@mutmutco/cli 3.135.0 → 3.137.0

package/dist/main.cjs

@@ -3416,7 +3416,7 @@ var program = new Command();
 
 // src/index.ts
 var import_promises12 = require("node:fs/promises");
-var import_node_fs47 = require("node:fs");
+var import_node_fs48 = require("node:fs");
 var import_node_child_process19 = require("node:child_process");
 
 // src/cli-shared.ts
@@ -5502,7 +5502,9 @@ function parseWorktreeOwners(text) {
   return parsed.entries.filter((e) => {
     if (!e || typeof e !== "object") return false;
     const entry = e;
-    return typeof entry.path === "string" && entry.path.length > 0 && typeof entry.branch === "string" && typeof entry.createdAt === "string" && typeof entry.lastSeenAt === "string" && isActor(entry.actor);
+    const provenance = entry.provenance;
+    const provenanceValid = provenance === void 0 || typeof provenance === "object" && typeof provenance.creationBaseOid === "string" && /^[0-9a-f]{40,64}$/i.test(provenance.creationBaseOid) && typeof provenance.workerBranch === "string" && provenance.workerBranch.length > 0;
+    return typeof entry.path === "string" && entry.path.length > 0 && typeof entry.branch === "string" && typeof entry.createdAt === "string" && typeof entry.lastSeenAt === "string" && isActor(entry.actor) && provenanceValid;
   });
 }
 function serializeWorktreeOwners(entries) {
@@ -5847,6 +5849,21 @@ async function sweepDeferredWorktrees(store, deps, removalContext) {
       continue;
     }
     const owner = removalContext ? lookupWorktreeOwner(removalContext.primaryRoot, entry.path) : void 0;
+    if (!current && deps.pathExists?.(entry.path) === false) {
+      removed.push(entry.path);
+      if (removalContext) {
+        recordWorktreeRemoval(removalContext.primaryRoot, {
+          action: "removed",
+          command: removalContext.command,
+          target: entry.path,
+          branch: entry.branch,
+          actor: removalContext.actor,
+          owner,
+          reason: "deferred worktree already absent from Git registration and filesystem"
+        });
+      }
+      continue;
+    }
     if (removalContext) {
       const activeRoot = removalContext.activeWorkspaceRoot ?? resolveActiveWorkspaceRoot();
       const activeGuard = decideActiveWorkspaceGuard(entry.path, activeRoot, process.platform, {
@@ -6400,6 +6417,8 @@ function buildGcPlan(inputs) {
   const preservedBranches2 = new Set(inputs.preservedBranches ?? []);
   const preservedWorktrees = new Set((inputs.worktrees ?? []).filter((w) => w.preserved).map((w) => w.branch));
   const mergedIntoBase = new Set((inputs.mergedIntoBase ?? []).map((b) => b.trim()).filter(Boolean));
+  const exactTreeLanded = new Map((inputs.exactTreeLanded ?? []).map((p) => [p.branch.trim(), p]));
+  const exactTreeRefusals = new Map((inputs.exactTreeRefusals ?? []).map((p) => [p.branch.trim(), p.detail]));
   const prLookupFailures = new Map((inputs.prLookupFailures ?? []).map((f) => [f.branch.trim(), f.detail]));
   const skipped = [];
   const branches = [];
@@ -6426,8 +6445,10 @@ function buildGcPlan(inputs) {
       skipped.push({ branch, reason: "open-pr" });
       continue;
     }
-    const state = closedState(prSet);
-    if (!state) continue;
+    const exactDelivery = exactTreeLanded.get(branch);
+    const exactRefusal = exactTreeRefusals.get(branch);
+    const state = closedState(prSet) ?? (exactDelivery ? { state: "EXACT_TREE", numbers: [], headOids: [] } : null);
+    if (!state && !exactRefusal) continue;
     if (branch === inputs.currentBranch) {
       skipped.push({ branch, reason: "current-branch" });
       skipTrackingBranches.add(branch);
@@ -6444,8 +6465,14 @@ function buildGcPlan(inputs) {
       skipTrackingBranches.add(branch);
       continue;
     }
+    if (!state) {
+      skipped.push({ branch, reason: "exact-tree-proof-refused", detail: exactRefusal });
+      skipTrackingBranches.add(branch);
+      continue;
+    }
     const localHead = branchHeads?.get(branch);
-    const containedInBase = mergedIntoBase.has(branch);
+    const exactHeadStillMatches = Boolean(exactDelivery && localHead === exactDelivery.headOid);
+    const containedInBase = mergedIntoBase.has(branch) || exactHeadStillMatches;
     if (!containedInBase && (worktree2?.unpushed || branchHeads && (!localHead || !state.headOids.length || !state.headOids.includes(localHead)))) {
       const detail = worktree2?.unpushed ? worktree2.path : localHead && state.headOids.length ? `${localHead} != ${state.headOids.join("|")}` : "local branch head could not be verified against the PR head";
       skipped.push({ branch, reason: "unpushed-branch", detail });
@@ -6458,7 +6485,8 @@ function buildGcPlan(inputs) {
       prNumbers: state.numbers,
       worktreePath: worktree2?.path,
       ...state.headOids.length ? { reviewedHeadOids: state.headOids } : {},
-      ...containedInBase ? { containedInBase: true, ...localHead ? { plannedHeadOid: localHead } : {} } : {}
+      ...containedInBase ? { containedInBase: true, ...localHead ? { plannedHeadOid: localHead } : {} } : {},
+      ...exactHeadStillMatches ? { deliveredBy: exactDelivery.candidateOid } : {}
     });
   }
   const trackingRefs = [...new Set(inputs.staleTrackingRefs ?? [])].map((ref) => {
@@ -7060,7 +7088,8 @@ function formatGcPlan(plan, apply, auditClone) {
     for (const b of plan.branches) {
       const prs = b.prNumbers.length ? ` #${b.prNumbers.join(",#")}` : "";
       const wt = b.worktreePath ? ` (worktree: ${b.worktreePath})` : "";
-      lines.push(` - ${b.branch} (${b.prState}${prs})${wt}`);
+      const authority = b.deliveredBy ? `${b.prState}; deliveredBy ${b.deliveredBy}` : `${b.prState}${prs}`;
+      lines.push(` - ${b.branch} (${authority})${wt}`);
     }
   }
   const remoteBranches = plan.branches.filter((b) => (b.reviewedHeadOids?.length ?? 0) > 0);
@@ -7869,7 +7898,7 @@ function commandLadderHint() {
 }
 
 // src/index.ts
-var import_node_path45 = require("node:path");
+var import_node_path46 = require("node:path");
 
 // src/merge-ci-policy.ts
 function resolveMergeCiPolicy(input) {
@@ -8384,6 +8413,12 @@ function loadBootstrapSeeds(manifestJson) {
     if (s.ownership !== "org" && s.ownership !== "repo") {
       throw new Error(`invalid seed ownership '${s.ownership}' for ${s.target} (must be 'org' or 'repo')`);
     }
+    if (s.managedBlock) {
+      const block = s.managedBlock;
+      if (!block.source || !block.begin || !block.end || block.begin === block.end || /[\r\n]/.test(block.begin + block.end)) {
+        throw new Error(`invalid managedBlock for ${s.target} (needs source and distinct single-line begin/end markers)`);
+      }
+    }
   }
   return {
     seeds,
@@ -8399,6 +8434,68 @@ function missingPlaceholders(rendered) {
   for (const m of rendered.matchAll(PLACEHOLDER_RE)) out.add(m[1]);
   return [...out];
 }
+function isPropagatableSeed(seed) {
+  return seed.ownership === "org" && seed.source === "self" || seed.managedBlock != null;
+}
+function sourceLines(content) {
+  const lines = [];
+  const newline = /\r\n|\n|\r/g;
+  let start = 0;
+  for (const match of content.matchAll(newline)) {
+    const index = match.index;
+    lines.push({ start, textEnd: index, end: index + match[0].length, text: content.slice(start, index) });
+    start = index + match[0].length;
+  }
+  lines.push({ start, textEnd: content.length, end: content.length, text: content.slice(start) });
+  return lines;
+}
+function normalizeEol(content) {
+  return content.replace(/\r\n|\r|\n/g, "\n");
+}
+function upsertManagedSeedBlock(current, desired, begin, end) {
+  const desiredLines = sourceLines(desired);
+  const desiredBegins = desiredLines.filter((line) => line.text === begin);
+  const desiredEnds = desiredLines.filter((line) => line.text === end);
+  if (desiredBegins.length !== 1 || desiredEnds.length !== 1 || desiredEnds[0].start <= desiredBegins[0].start) {
+    return { ok: false, reason: "managed block source must contain exactly one well-ordered marker pair" };
+  }
+  const desiredBegin = desiredBegins[0];
+  const desiredEnd = desiredEnds[0];
+  if (desired.slice(0, desiredBegin.start).trim() || desired.slice(desiredEnd.end).trim()) {
+    return { ok: false, reason: "managed block source must contain only the bounded block" };
+  }
+  const canonical = desired.slice(desiredBegin.start, desiredEnd.textEnd);
+  const currentLines = sourceLines(current);
+  const begins = currentLines.filter((line) => line.text === begin);
+  const ends = currentLines.filter((line) => line.text === end);
+  if (begins.length === 0 && ends.length === 0) {
+    const eol2 = current.match(/\r\n|\n|\r/)?.[0] ?? "\n";
+    const block2 = normalizeEol(canonical).replace(/\n/g, eol2);
+    if (current.length === 0) return { ok: true, content: `${block2}${eol2}`, changed: true, action: "insert" };
+    const separator = /(?:\r\n|\n|\r)$/.test(current) ? eol2 : `${eol2}${eol2}`;
+    return { ok: true, content: `${current}${separator}${block2}${eol2}`, changed: true, action: "insert" };
+  }
+  if (begins.length !== 1 || ends.length !== 1) {
+    return { ok: false, reason: `malformed managed block markers (begin=${begins.length}, end=${ends.length})` };
+  }
+  const currentBegin = begins[0];
+  const currentEnd = ends[0];
+  if (currentEnd.start <= currentBegin.start) {
+    return { ok: false, reason: "malformed managed block markers (end precedes begin)" };
+  }
+  const existing = current.slice(currentBegin.start, currentEnd.textEnd);
+  if (normalizeEol(existing) === normalizeEol(canonical)) {
+    return { ok: true, content: current, changed: false, action: "current" };
+  }
+  const eol = current.match(/\r\n|\n|\r/)?.[0] ?? "\n";
+  const block = normalizeEol(canonical).replace(/\n/g, eol);
+  return {
+    ok: true,
+    content: `${current.slice(0, currentBegin.start)}${block}${current.slice(currentEnd.textEnd)}`,
+    changed: true,
+    action: "replace"
+  };
+}
 async function resolveHubSeedSource(execGit, defaultBranch = "development") {
   let status;
   try {
@@ -9463,6 +9560,9 @@ function seedMatchesProjectType(seed, projectType) {
   return projectType != null && seed.projectTypes.includes(projectType);
 }
 function planSeedAction(seed, exists) {
+  if (seed.managedBlock) {
+    return exists ? { target: seed.target, action: "update", ownership: "repo", reason: "repo-owned file; Hub-managed block reconciled in place" } : { target: seed.target, action: "create", ownership: "repo", reason: "repo-owned, missing; full template created with Hub-managed block" };
+  }
   if (seed.source === "managed-block") {
     return exists ? { target: seed.target, action: "update", ownership: "org", reason: "org-managed block merged in-place (repo-owned lines preserved)" } : { target: seed.target, action: "create", ownership: "org", reason: "org-managed block; .gitignore absent, created" };
   }
@@ -9521,6 +9621,18 @@ function resolveSeedContent(seed, vars, readFile9) {
   }
   return null;
 }
+function resolveSeedWriteContent(seed, vars, readFile9, remoteContent) {
+  if (!seed.managedBlock) {
+    return { ok: true, content: resolveSeedContent(seed, vars, readFile9), managed: seed.source === "managed-block" };
+  }
+  const base = remoteContent ?? resolveSeedContent(seed, vars, readFile9);
+  if (base == null) return { ok: true, content: null, managed: true };
+  const blockSeed = { ...seed, source: seed.managedBlock.source, managedBlock: void 0 };
+  const desired = resolveSeedContent(blockSeed, vars, readFile9);
+  if (desired == null) return { ok: true, content: null, managed: true };
+  const result = upsertManagedSeedBlock(base, desired, seed.managedBlock.begin, seed.managedBlock.end);
+  return result.ok ? { ok: true, content: result.content, managed: true } : { ok: false, reason: result.reason, managed: true };
+}
 function buildRegisterPayload(repo, cls, vars, options = {}) {
   const parsedRepo = parseOwnerRepo(repo);
   const slug = parsedRepo.slug;
@@ -9752,9 +9864,9 @@ function parseVerifyBroker(stdout) {
 }
 
 // src/train-apply.ts
-var import_node_fs22 = require("node:fs");
+var import_node_fs23 = require("node:fs");
 var import_promises4 = require("node:fs/promises");
-var import_node_path22 = require("node:path");
+var import_node_path23 = require("node:path");
 
 // src/plugin-guard-io.ts
 var import_node_fs19 = require("node:fs");
@@ -11186,9 +11298,9 @@ function renderAccessReport(report) {
 }
 
 // src/cli-doctor-shared.ts
-var import_node_fs20 = require("node:fs");
-var import_node_path21 = require("node:path");
 var import_node_fs21 = require("node:fs");
+var import_node_path22 = require("node:path");
+var import_node_fs22 = require("node:fs");
 
 // ../infra/registry-endpoints.mjs
 var PROJECTS_LIST_PATH = "/projects/list";
@@ -13630,6 +13742,142 @@ async function fileReport(deps, req) {
   return { ok: true, body };
 }
 
+// src/worktree-delivery-proof.ts
+var import_node_fs20 = require("node:fs");
+var import_node_os9 = require("node:os");
+var import_node_path21 = require("node:path");
+var OID_RE = /^[0-9a-f]{40,64}$/i;
+var EXACT_TREE_CANDIDATE_LIMIT = 32;
+async function repointDeliveredWorktreeTransactionally(input) {
+  const symbolic = (await input.git(["symbolic-ref", "--quiet", "--short", "HEAD"]).catch(() => "")).trim();
+  if (symbolic !== input.branch) return { action: "refuse", reason: "wrong-branch", detail: symbolic || "detached HEAD" };
+  const current = (await input.git(["rev-parse", "--verify", `refs/heads/${input.branch}`]).catch(() => "")).trim();
+  if (current !== input.expectedWorkerOid) {
+    return { action: "refuse", reason: "worker-moved", detail: `${current || "unreadable"} != ${input.expectedWorkerOid}` };
+  }
+  const status = await input.git(["status", "--porcelain"]).catch(() => "unreadable");
+  if (status.trim()) return { action: "refuse", reason: "dirty-worktree", detail: "tracked or untracked files present" };
+  try {
+    await input.git(["checkout", "-B", input.branch, input.landedTipOid]);
+    return { action: "repointed" };
+  } catch (error) {
+    return { action: "refuse", reason: "checkout-failed", detail: error instanceof Error ? error.message : String(error) };
+  }
+}
+function supportsExactTreeProofGit(versionOutput) {
+  const match = /\bgit version (\d+)\.(\d+)(?:\.\d+)?/i.exec(versionOutput.trim());
+  if (!match) return false;
+  const major = Number(match[1]);
+  const minor = Number(match[2]);
+  return major > 2 || major === 2 && minor >= 32;
+}
+function describeExactTreeRefusal(verdict) {
+  return `${verdict.reason}${verdict.detail ? `: ${verdict.detail}` : ""}`;
+}
+function sameChangedPathSet(a, b) {
+  const sorted = (value) => value.split("\0").filter(Boolean).sort().join("\0");
+  return sorted(a) === sorted(b);
+}
+async function proveExactTreeDelivery(input, deps = {}) {
+  const base = input.creationBaseOid?.trim();
+  if (!base || !OID_RE.test(base)) return { action: "refuse", reason: "missing-provenance" };
+  if (!input.recordedWorkerBranch || input.recordedWorkerBranch !== input.branch) {
+    return { action: "refuse", reason: "worker-identity-mismatch" };
+  }
+  if (!OID_RE.test(input.workerOid)) return { action: "refuse", reason: "proof-failed", detail: "worker OID is invalid" };
+  const run = deps.git ?? (async (args, env) => (await execFileP2("git", ["-C", input.repoRoot, ...args], {
+    timeout: GIT_TIMEOUT_MS,
+    ...env ? { env: { ...process.env, ...env } } : {}
+  })).stdout);
+  const isAncestor = (ancestor, descendant) => run(["merge-base", "--is-ancestor", ancestor, descendant]).then(() => true).catch(() => false);
+  let version;
+  try {
+    version = await run(["version"]);
+  } catch {
+    return { action: "refuse", reason: "proof-failed", detail: "Git capability probe failed" };
+  }
+  if (!supportsExactTreeProofGit(version)) {
+    return { action: "refuse", reason: "unsupported-git", detail: `requires Git >=2.32; found ${version.trim() || "unparseable version"}` };
+  }
+  try {
+    const [baseType, workerType] = await Promise.all([
+      run(["cat-file", "-t", base]).then((v) => v.trim()).catch(() => ""),
+      run(["cat-file", "-t", input.workerOid]).then((v) => v.trim()).catch(() => "")
+    ]);
+    if (baseType !== "commit" || workerType !== "commit" || !await isAncestor(base, input.workerOid)) {
+      return { action: "refuse", reason: "unverified-base" };
+    }
+    const candidates = /* @__PURE__ */ new Map();
+    for (const tip of [...new Set(input.landedTips.map((v) => v.trim()).filter(Boolean))]) {
+      if (!OID_RE.test(tip) || !await isAncestor(base, tip)) continue;
+      const listed = await run([
+        "rev-list",
+        "--first-parent",
+        "--parents",
+        `--max-count=${EXACT_TREE_CANDIDATE_LIMIT + 1}`,
+        `${base}..${tip}`
+      ]);
+      const rows = listed.split(/\r?\n/).map((v) => v.trim()).filter(Boolean);
+      if (rows.length > EXACT_TREE_CANDIDATE_LIMIT) {
+        return {
+          action: "refuse",
+          reason: "candidate-limit-exceeded",
+          detail: `more than ${EXACT_TREE_CANDIDATE_LIMIT} first-parent candidates since stored base`
+        };
+      }
+      for (const row of rows) {
+        const [oid, parent] = row.split(/\s+/);
+        if (oid && parent && OID_RE.test(oid) && OID_RE.test(parent)) candidates.set(oid, parent);
+      }
+      if (candidates.size > EXACT_TREE_CANDIDATE_LIMIT) {
+        return {
+          action: "refuse",
+          reason: "candidate-limit-exceeded",
+          detail: `more than ${EXACT_TREE_CANDIDATE_LIMIT} unique first-parent candidates across landed tips`
+        };
+      }
+    }
+    if (!candidates.size) return { action: "refuse", reason: "no-candidate" };
+    const workerPaths = await run(["diff", "--name-only", "-z", "--no-renames", base, input.workerOid]);
+    const pathMatches = [];
+    for (const [candidate, parent] of candidates) {
+      const candidatePaths = await run(["diff", "--name-only", "-z", "--no-renames", parent, candidate]);
+      if (sameChangedPathSet(workerPaths, candidatePaths)) pathMatches.push([candidate, parent]);
+    }
+    if (!pathMatches.length) return { action: "refuse", reason: "tree-mismatch" };
+    const makeTempDir = deps.makeTempDir ?? (() => (0, import_node_fs20.mkdtempSync)((0, import_node_path21.join)((0, import_node_os9.tmpdir)(), "mmi-tree-proof-")));
+    const writeTextFile = deps.writeTextFile ?? ((path2, text) => (0, import_node_fs20.writeFileSync)(path2, text, "utf8"));
+    const removeTempDir = deps.removeTempDir ?? ((path2) => (0, import_node_fs20.rmSync)(path2, { recursive: true, force: true }));
+    const root = makeTempDir();
+    try {
+      const synthesize = async (name, from, to) => {
+        const index = (0, import_node_path21.join)(root, `${name}.index`);
+        const patch = (0, import_node_path21.join)(root, `${name}.patch`);
+        const env = { GIT_INDEX_FILE: index };
+        await run(["read-tree", base], env);
+        const delta = await run(["diff-tree", "-p", "--binary", "--full-index", "--no-renames", "--no-ext-diff", from, to]);
+        writeTextFile(patch, delta);
+        if (delta.length) await run(["apply", "--cached", "--binary", "--3way", patch], env);
+        return (await run(["write-tree"], env)).trim();
+      };
+      const workerTreeOid = await synthesize("worker", base, input.workerOid);
+      const matches = [];
+      let candidateNumber = 0;
+      for (const [candidate, parent] of pathMatches) {
+        const tree = await synthesize(`candidate-${candidateNumber++}`, parent, candidate).catch(() => void 0);
+        if (tree === workerTreeOid) matches.push(candidate);
+      }
+      if (matches.length === 1) return { action: "settle", workerTreeOid, candidateOid: matches[0] };
+      if (matches.length > 1) return { action: "refuse", reason: "ambiguous-candidate" };
+      return { action: "refuse", reason: "tree-mismatch" };
+    } finally {
+      removeTempDir(root);
+    }
+  } catch (error) {
+    return { action: "refuse", reason: "proof-failed", detail: error instanceof Error ? error.message : String(error) };
+  }
+}
+
 // src/cli-doctor-shared.ts
 var GC_GH_TIMEOUT_MS = 2e4;
 var RUN_LIST_TIMEOUT_MS = 2e4;
@@ -13732,7 +13980,7 @@ async function localBranchHeads() {
 }
 async function currentRepoWorktreeGitRoot(repoRoot2) {
   const gitCommonDir = (await execFileP2("git", ["rev-parse", "--git-common-dir"], { timeout: GIT_TIMEOUT_MS }).catch(() => ({ stdout: "" }))).stdout.trim();
-  return gitCommonDir ? (0, import_node_path21.resolve)(repoRoot2, gitCommonDir, "worktrees") : "";
+  return gitCommonDir ? (0, import_node_path22.resolve)(repoRoot2, gitCommonDir, "worktrees") : "";
 }
 async function worktreeBranches() {
   const { stdout } = await execFileP2("git", ["worktree", "list", "--porcelain"], { timeout: GIT_TIMEOUT_MS });
@@ -13752,18 +14000,18 @@ function resolveGitdirForWorktreeFile(worktreePath, content) {
   const match = /^gitdir:\s*(.+)\s*$/im.exec(content);
   if (!match?.[1]) return void 0;
   const raw = match[1].trim();
-  return (0, import_node_path21.isAbsolute)(raw) ? raw : (0, import_node_path21.resolve)(worktreePath, raw);
+  return (0, import_node_path22.isAbsolute)(raw) ? raw : (0, import_node_path22.resolve)(worktreePath, raw);
 }
 function metadataOwnsMissingWorktreeDir(worktreePath, worktreeGitRoot) {
   if (!worktreeGitRoot) return false;
   try {
-    const entries = (0, import_node_fs21.readdirSync)(worktreeGitRoot, { withFileTypes: true });
+    const entries = (0, import_node_fs22.readdirSync)(worktreeGitRoot, { withFileTypes: true });
     for (const ent of entries) {
       if (!ent.isDirectory()) continue;
       try {
-        const gitdirPath = (0, import_node_fs20.readFileSync)((0, import_node_path21.join)(worktreeGitRoot, ent.name, "gitdir"), "utf8").trim();
-        const resolvedGitdir = (0, import_node_path21.isAbsolute)(gitdirPath) ? gitdirPath : (0, import_node_path21.resolve)(worktreeGitRoot, ent.name, gitdirPath);
-        if (sameWorktreeMetadataPath((0, import_node_path21.dirname)(resolvedGitdir), worktreePath)) return true;
+        const gitdirPath = (0, import_node_fs21.readFileSync)((0, import_node_path22.join)(worktreeGitRoot, ent.name, "gitdir"), "utf8").trim();
+        const resolvedGitdir = (0, import_node_path22.isAbsolute)(gitdirPath) ? gitdirPath : (0, import_node_path22.resolve)(worktreeGitRoot, ent.name, gitdirPath);
+        if (sameWorktreeMetadataPath((0, import_node_path22.dirname)(resolvedGitdir), worktreePath)) return true;
       } catch {
       }
     }
@@ -13773,7 +14021,7 @@ function metadataOwnsMissingWorktreeDir(worktreePath, worktreeGitRoot) {
 }
 function pathExistsKnown(path2) {
   try {
-    (0, import_node_fs21.statSync)(path2);
+    (0, import_node_fs22.statSync)(path2);
     return true;
   } catch (e) {
     const code = typeof e === "object" && e && "code" in e ? String(e.code ?? "") : "";
@@ -13782,10 +14030,10 @@ function pathExistsKnown(path2) {
   }
 }
 function inspectSiblingWorktreeDir(path2, worktreeGitRoot) {
-  const gitPath = (0, import_node_path21.join)(path2, ".git");
+  const gitPath = (0, import_node_path22.join)(path2, ".git");
   let st;
   try {
-    st = (0, import_node_fs21.lstatSync)(gitPath);
+    st = (0, import_node_fs22.lstatSync)(gitPath);
   } catch (e) {
     const code = typeof e === "object" && e && "code" in e ? String(e.code ?? "") : "";
     if (code === "ENOENT" || code === "ENOTDIR") {
@@ -13802,7 +14050,7 @@ function inspectSiblingWorktreeDir(path2, worktreeGitRoot) {
   if (st.isDirectory()) return { path: path2, gitType: "dir" };
   if (!st.isFile()) return { path: path2, gitType: "other" };
   try {
-    const gitFileContent = (0, import_node_fs20.readFileSync)(gitPath, "utf8");
+    const gitFileContent = (0, import_node_fs21.readFileSync)(gitPath, "utf8");
     const gitdir = resolveGitdirForWorktreeFile(path2, gitFileContent);
     const gitDirExists = gitdir ? pathExistsKnown(gitdir) : false;
     return {
@@ -13819,7 +14067,7 @@ function inspectSiblingWorktreeDir(path2, worktreeGitRoot) {
 }
 function inspectDeadWorktreeDirContent(path2) {
   try {
-    return { entries: (0, import_node_fs21.readdirSync)(path2) };
+    return { entries: (0, import_node_fs22.readdirSync)(path2) };
   } catch (e) {
     const code = typeof e === "object" && e && "code" in e ? String(e.code ?? "") : "";
     return { error: code ? `unable to inspect directory contents (${code})` : "unable to inspect directory contents" };
@@ -13836,11 +14084,11 @@ async function preservedBranches() {
 async function siblingWorktreeDirs(explicitRoot) {
   const repoRoot2 = (await execFileP2("git", ["rev-parse", "--show-toplevel"], { timeout: GIT_TIMEOUT_MS }).catch(() => ({ stdout: "" }))).stdout.trim() || process.cwd();
   const worktreeGitRoot = await currentRepoWorktreeGitRoot(repoRoot2);
-  const primaryRepoRoot = worktreeGitRoot ? (0, import_node_path21.dirname)((0, import_node_path21.dirname)(worktreeGitRoot)) : repoRoot2;
+  const primaryRepoRoot = worktreeGitRoot ? (0, import_node_path22.dirname)((0, import_node_path22.dirname)(worktreeGitRoot)) : repoRoot2;
   try {
     const dirs = explicitRoot ? listDirsIn(resolveExplicitScanRoot(explicitRoot, primaryRepoRoot)) : worktreeScanDirs(siblingMmiWorktreesRoot(primaryRepoRoot), primaryRepoRoot, listDirsIn, isRepoCheckoutDir);
     const agentDirs = listDirsIn(agentWorktreesRoot(primaryRepoRoot));
-    const repoLocalWorktrees = listDirsIn((0, import_node_path21.join)(primaryRepoRoot, ".worktrees"));
+    const repoLocalWorktrees = listDirsIn((0, import_node_path22.join)(primaryRepoRoot, ".worktrees"));
     return [...dirs, ...agentDirs, ...repoLocalWorktrees].map((dir) => inspectSiblingWorktreeDir(dir, worktreeGitRoot)).filter((entry) => Boolean(entry));
   } catch {
     return [];
@@ -13848,18 +14096,18 @@ async function siblingWorktreeDirs(explicitRoot) {
 }
 function listDirsIn(dir) {
   try {
-    return (0, import_node_fs21.readdirSync)(dir, { withFileTypes: true }).filter((ent) => ent.isDirectory()).map((ent) => (0, import_node_path21.join)(dir, ent.name));
+    return (0, import_node_fs22.readdirSync)(dir, { withFileTypes: true }).filter((ent) => ent.isDirectory()).map((ent) => (0, import_node_path22.join)(dir, ent.name));
   } catch {
     return [];
   }
 }
 function isRepoCheckoutDir(dir) {
-  return (0, import_node_fs21.existsSync)((0, import_node_path21.join)(dir, ".git"));
+  return (0, import_node_fs22.existsSync)((0, import_node_path22.join)(dir, ".git"));
 }
 function resolveExplicitScanRoot(explicitRoot, repoRoot2) {
   let rootDirs;
   try {
-    rootDirs = (0, import_node_fs21.readdirSync)(explicitRoot, { withFileTypes: true }).filter((ent) => ent.isDirectory()).map((ent) => ent.name);
+    rootDirs = (0, import_node_fs22.readdirSync)(explicitRoot, { withFileTypes: true }).filter((ent) => ent.isDirectory()).map((ent) => ent.name);
   } catch {
     return explicitRoot;
   }
@@ -13890,6 +14138,38 @@ async function gcPlan(remote, limit, opts = {}) {
     ])].filter((b) => !isProtectedBranch(b)),
     limit
   );
+  const primaryRoot = await primaryCheckoutRootOf(gitOut);
+  const owners = primaryRoot ? readWorktreeOwners(primaryRoot) : [];
+  const mergedSet = new Set(mergedIntoBase);
+  const preservedSet = new Set(preserved);
+  const failedLookups = new Set(failures.map((failure) => failure.branch));
+  const openBranches = new Set(prs.filter((pr2) => pr2.state === "OPEN").map((pr2) => pr2.headRefName));
+  const proofWorktrees = worktrees.filter((wt) => !wt.dirty && wt.branch !== current.trim() && !isProtectedBranch(wt.branch) && !preservedSet.has(wt.branch) && !mergedSet.has(wt.branch) && !failedLookups.has(wt.branch) && !openBranches.has(wt.branch));
+  const trainTips = [];
+  if (proofWorktrees.length) {
+    for (const name of ["development", "main", "master"]) {
+      const oid = (await gitOut(["rev-parse", "--verify", `${remote}/${name}`]).catch(() => "")).trim();
+      if (oid) trainTips.push(oid);
+    }
+  }
+  const headByBranch = new Map(heads.map((h) => [h.branch, h.oid]));
+  const exactTreeLanded = [];
+  const exactTreeRefusals = [];
+  for (const wt of proofWorktrees) {
+    const headOid = headByBranch.get(wt.branch);
+    const owner = owners.find((entry) => sameWorktreeMetadataPath(entry.path, wt.path));
+    if (!headOid || !owner || !primaryRoot) continue;
+    const proof = await proveExactTreeDelivery({
+      repoRoot: primaryRoot,
+      branch: wt.branch,
+      workerOid: headOid,
+      creationBaseOid: owner.provenance?.creationBaseOid,
+      recordedWorkerBranch: owner.provenance?.workerBranch,
+      landedTips: trainTips
+    });
+    if (proof.action === "settle") exactTreeLanded.push({ branch: wt.branch, headOid, candidateOid: proof.candidateOid });
+    else exactTreeRefusals.push({ branch: wt.branch, detail: describeExactTreeRefusal(proof) });
+  }
   return buildGcPlan({
     localBranches,
     prLookupFailures: failures,
@@ -13902,6 +14182,8 @@ async function gcPlan(remote, limit, opts = {}) {
     remote,
     preservedBranches: preserved,
     mergedIntoBase,
+    exactTreeLanded,
+    exactTreeRefusals,
     originBranches,
     trainOnly: opts.trainOnly
   });
@@ -13938,6 +14220,11 @@ function semverRelation(a, b) {
 function classifyRow(row) {
   const findings = [];
   const reasons = /* @__PURE__ */ new Set();
+  if (row.onboarding.status === "drift") {
+    findings.push(`canonical onboarding link drift: ${row.onboarding.detail}`);
+  } else if (row.onboarding.status === "unknown") {
+    reasons.add(`canonical onboarding link evidence unknown: ${row.onboarding.detail}`);
+  }
   const releaseRequired = row.track !== "trunk" && !row.classifications.includes("no-deploy-surface");
   const tagIsVersion = Boolean(row.release.version) && row.unknowns.some((u) => u.startsWith(NO_VERSION_LOCK_PREFIX));
   for (const unknown of row.unknowns) {
@@ -14200,10 +14487,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "3.135.0",
-    tag: "v3.135.0",
-    commit: "3d9fbd6f4628",
-    npm: "@mutmutco/cli@3.135.0"
+    version: "3.137.0",
+    tag: "v3.137.0",
+    commit: "48d8161cd121",
+    npm: "@mutmutco/cli@3.137.0"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -14220,14 +14507,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v3.135.0"
+          v3Target: "v3.137.0"
         }
       ],
       rollbackTrigger: "Any red inside the post-cut soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a v3 client refused while the compat window must still admit it (SUPPORTED_MINOR_WINDOW=2, MIN_CLIENT_VERSION 0.0.0 \u2014 D6a), or npm consumer install/doctor failure on the v4 dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 3.135.0 and redeploy the Hub Lambda from tag v3.135.0 (3d9fbd6f4628); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v3.135.0 (@mutmutco/cli@3.135.0, tag commit 3d9fbd6f4628 \u2014 the preserved latest-v3 distribution, D6b)"
+        mechanism: "npm dist-tag latest -> 3.137.0 and redeploy the Hub Lambda from tag v3.137.0 (48d8161cd121); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v3.137.0 (@mutmutco/cli@3.137.0, tag commit 48d8161cd121 \u2014 the preserved latest-v3 distribution, D6b)"
       }
     },
     {
@@ -15435,6 +15722,7 @@ function registerQueryCommands(program3) {
 
 // src/fleet-track-inventory.ts
 var NO_DEPLOY_SURFACE_MODELS = /* @__PURE__ */ new Set(["none", "content"]);
+var CANONICAL_ONBOARDING_URL = "https://github.com/mutmutco/MMI-Hub/blob/main/docs/Architecture/agentic-dev-environment.md";
 function ghErrorText(e) {
   const err = e;
   return String(err?.stderr || err?.message || e).trim().replace(/\s+/g, " ");
@@ -15465,6 +15753,23 @@ async function readFleetPluginProbe(deps, repo, branch) {
     return isGhNotFound2(e) ? { repo, state: "absent" } : { repo, state: "unknown", unknown: `plugin surface read failed: ${ghErrorText(e)}` };
   }
 }
+async function readFleetOnboardingProbe(deps, repo, branch) {
+  const [owner, name] = repo.split("/");
+  const ref = branch ? `?ref=${encodeURIComponent(branch)}` : "";
+  try {
+    const raw = await deps.ghJson([
+      "api",
+      `repos/${encodeURIComponent(owner ?? "")}/${encodeURIComponent(name ?? "")}/contents/README.md${ref}`
+    ]);
+    if (raw.encoding !== "base64" || typeof raw.content !== "string") {
+      return { repo, status: "unknown", detail: "README contents read returned no base64 content" };
+    }
+    const readme = Buffer.from(raw.content.replace(/\s/g, ""), "base64").toString("utf8");
+    return readme.includes(CANONICAL_ONBOARDING_URL) ? { repo, status: "canonical", detail: CANONICAL_ONBOARDING_URL } : { repo, status: "drift", detail: `README.md does not link ${CANONICAL_ONBOARDING_URL}` };
+  } catch (e) {
+    return isGhNotFound2(e) ? { repo, status: "drift", detail: `README.md is absent; expected ${CANONICAL_ONBOARDING_URL}` } : { repo, status: "unknown", detail: `onboarding README read failed: ${ghErrorText(e)}` };
+  }
+}
 async function mapBounded2(values, limit, read) {
   const results = new Array(values.length);
   let next = 0;
@@ -15495,9 +15800,10 @@ function classificationsOf(surfaces) {
   if (surfaces.deploy === "absent") classes.push("no-deploy-surface");
   return classes;
 }
-function buildFleetTrackInventory(projects, releaseProbes, pluginProbes, generatedAt) {
+function buildFleetTrackInventory(projects, releaseProbes, pluginProbes, generatedAt, onboardingProbes = []) {
   const releaseByRepo = new Map(releaseProbes.map((p) => [p.repo.toLowerCase(), p]));
   const pluginByRepo = new Map(pluginProbes.map((p) => [p.repo.toLowerCase(), p]));
+  const onboardingByRepo = new Map(onboardingProbes.map((p) => [p.repo.toLowerCase(), p]));
   const projectByRepo = /* @__PURE__ */ new Map();
   const anomalies = [];
   for (const project2 of projects) {
@@ -15519,11 +15825,13 @@ function buildFleetTrackInventory(projects, releaseProbes, pluginProbes, generat
     const project2 = projectByRepo.get(repo.toLowerCase());
     const release = releaseByRepo.get(repo.toLowerCase());
     const plugin = pluginByRepo.get(repo.toLowerCase());
+    const onboarding = onboardingByRepo.get(repo.toLowerCase()) ?? { repo, status: "unknown", detail: "onboarding README was not probed" };
     const surfaces = classifySurfaces(project2, plugin);
     const unknowns = [...release?.unknowns ?? []];
     if (!release) unknowns.push("GitHub release evidence was not collected");
     if (plugin?.unknown) unknowns.push(plugin.unknown);
     if (!plugin) unknowns.push("plugin surface was not probed");
+    if (onboarding.status === "unknown") unknowns.push(onboarding.detail);
     return {
       repo,
       slug: String(project2?.slug ?? repo.split("/")[1] ?? repo).toLowerCase(),
@@ -15535,6 +15843,7 @@ function buildFleetTrackInventory(projects, releaseProbes, pluginProbes, generat
       surfaces,
       classifications: classificationsOf(surfaces),
       pluginVersion: plugin?.version ?? null,
+      onboarding,
       release: {
         tag: release?.releaseTag ?? null,
         version: release?.releasedVersion ?? null,
@@ -15547,7 +15856,7 @@ function buildFleetTrackInventory(projects, releaseProbes, pluginProbes, generat
         requiredChecks: Array.isArray(project2?.requiredChecks) ? project2.requiredChecks : null,
         exemptReason: typeof project2?.ciExemptReason === "string" ? project2.ciExemptReason : null
       },
-      source: { registry: "hub-registry-live", release: "github-releases-live", plugin: "github-contents-live" },
+      source: { registry: "hub-registry-live", release: "github-releases-live", plugin: "github-contents-live", onboarding: "github-readme-live" },
       freshness: { readAt: generatedAt, releasedAt: release?.releasedAt ?? null },
       unknowns
     };
@@ -15560,6 +15869,7 @@ function buildFleetTrackInventory(projects, releaseProbes, pluginProbes, generat
       roster: "hub-registry-live",
       releases: "github-releases-live",
       plugin: "github-contents-live",
+      onboarding: "github-readme-live",
       committedInventory: "never"
     },
     counts: {
@@ -15570,6 +15880,7 @@ function buildFleetTrackInventory(projects, releaseProbes, pluginProbes, generat
       noVault: repos.filter((r) => r.classifications.includes("no-vault")).length,
       noPlugin: repos.filter((r) => r.classifications.includes("no-plugin")).length,
       noDeploySurface: repos.filter((r) => r.classifications.includes("no-deploy-surface")).length,
+      onboardingDrift: repos.filter((r) => r.onboarding.status === "drift").length,
       unknownRows: repos.filter((r) => r.unknowns.length > 0).length,
       anomalies: anomalies.length
     },
@@ -15601,11 +15912,12 @@ async function readFleetTrackInventory(deps = defaultFleetTrackInventoryDeps())
       }
     }
   }
-  const [releaseProbes, pluginProbes] = await Promise.all([
+  const [releaseProbes, pluginProbes, onboardingProbes] = await Promise.all([
     mapBounded2(repos, 6, (repo) => readOrgVersionProbe(deps.query, repo)),
-    mapBounded2(repos, 6, (repo) => readFleetPluginProbe(deps.query, repo, branchByRepo.get(repo.toLowerCase())))
+    mapBounded2(repos, 6, (repo) => readFleetPluginProbe(deps.query, repo, branchByRepo.get(repo.toLowerCase()))),
+    mapBounded2(repos, 6, (repo) => readFleetOnboardingProbe(deps.query, repo, branchByRepo.get(repo.toLowerCase())))
   ]);
-  return buildFleetTrackInventory(projects, releaseProbes, pluginProbes, deps.now().toISOString());
+  return buildFleetTrackInventory(projects, releaseProbes, pluginProbes, deps.now().toISOString(), onboardingProbes);
 }
 function formatFleetTrackInventory(report) {
   const { counts } = report;
@@ -15613,13 +15925,13 @@ function formatFleetTrackInventory(report) {
     `fleet version-track inventory \u2014 ${counts.registeredRepos} registered repositories (${counts.projects} registry projects)`,
     `source: live Hub registry + live GitHub releases/contents \xB7 read ${report.generatedAt} \xB7 committed inventory: never`,
     `tracks: ${counts.tracks.full} full \xB7 ${counts.tracks.direct} direct \xB7 ${counts.tracks.trunk} trunk`,
-    `classified: ${counts.noBoard} no-board \xB7 ${counts.noVault} no-vault \xB7 ${counts.noPlugin} no-plugin \xB7 ${counts.noDeploySurface} no-deploy-surface \xB7 ${counts.unknownRows} rows with unknowns`,
+    `classified: ${counts.noBoard} no-board \xB7 ${counts.noVault} no-vault \xB7 ${counts.noPlugin} no-plugin \xB7 ${counts.noDeploySurface} no-deploy-surface \xB7 ${counts.onboardingDrift} onboarding-link drift \xB7 ${counts.unknownRows} rows with unknowns`,
     "",
-    "repository | track | deploy model | released | plugin | classifications"
+    "repository | track | deploy model | released | plugin | onboarding | classifications"
   ];
   for (const row of report.repos) {
     lines.push(
-      `${row.repo} | ${row.track}${row.declaredTrack ? "" : " (derived)"} | ${row.deployModel ?? "UNDECLARED"} | ${row.release.version ?? "UNKNOWN"} | ${row.pluginVersion ?? (row.surfaces.plugin === "present" ? "present" : row.surfaces.plugin)} | ${row.classifications.join(", ") || "none"}`
+      `${row.repo} | ${row.track}${row.declaredTrack ? "" : " (derived)"} | ${row.deployModel ?? "UNDECLARED"} | ${row.release.version ?? "UNKNOWN"} | ${row.pluginVersion ?? (row.surfaces.plugin === "present" ? "present" : row.surfaces.plugin)} | ${row.onboarding.status} | ${row.classifications.join(", ") || "none"}`
     );
     for (const unknown of row.unknowns) lines.push(`  ? ${unknown}`);
   }
@@ -15634,7 +15946,7 @@ function formatFleetTrackInventory(report) {
 function registerFleetTrackInventory(program3) {
   const train = program3.commands.find((c) => c.name() === "train");
   if (!train) throw new Error("train inventory registration requires the train command group");
-  train.command("inventory").description("live fleet version-track inventory (#4451) \u2014 every registered repo's track, deploy model, CI contract, release evidence, and explicit no-board/no-vault/no-plugin/no-deploy-surface classification").option("--json", "machine-readable output (the typed D2b input shape)").action(async (o) => {
+  train.command("inventory").description("live fleet version-track inventory (#4451) \u2014 every registered repo's track, release evidence, surface classification, and canonical Hub onboarding-link evidence").option("--json", "machine-readable output (the typed D2b input shape)").action(async (o) => {
     try {
       const report = await readFleetTrackInventory();
       console.log(o.json ? JSON.stringify(report, null, 2) : formatFleetTrackInventory(report));
@@ -16311,7 +16623,7 @@ function planTrainApplyRepoGuard(applyRepo, cwdRepo, rerun) {
 async function resolveFoldPaths(deps, model) {
   const helper = "scripts/release-distribution.mjs";
   if (model === "hub-serverless" || model === "registry-publish") {
-    if ((0, import_node_fs22.existsSync)(helper)) {
+    if ((0, import_node_fs23.existsSync)(helper)) {
       let out;
       try {
         out = await deps.run("node", [helper, "changed-files"]);
@@ -16430,7 +16742,7 @@ async function restoreMainNpmPackIdentities(deps, version) {
   if (mainBom.version !== version) return void 0;
   let localBom;
   try {
-    localBom = JSON.parse((0, import_node_fs22.readFileSync)(bomPath, "utf8"));
+    localBom = JSON.parse((0, import_node_fs23.readFileSync)(bomPath, "utf8"));
   } catch (e) {
     throw new Error(
       `version fold refused: ${bomPath} written by this fold's prepare is unreadable (${describeReadError(e)}) \u2014 cannot restore the published ${version} npm-pack identities from origin/main (#4503/#4713).`
@@ -16448,14 +16760,14 @@ async function restoreMainNpmPackIdentities(deps, version) {
     restored += 1;
   }
   if (restored === 0) return void 0;
-  (0, import_node_fs22.writeFileSync)(bomPath, `${JSON.stringify(localBom, null, 2)}
+  (0, import_node_fs23.writeFileSync)(bomPath, `${JSON.stringify(localBom, null, 2)}
 `);
   return `restored ${restored} npm-pack BOM identit${restored === 1 ? "y" : "ies"} from origin/main (#4503)`;
 }
 function publishVisibilityFor(surfaceId) {
   let raw;
   try {
-    raw = (0, import_node_fs22.readFileSync)("surfaces.json", "utf8");
+    raw = (0, import_node_fs23.readFileSync)("surfaces.json", "utf8");
   } catch (e) {
     if (e.code === "ENOENT") return "unknown";
     throw trainReadFailure(
@@ -16476,7 +16788,7 @@ function publishVisibilityFor(surfaceId) {
 }
 function npmPackArtifactName(packagePath) {
   try {
-    const pkg = JSON.parse((0, import_node_fs22.readFileSync)((0, import_node_path22.join)(packagePath, "package.json"), "utf8"));
+    const pkg = JSON.parse((0, import_node_fs23.readFileSync)((0, import_node_path23.join)(packagePath, "package.json"), "utf8"));
     return pkg.name || void 0;
   } catch {
     return void 0;
@@ -16485,7 +16797,7 @@ function npmPackArtifactName(packagePath) {
 async function refuseDivergentPublishedNpmPack(deps, version) {
   let localBom;
   try {
-    localBom = JSON.parse((0, import_node_fs22.readFileSync)("distribution-bom.json", "utf8"));
+    localBom = JSON.parse((0, import_node_fs23.readFileSync)("distribution-bom.json", "utf8"));
   } catch (e) {
     throw new Error(
       `version fold refused: distribution-bom.json written by this fold's prepare is unreadable (${e instanceof Error ? e.message.split("\n")[0] : String(e)}) \u2014 cannot compare the same-PATCH ${version} npm-pack identities against published npm (#4503/#4662).`
@@ -17647,17 +17959,17 @@ async function dispatchDeploy(deps, ctx, stage, ref, model, watch, autoRunSince,
   return { note: `no manual dispatch: ${model} repo deploys via its own push-triggered workflow`, deployStatus: "pending" };
 }
 function readLocalGateWorkflows() {
-  const dir = (0, import_node_path22.join)(".github", "workflows");
+  const dir = (0, import_node_path23.join)(".github", "workflows");
   let names;
   try {
-    names = (0, import_node_fs22.readdirSync)(dir);
+    names = (0, import_node_fs23.readdirSync)(dir);
   } catch {
     return null;
   }
   const files = [];
   for (const name of names.filter(isGateWorkflowPath)) {
     try {
-      files.push({ path: `${dir}/${name}`.replace(/\\/g, "/"), body: (0, import_node_fs22.readFileSync)((0, import_node_path22.join)(dir, name), "utf8") });
+      files.push({ path: `${dir}/${name}`.replace(/\\/g, "/"), body: (0, import_node_fs23.readFileSync)((0, import_node_path23.join)(dir, name), "utf8") });
     } catch {
     }
   }
@@ -19875,17 +20187,17 @@ async function runPrLand(prNumber, options, deps) {
 }
 
 // src/wave-status.ts
-var import_node_fs24 = require("node:fs");
+var import_node_fs25 = require("node:fs");
 
 // src/stage-runner.ts
 var import_node_child_process8 = require("node:child_process");
-var import_node_fs23 = require("node:fs");
-var import_node_path23 = require("node:path");
+var import_node_fs24 = require("node:fs");
+var import_node_path24 = require("node:path");
 var import_node_net = require("node:net");
 var import_node_util5 = require("node:util");
 
 // src/rules-sync.ts
-function normalizeEol(s) {
+function normalizeEol2(s) {
   return s.replace(/\r\n/g, "\n");
 }
 
@@ -19938,8 +20250,8 @@ function envFileKeys(content) {
   return keys;
 }
 function detectStaleEnvFile(exampleContent, targetContent, mtimes) {
-  const example = normalizeEol(exampleContent);
-  const target = normalizeEol(targetContent);
+  const example = normalizeEol2(exampleContent);
+  const target = normalizeEol2(targetContent);
   const exampleKeys = envFileKeys(example);
   const targetKeys = envFileKeys(target);
   for (const key of exampleKeys) {
@@ -20019,11 +20331,11 @@ function appendForceRecreate(up) {
   return `${up.trimEnd()} --force-recreate`;
 }
 function stageStatePath(cwd = process.cwd()) {
-  return (0, import_node_path23.join)(cwd, "tmp", "stage", "state.json");
+  return (0, import_node_path24.join)(cwd, "tmp", "stage", "state.json");
 }
 function stageGlobalStatePath(cwd = process.cwd(), gitCommonDir = ".git") {
-  const dir = (0, import_node_path23.isAbsolute)(gitCommonDir) ? gitCommonDir : (0, import_node_path23.resolve)(cwd, gitCommonDir);
-  return (0, import_node_path23.join)(dir, "mmi", "stage", "state.json");
+  const dir = (0, import_node_path24.isAbsolute)(gitCommonDir) ? gitCommonDir : (0, import_node_path24.resolve)(cwd, gitCommonDir);
+  return (0, import_node_path24.join)(dir, "mmi", "stage", "state.json");
 }
 function normPath3(path2) {
   return path2.replace(/\\/g, "/").replace(/\/+$/, "").toLowerCase();
@@ -20247,14 +20559,14 @@ function stageProcessEnv(stagePort, extraEnv) {
 }
 async function ensureStageRuntimeEnv(config, opts, cwd) {
   if (!config.ensureEnv) return;
-  const target = (0, import_node_path23.join)(cwd, config.ensureEnv.target);
-  const example = (0, import_node_path23.join)(cwd, config.ensureEnv.example);
-  if (!(0, import_node_fs23.existsSync)(target) && (0, import_node_fs23.existsSync)(example)) {
-    (0, import_node_fs23.copyFileSync)(example, target);
-  } else if ((0, import_node_fs23.existsSync)(target) && (0, import_node_fs23.existsSync)(example)) {
-    const stale = detectStaleEnvFile((0, import_node_fs23.readFileSync)(example, "utf8"), (0, import_node_fs23.readFileSync)(target, "utf8"), {
-      exampleMtimeMs: (0, import_node_fs23.statSync)(example).mtimeMs,
-      targetMtimeMs: (0, import_node_fs23.statSync)(target).mtimeMs
+  const target = (0, import_node_path24.join)(cwd, config.ensureEnv.target);
+  const example = (0, import_node_path24.join)(cwd, config.ensureEnv.example);
+  if (!(0, import_node_fs24.existsSync)(target) && (0, import_node_fs24.existsSync)(example)) {
+    (0, import_node_fs24.copyFileSync)(example, target);
+  } else if ((0, import_node_fs24.existsSync)(target) && (0, import_node_fs24.existsSync)(example)) {
+    const stale = detectStaleEnvFile((0, import_node_fs24.readFileSync)(example, "utf8"), (0, import_node_fs24.readFileSync)(target, "utf8"), {
+      exampleMtimeMs: (0, import_node_fs24.statSync)(example).mtimeMs,
+      targetMtimeMs: (0, import_node_fs24.statSync)(target).mtimeMs
     });
     if (stale) {
       const msg = `stale ${config.ensureEnv.target} (${stale}) \u2014 delete it or refresh from ${config.ensureEnv.example} before re-running /stage`;
@@ -20262,8 +20574,8 @@ async function ensureStageRuntimeEnv(config, opts, cwd) {
       console.error(`mmi-cli stage: ${msg} (allowed via --allow-stale-env)`);
     }
   }
-  if (opts.vaultEnvMerge && Object.keys(opts.vaultEnvMerge).length && (0, import_node_fs23.existsSync)(target)) {
-    (0, import_node_fs23.writeFileSync)(target, mergeEnvSecretsIntoFile((0, import_node_fs23.readFileSync)(target, "utf8"), opts.vaultEnvMerge), "utf8");
+  if (opts.vaultEnvMerge && Object.keys(opts.vaultEnvMerge).length && (0, import_node_fs24.existsSync)(target)) {
+    (0, import_node_fs24.writeFileSync)(target, mergeEnvSecretsIntoFile((0, import_node_fs24.readFileSync)(target, "utf8"), opts.vaultEnvMerge), "utf8");
   }
 }
 async function gitText(cwd, args) {
@@ -20293,20 +20605,20 @@ async function resolveGlobalStatePath(cwd, explicit) {
   return void 0;
 }
 function readState(path2) {
-  if (!(0, import_node_fs23.existsSync)(path2)) return null;
+  if (!(0, import_node_fs24.existsSync)(path2)) return null;
   try {
-    return JSON.parse((0, import_node_fs23.readFileSync)(path2, "utf8"));
+    return JSON.parse((0, import_node_fs24.readFileSync)(path2, "utf8"));
   } catch {
     return null;
   }
 }
 function mkdirFor(path2) {
   const dir = path2.slice(0, Math.max(path2.lastIndexOf("/"), path2.lastIndexOf("\\")));
-  (0, import_node_fs23.mkdirSync)(dir, { recursive: true });
+  (0, import_node_fs24.mkdirSync)(dir, { recursive: true });
 }
 function writeState(path2, state) {
   mkdirFor(path2);
-  (0, import_node_fs23.writeFileSync)(path2, JSON.stringify(state, null, 2), "utf8");
+  (0, import_node_fs24.writeFileSync)(path2, JSON.stringify(state, null, 2), "utf8");
 }
 function writeStagePortReservation(port, cwd, statePath, globalStatePath, now) {
   const reservation = {
@@ -20326,7 +20638,7 @@ async function cleanupStageState(state, paths, timeoutMs, fallbackCwd) {
     await shell(state.teardown.command.trim(), state.teardown.cwd || state.cwd || fallbackCwd, Math.max(timeoutMs, 1e4));
   }
   for (const path2 of [...new Set(paths.filter((p) => Boolean(p)))]) {
-    (0, import_node_fs23.rmSync)(path2, { force: true });
+    (0, import_node_fs24.rmSync)(path2, { force: true });
   }
 }
 async function killTree(pid) {
@@ -20484,8 +20796,8 @@ async function runStage(config = {}, opts = {}) {
     await ensureStageRuntimeEnv(config, opts, cwd);
     if (build) await shell(sub(build), cwd, timeoutMs, stageProcessEnv(stagePort, extraEnv));
   } catch (e) {
-    (0, import_node_fs23.rmSync)(statePath, { force: true });
-    if (globalStatePath && globalStatePath !== statePath) (0, import_node_fs23.rmSync)(globalStatePath, { force: true });
+    (0, import_node_fs24.rmSync)(statePath, { force: true });
+    if (globalStatePath && globalStatePath !== statePath) (0, import_node_fs24.rmSync)(globalStatePath, { force: true });
     throw e;
   }
   const started = await startStage(config, {
@@ -20506,9 +20818,9 @@ function parseNextFromHead(headText) {
 }
 function readStageSummary(worktreePath) {
   const statePath = stageStatePath(worktreePath);
-  if (!(0, import_node_fs24.existsSync)(statePath)) return void 0;
+  if (!(0, import_node_fs25.existsSync)(statePath)) return void 0;
   try {
-    const state = JSON.parse((0, import_node_fs24.readFileSync)(statePath, "utf8"));
+    const state = JSON.parse((0, import_node_fs25.readFileSync)(statePath, "utf8"));
     const port = typeof state.port === "number" ? state.port : void 0;
     if (port == null || !Number.isInteger(port) || port <= 0) return void 0;
     return { port, url: typeof state.url === "string" ? state.url : void 0 };
@@ -20613,13 +20925,13 @@ async function executeWaveLand(plan, deps, opts = { preserveWorktree: true }) {
 }
 
 // src/index.ts
-var import_node_os20 = require("node:os");
+var import_node_os21 = require("node:os");
 
 // src/board.ts
 var import_node_child_process9 = require("node:child_process");
-var import_node_fs25 = require("node:fs");
-var import_node_os9 = require("node:os");
-var import_node_path24 = require("node:path");
+var import_node_fs26 = require("node:fs");
+var import_node_os10 = require("node:os");
+var import_node_path25 = require("node:path");
 var import_node_util6 = require("node:util");
 
 // src/board-dependency.ts
@@ -22229,7 +22541,7 @@ var CLAIM_SESSION_ACTIVITY_MS = 30 * 6e4;
 var CLAIM_SESSION_PROBE_CACHE_MS = 6e4;
 var claimSessionProbeCache = /* @__PURE__ */ new Map();
 function probeLocalClaimSession(marker, now = Date.now()) {
-  if (!marker.session || !marker.host || marker.host.toLowerCase() !== (0, import_node_os9.hostname)().toLowerCase()) return void 0;
+  if (!marker.session || !marker.host || marker.host.toLowerCase() !== (0, import_node_os10.hostname)().toLowerCase()) return void 0;
   if (!marker.surface?.toLowerCase().startsWith("claude")) return void 0;
   const cacheKey = `${marker.host.toLowerCase()}/${marker.session}`;
   const cached = claimSessionProbeCache.get(cacheKey);
@@ -22238,17 +22550,17 @@ function probeLocalClaimSession(marker, now = Date.now()) {
     claimSessionProbeCache.set(cacheKey, { checkedAt: now, state });
     return state;
   };
-  const root = (0, import_node_path24.join)((0, import_node_os9.homedir)(), ".claude", "projects");
+  const root = (0, import_node_path25.join)((0, import_node_os10.homedir)(), ".claude", "projects");
   try {
     const wanted = `${marker.session}.jsonl`.toLowerCase();
     const pending = [root];
     while (pending.length) {
       const dir = pending.pop();
-      for (const entry of (0, import_node_fs25.readdirSync)(dir, { withFileTypes: true })) {
-        const path2 = (0, import_node_path24.join)(dir, entry.name);
+      for (const entry of (0, import_node_fs26.readdirSync)(dir, { withFileTypes: true })) {
+        const path2 = (0, import_node_path25.join)(dir, entry.name);
         if (entry.isDirectory()) pending.push(path2);
         else if (entry.isFile() && entry.name.toLowerCase() === wanted) {
-          return remember(now - (0, import_node_fs25.statSync)(path2).mtimeMs <= CLAIM_SESSION_ACTIVITY_MS ? "live" : "dead");
+          return remember(now - (0, import_node_fs26.statSync)(path2).mtimeMs <= CLAIM_SESSION_ACTIVITY_MS ? "live" : "dead");
         }
       }
     }
@@ -22536,7 +22848,7 @@ async function resolveAutoAddBoardAttach(client, cfg, selector, priority, warn =
 }
 
 // src/issue-body.ts
-var import_node_os10 = require("node:os");
+var import_node_os11 = require("node:os");
 var TextArgError = class extends Error {
   constructor(message, code, offendingFlag) {
     super(message);
@@ -22548,7 +22860,7 @@ var TextArgError = class extends Error {
   offendingFlag;
 };
 function emptyStdinMessage(fileFlag) {
-  if ((0, import_node_os10.platform)() === "win32") {
+  if ((0, import_node_os11.platform)() === "win32") {
     return `${fileFlag} - read empty stdin (on Windows, ${fileFlag} - is unreliable through the npm .cmd shim \u2014 use ${fileFlag} <path>, or pipe to \`node cli/dist/index.cjs\` directly)`;
   }
   return `${fileFlag} - read empty stdin (nothing piped \u2014 pass a heredoc/pipe, or ${fileFlag} <path>)`;
@@ -22785,6 +23097,13 @@ function applyCommandTaxonomy(program3) {
   }
   program3.configureHelp({
     ...REQUIRED_OPTION_HELP,
+    // #5014: the root help must show the CANONICAL house-prefixed term (`oracle board`, `devops pr`),
+    // not the retired flat leaf name — an agent grounding on `mmi-cli help` and running the flat name
+    // hits the Wave 3 refusal. `canonicalPathFor` is the identity for `core`, so core stays unprefixed.
+    subcommandTerm(command) {
+      const stock = Help.prototype.subcommandTerm.call(this, command);
+      return `${canonicalPathFor(command.name()) ?? command.name()}${stock.slice(command.name().length)}`;
+    },
     visibleCommands(command) {
       const visible = command.commands.filter((child2) => !child2._hidden);
       const helpCommand = command._getHelpCommand();
@@ -23149,20 +23468,20 @@ function consolidateCommandNamespaces(program3) {
 }
 
 // src/claude-binary-doctor.ts
+var import_node_fs28 = require("node:fs");
+var import_node_os13 = require("node:os");
+var import_node_path27 = require("node:path");
+
+// src/jerv-cli-spawn.ts
 var import_node_fs27 = require("node:fs");
 var import_node_os12 = require("node:os");
 var import_node_path26 = require("node:path");
-
-// src/jerv-cli-spawn.ts
-var import_node_fs26 = require("node:fs");
-var import_node_os11 = require("node:os");
-var import_node_path25 = require("node:path");
 var WIN_NAMES = ["jerv-cli.cmd", "jerv-cli.exe", "jerv-cli"];
 var POSIX_NAMES = ["jerv-cli"];
-var JERV_CLI_ENTRY = (0, import_node_path25.join)("node_modules", "@jervaise", "jerv-cli", "dist", "index.cjs");
+var JERV_CLI_ENTRY = (0, import_node_path26.join)("node_modules", "@jervaise", "jerv-cli", "dist", "index.cjs");
 function pathEnvEntries(pathEnv, platform2 = process.platform) {
   if (platform2 !== "win32") {
-    return pathEnv.split(import_node_path25.delimiter).map((e) => e.trim()).filter(Boolean);
+    return pathEnv.split(import_node_path26.delimiter).map((e) => e.trim()).filter(Boolean);
   }
   if (pathEnv.includes(";")) {
     return pathEnv.split(";").map((e) => e.trim()).filter(Boolean);
@@ -23181,7 +23500,7 @@ function normalizeSpawnPathEntry(entry, platform2 = process.platform) {
   if (msys) return `${msys[1].toUpperCase()}:\\${msys[2].replace(/\//g, "\\")}`;
   return trimmed;
 }
-function jervCliCandidateDirs(env = process.env, home = (0, import_node_os11.homedir)(), platform2 = process.platform) {
+function jervCliCandidateDirs(env = process.env, home = (0, import_node_os12.homedir)(), platform2 = process.platform) {
   const seen = /* @__PURE__ */ new Set();
   const out = [];
   const push = (dir) => {
@@ -23195,35 +23514,35 @@ function jervCliCandidateDirs(env = process.env, home = (0, import_node_os11.hom
     push(normalizeSpawnPathEntry(entry, platform2));
   }
   if (platform2 === "win32") {
-    if (env.APPDATA) push((0, import_node_path25.join)(env.APPDATA, "npm"));
-    if (env.LOCALAPPDATA) push((0, import_node_path25.join)(env.LOCALAPPDATA, "npm"));
+    if (env.APPDATA) push((0, import_node_path26.join)(env.APPDATA, "npm"));
+    if (env.LOCALAPPDATA) push((0, import_node_path26.join)(env.LOCALAPPDATA, "npm"));
   } else {
-    push((0, import_node_path25.join)(home, ".local", "bin"));
+    push((0, import_node_path26.join)(home, ".local", "bin"));
   }
   return out;
 }
-function jervCliCandidatePaths(env = process.env, home = (0, import_node_os11.homedir)(), platform2 = process.platform) {
+function jervCliCandidatePaths(env = process.env, home = (0, import_node_os12.homedir)(), platform2 = process.platform) {
   const names = platform2 === "win32" ? WIN_NAMES : POSIX_NAMES;
   const out = [];
   for (const dir of jervCliCandidateDirs(env, home, platform2)) {
-    for (const name of names) out.push((0, import_node_path25.join)(dir, name));
+    for (const name of names) out.push((0, import_node_path26.join)(dir, name));
   }
   return out;
 }
-function resolveJervCliPath(env = process.env, home = (0, import_node_os11.homedir)(), platform2 = process.platform, exists = import_node_fs26.existsSync) {
+function resolveJervCliPath(env = process.env, home = (0, import_node_os12.homedir)(), platform2 = process.platform, exists = import_node_fs27.existsSync) {
   for (const candidate of jervCliCandidatePaths(env, home, platform2)) {
     if (exists(candidate)) return candidate;
   }
   return void 0;
 }
-function resolveJervCliNodeEntry(shimPath, exists = import_node_fs26.existsSync) {
-  const entry = (0, import_node_path25.join)((0, import_node_path25.dirname)(shimPath), JERV_CLI_ENTRY);
+function resolveJervCliNodeEntry(shimPath, exists = import_node_fs27.existsSync) {
+  const entry = (0, import_node_path26.join)((0, import_node_path26.dirname)(shimPath), JERV_CLI_ENTRY);
   return exists(entry) ? entry : void 0;
 }
 function jervCliExecFileArgs(args, opts = {}) {
   const platform2 = opts.platform ?? process.platform;
-  const exists = opts.exists ?? import_node_fs26.existsSync;
-  const resolved = resolveJervCliPath(opts.env ?? process.env, opts.home ?? (0, import_node_os11.homedir)(), platform2, exists);
+  const exists = opts.exists ?? import_node_fs27.existsSync;
+  const resolved = resolveJervCliPath(opts.env ?? process.env, opts.home ?? (0, import_node_os12.homedir)(), platform2, exists);
   if (resolved) {
     const entry = resolveJervCliNodeEntry(resolved, exists);
     if (entry) {
@@ -23312,26 +23631,26 @@ function globalNodeModulesRoots(host) {
     out.push(dir);
   };
   const prefix = env.npm_config_prefix?.trim();
-  if (prefix) push(platform2 === "win32" ? (0, import_node_path26.join)(prefix, "node_modules") : (0, import_node_path26.join)(prefix, "lib", "node_modules"));
-  for (const dir of jervCliCandidateDirs(env, host.home ?? (0, import_node_os12.homedir)(), platform2)) {
-    push((0, import_node_path26.join)(dir, "node_modules"));
-    push((0, import_node_path26.join)((0, import_node_path26.dirname)(dir), "lib", "node_modules"));
+  if (prefix) push(platform2 === "win32" ? (0, import_node_path27.join)(prefix, "node_modules") : (0, import_node_path27.join)(prefix, "lib", "node_modules"));
+  for (const dir of jervCliCandidateDirs(env, host.home ?? (0, import_node_os13.homedir)(), platform2)) {
+    push((0, import_node_path27.join)(dir, "node_modules"));
+    push((0, import_node_path27.join)((0, import_node_path27.dirname)(dir), "lib", "node_modules"));
   }
   return out;
 }
 function readHead(path2) {
   let fd;
   try {
-    fd = (0, import_node_fs27.openSync)(path2, "r");
+    fd = (0, import_node_fs28.openSync)(path2, "r");
     const buffer = new Uint8Array(MAGIC_HEAD_BYTES);
-    const read = (0, import_node_fs27.readSync)(fd, buffer, 0, MAGIC_HEAD_BYTES, 0);
+    const read = (0, import_node_fs28.readSync)(fd, buffer, 0, MAGIC_HEAD_BYTES, 0);
     return buffer.subarray(0, read);
   } catch {
     return void 0;
   } finally {
     if (fd !== void 0) {
       try {
-        (0, import_node_fs27.closeSync)(fd);
+        (0, import_node_fs28.closeSync)(fd);
       } catch {
       }
     }
@@ -23339,7 +23658,7 @@ function readHead(path2) {
 }
 function fileBytes(path2) {
   try {
-    return (0, import_node_fs27.statSync)(path2).size;
+    return (0, import_node_fs28.statSync)(path2).size;
   } catch {
     return void 0;
   }
@@ -23353,17 +23672,17 @@ function readClaudeBinaryState(host = {}) {
   const arch = host.arch ?? process.arch;
   const magic = EXECUTABLE_MAGIC[platform2];
   if (!magic) return void 0;
-  const packageRoot = globalNodeModulesRoots(host).map((root) => (0, import_node_path26.join)(root, ...PACKAGE.split("/"))).find((dir) => (0, import_node_fs27.existsSync)((0, import_node_path26.join)(dir, "package.json")));
+  const packageRoot = globalNodeModulesRoots(host).map((root) => (0, import_node_path27.join)(root, ...PACKAGE.split("/"))).find((dir) => (0, import_node_fs28.existsSync)((0, import_node_path27.join)(dir, "package.json")));
   if (!packageRoot) return void 0;
   const keys = platformPackageKeys(platform2, arch);
   const fallbackPackage = `${PACKAGE}-${keys[0]}`;
   let manifest;
   try {
-    manifest = JSON.parse((0, import_node_fs27.readFileSync)((0, import_node_path26.join)(packageRoot, "package.json"), "utf8"));
+    manifest = JSON.parse((0, import_node_fs28.readFileSync)((0, import_node_path27.join)(packageRoot, "package.json"), "utf8"));
   } catch (e) {
     return {
       state: "unreadable",
-      binPath: (0, import_node_path26.join)(packageRoot, "package.json"),
+      binPath: (0, import_node_path27.join)(packageRoot, "package.json"),
       expectedMagic: magic.name,
       platformPackage: fallbackPackage,
       error: `package.json could not be read \u2014 ${e.message}`
@@ -23380,17 +23699,17 @@ function readClaudeBinaryState(host = {}) {
       error: "package.json declares no `bin` entry \u2014 the executed file cannot be resolved"
     };
   }
-  const binPath = (0, import_node_path26.join)(packageRoot, binRelative);
-  const binName = (0, import_node_path26.basename)(binRelative);
+  const binPath = (0, import_node_path27.join)(packageRoot, binRelative);
+  const binName = (0, import_node_path27.basename)(binRelative);
   const optional = manifest.optionalDependencies;
   const publishes = (name) => typeof optional === "object" && optional !== null && Object.prototype.hasOwnProperty.call(optional, name);
   const published = keys.map((key) => `${PACKAGE}-${key}`).filter(publishes);
   if (published.length === 0) return void 0;
   const binIn = (name) => [
-    (0, import_node_path26.join)(packageRoot, "node_modules", ...name.split("/"), binName),
-    (0, import_node_path26.join)((0, import_node_path26.dirname)((0, import_node_path26.dirname)(packageRoot)), ...name.split("/"), binName)
+    (0, import_node_path27.join)(packageRoot, "node_modules", ...name.split("/"), binName),
+    (0, import_node_path27.join)((0, import_node_path27.dirname)((0, import_node_path27.dirname)(packageRoot)), ...name.split("/"), binName)
   ];
-  const found = published.map((name) => ({ name, path: binIn(name).find((file) => (0, import_node_fs27.existsSync)(file)) })).find((c) => c.path);
+  const found = published.map((name) => ({ name, path: binIn(name).find((file) => (0, import_node_fs28.existsSync)(file)) })).find((c) => c.path);
   const platformPackage = found?.name ?? published[0];
   let source;
   let sourceProblem;
@@ -23401,7 +23720,7 @@ function readClaudeBinaryState(host = {}) {
   } else {
     source = { path: found.path, bytes: fileBytes(found.path) ?? 0 };
   }
-  if (!(0, import_node_fs27.existsSync)(binPath)) {
+  if (!(0, import_node_fs28.existsSync)(binPath)) {
     return { state: "missing", binPath, expectedMagic: magic.name, platformPackage, ...source ? { source } : {}, ...sourceProblem ? { sourceProblem } : {} };
   }
   const head = readHead(binPath);
@@ -23444,9 +23763,9 @@ function healClaudeBinary(host = {}, onStep) {
   const platform2 = host.platform ?? process.platform;
   const aside = `${probe.binPath}.stub-${Date.now()}`;
   let renamed = false;
-  if ((0, import_node_fs27.existsSync)(probe.binPath)) {
+  if ((0, import_node_fs28.existsSync)(probe.binPath)) {
     try {
-      (0, import_node_fs27.renameSync)(probe.binPath, aside);
+      (0, import_node_fs28.renameSync)(probe.binPath, aside);
       renamed = true;
       onStep?.(`renamed the stub aside: ${aside}`);
     } catch (e) {
@@ -23455,12 +23774,12 @@ function healClaudeBinary(host = {}, onStep) {
   }
   try {
     onStep?.(`copying ${probe.source.path} \u2192 ${probe.binPath} (${(probe.source.bytes / 1e6).toFixed(0)} MB)`);
-    (0, import_node_fs27.copyFileSync)(probe.source.path, probe.binPath);
-    if (platform2 !== "win32") (0, import_node_fs27.chmodSync)(probe.binPath, 493);
+    (0, import_node_fs28.copyFileSync)(probe.source.path, probe.binPath);
+    if (platform2 !== "win32") (0, import_node_fs28.chmodSync)(probe.binPath, 493);
   } catch (e) {
     if (renamed) {
       try {
-        (0, import_node_fs27.renameSync)(aside, probe.binPath);
+        (0, import_node_fs28.renameSync)(aside, probe.binPath);
       } catch {
         return { ok: false, detail: `copy failed (${e.message}) and the stub could not be restored \u2014 the original is at ${aside}` };
       }
@@ -23474,7 +23793,7 @@ function healClaudeBinary(host = {}, onStep) {
   let kept = false;
   if (renamed) {
     try {
-      (0, import_node_fs27.rmSync)(aside);
+      (0, import_node_fs28.rmSync)(aside);
     } catch {
       kept = true;
     }
@@ -23952,19 +24271,19 @@ function renderVerifyBroker(input) {
 
 // src/tenant-artifact.ts
 var import_node_crypto4 = require("node:crypto");
-var import_node_fs28 = require("node:fs");
+var import_node_fs29 = require("node:fs");
 var import_promises5 = require("node:fs/promises");
-var import_node_path27 = require("node:path");
+var import_node_path28 = require("node:path");
 var ARTIFACT_ID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
 var MAX_BYTES = 5 * 1024 * 1024 * 1024;
 async function sha256File(path2) {
   const hash = (0, import_node_crypto4.createHash)("sha256");
-  for await (const chunk of (0, import_node_fs28.createReadStream)(path2)) hash.update(chunk);
+  for await (const chunk of (0, import_node_fs29.createReadStream)(path2)) hash.update(chunk);
   return hash.digest("hex");
 }
 async function putTenantArtifact(repo, stage, inputPath, deps) {
   if (!["dev", "rc", "main"].includes(stage)) throw new Error("tenant artifact put: <stage> must be dev, rc, or main");
-  const path2 = (0, import_node_path27.resolve)(inputPath);
+  const path2 = (0, import_node_path28.resolve)(inputPath);
   const info = await (0, import_promises5.stat)(path2);
   if (!info.isFile()) throw new Error("tenant artifact put: input path must be a file");
   if (!Number.isSafeInteger(info.size) || info.size < 1 || info.size > MAX_BYTES) throw new Error(`tenant artifact put: file must be 1..${MAX_BYTES} bytes`);
@@ -23982,7 +24301,7 @@ async function putTenantArtifact(repo, stage, inputPath, deps) {
     return [key, value];
   }));
   headers["content-length"] = String(info.size);
-  const stream = (0, import_node_fs28.createReadStream)(path2);
+  const stream = (0, import_node_fs29.createReadStream)(path2);
   let uploaded;
   try {
     uploaded = await fetch(body.uploadUrl, {
@@ -25100,8 +25419,8 @@ async function announceRelease(deps, args) {
 // src/repo-index.ts
 var import_node_crypto5 = require("node:crypto");
 var import_node_child_process12 = require("node:child_process");
-var import_node_fs29 = require("node:fs");
-var import_node_path28 = require("node:path");
+var import_node_fs30 = require("node:fs");
+var import_node_path29 = require("node:path");
 var REPO_INDEX_SCHEMA = 1;
 var HARD_DENY = [
   /(^|\/)\.env(\.|$)/i,
@@ -25226,11 +25545,11 @@ function loadReadmeHints(cwd, candidatePaths) {
   }
   for (const rel of readmes) {
     if (isHardDeniedPath(rel)) continue;
-    const abs = (0, import_node_path28.join)(cwd, ...rel.split("/"));
-    if (!(0, import_node_fs29.existsSync)(abs)) continue;
+    const abs = (0, import_node_path29.join)(cwd, ...rel.split("/"));
+    if (!(0, import_node_fs30.existsSync)(abs)) continue;
     let text;
     try {
-      text = (0, import_node_fs29.readFileSync)(abs, "utf8");
+      text = (0, import_node_fs30.readFileSync)(abs, "utf8");
     } catch {
       continue;
     }
@@ -25243,7 +25562,7 @@ function loadReadmeHints(cwd, candidatePaths) {
   return hints;
 }
 function toPosix(p) {
-  return p.split(import_node_path28.sep).join("/");
+  return p.split(import_node_path29.sep).join("/");
 }
 function listCandidatePaths(cwd, exec = import_node_child_process12.execFileSync) {
   try {
@@ -25257,7 +25576,7 @@ function listCandidatePaths(cwd, exec = import_node_child_process12.execFileSync
     return [];
   }
 }
-function rebuildRepoIndex(cwd, repoSlug2) {
+function rebuildRepoIndex(cwd, repoSlug3) {
   const candidates = listCandidatePaths(cwd).filter(isIndexablePath);
   const ignored = defaultIsIgnored(cwd, candidates);
   const readmeHints = loadReadmeHints(cwd, candidates.filter((p) => !ignored.has(p)));
@@ -25265,11 +25584,11 @@ function rebuildRepoIndex(cwd, repoSlug2) {
   for (const rel of candidates) {
     if (ignored.has(rel)) continue;
     if (isHardDeniedPath(rel)) continue;
-    const abs = (0, import_node_path28.join)(cwd, ...rel.split("/"));
-    if (!(0, import_node_fs29.existsSync)(abs)) continue;
+    const abs = (0, import_node_path29.join)(cwd, ...rel.split("/"));
+    if (!(0, import_node_fs30.existsSync)(abs)) continue;
     let text;
     try {
-      text = (0, import_node_fs29.readFileSync)(abs, "utf8");
+      text = (0, import_node_fs30.readFileSync)(abs, "utf8");
     } catch {
       continue;
     }
@@ -25289,21 +25608,21 @@ function rebuildRepoIndex(cwd, repoSlug2) {
   entries.sort((a, b) => a.path.localeCompare(b.path));
   const projection = {
     schema: REPO_INDEX_SCHEMA,
-    repo: repoSlug2,
+    repo: repoSlug3,
     builtAt: (/* @__PURE__ */ new Date()).toISOString(),
     entries
   };
   const store = repoIndexStorePath(cwd);
-  (0, import_node_fs29.mkdirSync)((0, import_node_path28.dirname)(store), { recursive: true });
-  (0, import_node_fs29.writeFileSync)(store, `${JSON.stringify(projection, null, 2)}
+  (0, import_node_fs30.mkdirSync)((0, import_node_path29.dirname)(store), { recursive: true });
+  (0, import_node_fs30.writeFileSync)(store, `${JSON.stringify(projection, null, 2)}
 `, "utf8");
   return projection;
 }
 function loadRepoIndex(cwd) {
   const store = repoIndexStorePath(cwd);
-  if (!(0, import_node_fs29.existsSync)(store)) return null;
+  if (!(0, import_node_fs30.existsSync)(store)) return null;
   try {
-    const raw = JSON.parse((0, import_node_fs29.readFileSync)(store, "utf8"));
+    const raw = JSON.parse((0, import_node_fs30.readFileSync)(store, "utf8"));
     if (raw?.schema !== REPO_INDEX_SCHEMA || !Array.isArray(raw.entries)) return null;
     return raw;
   } catch {
@@ -25375,7 +25694,7 @@ function inferRepoSlug(cwd, exec = import_node_child_process12.execFileSync) {
     if (m?.[1]) return m[1].toLowerCase();
   } catch {
   }
-  return ((0, import_node_path28.basename)(cwd) || "local").toLowerCase();
+  return ((0, import_node_path29.basename)(cwd) || "local").toLowerCase();
 }
 
 // src/repo-index-cloud-client.ts
@@ -25515,9 +25834,9 @@ async function gcRepoIndexCloud(deps) {
 }
 
 // src/repo-index-sync.ts
-var import_node_fs30 = require("node:fs");
-var import_node_os13 = require("node:os");
-var import_node_path29 = require("node:path");
+var import_node_fs31 = require("node:fs");
+var import_node_os14 = require("node:os");
+var import_node_path30 = require("node:path");
 var import_node_child_process13 = require("node:child_process");
 var MAX_EMBED_BACKFILL_ROUNDS = 40;
 function normalizeRepo(raw) {
@@ -25561,7 +25880,7 @@ async function syncEstateRepoIndex(opts) {
   const failed = [];
   const skipped = [];
   for (const repo of repos) {
-    const dir = (0, import_node_fs30.mkdtempSync)((0, import_node_path29.join)((0, import_node_os13.tmpdir)(), "mmi-repo-index-"));
+    const dir = (0, import_node_fs31.mkdtempSync)((0, import_node_path30.join)((0, import_node_os14.tmpdir)(), "mmi-repo-index-"));
     try {
       shallowClone(repo, dir, opts.githubToken);
       const built = rebuildRepoIndex(dir, repo);
@@ -25611,7 +25930,7 @@ async function syncEstateRepoIndex(opts) {
       failed.push({ repo, error: e.message });
     } finally {
       try {
-        (0, import_node_fs30.rmSync)(dir, { recursive: true, force: true });
+        (0, import_node_fs31.rmSync)(dir, { recursive: true, force: true });
       } catch {
       }
     }
@@ -25620,7 +25939,7 @@ async function syncEstateRepoIndex(opts) {
 }
 
 // src/repo-index-health.ts
-var import_node_fs31 = require("node:fs");
+var import_node_fs32 = require("node:fs");
 
 // testdata/repo-index-golden-queries.json
 var repo_index_golden_queries_default = {
@@ -25662,7 +25981,7 @@ function assertGoldenSuite(raw, source) {
 function loadGoldenSuite(path2) {
   let text;
   try {
-    text = (0, import_node_fs31.readFileSync)(path2, "utf8");
+    text = (0, import_node_fs32.readFileSync)(path2, "utf8");
   } catch (e) {
     throw new Error(`golden suite unreadable at ${path2}: ${e.message}`);
   }
@@ -25816,8 +26135,8 @@ async function runRepoIndexHealth(opts) {
 
 // src/spawn-policy-core.ts
 var import_node_child_process14 = require("node:child_process");
-var import_node_fs32 = require("node:fs");
-var import_node_path30 = require("node:path");
+var import_node_fs33 = require("node:fs");
+var import_node_path31 = require("node:path");
 var SPAWNERS = ["spawn", "spawnSync", "exec", "execSync", "execFile", "execFileSync"];
 var CALL_SOURCE = String.raw`(^|[^.\w$])(${SPAWNERS.join("|")})\s*\(`;
 var SOURCE_EXT = /\.(ts|mts|cts|js|mjs|cjs)$/;
@@ -25903,7 +26222,7 @@ function runSpawnPolicy(root) {
   for (const file of files) {
     let raw;
     try {
-      raw = (0, import_node_fs32.readFileSync)((0, import_node_path30.join)(root, file), "utf8");
+      raw = (0, import_node_fs33.readFileSync)((0, import_node_path31.join)(root, file), "utf8");
     } catch {
       continue;
     }
@@ -25921,8 +26240,8 @@ function runSpawnPolicy(root) {
 
 // src/test-policy-core.ts
 var import_node_child_process15 = require("node:child_process");
-var import_node_fs33 = require("node:fs");
-var import_node_path31 = require("node:path");
+var import_node_fs34 = require("node:fs");
+var import_node_path32 = require("node:path");
 var POLICY_FILE = "test-policy.json";
 var TEST_RE = /\.(?:test|spec)\.[cm]?[jt]sx?$/;
 var PY_TEST_RE = /(?:^|\/)test_[^/]*\.py$|_test\.py$/;
@@ -25975,7 +26294,7 @@ function isTestPath(path2) {
   return TEST_RE.test(path2) || PY_TEST_RE.test(path2);
 }
 function loadPolicy(root, readFile9 = readFileOrNull2) {
-  const raw = readFile9((0, import_node_path31.join)(root, POLICY_FILE));
+  const raw = readFile9((0, import_node_path32.join)(root, POLICY_FILE));
   if (raw == null) return { mandatory: [], declared: false };
   try {
     return { ...JSON.parse(raw), declared: true };
@@ -25985,7 +26304,7 @@ function loadPolicy(root, readFile9 = readFileOrNull2) {
 }
 function readFileOrNull2(path2) {
   try {
-    return (0, import_node_fs33.readFileSync)(path2, "utf8");
+    return (0, import_node_fs34.readFileSync)(path2, "utf8");
   } catch {
     return null;
   }
@@ -26012,12 +26331,12 @@ function classify(changed, policy, present = () => false) {
   const removedProtected = [...removed].filter((p) => protectedBy.has(p)).map((p) => ({ path: p, why: protectedBy.get(p) ?? "" }));
   return { mandatoryHits, untestedHits, testChanges, addedTests, removedProtected };
 }
-function unresolvedProtectedEntries(policy, root, exists = (path2) => (0, import_node_fs33.existsSync)(path2)) {
-  return (policy.protected ?? []).map((p) => p.path).filter((p) => !exists((0, import_node_path31.join)(root, p)));
+function unresolvedProtectedEntries(policy, root, exists = (path2) => (0, import_node_fs34.existsSync)(path2)) {
+  return (policy.protected ?? []).map((p) => p.path).filter((p) => !exists((0, import_node_path32.join)(root, p)));
 }
-function unresolvedSatisfiers(policy, root, exists = (path2) => (0, import_node_fs33.existsSync)(path2)) {
+function unresolvedSatisfiers(policy, root, exists = (path2) => (0, import_node_fs34.existsSync)(path2)) {
   const declared = (policy.mandatory ?? []).flatMap((m) => m.satisfiedBy ?? []);
-  return [...new Set(declared)].filter((p) => !exists((0, import_node_path31.join)(root, p)));
+  return [...new Set(declared)].filter((p) => !exists((0, import_node_path32.join)(root, p)));
 }
 function evaluate(changed, policy, present = () => false) {
   const { mandatoryHits, untestedHits, testChanges, addedTests, removedProtected } = classify(changed, policy, present);
@@ -26199,13 +26518,13 @@ function changedFilesSince(base, cwd) {
 }
 function runTestPolicy(root, deps = {}) {
   const policy = deps.policy ?? loadPolicy(root);
-  const exists = deps.exists ?? ((path2) => (0, import_node_fs33.existsSync)(path2));
+  const exists = deps.exists ?? ((path2) => (0, import_node_fs34.existsSync)(path2));
   const counts = { mandatoryCount: (policy.mandatory ?? []).length, protectedCount: (policy.protected ?? []).length };
   const base = deps.changed ? "(injected)" : resolveBase(root, deps.base);
   const refusal = deps.changed ? null : untrustworthyRange(root, base);
   const changed = deps.changed ?? (refusal ? [] : changedFilesSince(base, root));
   const lookup = deps.override !== void 0 ? { override: deps.override, refusals: [] } : !deps.changed && !refusal ? readOverride(base, root) : { override: null, refusals: [] };
-  const present = (path2) => exists((0, import_node_path31.join)(root, path2));
+  const present = (path2) => exists((0, import_node_path32.join)(root, path2));
   const removedByThisDiff = removedPaths(changed);
   const staleFindings = [];
   const unresolved = unresolvedProtectedEntries(policy, root, exists).filter((p) => !removedByThisDiff.has(p));
@@ -26243,8 +26562,8 @@ function runTestPolicy(root, deps = {}) {
 }
 
 // src/project-info-sync.ts
-var import_node_fs34 = require("node:fs");
-var import_node_path32 = require("node:path");
+var import_node_fs35 = require("node:fs");
+var import_node_path33 = require("node:path");
 var UPDATE_PROJECT_INFO = `mutation($projectId: ID!, $shortDescription: String!, $readme: String!) {
   updateProjectV2(input: { projectId: $projectId, shortDescription: $shortDescription, readme: $readme }) {
     projectV2 { id }
@@ -26289,14 +26608,14 @@ function sharedName(entries, fallback) {
 }
 function buildProjectInfoSyncPlan(targetRepo2, project2, projects, repoRoot2) {
   if (!project2.projectId) throw new Error(`org project sync-info: ${targetRepo2} registry META has no projectId`);
-  const readmePath = (0, import_node_path32.join)(repoRoot2, "README.md");
-  if (!(0, import_node_fs34.existsSync)(readmePath)) throw new Error(`org project sync-info: ${targetRepo2} has no README.md`);
+  const readmePath = (0, import_node_path33.join)(repoRoot2, "README.md");
+  if (!(0, import_node_fs35.existsSync)(readmePath)) throw new Error(`org project sync-info: ${targetRepo2} has no README.md`);
   const entries = entriesFor(project2, projects);
   const memberRepos = [...new Set(entries.flatMap((entry) => entry.repos ?? []))].filter((repo) => /^[^/]+\/[^/]+$/.test(repo)).sort((a, b) => a.localeCompare(b));
   const projectName = sharedName(entries, project2.name?.trim() || targetRepo2.split("/").pop() || targetRepo2);
   if (!memberRepos.length) throw new Error(`org project sync-info: project ${projectName} has no registered member repos`);
   const entryNames = entries.map((entry) => entry.name?.trim()).filter((name) => Boolean(name));
-  const shortDescription = memberRepos.length === 1 ? shortDescriptionFromReadme((0, import_node_fs34.readFileSync)(readmePath, "utf8")) : `Shared work across ${new Intl.ListFormat("en", { type: "conjunction" }).format(entryNames)}.`;
+  const shortDescription = memberRepos.length === 1 ? shortDescriptionFromReadme((0, import_node_fs35.readFileSync)(readmePath, "utf8")) : `Shared work across ${new Intl.ListFormat("en", { type: "conjunction" }).format(entryNames)}.`;
   const lines = [
     `# ${projectName}`,
     "",
@@ -26315,8 +26634,8 @@ function buildProjectInfoSyncPlan(targetRepo2, project2, projects, repoRoot2) {
   const targetBase = `https://github.com/${targetRepo2}`;
   const targetBranch = branchFor(targetRepo2, projects);
   const orgDocs = [
-    (0, import_node_fs34.existsSync)((0, import_node_path32.join)(repoRoot2, "docs", "org-readme.md")) ? `- [Org identity](${targetBase}/blob/${targetBranch}/docs/org-readme.md)` : "",
-    (0, import_node_fs34.existsSync)((0, import_node_path32.join)(repoRoot2, "docs", "org-architecture.md")) ? `- [Org architecture](${targetBase}/blob/${targetBranch}/docs/org-architecture.md)` : ""
+    (0, import_node_fs35.existsSync)((0, import_node_path33.join)(repoRoot2, "docs", "org-readme.md")) ? `- [Org identity](${targetBase}/blob/${targetBranch}/docs/org-readme.md)` : "",
+    (0, import_node_fs35.existsSync)((0, import_node_path33.join)(repoRoot2, "docs", "org-architecture.md")) ? `- [Org architecture](${targetBase}/blob/${targetBranch}/docs/org-architecture.md)` : ""
   ].filter(Boolean);
   if (orgDocs.length) lines.push("", "## Organisation docs", "", ...orgDocs);
   return { projectId: project2.projectId, projectName, targetRepo: targetRepo2, memberRepos, shortDescription, readme: `${lines.join("\n")}
@@ -27142,9 +27461,9 @@ function writeError(res) {
 }
 
 // src/secrets-commands.ts
-var import_node_fs35 = require("node:fs");
-var import_node_path33 = require("node:path");
-var import_node_os14 = require("node:os");
+var import_node_fs36 = require("node:fs");
+var import_node_path34 = require("node:path");
+var import_node_os15 = require("node:os");
 
 // src/secrets-diff.ts
 var TIMEOUT_MS2 = 8e3;
@@ -27246,18 +27565,18 @@ function collectMap(value, previous = []) {
   return [...previous, value];
 }
 async function decryptRailsCredentials(input) {
-  const appDir = (0, import_node_path33.resolve)(input.appDir ?? process.cwd());
+  const appDir = (0, import_node_path34.resolve)(input.appDir ?? process.cwd());
   const credentialsFile = input.credentialsFile ?? DEFAULT_RAILS_CREDENTIALS_FILE;
   const masterKeyFile = input.masterKeyFile ?? DEFAULT_RAILS_MASTER_KEY_FILE;
-  const credentialsPath = (0, import_node_path33.resolve)(appDir, credentialsFile);
-  const masterKeyPath = (0, import_node_path33.resolve)(appDir, masterKeyFile);
+  const credentialsPath = (0, import_node_path34.resolve)(appDir, credentialsFile);
+  const masterKeyPath = (0, import_node_path34.resolve)(appDir, masterKeyFile);
   const env = {
     ...process.env,
     MMI_RAILS_CREDENTIALS_FILE: credentialsPath,
     MMI_RAILS_MASTER_KEY_FILE: masterKeyPath
   };
-  if ((0, import_node_fs35.existsSync)(masterKeyPath)) {
-    env.RAILS_MASTER_KEY = (0, import_node_fs35.readFileSync)(masterKeyPath, "utf8").trim();
+  if ((0, import_node_fs36.existsSync)(masterKeyPath)) {
+    env.RAILS_MASTER_KEY = (0, import_node_fs36.readFileSync)(masterKeyPath, "utf8").trim();
   }
   const script = [
     'require "json"',
@@ -27267,9 +27586,9 @@ async function decryptRailsCredentials(input) {
     'config = ActiveSupport::EncryptedConfiguration.new(config_path: config_path, key_path: key_path, env_key: "RAILS_MASTER_KEY", raise_if_missing_key: true)',
     "puts JSON.generate(config.config)"
   ].join("\n");
-  const scriptDir = (0, import_node_fs35.mkdtempSync)((0, import_node_path33.join)((0, import_node_os14.tmpdir)(), "mmi-rails-decrypt-"));
-  const scriptPath = (0, import_node_path33.join)(scriptDir, "decrypt.rb");
-  (0, import_node_fs35.writeFileSync)(scriptPath, script, "utf8");
+  const scriptDir = (0, import_node_fs36.mkdtempSync)((0, import_node_path34.join)((0, import_node_os15.tmpdir)(), "mmi-rails-decrypt-"));
+  const scriptPath = (0, import_node_path34.join)(scriptDir, "decrypt.rb");
+  (0, import_node_fs36.writeFileSync)(scriptPath, script, "utf8");
   try {
     const args = ["exec", "ruby", scriptPath];
     const cmd = process.platform === "win32" ? "cmd.exe" : "bundle";
@@ -27281,7 +27600,7 @@ async function decryptRailsCredentials(input) {
     });
     return JSON.parse(stdout);
   } finally {
-    (0, import_node_fs35.rmSync)(scriptDir, { recursive: true, force: true });
+    (0, import_node_fs36.rmSync)(scriptDir, { recursive: true, force: true });
   }
 }
 async function readSecretStdin() {
@@ -27371,7 +27690,7 @@ function registerSecretsCommands(program3) {
     let body;
     if (o.file) {
       try {
-        body = (0, import_node_fs35.readFileSync)((0, import_node_path33.resolve)(o.file), "utf8");
+        body = (0, import_node_fs36.readFileSync)((0, import_node_path34.resolve)(o.file), "utf8");
       } catch (e) {
         return fail(`secrets org-catalog: cannot read --file ${o.file}: ${e.message}`);
       }
@@ -27476,7 +27795,7 @@ function registerSecretsCommands(program3) {
       {
         ...d,
         decryptRailsCredentials,
-        removeFile: (path2) => (0, import_node_fs35.unlinkSync)((0, import_node_path33.resolve)(o.appDir ?? process.cwd(), path2))
+        removeFile: (path2) => (0, import_node_fs36.unlinkSync)((0, import_node_path34.resolve)(o.appDir ?? process.cwd(), path2))
       },
       {
         repo: o.repo,
@@ -27681,7 +28000,7 @@ function emitCliCallTelemetry(command) {
 }
 
 // src/box-commands.ts
-var import_node_fs36 = require("node:fs");
+var import_node_fs37 = require("node:fs");
 
 // src/box.ts
 var BOX_KEYS = {
@@ -27884,7 +28203,7 @@ function registerBoxCommands(program3) {
       }
       if (o.json) console.log(JSON.stringify({ box: found, incomplete }, null, 2));
       else if (o.ssh && o.script) {
-        (0, import_node_fs36.writeFileSync)(o.script, sshRecipeScript(found), "utf8");
+        (0, import_node_fs37.writeFileSync)(o.script, sshRecipeScript(found), "utf8");
         console.log(`wrote ${o.script} \u2014 run: bash "${o.script}"`);
       } else if (o.ssh) console.log(`${formatSshRecipe(found)}
 ${SSH_RECIPE_AGENT_NOTE}`);
@@ -28203,7 +28522,7 @@ function registerSchedulesCommands(program3) {
 
 // src/schedules-lift-command.ts
 var import_promises7 = require("node:fs/promises");
-var import_node_path34 = require("node:path");
+var import_node_path35 = require("node:path");
 var DEFAULT_WORKFLOWS_DIR = ".github/workflows";
 var SCHEDULE_REPO_RE = /^[A-Za-z0-9_.-]+$/;
 var SchedulesLiftUsageError = class extends Error {
@@ -28230,7 +28549,7 @@ async function readWorkflowFiles(dir) {
   const files = [];
   for (const name of names.sort()) {
     if (!/\.ya?ml$/.test(name)) continue;
-    files.push({ path: `.github/workflows/${name}`, text: await (0, import_promises7.readFile)((0, import_node_path34.join)(dir, name), "utf8") });
+    files.push({ path: `.github/workflows/${name}`, text: await (0, import_promises7.readFile)((0, import_node_path35.join)(dir, name), "utf8") });
   }
   return files;
 }
@@ -28378,9 +28697,9 @@ function registerEdgeCommands(program3) {
 }
 
 // src/bootstrap-commands.ts
-var import_node_fs37 = require("node:fs");
-var import_node_os15 = require("node:os");
-var import_node_path35 = require("node:path");
+var import_node_fs38 = require("node:fs");
+var import_node_os16 = require("node:os");
+var import_node_path36 = require("node:path");
 
 // src/bootstrap-drift.ts
 var import_node_crypto7 = require("node:crypto");
@@ -28565,6 +28884,71 @@ function renderPropagationReport(plan) {
   return lines.join("\n");
 }
 
+// src/bootstrap-propagation-identity.ts
+var import_node_crypto8 = require("node:crypto");
+var PROPAGATION_BRANCH_PREFIX = "seed-propagate-";
+var TARGET_MARKER_NAME = "mmi-bootstrap-propagation-target";
+function safeBranchPart(value, maxLength, fallback) {
+  const safe = value.normalize("NFKD").toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, maxLength).replace(/-+$/g, "");
+  return safe || fallback;
+}
+function repoSlug2(repo) {
+  return repo.trim().split("/").pop()?.toLowerCase() || "repo";
+}
+function propagationBranch(repo, target) {
+  const repoPart = safeBranchPart(repoSlug2(repo), 32, "repo");
+  const targetPart = safeBranchPart(target, 48, "target");
+  const hash = (0, import_node_crypto8.createHash)("sha256").update(repo.trim().toLowerCase()).update("\0").update(target).digest("hex").slice(0, 12);
+  return `${PROPAGATION_BRANCH_PREFIX}${repoPart}-${targetPart}-${hash}`;
+}
+function legacyPropagationBranch(repo) {
+  return `${PROPAGATION_BRANCH_PREFIX}${repoSlug2(repo)}`;
+}
+function renderPropagationTargetMarker(target) {
+  return `<!-- ${TARGET_MARKER_NAME}: ${JSON.stringify(target)} -->`;
+}
+function targetMarkers(body) {
+  const present = body.includes(`${TARGET_MARKER_NAME}:`);
+  const targets = [];
+  const marker = new RegExp(`<!--\\s*${TARGET_MARKER_NAME}:\\s*(.*?)\\s*-->`, "g");
+  for (const match of body.matchAll(marker)) {
+    try {
+      const parsed = JSON.parse(match[1]);
+      if (typeof parsed === "string") targets.push(parsed);
+    } catch {
+    }
+  }
+  return { present, targets };
+}
+function canonicalProseTargets(body) {
+  const targets = [];
+  const command = /bootstrap propagate --target (.+?) --execute`/g;
+  const prose = /(?:org-owned copy of|declared marker-bounded block inside repo-owned) `([^`]+)` — the file this PR carries and nothing else/g;
+  for (const match of body.matchAll(command)) targets.push(match[1]);
+  for (const match of body.matchAll(prose)) targets.push(match[1]);
+  return targets;
+}
+function propagationPrMatchesTarget(pr2, target, identity) {
+  const body = pr2.body ?? "";
+  const markers = targetMarkers(body);
+  if (markers.present) {
+    if (markers.targets.length !== 1 || markers.targets[0] !== target) return false;
+    return !pr2.files?.length || pr2.files.length === 1 && pr2.files[0] === target;
+  }
+  if (identity === "target-specific") return false;
+  const proseTargets = canonicalProseTargets(body);
+  if (proseTargets.some((candidate) => candidate !== target)) return false;
+  if (pr2.files?.length) {
+    return pr2.files.length === 1 && pr2.files[0] === target;
+  }
+  return proseTargets.length > 0;
+}
+function propagationPrCandidatesForTarget(target, targetSpecificPrs, legacyPrs) {
+  const targetSpecific = targetSpecificPrs.filter((pr2) => propagationPrMatchesTarget(pr2, target, "target-specific"));
+  if (targetSpecific.length) return targetSpecific;
+  return legacyPrs.filter((pr2) => propagationPrMatchesTarget(pr2, target, "legacy"));
+}
+
 // src/bootstrap-rollback.ts
 function resolveRollbackRecord(records, repo, target) {
   const candidates = records.filter((r) => r.repo === repo && r.target === target && r.mergeSha);
@@ -29260,13 +29644,13 @@ function registerBootstrapCommands(program3) {
       client: defaultGitHubClient(),
       projectMeta: meta,
       deployModel: typeof meta?.deployModel === "string" ? meta.deployModel : void 0,
-      readLocalFile: (path2) => path2 === "projects.json" && apiProjects != null ? apiProjects : (0, import_node_fs37.existsSync)(path2) ? (0, import_node_fs37.readFileSync)(path2, "utf8") : null,
+      readLocalFile: (path2) => path2 === "projects.json" && apiProjects != null ? apiProjects : (0, import_node_fs38.existsSync)(path2) ? (0, import_node_fs38.readFileSync)(path2, "utf8") : null,
       // requiredGcpApis is stored as an array by a JSON write, but `org project set --var KEY=VALUE` stores a raw
       // comma-string — accept either so the seeded value verifies regardless of how it was written.
       // #3689: the same committed map the org access audit reads (#3664), so a sanctioned admin is not a
       // permanent bootstrap failure on one surface and an intended state on the other. Absent file → no
       // sanction, which is the pre-#3664 behaviour.
-      sanctionedAdmins: (0, import_node_fs37.existsSync)("access-matrix.json") ? entriesValueByCanonicalRepo(loadSanctionedAdmins((0, import_node_fs37.readFileSync)("access-matrix.json", "utf8")), repo) : void 0,
+      sanctionedAdmins: (0, import_node_fs38.existsSync)("access-matrix.json") ? entriesValueByCanonicalRepo(loadSanctionedAdmins((0, import_node_fs38.readFileSync)("access-matrix.json", "utf8")), repo) : void 0,
       requiredGcpApis: (() => {
         const v = meta?.requiredGcpApis;
         if (Array.isArray(v)) return v;
@@ -29319,14 +29703,14 @@ function registerBootstrapCommands(program3) {
   bootstrap.command("drift").description("#3818: compare every org-owned whole-file seed against MMI-Hub's copy across the registry roster; read-only").option("--repo <owner/repo>", "audit one repo instead of the roster (never a fleet verdict)").option("--json", "machine-readable output").action(async () => {
     const o = { repo: rawValue("--repo", ""), json: rawFlag("--json") };
     const manifestPath = "skills/bootstrap/seeds/manifest.json";
-    if (!(0, import_node_fs37.existsSync)(manifestPath)) return fail(`bootstrap drift: ${manifestPath} not found; run from the MMI-Hub repo root \u2014 the Hub's copies ARE the reference this compares against`);
+    if (!(0, import_node_fs38.existsSync)(manifestPath)) return fail(`bootstrap drift: ${manifestPath} not found; run from the MMI-Hub repo root \u2014 the Hub's copies ARE the reference this compares against`);
     const seedSource = await resolveHubSeedSource(execGitForSeedSource);
     if (!seedSource.ok) return fail(`bootstrap drift: ${seedSource.reason}`);
-    const manifest = loadBootstrapSeeds((0, import_node_fs37.readFileSync)(manifestPath, "utf8"));
+    const manifest = loadBootstrapSeeds((0, import_node_fs38.readFileSync)(manifestPath, "utf8"));
     const hubContents = /* @__PURE__ */ new Map();
     for (const s of manifest.seeds) {
       if (s.ownership !== "org" || s.source !== "self") continue;
-      hubContents.set(s.target, (0, import_node_fs37.existsSync)(s.target) ? (0, import_node_fs37.readFileSync)(s.target, "utf8") : null);
+      hubContents.set(s.target, (0, import_node_fs38.existsSync)(s.target) ? (0, import_node_fs38.readFileSync)(s.target, "utf8") : null);
     }
     let targets;
     let classOf = (_repo) => "deployable";
@@ -29405,10 +29789,10 @@ function registerBootstrapCommands(program3) {
       return fail(`bootstrap apply: ${e.message}`);
     }
     const manifestPath = "skills/bootstrap/seeds/manifest.json";
-    if (!(0, import_node_fs37.existsSync)(manifestPath)) return fail(`bootstrap apply: ${manifestPath} not found; bootstrap runs from the MMI-Hub repo root by design \u2014 it stamps org-level resources (Project, Ruleset, secrets, access) through the GitHub App, which is only authorized from the Hub checkout`);
+    if (!(0, import_node_fs38.existsSync)(manifestPath)) return fail(`bootstrap apply: ${manifestPath} not found; bootstrap runs from the MMI-Hub repo root by design \u2014 it stamps org-level resources (Project, Ruleset, secrets, access) through the GitHub App, which is only authorized from the Hub checkout`);
     const seedSource = await resolveHubSeedSource(execGitForSeedSource);
     if (!seedSource.ok) return fail(`bootstrap apply: ${seedSource.reason}`);
-    const manifest = loadBootstrapSeeds((0, import_node_fs37.readFileSync)(manifestPath, "utf8"));
+    const manifest = loadBootstrapSeeds((0, import_node_fs38.readFileSync)(manifestPath, "utf8"));
     const baseBranch = o.class === "content" ? "main" : "development";
     const slug = parsedRepo.slug;
     const onlyTarget = o.only.trim();
@@ -29418,17 +29802,18 @@ function registerBootstrapCommands(program3) {
       return fail(`bootstrap apply: --only '${onlyTarget}' names no seed in ${manifestPath}. Declared targets:
   ${known}`);
     }
+    const onlyManagedBlock = onlyTarget ? seedsToApply[0]?.managedBlock != null : false;
     const gh = async (args) => execFileP2("gh", args, { timeout: 2e4 });
-    const readFile9 = (p) => (0, import_node_fs37.existsSync)(p) ? (0, import_node_fs37.readFileSync)(p, "utf8") : null;
+    const readFile9 = (p) => (0, import_node_fs38.existsSync)(p) ? (0, import_node_fs38.readFileSync)(p, "utf8") : null;
     const enc = (p) => p.split("/").map(encodeURIComponent).join("/");
     const putSeed = async (target, content, ref, sha) => {
-      const tmp = (0, import_node_path35.join)((0, import_node_os15.tmpdir)(), `mmi-seed-${process.pid}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}.json`);
-      (0, import_node_fs37.writeFileSync)(tmp, JSON.stringify(contentPutBody(target, content, ref, sha)), "utf8");
+      const tmp = (0, import_node_path36.join)((0, import_node_os16.tmpdir)(), `mmi-seed-${process.pid}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}.json`);
+      (0, import_node_fs38.writeFileSync)(tmp, JSON.stringify(contentPutBody(target, content, ref, sha)), "utf8");
       try {
         await gh(contentPutInputArgs(repo, target, tmp));
       } finally {
         try {
-          (0, import_node_fs37.unlinkSync)(tmp);
+          (0, import_node_fs38.unlinkSync)(tmp);
         } catch {
         }
       }
@@ -29525,9 +29910,22 @@ function registerBootstrapCommands(program3) {
         exists = false;
       }
       const planned = planSeedAction(resolved, exists);
-      const isBlock = resolved.source === "managed-block";
-      const content = planned.action === "create" || planned.action === "update" ? isBlock ? upsertManagedGitignoreBlock(remoteContent).content : resolveSeedContent(resolved, vars, readFile9) : null;
-      const action = reconcileSeedAction(planned, content, isBlock, remoteContent);
+      const isLegacyBlock = resolved.source === "managed-block";
+      let content = null;
+      let isManaged = isLegacyBlock || resolved.managedBlock != null;
+      if (planned.action === "create" || planned.action === "update") {
+        if (isLegacyBlock) {
+          content = upsertManagedGitignoreBlock(remoteContent).content;
+        } else {
+          const writeContent = resolveSeedWriteContent(resolved, vars, readFile9, remoteContent);
+          if (!writeContent.ok) {
+            return fail(`bootstrap apply: ${resolved.target}: ${writeContent.reason} \u2014 refusing to overwrite repo-owned content`);
+          }
+          content = writeContent.content;
+          isManaged = writeContent.managed;
+        }
+      }
+      const action = reconcileSeedAction(planned, content, isManaged, remoteContent);
       actions.push(action);
       const docBody = content ?? remoteContent;
       if (resolved.target.startsWith("docs/") && resolved.target.endsWith(".md") && docBody !== null) {
@@ -29580,11 +29978,11 @@ function registerBootstrapCommands(program3) {
           "--head",
           seedPlan.branch,
           "--title",
-          onlyTarget ? `chore: propagate org-owned ${onlyTarget} from MMI-Hub` : `bootstrap: seed ${parsedRepo.name} (${baseBranch} is protected)`,
+          onlyTarget ? `chore: propagate ${onlyManagedBlock ? "Hub-managed block in" : "org-owned"} ${onlyTarget} from MMI-Hub` : `bootstrap: seed ${parsedRepo.name} (${baseBranch} is protected)`,
           "--body",
           onlyTarget ? `Auto-opened by \`mmi-cli devops bootstrap apply ${repo} --only ${onlyTarget} --execute\` (#3818).
 
-\`${onlyTarget}\` is an org-owned seed declared in MMI-Hub's \`skills/bootstrap/seeds/manifest.json\` at MMI-Hub@${seedSource.sha}; this PR brings this repo's copy to the Hub's. It carries that file and nothing else \u2014 no labels, ruleset, merge settings or registry META were touched.
+${onlyManagedBlock ? `Only the marker-bounded Hub-managed block inside repo-owned \`${onlyTarget}\`` : `The org-owned \`${onlyTarget}\` seed`} is declared by MMI-Hub's \`skills/bootstrap/seeds/manifest.json\` at MMI-Hub@${seedSource.sha}; this PR reconciles that declared scope and preserves everything outside it. It carries that file and nothing else \u2014 no labels, ruleset, merge settings or registry META were touched.
 
 \`${baseBranch}\` is protected (${seedPlan.reason}), so delivery goes via this branch + PR \u2014 a direct contents PUT 409s on a protected base.` : `Auto-opened by \`mmi-cli devops bootstrap apply --execute ${repo}\` (#2286): \`${baseBranch}\` is protected (${seedPlan.reason}), so the org-managed seed files are delivered via this branch + PR \u2014 a direct contents PUT 409s on a protected base ("N of N required status checks are expected"). Seeds are from MMI-Hub@${seedSource.sha}.`
         ]);
@@ -29690,23 +30088,24 @@ LIVE apply to ${repo}:
   ${applied.join("\n  ")}`);
     }
   });
-  bootstrap.command("propagate").description("#4238: re-entrant canary\u2192wave tick \u2014 plan (or, with --execute, open) per-repo PRs fanning an org-owned seed out to the fleet").option("--target <path>", "the manifest target to propagate (an ownership:org + source:self seed, e.g. .github/workflows/agent-pr.yml)").option("--execute", "LIVE tick via gh (master-gated) \u2014 opens/reuses per-repo seed-propagate PRs; dry-run prints the plan only").option("--json", "machine-readable output").action(async () => {
+  bootstrap.command("propagate").description("#4238: re-entrant canary\u2192wave tick \u2014 plan (or, with --execute, open) per-repo PRs fanning an org-owned seed out to the fleet").option("--target <path>", "the manifest target to propagate (an org-owned whole file or declared Hub-managed block)").option("--execute", "LIVE tick via gh (master-gated) \u2014 opens/reuses per-repo seed-propagate PRs; dry-run prints the plan only").option("--json", "machine-readable output").action(async () => {
     const o = { target: rawValue("--target", ""), execute: rawFlag("--execute"), json: rawFlag("--json") };
     const manifestPath = "skills/bootstrap/seeds/manifest.json";
-    if (!(0, import_node_fs37.existsSync)(manifestPath)) return fail(`bootstrap propagate: ${manifestPath} not found; run from the MMI-Hub repo root \u2014 the Hub's copies ARE the desired state this tick propagates`);
+    if (!(0, import_node_fs38.existsSync)(manifestPath)) return fail(`bootstrap propagate: ${manifestPath} not found; run from the MMI-Hub repo root \u2014 the Hub's copies ARE the desired state this tick propagates`);
     const seedSource = await resolveHubSeedSource(execGitForSeedSource);
     if (!seedSource.ok) return fail(`bootstrap propagate: ${seedSource.reason}`);
-    const manifest = loadBootstrapSeeds((0, import_node_fs37.readFileSync)(manifestPath, "utf8"));
-    const propagatable = manifest.seeds.filter((s) => s.ownership === "org" && s.source === "self");
+    const manifest = loadBootstrapSeeds((0, import_node_fs38.readFileSync)(manifestPath, "utf8"));
+    const propagatable = manifest.seeds.filter(isPropagatableSeed);
     if (!o.target) {
       return fail(`bootstrap propagate: --target <path> is required \u2014 one of:
   ${propagatable.map((s) => s.target).join("\n  ")}`);
     }
     const seed = propagatable.find((s) => s.target === o.target);
-    if (!seed) return fail(`bootstrap propagate: --target '${o.target}' names no ownership:org + source:self seed in ${manifestPath}. Propagatable targets:
+    if (!seed) return fail(`bootstrap propagate: --target '${o.target}' names no centrally propagatable seed in ${manifestPath}. Propagatable targets:
   ${propagatable.map((s) => s.target).join("\n  ")}`);
-    if (!(0, import_node_fs37.existsSync)(seed.target)) return fail(`bootstrap propagate: the Hub's own copy of '${seed.target}' is missing \u2014 nothing to propagate`);
-    const hubContent = (0, import_node_fs37.readFileSync)(seed.target, "utf8");
+    if (!seed.managedBlock && !(0, import_node_fs38.existsSync)(seed.target)) return fail(`bootstrap propagate: the Hub's own copy of '${seed.target}' is missing \u2014 nothing to propagate`);
+    const hubContent = seed.managedBlock ? null : (0, import_node_fs38.readFileSync)(seed.target, "utf8");
+    const readSeedFile = (path2) => (0, import_node_fs38.existsSync)(path2) ? (0, import_node_fs38.readFileSync)(path2, "utf8") : null;
     const isWorkflowSeed = seed.target.startsWith(".github/workflows/");
     const cfg = await loadConfig();
     const projects = await fetchProjectsList(registryClientDeps(cfg));
@@ -29715,9 +30114,9 @@ LIVE apply to ${repo}:
     }
     const rosterRepos2 = collectRegistryRepos(projects).filter((r) => r.toLowerCase() !== "mutmutco/mmi-hub");
     let independentCount = rosterRepos2.length;
-    if ((0, import_node_fs37.existsSync)("projects.json")) {
+    if ((0, import_node_fs38.existsSync)("projects.json")) {
       try {
-        const local = JSON.parse((0, import_node_fs37.readFileSync)("projects.json", "utf8"));
+        const local = JSON.parse((0, import_node_fs38.readFileSync)("projects.json", "utf8"));
         const localRepos = /* @__PURE__ */ new Set();
         for (const p of local.projects ?? []) for (const r of p.repos ?? []) {
           const full = (r.includes("/") ? r : `mutmutco/${r}`).toLowerCase();
@@ -29762,11 +30161,12 @@ LIVE apply to ${repo}:
     });
     const gh = async (args) => execFileP2("gh", args, { timeout: 2e4 });
     const enc = (p) => p.split("/").map(encodeURIComponent).join("/");
-    const branchPrefix = "seed-propagate";
     const reads = [];
+    const desiredByRepo = /* @__PURE__ */ new Map();
     for (const r of repos) {
       if (r.waiver) continue;
-      const baseBranch = classOf(r.repo) === "content" ? "main" : "development";
+      const repoClass = classOf(r.repo);
+      const baseBranch = repoClass === "content" ? "main" : "development";
       let content = null;
       try {
         const resp = await gh(["api", `repos/${r.repo}/contents/${enc(seed.target)}?ref=${baseBranch}`]);
@@ -29775,13 +30175,35 @@ LIVE apply to ${repo}:
       } catch {
         content = null;
       }
-      const drift = compareSeedBytes(hubContent, content);
+      let desired;
+      if (seed.managedBlock) {
+        const vars = withDerivedRepoVars({}, parseOwnerRepo(r.repo), repoClass);
+        const resolved = resolveSeedWriteContent(seed, vars, readSeedFile, content);
+        if (!resolved.ok) {
+          return fail(`bootstrap propagate: ${r.repo} ${seed.target}: ${resolved.reason} \u2014 refusing to overwrite repo-owned content`);
+        }
+        if (resolved.content == null) {
+          return fail(`bootstrap propagate: cannot resolve the full template or managed block source for '${seed.target}' \u2014 refusing a partial fleet plan`);
+        }
+        desired = resolved.content;
+      } else {
+        desired = hubContent;
+      }
+      desiredByRepo.set(r.repo, desired);
+      const drift = compareSeedBytes(desired, content);
       let pr2;
       try {
-        const branch = `${branchPrefix}-${r.slug}`;
-        const listed = await gh(["pr", "list", "--repo", r.repo, "--head", branch, "--base", baseBranch, "--state", "all", "--json", "number,url,state,statusCheckRollup,mergeCommit,body", "--limit", "1"]);
-        const arr = JSON.parse(listed.stdout || "[]");
-        const p = arr[0];
+        const listBranchPrs = async (branch) => {
+          const listed = await gh(["pr", "list", "--repo", r.repo, "--head", branch, "--base", baseBranch, "--state", "all", "--json", "number,url,state,statusCheckRollup,mergeCommit,body,files", "--limit", "100"]);
+          return JSON.parse(listed.stdout || "[]");
+        };
+        const targetSpecific = (await listBranchPrs(propagationBranch(r.repo, seed.target))).map((p2) => ({ ...p2, files: p2.files?.map((f) => f.path) }));
+        let identified = propagationPrCandidatesForTarget(seed.target, targetSpecific, []);
+        if (!identified.length) {
+          const legacy = (await listBranchPrs(legacyPropagationBranch(r.repo))).map((p2) => ({ ...p2, files: p2.files?.map((f) => f.path) }));
+          identified = propagationPrCandidatesForTarget(seed.target, [], legacy);
+        }
+        const p = identified[0];
         if (p) {
           const rollup = p.statusCheckRollup ?? [];
           const checks = rollup.length === 0 ? "none" : rollup.some((c) => c.conclusion === "FAILURE" || c.state === "FAILURE") ? "red" : rollup.every((c) => c.conclusion === "SUCCESS" || c.state === "SUCCESS") ? "success" : "pending";
@@ -29814,9 +30236,8 @@ LIVE apply to ${repo}:
       const headSha = seedSource.sha;
       for (const rec of plan.records) {
         if (rec.action !== "open-pr") continue;
-        const repoEntry = repos.find((r) => r.repo === rec.repo);
         const baseBranch = classOf(rec.repo) === "content" ? "main" : "development";
-        const branch = `${branchPrefix}-${repoEntry.slug}`;
+        const branch = propagationBranch(rec.repo, seed.target);
         const baseRef = await gh(["api", `repos/${rec.repo}/git/ref/heads/${baseBranch}`, "--jq", ".object.sha"]);
         const baseSha = baseRef.stdout.trim();
         let branchExists = true;
@@ -29833,18 +30254,26 @@ LIVE apply to ${repo}:
         } catch {
           existingSha = void 0;
         }
-        const tmp = (0, import_node_path35.join)((0, import_node_os15.tmpdir)(), `mmi-propagate-${process.pid}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}.json`);
-        (0, import_node_fs37.writeFileSync)(tmp, JSON.stringify(contentPutBody(seed.target, hubContent, branch, existingSha)), "utf8");
+        const tmp = (0, import_node_path36.join)((0, import_node_os16.tmpdir)(), `mmi-propagate-${process.pid}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}.json`);
+        const desiredContent = desiredByRepo.get(rec.repo);
+        if (desiredContent == null) return fail(`bootstrap propagate: no resolved content for ${rec.repo} ${seed.target} \u2014 refusing to write`);
+        (0, import_node_fs38.writeFileSync)(tmp, JSON.stringify(contentPutBody(seed.target, desiredContent, branch, existingSha)), "utf8");
         try {
           await gh(contentPutInputArgs(rec.repo, seed.target, tmp));
         } finally {
           try {
-            (0, import_node_fs37.unlinkSync)(tmp);
+            (0, import_node_fs38.unlinkSync)(tmp);
           } catch {
           }
         }
-        const openPrs = await gh(["pr", "list", "--repo", rec.repo, "--head", branch, "--base", baseBranch, "--state", "open", "--json", "number,url"]);
-        const prDecision = decideSeedPrAction(JSON.parse(openPrs.stdout || "[]"));
+        const openPrs = await gh(["pr", "list", "--repo", rec.repo, "--head", branch, "--base", baseBranch, "--state", "open", "--json", "number,url,body,files"]);
+        const listedOpenPrs = JSON.parse(openPrs.stdout || "[]");
+        const identifiedOpenPrs = propagationPrCandidatesForTarget(
+          seed.target,
+          listedOpenPrs.map((p) => ({ ...p, files: p.files?.map((f) => f.path) })),
+          []
+        );
+        const prDecision = decideSeedPrAction(identifiedOpenPrs);
         let prUrl;
         if (prDecision.action === "reuse") {
           prUrl = prDecision.url;
@@ -29859,11 +30288,12 @@ LIVE apply to ${repo}:
             "--head",
             branch,
             "--title",
-            `chore: propagate org-owned ${seed.target} from MMI-Hub (wave ${rec.wave})`,
+            `chore: propagate ${seed.managedBlock ? "Hub-managed block in" : "org-owned"} ${seed.target} from MMI-Hub (wave ${rec.wave})`,
             "--body",
             `Auto-opened by \`mmi-cli devops bootstrap propagate --target ${seed.target} --execute\` (#4238), wave ${rec.wave}.
 
-Propagates MMI-Hub@${headSha} 's copy of \`${seed.target}\` to this repo \u2014 the file this PR carries and nothing else.
+Propagates MMI-Hub@${headSha}'s ${seed.managedBlock ? "declared marker-bounded block inside repo-owned" : "org-owned copy of"} \`${seed.target}\` \u2014 the file this PR carries and nothing else; content outside a managed block remains untouched.
+${renderPropagationTargetMarker(seed.target)}
 
 Rollback: \`mmi-cli devops bootstrap rollback ${rec.repo} --target ${seed.target} --execute\` (#4240) reverts this PR's merge commit; never re-run propagate with old bytes.`
           ]);
@@ -29897,30 +30327,30 @@ Rollback: \`mmi-cli devops bootstrap rollback ${rec.repo} --target ${seed.target
       return fail(`bootstrap rollback: ${e.message}`);
     }
     const manifestPath = "skills/bootstrap/seeds/manifest.json";
-    if (!(0, import_node_fs37.existsSync)(manifestPath)) return fail(`bootstrap rollback: ${manifestPath} not found; run from the MMI-Hub repo root \u2014 the manifest names which targets are org-owned and therefore propagated (and rollback-able)`);
+    if (!(0, import_node_fs38.existsSync)(manifestPath)) return fail(`bootstrap rollback: ${manifestPath} not found; run from the MMI-Hub repo root \u2014 the manifest names which targets are org-owned and therefore propagated (and rollback-able)`);
     const seedSource = await resolveHubSeedSource(execGitForSeedSource);
     if (!seedSource.ok) return fail(`bootstrap rollback: ${seedSource.reason}`);
-    const manifest = loadBootstrapSeeds((0, import_node_fs37.readFileSync)(manifestPath, "utf8"));
-    const propagatable = manifest.seeds.filter((s) => s.ownership === "org" && s.source === "self");
+    const manifest = loadBootstrapSeeds((0, import_node_fs38.readFileSync)(manifestPath, "utf8"));
+    const propagatable = manifest.seeds.filter(isPropagatableSeed);
     if (!o.target) {
       return fail(`bootstrap rollback: --target <path> is required \u2014 one of:
   ${propagatable.map((s) => s.target).join("\n  ")}`);
     }
     const seed = propagatable.find((s) => s.target === o.target);
-    if (!seed) return fail(`bootstrap rollback: --target '${o.target}' names no ownership:org + source:self seed in ${manifestPath}. Propagatable (hence rollback-able) targets:
+    if (!seed) return fail(`bootstrap rollback: --target '${o.target}' names no centrally propagatable seed in ${manifestPath}. Propagatable (hence rollback-able) targets:
   ${propagatable.map((s) => s.target).join("\n  ")}`);
     const slug = parsedRepo.slug;
     const baseBranch = o.class === "content" ? "main" : "development";
-    const branchPrefix = "seed-propagate";
-    const propagateBranch = `${branchPrefix}-${slug}`;
+    const targetPropagateBranch = propagationBranch(repo, seed.target);
+    const legacyPropagateBranch = legacyPropagationBranch(repo);
     const gh = async (args) => execFileP2("gh", args, { timeout: 2e4 });
     const enc = (p) => p.split("/").map(encodeURIComponent).join("/");
     let candidates;
     if (o.record) {
-      if (!(0, import_node_fs37.existsSync)(o.record)) return fail(`bootstrap rollback: --record '${o.record}' not found`);
+      if (!(0, import_node_fs38.existsSync)(o.record)) return fail(`bootstrap rollback: --record '${o.record}' not found`);
       let parsed;
       try {
-        parsed = JSON.parse((0, import_node_fs37.readFileSync)(o.record, "utf8"));
+        parsed = JSON.parse((0, import_node_fs38.readFileSync)(o.record, "utf8"));
       } catch (e) {
         return fail(`bootstrap rollback: --record '${o.record}' is not valid JSON: ${e.message}`);
       }
@@ -29935,9 +30365,17 @@ Rollback: \`mmi-cli devops bootstrap rollback ${rec.repo} --target ${seed.target
     } else {
       candidates = [];
       try {
-        const listed = await gh(["pr", "list", "--repo", repo, "--head", propagateBranch, "--base", baseBranch, "--state", "merged", "--json", "number,url,mergedAt,mergeCommit,files", "--limit", "20"]);
-        const arr = JSON.parse(listed.stdout || "[]");
-        for (const p of arr) {
+        const listMergedBranchPrs = async (branch) => {
+          const listed = await gh(["pr", "list", "--repo", repo, "--head", branch, "--base", baseBranch, "--state", "merged", "--json", "number,url,mergedAt,mergeCommit,body,files", "--limit", "100"]);
+          return JSON.parse(listed.stdout || "[]");
+        };
+        const targetSpecific = (await listMergedBranchPrs(targetPropagateBranch)).map((p) => ({ ...p, files: p.files?.map((f) => f.path) }));
+        let identified = propagationPrCandidatesForTarget(seed.target, targetSpecific, []);
+        if (!identified.length) {
+          const legacy = (await listMergedBranchPrs(legacyPropagateBranch)).map((p) => ({ ...p, files: p.files?.map((f) => f.path) }));
+          identified = propagationPrCandidatesForTarget(seed.target, [], legacy);
+        }
+        for (const p of identified) {
           if (!p.mergeCommit?.oid) continue;
           candidates.push({
             repo,
@@ -29946,11 +30384,11 @@ Rollback: \`mmi-cli devops bootstrap rollback ${rec.repo} --target ${seed.target
             url: p.url,
             mergeSha: p.mergeCommit.oid,
             mergedAt: p.mergedAt ?? "",
-            files: (p.files ?? []).map((f) => f.path)
+            files: p.files ?? []
           });
         }
       } catch (e) {
-        return fail(`bootstrap rollback: could not read ${repo}'s merged ${propagateBranch} PR history: ${e.message}`);
+        return fail(`bootstrap rollback: could not read ${repo}'s merged ${targetPropagateBranch} or positively matching legacy PR history: ${e.message}`);
       }
     }
     const plan = planRollback(repo, seed.target, slug, candidates);
@@ -29989,13 +30427,13 @@ Rollback: \`mmi-cli devops bootstrap rollback ${rec.repo} --target ${seed.target
       } catch {
         existingSha = void 0;
       }
-      const tmp = (0, import_node_path35.join)((0, import_node_os15.tmpdir)(), `mmi-rollback-${process.pid}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}.json`);
-      (0, import_node_fs37.writeFileSync)(tmp, JSON.stringify(contentPutBody(seed.target, preSeedContent, plan.branch, existingSha)), "utf8");
+      const tmp = (0, import_node_path36.join)((0, import_node_os16.tmpdir)(), `mmi-rollback-${process.pid}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}.json`);
+      (0, import_node_fs38.writeFileSync)(tmp, JSON.stringify(contentPutBody(seed.target, preSeedContent, plan.branch, existingSha)), "utf8");
       try {
         await gh(contentPutInputArgs(repo, seed.target, tmp));
       } finally {
         try {
-          (0, import_node_fs37.unlinkSync)(tmp);
+          (0, import_node_fs38.unlinkSync)(tmp);
         } catch {
         }
       }
@@ -30017,12 +30455,12 @@ Rollback: \`mmi-cli devops bootstrap rollback ${rec.repo} --target ${seed.target
 }
 
 // src/stage-commands.ts
-var import_node_fs39 = require("node:fs");
-var import_node_path37 = require("node:path");
+var import_node_fs40 = require("node:fs");
+var import_node_path38 = require("node:path");
 
 // src/port-registry.ts
-var import_node_fs38 = require("node:fs");
-var import_node_path36 = require("node:path");
+var import_node_fs39 = require("node:fs");
+var import_node_path37 = require("node:path");
 
 // ../infra/port-geometry.mjs
 var PORT_BLOCK = 100;
@@ -30036,8 +30474,8 @@ function nextPortBlock(registry2) {
   return [base, base + PORT_SPAN];
 }
 function loadPortRegistry(path2) {
-  if (!(0, import_node_fs38.existsSync)(path2)) return {};
-  const raw = JSON.parse((0, import_node_fs38.readFileSync)(path2, "utf8"));
+  if (!(0, import_node_fs39.existsSync)(path2)) return {};
+  const raw = JSON.parse((0, import_node_fs39.readFileSync)(path2, "utf8"));
   const out = {};
   for (const [key, value] of Object.entries(raw)) {
     if (Array.isArray(value) && value.length === 2 && value.every((n) => typeof n === "number")) {
@@ -30051,9 +30489,9 @@ function ensurePortRange(repo, path2) {
   const existing = registry2[repo];
   if (existing) return existing;
   const range = nextPortBlock(registry2);
-  const raw = (0, import_node_fs38.existsSync)(path2) ? JSON.parse((0, import_node_fs38.readFileSync)(path2, "utf8")) : {};
+  const raw = (0, import_node_fs39.existsSync)(path2) ? JSON.parse((0, import_node_fs39.readFileSync)(path2, "utf8")) : {};
   raw[repo] = range;
-  (0, import_node_fs38.writeFileSync)(path2, JSON.stringify(raw, null, 2) + "\n", "utf8");
+  (0, import_node_fs39.writeFileSync)(path2, JSON.stringify(raw, null, 2) + "\n", "utf8");
   return range;
 }
 function portCursorSeed(registry2) {
@@ -30075,22 +30513,22 @@ function existingPortRange(repo, registry2) {
   return registry2[repo] ?? null;
 }
 function portRangeInfraAt(root, source) {
-  const registryPath = (0, import_node_path36.join)(root, "infra", "port-ranges.json");
-  const ddbScriptPath = (0, import_node_path36.join)(root, "infra", "port-ddb.mjs");
-  if (!(0, import_node_fs38.existsSync)(registryPath) || !(0, import_node_fs38.existsSync)(ddbScriptPath)) return null;
+  const registryPath = (0, import_node_path37.join)(root, "infra", "port-ranges.json");
+  const ddbScriptPath = (0, import_node_path37.join)(root, "infra", "port-ddb.mjs");
+  if (!(0, import_node_fs39.existsSync)(registryPath) || !(0, import_node_fs39.existsSync)(ddbScriptPath)) return null;
   return { root, source, registryPath, ddbScriptPath };
 }
 function resolvePortRangeInfra(cwd, packageDir) {
   const direct = portRangeInfraAt(cwd, "cwd");
   if (direct) return direct;
-  for (let dir = cwd; ; dir = (0, import_node_path36.dirname)(dir)) {
-    const sibling = portRangeInfraAt((0, import_node_path36.join)(dir, "MMI-Hub"), "sibling-hub");
+  for (let dir = cwd; ; dir = (0, import_node_path37.dirname)(dir)) {
+    const sibling = portRangeInfraAt((0, import_node_path37.join)(dir, "MMI-Hub"), "sibling-hub");
     if (sibling) return sibling;
-    const parent = (0, import_node_path36.dirname)(dir);
+    const parent = (0, import_node_path37.dirname)(dir);
     if (parent === dir) break;
   }
   if (packageDir) {
-    const pkgRoot = (0, import_node_path36.join)(packageDir, "..", "..");
+    const pkgRoot = (0, import_node_path37.join)(packageDir, "..", "..");
     const pkgFrom = portRangeInfraAt(pkgRoot, "pkg-root");
     if (pkgFrom) return pkgFrom;
   }
@@ -30284,8 +30722,8 @@ function registerStageCommands(program3) {
     const portRange = portRangeMeta && typeof portRangeMeta.start === "number" && typeof portRangeMeta.end === "number" ? [portRangeMeta.start, portRangeMeta.end] : void 0;
     return decideStage({
       registry: { deployModel: project2?.deployModel, portRange, error: read.ok ? void 0 : read.error },
-      hasCompose: (0, import_node_fs39.existsSync)((0, import_node_path37.join)(process.cwd(), "docker-compose.yml")),
-      hasEnvExample: (0, import_node_fs39.existsSync)((0, import_node_path37.join)(process.cwd(), ".env.example"))
+      hasCompose: (0, import_node_fs40.existsSync)((0, import_node_path38.join)(process.cwd(), "docker-compose.yml")),
+      hasEnvExample: (0, import_node_fs40.existsSync)((0, import_node_path38.join)(process.cwd(), ".env.example"))
     });
   }
   async function fetchStageVaultEnvMerge() {
@@ -30776,10 +31214,10 @@ function registerBoardCommands(program3) {
 }
 
 // src/merge-cleanup.ts
-var import_node_fs40 = require("node:fs");
+var import_node_fs41 = require("node:fs");
 var import_promises9 = require("node:fs/promises");
-var import_node_path39 = require("node:path");
-var import_node_os16 = require("node:os");
+var import_node_path40 = require("node:path");
+var import_node_os17 = require("node:os");
 var import_node_child_process17 = require("node:child_process");
 
 // src/board-advance.ts
@@ -30866,7 +31304,7 @@ function boardAdvanceFailureMessage(result) {
 
 // src/deferred-registry-store.ts
 var import_promises8 = require("node:fs/promises");
-var import_node_path38 = require("node:path");
+var import_node_path39 = require("node:path");
 var sleep2 = (ms) => new Promise((resolve7) => setTimeout(resolve7, ms));
 async function atomicWrite(target, contents) {
   const tmp = `${target}.tmp-${process.pid}-${Math.random().toString(36).slice(2)}`;
@@ -30917,12 +31355,12 @@ function makeDeferredWorktreeStore(registryPath, lockOpts = {}) {
     },
     // Standalone atomic write — THROWS on failure (no best-effort swallow, #2846).
     write: async (entries) => {
-      await (0, import_promises8.mkdir)((0, import_node_path38.dirname)(registryPath), { recursive: true });
+      await (0, import_promises8.mkdir)((0, import_node_path39.dirname)(registryPath), { recursive: true });
       await atomicWrite(registryPath, serializeDeferredWorktrees(entries));
     },
     // Serialized read-modify-write under the repo-wide lock (#2846).
     update: async (mutate) => {
-      await (0, import_promises8.mkdir)((0, import_node_path38.dirname)(registryPath), { recursive: true });
+      await (0, import_promises8.mkdir)((0, import_node_path39.dirname)(registryPath), { recursive: true });
       const deadline = Date.now() + opts.maxWaitMs;
       for (; ; ) {
         const guard = await acquireLock(lockPath, opts, deadline);
@@ -31086,17 +31524,17 @@ ${err.stderr ?? ""}`;
     return { step, status: `failed: ${msg}` };
   }
 }
-async function bestEffortCloseMissingWorktreeLeases(leaseDir = (0, import_node_path39.join)((0, import_node_os16.homedir)(), ".jerv", "leases"), exists = import_node_fs40.existsSync) {
+async function bestEffortCloseMissingWorktreeLeases(leaseDir = (0, import_node_path40.join)((0, import_node_os17.homedir)(), ".jerv", "leases"), exists = import_node_fs41.existsSync) {
   let names = [];
   try {
-    names = (0, import_node_fs40.readdirSync)(leaseDir);
+    names = (0, import_node_fs41.readdirSync)(leaseDir);
   } catch {
     return;
   }
   for (const name of names) {
     if (!name.endsWith(".json")) continue;
     try {
-      const rec = JSON.parse((0, import_node_fs40.readFileSync)((0, import_node_path39.join)(leaseDir, name), "utf8"));
+      const rec = JSON.parse((0, import_node_fs41.readFileSync)((0, import_node_path40.join)(leaseDir, name), "utf8"));
       if (rec.kind !== "worktree" || rec.state === "closed" || typeof rec.ref !== "string" || !rec.ref.trim()) continue;
       if (!exists(rec.ref)) await bestEffortLeaseClose(rec.ref);
     } catch {
@@ -31110,7 +31548,7 @@ async function applyGcPlan(plan, remote, opts = {}) {
   );
   const repoRoot2 = (await execFileP2("git", ["rev-parse", "--show-toplevel"], { timeout: GIT_TIMEOUT_MS }).catch(() => ({ stdout: "" }))).stdout.trim() || process.cwd();
   const worktreeGitRoot = await currentRepoWorktreeGitRoot(repoRoot2);
-  const primaryRepoRoot = worktreeGitRoot ? (0, import_node_path39.dirname)((0, import_node_path39.dirname)(worktreeGitRoot)) : repoRoot2;
+  const primaryRepoRoot = worktreeGitRoot ? (0, import_node_path40.dirname)((0, import_node_path40.dirname)(worktreeGitRoot)) : repoRoot2;
   const gcActor = describeActor({ env: process.env, surface: detectSurface(process.env), cwd: process.cwd() });
   const owners = readWorktreeOwners(primaryRepoRoot);
   const removalNow = Date.now();
@@ -31169,7 +31607,7 @@ async function applyGcPlan(plan, remote, opts = {}) {
       const cleanup = await cleanupPrMergeLocalBranch(branch.branch, {
         beforeWorktrees,
         startingPath: branch.worktreePath,
-        pathExists: (p) => (0, import_node_fs40.existsSync)(p),
+        pathExists: (p) => (0, import_node_fs41.existsSync)(p),
         execGit: async (args) => (await execFileP2("git", args, { timeout: GIT_TIMEOUT_MS })).stdout,
         teardownWorktreeStage,
         deferredStore,
@@ -31208,7 +31646,7 @@ async function applyGcPlan(plan, remote, opts = {}) {
     let removalAttempted = false;
     try {
       const cleanupTarget = resolveSafeSiblingWorktreeCleanupTarget(wt.path, cleanupRoots, {
-        realpath: (path2) => (0, import_node_fs40.realpathSync)(path2)
+        realpath: (path2) => (0, import_node_fs41.realpathSync)(path2)
       });
       if (!cleanupTarget.ok) {
         result.failed.push(`${wt.path}: ${cleanupTarget.reason}`);
@@ -31310,13 +31748,13 @@ async function composeOverrideBodyFile(prNumber, repoArgs, gh) {
     const commits = JSON.parse(raw).commits ?? [];
     const body = squashBodyWithOverride(commits.map((c) => ({ headline: c.messageHeadline ?? "", body: c.messageBody ?? "" })), process.cwd());
     if (!body) return void 0;
-    const dir = (0, import_node_fs40.mkdtempSync)((0, import_node_path39.join)((0, import_node_os16.tmpdir)(), "mmi-squash-body-"));
-    const path2 = (0, import_node_path39.join)(dir, "body.txt");
-    (0, import_node_fs40.writeFileSync)(path2, `${body}
+    const dir = (0, import_node_fs41.mkdtempSync)((0, import_node_path40.join)((0, import_node_os17.tmpdir)(), "mmi-squash-body-"));
+    const path2 = (0, import_node_path40.join)(dir, "body.txt");
+    (0, import_node_fs41.writeFileSync)(path2, `${body}
 `, "utf8");
     return { path: path2, cleanup: () => {
       try {
-        (0, import_node_fs40.rmSync)(dir, { recursive: true, force: true });
+        (0, import_node_fs41.rmSync)(dir, { recursive: true, force: true });
       } catch {
       }
     } };
@@ -31439,13 +31877,13 @@ var realWorktreeDirRemover = {
     const target = win32LongPath(p);
     let st;
     try {
-      st = (0, import_node_fs40.lstatSync)(target);
+      st = (0, import_node_fs41.lstatSync)(target);
     } catch {
       return null;
     }
     if (st.isSymbolicLink()) return "link";
     try {
-      (0, import_node_fs40.readlinkSync)(target);
+      (0, import_node_fs41.readlinkSync)(target);
       return "link";
     } catch {
     }
@@ -31453,7 +31891,7 @@ var realWorktreeDirRemover = {
   },
   readdir: (p) => {
     try {
-      return (0, import_node_fs40.readdirSync)(win32LongPath(p));
+      return (0, import_node_fs41.readdirSync)(win32LongPath(p));
     } catch {
       return [];
     }
@@ -31463,9 +31901,9 @@ var realWorktreeDirRemover = {
   detachLink: (p) => {
     const target = win32LongPath(p);
     try {
-      (0, import_node_fs40.rmdirSync)(target);
+      (0, import_node_fs41.rmdirSync)(target);
     } catch {
-      (0, import_node_fs40.unlinkSync)(target);
+      (0, import_node_fs41.unlinkSync)(target);
     }
   },
   // #4904: Windows MAX_PATH aborts git worktree remove; the fallback must use \\?\ so the dir
@@ -31488,7 +31926,7 @@ function worktreeRemoveDeps(execGit) {
     detachReparsePoints: (worktreePath) => detachReparsePoints(worktreePath, realWorktreeDirRemover),
     removeWorktreeDir: async (worktreePath) => removeWorktreeTree(worktreePath, await resolvePrimaryCheckout(execGit), realWorktreeDirRemover),
     // #4850: verify the directory is actually gone before any caller reports completion.
-    pathExists: (worktreePath) => (0, import_node_fs40.existsSync)(worktreePath)
+    pathExists: (worktreePath) => (0, import_node_fs41.existsSync)(worktreePath)
   };
 }
 async function worktreeHasStageState(worktreePath) {
@@ -31502,9 +31940,9 @@ async function worktreeHasStageState(worktreePath) {
   }
 }
 function stageStateFileBelongsToWorktree(statePath, worktreePath) {
-  if (!(0, import_node_fs40.existsSync)(statePath)) return false;
+  if (!(0, import_node_fs41.existsSync)(statePath)) return false;
   try {
-    const state = JSON.parse((0, import_node_fs40.readFileSync)(statePath, "utf8"));
+    const state = JSON.parse((0, import_node_fs41.readFileSync)(statePath, "utf8"));
     const recordedCwd = typeof state.identity?.cwd === "string" ? state.identity.cwd : typeof state.cwd === "string" ? state.cwd : "";
     return Boolean(recordedCwd && isPathUnderDirectory2(recordedCwd, worktreePath));
   } catch {
@@ -31939,15 +32377,15 @@ async function checkDocsIndexAtHead(opts, deps) {
 }
 
 // src/worktree-lifecycle-commands.ts
-var import_node_fs42 = require("node:fs");
+var import_node_fs43 = require("node:fs");
 var import_promises10 = require("node:fs/promises");
-var import_node_os17 = require("node:os");
-var import_node_path41 = require("node:path");
+var import_node_os18 = require("node:os");
+var import_node_path42 = require("node:path");
 
 // src/worktree-install-cache.ts
-var import_node_crypto8 = require("node:crypto");
-var import_node_fs41 = require("node:fs");
-var import_node_path40 = require("node:path");
+var import_node_crypto9 = require("node:crypto");
+var import_node_fs42 = require("node:fs");
+var import_node_path41 = require("node:path");
 var CACHE_DIR = "worktree-install-cache";
 var MANIFEST = "manifest.json";
 var NODE_MODULES2 = "node_modules";
@@ -31960,24 +32398,24 @@ var LOCKFILE_NAMES = [
   "package-lock.json"
 ];
 var realWorktreeInstallCacheFs = {
-  exists: import_node_fs41.existsSync,
-  readFile: (path2) => (0, import_node_fs41.readFileSync)(path2, "utf8"),
-  lstat: (path2) => (0, import_node_fs41.lstatSync)(path2),
-  copyDir: (from, to) => (0, import_node_fs41.cpSync)(from, to, { recursive: true, force: true }),
+  exists: import_node_fs42.existsSync,
+  readFile: (path2) => (0, import_node_fs42.readFileSync)(path2, "utf8"),
+  lstat: (path2) => (0, import_node_fs42.lstatSync)(path2),
+  copyDir: (from, to) => (0, import_node_fs42.cpSync)(from, to, { recursive: true, force: true }),
   mkdirp: (path2) => {
-    (0, import_node_fs41.mkdirSync)(path2, { recursive: true });
+    (0, import_node_fs42.mkdirSync)(path2, { recursive: true });
   },
-  writeFile: (path2, contents) => (0, import_node_fs41.writeFileSync)(path2, contents, "utf8"),
+  writeFile: (path2, contents) => (0, import_node_fs42.writeFileSync)(path2, contents, "utf8"),
   rm: (path2) => {
-    (0, import_node_fs41.rmSync)(path2, { recursive: true, force: true });
+    (0, import_node_fs42.rmSync)(path2, { recursive: true, force: true });
   }
 };
 function hashLockfileBytes(contents) {
-  return (0, import_node_crypto8.createHash)("sha256").update(contents).digest("hex");
+  return (0, import_node_crypto9.createHash)("sha256").update(contents).digest("hex");
 }
 function resolveWorktreeInstallLockfile(packageDir, fs2 = realWorktreeInstallCacheFs) {
   for (const name of LOCKFILE_NAMES) {
-    const path2 = (0, import_node_path40.join)(packageDir, name);
+    const path2 = (0, import_node_path41.join)(packageDir, name);
     if (!fs2.exists(path2)) continue;
     try {
       const hash = hashLockfileBytes(fs2.readFile(path2));
@@ -31992,8 +32430,8 @@ function worktreeInstallCacheEntry(primaryRoot, lockfileHash) {
   const root = repoRuntimeStatePath(primaryRoot, CACHE_DIR, lockfileHash);
   return {
     root,
-    manifestPath: (0, import_node_path40.join)(root, MANIFEST),
-    nodeModulesPath: (0, import_node_path40.join)(root, NODE_MODULES2)
+    manifestPath: (0, import_node_path41.join)(root, MANIFEST),
+    nodeModulesPath: (0, import_node_path41.join)(root, NODE_MODULES2)
   };
 }
 function readWorktreeInstallCacheManifest(manifestPath, fs2 = realWorktreeInstallCacheFs) {
@@ -32033,7 +32471,7 @@ function invalidateWorktreeInstallCacheEntry(entry, fs2 = realWorktreeInstallCac
   }
 }
 function removeMaterializedTree(packageDir, fs2) {
-  const dest = (0, import_node_path40.join)(packageDir, NODE_MODULES2);
+  const dest = (0, import_node_path41.join)(packageDir, NODE_MODULES2);
   if (!fs2.exists(dest)) return;
   fs2.rm(dest);
   if (fs2.exists(dest)) {
@@ -32041,7 +32479,7 @@ function removeMaterializedTree(packageDir, fs2) {
   }
 }
 function materializeCachedNodeModules(entry, destPackageDir, fs2 = realWorktreeInstallCacheFs) {
-  const dest = (0, import_node_path40.join)(destPackageDir, NODE_MODULES2);
+  const dest = (0, import_node_path41.join)(destPackageDir, NODE_MODULES2);
   try {
     if (fs2.exists(dest)) fs2.rm(dest);
     fs2.mkdirp(destPackageDir);
@@ -32056,7 +32494,7 @@ function materializeCachedNodeModules(entry, destPackageDir, fs2 = realWorktreeI
   }
 }
 async function storeWorktreeInstallCacheEntry(primaryRoot, lockfile, command, sourcePackageDir, fs2 = realWorktreeInstallCacheFs, now = Date.now()) {
-  const source = (0, import_node_path40.join)(sourcePackageDir, NODE_MODULES2);
+  const source = (0, import_node_path41.join)(sourcePackageDir, NODE_MODULES2);
   if (!isMaterializableNodeModulesDir(source, fs2)) return;
   const entry = worktreeInstallCacheEntry(primaryRoot, lockfile.hash);
   const manifest = {
@@ -32340,7 +32778,7 @@ function classifyStaleLeaks(input) {
 var defaultOrphanDirScanDeps = {
   listDirs: (root) => {
     try {
-      return (0, import_node_fs42.readdirSync)(root, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => (0, import_node_path41.join)(root, e.name));
+      return (0, import_node_fs43.readdirSync)(root, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => (0, import_node_path42.join)(root, e.name));
     } catch {
       return [];
     }
@@ -32530,13 +32968,13 @@ function registerWorktreeCommands(program3) {
       const detached = headBorn && !symbolicBranch;
       const branch = symbolicBranch || (detached ? "HEAD" : "");
       if (!wtPath || !branch) return fail("worktree land: not inside a git worktree");
-      const gitFile = (0, import_node_path41.join)(wtPath, ".git");
-      const isLinked = (0, import_node_fs42.existsSync)(gitFile) && (0, import_node_fs42.statSync)(gitFile).isFile();
+      const gitFile = (0, import_node_path42.join)(wtPath, ".git");
+      const isLinked = (0, import_node_fs43.existsSync)(gitFile) && (0, import_node_fs43.statSync)(gitFile).isFile();
       if (apply && !isLinked) {
         return fail("worktree land: run from inside the linked worktree you want to land (this is the primary checkout)");
       }
       const commonDir = (await execFileP2("git", ["rev-parse", "--git-common-dir"], { timeout: GIT_TIMEOUT_MS }).catch(() => ({ stdout: "" }))).stdout.trim();
-      const primaryCheckout = commonDir ? (0, import_node_path41.dirname)(commonDir) : wtPath;
+      const primaryCheckout = commonDir ? (0, import_node_path42.dirname)(commonDir) : wtPath;
       const localBranchNames = await execFileP2("git", ["-C", primaryCheckout, "for-each-ref", "--format=%(refname:short)", "refs/heads"], { timeout: GIT_TIMEOUT_MS }).then(({ stdout }) => new Set((stdout || "").split("\n").map((l) => l.trim()).filter(Boolean))).catch(() => void 0);
       const orphan = classifyOrphanedWorktree({
         branch,
@@ -32796,7 +33234,7 @@ async function gatherWorktreeContext() {
   const porcelain = (await execFileP2("git", ["worktree", "list", "--porcelain"], { timeout: GIT_TIMEOUT_MS }).catch(() => ({ stdout: "" }))).stdout;
   const parsed = parseWorktreePorcelain(porcelain);
   const primaryPath = parsed[0]?.path ?? repoRoot2;
-  const worktrees = parsed.map((w) => ({ path: (0, import_node_path41.resolve)(toNativePath(w.path)), branch: w.branch, primary: w.path === primaryPath }));
+  const worktrees = parsed.map((w) => ({ path: (0, import_node_path42.resolve)(toNativePath(w.path)), branch: w.branch, primary: w.path === primaryPath }));
   const branchOut = (await execFileP2("git", ["branch", "--format=%(refname:short)"], { timeout: GIT_TIMEOUT_MS }).catch(() => ({ stdout: "" }))).stdout;
   const localBranches = branchOut.split(/\r?\n/).map((l) => l.trim()).filter(Boolean);
   const currentBranch2 = (await execFileP2("git", ["rev-parse", "--abbrev-ref", "HEAD"], { timeout: GIT_TIMEOUT_MS }).catch(() => ({ stdout: "" }))).stdout.trim() || void 0;
@@ -32834,17 +33272,17 @@ async function gatherWorktreeContext() {
     if (s) stages.push({ path: wt.path, port: s.port });
   }
   const worktreeGitRoot = await currentRepoWorktreeGitRoot(repoRoot2);
-  const primaryRepoRoot = worktreeGitRoot ? (0, import_node_path41.dirname)((0, import_node_path41.dirname)(worktreeGitRoot)) : repoRoot2;
+  const primaryRepoRoot = worktreeGitRoot ? (0, import_node_path42.dirname)((0, import_node_path42.dirname)(worktreeGitRoot)) : repoRoot2;
   const wtRoot = siblingMmiWorktreesRoot(primaryRepoRoot);
   let orphanDirs = [];
-  if ((0, import_node_fs42.existsSync)(wtRoot)) {
+  if ((0, import_node_fs43.existsSync)(wtRoot)) {
     orphanDirs = scanOrphanDirs(wtRoot, worktreeGitRoot, {
       ...defaultOrphanDirScanDeps,
       listDirs: (root) => worktreeScanDirs(root, primaryRepoRoot, defaultOrphanDirScanDeps.listDirs, isRepoCheckoutDir)
     });
   }
   const repoContainer = worktreesRootOf(primaryRepoRoot);
-  if ((0, import_node_fs42.existsSync)(repoContainer)) {
+  if ((0, import_node_fs43.existsSync)(repoContainer)) {
     for (const dir of defaultOrphanDirScanDeps.listDirs(repoContainer)) {
       if (orphanDirs.some((o) => o.path === dir)) continue;
       const inspected = inspectSiblingWorktreeDir(dir, worktreeGitRoot);
@@ -32868,7 +33306,7 @@ async function gatherWorktreeContext() {
   });
   const helperWorktrees = scanHelperWorktrees(primaryRepoRoot, worktreeGitRoot);
   const leaseRefs = readJervWorktreeLeaseRefs();
-  const missingLeaseRefs = leaseRefs.filter((ref) => !(0, import_node_fs42.existsSync)(ref));
+  const missingLeaseRefs = leaseRefs.filter((ref) => !(0, import_node_fs43.existsSync)(ref));
   const remoteUrls = await gitRemoteUrls();
   const otherCheckouts = discoverOtherPrimaries(primaryRepoRoot).map((path2) => ({
     path: path2,
@@ -32898,16 +33336,16 @@ async function gatherWorktreeContext() {
   };
 }
 function gitConfigRemoteUrls(checkout) {
-  const gitPath = (0, import_node_path41.join)(checkout, ".git");
-  let configPath = (0, import_node_path41.join)(checkout, ".git", "config");
+  const gitPath = (0, import_node_path42.join)(checkout, ".git");
+  let configPath = (0, import_node_path42.join)(checkout, ".git", "config");
   try {
-    const st = (0, import_node_fs42.statSync)(gitPath);
+    const st = (0, import_node_fs43.statSync)(gitPath);
     if (st.isFile()) return [];
   } catch {
     return [];
   }
   try {
-    const text = (0, import_node_fs42.readFileSync)(configPath, "utf8");
+    const text = (0, import_node_fs43.readFileSync)(configPath, "utf8");
     return [...text.matchAll(/^\s*url\s*=\s*(.+)$/gm)].map((m) => m[1].trim());
   } catch {
     return [];
@@ -32921,26 +33359,26 @@ async function gitRemoteUrls() {
 }
 function discoverOtherPrimaries(primaryRepoRoot) {
   const found = /* @__PURE__ */ new Set();
-  const parent = (0, import_node_path41.dirname)(primaryRepoRoot);
+  const parent = (0, import_node_path42.dirname)(primaryRepoRoot);
   try {
-    for (const name of (0, import_node_fs42.readdirSync)(parent)) {
-      const path2 = (0, import_node_path41.join)(parent, name);
+    for (const name of (0, import_node_fs43.readdirSync)(parent)) {
+      const path2 = (0, import_node_path42.join)(parent, name);
       if (path2 === primaryRepoRoot) continue;
-      if ((0, import_node_fs42.existsSync)((0, import_node_path41.join)(path2, ".git"))) found.add(path2);
+      if ((0, import_node_fs43.existsSync)((0, import_node_path42.join)(path2, ".git"))) found.add(path2);
     }
   } catch {
   }
-  const mirror = (0, import_node_path41.join)((0, import_node_os17.homedir)(), "Projects", (0, import_node_path41.basename)(primaryRepoRoot));
-  if (mirror !== primaryRepoRoot && (0, import_node_fs42.existsSync)((0, import_node_path41.join)(mirror, ".git"))) found.add(mirror);
+  const mirror = (0, import_node_path42.join)((0, import_node_os18.homedir)(), "Projects", (0, import_node_path42.basename)(primaryRepoRoot));
+  if (mirror !== primaryRepoRoot && (0, import_node_fs43.existsSync)((0, import_node_path42.join)(mirror, ".git"))) found.add(mirror);
   return [...found];
 }
-function readJervWorktreeLeaseRefs(leaseDir = (0, import_node_path41.join)((0, import_node_os17.homedir)(), ".jerv", "leases")) {
+function readJervWorktreeLeaseRefs(leaseDir = (0, import_node_path42.join)((0, import_node_os18.homedir)(), ".jerv", "leases")) {
   try {
     const refs = [];
-    for (const name of (0, import_node_fs42.readdirSync)(leaseDir)) {
+    for (const name of (0, import_node_fs43.readdirSync)(leaseDir)) {
       if (!name.endsWith(".json")) continue;
       try {
-        const rec = JSON.parse((0, import_node_fs42.readFileSync)((0, import_node_path41.join)(leaseDir, name), "utf8"));
+        const rec = JSON.parse((0, import_node_fs43.readFileSync)((0, import_node_path42.join)(leaseDir, name), "utf8"));
         if (rec.kind === "worktree" && rec.state !== "closed" && typeof rec.ref === "string" && rec.ref.trim()) {
           refs.push(rec.ref);
         }
@@ -32956,9 +33394,9 @@ function scanHelperWorktrees(thisPrimary, thisWorktreeGitRoot) {
   const primaries = [thisPrimary, ...discoverOtherPrimaries(thisPrimary)];
   const out = [];
   for (const primary of primaries) {
-    const gitRoot = primary === thisPrimary ? thisWorktreeGitRoot : (0, import_node_path41.join)(primary, ".git", "worktrees");
+    const gitRoot = primary === thisPrimary ? thisWorktreeGitRoot : (0, import_node_path42.join)(primary, ".git", "worktrees");
     for (const root of helperWorktreeRoots(primary)) {
-      if (!(0, import_node_fs42.existsSync)(root)) continue;
+      if (!(0, import_node_fs43.existsSync)(root)) continue;
       for (const dir of defaultOrphanDirScanDeps.listDirs(root)) {
         const inspected = inspectSiblingWorktreeDir(dir, gitRoot);
         const classified = classifySiblingWorktreeDir(inspected);
@@ -32998,8 +33436,8 @@ ${err.stderr ?? ""}`;
 }
 
 // src/issue-commands.ts
-var import_node_fs43 = require("node:fs");
-var import_node_crypto9 = require("node:crypto");
+var import_node_fs44 = require("node:fs");
+var import_node_crypto10 = require("node:crypto");
 var ghRunner = async (args, timeoutMs) => (await execFileP2("gh", args, { timeout: timeoutMs })).stdout;
 var ReparentConflictError = class extends Error {
   constructor(message, payload) {
@@ -33016,7 +33454,7 @@ async function editIssue(client, options, deps = {}) {
   const url = `https://github.com/${repo}/issues/${parsed.number}`;
   const patch = {};
   let bodyChanged = false;
-  const textDeps = () => deps.textDeps ?? { readFile: (p, e) => Promise.resolve((0, import_node_fs43.readFileSync)(p, e)), readStdin: () => Promise.resolve("") };
+  const textDeps = () => deps.textDeps ?? { readFile: (p, e) => Promise.resolve((0, import_node_fs44.readFileSync)(p, e)), readStdin: () => Promise.resolve("") };
   if (options.titleFile !== void 0) {
     patch.title = await resolveIssueTitle({ title: options.title, titleFile: options.titleFile }, textDeps());
   } else if (options.title !== void 0) {
@@ -33290,7 +33728,7 @@ function rowIdempotencyKey(batchKey, spec) {
   const identity = `${spec.type}
 ${spec.title.trim()}
 ${spec.body ?? ""}`;
-  const hash = (0, import_node_crypto9.createHash)("sha256").update(identity).digest("hex").slice(0, 16);
+  const hash = (0, import_node_crypto10.createHash)("sha256").update(identity).digest("hex").slice(0, 16);
   return `${batchKey}:${hash}`;
 }
 var BATCH_SPEC_KEYS = /* @__PURE__ */ new Set(["type", "title", "body", "priority", "labels", "label", "parent", "repo", "surface"]);
@@ -33621,7 +34059,7 @@ function extendCreateCommand(issue2, batchAttach) {
     if (opts.batch) {
       let specs;
       try {
-        const raw = (0, import_node_fs43.readFileSync)(opts.batch, "utf8");
+        const raw = (0, import_node_fs44.readFileSync)(opts.batch, "utf8");
         specs = JSON.parse(raw);
         if (!Array.isArray(specs)) throw new Error("batch file must contain a JSON array");
       } catch (e) {
@@ -33696,8 +34134,8 @@ ${lines}`, {
 }
 
 // src/train-commands.ts
-var import_node_fs44 = require("node:fs");
-var import_node_path42 = require("node:path");
+var import_node_fs45 = require("node:fs");
+var import_node_path43 = require("node:path");
 var RELEASE_BUMP_INTENTS = ["major", "minor", "patch"];
 function resolveReleaseBumpIntent(raw) {
   const intent = typeof raw === "string" ? raw.trim() : "";
@@ -33708,7 +34146,7 @@ function resolveReleaseBumpIntent(raw) {
 }
 function readRepoVersion() {
   try {
-    return JSON.parse((0, import_node_fs44.readFileSync)((0, import_node_path42.join)(process.cwd(), ".claude-plugin", "plugin.json"), "utf8")).version || void 0;
+    return JSON.parse((0, import_node_fs45.readFileSync)((0, import_node_path43.join)(process.cwd(), ".claude-plugin", "plugin.json"), "utf8")).version || void 0;
   } catch {
     return void 0;
   }
@@ -33865,9 +34303,9 @@ function registerDeployCommands(program3) {
 }
 
 // src/discovery-commands.ts
-var import_node_fs45 = require("node:fs");
-var import_node_os18 = require("node:os");
-var import_node_path43 = require("node:path");
+var import_node_fs46 = require("node:fs");
+var import_node_os19 = require("node:os");
+var import_node_path44 = require("node:path");
 var GC_GH_TIMEOUT_MS3 = 2e4;
 async function collectStatus() {
   const repo = await resolveRepo();
@@ -33969,7 +34407,7 @@ function onboardPluginGate(deps) {
     declared,
     settingsDeclared: readSettingsAutoUpdate(deps.readSettings(), MMI_MARKETPLACE_NAME)
   }).effective;
-  return autoUpdate ? { ok: false, detail: "background auto-update is ON \u2014 duplicate writer; run `mmi-updater reconcile` outside Claude Code to disable it" } : { ok: true, detail: "background auto-update off; mmi-updater is the single release-gated writer" };
+  return autoUpdate ? { ok: false, detail: "background auto-update is ON \u2014 duplicate writer; run `mmi-hub update` outside Claude Code to disable it" } : { ok: true, detail: "background auto-update off; mmi-hub is the single release-gated writer" };
 }
 async function collectOnboardStatus(opts = {}) {
   const cfg = await loadConfig();
@@ -34051,10 +34489,10 @@ async function collectOnboardStatus(opts = {}) {
     else if (top) nextCommand = `mmi-cli oracle board claim ${top.number}  # ${top.title}`;
     else nextCommand = "mmi-cli oracle board read \u2014 no claimable items found";
   }
-  const home = (0, import_node_os18.homedir)();
+  const home = (0, import_node_os19.homedir)();
   const plugin = onboardPluginGate({
-    readKnown: () => readFileSyncSafe((0, import_node_path43.join)(home, ...KNOWN_MARKETPLACES_RELATIVE), import_node_fs45.readFileSync),
-    readSettings: () => readFileSyncSafe((0, import_node_path43.join)(home, ".claude", "settings.json"), import_node_fs45.readFileSync)
+    readKnown: () => readFileSyncSafe((0, import_node_path44.join)(home, ...KNOWN_MARKETPLACES_RELATIVE), import_node_fs46.readFileSync),
+    readSettings: () => readFileSyncSafe((0, import_node_path44.join)(home, ".claude", "settings.json"), import_node_fs46.readFileSync)
   });
   return { track, board, registry: registry2, secrets, plugin, estateCli, doors: opts.doors ?? [], nextCommand };
 }
@@ -36269,13 +36707,13 @@ var surfaces_default = {
       publishVisibility: "public"
     },
     {
-      id: "mmi-updater",
+      id: "mmi-hub",
       classification: "capability",
       kind: "cli",
       ownerPath: "updater/package.json",
       deliveryPath: "updater/package.json",
       delivery: "npm",
-      applicability: "editor-agnostic agent surfaces",
+      applicability: "editor-agnostic MMI installation and maintenance; npm package @mutmutco/hub exposing mmi-hub",
       versionCoordinated: true,
       versionPaths: [
         {
@@ -36292,6 +36730,34 @@ var surfaces_default = {
       },
       publishVisibility: "public"
     },
+    {
+      id: "mmi-updater-compat",
+      classification: "packaging",
+      kind: "cli",
+      ownerPath: "packages/updater-compat/package.json",
+      deliveryPath: "packages/updater-compat/package.json",
+      delivery: "npm",
+      applicability: "one-window deprecated @mutmutco/updater / mmi-updater wrapper delegating to the exact coordinated @mutmutco/hub version",
+      versionCoordinated: true,
+      versionPaths: [
+        {
+          path: "packages/updater-compat/package.json",
+          pointer: "version"
+        },
+        {
+          path: "packages/updater-compat/package.json",
+          pointer: "dependencies.@mutmutco/hub"
+        }
+      ],
+      additionalPaths: [
+        "packages/updater-compat/dist"
+      ],
+      artifactIdentity: {
+        kind: "npm-pack",
+        packagePath: "packages/updater-compat"
+      },
+      publishVisibility: "public"
+    },
     {
       id: "mmi-cli-lock",
       classification: "packaging",
@@ -36753,7 +37219,7 @@ function checkCliVersion(input, releasedNote) {
       warn: true,
       label: "mmi-cli",
       detail: `${report.currentVersion} \u2014 freshness UNKNOWN, the published version could not be read`,
-      fix: "check it directly: `mmi-cli --version` against `npm view @mutmutco/cli version`; update with `npm install -g @mutmutco/cli@<released>`",
+      fix: "check actual maintenance state with `mmi-hub status`; converge with `mmi-hub update`",
       verbose: evidence
     };
   }
@@ -36763,7 +37229,7 @@ function checkCliVersion(input, releasedNote) {
     ok: false,
     label: "mmi-cli",
     detail: `${report.currentVersion} \u2192 ${report.releasedVersion}`,
-    fix: report.fix,
+    fix: "run `mmi-hub update` to converge the CLI and every present host surface",
     verbose: evidence
   };
 }
@@ -36776,8 +37242,8 @@ function checkFleetDrift(probe) {
       id,
       ok: true,
       label,
-      detail: "no updater journal \u2014 no reconciler scheduled on this machine",
-      verbose: [`journal: ${probe.journalPath} (absent)`, "schedule one with `mmi-updater install` (@mutmutco/updater)"]
+      detail: "no MMI Hub maintenance journal on this machine",
+      verbose: [`journal: ${probe.journalPath} (absent)`, "bootstrap with `npm install -g @mutmutco/hub` then `mmi-hub install`"]
     };
   }
   if (probe.unreadable) {
@@ -36788,14 +37254,14 @@ function checkFleetDrift(probe) {
       warn: true,
       label,
       detail: `journal could not be read \u2014 ${probe.unreadable}`,
-      fix: `read ${probe.journalPath} directly, or re-register the reconciler with \`mmi-updater install\``,
+      fix: `read ${probe.journalPath} directly, or repair maintenance with \`mmi-hub install\``,
       verbose: [`journal: ${probe.journalPath}`, `read failed: ${probe.unreadable}`]
     };
   }
   const evidence = [
     `journal: ${probe.journalPath}${probe.lastEventAt ? ` (last event ${probe.lastEventAt})` : ""}${probe.truncated ? ` \u2014 newest ${JOURNAL_TAIL_BYTES / 1024} KiB read` : ""}`,
     `expected: ${probe.expected ?? "(no gated release recorded yet)"}`,
-    ...probe.surfaces.map((s) => `${s.surface}: installed ${s.installed ?? "unknown"} \u2014 ${s.verdict}${s.detail ? ` (${s.detail})` : ""}${s.compat ? ` [compat ${s.compat}]` : ""}`),
+    ...probe.surfaces.map((s) => `${s.surface}: last recorded ${s.installed ?? "unknown"} \u2014 ${s.verdict}${s.detail ? ` (${s.detail})` : ""}${s.compat ? ` [compat ${s.compat}]` : ""}`),
     ...probe.absent?.length ? [`absent since their last arm, skipped by the reconciler: ${probe.absent.join(", ")}`] : []
   ];
   if (!probe.expected) {
@@ -36840,7 +37306,7 @@ function checkFleetDrift(probe) {
       warn: true,
       label,
       detail: `${probe.expected} \u2014 ${probe.surfaces.length - unverified.length} converged, ${unverifiedNote}: no installed version recorded`,
-      fix: `read why in ${probe.journalPath} (each arm records its own reason) \u2014 \`mmi-updater reconcile\` retries now; doctor never installs`,
+      fix: `read why in ${probe.journalPath} (each arm records its own reason) \u2014 \`mmi-hub update\` retries now; doctor never installs`,
       verbose: evidence
     };
   }
@@ -36851,7 +37317,7 @@ function checkFleetDrift(probe) {
     label,
     ...unverified.length ? { verified: false } : {},
     detail: `${drifted.length} of ${probe.surfaces.length} surface(s) behind ${probe.expected}: ${drifted.map((s) => `${s.surface} ${s.installed}`).join(", ")}${unverifiedNote ? `; ${unverifiedNote}` : ""}`,
-    fix: `the scheduled updater converges these on its next tick \u2014 \`mmi-updater reconcile\` runs one now; doctor never installs${unverified.length ? `. The unverified surface(s) recorded no version \u2014 read their reason in ${probe.journalPath}` : ""}`,
+    fix: `hourly Hub maintenance converges these on its next tick \u2014 \`mmi-hub update\` runs one now; doctor never installs${unverified.length ? `. The unverified surface(s) recorded no version \u2014 read their reason in ${probe.journalPath}` : ""}`,
     verbose: evidence
   };
 }
@@ -37144,7 +37610,7 @@ function gcReapable(plan) {
 async function runDoctorClean(opts, io, deps) {
   const full = !opts.fast && !opts.banner && !opts.preflight;
   const applyEnv = full;
-  const applyRepo = full && opts.repoWrites !== false;
+  const applyRepo = full && opts.repoWrites === true;
   const lane = {
     banner: Boolean(opts.banner),
     fast: Boolean(opts.fast),
@@ -37259,7 +37725,7 @@ async function runDoctorClean(opts, io, deps) {
       ...cli,
       ok: false,
       detail: cli.ok ? `missing commands: ${missing.join(", ")}` : cli.detail,
-      fix: `run \`${cliUpdateCommand(released)}\` \u2014 the CLI lacks ${missing.join(", ")} (or wait for the scheduled updater's next tick)`,
+      fix: `run \`mmi-hub update\` \u2014 the CLI lacks ${missing.join(", ")} (or wait for hourly Hub maintenance)`,
       verbose: [...cli.verbose ?? [], `missing commands: ${missing.join(", ")}`]
     });
   }
@@ -37292,7 +37758,7 @@ async function runDoctorClean(opts, io, deps) {
       emitNow({ ok: true, id: "gitignore-block", label: "gitignore block", detail: "rewrote managed block", verbose: giEvidence });
       restartPending = true;
     } else {
-      emitNow({ ok: false, id: "gitignore-block", label: "gitignore block", fix: "run `mmi-cli doctor` (without --no-repo-writes) to write the org-managed .gitignore block", verbose: giEvidence });
+      emitNow({ ok: false, id: "gitignore-block", label: "gitignore block", fix: "run `mmi-cli doctor --apply` to write the org-managed .gitignore block", verbose: giEvidence });
     }
   }
   async function runPluginCacheRow() {
@@ -37715,7 +38181,7 @@ async function runDoctorClean(opts, io, deps) {
           // #3574: `${n} stale` was prepended to `fix` because the ✗ branch would not render `detail` —
           // the same fact this row already puts in `detail` on its ✓ path four lines up. One convention now.
           detail: `${n} stale`,
-          fix: "run `mmi-cli doctor` (without --no-repo-writes) to reap merged branches, stale refs, and dead worktrees",
+          fix: "run `mmi-cli doctor --apply` to reap merged branches, stale refs, and dead worktrees",
           verbose: gcEvidence
         });
       }
@@ -37733,7 +38199,7 @@ async function runDoctorClean(opts, io, deps) {
         restartPending = true;
       }
     } else {
-      emitNow(scratch.plan.safeAuto.length === 0 ? { id: "scratch", ok: true, label: "scratch", verbose: scratchEvidence } : { id: "scratch", ok: false, label: "scratch", detail: `${scratch.plan.safeAuto.length} aged item(s)`, fix: "run `mmi-cli doctor` (without --no-repo-writes)", verbose: scratchEvidence });
+      emitNow(scratch.plan.safeAuto.length === 0 ? { id: "scratch", ok: true, label: "scratch", verbose: scratchEvidence } : { id: "scratch", ok: false, label: "scratch", detail: `${scratch.plan.safeAuto.length} aged item(s)`, fix: "run `mmi-cli doctor --apply`", verbose: scratchEvidence });
     }
   }
   const prefix = [
@@ -37835,17 +38301,17 @@ function parseOriginRepo(remoteUrl) {
 }
 function ghHostsConfigPath(env, platform2) {
   const sep3 = platform2 === "win32" ? "\\" : "/";
-  const join40 = (...parts) => parts.join(sep3);
+  const join41 = (...parts) => parts.join(sep3);
   const explicit = env.GH_CONFIG_DIR?.trim();
-  if (explicit) return join40(explicit, "hosts.yml");
+  if (explicit) return join41(explicit, "hosts.yml");
   if (platform2 === "win32") {
     const appData = (env.AppData ?? env.APPDATA)?.trim();
-    return appData ? join40(appData, "GitHub CLI", "hosts.yml") : void 0;
+    return appData ? join41(appData, "GitHub CLI", "hosts.yml") : void 0;
   }
   const xdg = env.XDG_CONFIG_HOME?.trim();
-  if (xdg) return join40(xdg, "gh", "hosts.yml");
+  if (xdg) return join41(xdg, "gh", "hosts.yml");
   const home = env.HOME?.trim();
-  return home ? join40(home, ".config", "gh", "hosts.yml") : void 0;
+  return home ? join41(home, ".config", "gh", "hosts.yml") : void 0;
 }
 function parseGhHostsAccounts(yaml, host = "github.com") {
   let hostIndent = null;
@@ -37895,9 +38361,9 @@ function ghAccountCaveat(announcedLogin, accounts) {
 }
 
 // src/doctor-io.ts
-var import_node_fs46 = require("node:fs");
-var import_node_os19 = require("node:os");
-var import_node_path44 = require("node:path");
+var import_node_fs47 = require("node:fs");
+var import_node_os20 = require("node:os");
+var import_node_path45 = require("node:path");
 var import_node_child_process18 = require("node:child_process");
 var import_node_util8 = require("node:util");
 var execFileP6 = (0, import_node_util8.promisify)(import_node_child_process18.execFile);
@@ -37905,7 +38371,7 @@ var MMI_PLUGIN_ID2 = "mmi@mutmutco";
 function installedClaudePluginVersion() {
   try {
     const file = JSON.parse(
-      (0, import_node_fs46.readFileSync)((0, import_node_path44.join)((0, import_node_os19.homedir)(), ".claude", "plugins", "installed_plugins.json"), "utf8")
+      (0, import_node_fs47.readFileSync)((0, import_node_path45.join)((0, import_node_os20.homedir)(), ".claude", "plugins", "installed_plugins.json"), "utf8")
     );
     const versions = (file.plugins?.[MMI_PLUGIN_ID2] ?? []).map((r) => r.version).filter((v) => Boolean(v));
     if (versions.length === 0) return void 0;
@@ -37916,7 +38382,7 @@ function installedClaudePluginVersion() {
 }
 function manifestVersion(path2) {
   try {
-    const manifest = JSON.parse((0, import_node_fs46.readFileSync)(path2, "utf8"));
+    const manifest = JSON.parse((0, import_node_fs47.readFileSync)(path2, "utf8"));
     return typeof manifest.version === "string" && manifest.version.trim() ? manifest.version.trim() : void 0;
   } catch {
     return void 0;
@@ -37926,20 +38392,20 @@ function installedSurfacePluginVersion(surface) {
   const token = surfaceToken(surface);
   if (token === "kilo") {
     try {
-      const stamp = (0, import_node_fs46.readFileSync)((0, import_node_path44.join)((0, import_node_os19.homedir)(), ".kilo", ".mmi-kilo-version"), "utf8").trim();
+      const stamp = (0, import_node_fs47.readFileSync)((0, import_node_path45.join)((0, import_node_os20.homedir)(), ".kilo", ".mmi-kilo-version"), "utf8").trim();
       return stamp || void 0;
     } catch {
       return void 0;
     }
   }
   if (token === "cursor") {
-    return manifestVersion((0, import_node_path44.join)(cursorLocalPluginRoot(), ".cursor-plugin", "plugin.json"));
+    return manifestVersion((0, import_node_path45.join)(cursorLocalPluginRoot(), ".cursor-plugin", "plugin.json"));
   }
   if (token === "jervcode") {
     return installedJervCodePackageVersion();
   }
   if (token === "kimi") {
-    return manifestVersion((0, import_node_path44.join)(surfaceConfigRoot(surface), "plugins", "managed", "mmi", ".kimi-plugin", "plugin.json"));
+    return manifestVersion((0, import_node_path45.join)(surfaceConfigRoot(surface), "plugins", "managed", "mmi", ".kimi-plugin", "plugin.json"));
   }
   if (token === "claude") return installedClaudePluginVersion();
   if (token !== "codex") return void 0;
@@ -37977,13 +38443,13 @@ function worktreeRootSync() {
 }
 var gitignorePath = () => {
   const root = worktreeRootSync();
-  return root === null ? null : (0, import_node_path44.join)(root, ".gitignore");
+  return root === null ? null : (0, import_node_path45.join)(root, ".gitignore");
 };
 function readGitignore() {
   const path2 = gitignorePath();
   if (path2 === null) return null;
   try {
-    return (0, import_node_fs46.readFileSync)(path2, "utf8");
+    return (0, import_node_fs47.readFileSync)(path2, "utf8");
   } catch {
     return null;
   }
@@ -37992,7 +38458,7 @@ function writeGitignore(content) {
   const path2 = gitignorePath();
   if (path2 === null) return false;
   try {
-    (0, import_node_fs46.writeFileSync)(path2, content, "utf8");
+    (0, import_node_fs47.writeFileSync)(path2, content, "utf8");
     return true;
   } catch {
     return false;
@@ -38011,7 +38477,7 @@ async function repoRoot() {
 }
 function hasRepoLocalWorktrees() {
   const root = worktreeRootSync();
-  return root !== null && ((0, import_node_fs46.existsSync)((0, import_node_path44.join)(root, ".worktrees")) || (0, import_node_fs46.existsSync)((0, import_node_path44.join)(root, ".claude", "worktrees")));
+  return root !== null && ((0, import_node_fs47.existsSync)((0, import_node_path45.join)(root, ".worktrees")) || (0, import_node_fs47.existsSync)((0, import_node_path45.join)(root, ".claude", "worktrees")));
 }
 
 // src/cross-repo-filing-issue.ts
@@ -38117,8 +38583,8 @@ ${r.stderr ?? ""}`).catch(() => "");
 function ghMultiAccountCaveat(announcedLogin) {
   try {
     const hostsPath = ghHostsConfigPath(process.env, process.platform);
-    if (!hostsPath || !(0, import_node_fs47.existsSync)(hostsPath)) return void 0;
-    return ghAccountCaveat(announcedLogin, parseGhHostsAccounts((0, import_node_fs47.readFileSync)(hostsPath, "utf8")));
+    if (!hostsPath || !(0, import_node_fs48.existsSync)(hostsPath)) return void 0;
+    return ghAccountCaveat(announcedLogin, parseGhHostsAccounts((0, import_node_fs48.readFileSync)(hostsPath, "utf8")));
   } catch {
     return void 0;
   }
@@ -38126,12 +38592,12 @@ function ghMultiAccountCaveat(announcedLogin) {
 var ENV_HEAL_LOCK_STALE_MS = 10 * 6e4;
 var ENV_HEAL_LOCK_MAX_WAIT_MS = 2 * 6e4;
 function envHealLockPath(home) {
-  return (0, import_node_path45.join)(home, ".claude", "plugins", ".mmi-env-heal.lock");
+  return (0, import_node_path46.join)(home, ".claude", "plugins", ".mmi-env-heal.lock");
 }
 async function withEnvHealLock(what, run) {
   try {
     return await withFileLock(
-      envHealLockPath((0, import_node_os20.homedir)()),
+      envHealLockPath((0, import_node_os21.homedir)()),
       { staleMs: ENV_HEAL_LOCK_STALE_MS, maxWaitMs: ENV_HEAL_LOCK_MAX_WAIT_MS, label: "mmi env-heal lock" },
       run
     );
@@ -38195,9 +38661,8 @@ function mmiDoctorDeps(opts = {}) {
     pluginTrustState: () => codexHookTrustState(),
     releasedVersion: throttled ? throttled.read : fetchNpmReleasedVersion,
     releasedVersionNote: throttled ? throttled.note : void 0,
-    // #4954: the fleet reconciler's journal, read. `@mutmutco/updater` owns every npm install now, so
-    // doctor's own CLI self-update (#3272) is gone and this read is what took its place — the same
-    // journal `mmi-updater stamp` reports from, parsed here into one row.
+    // #4954/#5023: the Hub maintenance journal is read-only last-run evidence. `@mutmutco/hub`
+    // owns every version install; `mmi-hub status` separately probes actual installed state.
     fleetDrift: () => readFleetDrift(process.env),
     // #3282: the --apply self-heal for a stale/unresolved Claude plugin — the same marketplace reinstall
     // `mmi-cli plugin heal` drives. Takes effect on the next Claude reload, so the row asks for a restart.
@@ -38226,7 +38691,7 @@ function mmiDoctorDeps(opts = {}) {
       const configRoot = surfaceConfigRoot(surface);
       const running = surface === "codex" ? installedActivePluginVersion(surface) : runningPluginVersion(process.env, resolveClientVersion());
       const plan = buildPluginCachePlan(
-        (0, import_node_os20.homedir)(),
+        (0, import_node_os21.homedir)(),
         running,
         pluginCacheFsDeps(configRoot, () => 0),
         { configRoot, includeStaging: surface !== "codex" }
@@ -38250,14 +38715,14 @@ function mmiDoctorDeps(opts = {}) {
       const running = surface === "codex" ? installedActivePluginVersion(surface) : runningPluginVersion(process.env, resolveClientVersion());
       const installed = installedActivePluginVersion(surface);
       const plan = buildPluginCachePlan(
-        (0, import_node_os20.homedir)(),
+        (0, import_node_os21.homedir)(),
         running,
         pluginCacheFsDeps(configRoot, () => 0),
         { configRoot, includeStaging: surface !== "codex", installedVersion: installed }
       );
       const result = applyPluginCachePlan(
         plan,
-        (p) => (0, import_node_fs47.rmSync)(p, { recursive: true }),
+        (p) => (0, import_node_fs48.rmSync)(p, { recursive: true }),
         stagingApplyFsGuard(configRoot)
       );
       return {
@@ -38295,7 +38760,7 @@ function mmiDoctorDeps(opts = {}) {
     // adopted the generated routing index (MMG-Unlive: `docs/Archive/**` only, no index, no gate.yml) would
     // get a permanent — demanding an artifact it never asked for.
     docsIndexState: (root) => {
-      if (!(0, import_node_fs47.existsSync)((0, import_node_path45.join)(root, DOCS_INDEX_PATH))) return void 0;
+      if (!(0, import_node_fs48.existsSync)((0, import_node_path46.join)(root, DOCS_INDEX_PATH))) return void 0;
       const real = createDocsIndexDeps(root);
       let docs2;
       const listDocs = () => docs2 ??= real.listDocs();
@@ -38304,7 +38769,7 @@ function mmiDoctorDeps(opts = {}) {
     },
     // #4168: working-tree heal — write if drifted, then re-check. Commit remains the operator's step.
     healDocsIndex: (root) => {
-      if (!(0, import_node_fs47.existsSync)((0, import_node_path45.join)(root, DOCS_INDEX_PATH))) return { drift: false, docCount: 0 };
+      if (!(0, import_node_fs48.existsSync)((0, import_node_path46.join)(root, DOCS_INDEX_PATH))) return { drift: false, docCount: 0 };
       const real = createDocsIndexDeps(root);
       let docs2;
       const listDocs = () => docs2 ??= real.listDocs();
@@ -38670,19 +39135,19 @@ program2.hook("preAction", async (_thisCommand, actionCommand) => {
 });
 var rules = program2.command("rules").description("org-managed .gitignore delivery");
 rules.command("gitignore").option("--write", "upsert the managed block into .gitignore (default: check only, non-zero exit on drift)").option("--json", "machine-readable output").description("verify (or --write) this repo's org-managed .gitignore block matches the SSOT").action((opts) => {
-  const path2 = (0, import_node_path45.join)(process.cwd(), ".gitignore");
-  const current = (0, import_node_fs47.existsSync)(path2) ? (0, import_node_fs47.readFileSync)(path2, "utf8") : null;
+  const path2 = (0, import_node_path46.join)(process.cwd(), ".gitignore");
+  const current = (0, import_node_fs48.existsSync)(path2) ? (0, import_node_fs48.readFileSync)(path2, "utf8") : null;
   const plan = planManagedGitignore(current);
   const drift = [...plan.added.map((l) => `+${l}`), ...plan.removed.map((l) => `-${l}`)].join(", ") || "block normalize";
   if (opts.json) {
-    if (opts.write && plan.changed) (0, import_node_fs47.writeFileSync)(path2, plan.content, "utf8");
+    if (opts.write && plan.changed) (0, import_node_fs48.writeFileSync)(path2, plan.content, "utf8");
     console.log(JSON.stringify(plan, null, 2));
     if (!opts.write && plan.changed) process.exitCode = 1;
     return;
   }
   if (opts.write) {
     if (plan.changed) {
-      (0, import_node_fs47.writeFileSync)(path2, plan.content, "utf8");
+      (0, import_node_fs48.writeFileSync)(path2, plan.content, "utf8");
       console.log(`mmi-cli devops org rules gitignore: updated .gitignore (${drift})`);
     } else {
       console.log("mmi-cli devops org rules gitignore: up to date");
@@ -38841,8 +39306,8 @@ gcCmd.option("--dry-run", "show what would be deleted (default)").option("--appl
   if (!Number.isFinite(limit) || limit < 1) return fail("worktree gc: --limit must be a positive integer");
   let root;
   if (o.root !== void 0) {
-    root = (0, import_node_path45.resolve)(o.root);
-    if (!(0, import_node_fs47.existsSync)(root) || !(0, import_node_fs47.statSync)(root).isDirectory()) return fail(`worktree gc: --root ${o.root} is not a directory`);
+    root = (0, import_node_path46.resolve)(o.root);
+    if (!(0, import_node_fs48.existsSync)(root) || !(0, import_node_fs48.statSync)(root).isDirectory()) return fail(`worktree gc: --root ${o.root} is not a directory`);
     const gcRepoRoot = (await execFileP2("git", ["rev-parse", "--show-toplevel"], { timeout: GIT_TIMEOUT_MS }).catch(() => ({ stdout: "" }))).stdout.trim() || process.cwd();
     if (isPathUnderDirectory2(gcRepoRoot, root)) {
       return fail(`worktree gc: --root ${root} contains this checkout \u2014 name a worktrees root, not the repo or an ancestor of it`);
@@ -38941,7 +39406,7 @@ async function currentWorktreeRemovalContext(command, force) {
   };
 }
 async function unprovenWorktreeReason(wtPath, repoRoot2) {
-  if (!(0, import_node_fs47.existsSync)(wtPath)) return `${wtPath} does not exist on disk`;
+  if (!(0, import_node_fs48.existsSync)(wtPath)) return `${wtPath} does not exist on disk`;
   const porcelain = (await execFileP2("git", ["-C", repoRoot2, "worktree", "list", "--porcelain"], { timeout: GIT_TIMEOUT_MS }).catch(() => ({ stdout: "" }))).stdout;
   const registered = parseWorktreePorcelainEntries(porcelain);
   if (!registered.length) {
@@ -38971,26 +39436,26 @@ function makeProvisionDeps(worktreeRoot, quiet, log) {
 function acquireWorktreeSetupLock(worktreeRoot) {
   const lockPath = repoRuntimeStatePath(worktreeRoot, "worktree-setup.lock");
   const take = () => {
-    const fd = (0, import_node_fs47.openSync)(lockPath, "wx");
+    const fd = (0, import_node_fs48.openSync)(lockPath, "wx");
     try {
-      (0, import_node_fs47.writeSync)(fd, String(Date.now()));
+      (0, import_node_fs48.writeSync)(fd, String(Date.now()));
     } finally {
-      (0, import_node_fs47.closeSync)(fd);
+      (0, import_node_fs48.closeSync)(fd);
     }
     return () => {
       try {
-        (0, import_node_fs47.rmSync)(lockPath, { force: true });
+        (0, import_node_fs48.rmSync)(lockPath, { force: true });
       } catch {
       }
     };
   };
   try {
-    (0, import_node_fs47.mkdirSync)((0, import_node_path45.dirname)(lockPath), { recursive: true });
+    (0, import_node_fs48.mkdirSync)((0, import_node_path46.dirname)(lockPath), { recursive: true });
     return take();
   } catch {
     try {
-      if (Date.now() - (0, import_node_fs47.statSync)(lockPath).mtimeMs > WORKTREE_SETUP_LOCK_TTL_MS) {
-        (0, import_node_fs47.rmSync)(lockPath, { force: true });
+      if (Date.now() - (0, import_node_fs48.statSync)(lockPath).mtimeMs > WORKTREE_SETUP_LOCK_TTL_MS) {
+        (0, import_node_fs48.rmSync)(lockPath, { force: true });
         return take();
       }
     } catch {
@@ -39070,8 +39535,10 @@ withExamples(mutating(
       }
     };
     if (preferRemote && await revParseRef(preferRemote)) base = preferRemote;
+    const resolvedBaseOid = await revParseRef(base);
+    if (!resolvedBaseOid) return fail(`worktree create: could not resolve creation base '${base}' to an immutable commit`);
     if (!o.json) {
-      const baseSha = (await revParseRef(base))?.slice(0, 12) ?? "unresolved";
+      const baseSha = resolvedBaseOid.slice(0, 12);
       const localOnly = preferRemote && base !== preferRemote ? ` (no ${preferRemote} ? local ref)` : "";
       console.error(`  base ${base} ${baseSha}${localOnly}`);
     }
@@ -39090,23 +39557,45 @@ withExamples(mutating(
       const status = (await execFileP2("git", ["-C", wtPath, "status", "--porcelain"], { timeout: GIT_TIMEOUT_MS })).stdout.trim();
       if (status) return fail(`worktree create: refusing to resume ${wtPath} \u2014 it has uncommitted changes`);
       const head = await revParseRef(`refs/heads/${branch}`);
-      const baseOid = await revParseRef(base);
-      if (!head || !baseOid) return fail(`worktree create: could not prove '${branch}' and '${base}' before resume`);
+      const baseOid = resolvedBaseOid;
+      if (!head) return fail(`worktree create: could not prove '${branch}' and '${base}' before resume`);
       const canFastForward = await execFileP2(
         "git",
         ["-C", repoRoot2, "merge-base", "--is-ancestor", head, baseOid],
         { timeout: GIT_TIMEOUT_MS }
         // io-census-allow: an unprovable ancestor probe conservatively refuses the resume below rather than fast-forwarding onto unproven history
       ).then(() => true).catch(() => false);
-      if (!canFastForward) {
-        return fail(`worktree create: refusing to resume '${branch}' \u2014 it has local commits or diverges from ${base}`);
+      if (canFastForward) {
+        await execFileP2("git", ["-C", wtPath, "merge", "--ff-only", base], { timeout: GIT_TIMEOUT_MS });
+        resumed = true;
+      } else {
+        const owner2 = lookupWorktreeOwner(repoRoot2, wtPath);
+        const delivered = await proveExactTreeDelivery({
+          repoRoot: repoRoot2,
+          branch,
+          workerOid: head,
+          creationBaseOid: owner2?.provenance?.creationBaseOid,
+          recordedWorkerBranch: owner2?.provenance?.workerBranch,
+          landedTips: [baseOid]
+        });
+        if (delivered.action !== "settle") {
+          return fail(`worktree create: refusing to resume '${branch}' \u2014 it has local commits or diverges from ${base}; exact-tree delivery proof refused (${describeExactTreeRefusal(delivered)})`);
+        }
+        const repoint = await repointDeliveredWorktreeTransactionally({
+          branch,
+          expectedWorkerOid: head,
+          landedTipOid: baseOid,
+          git: async (args) => (await execFileP2("git", ["-C", wtPath, ...args], { timeout: GIT_TIMEOUT_MS })).stdout
+        });
+        if (repoint.action !== "repointed") {
+          return fail(`worktree create: exact-tree delivery was proven by ${delivered.candidateOid}, but transactional resume refused (${repoint.reason}${repoint.detail ? `: ${repoint.detail}` : ""})`);
+        }
+        resumed = true;
       }
-      await execFileP2("git", ["-C", wtPath, "merge", "--ff-only", base], { timeout: GIT_TIMEOUT_MS });
-      resumed = true;
     }
     if (!resumed) {
       step = `git worktree add ${wtPath}`;
-      const wtPathPreExisted = (0, import_node_fs47.existsSync)(wtPath);
+      const wtPathPreExisted = (0, import_node_fs48.existsSync)(wtPath);
       const partialRemove = worktreeRemoveDeps(async (args) => (await execFileP2("git", args, { timeout: GIT_TIMEOUT_MS })).stdout);
       await withWorktreeAddLock(repoRoot2, () => addWorktreeRobust(wtPath, branch, base, {
         // #4834: `-c core.longpaths=true` rides the add command itself — a Windows worktree path
@@ -39122,7 +39611,7 @@ withExamples(mutating(
         },
         deleteBranch: (b) => execFileP2("git", ["branch", "-D", b], { timeout: GIT_TIMEOUT_MS }).then(() => void 0),
         cleanupPartial: async () => {
-          if (wtPathPreExisted || !(0, import_node_fs47.existsSync)(wtPath)) return;
+          if (wtPathPreExisted || !(0, import_node_fs48.existsSync)(wtPath)) return;
           partialRemove.detachReparsePoints(wtPath);
           await execFileP2("git", ["worktree", "remove", "--force", wtPath], { timeout: GIT_TIMEOUT_MS }).catch(() => partialRemove.removeWorktreeDir(wtPath).then(() => void 0));
           await execFileP2("git", ["worktree", "prune"], { timeout: GIT_TIMEOUT_MS }).catch(() => {
@@ -39166,7 +39655,14 @@ withExamples(mutating(
     }
     const createActor = describeActor({ env: process.env, surface: detectSurface(process.env), cwd: process.cwd() });
     const createdAt = (/* @__PURE__ */ new Date()).toISOString();
-    const owner = { path: wtPath, branch, createdAt, lastSeenAt: createdAt, actor: createActor };
+    const owner = {
+      path: wtPath,
+      branch,
+      provenance: { creationBaseOid: resolvedBaseOid, workerBranch: branch },
+      createdAt,
+      lastSeenAt: createdAt,
+      actor: createActor
+    };
     recordWorktreeOwner(repoRoot2, owner);
     appendWorktreeEvent(repoRoot2, { action: "created", command: "worktree create", target: wtPath, branch, actor: owner.actor });
     let lease;
@@ -39903,7 +40399,7 @@ project.command("set [owner/repo]").description("upsert project META (idempotent
   if (dupe) return fail(`org project set: KEY "${dupe}" was passed to both --var and --set; --set is an alias of --var, so pass each KEY once`);
   if (o.secretsFile) {
     try {
-      vars.push(`secrets=${(0, import_node_fs47.readFileSync)(o.secretsFile, "utf8")}`);
+      vars.push(`secrets=${(0, import_node_fs48.readFileSync)(o.secretsFile, "utf8")}`);
     } catch (e) {
       return fail(`org project set: cannot read --secrets-file ${o.secretsFile}: ${e.message}`);
     }
@@ -40671,11 +41167,11 @@ pr.command("view <number>").description("read a PR as structured JSON (merged st
   }
 });
 async function listCiWorkflowPaths(cwd = process.cwd()) {
-  const wfDir = (0, import_node_path45.join)(cwd, ".github", "workflows");
-  if (!(0, import_node_fs47.existsSync)(wfDir)) return [];
-  return (0, import_node_fs47.readdirSync)(wfDir).filter((name) => /\.(ya?ml)$/i.test(name)).filter((name) => {
+  const wfDir = (0, import_node_path46.join)(cwd, ".github", "workflows");
+  if (!(0, import_node_fs48.existsSync)(wfDir)) return [];
+  return (0, import_node_fs48.readdirSync)(wfDir).filter((name) => /\.(ya?ml)$/i.test(name)).filter((name) => {
     try {
-      return workflowReportsPrChecks((0, import_node_fs47.readFileSync)((0, import_node_path45.join)(wfDir, name), "utf8"));
+      return workflowReportsPrChecks((0, import_node_fs48.readFileSync)((0, import_node_path46.join)(wfDir, name), "utf8"));
     } catch {
       return true;
     }
@@ -40727,16 +41223,16 @@ function ciAuditDeps() {
     // gate re-seed step is skipped gracefully rather than failing mid-run.
     readSeedFile: (path2) => {
       if (!root) return null;
-      const fullPath = (0, import_node_path45.join)(root, path2);
-      return (0, import_node_fs47.existsSync)(fullPath) ? (0, import_node_fs47.readFileSync)(fullPath, "utf8") : null;
+      const fullPath = (0, import_node_path46.join)(root, path2);
+      return (0, import_node_fs48.existsSync)(fullPath) ? (0, import_node_fs48.readFileSync)(fullPath, "utf8") : null;
     }
   };
 }
 function hubRoot() {
-  const fromPkg = (0, import_node_path45.join)(__dirname, "..", "..");
+  const fromPkg = (0, import_node_path46.join)(__dirname, "..", "..");
   const marker = "skills/bootstrap/seeds/manifest.json";
-  if ((0, import_node_fs47.existsSync)((0, import_node_path45.join)(fromPkg, marker))) return fromPkg;
-  if ((0, import_node_fs47.existsSync)((0, import_node_path45.join)(process.cwd(), marker))) return process.cwd();
+  if ((0, import_node_fs48.existsSync)((0, import_node_path46.join)(fromPkg, marker))) return fromPkg;
+  if ((0, import_node_fs48.existsSync)((0, import_node_path46.join)(process.cwd(), marker))) return process.cwd();
   return null;
 }
 async function waitLoopCorePool(label) {
@@ -41067,7 +41563,7 @@ jsonParity(pr.command("merge <number>").description("merge a PR (squash by defau
         }
         if (!repoForPostCleanup) throw e;
         console.warn(`pr merge: gh GraphQL rate-limited \u2014 merging PR #${number} via REST PUT instead (#4588).`);
-        const commitMessage = bodyFile ? (0, import_node_fs47.readFileSync)(bodyFile, "utf8") : void 0;
+        const commitMessage = bodyFile ? (0, import_node_fs48.readFileSync)(bodyFile, "utf8") : void 0;
         await defaultGitHubClient().rest("PUT", `repos/${repoForPostCleanup}/pulls/${number}/merge`, {
           body: { merge_method: method.slice(2), ...commitMessage ? { commit_message: commitMessage } : {} },
           timeoutMs: GH_MUTATION_TIMEOUT_MS
@@ -41163,7 +41659,7 @@ jsonParity(pr.command("merge <number>").description("merge a PR (squash by defau
     localCleanup = await cleanupPrMergeLocalBranch(headRef, {
       beforeWorktrees,
       startingPath,
-      pathExists: (p) => (0, import_node_fs47.existsSync)(p),
+      pathExists: (p) => (0, import_node_fs48.existsSync)(p),
       execGit: async (args) => (await execFileP2("git", args, { timeout: GIT_TIMEOUT_MS })).stdout,
       teardownWorktreeStage,
       deferredStore,
@@ -41767,26 +42263,26 @@ access.command("audit").description("audit collaborator roles + train-branch pus
     targets = resolution.targets;
   }
   const derivedMatrix = registryProjects ? accessMatrixFromProjects(registryProjects) : {};
-  const fileMatrix = (0, import_node_fs47.existsSync)("access-matrix.json") ? loadAccessMatrix((0, import_node_fs47.readFileSync)("access-matrix.json", "utf8")) : {};
+  const fileMatrix = (0, import_node_fs48.existsSync)("access-matrix.json") ? loadAccessMatrix((0, import_node_fs48.readFileSync)("access-matrix.json", "utf8")) : {};
   const matrix = mergeAccessMatrix(fileMatrix, derivedMatrix);
   const derivedContracts = registryProjects ? dataAccessContractsFromProjects(registryProjects) : { consumers: {} };
-  const fileContracts = (0, import_node_fs47.existsSync)("data-access-contracts.json") ? loadDataAccessContracts((0, import_node_fs47.readFileSync)("data-access-contracts.json", "utf8")) : { consumers: {} };
+  const fileContracts = (0, import_node_fs48.existsSync)("data-access-contracts.json") ? loadDataAccessContracts((0, import_node_fs48.readFileSync)("data-access-contracts.json", "utf8")) : { consumers: {} };
   const dataAccess = mergeDataAccessContracts(fileContracts, derivedContracts);
-  const sanctioned = (0, import_node_fs47.existsSync)("access-matrix.json") ? loadSanctionedAdmins((0, import_node_fs47.readFileSync)("access-matrix.json", "utf8")) : {};
+  const sanctioned = (0, import_node_fs48.existsSync)("access-matrix.json") ? loadSanctionedAdmins((0, import_node_fs48.readFileSync)("access-matrix.json", "utf8")) : {};
   const report = await auditOrgAccess(targets, deps, matrix, dataAccess, sanctioned);
   console.log(o.json ? JSON.stringify(report, null, 2) : renderAccessReport(report));
   if (!report.ok) process.exitCode = 1;
 });
 access.command("capabilities").description("enumerate your effective vault reach \u2014 every credential NAME + tier + scope you can read/use across project + org/master tiers (names only, no values) (#1615)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--json", "machine-readable output").action((o) => withSecrets((d) => secretsCapabilities(d, o)));
 var isWin2 = process.platform === "win32";
-program2.command("doctor").description("heal plugin wiring and clean up repo cruft \u2014 repairs run by default (#3975); CLI/plugin updates belong to `mmi-updater` and are only REPORTED here (#4954); use --verbose for the full audit checklist").option("--banner", "one-line resume summary; silent when all gates pass").option("--fast", "offline-safe fast lane; read-only, skips slow checks and network probes").option("--preflight", "read-only fast gate for automation: measures and reports with the shared exit code, zero writes (#4199, canon); heal env drift with a plain run or --no-repo-writes").option("--verbose", "print the evidence behind every check \u2014 probes, resolved paths, versions compared, and the names behind each count (#2977)").option("--guide", "print the MMI Agentic Onboarding guide URL").option("--json", "machine-readable output (an output format \u2014 repairs still run by lane)").option("--apply", "deprecated no-op: repairs run by default now (#3975); kept so older instructions still parse").option("--no-repo-writes", "env/plugin repairs only \u2014 never mutate the repo working tree; report pending managed .gitignore repairs with the follow-up command (for train preflights)").option("--self", "verify CLI/plugin version parity and gh auth reach; suggests plugin-heal on a hard gap (reads the published version, so not offline-safe) (#2689)").addHelpText("after", "\nExit codes:\n  0  no hard gaps remain; advisory gaps may exist\n  1  one or more included hard checks failed\n\nA plain run heals the plugin install and cleans repo cruft (gitignore block, merged branches, dead\nworktrees, aged scratch) automatically (#3975). CLI and plugin UPDATES belong to the scheduled\n`mmi-updater` (#4954); doctor reports the lag and the fleet-drift row and never installs.\n--no-repo-writes keeps the working tree untouched for train preflights; --banner/--fast/--self are\nread-only lanes.\n\n--banner keeps the legacy SessionStart contract and returns 0 unless the process crashes.\n").action(async (opts) => {
+program2.command("doctor").description("safely heal active plugin wiring and report hygiene; repository cleanup requires explicit --apply (#5023), while version convergence belongs to `mmi-hub update`").option("--banner", "one-line resume summary; silent when all gates pass").option("--fast", "offline-safe fast lane; read-only, skips slow checks and network probes").option("--preflight", "read-only fast gate for automation: measures and reports with the shared exit code, zero writes").option("--verbose", "print the evidence behind every check \u2014 probes, resolved paths, versions compared, and the names behind each count (#2977)").option("--guide", "print the canonical MMI Agentic Onboarding URL").option("--json", "machine-readable output (an output format \u2014 repairs still run by lane)").option("--apply", "advanced explicit lane: also apply guarded repository cleanup (gitignore, docs index, board mechanics, merged branches, dead worktrees, aged scratch)").option("--no-repo-writes", "compatibility spelling for the safe default: env/plugin repairs only, never mutate the repository").option("--self", "verify CLI/plugin version parity and gh auth reach; suggests plugin-heal on a hard gap (reads the published version, so not offline-safe) (#2689)").addHelpText("after", "\nExit codes:\n  0  no hard gaps remain; advisory gaps may exist\n  1  one or more included hard checks failed\n\nA plain run may heal safe machine-global plugin wiring but never mutates the repository. Run\n`mmi-cli doctor --apply` only when you explicitly want the guarded full repository cleanup lane.\nCLI and host version convergence belongs to `mmi-hub update`; doctor reports lag and last-run evidence.\n--banner/--fast/--self/--preflight are read-only lanes.\n").action(async (opts) => {
   if (opts.guide) {
-    consoleIo.log("MMI Agentic Onboarding: docs/Architecture/agentic-dev-environment.md");
+    consoleIo.log(`MMI Agentic Onboarding: ${CANONICAL_ONBOARDING_URL}`);
     return;
   }
   process.exitCode = await runDoctorClean(
     {
-      repoWrites: opts.repoWrites,
+      repoWrites: opts.apply === true && opts.repoWrites !== false,
       banner: opts.banner,
       preflight: opts.preflight,
       fast: opts.fast || opts.self,
@@ -41804,16 +42300,16 @@ function directoryBytes(path2) {
   let total = 0;
   let entries;
   try {
-    entries = (0, import_node_fs47.readdirSync)(path2, { withFileTypes: true });
+    entries = (0, import_node_fs48.readdirSync)(path2, { withFileTypes: true });
   } catch {
     return 0;
   }
   for (const entry of entries) {
-    const child2 = (0, import_node_path45.join)(path2, entry.name);
+    const child2 = (0, import_node_path46.join)(path2, entry.name);
     if (entry.isDirectory()) total += directoryBytes(child2);
     else {
       try {
-        total += (0, import_node_fs47.statSync)(child2).size;
+        total += (0, import_node_fs48.statSync)(child2).size;
       } catch {
       }
     }
@@ -41821,25 +42317,25 @@ function directoryBytes(path2) {
   return total;
 }
 function listDirEntries(dir) {
-  return (0, import_node_fs47.readdirSync)(dir, { withFileTypes: true }).map((d) => ({ name: d.name, isDirectory: d.isDirectory() }));
+  return (0, import_node_fs48.readdirSync)(dir, { withFileTypes: true }).map((d) => ({ name: d.name, isDirectory: d.isDirectory() }));
 }
 function readInstalledPluginRefs(configRoot) {
   const p = installedPluginsPathForConfig(configRoot);
-  if (!(0, import_node_fs47.existsSync)(p)) return [];
+  if (!(0, import_node_fs48.existsSync)(p)) return [];
   try {
-    return installedPluginPaths((0, import_node_fs47.readFileSync)(p, "utf8"));
+    return installedPluginPaths((0, import_node_fs48.readFileSync)(p, "utf8"));
   } catch {
     return null;
   }
 }
 function pluginCacheFsDeps(configRoot, dirBytes) {
   return {
-    exists: (p) => (0, import_node_fs47.existsSync)(p),
-    listVersionDirs: (root) => (0, import_node_fs47.readdirSync)(root, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name),
+    exists: (p) => (0, import_node_fs48.existsSync)(p),
+    listVersionDirs: (root) => (0, import_node_fs48.readdirSync)(root, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name),
     dirBytes,
-    listStagingDirs: (root) => (0, import_node_fs47.readdirSync)(root, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => {
+    listStagingDirs: (root) => (0, import_node_fs48.readdirSync)(root, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => {
       try {
-        return { name: d.name, mtimeMs: newestMtimeMs((0, import_node_path45.join)(root, d.name), listDirEntries, (p) => (0, import_node_fs47.statSync)(p).mtimeMs) };
+        return { name: d.name, mtimeMs: newestMtimeMs((0, import_node_path46.join)(root, d.name), listDirEntries, (p) => (0, import_node_fs48.statSync)(p).mtimeMs) };
       } catch {
         return { name: d.name, mtimeMs: Date.now() };
       }
@@ -41853,10 +42349,10 @@ function stagingApplyFsGuard(configRoot) {
   return {
     referencedPaths: () => readInstalledPluginRefs(configRoot),
     mtimeMs: (name) => {
-      const p = (0, import_node_path45.join)(stagingRoot, name);
-      if (!(0, import_node_fs47.existsSync)(p)) return null;
+      const p = (0, import_node_path46.join)(stagingRoot, name);
+      if (!(0, import_node_fs48.existsSync)(p)) return null;
       try {
-        return newestMtimeMs(p, listDirEntries, (q) => (0, import_node_fs47.statSync)(q).mtimeMs);
+        return newestMtimeMs(p, listDirEntries, (q) => (0, import_node_fs48.statSync)(q).mtimeMs);
       } catch {
         return null;
       }
@@ -41876,13 +42372,13 @@ program2.command("plugin-prune").description(`prune stale cached MMI plugin vers
     return;
   }
   const plan = buildPluginCachePlan(
-    (0, import_node_os20.homedir)(),
+    (0, import_node_os21.homedir)(),
     running,
     pluginCacheFsDeps(configRoot, directoryBytes),
     { withBytes: true, configRoot, includeStaging: surface !== "codex" }
   );
   const anythingToDelete = plan.prune.length > 0 || plan.staging.length > 0;
-  const result = o.apply && anythingToDelete ? applyPluginCachePlan(plan, (p) => (0, import_node_fs47.rmSync)(p, { recursive: true, force: true }), stagingApplyFsGuard(configRoot)) : void 0;
+  const result = o.apply && anythingToDelete ? applyPluginCachePlan(plan, (p) => (0, import_node_fs48.rmSync)(p, { recursive: true, force: true }), stagingApplyFsGuard(configRoot)) : void 0;
   const warnings = plan.prune.length > 0 ? [CONCURRENT_SESSION_WARNING] : [];
   if (o.json) console.log(JSON.stringify({ ...plan, warnings, applied: result ?? null }));
   else console.log(renderPluginCachePlan(plan, result));