@mutmutco/cli 3.117.1 → 3.119.0

package/dist/main.cjs

@@ -5000,7 +5000,7 @@ var program = new Command();
 
 // src/index.ts
 var import_promises11 = require("node:fs/promises");
-var import_node_fs46 = require("node:fs");
+var import_node_fs47 = require("node:fs");
 var import_node_child_process20 = require("node:child_process");
 
 // src/cli-shared.ts
@@ -8708,6 +8708,40 @@ function cachedReadNote(cachedAt, now = Date.now()) {
   return `(cached ${hours < 1 ? "<1" : hours}h ago \u2014 the banner reads npm at most once a day)`;
 }
 
+// src/schedules-drift-cache.ts
+var import_node_fs13 = require("node:fs");
+var import_node_path11 = require("node:path");
+var SCHEDULES_DRIFT_CACHE_MS = 6 * 36e5;
+function schedulesDriftCachePath(runtimeRoot) {
+  return (0, import_node_path11.join)(runtimeRoot, "head-ts", ".schedules-drift");
+}
+function readSchedulesDriftCache(cachePath, now = Date.now(), read = import_node_fs13.readFileSync) {
+  let parsed;
+  try {
+    parsed = JSON.parse(read(cachePath, "utf8"));
+  } catch {
+    return void 0;
+  }
+  if (!parsed || typeof parsed !== "object") return void 0;
+  const { driftLines, at } = parsed;
+  if (!Array.isArray(driftLines) || driftLines.some((l) => typeof l !== "string")) return void 0;
+  if (typeof at !== "number" || !Number.isFinite(at)) return void 0;
+  const age = now - at;
+  if (age < 0 || age >= SCHEDULES_DRIFT_CACHE_MS) return void 0;
+  return { driftLines, at };
+}
+function writeSchedulesDriftCache(cachePath, driftLines, now = Date.now()) {
+  try {
+    (0, import_node_fs13.mkdirSync)((0, import_node_path11.dirname)(cachePath), { recursive: true });
+    (0, import_node_fs13.writeFileSync)(cachePath, JSON.stringify({ driftLines, at: now }), "utf8");
+  } catch {
+  }
+}
+function cachedSweepNote(cachedAt, now = Date.now()) {
+  const hours = cacheAgeHours(cachedAt, now);
+  return `cached ${hours < 1 ? "<1" : hours}h ago \u2014 doctor sweeps the org notebook at most every ${SCHEDULES_DRIFT_CACHE_MS / 36e5}h (run \`mmi-cli harbour org schedules\` for a live read)`;
+}
+
 // src/marketplace-autoupdate.ts
 var KNOWN_MARKETPLACES_RELATIVE = [".claude", "plugins", "known_marketplaces.json"];
 var MMI_MARKETPLACE_NAME = "mutmutco";
@@ -8919,8 +8953,8 @@ function marketplaceRows(name, known, settings, remedy = "manual") {
 }
 
 // src/hook-activity.ts
-var import_node_fs13 = require("node:fs");
-var import_node_path11 = require("node:path");
+var import_node_fs14 = require("node:fs");
+var import_node_path12 = require("node:path");
 var DEFAULT_SURFACE = "claude";
 function activityLogPath(cwd) {
   return repoRuntimeStatePath(cwd, "hooks", "activity.jsonl");
@@ -8933,20 +8967,20 @@ function appendHookActivity(cwd, entry) {
       surface: DEFAULT_SURFACE,
       ...entry
     };
-    (0, import_node_fs13.mkdirSync)((0, import_node_path11.dirname)(path2), { recursive: true });
-    (0, import_node_fs13.appendFileSync)(path2, `${JSON.stringify(line)}
+    (0, import_node_fs14.mkdirSync)((0, import_node_path12.dirname)(path2), { recursive: true });
+    (0, import_node_fs14.appendFileSync)(path2, `${JSON.stringify(line)}
 `, "utf8");
   } catch {
   }
 }
 
 // src/worktree.ts
-var import_node_fs14 = require("node:fs");
-var import_node_path13 = require("node:path");
+var import_node_fs15 = require("node:fs");
+var import_node_path14 = require("node:path");
 
 // src/file-lock.ts
 var import_promises2 = require("node:fs/promises");
-var import_node_path12 = require("node:path");
+var import_node_path13 = require("node:path");
 var sleep = (ms) => new Promise((resolve5) => setTimeout(resolve5, ms));
 var IMMEDIATE_RETRY_BUDGET = 3;
 var FileLockBusyError = class extends Error {
@@ -9031,7 +9065,7 @@ async function releaseFileLock(lockPath, guard) {
 }
 async function withFileLock(lockPath, opts, fn) {
   const resolved = resolveFileLockOpts(opts);
-  await (0, import_promises2.mkdir)((0, import_node_path12.dirname)(lockPath), { recursive: true }).catch(() => void 0);
+  await (0, import_promises2.mkdir)((0, import_node_path13.dirname)(lockPath), { recursive: true }).catch(() => void 0);
   const guard = await acquireFileLock(lockPath, resolved, Date.now() + resolved.maxWaitMs);
   try {
     return await fn();
@@ -9058,35 +9092,35 @@ var PROVISION_ENV_MARKER = "MMI_PROVISION_RUNNING";
 var realFsProbe = {
   isDir: (p) => {
     try {
-      return (0, import_node_fs14.statSync)(p).isDirectory();
+      return (0, import_node_fs15.statSync)(p).isDirectory();
     } catch {
       return false;
     }
   },
   isFile: (p) => {
     try {
-      return (0, import_node_fs14.statSync)(p).isFile();
+      return (0, import_node_fs15.statSync)(p).isFile();
     } catch {
       return false;
     }
   },
   listDirs: (p) => {
     try {
-      return (0, import_node_fs14.readdirSync)(p, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name);
+      return (0, import_node_fs15.readdirSync)(p, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name);
     } catch {
       return [];
     }
   },
   readFile: (p) => {
     try {
-      return (0, import_node_fs14.readFileSync)(p, "utf8");
+      return (0, import_node_fs15.readFileSync)(p, "utf8");
     } catch {
       return void 0;
     }
   }
 };
 function declaredProvision(fs2, abs) {
-  const raw = fs2.readFile?.((0, import_node_path13.join)(abs, PKG));
+  const raw = fs2.readFile?.((0, import_node_path14.join)(abs, PKG));
   if (raw === void 0) return void 0;
   try {
     const scripts = JSON.parse(raw).scripts;
@@ -9098,13 +9132,13 @@ function declaredProvision(fs2, abs) {
 }
 function scanInstallDirs(root, fs2 = realFsProbe) {
   const factsFor = (dir) => {
-    const abs = dir ? (0, import_node_path13.join)(root, dir) : root;
-    const match = LOCKFILE_INSTALLS.find((c) => fs2.isFile((0, import_node_path13.join)(abs, c.lockfile)));
-    const hasPackageJson = fs2.isFile((0, import_node_path13.join)(abs, PKG));
+    const abs = dir ? (0, import_node_path14.join)(root, dir) : root;
+    const match = LOCKFILE_INSTALLS.find((c) => fs2.isFile((0, import_node_path14.join)(abs, c.lockfile)));
+    const hasPackageJson = fs2.isFile((0, import_node_path14.join)(abs, PKG));
     return {
       dir,
       hasPackageJson,
-      hasNodeModules: fs2.isDir((0, import_node_path13.join)(abs, NODE_MODULES)),
+      hasNodeModules: fs2.isDir((0, import_node_path14.join)(abs, NODE_MODULES)),
       install: match?.command,
       provision: hasPackageJson ? declaredProvision(fs2, abs) : void 0
     };
@@ -9120,7 +9154,7 @@ function npmInstallTargets(dirs) {
   }));
 }
 function isLinkedWorktree(root, fs2 = realFsProbe) {
-  return fs2.isFile((0, import_node_path13.join)(root, ".git"));
+  return fs2.isFile((0, import_node_path14.join)(root, ".git"));
 }
 function worktreeAutoProvisionBanner(root, fs2 = realFsProbe) {
   if (!isLinkedWorktree(root, fs2)) return null;
@@ -9130,8 +9164,8 @@ function worktreeAutoProvisionBanner(root, fs2 = realFsProbe) {
   return `[worktree] provisioning tooling in the background (deps in ${where} + local config) \u2014 \`mmi-cli worktree setup\` to redo`;
 }
 function defaultCopyFile(from, to) {
-  (0, import_node_fs14.mkdirSync)((0, import_node_path13.dirname)(to), { recursive: true });
-  (0, import_node_fs14.copyFileSync)(from, to);
+  (0, import_node_fs15.mkdirSync)((0, import_node_path14.dirname)(to), { recursive: true });
+  (0, import_node_fs15.copyFileSync)(from, to);
 }
 async function runDeclaredProvision(target, cwd, runInstall) {
   const previous = process.env[PROVISION_ENV_MARKER];
@@ -9161,7 +9195,7 @@ async function provisionWorktree(worktreeRoot, deps) {
   const targets = npmInstallTargets(allDirs);
   if (deps.validateInstall) {
     for (const dir of allDirs.filter((d) => d.hasPackageJson && (d.provision ?? d.install) && d.hasNodeModules)) {
-      const cwd = dir.dir ? (0, import_node_path13.join)(worktreeRoot, dir.dir) : worktreeRoot;
+      const cwd = dir.dir ? (0, import_node_path14.join)(worktreeRoot, dir.dir) : worktreeRoot;
       if (!await deps.validateInstall(cwd)) {
         targets.push({
           dir: dir.dir,
@@ -9175,7 +9209,7 @@ async function provisionWorktree(worktreeRoot, deps) {
   const skippedInstall = allDirs.filter((d) => d.hasPackageJson && d.hasNodeModules && !targetDirs.has(d.dir)).map((d) => d.dir);
   const installed = [];
   for (const target of targets) {
-    const cwd = target.dir ? (0, import_node_path13.join)(worktreeRoot, target.dir) : worktreeRoot;
+    const cwd = target.dir ? (0, import_node_path14.join)(worktreeRoot, target.dir) : worktreeRoot;
     log(`installing deps: ${target.command} in ${target.dir || "."}`);
     if (target.declared) await runDeclaredProvision(target, cwd, deps.runInstall);
     else await deps.runInstall(target.command, cwd);
@@ -9185,7 +9219,7 @@ async function provisionWorktree(worktreeRoot, deps) {
   const copySkipped = [];
   const primary = await deps.primaryCheckout();
   for (const rel of LOCAL_ONLY_FILES) {
-    const dest = (0, import_node_path13.join)(worktreeRoot, rel);
+    const dest = (0, import_node_path14.join)(worktreeRoot, rel);
     if (fs2.isFile(dest)) {
       copySkipped.push({ file: rel, reason: "already-present" });
       continue;
@@ -9194,11 +9228,11 @@ async function provisionWorktree(worktreeRoot, deps) {
       copySkipped.push({ file: rel, reason: "no-primary" });
       continue;
     }
-    if (!fs2.isFile((0, import_node_path13.join)(primary, rel))) {
+    if (!fs2.isFile((0, import_node_path14.join)(primary, rel))) {
       copySkipped.push({ file: rel, reason: "absent-in-primary" });
       continue;
     }
-    copyFile((0, import_node_path13.join)(primary, rel), dest);
+    copyFile((0, import_node_path14.join)(primary, rel), dest);
     copied.push(rel);
     log(`copied local config: ${rel}`);
   }
@@ -9212,12 +9246,12 @@ function capWorktreeDirName(name, max = 40) {
 }
 function defaultWorktreePath(repoRoot2, branch) {
   const safe = capWorktreeDirName(branch.replace(/[/\\]+/g, "-"));
-  return (0, import_node_path13.join)((0, import_node_path13.dirname)(repoRoot2), "mmi-worktrees", (0, import_node_path13.basename)(repoRoot2), safe);
+  return (0, import_node_path14.join)((0, import_node_path14.dirname)(repoRoot2), "mmi-worktrees", (0, import_node_path14.basename)(repoRoot2), safe);
 }
 async function primaryCheckoutRootOf(git2) {
   try {
     const out = (await git2(["rev-parse", "--path-format=absolute", "--git-common-dir"])).trim();
-    return out ? (0, import_node_path13.dirname)(out) : void 0;
+    return out ? (0, import_node_path14.dirname)(out) : void 0;
   } catch {
     return void 0;
   }
@@ -9355,7 +9389,7 @@ function commandLadderHint() {
 }
 
 // src/index.ts
-var import_node_path43 = require("node:path");
+var import_node_path44 = require("node:path");
 
 // src/merge-ci-policy.ts
 function resolveMergeCiPolicy(input) {
@@ -10015,13 +10049,13 @@ function planManagedGitignore(current) {
 }
 
 // src/docs-index-command.ts
-var import_node_fs16 = require("node:fs");
-var import_node_path15 = require("node:path");
+var import_node_fs17 = require("node:fs");
+var import_node_path16 = require("node:path");
 
 // src/doc-refs-core.ts
 var import_node_child_process5 = require("node:child_process");
-var import_node_fs15 = require("node:fs");
-var import_node_path14 = require("node:path");
+var import_node_fs16 = require("node:fs");
+var import_node_path15 = require("node:path");
 var PIN_RE = /<!--\s*pinned by\s+([^:]+?)\s*:\s*"([^"]+)"[^"]*-->/;
 var PIN_MENTION_RE = /<!--\s*pinned by\b/;
 var FWD_RE = /<!--\s*forward-ref:\s*(\S+?)\s*-->/;
@@ -10080,7 +10114,7 @@ function checkPins(root, readFile9, docs2) {
         findings.push({ kind: "malformed-pin", doc, line: pin.line, detail: pin.text });
         continue;
       }
-      const source = readFile9((0, import_node_path14.join)(root, pin.file));
+      const source = readFile9((0, import_node_path15.join)(root, pin.file));
       if (source == null) {
         findings.push({ kind: "missing-test", doc, line: pin.line, detail: pin.file });
         continue;
@@ -10142,11 +10176,11 @@ function checkRefs(root, deps, docs2) {
     for (const { ref } of extractRefs(markdown)) allFirstSegments.add(refFirstSegment(ref));
   }
   const tracked = allFirstSegments.size ? deps.trackedFirstSegments?.([...allFirstSegments]) ?? null : null;
-  const firstVerifiable = (first) => tracked ? tracked.has(first) : exists((0, import_node_path14.join)(root, first));
+  const firstVerifiable = (first) => tracked ? tracked.has(first) : exists((0, import_node_path15.join)(root, first));
   const candidates = [];
   const direct = [];
   for (const [doc, markdown] of Object.entries(docs2)) {
-    const docDir = import_node_path14.posix.dirname(doc);
+    const docDir = import_node_path15.posix.dirname(doc);
     const base = docDir === "." ? "" : docDir;
     const covered = /* @__PURE__ */ new Set();
     const markers = [];
@@ -10155,21 +10189,21 @@ function checkRefs(root, deps, docs2) {
         direct.push({ kind: "malformed-forward-ref", doc, line: fwd.line, detail: fwd.text });
         continue;
       }
-      const docRel = import_node_path14.posix.normalize(import_node_path14.posix.join(base, fwd.target));
-      const rootRel = import_node_path14.posix.normalize(fwd.target.replace(/^\/+/, ""));
+      const docRel = import_node_path15.posix.normalize(import_node_path15.posix.join(base, fwd.target));
+      const rootRel = import_node_path15.posix.normalize(fwd.target.replace(/^\/+/, ""));
       markers.push({ target: fwd.target, line: fwd.line, docRel, rootRel });
       covered.add(docRel);
       covered.add(rootRel);
     }
     const links = extractLinks(markdown).map(({ target, line }) => {
-      const resolved = import_node_path14.posix.normalize(import_node_path14.posix.join(base, target));
-      return { target, line, resolved, missing: !exists((0, import_node_path14.join)(root, resolved)) };
+      const resolved = import_node_path15.posix.normalize(import_node_path15.posix.join(base, target));
+      return { target, line, resolved, missing: !exists((0, import_node_path15.join)(root, resolved)) };
     });
     for (const marker of markers) {
       const coversMissing = links.some(
         (l) => l.missing && (l.resolved === marker.docRel || l.resolved === marker.rootRel)
       );
-      if (!coversMissing && (exists((0, import_node_path14.join)(root, marker.docRel)) || exists((0, import_node_path14.join)(root, marker.rootRel)))) {
+      if (!coversMissing && (exists((0, import_node_path15.join)(root, marker.docRel)) || exists((0, import_node_path15.join)(root, marker.rootRel)))) {
         direct.push({
           kind: "stale-forward-ref",
           doc,
@@ -10180,7 +10214,7 @@ function checkRefs(root, deps, docs2) {
     }
     for (const { ref, line } of extractRefs(markdown)) {
       if (!firstVerifiable(refFirstSegment(ref))) continue;
-      if (!exists((0, import_node_path14.join)(root, ref))) candidates.push({ kind: "missing-path", doc, line, detail: ref });
+      if (!exists((0, import_node_path15.join)(root, ref))) candidates.push({ kind: "missing-path", doc, line, detail: ref });
     }
     for (const { target, line, resolved, missing } of links) {
       if (resolved.startsWith("..")) {
@@ -10228,22 +10262,22 @@ function checkCommands(docs2, commandPaths) {
   return { ok: findings.length === 0, findings, warnings: [] };
 }
 function readFileOrNull(path2) {
-  return (0, import_node_fs15.existsSync)(path2) ? (0, import_node_fs15.readFileSync)(path2, "utf8") : null;
+  return (0, import_node_fs16.existsSync)(path2) ? (0, import_node_fs16.readFileSync)(path2, "utf8") : null;
 }
 function walk(dir, root, out) {
-  for (const entry of (0, import_node_fs15.readdirSync)(dir)) {
-    const full = (0, import_node_path14.join)(dir, entry);
-    if ((0, import_node_fs15.statSync)(full).isDirectory()) walk(full, root, out);
+  for (const entry of (0, import_node_fs16.readdirSync)(dir)) {
+    const full = (0, import_node_path15.join)(dir, entry);
+    if ((0, import_node_fs16.statSync)(full).isDirectory()) walk(full, root, out);
     else if (entry.endsWith(".md")) out.push(full.slice(root.length + 1).replaceAll("\\", "/"));
   }
   return out;
 }
 function defaultListDocs(root) {
-  const docsDir = (0, import_node_path14.join)(root, "docs");
-  const docs2 = ((0, import_node_fs15.existsSync)(docsDir) ? walk(docsDir, root, []) : []).filter(
+  const docsDir = (0, import_node_path15.join)(root, "docs");
+  const docs2 = ((0, import_node_fs16.existsSync)(docsDir) ? walk(docsDir, root, []) : []).filter(
     (rel) => !SKIP_WALK.some((skip) => rel.startsWith(skip))
   );
-  return [...ROOT_DOCS.filter((rel) => (0, import_node_fs15.existsSync)((0, import_node_path14.join)(root, rel))), ...docs2];
+  return [...ROOT_DOCS.filter((rel) => (0, import_node_fs16.existsSync)((0, import_node_path15.join)(root, rel))), ...docs2];
 }
 var CHECK_IGNORE_MAX_BUFFER = 32 * 1024 * 1024;
 function defaultIsIgnored(root, relPaths, exec = import_node_child_process5.execFileSync) {
@@ -10295,7 +10329,7 @@ function defaultTrackedFirstSegments(root, firstSegments, exec = import_node_chi
 }
 function runDocRefs(root, deps = {}) {
   const readFile9 = deps.readFile ?? readFileOrNull;
-  const exists = deps.exists ?? import_node_fs15.existsSync;
+  const exists = deps.exists ?? import_node_fs16.existsSync;
   const listDocs = deps.listDocs ?? defaultListDocs;
   const isIgnored = deps.isIgnored ?? ((paths) => defaultIsIgnored(root, paths));
   const trackedFirstSegments = deps.trackedFirstSegments ?? ((segs) => defaultTrackedFirstSegments(root, segs));
@@ -10303,7 +10337,7 @@ function runDocRefs(root, deps = {}) {
   const walked = listDocs(root);
   const ignoredDocs = walked.length ? isIgnored(walked) : /* @__PURE__ */ new Set();
   const docs2 = Object.fromEntries(
-    walked.filter((rel) => !ignoredDocs.has(rel)).map((rel) => [rel, readFile9((0, import_node_path14.join)(root, rel))]).filter(([, body]) => body != null)
+    walked.filter((rel) => !ignoredDocs.has(rel)).map((rel) => [rel, readFile9((0, import_node_path15.join)(root, rel))]).filter(([, body]) => body != null)
   );
   const refResult = checkRefs(root, { exists, isIgnored, trackedFirstSegments }, docs2);
   const findings = [
@@ -10410,31 +10444,31 @@ function walkMarkdown(dir) {
   const stack = [dir];
   while (stack.length) {
     const current = stack.pop();
-    for (const entry of (0, import_node_fs16.readdirSync)(current, { withFileTypes: true })) {
-      const full = (0, import_node_path15.join)(current, entry.name);
+    for (const entry of (0, import_node_fs17.readdirSync)(current, { withFileTypes: true })) {
+      const full = (0, import_node_path16.join)(current, entry.name);
       if (entry.isDirectory()) {
         stack.push(full);
       } else if (entry.isFile() && entry.name.endsWith(".md")) {
-        out.push((0, import_node_path15.relative)(dir, full).split(import_node_path15.sep).join("/"));
+        out.push((0, import_node_path16.relative)(dir, full).split(import_node_path16.sep).join("/"));
       }
     }
   }
   return out;
 }
 function createDocsIndexDeps(repoRoot2) {
-  const docsDir = (0, import_node_path15.join)(repoRoot2, "docs");
-  const indexPath = (0, import_node_path15.join)(repoRoot2, DOCS_INDEX_PATH);
+  const docsDir = (0, import_node_path16.join)(repoRoot2, "docs");
+  const indexPath = (0, import_node_path16.join)(repoRoot2, DOCS_INDEX_PATH);
   return {
     listDocs: () => {
-      if (!(0, import_node_fs16.existsSync)(docsDir)) return [];
+      if (!(0, import_node_fs17.existsSync)(docsDir)) return [];
       const walked = walkMarkdown(docsDir).filter(isRoutableDocsPath);
       if (!walked.length) return [];
       const ignored = defaultIsIgnored(repoRoot2, walked.map((rel) => `docs/${rel}`));
       return walked.filter((rel) => !ignored.has(`docs/${rel}`)).sort();
     },
-    readDoc: (relPath) => (0, import_node_fs16.readFileSync)((0, import_node_path15.join)(docsDir, relPath), "utf8"),
-    readIndex: () => (0, import_node_fs16.existsSync)(indexPath) ? (0, import_node_fs16.readFileSync)(indexPath, "utf8") : null,
-    writeIndex: (content) => (0, import_node_fs16.writeFileSync)(indexPath, content, "utf8")
+    readDoc: (relPath) => (0, import_node_fs17.readFileSync)((0, import_node_path16.join)(docsDir, relPath), "utf8"),
+    readIndex: () => (0, import_node_fs17.existsSync)(indexPath) ? (0, import_node_fs17.readFileSync)(indexPath, "utf8") : null,
+    writeIndex: (content) => (0, import_node_fs17.writeFileSync)(indexPath, content, "utf8")
   };
 }
 
@@ -11219,14 +11253,14 @@ function parseVerifyBroker(stdout) {
 }
 
 // src/train-apply.ts
-var import_node_fs20 = require("node:fs");
+var import_node_fs21 = require("node:fs");
 var import_promises4 = require("node:fs/promises");
-var import_node_path19 = require("node:path");
+var import_node_path20 = require("node:path");
 
 // src/plugin-guard-io.ts
-var import_node_fs17 = require("node:fs");
+var import_node_fs18 = require("node:fs");
 var import_node_child_process7 = require("node:child_process");
-var import_node_path16 = require("node:path");
+var import_node_path17 = require("node:path");
 var import_node_os5 = require("node:os");
 var import_proper_lockfile = __toESM(require_proper_lockfile(), 1);
 
@@ -11529,21 +11563,21 @@ function runHostBin(bin, args, opts) {
   return step ? execFileHard(file, argv, { ...shared, step }) : execFileP2(file, argv, shared);
 }
 function surfaceConfigRoot(surface, env = process.env, home = (0, import_node_os5.homedir)()) {
-  if (surface === "codex") return env.CODEX_HOME?.trim() || (0, import_node_path16.join)(home, ".codex");
-  if (surface === "kimi") return env.KIMI_CODE_HOME?.trim() || (0, import_node_path16.join)(home, ".kimi-code");
-  if (surface === "kilo") return env.KILO_CONFIG_DIR?.trim() || (0, import_node_path16.join)(home, ".config", "kilo");
-  if (surface === "cursor") return (0, import_node_path16.join)(home, ".cursor");
+  if (surface === "codex") return env.CODEX_HOME?.trim() || (0, import_node_path17.join)(home, ".codex");
+  if (surface === "kimi") return env.KIMI_CODE_HOME?.trim() || (0, import_node_path17.join)(home, ".kimi-code");
+  if (surface === "kilo") return env.KILO_CONFIG_DIR?.trim() || (0, import_node_path17.join)(home, ".config", "kilo");
+  if (surface === "cursor") return (0, import_node_path17.join)(home, ".cursor");
   if (surface === "jervcode") {
-    return env.JERVCODE_CODING_AGENT_DIR?.trim() || env.PI_CODING_AGENT_DIR?.trim() || (0, import_node_path16.join)(home, ".jerv", "agent");
+    return env.JERVCODE_CODING_AGENT_DIR?.trim() || env.PI_CODING_AGENT_DIR?.trim() || (0, import_node_path17.join)(home, ".jerv", "agent");
   }
-  return (0, import_node_path16.join)(home, ".claude");
+  return (0, import_node_path17.join)(home, ".claude");
 }
 var installedPluginsPath = (surface = detectSurface(process.env)) => {
-  return (0, import_node_path16.join)(surfaceConfigRoot(surface), "plugins", "installed_plugins.json");
+  return (0, import_node_path17.join)(surfaceConfigRoot(surface), "plugins", "installed_plugins.json");
 };
 function readInstalledPlugins(surface = detectSurface(process.env)) {
   try {
-    return JSON.parse((0, import_node_fs17.readFileSync)(installedPluginsPath(surface), "utf8"));
+    return JSON.parse((0, import_node_fs18.readFileSync)(installedPluginsPath(surface), "utf8"));
   } catch {
     return null;
   }
@@ -11552,17 +11586,17 @@ function marketplaceCloneCandidates(surface, home, env = process.env) {
   if (surface === "codex") {
     const root = surfaceConfigRoot(surface, env, home);
     return [
-      (0, import_node_path16.join)(root, ".tmp", "marketplaces", CODEX_MARKETPLACE),
-      (0, import_node_path16.join)(root, "plugins", "marketplaces", CODEX_MARKETPLACE)
+      (0, import_node_path17.join)(root, ".tmp", "marketplaces", CODEX_MARKETPLACE),
+      (0, import_node_path17.join)(root, "plugins", "marketplaces", CODEX_MARKETPLACE)
     ];
   }
   if (surface === "kimi") return [];
   if (surface === "kilo") return [];
   if (surface === "cursor") return [];
   if (surface === "jervcode") return [];
-  return [(0, import_node_path16.join)(home, ".claude", "plugins", "marketplaces", "mutmutco")];
+  return [(0, import_node_path17.join)(home, ".claude", "plugins", "marketplaces", "mutmutco")];
 }
-function marketplaceClonePresent(surface, home, exists = import_node_fs17.existsSync, env = process.env) {
+function marketplaceClonePresent(surface, home, exists = import_node_fs18.existsSync, env = process.env) {
   return marketplaceCloneCandidates(surface, home, env).some(exists);
 }
 function runHostBinSync(bin, args) {
@@ -11594,7 +11628,7 @@ function codexPluginStatus() {
 }
 function countCodexHookCommands(path2) {
   try {
-    const parsed = JSON.parse((0, import_node_fs17.readFileSync)(path2, "utf8"));
+    const parsed = JSON.parse((0, import_node_fs18.readFileSync)(path2, "utf8"));
     let count = 0;
     for (const groups of Object.values(parsed.hooks ?? {})) {
       for (const group of groups) {
@@ -11611,11 +11645,11 @@ function codexHookTrustState(status = codexPluginStatus()) {
     return { applicable: false, trusted: false, trustedCount: 0, requiredCount: 0 };
   }
   const root = surfaceConfigRoot("codex");
-  const hooksPath = (0, import_node_path16.join)(root, "plugins", "cache", CODEX_MARKETPLACE, "mmi", status.version, "hooks", "codex-hooks.json");
+  const hooksPath = (0, import_node_path17.join)(root, "plugins", "cache", CODEX_MARKETPLACE, "mmi", status.version, "hooks", "codex-hooks.json");
   const requiredCount = countCodexHookCommands(hooksPath);
   let config = "";
   try {
-    config = (0, import_node_fs17.readFileSync)((0, import_node_path16.join)(root, "config.toml"), "utf8");
+    config = (0, import_node_fs18.readFileSync)((0, import_node_path17.join)(root, "config.toml"), "utf8");
   } catch {
     return { applicable: true, trusted: false, trustedCount: 0, requiredCount };
   }
@@ -11642,8 +11676,8 @@ var NPM_INSTALL_TIMEOUT_MS = 12e4;
 var CLI_VERSION_PROBE_TIMEOUT_MS = 3e4;
 function resolveNpmSpawn(args) {
   if (!isWin) return { file: "npm", args };
-  const cli = (0, import_node_path16.join)((0, import_node_path16.dirname)(process.execPath), "node_modules", "npm", "bin", "npm-cli.js");
-  if ((0, import_node_fs17.existsSync)(cli)) return { file: process.execPath, args: [cli, ...args] };
+  const cli = (0, import_node_path17.join)((0, import_node_path17.dirname)(process.execPath), "node_modules", "npm", "bin", "npm-cli.js");
+  if ((0, import_node_fs18.existsSync)(cli)) return { file: process.execPath, args: [cli, ...args] };
   return { file: "cmd.exe", args: ["/c", "npm", ...args] };
 }
 async function npmSelfUpdateCli(target, onStep, deps = {}) {
@@ -11669,11 +11703,11 @@ async function npmSelfUpdateCli(target, onStep, deps = {}) {
   onStep?.(verified.detail, { alwaysShow: true });
   return verified.ok ? { ok: true, detail: `${command} exited 0 \u2014 ${verified.detail}` } : { ok: false, detail: `${command} exited 0 but ${verified.detail}` };
 }
-function kiloConfigListsPlugin(configRoot, home = (0, import_node_os5.homedir)(), read = (p) => (0, import_node_fs17.readFileSync)(p, "utf8"), exists = import_node_fs17.existsSync) {
+function kiloConfigListsPlugin(configRoot, home = (0, import_node_os5.homedir)(), read = (p) => (0, import_node_fs18.readFileSync)(p, "utf8"), exists = import_node_fs18.existsSync) {
   const candidates = ["kilo.json", "kilo.jsonc", "opencode.json", "opencode.jsonc", "config.json"];
-  for (const dir of [configRoot, (0, import_node_path16.join)(home, ".kilo")]) {
+  for (const dir of [configRoot, (0, import_node_path17.join)(home, ".kilo")]) {
     for (const file of candidates) {
-      const path2 = (0, import_node_path16.join)(dir, file);
+      const path2 = (0, import_node_path17.join)(dir, file);
       if (!exists(path2)) continue;
       try {
         const stripped = read(path2).replace(/\/\*[\s\S]*?\*\//g, "").replace(/\/\/.*$/gm, "");
@@ -11690,23 +11724,23 @@ function kiloConfigListsPlugin(configRoot, home = (0, import_node_os5.homedir)()
   return false;
 }
 function cursorLocalPluginRoot(env = process.env, home = (0, import_node_os5.homedir)()) {
-  return (0, import_node_path16.join)(surfaceConfigRoot("cursor", env, home), "plugins", "local", "mmi");
+  return (0, import_node_path17.join)(surfaceConfigRoot("cursor", env, home), "plugins", "local", "mmi");
 }
-function cursorPluginTreeHealthy(root, exists = import_node_fs17.existsSync) {
+function cursorPluginTreeHealthy(root, exists = import_node_fs18.existsSync) {
   return [
     ".cursor-plugin/plugin.json",
     "skills/mmi/SKILL.md",
     "hooks/cursor-hooks.json",
     "scripts/hook-run.mjs",
     "scripts/hook-policy.mjs"
-  ].every((path2) => exists((0, import_node_path16.join)(root, ...path2.split("/"))));
+  ].every((path2) => exists((0, import_node_path17.join)(root, ...path2.split("/"))));
 }
-function kimiPluginTreeHealthy(root, exists = import_node_fs17.existsSync) {
+function kimiPluginTreeHealthy(root, exists = import_node_fs18.existsSync) {
   return [
     ".kimi-plugin/plugin.json",
     "skills/mmi/SKILL.md",
     "scripts/hook-run.mjs"
-  ].every((path2) => exists((0, import_node_path16.join)(root, ...path2.split("/"))));
+  ].every((path2) => exists((0, import_node_path17.join)(root, ...path2.split("/"))));
 }
 var JERVCODE_WRAPPER_DIR = ".pi-plugin";
 function normalizePiEntry(value) {
@@ -11729,7 +11763,7 @@ function jervcodePackageFamily(entry) {
 function isMmiOwnedPiEntry(entry) {
   if (typeof entry !== "string") return false;
   try {
-    const pkg = JSON.parse((0, import_node_fs17.readFileSync)((0, import_node_path16.join)(piEntryFsPath(entry), "package.json"), "utf8"));
+    const pkg = JSON.parse((0, import_node_fs18.readFileSync)((0, import_node_path17.join)(piEntryFsPath(entry), "package.json"), "utf8"));
     return pkg.name === "mmi";
   } catch {
     return false;
@@ -11751,9 +11785,9 @@ function mergeMmiPiPackageEntries(entries, packagePath) {
   };
 }
 function readPiSettings(path2) {
-  if (!(0, import_node_fs17.existsSync)(path2)) return void 0;
+  if (!(0, import_node_fs18.existsSync)(path2)) return void 0;
   try {
-    const parsed = JSON.parse((0, import_node_fs17.readFileSync)(path2, "utf8"));
+    const parsed = JSON.parse((0, import_node_fs18.readFileSync)(path2, "utf8"));
     if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return null;
     return parsed;
   } catch {
@@ -11761,8 +11795,8 @@ function readPiSettings(path2) {
   }
 }
 function jervcodeSettingsCandidates(env = process.env, home = (0, import_node_os5.homedir)()) {
-  const primary = (0, import_node_path16.join)(surfaceConfigRoot("jervcode", env, home), "settings.json");
-  const legacy = (0, import_node_path16.join)(home, ".pi", "agent", "settings.json");
+  const primary = (0, import_node_path17.join)(surfaceConfigRoot("jervcode", env, home), "settings.json");
+  const legacy = (0, import_node_path17.join)(home, ".pi", "agent", "settings.json");
   return legacy === primary ? [primary] : [primary, legacy];
 }
 function mmiPiWrapperEntry(env = process.env, home = (0, import_node_os5.homedir)()) {
@@ -11781,17 +11815,17 @@ function mmiPiWrapperEntry(env = process.env, home = (0, import_node_os5.homedir
 function mmiPiWrapperHealthy(entry) {
   if (!entry) return false;
   const wrapper = piEntryFsPath(entry);
-  return isMmiOwnedPiEntry(entry) && (0, import_node_fs17.existsSync)((0, import_node_path16.join)((0, import_node_path16.dirname)(wrapper), "skills", "mmi", "SKILL.md"));
+  return isMmiOwnedPiEntry(entry) && (0, import_node_fs18.existsSync)((0, import_node_path17.join)((0, import_node_path17.dirname)(wrapper), "skills", "mmi", "SKILL.md"));
 }
 function findMmiPiSourceClone(home = (0, import_node_os5.homedir)()) {
-  const cacheRoot = (0, import_node_path16.join)(home, ".claude", "plugins", "cache", "mutmutco", "mmi");
+  const cacheRoot = (0, import_node_path17.join)(home, ".claude", "plugins", "cache", "mutmutco", "mmi");
   let best = null;
   try {
-    for (const entry of (0, import_node_fs17.readdirSync)(cacheRoot, { withFileTypes: true })) {
+    for (const entry of (0, import_node_fs18.readdirSync)(cacheRoot, { withFileTypes: true })) {
       if (!entry.isDirectory() || !/^\d+\.\d+\.\d+$/.test(entry.name)) continue;
-      if (!(0, import_node_fs17.existsSync)((0, import_node_path16.join)(cacheRoot, entry.name, JERVCODE_WRAPPER_DIR, "package.json"))) continue;
+      if (!(0, import_node_fs18.existsSync)((0, import_node_path17.join)(cacheRoot, entry.name, JERVCODE_WRAPPER_DIR, "package.json"))) continue;
       if (!best || compareVersions(entry.name, best.version) > 0) {
-        best = { path: (0, import_node_path16.join)(cacheRoot, entry.name), version: entry.name };
+        best = { path: (0, import_node_path17.join)(cacheRoot, entry.name), version: entry.name };
       }
     }
   } catch {
@@ -11816,8 +11850,8 @@ function acquirePiSettingsLock(settingsPath2) {
   return void 0;
 }
 function healOneJervCodeSettingsFile(settingsPath2, packagePath, version, nextLaunch) {
-  const release = (0, import_node_fs17.existsSync)(settingsPath2) ? acquirePiSettingsLock(settingsPath2) : void 0;
-  if ((0, import_node_fs17.existsSync)(settingsPath2) && !release) {
+  const release = (0, import_node_fs18.existsSync)(settingsPath2) ? acquirePiSettingsLock(settingsPath2) : void 0;
+  if ((0, import_node_fs18.existsSync)(settingsPath2) && !release) {
     return {
       available: true,
       ok: false,
@@ -11845,14 +11879,14 @@ function healOneJervCodeSettingsFile(settingsPath2, packagePath, version, nextLa
     }
     current.packages = merged.next;
     try {
-      (0, import_node_fs17.mkdirSync)((0, import_node_path16.dirname)(settingsPath2), { recursive: true });
+      (0, import_node_fs18.mkdirSync)((0, import_node_path17.dirname)(settingsPath2), { recursive: true });
       const tmp = `${settingsPath2}.tmp-${process.pid}`;
-      (0, import_node_fs17.writeFileSync)(tmp, `${JSON.stringify(current, null, 2)}
+      (0, import_node_fs18.writeFileSync)(tmp, `${JSON.stringify(current, null, 2)}
 `, "utf8");
       try {
-        (0, import_node_fs17.renameSync)(tmp, settingsPath2);
+        (0, import_node_fs18.renameSync)(tmp, settingsPath2);
       } catch (renameError) {
-        (0, import_node_fs17.rmSync)(tmp, { force: true });
+        (0, import_node_fs18.rmSync)(tmp, { force: true });
         throw renameError;
       }
     } catch (error) {
@@ -11876,8 +11910,8 @@ function healJervCodePackageRegistration(opts = {}) {
   const nextLaunch = inSeat ? " \u2014 takes effect on the next seat launch" : "";
   const home = opts.home ?? (0, import_node_os5.homedir)();
   const agentDir = surfaceConfigRoot("jervcode", env, home);
-  const legacyPi = (0, import_node_path16.join)(home, ".pi", "agent");
-  if (!(0, import_node_fs17.existsSync)(agentDir) && !(0, import_node_fs17.existsSync)(legacyPi)) {
+  const legacyPi = (0, import_node_path17.join)(home, ".pi", "agent");
+  if (!(0, import_node_fs18.existsSync)(agentDir) && !(0, import_node_fs18.existsSync)(legacyPi)) {
     return { available: false, ok: true, changed: false, version: null, detail: "skipped \u2014 no Pi/JervCode install (no agent config dir)" };
   }
   const clone = opts.clone === void 0 ? findMmiPiSourceClone(home) : opts.clone;
@@ -11885,9 +11919,9 @@ function healJervCodePackageRegistration(opts = {}) {
     return { available: true, ok: true, changed: false, version: null, detail: "skipped \u2014 no installed MMI clone carries the pi wrapper (install the Claude plugin first)" };
   }
   const packagePath = `${clone.path.replace(/\\/g, "/").replace(/\/+$/, "")}/${JERVCODE_WRAPPER_DIR}`;
-  const targets = [(0, import_node_path16.join)(agentDir, "settings.json")];
-  const legacySettings = (0, import_node_path16.join)(legacyPi, "settings.json");
-  if ((0, import_node_fs17.existsSync)(legacyPi) && legacySettings !== targets[0]) targets.push(legacySettings);
+  const targets = [(0, import_node_path17.join)(agentDir, "settings.json")];
+  const legacySettings = (0, import_node_path17.join)(legacyPi, "settings.json");
+  if ((0, import_node_fs18.existsSync)(legacyPi) && legacySettings !== targets[0]) targets.push(legacySettings);
   const details = [];
   let anyChanged = false;
   for (const settingsPath2 of targets) {
@@ -11915,18 +11949,18 @@ function snapshotPluginGuardInput(surface = detectSurface(process.env), isOrgRep
   return {
     isOrgRepo,
     installRecordPresent: hasUserInstallRecord(installed, MMI_PLUGIN_ID) || hasProjectInstallRecord(installed, MMI_PLUGIN_ID, process.cwd()) || // Kimi's managed plugin directory is its native install record; it has no Claude-style ledger.
-    surface === "kimi" && (0, import_node_fs17.existsSync)((0, import_node_path16.join)(root, "plugins", "managed", "mmi")) || // kilo-p1: the install record is the config file itself.
+    surface === "kimi" && (0, import_node_fs18.existsSync)((0, import_node_path17.join)(root, "plugins", "managed", "mmi")) || // kilo-p1: the install record is the config file itself.
     surface === "kilo" && kiloConfigListsPlugin(root) || // #4188: jervcode's install record is the settings-file packages[] entry itself.
-    surface === "jervcode" && piEntry !== null || surface === "cursor" && (0, import_node_fs17.existsSync)(cursorLocalPluginRoot()),
+    surface === "jervcode" && piEntry !== null || surface === "cursor" && (0, import_node_fs18.existsSync)(cursorLocalPluginRoot()),
     // Kilo has no marketplace to clone — the config file IS the install record, so this dimension of
     // the shared guard table is vacuously satisfied. Same for jervcode's settings entry.
     marketplaceClonePresent: surface === "kimi" || surface === "kilo" || surface === "cursor" || surface === "jervcode" ? true : marketplaceClonePresent(surface, (0, import_node_os5.homedir)()),
     // Kimi keeps no plugin cache dir — installs are copied to plugins/managed/<id> and run from there.
     // Kilo (kilo-p1) keeps no cache dir either: the plugin's server() provisions ~/.kilo behind the
     // version stamp, so the stamp's presence is the cache signal.
-    pluginCachePresent: surface === "jervcode" ? mmiPiWrapperHealthy(piEntry) : surface === "kilo" ? (0, import_node_fs17.existsSync)((0, import_node_path16.join)((0, import_node_os5.homedir)(), ".kilo", ".mmi-kilo-version")) : surface === "kimi" ? kimiPluginTreeHealthy((0, import_node_path16.join)(root, "plugins", "managed", "mmi")) : surface === "cursor" ? cursorPluginTreeHealthy(cursorLocalPluginRoot()) : surface === "codex" ? Boolean(
-      codexStatus?.installed && codexStatus.enabled && codexStatus.version && (0, import_node_fs17.existsSync)((0, import_node_path16.join)(root, "plugins", "cache", CODEX_MARKETPLACE, "mmi", codexStatus.version))
-    ) : (0, import_node_fs17.existsSync)((0, import_node_path16.join)(root, "plugins", "cache", "mutmutco", "mmi"))
+    pluginCachePresent: surface === "jervcode" ? mmiPiWrapperHealthy(piEntry) : surface === "kilo" ? (0, import_node_fs18.existsSync)((0, import_node_path17.join)((0, import_node_os5.homedir)(), ".kilo", ".mmi-kilo-version")) : surface === "kimi" ? kimiPluginTreeHealthy((0, import_node_path17.join)(root, "plugins", "managed", "mmi")) : surface === "cursor" ? cursorPluginTreeHealthy(cursorLocalPluginRoot()) : surface === "codex" ? Boolean(
+      codexStatus?.installed && codexStatus.enabled && codexStatus.version && (0, import_node_fs18.existsSync)((0, import_node_path17.join)(root, "plugins", "cache", CODEX_MARKETPLACE, "mmi", codexStatus.version))
+    ) : (0, import_node_fs18.existsSync)((0, import_node_path17.join)(root, "plugins", "cache", "mutmutco", "mmi"))
   };
 }
 async function runHostBinLogged(bin, args, opts) {
@@ -11946,11 +11980,11 @@ async function runPluginCli(bin, args, log) {
 function captureCodexHookLauncher() {
   const status = codexPluginStatus();
   if (!status.installed || !status.enabled || !status.version) return void 0;
-  const root = (0, import_node_path16.join)(surfaceConfigRoot("codex"), "plugins", "cache", CODEX_MARKETPLACE, "mmi", status.version);
+  const root = (0, import_node_path17.join)(surfaceConfigRoot("codex"), "plugins", "cache", CODEX_MARKETPLACE, "mmi", status.version);
   const files = ["mmi-hook", "mmi-hook.exe"].flatMap((name) => {
-    const path2 = (0, import_node_path16.join)(root, "bin", name);
+    const path2 = (0, import_node_path17.join)(root, "bin", name);
     try {
-      return [{ name, content: (0, import_node_fs17.readFileSync)(path2) }];
+      return [{ name, content: (0, import_node_fs18.readFileSync)(path2) }];
     } catch {
       return [];
     }
@@ -11958,13 +11992,13 @@ function captureCodexHookLauncher() {
   return files.length === 2 ? { root, files } : void 0;
 }
 function restoreCodexHookLauncher(snapshot) {
-  if (!snapshot || (0, import_node_fs17.existsSync)((0, import_node_path16.join)(snapshot.root, "scripts", "hook-run.mjs"))) return false;
-  const bin = (0, import_node_path16.join)(snapshot.root, "bin");
-  (0, import_node_fs17.mkdirSync)(bin, { recursive: true });
+  if (!snapshot || (0, import_node_fs18.existsSync)((0, import_node_path17.join)(snapshot.root, "scripts", "hook-run.mjs"))) return false;
+  const bin = (0, import_node_path17.join)(snapshot.root, "bin");
+  (0, import_node_fs18.mkdirSync)(bin, { recursive: true });
   for (const file of snapshot.files) {
-    const path2 = (0, import_node_path16.join)(bin, file.name);
-    (0, import_node_fs17.writeFileSync)(path2, file.content);
-    if (file.name === "mmi-hook") (0, import_node_fs17.chmodSync)(path2, 493);
+    const path2 = (0, import_node_path17.join)(bin, file.name);
+    (0, import_node_fs18.writeFileSync)(path2, file.content);
+    if (file.name === "mmi-hook") (0, import_node_fs18.chmodSync)(path2, 493);
   }
   return true;
 }
@@ -11973,10 +12007,10 @@ function canonicalCursorRemote(remote) {
 }
 async function installCursorPluginCheckout(env = process.env) {
   const configRoot = surfaceConfigRoot("cursor", env);
-  const pluginsRoot = (0, import_node_path16.join)(configRoot, "plugins");
-  const target = (0, import_node_path16.join)(pluginsRoot, "local", "mmi");
+  const pluginsRoot = (0, import_node_path17.join)(configRoot, "plugins");
+  const target = (0, import_node_path17.join)(pluginsRoot, "local", "mmi");
   const source = env.MMI_CURSOR_PLUGIN_SOURCE?.trim();
-  if ((0, import_node_fs17.existsSync)(target) && !source) {
+  if ((0, import_node_fs18.existsSync)(target) && !source) {
     try {
       const { stdout } = await runHostBin("git", ["-C", target, "remote", "get-url", "origin"], { timeout: 15e3 });
       if (!canonicalCursorRemote(stdout)) {
@@ -11986,15 +12020,15 @@ async function installCursorPluginCheckout(env = process.env) {
       return { ok: false, detail: `refused to replace unmanaged Cursor plugin directory at ${target}` };
     }
   }
-  (0, import_node_fs17.mkdirSync)((0, import_node_path16.join)(pluginsRoot, "local"), { recursive: true });
-  (0, import_node_fs17.mkdirSync)((0, import_node_path16.join)(pluginsRoot, "staging"), { recursive: true });
-  (0, import_node_fs17.mkdirSync)((0, import_node_path16.join)(pluginsRoot, "quarantine"), { recursive: true });
+  (0, import_node_fs18.mkdirSync)((0, import_node_path17.join)(pluginsRoot, "local"), { recursive: true });
+  (0, import_node_fs18.mkdirSync)((0, import_node_path17.join)(pluginsRoot, "staging"), { recursive: true });
+  (0, import_node_fs18.mkdirSync)((0, import_node_path17.join)(pluginsRoot, "quarantine"), { recursive: true });
   const suffix = `${Date.now()}-${process.pid}`;
-  const staged = (0, import_node_path16.join)(pluginsRoot, "staging", `mmi-${suffix}`);
-  const quarantined = (0, import_node_path16.join)(pluginsRoot, "quarantine", `mmi-${suffix}`);
+  const staged = (0, import_node_path17.join)(pluginsRoot, "staging", `mmi-${suffix}`);
+  const quarantined = (0, import_node_path17.join)(pluginsRoot, "quarantine", `mmi-${suffix}`);
   try {
     if (source) {
-      (0, import_node_fs17.cpSync)(source, staged, {
+      (0, import_node_fs18.cpSync)(source, staged, {
         recursive: true,
         filter: (path2) => !path2.split(/[\\/]/).some((part) => part === ".git" || part === "node_modules")
       });
@@ -12005,18 +12039,18 @@ async function installCursorPluginCheckout(env = process.env) {
       });
     }
     if (!cursorPluginTreeHealthy(staged)) {
-      (0, import_node_fs17.rmSync)(staged, { recursive: true, force: true });
+      (0, import_node_fs18.rmSync)(staged, { recursive: true, force: true });
       return { ok: false, detail: "downloaded Cursor plugin is incomplete; existing install was preserved" };
     }
     let movedOld = false;
-    if ((0, import_node_fs17.existsSync)(target)) {
-      (0, import_node_fs17.renameSync)(target, quarantined);
+    if ((0, import_node_fs18.existsSync)(target)) {
+      (0, import_node_fs18.renameSync)(target, quarantined);
       movedOld = true;
     }
     try {
-      (0, import_node_fs17.renameSync)(staged, target);
+      (0, import_node_fs18.renameSync)(staged, target);
     } catch (error) {
-      if (movedOld && !(0, import_node_fs17.existsSync)(target)) (0, import_node_fs17.renameSync)(quarantined, target);
+      if (movedOld && !(0, import_node_fs18.existsSync)(target)) (0, import_node_fs18.renameSync)(quarantined, target);
       throw error;
     }
     return {
@@ -12024,7 +12058,7 @@ async function installCursorPluginCheckout(env = process.env) {
       detail: movedOld ? `installed canonical Cursor plugin; previous checkout quarantined at ${quarantined}` : `installed canonical Cursor plugin at ${target}`
     };
   } catch (error) {
-    if ((0, import_node_fs17.existsSync)(staged)) (0, import_node_fs17.rmSync)(staged, { recursive: true, force: true });
+    if ((0, import_node_fs18.existsSync)(staged)) (0, import_node_fs18.rmSync)(staged, { recursive: true, force: true });
     return { ok: false, detail: error.message.trim().slice(0, 240).replace(/\s+/g, " ") };
   }
 }
@@ -12074,7 +12108,7 @@ async function applyPluginHeal(surface, log, opts) {
   const refSupported = await marketplaceAddRefSupported(bin);
   const { steps } = adaptHealStepsForRefSupport(tableSteps, refSupported);
   log(healBannerLine(bin, token, refSupported));
-  const pinsPath = (0, import_node_path16.join)((0, import_node_os5.homedir)(), ...KNOWN_MARKETPLACES_RELATIVE);
+  const pinsPath = (0, import_node_path17.join)((0, import_node_os5.homedir)(), ...KNOWN_MARKETPLACES_RELATIVE);
   const pins = token === "claude" ? captureMarketplacePins(readKnownMarketplacesFile(pinsPath), [MMI_MARKETPLACE_NAME, JERV_MARKETPLACE_NAME]) : /* @__PURE__ */ new Map();
   try {
     for (const step of steps) {
@@ -12149,7 +12183,7 @@ async function healActivePluginForDoctor(surface = detectSurface(process.env), o
 }
 function readKnownMarketplacesFile(path2) {
   try {
-    return (0, import_node_fs17.existsSync)(path2) ? (0, import_node_fs17.readFileSync)(path2, "utf8") : void 0;
+    return (0, import_node_fs18.existsSync)(path2) ? (0, import_node_fs18.readFileSync)(path2, "utf8") : void 0;
   } catch {
     return void 0;
   }
@@ -12179,7 +12213,7 @@ function writeMarketplacePinsOnDisk(path2, pins, succeeded, failedVerb, declineW
   const declined = declineWhileHostLive?.();
   if (declined) return declined;
   try {
-    (0, import_node_fs17.writeFileSync)(path2, next, "utf8");
+    (0, import_node_fs18.writeFileSync)(path2, next, "utf8");
   } catch {
     return `could NOT ${failedVerb} ${[...pins.keys()].join(", ")} \u2014 set it by hand`;
   }
@@ -12219,15 +12253,15 @@ function applyOrgMarketplacePins(path2, names, hostIsRunning = claudeCodeIsRunni
 }
 function writeMarketplacePinPending(path2, names, now = Date.now()) {
   try {
-    (0, import_node_fs17.mkdirSync)((0, import_node_path16.dirname)(path2), { recursive: true });
-    (0, import_node_fs17.writeFileSync)(path2, `${JSON.stringify({ v: 1, names: [...names], at: new Date(now).toISOString() })}
+    (0, import_node_fs18.mkdirSync)((0, import_node_path17.dirname)(path2), { recursive: true });
+    (0, import_node_fs18.writeFileSync)(path2, `${JSON.stringify({ v: 1, names: [...names], at: new Date(now).toISOString() })}
 `, "utf8");
   } catch {
   }
 }
 function readMarketplacePinPending(path2, name, now = Date.now()) {
   try {
-    const parsed = JSON.parse((0, import_node_fs17.readFileSync)(path2, "utf8"));
+    const parsed = JSON.parse((0, import_node_fs18.readFileSync)(path2, "utf8"));
     const at = typeof parsed.at === "string" ? Date.parse(parsed.at) : Number.NaN;
     if (parsed.v !== 1 || !Array.isArray(parsed.names) || !parsed.names.includes(name) || !Number.isFinite(at)) return void 0;
     if (now - at < 0 || now - at > 12 * 60 * 6e4) return void 0;
@@ -12785,9 +12819,9 @@ function renderAccessReport(report) {
 }
 
 // src/cli-doctor-shared.ts
-var import_node_fs18 = require("node:fs");
-var import_node_path18 = require("node:path");
 var import_node_fs19 = require("node:fs");
+var import_node_path19 = require("node:path");
+var import_node_fs20 = require("node:fs");
 
 // ../infra/registry-endpoints.mjs
 var PROJECTS_LIST_PATH = "/projects/list";
@@ -13701,7 +13735,7 @@ var import_node_os7 = require("node:os");
 // src/gh-create.ts
 var import_promises3 = require("node:fs/promises");
 var import_node_os6 = require("node:os");
-var import_node_path17 = require("node:path");
+var import_node_path18 = require("node:path");
 var import_node_crypto3 = require("node:crypto");
 
 // src/board-priority.ts
@@ -13784,8 +13818,8 @@ async function bodyArgsViaFile(args, deps = {}) {
   const remove2 = deps.remove ?? import_promises3.unlink;
   const ensureDir = deps.ensureDir ?? import_promises3.mkdir;
   const dir = deps.dir ?? (0, import_node_os6.tmpdir)();
-  const file = (0, import_node_path17.join)(dir, `mmi-gh-body-${process.pid}-${(0, import_node_crypto3.randomBytes)(4).toString("hex")}.md`);
-  await ensureDir((0, import_node_path17.dirname)(file), { recursive: true }).catch(() => {
+  const file = (0, import_node_path18.join)(dir, `mmi-gh-body-${process.pid}-${(0, import_node_crypto3.randomBytes)(4).toString("hex")}.md`);
+  await ensureDir((0, import_node_path18.dirname)(file), { recursive: true }).catch(() => {
   });
   await write(file, args[i + 1], "utf8");
   return {
@@ -15328,7 +15362,7 @@ async function localBranchHeads() {
 }
 async function currentRepoWorktreeGitRoot(repoRoot2) {
   const gitCommonDir = (await execFileP2("git", ["rev-parse", "--git-common-dir"], { timeout: GIT_TIMEOUT_MS }).catch(() => ({ stdout: "" }))).stdout.trim();
-  return gitCommonDir ? (0, import_node_path18.resolve)(repoRoot2, gitCommonDir, "worktrees") : "";
+  return gitCommonDir ? (0, import_node_path19.resolve)(repoRoot2, gitCommonDir, "worktrees") : "";
 }
 async function worktreeBranches() {
   const { stdout } = await execFileP2("git", ["worktree", "list", "--porcelain"], { timeout: GIT_TIMEOUT_MS });
@@ -15348,18 +15382,18 @@ function resolveGitdirForWorktreeFile(worktreePath, content) {
   const match = /^gitdir:\s*(.+)\s*$/im.exec(content);
   if (!match?.[1]) return void 0;
   const raw = match[1].trim();
-  return (0, import_node_path18.isAbsolute)(raw) ? raw : (0, import_node_path18.resolve)(worktreePath, raw);
+  return (0, import_node_path19.isAbsolute)(raw) ? raw : (0, import_node_path19.resolve)(worktreePath, raw);
 }
 function metadataOwnsMissingWorktreeDir(worktreePath, worktreeGitRoot) {
   if (!worktreeGitRoot) return false;
   try {
-    const entries = (0, import_node_fs19.readdirSync)(worktreeGitRoot, { withFileTypes: true });
+    const entries = (0, import_node_fs20.readdirSync)(worktreeGitRoot, { withFileTypes: true });
     for (const ent of entries) {
       if (!ent.isDirectory()) continue;
       try {
-        const gitdirPath = (0, import_node_fs18.readFileSync)((0, import_node_path18.join)(worktreeGitRoot, ent.name, "gitdir"), "utf8").trim();
-        const resolvedGitdir = (0, import_node_path18.isAbsolute)(gitdirPath) ? gitdirPath : (0, import_node_path18.resolve)(worktreeGitRoot, ent.name, gitdirPath);
-        if (sameWorktreeMetadataPath((0, import_node_path18.dirname)(resolvedGitdir), worktreePath)) return true;
+        const gitdirPath = (0, import_node_fs19.readFileSync)((0, import_node_path19.join)(worktreeGitRoot, ent.name, "gitdir"), "utf8").trim();
+        const resolvedGitdir = (0, import_node_path19.isAbsolute)(gitdirPath) ? gitdirPath : (0, import_node_path19.resolve)(worktreeGitRoot, ent.name, gitdirPath);
+        if (sameWorktreeMetadataPath((0, import_node_path19.dirname)(resolvedGitdir), worktreePath)) return true;
       } catch {
       }
     }
@@ -15369,7 +15403,7 @@ function metadataOwnsMissingWorktreeDir(worktreePath, worktreeGitRoot) {
 }
 function pathExistsKnown(path2) {
   try {
-    (0, import_node_fs19.statSync)(path2);
+    (0, import_node_fs20.statSync)(path2);
     return true;
   } catch (e) {
     const code = typeof e === "object" && e && "code" in e ? String(e.code ?? "") : "";
@@ -15378,10 +15412,10 @@ function pathExistsKnown(path2) {
   }
 }
 function inspectSiblingWorktreeDir(path2, worktreeGitRoot) {
-  const gitPath = (0, import_node_path18.join)(path2, ".git");
+  const gitPath = (0, import_node_path19.join)(path2, ".git");
   let st;
   try {
-    st = (0, import_node_fs19.lstatSync)(gitPath);
+    st = (0, import_node_fs20.lstatSync)(gitPath);
   } catch (e) {
     const code = typeof e === "object" && e && "code" in e ? String(e.code ?? "") : "";
     if (code === "ENOENT" || code === "ENOTDIR") {
@@ -15398,7 +15432,7 @@ function inspectSiblingWorktreeDir(path2, worktreeGitRoot) {
   if (st.isDirectory()) return { path: path2, gitType: "dir" };
   if (!st.isFile()) return { path: path2, gitType: "other" };
   try {
-    const gitFileContent = (0, import_node_fs18.readFileSync)(gitPath, "utf8");
+    const gitFileContent = (0, import_node_fs19.readFileSync)(gitPath, "utf8");
     const gitdir = resolveGitdirForWorktreeFile(path2, gitFileContent);
     const gitDirExists = gitdir ? pathExistsKnown(gitdir) : false;
     return {
@@ -15415,7 +15449,7 @@ function inspectSiblingWorktreeDir(path2, worktreeGitRoot) {
 }
 function inspectDeadWorktreeDirContent(path2) {
   try {
-    return { entries: (0, import_node_fs19.readdirSync)(path2) };
+    return { entries: (0, import_node_fs20.readdirSync)(path2) };
   } catch (e) {
     const code = typeof e === "object" && e && "code" in e ? String(e.code ?? "") : "";
     return { error: code ? `unable to inspect directory contents (${code})` : "unable to inspect directory contents" };
@@ -15432,7 +15466,7 @@ async function preservedBranches() {
 async function siblingWorktreeDirs(explicitRoot) {
   const repoRoot2 = (await execFileP2("git", ["rev-parse", "--show-toplevel"], { timeout: GIT_TIMEOUT_MS }).catch(() => ({ stdout: "" }))).stdout.trim() || process.cwd();
   const worktreeGitRoot = await currentRepoWorktreeGitRoot(repoRoot2);
-  const primaryRepoRoot = worktreeGitRoot ? (0, import_node_path18.dirname)((0, import_node_path18.dirname)(worktreeGitRoot)) : repoRoot2;
+  const primaryRepoRoot = worktreeGitRoot ? (0, import_node_path19.dirname)((0, import_node_path19.dirname)(worktreeGitRoot)) : repoRoot2;
   try {
     const dirs = explicitRoot ? listDirsIn(resolveExplicitScanRoot(explicitRoot, primaryRepoRoot)) : worktreeScanDirs(siblingMmiWorktreesRoot(primaryRepoRoot), primaryRepoRoot, listDirsIn, isRepoCheckoutDir);
     const agentDirs2 = listDirsIn(agentWorktreesRoot(primaryRepoRoot));
@@ -15443,18 +15477,18 @@ async function siblingWorktreeDirs(explicitRoot) {
 }
 function listDirsIn(dir) {
   try {
-    return (0, import_node_fs19.readdirSync)(dir, { withFileTypes: true }).filter((ent) => ent.isDirectory()).map((ent) => (0, import_node_path18.join)(dir, ent.name));
+    return (0, import_node_fs20.readdirSync)(dir, { withFileTypes: true }).filter((ent) => ent.isDirectory()).map((ent) => (0, import_node_path19.join)(dir, ent.name));
   } catch {
     return [];
   }
 }
 function isRepoCheckoutDir(dir) {
-  return (0, import_node_fs19.existsSync)((0, import_node_path18.join)(dir, ".git"));
+  return (0, import_node_fs20.existsSync)((0, import_node_path19.join)(dir, ".git"));
 }
 function resolveExplicitScanRoot(explicitRoot, repoRoot2) {
   let rootDirs;
   try {
-    rootDirs = (0, import_node_fs19.readdirSync)(explicitRoot, { withFileTypes: true }).filter((ent) => ent.isDirectory()).map((ent) => ent.name);
+    rootDirs = (0, import_node_fs20.readdirSync)(explicitRoot, { withFileTypes: true }).filter((ent) => ent.isDirectory()).map((ent) => ent.name);
   } catch {
     return explicitRoot;
   }
@@ -15786,10 +15820,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "3.117.1",
-    tag: "v3.117.1",
-    commit: "b413403fb412",
-    npm: "@mutmutco/cli@3.117.1"
+    version: "3.119.0",
+    tag: "v3.119.0",
+    commit: "32fef9b214ee",
+    npm: "@mutmutco/cli@3.119.0"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -15806,14 +15840,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v3.117.1"
+          v3Target: "v3.119.0"
         }
       ],
       rollbackTrigger: "Any red inside the post-cut soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a v3 client refused while the compat window must still admit it (SUPPORTED_MINOR_WINDOW=2, MIN_CLIENT_VERSION 0.0.0 \u2014 D6a), or npm consumer install/doctor failure on the v4 dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 3.117.1 and redeploy the Hub Lambda from tag v3.117.1 (b413403fb412); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v3.117.1 (@mutmutco/cli@3.117.1, tag commit b413403fb412 \u2014 the preserved latest-v3 distribution, D6b)"
+        mechanism: "npm dist-tag latest -> 3.119.0 and redeploy the Hub Lambda from tag v3.119.0 (32fef9b214ee); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v3.119.0 (@mutmutco/cli@3.119.0, tag commit 32fef9b214ee \u2014 the preserved latest-v3 distribution, D6b)"
       }
     },
     {
@@ -17897,7 +17931,7 @@ function planTrainApplyRepoGuard(applyRepo, cwdRepo, rerun) {
 async function resolveFoldPaths(deps, model) {
   const helper = "scripts/release-distribution.mjs";
   if (model === "hub-serverless" || model === "registry-publish") {
-    if ((0, import_node_fs20.existsSync)(helper)) {
+    if ((0, import_node_fs21.existsSync)(helper)) {
       let out;
       try {
         out = await deps.run("node", [helper, "changed-files"]);
@@ -18016,7 +18050,7 @@ async function restoreMainNpmPackIdentities(deps, version) {
   if (mainBom.version !== version) return void 0;
   let localBom;
   try {
-    localBom = JSON.parse((0, import_node_fs20.readFileSync)(bomPath, "utf8"));
+    localBom = JSON.parse((0, import_node_fs21.readFileSync)(bomPath, "utf8"));
   } catch (e) {
     throw new Error(
       `version fold refused: ${bomPath} written by this fold's prepare is unreadable (${describeReadError(e)}) \u2014 cannot restore the published ${version} npm-pack identities from origin/main (#4503/#4713).`
@@ -18034,14 +18068,14 @@ async function restoreMainNpmPackIdentities(deps, version) {
     restored += 1;
   }
   if (restored === 0) return void 0;
-  (0, import_node_fs20.writeFileSync)(bomPath, `${JSON.stringify(localBom, null, 2)}
+  (0, import_node_fs21.writeFileSync)(bomPath, `${JSON.stringify(localBom, null, 2)}
 `);
   return `restored ${restored} npm-pack BOM identit${restored === 1 ? "y" : "ies"} from origin/main (#4503)`;
 }
 function publishVisibilityFor(surfaceId) {
   let raw;
   try {
-    raw = (0, import_node_fs20.readFileSync)("surfaces.json", "utf8");
+    raw = (0, import_node_fs21.readFileSync)("surfaces.json", "utf8");
   } catch (e) {
     if (e.code === "ENOENT") return "unknown";
     throw trainReadFailure(
@@ -18062,7 +18096,7 @@ function publishVisibilityFor(surfaceId) {
 }
 function npmPackArtifactName(packagePath) {
   try {
-    const pkg = JSON.parse((0, import_node_fs20.readFileSync)((0, import_node_path19.join)(packagePath, "package.json"), "utf8"));
+    const pkg = JSON.parse((0, import_node_fs21.readFileSync)((0, import_node_path20.join)(packagePath, "package.json"), "utf8"));
     return pkg.name || void 0;
   } catch {
     return void 0;
@@ -18071,7 +18105,7 @@ function npmPackArtifactName(packagePath) {
 async function refuseDivergentPublishedNpmPack(deps, version) {
   let localBom;
   try {
-    localBom = JSON.parse((0, import_node_fs20.readFileSync)("distribution-bom.json", "utf8"));
+    localBom = JSON.parse((0, import_node_fs21.readFileSync)("distribution-bom.json", "utf8"));
   } catch (e) {
     throw new Error(
       `version fold refused: distribution-bom.json written by this fold's prepare is unreadable (${e instanceof Error ? e.message.split("\n")[0] : String(e)}) \u2014 cannot compare the same-PATCH ${version} npm-pack identities against published npm (#4503/#4662).`
@@ -19233,17 +19267,17 @@ async function dispatchDeploy(deps, ctx, stage, ref, model, watch, autoRunSince,
   return { note: `no manual dispatch: ${model} repo deploys via its own push-triggered workflow`, deployStatus: "pending" };
 }
 function readLocalGateWorkflows() {
-  const dir = (0, import_node_path19.join)(".github", "workflows");
+  const dir = (0, import_node_path20.join)(".github", "workflows");
   let names;
   try {
-    names = (0, import_node_fs20.readdirSync)(dir);
+    names = (0, import_node_fs21.readdirSync)(dir);
   } catch {
     return null;
   }
   const files = [];
   for (const name of names.filter(isGateWorkflowPath)) {
     try {
-      files.push({ path: `${dir}/${name}`.replace(/\\/g, "/"), body: (0, import_node_fs20.readFileSync)((0, import_node_path19.join)(dir, name), "utf8") });
+      files.push({ path: `${dir}/${name}`.replace(/\\/g, "/"), body: (0, import_node_fs21.readFileSync)((0, import_node_path20.join)(dir, name), "utf8") });
     } catch {
     }
   }
@@ -21464,12 +21498,12 @@ async function runPrLand(prNumber, options, deps) {
 }
 
 // src/wave-status.ts
-var import_node_fs22 = require("node:fs");
+var import_node_fs23 = require("node:fs");
 
 // src/stage-runner.ts
 var import_node_child_process9 = require("node:child_process");
-var import_node_fs21 = require("node:fs");
-var import_node_path20 = require("node:path");
+var import_node_fs22 = require("node:fs");
+var import_node_path21 = require("node:path");
 var import_node_net = require("node:net");
 var import_node_util5 = require("node:util");
 
@@ -21608,11 +21642,11 @@ function appendForceRecreate(up) {
   return `${up.trimEnd()} --force-recreate`;
 }
 function stageStatePath(cwd = process.cwd()) {
-  return (0, import_node_path20.join)(cwd, "tmp", "stage", "state.json");
+  return (0, import_node_path21.join)(cwd, "tmp", "stage", "state.json");
 }
 function stageGlobalStatePath(cwd = process.cwd(), gitCommonDir = ".git") {
-  const dir = (0, import_node_path20.isAbsolute)(gitCommonDir) ? gitCommonDir : (0, import_node_path20.resolve)(cwd, gitCommonDir);
-  return (0, import_node_path20.join)(dir, "mmi", "stage", "state.json");
+  const dir = (0, import_node_path21.isAbsolute)(gitCommonDir) ? gitCommonDir : (0, import_node_path21.resolve)(cwd, gitCommonDir);
+  return (0, import_node_path21.join)(dir, "mmi", "stage", "state.json");
 }
 function normPath3(path2) {
   return path2.replace(/\\/g, "/").replace(/\/+$/, "").toLowerCase();
@@ -21836,14 +21870,14 @@ function stageProcessEnv(stagePort, extraEnv) {
 }
 async function ensureStageRuntimeEnv(config, opts, cwd) {
   if (!config.ensureEnv) return;
-  const target = (0, import_node_path20.join)(cwd, config.ensureEnv.target);
-  const example = (0, import_node_path20.join)(cwd, config.ensureEnv.example);
-  if (!(0, import_node_fs21.existsSync)(target) && (0, import_node_fs21.existsSync)(example)) {
-    (0, import_node_fs21.copyFileSync)(example, target);
-  } else if ((0, import_node_fs21.existsSync)(target) && (0, import_node_fs21.existsSync)(example)) {
-    const stale = detectStaleEnvFile((0, import_node_fs21.readFileSync)(example, "utf8"), (0, import_node_fs21.readFileSync)(target, "utf8"), {
-      exampleMtimeMs: (0, import_node_fs21.statSync)(example).mtimeMs,
-      targetMtimeMs: (0, import_node_fs21.statSync)(target).mtimeMs
+  const target = (0, import_node_path21.join)(cwd, config.ensureEnv.target);
+  const example = (0, import_node_path21.join)(cwd, config.ensureEnv.example);
+  if (!(0, import_node_fs22.existsSync)(target) && (0, import_node_fs22.existsSync)(example)) {
+    (0, import_node_fs22.copyFileSync)(example, target);
+  } else if ((0, import_node_fs22.existsSync)(target) && (0, import_node_fs22.existsSync)(example)) {
+    const stale = detectStaleEnvFile((0, import_node_fs22.readFileSync)(example, "utf8"), (0, import_node_fs22.readFileSync)(target, "utf8"), {
+      exampleMtimeMs: (0, import_node_fs22.statSync)(example).mtimeMs,
+      targetMtimeMs: (0, import_node_fs22.statSync)(target).mtimeMs
     });
     if (stale) {
       const msg = `stale ${config.ensureEnv.target} (${stale}) \u2014 delete it or refresh from ${config.ensureEnv.example} before re-running /stage`;
@@ -21851,8 +21885,8 @@ async function ensureStageRuntimeEnv(config, opts, cwd) {
       console.error(`mmi-cli stage: ${msg} (allowed via --allow-stale-env)`);
     }
   }
-  if (opts.vaultEnvMerge && Object.keys(opts.vaultEnvMerge).length && (0, import_node_fs21.existsSync)(target)) {
-    (0, import_node_fs21.writeFileSync)(target, mergeEnvSecretsIntoFile((0, import_node_fs21.readFileSync)(target, "utf8"), opts.vaultEnvMerge), "utf8");
+  if (opts.vaultEnvMerge && Object.keys(opts.vaultEnvMerge).length && (0, import_node_fs22.existsSync)(target)) {
+    (0, import_node_fs22.writeFileSync)(target, mergeEnvSecretsIntoFile((0, import_node_fs22.readFileSync)(target, "utf8"), opts.vaultEnvMerge), "utf8");
   }
 }
 async function gitText(cwd, args) {
@@ -21882,20 +21916,20 @@ async function resolveGlobalStatePath(cwd, explicit) {
   return void 0;
 }
 function readState(path2) {
-  if (!(0, import_node_fs21.existsSync)(path2)) return null;
+  if (!(0, import_node_fs22.existsSync)(path2)) return null;
   try {
-    return JSON.parse((0, import_node_fs21.readFileSync)(path2, "utf8"));
+    return JSON.parse((0, import_node_fs22.readFileSync)(path2, "utf8"));
   } catch {
     return null;
   }
 }
 function mkdirFor(path2) {
   const dir = path2.slice(0, Math.max(path2.lastIndexOf("/"), path2.lastIndexOf("\\")));
-  (0, import_node_fs21.mkdirSync)(dir, { recursive: true });
+  (0, import_node_fs22.mkdirSync)(dir, { recursive: true });
 }
 function writeState(path2, state) {
   mkdirFor(path2);
-  (0, import_node_fs21.writeFileSync)(path2, JSON.stringify(state, null, 2), "utf8");
+  (0, import_node_fs22.writeFileSync)(path2, JSON.stringify(state, null, 2), "utf8");
 }
 function writeStagePortReservation(port, cwd, statePath, globalStatePath, now) {
   const reservation = {
@@ -21915,7 +21949,7 @@ async function cleanupStageState(state, paths, timeoutMs, fallbackCwd) {
     await shell(state.teardown.command.trim(), state.teardown.cwd || state.cwd || fallbackCwd, Math.max(timeoutMs, 1e4));
   }
   for (const path2 of [...new Set(paths.filter((p) => Boolean(p)))]) {
-    (0, import_node_fs21.rmSync)(path2, { force: true });
+    (0, import_node_fs22.rmSync)(path2, { force: true });
   }
 }
 async function killTree(pid) {
@@ -22073,8 +22107,8 @@ async function runStage(config = {}, opts = {}) {
     await ensureStageRuntimeEnv(config, opts, cwd);
     if (build) await shell(sub(build), cwd, timeoutMs, stageProcessEnv(stagePort, extraEnv));
   } catch (e) {
-    (0, import_node_fs21.rmSync)(statePath, { force: true });
-    if (globalStatePath && globalStatePath !== statePath) (0, import_node_fs21.rmSync)(globalStatePath, { force: true });
+    (0, import_node_fs22.rmSync)(statePath, { force: true });
+    if (globalStatePath && globalStatePath !== statePath) (0, import_node_fs22.rmSync)(globalStatePath, { force: true });
     throw e;
   }
   const started = await startStage(config, {
@@ -22095,9 +22129,9 @@ function parseNextFromHead(headText) {
 }
 function readStageSummary(worktreePath) {
   const statePath = stageStatePath(worktreePath);
-  if (!(0, import_node_fs22.existsSync)(statePath)) return void 0;
+  if (!(0, import_node_fs23.existsSync)(statePath)) return void 0;
   try {
-    const state = JSON.parse((0, import_node_fs22.readFileSync)(statePath, "utf8"));
+    const state = JSON.parse((0, import_node_fs23.readFileSync)(statePath, "utf8"));
     const port = typeof state.port === "number" ? state.port : void 0;
     if (port == null || !Number.isInteger(port) || port <= 0) return void 0;
     return { port, url: typeof state.url === "string" ? state.url : void 0 };
@@ -22206,9 +22240,9 @@ var import_node_os19 = require("node:os");
 
 // src/board.ts
 var import_node_child_process10 = require("node:child_process");
-var import_node_fs23 = require("node:fs");
+var import_node_fs24 = require("node:fs");
 var import_node_os8 = require("node:os");
-var import_node_path21 = require("node:path");
+var import_node_path22 = require("node:path");
 var import_node_util6 = require("node:util");
 
 // src/board-dependency.ts
@@ -23955,17 +23989,17 @@ function probeLocalClaimSession(marker, now = Date.now()) {
     claimSessionProbeCache.set(cacheKey, { checkedAt: now, state });
     return state;
   };
-  const root = (0, import_node_path21.join)((0, import_node_os8.homedir)(), ".claude", "projects");
+  const root = (0, import_node_path22.join)((0, import_node_os8.homedir)(), ".claude", "projects");
   try {
     const wanted = `${marker.session}.jsonl`.toLowerCase();
     const pending = [root];
     while (pending.length) {
       const dir = pending.pop();
-      for (const entry of (0, import_node_fs23.readdirSync)(dir, { withFileTypes: true })) {
-        const path2 = (0, import_node_path21.join)(dir, entry.name);
+      for (const entry of (0, import_node_fs24.readdirSync)(dir, { withFileTypes: true })) {
+        const path2 = (0, import_node_path22.join)(dir, entry.name);
         if (entry.isDirectory()) pending.push(path2);
         else if (entry.isFile() && entry.name.toLowerCase() === wanted) {
-          return remember(now - (0, import_node_fs23.statSync)(path2).mtimeMs <= CLAIM_SESSION_ACTIVITY_MS ? "live" : "dead");
+          return remember(now - (0, import_node_fs24.statSync)(path2).mtimeMs <= CLAIM_SESSION_ACTIVITY_MS ? "live" : "dead");
         }
       }
     }
@@ -24623,6 +24657,7 @@ function buildCommand(cmd, path2) {
     path: path2,
     ...aliases.length ? { aliases: [...aliases] } : {},
     house,
+    canonical: canonicalPathFor(path2) ?? path2,
     arguments: cmd.registeredArguments.map(buildArgument),
     // A hand-parsed command registers no Commander options, so its declared set is merged in (#3682).
     options: [...cmd.options.map(buildOption), ...readDeclaredOptions(cmd)],
@@ -24864,8 +24899,8 @@ function consolidateCommandNamespaces(program3) {
 }
 
 // src/pi-plugin-registration.ts
-var import_node_fs24 = require("node:fs");
-var import_node_path22 = require("node:path");
+var import_node_fs25 = require("node:fs");
+var import_node_path23 = require("node:path");
 var import_proper_lockfile2 = __toESM(require_proper_lockfile(), 1);
 
 // src/plugin-cache-prune.ts
@@ -25123,48 +25158,48 @@ function newestExistingPiPlugin(home) {
   const cacheRoot = pluginCacheRoot(home);
   let names;
   try {
-    names = (0, import_node_fs24.readdirSync)(cacheRoot);
+    names = (0, import_node_fs25.readdirSync)(cacheRoot);
   } catch {
     return void 0;
   }
   for (const version of names.filter(isVersionDirName).sort((a, b) => compareVersions(b, a))) {
-    const candidate = (0, import_node_path22.join)(cacheRoot, version, ".pi-plugin");
-    if ((0, import_node_fs24.existsSync)(candidate)) return candidate;
+    const candidate = (0, import_node_path23.join)(cacheRoot, version, ".pi-plugin");
+    if ((0, import_node_fs25.existsSync)(candidate)) return candidate;
   }
   return void 0;
 }
 function expectedPiPluginPath(home, env, installedVersion) {
   const root = env.CLAUDE_PLUGIN_ROOT?.trim();
-  if (root && /[\\/]mutmutco[\\/]mmi[\\/]/.test(root)) return (0, import_node_path22.join)(root, ".pi-plugin");
+  if (root && /[\\/]mutmutco[\\/]mmi[\\/]/.test(root)) return (0, import_node_path23.join)(root, ".pi-plugin");
   const version = installedVersion ?? runningPluginVersion(env);
   if (version) {
-    const pinned = (0, import_node_path22.join)(home, ".claude", "plugins", "cache", "mutmutco", "mmi", version, ".pi-plugin");
-    if ((0, import_node_fs24.existsSync)(pinned)) return pinned;
+    const pinned = (0, import_node_path23.join)(home, ".claude", "plugins", "cache", "mutmutco", "mmi", version, ".pi-plugin");
+    if ((0, import_node_fs25.existsSync)(pinned)) return pinned;
   }
   return newestExistingPiPlugin(home);
 }
 function agentDirs(home, env = process.env) {
   const override = env.JERVCODE_CODING_AGENT_DIR?.trim() || env.PI_CODING_AGENT_DIR?.trim();
   if (override) return [override];
-  const jerv = (0, import_node_path22.join)(home, ".jerv", "agent");
-  const pi = (0, import_node_path22.join)(home, ".pi", "agent");
-  if (!(0, import_node_fs24.existsSync)(jerv) && !(0, import_node_fs24.existsSync)(pi)) return [];
+  const jerv = (0, import_node_path23.join)(home, ".jerv", "agent");
+  const pi = (0, import_node_path23.join)(home, ".pi", "agent");
+  if (!(0, import_node_fs25.existsSync)(jerv) && !(0, import_node_fs25.existsSync)(pi)) return [];
   const dirs = [jerv];
-  if ((0, import_node_fs24.existsSync)(pi) && pi !== jerv) dirs.push(pi);
+  if ((0, import_node_fs25.existsSync)(pi) && pi !== jerv) dirs.push(pi);
   return dirs;
 }
 function settingsPath(agentDir) {
-  return (0, import_node_path22.join)(agentDir, "settings.json");
+  return (0, import_node_path23.join)(agentDir, "settings.json");
 }
 function readPiPluginState(home, env, installedVersion) {
   const dirs = agentDirs(home, env);
   if (dirs.length === 0) return void 0;
   const expectedPath = expectedPiPluginPath(home, env, installedVersion);
   if (!expectedPath) return void 0;
-  const file = dirs.map(settingsPath).find((p) => (0, import_node_fs24.existsSync)(p)) ?? settingsPath(dirs[0]);
-  if (!(0, import_node_fs24.existsSync)(file)) return { expectedPath, settingsReadable: true };
+  const file = dirs.map(settingsPath).find((p) => (0, import_node_fs25.existsSync)(p)) ?? settingsPath(dirs[0]);
+  if (!(0, import_node_fs25.existsSync)(file)) return { expectedPath, settingsReadable: true };
   try {
-    const parsed = JSON.parse((0, import_node_fs24.readFileSync)(file, "utf8"));
+    const parsed = JSON.parse((0, import_node_fs25.readFileSync)(file, "utf8"));
     const packages = Array.isArray(parsed.packages) ? parsed.packages : [];
     return { expectedPath, registeredPath: packages.find((p) => typeof p === "string" && isMmiPiPackage(p)), settingsReadable: true };
   } catch {
@@ -25188,20 +25223,20 @@ function acquirePiSettingsLock2(settingsFile) {
   return void 0;
 }
 function atomicWriteSettings(file, body) {
-  (0, import_node_fs24.mkdirSync)((0, import_node_path22.dirname)(file), { recursive: true });
+  (0, import_node_fs25.mkdirSync)((0, import_node_path23.dirname)(file), { recursive: true });
   const tmp = `${file}.tmp-${process.pid}`;
-  (0, import_node_fs24.writeFileSync)(tmp, body, "utf8");
+  (0, import_node_fs25.writeFileSync)(tmp, body, "utf8");
   try {
-    (0, import_node_fs24.renameSync)(tmp, file);
+    (0, import_node_fs25.renameSync)(tmp, file);
   } catch (renameError) {
-    (0, import_node_fs24.rmSync)(tmp, { force: true });
+    (0, import_node_fs25.rmSync)(tmp, { force: true });
     throw renameError;
   }
 }
 function healOneAgentDir(agentDir, expectedPath) {
   const file = settingsPath(agentDir);
-  const release = (0, import_node_fs24.existsSync)(file) ? acquirePiSettingsLock2(file) : void 0;
-  if ((0, import_node_fs24.existsSync)(file) && !release) {
+  const release = (0, import_node_fs25.existsSync)(file) ? acquirePiSettingsLock2(file) : void 0;
+  if ((0, import_node_fs25.existsSync)(file) && !release) {
     return {
       ok: false,
       detail: `Pi's settings lock (${file}.lock) is held by another process; nothing written, retry on the next doctor run`,
@@ -25210,9 +25245,9 @@ function healOneAgentDir(agentDir, expectedPath) {
   }
   try {
     let parsed = {};
-    if ((0, import_node_fs24.existsSync)(file)) {
+    if ((0, import_node_fs25.existsSync)(file)) {
       try {
-        const raw = JSON.parse((0, import_node_fs24.readFileSync)(file, "utf8"));
+        const raw = JSON.parse((0, import_node_fs25.readFileSync)(file, "utf8"));
         if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
           return { ok: false, detail: "settings.json unreadable \u2014 nothing written (fail closed)" };
         }
@@ -25264,20 +25299,20 @@ function healPiPluginRegistration(home, env, installedVersion) {
 }
 
 // src/claude-binary-doctor.ts
-var import_node_fs26 = require("node:fs");
+var import_node_fs27 = require("node:fs");
 var import_node_os11 = require("node:os");
-var import_node_path24 = require("node:path");
+var import_node_path25 = require("node:path");
 
 // src/jerv-cli-spawn.ts
-var import_node_fs25 = require("node:fs");
+var import_node_fs26 = require("node:fs");
 var import_node_os10 = require("node:os");
-var import_node_path23 = require("node:path");
+var import_node_path24 = require("node:path");
 var WIN_NAMES = ["jerv-cli.cmd", "jerv-cli.exe", "jerv-cli"];
 var POSIX_NAMES = ["jerv-cli"];
-var JERV_CLI_ENTRY = (0, import_node_path23.join)("node_modules", "@jervaise", "jerv-cli", "dist", "index.cjs");
+var JERV_CLI_ENTRY = (0, import_node_path24.join)("node_modules", "@jervaise", "jerv-cli", "dist", "index.cjs");
 function pathEnvEntries(pathEnv, platform2 = process.platform) {
   if (platform2 !== "win32") {
-    return pathEnv.split(import_node_path23.delimiter).map((e) => e.trim()).filter(Boolean);
+    return pathEnv.split(import_node_path24.delimiter).map((e) => e.trim()).filter(Boolean);
   }
   if (pathEnv.includes(";")) {
     return pathEnv.split(";").map((e) => e.trim()).filter(Boolean);
@@ -25310,10 +25345,10 @@ function jervCliCandidateDirs(env = process.env, home = (0, import_node_os10.hom
     push(normalizeSpawnPathEntry(entry, platform2));
   }
   if (platform2 === "win32") {
-    if (env.APPDATA) push((0, import_node_path23.join)(env.APPDATA, "npm"));
-    if (env.LOCALAPPDATA) push((0, import_node_path23.join)(env.LOCALAPPDATA, "npm"));
+    if (env.APPDATA) push((0, import_node_path24.join)(env.APPDATA, "npm"));
+    if (env.LOCALAPPDATA) push((0, import_node_path24.join)(env.LOCALAPPDATA, "npm"));
   } else {
-    push((0, import_node_path23.join)(home, ".local", "bin"));
+    push((0, import_node_path24.join)(home, ".local", "bin"));
   }
   return out;
 }
@@ -25321,23 +25356,23 @@ function jervCliCandidatePaths(env = process.env, home = (0, import_node_os10.ho
   const names = platform2 === "win32" ? WIN_NAMES : POSIX_NAMES;
   const out = [];
   for (const dir of jervCliCandidateDirs(env, home, platform2)) {
-    for (const name of names) out.push((0, import_node_path23.join)(dir, name));
+    for (const name of names) out.push((0, import_node_path24.join)(dir, name));
   }
   return out;
 }
-function resolveJervCliPath(env = process.env, home = (0, import_node_os10.homedir)(), platform2 = process.platform, exists = import_node_fs25.existsSync) {
+function resolveJervCliPath(env = process.env, home = (0, import_node_os10.homedir)(), platform2 = process.platform, exists = import_node_fs26.existsSync) {
   for (const candidate of jervCliCandidatePaths(env, home, platform2)) {
     if (exists(candidate)) return candidate;
   }
   return void 0;
 }
-function resolveJervCliNodeEntry(shimPath, exists = import_node_fs25.existsSync) {
-  const entry = (0, import_node_path23.join)((0, import_node_path23.dirname)(shimPath), JERV_CLI_ENTRY);
+function resolveJervCliNodeEntry(shimPath, exists = import_node_fs26.existsSync) {
+  const entry = (0, import_node_path24.join)((0, import_node_path24.dirname)(shimPath), JERV_CLI_ENTRY);
   return exists(entry) ? entry : void 0;
 }
 function jervCliExecFileArgs(args, opts = {}) {
   const platform2 = opts.platform ?? process.platform;
-  const exists = opts.exists ?? import_node_fs25.existsSync;
+  const exists = opts.exists ?? import_node_fs26.existsSync;
   const resolved = resolveJervCliPath(opts.env ?? process.env, opts.home ?? (0, import_node_os10.homedir)(), platform2, exists);
   if (resolved) {
     const entry = resolveJervCliNodeEntry(resolved, exists);
@@ -25427,26 +25462,26 @@ function globalNodeModulesRoots(host) {
     out.push(dir);
   };
   const prefix = env.npm_config_prefix?.trim();
-  if (prefix) push(platform2 === "win32" ? (0, import_node_path24.join)(prefix, "node_modules") : (0, import_node_path24.join)(prefix, "lib", "node_modules"));
+  if (prefix) push(platform2 === "win32" ? (0, import_node_path25.join)(prefix, "node_modules") : (0, import_node_path25.join)(prefix, "lib", "node_modules"));
   for (const dir of jervCliCandidateDirs(env, host.home ?? (0, import_node_os11.homedir)(), platform2)) {
-    push((0, import_node_path24.join)(dir, "node_modules"));
-    push((0, import_node_path24.join)((0, import_node_path24.dirname)(dir), "lib", "node_modules"));
+    push((0, import_node_path25.join)(dir, "node_modules"));
+    push((0, import_node_path25.join)((0, import_node_path25.dirname)(dir), "lib", "node_modules"));
   }
   return out;
 }
 function readHead(path2) {
   let fd;
   try {
-    fd = (0, import_node_fs26.openSync)(path2, "r");
+    fd = (0, import_node_fs27.openSync)(path2, "r");
     const buffer = new Uint8Array(MAGIC_HEAD_BYTES);
-    const read = (0, import_node_fs26.readSync)(fd, buffer, 0, MAGIC_HEAD_BYTES, 0);
+    const read = (0, import_node_fs27.readSync)(fd, buffer, 0, MAGIC_HEAD_BYTES, 0);
     return buffer.subarray(0, read);
   } catch {
     return void 0;
   } finally {
     if (fd !== void 0) {
       try {
-        (0, import_node_fs26.closeSync)(fd);
+        (0, import_node_fs27.closeSync)(fd);
       } catch {
       }
     }
@@ -25454,7 +25489,7 @@ function readHead(path2) {
 }
 function fileBytes(path2) {
   try {
-    return (0, import_node_fs26.statSync)(path2).size;
+    return (0, import_node_fs27.statSync)(path2).size;
   } catch {
     return void 0;
   }
@@ -25468,17 +25503,17 @@ function readClaudeBinaryState(host = {}) {
   const arch = host.arch ?? process.arch;
   const magic = EXECUTABLE_MAGIC[platform2];
   if (!magic) return void 0;
-  const packageRoot = globalNodeModulesRoots(host).map((root) => (0, import_node_path24.join)(root, ...PACKAGE.split("/"))).find((dir) => (0, import_node_fs26.existsSync)((0, import_node_path24.join)(dir, "package.json")));
+  const packageRoot = globalNodeModulesRoots(host).map((root) => (0, import_node_path25.join)(root, ...PACKAGE.split("/"))).find((dir) => (0, import_node_fs27.existsSync)((0, import_node_path25.join)(dir, "package.json")));
   if (!packageRoot) return void 0;
   const keys = platformPackageKeys(platform2, arch);
   const fallbackPackage = `${PACKAGE}-${keys[0]}`;
   let manifest;
   try {
-    manifest = JSON.parse((0, import_node_fs26.readFileSync)((0, import_node_path24.join)(packageRoot, "package.json"), "utf8"));
+    manifest = JSON.parse((0, import_node_fs27.readFileSync)((0, import_node_path25.join)(packageRoot, "package.json"), "utf8"));
   } catch (e) {
     return {
       state: "unreadable",
-      binPath: (0, import_node_path24.join)(packageRoot, "package.json"),
+      binPath: (0, import_node_path25.join)(packageRoot, "package.json"),
       expectedMagic: magic.name,
       platformPackage: fallbackPackage,
       error: `package.json could not be read \u2014 ${e.message}`
@@ -25495,17 +25530,17 @@ function readClaudeBinaryState(host = {}) {
       error: "package.json declares no `bin` entry \u2014 the executed file cannot be resolved"
     };
   }
-  const binPath = (0, import_node_path24.join)(packageRoot, binRelative);
-  const binName = (0, import_node_path24.basename)(binRelative);
+  const binPath = (0, import_node_path25.join)(packageRoot, binRelative);
+  const binName = (0, import_node_path25.basename)(binRelative);
   const optional = manifest.optionalDependencies;
   const publishes = (name) => typeof optional === "object" && optional !== null && Object.prototype.hasOwnProperty.call(optional, name);
   const published = keys.map((key) => `${PACKAGE}-${key}`).filter(publishes);
   if (published.length === 0) return void 0;
   const binIn = (name) => [
-    (0, import_node_path24.join)(packageRoot, "node_modules", ...name.split("/"), binName),
-    (0, import_node_path24.join)((0, import_node_path24.dirname)((0, import_node_path24.dirname)(packageRoot)), ...name.split("/"), binName)
+    (0, import_node_path25.join)(packageRoot, "node_modules", ...name.split("/"), binName),
+    (0, import_node_path25.join)((0, import_node_path25.dirname)((0, import_node_path25.dirname)(packageRoot)), ...name.split("/"), binName)
   ];
-  const found = published.map((name) => ({ name, path: binIn(name).find((file) => (0, import_node_fs26.existsSync)(file)) })).find((c) => c.path);
+  const found = published.map((name) => ({ name, path: binIn(name).find((file) => (0, import_node_fs27.existsSync)(file)) })).find((c) => c.path);
   const platformPackage = found?.name ?? published[0];
   let source;
   let sourceProblem;
@@ -25516,7 +25551,7 @@ function readClaudeBinaryState(host = {}) {
   } else {
     source = { path: found.path, bytes: fileBytes(found.path) ?? 0 };
   }
-  if (!(0, import_node_fs26.existsSync)(binPath)) {
+  if (!(0, import_node_fs27.existsSync)(binPath)) {
     return { state: "missing", binPath, expectedMagic: magic.name, platformPackage, ...source ? { source } : {}, ...sourceProblem ? { sourceProblem } : {} };
   }
   const head = readHead(binPath);
@@ -25559,9 +25594,9 @@ function healClaudeBinary(host = {}, onStep) {
   const platform2 = host.platform ?? process.platform;
   const aside = `${probe.binPath}.stub-${Date.now()}`;
   let renamed = false;
-  if ((0, import_node_fs26.existsSync)(probe.binPath)) {
+  if ((0, import_node_fs27.existsSync)(probe.binPath)) {
     try {
-      (0, import_node_fs26.renameSync)(probe.binPath, aside);
+      (0, import_node_fs27.renameSync)(probe.binPath, aside);
       renamed = true;
       onStep?.(`renamed the stub aside: ${aside}`);
     } catch (e) {
@@ -25570,12 +25605,12 @@ function healClaudeBinary(host = {}, onStep) {
   }
   try {
     onStep?.(`copying ${probe.source.path} \u2192 ${probe.binPath} (${(probe.source.bytes / 1e6).toFixed(0)} MB)`);
-    (0, import_node_fs26.copyFileSync)(probe.source.path, probe.binPath);
-    if (platform2 !== "win32") (0, import_node_fs26.chmodSync)(probe.binPath, 493);
+    (0, import_node_fs27.copyFileSync)(probe.source.path, probe.binPath);
+    if (platform2 !== "win32") (0, import_node_fs27.chmodSync)(probe.binPath, 493);
   } catch (e) {
     if (renamed) {
       try {
-        (0, import_node_fs26.renameSync)(aside, probe.binPath);
+        (0, import_node_fs27.renameSync)(aside, probe.binPath);
       } catch {
         return { ok: false, detail: `copy failed (${e.message}) and the stub could not be restored \u2014 the original is at ${aside}` };
       }
@@ -25589,7 +25624,7 @@ function healClaudeBinary(host = {}, onStep) {
   let kept = false;
   if (renamed) {
     try {
-      (0, import_node_fs26.rmSync)(aside);
+      (0, import_node_fs27.rmSync)(aside);
     } catch {
       kept = true;
     }
@@ -26923,8 +26958,8 @@ async function announceRelease(deps, args) {
 // src/repo-index.ts
 var import_node_crypto4 = require("node:crypto");
 var import_node_child_process13 = require("node:child_process");
-var import_node_fs27 = require("node:fs");
-var import_node_path25 = require("node:path");
+var import_node_fs28 = require("node:fs");
+var import_node_path26 = require("node:path");
 var REPO_INDEX_SCHEMA = 1;
 var HARD_DENY = [
   /(^|\/)\.env(\.|$)/i,
@@ -27049,11 +27084,11 @@ function loadReadmeHints(cwd, candidatePaths) {
   }
   for (const rel of readmes) {
     if (isHardDeniedPath(rel)) continue;
-    const abs = (0, import_node_path25.join)(cwd, ...rel.split("/"));
-    if (!(0, import_node_fs27.existsSync)(abs)) continue;
+    const abs = (0, import_node_path26.join)(cwd, ...rel.split("/"));
+    if (!(0, import_node_fs28.existsSync)(abs)) continue;
     let text;
     try {
-      text = (0, import_node_fs27.readFileSync)(abs, "utf8");
+      text = (0, import_node_fs28.readFileSync)(abs, "utf8");
     } catch {
       continue;
     }
@@ -27066,7 +27101,7 @@ function loadReadmeHints(cwd, candidatePaths) {
   return hints;
 }
 function toPosix(p) {
-  return p.split(import_node_path25.sep).join("/");
+  return p.split(import_node_path26.sep).join("/");
 }
 function listCandidatePaths(cwd, exec = import_node_child_process13.execFileSync) {
   try {
@@ -27088,11 +27123,11 @@ function rebuildRepoIndex(cwd, repoSlug2) {
   for (const rel of candidates) {
     if (ignored.has(rel)) continue;
     if (isHardDeniedPath(rel)) continue;
-    const abs = (0, import_node_path25.join)(cwd, ...rel.split("/"));
-    if (!(0, import_node_fs27.existsSync)(abs)) continue;
+    const abs = (0, import_node_path26.join)(cwd, ...rel.split("/"));
+    if (!(0, import_node_fs28.existsSync)(abs)) continue;
     let text;
     try {
-      text = (0, import_node_fs27.readFileSync)(abs, "utf8");
+      text = (0, import_node_fs28.readFileSync)(abs, "utf8");
     } catch {
       continue;
     }
@@ -27117,16 +27152,16 @@ function rebuildRepoIndex(cwd, repoSlug2) {
     entries
   };
   const store = repoIndexStorePath(cwd);
-  (0, import_node_fs27.mkdirSync)((0, import_node_path25.dirname)(store), { recursive: true });
-  (0, import_node_fs27.writeFileSync)(store, `${JSON.stringify(projection, null, 2)}
+  (0, import_node_fs28.mkdirSync)((0, import_node_path26.dirname)(store), { recursive: true });
+  (0, import_node_fs28.writeFileSync)(store, `${JSON.stringify(projection, null, 2)}
 `, "utf8");
   return projection;
 }
 function loadRepoIndex(cwd) {
   const store = repoIndexStorePath(cwd);
-  if (!(0, import_node_fs27.existsSync)(store)) return null;
+  if (!(0, import_node_fs28.existsSync)(store)) return null;
   try {
-    const raw = JSON.parse((0, import_node_fs27.readFileSync)(store, "utf8"));
+    const raw = JSON.parse((0, import_node_fs28.readFileSync)(store, "utf8"));
     if (raw?.schema !== REPO_INDEX_SCHEMA || !Array.isArray(raw.entries)) return null;
     return raw;
   } catch {
@@ -27198,7 +27233,7 @@ function inferRepoSlug(cwd, exec = import_node_child_process13.execFileSync) {
     if (m?.[1]) return m[1].toLowerCase();
   } catch {
   }
-  return ((0, import_node_path25.basename)(cwd) || "local").toLowerCase();
+  return ((0, import_node_path26.basename)(cwd) || "local").toLowerCase();
 }
 
 // src/repo-index-cloud-client.ts
@@ -27338,9 +27373,9 @@ async function gcRepoIndexCloud(deps) {
 }
 
 // src/repo-index-sync.ts
-var import_node_fs28 = require("node:fs");
+var import_node_fs29 = require("node:fs");
 var import_node_os12 = require("node:os");
-var import_node_path26 = require("node:path");
+var import_node_path27 = require("node:path");
 var import_node_child_process14 = require("node:child_process");
 var MAX_EMBED_BACKFILL_ROUNDS = 40;
 function normalizeRepo(raw) {
@@ -27384,7 +27419,7 @@ async function syncEstateRepoIndex(opts) {
   const failed = [];
   const skipped = [];
   for (const repo of repos) {
-    const dir = (0, import_node_fs28.mkdtempSync)((0, import_node_path26.join)((0, import_node_os12.tmpdir)(), "mmi-repo-index-"));
+    const dir = (0, import_node_fs29.mkdtempSync)((0, import_node_path27.join)((0, import_node_os12.tmpdir)(), "mmi-repo-index-"));
     try {
       shallowClone(repo, dir, opts.githubToken);
       const built = rebuildRepoIndex(dir, repo);
@@ -27434,7 +27469,7 @@ async function syncEstateRepoIndex(opts) {
       failed.push({ repo, error: e.message });
     } finally {
       try {
-        (0, import_node_fs28.rmSync)(dir, { recursive: true, force: true });
+        (0, import_node_fs29.rmSync)(dir, { recursive: true, force: true });
       } catch {
       }
     }
@@ -27443,7 +27478,7 @@ async function syncEstateRepoIndex(opts) {
 }
 
 // src/repo-index-health.ts
-var import_node_fs29 = require("node:fs");
+var import_node_fs30 = require("node:fs");
 
 // testdata/repo-index-golden-queries.json
 var repo_index_golden_queries_default = {
@@ -27485,7 +27520,7 @@ function assertGoldenSuite(raw, source) {
 function loadGoldenSuite(path2) {
   let text;
   try {
-    text = (0, import_node_fs29.readFileSync)(path2, "utf8");
+    text = (0, import_node_fs30.readFileSync)(path2, "utf8");
   } catch (e) {
     throw new Error(`golden suite unreadable at ${path2}: ${e.message}`);
   }
@@ -27631,8 +27666,8 @@ async function runRepoIndexHealth(opts) {
 
 // src/spawn-policy-core.ts
 var import_node_child_process15 = require("node:child_process");
-var import_node_fs30 = require("node:fs");
-var import_node_path27 = require("node:path");
+var import_node_fs31 = require("node:fs");
+var import_node_path28 = require("node:path");
 var SPAWNERS = ["spawn", "spawnSync", "exec", "execSync", "execFile", "execFileSync"];
 var CALL_SOURCE = String.raw`(^|[^.\w$])(${SPAWNERS.join("|")})\s*\(`;
 var SOURCE_EXT = /\.(ts|mts|cts|js|mjs|cjs)$/;
@@ -27718,7 +27753,7 @@ function runSpawnPolicy(root) {
   for (const file of files) {
     let raw;
     try {
-      raw = (0, import_node_fs30.readFileSync)((0, import_node_path27.join)(root, file), "utf8");
+      raw = (0, import_node_fs31.readFileSync)((0, import_node_path28.join)(root, file), "utf8");
     } catch {
       continue;
     }
@@ -27736,8 +27771,8 @@ function runSpawnPolicy(root) {
 
 // src/test-policy-core.ts
 var import_node_child_process16 = require("node:child_process");
-var import_node_fs31 = require("node:fs");
-var import_node_path28 = require("node:path");
+var import_node_fs32 = require("node:fs");
+var import_node_path29 = require("node:path");
 var POLICY_FILE = "test-policy.json";
 var TEST_RE = /\.(?:test|spec)\.[cm]?[jt]sx?$/;
 var PY_TEST_RE = /(?:^|\/)test_[^/]*\.py$|_test\.py$/;
@@ -27790,7 +27825,7 @@ function isTestPath(path2) {
   return TEST_RE.test(path2) || PY_TEST_RE.test(path2);
 }
 function loadPolicy(root, readFile9 = readFileOrNull2) {
-  const raw = readFile9((0, import_node_path28.join)(root, POLICY_FILE));
+  const raw = readFile9((0, import_node_path29.join)(root, POLICY_FILE));
   if (raw == null) return { mandatory: [], declared: false };
   try {
     return { ...JSON.parse(raw), declared: true };
@@ -27800,7 +27835,7 @@ function loadPolicy(root, readFile9 = readFileOrNull2) {
 }
 function readFileOrNull2(path2) {
   try {
-    return (0, import_node_fs31.readFileSync)(path2, "utf8");
+    return (0, import_node_fs32.readFileSync)(path2, "utf8");
   } catch {
     return null;
   }
@@ -27827,12 +27862,12 @@ function classify(changed, policy, present = () => false) {
   const removedProtected = [...removed].filter((p) => protectedBy.has(p)).map((p) => ({ path: p, why: protectedBy.get(p) ?? "" }));
   return { mandatoryHits, untestedHits, testChanges, addedTests, removedProtected };
 }
-function unresolvedProtectedEntries(policy, root, exists = (path2) => (0, import_node_fs31.existsSync)(path2)) {
-  return (policy.protected ?? []).map((p) => p.path).filter((p) => !exists((0, import_node_path28.join)(root, p)));
+function unresolvedProtectedEntries(policy, root, exists = (path2) => (0, import_node_fs32.existsSync)(path2)) {
+  return (policy.protected ?? []).map((p) => p.path).filter((p) => !exists((0, import_node_path29.join)(root, p)));
 }
-function unresolvedSatisfiers(policy, root, exists = (path2) => (0, import_node_fs31.existsSync)(path2)) {
+function unresolvedSatisfiers(policy, root, exists = (path2) => (0, import_node_fs32.existsSync)(path2)) {
   const declared = (policy.mandatory ?? []).flatMap((m) => m.satisfiedBy ?? []);
-  return [...new Set(declared)].filter((p) => !exists((0, import_node_path28.join)(root, p)));
+  return [...new Set(declared)].filter((p) => !exists((0, import_node_path29.join)(root, p)));
 }
 function evaluate(changed, policy, present = () => false) {
   const { mandatoryHits, untestedHits, testChanges, addedTests, removedProtected } = classify(changed, policy, present);
@@ -28014,13 +28049,13 @@ function changedFilesSince(base, cwd) {
 }
 function runTestPolicy(root, deps = {}) {
   const policy = deps.policy ?? loadPolicy(root);
-  const exists = deps.exists ?? ((path2) => (0, import_node_fs31.existsSync)(path2));
+  const exists = deps.exists ?? ((path2) => (0, import_node_fs32.existsSync)(path2));
   const counts = { mandatoryCount: (policy.mandatory ?? []).length, protectedCount: (policy.protected ?? []).length };
   const base = deps.changed ? "(injected)" : resolveBase(root, deps.base);
   const refusal = deps.changed ? null : untrustworthyRange(root, base);
   const changed = deps.changed ?? (refusal ? [] : changedFilesSince(base, root));
   const lookup = deps.override !== void 0 ? { override: deps.override, refusals: [] } : !deps.changed && !refusal ? readOverride(base, root) : { override: null, refusals: [] };
-  const present = (path2) => exists((0, import_node_path28.join)(root, path2));
+  const present = (path2) => exists((0, import_node_path29.join)(root, path2));
   const removedByThisDiff = removedPaths(changed);
   const staleFindings = [];
   const unresolved = unresolvedProtectedEntries(policy, root, exists).filter((p) => !removedByThisDiff.has(p));
@@ -28058,8 +28093,8 @@ function runTestPolicy(root, deps = {}) {
 }
 
 // src/project-info-sync.ts
-var import_node_fs32 = require("node:fs");
-var import_node_path29 = require("node:path");
+var import_node_fs33 = require("node:fs");
+var import_node_path30 = require("node:path");
 var UPDATE_PROJECT_INFO = `mutation($projectId: ID!, $shortDescription: String!, $readme: String!) {
   updateProjectV2(input: { projectId: $projectId, shortDescription: $shortDescription, readme: $readme }) {
     projectV2 { id }
@@ -28104,14 +28139,14 @@ function sharedName(entries, fallback) {
 }
 function buildProjectInfoSyncPlan(targetRepo2, project2, projects, repoRoot2) {
   if (!project2.projectId) throw new Error(`org project sync-info: ${targetRepo2} registry META has no projectId`);
-  const readmePath = (0, import_node_path29.join)(repoRoot2, "README.md");
-  if (!(0, import_node_fs32.existsSync)(readmePath)) throw new Error(`org project sync-info: ${targetRepo2} has no README.md`);
+  const readmePath = (0, import_node_path30.join)(repoRoot2, "README.md");
+  if (!(0, import_node_fs33.existsSync)(readmePath)) throw new Error(`org project sync-info: ${targetRepo2} has no README.md`);
   const entries = entriesFor(project2, projects);
   const memberRepos = [...new Set(entries.flatMap((entry) => entry.repos ?? []))].filter((repo) => /^[^/]+\/[^/]+$/.test(repo)).sort((a, b) => a.localeCompare(b));
   const projectName = sharedName(entries, project2.name?.trim() || targetRepo2.split("/").pop() || targetRepo2);
   if (!memberRepos.length) throw new Error(`org project sync-info: project ${projectName} has no registered member repos`);
   const entryNames = entries.map((entry) => entry.name?.trim()).filter((name) => Boolean(name));
-  const shortDescription = memberRepos.length === 1 ? shortDescriptionFromReadme((0, import_node_fs32.readFileSync)(readmePath, "utf8")) : `Shared work across ${new Intl.ListFormat("en", { type: "conjunction" }).format(entryNames)}.`;
+  const shortDescription = memberRepos.length === 1 ? shortDescriptionFromReadme((0, import_node_fs33.readFileSync)(readmePath, "utf8")) : `Shared work across ${new Intl.ListFormat("en", { type: "conjunction" }).format(entryNames)}.`;
   const lines = [
     `# ${projectName}`,
     "",
@@ -28130,8 +28165,8 @@ function buildProjectInfoSyncPlan(targetRepo2, project2, projects, repoRoot2) {
   const targetBase = `https://github.com/${targetRepo2}`;
   const targetBranch = branchFor(targetRepo2, projects);
   const orgDocs = [
-    (0, import_node_fs32.existsSync)((0, import_node_path29.join)(repoRoot2, "docs", "org-readme.md")) ? `- [Org identity](${targetBase}/blob/${targetBranch}/docs/org-readme.md)` : "",
-    (0, import_node_fs32.existsSync)((0, import_node_path29.join)(repoRoot2, "docs", "org-architecture.md")) ? `- [Org architecture](${targetBase}/blob/${targetBranch}/docs/org-architecture.md)` : ""
+    (0, import_node_fs33.existsSync)((0, import_node_path30.join)(repoRoot2, "docs", "org-readme.md")) ? `- [Org identity](${targetBase}/blob/${targetBranch}/docs/org-readme.md)` : "",
+    (0, import_node_fs33.existsSync)((0, import_node_path30.join)(repoRoot2, "docs", "org-architecture.md")) ? `- [Org architecture](${targetBase}/blob/${targetBranch}/docs/org-architecture.md)` : ""
   ].filter(Boolean);
   if (orgDocs.length) lines.push("", "## Organisation docs", "", ...orgDocs);
   return { projectId: project2.projectId, projectName, targetRepo: targetRepo2, memberRepos, shortDescription, readme: `${lines.join("\n")}
@@ -28916,8 +28951,8 @@ function writeError(res) {
 }
 
 // src/secrets-commands.ts
-var import_node_fs33 = require("node:fs");
-var import_node_path30 = require("node:path");
+var import_node_fs34 = require("node:fs");
+var import_node_path31 = require("node:path");
 var import_node_os13 = require("node:os");
 
 // src/secrets-diff.ts
@@ -29020,18 +29055,18 @@ function collectMap(value, previous = []) {
   return [...previous, value];
 }
 async function decryptRailsCredentials(input) {
-  const appDir = (0, import_node_path30.resolve)(input.appDir ?? process.cwd());
+  const appDir = (0, import_node_path31.resolve)(input.appDir ?? process.cwd());
   const credentialsFile = input.credentialsFile ?? DEFAULT_RAILS_CREDENTIALS_FILE;
   const masterKeyFile = input.masterKeyFile ?? DEFAULT_RAILS_MASTER_KEY_FILE;
-  const credentialsPath = (0, import_node_path30.resolve)(appDir, credentialsFile);
-  const masterKeyPath = (0, import_node_path30.resolve)(appDir, masterKeyFile);
+  const credentialsPath = (0, import_node_path31.resolve)(appDir, credentialsFile);
+  const masterKeyPath = (0, import_node_path31.resolve)(appDir, masterKeyFile);
   const env = {
     ...process.env,
     MMI_RAILS_CREDENTIALS_FILE: credentialsPath,
     MMI_RAILS_MASTER_KEY_FILE: masterKeyPath
   };
-  if ((0, import_node_fs33.existsSync)(masterKeyPath)) {
-    env.RAILS_MASTER_KEY = (0, import_node_fs33.readFileSync)(masterKeyPath, "utf8").trim();
+  if ((0, import_node_fs34.existsSync)(masterKeyPath)) {
+    env.RAILS_MASTER_KEY = (0, import_node_fs34.readFileSync)(masterKeyPath, "utf8").trim();
   }
   const script = [
     'require "json"',
@@ -29041,9 +29076,9 @@ async function decryptRailsCredentials(input) {
     'config = ActiveSupport::EncryptedConfiguration.new(config_path: config_path, key_path: key_path, env_key: "RAILS_MASTER_KEY", raise_if_missing_key: true)',
     "puts JSON.generate(config.config)"
   ].join("\n");
-  const scriptDir = (0, import_node_fs33.mkdtempSync)((0, import_node_path30.join)((0, import_node_os13.tmpdir)(), "mmi-rails-decrypt-"));
-  const scriptPath = (0, import_node_path30.join)(scriptDir, "decrypt.rb");
-  (0, import_node_fs33.writeFileSync)(scriptPath, script, "utf8");
+  const scriptDir = (0, import_node_fs34.mkdtempSync)((0, import_node_path31.join)((0, import_node_os13.tmpdir)(), "mmi-rails-decrypt-"));
+  const scriptPath = (0, import_node_path31.join)(scriptDir, "decrypt.rb");
+  (0, import_node_fs34.writeFileSync)(scriptPath, script, "utf8");
   try {
     const args = ["exec", "ruby", scriptPath];
     const cmd = process.platform === "win32" ? "cmd.exe" : "bundle";
@@ -29055,7 +29090,7 @@ async function decryptRailsCredentials(input) {
     });
     return JSON.parse(stdout);
   } finally {
-    (0, import_node_fs33.rmSync)(scriptDir, { recursive: true, force: true });
+    (0, import_node_fs34.rmSync)(scriptDir, { recursive: true, force: true });
   }
 }
 async function readSecretStdin() {
@@ -29145,7 +29180,7 @@ function registerSecretsCommands(program3) {
     let body;
     if (o.file) {
       try {
-        body = (0, import_node_fs33.readFileSync)((0, import_node_path30.resolve)(o.file), "utf8");
+        body = (0, import_node_fs34.readFileSync)((0, import_node_path31.resolve)(o.file), "utf8");
       } catch (e) {
         return fail(`secrets org-catalog: cannot read --file ${o.file}: ${e.message}`);
       }
@@ -29250,7 +29285,7 @@ function registerSecretsCommands(program3) {
       {
         ...d,
         decryptRailsCredentials,
-        removeFile: (path2) => (0, import_node_fs33.unlinkSync)((0, import_node_path30.resolve)(o.appDir ?? process.cwd(), path2))
+        removeFile: (path2) => (0, import_node_fs34.unlinkSync)((0, import_node_path31.resolve)(o.appDir ?? process.cwd(), path2))
       },
       {
         repo: o.repo,
@@ -29455,7 +29490,7 @@ function emitCliCallTelemetry(command) {
 }
 
 // src/box-commands.ts
-var import_node_fs34 = require("node:fs");
+var import_node_fs35 = require("node:fs");
 
 // src/box.ts
 var BOX_KEYS = {
@@ -29658,7 +29693,7 @@ function registerBoxCommands(program3) {
       }
       if (o.json) console.log(JSON.stringify({ box: found, incomplete }, null, 2));
       else if (o.ssh && o.script) {
-        (0, import_node_fs34.writeFileSync)(o.script, sshRecipeScript(found), "utf8");
+        (0, import_node_fs35.writeFileSync)(o.script, sshRecipeScript(found), "utf8");
         console.log(`wrote ${o.script} \u2014 run: bash "${o.script}"`);
       } else if (o.ssh) console.log(`${formatSshRecipe(found)}
 ${SSH_RECIPE_AGENT_NOTE}`);
@@ -29977,7 +30012,7 @@ function registerSchedulesCommands(program3) {
 
 // src/schedules-lift-command.ts
 var import_promises6 = require("node:fs/promises");
-var import_node_path31 = require("node:path");
+var import_node_path32 = require("node:path");
 var DEFAULT_WORKFLOWS_DIR = ".github/workflows";
 var SCHEDULE_REPO_RE = /^[A-Za-z0-9_.-]+$/;
 var SchedulesLiftUsageError = class extends Error {
@@ -30004,7 +30039,7 @@ async function readWorkflowFiles(dir) {
   const files = [];
   for (const name of names.sort()) {
     if (!/\.ya?ml$/.test(name)) continue;
-    files.push({ path: `.github/workflows/${name}`, text: await (0, import_promises6.readFile)((0, import_node_path31.join)(dir, name), "utf8") });
+    files.push({ path: `.github/workflows/${name}`, text: await (0, import_promises6.readFile)((0, import_node_path32.join)(dir, name), "utf8") });
   }
   return files;
 }
@@ -30152,9 +30187,9 @@ function registerEdgeCommands(program3) {
 }
 
 // src/bootstrap-commands.ts
-var import_node_fs35 = require("node:fs");
+var import_node_fs36 = require("node:fs");
 var import_node_os14 = require("node:os");
-var import_node_path32 = require("node:path");
+var import_node_path33 = require("node:path");
 
 // src/bootstrap-drift.ts
 var import_node_crypto6 = require("node:crypto");
@@ -31034,13 +31069,13 @@ function registerBootstrapCommands(program3) {
       client: defaultGitHubClient(),
       projectMeta: meta,
       deployModel: typeof meta?.deployModel === "string" ? meta.deployModel : void 0,
-      readLocalFile: (path2) => path2 === "projects.json" && apiProjects != null ? apiProjects : (0, import_node_fs35.existsSync)(path2) ? (0, import_node_fs35.readFileSync)(path2, "utf8") : null,
+      readLocalFile: (path2) => path2 === "projects.json" && apiProjects != null ? apiProjects : (0, import_node_fs36.existsSync)(path2) ? (0, import_node_fs36.readFileSync)(path2, "utf8") : null,
       // requiredGcpApis is stored as an array by a JSON write, but `org project set --var KEY=VALUE` stores a raw
       // comma-string — accept either so the seeded value verifies regardless of how it was written.
       // #3689: the same committed map the org access audit reads (#3664), so a sanctioned admin is not a
       // permanent bootstrap failure on one surface and an intended state on the other. Absent file → no
       // sanction, which is the pre-#3664 behaviour.
-      sanctionedAdmins: (0, import_node_fs35.existsSync)("access-matrix.json") ? entriesValueByCanonicalRepo(loadSanctionedAdmins((0, import_node_fs35.readFileSync)("access-matrix.json", "utf8")), repo) : void 0,
+      sanctionedAdmins: (0, import_node_fs36.existsSync)("access-matrix.json") ? entriesValueByCanonicalRepo(loadSanctionedAdmins((0, import_node_fs36.readFileSync)("access-matrix.json", "utf8")), repo) : void 0,
       requiredGcpApis: (() => {
         const v = meta?.requiredGcpApis;
         if (Array.isArray(v)) return v;
@@ -31093,14 +31128,14 @@ function registerBootstrapCommands(program3) {
   bootstrap.command("drift").description("#3818: compare every org-owned whole-file seed against MMI-Hub's copy across the registry roster; read-only").option("--repo <owner/repo>", "audit one repo instead of the roster (never a fleet verdict)").option("--json", "machine-readable output").action(async () => {
     const o = { repo: rawValue("--repo", ""), json: rawFlag("--json") };
     const manifestPath = "skills/bootstrap/seeds/manifest.json";
-    if (!(0, import_node_fs35.existsSync)(manifestPath)) return fail(`bootstrap drift: ${manifestPath} not found; run from the MMI-Hub repo root \u2014 the Hub's copies ARE the reference this compares against`);
+    if (!(0, import_node_fs36.existsSync)(manifestPath)) return fail(`bootstrap drift: ${manifestPath} not found; run from the MMI-Hub repo root \u2014 the Hub's copies ARE the reference this compares against`);
     const seedSource = await resolveHubSeedSource(execGitForSeedSource);
     if (!seedSource.ok) return fail(`bootstrap drift: ${seedSource.reason}`);
-    const manifest = loadBootstrapSeeds((0, import_node_fs35.readFileSync)(manifestPath, "utf8"));
+    const manifest = loadBootstrapSeeds((0, import_node_fs36.readFileSync)(manifestPath, "utf8"));
     const hubContents = /* @__PURE__ */ new Map();
     for (const s of manifest.seeds) {
       if (s.ownership !== "org" || s.source !== "self") continue;
-      hubContents.set(s.target, (0, import_node_fs35.existsSync)(s.target) ? (0, import_node_fs35.readFileSync)(s.target, "utf8") : null);
+      hubContents.set(s.target, (0, import_node_fs36.existsSync)(s.target) ? (0, import_node_fs36.readFileSync)(s.target, "utf8") : null);
     }
     let targets;
     let classOf = (_repo) => "deployable";
@@ -31179,10 +31214,10 @@ function registerBootstrapCommands(program3) {
       return fail(`bootstrap apply: ${e.message}`);
     }
     const manifestPath = "skills/bootstrap/seeds/manifest.json";
-    if (!(0, import_node_fs35.existsSync)(manifestPath)) return fail(`bootstrap apply: ${manifestPath} not found; bootstrap runs from the MMI-Hub repo root by design \u2014 it stamps org-level resources (Project, Ruleset, secrets, access) through the GitHub App, which is only authorized from the Hub checkout`);
+    if (!(0, import_node_fs36.existsSync)(manifestPath)) return fail(`bootstrap apply: ${manifestPath} not found; bootstrap runs from the MMI-Hub repo root by design \u2014 it stamps org-level resources (Project, Ruleset, secrets, access) through the GitHub App, which is only authorized from the Hub checkout`);
     const seedSource = await resolveHubSeedSource(execGitForSeedSource);
     if (!seedSource.ok) return fail(`bootstrap apply: ${seedSource.reason}`);
-    const manifest = loadBootstrapSeeds((0, import_node_fs35.readFileSync)(manifestPath, "utf8"));
+    const manifest = loadBootstrapSeeds((0, import_node_fs36.readFileSync)(manifestPath, "utf8"));
     const baseBranch = o.class === "content" ? "main" : "development";
     const slug = parsedRepo.slug;
     const onlyTarget = o.only.trim();
@@ -31193,16 +31228,16 @@ function registerBootstrapCommands(program3) {
   ${known}`);
     }
     const gh = async (args) => execFileP2("gh", args, { timeout: 2e4 });
-    const readFile9 = (p) => (0, import_node_fs35.existsSync)(p) ? (0, import_node_fs35.readFileSync)(p, "utf8") : null;
+    const readFile9 = (p) => (0, import_node_fs36.existsSync)(p) ? (0, import_node_fs36.readFileSync)(p, "utf8") : null;
     const enc = (p) => p.split("/").map(encodeURIComponent).join("/");
     const putSeed = async (target, content, ref, sha) => {
-      const tmp = (0, import_node_path32.join)((0, import_node_os14.tmpdir)(), `mmi-seed-${process.pid}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}.json`);
-      (0, import_node_fs35.writeFileSync)(tmp, JSON.stringify(contentPutBody(target, content, ref, sha)), "utf8");
+      const tmp = (0, import_node_path33.join)((0, import_node_os14.tmpdir)(), `mmi-seed-${process.pid}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}.json`);
+      (0, import_node_fs36.writeFileSync)(tmp, JSON.stringify(contentPutBody(target, content, ref, sha)), "utf8");
       try {
         await gh(contentPutInputArgs(repo, target, tmp));
       } finally {
         try {
-          (0, import_node_fs35.unlinkSync)(tmp);
+          (0, import_node_fs36.unlinkSync)(tmp);
         } catch {
         }
       }
@@ -31467,10 +31502,10 @@ LIVE apply to ${repo}:
   bootstrap.command("propagate").description("#4238: re-entrant canary\u2192wave tick \u2014 plan (or, with --execute, open) per-repo PRs fanning an org-owned seed out to the fleet").option("--target <path>", "the manifest target to propagate (an ownership:org + source:self seed, e.g. .github/workflows/agent-pr.yml)").option("--execute", "LIVE tick via gh (master-gated) \u2014 opens/reuses per-repo seed-propagate PRs; dry-run prints the plan only").option("--json", "machine-readable output").action(async () => {
     const o = { target: rawValue("--target", ""), execute: rawFlag("--execute"), json: rawFlag("--json") };
     const manifestPath = "skills/bootstrap/seeds/manifest.json";
-    if (!(0, import_node_fs35.existsSync)(manifestPath)) return fail(`bootstrap propagate: ${manifestPath} not found; run from the MMI-Hub repo root \u2014 the Hub's copies ARE the desired state this tick propagates`);
+    if (!(0, import_node_fs36.existsSync)(manifestPath)) return fail(`bootstrap propagate: ${manifestPath} not found; run from the MMI-Hub repo root \u2014 the Hub's copies ARE the desired state this tick propagates`);
     const seedSource = await resolveHubSeedSource(execGitForSeedSource);
     if (!seedSource.ok) return fail(`bootstrap propagate: ${seedSource.reason}`);
-    const manifest = loadBootstrapSeeds((0, import_node_fs35.readFileSync)(manifestPath, "utf8"));
+    const manifest = loadBootstrapSeeds((0, import_node_fs36.readFileSync)(manifestPath, "utf8"));
     const propagatable = manifest.seeds.filter((s) => s.ownership === "org" && s.source === "self");
     if (!o.target) {
       return fail(`bootstrap propagate: --target <path> is required \u2014 one of:
@@ -31479,8 +31514,8 @@ LIVE apply to ${repo}:
     const seed = propagatable.find((s) => s.target === o.target);
     if (!seed) return fail(`bootstrap propagate: --target '${o.target}' names no ownership:org + source:self seed in ${manifestPath}. Propagatable targets:
   ${propagatable.map((s) => s.target).join("\n  ")}`);
-    if (!(0, import_node_fs35.existsSync)(seed.target)) return fail(`bootstrap propagate: the Hub's own copy of '${seed.target}' is missing \u2014 nothing to propagate`);
-    const hubContent = (0, import_node_fs35.readFileSync)(seed.target, "utf8");
+    if (!(0, import_node_fs36.existsSync)(seed.target)) return fail(`bootstrap propagate: the Hub's own copy of '${seed.target}' is missing \u2014 nothing to propagate`);
+    const hubContent = (0, import_node_fs36.readFileSync)(seed.target, "utf8");
     const isWorkflowSeed = seed.target.startsWith(".github/workflows/");
     const cfg = await loadConfig();
     const projects = await fetchProjectsList(registryClientDeps(cfg));
@@ -31489,9 +31524,9 @@ LIVE apply to ${repo}:
     }
     const rosterRepos2 = collectRegistryRepos(projects).filter((r) => r.toLowerCase() !== "mutmutco/mmi-hub");
     let independentCount = rosterRepos2.length;
-    if ((0, import_node_fs35.existsSync)("projects.json")) {
+    if ((0, import_node_fs36.existsSync)("projects.json")) {
       try {
-        const local = JSON.parse((0, import_node_fs35.readFileSync)("projects.json", "utf8"));
+        const local = JSON.parse((0, import_node_fs36.readFileSync)("projects.json", "utf8"));
         const localRepos = /* @__PURE__ */ new Set();
         for (const p of local.projects ?? []) for (const r of p.repos ?? []) {
           const full = (r.includes("/") ? r : `mutmutco/${r}`).toLowerCase();
@@ -31607,13 +31642,13 @@ LIVE apply to ${repo}:
         } catch {
           existingSha = void 0;
         }
-        const tmp = (0, import_node_path32.join)((0, import_node_os14.tmpdir)(), `mmi-propagate-${process.pid}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}.json`);
-        (0, import_node_fs35.writeFileSync)(tmp, JSON.stringify(contentPutBody(seed.target, hubContent, branch, existingSha)), "utf8");
+        const tmp = (0, import_node_path33.join)((0, import_node_os14.tmpdir)(), `mmi-propagate-${process.pid}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}.json`);
+        (0, import_node_fs36.writeFileSync)(tmp, JSON.stringify(contentPutBody(seed.target, hubContent, branch, existingSha)), "utf8");
         try {
           await gh(contentPutInputArgs(rec.repo, seed.target, tmp));
         } finally {
           try {
-            (0, import_node_fs35.unlinkSync)(tmp);
+            (0, import_node_fs36.unlinkSync)(tmp);
           } catch {
           }
         }
@@ -31671,10 +31706,10 @@ Rollback: \`mmi-cli devops bootstrap rollback ${rec.repo} --target ${seed.target
       return fail(`bootstrap rollback: ${e.message}`);
     }
     const manifestPath = "skills/bootstrap/seeds/manifest.json";
-    if (!(0, import_node_fs35.existsSync)(manifestPath)) return fail(`bootstrap rollback: ${manifestPath} not found; run from the MMI-Hub repo root \u2014 the manifest names which targets are org-owned and therefore propagated (and rollback-able)`);
+    if (!(0, import_node_fs36.existsSync)(manifestPath)) return fail(`bootstrap rollback: ${manifestPath} not found; run from the MMI-Hub repo root \u2014 the manifest names which targets are org-owned and therefore propagated (and rollback-able)`);
     const seedSource = await resolveHubSeedSource(execGitForSeedSource);
     if (!seedSource.ok) return fail(`bootstrap rollback: ${seedSource.reason}`);
-    const manifest = loadBootstrapSeeds((0, import_node_fs35.readFileSync)(manifestPath, "utf8"));
+    const manifest = loadBootstrapSeeds((0, import_node_fs36.readFileSync)(manifestPath, "utf8"));
     const propagatable = manifest.seeds.filter((s) => s.ownership === "org" && s.source === "self");
     if (!o.target) {
       return fail(`bootstrap rollback: --target <path> is required \u2014 one of:
@@ -31691,10 +31726,10 @@ Rollback: \`mmi-cli devops bootstrap rollback ${rec.repo} --target ${seed.target
     const enc = (p) => p.split("/").map(encodeURIComponent).join("/");
     let candidates;
     if (o.record) {
-      if (!(0, import_node_fs35.existsSync)(o.record)) return fail(`bootstrap rollback: --record '${o.record}' not found`);
+      if (!(0, import_node_fs36.existsSync)(o.record)) return fail(`bootstrap rollback: --record '${o.record}' not found`);
       let parsed;
       try {
-        parsed = JSON.parse((0, import_node_fs35.readFileSync)(o.record, "utf8"));
+        parsed = JSON.parse((0, import_node_fs36.readFileSync)(o.record, "utf8"));
       } catch (e) {
         return fail(`bootstrap rollback: --record '${o.record}' is not valid JSON: ${e.message}`);
       }
@@ -31763,13 +31798,13 @@ Rollback: \`mmi-cli devops bootstrap rollback ${rec.repo} --target ${seed.target
       } catch {
         existingSha = void 0;
       }
-      const tmp = (0, import_node_path32.join)((0, import_node_os14.tmpdir)(), `mmi-rollback-${process.pid}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}.json`);
-      (0, import_node_fs35.writeFileSync)(tmp, JSON.stringify(contentPutBody(seed.target, preSeedContent, plan.branch, existingSha)), "utf8");
+      const tmp = (0, import_node_path33.join)((0, import_node_os14.tmpdir)(), `mmi-rollback-${process.pid}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}.json`);
+      (0, import_node_fs36.writeFileSync)(tmp, JSON.stringify(contentPutBody(seed.target, preSeedContent, plan.branch, existingSha)), "utf8");
       try {
         await gh(contentPutInputArgs(repo, seed.target, tmp));
       } finally {
         try {
-          (0, import_node_fs35.unlinkSync)(tmp);
+          (0, import_node_fs36.unlinkSync)(tmp);
         } catch {
         }
       }
@@ -31791,12 +31826,12 @@ Rollback: \`mmi-cli devops bootstrap rollback ${rec.repo} --target ${seed.target
 }
 
 // src/stage-commands.ts
-var import_node_fs37 = require("node:fs");
-var import_node_path34 = require("node:path");
+var import_node_fs38 = require("node:fs");
+var import_node_path35 = require("node:path");
 
 // src/port-registry.ts
-var import_node_fs36 = require("node:fs");
-var import_node_path33 = require("node:path");
+var import_node_fs37 = require("node:fs");
+var import_node_path34 = require("node:path");
 
 // ../infra/port-geometry.mjs
 var PORT_BLOCK = 100;
@@ -31810,8 +31845,8 @@ function nextPortBlock(registry2) {
   return [base, base + PORT_SPAN];
 }
 function loadPortRegistry(path2) {
-  if (!(0, import_node_fs36.existsSync)(path2)) return {};
-  const raw = JSON.parse((0, import_node_fs36.readFileSync)(path2, "utf8"));
+  if (!(0, import_node_fs37.existsSync)(path2)) return {};
+  const raw = JSON.parse((0, import_node_fs37.readFileSync)(path2, "utf8"));
   const out = {};
   for (const [key, value] of Object.entries(raw)) {
     if (Array.isArray(value) && value.length === 2 && value.every((n) => typeof n === "number")) {
@@ -31825,9 +31860,9 @@ function ensurePortRange(repo, path2) {
   const existing = registry2[repo];
   if (existing) return existing;
   const range = nextPortBlock(registry2);
-  const raw = (0, import_node_fs36.existsSync)(path2) ? JSON.parse((0, import_node_fs36.readFileSync)(path2, "utf8")) : {};
+  const raw = (0, import_node_fs37.existsSync)(path2) ? JSON.parse((0, import_node_fs37.readFileSync)(path2, "utf8")) : {};
   raw[repo] = range;
-  (0, import_node_fs36.writeFileSync)(path2, JSON.stringify(raw, null, 2) + "\n", "utf8");
+  (0, import_node_fs37.writeFileSync)(path2, JSON.stringify(raw, null, 2) + "\n", "utf8");
   return range;
 }
 function portCursorSeed(registry2) {
@@ -31849,22 +31884,22 @@ function existingPortRange(repo, registry2) {
   return registry2[repo] ?? null;
 }
 function portRangeInfraAt(root, source) {
-  const registryPath = (0, import_node_path33.join)(root, "infra", "port-ranges.json");
-  const ddbScriptPath = (0, import_node_path33.join)(root, "infra", "port-ddb.mjs");
-  if (!(0, import_node_fs36.existsSync)(registryPath) || !(0, import_node_fs36.existsSync)(ddbScriptPath)) return null;
+  const registryPath = (0, import_node_path34.join)(root, "infra", "port-ranges.json");
+  const ddbScriptPath = (0, import_node_path34.join)(root, "infra", "port-ddb.mjs");
+  if (!(0, import_node_fs37.existsSync)(registryPath) || !(0, import_node_fs37.existsSync)(ddbScriptPath)) return null;
   return { root, source, registryPath, ddbScriptPath };
 }
 function resolvePortRangeInfra(cwd, packageDir) {
   const direct = portRangeInfraAt(cwd, "cwd");
   if (direct) return direct;
-  for (let dir = cwd; ; dir = (0, import_node_path33.dirname)(dir)) {
-    const sibling = portRangeInfraAt((0, import_node_path33.join)(dir, "MMI-Hub"), "sibling-hub");
+  for (let dir = cwd; ; dir = (0, import_node_path34.dirname)(dir)) {
+    const sibling = portRangeInfraAt((0, import_node_path34.join)(dir, "MMI-Hub"), "sibling-hub");
     if (sibling) return sibling;
-    const parent = (0, import_node_path33.dirname)(dir);
+    const parent = (0, import_node_path34.dirname)(dir);
     if (parent === dir) break;
   }
   if (packageDir) {
-    const pkgRoot = (0, import_node_path33.join)(packageDir, "..", "..");
+    const pkgRoot = (0, import_node_path34.join)(packageDir, "..", "..");
     const pkgFrom = portRangeInfraAt(pkgRoot, "pkg-root");
     if (pkgFrom) return pkgFrom;
   }
@@ -32058,8 +32093,8 @@ function registerStageCommands(program3) {
     const portRange = portRangeMeta && typeof portRangeMeta.start === "number" && typeof portRangeMeta.end === "number" ? [portRangeMeta.start, portRangeMeta.end] : void 0;
     return decideStage({
       registry: { deployModel: project2?.deployModel, portRange, error: read.ok ? void 0 : read.error },
-      hasCompose: (0, import_node_fs37.existsSync)((0, import_node_path34.join)(process.cwd(), "docker-compose.yml")),
-      hasEnvExample: (0, import_node_fs37.existsSync)((0, import_node_path34.join)(process.cwd(), ".env.example"))
+      hasCompose: (0, import_node_fs38.existsSync)((0, import_node_path35.join)(process.cwd(), "docker-compose.yml")),
+      hasEnvExample: (0, import_node_fs38.existsSync)((0, import_node_path35.join)(process.cwd(), ".env.example"))
     });
   }
   async function fetchStageVaultEnvMerge() {
@@ -32550,9 +32585,9 @@ function registerBoardCommands(program3) {
 }
 
 // src/merge-cleanup.ts
-var import_node_fs38 = require("node:fs");
+var import_node_fs39 = require("node:fs");
 var import_promises8 = require("node:fs/promises");
-var import_node_path36 = require("node:path");
+var import_node_path37 = require("node:path");
 var import_node_os15 = require("node:os");
 var import_node_child_process18 = require("node:child_process");
 
@@ -32640,7 +32675,7 @@ function boardAdvanceFailureMessage(result) {
 
 // src/deferred-registry-store.ts
 var import_promises7 = require("node:fs/promises");
-var import_node_path35 = require("node:path");
+var import_node_path36 = require("node:path");
 var sleep2 = (ms) => new Promise((resolve5) => setTimeout(resolve5, ms));
 async function atomicWrite(target, contents) {
   const tmp = `${target}.tmp-${process.pid}-${Math.random().toString(36).slice(2)}`;
@@ -32691,12 +32726,12 @@ function makeDeferredWorktreeStore(registryPath, lockOpts = {}) {
     },
     // Standalone atomic write — THROWS on failure (no best-effort swallow, #2846).
     write: async (entries) => {
-      await (0, import_promises7.mkdir)((0, import_node_path35.dirname)(registryPath), { recursive: true });
+      await (0, import_promises7.mkdir)((0, import_node_path36.dirname)(registryPath), { recursive: true });
       await atomicWrite(registryPath, serializeDeferredWorktrees(entries));
     },
     // Serialized read-modify-write under the repo-wide lock (#2846).
     update: async (mutate) => {
-      await (0, import_promises7.mkdir)((0, import_node_path35.dirname)(registryPath), { recursive: true });
+      await (0, import_promises7.mkdir)((0, import_node_path36.dirname)(registryPath), { recursive: true });
       const deadline = Date.now() + opts.maxWaitMs;
       for (; ; ) {
         const guard = await acquireLock(lockPath, opts, deadline);
@@ -32847,7 +32882,7 @@ var defaultLeaseCloseExec = (_cmd, args) => execJervCli(args, { timeout: GIT_TIM
 async function bestEffortLeaseClose(wtPath, exec = defaultLeaseCloseExec) {
   const step = "close jerv worktree lease";
   try {
-    await exec("jerv-cli", ["lease", "close", "--ref", wtPath]);
+    await exec("jerv-cli", ["cli", "lease", "close", "--ref", wtPath]);
     return { step, status: "done" };
   } catch (e) {
     const err = e;
@@ -32867,7 +32902,7 @@ async function applyGcPlan(plan, remote, opts = {}) {
   );
   const repoRoot2 = (await execFileP2("git", ["rev-parse", "--show-toplevel"], { timeout: GIT_TIMEOUT_MS }).catch(() => ({ stdout: "" }))).stdout.trim() || process.cwd();
   const worktreeGitRoot = await currentRepoWorktreeGitRoot(repoRoot2);
-  const primaryRepoRoot = worktreeGitRoot ? (0, import_node_path36.dirname)((0, import_node_path36.dirname)(worktreeGitRoot)) : repoRoot2;
+  const primaryRepoRoot = worktreeGitRoot ? (0, import_node_path37.dirname)((0, import_node_path37.dirname)(worktreeGitRoot)) : repoRoot2;
   const gcActor = describeActor({ env: process.env, surface: detectSurface(process.env), cwd: process.cwd() });
   const owners = readWorktreeOwners(primaryRepoRoot);
   const removalNow = Date.now();
@@ -32924,7 +32959,7 @@ async function applyGcPlan(plan, remote, opts = {}) {
       const cleanup = await cleanupPrMergeLocalBranch(branch.branch, {
         beforeWorktrees,
         startingPath: branch.worktreePath,
-        pathExists: (p) => (0, import_node_fs38.existsSync)(p),
+        pathExists: (p) => (0, import_node_fs39.existsSync)(p),
         execGit: async (args) => (await execFileP2("git", args, { timeout: GIT_TIMEOUT_MS })).stdout,
         teardownWorktreeStage,
         deferredStore,
@@ -32962,7 +32997,7 @@ async function applyGcPlan(plan, remote, opts = {}) {
     let removalAttempted = false;
     try {
       const cleanupTarget = resolveSafeSiblingWorktreeCleanupTarget(wt.path, cleanupRoots, {
-        realpath: (path2) => (0, import_node_fs38.realpathSync)(path2)
+        realpath: (path2) => (0, import_node_fs39.realpathSync)(path2)
       });
       if (!cleanupTarget.ok) {
         result.failed.push(`${wt.path}: ${cleanupTarget.reason}`);
@@ -33049,13 +33084,13 @@ async function composeOverrideBodyFile(prNumber, repoArgs, gh) {
     const commits = JSON.parse(raw).commits ?? [];
     const body = squashBodyWithOverride(commits.map((c) => ({ headline: c.messageHeadline ?? "", body: c.messageBody ?? "" })), process.cwd());
     if (!body) return void 0;
-    const dir = (0, import_node_fs38.mkdtempSync)((0, import_node_path36.join)((0, import_node_os15.tmpdir)(), "mmi-squash-body-"));
-    const path2 = (0, import_node_path36.join)(dir, "body.txt");
-    (0, import_node_fs38.writeFileSync)(path2, `${body}
+    const dir = (0, import_node_fs39.mkdtempSync)((0, import_node_path37.join)((0, import_node_os15.tmpdir)(), "mmi-squash-body-"));
+    const path2 = (0, import_node_path37.join)(dir, "body.txt");
+    (0, import_node_fs39.writeFileSync)(path2, `${body}
 `, "utf8");
     return { path: path2, cleanup: () => {
       try {
-        (0, import_node_fs38.rmSync)(dir, { recursive: true, force: true });
+        (0, import_node_fs39.rmSync)(dir, { recursive: true, force: true });
       } catch {
       }
     } };
@@ -33177,13 +33212,13 @@ var realWorktreeDirRemover = {
   probe: (p) => {
     let st;
     try {
-      st = (0, import_node_fs38.lstatSync)(p);
+      st = (0, import_node_fs39.lstatSync)(p);
     } catch {
       return null;
     }
     if (st.isSymbolicLink()) return "link";
     try {
-      (0, import_node_fs38.readlinkSync)(p);
+      (0, import_node_fs39.readlinkSync)(p);
       return "link";
     } catch {
     }
@@ -33191,7 +33226,7 @@ var realWorktreeDirRemover = {
   },
   readdir: (p) => {
     try {
-      return (0, import_node_fs38.readdirSync)(p);
+      return (0, import_node_fs39.readdirSync)(p);
     } catch {
       return [];
     }
@@ -33200,9 +33235,9 @@ var realWorktreeDirRemover = {
   // leaving the target); a file symlink with unlink. rmdir first, fall back to unlink.
   detachLink: (p) => {
     try {
-      (0, import_node_fs38.rmdirSync)(p);
+      (0, import_node_fs39.rmdirSync)(p);
     } catch {
-      (0, import_node_fs38.unlinkSync)(p);
+      (0, import_node_fs39.unlinkSync)(p);
     }
   },
   removeTree: (p) => (0, import_promises8.rm)(p, { recursive: true, force: true, maxRetries: 5, retryDelay: 200 })
@@ -33235,9 +33270,9 @@ async function worktreeHasStageState(worktreePath) {
   }
 }
 function stageStateFileBelongsToWorktree(statePath, worktreePath) {
-  if (!(0, import_node_fs38.existsSync)(statePath)) return false;
+  if (!(0, import_node_fs39.existsSync)(statePath)) return false;
   try {
-    const state = JSON.parse((0, import_node_fs38.readFileSync)(statePath, "utf8"));
+    const state = JSON.parse((0, import_node_fs39.readFileSync)(statePath, "utf8"));
     const recordedCwd = typeof state.identity?.cwd === "string" ? state.identity.cwd : typeof state.cwd === "string" ? state.cwd : "";
     return Boolean(recordedCwd && isPathUnderDirectory2(recordedCwd, worktreePath));
   } catch {
@@ -33672,14 +33707,14 @@ async function checkDocsIndexAtHead(opts, deps) {
 }
 
 // src/worktree-lifecycle-commands.ts
-var import_node_fs40 = require("node:fs");
+var import_node_fs41 = require("node:fs");
 var import_promises9 = require("node:fs/promises");
-var import_node_path38 = require("node:path");
+var import_node_path39 = require("node:path");
 
 // src/worktree-install-cache.ts
 var import_node_crypto7 = require("node:crypto");
-var import_node_fs39 = require("node:fs");
-var import_node_path37 = require("node:path");
+var import_node_fs40 = require("node:fs");
+var import_node_path38 = require("node:path");
 var CACHE_DIR = "worktree-install-cache";
 var MANIFEST = "manifest.json";
 var NODE_MODULES2 = "node_modules";
@@ -33692,16 +33727,16 @@ var LOCKFILE_NAMES = [
   "package-lock.json"
 ];
 var realWorktreeInstallCacheFs = {
-  exists: import_node_fs39.existsSync,
-  readFile: (path2) => (0, import_node_fs39.readFileSync)(path2, "utf8"),
-  lstat: (path2) => (0, import_node_fs39.lstatSync)(path2),
-  copyDir: (from, to) => (0, import_node_fs39.cpSync)(from, to, { recursive: true, force: true }),
+  exists: import_node_fs40.existsSync,
+  readFile: (path2) => (0, import_node_fs40.readFileSync)(path2, "utf8"),
+  lstat: (path2) => (0, import_node_fs40.lstatSync)(path2),
+  copyDir: (from, to) => (0, import_node_fs40.cpSync)(from, to, { recursive: true, force: true }),
   mkdirp: (path2) => {
-    (0, import_node_fs39.mkdirSync)(path2, { recursive: true });
+    (0, import_node_fs40.mkdirSync)(path2, { recursive: true });
   },
-  writeFile: (path2, contents) => (0, import_node_fs39.writeFileSync)(path2, contents, "utf8"),
+  writeFile: (path2, contents) => (0, import_node_fs40.writeFileSync)(path2, contents, "utf8"),
   rm: (path2) => {
-    (0, import_node_fs39.rmSync)(path2, { recursive: true, force: true });
+    (0, import_node_fs40.rmSync)(path2, { recursive: true, force: true });
   }
 };
 function hashLockfileBytes(contents) {
@@ -33709,7 +33744,7 @@ function hashLockfileBytes(contents) {
 }
 function resolveWorktreeInstallLockfile(packageDir, fs2 = realWorktreeInstallCacheFs) {
   for (const name of LOCKFILE_NAMES) {
-    const path2 = (0, import_node_path37.join)(packageDir, name);
+    const path2 = (0, import_node_path38.join)(packageDir, name);
     if (!fs2.exists(path2)) continue;
     try {
       const hash = hashLockfileBytes(fs2.readFile(path2));
@@ -33724,8 +33759,8 @@ function worktreeInstallCacheEntry(primaryRoot, lockfileHash) {
   const root = repoRuntimeStatePath(primaryRoot, CACHE_DIR, lockfileHash);
   return {
     root,
-    manifestPath: (0, import_node_path37.join)(root, MANIFEST),
-    nodeModulesPath: (0, import_node_path37.join)(root, NODE_MODULES2)
+    manifestPath: (0, import_node_path38.join)(root, MANIFEST),
+    nodeModulesPath: (0, import_node_path38.join)(root, NODE_MODULES2)
   };
 }
 function readWorktreeInstallCacheManifest(manifestPath, fs2 = realWorktreeInstallCacheFs) {
@@ -33765,7 +33800,7 @@ function invalidateWorktreeInstallCacheEntry(entry, fs2 = realWorktreeInstallCac
   }
 }
 function removeMaterializedTree(packageDir, fs2) {
-  const dest = (0, import_node_path37.join)(packageDir, NODE_MODULES2);
+  const dest = (0, import_node_path38.join)(packageDir, NODE_MODULES2);
   if (!fs2.exists(dest)) return;
   fs2.rm(dest);
   if (fs2.exists(dest)) {
@@ -33773,7 +33808,7 @@ function removeMaterializedTree(packageDir, fs2) {
   }
 }
 function materializeCachedNodeModules(entry, destPackageDir, fs2 = realWorktreeInstallCacheFs) {
-  const dest = (0, import_node_path37.join)(destPackageDir, NODE_MODULES2);
+  const dest = (0, import_node_path38.join)(destPackageDir, NODE_MODULES2);
   try {
     if (fs2.exists(dest)) fs2.rm(dest);
     fs2.mkdirp(destPackageDir);
@@ -33788,7 +33823,7 @@ function materializeCachedNodeModules(entry, destPackageDir, fs2 = realWorktreeI
   }
 }
 async function storeWorktreeInstallCacheEntry(primaryRoot, lockfile3, command, sourcePackageDir, fs2 = realWorktreeInstallCacheFs, now = Date.now()) {
-  const source = (0, import_node_path37.join)(sourcePackageDir, NODE_MODULES2);
+  const source = (0, import_node_path38.join)(sourcePackageDir, NODE_MODULES2);
   if (!isMaterializableNodeModulesDir(source, fs2)) return;
   const entry = worktreeInstallCacheEntry(primaryRoot, lockfile3.hash);
   const manifest = {
@@ -34048,7 +34083,7 @@ function classifyStaleLeaks(input) {
 var defaultOrphanDirScanDeps = {
   listDirs: (root) => {
     try {
-      return (0, import_node_fs40.readdirSync)(root, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => (0, import_node_path38.join)(root, e.name));
+      return (0, import_node_fs41.readdirSync)(root, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => (0, import_node_path39.join)(root, e.name));
     } catch {
       return [];
     }
@@ -34214,13 +34249,13 @@ function registerWorktreeCommands(program3) {
       const detached = headBorn && !symbolicBranch;
       const branch = symbolicBranch || (detached ? "HEAD" : "");
       if (!wtPath || !branch) return fail("worktree land: not inside a git worktree");
-      const gitFile = (0, import_node_path38.join)(wtPath, ".git");
-      const isLinked = (0, import_node_fs40.existsSync)(gitFile) && (0, import_node_fs40.statSync)(gitFile).isFile();
+      const gitFile = (0, import_node_path39.join)(wtPath, ".git");
+      const isLinked = (0, import_node_fs41.existsSync)(gitFile) && (0, import_node_fs41.statSync)(gitFile).isFile();
       if (apply && !isLinked) {
         return fail("worktree land: run from inside the linked worktree you want to land (this is the primary checkout)");
       }
       const commonDir = (await execFileP2("git", ["rev-parse", "--git-common-dir"], { timeout: GIT_TIMEOUT_MS }).catch(() => ({ stdout: "" }))).stdout.trim();
-      const primaryCheckout = commonDir ? (0, import_node_path38.dirname)(commonDir) : wtPath;
+      const primaryCheckout = commonDir ? (0, import_node_path39.dirname)(commonDir) : wtPath;
       const localBranchNames = await execFileP2("git", ["-C", primaryCheckout, "for-each-ref", "--format=%(refname:short)", "refs/heads"], { timeout: GIT_TIMEOUT_MS }).then(({ stdout }) => new Set((stdout || "").split("\n").map((l) => l.trim()).filter(Boolean))).catch(() => void 0);
       const orphan = classifyOrphanedWorktree({
         branch,
@@ -34494,10 +34529,10 @@ async function gatherWorktreeContext() {
     if (s) stages.push({ path: wt.path, port: s.port });
   }
   const worktreeGitRoot = await currentRepoWorktreeGitRoot(repoRoot2);
-  const primaryRepoRoot = worktreeGitRoot ? (0, import_node_path38.dirname)((0, import_node_path38.dirname)(worktreeGitRoot)) : repoRoot2;
+  const primaryRepoRoot = worktreeGitRoot ? (0, import_node_path39.dirname)((0, import_node_path39.dirname)(worktreeGitRoot)) : repoRoot2;
   const wtRoot = siblingMmiWorktreesRoot(primaryRepoRoot);
   let orphanDirs = [];
-  if ((0, import_node_fs40.existsSync)(wtRoot)) {
+  if ((0, import_node_fs41.existsSync)(wtRoot)) {
     orphanDirs = scanOrphanDirs(wtRoot, worktreeGitRoot, {
       ...defaultOrphanDirScanDeps,
       listDirs: (root) => worktreeScanDirs(root, primaryRepoRoot, defaultOrphanDirScanDeps.listDirs, isRepoCheckoutDir)
@@ -34533,7 +34568,7 @@ ${err.stderr ?? ""}`;
 }
 
 // src/issue-commands.ts
-var import_node_fs41 = require("node:fs");
+var import_node_fs42 = require("node:fs");
 var import_node_crypto8 = require("node:crypto");
 var ghRunner = async (args, timeoutMs) => (await execFileP2("gh", args, { timeout: timeoutMs })).stdout;
 var ReparentConflictError = class extends Error {
@@ -34551,7 +34586,7 @@ async function editIssue(client, options, deps = {}) {
   const url = `https://github.com/${repo}/issues/${parsed.number}`;
   const patch = {};
   let bodyChanged = false;
-  const textDeps = () => deps.textDeps ?? { readFile: (p, e) => Promise.resolve((0, import_node_fs41.readFileSync)(p, e)), readStdin: () => Promise.resolve("") };
+  const textDeps = () => deps.textDeps ?? { readFile: (p, e) => Promise.resolve((0, import_node_fs42.readFileSync)(p, e)), readStdin: () => Promise.resolve("") };
   if (options.titleFile !== void 0) {
     patch.title = await resolveIssueTitle({ title: options.title, titleFile: options.titleFile }, textDeps());
   } else if (options.title !== void 0) {
@@ -35156,7 +35191,7 @@ function extendCreateCommand(issue2, batchAttach) {
     if (opts.batch) {
       let specs;
       try {
-        const raw = (0, import_node_fs41.readFileSync)(opts.batch, "utf8");
+        const raw = (0, import_node_fs42.readFileSync)(opts.batch, "utf8");
         specs = JSON.parse(raw);
         if (!Array.isArray(specs)) throw new Error("batch file must contain a JSON array");
       } catch (e) {
@@ -35231,8 +35266,8 @@ ${lines}`, {
 }
 
 // src/train-commands.ts
-var import_node_fs42 = require("node:fs");
-var import_node_path39 = require("node:path");
+var import_node_fs43 = require("node:fs");
+var import_node_path40 = require("node:path");
 var RELEASE_BUMP_INTENTS = ["major", "minor", "patch"];
 function resolveReleaseBumpIntent(raw) {
   const intent = typeof raw === "string" ? raw.trim() : "";
@@ -35243,7 +35278,7 @@ function resolveReleaseBumpIntent(raw) {
 }
 function readRepoVersion() {
   try {
-    return JSON.parse((0, import_node_fs42.readFileSync)((0, import_node_path39.join)(process.cwd(), ".claude-plugin", "plugin.json"), "utf8")).version || void 0;
+    return JSON.parse((0, import_node_fs43.readFileSync)((0, import_node_path40.join)(process.cwd(), ".claude-plugin", "plugin.json"), "utf8")).version || void 0;
   } catch {
     return void 0;
   }
@@ -35400,9 +35435,9 @@ function registerDeployCommands(program3) {
 }
 
 // src/discovery-commands.ts
-var import_node_fs43 = require("node:fs");
+var import_node_fs44 = require("node:fs");
 var import_node_os16 = require("node:os");
-var import_node_path40 = require("node:path");
+var import_node_path41 = require("node:path");
 var GC_GH_TIMEOUT_MS3 = 2e4;
 async function collectStatus() {
   const repo = await resolveRepo();
@@ -35592,8 +35627,8 @@ async function collectOnboardStatus(opts = {}) {
   }
   const home = (0, import_node_os16.homedir)();
   const plugin = onboardPluginGate({
-    readKnown: () => readFileSyncSafe((0, import_node_path40.join)(home, ...KNOWN_MARKETPLACES_RELATIVE), import_node_fs43.readFileSync),
-    readSettings: () => readFileSyncSafe((0, import_node_path40.join)(home, ".claude", "settings.json"), import_node_fs43.readFileSync)
+    readKnown: () => readFileSyncSafe((0, import_node_path41.join)(home, ...KNOWN_MARKETPLACES_RELATIVE), import_node_fs44.readFileSync),
+    readSettings: () => readFileSyncSafe((0, import_node_path41.join)(home, ".claude", "settings.json"), import_node_fs44.readFileSync)
   });
   return { track, board, registry: registry2, secrets, plugin, estateCli, doors: opts.doors ?? [], nextCommand };
 }
@@ -35753,8 +35788,9 @@ function formatExplainCommand(cmd, rootName) {
   return lines.join("\n").trimEnd();
 }
 function formatExplainGroup(cmd, rootName) {
+  const canonical = (node) => canonicalPathFor(node.path) ?? node.path;
   const lines = [
-    `${rootName} ${cmd.path}${cmd.description ? ` \u2014 ${cmd.description}` : ""}`,
+    `${rootName} ${canonical(cmd)}${cmd.description ? ` \u2014 ${cmd.description}` : ""}`,
     `Category: ${cmd.category} \xB7 Discovery: ${cmd.discovery}`,
     "",
     "Commands:"
@@ -35764,7 +35800,7 @@ function formatExplainGroup(cmd, rootName) {
       const name = arg.variadic ? `${arg.name}...` : arg.name;
       return arg.required ? `<${name}>` : `[${name}]`;
     }).join(" ");
-    lines.push(`  ${child2.path}${args ? ` ${args}` : ""}${child2.description ? ` \u2014 ${child2.description}` : ""}`);
+    lines.push(`  ${canonical(child2)}${args ? ` ${args}` : ""}${child2.description ? ` \u2014 ${child2.description}` : ""}`);
   }
   return lines.join("\n");
 }
@@ -35778,7 +35814,7 @@ function formatExplainLoop(playbook) {
 }
 function findCommandInManifest(manifest, commandPath3) {
   const visit = (command) => {
-    if (command.path === commandPath3) return command;
+    if (command.path === commandPath3 || canonicalPathFor(command.path) === commandPath3) return command;
     for (const child2 of command.subcommands) {
       const found = visit(child2);
       if (found) return found;
@@ -36692,19 +36728,19 @@ function registerOrgHealthQuery(program3, deps = defaultOrgHealthQueryDeps()) {
 }
 
 // src/plugin-release-catchup.ts
-var import_node_fs44 = require("node:fs");
-var import_node_path41 = require("node:path");
+var import_node_fs45 = require("node:fs");
+var import_node_path42 = require("node:path");
 var import_node_os17 = require("node:os");
 var RELEASE_CATCHUP_TTL_MS = 24 * 60 * 60 * 1e3;
 var RELEASE_CATCHUP_DISABLE_ENV = "MMI_NO_RELEASE_CATCHUP";
 function releaseCatchupStatePath(env = process.env) {
   if (env.MMI_RELEASE_CATCHUP_STATE) return env.MMI_RELEASE_CATCHUP_STATE;
   if (process.platform === "win32") {
-    const base2 = env.LOCALAPPDATA || (0, import_node_path41.join)((0, import_node_os17.homedir)(), "AppData", "Local");
-    return (0, import_node_path41.join)(base2, "MMI Future", "mmi-cli", "release-catchup.json");
+    const base2 = env.LOCALAPPDATA || (0, import_node_path42.join)((0, import_node_os17.homedir)(), "AppData", "Local");
+    return (0, import_node_path42.join)(base2, "MMI Future", "mmi-cli", "release-catchup.json");
   }
-  const base = env.XDG_STATE_HOME || (0, import_node_path41.join)((0, import_node_os17.homedir)(), ".local", "state");
-  return (0, import_node_path41.join)(base, "mmi-cli", "release-catchup.json");
+  const base = env.XDG_STATE_HOME || (0, import_node_path42.join)((0, import_node_os17.homedir)(), ".local", "state");
+  return (0, import_node_path42.join)(base, "mmi-cli", "release-catchup.json");
 }
 function releaseCatchupDue(state, now, force = false) {
   if (force) return true;
@@ -36714,7 +36750,7 @@ function releaseCatchupDue(state, now, force = false) {
 function newestCachedPluginVersion(home) {
   let names;
   try {
-    names = (0, import_node_fs44.readdirSync)(pluginCacheRoot(home));
+    names = (0, import_node_fs45.readdirSync)(pluginCacheRoot(home));
   } catch {
     return void 0;
   }
@@ -36722,15 +36758,15 @@ function newestCachedPluginVersion(home) {
 }
 function marketplaceClonePath(home) {
   try {
-    const parsed = JSON.parse((0, import_node_fs44.readFileSync)((0, import_node_path41.join)(home, ".claude", "plugins", "known_marketplaces.json"), "utf8"));
+    const parsed = JSON.parse((0, import_node_fs45.readFileSync)((0, import_node_path42.join)(home, ".claude", "plugins", "known_marketplaces.json"), "utf8"));
     if (parsed.mutmutco?.installLocation) return parsed.mutmutco.installLocation;
   } catch {
   }
-  return (0, import_node_path41.join)(home, ".claude", "plugins", "marketplaces", "mutmutco");
+  return (0, import_node_path42.join)(home, ".claude", "plugins", "marketplaces", "mutmutco");
 }
 function readCatalogVersion(home) {
   try {
-    const parsed = JSON.parse((0, import_node_fs44.readFileSync)((0, import_node_path41.join)(marketplaceClonePath(home), ".claude-plugin", "marketplace.json"), "utf8"));
+    const parsed = JSON.parse((0, import_node_fs45.readFileSync)((0, import_node_path42.join)(marketplaceClonePath(home), ".claude-plugin", "marketplace.json"), "utf8"));
     return parsed.plugins?.find((p) => p.name === "mmi")?.version;
   } catch {
     return void 0;
@@ -36738,7 +36774,7 @@ function readCatalogVersion(home) {
 }
 function readMmiInstallRecord(home) {
   try {
-    const parsed = JSON.parse((0, import_node_fs44.readFileSync)((0, import_node_path41.join)(home, ".claude", "plugins", "installed_plugins.json"), "utf8"));
+    const parsed = JSON.parse((0, import_node_fs45.readFileSync)((0, import_node_path42.join)(home, ".claude", "plugins", "installed_plugins.json"), "utf8"));
     const record = parsed.plugins?.["mmi@mutmutco"]?.[0];
     return record?.version ? { version: record.version, gitCommitSha: record.gitCommitSha } : void 0;
   } catch {
@@ -36767,7 +36803,7 @@ async function runReleaseCatchup(home, env, deps, opts = {}) {
     cliUpdated = true;
   }
   const cliUpdateDetail = cliUpdated ? `CLI ${runningCli} \u2192 ${latest}; the next mmi-cli invocation runs ${latest}` : `CLI ${runningCli} is current against released ${latest}`;
-  if (!(0, import_node_fs44.existsSync)(pluginCacheRoot(home))) {
+  if (!(0, import_node_fs45.existsSync)(pluginCacheRoot(home))) {
     deps.writeState(statePath, { checkedAt: deps.now(), latest });
     return {
       ok: true,
@@ -36800,8 +36836,8 @@ async function runReleaseCatchup(home, env, deps, opts = {}) {
     return { ok: false, detail: `${cliUpdateDetail}; plugin install record could not be cleared (still ${prior.version})` };
   }
   const installed = await deps.runClaude(["plugin", "install", "mmi@mutmutco"], "claude plugin install mmi@mutmutco");
-  const payload = (0, import_node_path41.join)(pluginCacheRoot(home), latest, ".pi-plugin");
-  if (!installed || !(0, import_node_fs44.existsSync)(payload)) {
+  const payload = (0, import_node_path42.join)(pluginCacheRoot(home), latest, ".pi-plugin");
+  if (!installed || !(0, import_node_fs45.existsSync)(payload)) {
     const why = installed ? `install of ${latest} did not produce a verifiable .pi-plugin payload` : `install of ${latest} failed`;
     if (!prior) return { ok: false, detail: `${cliUpdateDetail}; ${why}; no prior record to restore` };
     const rollback = await restorePriorRecord(home, prior, deps);
@@ -38774,6 +38810,7 @@ async function runDoctorClean(opts, io, deps) {
         });
         return;
       }
+      const provenance = state.cachedAt === void 0 ? [] : [cachedSweepNote(state.cachedAt)];
       if (state.driftLines.length === 0) {
         emitNow({
           ok: true,
@@ -38781,7 +38818,7 @@ async function runDoctorClean(opts, io, deps) {
           id: "schedules-drift",
           label: "schedules drift",
           detail: "no drift",
-          verbose: ["no drift lines"]
+          verbose: ["no drift lines", ...provenance]
         });
         return;
       }
@@ -38792,7 +38829,7 @@ async function runDoctorClean(opts, io, deps) {
         label: "schedules drift",
         detail: `${state.driftLines.length} drift line(s)`,
         fix: "run `mmi-cli harbour org schedules` / `org schedules register`",
-        verbose: state.driftLines
+        verbose: [...state.driftLines, ...provenance]
       });
     } catch (e) {
       const message = e instanceof Error ? e.message : String(e);
@@ -39009,17 +39046,17 @@ function parseOriginRepo(remoteUrl) {
 }
 function ghHostsConfigPath(env, platform2) {
   const sep3 = platform2 === "win32" ? "\\" : "/";
-  const join39 = (...parts) => parts.join(sep3);
+  const join40 = (...parts) => parts.join(sep3);
   const explicit = env.GH_CONFIG_DIR?.trim();
-  if (explicit) return join39(explicit, "hosts.yml");
+  if (explicit) return join40(explicit, "hosts.yml");
   if (platform2 === "win32") {
     const appData = (env.AppData ?? env.APPDATA)?.trim();
-    return appData ? join39(appData, "GitHub CLI", "hosts.yml") : void 0;
+    return appData ? join40(appData, "GitHub CLI", "hosts.yml") : void 0;
   }
   const xdg = env.XDG_CONFIG_HOME?.trim();
-  if (xdg) return join39(xdg, "gh", "hosts.yml");
+  if (xdg) return join40(xdg, "gh", "hosts.yml");
   const home = env.HOME?.trim();
-  return home ? join39(home, ".config", "gh", "hosts.yml") : void 0;
+  return home ? join40(home, ".config", "gh", "hosts.yml") : void 0;
 }
 function parseGhHostsAccounts(yaml, host = "github.com") {
   let hostIndent = null;
@@ -39069,9 +39106,9 @@ function ghAccountCaveat(announcedLogin, accounts) {
 }
 
 // src/doctor-io.ts
-var import_node_fs45 = require("node:fs");
+var import_node_fs46 = require("node:fs");
 var import_node_os18 = require("node:os");
-var import_node_path42 = require("node:path");
+var import_node_path43 = require("node:path");
 var import_node_child_process19 = require("node:child_process");
 var import_node_util8 = require("node:util");
 var execFileP6 = (0, import_node_util8.promisify)(import_node_child_process19.execFile);
@@ -39079,7 +39116,7 @@ var MMI_PLUGIN_ID2 = "mmi@mutmutco";
 function installedClaudePluginVersion() {
   try {
     const file = JSON.parse(
-      (0, import_node_fs45.readFileSync)((0, import_node_path42.join)((0, import_node_os18.homedir)(), ".claude", "plugins", "installed_plugins.json"), "utf8")
+      (0, import_node_fs46.readFileSync)((0, import_node_path43.join)((0, import_node_os18.homedir)(), ".claude", "plugins", "installed_plugins.json"), "utf8")
     );
     const versions = (file.plugins?.[MMI_PLUGIN_ID2] ?? []).map((r) => r.version).filter((v) => Boolean(v));
     if (versions.length === 0) return void 0;
@@ -39090,7 +39127,7 @@ function installedClaudePluginVersion() {
 }
 function manifestVersion(path2) {
   try {
-    const manifest = JSON.parse((0, import_node_fs45.readFileSync)(path2, "utf8"));
+    const manifest = JSON.parse((0, import_node_fs46.readFileSync)(path2, "utf8"));
     return typeof manifest.version === "string" && manifest.version.trim() ? manifest.version.trim() : void 0;
   } catch {
     return void 0;
@@ -39100,22 +39137,22 @@ function installedSurfacePluginVersion(surface) {
   const token = surfaceToken(surface);
   if (token === "kilo") {
     try {
-      const stamp = (0, import_node_fs45.readFileSync)((0, import_node_path42.join)((0, import_node_os18.homedir)(), ".kilo", ".mmi-kilo-version"), "utf8").trim();
+      const stamp = (0, import_node_fs46.readFileSync)((0, import_node_path43.join)((0, import_node_os18.homedir)(), ".kilo", ".mmi-kilo-version"), "utf8").trim();
       return stamp || void 0;
     } catch {
       return void 0;
     }
   }
   if (token === "cursor") {
-    return manifestVersion((0, import_node_path42.join)(cursorLocalPluginRoot(), ".cursor-plugin", "plugin.json"));
+    return manifestVersion((0, import_node_path43.join)(cursorLocalPluginRoot(), ".cursor-plugin", "plugin.json"));
   }
   if (token === "jervcode") {
     const entry = mmiPiWrapperEntry();
     if (!entry) return void 0;
-    return manifestVersion((0, import_node_path42.join)(decodeURIComponent(entry.replace(/^file:\/\/\/?/, "")), "package.json"));
+    return manifestVersion((0, import_node_path43.join)(decodeURIComponent(entry.replace(/^file:\/\/\/?/, "")), "package.json"));
   }
   if (token === "kimi") {
-    return manifestVersion((0, import_node_path42.join)(surfaceConfigRoot(surface), "plugins", "managed", "mmi", ".kimi-plugin", "plugin.json"));
+    return manifestVersion((0, import_node_path43.join)(surfaceConfigRoot(surface), "plugins", "managed", "mmi", ".kimi-plugin", "plugin.json"));
   }
   if (token === "claude") return installedClaudePluginVersion();
   if (token !== "codex") return void 0;
@@ -39153,13 +39190,13 @@ function worktreeRootSync() {
 }
 var gitignorePath = () => {
   const root = worktreeRootSync();
-  return root === null ? null : (0, import_node_path42.join)(root, ".gitignore");
+  return root === null ? null : (0, import_node_path43.join)(root, ".gitignore");
 };
 function readGitignore() {
   const path2 = gitignorePath();
   if (path2 === null) return null;
   try {
-    return (0, import_node_fs45.readFileSync)(path2, "utf8");
+    return (0, import_node_fs46.readFileSync)(path2, "utf8");
   } catch {
     return null;
   }
@@ -39168,7 +39205,7 @@ function writeGitignore(content) {
   const path2 = gitignorePath();
   if (path2 === null) return false;
   try {
-    (0, import_node_fs45.writeFileSync)(path2, content, "utf8");
+    (0, import_node_fs46.writeFileSync)(path2, content, "utf8");
     return true;
   } catch {
     return false;
@@ -39187,7 +39224,7 @@ async function repoRoot() {
 }
 function hasRepoLocalWorktrees() {
   const root = worktreeRootSync();
-  return root !== null && (0, import_node_fs45.existsSync)((0, import_node_path42.join)(root, ".worktrees"));
+  return root !== null && (0, import_node_fs46.existsSync)((0, import_node_path43.join)(root, ".worktrees"));
 }
 
 // src/index.ts
@@ -39206,8 +39243,8 @@ ${r.stderr ?? ""}`).catch(() => "");
 function ghMultiAccountCaveat(announcedLogin) {
   try {
     const hostsPath = ghHostsConfigPath(process.env, process.platform);
-    if (!hostsPath || !(0, import_node_fs46.existsSync)(hostsPath)) return void 0;
-    return ghAccountCaveat(announcedLogin, parseGhHostsAccounts((0, import_node_fs46.readFileSync)(hostsPath, "utf8")));
+    if (!hostsPath || !(0, import_node_fs47.existsSync)(hostsPath)) return void 0;
+    return ghAccountCaveat(announcedLogin, parseGhHostsAccounts((0, import_node_fs47.readFileSync)(hostsPath, "utf8")));
   } catch {
     return void 0;
   }
@@ -39215,7 +39252,7 @@ function ghMultiAccountCaveat(announcedLogin) {
 var ENV_HEAL_LOCK_STALE_MS = 10 * 6e4;
 var ENV_HEAL_LOCK_MAX_WAIT_MS = 2 * 6e4;
 function envHealLockPath(home) {
-  return (0, import_node_path43.join)(home, ".claude", "plugins", ".mmi-env-heal.lock");
+  return (0, import_node_path44.join)(home, ".claude", "plugins", ".mmi-env-heal.lock");
 }
 async function withEnvHealLock(what, run) {
   try {
@@ -39348,7 +39385,7 @@ function mmiDoctorDeps(opts = {}) {
       );
       const result = applyPluginCachePlan(
         plan,
-        (p) => (0, import_node_fs46.rmSync)(p, { recursive: true }),
+        (p) => (0, import_node_fs47.rmSync)(p, { recursive: true }),
         stagingApplyFsGuard(configRoot)
       );
       return {
@@ -39402,8 +39439,8 @@ function mmiDoctorDeps(opts = {}) {
         const home = (0, import_node_os19.homedir)();
         const rows = marketplaceRows(
           MMI_MARKETPLACE_NAME,
-          readFileSyncSafe((0, import_node_path43.join)(home, ...KNOWN_MARKETPLACES_RELATIVE), import_node_fs46.readFileSync),
-          readFileSyncSafe((0, import_node_path43.join)(home, ".claude", "settings.json"), import_node_fs46.readFileSync),
+          readFileSyncSafe((0, import_node_path44.join)(home, ...KNOWN_MARKETPLACES_RELATIVE), import_node_fs47.readFileSync),
+          readFileSyncSafe((0, import_node_path44.join)(home, ".claude", "settings.json"), import_node_fs47.readFileSync),
           // #3974: this CLI heals these rows, so report mode names the doctor run rather than the hand
           // edit. #4792 narrows WHICH run: `applyOrgMarketplacePins` declines outright while Claude Code
           // is up, because the host owns this file and rewrites it from its own copy (#4083). Naming the
@@ -39415,7 +39452,7 @@ function mmiDoctorDeps(opts = {}) {
           hostBlocked ?? claudeCodeEnvMarkerPresent() ? "host-running" : "doctor"
         );
         const pending = readMarketplacePinPending(
-          (0, import_node_path43.join)(home, ".claude", "plugins", ".mmi-marketplace-pin-pending.json"),
+          (0, import_node_path44.join)(home, ".claude", "plugins", ".mmi-marketplace-pin-pending.json"),
           MMI_MARKETPLACE_NAME
         );
         if (!pending) return rows;
@@ -39441,9 +39478,9 @@ function mmiDoctorDeps(opts = {}) {
         if (detectSurface(process.env) === "codex") return void 0;
         const home = (0, import_node_os19.homedir)();
         const names = [MMI_MARKETPLACE_NAME];
-        const result = applyOrgMarketplacePins((0, import_node_path43.join)(home, ...KNOWN_MARKETPLACES_RELATIVE), names);
+        const result = applyOrgMarketplacePins((0, import_node_path44.join)(home, ...KNOWN_MARKETPLACES_RELATIVE), names);
         if (result?.wrote) {
-          writeMarketplacePinPending((0, import_node_path43.join)(home, ".claude", "plugins", ".mmi-marketplace-pin-pending.json"), names);
+          writeMarketplacePinPending((0, import_node_path44.join)(home, ".claude", "plugins", ".mmi-marketplace-pin-pending.json"), names);
         }
         return result;
       } catch {
@@ -39459,7 +39496,7 @@ function mmiDoctorDeps(opts = {}) {
     // adopted the generated routing index (MMG-Unlive: `docs/Archive/**` only, no index, no gate.yml) would
     // get a permanent — demanding an artifact it never asked for.
     docsIndexState: (root) => {
-      if (!(0, import_node_fs46.existsSync)((0, import_node_path43.join)(root, DOCS_INDEX_PATH))) return void 0;
+      if (!(0, import_node_fs47.existsSync)((0, import_node_path44.join)(root, DOCS_INDEX_PATH))) return void 0;
       const real = createDocsIndexDeps(root);
       let docs2;
       const listDocs = () => docs2 ??= real.listDocs();
@@ -39468,7 +39505,7 @@ function mmiDoctorDeps(opts = {}) {
     },
     // #4168: working-tree heal — write if drifted, then re-check. Commit remains the operator's step.
     healDocsIndex: (root) => {
-      if (!(0, import_node_fs46.existsSync)((0, import_node_path43.join)(root, DOCS_INDEX_PATH))) return { drift: false, docCount: 0 };
+      if (!(0, import_node_fs47.existsSync)((0, import_node_path44.join)(root, DOCS_INDEX_PATH))) return { drift: false, docCount: 0 };
       const real = createDocsIndexDeps(root);
       let docs2;
       const listDocs = () => docs2 ??= real.listDocs();
@@ -39496,6 +39533,7 @@ function mmiDoctorDeps(opts = {}) {
     // #4170: light board doctor with 15s ceiling. skipClaimLiveness keeps Phase 3 off.
     boardDoctorFix: async ({ fix } = {}) => {
       const BOARD_DOCTOR_TIMEOUT_MS = 15e3;
+      let ceiling;
       try {
         const cfg = await loadConfigForRepo();
         const work = boardDoctor({
@@ -39506,7 +39544,7 @@ function mmiDoctorDeps(opts = {}) {
         const raced = await Promise.race([
           work.then((r) => ({ ...r, timedOut: false })),
           new Promise((resolve5) => {
-            setTimeout(() => resolve5({ timedOut: true, scanned: 0, findings: 0, fixed: 0, failed: 0 }), BOARD_DOCTOR_TIMEOUT_MS);
+            ceiling = setTimeout(() => resolve5({ timedOut: true, scanned: 0, findings: 0, fixed: 0, failed: 0 }), BOARD_DOCTOR_TIMEOUT_MS);
           })
         ]);
         if (raced.timedOut) return { scanned: 0, findings: 0, fixed: 0, failed: 0, timedOut: true };
@@ -39518,11 +39556,20 @@ function mmiDoctorDeps(opts = {}) {
         };
       } catch (e) {
         return { scanned: 0, findings: 0, fixed: 0, failed: 0, readFailed: true, error: e instanceof Error ? e.message : String(e) };
+      } finally {
+        clearTimeout(ceiling);
       }
     },
     // #4171: schedules drift notebook — report-only, ~20s ceiling.
+    // #4815: and throttled. The sweep behind it reads every workflow file in every org repo — 12s of a
+    // 22s doctor — so a cached notebook under six hours old answers the row instead, saying so in its
+    // evidence. Only a COMPLETE sweep is cached (see schedules-drift-cache.ts).
     schedulesDriftState: async () => {
       const SCHEDULES_DRIFT_TIMEOUT_MS = 2e4;
+      const cachePath = schedulesDriftCachePath(repoRuntimeStatePath(process.cwd()));
+      const cached = readSchedulesDriftCache(cachePath);
+      if (cached) return { driftLines: cached.driftLines, incomplete: [], cachedAt: cached.at };
+      let ceiling;
       try {
         const raced = await Promise.race([
           fetchNotebook().then((nb) => ({
@@ -39531,12 +39578,15 @@ function mmiDoctorDeps(opts = {}) {
             timedOut: false
           })),
           new Promise((resolve5) => {
-            setTimeout(() => resolve5({ driftLines: [], incomplete: [], timedOut: true }), SCHEDULES_DRIFT_TIMEOUT_MS);
+            ceiling = setTimeout(() => resolve5({ driftLines: [], incomplete: [], timedOut: true }), SCHEDULES_DRIFT_TIMEOUT_MS);
           })
         ]);
+        if (!raced.timedOut && raced.incomplete.length === 0) writeSchedulesDriftCache(cachePath, raced.driftLines);
         return raced;
       } catch (e) {
         return { driftLines: [], incomplete: [], readFailed: true, error: e instanceof Error ? e.message : String(e) };
+      } finally {
+        clearTimeout(ceiling);
       }
     },
     // #4173: estate commands absent from the running Commander program (stale global CLI).
@@ -39703,12 +39753,15 @@ function positionalTargetForm(cmd, opts = {}) {
   const args = cmd.registeredArguments ?? [];
   const first = args[0];
   if (!first) return void 0;
-  return formatPositionalTarget(commandPath2(cmd), first.name(), opts);
+  return formatPositionalTarget(canonicalPathFor(commandPath2(cmd)) ?? commandPath2(cmd), first.name(), opts);
 }
 function resolveParseHint() {
   if (lastParseErrorKind === "unknown-command") {
-    const path3 = lastUnknownCommand ? suggestCommandPath(lastUnknownCommand, allCommandPaths()) : void 0;
-    return path3 ? `(did you mean \`mmi-cli ${path3}\`? ${DISCOVERY_HINT})` : STALE_HINT;
+    const parent = resolveCommandFromArgv(program2, process.argv.slice(2));
+    const candidates = parent && parent.commands.length ? parent.commands.filter((child2) => commandMetadata(child2)?.category !== "internal").map(commandPath2) : allCommandPaths();
+    const path3 = lastUnknownCommand ? suggestCommandPath(lastUnknownCommand, candidates) : void 0;
+    const canonical = path3 ? canonicalPathFor(path3) ?? path3 : void 0;
+    return canonical ? `(did you mean \`mmi-cli ${canonical}\`? ${DISCOVERY_HINT})` : STALE_HINT;
   }
   if (lastParseErrorKind !== "bad-arguments") return STALE_HINT;
   const cmd = resolveCommandFromArgv(program2, process.argv.slice(2));
@@ -39818,19 +39871,19 @@ program2.hook("preAction", async (_thisCommand, actionCommand) => {
 });
 var rules = program2.command("rules").description("org-managed .gitignore delivery");
 rules.command("gitignore").option("--write", "upsert the managed block into .gitignore (default: check only, non-zero exit on drift)").option("--json", "machine-readable output").description("verify (or --write) this repo's org-managed .gitignore block matches the SSOT").action((opts) => {
-  const path2 = (0, import_node_path43.join)(process.cwd(), ".gitignore");
-  const current = (0, import_node_fs46.existsSync)(path2) ? (0, import_node_fs46.readFileSync)(path2, "utf8") : null;
+  const path2 = (0, import_node_path44.join)(process.cwd(), ".gitignore");
+  const current = (0, import_node_fs47.existsSync)(path2) ? (0, import_node_fs47.readFileSync)(path2, "utf8") : null;
   const plan = planManagedGitignore(current);
   const drift = [...plan.added.map((l) => `+${l}`), ...plan.removed.map((l) => `-${l}`)].join(", ") || "block normalize";
   if (opts.json) {
-    if (opts.write && plan.changed) (0, import_node_fs46.writeFileSync)(path2, plan.content, "utf8");
+    if (opts.write && plan.changed) (0, import_node_fs47.writeFileSync)(path2, plan.content, "utf8");
     console.log(JSON.stringify(plan, null, 2));
     if (!opts.write && plan.changed) process.exitCode = 1;
     return;
   }
   if (opts.write) {
     if (plan.changed) {
-      (0, import_node_fs46.writeFileSync)(path2, plan.content, "utf8");
+      (0, import_node_fs47.writeFileSync)(path2, plan.content, "utf8");
       console.log(`mmi-cli devops org rules gitignore: updated .gitignore (${drift})`);
     } else {
       console.log("mmi-cli devops org rules gitignore: up to date");
@@ -39989,8 +40042,8 @@ gcCmd.option("--dry-run", "show what would be deleted (default)").option("--appl
   if (!Number.isFinite(limit) || limit < 1) return fail("worktree gc: --limit must be a positive integer");
   let root;
   if (o.root !== void 0) {
-    root = (0, import_node_path43.resolve)(o.root);
-    if (!(0, import_node_fs46.existsSync)(root) || !(0, import_node_fs46.statSync)(root).isDirectory()) return fail(`worktree gc: --root ${o.root} is not a directory`);
+    root = (0, import_node_path44.resolve)(o.root);
+    if (!(0, import_node_fs47.existsSync)(root) || !(0, import_node_fs47.statSync)(root).isDirectory()) return fail(`worktree gc: --root ${o.root} is not a directory`);
     const gcRepoRoot = (await execFileP2("git", ["rev-parse", "--show-toplevel"], { timeout: GIT_TIMEOUT_MS }).catch(() => ({ stdout: "" }))).stdout.trim() || process.cwd();
     if (isPathUnderDirectory2(gcRepoRoot, root)) {
       return fail(`worktree gc: --root ${root} contains this checkout \u2014 name a worktrees root, not the repo or an ancestor of it`);
@@ -40087,7 +40140,7 @@ async function currentWorktreeRemovalContext(command, force) {
   };
 }
 async function unprovenWorktreeReason(wtPath, repoRoot2) {
-  if (!(0, import_node_fs46.existsSync)(wtPath)) return `${wtPath} does not exist on disk`;
+  if (!(0, import_node_fs47.existsSync)(wtPath)) return `${wtPath} does not exist on disk`;
   const porcelain = (await execFileP2("git", ["-C", repoRoot2, "worktree", "list", "--porcelain"], { timeout: GIT_TIMEOUT_MS }).catch(() => ({ stdout: "" }))).stdout;
   const registered = parseWorktreePorcelainEntries(porcelain);
   if (!registered.length) {
@@ -40117,26 +40170,26 @@ function makeProvisionDeps(worktreeRoot, quiet, log) {
 function acquireWorktreeSetupLock(worktreeRoot) {
   const lockPath = repoRuntimeStatePath(worktreeRoot, "worktree-setup.lock");
   const take = () => {
-    const fd = (0, import_node_fs46.openSync)(lockPath, "wx");
+    const fd = (0, import_node_fs47.openSync)(lockPath, "wx");
     try {
-      (0, import_node_fs46.writeSync)(fd, String(Date.now()));
+      (0, import_node_fs47.writeSync)(fd, String(Date.now()));
     } finally {
-      (0, import_node_fs46.closeSync)(fd);
+      (0, import_node_fs47.closeSync)(fd);
     }
     return () => {
       try {
-        (0, import_node_fs46.rmSync)(lockPath, { force: true });
+        (0, import_node_fs47.rmSync)(lockPath, { force: true });
       } catch {
       }
     };
   };
   try {
-    (0, import_node_fs46.mkdirSync)((0, import_node_path43.dirname)(lockPath), { recursive: true });
+    (0, import_node_fs47.mkdirSync)((0, import_node_path44.dirname)(lockPath), { recursive: true });
     return take();
   } catch {
     try {
-      if (Date.now() - (0, import_node_fs46.statSync)(lockPath).mtimeMs > WORKTREE_SETUP_LOCK_TTL_MS) {
-        (0, import_node_fs46.rmSync)(lockPath, { force: true });
+      if (Date.now() - (0, import_node_fs47.statSync)(lockPath).mtimeMs > WORKTREE_SETUP_LOCK_TTL_MS) {
+        (0, import_node_fs47.rmSync)(lockPath, { force: true });
         return take();
       }
     } catch {
@@ -40282,6 +40335,7 @@ withExamples(mutating(
     let lease;
     try {
       await execJervCli([
+        "cli",
         "lease",
         "open",
         "--kind",
@@ -41000,7 +41054,7 @@ project.command("set [owner/repo]").description("upsert project META (idempotent
   if (dupe) return fail(`org project set: KEY "${dupe}" was passed to both --var and --set; --set is an alias of --var, so pass each KEY once`);
   if (o.secretsFile) {
     try {
-      vars.push(`secrets=${(0, import_node_fs46.readFileSync)(o.secretsFile, "utf8")}`);
+      vars.push(`secrets=${(0, import_node_fs47.readFileSync)(o.secretsFile, "utf8")}`);
     } catch (e) {
       return fail(`org project set: cannot read --secrets-file ${o.secretsFile}: ${e.message}`);
     }
@@ -41768,11 +41822,11 @@ pr.command("view <number>").description("read a PR as structured JSON (merged st
   }
 });
 async function listCiWorkflowPaths(cwd = process.cwd()) {
-  const wfDir = (0, import_node_path43.join)(cwd, ".github", "workflows");
-  if (!(0, import_node_fs46.existsSync)(wfDir)) return [];
-  return (0, import_node_fs46.readdirSync)(wfDir).filter((name) => /\.(ya?ml)$/i.test(name)).filter((name) => {
+  const wfDir = (0, import_node_path44.join)(cwd, ".github", "workflows");
+  if (!(0, import_node_fs47.existsSync)(wfDir)) return [];
+  return (0, import_node_fs47.readdirSync)(wfDir).filter((name) => /\.(ya?ml)$/i.test(name)).filter((name) => {
     try {
-      return workflowReportsPrChecks((0, import_node_fs46.readFileSync)((0, import_node_path43.join)(wfDir, name), "utf8"));
+      return workflowReportsPrChecks((0, import_node_fs47.readFileSync)((0, import_node_path44.join)(wfDir, name), "utf8"));
     } catch {
       return true;
     }
@@ -41824,16 +41878,16 @@ function ciAuditDeps() {
     // gate re-seed step is skipped gracefully rather than failing mid-run.
     readSeedFile: (path2) => {
       if (!root) return null;
-      const fullPath = (0, import_node_path43.join)(root, path2);
-      return (0, import_node_fs46.existsSync)(fullPath) ? (0, import_node_fs46.readFileSync)(fullPath, "utf8") : null;
+      const fullPath = (0, import_node_path44.join)(root, path2);
+      return (0, import_node_fs47.existsSync)(fullPath) ? (0, import_node_fs47.readFileSync)(fullPath, "utf8") : null;
     }
   };
 }
 function hubRoot() {
-  const fromPkg = (0, import_node_path43.join)(__dirname, "..", "..");
+  const fromPkg = (0, import_node_path44.join)(__dirname, "..", "..");
   const marker = "skills/bootstrap/seeds/manifest.json";
-  if ((0, import_node_fs46.existsSync)((0, import_node_path43.join)(fromPkg, marker))) return fromPkg;
-  if ((0, import_node_fs46.existsSync)((0, import_node_path43.join)(process.cwd(), marker))) return process.cwd();
+  if ((0, import_node_fs47.existsSync)((0, import_node_path44.join)(fromPkg, marker))) return fromPkg;
+  if ((0, import_node_fs47.existsSync)((0, import_node_path44.join)(process.cwd(), marker))) return process.cwd();
   return null;
 }
 async function waitLoopCorePool(label) {
@@ -42141,7 +42195,7 @@ jsonParity(pr.command("merge <number>").description("merge a PR (squash by defau
         }
         if (!repoForPostCleanup) throw e;
         console.warn(`pr merge: gh GraphQL rate-limited \u2014 merging PR #${number} via REST PUT instead (#4588).`);
-        const commitMessage = bodyFile ? (0, import_node_fs46.readFileSync)(bodyFile, "utf8") : void 0;
+        const commitMessage = bodyFile ? (0, import_node_fs47.readFileSync)(bodyFile, "utf8") : void 0;
         await defaultGitHubClient().rest("PUT", `repos/${repoForPostCleanup}/pulls/${number}/merge`, {
           body: { merge_method: method.slice(2), ...commitMessage ? { commit_message: commitMessage } : {} },
           timeoutMs: GH_MUTATION_TIMEOUT_MS
@@ -42237,7 +42291,7 @@ jsonParity(pr.command("merge <number>").description("merge a PR (squash by defau
     localCleanup = await cleanupPrMergeLocalBranch(headRef, {
       beforeWorktrees,
       startingPath,
-      pathExists: (p) => (0, import_node_fs46.existsSync)(p),
+      pathExists: (p) => (0, import_node_fs47.existsSync)(p),
       execGit: async (args) => (await execFileP2("git", args, { timeout: GIT_TIMEOUT_MS })).stdout,
       teardownWorktreeStage,
       deferredStore,
@@ -42815,12 +42869,12 @@ access.command("audit").description("audit collaborator roles + train-branch pus
     targets = resolution.targets;
   }
   const derivedMatrix = registryProjects ? accessMatrixFromProjects(registryProjects) : {};
-  const fileMatrix = (0, import_node_fs46.existsSync)("access-matrix.json") ? loadAccessMatrix((0, import_node_fs46.readFileSync)("access-matrix.json", "utf8")) : {};
+  const fileMatrix = (0, import_node_fs47.existsSync)("access-matrix.json") ? loadAccessMatrix((0, import_node_fs47.readFileSync)("access-matrix.json", "utf8")) : {};
   const matrix = mergeAccessMatrix(fileMatrix, derivedMatrix);
   const derivedContracts = registryProjects ? dataAccessContractsFromProjects(registryProjects) : { consumers: {} };
-  const fileContracts = (0, import_node_fs46.existsSync)("data-access-contracts.json") ? loadDataAccessContracts((0, import_node_fs46.readFileSync)("data-access-contracts.json", "utf8")) : { consumers: {} };
+  const fileContracts = (0, import_node_fs47.existsSync)("data-access-contracts.json") ? loadDataAccessContracts((0, import_node_fs47.readFileSync)("data-access-contracts.json", "utf8")) : { consumers: {} };
   const dataAccess = mergeDataAccessContracts(fileContracts, derivedContracts);
-  const sanctioned = (0, import_node_fs46.existsSync)("access-matrix.json") ? loadSanctionedAdmins((0, import_node_fs46.readFileSync)("access-matrix.json", "utf8")) : {};
+  const sanctioned = (0, import_node_fs47.existsSync)("access-matrix.json") ? loadSanctionedAdmins((0, import_node_fs47.readFileSync)("access-matrix.json", "utf8")) : {};
   const report = await auditOrgAccess(targets, deps, matrix, dataAccess, sanctioned);
   console.log(o.json ? JSON.stringify(report, null, 2) : renderAccessReport(report));
   if (!report.ok) process.exitCode = 1;
@@ -42852,16 +42906,16 @@ function directoryBytes(path2) {
   let total = 0;
   let entries;
   try {
-    entries = (0, import_node_fs46.readdirSync)(path2, { withFileTypes: true });
+    entries = (0, import_node_fs47.readdirSync)(path2, { withFileTypes: true });
   } catch {
     return 0;
   }
   for (const entry of entries) {
-    const child2 = (0, import_node_path43.join)(path2, entry.name);
+    const child2 = (0, import_node_path44.join)(path2, entry.name);
     if (entry.isDirectory()) total += directoryBytes(child2);
     else {
       try {
-        total += (0, import_node_fs46.statSync)(child2).size;
+        total += (0, import_node_fs47.statSync)(child2).size;
       } catch {
       }
     }
@@ -42869,25 +42923,25 @@ function directoryBytes(path2) {
   return total;
 }
 function listDirEntries(dir) {
-  return (0, import_node_fs46.readdirSync)(dir, { withFileTypes: true }).map((d) => ({ name: d.name, isDirectory: d.isDirectory() }));
+  return (0, import_node_fs47.readdirSync)(dir, { withFileTypes: true }).map((d) => ({ name: d.name, isDirectory: d.isDirectory() }));
 }
 function readInstalledPluginRefs(configRoot) {
   const p = installedPluginsPathForConfig(configRoot);
-  if (!(0, import_node_fs46.existsSync)(p)) return [];
+  if (!(0, import_node_fs47.existsSync)(p)) return [];
   try {
-    return installedPluginPaths((0, import_node_fs46.readFileSync)(p, "utf8"));
+    return installedPluginPaths((0, import_node_fs47.readFileSync)(p, "utf8"));
   } catch {
     return null;
   }
 }
 function pluginCacheFsDeps(configRoot, dirBytes) {
   return {
-    exists: (p) => (0, import_node_fs46.existsSync)(p),
-    listVersionDirs: (root) => (0, import_node_fs46.readdirSync)(root, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name),
+    exists: (p) => (0, import_node_fs47.existsSync)(p),
+    listVersionDirs: (root) => (0, import_node_fs47.readdirSync)(root, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name),
     dirBytes,
-    listStagingDirs: (root) => (0, import_node_fs46.readdirSync)(root, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => {
+    listStagingDirs: (root) => (0, import_node_fs47.readdirSync)(root, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => {
       try {
-        return { name: d.name, mtimeMs: newestMtimeMs((0, import_node_path43.join)(root, d.name), listDirEntries, (p) => (0, import_node_fs46.statSync)(p).mtimeMs) };
+        return { name: d.name, mtimeMs: newestMtimeMs((0, import_node_path44.join)(root, d.name), listDirEntries, (p) => (0, import_node_fs47.statSync)(p).mtimeMs) };
       } catch {
         return { name: d.name, mtimeMs: Date.now() };
       }
@@ -42901,10 +42955,10 @@ function stagingApplyFsGuard(configRoot) {
   return {
     referencedPaths: () => readInstalledPluginRefs(configRoot),
     mtimeMs: (name) => {
-      const p = (0, import_node_path43.join)(stagingRoot, name);
-      if (!(0, import_node_fs46.existsSync)(p)) return null;
+      const p = (0, import_node_path44.join)(stagingRoot, name);
+      if (!(0, import_node_fs47.existsSync)(p)) return null;
       try {
-        return newestMtimeMs(p, listDirEntries, (q) => (0, import_node_fs46.statSync)(q).mtimeMs);
+        return newestMtimeMs(p, listDirEntries, (q) => (0, import_node_fs47.statSync)(q).mtimeMs);
       } catch {
         return null;
       }
@@ -42930,7 +42984,7 @@ program2.command("plugin-prune").description(`prune stale cached MMI plugin vers
     { withBytes: true, configRoot, includeStaging: surface !== "codex" }
   );
   const anythingToDelete = plan.prune.length > 0 || plan.staging.length > 0;
-  const result = o.apply && anythingToDelete ? applyPluginCachePlan(plan, (p) => (0, import_node_fs46.rmSync)(p, { recursive: true, force: true }), stagingApplyFsGuard(configRoot)) : void 0;
+  const result = o.apply && anythingToDelete ? applyPluginCachePlan(plan, (p) => (0, import_node_fs47.rmSync)(p, { recursive: true, force: true }), stagingApplyFsGuard(configRoot)) : void 0;
   const warnings = plan.prune.length > 0 ? [CONCURRENT_SESSION_WARNING] : [];
   if (o.json) console.log(JSON.stringify({ ...plan, warnings, applied: result ?? null }));
   else console.log(renderPluginCachePlan(plan, result));
@@ -42938,7 +42992,7 @@ program2.command("plugin-prune").description(`prune stale cached MMI plugin vers
 });
 function readReleaseCatchupState(path2) {
   try {
-    const parsed = JSON.parse((0, import_node_fs46.readFileSync)(path2, "utf8"));
+    const parsed = JSON.parse((0, import_node_fs47.readFileSync)(path2, "utf8"));
     return typeof parsed?.checkedAt === "number" ? parsed : void 0;
   } catch {
     return void 0;
@@ -42946,8 +43000,8 @@ function readReleaseCatchupState(path2) {
 }
 function writeReleaseCatchupState(path2, state) {
   try {
-    (0, import_node_fs46.mkdirSync)((0, import_node_path43.dirname)(path2), { recursive: true });
-    (0, import_node_fs46.writeFileSync)(path2, `${JSON.stringify(state)}
+    (0, import_node_fs47.mkdirSync)((0, import_node_path44.dirname)(path2), { recursive: true });
+    (0, import_node_fs47.writeFileSync)(path2, `${JSON.stringify(state)}
 `);
   } catch {
   }