@mutmutco/cli 3.27.1 → 3.28.0

package/dist/main.cjs

@@ -9252,6 +9252,22 @@ function parseGhPrChecksResult(stdout, stderr) {
 function pollStateFromParsed(parsed) {
   return parsed === "error" ? "failure" : parsed;
 }
+var PR_MERGEABLE_UNKNOWN_POLL_RETRIES = 4;
+var PR_MERGEABLE_UNKNOWN_POLL_MS = 3e3;
+async function resolveSettledMergeableState(pollMergeable, sleep2) {
+  for (let attempt = 1; attempt <= PR_MERGEABLE_UNKNOWN_POLL_RETRIES; attempt++) {
+    const state = await pollMergeable();
+    if (state !== "UNKNOWN") return state;
+    if (attempt < PR_MERGEABLE_UNKNOWN_POLL_RETRIES) await sleep2(PR_MERGEABLE_UNKNOWN_POLL_MS);
+  }
+  return "UNKNOWN";
+}
+function conflictingPrMessage(baseBranch) {
+  return `PR is CONFLICTING with ${baseBranch} \u2014 GitHub will not queue checks until the conflict is resolved. Resolve with: git fetch origin ${baseBranch} && git rebase origin/${baseBranch}`;
+}
+function conflictingResult(policy, baseBranch, waitedMs) {
+  return { policy, status: "conflicting", reason: conflictingPrMessage(baseBranch), detail: "conflicting", waitedMs };
+}
 var PR_CHECKS_TIMEOUT_EXIT_CODE = 2;
 var PR_CHECKS_POLL_MS = 3e4;
 var PR_CHECKS_TIMEOUT_MS = 30 * 6e4;
@@ -9276,6 +9292,7 @@ function decidePrMergeNoCiGuard(checks, policyReason = "registry META ci:none")
 }
 async function waitForPrChecks(deps) {
   let { policy, reason } = await deps.resolvePolicy();
+  const baseBranch = deps.baseBranch ?? "development";
   const queuedStates = [];
   if (policy === "no-ci") {
     const firstState = await deps.pollChecks();
@@ -9287,6 +9304,10 @@ async function waitForPrChecks(deps) {
     policy = "wait-for-checks";
     queuedStates.push(firstState);
   }
+  if (deps.pollMergeable) {
+    const mergeable = await resolveSettledMergeableState(deps.pollMergeable, deps.sleep);
+    if (mergeable === "CONFLICTING") return conflictingResult(policy, baseBranch, 0);
+  }
   const now = deps.now ?? (() => Date.now());
   const timeoutMs = deps.timeoutMs ?? PR_CHECKS_TIMEOUT_MS;
   const started = now();
@@ -9303,6 +9324,10 @@ async function waitForPrChecks(deps) {
   let failureStreak = 0;
   report("starting");
   while (now() < deadline) {
+    if (deps.pollMergeable) {
+      const mergeable = await deps.pollMergeable();
+      if (mergeable === "CONFLICTING") return conflictingResult(policy, baseBranch, now() - started);
+    }
     const state = queuedStates.shift() ?? await deps.pollChecks();
     report(state);
     if (state !== "success") successStreak = 0;
@@ -10454,6 +10479,12 @@ async function runPrLand(prNumber, options, deps) {
   base.ciPolicy = ciPolicy;
   const checksWait = await deps.waitForChecks(prNumber, repo);
   base.checksWait = checksWait;
+  if (checksWait.status === "conflicting") {
+    return {
+      ...base,
+      error: `checks-wait conflicting: ${checksWait.reason ?? "PR is conflicting with the base branch"}`
+    };
+  }
   if (checksWait.status === "failure" || checksWait.status === "timeout") {
     return {
       ...base,
@@ -16632,23 +16663,20 @@ var DEPLOY_SUBSTRATES = ["hetzner-ssh"];
 var DEPLOY_STAGES = ["dev", "rc", "main"];
 var DEPLOY_DOMAIN_RE = /^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+$/;
 var DEPLOY_SHELL_SAFE_RE = /^[A-Za-z0-9./:_?&=%-]*$/;
-function buildSetDeployPatch(slug, input) {
+function buildSetDeployPatch(_slug, input) {
   const clean4 = (v) => typeof v === "string" && v.trim() !== "" ? v.trim() : void 0;
   const stage2 = clean4(input.stage);
   if (!stage2 || !DEPLOY_STAGES.includes(stage2)) {
     throw new Error(`project set-deploy: --stage must be one of: ${DEPLOY_STAGES.join(", ")}`);
   }
-  const substrate = clean4(input.substrate) ?? "hetzner-ssh";
-  if (!DEPLOY_SUBSTRATES.includes(substrate)) {
+  const substrate = clean4(input.substrate);
+  if (substrate !== void 0 && !DEPLOY_SUBSTRATES.includes(substrate)) {
     throw new Error(`project set-deploy: --substrate must be one of: ${DEPLOY_SUBSTRATES.join(", ")}`);
   }
   const sshHost = clean4(input.sshHost);
-  if (substrate === "hetzner-ssh" && !sshHost) {
-    throw new Error("project set-deploy: hetzner-ssh requires --ssh-host");
-  }
-  const sshUser = clean4(input.sshUser) ?? "root";
-  const deployPath = clean4(input.deployPath) ?? `/opt/mmi/${slug}/${stage2}`;
-  const serviceName = clean4(input.service) ?? slug;
+  const sshUser = clean4(input.sshUser);
+  const deployPath = clean4(input.deployPath);
+  const serviceName = clean4(input.service);
   for (const [label, v] of [["--ssh-host", sshHost], ["--ssh-user", sshUser], ["--deploy-path", deployPath], ["--service", serviceName]]) {
     if (v !== void 0 && !DEPLOY_SHELL_SAFE_RE.test(v)) throw new Error(`project set-deploy: ${label} contains unsafe characters`);
   }
@@ -16664,19 +16692,24 @@ function buildSetDeployPatch(slug, input) {
     if (!DEPLOY_DOMAIN_RE.test(a)) throw new Error(`project set-deploy: --alias must be a DNS hostname, got ${JSON.stringify(a)}`);
   }
   const uniqueAliases = [...new Set(aliases)];
+  if (input.clearAliases && uniqueAliases.length) {
+    throw new Error("project set-deploy: --clear-aliases cannot be combined with --alias (they contradict)");
+  }
   if (input.noEnvFile !== void 0 && typeof input.noEnvFile !== "boolean") {
     throw new Error("project set-deploy: --no-env-file must be true or false");
   }
   return {
     stage: stage2,
-    substrate,
-    sshHost,
-    sshUser,
-    deployPath,
-    serviceName,
+    ...substrate !== void 0 ? { substrate } : {},
+    ...sshHost !== void 0 ? { sshHost } : {},
+    ...sshUser !== void 0 ? { sshUser } : {},
+    ...deployPath !== void 0 ? { deployPath } : {},
+    ...serviceName !== void 0 ? { serviceName } : {},
     ...domain !== void 0 ? { domain } : {},
     ...port !== void 0 ? { port } : {},
-    ...uniqueAliases.length ? { aliases: uniqueAliases } : {},
+    // #2986: an explicit `[]` is what the route reads as "clear them"; omitting the key is what it reads as
+    // "keep them". Those are different instructions and they now have different flags.
+    ...input.clearAliases ? { aliases: [] } : uniqueAliases.length ? { aliases: uniqueAliases } : {},
     ...input.noEnvFile !== void 0 ? { noEnvFile: input.noEnvFile } : {}
   };
 }
@@ -17188,6 +17221,206 @@ function registerSecretsCommands(program3) {
   secrets.command("revoke <repo> <login> <key>").description("MASTER-ONLY: withdraw a previously granted org-tier secret access").action((repo, login, key) => withSecrets((d) => secretsRevoke(d, repo, login, key, {})));
 }
 
+// src/box.ts
+var BOX_KEYS = {
+  /** Opens every MM box INCLUDING the CI runner (`mmi-runner`). The general-purpose MM key. */
+  mmMaster: "HETZNER_MASTER_SSH_PRIVATE_KEY",
+  /** Opens the OGUZ project's boxes. */
+  oguzMaster: "HETZNER_OGUZ_MASTER_SSH_PRIVATE_KEY",
+  /** The deploy key. Opens MM prod/tenant boxes but NOT `mmi-runner` — a real trap: reaching for this key
+   *  to get into the CI runner fails, and the failure reads like a broken box rather than a wrong key. */
+  mmDeploy: "HETZNER_SSH_PRIVATE_KEY"
+};
+var HETZNER_VAULT_SLUG = "_org";
+var HETZNER_NS = "hetzner";
+var nsKey = (key) => `${HETZNER_NS}/${key}`;
+var PROJECT_API_TOKEN = {
+  MM: nsKey("HETZNER_MM_API_TOKEN"),
+  OGUZ: nsKey("HETZNER_OGUZ_API_TOKEN")
+};
+function sshKeyForProject(project2) {
+  return project2 === "OGUZ" ? BOX_KEYS.oguzMaster : BOX_KEYS.mmMaster;
+}
+function vaultPath(key) {
+  return `/mmi-future/${HETZNER_VAULT_SLUG}/${HETZNER_NS}/${key}`;
+}
+function nextPage(payload) {
+  if (!payload || typeof payload !== "object") return null;
+  const { meta } = payload;
+  if (!meta || typeof meta !== "object") return null;
+  const { pagination } = meta;
+  if (!pagination || typeof pagination !== "object") return null;
+  const { next_page: next } = pagination;
+  return typeof next === "number" && Number.isInteger(next) && next > 0 ? next : null;
+}
+function parseServer(node, project2) {
+  if (!node || typeof node !== "object") return null;
+  const { name, status, public_net: publicNet } = node;
+  if (typeof name !== "string" || !name) return null;
+  let address = "";
+  if (publicNet && typeof publicNet === "object") {
+    const { ipv4 } = publicNet;
+    if (ipv4 && typeof ipv4 === "object") {
+      const { ip } = ipv4;
+      if (typeof ip === "string") address = ip;
+    }
+  }
+  const sshKey = sshKeyForProject(project2);
+  return {
+    name,
+    address,
+    project: project2,
+    status: typeof status === "string" ? status : "unknown",
+    sshKey,
+    sshKeyPath: vaultPath(sshKey)
+  };
+}
+function parseServers(payload, project2) {
+  if (!payload || typeof payload !== "object") {
+    throw new Error(`Hetzner ${project2}: expected an object from /v1/servers, got ${payload === null ? "null" : typeof payload}`);
+  }
+  const { servers } = payload;
+  if (!Array.isArray(servers)) {
+    throw new Error(`Hetzner ${project2}: /v1/servers returned no servers array`);
+  }
+  return servers.map((node) => parseServer(node, project2)).filter((b) => b !== null).sort((a, b) => a.name.localeCompare(b.name));
+}
+function lookupBox(name, boxes, incomplete) {
+  const found = boxes.find((b) => b.name.toLowerCase() === name.toLowerCase());
+  if (found) return { kind: "found", box: found };
+  if (incomplete.length) return { kind: "unknown", reasons: [...incomplete] };
+  return { kind: "absent", known: boxes.map((b) => b.name) };
+}
+function formatBoxTable(boxes) {
+  if (!boxes.length) return "no boxes";
+  const w = (pick, head) => Math.max(head.length, ...boxes.map((b) => pick(b).length));
+  const nameW = w((b) => b.name, "BOX");
+  const addrW = w((b) => b.address || "(no public ipv4)", "ADDRESS");
+  const projW = w((b) => b.project, "PROJECT");
+  const statW = w((b) => b.status, "STATUS");
+  const row = (name, addr, proj, stat2, key) => `${name.padEnd(nameW)}  ${addr.padEnd(addrW)}  ${proj.padEnd(projW)}  ${stat2.padEnd(statW)}  ${key}`;
+  const lines = [row("BOX", "ADDRESS", "PROJECT", "STATUS", "SSH KEY (vault path)")];
+  for (const b of boxes) {
+    lines.push(row(b.name, b.address || "(no public ipv4)", b.project, b.status, b.sshKeyPath));
+  }
+  return lines.join("\n");
+}
+function formatSshRecipe(box) {
+  if (!box.address) {
+    return `box ${box.name} has no public IPv4 \u2014 it is not directly reachable over ssh.`;
+  }
+  return [
+    `# ${box.name} (${box.project}, ${box.status}) \u2014 the key value is never printed or kept in shell history`,
+    'set -eo pipefail    # pipefail matters: without it a failed SSM read still "succeeds" through tr',
+    "kf=$(mktemp)",
+    `trap 'rm -f "$kf"' EXIT INT TERM HUP    # the key must not outlive this shell, however it dies`,
+    'chmod 600 "$kf"',
+    `MSYS_NO_PATHCONV=1 aws ssm get-parameter --name ${box.sshKeyPath} \\`,
+    "  --with-decryption --query Parameter.Value --output text --region eu-central-1 \\",
+    `  | tr -d '\\r' > "$kf"`,
+    'test -s "$kf"       # never hand ssh an empty key file',
+    `ssh -i "$kf" -o StrictHostKeyChecking=accept-new root@${box.address} 'hostname; uptime'`
+  ].join("\n");
+}
+
+// src/box-commands.ts
+var HETZNER_API = "https://api.hetzner.cloud/v1/servers";
+var HETZNER_TIMEOUT_MS = 15e3;
+var PER_PAGE = 50;
+var MAX_PAGES = 20;
+var PROJECTS = ["MM", "OGUZ"];
+async function fetchProjectBoxes(project2, token) {
+  const boxes = [];
+  let page = 1;
+  for (let i = 0; page !== null && i < MAX_PAGES; i += 1) {
+    const url = `${HETZNER_API}?page=${page}&per_page=${PER_PAGE}`;
+    const res = await fetch(url, {
+      headers: { Authorization: `Bearer ${token}` },
+      signal: AbortSignal.timeout(HETZNER_TIMEOUT_MS)
+    });
+    if (!res.ok) {
+      throw new Error(`Hetzner ${project2}: /v1/servers page ${page} returned ${res.status} ${res.statusText}`);
+    }
+    const payload = await res.json();
+    boxes.push(...parseServers(payload, project2));
+    page = nextPage(payload);
+  }
+  if (page !== null) {
+    throw new Error(`Hetzner ${project2}: still paginating after ${MAX_PAGES} pages \u2014 refusing to report a possibly-truncated inventory`);
+  }
+  return boxes;
+}
+async function fetchInventory() {
+  const boxes = [];
+  const incomplete = [];
+  await withSecrets(async (deps) => {
+    for (const project2 of PROJECTS) {
+      const key = PROJECT_API_TOKEN[project2];
+      const token = await fetchSecretValue(deps, key, { slug: HETZNER_VAULT_SLUG });
+      if (!token) {
+        incomplete.push(`${project2}: could not read ${key} from the vault (slug ${HETZNER_VAULT_SLUG})`);
+        continue;
+      }
+      try {
+        boxes.push(...await fetchProjectBoxes(project2, token));
+      } catch (e) {
+        incomplete.push(e.message);
+      }
+    }
+  });
+  if (incomplete.length === PROJECTS.length) {
+    throw new Error(`box: could not read any Hetzner project \u2014
+  ${incomplete.join("\n  ")}`);
+  }
+  return { boxes: boxes.sort((a, b) => a.name.localeCompare(b.name)), incomplete };
+}
+function warnIncomplete(incomplete) {
+  for (const f of incomplete) console.error(`box: WARNING \u2014 ${f}`);
+  if (incomplete.length) console.error("box: this inventory is INCOMPLETE \u2014 boxes may be missing from it.");
+}
+function registerBoxCommands(program3) {
+  const box = program3.command("box").description("the box inventory \u2014 which machines exist, their addresses, and the vault key that opens each (never key values)");
+  box.command("list").description("list every Hetzner box (both projects, live) with its address and the vault path of its ssh key").option("--json", "machine-readable output").action(async (o) => {
+    try {
+      const { boxes, incomplete } = await fetchInventory();
+      if (o.json) {
+        console.log(JSON.stringify({ boxes, incomplete }, null, 2));
+      } else {
+        console.log(formatBoxTable(boxes));
+        warnIncomplete(incomplete);
+      }
+      if (incomplete.length) process.exitCode = 1;
+    } catch (e) {
+      await failGraceful(e.message);
+    }
+  });
+  box.command("get <name>").description("one box by name \u2014 its address and ssh key path; --ssh prints a ready-to-run connect recipe").option("--json", "machine-readable output").option("--ssh", "print a copy-paste ssh recipe (materializes the key to a temp file; never echoes it)").action(async (name, o) => {
+    try {
+      const { boxes, incomplete } = await fetchInventory();
+      const result = lookupBox(name, boxes, incomplete);
+      if (result.kind === "unknown") {
+        warnIncomplete(result.reasons);
+        await failGraceful(
+          `box: cannot confirm whether '${name}' exists \u2014 part of the inventory could not be read (see above). Refusing to answer "no such box" from a list I know is incomplete.`
+        );
+        return;
+      }
+      if (result.kind === "absent") {
+        await failGraceful(`box: no box named '${name}'. Known boxes: ${result.known.join(", ") || "(none)"}`);
+        return;
+      }
+      const found = result.box;
+      if (o.json) console.log(JSON.stringify({ box: found, incomplete }, null, 2));
+      else if (o.ssh) console.log(formatSshRecipe(found));
+      else console.log(formatBoxTable([found]));
+      if (!o.json) warnIncomplete(incomplete);
+      if (incomplete.length) process.exitCode = 1;
+    } catch (e) {
+      await failGraceful(e.message);
+    }
+  });
+}
+
 // src/edge-tunnel.ts
 var HOSTNAME_RE = /^(?=.{1,253}$)([a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)(\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)+$/;
 var UPSTREAM_RE = /^https?:\/\/[^/\s]+(?::\d+)?(?:\/.*)?$/;
@@ -19380,15 +19613,6 @@ function parseLinkedIssues(body) {
   }
   return [...refs].sort((a, b) => Number(a.slice(1)) - Number(b.slice(1)));
 }
-function parseClosingIssues(body) {
-  const refs = /* @__PURE__ */ new Set();
-  const re = /\b(?:close[sd]?|fix(?:e[sd])?|resolve[sd]?)\s+(#\d+\b(?:(?:\s*,\s*(?:and\s+)?|\s+and\s+|\s*&\s*)#\d+\b)*)/gi;
-  let m;
-  while ((m = re.exec(body)) !== null) {
-    for (const ref of m[1].match(/#\d+/g) ?? []) refs.add(ref);
-  }
-  return [...refs].sort((a, b) => Number(a.slice(1)) - Number(b.slice(1)));
-}
 function decidePrCloseBranchCleanup(input) {
   if (input.isProtected) return { action: "skip", reason: "protected-branch" };
   if (input.dirty) return { action: "skip", reason: "dirty" };
@@ -19784,6 +20008,88 @@ function parseWorktreePorcelain2(stdout) {
   return out;
 }
 
+// src/board-advance.ts
+function repoOf2(ref) {
+  if (!ref || typeof ref !== "object") return void 0;
+  const { number, repository } = ref;
+  if (typeof number !== "number" || !Number.isInteger(number) || number <= 0) return void 0;
+  if (!repository || typeof repository !== "object") return void 0;
+  const { name, owner } = repository;
+  if (typeof name !== "string" || !name) return void 0;
+  if (!owner || typeof owner !== "object") return void 0;
+  const { login } = owner;
+  if (typeof login !== "string" || !login) return void 0;
+  return `${login}/${name}`;
+}
+async function advanceClosedIssuesToDone(deps) {
+  let closing;
+  try {
+    closing = await deps.fetchClosingIssues();
+  } catch (e) {
+    return { status: "fetch-failed", entries: [], error: e.message };
+  }
+  if (!Array.isArray(closing)) {
+    return {
+      status: "fetch-failed",
+      entries: [],
+      error: `expected an array of closing issue references, got ${closing === null ? "null" : typeof closing}`
+    };
+  }
+  if (closing.length === 0) return { status: "none", entries: [] };
+  const refs = [];
+  for (const [i, candidate] of closing.entries()) {
+    const repo = repoOf2(candidate);
+    if (!repo) {
+      return {
+        status: "fetch-failed",
+        entries: [],
+        error: `closing reference ${i} is missing a usable issue number or repository \u2014 refusing to guess which board it belongs to`
+      };
+    }
+    refs.push({ ref: candidate, repo });
+  }
+  const entries = [];
+  for (const { ref, repo } of refs) {
+    if (repo.toLowerCase() !== deps.repo.toLowerCase()) {
+      entries.push({
+        issue: `${repo}#${ref.number}`,
+        moved: false,
+        status: "skipped-cross-repo",
+        error: `closed by this PR but lives in another repo \u2014 the ${deps.repo} board does not own it; move it on that repo's board`
+      });
+      continue;
+    }
+    const issue2 = `#${ref.number}`;
+    try {
+      const outcome = await deps.moveIssueToDone(issue2);
+      entries.push(
+        outcome.moved ? { issue: issue2, moved: true, status: "moved" } : { issue: issue2, moved: false, status: "failed", error: outcome.error }
+      );
+    } catch (e) {
+      entries.push({ issue: issue2, moved: false, status: "failed", error: e.message });
+    }
+  }
+  return { status: entries.every((e) => e.moved) ? "ok" : "partial", entries };
+}
+function boardAdvanceFailures(result) {
+  return (result?.entries ?? []).filter((e) => !e.moved);
+}
+function boardAdvanceExitCode(result) {
+  if (!result) return void 0;
+  if (result.status === "fetch-failed") return 1;
+  return boardAdvanceFailures(result).length > 0 ? 1 : void 0;
+}
+function boardAdvanceFailureMessage(result) {
+  if (!result) return void 0;
+  if (result.status === "fetch-failed") {
+    return `pr merge: could not read the PR's closing issues (${result.error ?? "unknown error"}) \u2014 the PR MERGED, but no board item was advanced. Check the board by hand.`;
+  }
+  const failures = boardAdvanceFailures(result);
+  if (!failures.length) return void 0;
+  const named = failures.map((f) => f.error ? `${f.issue} (${f.error})` : f.issue).join(", ");
+  return `pr merge: board advance incomplete for ${named} \u2014 the PR MERGED, but ${failures.length === 1 ? "this issue" : "these issues"} did not reach Done on the board.`;
+}
+
 // src/session-report.ts
 var GC_GH_TIMEOUT_MS4 = 2e4;
 function shapeSessionIssues(report) {
@@ -19902,6 +20208,7 @@ function registerSessionReport(program3) {
 
 // src/doctor-render.ts
 var RESTART_LINE = "\u21BB Restart Claude to finish.";
+var VERBOSE_INDENT = "    ";
 function renderCheckLine(check) {
   if (check.ok) {
     return check.detail ? `\u2713 ${check.label} \u2014 ${check.detail}` : `\u2713 ${check.label}`;
@@ -19913,17 +20220,39 @@ function renderReport(checks, opts) {
   if (opts.restartPending) lines.push(RESTART_LINE);
   return lines.join("\n");
 }
+function renderTally(checks) {
+  const total = checks.length;
+  const healthy = total - checks.filter((c) => !c.ok).length;
+  return healthy === total ? `\u2713 all ${total} checks healthy` : `\u2713 ${healthy} of ${total} checks healthy`;
+}
+function renderDoctorText(checks, opts) {
+  const lines = [];
+  for (const check of checks) {
+    lines.push(renderCheckLine(check));
+    if (opts.verbose) {
+      for (const evidence of check.verbose ?? []) lines.push(`${VERBOSE_INDENT}${evidence}`);
+    }
+  }
+  lines.push(renderTally(checks));
+  if (opts.restartPending) lines.push(RESTART_LINE);
+  return lines.join("\n");
+}
 function doctorReportExitCode(checks) {
   return checks.some((c) => !c.ok) ? 1 : 0;
 }
 
 // src/doctor-clean.ts
 function checkGithubAuth(probe) {
-  const ok = Boolean(probe.login?.trim());
+  const login = probe.login?.trim();
+  const ok = Boolean(login);
   return {
     ok,
     label: "github auth",
-    fix: probe.ghInstalled ? 'run: gh auth login --hostname github.com --git-protocol https --web --scopes "project"' : "install GitHub CLI (https://cli.github.com), then: gh auth login"
+    fix: probe.ghInstalled ? 'run: gh auth login --hostname github.com --git-protocol https --web --scopes "project"' : "install GitHub CLI (https://cli.github.com), then: gh auth login",
+    verbose: [
+      `gh installed: ${probe.ghInstalled ? "yes" : "no"}`,
+      `authenticated as: ${login || "(none)"}`
+    ]
   };
 }
 function checkAwsIdentity(probe) {
@@ -19932,23 +20261,36 @@ function checkAwsIdentity(probe) {
   return {
     ok: !arn || !arn.endsWith(":root"),
     label: "aws identity",
-    fix: "use a non-root IAM user/session profile (set AWS_PROFILE or run: aws sso login), then verify `aws sts get-caller-identity` is not :root"
+    fix: "use a non-root IAM user/session profile (set AWS_PROFILE or run: aws sso login), then verify `aws sts get-caller-identity` is not :root",
+    // Name the caller. A green "aws identity" says only "not root" — it does not say WHO, and "no AWS
+    // configured at all" is also green here. Under --verbose those two must not look the same.
+    verbose: [`caller: ${arn || "(no AWS identity configured \u2014 allowed)"}`]
   };
 }
 function checkRepoWorktrees(probe) {
   return {
     ok: !(probe.isOrgRepo && probe.hasRepoLocalWorktrees),
     label: "repo worktrees",
-    fix: "repo-local `.worktrees/` is not the canonical path \u2014 use `mmi-cli worktree create <branch>` (sibling `../worktrees/`), then remove the in-repo `.worktrees/`"
+    fix: "repo-local `.worktrees/` is not the canonical path \u2014 use `mmi-cli worktree create <branch>` (sibling `../worktrees/`), then remove the in-repo `.worktrees/`",
+    verbose: [
+      `org repo: ${probe.isOrgRepo ? "yes" : "no"}`,
+      `repo-local .worktrees/: ${probe.hasRepoLocalWorktrees ? "present" : "absent"}`
+    ]
   };
 }
 function checkClaudePlugin(probe) {
   const { installed, released, guardState } = probe;
+  const evidence = [
+    `installed: ${installed ?? "(none)"}`,
+    `released:  ${released ?? "(not checked \u2014 offline or --fast)"}`,
+    `resolvable: ${guardState}`
+  ];
   if (guardState === "no-install" || guardState === "unresolved") {
     return {
       ok: false,
       label: guardState === "no-install" ? "Claude plugin \u2014 not installed" : "Claude plugin \u2014 unresolved (marketplace/cache missing)",
-      fix: "run `mmi-cli plugin-heal` to reinstall the MMI marketplace + plugin, then restart Claude"
+      fix: "run `mmi-cli plugin-heal` to reinstall the MMI marketplace + plugin, then restart Claude",
+      verbose: evidence
     };
   }
   const behind = Boolean(installed && released) && compareVersions(installed, released) < 0;
@@ -19956,43 +20298,61 @@ function checkClaudePlugin(probe) {
     return {
       ok: false,
       label: `Claude plugin ${installed} \u2192 ${released}`,
-      fix: "run /plugin, update MMI (reinstall if it shows a legacy row), then restart Claude"
+      fix: "run /plugin, update MMI (reinstall if it shows a legacy row), then restart Claude",
+      verbose: evidence
     };
   }
-  return { ok: true, label: installed ? `Claude plugin ${installed}` : "Claude plugin" };
+  return { ok: true, label: installed ? `Claude plugin ${installed}` : "Claude plugin", verbose: evidence };
 }
 function checkCliVersion(input) {
   const report = buildVersionLagReport(input);
-  if (!report.releasedVersion) return { ok: true, label: `mmi-cli ${report.currentVersion}` };
-  if (report.ok) return { ok: true, label: `mmi-cli ${report.currentVersion}` };
+  const evidence = [
+    `running:  ${report.currentVersion}`,
+    `published: ${report.releasedVersion ?? "(not checked \u2014 offline or --fast)"}`
+  ];
+  if (!report.releasedVersion) return { ok: true, label: `mmi-cli ${report.currentVersion}`, verbose: evidence };
+  if (report.ok) return { ok: true, label: `mmi-cli ${report.currentVersion}`, verbose: evidence };
   return {
     ok: false,
     label: `mmi-cli ${report.currentVersion} \u2192 ${report.releasedVersion}`,
-    fix: report.fix
+    fix: report.fix,
+    verbose: evidence
   };
 }
 function checkPluginCache(input) {
+  const evidence = [
+    `cached versions: ${input.cached}`,
+    `stale: ${input.stale.length ? input.stale.join(", ") : "(none)"}`
+  ];
   if (input.stale.length === 0) {
-    return { ok: true, label: "plugin cache", detail: input.cached ? `${input.cached} version(s), nothing stale` : "no cache" };
+    return {
+      ok: true,
+      label: "plugin cache",
+      detail: input.cached ? `${input.cached} version(s), nothing stale` : "no cache",
+      verbose: evidence
+    };
   }
   const size = input.bytes > 0 ? `, ${(input.bytes / 1e6).toFixed(1)} MB` : "";
   return {
     ok: false,
     label: "plugin cache",
     detail: `${input.cached} versions cached (${input.stale.length} stale${size})`,
-    fix: "run `mmi-cli plugin-prune` to review, then `mmi-cli plugin-prune --apply` to delete"
+    fix: "run `mmi-cli plugin-prune` to review, then `mmi-cli plugin-prune --apply` to delete",
+    verbose: evidence
   };
 }
 function checkTrainSync(result) {
+  const evidence = result.branches.length ? result.branches.map((b) => `${b.branch}: ${b.status}${b.reason ? ` (${b.reason})` : ""}`) : ["no local train branches to sync"];
   const problems = result.branches.filter((b) => b.status === "skipped" && (b.reason === "diverged" || b.reason === "ff-failed"));
   if (problems.length) {
-    return { ok: false, label: "train branches", fix: problems.map((b) => b.note).join("; ") };
+    return { ok: false, label: "train branches", fix: problems.map((b) => b.note).join("; "), verbose: evidence };
   }
   const moved = result.branches.filter((b) => b.status === "synced");
   return {
     ok: true,
     label: "train branches",
-    detail: moved.length ? `fast-forwarded ${moved.map((b) => b.branch).join(", ")}` : void 0
+    detail: moved.length ? `fast-forwarded ${moved.map((b) => b.branch).join(", ")}` : void 0,
+    verbose: evidence
   };
 }
 function planGitignore(current) {
@@ -20019,14 +20379,19 @@ async function runDoctorClean(opts, io, deps) {
   if (aws) checks.push(aws);
   checks.push(checkRepoWorktrees({ isOrgRepo, hasRepoLocalWorktrees: deps.hasRepoLocalWorktrees() }));
   if (isOrgRepo) {
-    const gi = planGitignore(deps.readGitignore());
+    const current = deps.readGitignore();
+    const gi = planGitignore(current);
+    const giEvidence = [
+      `.gitignore: ${current === null ? "absent" : `${current.split("\n").length} lines`}`,
+      `managed block: ${gi.ok ? "present and current" : "missing or out of date"}`
+    ];
     if (gi.ok) {
-      checks.push({ ok: true, label: "gitignore block" });
+      checks.push({ ok: true, label: "gitignore block", verbose: giEvidence });
     } else if (apply && gi.content && deps.writeGitignore(gi.content)) {
-      checks.push({ ok: true, label: "gitignore block", detail: "rewrote managed block" });
+      checks.push({ ok: true, label: "gitignore block", detail: "rewrote managed block", verbose: giEvidence });
       restartPending = true;
     } else {
-      checks.push({ ok: false, label: "gitignore block", fix: "run `mmi-cli doctor --apply` to write the org-managed .gitignore block" });
+      checks.push({ ok: false, label: "gitignore block", fix: "run `mmi-cli doctor --apply` to write the org-managed .gitignore block", verbose: giEvidence });
     }
   }
   const plugin = checkClaudePlugin({ installed, released, guardState: deps.pluginGuardState(isOrgRepo) });
@@ -20038,7 +20403,13 @@ async function runDoctorClean(opts, io, deps) {
     try {
       checks.push(checkTrainSync(await deps.syncTrain()));
     } catch (e) {
-      checks.push({ ok: false, label: "train branches", fix: `sync failed \u2014 ${e instanceof Error ? e.message : String(e)}` });
+      const message = e instanceof Error ? e.message : String(e);
+      checks.push({
+        ok: false,
+        label: "train branches",
+        fix: `sync failed \u2014 ${message}`,
+        verbose: [`sync threw: ${message}`, "no train branch was fast-forwarded this run"]
+      });
     }
     const repoRoot2 = await deps.repoRoot();
     try {
@@ -20050,36 +20421,64 @@ async function runDoctorClean(opts, io, deps) {
         if (r.removedBranches.length || r.removedRemoteBranches.length) detailParts.push(`${r.removedBranches.length + r.removedRemoteBranches.length} merged branches`);
         if (r.removedWorktreeDirs.length) detailParts.push(`${r.removedWorktreeDirs.length} dead worktrees`);
         if (r.removedTrackingRefs.length) detailParts.push(`${r.removedTrackingRefs.length} stale refs`);
-        checks.push({ ok: true, label: "branches / worktrees", detail: reaped ? `reaped ${detailParts.join(", ")}` : "nothing stale" });
+        checks.push({
+          ok: true,
+          label: "branches / worktrees",
+          detail: reaped ? `reaped ${detailParts.join(", ")}` : "nothing stale",
+          // Under --apply the evidence is what was actually DELETED. This is the run where naming it matters
+          // most: the one-liner says "reaped 3 merged branches", and only these lines say which three.
+          verbose: reaped ? [
+            ...r.removedBranches.map((b) => `deleted local branch: ${b}`),
+            ...r.removedRemoteBranches.map((b) => `deleted remote branch: ${b}`),
+            ...r.removedTrackingRefs.map((t) => `deleted tracking ref: ${t}`),
+            ...r.removedWorktreeDirs.map((w) => `removed worktree dir: ${w}`),
+            ...r.failed.map((f) => `FAILED: ${f}`)
+          ] : ["nothing reapable"]
+        });
         if (reaped) restartPending = true;
       } else {
         const n = gcReapable(plan);
-        checks.push(n === 0 ? { ok: true, label: "branches / worktrees" } : { ok: false, label: "branches / worktrees", fix: `${n} stale \u2014 run \`mmi-cli doctor --apply\` to reap merged branches, stale refs, and dead worktrees` });
+        const gcEvidence = [
+          ...plan.branches.map((b) => `merged branch: ${b.branch} (PR ${b.prNumbers.map((n2) => `#${n2}`).join(", ") || "?"} ${b.prState})`),
+          ...plan.trackingRefs.map((r) => `stale tracking ref: ${r.ref}`),
+          ...plan.worktreeDirs.map((w) => `dead worktree: ${w.path} (${w.reason})`)
+        ];
+        checks.push(n === 0 ? { ok: true, label: "branches / worktrees", verbose: ["nothing reapable"] } : {
+          ok: false,
+          label: "branches / worktrees",
+          fix: `${n} stale \u2014 run \`mmi-cli doctor --apply\` to reap merged branches, stale refs, and dead worktrees`,
+          verbose: gcEvidence
+        });
       }
     } catch {
     }
     const scratch = deps.executeScratchGc(repoRoot2, { apply: false });
+    const scratchEvidence = scratch.plan.safeAuto.length ? scratch.plan.safeAuto.map((c) => `aged: ${c.path} (${c.reason})`) : ["nothing aged"];
     if (apply && scratch.plan.safeAuto.length > 0) {
       const applied = deps.executeScratchGc(repoRoot2, { apply: true });
       const pruned = applied.applied?.pruned.length ?? 0;
-      checks.push({ ok: true, label: "scratch", detail: pruned ? `removed ${pruned} aged item(s)` : "nothing stale" });
+      checks.push({ ok: true, label: "scratch", detail: pruned ? `removed ${pruned} aged item(s)` : "nothing stale", verbose: scratchEvidence });
       if (pruned) restartPending = true;
     } else {
-      checks.push(scratch.plan.safeAuto.length === 0 ? { ok: true, label: "scratch" } : { ok: false, label: "scratch", fix: `${scratch.plan.safeAuto.length} aged scratch item(s) \u2014 run \`mmi-cli doctor --apply\`` });
+      checks.push(scratch.plan.safeAuto.length === 0 ? { ok: true, label: "scratch", verbose: scratchEvidence } : { ok: false, label: "scratch", fix: `${scratch.plan.safeAuto.length} aged scratch item(s) \u2014 run \`mmi-cli doctor --apply\``, verbose: scratchEvidence });
     }
   }
   const exitCode = doctorReportExitCode(checks);
   if (opts.json) {
-    io.log(JSON.stringify({ checks, restartPending, exitCode }, null, 2));
+    const payload = opts.verbose ? checks : checks.map(({ verbose: _evidence, ...check }) => check);
+    io.log(JSON.stringify({ checks: payload, restartPending, exitCode }, null, 2));
     return exitCode;
   }
   if (opts.banner) {
     const actionable = checks.filter((c) => !c.ok);
-    for (const c of actionable) io.log(renderReport([c], { restartPending: false }));
+    for (const c of actionable) {
+      io.log(renderReport([c], { restartPending: false }));
+      if (opts.verbose) for (const evidence of c.verbose ?? []) io.log(`${VERBOSE_INDENT}${evidence}`);
+    }
     if (restartPending) io.log(RESTART_LINE);
     return 0;
   }
-  io.log(renderReport(checks, { restartPending }));
+  io.log(renderDoctorText(checks, { verbose: Boolean(opts.verbose), restartPending }));
   return exitCode;
 }
 
@@ -20103,17 +20502,34 @@ function installedClaudePluginVersion() {
     return void 0;
   }
 }
-var gitignorePath = () => (0, import_node_path22.join)(process.cwd(), ".gitignore");
+function worktreeRootSync() {
+  try {
+    const out = (0, import_node_child_process10.execFileSync)("git", ["rev-parse", "--show-toplevel"], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
+    let root = out.endsWith("\n") ? out.slice(0, -1) : out;
+    if (process.platform === "win32" && root.endsWith("\r")) root = root.slice(0, -1);
+    return root || null;
+  } catch {
+    return null;
+  }
+}
+var gitignorePath = () => {
+  const root = worktreeRootSync();
+  return root === null ? null : (0, import_node_path22.join)(root, ".gitignore");
+};
 function readGitignore() {
+  const path2 = gitignorePath();
+  if (path2 === null) return null;
   try {
-    return (0, import_node_fs23.readFileSync)(gitignorePath(), "utf8");
+    return (0, import_node_fs23.readFileSync)(path2, "utf8");
   } catch {
     return null;
   }
 }
 function writeGitignore(content) {
+  const path2 = gitignorePath();
+  if (path2 === null) return false;
   try {
-    (0, import_node_fs23.writeFileSync)(gitignorePath(), content, "utf8");
+    (0, import_node_fs23.writeFileSync)(path2, content, "utf8");
     return true;
   } catch {
     return false;
@@ -20136,7 +20552,8 @@ async function repoRoot() {
   }
 }
 function hasRepoLocalWorktrees() {
-  return (0, import_node_fs23.existsSync)((0, import_node_path22.join)(process.cwd(), ".worktrees"));
+  const root = worktreeRootSync();
+  return root !== null && (0, import_node_fs23.existsSync)((0, import_node_path22.join)(root, ".worktrees"));
 }
 
 // src/index.ts
@@ -20167,26 +20584,38 @@ async function loadConfigForRepo(targetRepo2) {
 async function loadConfigForBoardSelector2(selector, repoOption) {
   return loadConfigForRepo(repoFromSelector(selector) ?? repoOption);
 }
-async function advanceClosedIssuesToDone(prNumber, repoOption) {
-  const repoArgs = repoOption ? ["--repo", repoOption] : [];
-  let body;
+async function advanceClosedIssuesToDone2(prNumber, repoOption) {
   try {
-    body = (await execFileP2("gh", ["pr", "view", prNumber, ...repoArgs, "--json", "body", "--jq", ".body"], { timeout: GC_GH_TIMEOUT_MS5 })).stdout;
-  } catch {
-    return void 0;
+    return await resolveBoardAdvanceForPr(prNumber, repoOption);
+  } catch (e) {
+    return { status: "fetch-failed", entries: [], error: e.message };
   }
-  const closing = parseClosingIssues(body ?? "");
-  if (closing.length === 0) return void 0;
-  const results = [];
-  for (const ref of closing) {
-    try {
+}
+async function resolveBoardAdvanceForPr(prNumber, repoOption) {
+  const repoArgs = repoOption ? ["--repo", repoOption] : [];
+  const repo = await resolveRepo(repoOption);
+  if (!repo) {
+    return {
+      status: "fetch-failed",
+      entries: [],
+      error: "could not resolve the PR's repo, so a closing reference cannot be proven to belong to this board"
+    };
+  }
+  return advanceClosedIssuesToDone({
+    repo,
+    fetchClosingIssues: async () => {
+      const { stdout } = await execFileP2("gh", ["pr", "view", prNumber, ...repoArgs, "--json", "closingIssuesReferences"], { timeout: GC_GH_TIMEOUT_MS5 });
+      const parsed = JSON.parse(stdout || "null");
+      if (!parsed || typeof parsed !== "object" || !("closingIssuesReferences" in parsed)) {
+        throw new Error("gh returned no closingIssuesReferences field for this PR");
+      }
+      return parsed.closingIssuesReferences;
+    },
+    moveIssueToDone: async (ref) => {
       const moved = await moveBoardItem({ config: await loadConfigForBoardSelector2(ref, repoOption), selector: ref, status: "Done", repo: repoOption, allowPartial: true });
-      results.push(moved.partial ? { issue: ref, moved: false, error: moved.warning } : { issue: ref, moved: true });
-    } catch (e) {
-      results.push({ issue: ref, moved: false, error: e.message });
+      return moved.partial ? { moved: false, error: moved.warning } : { moved: true };
     }
-  }
-  return results;
+  });
 }
 function renderGcApplyResult(result) {
   const lines = ["gc apply result:"];
@@ -20762,6 +21191,7 @@ function scheduleRelatedDiscovery(o) {
 }
 registerSecretsCommands(program2);
 registerEdgeCommands(program2);
+registerBoxCommands(program2);
 async function reportWrite(label, res) {
   if (res.ok) {
     console.log(JSON.stringify(res.body));
@@ -21197,7 +21627,7 @@ fullTrack.command("readiness <owner/repo>").description("aggregate branch topolo
   console.log(JSON.stringify(report, null, 2));
   if (!report.rcand.canApply) process.exitCode = 1;
 });
-project.command("set-deploy [owner/repo]").description("write the DEPLOY#<stage> Hetzner deploy coords for a tenant (master-only) \u2014 the explicit-coords path that seeds a freshly-bootstrapped tenant; defaults to the current repo").requiredOption("--stage <stage>", "dev | rc | main").option("--ssh-host <host>", "the box address the deploy ssh-es into (required for hetzner-ssh)").option("--ssh-user <user>", "ssh user (default root)").option("--port <port>", "loopback port the container binds / Caddy upstream (1..65535)").option("--substrate <substrate>", "hetzner-ssh (default)").option("--deploy-path <path>", "on-box per-stage release root (default /opt/mmi/<slug>/<stage>)").option("--service <name>", "systemd/compose service name (default the slug)").option("--domain <domain>", "canonical serving host (default the project edgeDomains[stage])").option("--alias <domain...>", "extra serving hostname the box Caddy answers (repeatable)").option("--no-env-file <bool>", "set the DEPLOY# fileless flag (true|false) \u2014 true = #2662 env passthrough, no .env symlink; omit to leave the row unchanged").option("--force", "skip the #2748 fileless-compose guard (flip noEnvFile=true even if the stage branch compose still declares env_file:)").option("--json", "machine-readable output").action(async (repoOrSlug, o) => {
+project.command("set-deploy [owner/repo]").description("patch the DEPLOY#<stage> Hetzner deploy coords for a tenant (master-only) \u2014 omitted flags keep their stored value; seeds a freshly-bootstrapped tenant; defaults to the current repo").requiredOption("--stage <stage>", "dev | rc | main").option("--ssh-host <host>", "the box address the deploy ssh-es into; omit to keep the stored value (required only for a NEW hetzner-ssh row \u2014 `mmi-cli box list` finds it)").option("--ssh-user <user>", "ssh user; omit to leave the row unchanged (default root on a new row)").option("--port <port>", "loopback port the container binds / Caddy upstream (1..65535); omit to leave the row unchanged").option("--substrate <substrate>", "hetzner-ssh; omit to leave the row unchanged").option("--deploy-path <path>", "on-box per-stage release root; omit to leave the row unchanged (default /opt/mmi/<slug>/<stage> on a new row)").option("--service <name>", "systemd/compose service name; omit to leave the row unchanged (default the slug on a new row)").option("--domain <domain>", "canonical serving host; omit to leave the row unchanged").option("--alias <domain...>", "extra serving hostname the box Caddy answers (repeatable); omit to leave the stored aliases unchanged").option("--clear-aliases", "remove EVERY serving alias from the row (#2986) \u2014 omitting --alias preserves them, so clearing needs saying out loud").option("--no-env-file <bool>", "set the DEPLOY# fileless flag (true|false) \u2014 true = #2662 env passthrough, no .env symlink; omit to leave the row unchanged").option("--force", "skip the #2748 fileless-compose guard (flip noEnvFile=true even if the stage branch compose still declares env_file:)").option("--json", "machine-readable output").action(async (repoOrSlug, o) => {
   const cfg = await loadConfig();
   let target;
   try {
@@ -21238,6 +21668,7 @@ project.command("set-deploy [owner/repo]").description("write the DEPLOY#<stage>
       service: o.service,
       domain: o.domain,
       aliases: o.alias,
+      clearAliases: o.clearAliases,
       noEnvFile
     });
   } catch (e) {
@@ -21794,7 +22225,24 @@ async function pollGhPrChecks(prNumber, repoArgs) {
   }
   return state;
 }
-pr.command("checks-wait <number>").description(`bounded wait for PR checks; skips immediately on no-ci repos (#1432). Default budget ${PR_CHECKS_TIMEOUT_MS / 6e4}m; --timeout raises it. Exit 1 = a check FAILED, exit ${PR_CHECKS_TIMEOUT_EXIT_CODE} = the wait window expired (re-arm)`).option("--json", "machine-readable output").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--timeout <minutes>", `wait budget in minutes (default ${PR_CHECKS_TIMEOUT_MS / 6e4}) \u2014 raise it for serial self-hosted e2e queues`).action(async (number, o) => {
+async function pollGhPrMergeable(prNumber, repoArgs) {
+  try {
+    const { stdout } = await execFileP2("gh", ["pr", "view", prNumber, ...repoArgs, "--json", "mergeable", "--jq", ".mergeable"], { timeout: GC_GH_TIMEOUT_MS5 });
+    const state = stdout.trim().toUpperCase();
+    return state === "MERGEABLE" || state === "CONFLICTING" ? state : "UNKNOWN";
+  } catch {
+    return "UNKNOWN";
+  }
+}
+async function resolvePrBaseBranch(prNumber, repoArgs) {
+  try {
+    const { stdout } = await execFileP2("gh", ["pr", "view", prNumber, ...repoArgs, "--json", "baseRefName", "--jq", ".baseRefName"], { timeout: GC_GH_TIMEOUT_MS5 });
+    return stdout.trim() || "development";
+  } catch {
+    return "development";
+  }
+}
+pr.command("checks-wait <number>").description(`bounded wait for PR checks; skips immediately on no-ci repos (#1432), fails immediately on a CONFLICTING PR \u2014 GitHub never queues checks for one (#2970). Default budget ${PR_CHECKS_TIMEOUT_MS / 6e4}m; --timeout raises it. Exit 1 = a check FAILED or the PR is CONFLICTING, exit ${PR_CHECKS_TIMEOUT_EXIT_CODE} = the wait window expired (re-arm)`).option("--json", "machine-readable output").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--timeout <minutes>", `wait budget in minutes (default ${PR_CHECKS_TIMEOUT_MS / 6e4}) \u2014 raise it for serial self-hosted e2e queues`).action(async (number, o) => {
   const repoArgs = o.repo ? ["--repo", o.repo] : [];
   let timeoutMs;
   if (o.timeout !== void 0) {
@@ -21802,9 +22250,12 @@ pr.command("checks-wait <number>").description(`bounded wait for PR checks; skip
     if (!Number.isFinite(minutes) || minutes <= 0) return fail("pr checks-wait: --timeout must be a positive number of minutes");
     timeoutMs = Math.round(minutes * 6e4);
   }
+  const baseBranch = await resolvePrBaseBranch(number, repoArgs);
   const result = await waitForPrChecks({
     resolvePolicy: () => resolveMergeCiPolicyForCheckout(o.repo),
     pollChecks: () => pollGhPrChecks(number, repoArgs),
+    pollMergeable: () => pollGhPrMergeable(number, repoArgs),
+    baseBranch,
     sleep: (ms) => new Promise((resolve5) => setTimeout(resolve5, ms)),
     log: (message) => console.warn(message),
     timeoutMs,
@@ -21813,10 +22264,12 @@ pr.command("checks-wait <number>").description(`bounded wait for PR checks; skip
     progress: ({ state, elapsedMs, remainingMs }) => console.warn(`pr checks-wait: ${state} \u2014 ${Math.round(elapsedMs / 1e3)}s elapsed, ${Math.round(remainingMs / 6e4)}m left`)
   });
   if (o.json) printLine(JSON.stringify(result));
-  else if (result.status === "timeout") {
+  else if (result.status === "conflicting") {
+    printLine(`pr checks-wait: conflicting \u2014 ${result.reason}`);
+  } else if (result.status === "timeout") {
     printLine(`pr checks-wait: timeout \u2014 waited ${Math.round((result.waitedMs ?? 0) / 6e4)}m, last state: ${result.detail ?? "pending"}. No check failed; re-run to keep waiting, or pass --timeout <minutes>.`);
   } else printLine(`pr checks-wait: ${result.status}${result.reason ? ` \u2014 ${result.reason}` : ""}${result.detail ? ` (${result.detail})` : ""}`);
-  if (result.status === "failure") process.exitCode = 1;
+  if (result.status === "failure" || result.status === "conflicting") process.exitCode = 1;
   if (result.status === "timeout") process.exitCode = PR_CHECKS_TIMEOUT_EXIT_CODE;
 });
 async function ghMergeAutoEnqueue(prNumber, repo, method) {
@@ -21899,6 +22352,10 @@ pr.command("land <number>").description("agent merge path (#1440): train probe \
     waitForChecks: (prNumber, repo) => waitForPrChecks({
       resolvePolicy: () => resolveRepoMergeCiPolicy(repo, ciAuditDeps()),
       pollChecks: () => pollGhPrChecks(prNumber, repo ? ["--repo", repo] : []),
+      // #2970: `pr land` only ever lands PRs based on development (resolveRepo above already rejects any
+      // other base), so the fast-fail message's base branch is always 'development' here.
+      pollMergeable: () => pollGhPrMergeable(prNumber, repo ? ["--repo", repo] : []),
+      baseBranch: "development",
       sleep: (ms) => new Promise((resolve5) => setTimeout(resolve5, ms)),
       log: (message) => console.warn(message),
       // `pr land` inherits the same (raised) checks budget, so it needs the same liveness — otherwise the
@@ -22172,7 +22629,7 @@ pr.command("merge <number>").description("merge a PR (squash by default) and cle
       }
     };
   }
-  const boardAdvance = await advanceClosedIssuesToDone(number, o.repo);
+  const boardAdvance = await advanceClosedIssuesToDone2(number, o.repo);
   console.log(JSON.stringify({
     ...buildPrMergeResultPayload({
       number,
@@ -22182,8 +22639,14 @@ pr.command("merge <number>").description("merge a PR (squash by default) and cle
       localCleanup,
       housekeeping
     }),
-    ...boardAdvance ? { boardAdvance } : {}
+    // `boardAdvance` keeps its published array shape; `boardAdvanceStatus` is the field a caller reads to
+    // tell "merged clean" from "merged, but the board did not follow" without guessing from the exit code.
+    ...boardAdvance.entries.length ? { boardAdvance: boardAdvance.entries } : {},
+    boardAdvanceStatus: boardAdvance.status
   }));
+  const boardAdvanceMessage = boardAdvanceFailureMessage(boardAdvance);
+  if (boardAdvanceMessage) console.error(boardAdvanceMessage);
+  process.exitCode = boardAdvanceExitCode(boardAdvance) ?? process.exitCode;
 });
 registerQueryCommands(program2);
 registerWorktreeCommands(program2);
@@ -23380,7 +23843,7 @@ access.command("audit").description("audit collaborator roles + train-branch pus
 });
 access.command("capabilities").description("enumerate your effective vault reach \u2014 every credential NAME + tier + scope you can read/use across project + org/master tiers (names only, no values) (#1615)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--json", "machine-readable output").action((o) => withSecrets((d) => secretsCapabilities(d, o)));
 var isWin2 = process.platform === "win32";
-program2.command("doctor").description("check onboarding gates and auto-heal CLI/plugin wiring; use --verbose for the full audit checklist").option("--banner", "one-line resume summary; silent when all gates pass").option("--fast", "offline-safe fast lane; skips slow checks and network probes").option("--preflight", "eager version/plugin heal with upfront notice when stale; silent when healthy (#1871)").option("--verbose", "run extended audit checks and print the full checklist + version report (#1989)").option("--ci", "stable CI output contract; no color, exit 0 for clear/advisory-only, 1 for hard gaps, 2 for doctor/tool failure").option("--guide", "print the MMI Agentic Onboarding guide URL").option("--json", "machine-readable output (read-only inspection \u2014 performs no repairs)").option("--apply", "perform the same auto-repairs as the interactive run (combine with --json for a machine-readable repair run)").option("--no-repo-writes", "env/plugin repairs only \u2014 never mutate the repo working tree; report pending managed .gitignore repairs with the follow-up command (for train preflights)").option("--self", "verify CLI/plugin version parity, PATH, gh auth scopes, and hook wiring (offline-safe; suggests plugin-heal on a hard gap) (#2689)").addHelpText("after", "\nExit codes:\n  0  no hard gaps remain; advisory gaps may exist\n  1  one or more included hard checks failed\n  2  doctor/tool execution failed before a normal verdict\n\n--banner keeps the legacy SessionStart contract and returns 0 unless the process crashes.\n").action(async (opts) => {
+program2.command("doctor").description("check onboarding gates and auto-heal CLI/plugin wiring; use --verbose for the full audit checklist").option("--banner", "one-line resume summary; silent when all gates pass").option("--fast", "offline-safe fast lane; skips slow checks and network probes").option("--preflight", "eager version/plugin heal with upfront notice when stale; silent when healthy (#1871)").option("--verbose", "print the evidence behind every check \u2014 probes, resolved paths, versions compared, and the names behind each count (#2977)").option("--ci", "stable CI output contract; no color, exit 0 for clear/advisory-only, 1 for hard gaps, 2 for doctor/tool failure").option("--guide", "print the MMI Agentic Onboarding guide URL").option("--json", "machine-readable output (read-only inspection \u2014 performs no repairs)").option("--apply", "perform the same auto-repairs as the interactive run (combine with --json for a machine-readable repair run)").option("--no-repo-writes", "env/plugin repairs only \u2014 never mutate the repo working tree; report pending managed .gitignore repairs with the follow-up command (for train preflights)").option("--self", "verify CLI/plugin version parity, PATH, gh auth scopes, and hook wiring (offline-safe; suggests plugin-heal on a hard gap) (#2689)").addHelpText("after", "\nExit codes:\n  0  no hard gaps remain; advisory gaps may exist\n  1  one or more included hard checks failed\n  2  doctor/tool execution failed before a normal verdict\n\n--banner keeps the legacy SessionStart contract and returns 0 unless the process crashes.\n").action(async (opts) => {
   if (opts.guide) {
     consoleIo.log("MMI Agentic Onboarding: https://github.com/mutmutco/MMI-Hub/wiki/Agentic-Dev-Environment-Guide");
     return;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "3.27.1",
+  "version": "3.28.0",
   "description": "MMI Future CLI — the org dev toolbox (board, registry, keyless secrets, release train, bootstrap, doctor) and the cross-IDE engine the plugin's session-start hook drives.",
   "type": "module",
   "license": "UNLICENSED",