@mutmutco/cli 3.139.10 → 3.139.12

package/dist/main.cjs

@@ -5747,6 +5747,16 @@ function rulesetRequiredContexts(ruleset) {
   }
   return contexts;
 }
+function rulesetBranchIncludes(ruleset) {
+  const raw = ruleset.conditions?.ref_name?.include;
+  return Array.isArray(raw) ? [...new Set(raw.filter((ref) => typeof ref === "string" && ref.length > 0))].sort((a, b) => a.localeCompare(b)) : [];
+}
+function patchRulesetBranchIncludes(body, branches) {
+  const conditions = body.conditions && typeof body.conditions === "object" && !Array.isArray(body.conditions) ? body.conditions : {};
+  const currentRef = conditions.ref_name && typeof conditions.ref_name === "object" && !Array.isArray(conditions.ref_name) ? conditions.ref_name : {};
+  const include = [...new Set(branches)].map((branch) => branch.startsWith("refs/") ? branch : `refs/heads/${branch}`);
+  return { ...body, conditions: { ...conditions, ref_name: { ...currentRef, include } } };
+}
 function patchRulesetRequiredContexts(body, contexts) {
   const sorted = [...new Set(contexts)].sort((a, b) => a.localeCompare(b));
   const rules2 = (body.rules ?? []).map((rule) => {
@@ -5844,13 +5854,16 @@ async function gateIsProvenGreen(repo, client, baseBranch, gateFiles = DEFAULT_G
 async function activateProductRuleset(repo, rulesetBody, client, enforcement = "active") {
   const body = { ...rulesetBody, enforcement };
   const want = new Set(rulesetRequiredContexts({ rules: body.rules }));
+  const wantBranches = rulesetBranchIncludes(body);
   const list = await client.rest("GET", `repos/${repo}/rulesets`, { timeoutMs: 2e4 });
   const existing = findProductRuleset(list ?? []);
   if (existing?.id != null) {
     const detail = await client.rest("GET", `repos/${repo}/rulesets/${existing.id}`, { timeoutMs: 2e4 });
     const have = new Set(rulesetRequiredContexts(detail));
-    if (detail.enforcement === enforcement && have.size === want.size && [...want].every((c) => have.has(c))) {
-      return { action: "skipped", enforcement, detail: `${enforcement} ruleset already matches required contexts` };
+    const haveBranches = rulesetBranchIncludes(detail);
+    const branchesMatch = haveBranches.length === wantBranches.length && wantBranches.every((ref, index) => ref === haveBranches[index]);
+    if (detail.enforcement === enforcement && branchesMatch && have.size === want.size && [...want].every((c) => have.has(c))) {
+      return { action: "skipped", enforcement, detail: `${enforcement} ruleset already matches required contexts and branches` };
     }
     await client.rest("PUT", `repos/${repo}/rulesets/${existing.id}`, { body, timeoutMs: 2e4 });
     return { action: "updated", enforcement, detail: `ruleset ${existing.id}` };
@@ -6826,9 +6839,11 @@ function checkGateBudget(files, opts = {}) {
 var PROJECT_TYPES = ["web-app", "hub-service", "content", "desktop-app", "desktop-game", "mobile-app", "non-deployable", "cli-tool", "worker"];
 var DEPLOY_MODELS = ["hub-serverless", "serverless", "tenant-container", "solo-container", "static-cdn", "registry-publish", "content", "none"];
 var RELEASE_TRACKS = ["full", "direct", "trunk"];
+var REQUIRED_CHECK_BRANCHES = ["development", "rc", "main"];
 var PROJECT_TYPE_SET = new Set(PROJECT_TYPES);
 var DEPLOY_MODEL_SET = new Set(DEPLOY_MODELS);
 var RELEASE_TRACK_SET = new Set(RELEASE_TRACKS);
+var REQUIRED_CHECK_BRANCH_SET = new Set(REQUIRED_CHECK_BRANCHES);
 function isProjectType(value) {
   return Boolean(value && PROJECT_TYPE_SET.has(value));
 }
@@ -6838,6 +6853,9 @@ function isDeployModel(value) {
 function isReleaseTrack(value) {
   return Boolean(value && RELEASE_TRACK_SET.has(value));
 }
+function isRequiredCheckBranch(value) {
+  return Boolean(value && REQUIRED_CHECK_BRANCH_SET.has(value));
+}
 function repoIsHub(repo) {
   return repo.toLowerCase().endsWith("/mmi-hub") || repo.toLowerCase() === "mmi-hub";
 }
@@ -6906,6 +6924,13 @@ function branchesForTrack(track) {
   if (track === "direct") return ["development", "main"];
   return ["development", "rc", "main"];
 }
+function resolveRequiredCheckBranches(meta, repo) {
+  const explicit = Array.isArray(meta?.requiredCheckBranches) ? meta.requiredCheckBranches.filter((branch) => typeof branch === "string" && isRequiredCheckBranch(branch)) : [];
+  if (explicit.length > 0 && explicit.length === meta?.requiredCheckBranches?.length && new Set(explicit).size === explicit.length) {
+    return REQUIRED_CHECK_BRANCHES.filter((branch) => explicit.includes(branch));
+  }
+  return branchesForTrack(resolveReleaseTrack(meta, void 0, repo));
+}
 function promotionBranchesForTrack(track) {
   if (track === "trunk") return [];
   if (track === "direct") return ["main"];
@@ -7064,7 +7089,7 @@ var GATE_RUNTIME_DEFAULTS = {
   node: { cmd: DEFAULT_GATE_CMD, install: "npm ci" },
   python: { cmd: "pytest", install: 'pip install -e ".[dev]"' }
 };
-function gateSeedVars(cls, releaseTrack, runtime = "node") {
+function gateSeedVars(cls, releaseTrack, runtime = "node", requiredCheckBranches) {
   const rt = GATE_RUNTIME_DEFAULTS[runtime] ?? GATE_RUNTIME_DEFAULTS.node;
   const runtimeVars = {
     GATE_RUNTIME: runtime,
@@ -7078,6 +7103,9 @@ function gateSeedVars(cls, releaseTrack, runtime = "node") {
     GATE_BUDGET_SHA: BLESSED_RUN_WITH_BUDGET_SHA
   };
   const track = releaseTrack ?? (cls === "content" ? "trunk" : "full");
+  const trackBranches = track === "trunk" ? ["main"] : track === "direct" ? ["development", "main"] : ["development", "rc", "main"];
+  const rulesetBranches = requiredCheckBranches?.length ? [...requiredCheckBranches] : trackBranches;
+  const rulesetRefs = JSON.stringify(rulesetBranches.map((branch) => `refs/heads/${branch}`));
   const windowsCompat = {
     // #5113: opt-in informational windows-latest proof. Default OFF — the CLI fills the rendered job
     // YAML (or '') at the final layering step; never hand-passed.
@@ -7089,7 +7117,7 @@ function gateSeedVars(cls, releaseTrack, runtime = "node") {
       ...windowsCompat,
       GATE_PUSH_BRANCHES_YAML: "[main]",
       GATE_FULL_RUN_BRANCH: "main",
-      GATE_RULESET_BRANCH_REFS_JSON: '["refs/heads/main"]'
+      GATE_RULESET_BRANCH_REFS_JSON: rulesetRefs
     };
   }
   if (track === "direct") {
@@ -7098,7 +7126,7 @@ function gateSeedVars(cls, releaseTrack, runtime = "node") {
       ...windowsCompat,
       GATE_PUSH_BRANCHES_YAML: "[development, main]",
       GATE_FULL_RUN_BRANCH: "development",
-      GATE_RULESET_BRANCH_REFS_JSON: '["refs/heads/development", "refs/heads/main"]'
+      GATE_RULESET_BRANCH_REFS_JSON: rulesetRefs
     };
   }
   return {
@@ -7106,10 +7134,10 @@ function gateSeedVars(cls, releaseTrack, runtime = "node") {
     ...windowsCompat,
     GATE_PUSH_BRANCHES_YAML: "[development, rc, main]",
     GATE_FULL_RUN_BRANCH: "development",
-    GATE_RULESET_BRANCH_REFS_JSON: '["refs/heads/development", "refs/heads/rc", "refs/heads/main"]'
+    GATE_RULESET_BRANCH_REFS_JSON: rulesetRefs
   };
 }
-function withDerivedRepoVars(vars, parsed, cls, releaseTrack) {
+function withDerivedRepoVars(vars, parsed, cls, releaseTrack, requiredCheckBranches) {
   const out = { ...vars };
   out.REPO_NAME ??= parsed.name;
   out.REPO_SLUG ??= parsed.slug;
@@ -7117,7 +7145,7 @@ function withDerivedRepoVars(vars, parsed, cls, releaseTrack) {
   out.PROJECT_OWNER ??= parsed.owner;
   const track = releaseTrack ?? resolveBootstrapReleaseTrack(cls);
   const runtime = out.GATE_RUNTIME === "python" ? "python" : "node";
-  for (const [key, value] of Object.entries(gateSeedVars(cls, track, runtime))) {
+  for (const [key, value] of Object.entries(gateSeedVars(cls, track, runtime, requiredCheckBranches))) {
     out[key] ??= value;
   }
   if (out.GATE_WINDOWS_COMPAT === "true" && !out.GATE_WINDOWS_COMPAT_JOB_YAML) {
@@ -10624,7 +10652,7 @@ function validateRolloutPlan(planRaw, fleet) {
   } else {
     if (nonEmpty(hubReleaseVersion) && baselineVersion !== hubReleaseVersion.trim()) {
       violations.push(
-        `rollback baseline v${baselineVersion} is stale \u2014 the Hub's current release is v${hubReleaseVersion.trim()}; a v4 rollback would drop every fix shipped since. Bump infra/rollout-plan.json baseline (and the hub-serverless cohort v3 target) to the latest release.`
+        `rollback baseline v${baselineVersion} is stale \u2014 the Hub's current release is v${hubReleaseVersion.trim()}; a v4 rollback would drop every fix shipped since. Bump infra/rollout-plan.json baseline (and the hub-serverless cohort rollback target) to the latest known-good v4-only release.`
       );
     }
     if (baselineTag && baselineTag !== `v${baselineVersion}`) {
@@ -10651,7 +10679,7 @@ function validateRolloutPlan(planRaw, fleet) {
     if (!nonEmpty(cohort?.deployModel)) violations.push(`cohort ${label} names no deployModel`);
     if (!nonEmpty(cohort?.rollbackTrigger)) violations.push(`cohort ${label} names no rollback trigger`);
     if (!nonEmpty(cohort?.rollback?.mechanism)) violations.push(`cohort ${label} names no rollback mechanism`);
-    if (!nonEmpty(cohort?.rollback?.v3Target)) violations.push(`cohort ${label} names no compatible v3 target`);
+    if (!nonEmpty(cohort?.rollback?.v3Target)) violations.push(`cohort ${label} names no compatible rollback target`);
     if (cohort?.rollback?.independent !== true) violations.push(`cohort ${label} does not declare an independent rollback`);
     if (!Array.isArray(cohort?.dependsOn) || cohort.dependsOn.some((d) => !nonEmpty(d))) {
       violations.push(`cohort ${label} has a malformed dependsOn list`);
@@ -10677,10 +10705,10 @@ function validateRolloutPlan(planRaw, fleet) {
         violations.push(`${repo} has schedule ${JSON.stringify(member.schedule)} \u2014 expected "train" or "own"`);
       }
       if (member.v3Target === null && !nonEmpty(member.note)) {
-        violations.push(`${repo} has no v3 target and no note naming why`);
+        violations.push(`${repo} has no rollback target and no note naming why`);
       }
       if (member.v3Target !== null && !nonEmpty(member.v3Target)) {
-        violations.push(`${repo} has an empty v3 target \u2014 use null plus a note, or a real tag`);
+        violations.push(`${repo} has an empty rollback target \u2014 use null plus a note, or a real tag`);
       }
     }
   }
@@ -10689,7 +10717,7 @@ function validateRolloutPlan(planRaw, fleet) {
     const hubCanary = (Array.isArray(hubCohort?.members) ? hubCohort.members : []).find((m) => m?.role === "canary");
     if (hubCanary && nonEmpty(hubCanary.v3Target) && hubCanary.v3Target.trim() !== baselineTag) {
       violations.push(
-        `hub-serverless canary ${hubCanary.repo} names v3 target ${hubCanary.v3Target}, but the rollback baseline is ${baselineTag} \u2014 they must match`
+        `hub-serverless canary ${hubCanary.repo} names rollback target ${hubCanary.v3Target}, but the rollback baseline is ${baselineTag} \u2014 they must match`
       );
     }
   }
@@ -10746,10 +10774,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "3.139.10",
-    tag: "v3.139.10",
-    commit: "aa537db8c4ba",
-    npm: "@mutmutco/cli@3.139.10"
+    version: "3.139.12",
+    tag: "v3.139.12",
+    commit: "2e7c01a927e2",
+    npm: "@mutmutco/cli@3.139.12"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -10766,14 +10794,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v3.139.10"
+          v3Target: "v3.139.12"
         }
       ],
-      rollbackTrigger: "Any red inside the post-cut soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a v3 client refused while the compat window must still admit it (SUPPORTED_MINOR_WINDOW=2, MIN_CLIENT_VERSION 0.0.0 \u2014 D6a), or npm consumer install/doctor failure on the v4 dist.",
+      rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 3.139.10 and redeploy the Hub Lambda from tag v3.139.10 (aa537db8c4ba); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v3.139.10 (@mutmutco/cli@3.139.10, tag commit aa537db8c4ba \u2014 the preserved latest-v3 distribution, D6b)"
+        mechanism: "npm dist-tag latest -> 3.139.12 and redeploy the Hub Lambda from tag v3.139.12 (2e7c01a927e2); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v3.139.12 (@mutmutco/cli@3.139.12, tag commit 2e7c01a927e2 \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -10792,17 +10820,17 @@ var rollout_plan_default = {
           v3Target: "v1.25.0"
         },
         {
-          repo: "mutmutco/jerv-powertools",
+          repo: "mutmutco/jerv-hub",
           role: "member",
           schedule: "train",
-          v3Target: "v2.53.25"
+          v3Target: "v3.1.1"
         }
       ],
       rollbackTrigger: "The first publish minted on the v4 train breaks an installed consumer: plugin install/upgrade failure, doctor red, or a version-lag alarm against the registered plugin surface.",
       rollback: {
         independent: true,
         mechanism: "Per-package npm dist-tag revert to the member's named v3-era version; publishes are additive, so nothing is unpublished and no other cohort is touched.",
-        v3Target: "The last release each package minted on the v3 train: jerv-jervcode v1.25.0, jerv-powertools v2.53.25 (named per member)"
+        v3Target: "The last release each package minted on the pre-v4 train: jerv-jervcode v1.25.0, jerv-hub v3.1.1 (named per member)"
       }
     },
     {
@@ -12113,6 +12141,8 @@ function buildFleetTrackInventory(projects, releaseProbes, pluginProbes, generat
       ci: {
         declared: typeof project2?.ci === "string" ? project2.ci : null,
         requiredChecks: Array.isArray(project2?.requiredChecks) ? project2.requiredChecks : null,
+        requiredCheckBranches: resolveRequiredCheckBranches(project2, repo),
+        requiredCheckBranchesDeclared: Array.isArray(project2?.requiredCheckBranches),
         exemptReason: typeof project2?.ciExemptReason === "string" ? project2.ciExemptReason : null
       },
       source: { registry: "hub-registry-live", release: "github-releases-live", plugin: "github-contents-live", onboarding: "github-readme-live" },
@@ -15390,6 +15420,7 @@ var RULESET_REFERENCE_MATCH_LABEL = "committed ruleset reference matches the liv
 var GATE_GREEN_ON_BASE_LABEL = "gate is green on the default branch (#3819)";
 var REQUIRED_CONTEXTS_EMITTED_LABEL = "required check contexts match PR workflows";
 var TAG_ADDRESSABLE_CONTEXTS_LABEL = "rc/main required contexts are tag-addressable (#3880)";
+var RELEASE_BRANCH_REACHABLE_LABEL = "rc/main required contexts are reachable from a release-base head (#5193)";
 var RECONCILE_SEED_BRANCH_PREFIX = "ci-reconcile-ruleset-ref";
 function slugFromRepo(repo) {
   return (repo.includes("/") ? repo.split("/")[1] : repo).toLowerCase();
@@ -15485,30 +15516,60 @@ function rulesetCoversReleaseBranches(payload, track) {
   const releaseRefs = track === "full" ? ["refs/heads/rc", "refs/heads/main"] : ["refs/heads/main"];
   return include.some((entry) => typeof entry === "string" && (entry === "~DEFAULT_BRANCH" ? track === "trunk" : releaseRefs.some((ref) => refPatternCovers(entry, ref))));
 }
+function releaseBranchRefsCovered(conditions, track) {
+  const include = conditions?.ref_name?.include;
+  if (!Array.isArray(include)) return [];
+  const releaseRefs = track === "full" ? ["refs/heads/rc", "refs/heads/main"] : ["refs/heads/main"];
+  return releaseRefs.filter((ref) => include.some((entry) => typeof entry === "string" && refPatternCovers(entry, ref)));
+}
+function unreachableReleaseContexts(input) {
+  const ignore = input.ignore ?? /* @__PURE__ */ new Set();
+  const required = input.requiredContexts.filter((context) => !ignore.has(context));
+  const out = [];
+  if (required.length === 0) return out;
+  for (const branch of input.releaseBranches) {
+    const emitted = input.emittedByBranch[branch];
+    if (emitted === void 0) continue;
+    const emittedSet = new Set(emitted);
+    const unreachable = required.filter((context) => !emittedSet.has(context));
+    if (unreachable.length) out.push({ branch, unreachable });
+  }
+  return out;
+}
 function registryAuthorityWithoutReference(meta, repo) {
   const contexts = registryRequiredContexts(meta);
   if (contexts == null) return null;
-  const track = resolveReleaseTrack(meta, void 0, repo);
+  const requiredBranches = resolveRequiredCheckBranches(meta, repo);
   return {
     contexts: sortedUnique(contexts),
     source: "registry META requiredChecks",
-    // With no committed conditions to narrow scope, the registry track is the only available authority.
-    coversReleaseBranches: track === "full" || track === "direct" || track === "trunk"
+    coversReleaseBranches: requiredBranches.some((branch) => branch === "rc" || branch === "main")
   };
 }
 function parseAuthoritativeRuleset(raw, meta, repo) {
   const filePayload = JSON.parse(raw);
   const committedPayload = stripRulesetComment(raw);
   const committedContexts = sortedUnique(rulesetRequiredContexts(committedPayload));
+  const committedBranchIncludes = rulesetBranchIncludes(committedPayload);
   const registryContexts = registryRequiredContexts(meta);
   const contexts = sortedUnique(registryContexts ?? committedContexts);
-  const apiPayload = registryContexts == null ? committedPayload : patchRulesetRequiredContexts(committedPayload, contexts);
-  const authoritativeFilePayload = registryContexts == null ? filePayload : { ...filePayload, rules: apiPayload.rules };
+  const explicitBranches = Array.isArray(meta?.requiredCheckBranches) && meta.requiredCheckBranches.length > 0 ? resolveRequiredCheckBranches(meta, repo) : null;
+  let apiPayload = registryContexts == null ? committedPayload : patchRulesetRequiredContexts(committedPayload, contexts);
+  if (explicitBranches) apiPayload = patchRulesetBranchIncludes(apiPayload, explicitBranches);
+  const branchIncludes = rulesetBranchIncludes(apiPayload);
+  const authoritativeFilePayload = {
+    ...filePayload,
+    ...registryContexts == null ? {} : { rules: apiPayload.rules },
+    ...explicitBranches == null ? {} : { conditions: apiPayload.conditions }
+  };
   return {
     filePayload: authoritativeFilePayload,
     apiPayload,
     committedContexts,
     contexts,
+    branchIncludes,
+    committedBranchIncludes,
+    branchSource: explicitBranches ? "registry META requiredCheckBranches" : "committed ruleset reference",
     source: registryContexts == null ? "committed ruleset reference" : "registry META requiredChecks",
     coversReleaseBranches: rulesetCoversReleaseBranches(apiPayload, resolveReleaseTrack(meta, void 0, repo))
   };
@@ -15518,8 +15579,9 @@ function sameContexts(left, right) {
 }
 function resolveProductRulesetReconcilePlan(input) {
   const liveNeedsContextConvergence = !sameContexts(input.liveContexts, input.authorityContexts);
+  const liveNeedsBranchConvergence = input.liveBranchIncludes !== void 0 && input.authorityBranchIncludes !== void 0 && !sameContexts(input.liveBranchIncludes, input.authorityBranchIncludes);
   const liveIsActive = input.liveEnforcement === "active";
-  if (liveIsActive && !liveNeedsContextConvergence) {
+  if (liveIsActive && !liveNeedsContextConvergence && !liveNeedsBranchConvergence) {
     return { shouldActivate: false, targetEnforcement: "active" };
   }
   if (input.unsafeContexts.length > 0) {
@@ -15706,6 +15768,7 @@ async function auditRepoCi(repo, deps) {
   } else if (deployableGated) {
     const productRuleset = rulesets.find((r) => r.name === PRODUCT_RULESET_NAME);
     const liveContexts = productRuleset == null ? [] : sortedUnique(rulesetRequiredContexts(productRuleset));
+    const liveBranchIncludes = productRuleset == null ? [] : rulesetBranchIncludes(productRuleset);
     const hasRequiredChecks = productRuleset?.enforcement === "active" && liveContexts.length > 0;
     checks.push({
       ok: hasRequiredChecks,
@@ -15722,13 +15785,15 @@ async function auditRepoCi(repo, deps) {
           remediation: `Fix ${PRODUCT_RULESET_REF}, then run mmi-cli devops ci reconcile --repo ${repo} --apply`
         });
       } else {
-        const fileAligned = sameContexts(authoritativeRuleset.committedContexts, authoritativeRuleset.contexts);
-        const liveAligned = sameContexts(liveContexts, authoritativeRuleset.contexts);
-        const aligned = fileAligned && liveAligned;
+        const fileContextsAligned = sameContexts(authoritativeRuleset.committedContexts, authoritativeRuleset.contexts);
+        const liveContextsAligned = sameContexts(liveContexts, authoritativeRuleset.contexts);
+        const fileBranchesAligned = sameContexts(authoritativeRuleset.committedBranchIncludes, authoritativeRuleset.branchIncludes);
+        const liveBranchesAligned = sameContexts(liveBranchIncludes, authoritativeRuleset.branchIncludes);
+        const aligned = fileContextsAligned && liveContextsAligned && fileBranchesAligned && liveBranchesAligned;
         checks.push({
           ok: aligned,
           label: RULESET_REFERENCE_MATCH_LABEL,
-          detail: aligned ? `[${authoritativeRuleset.contexts.join(", ")}] from ${authoritativeRuleset.source} on both sides` : `${authoritativeRuleset.source} requires [${authoritativeRuleset.contexts.join(", ")}]; ${PRODUCT_RULESET_REF} declares [${authoritativeRuleset.committedContexts.join(", ")}] and the live ${PRODUCT_RULESET_NAME} ruleset requires [${liveContexts.join(", ")}]`,
+          detail: aligned ? `contexts [${authoritativeRuleset.contexts.join(", ")}] and branches [${authoritativeRuleset.branchIncludes.join(", ")}] match declared authority` : `${authoritativeRuleset.source} requires contexts [${authoritativeRuleset.contexts.join(", ")}]; ${authoritativeRuleset.branchSource} requires branches [${authoritativeRuleset.branchIncludes.join(", ")}]; ${PRODUCT_RULESET_REF} declares contexts [${authoritativeRuleset.committedContexts.join(", ")}] / branches [${authoritativeRuleset.committedBranchIncludes.join(", ")}] and live ${PRODUCT_RULESET_NAME} has contexts [${liveContexts.join(", ")}] / branches [${liveBranchIncludes.join(", ")}]`,
           remediation: aligned ? void 0 : `mmi-cli devops ci reconcile --repo ${repo} --apply`
         });
       }
@@ -15753,6 +15818,23 @@ async function auditRepoCi(repo, deps) {
         detail: prOnly.length ? `${contextAuthority.source} requires [${prOnly.join(", ")}] on rc/main, but those contexts can only materialize for pull_request` : void 0,
         remediation: prOnly.length ? `Remove [${prOnly.join(", ")}] from rc/main requirements in registry META or ${PRODUCT_RULESET_REF}` : void 0
       });
+      if (productRuleset != null && liveContexts.length > 0) {
+        const releaseBranches = releaseBranchRefsCovered(productRuleset.conditions, resolveReleaseTrack(meta, void 0, repo));
+        if (releaseBranches.length > 0) {
+          const emittedByBranch = {};
+          for (const ref of releaseBranches) {
+            emittedByBranch[ref] = await resolveEmittedPrContexts(deps, repo, ref.replace("refs/heads/", ""));
+          }
+          const ignore = /* @__PURE__ */ new Set([...AGENT_PR_BOOKKEEPING_CONTEXTS, ...TRAIN_PR_ONLY_CONTEXTS]);
+          const unreachable = unreachableReleaseContexts({ requiredContexts: liveContexts, releaseBranches, emittedByBranch, ignore });
+          checks.push({
+            ok: unreachable.length === 0,
+            label: RELEASE_BRANCH_REACHABLE_LABEL,
+            detail: unreachable.length === 0 ? void 0 : unreachable.map((u) => `${u.branch.replace("refs/heads/", "")} requires [${u.unreachable.join(", ")}] but its own workflows emit none of them`).join("; ") + " \u2014 a base-" + unreachable.map((u) => u.branch.replace("refs/heads/", "")).join("/") + " PR (e.g. a hotfix) can never satisfy the gate and stays permanently BLOCKED",
+            remediation: unreachable.length === 0 ? void 0 : `Remove the unreachable context(s) from those branches in the ${PRODUCT_RULESET_NAME} ruleset conditions and ${PRODUCT_RULESET_REF}, or add the emitting workflow to the branch`
+          });
+        }
+      }
     }
   }
   if (repoClass === "deployable") {
@@ -16026,7 +16108,13 @@ async function seedGateYml(repo, deps, meta, result) {
   const baseBranch = "development";
   const releaseTrack = isReleaseTrack(meta?.releaseTrack) ? meta?.releaseTrack : void 0;
   const parsed = parseOwnerRepo(repo);
-  const refOnlyVars = () => withDerivedRepoVars({ REPO_SLUG: parsed.slug }, parsed, "deployable", releaseTrack);
+  const refOnlyVars = () => withDerivedRepoVars(
+    { REPO_SLUG: parsed.slug },
+    parsed,
+    "deployable",
+    releaseTrack,
+    meta?.requiredCheckBranches
+  );
   if (await contentExists(deps, repo, baseBranch, PRODUCT_GATE_PATH)) {
     return await seedRulesetRefIfMissing(repo, deps, refOnlyVars(), baseBranch, result);
   }
@@ -16047,7 +16135,13 @@ async function seedGateYml(repo, deps, meta, result) {
     result.skipped.push(`gate.yml missing \u2014 no registry gate config; set \`mmi-cli oracle org project set ${repo} --var gate={...}\` first, then re-run reconcile`);
     return "none";
   }
-  const derivedVars = withDerivedRepoVars({ ...gateConfigToVars(gate), REPO_SLUG: parsed.slug }, parsed, "deployable", releaseTrack);
+  const derivedVars = withDerivedRepoVars(
+    { ...gateConfigToVars(gate), REPO_SLUG: parsed.slug },
+    parsed,
+    "deployable",
+    releaseTrack,
+    meta?.requiredCheckBranches
+  );
   const rendered = renderSeedBody(deps, GATE_TEMPLATE_SEED, PRODUCT_GATE_PATH, derivedVars);
   if (rendered == null) {
     result.errors.push(`gate.yml re-seed: could not render ${GATE_TEMPLATE_SEED} (template unreadable or unfilled)`);
@@ -16223,7 +16317,8 @@ async function applyCiReconcileRepo(repo, deps) {
     result.errors.push(`${authority.source} declares no required contexts`);
     return finalizeCiReconcile(repo, deps, result, report);
   }
-  if (!sameContexts(authority.committedContexts, authority.contexts)) {
+  const sourceNeedsConvergence = !sameContexts(authority.committedContexts, authority.contexts) || !sameContexts(authority.committedBranchIncludes, authority.branchIncludes);
+  if (sourceNeedsConvergence) {
     try {
       const delivery = await deliverSeedFile(
         deps,
@@ -16237,19 +16332,19 @@ async function applyCiReconcileRepo(repo, deps) {
         result.skipped.push(`${PRODUCT_RULESET_REF} already byte-equivalent on ${baseBranch}`);
       } else if (delivery.plan.mode === "pr") {
         result.applied.push(
-          `${PRODUCT_RULESET_REF} authoritative contexts \u2192 [${authority.contexts.join(", ")}] delivered on ${delivery.plan.branch} (${delivery.plan.reason})${delivery.prUrl ? `: ${delivery.prUrl}` : ""}`
+          `${PRODUCT_RULESET_REF} authority \u2192 contexts [${authority.contexts.join(", ")}], branches [${authority.branchIncludes.join(", ")}] delivered on ${delivery.plan.branch} (${delivery.plan.reason})${delivery.prUrl ? `: ${delivery.prUrl}` : ""}`
         );
         const reason = `${PRODUCT_RULESET_REF} authority is pending on its protected-base source PR; live ruleset convergence waits for that source to merge`;
         return finalizeCiReconcile(repo, deps, result, report, reason);
       } else {
-        result.applied.push(`reconciled ${PRODUCT_RULESET_REF} authoritative contexts \u2192 [${authority.contexts.join(", ")}]`);
+        result.applied.push(`reconciled ${PRODUCT_RULESET_REF} authority \u2192 contexts [${authority.contexts.join(", ")}], branches [${authority.branchIncludes.join(", ")}]`);
       }
     } catch (e) {
       result.errors.push(`ruleset reference delivery failed: ${e.message}`);
       return finalizeCiReconcile(repo, deps, result, report);
     }
   } else {
-    result.skipped.push(`${PRODUCT_RULESET_REF} already matches ${authority.source}`);
+    result.skipped.push(`${PRODUCT_RULESET_REF} already matches declared context and branch authority`);
   }
   let live;
   try {
@@ -16259,6 +16354,7 @@ async function applyCiReconcileRepo(repo, deps) {
     return finalizeCiReconcile(repo, deps, result, report);
   }
   const liveContexts = live == null ? [] : sortedUnique(rulesetRequiredContexts(live));
+  const liveBranchIncludes = live == null ? [] : rulesetBranchIncludes(live);
   const prWorkflows = await prTriggeredWorkflowsOnRef(deps, repo, baseBranch, "deployable") ?? [];
   const gateFiles = gateWorkflowFiles(prWorkflows);
   const allPrWorkflows = await listWorkflowPaths(deps, repo, baseBranch) ?? [];
@@ -16274,6 +16370,8 @@ async function applyCiReconcileRepo(repo, deps) {
     liveEnforcement: live?.enforcement,
     liveContexts,
     authorityContexts: authority.contexts,
+    liveBranchIncludes,
+    authorityBranchIncludes: authority.branchIncludes,
     gateProvenGreen: await gateIsProvenGreen(repo, deps.client, baseBranch, gateFiles),
     unsafeContexts: unsafe
   });
@@ -16282,7 +16380,7 @@ async function applyCiReconcileRepo(repo, deps) {
       result.skipped.push(plan.holdReason);
       return finalizeCiReconcile(repo, deps, result, report, plan.holdReason);
     }
-    result.skipped.push(`live ${PRODUCT_RULESET_NAME} contexts already match ${authority.source}`);
+    result.skipped.push(`live ${PRODUCT_RULESET_NAME} contexts and branches already match declared authority`);
     return finalizeCiReconcile(repo, deps, result, report);
   }
   try {
@@ -23412,57 +23510,35 @@ function shardRepoIndexV4(envelope) {
 
 // src/repo-index-cloud-client.ts
 var RETRY_ATTEMPTS2 = 3;
-async function publishRepoIndexCloud(payload, deps) {
+async function probeRepoIndexV4ReadinessCloud(queries, deps) {
   if (!deps.baseUrl) return { ok: false, error: "Hub API URL not configured" };
   const token = await deps.token();
   if (!token) return { ok: false, error: "no Hub session token (run `gh auth login`)" };
+  const baseUrl = deps.baseUrl.replace(/\/$/, "");
+  const headers = { ...clientVersionHeaders(), Authorization: ["Bearer", token].join(" "), "content-type": "application/json" };
   try {
-    const res = await fetchWithRetry(
-      deps.fetch ?? fetch,
-      `${deps.baseUrl.replace(/\/$/, "")}/repo-index/publish`,
-      {
+    for (const query of queries) {
+      const res2 = await fetchWithRetry(deps.fetch ?? fetch, `${baseUrl}/repo-index/v4/shadow`, {
         method: "POST",
-        headers: {
-          ...clientVersionHeaders(),
-          Authorization: `Bearer ${token}`,
-          "content-type": "application/json"
-        },
-        body: JSON.stringify(payload)
-      },
-      {
-        attempts: RETRY_ATTEMPTS2,
-        // Embed publish can take longer than a registry read.
-        timeoutMs: payload.embed ? 12e4 : deps.timeoutMs ?? REGISTRY_FETCH_TIMEOUT_MS,
-        sleep: deps.retrySleep
-      }
-    );
-    if (res.status === 426) return { ok: false, error: upgradeRequiredError(res, await res.json().catch(() => null)), status: 426 };
-    const body = await res.json().catch(() => ({}));
-    if (!res.ok) {
-      const v42 = body.v4;
-      const detail = v42?.error?.message;
-      return { ok: false, error: typeof detail === "string" ? detail : typeof body.error === "string" ? body.error : `publish HTTP ${res.status}`, status: res.status };
+        headers,
+        body: JSON.stringify({ q: query.query, mode: query.mode, readinessProbe: true })
+      }, { attempts: RETRY_ATTEMPTS2, timeoutMs: 12e4, sleep: deps.retrySleep });
+      const body2 = await res2.json().catch(() => ({}));
+      if (!res2.ok) return { ok: false, error: `${query.id}: ${body2.error ?? `v4 readiness probe HTTP ${res2.status}`}${body2.errorClass ? ` (${body2.errorClass})` : ""}`, status: res2.status };
     }
-    const v4 = body.v4;
-    if (v4?.ok === false) return { ok: false, error: typeof v4.error?.message === "string" ? v4.error.message : "v4 publication rejected", status: res.status };
-    return { ok: true, body };
-  } catch (e) {
-    return { ok: false, error: e.message };
-  }
-}
-async function setRepoIndexV4ReadPercentCloud(percent, deps) {
-  if (!deps.baseUrl) return { ok: false, error: "Hub API URL not configured" };
-  const token = await deps.token();
-  if (!token) return { ok: false, error: "no Hub session token (run `gh auth login`)" };
-  try {
-    const res = await fetchWithRetry(deps.fetch ?? fetch, `${deps.baseUrl.replace(/\/$/, "")}/repo-index/v4/cutover`, {
-      method: "POST",
-      headers: { ...clientVersionHeaders(), Authorization: `Bearer ${token}`, "content-type": "application/json" },
-      body: JSON.stringify({ percent })
+    const res = await fetchWithRetry(deps.fetch ?? fetch, `${baseUrl}/repo-index/status`, {
+      method: "GET",
+      headers: { ...clientVersionHeaders(), Authorization: ["Bearer", token].join(" ") }
     }, { attempts: RETRY_ATTEMPTS2, timeoutMs: deps.timeoutMs ?? REGISTRY_FETCH_TIMEOUT_MS, sleep: deps.retrySleep });
     const body = await res.json().catch(() => ({}));
-    if (!res.ok) return { ok: false, error: body.error ?? `cutover HTTP ${res.status}`, status: res.status };
-    return { ok: true, percent: body.percent, cohort: body.cohort, rollbackAction: body.rollbackAction };
+    if (!res.ok) return { ok: false, error: body.error ?? `v4 readiness status HTTP ${res.status}`, status: res.status };
+    const readiness = body.v4Readiness;
+    const complete = !!readiness && ["ready", "not-ready"].includes(readiness.verdict) && Array.isArray(readiness.reasons) && Number.isFinite(readiness.goldenCount) && Number.isFinite(readiness.evidenceCount) && !!readiness.modes && ["lexical", "semantic", "hybrid"].every((mode) => {
+      const verdict = readiness.modes[mode]?.verdict;
+      return verdict === "ready" || verdict === "not-ready";
+    });
+    if (!complete) return { ok: false, error: "Hub status omitted the explicit v4 readiness verdict/reasons/modes contract", status: res.status };
+    return { ok: true, readiness };
   } catch (error) {
     return { ok: false, error: error.message };
   }
@@ -23568,7 +23644,7 @@ async function searchRepoIndexCloud(query, opts, deps) {
       void fetchWithRetry(
         deps.fetch ?? fetch,
         `${deps.baseUrl.replace(/\/$/, "")}/repo-index/v4/shadow`,
-        { method: "POST", headers: { ...clientVersionHeaders(), Authorization: `Bearer ${token}`, "content-type": "application/json" }, body: JSON.stringify({ q: query, mode: opts.mode ?? "hybrid", limit: opts.limit ?? 20, cohort: `shadow-${Math.round(shadowRate * 100)}`, ...opts.repo ? { repo: opts.repo } : {} }) },
+        { method: "POST", headers: { ...clientVersionHeaders(), Authorization: ["Bearer", token].join(" "), "content-type": "application/json" }, body: JSON.stringify({ q: query, mode: opts.mode ?? "hybrid", limit: opts.limit ?? 20, ...opts.repo ? { repo: opts.repo } : {} }) },
         { attempts: 1, timeoutMs: 12e4, sleep: deps.retrySleep }
       ).catch(() => {
       });
@@ -23797,7 +23873,9 @@ function buildGraphEdges(cwd, repo, commit, rosterRepos2) {
 }
 
 // src/repo-index-sync.ts
-var MAX_EMBED_BACKFILL_ROUNDS = 40;
+var COMMIT2 = /^[a-f0-9]{40}$/;
+var SHA256 = /^[a-f0-9]{64}$/;
+var UTC_MILLIS = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/;
 function normalizeRepo(raw) {
   const normalized = normalizeRepoIndexRepo(raw);
   if (!normalized) throw new Error(`invalid repository: ${raw}`);
@@ -23814,6 +23892,28 @@ function shallowClone(repo, dest, token) {
     { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], windowsHide: true }
   );
 }
+function remoteHead(repo, token) {
+  const basic = Buffer.from(`x-access-token:${token}`, "utf8").toString("base64");
+  const output = (0, import_node_child_process14.execFileSync)(
+    "git",
+    ["-c", `http.extraHeader=Authorization: Basic ${basic}`, "ls-remote", "--exit-code", `https://github.com/${repo}.git`, "HEAD"],
+    { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], windowsHide: true }
+  );
+  const match = String(output).match(/^([a-f0-9]{40})\s+HEAD$/m);
+  if (!match) throw new Error(`could not resolve remote HEAD for ${repo}`);
+  return match[1];
+}
+function verifiedReadyCommit(statusValue, repo) {
+  if (!statusValue || typeof statusValue !== "object" || Array.isArray(statusValue)) return null;
+  const status = statusValue;
+  const v4 = status.v4;
+  if (!v4 || typeof v4 !== "object" || Array.isArray(v4)) return null;
+  const pointer = v4;
+  const artifactDigests = pointer.artifactDigests;
+  const counts = [pointer.chunkCount, pointer.embeddingCount, pointer.tombstoneCount];
+  const structurallyVerified = status.repo === repo && pointer.repo === repo && pointer.state === "ready" && pointer.integrity === "verified" && typeof pointer.commit === "string" && COMMIT2.test(pointer.commit) && typeof pointer.digest === "string" && SHA256.test(pointer.digest) && Array.isArray(artifactDigests) && artifactDigests.length === 2 && new Set(artifactDigests).size === artifactDigests.length && artifactDigests.every((digest) => typeof digest === "string" && SHA256.test(digest)) && counts.every((count) => Number.isInteger(count) && Number(count) >= 0) && pointer.embeddingCount === pointer.chunkCount && typeof pointer.activatedAt === "string" && UTC_MILLIS.test(pointer.activatedAt) && Number.isFinite(Date.parse(pointer.activatedAt)) && new Date(pointer.activatedAt).toISOString() === pointer.activatedAt;
+  return structurallyVerified && typeof pointer.commit === "string" ? pointer.commit : null;
+}
 async function syncEstateRepoIndex(opts) {
   const projects = await fetchProjectsList(opts.deps);
   if (!projects) {
@@ -23832,6 +23932,18 @@ async function syncEstateRepoIndex(opts) {
   const failed = [];
   const skipped = [];
   for (const repo of repos) {
+    try {
+      const status = await statusRepoIndexCloud(repo, opts.deps);
+      const activeCommit = verifiedReadyCommit(status, repo);
+      if (activeCommit) {
+        const head = remoteHead(repo, opts.githubToken);
+        if (head === activeCommit) {
+          skipped.push(`${repo}: unchanged verified-ready authority at ${head}`);
+          continue;
+        }
+      }
+    } catch {
+    }
     const dir = (0, import_node_fs27.mkdtempSync)((0, import_node_path25.join)((0, import_node_os12.tmpdir)(), "mmi-repo-index-"));
     try {
       const reconciled = await reconcileRepoIndexCloud(repo, opts.deps);
@@ -23840,51 +23952,19 @@ async function syncEstateRepoIndex(opts) {
         continue;
       }
       shallowClone(repo, dir, opts.githubToken);
-      const built = rebuildRepoIndex(dir, repo);
-      let pub = await publishRepoIndexCloud(
-        {
-          repo,
-          builtAt: built.builtAt,
-          entries: built.entries,
-          embed: opts.embed === true
-        },
-        opts.deps
-      );
-      if (!pub.ok) {
-        failed.push({ repo, error: pub.error });
-        continue;
-      }
-      let rounds = 1;
-      while (opts.embed === true && pub.ok && pub.body.embTruncated === true && rounds < MAX_EMBED_BACKFILL_ROUNDS) {
-        pub = await publishRepoIndexCloud(
-          {
-            repo,
-            builtAt: built.builtAt,
-            entries: built.entries,
-            embed: true
-          },
-          opts.deps
-        );
-        if (!pub.ok) {
-          failed.push({ repo, error: pub.error });
-          break;
-        }
-        rounds++;
-      }
-      if (!pub.ok) continue;
-      let v4Commit;
+      let v4;
       try {
-        const v4 = await buildRepoIndexV4(dir, repo, { modelDirectory: process.env.MMI_REPO_INDEXER_MODEL_DIR });
-        v4Commit = v4.manifest.commit;
+        v4 = await buildRepoIndexV4(dir, repo, { modelDirectory: process.env.MMI_REPO_INDEXER_MODEL_DIR });
         const v4Published = await publishRepoIndexV4Cloud(v4, opts.deps);
         if (!v4Published.ok) {
-          failed.push({ repo, error: `v3 published; v4 failed: ${v4Published.error}` });
+          failed.push({ repo, error: `v4 failed: ${v4Published.error}` });
           continue;
         }
       } catch (error) {
-        failed.push({ repo, error: `v3 published; v4 failed: ${error.message}` });
+        failed.push({ repo, error: `v4 failed: ${error.message}` });
         continue;
       }
+      const v4Commit = v4.manifest.commit;
       let graphEdges;
       try {
         const edges = buildGraphEdges(dir, repo, v4Commit, allRosterRepos);
@@ -23894,16 +23974,14 @@ async function syncEstateRepoIndex(opts) {
       } catch (error) {
         skipped.push(`${repo}: optional v4 graph unavailable: ${error.message}`);
       }
-      const fileCount = Number(pub.body.fileCount ?? built.entries.length);
-      const embCount = typeof pub.body.embCount === "number" ? pub.body.embCount : void 0;
-      const embGap = typeof pub.body.embGap === "number" ? pub.body.embGap : typeof embCount === "number" ? Math.max(0, fileCount - embCount) : void 0;
+      const fileCount = v4.manifest.chunks.length;
+      const embCount = v4.manifest.embeddings.length;
+      const embGap = Math.max(0, fileCount - embCount);
       published.push({
         repo,
         fileCount,
         embCount,
         embGap,
-        embTruncated: pub.body.embTruncated === true,
-        embedRounds: opts.embed ? rounds : void 0,
         graphEdges
       });
     } catch (e) {
@@ -23951,6 +24029,68 @@ var repo_index_golden_queries_default = {
   ]
 };
 
+// testdata/repo-index-golden-queries-v4.json
+var repo_index_golden_queries_v4_default = {
+  schemaVersion: 4,
+  suite: "repo-index-golden-queries",
+  authority: "docs/schemas/repo-index-v4.schema.json#/$defs/goldenBenchmarkRecord",
+  queries: [
+    {
+      id: "rebuild-symbol-lexical-v4",
+      version: 4,
+      query: "rebuildRepoIndex",
+      mode: "lexical",
+      expected: {
+        repo: "mutmutco/MMI-Hub",
+        path: "cli/src/repo-index.ts",
+        minScore: 0.1,
+        citationPolicy: {
+          commit: "indexed-head",
+          lineRange: "required",
+          symbol: "rebuildRepoIndex"
+        }
+      },
+      latency: { p95Ms: 1e3 },
+      degraded: { allowed: false, fallbackMode: "none", maxLatencyMs: 1e3 }
+    },
+    {
+      id: "schedules-register-semantic-v4",
+      version: 4,
+      query: "where do schedules get registered",
+      mode: "semantic",
+      expected: {
+        repo: "mutmutco/MMI-Hub",
+        path: "cli/src/schedules.ts",
+        minScore: 0.05,
+        citationPolicy: {
+          commit: "indexed-head",
+          lineRange: "required"
+        }
+      },
+      latency: { p95Ms: 5e3 },
+      degraded: { allowed: true, fallbackMode: "lexical", maxLatencyMs: 1500 }
+    },
+    {
+      id: "pointer-safe-hybrid-v4",
+      version: 4,
+      query: "pointer-safe repository index embeddings",
+      mode: "hybrid",
+      expected: {
+        repo: "mutmutco/MMI-Hub",
+        path: "cli/src/repo-index-v4/chunks.ts",
+        minScore: 0.05,
+        citationPolicy: {
+          commit: "indexed-head",
+          lineRange: "required",
+          symbol: "pointerId"
+        }
+      },
+      latency: { p95Ms: 5e3 },
+      degraded: { allowed: true, fallbackMode: "lexical", maxLatencyMs: 1500 }
+    }
+  ]
+};
+
 // src/repo-index-health.ts
 function assertGoldenSuite(raw, source) {
   if (!raw || raw.schema !== 1 || !Array.isArray(raw.queries)) {
@@ -23970,6 +24110,64 @@ function loadGoldenSuite(path2) {
 function defaultGoldenSuite() {
   return assertGoldenSuite(repo_index_golden_queries_default, "bundled repo-index-golden-queries.json");
 }
+function repoIndexHealthGoldenSource(opts) {
+  if (opts.live) return "bundled repo-index-golden-queries-v4.json";
+  return opts.customPath || "bundled repo-index-golden-queries.json";
+}
+function formatRepoIndexV4ReadinessSummary(readiness) {
+  const modes = Object.entries(readiness.modes).sort(([a], [b]) => a.localeCompare(b)).map(([mode, result]) => `${mode} ${result.verdict} (${result.evidenceCount}/${result.goldenCount})`).join(", ");
+  return `v4 readiness ${readiness.verdict} \u2014 ${readiness.evidenceCount}/${readiness.goldenCount} checked-in goldens${modes ? `; ${modes}` : ""}`;
+}
+function formatRepoIndexCloudStatus(status) {
+  const repo = typeof status.repo === "string" ? status.repo : void 0;
+  const v4 = status.v4 && typeof status.v4 === "object" ? status.v4 : void 0;
+  const state = typeof v4?.state === "string" ? v4.state : status.present === false ? "absent" : "unknown";
+  const commit = typeof v4?.commit === "string" ? ` @ ${v4.commit.slice(0, 12)}` : "";
+  const rawReadiness = status.v4Readiness && typeof status.v4Readiness === "object" ? status.v4Readiness : void 0;
+  const readiness = rawReadiness && (rawReadiness.verdict === "ready" || rawReadiness.verdict === "not-ready") && typeof rawReadiness.goldenCount === "number" && typeof rawReadiness.evidenceCount === "number" && rawReadiness.modes && typeof rawReadiness.modes === "object" ? formatRepoIndexV4ReadinessSummary(rawReadiness) : "v4 readiness unavailable";
+  if (!repo) {
+    const authority = status.v4Authority && typeof status.v4Authority === "object" ? status.v4Authority : void 0;
+    const roster = typeof authority?.rosterCount === "number" ? authority.rosterCount : 0;
+    const ready = typeof authority?.readyAuthorities === "number" ? authority.readyAuthorities : 0;
+    const authorityState = authority?.nOfN === true && authority?.activeNOfN === true ? "ready" : "not-ready";
+    return `repo-index: cloud v4 authorities ${authorityState} ${ready}/${roster}; ${readiness}`;
+  }
+  return `repo-index: cloud ${repo} v4 ${state}${commit}; ${readiness}`;
+}
+function defaultV4ReadinessSuite() {
+  const suite = repo_index_golden_queries_v4_default;
+  const modes = new Set(suite.queries?.map((query) => query.mode));
+  if (suite.schemaVersion !== 4 || !Array.isArray(suite.queries) || !["lexical", "semantic", "hybrid"].every((mode) => modes.has(mode))) {
+    throw new Error("invalid bundled repo-index-golden-queries-v4.json");
+  }
+  return suite;
+}
+async function runRepoIndexV4ReadinessGate(opts) {
+  const queries = opts.suite.queries.map(({ id, query, mode }) => ({ id, query, mode }));
+  const probed = await opts.probe(queries);
+  if (!probed.ok) return { ok: false, findings: [{ ok: false, code: "v4-probe-error", detail: probed.error }] };
+  const ok = probed.readiness.verdict === "ready";
+  return {
+    ok,
+    findings: [{
+      ok,
+      code: ok ? "v4-ready" : "v4-not-ready",
+      detail: `v4 readiness verdict=${probed.readiness.verdict} evidence=${probed.readiness.evidenceCount}/${probed.readiness.goldenCount} reasons=${JSON.stringify(probed.readiness.reasons)} modes=${JSON.stringify(probed.readiness.modes)}`
+    }],
+    readiness: probed.readiness
+  };
+}
+async function runRepoIndexLiveHealth(opts) {
+  const readiness = await runRepoIndexV4ReadinessGate(opts.v4Readiness);
+  if (opts.queriesOnly) return readiness;
+  const status = await opts.live.status();
+  const statusFindings = status.ok === false && typeof status.error === "string" ? [{ ok: true, code: "status-error", detail: status.error, severity: "warn" }] : evaluateCloudStatus(status);
+  return {
+    ok: statusFindings.every((finding) => finding.ok) && readiness.ok,
+    findings: [...statusFindings, ...readiness.findings],
+    ...readiness.readiness ? { readiness: readiness.readiness } : {}
+  };
+}
 function evaluateQueryHits(query, hits) {
   if (!hits.length) {
     return { ok: false, code: "empty-hits", detail: `${query.id}: no hits for ${JSON.stringify(query.q)}` };
@@ -24005,85 +24203,25 @@ function evaluateQueryHits(query, hits) {
   }
   return { ok: true, code: "ok", detail: `${query.id}: top hit accepted` };
 }
-function evaluateCloudStatus(status, golden) {
-  const findings = [];
-  const count = typeof status.count === "number" ? status.count : Array.isArray(status.repos) ? status.repos.length : null;
-  if (count === 0 || Array.isArray(status.repos) && status.repos.length === 0 && status.present !== true) {
-    findings.push({ ok: false, code: "projections-empty", detail: "cloud repo-index has zero projections" });
-  }
-  const repos = [];
-  if (Array.isArray(status.repos)) {
-    for (const r of status.repos) {
-      if (r && typeof r === "object") repos.push(r);
-    }
-  } else if (status.present === true && typeof status.repo === "string") {
-    repos.push(status);
-  }
-  const stale = repos.filter((r) => r.stale === true);
-  if (stale.length) {
-    findings.push({
-      ok: false,
-      code: "stale-projections",
-      detail: `${stale.length} stale projection(s) (threshold ${golden.staleThresholdHours}h): ${stale.slice(0, 5).map((r) => r.repo).join(", ")}`
-    });
-  }
-  const hub = repos.find((r) => r.repo?.toLowerCase() === golden.hubRepo.toLowerCase()) ?? (typeof status.repo === "string" && status.repo.toLowerCase() === golden.hubRepo.toLowerCase() ? status : void 0);
-  if (!hub || hub.present === false) {
-    findings.push({ ok: false, code: "hub-missing", detail: `${golden.hubRepo} projection missing` });
-  } else {
-    const fileCount = Number(hub.fileCount ?? 0);
-    const embCount = Number(hub.embCount ?? 0);
-    if (fileCount <= 0) {
-      findings.push({ ok: false, code: "hub-empty", detail: `${golden.hubRepo} has fileCount=${fileCount}` });
-    }
-    const denom = Math.min(fileCount, golden.maxSyncEmbeds);
-    const coverage = denom > 0 ? embCount / denom : 0;
-    if (fileCount > 0 && coverage < golden.hubEmbMinCoverage) {
-      findings.push({
-        ok: false,
-        code: "hub-emb-gap",
-        detail: `${golden.hubRepo} embCoverage=${coverage.toFixed(2)} (emb=${embCount} files=${fileCount} cap=${golden.maxSyncEmbeds}) < ${golden.hubEmbMinCoverage}`
-      });
-    }
-  }
-  if (!findings.length) {
-    findings.push({ ok: true, code: "status-ok", detail: `status healthy (${repos.length || count || 0} repo projection(s))` });
-  }
-  return findings;
+function evaluateCloudStatus(status) {
+  const authority = status.v4Authority && typeof status.v4Authority === "object" ? status.v4Authority : void 0;
+  const rosterCount = authority?.rosterCount;
+  const activeAuthorities = authority?.activeAuthorities;
+  const readyAuthorities = authority?.readyAuthorities;
+  const ready = typeof rosterCount === "number" && rosterCount > 0 && activeAuthorities === rosterCount && readyAuthorities === rosterCount && authority?.activeNOfN === true && authority.nOfN === true;
+  if (ready) {
+    return [{ ok: true, code: "v4-authority-ready", detail: `v4 authorities ready ${readyAuthorities}/${rosterCount}` }];
+  }
+  const failures = Array.isArray(authority?.authorityFailures) ? JSON.stringify(authority.authorityFailures) : "unavailable";
+  return [{
+    ok: false,
+    code: "v4-authority-not-ready",
+    detail: `v4 authorities not ready: active=${String(activeAuthorities ?? "unknown")}/${String(rosterCount ?? "unknown")} ready=${String(readyAuthorities ?? "unknown")}/${String(rosterCount ?? "unknown")} failures=${failures}`
+  }];
 }
 async function runRepoIndexHealth(opts) {
   const findings = [];
-  const searchAttempts = Math.max(1, opts.searchRetry?.attempts ?? 3);
-  const sleep2 = opts.searchRetry?.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
-  if (opts.live) {
-    if (!opts.queriesOnly) {
-      const st = await opts.live.status();
-      if (st.ok === false && typeof st.error === "string") {
-        findings.push({ ok: true, code: "status-error", detail: st.error, severity: "warn" });
-      } else {
-        findings.push(...evaluateCloudStatus(st, opts.golden));
-      }
-    }
-    for (const q of opts.golden.queries) {
-      let res = await opts.live.search(q.q, q.mode);
-      let attempts = 1;
-      while (!res.ok && attempts < searchAttempts) {
-        await sleep2(500 * attempts);
-        res = await opts.live.search(q.q, q.mode);
-        attempts += 1;
-      }
-      if (!res.ok) {
-        const semantic503 = q.mode === "semantic" && (res.status === 503 || /semantic unavailable|503/i.test(res.error));
-        findings.push({
-          ok: false,
-          code: semantic503 ? "semantic-503" : "search-error",
-          detail: `${q.id}: ${res.error}${attempts > 1 ? ` (no answer after ${attempts} attempts)` : ""}`
-        });
-        continue;
-      }
-      findings.push(evaluateQueryHits(q, res.hits));
-    }
-  } else if (opts.fixtures) {
+  if (opts.fixtures) {
     for (const q of opts.golden.queries) {
       const fx = opts.fixtures[q.id];
       if (!fx) {
@@ -24637,7 +24775,7 @@ async function syncProjectInfo(plan, client, apply) {
 }
 
 // src/project-set.ts
-var UNSET_KEYS = ["oauth", "requiredRuntimeSecrets", "requiredBuildSecrets", "tenantTasks", "secrets", "edgeDomains", "requiredGcpApis", "publishRequired", "publishDir", "dsManifestPath", "fofuEnabled", "consumesDesignSystem", "ci", "requiredChecks", "ciExemptReason", "gate", "seedCanary", "repoIndexExcludedRepos"];
+var UNSET_KEYS = ["oauth", "requiredRuntimeSecrets", "requiredBuildSecrets", "tenantTasks", "secrets", "edgeDomains", "requiredGcpApis", "publishRequired", "publishDir", "dsManifestPath", "fofuEnabled", "consumesDesignSystem", "ci", "requiredChecks", "requiredCheckBranches", "ciExemptReason", "gate", "seedCanary", "repoIndexExcludedRepos"];
 var UNSET_KEY_SET = new Set(UNSET_KEYS);
 var RUNTIME_SECRET_STAGES = ["dev", "rc", "main"];
 var SECRET_CONSUMERS = ["runtime", "build", "lambda", "actions", "agent", "box"];
@@ -24932,6 +25070,21 @@ function parseRequiredChecksVar(raw) {
   }
   return parsed.map((c) => c.trim());
 }
+function parseRequiredCheckBranchesVar(raw) {
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    throw new Error('org project set: requiredCheckBranches must be a JSON array, e.g. ["development"]');
+  }
+  if (!Array.isArray(parsed) || parsed.length === 0 || parsed.some((b) => typeof b !== "string" || !isRequiredCheckBranch(b))) {
+    throw new Error(`org project set: requiredCheckBranches must be a non-empty JSON array of: ${REQUIRED_CHECK_BRANCHES.join(", ")}`);
+  }
+  if (new Set(parsed).size !== parsed.length) {
+    throw new Error("org project set: requiredCheckBranches must not contain duplicates");
+  }
+  return REQUIRED_CHECK_BRANCHES.filter((branch) => parsed.includes(branch));
+}
 function parseCiExemptReasonVar(raw) {
   const trimmed = raw.trim();
   if (!trimmed) throw new Error("org project set: ciExemptReason must be a non-empty reason (or use --unset ciExemptReason to clear it)");
@@ -25028,6 +25181,7 @@ var SETTABLE_VAR_KEYS = [
   "portRange",
   "ci",
   "requiredChecks",
+  "requiredCheckBranches",
   "ciExemptReason",
   "gate",
   "secrets",
@@ -25057,6 +25211,7 @@ var SETTABLE_VAR_HINTS = {
   portRange: "JSON {start,end} or [start,end]",
   ci: "none \u2014 declare intentional no-ci",
   requiredChecks: 'JSON array, e.g. ["gate"] or [] for no-ci',
+  requiredCheckBranches: "non-empty JSON branch-name array; exact product-ruleset scope (#5210)",
   ciExemptReason: "non-empty string \u2014 declares this deployable repo has no CI surface (#4265)",
   gate: "JSON {runtime,cmd,workdir,cacheDepPath,pyVersion}"
 };
@@ -25157,6 +25312,8 @@ function buildProjectSetPatch(input) {
       patch[key] = raw;
     } else if (key === "requiredChecks") {
       patch[key] = parseRequiredChecksVar(raw);
+    } else if (key === "requiredCheckBranches") {
+      patch[key] = parseRequiredCheckBranchesVar(raw);
     } else if (key === "ciExemptReason") {
       patch[key] = parseCiExemptReasonVar(raw);
     } else if (key === "gate") {
@@ -27996,12 +28153,14 @@ function registerBootstrapCommands(program3) {
       const eq = value.indexOf("=");
       if (eq > 0) rawVars[value.slice(0, eq)] = value.slice(eq + 1);
     }
+    let registryRequiredCheckBranches;
     try {
       const meta = await fetchProjectBySlug(slug, registryClientDeps(await loadConfig()));
+      registryRequiredCheckBranches = meta?.requiredCheckBranches;
       for (const [k, v] of Object.entries(gateConfigToVars(meta?.gate))) if (rawVars[k] == null) rawVars[k] = v;
     } catch {
     }
-    const vars = withDerivedRepoVars(rawVars, parsedRepo, o.class, bootstrapReleaseTrack);
+    const vars = withDerivedRepoVars(rawVars, parsedRepo, o.class, bootstrapReleaseTrack, registryRequiredCheckBranches);
     if (!vars.PROJECT_ID) {
       try {
         const r = await gh(linkedProjectsQueryArgs(parsedRepo.owner, parsedRepo.name));
@@ -28362,7 +28521,16 @@ LIVE apply to ${repo}:
         content = null;
       }
       let desired;
-      if (seed.managedBlock) {
+      if (seed.source.startsWith("seed:")) {
+        const project2 = projects.find((p) => (p.repos ?? []).some((repo) => repo.toLowerCase() === r.repo.toLowerCase()));
+        const track = resolveReleaseTrack(project2, void 0, r.repo);
+        const vars = withDerivedRepoVars({}, parseOwnerRepo(r.repo), repoClass, track, project2?.requiredCheckBranches);
+        const resolved = resolveSeedWriteContent(seed, vars, readSeedFile, content);
+        if (!resolved.ok || resolved.content == null) {
+          return fail(`bootstrap propagate: ${r.repo} ${seed.target}: ${resolved.ok ? "rendered no content" : resolved.reason} \u2014 refusing an incomplete per-repo render`);
+        }
+        desired = resolved.content;
+      } else if (seed.managedBlock) {
         const vars = withDerivedRepoVars({}, parseOwnerRepo(r.repo), repoClass);
         const resolved = resolveSeedWriteContent(seed, vars, readSeedFile, content);
         if (!resolved.ok) {
@@ -33168,12 +33336,12 @@ var surfaces_default = {
         reload: "restart"
       },
       skills: {
-        delivery: "plugin",
+        delivery: "provisioned",
         sourceSurfaceId: "mmi-skills",
         artifactId: "mmi-hermes-plugin",
         invocation: {
           entry: "/mmi",
-          any: "mmi:<skill>"
+          any: "skill_view(name='<skill>')"
         }
       },
       hooks: {
@@ -33217,7 +33385,7 @@ var surfaces_default = {
       enforcementCeilings: [
         "Hermes pre_tool_call blocks only mapped shell and edit/write/patch tool families; disabled plugins enforce nothing.",
         "Hermes user plugins are opt-in through plugins.enabled; operator consent and host process isolation remain Hermes-owned.",
-        "npm is MMI transport only: MMI-Hub extracts @mutmutco/hermes-plugin into $HERMES_HOME/plugins/mmi, and a fresh Hermes Agent process is required for discovery.",
+        "npm is MMI transport only: MMI-Hub extracts @mutmutco/hermes-plugin into $HERMES_HOME/plugins/mmi and provisions the canonical skills into $HERMES_HOME/skills/mmi/; a fresh Hermes Agent process is required for discovery.",
         "Final assistant output is outside Hermes pre_tool_call hook control."
       ]
     }
@@ -34329,29 +34497,35 @@ function checkDocsIndex(probe) {
 }
 function checkRepoIndexCloud(probe) {
   if (!probe) return null;
+  const percent = (value) => value == null ? "n/a" : `${Math.round(value * 100)}%`;
+  const readiness = probe.v4Readiness;
+  const readinessEvidence = readiness ? [
+    `v4 readiness: ${readiness.verdict} \u2014 ${readiness.evidenceCount}/${readiness.goldenCount} checked-in goldens`,
+    ...Object.entries(readiness.modes).sort(([a], [b]) => a.localeCompare(b)).flatMap(([mode, result]) => {
+      const errors = Object.entries(result.errors).map(([kind, count]) => `${kind}:${count}`).join(",") || "none";
+      return [
+        `v4 ${mode}: ${result.verdict} \u2014 evidence=${result.evidenceCount}/${result.goldenCount} relevance=${percent(result.expectedTop10CitationRelevance)} citations=${percent(result.citationValidity)} embeddings=${percent(result.embeddingCoverage)} p95=${result.p95V4Ms ?? "n/a"}ms errorRate=${percent(result.errorRate)} errors=${errors}`,
+        `v4 ${mode} ceilings relevance>=${percent(result.ceilings.minimumExpectedTop10CitationRelevance)} citations>=${percent(result.ceilings.minimumCitationValidity)} embeddings>=${percent(result.ceilings.minimumEmbeddingCoverage)} p95<=${result.ceilings.maximumP95Ms}ms errorRate<=${percent(result.ceilings.maximumErrorRate)}`
+      ];
+    }),
+    ...readiness.reasons?.length ? [`v4 readiness reasons: ${readiness.reasons.join(", ")}`] : []
+  ] : ["v4 readiness: unavailable"];
   const evidence = [
     probe.repo ? `repo: ${probe.repo}` : "repo: (estate)",
-    probe.builtAt ? `builtAt: ${probe.builtAt}` : "builtAt: n/a",
-    typeof probe.fileCount === "number" ? `fileCount: ${probe.fileCount}` : "fileCount: n/a",
-    typeof probe.embCount === "number" ? `embCount: ${probe.embCount}` : "embCount: n/a",
-    typeof probe.localPresent === "boolean" ? `local v3 cache: ${probe.localPresent ? "present" : "absent"}` : "local v3 cache: n/a",
     `local v4: ${probe.localV4State ?? "unknown"}${probe.localV4Commit ? ` @ ${probe.localV4Commit.slice(0, 12)}` : ""}${typeof probe.localV4EmbeddingCoverage === "number" ? ` (${Math.round(probe.localV4EmbeddingCoverage * 100)}% embeddings)` : ""}`,
     `cloud v4: ${probe.cloudV4State ?? "unknown"}${probe.cloudV4Commit ? ` @ ${probe.cloudV4Commit.slice(0, 12)}` : ""}`,
-    `v4 cohort: ${probe.v4ReadPercent ?? 0}%`,
-    `v4 shadows: ${probe.v4ShadowComparisons ?? 0}/${probe.v4ShadowMinimum ?? 50} \u2014 ${probe.v4ShadowCutoverReady ? "cutover-ready" : "not ready"}`,
-    ...Object.entries(probe.v4ShadowErrors ?? {}).map(([kind, count]) => `v4 shadow error ${kind}: ${count}`)
+    ...readinessEvidence
   ];
   switch (probe.kind) {
     case "healthy": {
-      const v4Unready = probe.cloudV4State === "invalid" || probe.cloudV4State === "tombstoned" || probe.cloudV4State === "degraded" && (probe.localV4EmbeddingCoverage ?? 1) < 0.95;
-      const detail = probe.detail ?? `cloud v3 ok${typeof probe.fileCount === "number" ? ` \u2014 ${probe.fileCount} files` : ""}; v4 ${probe.cloudV4State ?? "absent"}, cohort ${probe.v4ReadPercent ?? 0}%`;
+      const v4Unready = probe.cloudV4State === "invalid" || probe.cloudV4State === "tombstoned" || probe.cloudV4State === "degraded" && (probe.localV4EmbeddingCoverage ?? 1) < 0.95 || !readiness || readiness.verdict === "not-ready";
+      const detail = probe.detail ?? `cloud v4 ${probe.cloudV4State ?? "absent"}, readiness ${readiness?.verdict ?? "unknown"}`;
       return {
-        ok: !v4Unready || (probe.v4ReadPercent ?? 0) === 0,
-        ...v4Unready && (probe.v4ReadPercent ?? 0) === 0 ? { warn: true, verified: false } : {},
+        ok: !v4Unready,
         id: "repo-index",
         label: "repo-index",
         detail,
-        ...v4Unready ? { fix: "run `mmi-hub update`, then dispatch `mmi-cli harbour org schedules run MMI-Hub/repo-index-reconcile`; keep the v4 cohort at 0 until shadows pass" } : {},
+        ...v4Unready ? { fix: "run `mmi-hub update`, then dispatch `mmi-cli harbour org schedules run MMI-Hub/repo-index-reconcile`; require v4 authority and readiness to become ready" } : {},
         verbose: evidence
       };
     }
@@ -34374,24 +34548,15 @@ function checkRepoIndexCloud(probe) {
         reportOnly: true,
         verbose: evidence
       };
-    case "missing-projection":
+    case "missing-authority":
       return {
         ok: false,
         id: "repo-index",
         label: "repo-index",
-        detail: probe.detail ?? "no cloud projection for this repo",
+        detail: probe.detail ?? "no active v4 authority for this repo",
         fix: "dispatch `mmi-cli harbour org schedules run MMI-Hub/repo-index-reconcile` or run the authenticated per-repo sync",
         verbose: evidence
       };
-    case "stale":
-      return {
-        ok: false,
-        id: "repo-index",
-        label: "repo-index",
-        detail: probe.detail ?? "cloud projection looks stale vs recent pushes",
-        fix: "dispatch `mmi-cli harbour org schedules run MMI-Hub/repo-index-reconcile` or wait for the registered 6h schedule",
-        verbose: evidence
-      };
     case "auth":
       return {
         ok: false,
@@ -34425,7 +34590,7 @@ function checkRepoIndexCloud(probe) {
         ok: true,
         id: "repo-index",
         label: "repo-index",
-        detail: probe.detail ?? "local cache absent (cloud search does not need it)",
+        detail: probe.detail ?? "local v4 authority absent (cloud search does not need it)",
         warn: true,
         verbose: evidence
       };
@@ -35639,7 +35804,6 @@ function mmiDoctorDeps(opts = {}) {
     },
     // #4156: short-timeout Hub status for the current repo. Fail-soft — never throws to doctor.
     repoIndexCloudState: async (root) => {
-      const local = repoIndexStatus(root);
       let localV4 = { state: "absent" };
       try {
         const parsed = JSON.parse((0, import_node_fs42.readFileSync)(repoIndexV4StorePath(root), "utf8"));
@@ -35654,7 +35818,7 @@ function mmiDoctorDeps(opts = {}) {
         } else localV4 = { state: "invalid" };
       } catch {
       }
-      const localFields = { localPresent: local.present, localV4State: localV4.state, localV4Commit: localV4.commit, localV4EmbeddingCoverage: localV4.embeddingCoverage };
+      const localFields = { localV4State: localV4.state, localV4Commit: localV4.commit, localV4EmbeddingCoverage: localV4.embeddingCoverage };
       try {
         const cfg = await loadConfig();
         const repo = inferRepoSlug(root);
@@ -35669,47 +35833,22 @@ function mmiDoctorDeps(opts = {}) {
           return { kind: "network", repo, detail: st.error, ...localFields };
         }
         const present = st.present;
-        const builtAt = typeof st.builtAt === "string" ? st.builtAt : void 0;
-        const fileCount = typeof st.fileCount === "number" ? st.fileCount : void 0;
-        const embCount = typeof st.embCount === "number" ? st.embCount : void 0;
         const v4 = st.v4;
-        const migration = st.v4Migration;
-        const shadow = st.v4Shadow;
-        const shadowThresholds = shadow?.thresholds;
+        const readinessRaw = st.v4Readiness;
+        const v4Readiness = readinessRaw && (readinessRaw.verdict === "ready" || readinessRaw.verdict === "not-ready") && typeof readinessRaw.goldenCount === "number" && typeof readinessRaw.evidenceCount === "number" && readinessRaw.modes && typeof readinessRaw.modes === "object" ? readinessRaw : void 0;
         const cloudV4State = typeof v4?.state === "string" && ["ready", "degraded", "invalid", "tombstoned"].includes(v4.state) ? v4.state : "absent";
         const v4Fields = {
           ...localFields,
           cloudV4State,
           ...typeof v4?.commit === "string" ? { cloudV4Commit: v4.commit } : {},
-          v4ReadPercent: typeof migration?.readPercent === "number" ? migration.readPercent : 0,
-          v4ShadowComparisons: typeof shadow?.comparisonCount === "number" ? shadow.comparisonCount : 0,
-          v4ShadowMinimum: typeof shadowThresholds?.minimumComparisons === "number" ? shadowThresholds.minimumComparisons : 50,
-          v4ShadowCutoverReady: shadow?.cutoverReady === true,
-          v4ShadowErrors: shadow?.errors && typeof shadow.errors === "object" ? shadow.errors : {}
+          ...v4Readiness ? { v4Readiness } : {}
         };
         if (present === false) {
-          return { kind: "missing-projection", repo, ...v4Fields, fileCount: 0, embCount: 0 };
-        }
-        if (builtAt) {
-          const ageMs = Date.now() - Date.parse(builtAt);
-          if (Number.isFinite(ageMs) && ageMs > 48 * 60 * 60 * 1e3) {
-            return {
-              kind: "stale",
-              repo,
-              builtAt,
-              fileCount,
-              embCount,
-              ...v4Fields,
-              detail: `projection builtAt ${builtAt} (>48h old)`
-            };
-          }
+          return { kind: "missing-authority", repo, ...v4Fields };
         }
         return {
           kind: "healthy",
           repo: typeof st.repo === "string" ? st.repo : repo,
-          builtAt,
-          fileCount,
-          embCount,
           ...v4Fields
         };
       } catch (e) {
@@ -36141,30 +36280,20 @@ repoIndex.command("rebuild").description("walk the checkout (git ls-files + giti
     await failGraceful(e.message);
   }
 });
-repoIndex.command("publish").description("publish this checkout's projection to Hub cloud (rebuilds locally first; estate indexer also runs on a schedule)").option("--embed", "request Titan file embeddings on the Hub (capped per publish)").option("--json", "machine-readable result").action(async (o) => {
+repoIndex.command("publish").description("build and publish this checkout's immutable v4 authority to Hub cloud").option("--json", "machine-readable result").action(async (o) => {
   try {
     const root = await repoRoot();
     const repo = inferRepoSlug(root);
-    const built = rebuildRepoIndex(root, repo);
     const cfg = await loadConfig();
     const deps = registryClientDeps(cfg);
-    const res = await publishRepoIndexCloud(
-      { repo, builtAt: built.builtAt, entries: built.entries, embed: o.embed === true },
-      deps
-    );
-    if (!res.ok) return await failGraceful(res.error);
     const v4 = await buildRepoIndexV4(root, repo, { modelDirectory: process.env.MMI_REPO_INDEXER_MODEL_DIR });
     const v4Result = await publishRepoIndexV4Cloud(v4, deps);
-    if (!v4Result.ok) return await failGraceful(`v3 published; v4 failed: ${v4Result.error}`);
+    if (!v4Result.ok) return await failGraceful(v4Result.error);
     if (o.json) {
-      consoleIo.log(JSON.stringify(res.body, null, 2));
+      consoleIo.log(JSON.stringify(v4Result, null, 2));
       return;
     }
-    const embCount = Number(res.body.embCount ?? 0);
-    const embRequested = Number(res.body.embRequested ?? 0);
-    const embCap = Number(res.body.embCap ?? 0);
-    const capNote = o.embed && embRequested > embCap && embCap > 0 ? ` (emb=${embCount} of ${embRequested} requested \u2014 capped at ${embCap}/publish, run \`--embed\` again to continue)` : "";
-    console.log(`repo-index: published ${res.body.repo} \u2014 ${res.body.fileCount} files, emb=${embCount}${capNote}`);
+    console.log(`repo-index: published v4 ${repo} \u2014 ${v4.manifest.chunks.length} chunks, ${v4.manifest.embeddings.length} embeddings`);
   } catch (e) {
     return await failGraceful(e.message);
   }
@@ -36214,7 +36343,7 @@ async function runRepoIndexSearchCommand(query, o, defaultMode) {
 }
 var REPO_INDEX_SEARCH_WHEN = 'beats grep for cross-repo questions, "where does X happen", and unknown filenames; grep wins inside a known checkout';
 function repoIndexSearchOptions(cmd) {
-  return cmd.option("--limit <n>", "max hits", "20").option("--json", "machine-readable hits").option("--local", "search only the local projection (rebuild if missing)").option("--cloud", "force Hub cloud search (default when not --local)").option("--semantic", "semantic mode (Titan cosine over path+symbols embeddings)").option("--lexical", "lexical-only mode (paths/symbols)").option("--repo <owner/name>", "limit cloud search to one repo");
+  return cmd.option("--limit <n>", "max hits", "20").option("--json", "machine-readable hits").option("--local", "search only the local projection (rebuild if missing)").option("--cloud", "force Hub cloud search (default when not --local)").option("--semantic", "v4 semantic mode (pinned BGE over structural chunks)").option("--lexical", "lexical-only mode (paths/symbols)").option("--repo <owner/name>", "limit cloud search to one repo");
 }
 repoIndexSearchOptions(repoIndex.command("search").description(`search Hub cloud by default (lexical/hybrid/semantic); use --local for checkout-only \u2014 ${REPO_INDEX_SEARCH_WHEN}`).argument("<query>", "path fragment, symbol, or meaning phrase")).action(async (query, o) => runRepoIndexSearchCommand(query, o, "hybrid"));
 repoIndexSearchOptions(program2.command("find").description(`estate code search across every registered repo (repo-index search, semantic by default) \u2014 ${REPO_INDEX_SEARCH_WHEN}`).argument("<query>", "path fragment, symbol, or meaning phrase")).action(async (query, o) => runRepoIndexSearchCommand(query, o, "semantic"));
@@ -36234,24 +36363,7 @@ repoIndex.command("status").description("show local and/or cloud repo-index stat
         consoleIo.log(JSON.stringify(st2, null, 2));
         return;
       }
-      if (st2.present === true && typeof st2.repo === "string") {
-        const fileCount = Number(st2.fileCount ?? 0);
-        const embCount = Number(st2.embCount ?? 0);
-        const embGap = Number(st2.embGap ?? Math.max(0, fileCount - embCount));
-        const stale = st2.staleBuiltAt === true ? " stale-builtAt" : "";
-        console.log(
-          `repo-index: cloud ${st2.repo} built ${st2.builtAt} \u2014 ${fileCount} files, emb=${embCount}/${fileCount} gap=${embGap}${stale}`
-        );
-        return;
-      }
-      consoleIo.log(JSON.stringify(st2, null, 2));
-      const count = typeof st2.count === "number" ? st2.count : void 0;
-      const present = st2.present;
-      if (count === 0 || present === false) {
-        console.error(
-          "repo-index: no cloud projection yet \u2014 after Hub deploy, run harbour `repo-index-reconcile` or `mmi-cli oracle repo-index sync-estate` (see docs/Guides/repo-index-runbook.md)."
-        );
-      }
+      console.log(formatRepoIndexCloudStatus(st2));
       return;
     }
     const root = await repoRoot();
@@ -36286,49 +36398,30 @@ repoIndex.command("graph").description("optional bounded cross-repo relationship
     return await failGraceful(error.message);
   }
 });
-repoIndex.command("cutover").description("set the schema-v4 read cohort; --percent 0 is the one-action rollback to v3").requiredOption("--percent <n>", "integer cohort percentage from 0 through 100").option("--json", "machine-readable result").action(async (o) => {
+repoIndex.command("health").description("post-deploy health gate: checked-in v4 readiness plus active-authority status").option("--live", "hit Hub cloud (v4 readiness and authority status); omit for offline golden-shape check").option("--golden <path>", "offline-only golden queries JSON").option("--json", "machine-readable findings").option("--queries-only", "release-gate mode: execute checked-in v4 goldens and consume the explicit readiness verdict; skip authority status").action(async (o) => {
   try {
-    const percent = Number(o.percent);
-    if (!Number.isInteger(percent) || percent < 0 || percent > 100) return await failGraceful("repo-index cutover --percent must be an integer from 0 through 100");
-    const cfg = await loadConfig();
-    const result = await setRepoIndexV4ReadPercentCloud(percent, registryClientDeps(cfg));
-    if (!result.ok) return await failGraceful(result.error);
-    if (o.json) consoleIo.log(JSON.stringify(result, null, 2));
-    else console.log(`repo-index: v4 read cohort ${result.percent}% (${result.cohort}); rollback: mmi-cli oracle repo-index cutover --percent 0`);
-  } catch (error) {
-    return await failGraceful(error.message);
-  }
-});
-repoIndex.command("health").description("post-deploy health gate: status + golden lexical/semantic queries (Hub#4149)").option("--live", "hit Hub cloud (status + searches); omit for offline golden-shape check").option("--golden <path>", "golden queries JSON (default: the suite bundled with the CLI, so the gate runs from any repo)").option("--json", "machine-readable findings").option("--queries-only", "deploy-gate mode: evaluate golden queries only, no estate/status reporting (Hub#4753)").action(async (o) => {
-  try {
-    const goldenPath = o.golden || "bundled repo-index-golden-queries.json";
-    const golden = o.golden ? loadGoldenSuite(o.golden) : defaultGoldenSuite();
-    const result = o.live ? await runRepoIndexHealth({
-      golden,
-      queriesOnly: o.queriesOnly,
-      live: {
-        status: async () => {
-          const cfg = await loadConfig();
-          const st = await statusRepoIndexCloud(void 0, registryClientDeps(cfg));
-          if ("error" in st && st.ok === false) return { ok: false, error: st.error };
-          return st;
+    const goldenPath = repoIndexHealthGoldenSource({ live: o.live, queriesOnly: o.queriesOnly, customPath: o.golden });
+    const golden = !o.live && o.golden ? loadGoldenSuite(o.golden) : defaultGoldenSuite();
+    const result = o.live ? await (async () => {
+      const cfg = await loadConfig();
+      const deps = registryClientDeps(cfg);
+      return runRepoIndexLiveHealth({
+        queriesOnly: o.queriesOnly,
+        v4Readiness: {
+          suite: defaultV4ReadinessSuite(),
+          probe: (queries) => probeRepoIndexV4ReadinessCloud(queries, deps)
         },
-        search: async (q, mode) => {
-          const cfg = await loadConfig();
-          const res = await searchRepoIndexCloud(q, { mode, limit: 10 }, registryClientDeps(cfg));
-          if (!res.ok) {
-            return {
-              ok: false,
-              error: res.error,
-              status: res.status
-            };
+        live: {
+          status: async () => {
+            const st = await statusRepoIndexCloud(void 0, deps);
+            if ("error" in st && st.ok === false) return { ok: false, error: st.error };
+            return st;
           }
-          return { ok: true, hits: res.hits };
         }
-      }
-    }) : await runRepoIndexHealth({ golden });
+      });
+    })() : await runRepoIndexHealth({ golden });
     if (o.json) {
-      consoleIo.log(JSON.stringify({ ok: result.ok, findings: result.findings, golden: goldenPath }, null, 2));
+      consoleIo.log(JSON.stringify({ ok: result.ok, findings: result.findings, golden: goldenPath, ..."readiness" in result && result.readiness ? { v4Readiness: result.readiness } : {} }, null, 2));
     } else {
       for (const f of result.findings) {
         const label = f.severity === "warn" ? "WARN" : f.ok ? "ok" : "FAIL";
@@ -36341,7 +36434,7 @@ repoIndex.command("health").description("post-deploy health gate: status + golde
     return await failGraceful(e.message);
   }
 });
-repoIndex.command("gc").description("remove cloud projections for repos no longer on the registry roster").option("--cloud", "required \u2014 GC only applies to Hub cloud").option("--json", "machine-readable result").action(async (o) => {
+repoIndex.command("gc").description("remove v4 cloud authority material for repos no longer on the registry roster").option("--cloud", "required \u2014 GC only applies to Hub cloud").option("--json", "machine-readable result").action(async (o) => {
   try {
     if (!o.cloud) return await failGraceful("repo-index gc requires --cloud");
     const cfg = await loadConfig();
@@ -36351,12 +36444,12 @@ repoIndex.command("gc").description("remove cloud projections for repos no longe
       consoleIo.log(JSON.stringify(res, null, 2));
       return;
     }
-    console.log(`repo-index: gc removed ${res.removed.length} orphan projection(s)`);
+    console.log(`repo-index: gc removed ${res.removed.length} orphan v4 authority record(s)`);
   } catch (e) {
     return await failGraceful(e.message);
   }
 });
-repoIndex.command("sync-estate").description("Hub indexer: shallow-clone registry repos, rebuild, publish to cloud (CI / operator)").option("--repo <owner/name>", "limit to one registered repo").option("--embed", "request Titan embeddings on publish").option("--json", "machine-readable result").action(async (o) => {
+repoIndex.command("sync-estate").description("Hub indexer: shallow-clone registry repos, build and publish v4 authorities (CI / operator)").option("--repo <owner/name>", "limit to one registered repo").option("--json", "machine-readable result").action(async (o) => {
   try {
     const cfg = await loadConfig();
     const gh = process.env.GH_TOKEN || process.env.GITHUB_TOKEN || "";
@@ -36364,7 +36457,6 @@ repoIndex.command("sync-estate").description("Hub indexer: shallow-clone registr
     const res = await syncEstateRepoIndex({
       deps: registryClientDeps(cfg),
       repo: o.repo,
-      embed: o.embed === true,
       githubToken: gh
     });
     if (o.json) {
@@ -36374,8 +36466,7 @@ repoIndex.command("sync-estate").description("Hub indexer: shallow-clone registr
     }
     for (const p of res.published) {
       const gap = p.embGap ?? Math.max(0, p.fileCount - (p.embCount ?? 0));
-      const trunc = p.embTruncated ? " truncated" : "";
-      console.log(`repo-index: published ${p.repo} \u2014 ${p.fileCount} files emb=${p.embCount ?? 0}/${p.fileCount} gap=${gap}${trunc} graph=${p.graphEdges ?? "unavailable"}`);
+      console.log(`repo-index: published v4 ${p.repo} \u2014 ${p.fileCount} chunks emb=${p.embCount ?? 0}/${p.fileCount} gap=${gap} graph=${p.graphEdges ?? "unavailable"}`);
     }
     for (const warning of res.skipped) console.error(`repo-index: WARN ${warning}`);
     for (const f of res.failed) {
@@ -36687,11 +36778,13 @@ project.command("get [owner/repo]").description("a project's META (board ids + p
     const m = read.project;
     const track = resolveReleaseTrack(m, void 0, target);
     const stages = branchesForTrack(track).join(" -> ");
+    const requiredCheckBranches = resolveRequiredCheckBranches(m, target).join(", ");
     const note = track === "direct" ? " (direct \u2014 no rc; /rcand refuses, /release ships development -> main)" : track === "trunk" ? " (trunk \u2014 main only)" : "";
     const deployNote = m.deployModel === "registry-publish" ? "\ndeploys are repository-owned publish workflows (registry-publish); no central tenant deploy runs for this repo." : "\ndeploys run centrally (tenant-deploy.yml); product repos carry no deploy files.";
     console.error(
       `${m.name ?? target} \u2014 class ${m.class ?? "?"} \u2014 deploy ${m.deployModel ?? "?"}
-release track: ${track} \u2014 stages: ${stages}${note}` + deployNote + " Inspect nonsecret DEPLOY facts with `mmi-cli oracle org project deploy get`; full coords remain OIDC-gated."
+release track: ${track} \u2014 stages: ${stages}${note}
+required-check branches: ${requiredCheckBranches}${m.requiredCheckBranches ? " (explicit)" : " (release-track fallback)"}` + deployNote + " Inspect nonsecret DEPLOY facts with `mmi-cli oracle org project deploy get`; full coords remain OIDC-gated."
     );
   }
 });