@mutmutco/cli 3.136.0 → 3.138.0

package/dist/main.cjs

@@ -5849,6 +5849,21 @@ async function sweepDeferredWorktrees(store, deps, removalContext) {
       continue;
     }
     const owner = removalContext ? lookupWorktreeOwner(removalContext.primaryRoot, entry.path) : void 0;
+    if (!current && deps.pathExists?.(entry.path) === false) {
+      removed.push(entry.path);
+      if (removalContext) {
+        recordWorktreeRemoval(removalContext.primaryRoot, {
+          action: "removed",
+          command: removalContext.command,
+          target: entry.path,
+          branch: entry.branch,
+          actor: removalContext.actor,
+          owner,
+          reason: "deferred worktree already absent from Git registration and filesystem"
+        });
+      }
+      continue;
+    }
     if (removalContext) {
       const activeRoot = removalContext.activeWorkspaceRoot ?? resolveActiveWorkspaceRoot();
       const activeGuard = decideActiveWorkspaceGuard(entry.path, activeRoot, process.platform, {
@@ -8398,6 +8413,12 @@ function loadBootstrapSeeds(manifestJson) {
     if (s.ownership !== "org" && s.ownership !== "repo") {
       throw new Error(`invalid seed ownership '${s.ownership}' for ${s.target} (must be 'org' or 'repo')`);
     }
+    if (s.managedBlock) {
+      const block = s.managedBlock;
+      if (!block.source || !block.begin || !block.end || block.begin === block.end || /[\r\n]/.test(block.begin + block.end)) {
+        throw new Error(`invalid managedBlock for ${s.target} (needs source and distinct single-line begin/end markers)`);
+      }
+    }
   }
   return {
     seeds,
@@ -8413,6 +8434,68 @@ function missingPlaceholders(rendered) {
   for (const m of rendered.matchAll(PLACEHOLDER_RE)) out.add(m[1]);
   return [...out];
 }
+function isPropagatableSeed(seed) {
+  return seed.ownership === "org" && seed.source === "self" || seed.managedBlock != null;
+}
+function sourceLines(content) {
+  const lines = [];
+  const newline = /\r\n|\n|\r/g;
+  let start = 0;
+  for (const match of content.matchAll(newline)) {
+    const index = match.index;
+    lines.push({ start, textEnd: index, end: index + match[0].length, text: content.slice(start, index) });
+    start = index + match[0].length;
+  }
+  lines.push({ start, textEnd: content.length, end: content.length, text: content.slice(start) });
+  return lines;
+}
+function normalizeEol(content) {
+  return content.replace(/\r\n|\r|\n/g, "\n");
+}
+function upsertManagedSeedBlock(current, desired, begin, end) {
+  const desiredLines = sourceLines(desired);
+  const desiredBegins = desiredLines.filter((line) => line.text === begin);
+  const desiredEnds = desiredLines.filter((line) => line.text === end);
+  if (desiredBegins.length !== 1 || desiredEnds.length !== 1 || desiredEnds[0].start <= desiredBegins[0].start) {
+    return { ok: false, reason: "managed block source must contain exactly one well-ordered marker pair" };
+  }
+  const desiredBegin = desiredBegins[0];
+  const desiredEnd = desiredEnds[0];
+  if (desired.slice(0, desiredBegin.start).trim() || desired.slice(desiredEnd.end).trim()) {
+    return { ok: false, reason: "managed block source must contain only the bounded block" };
+  }
+  const canonical = desired.slice(desiredBegin.start, desiredEnd.textEnd);
+  const currentLines = sourceLines(current);
+  const begins = currentLines.filter((line) => line.text === begin);
+  const ends = currentLines.filter((line) => line.text === end);
+  if (begins.length === 0 && ends.length === 0) {
+    const eol2 = current.match(/\r\n|\n|\r/)?.[0] ?? "\n";
+    const block2 = normalizeEol(canonical).replace(/\n/g, eol2);
+    if (current.length === 0) return { ok: true, content: `${block2}${eol2}`, changed: true, action: "insert" };
+    const separator = /(?:\r\n|\n|\r)$/.test(current) ? eol2 : `${eol2}${eol2}`;
+    return { ok: true, content: `${current}${separator}${block2}${eol2}`, changed: true, action: "insert" };
+  }
+  if (begins.length !== 1 || ends.length !== 1) {
+    return { ok: false, reason: `malformed managed block markers (begin=${begins.length}, end=${ends.length})` };
+  }
+  const currentBegin = begins[0];
+  const currentEnd = ends[0];
+  if (currentEnd.start <= currentBegin.start) {
+    return { ok: false, reason: "malformed managed block markers (end precedes begin)" };
+  }
+  const existing = current.slice(currentBegin.start, currentEnd.textEnd);
+  if (normalizeEol(existing) === normalizeEol(canonical)) {
+    return { ok: true, content: current, changed: false, action: "current" };
+  }
+  const eol = current.match(/\r\n|\n|\r/)?.[0] ?? "\n";
+  const block = normalizeEol(canonical).replace(/\n/g, eol);
+  return {
+    ok: true,
+    content: `${current.slice(0, currentBegin.start)}${block}${current.slice(currentEnd.textEnd)}`,
+    changed: true,
+    action: "replace"
+  };
+}
 async function resolveHubSeedSource(execGit, defaultBranch = "development") {
   let status;
   try {
@@ -9477,6 +9560,9 @@ function seedMatchesProjectType(seed, projectType) {
   return projectType != null && seed.projectTypes.includes(projectType);
 }
 function planSeedAction(seed, exists) {
+  if (seed.managedBlock) {
+    return exists ? { target: seed.target, action: "update", ownership: "repo", reason: "repo-owned file; Hub-managed block reconciled in place" } : { target: seed.target, action: "create", ownership: "repo", reason: "repo-owned, missing; full template created with Hub-managed block" };
+  }
   if (seed.source === "managed-block") {
     return exists ? { target: seed.target, action: "update", ownership: "org", reason: "org-managed block merged in-place (repo-owned lines preserved)" } : { target: seed.target, action: "create", ownership: "org", reason: "org-managed block; .gitignore absent, created" };
   }
@@ -9535,6 +9621,18 @@ function resolveSeedContent(seed, vars, readFile9) {
   }
   return null;
 }
+function resolveSeedWriteContent(seed, vars, readFile9, remoteContent) {
+  if (!seed.managedBlock) {
+    return { ok: true, content: resolveSeedContent(seed, vars, readFile9), managed: seed.source === "managed-block" };
+  }
+  const base = remoteContent ?? resolveSeedContent(seed, vars, readFile9);
+  if (base == null) return { ok: true, content: null, managed: true };
+  const blockSeed = { ...seed, source: seed.managedBlock.source, managedBlock: void 0 };
+  const desired = resolveSeedContent(blockSeed, vars, readFile9);
+  if (desired == null) return { ok: true, content: null, managed: true };
+  const result = upsertManagedSeedBlock(base, desired, seed.managedBlock.begin, seed.managedBlock.end);
+  return result.ok ? { ok: true, content: result.content, managed: true } : { ok: false, reason: result.reason, managed: true };
+}
 function buildRegisterPayload(repo, cls, vars, options = {}) {
   const parsedRepo = parseOwnerRepo(repo);
   const slug = parsedRepo.slug;
@@ -14122,6 +14220,11 @@ function semverRelation(a, b) {
 function classifyRow(row) {
   const findings = [];
   const reasons = /* @__PURE__ */ new Set();
+  if (row.onboarding.status === "drift") {
+    findings.push(`canonical onboarding link drift: ${row.onboarding.detail}`);
+  } else if (row.onboarding.status === "unknown") {
+    reasons.add(`canonical onboarding link evidence unknown: ${row.onboarding.detail}`);
+  }
   const releaseRequired = row.track !== "trunk" && !row.classifications.includes("no-deploy-surface");
   const tagIsVersion = Boolean(row.release.version) && row.unknowns.some((u) => u.startsWith(NO_VERSION_LOCK_PREFIX));
   for (const unknown of row.unknowns) {
@@ -14384,10 +14487,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "3.136.0",
-    tag: "v3.136.0",
-    commit: "acba68c21013",
-    npm: "@mutmutco/cli@3.136.0"
+    version: "3.138.0",
+    tag: "v3.138.0",
+    commit: "8735687f4693",
+    npm: "@mutmutco/cli@3.138.0"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -14404,14 +14507,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v3.136.0"
+          v3Target: "v3.138.0"
         }
       ],
       rollbackTrigger: "Any red inside the post-cut soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a v3 client refused while the compat window must still admit it (SUPPORTED_MINOR_WINDOW=2, MIN_CLIENT_VERSION 0.0.0 \u2014 D6a), or npm consumer install/doctor failure on the v4 dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 3.136.0 and redeploy the Hub Lambda from tag v3.136.0 (acba68c21013); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v3.136.0 (@mutmutco/cli@3.136.0, tag commit acba68c21013 \u2014 the preserved latest-v3 distribution, D6b)"
+        mechanism: "npm dist-tag latest -> 3.138.0 and redeploy the Hub Lambda from tag v3.138.0 (8735687f4693); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v3.138.0 (@mutmutco/cli@3.138.0, tag commit 8735687f4693 \u2014 the preserved latest-v3 distribution, D6b)"
       }
     },
     {
@@ -15619,6 +15722,7 @@ function registerQueryCommands(program3) {
 
 // src/fleet-track-inventory.ts
 var NO_DEPLOY_SURFACE_MODELS = /* @__PURE__ */ new Set(["none", "content"]);
+var CANONICAL_ONBOARDING_URL = "https://github.com/mutmutco/MMI-Hub/blob/main/docs/Architecture/agentic-dev-environment.md";
 function ghErrorText(e) {
   const err = e;
   return String(err?.stderr || err?.message || e).trim().replace(/\s+/g, " ");
@@ -15649,6 +15753,23 @@ async function readFleetPluginProbe(deps, repo, branch) {
     return isGhNotFound2(e) ? { repo, state: "absent" } : { repo, state: "unknown", unknown: `plugin surface read failed: ${ghErrorText(e)}` };
   }
 }
+async function readFleetOnboardingProbe(deps, repo, branch) {
+  const [owner, name] = repo.split("/");
+  const ref = branch ? `?ref=${encodeURIComponent(branch)}` : "";
+  try {
+    const raw = await deps.ghJson([
+      "api",
+      `repos/${encodeURIComponent(owner ?? "")}/${encodeURIComponent(name ?? "")}/contents/README.md${ref}`
+    ]);
+    if (raw.encoding !== "base64" || typeof raw.content !== "string") {
+      return { repo, status: "unknown", detail: "README contents read returned no base64 content" };
+    }
+    const readme = Buffer.from(raw.content.replace(/\s/g, ""), "base64").toString("utf8");
+    return readme.includes(CANONICAL_ONBOARDING_URL) ? { repo, status: "canonical", detail: CANONICAL_ONBOARDING_URL } : { repo, status: "drift", detail: `README.md does not link ${CANONICAL_ONBOARDING_URL}` };
+  } catch (e) {
+    return isGhNotFound2(e) ? { repo, status: "drift", detail: `README.md is absent; expected ${CANONICAL_ONBOARDING_URL}` } : { repo, status: "unknown", detail: `onboarding README read failed: ${ghErrorText(e)}` };
+  }
+}
 async function mapBounded2(values, limit, read) {
   const results = new Array(values.length);
   let next = 0;
@@ -15679,9 +15800,10 @@ function classificationsOf(surfaces) {
   if (surfaces.deploy === "absent") classes.push("no-deploy-surface");
   return classes;
 }
-function buildFleetTrackInventory(projects, releaseProbes, pluginProbes, generatedAt) {
+function buildFleetTrackInventory(projects, releaseProbes, pluginProbes, generatedAt, onboardingProbes = []) {
   const releaseByRepo = new Map(releaseProbes.map((p) => [p.repo.toLowerCase(), p]));
   const pluginByRepo = new Map(pluginProbes.map((p) => [p.repo.toLowerCase(), p]));
+  const onboardingByRepo = new Map(onboardingProbes.map((p) => [p.repo.toLowerCase(), p]));
   const projectByRepo = /* @__PURE__ */ new Map();
   const anomalies = [];
   for (const project2 of projects) {
@@ -15703,11 +15825,13 @@ function buildFleetTrackInventory(projects, releaseProbes, pluginProbes, generat
     const project2 = projectByRepo.get(repo.toLowerCase());
     const release = releaseByRepo.get(repo.toLowerCase());
     const plugin = pluginByRepo.get(repo.toLowerCase());
+    const onboarding = onboardingByRepo.get(repo.toLowerCase()) ?? { repo, status: "unknown", detail: "onboarding README was not probed" };
     const surfaces = classifySurfaces(project2, plugin);
     const unknowns = [...release?.unknowns ?? []];
     if (!release) unknowns.push("GitHub release evidence was not collected");
     if (plugin?.unknown) unknowns.push(plugin.unknown);
     if (!plugin) unknowns.push("plugin surface was not probed");
+    if (onboarding.status === "unknown") unknowns.push(onboarding.detail);
     return {
       repo,
       slug: String(project2?.slug ?? repo.split("/")[1] ?? repo).toLowerCase(),
@@ -15719,6 +15843,7 @@ function buildFleetTrackInventory(projects, releaseProbes, pluginProbes, generat
       surfaces,
       classifications: classificationsOf(surfaces),
       pluginVersion: plugin?.version ?? null,
+      onboarding,
       release: {
         tag: release?.releaseTag ?? null,
         version: release?.releasedVersion ?? null,
@@ -15731,7 +15856,7 @@ function buildFleetTrackInventory(projects, releaseProbes, pluginProbes, generat
         requiredChecks: Array.isArray(project2?.requiredChecks) ? project2.requiredChecks : null,
         exemptReason: typeof project2?.ciExemptReason === "string" ? project2.ciExemptReason : null
       },
-      source: { registry: "hub-registry-live", release: "github-releases-live", plugin: "github-contents-live" },
+      source: { registry: "hub-registry-live", release: "github-releases-live", plugin: "github-contents-live", onboarding: "github-readme-live" },
       freshness: { readAt: generatedAt, releasedAt: release?.releasedAt ?? null },
       unknowns
     };
@@ -15744,6 +15869,7 @@ function buildFleetTrackInventory(projects, releaseProbes, pluginProbes, generat
       roster: "hub-registry-live",
       releases: "github-releases-live",
       plugin: "github-contents-live",
+      onboarding: "github-readme-live",
       committedInventory: "never"
     },
     counts: {
@@ -15754,6 +15880,7 @@ function buildFleetTrackInventory(projects, releaseProbes, pluginProbes, generat
       noVault: repos.filter((r) => r.classifications.includes("no-vault")).length,
       noPlugin: repos.filter((r) => r.classifications.includes("no-plugin")).length,
       noDeploySurface: repos.filter((r) => r.classifications.includes("no-deploy-surface")).length,
+      onboardingDrift: repos.filter((r) => r.onboarding.status === "drift").length,
       unknownRows: repos.filter((r) => r.unknowns.length > 0).length,
       anomalies: anomalies.length
     },
@@ -15785,11 +15912,12 @@ async function readFleetTrackInventory(deps = defaultFleetTrackInventoryDeps())
       }
     }
   }
-  const [releaseProbes, pluginProbes] = await Promise.all([
+  const [releaseProbes, pluginProbes, onboardingProbes] = await Promise.all([
     mapBounded2(repos, 6, (repo) => readOrgVersionProbe(deps.query, repo)),
-    mapBounded2(repos, 6, (repo) => readFleetPluginProbe(deps.query, repo, branchByRepo.get(repo.toLowerCase())))
+    mapBounded2(repos, 6, (repo) => readFleetPluginProbe(deps.query, repo, branchByRepo.get(repo.toLowerCase()))),
+    mapBounded2(repos, 6, (repo) => readFleetOnboardingProbe(deps.query, repo, branchByRepo.get(repo.toLowerCase())))
   ]);
-  return buildFleetTrackInventory(projects, releaseProbes, pluginProbes, deps.now().toISOString());
+  return buildFleetTrackInventory(projects, releaseProbes, pluginProbes, deps.now().toISOString(), onboardingProbes);
 }
 function formatFleetTrackInventory(report) {
   const { counts } = report;
@@ -15797,13 +15925,13 @@ function formatFleetTrackInventory(report) {
     `fleet version-track inventory \u2014 ${counts.registeredRepos} registered repositories (${counts.projects} registry projects)`,
     `source: live Hub registry + live GitHub releases/contents \xB7 read ${report.generatedAt} \xB7 committed inventory: never`,
     `tracks: ${counts.tracks.full} full \xB7 ${counts.tracks.direct} direct \xB7 ${counts.tracks.trunk} trunk`,
-    `classified: ${counts.noBoard} no-board \xB7 ${counts.noVault} no-vault \xB7 ${counts.noPlugin} no-plugin \xB7 ${counts.noDeploySurface} no-deploy-surface \xB7 ${counts.unknownRows} rows with unknowns`,
+    `classified: ${counts.noBoard} no-board \xB7 ${counts.noVault} no-vault \xB7 ${counts.noPlugin} no-plugin \xB7 ${counts.noDeploySurface} no-deploy-surface \xB7 ${counts.onboardingDrift} onboarding-link drift \xB7 ${counts.unknownRows} rows with unknowns`,
     "",
-    "repository | track | deploy model | released | plugin | classifications"
+    "repository | track | deploy model | released | plugin | onboarding | classifications"
   ];
   for (const row of report.repos) {
     lines.push(
-      `${row.repo} | ${row.track}${row.declaredTrack ? "" : " (derived)"} | ${row.deployModel ?? "UNDECLARED"} | ${row.release.version ?? "UNKNOWN"} | ${row.pluginVersion ?? (row.surfaces.plugin === "present" ? "present" : row.surfaces.plugin)} | ${row.classifications.join(", ") || "none"}`
+      `${row.repo} | ${row.track}${row.declaredTrack ? "" : " (derived)"} | ${row.deployModel ?? "UNDECLARED"} | ${row.release.version ?? "UNKNOWN"} | ${row.pluginVersion ?? (row.surfaces.plugin === "present" ? "present" : row.surfaces.plugin)} | ${row.onboarding.status} | ${row.classifications.join(", ") || "none"}`
     );
     for (const unknown of row.unknowns) lines.push(`  ? ${unknown}`);
   }
@@ -15818,7 +15946,7 @@ function formatFleetTrackInventory(report) {
 function registerFleetTrackInventory(program3) {
   const train = program3.commands.find((c) => c.name() === "train");
   if (!train) throw new Error("train inventory registration requires the train command group");
-  train.command("inventory").description("live fleet version-track inventory (#4451) \u2014 every registered repo's track, deploy model, CI contract, release evidence, and explicit no-board/no-vault/no-plugin/no-deploy-surface classification").option("--json", "machine-readable output (the typed D2b input shape)").action(async (o) => {
+  train.command("inventory").description("live fleet version-track inventory (#4451) \u2014 every registered repo's track, release evidence, surface classification, and canonical Hub onboarding-link evidence").option("--json", "machine-readable output (the typed D2b input shape)").action(async (o) => {
     try {
       const report = await readFleetTrackInventory();
       console.log(o.json ? JSON.stringify(report, null, 2) : formatFleetTrackInventory(report));
@@ -20069,7 +20197,7 @@ var import_node_net = require("node:net");
 var import_node_util5 = require("node:util");
 
 // src/rules-sync.ts
-function normalizeEol(s) {
+function normalizeEol2(s) {
   return s.replace(/\r\n/g, "\n");
 }
 
@@ -20122,8 +20250,8 @@ function envFileKeys(content) {
   return keys;
 }
 function detectStaleEnvFile(exampleContent, targetContent, mtimes) {
-  const example = normalizeEol(exampleContent);
-  const target = normalizeEol(targetContent);
+  const example = normalizeEol2(exampleContent);
+  const target = normalizeEol2(targetContent);
   const exampleKeys = envFileKeys(example);
   const targetKeys = envFileKeys(target);
   for (const key of exampleKeys) {
@@ -25448,7 +25576,7 @@ function listCandidatePaths(cwd, exec = import_node_child_process12.execFileSync
     return [];
   }
 }
-function rebuildRepoIndex(cwd, repoSlug2) {
+function rebuildRepoIndex(cwd, repoSlug3) {
   const candidates = listCandidatePaths(cwd).filter(isIndexablePath);
   const ignored = defaultIsIgnored(cwd, candidates);
   const readmeHints = loadReadmeHints(cwd, candidates.filter((p) => !ignored.has(p)));
@@ -25480,7 +25608,7 @@ function rebuildRepoIndex(cwd, repoSlug2) {
   entries.sort((a, b) => a.path.localeCompare(b.path));
   const projection = {
     schema: REPO_INDEX_SCHEMA,
-    repo: repoSlug2,
+    repo: repoSlug3,
     builtAt: (/* @__PURE__ */ new Date()).toISOString(),
     entries
   };
@@ -28756,6 +28884,71 @@ function renderPropagationReport(plan) {
   return lines.join("\n");
 }
 
+// src/bootstrap-propagation-identity.ts
+var import_node_crypto8 = require("node:crypto");
+var PROPAGATION_BRANCH_PREFIX = "seed-propagate-";
+var TARGET_MARKER_NAME = "mmi-bootstrap-propagation-target";
+function safeBranchPart(value, maxLength, fallback) {
+  const safe = value.normalize("NFKD").toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, maxLength).replace(/-+$/g, "");
+  return safe || fallback;
+}
+function repoSlug2(repo) {
+  return repo.trim().split("/").pop()?.toLowerCase() || "repo";
+}
+function propagationBranch(repo, target) {
+  const repoPart = safeBranchPart(repoSlug2(repo), 32, "repo");
+  const targetPart = safeBranchPart(target, 48, "target");
+  const hash = (0, import_node_crypto8.createHash)("sha256").update(repo.trim().toLowerCase()).update("\0").update(target).digest("hex").slice(0, 12);
+  return `${PROPAGATION_BRANCH_PREFIX}${repoPart}-${targetPart}-${hash}`;
+}
+function legacyPropagationBranch(repo) {
+  return `${PROPAGATION_BRANCH_PREFIX}${repoSlug2(repo)}`;
+}
+function renderPropagationTargetMarker(target) {
+  return `<!-- ${TARGET_MARKER_NAME}: ${JSON.stringify(target)} -->`;
+}
+function targetMarkers(body) {
+  const present = body.includes(`${TARGET_MARKER_NAME}:`);
+  const targets = [];
+  const marker = new RegExp(`<!--\\s*${TARGET_MARKER_NAME}:\\s*(.*?)\\s*-->`, "g");
+  for (const match of body.matchAll(marker)) {
+    try {
+      const parsed = JSON.parse(match[1]);
+      if (typeof parsed === "string") targets.push(parsed);
+    } catch {
+    }
+  }
+  return { present, targets };
+}
+function canonicalProseTargets(body) {
+  const targets = [];
+  const command = /bootstrap propagate --target (.+?) --execute`/g;
+  const prose = /(?:org-owned copy of|declared marker-bounded block inside repo-owned) `([^`]+)` — the file this PR carries and nothing else/g;
+  for (const match of body.matchAll(command)) targets.push(match[1]);
+  for (const match of body.matchAll(prose)) targets.push(match[1]);
+  return targets;
+}
+function propagationPrMatchesTarget(pr2, target, identity) {
+  const body = pr2.body ?? "";
+  const markers = targetMarkers(body);
+  if (markers.present) {
+    if (markers.targets.length !== 1 || markers.targets[0] !== target) return false;
+    return !pr2.files?.length || pr2.files.length === 1 && pr2.files[0] === target;
+  }
+  if (identity === "target-specific") return false;
+  const proseTargets = canonicalProseTargets(body);
+  if (proseTargets.some((candidate) => candidate !== target)) return false;
+  if (pr2.files?.length) {
+    return pr2.files.length === 1 && pr2.files[0] === target;
+  }
+  return proseTargets.length > 0;
+}
+function propagationPrCandidatesForTarget(target, targetSpecificPrs, legacyPrs) {
+  const targetSpecific = targetSpecificPrs.filter((pr2) => propagationPrMatchesTarget(pr2, target, "target-specific"));
+  if (targetSpecific.length) return targetSpecific;
+  return legacyPrs.filter((pr2) => propagationPrMatchesTarget(pr2, target, "legacy"));
+}
+
 // src/bootstrap-rollback.ts
 function resolveRollbackRecord(records, repo, target) {
   const candidates = records.filter((r) => r.repo === repo && r.target === target && r.mergeSha);
@@ -28819,6 +29012,11 @@ var ENVIRONMENT_BRANCHES = {
   rc: "rc",
   main: "main"
 };
+function classifyEnvironmentDrift(drift) {
+  if (drift.missing) return { environment: drift.environment, action: "CREATE", reason: "environment is missing" };
+  const why = [...drift.problems, ...drift.notes].join("; ");
+  return why ? { environment: drift.environment, action: "UPDATE", reason: why } : { environment: drift.environment, action: "SKIP", reason: "already current" };
+}
 var TRACK_ENVIRONMENT_EXCEPTIONS = {
   direct: { rc: "direct release track has no rc stage" },
   trunk: {
@@ -28857,9 +29055,9 @@ function reviewerKey(reviewer) {
   return `${reviewer.type ?? ""}:${reviewer.id ?? ""}`;
 }
 function environmentDrift(live, desired) {
-  if (!live) return ["environment is missing"];
+  if (!live) return { environment: desired.name, missing: true, problems: ["environment is missing"], notes: [] };
   const problems = [];
-  if (live.wait_timer !== desired.waitTimer) problems.push(`wait_timer=${live.wait_timer ?? "unset"} (want ${desired.waitTimer})`);
+  const notes = [];
   const policy = live.deployment_branch_policy;
   if (policy?.protected_branches !== desired.deploymentBranchPolicy.protectedBranches) {
     problems.push(`protected_branches=${String(policy?.protected_branches)} (want true)`);
@@ -28867,16 +29065,67 @@ function environmentDrift(live, desired) {
   if (policy?.custom_branch_policies !== desired.deploymentBranchPolicy.customBranchPolicies) {
     problems.push(`custom_branch_policies=${String(policy?.custom_branch_policies)} (want false)`);
   }
+  if (live.wait_timer !== desired.waitTimer) notes.push(`wait_timer=${live.wait_timer ?? "unset"} (want ${desired.waitTimer})`);
   const reviewers = (live.reviewers ?? []).map(reviewerKey).sort();
-  if (reviewers.length !== 0) problems.push(`reviewers=${reviewers.join(", ")} (want none)`);
-  return problems;
+  if (reviewers.length !== 0) notes.push(`reviewers=${reviewers.join(", ")} (want none)`);
+  return { environment: desired.name, missing: false, problems, notes };
+}
+function environmentBody(spec) {
+  return {
+    wait_timer: spec.waitTimer,
+    reviewers: spec.reviewers,
+    deployment_branch_policy: {
+      protected_branches: spec.deploymentBranchPolicy.protectedBranches,
+      custom_branch_policies: spec.deploymentBranchPolicy.customBranchPolicies
+    }
+  };
+}
+var PLAN_GATED_PROTECTION_RE = /billing plan/i;
+function isPlanGatedProtectionError(error) {
+  return PLAN_GATED_PROTECTION_RE.test(String(error?.message ?? error));
+}
+async function reconcileRepoEnvironments(repo, releaseTrack, client) {
+  const raw = await client.rest("GET", `repos/${repo}/environments`);
+  const live = new Map(asEnvironmentList(raw).flatMap((entry) => entry.name ? [[entry.name, entry]] : []));
+  const planned = provisionedEnvironmentSpecs(repo, releaseTrack);
+  const created = [];
+  const updated = [];
+  const skipped = [];
+  const planGated = [];
+  for (const spec of planned) {
+    const current = live.get(spec.name);
+    const drift = environmentDrift(current, spec);
+    if (drift.problems.length === 0 && drift.notes.length === 0) {
+      skipped.push(spec.name);
+      continue;
+    }
+    const path2 = `repos/${repo}/environments/${encodeURIComponent(spec.name)}`;
+    let gatedProtections = [];
+    try {
+      await client.rest("PUT", path2, { body: environmentBody(spec) });
+    } catch (error) {
+      if (!isPlanGatedProtectionError(error)) throw error;
+      await client.rest("PUT", path2, {
+        body: {
+          deployment_branch_policy: {
+            protected_branches: spec.deploymentBranchPolicy.protectedBranches,
+            custom_branch_policies: spec.deploymentBranchPolicy.customBranchPolicies
+          }
+        }
+      });
+      gatedProtections = ["wait_timer", "reviewers"];
+    }
+    if (gatedProtections.length) planGated.push({ environment: spec.name, protections: gatedProtections });
+    (current ? updated : created).push(spec.name);
+  }
+  return { repo, planned, created, updated, skipped, planGated };
 }
 async function verifyRepoEnvironments(repo, releaseTrack, client) {
   const raw = await client.rest("GET", `repos/${repo}/environments`);
   const live = new Map(asEnvironmentList(raw).flatMap((entry) => entry.name ? [[entry.name, entry]] : []));
   return provisionedEnvironmentSpecs(repo, releaseTrack).map((spec) => {
-    const problems = environmentDrift(live.get(spec.name), spec);
-    return { environment: spec.name, missing: !live.has(spec.name), problems };
+    const drift = environmentDrift(live.get(spec.name), spec);
+    return { environment: spec.name, missing: !live.has(spec.name), problems: drift.problems, notes: drift.notes };
   });
 }
 
@@ -29127,7 +29376,7 @@ async function verifyBootstrap(repo, repoClass, deps, releaseTrack) {
     checks.push({
       ok: drift.problems.length === 0,
       label: `repository environment protected: ${drift.environment}`,
-      detail: drift.problems.length ? drift.problems.join("; ") : void 0
+      detail: drift.problems.length ? drift.problems.join("; ") : drift.notes.length ? `advisory: ${drift.notes.join("; ")}` : void 0
     });
   }
   for (const spec of repoEnvironmentSpecs(repo, releaseTrack ?? (repoClass === "content" ? "trunk" : "full")).filter((entry) => entry.exception)) {
@@ -29574,7 +29823,7 @@ function registerBootstrapCommands(program3) {
     }
     if (findings.some((f) => f.state !== "waived")) process.exitCode = 1;
   });
-  bootstrap.command("apply <repo>").description("run from the MMI-Hub repo root: idempotent seed apply from skills/bootstrap/seeds/manifest.json; dry-run unless --execute (live, master-gated)").addOption(new Option("--class <class>", "deployable | content").default("deployable").choices(["deployable", "content"])).addOption(new Option("--project-type <type>", `${PROJECT_TYPES.join(" | ")} (capability shape)`).choices([...PROJECT_TYPES])).addOption(new Option("--deploy-model <model>", `${DEPLOY_MODELS.join(" | ")} (release/deploy path)`).choices([...DEPLOY_MODELS])).addOption(new Option("--release-track <track>", `${RELEASE_TRACKS.join(" | ")} (branch topology; direct skips rc)`).choices([...RELEASE_TRACKS])).option("--execute", "LIVE apply via gh (master-gated) \u2014 stamps seed files + labels into the repo").option("--only <target>", "deliver ONLY this manifest target (#3818) \u2014 one file, no labels/ruleset/registry writes").option("--var <KEY=VALUE...>", "placeholder values for repo-owned templates (repeatable)").option("--json", "machine-readable output").action(async (repo, cmdOpts) => {
+  bootstrap.command("apply <repo>").description("run from the MMI-Hub repo root: idempotent seed apply from skills/bootstrap/seeds/manifest.json; dry-run unless --execute (live, master-gated)").addOption(new Option("--class <class>", "deployable | content").default("deployable").choices(["deployable", "content"])).addOption(new Option("--project-type <type>", `${PROJECT_TYPES.join(" | ")} (capability shape)`).choices([...PROJECT_TYPES])).addOption(new Option("--deploy-model <model>", `${DEPLOY_MODELS.join(" | ")} (release/deploy path)`).choices([...DEPLOY_MODELS])).addOption(new Option("--release-track <track>", `${RELEASE_TRACKS.join(" | ")} (branch topology; direct skips rc)`).choices([...RELEASE_TRACKS])).option("--execute", "LIVE apply via gh (master-gated) \u2014 stamps seed files + labels into the repo").option("--only <target>", "deliver ONLY this manifest target (#3818) \u2014 one file, no labels/ruleset/registry writes; or the special target environments (#5035) to run the deployment-environment reconcile alone (dry-run classifies, --execute writes)").option("--var <KEY=VALUE...>", "placeholder values for repo-owned templates (repeatable)").option("--json", "machine-readable output").action(async (repo, cmdOpts) => {
     const o = {
       class: rawValue("--class", "deployable"),
       projectType: rawValue("--project-type", ""),
@@ -29595,6 +29844,45 @@ function registerBootstrapCommands(program3) {
     } catch (e) {
       return fail(`bootstrap apply: ${e.message}`);
     }
+    let effectiveTrack = bootstrapReleaseTrack;
+    if (!o.releaseTrack) {
+      try {
+        const meta = await fetchProjectBySlug(parsedRepo.slug, registryClientDeps(await loadConfig()));
+        if (meta?.releaseTrack && isReleaseTrack(meta.releaseTrack)) effectiveTrack = meta.releaseTrack;
+      } catch {
+      }
+    }
+    if (o.only.trim() === "environments") {
+      const client = defaultGitHubClient();
+      const envJson = { repo, track: effectiveTrack };
+      if (!o.execute) {
+        const drift = await verifyRepoEnvironments(repo, effectiveTrack, client);
+        const classified = drift.map(classifyEnvironmentDrift);
+        envJson.plan = classified;
+        if (o.json) console.log(JSON.stringify(envJson, null, 2));
+        else {
+          console.log(`bootstrap apply --only environments \u2014 dry-run (${repo}, track ${effectiveTrack}); no writes:`);
+          for (const c of classified) console.log(`  ${c.action} ${c.environment} \u2014 ${c.reason}`);
+          console.log("  (plan-gated protections \u2014 wait_timer/reviewers the org plan rejects \u2014 are reported at --execute)");
+        }
+      } else {
+        const envResult = await reconcileRepoEnvironments(repo, effectiveTrack, client);
+        const lines = [];
+        if (envResult.created.length) lines.push(`environments created: ${envResult.created.join(", ")}`);
+        if (envResult.updated.length) lines.push(`environments updated: ${envResult.updated.join(", ")}`);
+        if (envResult.skipped.length) lines.push(`environments current: ${envResult.skipped.join(", ")}`);
+        for (const gated of envResult.planGated) {
+          lines.push(`environment ${gated.environment}: plan-gated protections (${gated.protections.join(", ")} not settable on this org plan \u2014 policy-only provisioned)`);
+        }
+        envJson.result = { created: envResult.created, updated: envResult.updated, skipped: envResult.skipped, planGated: envResult.planGated };
+        if (o.json) console.log(JSON.stringify(envJson, null, 2));
+        else {
+          console.log(`LIVE environments apply to ${repo}:`);
+          lines.forEach((l) => console.log(`  ${l}`));
+        }
+      }
+      return;
+    }
     const manifestPath = "skills/bootstrap/seeds/manifest.json";
     if (!(0, import_node_fs38.existsSync)(manifestPath)) return fail(`bootstrap apply: ${manifestPath} not found; bootstrap runs from the MMI-Hub repo root by design \u2014 it stamps org-level resources (Project, Ruleset, secrets, access) through the GitHub App, which is only authorized from the Hub checkout`);
     const seedSource = await resolveHubSeedSource(execGitForSeedSource);
@@ -29609,6 +29897,7 @@ function registerBootstrapCommands(program3) {
       return fail(`bootstrap apply: --only '${onlyTarget}' names no seed in ${manifestPath}. Declared targets:
   ${known}`);
     }
+    const onlyManagedBlock = onlyTarget ? seedsToApply[0]?.managedBlock != null : false;
     const gh = async (args) => execFileP2("gh", args, { timeout: 2e4 });
     const readFile9 = (p) => (0, import_node_fs38.existsSync)(p) ? (0, import_node_fs38.readFileSync)(p, "utf8") : null;
     const enc = (p) => p.split("/").map(encodeURIComponent).join("/");
@@ -29716,9 +30005,22 @@ function registerBootstrapCommands(program3) {
         exists = false;
       }
       const planned = planSeedAction(resolved, exists);
-      const isBlock = resolved.source === "managed-block";
-      const content = planned.action === "create" || planned.action === "update" ? isBlock ? upsertManagedGitignoreBlock(remoteContent).content : resolveSeedContent(resolved, vars, readFile9) : null;
-      const action = reconcileSeedAction(planned, content, isBlock, remoteContent);
+      const isLegacyBlock = resolved.source === "managed-block";
+      let content = null;
+      let isManaged = isLegacyBlock || resolved.managedBlock != null;
+      if (planned.action === "create" || planned.action === "update") {
+        if (isLegacyBlock) {
+          content = upsertManagedGitignoreBlock(remoteContent).content;
+        } else {
+          const writeContent = resolveSeedWriteContent(resolved, vars, readFile9, remoteContent);
+          if (!writeContent.ok) {
+            return fail(`bootstrap apply: ${resolved.target}: ${writeContent.reason} \u2014 refusing to overwrite repo-owned content`);
+          }
+          content = writeContent.content;
+          isManaged = writeContent.managed;
+        }
+      }
+      const action = reconcileSeedAction(planned, content, isManaged, remoteContent);
       actions.push(action);
       const docBody = content ?? remoteContent;
       if (resolved.target.startsWith("docs/") && resolved.target.endsWith(".md") && docBody !== null) {
@@ -29771,11 +30073,11 @@ function registerBootstrapCommands(program3) {
           "--head",
           seedPlan.branch,
           "--title",
-          onlyTarget ? `chore: propagate org-owned ${onlyTarget} from MMI-Hub` : `bootstrap: seed ${parsedRepo.name} (${baseBranch} is protected)`,
+          onlyTarget ? `chore: propagate ${onlyManagedBlock ? "Hub-managed block in" : "org-owned"} ${onlyTarget} from MMI-Hub` : `bootstrap: seed ${parsedRepo.name} (${baseBranch} is protected)`,
           "--body",
           onlyTarget ? `Auto-opened by \`mmi-cli devops bootstrap apply ${repo} --only ${onlyTarget} --execute\` (#3818).
 
-\`${onlyTarget}\` is an org-owned seed declared in MMI-Hub's \`skills/bootstrap/seeds/manifest.json\` at MMI-Hub@${seedSource.sha}; this PR brings this repo's copy to the Hub's. It carries that file and nothing else \u2014 no labels, ruleset, merge settings or registry META were touched.
+${onlyManagedBlock ? `Only the marker-bounded Hub-managed block inside repo-owned \`${onlyTarget}\`` : `The org-owned \`${onlyTarget}\` seed`} is declared by MMI-Hub's \`skills/bootstrap/seeds/manifest.json\` at MMI-Hub@${seedSource.sha}; this PR reconciles that declared scope and preserves everything outside it. It carries that file and nothing else \u2014 no labels, ruleset, merge settings or registry META were touched.
 
 \`${baseBranch}\` is protected (${seedPlan.reason}), so delivery goes via this branch + PR \u2014 a direct contents PUT 409s on a protected base.` : `Auto-opened by \`mmi-cli devops bootstrap apply --execute ${repo}\` (#2286): \`${baseBranch}\` is protected (${seedPlan.reason}), so the org-managed seed files are delivered via this branch + PR \u2014 a direct contents PUT 409s on a protected base ("N of N required status checks are expected"). Seeds are from MMI-Hub@${seedSource.sha}.`
         ]);
@@ -29830,6 +30132,19 @@ function registerBootstrapCommands(program3) {
         }
       }
     }
+    if (o.execute && !onlyTarget) {
+      try {
+        const envResult = await reconcileRepoEnvironments(repo, effectiveTrack, defaultGitHubClient());
+        if (envResult.created.length) applied.push(`environments created: ${envResult.created.join(", ")}`);
+        if (envResult.updated.length) applied.push(`environments updated: ${envResult.updated.join(", ")}`);
+        if (envResult.skipped.length) applied.push(`environments current: ${envResult.skipped.join(", ")}`);
+        for (const gated of envResult.planGated) {
+          applied.push(`environment ${gated.environment}: plan-gated protections (${gated.protections.join(", ")} not settable on this org plan \u2014 policy-only provisioned)`);
+        }
+      } catch (e) {
+        applied.push(`environments (failed: ${e.message})`);
+      }
+    }
     if (o.execute && !onlyTarget) {
       for (const l of manifest.labels) {
         try {
@@ -29881,23 +30196,24 @@ LIVE apply to ${repo}:
   ${applied.join("\n  ")}`);
     }
   });
-  bootstrap.command("propagate").description("#4238: re-entrant canary\u2192wave tick \u2014 plan (or, with --execute, open) per-repo PRs fanning an org-owned seed out to the fleet").option("--target <path>", "the manifest target to propagate (an ownership:org + source:self seed, e.g. .github/workflows/agent-pr.yml)").option("--execute", "LIVE tick via gh (master-gated) \u2014 opens/reuses per-repo seed-propagate PRs; dry-run prints the plan only").option("--json", "machine-readable output").action(async () => {
+  bootstrap.command("propagate").description("#4238: re-entrant canary\u2192wave tick \u2014 plan (or, with --execute, open) per-repo PRs fanning an org-owned seed out to the fleet").option("--target <path>", "the manifest target to propagate (an org-owned whole file or declared Hub-managed block)").option("--execute", "LIVE tick via gh (master-gated) \u2014 opens/reuses per-repo seed-propagate PRs; dry-run prints the plan only").option("--json", "machine-readable output").action(async () => {
     const o = { target: rawValue("--target", ""), execute: rawFlag("--execute"), json: rawFlag("--json") };
     const manifestPath = "skills/bootstrap/seeds/manifest.json";
     if (!(0, import_node_fs38.existsSync)(manifestPath)) return fail(`bootstrap propagate: ${manifestPath} not found; run from the MMI-Hub repo root \u2014 the Hub's copies ARE the desired state this tick propagates`);
     const seedSource = await resolveHubSeedSource(execGitForSeedSource);
     if (!seedSource.ok) return fail(`bootstrap propagate: ${seedSource.reason}`);
     const manifest = loadBootstrapSeeds((0, import_node_fs38.readFileSync)(manifestPath, "utf8"));
-    const propagatable = manifest.seeds.filter((s) => s.ownership === "org" && s.source === "self");
+    const propagatable = manifest.seeds.filter(isPropagatableSeed);
     if (!o.target) {
       return fail(`bootstrap propagate: --target <path> is required \u2014 one of:
   ${propagatable.map((s) => s.target).join("\n  ")}`);
     }
     const seed = propagatable.find((s) => s.target === o.target);
-    if (!seed) return fail(`bootstrap propagate: --target '${o.target}' names no ownership:org + source:self seed in ${manifestPath}. Propagatable targets:
+    if (!seed) return fail(`bootstrap propagate: --target '${o.target}' names no centrally propagatable seed in ${manifestPath}. Propagatable targets:
   ${propagatable.map((s) => s.target).join("\n  ")}`);
-    if (!(0, import_node_fs38.existsSync)(seed.target)) return fail(`bootstrap propagate: the Hub's own copy of '${seed.target}' is missing \u2014 nothing to propagate`);
-    const hubContent = (0, import_node_fs38.readFileSync)(seed.target, "utf8");
+    if (!seed.managedBlock && !(0, import_node_fs38.existsSync)(seed.target)) return fail(`bootstrap propagate: the Hub's own copy of '${seed.target}' is missing \u2014 nothing to propagate`);
+    const hubContent = seed.managedBlock ? null : (0, import_node_fs38.readFileSync)(seed.target, "utf8");
+    const readSeedFile = (path2) => (0, import_node_fs38.existsSync)(path2) ? (0, import_node_fs38.readFileSync)(path2, "utf8") : null;
     const isWorkflowSeed = seed.target.startsWith(".github/workflows/");
     const cfg = await loadConfig();
     const projects = await fetchProjectsList(registryClientDeps(cfg));
@@ -29953,11 +30269,12 @@ LIVE apply to ${repo}:
     });
     const gh = async (args) => execFileP2("gh", args, { timeout: 2e4 });
     const enc = (p) => p.split("/").map(encodeURIComponent).join("/");
-    const branchPrefix = "seed-propagate";
     const reads = [];
+    const desiredByRepo = /* @__PURE__ */ new Map();
     for (const r of repos) {
       if (r.waiver) continue;
-      const baseBranch = classOf(r.repo) === "content" ? "main" : "development";
+      const repoClass = classOf(r.repo);
+      const baseBranch = repoClass === "content" ? "main" : "development";
       let content = null;
       try {
         const resp = await gh(["api", `repos/${r.repo}/contents/${enc(seed.target)}?ref=${baseBranch}`]);
@@ -29966,13 +30283,35 @@ LIVE apply to ${repo}:
       } catch {
         content = null;
       }
-      const drift = compareSeedBytes(hubContent, content);
+      let desired;
+      if (seed.managedBlock) {
+        const vars = withDerivedRepoVars({}, parseOwnerRepo(r.repo), repoClass);
+        const resolved = resolveSeedWriteContent(seed, vars, readSeedFile, content);
+        if (!resolved.ok) {
+          return fail(`bootstrap propagate: ${r.repo} ${seed.target}: ${resolved.reason} \u2014 refusing to overwrite repo-owned content`);
+        }
+        if (resolved.content == null) {
+          return fail(`bootstrap propagate: cannot resolve the full template or managed block source for '${seed.target}' \u2014 refusing a partial fleet plan`);
+        }
+        desired = resolved.content;
+      } else {
+        desired = hubContent;
+      }
+      desiredByRepo.set(r.repo, desired);
+      const drift = compareSeedBytes(desired, content);
       let pr2;
       try {
-        const branch = `${branchPrefix}-${r.slug}`;
-        const listed = await gh(["pr", "list", "--repo", r.repo, "--head", branch, "--base", baseBranch, "--state", "all", "--json", "number,url,state,statusCheckRollup,mergeCommit,body", "--limit", "1"]);
-        const arr = JSON.parse(listed.stdout || "[]");
-        const p = arr[0];
+        const listBranchPrs = async (branch) => {
+          const listed = await gh(["pr", "list", "--repo", r.repo, "--head", branch, "--base", baseBranch, "--state", "all", "--json", "number,url,state,statusCheckRollup,mergeCommit,body,files", "--limit", "100"]);
+          return JSON.parse(listed.stdout || "[]");
+        };
+        const targetSpecific = (await listBranchPrs(propagationBranch(r.repo, seed.target))).map((p2) => ({ ...p2, files: p2.files?.map((f) => f.path) }));
+        let identified = propagationPrCandidatesForTarget(seed.target, targetSpecific, []);
+        if (!identified.length) {
+          const legacy = (await listBranchPrs(legacyPropagationBranch(r.repo))).map((p2) => ({ ...p2, files: p2.files?.map((f) => f.path) }));
+          identified = propagationPrCandidatesForTarget(seed.target, [], legacy);
+        }
+        const p = identified[0];
         if (p) {
           const rollup = p.statusCheckRollup ?? [];
           const checks = rollup.length === 0 ? "none" : rollup.some((c) => c.conclusion === "FAILURE" || c.state === "FAILURE") ? "red" : rollup.every((c) => c.conclusion === "SUCCESS" || c.state === "SUCCESS") ? "success" : "pending";
@@ -30005,9 +30344,8 @@ LIVE apply to ${repo}:
       const headSha = seedSource.sha;
       for (const rec of plan.records) {
         if (rec.action !== "open-pr") continue;
-        const repoEntry = repos.find((r) => r.repo === rec.repo);
         const baseBranch = classOf(rec.repo) === "content" ? "main" : "development";
-        const branch = `${branchPrefix}-${repoEntry.slug}`;
+        const branch = propagationBranch(rec.repo, seed.target);
         const baseRef = await gh(["api", `repos/${rec.repo}/git/ref/heads/${baseBranch}`, "--jq", ".object.sha"]);
         const baseSha = baseRef.stdout.trim();
         let branchExists = true;
@@ -30025,7 +30363,9 @@ LIVE apply to ${repo}:
           existingSha = void 0;
         }
         const tmp = (0, import_node_path36.join)((0, import_node_os16.tmpdir)(), `mmi-propagate-${process.pid}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}.json`);
-        (0, import_node_fs38.writeFileSync)(tmp, JSON.stringify(contentPutBody(seed.target, hubContent, branch, existingSha)), "utf8");
+        const desiredContent = desiredByRepo.get(rec.repo);
+        if (desiredContent == null) return fail(`bootstrap propagate: no resolved content for ${rec.repo} ${seed.target} \u2014 refusing to write`);
+        (0, import_node_fs38.writeFileSync)(tmp, JSON.stringify(contentPutBody(seed.target, desiredContent, branch, existingSha)), "utf8");
         try {
           await gh(contentPutInputArgs(rec.repo, seed.target, tmp));
         } finally {
@@ -30034,8 +30374,14 @@ LIVE apply to ${repo}:
           } catch {
           }
         }
-        const openPrs = await gh(["pr", "list", "--repo", rec.repo, "--head", branch, "--base", baseBranch, "--state", "open", "--json", "number,url"]);
-        const prDecision = decideSeedPrAction(JSON.parse(openPrs.stdout || "[]"));
+        const openPrs = await gh(["pr", "list", "--repo", rec.repo, "--head", branch, "--base", baseBranch, "--state", "open", "--json", "number,url,body,files"]);
+        const listedOpenPrs = JSON.parse(openPrs.stdout || "[]");
+        const identifiedOpenPrs = propagationPrCandidatesForTarget(
+          seed.target,
+          listedOpenPrs.map((p) => ({ ...p, files: p.files?.map((f) => f.path) })),
+          []
+        );
+        const prDecision = decideSeedPrAction(identifiedOpenPrs);
         let prUrl;
         if (prDecision.action === "reuse") {
           prUrl = prDecision.url;
@@ -30050,11 +30396,12 @@ LIVE apply to ${repo}:
             "--head",
             branch,
             "--title",
-            `chore: propagate org-owned ${seed.target} from MMI-Hub (wave ${rec.wave})`,
+            `chore: propagate ${seed.managedBlock ? "Hub-managed block in" : "org-owned"} ${seed.target} from MMI-Hub (wave ${rec.wave})`,
             "--body",
             `Auto-opened by \`mmi-cli devops bootstrap propagate --target ${seed.target} --execute\` (#4238), wave ${rec.wave}.
 
-Propagates MMI-Hub@${headSha} 's copy of \`${seed.target}\` to this repo \u2014 the file this PR carries and nothing else.
+Propagates MMI-Hub@${headSha}'s ${seed.managedBlock ? "declared marker-bounded block inside repo-owned" : "org-owned copy of"} \`${seed.target}\` \u2014 the file this PR carries and nothing else; content outside a managed block remains untouched.
+${renderPropagationTargetMarker(seed.target)}
 
 Rollback: \`mmi-cli devops bootstrap rollback ${rec.repo} --target ${seed.target} --execute\` (#4240) reverts this PR's merge commit; never re-run propagate with old bytes.`
           ]);
@@ -30092,18 +30439,18 @@ Rollback: \`mmi-cli devops bootstrap rollback ${rec.repo} --target ${seed.target
     const seedSource = await resolveHubSeedSource(execGitForSeedSource);
     if (!seedSource.ok) return fail(`bootstrap rollback: ${seedSource.reason}`);
     const manifest = loadBootstrapSeeds((0, import_node_fs38.readFileSync)(manifestPath, "utf8"));
-    const propagatable = manifest.seeds.filter((s) => s.ownership === "org" && s.source === "self");
+    const propagatable = manifest.seeds.filter(isPropagatableSeed);
     if (!o.target) {
       return fail(`bootstrap rollback: --target <path> is required \u2014 one of:
   ${propagatable.map((s) => s.target).join("\n  ")}`);
     }
     const seed = propagatable.find((s) => s.target === o.target);
-    if (!seed) return fail(`bootstrap rollback: --target '${o.target}' names no ownership:org + source:self seed in ${manifestPath}. Propagatable (hence rollback-able) targets:
+    if (!seed) return fail(`bootstrap rollback: --target '${o.target}' names no centrally propagatable seed in ${manifestPath}. Propagatable (hence rollback-able) targets:
   ${propagatable.map((s) => s.target).join("\n  ")}`);
     const slug = parsedRepo.slug;
     const baseBranch = o.class === "content" ? "main" : "development";
-    const branchPrefix = "seed-propagate";
-    const propagateBranch = `${branchPrefix}-${slug}`;
+    const targetPropagateBranch = propagationBranch(repo, seed.target);
+    const legacyPropagateBranch = legacyPropagationBranch(repo);
     const gh = async (args) => execFileP2("gh", args, { timeout: 2e4 });
     const enc = (p) => p.split("/").map(encodeURIComponent).join("/");
     let candidates;
@@ -30126,9 +30473,17 @@ Rollback: \`mmi-cli devops bootstrap rollback ${rec.repo} --target ${seed.target
     } else {
       candidates = [];
       try {
-        const listed = await gh(["pr", "list", "--repo", repo, "--head", propagateBranch, "--base", baseBranch, "--state", "merged", "--json", "number,url,mergedAt,mergeCommit,files", "--limit", "20"]);
-        const arr = JSON.parse(listed.stdout || "[]");
-        for (const p of arr) {
+        const listMergedBranchPrs = async (branch) => {
+          const listed = await gh(["pr", "list", "--repo", repo, "--head", branch, "--base", baseBranch, "--state", "merged", "--json", "number,url,mergedAt,mergeCommit,body,files", "--limit", "100"]);
+          return JSON.parse(listed.stdout || "[]");
+        };
+        const targetSpecific = (await listMergedBranchPrs(targetPropagateBranch)).map((p) => ({ ...p, files: p.files?.map((f) => f.path) }));
+        let identified = propagationPrCandidatesForTarget(seed.target, targetSpecific, []);
+        if (!identified.length) {
+          const legacy = (await listMergedBranchPrs(legacyPropagateBranch)).map((p) => ({ ...p, files: p.files?.map((f) => f.path) }));
+          identified = propagationPrCandidatesForTarget(seed.target, [], legacy);
+        }
+        for (const p of identified) {
           if (!p.mergeCommit?.oid) continue;
           candidates.push({
             repo,
@@ -30137,11 +30492,11 @@ Rollback: \`mmi-cli devops bootstrap rollback ${rec.repo} --target ${seed.target
             url: p.url,
             mergeSha: p.mergeCommit.oid,
             mergedAt: p.mergedAt ?? "",
-            files: (p.files ?? []).map((f) => f.path)
+            files: p.files ?? []
           });
         }
       } catch (e) {
-        return fail(`bootstrap rollback: could not read ${repo}'s merged ${propagateBranch} PR history: ${e.message}`);
+        return fail(`bootstrap rollback: could not read ${repo}'s merged ${targetPropagateBranch} or positively matching legacy PR history: ${e.message}`);
       }
     }
     const plan = planRollback(repo, seed.target, slug, candidates);
@@ -32136,7 +32491,7 @@ var import_node_os18 = require("node:os");
 var import_node_path42 = require("node:path");
 
 // src/worktree-install-cache.ts
-var import_node_crypto8 = require("node:crypto");
+var import_node_crypto9 = require("node:crypto");
 var import_node_fs42 = require("node:fs");
 var import_node_path41 = require("node:path");
 var CACHE_DIR = "worktree-install-cache";
@@ -32164,7 +32519,7 @@ var realWorktreeInstallCacheFs = {
   }
 };
 function hashLockfileBytes(contents) {
-  return (0, import_node_crypto8.createHash)("sha256").update(contents).digest("hex");
+  return (0, import_node_crypto9.createHash)("sha256").update(contents).digest("hex");
 }
 function resolveWorktreeInstallLockfile(packageDir, fs2 = realWorktreeInstallCacheFs) {
   for (const name of LOCKFILE_NAMES) {
@@ -33190,7 +33545,7 @@ ${err.stderr ?? ""}`;
 
 // src/issue-commands.ts
 var import_node_fs44 = require("node:fs");
-var import_node_crypto9 = require("node:crypto");
+var import_node_crypto10 = require("node:crypto");
 var ghRunner = async (args, timeoutMs) => (await execFileP2("gh", args, { timeout: timeoutMs })).stdout;
 var ReparentConflictError = class extends Error {
   constructor(message, payload) {
@@ -33481,7 +33836,7 @@ function rowIdempotencyKey(batchKey, spec) {
   const identity = `${spec.type}
 ${spec.title.trim()}
 ${spec.body ?? ""}`;
-  const hash = (0, import_node_crypto9.createHash)("sha256").update(identity).digest("hex").slice(0, 16);
+  const hash = (0, import_node_crypto10.createHash)("sha256").update(identity).digest("hex").slice(0, 16);
   return `${batchKey}:${hash}`;
 }
 var BATCH_SPEC_KEYS = /* @__PURE__ */ new Set(["type", "title", "body", "priority", "labels", "label", "parent", "repo", "surface"]);
@@ -34160,7 +34515,7 @@ function onboardPluginGate(deps) {
     declared,
     settingsDeclared: readSettingsAutoUpdate(deps.readSettings(), MMI_MARKETPLACE_NAME)
   }).effective;
-  return autoUpdate ? { ok: false, detail: "background auto-update is ON \u2014 duplicate writer; run `mmi-updater reconcile` outside Claude Code to disable it" } : { ok: true, detail: "background auto-update off; mmi-updater is the single release-gated writer" };
+  return autoUpdate ? { ok: false, detail: "background auto-update is ON \u2014 duplicate writer; run `mmi-hub update` outside Claude Code to disable it" } : { ok: true, detail: "background auto-update off; mmi-hub is the single release-gated writer" };
 }
 async function collectOnboardStatus(opts = {}) {
   const cfg = await loadConfig();
@@ -36460,13 +36815,13 @@ var surfaces_default = {
       publishVisibility: "public"
     },
     {
-      id: "mmi-updater",
+      id: "mmi-hub",
       classification: "capability",
       kind: "cli",
       ownerPath: "updater/package.json",
       deliveryPath: "updater/package.json",
       delivery: "npm",
-      applicability: "editor-agnostic agent surfaces",
+      applicability: "editor-agnostic MMI installation and maintenance; npm package @mutmutco/hub exposing mmi-hub",
       versionCoordinated: true,
       versionPaths: [
         {
@@ -36944,7 +37299,7 @@ function checkCliVersion(input, releasedNote) {
       warn: true,
       label: "mmi-cli",
       detail: `${report.currentVersion} \u2014 freshness UNKNOWN, the published version could not be read`,
-      fix: "check it directly: `mmi-cli --version` against `npm view @mutmutco/cli version`; update with `npm install -g @mutmutco/cli@<released>`",
+      fix: "check actual maintenance state with `mmi-hub status`; converge with `mmi-hub update`",
       verbose: evidence
     };
   }
@@ -36954,7 +37309,7 @@ function checkCliVersion(input, releasedNote) {
     ok: false,
     label: "mmi-cli",
     detail: `${report.currentVersion} \u2192 ${report.releasedVersion}`,
-    fix: report.fix,
+    fix: "run `mmi-hub update` to converge the CLI and every present host surface",
     verbose: evidence
   };
 }
@@ -36967,8 +37322,8 @@ function checkFleetDrift(probe) {
       id,
       ok: true,
       label,
-      detail: "no updater journal \u2014 no reconciler scheduled on this machine",
-      verbose: [`journal: ${probe.journalPath} (absent)`, "schedule one with `mmi-updater install` (@mutmutco/updater)"]
+      detail: "no MMI Hub maintenance journal on this machine",
+      verbose: [`journal: ${probe.journalPath} (absent)`, "bootstrap with `npm install -g @mutmutco/hub` then `mmi-hub install`"]
     };
   }
   if (probe.unreadable) {
@@ -36979,14 +37334,14 @@ function checkFleetDrift(probe) {
       warn: true,
       label,
       detail: `journal could not be read \u2014 ${probe.unreadable}`,
-      fix: `read ${probe.journalPath} directly, or re-register the reconciler with \`mmi-updater install\``,
+      fix: `read ${probe.journalPath} directly, or repair maintenance with \`mmi-hub install\``,
       verbose: [`journal: ${probe.journalPath}`, `read failed: ${probe.unreadable}`]
     };
   }
   const evidence = [
     `journal: ${probe.journalPath}${probe.lastEventAt ? ` (last event ${probe.lastEventAt})` : ""}${probe.truncated ? ` \u2014 newest ${JOURNAL_TAIL_BYTES / 1024} KiB read` : ""}`,
     `expected: ${probe.expected ?? "(no gated release recorded yet)"}`,
-    ...probe.surfaces.map((s) => `${s.surface}: installed ${s.installed ?? "unknown"} \u2014 ${s.verdict}${s.detail ? ` (${s.detail})` : ""}${s.compat ? ` [compat ${s.compat}]` : ""}`),
+    ...probe.surfaces.map((s) => `${s.surface}: last recorded ${s.installed ?? "unknown"} \u2014 ${s.verdict}${s.detail ? ` (${s.detail})` : ""}${s.compat ? ` [compat ${s.compat}]` : ""}`),
     ...probe.absent?.length ? [`absent since their last arm, skipped by the reconciler: ${probe.absent.join(", ")}`] : []
   ];
   if (!probe.expected) {
@@ -37031,7 +37386,7 @@ function checkFleetDrift(probe) {
       warn: true,
       label,
       detail: `${probe.expected} \u2014 ${probe.surfaces.length - unverified.length} converged, ${unverifiedNote}: no installed version recorded`,
-      fix: `read why in ${probe.journalPath} (each arm records its own reason) \u2014 \`mmi-updater reconcile\` retries now; doctor never installs`,
+      fix: `read why in ${probe.journalPath} (each arm records its own reason) \u2014 \`mmi-hub update\` retries now; doctor never installs`,
       verbose: evidence
     };
   }
@@ -37042,7 +37397,7 @@ function checkFleetDrift(probe) {
     label,
     ...unverified.length ? { verified: false } : {},
     detail: `${drifted.length} of ${probe.surfaces.length} surface(s) behind ${probe.expected}: ${drifted.map((s) => `${s.surface} ${s.installed}`).join(", ")}${unverifiedNote ? `; ${unverifiedNote}` : ""}`,
-    fix: `the scheduled updater converges these on its next tick \u2014 \`mmi-updater reconcile\` runs one now; doctor never installs${unverified.length ? `. The unverified surface(s) recorded no version \u2014 read their reason in ${probe.journalPath}` : ""}`,
+    fix: `hourly Hub maintenance converges these on its next tick \u2014 \`mmi-hub update\` runs one now; doctor never installs${unverified.length ? `. The unverified surface(s) recorded no version \u2014 read their reason in ${probe.journalPath}` : ""}`,
     verbose: evidence
   };
 }
@@ -37335,7 +37690,7 @@ function gcReapable(plan) {
 async function runDoctorClean(opts, io, deps) {
   const full = !opts.fast && !opts.banner && !opts.preflight;
   const applyEnv = full;
-  const applyRepo = full && opts.repoWrites !== false;
+  const applyRepo = full && opts.repoWrites === true;
   const lane = {
     banner: Boolean(opts.banner),
     fast: Boolean(opts.fast),
@@ -37450,7 +37805,7 @@ async function runDoctorClean(opts, io, deps) {
       ...cli,
       ok: false,
       detail: cli.ok ? `missing commands: ${missing.join(", ")}` : cli.detail,
-      fix: `run \`${cliUpdateCommand(released)}\` \u2014 the CLI lacks ${missing.join(", ")} (or wait for the scheduled updater's next tick)`,
+      fix: `run \`mmi-hub update\` \u2014 the CLI lacks ${missing.join(", ")} (or wait for hourly Hub maintenance)`,
       verbose: [...cli.verbose ?? [], `missing commands: ${missing.join(", ")}`]
     });
   }
@@ -37483,7 +37838,7 @@ async function runDoctorClean(opts, io, deps) {
       emitNow({ ok: true, id: "gitignore-block", label: "gitignore block", detail: "rewrote managed block", verbose: giEvidence });
       restartPending = true;
     } else {
-      emitNow({ ok: false, id: "gitignore-block", label: "gitignore block", fix: "run `mmi-cli doctor` (without --no-repo-writes) to write the org-managed .gitignore block", verbose: giEvidence });
+      emitNow({ ok: false, id: "gitignore-block", label: "gitignore block", fix: "run `mmi-cli doctor --apply` to write the org-managed .gitignore block", verbose: giEvidence });
     }
   }
   async function runPluginCacheRow() {
@@ -37906,7 +38261,7 @@ async function runDoctorClean(opts, io, deps) {
           // #3574: `${n} stale` was prepended to `fix` because the ✗ branch would not render `detail` —
           // the same fact this row already puts in `detail` on its ✓ path four lines up. One convention now.
           detail: `${n} stale`,
-          fix: "run `mmi-cli doctor` (without --no-repo-writes) to reap merged branches, stale refs, and dead worktrees",
+          fix: "run `mmi-cli doctor --apply` to reap merged branches, stale refs, and dead worktrees",
           verbose: gcEvidence
         });
       }
@@ -37924,7 +38279,7 @@ async function runDoctorClean(opts, io, deps) {
         restartPending = true;
       }
     } else {
-      emitNow(scratch.plan.safeAuto.length === 0 ? { id: "scratch", ok: true, label: "scratch", verbose: scratchEvidence } : { id: "scratch", ok: false, label: "scratch", detail: `${scratch.plan.safeAuto.length} aged item(s)`, fix: "run `mmi-cli doctor` (without --no-repo-writes)", verbose: scratchEvidence });
+      emitNow(scratch.plan.safeAuto.length === 0 ? { id: "scratch", ok: true, label: "scratch", verbose: scratchEvidence } : { id: "scratch", ok: false, label: "scratch", detail: `${scratch.plan.safeAuto.length} aged item(s)`, fix: "run `mmi-cli doctor --apply`", verbose: scratchEvidence });
     }
   }
   const prefix = [
@@ -38386,9 +38741,8 @@ function mmiDoctorDeps(opts = {}) {
     pluginTrustState: () => codexHookTrustState(),
     releasedVersion: throttled ? throttled.read : fetchNpmReleasedVersion,
     releasedVersionNote: throttled ? throttled.note : void 0,
-    // #4954: the fleet reconciler's journal, read. `@mutmutco/updater` owns every npm install now, so
-    // doctor's own CLI self-update (#3272) is gone and this read is what took its place — the same
-    // journal `mmi-updater stamp` reports from, parsed here into one row.
+    // #4954/#5023: the Hub maintenance journal is read-only last-run evidence. `@mutmutco/hub`
+    // owns every version install; `mmi-hub status` separately probes actual installed state.
     fleetDrift: () => readFleetDrift(process.env),
     // #3282: the --apply self-heal for a stale/unresolved Claude plugin — the same marketplace reinstall
     // `mmi-cli plugin heal` drives. Takes effect on the next Claude reload, so the row asks for a restart.
@@ -39245,7 +39599,7 @@ withExamples(mutating(
       return fail("worktree create: --claim/--for need an issue-ref argument (e.g. worktree create 2687 --claim)");
     }
     const repoRoot2 = await primaryCheckoutRoot(process.cwd()) ?? process.cwd();
-    const wtPath = o.path ?? defaultWorktreePath(repoRoot2, branch);
+    const wtPath = o.path ? (0, import_node_path46.resolve)(o.path) : defaultWorktreePath(repoRoot2, branch);
     const { base: fallbackBase, fetchBranch, preferRemote } = resolveWorktreeBase(fromRef, o.remote);
     let base = fallbackBase;
     step = `fetch the base ref ${fromRef}`;
@@ -42001,14 +42355,14 @@ access.command("audit").description("audit collaborator roles + train-branch pus
 });
 access.command("capabilities").description("enumerate your effective vault reach \u2014 every credential NAME + tier + scope you can read/use across project + org/master tiers (names only, no values) (#1615)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--json", "machine-readable output").action((o) => withSecrets((d) => secretsCapabilities(d, o)));
 var isWin2 = process.platform === "win32";
-program2.command("doctor").description("heal plugin wiring and clean up repo cruft \u2014 repairs run by default (#3975); CLI/plugin updates belong to `mmi-updater` and are only REPORTED here (#4954); use --verbose for the full audit checklist").option("--banner", "one-line resume summary; silent when all gates pass").option("--fast", "offline-safe fast lane; read-only, skips slow checks and network probes").option("--preflight", "read-only fast gate for automation: measures and reports with the shared exit code, zero writes (#4199, canon); heal env drift with a plain run or --no-repo-writes").option("--verbose", "print the evidence behind every check \u2014 probes, resolved paths, versions compared, and the names behind each count (#2977)").option("--guide", "print the MMI Agentic Onboarding guide URL").option("--json", "machine-readable output (an output format \u2014 repairs still run by lane)").option("--apply", "deprecated no-op: repairs run by default now (#3975); kept so older instructions still parse").option("--no-repo-writes", "env/plugin repairs only \u2014 never mutate the repo working tree; report pending managed .gitignore repairs with the follow-up command (for train preflights)").option("--self", "verify CLI/plugin version parity and gh auth reach; suggests plugin-heal on a hard gap (reads the published version, so not offline-safe) (#2689)").addHelpText("after", "\nExit codes:\n  0  no hard gaps remain; advisory gaps may exist\n  1  one or more included hard checks failed\n\nA plain run heals the plugin install and cleans repo cruft (gitignore block, merged branches, dead\nworktrees, aged scratch) automatically (#3975). CLI and plugin UPDATES belong to the scheduled\n`mmi-updater` (#4954); doctor reports the lag and the fleet-drift row and never installs.\n--no-repo-writes keeps the working tree untouched for train preflights; --banner/--fast/--self are\nread-only lanes.\n\n--banner keeps the legacy SessionStart contract and returns 0 unless the process crashes.\n").action(async (opts) => {
+program2.command("doctor").description("safely heal active plugin wiring and report hygiene; repository cleanup requires explicit --apply (#5023), while version convergence belongs to `mmi-hub update`").option("--banner", "one-line resume summary; silent when all gates pass").option("--fast", "offline-safe fast lane; read-only, skips slow checks and network probes").option("--preflight", "read-only fast gate for automation: measures and reports with the shared exit code, zero writes").option("--verbose", "print the evidence behind every check \u2014 probes, resolved paths, versions compared, and the names behind each count (#2977)").option("--guide", "print the canonical MMI Agentic Onboarding URL").option("--json", "machine-readable output (an output format \u2014 repairs still run by lane)").option("--apply", "advanced explicit lane: also apply guarded repository cleanup (gitignore, docs index, board mechanics, merged branches, dead worktrees, aged scratch)").option("--no-repo-writes", "compatibility spelling for the safe default: env/plugin repairs only, never mutate the repository").option("--self", "verify CLI/plugin version parity and gh auth reach; suggests plugin-heal on a hard gap (reads the published version, so not offline-safe) (#2689)").addHelpText("after", "\nExit codes:\n  0  no hard gaps remain; advisory gaps may exist\n  1  one or more included hard checks failed\n\nA plain run may heal safe machine-global plugin wiring but never mutates the repository. Run\n`mmi-cli doctor --apply` only when you explicitly want the guarded full repository cleanup lane.\nCLI and host version convergence belongs to `mmi-hub update`; doctor reports lag and last-run evidence.\n--banner/--fast/--self/--preflight are read-only lanes.\n").action(async (opts) => {
   if (opts.guide) {
-    consoleIo.log("MMI Agentic Onboarding: docs/Architecture/agentic-dev-environment.md");
+    consoleIo.log(`MMI Agentic Onboarding: ${CANONICAL_ONBOARDING_URL}`);
     return;
   }
   process.exitCode = await runDoctorClean(
     {
-      repoWrites: opts.repoWrites,
+      repoWrites: opts.apply === true && opts.repoWrites !== false,
       banner: opts.banner,
       preflight: opts.preflight,
       fast: opts.fast || opts.self,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "3.136.0",
+  "version": "3.138.0",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",