opencode.json", "opencode.jsonc", "config.json"];
@@ -12016,8 +12147,11 @@ function readKnownMarketplacesFile(path2) {
     return void 0;
   }
 }
+function claudeCodeEnvMarkerPresent(env = process.env) {
+  return Boolean(env.CLAUDE_CODE_SESSION_ID?.trim() || env.CLAUDECODE?.trim() || env.CLAUDE_PLUGIN_ROOT?.trim());
+}
 function claudeCodeIsRunning(env = process.env, listProcesses = defaultProcessList) {
-  if (env.CLAUDE_CODE_SESSION_ID?.trim() || env.CLAUDECODE?.trim() || env.CLAUDE_PLUGIN_ROOT?.trim()) return true;
+  if (claudeCodeEnvMarkerPresent(env)) return true;
   let table;
   try {
     table = listProcesses();
@@ -12028,7 +12162,7 @@ function claudeCodeIsRunning(env = process.env, listProcesses = defaultProcessLi
   return table.split(/\r?\n/).some((line) => /(^|[/\\])claude(\.(exe|cmd|ps1))?\s/.test(`${line.trim()} `));
 }
 function defaultProcessList() {
-  return isWin ? (0, import_node_child_process6.execFileSync)("powershell.exe", ["-NoProfile", "-Command", "Get-CimInstance Win32_Process | ForEach-Object { $_.CommandLine }"], { encoding: "utf8", windowsHide: true, maxBuffer: 32 * 1024 * 1024, timeout: 15e3 }) : (0, import_node_child_process6.execFileSync)("ps", ["-eo", "args="], { encoding: "utf8", windowsHide: true, timeout: 15e3 });
+  return isWin ? (0, import_node_child_process7.execFileSync)("powershell.exe", ["-NoProfile", "-Command", "Get-CimInstance Win32_Process | ForEach-Object { $_.CommandLine }"], { encoding: "utf8", windowsHide: true, maxBuffer: 32 * 1024 * 1024, timeout: 15e3 }) : (0, import_node_child_process7.execFileSync)("ps", ["-eo", "args="], { encoding: "utf8", windowsHide: true, timeout: 15e3 });
 }
 function writeMarketplacePinsOnDisk(path2, pins, succeeded, failedVerb, declineWhileHostLive) {
   if (pins.size === 0) return void 0;
@@ -12059,6 +12193,7 @@ function restoreMarketplacePinsOnDisk(path2, pins, hostIsRunning = claudeCodeIsR
 }
 function applyOrgMarketplacePins(path2, names, hostIsRunning = claudeCodeIsRunning) {
   let landed = false;
+  let blockedByHost = false;
   const detail = writeMarketplacePinsOnDisk(
     path2,
     new Map(names.map((name) => [name, ORG_MARKETPLACE_PINS])),
@@ -12067,9 +12202,13 @@ function applyOrgMarketplacePins(path2, names, hostIsRunning = claudeCodeIsRunni
       return `pinned ${[...pins.keys()].join(", ")} to ${ORG_MARKETPLACE_PINS.ref} with auto-update on`;
     },
     "pin",
-    () => hostIsRunning() ? "not pinned \u2014 Claude Code is running and rewrites this registration from its own copy; quit it, then run `mmi-cli doctor`" : void 0
+    () => {
+      if (!hostIsRunning()) return void 0;
+      blockedByHost = true;
+      return "not pinned \u2014 Claude Code is running and rewrites this registration from its own copy; quit it, then run `mmi-cli doctor`";
+    }
   );
-  return detail === void 0 ? void 0 : { detail, wrote: landed };
+  return detail === void 0 ? void 0 : { detail, wrote: landed, blockedByHost };
 }
 function writeMarketplacePinPending(path2, names, now = Date.now()) {
   try {
@@ -12777,7 +12916,8 @@ function workflowEntry(repo, workflowPath, yamlText) {
     executor: "github-actions",
     llm: llmFromHeader(yamlText),
     resolved: "live",
-    source: `${ORG}/${repo}:${workflowPath}`
+    source: `${ORG}/${repo}:${workflowPath}`,
+    harbourUnmanaged: isHarbourUnmanaged(yamlText)
   };
 }
 function awsRuleEntries(payload) {
@@ -12980,12 +13120,13 @@ function cadenceStale(registryCadence, liveCadence) {
   return !liveCrons.every((cron) => registered.has(cron));
 }
 function reconcileGithubActions(liveGithub, registry2, readRepos, activeWorkflowNames = /* @__PURE__ */ new Set(), disabledWorkflowNames = /* @__PURE__ */ new Set()) {
+  const managedLiveGithub = liveGithub.filter((e) => !e.harbourUnmanaged);
   const registryGithub = registry2.filter((r) => r.executor === "github-actions");
-  const liveByName = new Map(liveGithub.map((e) => [e.name, e]));
+  const liveByName = new Map(managedLiveGithub.map((e) => [e.name, e]));
   const registryById = new Map(registryGithub.map((r) => [r.id, r]));
   const drifts = [];
   const parked = [];
-  for (const e of liveGithub) {
+  for (const e of managedLiveGithub) {
     if (!registryById.has(e.name)) {
       drifts.push({
         class: "live-but-unregistered",
@@ -13063,9 +13204,11 @@ function strayCronDrift(name) {
     remedy: "strip on: schedule \u2192 workflow_dispatch and let the harbour dispatcher fire on the registry cadence (docs/schedules.md rule 1)"
   };
 }
-var STRAY_CRON_EXEMPT = /* @__PURE__ */ new Set(["MMI-Hub/schedule-plane-deadman"]);
+function isHarbourUnmanaged(yamlText) {
+  return /^#\s*harbour:\s*unmanaged\s*$/im.test(yamlText);
+}
 function strayCronDrifts(workflows) {
-  return workflows.filter((w) => !STRAY_CRON_EXEMPT.has(w.name)).filter((w) => workflowTriggersSchedule(w.yamlText)).map((w) => strayCronDrift(w.name)).sort((a, b) => a.name.localeCompare(b.name));
+  return workflows.filter((w) => !isHarbourUnmanaged(w.yamlText)).filter((w) => workflowTriggersSchedule(w.yamlText)).map((w) => strayCronDrift(w.name)).sort((a, b) => a.name.localeCompare(b.name));
 }
 function unlauncheredLlmDrift(entry) {
   if (entry.llm !== "yes") return null;
@@ -13180,7 +13323,7 @@ function scheduleRecordFromWorkflow(repo, workflowPath, yamlText) {
   if (!crons.length && !header.schedule) return null;
   const basename6 = workflowPath.split("/").pop() ?? workflowPath;
   const expectedId = `${repo}/${basename6.replace(/\.ya?ml$/, "")}`;
-  if (STRAY_CRON_EXEMPT.has(expectedId)) return null;
+  if (isHarbourUnmanaged(yamlText)) return null;
   const missing = SCHEDULE_HEADER_FIELDS.filter((f) => !header[f]);
   if (missing.length) {
     throw new Error(`schedules register: ${expectedId} (${workflowPath}) is a scheduled workflow but is missing the eight-field entry-template header field(s): ${missing.join(", ")} \u2014 see docs/schedules.md "The entry template".`);
@@ -13545,7 +13688,7 @@ ${lines.join("\n")}`;
 }
 
 // src/secrets.ts
-var import_node_child_process7 = require("node:child_process");
+var import_node_child_process8 = require("node:child_process");
 var import_node_os7 = require("node:os");
 
 // src/gh-create.ts
@@ -14817,7 +14960,7 @@ function spawnExitCode(status, signal) {
 }
 function defaultSpawn(command, args, env) {
   const target = resolveSpawnTarget(command, args);
-  const r = (0, import_node_child_process7.spawnSync)(target.cmd, target.args, {
+  const r = (0, import_node_child_process8.spawnSync)(target.cmd, target.args, {
     windowsHide: true,
     stdio: "inherit",
     env,
@@ -15285,7 +15428,8 @@ async function siblingWorktreeDirs(explicitRoot) {
   const primaryRepoRoot = worktreeGitRoot ? (0, import_node_path18.dirname)((0, import_node_path18.dirname)(worktreeGitRoot)) : repoRoot2;
   try {
     const dirs = explicitRoot ? listDirsIn(resolveExplicitScanRoot(explicitRoot, primaryRepoRoot)) : worktreeScanDirs(siblingMmiWorktreesRoot(primaryRepoRoot), primaryRepoRoot, listDirsIn, isRepoCheckoutDir);
-    return dirs.map((dir) => inspectSiblingWorktreeDir(dir, worktreeGitRoot)).filter((entry) => Boolean(entry));
+    const agentDirs2 = listDirsIn(agentWorktreesRoot(primaryRepoRoot));
+    return [...dirs, ...agentDirs2].map((dir) => inspectSiblingWorktreeDir(dir, worktreeGitRoot)).filter((entry) => Boolean(entry));
   } catch {
     return [];
   }
@@ -15635,10 +15779,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "3.113.0",
-    tag: "v3.113.0",
-    commit: "1d1e521aa96f",
-    npm: "@mutmutco/cli@3.113.0"
+    version: "3.115.0",
+    tag: "v3.115.0",
+    commit: "955ec7ae88f1",
+    npm: "@mutmutco/cli@3.115.0"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -15655,14 +15799,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v3.113.0"
+          v3Target: "v3.115.0"
         }
       ],
       rollbackTrigger: "Any red inside the post-cut soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a v3 client refused while the compat window must still admit it (SUPPORTED_MINOR_WINDOW=2, MIN_CLIENT_VERSION 0.0.0 \u2014 D6a), or npm consumer install/doctor failure on the v4 dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 3.113.0 and redeploy the Hub Lambda from tag v3.113.0 (1d1e521aa96f); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v3.113.0 (@mutmutco/cli@3.113.0, tag commit 1d1e521aa96f \u2014 the preserved latest-v3 distribution, D6b)"
+        mechanism: "npm dist-tag latest -> 3.115.0 and redeploy the Hub Lambda from tag v3.115.0 (955ec7ae88f1); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v3.115.0 (@mutmutco/cli@3.115.0, tag commit 955ec7ae88f1 \u2014 the preserved latest-v3 distribution, D6b)"
       }
     },
     {
@@ -21316,7 +21460,7 @@ async function runPrLand(prNumber, options, deps) {
 var import_node_fs22 = require("node:fs");
 
 // src/stage-runner.ts
-var import_node_child_process8 = require("node:child_process");
+var import_node_child_process9 = require("node:child_process");
 var import_node_fs21 = require("node:fs");
 var import_node_path20 = require("node:path");
 var import_node_net = require("node:net");
@@ -21328,7 +21472,7 @@ function normalizeEol(s) {
 }
 
 // src/stage-runner.ts
-var execFileP3 = (0, import_node_util5.promisify)(import_node_child_process8.execFile);
+var execFileP3 = (0, import_node_util5.promisify)(import_node_child_process9.execFile);
 var DOCKER_TIMEOUT_MS = 15e3;
 var EARLY_EXIT_GRACE_MS = 2e3;
 function earlyExitGraceMs() {
@@ -21850,7 +21994,7 @@ async function startStage(config = {}, opts = {}) {
   let up = sub(config.up.trim());
   if (opts.forceRecreate) up = appendForceRecreate(up);
   const identity = await resolveStageIdentity(cwd);
-  const child2 = (0, import_node_child_process8.spawn)(up, {
+  const child2 = (0, import_node_child_process9.spawn)(up, {
     cwd,
     shell: true,
     // POSIX-only: the process group exists for the group-kill in stopStage. On win32 teardown is
@@ -22054,7 +22198,7 @@ async function executeWaveLand(plan, deps, opts = { preserveWorktree: true }) {
 var import_node_os19 = require("node:os");
 
 // src/board.ts
-var import_node_child_process9 = require("node:child_process");
+var import_node_child_process10 = require("node:child_process");
 var import_node_fs23 = require("node:fs");
 var import_node_os8 = require("node:os");
 var import_node_path21 = require("node:path");
@@ -22399,7 +22543,7 @@ function findDuplicateLesson(source, openLessons) {
 var BOARD_STATUSES = ["Todo", "In Progress", "In Review", "Done"];
 
 // src/board.ts
-var rawExecFileP3 = (0, import_node_util6.promisify)(import_node_child_process9.execFile);
+var rawExecFileP3 = (0, import_node_util6.promisify)(import_node_child_process10.execFile);
 var BOARD_GIT_TIMEOUT_MS = 1e4;
 var WRITE_PROBE_CONCURRENCY = 8;
 var CLAIM_CONCURRENCY = 5;
@@ -25452,10 +25596,10 @@ function healClaudeBinary(host = {}, onStep) {
 }
 
 // src/statusline-invalidate.ts
-var import_node_child_process10 = require("node:child_process");
+var import_node_child_process11 = require("node:child_process");
 function invalidateStatuslineBoardCache() {
   try {
-    const child2 = (0, import_node_child_process10.spawn)("jerv-cli", ["lane", "ops", "invalidate-board"], {
+    const child2 = (0, import_node_child_process11.spawn)("jerv-cli", ["lane", "ops", "invalidate-board"], {
       detached: true,
       stdio: "ignore",
       windowsHide: true
@@ -25674,12 +25818,12 @@ function renderVerifyBroker(input) {
 }
 
 // src/hotfix-coverage.ts
-var import_node_child_process11 = require("node:child_process");
+var import_node_child_process12 = require("node:child_process");
 var CHERRY_TRAILER = /\(cherry picked from commit ([0-9a-f]{7,40})\)/g;
 function checkHotfixCoverage(options = {}) {
   const { cwd = process.cwd(), mainRef = "origin/main", rcRef = "origin/rc", manifestPaths = [] } = options;
   const ack = (options.ack ?? []).filter(Boolean);
-  const git2 = options.git ?? ((args, opts) => (0, import_node_child_process11.execFileSync)("git", args, { cwd, encoding: "utf8", input: opts?.input, stdio: ["pipe", "pipe", "pipe"] }));
+  const git2 = options.git ?? ((args, opts) => (0, import_node_child_process12.execFileSync)("git", args, { cwd, encoding: "utf8", input: opts?.input, stdio: ["pipe", "pipe", "pipe"] }));
   const revList = (range) => {
     const out = git2(["rev-list", "--no-merges", range]).trim();
     return out ? out.split("\n") : [];
@@ -25747,7 +25891,7 @@ function checkHotfixCoverage(options = {}) {
 }
 function checkHotfixCarries(options) {
   const { cwd = process.cwd(), branch, baseRef, targets } = options;
-  const git2 = options.git ?? ((args, opts) => (0, import_node_child_process11.execFileSync)("git", args, { cwd, encoding: "utf8", input: opts?.input, stdio: ["pipe", "pipe", "pipe"] }));
+  const git2 = options.git ?? ((args, opts) => (0, import_node_child_process12.execFileSync)("git", args, { cwd, encoding: "utf8", input: opts?.input, stdio: ["pipe", "pipe", "pipe"] }));
   const isAncestor = (sha, ref) => {
     try {
       git2(["merge-base", "--is-ancestor", sha, ref]);
@@ -26771,7 +26915,7 @@ async function announceRelease(deps, args) {
 
 // src/repo-index.ts
 var import_node_crypto4 = require("node:crypto");
-var import_node_child_process12 = require("node:child_process");
+var import_node_child_process13 = require("node:child_process");
 var import_node_fs27 = require("node:fs");
 var import_node_path25 = require("node:path");
 var REPO_INDEX_SCHEMA = 1;
@@ -26917,7 +27061,7 @@ function loadReadmeHints(cwd, candidatePaths) {
 function toPosix(p) {
   return p.split(import_node_path25.sep).join("/");
 }
-function listCandidatePaths(cwd, exec = import_node_child_process12.execFileSync) {
+function listCandidatePaths(cwd, exec = import_node_child_process13.execFileSync) {
   try {
     const out = exec("git", ["ls-files", "-z", "-c", "-o", "--exclude-standard"], {
       cwd,
@@ -27040,7 +27184,7 @@ function searchRepoIndex(idx, query, limit = 20) {
   }
   return out;
 }
-function inferRepoSlug(cwd, exec = import_node_child_process12.execFileSync) {
+function inferRepoSlug(cwd, exec = import_node_child_process13.execFileSync) {
   try {
     const url = String(exec("git", ["remote", "get-url", "origin"], { cwd, encoding: "utf8" })).trim();
     const m = /[:/]([^/]+\/[^/]+?)(?:\.git)?$/.exec(url);
@@ -27190,7 +27334,7 @@ async function gcRepoIndexCloud(deps) {
 var import_node_fs28 = require("node:fs");
 var import_node_os12 = require("node:os");
 var import_node_path26 = require("node:path");
-var import_node_child_process13 = require("node:child_process");
+var import_node_child_process14 = require("node:child_process");
 var MAX_EMBED_BACKFILL_ROUNDS = 40;
 function normalizeRepo(raw) {
   const t = raw.trim().replace(/\.git$/, "");
@@ -27210,7 +27354,7 @@ function rosterRepos(projects) {
 }
 function shallowClone(repo, dest, token) {
   const basic = Buffer.from(`x-access-token:${token}`, "utf8").toString("base64");
-  (0, import_node_child_process13.execFileSync)(
+  (0, import_node_child_process14.execFileSync)(
     "git",
     ["-c", `http.extraHeader=Authorization: Basic ${basic}`, "clone", "--depth", "1", "--single-branch", `https://github.com/${repo}.git`, dest],
     { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], windowsHide: true }
@@ -27479,7 +27623,7 @@ async function runRepoIndexHealth(opts) {
 }
 
 // src/spawn-policy-core.ts
-var import_node_child_process14 = require("node:child_process");
+var import_node_child_process15 = require("node:child_process");
 var import_node_fs30 = require("node:fs");
 var import_node_path27 = require("node:path");
 var SPAWNERS = ["spawn", "spawnSync", "exec", "execSync", "execFile", "execFileSync"];
@@ -27550,7 +27694,7 @@ function findViolationsInSource(raw) {
   return found;
 }
 function policedFiles(root) {
-  const r = (0, import_node_child_process14.spawnSync)("git", ["ls-files", "-z", "--cached", "--others", "--exclude-standard"], {
+  const r = (0, import_node_child_process15.spawnSync)("git", ["ls-files", "-z", "--cached", "--others", "--exclude-standard"], {
     cwd: root,
     encoding: "utf8",
     windowsHide: true,
@@ -27584,7 +27728,7 @@ function runSpawnPolicy(root) {
 }
 
 // src/test-policy-core.ts
-var import_node_child_process15 = require("node:child_process");
+var import_node_child_process16 = require("node:child_process");
 var import_node_fs31 = require("node:fs");
 var import_node_path28 = require("node:path");
 var POLICY_FILE = "test-policy.json";
@@ -27714,14 +27858,14 @@ function evaluate(changed, policy, present = () => false) {
   return findings;
 }
 function git(args, cwd) {
-  return (0, import_node_child_process15.execFileSync)("git", args, { windowsHide: true, cwd, encoding: "utf8", maxBuffer: 32 * 1024 * 1024 });
+  return (0, import_node_child_process16.execFileSync)("git", args, { windowsHide: true, cwd, encoding: "utf8", maxBuffer: 32 * 1024 * 1024 });
 }
 var COAUTHOR_KEY = "Co-authored-by";
 var GH_MESSAGE_SEPARATOR = /^-{5,}$/;
 var LIFTED_KEYS = new RegExp(`^(?:${TRAILER_KEY}|${COAUTHOR_KEY}):`, "i");
 function parseTrailers(message, cwd) {
   try {
-    return (0, import_node_child_process15.execFileSync)("git", ["interpret-trailers", "--parse", "--unfold"], {
+    return (0, import_node_child_process16.execFileSync)("git", ["interpret-trailers", "--parse", "--unfold"], {
       windowsHide: true,
       cwd,
       input: message,
@@ -29522,9 +29666,9 @@ ${SSH_RECIPE_AGENT_NOTE}`);
 
 // src/schedules-commands.ts
 var import_promises5 = require("node:fs/promises");
-var import_node_child_process16 = require("node:child_process");
+var import_node_child_process17 = require("node:child_process");
 var import_node_util7 = require("node:util");
-var execFileP5 = (0, import_node_util7.promisify)(import_node_child_process16.execFile);
+var execFileP5 = (0, import_node_util7.promisify)(import_node_child_process17.execFile);
 var AWS_REGION = "eu-central-1";
 var AWS_TIMEOUT_MS = 3e4;
 var AWS_RETRY_DELAY_MS = 1500;
@@ -32403,7 +32547,7 @@ var import_node_fs38 = require("node:fs");
 var import_promises8 = require("node:fs/promises");
 var import_node_path36 = require("node:path");
 var import_node_os15 = require("node:os");
-var import_node_child_process17 = require("node:child_process");
+var import_node_child_process18 = require("node:child_process");
 
 // src/board-advance.ts
 function repoOf2(ref) {
@@ -32802,12 +32946,15 @@ async function applyGcPlan(plan, remote, opts = {}) {
   result.removedTrackingRefs.push(...branchTracking.removedTrackingRefs);
   result.failed.push(...branchTracking.failed);
   const removeDeps = worktreeRemoveDeps(async (args) => (await execFileP2("git", args, { timeout: GIT_TIMEOUT_MS })).stdout);
-  const siblingRoot = opts.root ? resolveExplicitScanRoot(opts.root, primaryRepoRoot) : siblingMmiWorktreesRoot(primaryRepoRoot);
+  const cleanupRoots = [
+    opts.root ? resolveExplicitScanRoot(opts.root, primaryRepoRoot) : siblingMmiWorktreesRoot(primaryRepoRoot),
+    agentWorktreesRoot(primaryRepoRoot)
+  ];
   for (const wt of worktreeDirsToRemove) {
     const owner = findWorktreeOwner(owners, wt.path);
     let removalAttempted = false;
     try {
-      const cleanupTarget = resolveSafeSiblingWorktreeCleanupTarget(wt.path, siblingRoot, {
+      const cleanupTarget = resolveSafeSiblingWorktreeCleanupTarget(wt.path, cleanupRoots, {
         realpath: (path2) => (0, import_node_fs38.realpathSync)(path2)
       });
       if (!cleanupTarget.ok) {
@@ -33009,7 +33156,7 @@ async function remoteBranchExists2(branch, options = {}) {
 }
 var COMPOSE_TIMEOUT_MS = 12e4;
 function spawnDeferredGcSweep() {
-  spawnDetachedSelf(["worktree", "gc", "sweep-deferred", "--quiet"], { spawn: import_node_child_process17.spawn, execPath: process.execPath, scriptPath: process.argv[1] });
+  spawnDetachedSelf(["worktree", "gc", "sweep-deferred", "--quiet"], { spawn: import_node_child_process18.spawn, execPath: process.execPath, scriptPath: process.argv[1] });
 }
 async function createDeferredWorktreeStore() {
   try {
@@ -36689,7 +36836,8 @@ var RESTART_LINE = "\u21BB Restart Claude to finish.";
 var VERBOSE_INDENT = "    ";
 function checkGlyph(check) {
   if (!check.ok) return "\u2717";
-  return check.verified === false ? "?" : "\u2713";
+  if (check.verified === false) return "?";
+  return check.warn ? "\u26A0" : "\u2713";
 }
 function renderCheckLine(check) {
   const head = check.detail ? `${checkGlyph(check)} ${check.label} \u2014 ${check.detail}` : `${checkGlyph(check)} ${check.label}`;
@@ -36707,9 +36855,11 @@ function renderTally(checks) {
   const total = checks.length;
   const failed = checks.filter((c) => !c.ok).length;
   const unverified = checks.filter((c) => c.ok && c.verified === false).length;
-  const healthy = total - failed - unverified;
-  if (failed === 0 && unverified === 0) return `\u2713 all ${total} checks healthy`;
+  const warned = checks.filter((c) => c.ok && c.verified !== false && c.warn).length;
+  const healthy = total - failed - unverified - warned;
+  if (failed === 0 && unverified === 0 && warned === 0) return `\u2713 all ${total} checks healthy`;
   const parts = [`\u2713 ${healthy} verified healthy`];
+  if (warned > 0) parts.push(`\u26A0 ${warned} warn`);
   if (unverified > 0) parts.push(`? ${unverified} unverified`);
   if (failed > 0) parts.push(`\u2717 ${failed} failed`);
   return `${parts.join(" \xB7 ")} \u2014 ${total} checks`;
@@ -38359,18 +38509,19 @@ async function runDoctorClean(opts, io, deps) {
     if (payload) emitNow(payload);
   }
   async function runMarketplaceRows() {
+    let healed;
     if (applyEnv) {
-      const healed = deps.healMarketplacePins();
-      if (healed) {
+      healed = deps.healMarketplacePins();
+      if (healed?.wrote) {
         healIntent(`marketplace pins \u2014 ${healed.detail}`);
-        if (healed.wrote) {
-          traceHeal("env-heals");
-          markHealChanged();
-          restartPending = true;
-        }
+        traceHeal("env-heals");
+        markHealChanged();
+        restartPending = true;
       }
     }
-    for (const row of deps.marketplaceRows()) emitNow(row);
+    for (const row of deps.marketplaceRows(healed?.blockedByHost)) {
+      emitNow(healed && !healed.wrote ? { ...row, verbose: [...row.verbose ?? [], `heal: ${healed.detail}`] } : row);
+    }
   }
   async function runTrainSyncRow() {
     try {
@@ -38903,9 +39054,9 @@ function ghAccountCaveat(announcedLogin, accounts) {
 var import_node_fs45 = require("node:fs");
 var import_node_os18 = require("node:os");
 var import_node_path42 = require("node:path");
-var import_node_child_process18 = require("node:child_process");
+var import_node_child_process19 = require("node:child_process");
 var import_node_util8 = require("node:util");
-var execFileP6 = (0, import_node_util8.promisify)(import_node_child_process18.execFile);
+var execFileP6 = (0, import_node_util8.promisify)(import_node_child_process19.execFile);
 var MMI_PLUGIN_ID2 = "mmi@mutmutco";
 function installedClaudePluginVersion() {
   try {
@@ -38951,12 +39102,12 @@ function installedSurfacePluginVersion(surface) {
   if (token === "claude") return installedClaudePluginVersion();
   if (token !== "codex") return void 0;
   try {
-    const raw = process.platform === "win32" ? (0, import_node_child_process18.execFileSync)("cmd.exe", ["/c", "codex", "plugin", "list", "--json"], {
+    const raw = process.platform === "win32" ? (0, import_node_child_process19.execFileSync)("cmd.exe", ["/c", "codex", "plugin", "list", "--json"], {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "ignore"],
       timeout: 15e3,
       windowsHide: true
-    }) : (0, import_node_child_process18.execFileSync)("codex", ["plugin", "list", "--json"], {
+    }) : (0, import_node_child_process19.execFileSync)("codex", ["plugin", "list", "--json"], {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "ignore"],
       timeout: 15e3,
@@ -38974,7 +39125,7 @@ function installedActivePluginVersion(surface = detectSurface(process.env)) {
 }
 function worktreeRootSync() {
   try {
-    const out = (0, import_node_child_process18.execFileSync)("git", ["rev-parse", "--show-toplevel"], { windowsHide: true, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
+    const out = (0, import_node_child_process19.execFileSync)("git", ["rev-parse", "--show-toplevel"], { windowsHide: true, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
     let root = out.endsWith("\n") ? out.slice(0, -1) : out;
     if (process.platform === "win32" && root.endsWith("\r")) root = root.slice(0, -1);
     return root || null;
@@ -39057,9 +39208,9 @@ async function withEnvHealLock(what, run) {
     );
   } catch (e) {
     if (e instanceof FileLockBusyError) {
-      return { ok: false, skipped: true, detail: `${what} skipped ? ${e.message}` };
+      return { ok: false, skipped: true, detail: `${what} skipped \u2014 ${e.message}` };
     }
-    return { ok: false, detail: `${what} could not take the env-heal lock ? ${e.message}` };
+    return { ok: false, detail: `${what} could not take the env-heal lock \u2014 ${e.message}` };
   }
 }
 function throttledReleasedVersion() {
@@ -39115,13 +39266,13 @@ function mmiDoctorDeps(opts = {}) {
     pluginTrustState: () => codexHookTrustState(),
     releasedVersion: throttled ? throttled.read : fetchNpmReleasedVersion,
     releasedVersionNote: throttled ? throttled.note : void 0,
-    // #3272: the --apply self-heal for a stale running CLI ? npm global, shadows any plugin shim (#2879).
+    // #3272: the --apply self-heal for a stale running CLI — npm global, shadows any plugin shim (#2879).
     // #3489: serialised. Both heals mutate machine-global state (the npm global prefix; the Claude
     // marketplace clone + plugin cache) and neither is idempotent under concurrency. They share ONE lock
     // rather than one each, because they are not independent: the plugin heal reinstalls a bundle that
     // carries a CLI shim, so a concurrent npm global install races the same PATH surface.
     updateCli: (target, onStep) => withEnvHealLock("npm global CLI self-update", () => npmSelfUpdateCli(target, onStep)),
-    // #3282: the --apply self-heal for a stale/unresolved Claude plugin ? the same marketplace reinstall
+    // #3282: the --apply self-heal for a stale/unresolved Claude plugin — the same marketplace reinstall
     // `mmi-cli plugin heal` drives. Takes effect on the next Claude reload, so the row asks for a restart.
     healPlugin: (onStep) => {
       const surface = detectSurface(process.env);
@@ -39139,7 +39290,7 @@ function mmiDoctorDeps(opts = {}) {
     // #2759: same fetch+ff-only sync SessionStart runs, wired here too so an on-demand `mmi-cli doctor`
     // self-heals a checkout a long-running session left stale.
     syncTrain: () => syncLocalTrainBranches(execFileGitRun),
-    // #2903: doctor DETECTS stale cached plugin versions and defers the delete to `plugin-prune` ? it never
+    // #2903: doctor DETECTS stale cached plugin versions and defers the delete to `plugin-prune` — it never
     // writes to the harness-owned cache itself. Same plan builder the verb uses, so the two never disagree.
     // No `withBytes` here: doctor runs on EVERY SessionStart, and sizing means recursively stat'ing every
     // stale version tree. The count comes from one cheap readdir; `plugin-prune` reports the MB.
@@ -39223,11 +39374,11 @@ function mmiDoctorDeps(opts = {}) {
     // binary is exactly the half-applied state being repaired.
     healClaudeBinary: (onStep) => withEnvHealLock("claude binary restore", async () => healClaudeBinary({}, onStep)),
     // #3470: what the SessionStart hook LAST emitted, measured at emission by the session-start verb below.
-    // A local record read ? cheap enough for every lane, including the banner.
+    // A local record read — cheap enough for every lane, including the banner.
     sessionPayload: () => readSessionPayload(process.cwd()),
-    // #3485 items 9 and 8: why the MMI plugin has never printed an "updated ? please restart" notice, and
+    // #3485 items 9 and 8: why the MMI plugin has never printed an "updated — please restart" notice, and
     // which branch it would pick one up from. Two local file reads, no network, fail-soft to no rows.
-    marketplaceRows: () => {
+    marketplaceRows: (hostBlocked) => {
       try {
         if (detectSurface(process.env) === "codex") return [];
         const home = (0, import_node_os19.homedir)();
@@ -39236,8 +39387,14 @@ function mmiDoctorDeps(opts = {}) {
           readFileSyncSafe((0, import_node_path43.join)(home, ...KNOWN_MARKETPLACES_RELATIVE), import_node_fs46.readFileSync),
           readFileSyncSafe((0, import_node_path43.join)(home, ".claude", "settings.json"), import_node_fs46.readFileSync),
           // #3974: this CLI heals these rows, so report mode names the doctor run rather than the hand
-          // edit. Unconditional ? it is a fact about mmi-cli, not about the lane this run is on.
-          true
+          // edit. #4792 narrows WHICH run: `applyOrgMarketplacePins` declines outright while Claude Code
+          // is up, because the host owns this file and rewrites it from its own copy (#4083). Naming the
+          // doctor there is the circular-and-false remedy the issue was filed on — doctor ran twice and
+          // healed neither row. So the live host, when there is one, is what the rows name first.
+          // The heal lane pays for the full process probe and hands its answer down; every other lane
+          // reads the free env markers, which are set precisely when doctor runs inside a Claude session
+          // — the case the owner hit. A cheap lane never shells a process listing for this.
+          hostBlocked ?? claudeCodeEnvMarkerPresent() ? "host-running" : "doctor"
         );
         const pending = readMarketplacePinPending(
           (0, import_node_path43.join)(home, ".claude", "plugins", ".mmi-marketplace-pin-pending.json"),
@@ -39251,7 +39408,7 @@ function mmiDoctorDeps(opts = {}) {
             ...rest,
             ok: true,
             warn: true,
-            detail: `pending restart ? doctor pinned main at ${pending.at}; restart Claude Code to load it`,
+            detail: `pending restart \u2014 doctor pinned main at ${pending.at}; restart Claude Code to load it`,
             verbose: [...row.verbose ?? [], "known_marketplaces.json was rewritten by the running Claude host after the verified doctor write"]
           };
         });
@@ -39276,13 +39433,13 @@ function mmiDoctorDeps(opts = {}) {
       }
     },
     // #4091: the same `docs index --check` comparison the required CI gate runs, in-process. Rooted at the
-    // repo root doctor already resolved ? never `process.cwd()`, which would have `mmi-cli doctor` run from
+    // repo root doctor already resolved — never `process.cwd()`, which would have `mmi-cli doctor` run from
     // `cli/` measure a `cli/docs/` tree that does not exist.
     //
     // `existsSync` on `docs/index.md` is the adoption gate, and it sits UNDER the table's org-repo gate
     // rather than replacing it: a missing index is drift by construction, so without this a repo that never
     // adopted the generated routing index (MMG-Unlive: `docs/Archive/**` only, no index, no gate.yml) would
-    // get a permanent ? demanding an artifact it never asked for.
+    // get a permanent — demanding an artifact it never asked for.
     docsIndexState: (root) => {
       if (!(0, import_node_fs46.existsSync)((0, import_node_path43.join)(root, DOCS_INDEX_PATH))) return void 0;
       const real = createDocsIndexDeps(root);
@@ -39370,7 +39527,7 @@ function mmiDoctorDeps(opts = {}) {
       const names = new Set((opts.program?.commands ?? []).map((c) => c.name()));
       return required.filter((n) => !names.has(n));
     },
-    // #4156: short-timeout Hub status for the current repo. Fail-soft ? never throws to doctor.
+    // #4156: short-timeout Hub status for the current repo. Fail-soft — never throws to doctor.
     repoIndexCloudState: async (root) => {
       const local = repoIndexStatus(root);
       try {
@@ -39430,7 +39587,7 @@ async function requireFreshTrainCli(commandName) {
   const releasedVersion = await fetchNpmReleasedVersion();
   if (!releasedVersion) {
     throw new Error(
-      `${commandName}: the train staleness gate could not read the released CLI version (\`npm view @mutmutco/cli version\` returned nothing ? registry unreachable, npm missing, or output unparseable). That is a FAILED read, not "the running CLI is fresh", so this train command refuses rather than running unproven. This gate runs before any train mutation, so this invocation changed nothing. Retry once the registry answers, or set MMI_TRAIN_FRESH_OVERRIDE=1 to run this command with the staleness check deliberately skipped.`
+      `${commandName}: the train staleness gate could not read the released CLI version (\`npm view @mutmutco/cli version\` returned nothing \u2014 registry unreachable, npm missing, or output unparseable). That is a FAILED read, not "the running CLI is fresh", so this train command refuses rather than running unproven. This gate runs before any train mutation, so this invocation changed nothing. Retry once the registry answers, or set MMI_TRAIN_FRESH_OVERRIDE=1 to run this command with the staleness check deliberately skipped.`
     );
   }
   const report = buildVersionLagReport({
@@ -39475,7 +39632,7 @@ function argvWantsJson2() {
 var unknownFlagJsonHandled = false;
 var PARSE_HINT_SENTINEL = "@@mmi-parse-hint@@";
 var DISCOVERY_HINT = "run `mmi-cli commands` for the agentic-coding map, `mmi-cli explain <command>` for detail, or `mmi-cli commands --json --primary` for machine discovery";
-var STALE_HINT = `(${DISCOVERY_HINT}). If you expected this command to exist, your installed mmi-cli may be stale ? update it (see: mmi-cli doctor)`;
+var STALE_HINT = `(${DISCOVERY_HINT}). If you expected this command to exist, your installed mmi-cli may be stale \u2014 update it (see: mmi-cli doctor)`;
 var lastParseErrorKind = "other";
 var lastUnknownCommand;
 function classifyParseError(plain) {
@@ -39541,7 +39698,7 @@ function resolveParseHint() {
   const path2 = commandPath2(cmd);
   return [
     `Usage: mmi-cli ${path2} ${cmd.usage()}`,
-    "This command exists and your mmi-cli is not the problem ? the ARGUMENTS did not parse.",
+    "This command exists and your mmi-cli is not the problem \u2014 the ARGUMENTS did not parse.",
     `Run \`mmi-cli ${path2} --help\` for its signature, \`mmi-cli explain ${path2}\` for detail, or \`mmi-cli commands\` for the full map.`
   ].join("\n");
 }
@@ -39578,7 +39735,7 @@ function envelopeAwareWriteErr(str) {
     const positional = TARGET_SELECTOR_FLAGS.has(flag) ? positionalTargetForm(invoked, { flag, argv }) : void 0;
     if (argvWantsJson2()) {
       const suggestion = positional ? void 0 : didYouMean(flag, commandOwnLongFlags(invoked));
-      const corrected = suggestion ? `mmi-cli ${argv.map((a) => a === flag ? suggestion : a).join(" ")}` : void 0;
+      const corrected = suggestion ? `mmi-cli ${canonicalArgvFor(argv.map((a) => a === flag ? suggestion : a)).join(" ")}` : void 0;
       const message = positional ? unknownTargetFlagMessage(flag, positional) : `unknown option '${flag}'`;
       process.stderr.write(
         formatErrorEnvelope(message, {
@@ -39602,7 +39759,7 @@ function envelopeAwareWriteErr(str) {
   process.stderr.write(str);
 }
 var program2 = new Command();
-program2.name("mmi-cli").description("MMI Future Hub CLI ? the org control plane for agentic coding.").version(resolveClientVersion()).configureOutput({ writeErr: envelopeAwareWriteErr }).showHelpAfterError(PARSE_HINT_SENTINEL);
+program2.name("mmi-cli").description("MMI Future Hub CLI \u2014 the org control plane for agentic coding.").version(resolveClientVersion()).configureOutput({ writeErr: envelopeAwareWriteErr }).showHelpAfterError(PARSE_HINT_SENTINEL);
 program2.addHelpText(
   "before",
   `Houses (canonical roots): oracle \xB7 harbour \xB7 devops \xB7 vault \xB7 learning
@@ -39663,7 +39820,7 @@ rules.command("gitignore").option("--write", "upsert the managed block into .git
     return;
   }
   if (plan.changed) {
-    console.error(`mmi-cli devops org rules gitignore: managed block drift (${drift}) ? run \`mmi-cli devops org rules gitignore --write\` and commit`);
+    console.error(`mmi-cli devops org rules gitignore: managed block drift (${drift}) \u2014 run \`mmi-cli devops org rules gitignore --write\` and commit`);
     process.exitCode = 1;
   } else {
     console.log("mmi-cli devops org rules gitignore: up to date");
@@ -39769,7 +39926,7 @@ wave.command("land").description("serial merge open PRs to development with reba
 });
 var gcCmd = program2.command("gc").description("dry-run cleanup for merged/closed PR local+remote branches, linked worktrees, stale tracking refs, and worktree metadata (--scratch: safe local scratch + confirmed-synced plans)");
 var DEFERRED_SWEEP_HARD_TIMEOUT_MS = 12e4;
-gcCmd.command("sweep-deferred").description("retry IDE-locked deferred worktree removals with backoff (#1932) ? SessionStart + pr land spawn this detached").option("--quiet", "silent when registry empty or all cleared").option("--json", "machine-readable output").action(async (o) => {
+gcCmd.command("sweep-deferred").description("retry IDE-locked deferred worktree removals with backoff (#1932) \u2014 SessionStart + pr land spawn this detached").option("--quiet", "silent when registry empty or all cleared").option("--json", "machine-readable output").action(async (o) => {
   await runWithSweepWatchdog(async () => {
     try {
       const deferredStore = await createDeferredWorktreeStore();
@@ -39777,7 +39934,7 @@ gcCmd.command("sweep-deferred").description("retry IDE-locked deferred worktree
       const result = await sweepDeferredWorktreesWithRetry(
         deferredStore,
         // #2841: `-c core.fsmonitor=false` stops a git fsmonitor daemon from inheriting this detached
-        // worker's stdio pipe (the likely Windows hang ? execFile then never sees EOF and never resolves).
+        // worker's stdio pipe (the likely Windows hang — execFile then never sees EOF and never resolves).
         worktreeRemoveDeps(async (args) => (await execFileP2("git", ["-c", "core.fsmonitor=false", ...args], { timeout: GIT_TIMEOUT_MS })).stdout),
         { removalContext }
       );
@@ -39793,11 +39950,11 @@ gcCmd.command("sweep-deferred").description("retry IDE-locked deferred worktree
       fail(`worktree gc sweep-deferred: ${e.message}`);
     }
   }, DEFERRED_SWEEP_HARD_TIMEOUT_MS, () => {
-    console.error("worktree gc sweep-deferred: exceeded hard timeout ? exiting so the detached worker cannot leak (#2841)");
+    console.error("worktree gc sweep-deferred: exceeded hard timeout \u2014 exiting so the detached worker cannot leak (#2841)");
     process.exit(process.exitCode ?? 0);
   });
 });
-gcCmd.option("--dry-run", "show what would be deleted (default)").option("--apply", "delete only the listed clean merged/closed PR local+remote branches, linked worktrees, and stale tracking refs").option("--json", "machine-readable output").option("--scratch", "prune safe local scratch (#1864) instead of git branches/refs; local plans are surfaced advisory-only, never auto-pruned").option("--remote <name>", "remote name", "origin").option("--limit <n>", "PRs to read PER BRANCH ? an effort bound, not a correctness one: merge state is resolved per branch, so no branch is ever skipped for being old (#4227)", "200").option("--force", "remove worktrees even when the ownership registry shows another session created or worked in them recently (#3580), or when a dead worktree directory still holds leftover files (#4779)").option("--root <path>", "sweep an explicitly named worktrees root instead of the authoritative ../mmi-worktrees (#3471) ? descends into this repo container when present; ownership, dead-dir, and content guards still apply").action(async (o) => {
+gcCmd.option("--dry-run", "show what would be deleted (default)").option("--apply", "delete only the listed clean merged/closed PR local+remote branches, linked worktrees, and stale tracking refs").option("--json", "machine-readable output").option("--scratch", "prune safe local scratch (#1864) instead of git branches/refs; local plans are surfaced advisory-only, never auto-pruned").option("--remote <name>", "remote name", "origin").option("--limit <n>", "PRs to read PER BRANCH \u2014 an effort bound, not a correctness one: merge state is resolved per branch, so no branch is ever skipped for being old (#4227)", "200").option("--force", "remove worktrees even when the ownership registry shows another session created or worked in them recently (#3580), or when a dead worktree directory still holds leftover files (#4779)").option("--root <path>", "sweep an explicitly named worktrees root instead of the authoritative ../mmi-worktrees (#3471) \u2014 descends into this repo container when present; ownership, dead-dir, and content guards still apply").action(async (o) => {
   if (o.apply && o.dryRun) return fail("worktree gc: choose either --dry-run or --apply");
   if (o.scratch) {
     try {
@@ -39818,7 +39975,7 @@ gcCmd.option("--dry-run", "show what would be deleted (default)").option("--appl
     if (!(0, import_node_fs46.existsSync)(root) || !(0, import_node_fs46.statSync)(root).isDirectory()) return fail(`worktree gc: --root ${o.root} is not a directory`);
     const gcRepoRoot = (await execFileP2("git", ["rev-parse", "--show-toplevel"], { timeout: GIT_TIMEOUT_MS }).catch(() => ({ stdout: "" }))).stdout.trim() || process.cwd();
     if (isPathUnderDirectory2(gcRepoRoot, root)) {
-      return fail(`worktree gc: --root ${root} contains this checkout ? name a worktrees root, not the repo or an ancestor of it`);
+      return fail(`worktree gc: --root ${root} contains this checkout \u2014 name a worktrees root, not the repo or an ancestor of it`);
     }
   }
   try {
@@ -39832,7 +39989,7 @@ gcCmd.option("--dry-run", "show what would be deleted (default)").option("--appl
       const removalContext = await currentWorktreeRemovalContext("worktree gc", o.force);
       const sweepResult = await sweepDeferredWorktrees(
         deferredStore,
-        // #2841: same `-c core.fsmonitor=false` guard as the detached `gc sweep-deferred` worker ? keep a
+        // #2841: same `-c core.fsmonitor=false` guard as the detached `gc sweep-deferred` worker — keep a
         // git fsmonitor daemon from inheriting this sweep's stdio pipe and wedging the git call on Windows.
         worktreeRemoveDeps(async (args) => (await execFileP2("git", ["-c", "core.fsmonitor=false", ...args], { timeout: GIT_TIMEOUT_MS })).stdout),
         removalContext
@@ -39864,11 +40021,11 @@ function runWorktreeInstall(command, cwd, quiet, opts) {
     "pipe"
   ];
   return new Promise((resolve5, reject) => {
-    const child2 = opts?.shell ? (0, import_node_child_process19.spawn)(command, { cwd, stdio, windowsHide: true, shell: true }) : (() => {
+    const child2 = opts?.shell ? (0, import_node_child_process20.spawn)(command, { cwd, stdio, windowsHide: true, shell: true }) : (() => {
       const [bin, ...args] = command.split(" ");
       const file = isWin2 ? "cmd.exe" : bin;
       const spawnArgs = isWin2 ? ["/c", bin, ...args] : args;
-      return (0, import_node_child_process19.spawn)(file, spawnArgs, { cwd, stdio, windowsHide: true });
+      return (0, import_node_child_process20.spawn)(file, spawnArgs, { cwd, stdio, windowsHide: true });
     })();
     let stderrTail = "";
     child2.stderr?.on("data", (chunk) => {
@@ -39919,7 +40076,7 @@ async function unprovenWorktreeReason(wtPath, repoRoot2) {
     return `'git worktree list' could not be read from ${repoRoot2}, so ${wtPath} could not be proven registered`;
   }
   if (!registered.some((w) => samePath(w.path, wtPath))) {
-    return `${wtPath} exists on disk but 'git worktree list' does not name it ? its git metadata is gone, so it is not a usable worktree`;
+    return `${wtPath} exists on disk but 'git worktree list' does not name it \u2014 its git metadata is gone, so it is not a usable worktree`;
   }
   return void 0;
 }
@@ -39969,15 +40126,15 @@ function acquireWorktreeSetupLock(worktreeRoot) {
     return null;
   }
 }
-var worktree = program2.command("worktree").description("self-provisioning worktrees ? install deps + copy local-only config");
+var worktree = program2.command("worktree").description("self-provisioning worktrees \u2014 install deps + copy local-only config");
 withExamples(mutating(
-  worktree.command("create <branch-or-issue>").description("create a worktree from a base ref and provision it (install deps + copy local-only config); an issue ref derives the <issue>-<slug> branch, and --claim claims its board item (#2996, formerly worktree new)").option("--from <ref>", "base ref to branch from", "origin/development").option("--base <ref>", "alias of --from (git's own word for the base ref)").option("--path <path>", "worktree path (default: ../mmi-worktrees/<RepoName>/<branch> ? authoritative; the <RepoName> segment is what makes ownership provable from the path, #3471. gc/list read this root in BOTH the nested and the legacy flat shape)").option("--remote <name>", "remote to fetch when --from is a <remote>/<branch> ref", "origin").option("--slug <slug>", "issue-ref form: override the slug derived from the issue title").option("--claim", "issue-ref form: claim the issue's board item after provisioning").option("--for <login>", "with --claim: assign the board item to this login instead of @me"),
+  worktree.command("create <branch-or-issue>").description("create a worktree from a base ref and provision it (install deps + copy local-only config); an issue ref derives the <issue>-<slug> branch, and --claim claims its board item (#2996, formerly worktree new)").option("--from <ref>", "base ref to branch from", "origin/development").option("--base <ref>", "alias of --from (git's own word for the base ref)").option("--path <path>", "worktree path (default: ../mmi-worktrees/<RepoName>/<branch> \u2014 authoritative; the <RepoName> segment is what makes ownership provable from the path, #3471. gc/list read this root in BOTH the nested and the legacy flat shape)").option("--remote <name>", "remote to fetch when --from is a <remote>/<branch> ref", "origin").option("--slug <slug>", "issue-ref form: override the slug derived from the issue title").option("--claim", "issue-ref form: claim the issue's board item after provisioning").option("--for <login>", "with --claim: assign the board item to this login instead of @me"),
   worktreeCreatePlan
 ).action(async (target, o, cmd) => {
   let step = "resolve the branch name";
   try {
     if (o.base !== void 0 && cmd.getOptionValueSource("from") === "cli" && o.base !== o.from) {
-      return fail(`worktree create: --from and --base are the same option (--base is an alias); got --from ${o.from} and --base ${o.base} ? pass one`);
+      return fail(`worktree create: --from and --base are the same option (--base is an alias); got --from ${o.from} and --base ${o.base} \u2014 pass one`);
     }
     const fromRef = o.base ?? o.from;
     const issueForm = isIssueRef(target);
@@ -39995,7 +40152,7 @@ withExamples(mutating(
       const slug = o.slug ?? await fetchIssueTitle(selector.repo, selector.number).then((t) => t ? slugifyIssueTitle(t) : "");
       branch = buildNewBranchName(selector.number, slug ?? "");
       if (PROTECTED_BRANCHES2.has(branch)) {
-        return fail(`worktree create: generated branch name '${branch}' collides with a protected train branch ? pass a branch name instead`);
+        return fail(`worktree create: generated branch name '${branch}' collides with a protected train branch \u2014 pass a branch name instead`);
       }
     } else if (o.claim || o.for) {
       return fail("worktree create: --claim/--for need an issue-ref argument (e.g. worktree create 2687 --claim)");
@@ -40035,7 +40192,7 @@ withExamples(mutating(
         return fail(`worktree create: ${wtPath} is already registered for '${exact.branch ?? "detached HEAD"}', not '${branch}'`);
       }
       const status = (await execFileP2("git", ["-C", wtPath, "status", "--porcelain"], { timeout: GIT_TIMEOUT_MS })).stdout.trim();
-      if (status) return fail(`worktree create: refusing to resume ${wtPath} ? it has uncommitted changes`);
+      if (status) return fail(`worktree create: refusing to resume ${wtPath} \u2014 it has uncommitted changes`);
       const head = await revParseRef(`refs/heads/${branch}`);
       const baseOid = await revParseRef(base);
       if (!head || !baseOid) return fail(`worktree create: could not prove '${branch}' and '${base}' before resume`);
@@ -40046,7 +40203,7 @@ withExamples(mutating(
         // io-census-allow: an unprovable ancestor probe conservatively refuses the resume below rather than fast-forwarding onto unproven history
       ).then(() => true).catch(() => false);
       if (!canFastForward) {
-        return fail(`worktree create: refusing to resume '${branch}' ? it has local commits or diverges from ${base}`);
+        return fail(`worktree create: refusing to resume '${branch}' \u2014 it has local commits or diverges from ${base}`);
       }
       await execFileP2("git", ["-C", wtPath, "merge", "--ff-only", base], { timeout: GIT_TIMEOUT_MS });
       resumed = true;
@@ -40148,11 +40305,11 @@ withExamples(mutating(
     console.log(`  installed: ${report.installed.map((i) => i.dir || ".").join(", ") || "none"}`);
     console.log(`  copied: ${report.copied.join(", ") || "none"}`);
     if (issueForm && o.claim && selector) {
-      if (claimError) console.error(`  warning: board claim failed (${claimError}) ? worktree is ready, finish the claim manually`);
+      if (claimError) console.error(`  warning: board claim failed (${claimError}) \u2014 worktree is ready, finish the claim manually`);
       else console.log(`  board item ${selector.repo}#${selector.number} claimed`);
     }
   } catch (e) {
-    fail(`worktree create: failed at step '${step}' ? ${e.message}`);
+    fail(`worktree create: failed at step '${step}' \u2014 ${e.message}`);
   }
 }), [
   "mmi-cli worktree create fix/gc-sweep-2687",
@@ -40163,7 +40320,7 @@ worktree.command("setup [path]").description("provision an existing worktree (in
   const root = path2 ?? process.cwd();
   const release = acquireWorktreeSetupLock(root);
   if (!release) {
-    if (!o.quiet && !o.json) console.log("worktree setup: another provision is in progress ? skipping");
+    if (!o.quiet && !o.json) console.log("worktree setup: another provision is in progress \u2014 skipping");
     return;
   }
   try {
@@ -40183,7 +40340,7 @@ worktree.command("setup [path]").description("provision an existing worktree (in
     release();
   }
 });
-worktree.command("events").description("who created and who removed this repo's worktrees ? the append-only attribution log (#3580)").option("--limit <n>", "most recent events to show", "50").option("--json", "machine-readable output").action(async (o) => {
+worktree.command("events").description("who created and who removed this repo's worktrees \u2014 the append-only attribution log (#3580)").option("--limit <n>", "most recent events to show", "50").option("--json", "machine-readable output").action(async (o) => {
   const limit = Number.parseInt(o.limit, 10);
   if (!Number.isFinite(limit) || limit < 1) return fail("worktree events: --limit must be a positive integer");
   const primaryRoot = await primaryCheckoutRoot(process.cwd()) ?? process.cwd();
@@ -40201,11 +40358,11 @@ async function attachToProject(issueNumber, repo, priority) {
   try {
     cfg = await loadConfigForRepo(targetRepo2);
   } catch (e) {
-    console.error(`issue create: board attach skipped ? ${e.message}`);
+    console.error(`issue create: board attach skipped \u2014 ${e.message}`);
     return { onBoard: false };
   }
   if (!cfg.projectId) {
-    console.error(`issue create: board attach skipped ? no Hub registry board META for ${targetRepo2 ?? "current repo"}; run \`mmi-cli oracle org project get ${targetRepo2 ?? "<owner/repo>"}\` and backfill board coords`);
+    console.error(`issue create: board attach skipped \u2014 no Hub registry board META for ${targetRepo2 ?? "current repo"}; run \`mmi-cli oracle org project get ${targetRepo2 ?? "<owner/repo>"}\` and backfill board coords`);
     return { onBoard: false };
   }
   try {
@@ -40251,7 +40408,7 @@ function scheduleRelatedDiscovery(o) {
   try {
     const args = ["issue", "discover-related", "--number", String(o.number), "--title", o.title, "--body", o.body, "--fail-soft"];
     if (o.repo) args.push("--repo", o.repo);
-    spawnDetachedSelf(args, { spawn: import_node_child_process19.spawn, execPath: process.execPath, scriptPath: process.argv[1] }, { cwd: process.cwd() });
+    spawnDetachedSelf(args, { spawn: import_node_child_process20.spawn, execPath: process.execPath, scriptPath: process.argv[1] }, { cwd: process.cwd() });
   } catch {
   }
 }
@@ -40260,7 +40417,7 @@ registerEdgeCommands(program2);
 registerBoxCommands(program2);
 registerSchedulesCommands(program2);
 registerSchedulesLiftCommand(program2);
-var repoIndex = program2.command("repo-index").description("Hub cloud + local pointer index ? paths/symbols only, never wiki prose (Hub#4133)");
+var repoIndex = program2.command("repo-index").description("Hub cloud + local pointer index \u2014 paths/symbols only, never wiki prose (Hub#4133)");
 repoIndex.command("rebuild").description("walk the checkout (git ls-files + gitignore/secrets walls), rebuild the local pointer index, drop orphans").option("--json", "machine-readable projection summary").action(async (o) => {
   try {
     const root = await repoRoot();
@@ -40278,7 +40435,7 @@ repoIndex.command("rebuild").description("walk the checkout (git ls-files + giti
       }, null, 2));
       return;
     }
-    console.log(`repo-index: rebuilt ${built.repo} ? ${built.entries.length} files, ${symbolCount} symbols`);
+    console.log(`repo-index: rebuilt ${built.repo} \u2014 ${built.entries.length} files, ${symbolCount} symbols`);
   } catch (e) {
     await failGraceful(e.message);
   }
@@ -40302,7 +40459,7 @@ repoIndex.command("publish").description("publish this checkout's projection to
     const embRequested = Number(res.body.embRequested ?? 0);
     const embCap = Number(res.body.embCap ?? 0);
     const capNote = o.embed && embRequested > embCap && embCap > 0 ? ` (emb=${embCount} of ${embRequested} requested \u2014 capped at ${embCap}/publish, run \`--embed\` again to continue)` : "";
-    console.log(`repo-index: published ${res.body.repo} ? ${res.body.fileCount} files, emb=${embCount}${capNote}`);
+    console.log(`repo-index: published ${res.body.repo} \u2014 ${res.body.fileCount} files, emb=${embCount}${capNote}`);
   } catch (e) {
     return await failGraceful(e.message);
   }
@@ -40378,7 +40535,7 @@ repoIndex.command("status").description("show local and/or cloud repo-index stat
         const embGap = Number(st2.embGap ?? Math.max(0, fileCount - embCount));
         const stale = st2.staleBuiltAt === true ? " stale-builtAt" : "";
         console.log(
-          `repo-index: cloud ${st2.repo} built ${st2.builtAt} ? ${fileCount} files, emb=${embCount}/${fileCount} gap=${embGap}${stale}`
+          `repo-index: cloud ${st2.repo} built ${st2.builtAt} \u2014 ${fileCount} files, emb=${embCount}/${fileCount} gap=${embGap}${stale}`
         );
         return;
       }
@@ -40387,7 +40544,7 @@ repoIndex.command("status").description("show local and/or cloud repo-index stat
       const present = st2.present;
       if (count === 0 || present === false) {
         console.error(
-          "repo-index: no cloud projection yet ? after Hub deploy, run harbour `repo-index-reconcile` or `mmi-cli oracle repo-index sync-estate` (see docs/Guides/repo-index-runbook.md)."
+          "repo-index: no cloud projection yet \u2014 after Hub deploy, run harbour `repo-index-reconcile` or `mmi-cli oracle repo-index sync-estate` (see docs/Guides/repo-index-runbook.md)."
         );
       }
       return;
@@ -40399,10 +40556,10 @@ repoIndex.command("status").description("show local and/or cloud repo-index stat
       return;
     }
     if (!st.present) {
-      console.log(`repo-index: local missing ? cloud search needs no rebuild; optional \`repo-index rebuild\` for --local`);
+      console.log(`repo-index: local missing \u2014 cloud search needs no rebuild; optional \`repo-index rebuild\` for --local`);
       return;
     }
-    console.log(`repo-index: local ${st.repo} built ${st.builtAt} ? ${st.fileCount} files, ${st.symbolCount} symbols`);
+    console.log(`repo-index: local ${st.repo} built ${st.builtAt} \u2014 ${st.fileCount} files, ${st.symbolCount} symbols`);
   } catch (e) {
     return await failGraceful(e.message);
   }
@@ -40449,7 +40606,7 @@ repoIndex.command("health").description("post-deploy health gate: status + golde
     return await failGraceful(e.message);
   }
 });
-repoIndex.command("gc").description("remove cloud projections for repos no longer on the registry roster").option("--cloud", "required ? GC only applies to Hub cloud").option("--json", "machine-readable result").action(async (o) => {
+repoIndex.command("gc").description("remove cloud projections for repos no longer on the registry roster").option("--cloud", "required \u2014 GC only applies to Hub cloud").option("--json", "machine-readable result").action(async (o) => {
   try {
     if (!o.cloud) return await failGraceful("repo-index gc requires --cloud");
     const cfg = await loadConfig();
@@ -40483,7 +40640,7 @@ repoIndex.command("sync-estate").description("Hub indexer: shallow-clone registr
     for (const p of res.published) {
       const gap = p.embGap ?? Math.max(0, p.fileCount - (p.embCount ?? 0));
       const trunc = p.embTruncated ? " truncated" : "";
-      console.log(`repo-index: published ${p.repo} ? ${p.fileCount} files emb=${p.embCount ?? 0}/${p.fileCount} gap=${gap}${trunc}`);
+      console.log(`repo-index: published ${p.repo} \u2014 ${p.fileCount} files emb=${p.embCount ?? 0}/${p.fileCount} gap=${gap}${trunc}`);
     }
     for (const f of res.failed) {
       console.error(`repo-index: FAILED ${f.repo}: ${f.error}`);
@@ -40493,14 +40650,14 @@ repoIndex.command("sync-estate").description("Hub indexer: shallow-clone registr
     await failGraceful(e.message);
   }
 });
-var docs = program2.command("docs").description("generated docs surfaces ? the routing index (org knowledge layer)");
-docs.command("index").description("regenerate docs/index.md from the docs/ tree (--write, the default) or fail on drift (--check) ? the generated routing index, never hand-maintained").option("--check", "compare against the committed docs/index.md and exit 1 on drift; never write").option("--write", "regenerate docs/index.md when it has drifted (the default)").action(async (o) => {
+var docs = program2.command("docs").description("generated docs surfaces \u2014 the routing index (org knowledge layer)");
+docs.command("index").description("regenerate docs/index.md from the docs/ tree (--write, the default) or fail on drift (--check) \u2014 the generated routing index, never hand-maintained").option("--check", "compare against the committed docs/index.md and exit 1 on drift; never write").option("--write", "regenerate docs/index.md when it has drifted (the default)").action(async (o) => {
   try {
     const root = await repoRoot();
     const result = docsIndex(createDocsIndexDeps(root), { check: Boolean(o.check) });
     if (o.check) {
       if (result.drift) {
-        return failGraceful(`docs index: ${DOCS_INDEX_PATH} is stale ? run \`mmi-cli oracle docs index --write\` and commit the result`);
+        return failGraceful(`docs index: ${DOCS_INDEX_PATH} is stale \u2014 run \`mmi-cli oracle docs index --write\` and commit the result`);
       }
       console.log(`docs index: ${DOCS_INDEX_PATH} is current`);
       return;
@@ -40510,7 +40667,7 @@ docs.command("index").description("regenerate docs/index.md from the docs/ tree
     await failGraceful(e.message);
   }
 });
-docs.command("refs").description("deterministic doc reference gate: every backticked repo path, relative .md link, `mmi-cli` command ref, and `<!-- pinned by ? -->` comment across docs/** + README.md + architecture.md must resolve, or exit 1 (fleet-portable port of the Hub gate scripts/check-doc-refs.mjs, #3339)").option("--json", "machine-readable findings list: { ok, docCount, findings[], warnings[] }").action(async (o) => {
+docs.command("refs").description("deterministic doc reference gate: every backticked repo path, relative .md link, `mmi-cli` command ref, and `<!-- pinned by \u2014 -->` comment across docs/** + README.md + architecture.md must resolve, or exit 1 (fleet-portable port of the Hub gate scripts/check-doc-refs.mjs, #3339)").option("--json", "machine-readable findings list: { ok, docCount, findings[], warnings[] }").action(async (o) => {
   try {
     const root = await repoRoot();
     const commandPaths = new Set(
@@ -40538,7 +40695,7 @@ docs.command("refs").description("deterministic doc reference gate: every backti
     await failGraceful(e.message);
   }
 });
-var spawnCmd = program2.command("spawn").description("this repo's process-spawn contract ? every child process must be unable to pop a console window");
+var spawnCmd = program2.command("spawn").description("this repo's process-spawn contract \u2014 every child process must be unable to pop a console window");
 spawnCmd.command("policy").description("enforce the windowsHide contract across this repo's tracked source: a child_process call must set windowsHide, or take its options from a named constant, a type annotation, or a forwarded caller bag that does. Waive a call the scan cannot classify with a `// windows-hide-exempt: <reason>` comment on the line above it (#3979)").option("--json", "machine-readable result: { ok, scannedCount, findings[] }").action(async (o) => {
   try {
     const root = await repoRoot();
@@ -40554,14 +40711,14 @@ spawnCmd.command("policy").description("enforce the windowsHide contract across
     }
     for (const f of result.findings) console.error(`spawn policy: ${f.detail}`);
     console.error(
-      "\nA process spawned without windowsHide allocates a console when it has none to inherit.\nWhere Windows Terminal is the default terminal, that console becomes a desktop window the\nhost never reaps ? it outlives the process as an empty frame. Set windowsHide: true, or\nroute the call through a helper that does."
+      "\nA process spawned without windowsHide allocates a console when it has none to inherit.\nWhere Windows Terminal is the default terminal, that console becomes a desktop window the\nhost never reaps \u2014 it outlives the process as an empty frame. Set windowsHide: true, or\nroute the call through a helper that does."
     );
     process.exitCode = 1;
   } catch (e) {
     await failGraceful(e.message);
   }
 });
-var tests = program2.command("tests").description("a repo's test-policy.json ? the opt-in test contract and its enforcement");
+var tests = program2.command("tests").description("a repo's test-policy.json \u2014 the opt-in test contract and its enforcement");
 tests.command("policy").description("enforce this repo's test-policy.json against the diff: a mandatory-zone change must carry a test, an unrequested new test file is refused, a `protected` test file may not be deleted or renamed away, and a `protected` entry naming a missing file is refused. Override any of them with a `Test-Policy-Override: <reason>` commit trailer (#3605)").option("--json", "machine-readable result: { ok, base, changedCount, findings[] }").option("--base <ref>", "comparison base (default: TEST_POLICY_BASE, then origin/development, then origin/main)").action(async (o) => {
   try {
     const root = await repoRoot();
@@ -40574,7 +40731,7 @@ tests.command("policy").description("enforce this repo's test-policy.json agains
     if (result.overriddenBy && result.ok) {
       const { sha, reason, kinds } = result.overriddenBy;
       const scope = (result.waived ?? []).map((f) => f.kind).join(", ") || "nothing";
-      console.log(`tests policy: overridden by ${sha.slice(0, 8)} (waiving ${scope}; scope ${kinds.join(", ")}) ? ${reason}`);
+      console.log(`tests policy: overridden by ${sha.slice(0, 8)} (waiving ${scope}; scope ${kinds.join(", ")}) \u2014 ${reason}`);
       return;
     }
     if (result.ok) {
@@ -40596,7 +40753,7 @@ async function reportWrite(label, res) {
   }
   if (res.error) return failGraceful(`${label}: ${res.error}`);
   const detail = res.body?.error ?? "";
-  return failGraceful(`${label}: HTTP ${res.status}${detail ? ` ? ${detail}` : ""}`);
+  return failGraceful(`${label}: HTTP ${res.status}${detail ? ` \u2014 ${detail}` : ""}`);
 }
 var tenant = program2.command("tenant").description("tenant runtime control through Hub authority");
 tenant.command("control <owner/repo> <stage> <action>").description("bounded tenant control plus value-free vault/broker verification; project-admin own dev/rc, master main").option("--watch", "block on the dispatched run and report its conclusion (status/retire/verify-secrets/verify-broker/logs watch by default)").option("--lines <n>", "logs only: trailing lines of the tenant service to return (1-2000, default 200)").option("--json", "machine-readable output").action(async (repo, stage, action, o) => {
@@ -40623,7 +40780,7 @@ tenant.command("control <owner/repo> <stage> <action>").description("bounded ten
       printLine(o.json ? JSON.stringify(result, null, 2) : renderTenantControl(result));
     }
     if (result.conclusion === "failure") {
-      return failGraceful(`runtime tenant control ${stage} ${action}: ${result.category ?? "failed"} ? ${result.note}`);
+      return failGraceful(`runtime tenant control ${stage} ${action}: ${result.category ?? "failed"} \u2014 ${result.note}`);
     }
   } catch (e) {
     return failGraceful(`runtime tenant control: ${e.message}`);
@@ -40632,7 +40789,7 @@ tenant.command("control <owner/repo> <stage> <action>").description("bounded ten
 tenant.command("reconcile <owner/repo> <stage>").description("re-render this tenant stage's generated box assets from registry truth; project-admin own dev/rc, master main; watches by default").option("--watch", "wait for the tenant-reconcile.yml run (default)").option("--no-watch", "return after dispatch; do not redeploy until the reconcile run succeeds").option("--json", "machine-readable output").action(async (repo, stage, o) => {
   try {
     const result = await runTenantReconcile(trainApplyDeps(), { repo, stage, watch: o.watch });
-    printLine(o.json ? JSON.stringify(result, null, 2) : `${result.note}${result.runUrl ? ` ? ${result.runUrl}` : ""}`);
+    printLine(o.json ? JSON.stringify(result, null, 2) : `${result.note}${result.runUrl ? ` \u2014 ${result.runUrl}` : ""}`);
     if (result.conclusion === "failure" || !result.dispatched) process.exitCode = 1;
   } catch (e) {
     return failGraceful(`runtime tenant reconcile: ${e.message}`);
@@ -40645,7 +40802,7 @@ tenant.command("status <owner/repo> <stage>").description("read tenant runtime r
   console.log(JSON.stringify(result, null, 2));
   if (result.publicProbe?.ok === false) process.exitCode = 1;
 });
-tenant.command("redeploy <owner/repo> <stage>").description("re-dispatch the central tenant-deploy.yml for an already-promoted ref (no re-tag/merge); train-authority gated").option("--ref <ref>", "ref to deploy (defaults to the stage branch rc/main, or `development` for dev ? the promoted/staging ref)").option("--watch", "block on the dispatched run and report its outcome (gh run watch --exit-status)").option("--json", "machine-readable output").action(async (repo, stage, o) => {
+tenant.command("redeploy <owner/repo> <stage>").description("re-dispatch the central tenant-deploy.yml for an already-promoted ref (no re-tag/merge); train-authority gated").option("--ref <ref>", "ref to deploy (defaults to the stage branch rc/main, or `development` for dev \u2014 the promoted/staging ref)").option("--watch", "block on the dispatched run and report its outcome (gh run watch --exit-status)").option("--json", "machine-readable output").action(async (repo, stage, o) => {
   if (stage !== "dev" && stage !== "rc" && stage !== "main") return fail("runtime tenant redeploy: <stage> must be dev, rc, or main");
   try {
     const result = await runTenantRedeploy(trainApplyDeps(), { repo, stage, ref: o.ref, watch: o.watch });
@@ -40654,9 +40811,9 @@ tenant.command("redeploy <owner/repo> <stage>").description("re-dispatch the cen
     return failGraceful(`runtime tenant redeploy: ${e.message}`);
   }
 });
-tenant.command("sweep-rc").description("discover (and optionally retire) running rc tenant runtimes across tenant-containers ? orphan cleanup after a failed post-release retire (#942)").option("--retire", "retire every running rc runtime found (requires --yes) ? WARNING: tears down a legitimately-staged rc too").option("--yes", "confirm the destructive --retire").option("--json", "machine-readable output").action(async (o) => {
+tenant.command("sweep-rc").description("discover (and optionally retire) running rc tenant runtimes across tenant-containers \u2014 orphan cleanup after a failed post-release retire (#942)").option("--retire", "retire every running rc runtime found (requires --yes) \u2014 WARNING: tears down a legitimately-staged rc too").option("--yes", "confirm the destructive --retire").option("--json", "machine-readable output").action(async (o) => {
   if (o.retire && !o.yes) {
-    return fail("runtime tenant sweep-rc --retire is destructive (it tears down EVERY running rc, including one legitimately staged between /rcand and /release) ? re-run with --yes to confirm");
+    return fail("runtime tenant sweep-rc --retire is destructive (it tears down EVERY running rc, including one legitimately staged between /rcand and /release) \u2014 re-run with --yes to confirm");
   }
   const cfg = await loadConfig();
   const cdeps = registryClientDeps(cfg);
@@ -40709,7 +40866,7 @@ async function buildTenantRuntimeStatusFor(target, stage, cfg) {
     lastTenantDeployRun: (await fetchLastTenantDeployRun(slug, stage)).run
   });
 }
-var project = program2.command("project").description("the DDB org registry ? list/get projects (any member); set is master-only");
+var project = program2.command("project").description("the DDB org registry \u2014 list/get projects (any member); set is master-only");
 async function projectTarget(commandName, explicitTarget) {
   return requireProjectTarget(commandName, explicitTarget, explicitTarget ? void 0 : await resolveRepo());
 }
@@ -40753,7 +40910,7 @@ project.command("list").description("list all projects (identity + board, never
     console.log(`${p.slug ?? "?"} - ${p.name ?? ""}${p.division ? ` [${p.division}]` : ""}${p.class ? ` (${p.class})` : ""}${p.projectType ? ` <${p.projectType}>` : ""}${p.deployModel ? ` {${p.deployModel}}` : ""}`);
   }
 });
-project.command("get [owner/repo]").description("a project's META (board ids + pointers) by repo or slug; defaults to the current repo ? identity, NOT deploy coords").option("--json", "machine-readable output").action(async (repoOrSlug, o) => {
+project.command("get [owner/repo]").description("a project's META (board ids + pointers) by repo or slug; defaults to the current repo \u2014 identity, NOT deploy coords").option("--json", "machine-readable output").action(async (repoOrSlug, o) => {
   const cfg = await loadConfig();
   let target;
   try {
@@ -40763,7 +40920,7 @@ project.command("get [owner/repo]").description("a project's META (board ids + p
   }
   const read = await fetchProjectBySlugChecked(slugOf(target), registryClientDeps(cfg));
   if (!read.ok) {
-    return failGraceful(`org project get: Hub registry read failed (${read.error}) ? likely transient (cold start, network, or auth blip); retry shortly`);
+    return failGraceful(`org project get: Hub registry read failed (${read.error}) \u2014 likely transient (cold start, network, or auth blip); retry shortly`);
   }
   if (!read.project) {
     return failGraceful(`org project get: no registry META for ${target} (unknown or unbootstrapped)`);
@@ -40773,10 +40930,10 @@ project.command("get [owner/repo]").description("a project's META (board ids + p
     const m = read.project;
     const track = resolveReleaseTrack(m, void 0, target);
     const stages = branchesForTrack(track).join(" -> ");
-    const note = track === "direct" ? " (direct ? no rc; /rcand refuses, /release ships development -> main)" : track === "trunk" ? " (trunk ? main only)" : "";
+    const note = track === "direct" ? " (direct \u2014 no rc; /rcand refuses, /release ships development -> main)" : track === "trunk" ? " (trunk \u2014 main only)" : "";
     console.error(
-      `${m.name ?? target} ? class ${m.class ?? "?"} ? deploy ${m.deployModel ?? "?"}
-release track: ${track} ? stages: ${stages}${note}
+      `${m.name ?? target} \u2014 class ${m.class ?? "?"} \u2014 deploy ${m.deployModel ?? "?"}
+release track: ${track} \u2014 stages: ${stages}${note}
 deploys run centrally (tenant-deploy.yml); product repos carry no deploy files. Inspect nonsecret DEPLOY facts with \`mmi-cli oracle org project deploy get\`; full coords remain OIDC-gated.`
     );
   }
@@ -40850,7 +41007,7 @@ project.command("set [owner/repo]").description("upsert project META (idempotent
   const res = await upsertProject(slug, { ...patch, repo }, registryClientDeps(cfg));
   return reportWrite("org project set", res);
 });
-project.command("retire [owner/repo]").description("retire an orphaned registry slug (master-only): soft-delete the PROJECT# META row + drop the repo's board items; secrets/vault left alone. DRY-RUN by default ? pass --apply to actually delete; defaults to the current repo").option("--apply", "actually delete (default is a dry-run preview of what would be removed)").option("--skip-board", "retire the registry META only ? leave board items in place").option("--json", "machine-readable {slug, removedMeta, removedBoardItem} output").action(async (repoOrSlug, o) => {
+project.command("retire [owner/repo]").description("retire an orphaned registry slug (master-only): soft-delete the PROJECT# META row + drop the repo's board items; secrets/vault left alone. DRY-RUN by default \u2014 pass --apply to actually delete; defaults to the current repo").option("--apply", "actually delete (default is a dry-run preview of what would be removed)").option("--skip-board", "retire the registry META only \u2014 leave board items in place").option("--json", "machine-readable {slug, removedMeta, removedBoardItem} output").action(async (repoOrSlug, o) => {
   const cfg = await loadConfig();
   let target;
   try {
@@ -40882,9 +41039,9 @@ project.command("retire [owner/repo]").description("retire an orphaned registry
     const verb = result.applied ? "retired" : "WOULD retire (dry-run; pass --apply to delete)";
     printLine(`org project retire: ${verb} ${result.slug} (${result.repo})`);
     if (result.applied) {
-      printLine(`  META: ${result.removedMeta.ok ? `removed=${result.removedMeta.removed ?? "unknown"}` : `FAILED ? ${result.removedMeta.error}`}`);
+      printLine(`  META: ${result.removedMeta.ok ? `removed=${result.removedMeta.removed ?? "unknown"}` : `FAILED \u2014 ${result.removedMeta.error}`}`);
     } else {
-      printLine(`  META: ${result.removedMeta.ok ? result.removedMeta.existing ? "live row present ? would be tombstoned" : "no live row (already absent/tombstoned)" : `read failed ? ${result.removedMeta.error}`}`);
+      printLine(`  META: ${result.removedMeta.ok ? result.removedMeta.existing ? "live row present \u2014 would be tombstoned" : "no live row (already absent/tombstoned)" : `read failed \u2014 ${result.removedMeta.error}`}`);
     }
     if (result.removedBoardItem) {
       const b = result.removedBoardItem;
@@ -40895,7 +41052,7 @@ project.command("retire [owner/repo]").description("retire an orphaned registry
     printLine(`  ${result.vaultNote}`);
   }
   if (result.applied && !result.removedMeta.ok) {
-    return failGraceful(`org project retire: META delete failed ? ${result.removedMeta.error}`);
+    return failGraceful(`org project retire: META delete failed \u2014 ${result.removedMeta.error}`);
   }
 });
 var fullTrack = program2.command("full-track").description("direct-to-train readiness audits");
@@ -40923,7 +41080,7 @@ fullTrack.command("readiness <owner/repo>").description("aggregate branch topolo
   console.log(JSON.stringify(report, null, 2));
   if (!report.rcand.canApply) process.exitCode = 1;
 });
-project.command("set-deploy [owner/repo]").description("patch a tenant DEPLOY row ? project-admin may set only --no-env-file on their own existing dev/rc row; master may seed/change all coords and main; defaults to the current repo").addOption(new Option("--stage <stage>", "dev | rc | main").makeOptionMandatory().choices(["dev", "rc", "main"])).option("--ssh-host <host>", "the box address the deploy ssh-es into; omit to keep the stored value (required only for a NEW hetzner-ssh row ? `mmi-cli devops runtime box list` finds it)").option("--ssh-user <user>", "ssh user; omit to leave the row unchanged (default root on a new row)").option("--port <port>", "loopback port the container binds / Caddy upstream (1..65535); omit to leave the row unchanged").addOption(new Option("--substrate <substrate>", "hetzner-ssh | s3-cloudfront; omit to leave the row unchanged").choices([...DEPLOY_SUBSTRATES])).option("--deploy-role-arn <arn>", "s3-cloudfront: the scoped OIDC deployer role tenant-deploy.yml assumes for this stage").option("--app-bucket <bucket>", "s3-cloudfront: the S3 bucket the built dist/ is synced into").option("--distribution-id <id>", "s3-cloudfront: the CloudFront distribution invalidated after the sync").option("--distribution-domain <domain>", "s3-cloudfront: the host the post-deploy security-header proof is measured against").option("--deploy-path <path>", "on-box per-stage release root; omit to leave the row unchanged (default /opt/mmi/<slug>/<stage> on a new row)").option("--service <name>", "systemd/compose service name; omit to leave the row unchanged (default the slug on a new row)").option("--domain <domain>", "canonical serving host; omit to leave the row unchanged").option("--alias <domain...>", "extra serving hostname the box Caddy answers (repeatable); omit to leave the stored aliases unchanged").option("--clear-aliases", "remove EVERY serving alias from the row (#2986) ? omitting --alias preserves them, so clearing needs saying out loud").option("--no-env-file <bool>", "set the DEPLOY# fileless flag (true|false) ? own-repo project-admin dev/rc; master main; true = env passthrough with no .env symlink").option("--force", "explicit recovery override: skip fileless-compose verification only after independent proof").option("--json", "machine-readable output").action(async (repoOrSlug, o) => {
+project.command("set-deploy [owner/repo]").description("patch a tenant DEPLOY row \u2014 project-admin may set only --no-env-file on their own existing dev/rc row; master may seed/change all coords and main; defaults to the current repo").addOption(new Option("--stage <stage>", "dev | rc | main").makeOptionMandatory().choices(["dev", "rc", "main"])).option("--ssh-host <host>", "the box address the deploy ssh-es into; omit to keep the stored value (required only for a NEW hetzner-ssh row \u2014 `mmi-cli devops runtime box list` finds it)").option("--ssh-user <user>", "ssh user; omit to leave the row unchanged (default root on a new row)").option("--port <port>", "loopback port the container binds / Caddy upstream (1..65535); omit to leave the row unchanged").addOption(new Option("--substrate <substrate>", "hetzner-ssh | s3-cloudfront; omit to leave the row unchanged").choices([...DEPLOY_SUBSTRATES])).option("--deploy-role-arn <arn>", "s3-cloudfront: the scoped OIDC deployer role tenant-deploy.yml assumes for this stage").option("--app-bucket <bucket>", "s3-cloudfront: the S3 bucket the built dist/ is synced into").option("--distribution-id <id>", "s3-cloudfront: the CloudFront distribution invalidated after the sync").option("--distribution-domain <domain>", "s3-cloudfront: the host the post-deploy security-header proof is measured against").option("--deploy-path <path>", "on-box per-stage release root; omit to leave the row unchanged (default /opt/mmi/<slug>/<stage> on a new row)").option("--service <name>", "systemd/compose service name; omit to leave the row unchanged (default the slug on a new row)").option("--domain <domain>", "canonical serving host; omit to leave the row unchanged").option("--alias <domain...>", "extra serving hostname the box Caddy answers (repeatable); omit to leave the stored aliases unchanged").option("--clear-aliases", "remove EVERY serving alias from the row (#2986) \u2014 omitting --alias preserves them, so clearing needs saying out loud").option("--no-env-file <bool>", "set the DEPLOY# fileless flag (true|false) \u2014 own-repo project-admin dev/rc; master main; true = env passthrough with no .env symlink").option("--force", "explicit recovery override: skip fileless-compose verification only after independent proof").option("--json", "machine-readable output").action(async (repoOrSlug, o) => {
   const cfg = await loadConfig();
   let target;
   try {
@@ -40949,7 +41106,7 @@ ${filelessTransitionGuide(target, o.stage)}`);
         if (verdict.warn) console.error(`org project set-deploy: ${verdict.warn}`);
       } else if (!o.force) {
         return fail(
-          `org project set-deploy: cannot verify ${target} ${branch} from this checkout ? refusing to change noEnvFile. Run from the target repo with origin/${branch} fetched.
+          `org project set-deploy: cannot verify ${target} ${branch} from this checkout \u2014 refusing to change noEnvFile. Run from the target repo with origin/${branch} fetched.
 ${filelessTransitionGuide(target, o.stage)}`
         );
       } else {
@@ -40984,14 +41141,14 @@ ${filelessTransitionGuide(target, o.stage)}`
   const res = await setDeployCoords(slug, body, registryClientDeps(cfg));
   return reportWrite("org project set-deploy", res);
 });
-var registry = program2.command("registry").description("the DDB org registry ? org-level constants");
+var registry = program2.command("registry").description("the DDB org registry \u2014 org-level constants");
 registry.command("org").description("the org config (account id, region, orgProjectId, sagaApiUrl)").option("--json", "machine-readable output").action(async (_o) => {
   const cfg = await loadConfig();
   const org = await fetchOrgConfig(registryClientDeps(cfg));
   if (!org) return failGraceful("org config get: Hub API unreachable, unseeded, or this repo is not bootstrapped");
   console.log(JSON.stringify(org));
 });
-var oauth = program2.command("oauth").description("per-repo Google OAuth ? plan the canonical URI set, verify the client is port-agnostic");
+var oauth = program2.command("oauth").description("per-repo Google OAuth \u2014 plan the canonical URI set, verify the client is port-agnostic");
 oauth.command("plan", { isDefault: true }).description("print the canonical JS origins + redirect URIs + SSM cred param names for this repo").option("--repo <owner/repo>", "slug source (defaults to the current repo)").option("--json", "machine-readable output").action(async (o) => {
   const cfg = await loadConfig();
   const slug = (o.repo ? o.repo.split("/").pop() : cfg.project ?? await repoSlug()).toLowerCase();
@@ -41005,7 +41162,7 @@ oauth.command("plan", { isDefault: true }).description("print the canonical JS o
       return failGraceful(
         `org oauth plan: ${message}. Declare it in the registry META first:
   mmi-cli oracle org project set ${o.repo ?? `mutmutco/${slug}`} --var 'oauth={"subdomains":["${defaultSubdomain(slug)}"],"callbackPath":"${DEFAULT_CALLBACK_PATH}"}'
-  New repo? The GCP project and its Google Auth Platform consent screen must exist too ? docs/Guides/oauth-provision.md ? New repo.`
+  New repo? The GCP project and its Google Auth Platform consent screen must exist too \u2014 docs/Guides/oauth-provision.md \u2014 New repo.`
       );
     }
     return failGraceful(`org oauth plan: ${message}`);
@@ -41031,7 +41188,7 @@ SSM cred params (under /mmi-future/${slug}/):`);
 oauth.command("set-creds").description('store the OAuth client into the canonical stageless GOOGLE_CLIENT_ID/SECRET pair (pipe the Console "Download JSON" on stdin)').option("--repo <owner/repo>", "target repo (defaults to the current repo)").action(async (o) => {
   const raw = await readStdin();
   if (!raw.trim()) {
-    return fail("org oauth set-creds: pipe the Google client JSON on stdin ? e.g.\n  mmi-cli vault org oauth set-creds --repo <owner/repo> < client.json");
+    return fail("org oauth set-creds: pipe the Google client JSON on stdin \u2014 e.g.\n  mmi-cli vault org oauth set-creds --repo <owner/repo> < client.json");
   }
   let creds;
   try {
@@ -41081,9 +41238,9 @@ oauth.command("verify").description("probe Google authorize with an arbitrary po
   if (o.json) {
     console.log(JSON.stringify({ slug, redirectUri, portAgnostic: !mismatch }));
   } else if (mismatch) {
-    console.error(`FAIL ${slug}: redirect_uri_mismatch for ${redirectUri} ? client is not port-agnostic (run /oauth-provision)`);
+    console.error(`FAIL ${slug}: redirect_uri_mismatch for ${redirectUri} \u2014 client is not port-agnostic (run /oauth-provision)`);
   } else {
-    console.log(`PASS ${slug}: ${redirectUri} accepted ? port-agnostic OAuth is live`);
+    console.log(`PASS ${slug}: ${redirectUri} accepted \u2014 port-agnostic OAuth is live`);
   }
   if (mismatch) process.exitCode = 1;
 });
@@ -41096,7 +41253,7 @@ function resolveCreatePriority(raw, command) {
   try {
     return normalizePriority(raw);
   } catch {
-    fail(`${command}: unknown priority "${raw}" ? expected one of: ${CLI_PRIORITIES.join(", ")}`, {
+    fail(`${command}: unknown priority "${raw}" \u2014 expected one of: ${CLI_PRIORITIES.join(", ")}`, {
       code: ERROR_CODES.ERR_BAD_ENUM,
       offending_flag: "--priority",
       expected: [...CLI_PRIORITIES]
@@ -41106,15 +41263,25 @@ function resolveCreatePriority(raw, command) {
 function resolveCreateType(raw, command, labels) {
   if (raw === void 0 || raw === "") {
     const nearMiss = labels?.find((l) => ISSUE_TYPES.includes(l));
-    const hint = nearMiss ? ` (you passed --label ${nearMiss} ? did you mean --type ${nearMiss}?)` : "";
+    const hint = nearMiss ? ` (you passed --label ${nearMiss} \u2014 did you mean --type ${nearMiss}?)` : "";
+    let correctedCommand;
+    if (nearMiss) {
+      const argv = process.argv.slice(2);
+      const collisionIndex = argv.findIndex((a, i) => a === "--label" && argv[i + 1] === nearMiss);
+      if (collisionIndex !== -1) {
+        const rewritten = argv.slice();
+        rewritten[collisionIndex] = "--type";
+        correctedCommand = `mmi-cli ${canonicalArgvFor(rewritten).join(" ")}`;
+      }
+    }
     fail(`${command}: --type is required (bug | feature | task) unless --batch supplies it per row${hint}`, {
       code: ERROR_CODES.ERR_MISSING_FLAG,
       offending_flag: "--type",
-      ...nearMiss ? { corrected_command: `${command} --type ${nearMiss} ?` } : {}
+      ...correctedCommand ? { corrected_command: correctedCommand } : {}
     });
   }
   if (!ISSUE_TYPES.includes(raw)) {
-    fail(`${command}: unknown type "${raw}" ? expected one of: ${ISSUE_TYPES.join(", ")}`, {
+    fail(`${command}: unknown type "${raw}" \u2014 expected one of: ${ISSUE_TYPES.join(", ")}`, {
       code: ERROR_CODES.ERR_BAD_ENUM,
       offending_flag: "--type",
       expected: [...ISSUE_TYPES]
@@ -41128,9 +41295,9 @@ function resolveCreateSurface(opts) {
 function surfaceWaived() {
   return rawFlag("--no-surface");
 }
-var issue = program2.command("issue").description("issues ? reliable create with structured output");
+var issue = program2.command("issue").description("issues \u2014 reliable create with structured output");
 withExamples(mutating(
-  issue.command("create").description("create an issue (type ? label) and print {number,url,label} JSON").addOption(new Option("--type <type>", "bug | feature | task (sets the matching label; required unless --batch)").choices([...ISSUE_TYPES])).option("--title <title>", "issue title").option("--title-file <path|->", "read the issue title from a UTF-8 file, or from stdin with -").option("--body <body>", "issue body (markdown)").option("--body-file <path|->", "read issue body from a UTF-8 file. `-` (stdin) needs a heredoc, which the agent inline-body guard denies (#1473/#2125) ? prefer a real path; a title with backticks needs --title-file for the same reason (#3381)").option("--priority <priority>", "urgent | high | medium | low (defaults to medium; sets the board Priority field only ? never a priority:* label, #416)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--label <label...>", "extra label(s) to attach (repeatable; auto-created if missing)").option("--surface <surface>", "issue surface, with or without the surface: prefix (#3789). Required when the target repo runs the one-surface-label board rule; any value satisfies it, so this is not a closed enum").option("--no-surface", "file without a surface label on a repo that requires one ? for a genuinely exempt filing (e.g. a coop proof issue that spans every surface)").option("--parent <ref>", "file as a native sub-issue of this parent (#123, owner/repo#123, or URL)").option("--no-related", "skip the auto related-issues comment"),
+  issue.command("create").description("create an issue (type \u2014 label) and print {number,url,label} JSON").addOption(new Option("--type <type>", "bug | feature | task (sets the matching label; required unless --batch)").choices([...ISSUE_TYPES])).option("--title <title>", "issue title").option("--title-file <path|->", "read the issue title from a UTF-8 file, or from stdin with -").option("--body <body>", "issue body (markdown)").option("--body-file <path|->", "read issue body from a UTF-8 file. `-` (stdin) needs a heredoc, which the agent inline-body guard denies (#1473/#2125) \u2014 prefer a real path; a title with backticks needs --title-file for the same reason (#3381)").option("--priority <priority>", "urgent | high | medium | low (defaults to medium; sets the board Priority field only \u2014 never a priority:* label, #416)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--label <label...>", "extra label(s) to attach (repeatable; auto-created if missing)").option("--surface <surface>", "issue surface, with or without the surface: prefix (#3789). Required when the target repo runs the one-surface-label board rule; any value satisfies it, so this is not a closed enum").option("--no-surface", "file without a surface label on a repo that requires one \u2014 for a genuinely exempt filing (e.g. a coop proof issue that spans every surface)").option("--parent <ref>", "file as a native sub-issue of this parent (#123, owner/repo#123, or URL)").option("--no-related", "skip the auto related-issues comment"),
   // --dry-run/--validate-only plan: resolve the same title source and validate the same type, priority,
   // and surface contract as the real action. A plan that echoes the title-file PATH instead of its value
   // is not a plan of the mutation that will run (#3914).
@@ -41197,7 +41364,7 @@ withExamples(mutating(
     }
     targetRepo2 = await resolveRepo(o.repo);
     if (!targetRepo2) {
-      return fail("issue create: could not resolve the target repo ? run inside a git checkout or pass --repo <owner/repo>");
+      return fail("issue create: could not resolve the target repo \u2014 run inside a git checkout or pass --repo <owner/repo>");
     }
     args = buildIssueArgs({
       type: issueType,
@@ -41226,7 +41393,7 @@ withExamples(mutating(
         labels: extraLabels.length ? extraLabels : void 0
       });
       process.stderr.write(
-        `warning: --surface ${surfaceFlagLabel} was dropped ? ${targetRepo2} defines no surface:* labels, and creating one here would switch the one-surface-label rule on for every later filing in it. Use --label ${surfaceFlagLabel} if you really mean to start that taxonomy.
+        `warning: --surface ${surfaceFlagLabel} was dropped \u2014 ${targetRepo2} defines no surface:* labels, and creating one here would switch the one-surface-label rule on for every later filing in it. Use --label ${surfaceFlagLabel} if you really mean to start that taxonomy.
 `
       );
     }
@@ -41276,7 +41443,7 @@ async function readParentField(number, repo) {
   }
   return resolveParentField(payload);
 }
-issue.command("view <number>").description('read an issue as structured JSON ? the mmi-cli path for non-board issue reads (#2347). --comments folds in every comment; --context also adds linkedPrs + children (the one-shot "load the whole item" read, #2894)').option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--json [fields...]", 'gh --json field list (overrides the default field set). Accepts commas, spaces, or repeated --json flags ? in PowerShell an unquoted comma list is an array literal, so QUOTE it: --json "number,title,body,url"').option("--comments", 'include every comment (body + comments in one call) ? the agentic "read the whole item before working it" read (#2894)').option("--context", "full working context in one call: implies --comments and also adds linkedPrs and, for an epic, a children summary (#2894)").action(async (number, o) => {
+issue.command("view <number>").description('read an issue as structured JSON \u2014 the mmi-cli path for non-board issue reads (#2347). --comments folds in every comment; --context also adds linkedPrs + children (the one-shot "load the whole item" read, #2894)').option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--json [fields...]", 'gh --json field list (overrides the default field set). Accepts commas, spaces, or repeated --json flags \u2014 in PowerShell an unquoted comma list is an array literal, so QUOTE it: --json "number,title,body,url"').option("--comments", 'include every comment (body + comments in one call) \u2014 the agentic "read the whole item before working it" read (#2894)').option("--context", "full working context in one call: implies --comments and also adds linkedPrs and, for an epic, a children summary (#2894)").action(async (number, o) => {
   const n = Number(number);
   if (!Number.isInteger(n) || n <= 0) return fail("issue view: <number> must be a positive integer");
   const repo = await resolveRepo(o.repo);
@@ -41370,7 +41537,7 @@ jsonParity(issue.command("comment <ref>").description("post a Markdown comment t
     return fail(`issue comment: ${e.message}`);
   }
   const repo = await resolveRepo(parsed.repo ?? o.repo);
-  if (!repo) return fail("issue comment: could not resolve repo ? pass --repo owner/repo");
+  if (!repo) return fail("issue comment: could not resolve repo \u2014 pass --repo owner/repo");
   try {
     const result = await postIssueComment(defaultGitHubClient(), { ref, defaultRepo: repo, body });
     console.log(JSON.stringify(result));
@@ -41379,7 +41546,7 @@ jsonParity(issue.command("comment <ref>").description("post a Markdown comment t
     return failGraceful(`issue comment: ${(err.stderr || err.message || String(e)).trim()}`);
   }
 });
-jsonParity(issue.command("check <ref>").description("tick (or with --off untick) a task-list checkbox in an issue/epic body by its item text and print {number,repo,item,checked,changed} JSON").requiredOption("--item <text>", "the checklist item to match ? exact item text, else a unique substring").option("--off", "untick the item ([x] ? [ ]) instead of ticking it").option("--repo <owner/repo>", "repo for a bare ref (defaults to the current repo)")).action(async (ref, o) => {
+jsonParity(issue.command("check <ref>").description("tick (or with --off untick) a task-list checkbox in an issue/epic body by its item text and print {number,repo,item,checked,changed} JSON").requiredOption("--item <text>", "the checklist item to match \u2014 exact item text, else a unique substring").option("--off", "untick the item ([x] \u2014 [ ]) instead of ticking it").option("--repo <owner/repo>", "repo for a bare ref (defaults to the current repo)")).action(async (ref, o) => {
   let parsed;
   try {
     parsed = parseIssueRef(ref);
@@ -41387,7 +41554,7 @@ jsonParity(issue.command("check <ref>").description("tick (or with --off untick)
     return fail(`issue check: ${e.message}`);
   }
   const repo = await resolveRepo(parsed.repo ?? o.repo);
-  if (!repo) return fail("issue check: could not resolve repo ? pass --repo owner/repo");
+  if (!repo) return fail("issue check: could not resolve repo \u2014 pass --repo owner/repo");
   const checked = o.off !== true;
   let body;
   try {
@@ -41400,7 +41567,7 @@ jsonParity(issue.command("check <ref>").description("tick (or with --off untick)
   if (!result.ok) {
     if (result.reason === "ambiguous") {
       const list = result.matches.map((m) => `  - ${m.text}`).join("\n");
-      return fail(`issue check: "${o.item}" matches ${result.matches.length} checklist items in ${repo}#${parsed.number} ? narrow the text:
+      return fail(`issue check: "${o.item}" matches ${result.matches.length} checklist items in ${repo}#${parsed.number} \u2014 narrow the text:
 ${list}`);
     }
     return fail(`issue check: no checklist item matching "${o.item}" in ${repo}#${parsed.number}`);
@@ -41419,7 +41586,7 @@ ${list}`);
   }
   console.log(JSON.stringify({ number: parsed.number, repo, item: result.item.text, checked, changed: true }));
 });
-program2.command("report").description("file a friction report on the Hub board (Hub session auth, dedups open reports) and print {number,url} JSON").option("--title <title>", "one-line friction summary").option("--title-file <path|->", "read the friction summary from a UTF-8 file, or from stdin with -").option("--body <body>", "report body (markdown)").option("--body-file <path|->", "read report body from a UTF-8 file, or from stdin with -").addOption(new Option("--type <type>", "bug | feature | task (sets the matching label)").default("task").choices([...ISSUE_TYPES])).option("--priority <priority>", "urgent | high | medium | low (defaults to medium; sets the board Priority field only, #416)").option("--repo <owner/repo>", 'attribute the report to a different source repo than the current checkout for the "Filed via..." footer (rare ? usually auto-detected; every report always lands on the org Hub, never an alternate target, #263)').option("--force", "file a new issue even when an open report looks like a duplicate").option("--json", "machine-readable output (already the default ? report always prints JSON; #682)").action(async (o) => {
+program2.command("report").description("file a friction report on the Hub board (Hub session auth, dedups open reports) and print {number,url} JSON").option("--title <title>", "one-line friction summary").option("--title-file <path|->", "read the friction summary from a UTF-8 file, or from stdin with -").option("--body <body>", "report body (markdown)").option("--body-file <path|->", "read report body from a UTF-8 file, or from stdin with -").addOption(new Option("--type <type>", "bug | feature | task (sets the matching label)").default("task").choices([...ISSUE_TYPES])).option("--priority <priority>", "urgent | high | medium | low (defaults to medium; sets the board Priority field only, #416)").option("--repo <owner/repo>", 'attribute the report to a different source repo than the current checkout for the "Filed via..." footer (rare \u2014 usually auto-detected; every report always lands on the org Hub, never an alternate target, #263)').option("--force", "file a new issue even when an open report looks like a duplicate").option("--json", "machine-readable output (already the default \u2014 report always prints JSON; #682)").action(async (o) => {
   let body;
   let priority;
   let title;
@@ -41429,14 +41596,16 @@ program2.command("report").description("file a friction report on the Hub board
     body = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises11.readFile, readStdin });
     priority = resolveCreatePriority(o.priority, "report");
     if (!ISSUE_TYPES.includes(o.type)) {
-      throw new Error(`unknown issue type "${o.type}" ? expected one of: ${ISSUE_TYPES.join(", ")}`);
+      throw new Error(`unknown issue type "${o.type}" \u2014 expected one of: ${ISSUE_TYPES.join(", ")}`);
     }
   } catch (e) {
     const m = e.message;
     const payload = m === "pass --title or --title-file" ? {
       code: ERROR_CODES.ERR_MISSING_FLAG,
       offending_flag: "--title",
-      corrected_command: `mmi-cli ${process.argv.slice(2).join(" ")} --title "..."`
+      // #4803: process.argv's house token is already spliced by resolveHouseShim (#4438);
+      // canonicalArgvFor re-prepends it so this stays the runnable house-prefixed form.
+      corrected_command: `mmi-cli ${canonicalArgvFor(process.argv.slice(2)).join(" ")} --title "..."`
     } : void 0;
     return fail(`report: ${m}`, payload);
   }
@@ -41466,7 +41635,7 @@ async function resolvePluginSha() {
     return void 0;
   }
 }
-program2.command("skill-lesson").description("file a skill-lesson on the Hub board (GitHub auth, dedups open lessons) and print {number,url} JSON").addOption(new Option("--skill <name>", `which skill misfired (${SKILL_NAMES.join(" | ")})`).makeOptionMandatory().choices([...SKILL_NAMES])).option("--title <title>", "one-line summary of what misfired").option("--title-file <path|->", "read the one-line summary from a UTF-8 file, or from stdin with -").option("--body <body>", "lesson body: what misfired, the evidence, and the proposed amendment (markdown)").option("--body-file <path|->", "read the lesson body from a UTF-8 file, or from stdin with -").option("--priority <priority>", "urgent | high | medium | low (defaults to medium; sets the board Priority field only, #416)").option("--repo <owner/repo>", `target repo (defaults to the org Hub: ${HUB_REPO})`).option("--force", "file a new issue even when an open lesson looks like a duplicate").option("--json", "machine-readable output (already the default ? skill-lesson always prints JSON)").action(async (o) => {
+program2.command("skill-lesson").description("file a skill-lesson on the Hub board (GitHub auth, dedups open lessons) and print {number,url} JSON").addOption(new Option("--skill <name>", `which skill misfired (${SKILL_NAMES.join(" | ")})`).makeOptionMandatory().choices([...SKILL_NAMES])).option("--title <title>", "one-line summary of what misfired").option("--title-file <path|->", "read the one-line summary from a UTF-8 file, or from stdin with -").option("--body <body>", "lesson body: what misfired, the evidence, and the proposed amendment (markdown)").option("--body-file <path|->", "read the lesson body from a UTF-8 file, or from stdin with -").option("--priority <priority>", "urgent | high | medium | low (defaults to medium; sets the board Priority field only, #416)").option("--repo <owner/repo>", `target repo (defaults to the org Hub: ${HUB_REPO})`).option("--force", "file a new issue even when an open lesson looks like a duplicate").option("--json", "machine-readable output (already the default \u2014 skill-lesson always prints JSON)").action(async (o) => {
   const targetRepo2 = o.repo ?? HUB_REPO;
   const sourceRepo = await resolveRepo(void 0);
   const pluginSha = await resolvePluginSha();
@@ -41521,7 +41690,7 @@ program2.command("skill-lesson").description("file a skill-lesson on the Hub boa
     repo: targetRepo2,
     labels: [SKILL_LESSON_LABEL],
     command: "skill-lesson",
-    waiver: { reason: "tooling lesson spans product surfaces ? coop-proof class (#3789)" }
+    waiver: { reason: "tooling lesson spans product surfaces \u2014 coop-proof class (#3789)" }
   });
   if (surfaceWarn) process.stderr.write(`${surfaceWarn}
 `);
@@ -41533,7 +41702,7 @@ program2.command("skill-lesson").description("file a skill-lesson on the Hub boa
   const { projectItemId, onBoard } = await attachToProject(created.number, targetRepo2, priority);
   console.log(JSON.stringify({ ...created, deduped: false, label: SKILL_LESSON_LABEL, skill, priority, projectItemId, onBoard }));
 });
-var pr = program2.command("pr").description("pull requests ? reliable create with structured output");
+var pr = program2.command("pr").description("pull requests \u2014 reliable create with structured output");
 withExamples(pr.command("create").description("create a PR and print {number,url} JSON").option("--title <title>", "PR title").option("--title-file <path|->", "read the PR title from a UTF-8 file, or from stdin with -").option("--body <body>", "PR body (markdown)").option("--body-file <path|->", "read PR body from a UTF-8 file, or from stdin with -").option("--base <branch>", "base branch (defaults to the repo default)").option("--head <branch>", "head branch (defaults to the current branch)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--draft", "open the PR in draft state (#2667)").option("--json", "machine-readable output (default; accepted for parity)").action(async (o) => {
   let body;
   let title;
@@ -41547,7 +41716,7 @@ withExamples(pr.command("create").description("create a PR and print {number,url
   body = rewriteNegatedClosingPhrases(body);
   const docsCheck = await checkDocsIndexAtHead({ repo: o.repo, head: o.head }, createPrCreateDocsIndexDeps());
   if (docsCheck && !docsCheck.ok) {
-    return fail(`pr create: ${docsCheck.detail} ? ${docsCheck.fix}`);
+    return fail(`pr create: ${docsCheck.detail} \u2014 ${docsCheck.fix}`);
   }
   const created = await ghCreate(buildPrArgs({ title, body, base: o.base, head: o.head, repo: o.repo, draft: o.draft }));
   invalidateStatuslineBoardCache();
@@ -41560,7 +41729,7 @@ withExamples(pr.command("create").description("create a PR and print {number,url
   "Use --body-file for multiline PR bodies instead of shell-escaped inline markdown.",
   "Write that file under .jerv/ inside a worktree (#4405): any other untracked path makes `worktree land` refuse cleanup as untracked-files."
 ]);
-pr.command("view <number>").description("read a PR as structured JSON (merged state, head/base, URL, merge commit) ? the mmi-cli read path (#2347). --comments folds in every comment; --context also adds linkedIssues (the issues it closes/references, #2894)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--json [fields...]", 'gh --json field list (overrides the default field set). Accepts commas, spaces, or repeated --json flags ? in PowerShell an unquoted comma list is an array literal, so QUOTE it: --json "state,baseRefName,mergeCommit"').option("--comments", "include every comment (body + comments in one call) ? read the whole PR before landing it (#2894)").option("--context", "full working context in one call: implies --comments and also adds linkedIssues (the issues the PR closes/references) (#2894)").action(async (number, o) => {
+pr.command("view <number>").description("read a PR as structured JSON (merged state, head/base, URL, merge commit) \u2014 the mmi-cli read path (#2347). --comments folds in every comment; --context also adds linkedIssues (the issues it closes/references, #2894)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--json [fields...]", 'gh --json field list (overrides the default field set). Accepts commas, spaces, or repeated --json flags \u2014 in PowerShell an unquoted comma list is an array literal, so QUOTE it: --json "state,baseRefName,mergeCommit"').option("--comments", "include every comment (body + comments in one call) \u2014 read the whole PR before landing it (#2894)").option("--context", "full working context in one call: implies --comments and also adds linkedIssues (the issues the PR closes/references) (#2894)").action(async (number, o) => {
   const n = Number(number);
   if (!Number.isInteger(n) || n <= 0) return fail("pr view: <number> must be a positive integer");
   const repo = await resolveRepo(o.repo);
@@ -41670,7 +41839,7 @@ pr.command("ci-policy").description("report merge CI policy: wait-for-checks vs
   if (o.json) return printLine(JSON.stringify(result));
   printLine(`merge CI policy: ${result.policy} (${result.reason})`);
 });
-pr.command("checks-wait <number>").description(`bounded wait for PR checks; skips immediately on no-ci repos (#1432), fails immediately on a CONFLICTING PR ? GitHub never queues checks for one (#2970). REST-only polling with a pool floor (#3024). Default budget ${PR_CHECKS_TIMEOUT_MS / 6e4}m; --timeout raises it. Exit 1 = a check FAILED or the PR is CONFLICTING, exit ${PR_CHECKS_TIMEOUT_EXIT_CODE} = the wait window expired or the API pool ran dry (re-arm)`).option("--json", "machine-readable output").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--timeout <minutes>", `wait budget in minutes (default ${PR_CHECKS_TIMEOUT_MS / 6e4}) ? raise it for serial self-hosted e2e queues`).action(async (number, o) => {
+pr.command("checks-wait <number>").description(`bounded wait for PR checks; skips immediately on no-ci repos (#1432), fails immediately on a CONFLICTING PR \u2014 GitHub never queues checks for one (#2970). REST-only polling with a pool floor (#3024). Default budget ${PR_CHECKS_TIMEOUT_MS / 6e4}m; --timeout raises it. Exit 1 = a check FAILED or the PR is CONFLICTING, exit ${PR_CHECKS_TIMEOUT_EXIT_CODE} = the wait window expired or the API pool ran dry (re-arm)`).option("--json", "machine-readable output").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--timeout <minutes>", `wait budget in minutes (default ${PR_CHECKS_TIMEOUT_MS / 6e4}) \u2014 raise it for serial self-hosted e2e queues`).action(async (number, o) => {
   let timeoutMs;
   if (o.timeout !== void 0) {
     const minutes = Number(o.timeout);
@@ -41700,27 +41869,27 @@ pr.command("checks-wait <number>").description(`bounded wait for PR checks; skip
     timeoutMs,
     // Liveness on stderr, one line per poll. A silent bounded wait is indistinguishable from a hang, and
     // an agent harness kills it on its own (shorter) deadline before the verdict ever prints (#2940).
-    progress: ({ state, elapsedMs, remainingMs }) => console.warn(`pr checks-wait: ${state} ? ${Math.round(elapsedMs / 1e3)}s elapsed, ${Math.round(remainingMs / 6e4)}m left`)
+    progress: ({ state, elapsedMs, remainingMs }) => console.warn(`pr checks-wait: ${state} \u2014 ${Math.round(elapsedMs / 1e3)}s elapsed, ${Math.round(remainingMs / 6e4)}m left`)
   });
   if (o.json) printLine(JSON.stringify(result));
   else if (result.status === "conflicting") {
-    printLine(`pr checks-wait: conflicting ? ${result.reason}`);
+    printLine(`pr checks-wait: conflicting \u2014 ${result.reason}`);
   } else if (result.status === "timeout") {
     const stuckQueuing = /no-checks-reported/i.test(result.detail ?? "");
     printLine(
-      `pr checks-wait: timeout ? waited ${Math.round((result.waitedMs ?? 0) / 6e4)}m, last state: ${result.detail ?? "pending"}. No check failed; re-run to keep waiting, or pass --timeout <minutes>.` + (stuckQueuing ? " Tip: jobs never appeared ? mmi-live may be saturated or Actions may be failing before checkout; check runner health (docs/Guides/gh-runner-runbook.md) and re-run the workflow." : "")
+      `pr checks-wait: timeout \u2014 waited ${Math.round((result.waitedMs ?? 0) / 6e4)}m, last state: ${result.detail ?? "pending"}. No check failed; re-run to keep waiting, or pass --timeout <minutes>.` + (stuckQueuing ? " Tip: jobs never appeared \u2014 mmi-live may be saturated or Actions may be failing before checkout; check runner health (docs/Guides/gh-runner-runbook.md) and re-run the workflow." : "")
     );
   } else if (result.status === "rate-limited") {
-    printLine(`pr checks-wait: rate-limited ? ${result.reason ?? "REST pool below floor"}. No check failed; re-run after the pool resets.`);
+    printLine(`pr checks-wait: rate-limited \u2014 ${result.reason ?? "REST pool below floor"}. No check failed; re-run after the pool resets.`);
   } else if (result.detail === "runner-infra") {
-    printLine(`pr checks-wait: failure (runner infrastructure, NOT a test failure) ? ${result.reason}`);
+    printLine(`pr checks-wait: failure (runner infrastructure, NOT a test failure) \u2014 ${result.reason}`);
   } else if (result.detail === "stale-head") {
-    printLine(`pr checks-wait: failure (stale PR head, NOT a test failure) ? ${result.reason}`);
-  } else printLine(`pr checks-wait: ${result.status}${result.reason ? ` ? ${result.reason}` : ""}${result.detail ? ` (${result.detail})` : ""}`);
+    printLine(`pr checks-wait: failure (stale PR head, NOT a test failure) \u2014 ${result.reason}`);
+  } else printLine(`pr checks-wait: ${result.status}${result.reason ? ` \u2014 ${result.reason}` : ""}${result.detail ? ` (${result.detail})` : ""}`);
   if (result.status === "failure" || result.status === "conflicting") process.exitCode = 1;
   if (result.status === "timeout" || result.status === "rate-limited") process.exitCode = PR_CHECKS_TIMEOUT_EXIT_CODE;
 });
-pr.command("land <number>").description("agent merge path (#1440): train probe ? checks-wait ? merge --auto ? poll enqueued ? development PRs only").option("--json", "machine-readable output").option("--repo <owner/repo>", "target repo (defaults to the PR repo)").option("--no-require-train", "skip train-authority preflight (not recommended for autonomous agents)").option("--preserve-worktree", "after merge, keep the local PR worktree/stage/branch for an active batch (#1888)").option("--force", "acknowledge and land past a remaining prunable/severe scratch housekeeping block (advisory kept plans/ never blocks, #3012) or a negated-closing-keyword (#3718) or ambiguous-cross-repo-closing (#4279) refusal").action(async (number, o) => {
+pr.command("land <number>").description("agent merge path (#1440): train probe \u2014 checks-wait \u2014 merge --auto \u2014 poll enqueued \u2014 development PRs only").option("--json", "machine-readable output").option("--repo <owner/repo>", "target repo (defaults to the PR repo)").option("--no-require-train", "skip train-authority preflight (not recommended for autonomous agents)").option("--preserve-worktree", "after merge, keep the local PR worktree/stage/branch for an active batch (#1888)").option("--force", "acknowledge and land past a remaining prunable/severe scratch housekeeping block (advisory kept plans/ never blocks, #3012) or a negated-closing-keyword (#3718) or ambiguous-cross-repo-closing (#4279) refusal").action(async (number, o) => {
   const repoArgs = o.repo ? ["--repo", o.repo] : [];
   const startingPath = (await execFileP2("git", ["rev-parse", "--show-toplevel"], { timeout: GIT_TIMEOUT_MS }).catch(() => ({ stdout: "" }))).stdout.trim();
   assertPrMergeHousekeepingClean(startingPath || process.cwd(), "pr land", { force: o.force });
@@ -41754,8 +41923,8 @@ pr.command("land <number>").description("agent merge path (#1440): train probe ?
       } catch {
       }
       if (isPromotionBase(base, track)) {
-        const shape = track ? `${track} track` : "unresolved track ? strict reading";
-        throw new Error(`pr land: base branch ${base} is a promotion target (${shape}) ? promotion merges stay human-only`);
+        const shape = track ? `${track} track` : "unresolved track \u2014 strict reading";
+        throw new Error(`pr land: base branch ${base} is a promotion target (${shape}) \u2014 promotion merges stay human-only`);
       }
       return repo;
     },
@@ -41765,26 +41934,26 @@ pr.command("land <number>").description("agent merge path (#1440): train probe ?
       const requiredContexts = await fetchRequiredCheckContexts(repo, "development").catch(() => null);
       return waitForPrChecks({
         resolvePolicy: () => resolveRepoMergeCiPolicy(repo, ciAuditDeps()),
-        // #3024: REST-only wait loop ? runPrLand's resolveRepo already guarantees `repo` is set.
+        // #3024: REST-only wait loop — runPrLand's resolveRepo already guarantees `repo` is set.
         pollChecks: () => pollRestPrChecks(prNumber, repo, void 0, requiredContexts),
         // #2970: `pr land` only ever lands PRs based on development (resolveRepo above already rejects any
         // other base), so the fast-fail message's base branch is always 'development' here.
         pollMergeable: () => pollRestPrMergeable(prNumber, repo),
         pollRateLimit: () => waitLoopCorePool("pr land"),
-        // #3388: `pr land` is the batch path ? the one most likely to self-DOS the shared runner and
+        // #3388: `pr land` is the batch path — the one most likely to self-DOS the shared runner and
         // then read its own wall-clock kill as a broken diff.
         diagnoseFailure: () => waitLoopDiagnosis("pr land", prNumber, repo),
         baseBranch: "development",
         sleep: (ms) => new Promise((resolve5) => setTimeout(resolve5, ms)),
         log: (message) => console.warn(message),
-        // `pr land` inherits the same (raised) checks budget, so it needs the same liveness ? otherwise the
+        // `pr land` inherits the same (raised) checks budget, so it needs the same liveness — otherwise the
         // 30m wait is SILENT and reads exactly like the hang #2940 was filed about, only three times longer.
-        progress: ({ state, elapsedMs, remainingMs }) => console.warn(`pr land: waiting on checks ? ${state}, ${Math.round(elapsedMs / 1e3)}s elapsed, ${Math.round(remainingMs / 6e4)}m left`)
+        progress: ({ state, elapsedMs, remainingMs }) => console.warn(`pr land: waiting on checks \u2014 ${state}, ${Math.round(elapsedMs / 1e3)}s elapsed, ${Math.round(remainingMs / 6e4)}m left`)
       });
     },
-    // #2425: re-probe used ONLY to decide whether a failed `gh pr merge --auto` is worth retrying ? a
+    // #2425: re-probe used ONLY to decide whether a failed `gh pr merge --auto` is worth retrying — a
     // fresh read of state/mergeable/checks, independent of the merge call's own (possibly stale) error.
-    // #4396: same required-status scoping as the wait loop above ? a non-required red must not read
+    // #4396: same required-status scoping as the wait loop above — a non-required red must not read
     // as "not ready to retry" any more than it should have blocked the wait itself.
     probeMergeReady: async (prNumber, repo) => {
       const [snapshot, requiredContexts] = await Promise.all([
@@ -41814,7 +41983,7 @@ pr.command("land <number>").description("agent merge path (#1440): train probe ?
         if (read.state === "merged") return true;
         if (read.state === "failed") {
           lastFailure = read.error;
-          console.warn(`pr land: merged-state read FAILED (${read.error}) ? retrying; this is not evidence the PR is unmerged`);
+          console.warn(`pr land: merged-state read FAILED (${read.error}) \u2014 retrying; this is not evidence the PR is unmerged`);
         } else {
           lastFailure = void 0;
         }
@@ -41822,7 +41991,7 @@ pr.command("land <number>").description("agent merge path (#1440): train probe ?
       }
       if (lastFailure) {
         throw new Error(
-          `pr land: could not verify whether PR #${prNumber} merged ? the last merged-state read FAILED (${lastFailure}). The auto-merge enqueue stands; read the PR directly (gh pr view ${prNumber} --repo ${repo} --json merged,state) and rerun cleanup if it merged.`
+          `pr land: could not verify whether PR #${prNumber} merged \u2014 the last merged-state read FAILED (${lastFailure}). The auto-merge enqueue stands; read the PR directly (gh pr view ${prNumber} --repo ${repo} --json merged,state) and rerun cleanup if it merged.`
         );
       }
       return false;
@@ -41830,7 +41999,7 @@ pr.command("land <number>").description("agent merge path (#1440): train probe ?
   });
   if (result.status !== "failed") {
     const repoFlag = result.repo ? ` --repo ${result.repo}` : "";
-    console.warn(`pr land: merge confirmed; cleanup pending ? if this process is interrupted, resume with: mmi-cli devops pr merge ${number}${repoFlag} --squash`);
+    console.warn(`pr land: merge confirmed; cleanup pending \u2014 if this process is interrupted, resume with: mmi-cli devops pr merge ${number}${repoFlag} --squash`);
   }
   if (result.status !== "failed") {
     try {
@@ -41861,13 +42030,13 @@ pr.command("land <number>").description("agent merge path (#1440): train probe ?
   }
   if (o.json) printLine(JSON.stringify(result));
   else {
-    printLine(`pr land: ${result.status}${result.error ? ` ? ${result.error}` : ""}`);
+    printLine(`pr land: ${result.status}${result.error ? ` \u2014 ${result.error}` : ""}`);
     for (const line of renderPrLandCleanupLines(result.cleanup)) printLine(line);
     if (result.cleanupError) printLine(`pr land cleanup: ${result.cleanupError}`);
   }
   if (result.status === "failed" || result.cleanupError) process.exitCode = 1;
 });
-jsonParity(pr.command("merge <number>").description("merge a PR (squash by default) and clean up its branch + worktree ? no leftover local branch; on no-ci repos run pr ci-policy / checks-wait first (#1432)").option("--squash", "squash merge (default)").option("--merge", "create a merge commit").option("--rebase", "rebase merge").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--auto", "enable auto-merge ? merge once the base-branch policy is satisfied (use for policy-gated repos)").option("--wait", `wait for checks to reach a terminal passing verdict before merging (default budget ${PR_CHECKS_TIMEOUT_MS / 6e4}m)`).option("--preserve-worktree", "keep the local PR worktree/stage/branch for an active multi-issue batch (#1888)").option("--force", "acknowledge and merge past a remaining prunable/severe scratch housekeeping block (advisory kept plans/ never blocks, #3012) or a negated-closing-keyword (#3718) or ambiguous-cross-repo-closing (#4279) refusal")).action(async (number, o) => {
+jsonParity(pr.command("merge <number>").description("merge a PR (squash by default) and clean up its branch + worktree \u2014 no leftover local branch; on no-ci repos run pr ci-policy / checks-wait first (#1432)").option("--squash", "squash merge (default)").option("--merge", "create a merge commit").option("--rebase", "rebase merge").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--auto", "enable auto-merge \u2014 merge once the base-branch policy is satisfied (use for policy-gated repos)").option("--wait", `wait for checks to reach a terminal passing verdict before merging (default budget ${PR_CHECKS_TIMEOUT_MS / 6e4}m)`).option("--preserve-worktree", "keep the local PR worktree/stage/branch for an active multi-issue batch (#1888)").option("--force", "acknowledge and merge past a remaining prunable/severe scratch housekeeping block (advisory kept plans/ never blocks, #3012) or a negated-closing-keyword (#3718) or ambiguous-cross-repo-closing (#4279) refusal")).action(async (number, o) => {
   const method = o.rebase ? "--rebase" : o.merge ? "--merge" : "--squash";
   const repoArgs = o.repo ? ["--repo", o.repo] : [];
   const repoForPostCleanup = await resolveRepo(o.repo) ?? o.repo;
@@ -41920,10 +42089,10 @@ jsonParity(pr.command("merge <number>").description("merge a PR (squash by defau
       baseBranch,
       sleep: (ms) => new Promise((resolve5) => setTimeout(resolve5, ms)),
       log: (message) => console.warn(message),
-      progress: ({ state, elapsedMs, remainingMs }) => console.warn(`pr merge: --wait checks ? ${state}, ${Math.round(elapsedMs / 1e3)}s elapsed, ${Math.round(remainingMs / 6e4)}m left`)
+      progress: ({ state, elapsedMs, remainingMs }) => console.warn(`pr merge: --wait checks \u2014 ${state}, ${Math.round(elapsedMs / 1e3)}s elapsed, ${Math.round(remainingMs / 6e4)}m left`)
     });
     if (wait.status !== "success" && wait.status !== "skipped") {
-      console.warn(`pr merge: --wait stopped before merge ? ${wait.status}${wait.reason ? `: ${wait.reason}` : ""}${wait.detail ? ` (${wait.detail})` : ""}`);
+      console.warn(`pr merge: --wait stopped before merge \u2014 ${wait.status}${wait.reason ? `: ${wait.reason}` : ""}${wait.detail ? ` (${wait.detail})` : ""}`);
       process.exitCode = wait.status === "timeout" || wait.status === "rate-limited" ? PR_CHECKS_TIMEOUT_EXIT_CODE : 1;
       return;
     }
@@ -41979,7 +42148,7 @@ jsonParity(pr.command("merge <number>").description("merge a PR (squash by defau
         return;
       }
       if (!o.auto && basePolicyBlocksImmediateMerge(message)) {
-        console.warn(`pr merge: the base-branch policy blocks an immediate merge ? upgrading to --auto (merges once required checks pass).`);
+        console.warn(`pr merge: the base-branch policy blocks an immediate merge \u2014 upgrading to --auto (merges once required checks pass).`);
         upgradedToAuto = true;
         await execFileP2("gh", buildPrMergeArgs({ number, repoArgs, method, auto: true, deleteBranch: !headIsProtected, bodyFile }), { timeout: GH_MUTATION_TIMEOUT_MS }).catch((e2) => {
           const m2 = String(e2.message || "");
@@ -42014,7 +42183,7 @@ jsonParity(pr.command("merge <number>").description("merge a PR (squash by defau
     const state = stateRead.ok ? stateRead.state : "";
     const enqueued = describePrMergeEnqueuedReason(await pollGhPrChecks(number, repoArgs).catch(() => void 0));
     console.log(JSON.stringify({ mergeStatus: "auto-merge-enqueued", enqueuedReason: enqueued.reason, pr: number, branch: headRef, state: state || "unknown", upgradedToAuto: upgradedToAuto || void 0 }));
-    console.warn(`pr merge: PR #${number} is ENQUEUED, not merged ? ${enqueued.message}.`);
+    console.warn(`pr merge: PR #${number} is ENQUEUED, not merged \u2014 ${enqueued.message}.`);
     if (upgradedToAuto && !o.auto) {
       console.warn(`pr merge: exiting ${PR_MERGE_ENQUEUED_EXIT_CODE} so a chained command does not treat this as a completed merge.`);
       process.exitCode = PR_MERGE_ENQUEUED_EXIT_CODE;
@@ -42030,7 +42199,7 @@ jsonParity(pr.command("merge <number>").description("merge a PR (squash by defau
       state: stateRead.ok ? stateRead.state : "unknown",
       cleanupStatus: "skipped"
     }));
-    console.error(`pr merge: ${gate.message}. Nothing was deleted ? re-check the PR and retry.`);
+    console.error(`pr merge: ${gate.message}. Nothing was deleted \u2014 re-check the PR and retry.`);
     process.exitCode = 1;
     return;
   }
@@ -42133,7 +42302,7 @@ function trainApplyDeps() {
       const verdict = await fetchTrainAuthority(repo, registryClientDeps(await loadConfig()));
       return verdict.ok ? { ok: true, role: verdict.authority.role, train: verdict.authority.train } : verdict;
     },
-    // Hub-App-authority dispatch of the central tenant deploy (#953) ? the Hub fires the
+    // Hub-App-authority dispatch of the central tenant deploy (#953) — the Hub fires the
     // workflow_dispatch with its App token, so the caller needs no MMI-Hub Actions write.
     dispatchTenantDeploy: async ({ repo, stage, ref }) => {
       const res = await tenantDeploy({ repo, stage, ref }, registryClientDeps(await loadConfig()));
@@ -42142,7 +42311,7 @@ function trainApplyDeps() {
         throw new Error(`tenant deploy dispatch failed: ${detail}`);
       }
     },
-    // Hub-App-authority dispatch of the central tenant-control.yml (#1717) ? the Hub fires the
+    // Hub-App-authority dispatch of the central tenant-control.yml (#1717) — the Hub fires the
     // workflow_dispatch with its App token. Never throws for an expected rejection: it returns the dispatch
     // outcome so runTenantControl can map a 5xx (transport-failed, retryable) vs a 4xx (rejected) vs ok.
     dispatchTenantControl: async ({ repo, stage, action, lines }) => {
@@ -42158,7 +42327,7 @@ function trainApplyDeps() {
       return { ok: false, category: body?.category, error: body?.error ?? res.error };
     },
     // Hotfix-coverage guard (#958): runs against the local clone via real git. manifestPaths exempts the
-    // release version fold (#976) ? a main-only commit touching ONLY the root package manifest is the
+    // release version fold (#976) — a main-only commit touching ONLY the root package manifest is the
     // fold's version metadata, which the candidate replaces with its own. (The Hub's wider distribution
     // set never reaches this guard: the Hub is direct-track.)
     hotfixCoverage: (input) => checkHotfixCoverage({ ...input, manifestPaths: ["package.json", "package-lock.json"] }),
@@ -42174,14 +42343,14 @@ function trainApplyDeps() {
       removeFile: (path2) => (0, import_promises11.unlink)(path2)
     }, args),
     // #4713 (I/O-boundary census): `null` used to mean BOTH "this project configures no edge domains"
-    // (a real answer) and "the registry read missed" ? so a release verdict printed an environments block
+    // (a real answer) and "the registry read missed" — so a release verdict printed an environments block
     // with no domains as though the project had none. The checked read separates them: an absent project
     // or an absent edgeDomains block still answers null; a FAILED read refuses by name, and the caller's
     // own best-effort catch degrades the block instead of the read pretending it saw an answer.
     fetchEdgeDomains: async (slug) => {
       const read = await fetchProjectBySlugChecked(slug, registryClientDeps(await loadConfig()));
       if (!read.ok) {
-        const message = `release environments: Hub registry read FAILED for ${slug} (${read.error}) ? edge domains are UNREAD, not absent`;
+        const message = `release environments: Hub registry read FAILED for ${slug} (${read.error}) \u2014 edge domains are UNREAD, not absent`;
         consoleIo.err(`mmi-cli: ${message}`);
         throw new Error(message);
       }
@@ -42203,13 +42372,13 @@ function renderDeployLine(d) {
   else if (d.runUrl) parts.push(`run ${d.runUrl}`);
   if (d.deployStatus === "success") parts.push("deploy: SUCCEEDED");
   else if (d.deployStatus === "failure") parts.push("deploy: FAILED (promotion stands; retry the deploy, do not re-tag)");
-  else if (d.runId != null) parts.push(`deploy: UNVERIFIED ? dispatched, not resolved (watch: gh run watch ${d.runId} --repo mutmutco/MMI-Hub --exit-status)`);
-  else if (d.workflowRuns?.length) parts.push("deploy: UNVERIFIED ? the runs above are enumerated, not resolved; watch each to conclusion before calling this release healthy (#3322)");
-  else parts.push("deploy: UNVERIFIED ? no run correlated or watched; resolve every workflow run on the release SHA before calling this release healthy (#3322)");
+  else if (d.runId != null) parts.push(`deploy: UNVERIFIED \u2014 dispatched, not resolved (watch: gh run watch ${d.runId} --repo mutmutco/MMI-Hub --exit-status)`);
+  else if (d.workflowRuns?.length) parts.push("deploy: UNVERIFIED \u2014 the runs above are enumerated, not resolved; watch each to conclusion before calling this release healthy (#3322)");
+  else parts.push("deploy: UNVERIFIED \u2014 no run correlated or watched; resolve every workflow run on the release SHA before calling this release healthy (#3322)");
   return parts.join("; ");
 }
 function renderReleaseResume(r) {
-  const lines = [`mmi-cli devops release --resume: ${r.repo} ${r.tag} (${r.tagSha.slice(0, 12)}) [${r.deployModel}] ? ${r.note}`];
+  const lines = [`mmi-cli devops release --resume: ${r.repo} ${r.tag} (${r.tagSha.slice(0, 12)}) [${r.deployModel}] \u2014 ${r.note}`];
   for (const step of r.steps) lines.push(`  - ${step}`);
   if (r.releaseUrl) lines.push(`  release: ${r.releaseUrl}`);
   if (r.announceNote) lines.push(`  announce: ${r.announceNote}`);
@@ -42219,23 +42388,23 @@ function renderReleaseResume(r) {
   return lines.join("\n");
 }
 function renderReleaseAbort(r) {
-  return `mmi-cli devops release --abort --apply: ${r.repo} ${r.tag} (${r.tagSha.slice(0, 12)}) ? ${r.note}`;
+  return `mmi-cli devops release --abort --apply: ${r.repo} ${r.tag} (${r.tagSha.slice(0, 12)}) \u2014 ${r.note}`;
 }
 function renderReleasePublishRetry(r) {
-  return `mmi-cli devops release --retry-publish: ${r.repo} ${r.tag} (${r.tagSha.slice(0, 12)}) ? ${r.note}; ${r.runUrl}`;
+  return `mmi-cli devops release --retry-publish: ${r.repo} ${r.tag} (${r.tagSha.slice(0, 12)}) \u2014 ${r.note}; ${r.runUrl}`;
 }
 function renderRcandResume(r) {
-  return `mmi-cli devops rcand --resume: promoted ${r.repo} ? rc at ${r.tag} (${r.tagSha.slice(0, 12)}) [${r.deployModel}]; ${renderDeployLine(r)}; ${r.note}`;
+  return `mmi-cli devops rcand --resume: promoted ${r.repo} \u2014 rc at ${r.tag} (${r.tagSha.slice(0, 12)}) [${r.deployModel}]; ${renderDeployLine(r)}; ${r.note}`;
 }
 function renderAlignment(label, alignment) {
   if (alignment.status !== "pr-pending") return `${label}: ${alignment.note}`;
   if (alignment.autoMergeEnqueued) {
     return `${label}: alignment PR #${alignment.prNumber ?? "?"} AUTO-MERGE ENQUEUED (merges when checks pass)${alignment.prUrl ? ` (${alignment.prUrl})` : ""}`;
   }
-  return `${label}: ALIGNMENT PR PENDING ? land it with \`mmi-cli devops pr merge ${alignment.prNumber ?? "<number>"} --auto --merge\`${alignment.prUrl ? ` (${alignment.prUrl})` : ""}`;
+  return `${label}: ALIGNMENT PR PENDING \u2014 land it with \`mmi-cli devops pr merge ${alignment.prNumber ?? "<number>"} --auto --merge\`${alignment.prUrl ? ` (${alignment.prUrl})` : ""}`;
 }
 function renderTrainApply(commandName, r) {
-  let base = `mmi-cli ${commandName}: promoted ${r.repo} ? ${r.stage} at ${r.tag} [${r.deployModel}]; ${renderDeployLine(r)}`;
+  let base = `mmi-cli ${commandName}: promoted ${r.repo} \u2014 ${r.stage} at ${r.tag} [${r.deployModel}]; ${renderDeployLine(r)}`;
   if (r.versionFold) base = `${base}; ${r.versionFold}`;
   if (r.resumeNote) base = `${base}; ${r.resumeNote}`;
   if (r.devNote) base = `${base}; ${r.devNote}`;
@@ -42298,16 +42467,16 @@ for (const commandName of ["rcand", "release"]) {
       return fail(`${commandName}: ${e.message}`);
     }
     if (o.ack && commandName !== "release") {
-      return fail(`${commandName}: --ack applies only to release ? it overrides the rc -> main hotfix-coverage guard, which rcand does not run. Run: mmi-cli devops release --ack <shas>`);
+      return fail(`${commandName}: --ack applies only to release \u2014 it overrides the rc -> main hotfix-coverage guard, which rcand does not run. Run: mmi-cli devops release --ack <shas>`);
     }
     if (o.dev && commandName !== "release") {
-      return fail(`${commandName}: --dev applies only to release ? it ships development -> main skipping rc, which rcand cannot do. Run: mmi-cli devops release --dev`);
+      return fail(`${commandName}: --dev applies only to release \u2014 it ships development -> main skipping rc, which rcand cannot do. Run: mmi-cli devops release --dev`);
     }
     if (o.announceSummaryFile && commandName !== "release") {
-      return fail(`${commandName}: --announce-summary-file applies only to release ? rcand posts no Hub Slack announcement. Run: mmi-cli devops release --announce-summary-file <path>`);
+      return fail(`${commandName}: --announce-summary-file applies only to release \u2014 rcand posts no Hub Slack announcement. Run: mmi-cli devops release --announce-summary-file <path>`);
     }
     if (o.abort && commandName !== "release") {
-      return fail(`${commandName}: --abort applies only to release ? it rolls back a proven unpublished Hub release tag. Run: mmi-cli devops release --abort --apply`);
+      return fail(`${commandName}: --abort applies only to release \u2014 it rolls back a proven unpublished Hub release tag. Run: mmi-cli devops release --abort --apply`);
     }
     if (o.retryPublish && commandName !== "release") {
       return fail(`${commandName}: --retry-publish applies only to release. Run: mmi-cli devops release --retry-publish <run-id> --apply --watch`);
@@ -42337,7 +42506,7 @@ for (const commandName of ["rcand", "release"]) {
       }
     }
     if (o.abort) {
-      if (o.resume) return fail("release: --abort and --resume are mutually exclusive ? abort removes an unpublished tag while resume preserves and promotes it");
+      if (o.resume) return fail("release: --abort and --resume are mutually exclusive \u2014 abort removes an unpublished tag while resume preserves and promotes it");
       if (!o.apply) return fail("release: --abort requires --apply after explicit approval; nothing was written");
       if (o.watch || o.announceSummaryFile || o.ack || o.dev) {
         return fail("release: --abort accepts only --apply, --repo and --json; promotion flags cannot be combined with rollback");
@@ -42354,7 +42523,7 @@ for (const commandName of ["rcand", "release"]) {
       }
     }
     if (o.resume) {
-      if (o.apply) return fail(`${commandName}: --resume and --apply are mutually exclusive ? --apply cuts the NEXT version, --resume finishes the immutable tag already on origin`);
+      if (o.apply) return fail(`${commandName}: --resume and --apply are mutually exclusive \u2014 --apply cuts the NEXT version, --resume finishes the immutable tag already on origin`);
       try {
         if (commandName === "rcand") {
           const result2 = await runRcandResume(trainApplyDeps(), { watch: o.watch });
@@ -42410,7 +42579,7 @@ for (const commandName of ["rcand", "release"]) {
             projectInfoSync = await runProjectInfoSync(result.repo, true);
           } catch (e) {
             const error = e.message;
-            projectInfoSync = { applied: false, note: `FAILED ? ${error}`, error };
+            projectInfoSync = { applied: false, note: `FAILED \u2014 ${error}`, error };
           }
         }
         const alignmentPending = result.devRollForward?.status === "pr-pending" || result.rcAlignment?.status === "pr-pending";
@@ -42452,7 +42621,7 @@ for (const commandName of ["rcand", "release"]) {
       }
       if (!read.ok) {
         return failGraceful(
-          `${commandName}: Hub registry read failed for ${slugOf(repo)} (${read.error}) ? the release track behind this plan is unproven, and a dry-run plan built on the isHub fallback would name the wrong branches. Likely transient (cold start, network, or auth blip); retry shortly.`
+          `${commandName}: Hub registry read failed for ${slugOf(repo)} (${read.error}) \u2014 the release track behind this plan is unproven, and a dry-run plan built on the isHub fallback would name the wrong branches. Likely transient (cold start, network, or auth blip); retry shortly.`
         );
       }
       const raw = read.project?.releaseTrack;
@@ -42478,13 +42647,13 @@ function renderHotfixRelease(r) {
     `  - ${r.verifyNote}`,
     ...r.announceNote ? [`  - announce: ${r.announceNote}`] : [],
     `  - fold: ${r.foldNote}`,
-    `  - next: mmi-cli devops hotfix status ${r.tag} (no back-merge of the FIX ? development already has it; the version fold above is ported for you, #4410)`
+    `  - next: mmi-cli devops hotfix status ${r.tag} (no back-merge of the FIX \u2014 development already has it; the version fold above is ported for you, #4410)`
   ].join("\n");
 }
 function renderHotfixStatus(r) {
   return [
-    `mmi-cli devops hotfix status: ${r.tag} on ${r.repo} ? ${r.state}`,
-    `  - branch: ${r.branchExists ? "pushed" : "absent"} ? PR: ${r.pr ? `#${r.pr.number} ${r.pr.state}` : "none"} ? tag: ${r.tagPushed ? "pushed" : "absent"} ? Release: ${r.releaseExists ? "exists" : "absent"}`,
+    `mmi-cli devops hotfix status: ${r.tag} on ${r.repo} \u2014 ${r.state}`,
+    `  - branch: ${r.branchExists ? "pushed" : "absent"} \u2014 PR: ${r.pr ? `#${r.pr.number} ${r.pr.state}` : "none"} \u2014 tag: ${r.tagPushed ? "pushed" : "absent"} \u2014 Release: ${r.releaseExists ? "exists" : "absent"}`,
     ...r.runs.map((run) => `  - ${run.workflow}: ${run.conclusion}${run.url ? ` (${run.url})` : ""}`),
     `  - npm @mutmutco/cli: ${r.npmVersion}`,
     `  - next: ${r.next}`,
@@ -42514,13 +42683,13 @@ async function runHotfixSub(sub, body, json, render) {
     return failGraceful(`hotfix ${sub}: ${e.message}`);
   }
 }
-var hotfixCmd = program2.command("hotfix").description("stepwise hotfix orchestrator: start ? release, with status (bare command prints the dry-run plan; no back-merge ? #839)").option("--json", "machine-readable output").option("--apply", "not a verb; use the hotfix subcommands (start/release/status)").action(async (o) => {
+var hotfixCmd = program2.command("hotfix").description("stepwise hotfix orchestrator: start \u2014 release, with status (bare command prints the dry-run plan; no back-merge \u2014 #839)").option("--json", "machine-readable output").option("--apply", "not a verb; use the hotfix subcommands (start/release/status)").action(async (o) => {
   try {
     await requireFreshTrainCli("hotfix");
   } catch (e) {
     return fail(`hotfix: ${e.message}`);
   }
-  if (o.apply) return fail("hotfix: use the stepwise subcommands ? mmi-cli devops hotfix start --from <pr#|sha> ? release <vX.Y.Z> ? status [vX.Y.Z]");
+  if (o.apply) return fail("hotfix: use the stepwise subcommands \u2014 mmi-cli devops hotfix start --from <pr#|sha> \u2014 release <vX.Y.Z> \u2014 status [vX.Y.Z]");
   const steps = trainPlan("hotfix");
   console.log(o.json ? JSON.stringify({ command: "hotfix", steps }, null, 2) : renderSteps("mmi-cli devops hotfix: dry-run plan", steps));
 });
@@ -42552,7 +42721,7 @@ ci.command("audit").description("read-only fleet scan: gate workflow, ruleset co
   else console.log(renderCiAuditText(report));
   if (!report.ok) process.exitCode = 1;
 });
-ci.command("reconcile").description("audit + optionally apply merge settings and product ruleset activation (master-admin)").option("--json", "machine-readable output").option("--repo <owner/repo>", "reconcile one repo instead of the full registry").option("--apply", "PATCH merge settings + activate product ruleset when missing (master role required); activation is skipped while the repo's gate has never passed (#3694)").option("--park-ruleset", "stop the product ruleset enforcing without deleting it ? keeps its required contexts (master role required)").action(async (o) => {
+ci.command("reconcile").description("audit + optionally apply merge settings and product ruleset activation (master-admin)").option("--json", "machine-readable output").option("--repo <owner/repo>", "reconcile one repo instead of the full registry").option("--apply", "PATCH merge settings + activate product ruleset when missing (master role required); activation is skipped while the repo's gate has never passed (#3694)").option("--park-ruleset", "stop the product ruleset enforcing without deleting it \u2014 keeps its required contexts (master role required)").action(async (o) => {
   if (o.apply && o.parkRuleset) {
     return fail("ci reconcile: --apply and --park-ruleset ask for opposite things; pass one");
   }
@@ -42575,7 +42744,7 @@ ci.command("reconcile").description("audit + optionally apply merge settings and
 ${r.repo}: applied=[${r.applied.join("; ")}] skipped=[${r.skipped.join("; ")}]${r.errors.length ? ` errors=[${r.errors.join("; ")}]` : ""}`);
       }
     } else {
-      console.log("\nDry-run ? re-run with --apply to patch merge settings and activate product rulesets (master-admin).");
+      console.log("\nDry-run \u2014 re-run with --apply to patch merge settings and activate product rulesets (master-admin).");
     }
   }
   const applyFailed = applyResults.some((result) => result.errors.length > 0 || result.postApply?.state === "failed");
@@ -42603,7 +42772,7 @@ access.command("role [repo]").description("D14 train authority for a repo (serve
     if (!a.train) process.exitCode = 1;
     return;
   }
-  console.log(`${a.repo}: @${a.login} is ${a.role} ? train ${a.train ? "AUTHORIZED" : "not authorized"}${a.hubTrainMasterOnly ? " (Hub train is master-only)" : ""}`);
+  console.log(`${a.repo}: @${a.login} is ${a.role} \u2014 train ${a.train ? "AUTHORIZED" : "not authorized"}${a.hubTrainMasterOnly ? " (Hub train is master-only)" : ""}`);
   if (!a.train) process.exitCode = 1;
 });
 access.command("audit").description("audit collaborator roles + train-branch push allowlists vs the locked state; read-only, emits gh remediation, never applies").option("--json", "machine-readable output").option("--repo <owner/repo>", "audit a single repo instead of the whole org").option("--class <class>", "repo class for --repo (deployable | content)", "deployable").action(async () => {
@@ -42638,9 +42807,9 @@ access.command("audit").description("audit collaborator roles + train-branch pus
   console.log(o.json ? JSON.stringify(report, null, 2) : renderAccessReport(report));
   if (!report.ok) process.exitCode = 1;
 });
-access.command("capabilities").description("enumerate your effective vault reach ? every credential NAME + tier + scope you can read/use across project + org/master tiers (names only, no values) (#1615)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--json", "machine-readable output").action((o) => withSecrets((d) => secretsCapabilities(d, o)));
+access.command("capabilities").description("enumerate your effective vault reach \u2014 every credential NAME + tier + scope you can read/use across project + org/master tiers (names only, no values) (#1615)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--json", "machine-readable output").action((o) => withSecrets((d) => secretsCapabilities(d, o)));
 var isWin2 = process.platform === "win32";
-program2.command("doctor").description("heal CLI/plugin wiring and clean up repo cruft ? repairs run by default (#3975); use --verbose for the full audit checklist").option("--banner", "one-line resume summary; silent when all gates pass").option("--fast", "offline-safe fast lane; read-only, skips slow checks and network probes").option("--preflight", "read-only fast gate for automation: measures and reports with the shared exit code, zero writes (#4199, canon); heal env drift with a plain run or --no-repo-writes").option("--verbose", "print the evidence behind every check ? probes, resolved paths, versions compared, and the names behind each count (#2977)").option("--guide", "print the MMI Agentic Onboarding guide URL").option("--json", "machine-readable output (an output format ? repairs still run by lane)").option("--apply", "deprecated no-op: repairs run by default now (#3975); kept so older instructions still parse").option("--no-repo-writes", "env/plugin repairs only ? never mutate the repo working tree; report pending managed .gitignore repairs with the follow-up command (for train preflights)").option("--self", "verify CLI/plugin version parity and gh auth reach; suggests plugin-heal on a hard gap (reads the published version, so not offline-safe) (#2689)").addHelpText("after", "\nExit codes:\n  0  no hard gaps remain; advisory gaps may exist\n  1  one or more included hard checks failed\n\nA plain run heals env drift (CLI, plugin, marketplace pins) and cleans repo cruft (gitignore block,\nmerged branches, dead worktrees, aged scratch) automatically (#3975). --no-repo-writes keeps the\nworking tree untouched for train preflights; --banner/--fast/--self are read-only lanes.\n\n--banner keeps the legacy SessionStart contract and returns 0 unless the process crashes.\n").action(async (opts) => {
+program2.command("doctor").description("heal CLI/plugin wiring and clean up repo cruft \u2014 repairs run by default (#3975); use --verbose for the full audit checklist").option("--banner", "one-line resume summary; silent when all gates pass").option("--fast", "offline-safe fast lane; read-only, skips slow checks and network probes").option("--preflight", "read-only fast gate for automation: measures and reports with the shared exit code, zero writes (#4199, canon); heal env drift with a plain run or --no-repo-writes").option("--verbose", "print the evidence behind every check \u2014 probes, resolved paths, versions compared, and the names behind each count (#2977)").option("--guide", "print the MMI Agentic Onboarding guide URL").option("--json", "machine-readable output (an output format \u2014 repairs still run by lane)").option("--apply", "deprecated no-op: repairs run by default now (#3975); kept so older instructions still parse").option("--no-repo-writes", "env/plugin repairs only \u2014 never mutate the repo working tree; report pending managed .gitignore repairs with the follow-up command (for train preflights)").option("--self", "verify CLI/plugin version parity and gh auth reach; suggests plugin-heal on a hard gap (reads the published version, so not offline-safe) (#2689)").addHelpText("after", "\nExit codes:\n  0  no hard gaps remain; advisory gaps may exist\n  1  one or more included hard checks failed\n\nA plain run heals env drift (CLI, plugin, marketplace pins) and cleans repo cruft (gitignore block,\nmerged branches, dead worktrees, aged scratch) automatically (#3975). --no-repo-writes keeps the\nworking tree untouched for train preflights; --banner/--fast/--self are read-only lanes.\n\n--banner keeps the legacy SessionStart contract and returns 0 unless the process crashes.\n").action(async (opts) => {
   if (opts.guide) {
     consoleIo.log("MMI Agentic Onboarding: docs/Architecture/agentic-dev-environment.md");
     return;
@@ -42794,7 +42963,7 @@ program2.command("plugin-release-catchup").description("install a newer released
 });
 program2.command("session-start").description("run the SessionStart verbs (whoami, board slice, doctor) in one process").action(async () => {
   if (isInsideRepoSubdir(process.cwd())) {
-    console.error("[mmi-hook] plugin session-start: cwd is a repository SUBDIRECTORY ? skipping the SessionStart hook (spine/docs/plan/saga delivery); run it from the repo root.");
+    console.error("[mmi-hook] plugin session-start: cwd is a repository SUBDIRECTORY \u2014 skipping the SessionStart hook (spine/docs/plan/saga delivery); run it from the repo root.");
     appendHookActivity(process.cwd(), { event: "SessionStart", script: "session-start", outcome: "ran", action: "skip (repo subdirectory)" });
     return;
   }
@@ -42807,7 +42976,7 @@ program2.command("session-start").description("run the SessionStart verbs (whoam
   const bannerIo = measured.io;
   const { parallel, sequential } = buildSessionStartPlan({
     // whoami (#879): surface the resolved human so agents act --for them without asking. Silent
-    // when unknown ? a missing gh login must not noise or fail the banner.
+    // when unknown — a missing gh login must not noise or fail the banner.
     whoami: async (io) => {
       const report = await resolveWhoami({
         hubSession: async () => hubAuthSession({ baseUrl: (await loadConfig()).sagaApiUrl ?? defaultHubUrl(), githubToken }),
@@ -42819,14 +42988,14 @@ program2.command("session-start").description("run the SessionStart verbs (whoam
       if (authority) io.log(authority);
     },
     // command-ladder hint (#2609): compact gh?mmi-cli cheat sheet so agents reach for mmi-cli first,
-    // not after a denied gh call. <1KB, pure in-memory ? no network, no fs, fail-soft.
+    // not after a denied gh call. <1KB, pure in-memory — no network, no fs, fail-soft.
     commandLadderHint: async (io) => {
       const hint = commandLadderHint();
       if (hint) io.log(hint);
     },
     // stale worktrees: fast LOCAL-only git check (worktree list + branch -vv gone status). Flags leaked
     // worktrees / merged-but-undeleted branches so the session never starts atop leftover state. No
-    // network ? never the ~20s `gh pr list` path of `worktree list --stale`. Fail-soft.
+    // network — never the ~20s `gh pr list` path of `worktree list --stale`. Fail-soft.
     staleWorktrees: async (io) => {
       const line = await gatherStaleWorktreeWarning();
       if (line) io.log(line);
@@ -42839,7 +43008,7 @@ program2.command("session-start").description("run the SessionStart verbs (whoam
       const line = localTrainSyncBannerLine(result);
       if (line) io.log(line);
     },
-    // #3485 item 7: the ONLY lane that throttles the npm read ? it runs on every session start, on a
+    // #3485 item 7: the ONLY lane that throttles the npm read — it runs on every session start, on a
     // blocking hook. Every interactive lane still reads live.
     doctor: async (io) => {
       await runDoctorClean({ banner: true }, io, mmiDoctorDeps({ throttleReleasedRead: true, program: program2 }));
@@ -42849,11 +43018,11 @@ program2.command("session-start").description("run the SessionStart verbs (whoam
   for (const line of scratchGcLines(process.cwd())) bannerIo.log(line);
   const worktreeBanner = worktreeAutoProvisionBanner(process.cwd());
   if (worktreeBanner) {
-    spawnDetachedSelf(["worktree", "setup", "--quiet"], { spawn: import_node_child_process19.spawn, execPath: process.execPath, scriptPath: process.argv[1] });
+    spawnDetachedSelf(["worktree", "setup", "--quiet"], { spawn: import_node_child_process20.spawn, execPath: process.execPath, scriptPath: process.argv[1] });
     bannerIo.log(worktreeBanner);
   }
   if (shouldSpawnReleaseCatchup((0, import_node_os19.homedir)(), process.env, readReleaseCatchupState)) {
-    spawnDetachedSelf(["plugin", "release-catchup", "--quiet"], { spawn: import_node_child_process19.spawn, execPath: process.execPath, scriptPath: process.argv[1] });
+    spawnDetachedSelf(["plugin", "release-catchup", "--quiet"], { spawn: import_node_child_process20.spawn, execPath: process.execPath, scriptPath: process.argv[1] });
   }
   if (isLinkedWorktree(process.cwd())) {
     const primaryRoot = await primaryCheckoutRoot(process.cwd());