@mutmutco/cli 3.29.0 → 3.30.1

package/dist/main.cjs

@@ -3408,9 +3408,9 @@ function useColor() {
 var program = new Command();
 
 // src/index.ts
-var import_promises7 = require("node:fs/promises");
-var import_node_fs28 = require("node:fs");
-var import_node_child_process13 = require("node:child_process");
+var import_promises6 = require("node:fs/promises");
+var import_node_fs27 = require("node:fs");
+var import_node_child_process12 = require("node:child_process");
 
 // src/cli-shared.ts
 var import_node_child_process3 = require("node:child_process");
@@ -4949,19 +4949,6 @@ async function fetchTrainAuthority(repo, deps) {
     return { ok: false, error: e.message };
   }
 }
-async function mintWikiToken(repo, deps) {
-  const res = await postJson("/wiki-mint", { repo }, deps, "POST", { noRetry: true });
-  if (res.error) return { ok: false, error: res.error };
-  const body = res.body ?? {};
-  if (res.status === 426) return { ok: false, error: upgradeRequiredError({ status: 426 }, res.body) };
-  if (res.status === 403) return { ok: false, error: `master-admin only (HTTP 403)${body.error ? ` \u2014 ${body.error}` : ""}` };
-  if (res.status === 404) {
-    return { ok: false, error: "the Hub API did not recognize /wiki-mint (HTTP 404) \u2014 the deployed Hub predates this command; it answers once a Hub release carrying it is deployed" };
-  }
-  if (!res.ok) return { ok: false, error: `wiki-mint HTTP ${res.status}${body.error ? ` \u2014 ${body.error}` : ""}` };
-  if (!body.token || !body.expiresAt) return { ok: false, error: "malformed wiki-mint response (no token)" };
-  return { ok: true, mint: { token: body.token, expiresAt: body.expiresAt, repository: body.repository ?? repo, permissions: body.permissions ?? {} } };
-}
 async function fetchProjectsList(deps) {
   if (!deps.baseUrl) return null;
   const token = await deps.token();
@@ -5039,6 +5026,39 @@ async function fetchDeployFactsBySlug(slug, deps) {
     return null;
   }
 }
+async function fetchSchedulesList(deps) {
+  if (!deps.baseUrl) return null;
+  const token = await deps.token();
+  if (!token) return null;
+  try {
+    const res = await retriedFetch(deps, `${deps.baseUrl.replace(/\/$/, "")}/schedules/list`, {
+      method: "GET",
+      headers: { Authorization: `Bearer ${token}` }
+    });
+    if (!res.ok) return null;
+    const body = await res.json();
+    return Array.isArray(body?.schedules) ? body.schedules : null;
+  } catch {
+    return null;
+  }
+}
+async function fetchDocsAuditList(deps) {
+  if (!deps.baseUrl) return { notArmed: true };
+  try {
+    const token = await deps.token();
+    if (!token) return { notArmed: true };
+    const res = await retriedFetch(deps, `${deps.baseUrl.replace(/\/$/, "")}/docs-audit/list`, {
+      method: "GET",
+      headers: { Authorization: `Bearer ${token}` }
+    });
+    if (res.status === 404) return { notArmed: true };
+    if (!res.ok) return { ok: false, error: `docs-audit list HTTP ${res.status}` };
+    const body = await res.json();
+    return { ok: true, rows: Array.isArray(body?.docsAudits) ? body.docsAudits : [] };
+  } catch (e) {
+    return { ok: false, error: e.message };
+  }
+}
 async function fetchOrgConfig(deps) {
   if (!deps.baseUrl) return null;
   const token = await deps.token();
@@ -5092,6 +5112,9 @@ async function attestAppGaps(slug, repo, deps) {
 async function setDeployCoords(slug, payload, deps) {
   return postJson(`/projects/${encodeURIComponent(slug)}/deploy`, payload, deps);
 }
+async function recordDocsAudit(verdict, deps) {
+  return postJson("/docs-audit/record", { ...verdict }, deps);
+}
 async function tenantControl(payload, deps) {
   return postJson("/tenant-control", payload, deps, "POST", { noRetry: true });
 }
@@ -5257,7 +5280,16 @@ async function removeWorktreeWithRecovery(wtPath, deps) {
   const backoff = deps.backoffMs ?? [250, 1e3];
   let attempts = 0;
   let lastError;
-  for (let i = 0; i < maxAttempts; i++) {
+  let safeForGitPrimary = true;
+  if (deps.detachReparsePoints) {
+    try {
+      deps.detachReparsePoints(wtPath);
+    } catch (e) {
+      safeForGitPrimary = false;
+      lastError = e;
+    }
+  }
+  for (let i = 0; safeForGitPrimary && i < maxAttempts; i++) {
     attempts++;
     try {
       await deps.git(["worktree", "remove", "--force", wtPath]);
@@ -5977,6 +6009,8 @@ async function cleanupPrMergeLocalBranch(branch, options) {
     const removeDeps = {
       git,
       sleep: options.sleep ?? defaultSleep,
+      detachReparsePoints: options.detachReparsePoints,
+      // #3064: junction-safe deferred sweep too
       removeWorktreeDir: options.removeWorktreeDir
     };
     await sweepDeferredWorktrees(options.deferredStore, removeDeps).catch(() => void 0);
@@ -5995,6 +6029,8 @@ async function cleanupPrMergeLocalBranch(branch, options) {
     const outcome = await removeWorktreeWithRecovery(wtPath, {
       git,
       sleep: options.sleep ?? defaultSleep,
+      detachReparsePoints: options.detachReparsePoints,
+      // #3064: reach the actual pr-merge teardown path
       removeWorktreeDir: options.removeWorktreeDir
     });
     if (outcome.status === "removed") {
@@ -8152,7 +8188,9 @@ async function unclaimBoardIssue(options, deps = {}) {
   }
   const toStatus = options.toStatus ?? "Todo";
   try {
-    await client.rest("DELETE", `repos/${item.repository}/issues/${item.number}/assignees`);
+    await client.rest("DELETE", `repos/${item.repository}/issues/${item.number}/assignees`, {
+      body: { assignees: item.assignees }
+    });
   } catch (e) {
     const warning = `partial unclaim: ${item.ref} assignees were not cleared (${ghError(e)})`;
     if (!options.allowPartial) throw new Error(warning);
@@ -8994,7 +9032,7 @@ function commandLadderHint() {
 }
 
 // src/index.ts
-var import_node_path24 = require("node:path");
+var import_node_path23 = require("node:path");
 
 // src/merge-ci-policy.ts
 function resolveMergeCiPolicy(input) {
@@ -9512,9 +9550,6 @@ function seedMatchesProjectType(seed, projectType) {
   return projectType != null && seed.projectTypes.includes(projectType);
 }
 function planSeedAction(seed, exists) {
-  if (seed.source === "fanout") {
-    return { target: seed.target, action: "skip", ownership: "fanout", reason: "delivered by the fanout pipeline" };
-  }
   if (seed.source === "managed-block") {
     return exists ? { target: seed.target, action: "update", ownership: "org", reason: "org-managed block merged in-place (repo-owned lines preserved)" } : { target: seed.target, action: "create", ownership: "org", reason: "org-managed block; .gitignore absent, created" };
   }
@@ -9620,7 +9655,6 @@ function buildRegisterPayload(repo, cls, vars, options = {}) {
     name: vars.NAME || parsedRepo.name,
     division: vars.DIVISION || parsedRepo.name.split("-")[0] || void 0,
     repos: [`${parsedRepo.owner}/${slug}`],
-    wikiRepo: vars.WIKI_REPO || parsedRepo.fullName,
     branch: vars.BRANCH || (cls === "content" ? "main" : "development"),
     class: cls,
     projectType,
@@ -9688,43 +9722,7 @@ function boardFieldsQueryArgs(projectId) {
   const query = "query($id: ID!) { node(id: $id) { ... on ProjectV2 { number fields(first: 50) { nodes { ... on ProjectV2SingleSelectField { id name options { id name } } } } } } }";
   return ["api", "graphql", "-f", `query=${query}`, "-f", `id=${projectId}`];
 }
-function serializeRegistry(obj) {
-  return `${JSON.stringify(obj, null, 2)}
-`;
-}
-function planFanoutRegistration(fanoutTargetsRaw, projectsRaw, entry) {
-  const fanout = JSON.parse(fanoutTargetsRaw);
-  const projects = JSON.parse(projectsRaw);
-  const fanoutRepos = Array.isArray(fanout.repos) ? fanout.repos : [];
-  const projectEntries = Array.isArray(projects.projects) ? projects.projects : [];
-  const name = entry.name ?? entry.repo;
-  const canonName = entry.repo.toLowerCase();
-  const inFanout = fanoutRepos.some((r) => typeof r.repo === "string" && r.repo.toLowerCase() === canonName);
-  const inProjects = projectEntries.some(
-    (p) => p.slug === entry.slug || Array.isArray(p.repos) && p.repos.some((full) => String(full).split("/").pop()?.toLowerCase() === canonName)
-  );
-  if (inFanout || inProjects) {
-    return { changed: false, fanoutTargets: fanoutTargetsRaw, projects: projectsRaw };
-  }
-  const projectEntry = {
-    name,
-    slug: entry.slug,
-    projectId: entry.projectId,
-    wikiRepo: entry.wikiRepo,
-    repos: [`mutmutco/${entry.repo}`]
-  };
-  if (entry.cls === "content") projectEntry.branch = "main";
-  for (const k of Object.keys(projectEntry)) if (projectEntry[k] === void 0) delete projectEntry[k];
-  const nextProjects = { ...projects, projects: [...projectEntries, projectEntry] };
-  const fanoutEntry = { repo: entry.repo, branch: entry.branch, class: entry.cls };
-  const nextFanout = { ...fanout, repos: [...fanoutRepos, fanoutEntry] };
-  return {
-    changed: true,
-    fanoutTargets: serializeRegistry(nextFanout),
-    projects: serializeRegistry(nextProjects)
-  };
-}
-function decideFanoutPrAction(openPrs) {
+function decideSeedPrAction(openPrs) {
   const list = Array.isArray(openPrs) ? openPrs : [];
   for (const pr2 of list) {
     const url = pr2?.url;
@@ -11055,7 +11053,7 @@ async function executeWaveLand(plan, deps, opts = { preserveWorktree: true }) {
 }
 
 // src/index.ts
-var import_node_os9 = require("node:os");
+var import_node_os8 = require("node:os");
 
 // src/attach-to-project.ts
 async function resolveAutoAddBoardAttach(client, cfg, selector, priority, warn = (m) => process.stderr.write(m), retry = {}) {
@@ -11170,6 +11168,21 @@ function parseAddedItemId(stdout) {
 function isAlreadyOnBoardError(stderr) {
   return /already exists in (?:this|the) project/i.test(stderr);
 }
+var CLOSING_KEYWORD = "clos(?:e|es|ed)|fix(?:es|ed)?|resolve(?:s|d)?";
+var CLOSING_CHAIN = new RegExp(
+  `\\b(${CLOSING_KEYWORD})(\\s+)#(\\d+)((?:\\s*(?:,|,?\\s+and)\\s*#\\d+)+)`,
+  "gi"
+);
+function normalizeClosingDirectives(body) {
+  if (!body.includes("#")) return body;
+  const segments = body.split(/(```[\s\S]*?```|~~~[\s\S]*?~~~|`[^`\n]*`)/g);
+  return segments.map(
+    (seg, i) => i % 2 === 1 ? seg : seg.replace(
+      CLOSING_CHAIN,
+      (_m, kw, ws, first, tail) => `${kw}${ws}#${first}${tail.replace(/#(\d+)/g, "closes #$1")}`
+    )
+  ).join("");
+}
 function buildPrArgs({ title, body, base, head, repo, draft }) {
   const args = ["pr", "create"];
   if (repo) args.push("--repo", repo);
@@ -11654,9 +11667,106 @@ function runningPluginVersion(env, cliVersion) {
   if (leaf && isVersionDirName(leaf)) return leaf;
   return cliVersion && isVersionDirName(cliVersion) ? cliVersion : void 0;
 }
+function pluginCacheStagingRoot(home) {
+  return `${home}/.claude/plugins/cache`;
+}
+function installedPluginsPath(home) {
+  return `${home}/.claude/plugins/installed_plugins.json`;
+}
+var STAGING_DIR = /^temp_git_\d{13}_[a-z0-9]+$/i;
+function isStagingDirName(name) {
+  return STAGING_DIR.test(name);
+}
+var STAGING_AGE_FLOOR_MS = 5 * 60 * 1e3;
+function installedPluginPaths(json) {
+  const parsed = JSON.parse(json);
+  if (parsed.plugins === void 0 || parsed.plugins === null) return null;
+  const out = [];
+  for (const entries of Object.values(parsed.plugins)) {
+    for (const e of entries ?? []) if (e?.installPath) out.push(e.installPath);
+  }
+  return out;
+}
+function newestMtimeMs(path2, listDir, mtimeOf) {
+  let newest = 0;
+  try {
+    newest = mtimeOf(path2);
+  } catch {
+  }
+  let entries;
+  try {
+    entries = listDir(path2);
+  } catch {
+    return newest;
+  }
+  for (const e of entries) {
+    const child = `${path2}/${e.name}`;
+    let m = 0;
+    if (e.isDirectory) m = newestMtimeMs(child, listDir, mtimeOf);
+    else {
+      try {
+        m = mtimeOf(child);
+      } catch {
+        m = 0;
+      }
+    }
+    if (m > newest) newest = m;
+  }
+  return newest;
+}
+function normStagingPath(p) {
+  return p.replace(/\\/g, "/").replace(/\/+$/, "").toLowerCase();
+}
+function stagingIsReferenced(dirPath, referenced) {
+  const d = normStagingPath(dirPath);
+  for (const r of referenced) {
+    if (r === d || r.startsWith(`${d}/`)) return true;
+  }
+  return false;
+}
+function stagingDirIsSweepable(stagingRoot, entry, referencedPaths, now) {
+  if (referencedPaths === null) return false;
+  if (!isStagingDirName(entry.name)) return false;
+  if (now - entry.mtimeMs < STAGING_AGE_FLOOR_MS) return false;
+  const referenced = new Set(referencedPaths.map(normStagingPath));
+  return !stagingIsReferenced(`${stagingRoot}/${entry.name}`, referenced);
+}
+function selectOrphanStagingDirs(stagingRoot, entries, referencedPaths, now, bytesOf) {
+  if (referencedPaths === null) return [];
+  return entries.filter((e) => stagingDirIsSweepable(stagingRoot, e, referencedPaths, now)).map((e) => ({ name: e.name, ageMs: now - e.mtimeMs, bytes: bytesOf(e.name) }));
+}
+function humanStagingAge(ms) {
+  const minutes = Math.floor(ms / 6e4);
+  if (minutes < 60) return `${minutes}m old`;
+  const hours = Math.floor(minutes / 60);
+  if (hours < 24) return `${hours}h old`;
+  return `${Math.floor(hours / 24)}d old`;
+}
 function buildPluginCachePlan(home, running, deps, opts = {}) {
   const cacheRoot = pluginCacheRoot(home);
-  const absent = { cacheRoot, present: false, keep: [], prune: [], bytes: 0, running };
+  const stagingRoot = pluginCacheStagingRoot(home);
+  let stagingEntries;
+  try {
+    stagingEntries = deps.listStagingDirs(stagingRoot);
+  } catch {
+    stagingEntries = [];
+  }
+  let referenced;
+  try {
+    referenced = deps.readInstalledPluginPaths();
+  } catch {
+    referenced = null;
+  }
+  const staging = selectOrphanStagingDirs(
+    stagingRoot,
+    stagingEntries,
+    referenced,
+    deps.now(),
+    (name) => opts.withBytes ? deps.dirBytes(`${stagingRoot}/${name}`) : 0
+  );
+  const stagingBytes = staging.reduce((sum, s) => sum + s.bytes, 0);
+  const stagingFields = { stagingRoot, staging, stagingBytes };
+  const absent = { cacheRoot, present: false, keep: [], prune: [], bytes: 0, running, ...stagingFields };
   if (!deps.exists(cacheRoot)) return absent;
   let names;
   try {
@@ -11669,9 +11779,9 @@ function buildPluginCachePlan(home, running, deps, opts = {}) {
   const pruneSet = new Set(prune);
   const keep = [...versions].sort((a, b) => compareVersions(b, a)).filter((v) => !pruneSet.has(v));
   const bytes = opts.withBytes ? prune.reduce((sum, v) => sum + deps.dirBytes(`${cacheRoot}/${v}`), 0) : 0;
-  return { cacheRoot, present: true, keep, prune, bytes, running };
+  return { cacheRoot, present: true, keep, prune, bytes, running, ...stagingFields };
 }
-function applyPluginCachePlan(plan, remove) {
+function applyPluginCachePlan(plan, remove, stagingGuard) {
   const removed = [];
   const failed = [];
   for (const version of plan.prune) {
@@ -11682,28 +11792,85 @@ function applyPluginCachePlan(plan, remove) {
       failed.push({ version, error: e.message });
     }
   }
-  return { removed, failed, bytes: plan.bytes };
+  const removedStaging = [];
+  const failedStaging = [];
+  const skippedStaging = [];
+  const guardRefs = stagingGuard ? stagingGuard.referencedPaths() : void 0;
+  const guardNow = stagingGuard ? stagingGuard.now() : 0;
+  for (const s of plan.staging) {
+    if (stagingGuard) {
+      if (guardRefs == null) {
+        skippedStaging.push({ name: s.name, reason: "reference set became unknown before apply" });
+        continue;
+      }
+      const m = stagingGuard.mtimeMs(s.name);
+      if (m === null) {
+        skippedStaging.push({ name: s.name, reason: "dir vanished before apply" });
+        continue;
+      }
+      if (!stagingDirIsSweepable(plan.stagingRoot, { name: s.name, mtimeMs: m }, guardRefs, guardNow)) {
+        skippedStaging.push({ name: s.name, reason: "became referenced or active (under age floor) before apply" });
+        continue;
+      }
+    }
+    try {
+      remove(`${plan.stagingRoot}/${s.name}`);
+      removedStaging.push(s.name);
+    } catch (e) {
+      failedStaging.push({ name: s.name, error: e.message });
+    }
+  }
+  return {
+    removed,
+    failed,
+    bytes: plan.bytes,
+    removedStaging,
+    failedStaging,
+    skippedStaging,
+    stagingBytes: plan.stagingBytes
+  };
 }
 var CONCURRENT_SESSION_WARNING = "only the version THIS session runs from is protected \u2014 a concurrent Claude session running from a pruned version will break mid-session; close other sessions before --apply";
 function renderPluginCachePlan(plan, applied) {
-  if (!plan.present) return `plugin-prune: no plugin cache at ${plan.cacheRoot} \u2014 nothing to prune`;
   const mb = (b) => `${(b / 1e6).toFixed(1)} MB`;
-  const lines = [`  cache: ${plan.cacheRoot}`];
-  const keepLabel = plan.keep.map((v) => v === plan.running ? `${v} (running)` : v).join(", ") || "(none)";
-  lines.push(`  keep   ${keepLabel}`);
-  if (plan.prune.length === 0) {
-    lines.push("  prune  nothing stale");
-    return lines.join("\n");
+  if (!plan.present && plan.staging.length === 0) {
+    return `plugin-prune: no plugin cache at ${plan.cacheRoot} \u2014 nothing to prune`;
+  }
+  const lines = [];
+  if (plan.present) {
+    lines.push(`  cache: ${plan.cacheRoot}`);
+    const keepLabel = plan.keep.map((v) => v === plan.running ? `${v} (running)` : v).join(", ") || "(none)";
+    lines.push(`  keep   ${keepLabel}`);
+    if (plan.prune.length === 0) {
+      lines.push("  prune  nothing stale");
+    } else {
+      const size = plan.bytes > 0 ? `, ${mb(plan.bytes)}` : "";
+      lines.push(`  prune  ${plan.prune.join("  ")}   (${plan.prune.length} dirs${size})`);
+      lines.push(`  ! ${CONCURRENT_SESSION_WARNING}`);
+    }
+  }
+  if (plan.staging.length > 0) {
+    lines.push(`  staging: ${plan.stagingRoot}`);
+    for (const s of plan.staging) {
+      const size = s.bytes > 0 ? `, ${mb(s.bytes)}` : "";
+      lines.push(`  orphan ${s.name}   (${humanStagingAge(s.ageMs)}${size})`);
+    }
+    const total = plan.stagingBytes > 0 ? `, ${mb(plan.stagingBytes)}` : "";
+    lines.push(`         ${plan.staging.length} orphaned staging dir(s)${total}`);
   }
-  const size = plan.bytes > 0 ? `, ${mb(plan.bytes)}` : "";
-  lines.push(`  prune  ${plan.prune.join("  ")}   (${plan.prune.length} dirs${size})`);
-  lines.push(`  ! ${CONCURRENT_SESSION_WARNING}`);
   if (!applied) {
-    lines.push("  \u2192 re-run with --apply to delete");
+    if (plan.prune.length > 0 || plan.staging.length > 0) lines.push("  \u2192 re-run with --apply to delete");
     return lines.join("\n");
   }
-  lines.push(`  removed ${applied.removed.length} dirs (${mb(applied.bytes)})`);
-  for (const f of applied.failed) lines.push(`  \u2717 ${f.version}: ${f.error}`);
+  if (plan.prune.length > 0) {
+    lines.push(`  removed ${applied.removed.length} version dir(s) (${mb(applied.bytes)})`);
+    for (const f of applied.failed) lines.push(`  \u2717 ${f.version}: ${f.error}`);
+  }
+  if (plan.staging.length > 0) {
+    lines.push(`  removed ${applied.removedStaging.length} staging dir(s) (${mb(applied.stagingBytes)})`);
+    for (const f of applied.failedStaging) lines.push(`  \u2717 ${f.name}: ${f.error}`);
+    for (const s of applied.skippedStaging) lines.push(`  ~ skipped ${s.name}: ${s.reason}`);
+  }
   return lines.join("\n");
 }
 
@@ -11880,8 +12047,7 @@ function bootstrapPlan(repo, repoClass) {
     { label: `provision branch model: ${branchModel}`, gated: true },
     { label: `apply branch protection / allowlist: ${protectedBranches}`, gated: true },
     { label: "attach GitHub Project v2 and register Hub registry META", gated: true },
-    { label: "seed README.md and architecture.md", gated: true },
-    { label: `register fanout target on ${repoClass === "content" ? "main" : "development"}`, gated: true }
+    { label: "seed README.md and architecture.md", gated: true }
   ];
 }
 function renderSteps(title, steps) {
@@ -13534,6 +13700,38 @@ function checkHotfixCoverage(options = {}) {
   const uncovered = commits.filter((c) => c.coverage === "uncovered");
   return { ok: uncovered.length === 0, mainRef, rcRef, commits, uncovered };
 }
+function checkHotfixCarries(options) {
+  const { cwd = process.cwd(), branch, baseRef, targets } = options;
+  const git = options.git ?? ((args, opts) => (0, import_node_child_process8.execFileSync)("git", args, { cwd, encoding: "utf8", input: opts?.input, stdio: ["pipe", "pipe", "pipe"] }));
+  const isAncestor = (sha, ref) => {
+    try {
+      git(["merge-base", "--is-ancestor", sha, ref]);
+      return true;
+    } catch {
+      return false;
+    }
+  };
+  const revList = (range) => {
+    const out = git(["rev-list", "--no-merges", range]).trim();
+    return out ? out.split("\n") : [];
+  };
+  const cherrySources = (sha) => {
+    const message = git(["log", "-1", "--format=%B", sha]);
+    return [...message.matchAll(CHERRY_TRAILER)].map((m) => m[1]);
+  };
+  const carried = /* @__PURE__ */ new Set();
+  for (const sha of revList(`${baseRef}..${branch}`)) {
+    for (const source of cherrySources(sha)) carried.add(source);
+  }
+  const shaMatches = (a, b) => a.startsWith(b) || b.startsWith(a);
+  const evaluated = targets.map((t) => {
+    if (isAncestor(t.sha, branch)) return { ...t, carried: true, via: "ancestor" };
+    if ([...carried].some((s) => shaMatches(s, t.sha))) return { ...t, carried: true, via: "trailer" };
+    return { ...t, carried: false };
+  });
+  const missing = evaluated.filter((t) => !t.carried);
+  return { ok: missing.length === 0, branch, baseRef, targets: evaluated, missing };
+}
 
 // src/tenant-sweep.ts
 function isRcBearingTenant(p) {
@@ -13635,6 +13833,7 @@ async function resolveHotfixDeployModel(deps, ctx) {
   const meta = requireProjectMetaForTrain(load, ctx.repo);
   return resolveDeployModel2(meta, ctx.repo);
 }
+var HOTFIX_CARRIES_MARKER = /<!--\s*mmi-hotfix-carries:\s*([^>]+?)\s*-->/i;
 async function findHotfixPr(deps, ctx, tag) {
   const out = await deps.run("gh", [
     "pr",
@@ -13648,7 +13847,7 @@ async function findHotfixPr(deps, ctx, tag) {
     "--limit",
     "50",
     "--json",
-    "number,state,url,mergeCommit,headRefName"
+    "number,state,url,body,mergeCommit,headRefName"
   ]);
   const rows = JSON.parse(out || "[]");
   const branch = hotfixBranch(tag);
@@ -13670,6 +13869,31 @@ async function resolveHotfixSource(deps, ctx, from) {
   if (!sha) throw new Error(`could not resolve commit ${from}`);
   return { sha, label: sha.slice(0, 7) };
 }
+function splitCarrySpecs(values = []) {
+  return values.flatMap((v) => v.split(",")).map((s) => s.trim()).filter(Boolean);
+}
+function carrySpecsFromPrBody(body) {
+  const marker = HOTFIX_CARRIES_MARKER.exec(body ?? "");
+  if (marker) return splitCarrySpecs([marker[1]]);
+  const specs = [];
+  for (const m of (body ?? "").matchAll(/\bPR\s+#(\d+)\b/gi)) specs.push(`#${m[1]}`);
+  for (const m of (body ?? "").matchAll(/\b[0-9a-f]{7,40}\b/gi)) specs.push(m[0]);
+  return [...new Set(specs)];
+}
+async function resolveHotfixCarryTargets(deps, ctx, pr2, explicit = []) {
+  const specs = splitCarrySpecs(explicit).length > 0 ? splitCarrySpecs(explicit) : carrySpecsFromPrBody(pr2.body);
+  const targets = [];
+  for (const spec of specs) {
+    const { sha, label } = await resolveHotfixSource(deps, ctx, spec);
+    if (!targets.some((t) => t.sha === sha)) targets.push({ sha, label });
+  }
+  return targets;
+}
+async function hotfixBaseTagForRelease(deps, tag) {
+  const tags = (await deps.run("git", ["tag", "--list", "v[0-9]*.[0-9]*.[0-9]*", "--merged", "origin/main", "--sort=-v:refname"])).split("\n").map((s) => s.trim()).filter((t) => /^v\d+\.\d+\.\d+$/.test(t));
+  const current = normalizeHotfixVersion(tag).tag;
+  return tags.find((t) => compareHotfixVersions(t, current) < 0) ?? tags.find((t) => t !== current) ?? "origin/main^";
+}
 async function runHotfixStart(deps, options) {
   const ctx = await buildTrainApplyContext(deps);
   const deployModel = await resolveHotfixDeployModel(deps, ctx);
@@ -13739,6 +13963,8 @@ async function runHotfixStart(deps, options) {
     "--body",
     `Hotfix ${tag}: cherry-pick of ${label} onto origin/main${bumpNote}.
 
+<!-- mmi-hotfix-carries: ${sha} -->
+
 Merge this PR (human-initiated), then run \`mmi-cli hotfix release ${tag}\`.`
   ]));
   notes.push(`opened hotfix PR ${prUrl} \u2014 merge it (human-initiated), then: mmi-cli hotfix release ${tag}`);
@@ -13795,6 +14021,15 @@ async function runHotfixRelease(deps, versionInput, options = {}) {
   await deps.run("git", ["merge-base", "--is-ancestor", mergedSha, "origin/main"]).catch(() => {
     throw new Error(`merged hotfix SHA ${mergedSha.slice(0, 7)} is not on origin/main \u2014 refusing to tag`);
   });
+  const carryTargets = await resolveHotfixCarryTargets(deps, ctx, pr2, options.carries);
+  if (carryTargets.length > 0) {
+    const baseRef = await hotfixBaseTagForRelease(deps, tag);
+    const carries = deps.hotfixCarries ? deps.hotfixCarries({ branch: mergedSha, baseRef, targets: carryTargets }) : { ok: true, branch: mergedSha, baseRef, targets: carryTargets.map((t) => ({ ...t, carried: true, via: "ancestor" })), missing: [] };
+    if (!carries.ok) {
+      const missing = carries.missing.map((t) => t.label ?? t.sha.slice(0, 12)).join(", ");
+      throw new Error(`hotfix-carries: ${carries.missing.length} declared fix target(s) missing from ${tag} before tagging: ${missing}. Cherry-pick the missing fix(es) with -x onto ${hotfixBranch(tag)}, merge that PR, then rerun hotfix release.`);
+    }
+  }
   const tagPush = await ensureTagPushed(deps, tag, mergedSha);
   const tagPushSince = Date.now();
   const tagNote = tagPush.note;
@@ -14301,7 +14536,7 @@ async function auditTrainBranch(repo, branch, owners, deps, projectAdmins = /* @
       branch,
       kind: "app-bypass-missing",
       severity: "high",
-      detail: `the ${LOCKED_APP} App is missing from the ${branch} allowlist \u2014 fanout/promotions will break`,
+      detail: `the ${LOCKED_APP} App is missing from the ${branch} allowlist \u2014 release promotions will break`,
       remediation: `gh api -X POST repos/${repo}/branches/${branch}/protection/restrictions/apps -f apps[]="${LOCKED_APP}"`
     });
   }
@@ -14369,6 +14604,20 @@ async function auditPluginReadAccess(owners, projectAdmins, deps) {
   return findings;
 }
 async function auditOrgAccess(targets, deps, matrix = {}, dataAccess) {
+  if (targets.length === 0) {
+    return {
+      ok: false,
+      owners: [],
+      orgFindings: [{
+        repo: OWNER2,
+        kind: "empty-target-inventory",
+        severity: "high",
+        detail: "access audit received an empty repo inventory \u2014 zero repos to audit; a green audit of nothing is a false pass",
+        remediation: `confirm the Hub registry is reachable and returns projects, then re-run \`mmi-cli access audit\`; or audit one repo explicitly with \`mmi-cli access audit --repo <owner/repo>\``
+      }],
+      repos: []
+    };
+  }
   let owners;
   try {
     owners = new Set(await resolveOwners(deps));
@@ -14396,10 +14645,8 @@ async function auditOrgAccess(targets, deps, matrix = {}, dataAccess) {
   const ok = orgFindings.every((f) => f.severity !== "high") && repos.every((r) => r.ok);
   return { ok, owners: [...owners], orgFindings, repos };
 }
-function loadAccessTargets(projectsJson, fanoutJson) {
+function loadAccessTargets(projectsJson) {
   const projects = safeJson(projectsJson, {}).projects ?? [];
-  const fanout = fanoutJson ? safeJson(fanoutJson, {}).repos ?? [] : [];
-  const legacyContentNames = new Set(fanout.filter((r) => r.class === "content" && r.repo).map((r) => r.repo.toLowerCase()));
   const seen = /* @__PURE__ */ new Set();
   const targets = [];
   for (const project2 of projects) {
@@ -14410,13 +14657,28 @@ function loadAccessTargets(projectsJson, fanoutJson) {
       if (seen.has(repo)) continue;
       seen.add(repo);
       const repoName = repo.split("/").pop()?.toLowerCase() ?? repo.toLowerCase();
-      const cls = project2.class === "content" || project2.deployModel === "content" || embeddedContent.has(repo.toLowerCase()) || embeddedContent.has(repoName) || legacyContentNames.has(repo.toLowerCase()) || legacyContentNames.has(repoName) ? "content" : "deployable";
+      const cls = project2.class === "content" || project2.deployModel === "content" || embeddedContent.has(repo.toLowerCase()) || embeddedContent.has(repoName) ? "content" : "deployable";
       const releaseTrack = cls === "content" ? "trunk" : resolveReleaseTrack(project2, void 0, repo);
       targets.push({ repo, class: cls, releaseTrack });
     }
   }
   return targets;
 }
+function resolveOrgAuditTargets(registryProjects) {
+  if (registryProjects === null) {
+    return {
+      ok: false,
+      finding: {
+        repo: OWNER2,
+        kind: "registry-unreadable",
+        severity: "high",
+        detail: "the project registry SSOT (Hub API) was unreachable or unconfigured \u2014 the audit target set is unknown; auditing the stale committed projects.json instead could pass green while missing live repos",
+        remediation: `confirm the Hub API base URL + token are configured and reachable, then re-run \`mmi-cli access audit\`; or audit one repo explicitly with \`mmi-cli access audit --repo <owner/repo>\``
+      }
+    };
+  }
+  return { ok: true, targets: loadAccessTargets(JSON.stringify({ projects: registryProjects })) };
+}
 function loadAccessMatrix(matrixJson) {
   if (!matrixJson) return {};
   return safeJson(matrixJson, {}).projectAdmins ?? {};
@@ -14471,279 +14733,202 @@ function renderAccessReport(report) {
   return lines.join("\n");
 }
 
-// src/wiki-publish-command.ts
-async function wikiPublish(deps, opts) {
-  if (!opts.pagesDir) {
-    if (opts.json) {
-      deps.log(JSON.stringify({ ok: false, error: "pages-dir is required" }, null, 2));
-    } else {
-      deps.err("wiki publish: <pages-dir> is required");
-    }
-    return false;
-  }
-  const minted = await deps.mint(opts.repo);
-  if (!minted.ok) {
-    if (opts.json) {
-      deps.log(JSON.stringify({ ok: false, error: minted.error }, null, 2));
-    } else {
-      deps.err(`wiki publish failed: could not mint a scoped wiki token for ${opts.repo}: ${minted.error}`);
-    }
-    return false;
-  }
-  const ok = deps.publish({ repo: opts.repo, token: minted.mint.token, pagesDir: opts.pagesDir, json: opts.json });
-  if (!ok) {
-    return false;
-  }
-  if (opts.json) {
-    deps.log(JSON.stringify({ ok: true, repo: opts.repo }, null, 2));
-  } else {
-    deps.log(`wiki published for ${opts.repo} (scoped token, expired/discarded)`);
-  }
-  return true;
-}
-
-// src/wiki-publish-git.ts
-var import_node_child_process9 = require("node:child_process");
+// src/docs-index-command.ts
 var import_node_fs16 = require("node:fs");
-var import_node_os5 = require("node:os");
 var import_node_path14 = require("node:path");
-var WIKI_STAMP_FILE = ".wiki-state.json";
-function redactWikiSecrets(msg) {
-  return msg.replace(/x-access-token:[^@\s]+@/gi, "x-access-token:***@").replace(/(AUTHORIZATION:\s*basic\s+)[A-Za-z0-9+/=]+/gi, "$1***");
-}
-function wikiAuthArgs(token) {
-  return ["-c", `http.extraheader=AUTHORIZATION: basic ${Buffer.from(`x-access-token:${token}`).toString("base64")}`];
-}
-function publishWikiViaGit(deps, opts) {
-  const dir = deps.mkdtemp();
-  const url = `https://github.com/${opts.repo}.wiki.git`;
-  const authArgs = wikiAuthArgs(opts.token);
-  const json = opts.json ?? false;
-  try {
-    deps.gitRun(["init", "-q"], dir);
-    deps.gitRun(["remote", "add", "origin", url], dir);
-    if (deps.gitProbe([...authArgs, "fetch", "--depth", "1", "origin", "master"], dir)) {
-      deps.gitRun(["reset", "--hard", "FETCH_HEAD"], dir);
-    }
-    let copied = 0;
-    for (const f of deps.readdir(opts.pagesDir)) {
-      if (f.endsWith(".md")) {
-        deps.copyFile((0, import_node_path14.join)(opts.pagesDir, f), (0, import_node_path14.join)(dir, f));
-        copied++;
-      }
-    }
-    if (!copied) {
-      if (!json) deps.err(`wiki publish: no .md pages found in ${opts.pagesDir}`);
-      return false;
-    }
-    if (deps.fileExists((0, import_node_path14.join)(opts.pagesDir, WIKI_STAMP_FILE))) {
-      deps.copyFile((0, import_node_path14.join)(opts.pagesDir, WIKI_STAMP_FILE), (0, import_node_path14.join)(dir, WIKI_STAMP_FILE));
+var DOCS_INDEX_PATH = "docs/index.md";
+var GENERATED_HEADER = "<!-- Generated by `mmi-cli docs index --write`. Do not edit by hand. -->";
+function escapeCell(text) {
+  return text.replace(/\r?\n/g, " ").replace(/\|/g, "\\|").replace(/\s+/g, " ").trim();
+}
+function extractDocMeta(relPath, raw) {
+  const lines = raw.split(/\r?\n/);
+  let i = 0;
+  if (lines[i]?.trim() === "---") {
+    i++;
+    while (i < lines.length && lines[i].trim() !== "---") i++;
+    if (i < lines.length) i++;
+  }
+  let title = "";
+  let scope = "";
+  for (; i < lines.length; i++) {
+    const line = lines[i];
+    const trimmed = line.trim();
+    if (trimmed === "") continue;
+    if (trimmed.startsWith("<!--")) {
+      while (i < lines.length && !lines[i].includes("-->")) i++;
+      continue;
     }
-    deps.gitRun(["add", "-A"], dir);
-    if (deps.gitProbe(["diff", "--cached", "--quiet"], dir)) {
-      if (!json) deps.log("wiki publish: already up to date");
-      return true;
+    if (!title && trimmed.startsWith("# ")) {
+      title = trimmed.slice(2).trim();
+      continue;
     }
-    deps.gitRun(
-      [
-        "-c",
-        "user.email=mmi-github-app[bot]@users.noreply.github.com",
-        "-c",
-        "user.name=mmi-github-app[bot]",
-        "commit",
-        "-m",
-        "docs(wiki): refresh MMI Future project wiki"
-      ],
-      dir
-    );
-    try {
-      deps.gitRun([...authArgs, "push", "origin", "HEAD:master"], dir);
-    } catch (e) {
-      if (!json) deps.err(
-        `wiki publish failed: push to ${opts.repo}.wiki.git rejected: ${redactWikiSecrets(e.message)} \u2014 if the wiki advanced before this push, re-run wiki publish to pick up the latest wiki state`
-      );
-      return false;
+    if (!title) {
+      break;
     }
-    if (!json) deps.log(`wiki publish: published ${copied} page(s) to ${opts.repo} wiki`);
-    return true;
-  } catch (e) {
-    if (!json) deps.err(`wiki publish failed: ${redactWikiSecrets(e.message)}`);
-    return false;
-  } finally {
-    deps.rm(dir);
+    if (trimmed.startsWith("#")) continue;
+    scope = escapeCell(trimmed);
+    break;
   }
-}
-function readWikiStampViaGit(deps, opts) {
-  const dir = deps.mkdtemp();
-  const url = `https://github.com/${opts.repo}.wiki.git`;
-  const authArgs = wikiAuthArgs(opts.token);
-  try {
-    deps.gitRun(["init", "-q"], dir);
-    deps.gitRun(["remote", "add", "origin", url], dir);
-    if (!deps.gitProbe([...authArgs, "ls-remote", "origin"], dir)) {
-      return { ok: false, error: `could not reach ${opts.repo}.wiki.git to read the wiki stamp \u2014 auth or network failure` };
-    }
-    if (!deps.gitProbe([...authArgs, "fetch", "--depth", "1", "origin", "master"], dir)) {
-      return { ok: true, stamp: {} };
-    }
-    deps.gitRun(["reset", "--hard", "FETCH_HEAD"], dir);
-    const stampPath = (0, import_node_path14.join)(dir, WIKI_STAMP_FILE);
-    if (!deps.fileExists(stampPath)) return { ok: true, stamp: {} };
-    let parsed;
-    try {
-      parsed = JSON.parse(deps.readFile(stampPath));
-    } catch (e) {
-      deps.err(
-        `wiki stamp: ${WIKI_STAMP_FILE} in ${opts.repo}.wiki.git is unreadable (${redactWikiSecrets(e.message)}) \u2014 treating as absent (full backfill); the next wiki publish rewrites it`
-      );
-      return { ok: true, stamp: {} };
-    }
-    return { ok: true, stamp: parsed && typeof parsed === "object" ? parsed : {} };
-  } catch (e) {
-    return { ok: false, error: redactWikiSecrets(e.message) };
-  } finally {
-    deps.rm(dir);
+  if (!title) {
+    const base = relPath.split("/").pop() ?? relPath;
+    title = base.replace(/\.md$/, "");
   }
+  return { path: relPath, title, scope };
 }
-function realWikiGitPublishDeps() {
-  return {
-    mkdtemp: () => (0, import_node_fs16.mkdtempSync)((0, import_node_path14.join)((0, import_node_os5.tmpdir)(), "wiki-")),
-    readdir: (dir) => (0, import_node_fs16.readdirSync)(dir),
-    copyFile: (src, dest) => (0, import_node_fs16.copyFileSync)(src, dest),
-    fileExists: (p) => (0, import_node_fs16.existsSync)(p),
-    readFile: (p) => (0, import_node_fs16.readFileSync)(p, "utf8"),
-    rm: (p) => (0, import_node_fs16.rmSync)(p, { recursive: true, force: true }),
-    gitProbe: (args, cwd) => {
-      try {
-        (0, import_node_child_process9.execFileSync)("git", args, { cwd, stdio: "pipe" });
-        return true;
-      } catch {
-        return false;
-      }
-    },
-    gitRun: (args, cwd) => {
-      (0, import_node_child_process9.execFileSync)("git", args, { cwd, stdio: "inherit" });
-    },
-    log: (msg) => console.log(msg),
-    err: (msg) => console.error(msg)
-  };
-}
-
-// src/wiki-pages.ts
-var import_node_crypto4 = require("node:crypto");
-var import_node_fs17 = require("node:fs");
-var import_node_path15 = require("node:path");
-var MARKER_RE = /<!--\s*wiki:page\s+([^>]*?)-->/g;
-var attr = (raw, key) => {
-  const m = new RegExp(`${key}\\s*=\\s*"([^"]*)"`).exec(raw);
-  return m ? m[1].trim() : "";
-};
-var sanitizeSlug = (s) => String(s ?? "").trim().replace(/[^\w.-]+/g, "-").replace(/^-+|-+$/g, "");
-function extractWikiMarkers(text, sourcePath = "") {
-  const out = [];
-  for (const m of String(text ?? "").matchAll(MARKER_RE)) {
-    const raw = m[1];
-    const slug = sanitizeSlug(attr(raw, "slug"));
-    const title = attr(raw, "title");
-    if (!slug || !title) continue;
-    out.push({ slug, title, artifact: attr(raw, "artifact"), sourcePath });
+function renderDocsIndex(entries) {
+  const lines = [
+    GENERATED_HEADER,
+    "# Documentation index",
+    "",
+    "Generated from the `docs/` tree by `mmi-cli docs index --write`. `--check` fails on drift, so this index",
+    "can never diverge from the records it lists.",
+    "",
+    "| Document | Scope |",
+    "| --- | --- |"
+  ];
+  for (const entry of entries) {
+    lines.push(`| [${escapeCell(entry.title)}](${entry.path}) | ${entry.scope} |`);
   }
-  return out;
+  return lines.join("\n") + "\n";
 }
-var DURABLE_GLOBS = [
-  "architecture.md",
-  "docs/Architecture",
-  "docs/org-architecture.md",
-  "docs/org-readme.md"
-];
-var walkMarkdown = (root, rel) => {
-  const abs = (0, import_node_path15.join)(root, rel);
-  let st;
-  try {
-    st = (0, import_node_fs17.statSync)(abs);
-  } catch {
-    return [];
+function docsIndex(deps, opts = {}) {
+  const entries = deps.listDocs().slice().sort().map((relPath) => extractDocMeta(relPath, deps.readDoc(relPath)));
+  const content = renderDocsIndex(entries);
+  const current = deps.readIndex();
+  const drift = current !== content;
+  let wrote = false;
+  if (!opts.check && drift) {
+    deps.writeIndex(content);
+    wrote = true;
   }
-  if (st.isFile()) return rel.endsWith(".md") ? [rel] : [];
-  return (0, import_node_fs17.readdirSync)(abs).flatMap((name) => walkMarkdown(root, (0, import_node_path15.join)(rel, name)));
-};
-function collectFeaturePages({ listDocs, readDoc }) {
-  const seen = /* @__PURE__ */ new Set();
-  const pages = [];
-  for (const path2 of listDocs()) {
-    for (const mk of extractWikiMarkers(readDoc(path2), path2)) {
-      if (seen.has(mk.slug)) continue;
-      seen.add(mk.slug);
-      pages.push(mk);
+  return { content, drift, wrote };
+}
+function walkMarkdown(dir) {
+  const out = [];
+  const stack = [dir];
+  while (stack.length) {
+    const current = stack.pop();
+    for (const entry of (0, import_node_fs16.readdirSync)(current, { withFileTypes: true })) {
+      const full = (0, import_node_path14.join)(current, entry.name);
+      if (entry.isDirectory()) {
+        stack.push(full);
+      } else if (entry.isFile() && entry.name.endsWith(".md")) {
+        out.push((0, import_node_path14.relative)(dir, full).split(import_node_path14.sep).join("/"));
+      }
     }
   }
-  return pages;
+  return out;
 }
-function fsReaders(rootDir) {
+function createDocsIndexDeps(repoRoot2) {
+  const docsDir = (0, import_node_path14.join)(repoRoot2, "docs");
+  const indexPath = (0, import_node_path14.join)(repoRoot2, DOCS_INDEX_PATH);
   return {
-    listDocs: () => DURABLE_GLOBS.flatMap((g) => walkMarkdown(rootDir, g)),
-    readDoc: (p) => {
-      try {
-        return (0, import_node_fs17.readFileSync)((0, import_node_path15.join)(rootDir, p), "utf8");
-      } catch {
-        return "";
-      }
-    }
+    listDocs: () => (0, import_node_fs16.existsSync)(docsDir) ? walkMarkdown(docsDir).filter((p) => p !== "index.md").sort() : [],
+    readDoc: (relPath) => (0, import_node_fs16.readFileSync)((0, import_node_path14.join)(docsDir, relPath), "utf8"),
+    readIndex: () => (0, import_node_fs16.existsSync)(indexPath) ? (0, import_node_fs16.readFileSync)(indexPath, "utf8") : null,
+    writeIndex: (content) => (0, import_node_fs16.writeFileSync)(indexPath, content, "utf8")
   };
 }
-function hashPageInputs({ slug, title, source }) {
-  return (0, import_node_crypto4.createHash)("sha256").update(JSON.stringify([slug ?? "", title ?? "", source ?? ""])).digest("hex");
-}
-function computePageStamp(pages, readSource) {
-  const stamp = {};
-  for (const p of pages ?? []) {
-    stamp[p.slug] = {
-      hash: hashPageInputs({ slug: p.slug, title: p.title, source: readSource(p.sourcePath) }),
-      sourcePath: p.sourcePath
+
+// src/docs-audit-command.ts
+function serializeOutcome(outcome) {
+  switch (outcome.kind) {
+    case "clean":
+      return "clean";
+    case "refreshed":
+      return `refreshed-${outcome.count}`;
+    case "failed":
+      return "failed";
+  }
+}
+var ISO_DATE_RE = /^\d{4}-\d{2}-\d{2}$/;
+function isValidIsoDate(date) {
+  if (typeof date !== "string" || !ISO_DATE_RE.test(date)) return false;
+  const parsed = Date.parse(`${date}T00:00:00Z`);
+  if (Number.isNaN(parsed)) return false;
+  return new Date(parsed).toISOString().slice(0, 10) === date;
+}
+var OUTCOME_WIRE_RE = /^(clean|refreshed-[1-9]\d*|failed)$/;
+function isValidOutcomeWire(outcome) {
+  return typeof outcome === "string" && OUTCOME_WIRE_RE.test(outcome);
+}
+function docsAuditRecord(input) {
+  const repo = input.repo.trim();
+  const date = input.date.trim();
+  const shaRange = input.shaRange.trim();
+  const checkerVendor = input.checkerVendor.trim();
+  if (!repo) throw new Error("docs-audit record: repo is required");
+  if (!date) throw new Error("docs-audit record: date is required");
+  if (!isValidIsoDate(date)) throw new Error(`docs-audit record: date must be a real ISO date (YYYY-MM-DD), got "${date}"`);
+  if (!shaRange) throw new Error("docs-audit record: shaRange is required");
+  if (!checkerVendor) throw new Error("docs-audit record: checkerVendor is required");
+  if (input.outcome.kind === "refreshed" && !(Number.isInteger(input.outcome.count) && input.outcome.count > 0)) {
+    throw new Error("docs-audit record: a `refreshed` outcome must carry a positive integer count");
+  }
+  if (input.outcome.kind === "failed" && !input.outcome.reason.trim()) {
+    throw new Error("docs-audit record: a `failed` outcome must carry a reason");
+  }
+  const outcome = serializeOutcome(input.outcome);
+  if (!isValidOutcomeWire(outcome)) {
+    throw new Error(`docs-audit record: outcome serialized to an invalid wire form "${outcome}"`);
+  }
+  return { repo, date, shaRange, outcome, checkerVendor };
+}
+function ageInDays(verdictDate, today) {
+  const a = Date.parse(`${verdictDate}T00:00:00Z`);
+  const b = Date.parse(`${today}T00:00:00Z`);
+  return Math.max(0, Math.round((b - a) / 864e5));
+}
+function docsAuditStatus(fetch2, opts) {
+  if ("notArmed" in fetch2) {
+    return { ok: true, state: "not-armed", line: `docs-audit: ${opts.repo} janitor not armed (registry route not live yet)` };
+  }
+  if (!fetch2.ok) {
+    return { ok: false, state: "error", line: `docs-audit: ${opts.repo} registry read failed \u2014 ${fetch2.error}` };
+  }
+  if (fetch2.verdict === null) {
+    return { ok: false, state: "missing", line: `docs-audit: ${opts.repo} no verdict on record \u2014 janitor blind or dead` };
+  }
+  const verdict = fetch2.verdict;
+  for (const field of ["repo", "shaRange", "checkerVendor"]) {
+    const value = verdict[field];
+    if (typeof value !== "string" || !value.trim()) {
+      const shown = typeof value === "string" ? `"${value}"` : `type ${Array.isArray(value) ? "array" : typeof value}`;
+      return {
+        ok: false,
+        state: "malformed",
+        line: `docs-audit: ${opts.repo} malformed verdict ${field} (${shown}, expected a non-empty string) \u2014 registry record corrupt, treating as RED`
+      };
+    }
+  }
+  if (!isValidIsoDate(verdict.date)) {
+    return {
+      ok: false,
+      state: "malformed",
+      line: `docs-audit: ${opts.repo} malformed verdict date "${verdict.date}" \u2014 registry record corrupt, treating as RED`
     };
   }
-  return stamp;
-}
-function selectChangedPages(pages, prevStamp, readSource) {
-  const prev = prevStamp && typeof prevStamp === "object" ? prevStamp : {};
-  const backfill = Object.keys(prev).length === 0;
-  return (pages ?? []).filter((p) => {
-    if (backfill) return true;
-    const prior = prev[p.slug];
-    if (!prior) return true;
-    const cur = hashPageInputs({ slug: p.slug, title: p.title, source: readSource(p.sourcePath) });
-    return prior.hash !== cur;
-  });
-}
-
-// src/wiki-plan-command.ts
-async function wikiPlan(deps, opts) {
-  const wikiRepo = `${opts.repo}.wiki.git`;
-  const pages = deps.collectPages();
-  if (pages.length === 0) {
-    emit(deps, { repo: opts.repo, wikiRepo, backfill: false, pages: [], stamp: {} });
-    return true;
+  if (!isValidOutcomeWire(verdict.outcome)) {
+    return {
+      ok: false,
+      state: "malformed",
+      line: `docs-audit: ${opts.repo} malformed verdict outcome "${verdict.outcome}" (expected clean|refreshed-N|failed) \u2014 registry record corrupt, treating as RED`
+    };
   }
-  const read = await deps.mintAndReadStamp(opts.repo);
-  if (!read.ok) {
-    deps.err(`wiki plan failed: could not read the wiki stamp for ${opts.repo}: ${read.error}`);
-    return false;
+  if (!isValidIsoDate(opts.today)) {
+    throw new Error(`docs-audit status: today must be a real ISO date (YYYY-MM-DD), got "${opts.today}"`);
   }
-  const prevStamp = read.stamp;
-  const backfill = Object.keys(prevStamp).length === 0;
-  const changed = new Set(selectChangedPages(pages, prevStamp, deps.readSource).map((p) => p.slug));
-  const stamp = computePageStamp(pages, deps.readSource);
-  emit(deps, {
-    repo: opts.repo,
-    wikiRepo,
-    backfill,
-    pages: pages.map((p) => ({ ...p, changed: changed.has(p.slug) })),
-    stamp
-  });
-  return true;
-}
-function emit(deps, result) {
-  deps.out(JSON.stringify(result, null, 2));
+  const cadence = opts.cadenceDays ?? 7;
+  const grace = opts.graceDays ?? 3;
+  const age = ageInDays(verdict.date, opts.today);
+  if (age > cadence + grace) {
+    return { ok: false, state: "stale", line: `docs-audit: ${opts.repo} last verdict ${age}d old \u2014 janitor blind or dead` };
+  }
+  if (verdict.outcome === "failed") {
+    return { ok: false, state: "failed", line: `docs-audit: ${opts.repo} last run FAILED (${verdict.date}) \u2014 janitor needs attention` };
+  }
+  return { ok: true, state: "clean", line: `docs-audit: ${opts.repo} ${verdict.outcome} (${verdict.date}, ${verdict.checkerVendor})` };
 }
 
 // src/project-readiness.ts
@@ -15562,7 +15747,6 @@ var SETTABLE_VAR_KEYS = [
   "projectOwner",
   "projectNumber",
   "branch",
-  "wikiRepo",
   "vaultPath",
   "repos",
   "oauth",
@@ -15943,9 +16127,9 @@ function writeError(res) {
 }
 
 // src/secrets-commands.ts
-var import_node_fs18 = require("node:fs");
-var import_node_path16 = require("node:path");
-var import_node_os6 = require("node:os");
+var import_node_fs17 = require("node:fs");
+var import_node_path15 = require("node:path");
+var import_node_os5 = require("node:os");
 
 // src/secrets-diff.ts
 var TIMEOUT_MS2 = 8e3;
@@ -16047,18 +16231,18 @@ function collectMap(value, previous = []) {
   return [...previous, value];
 }
 async function decryptRailsCredentials(input) {
-  const appDir = (0, import_node_path16.resolve)(input.appDir ?? process.cwd());
+  const appDir = (0, import_node_path15.resolve)(input.appDir ?? process.cwd());
   const credentialsFile = input.credentialsFile ?? DEFAULT_RAILS_CREDENTIALS_FILE;
   const masterKeyFile = input.masterKeyFile ?? DEFAULT_RAILS_MASTER_KEY_FILE;
-  const credentialsPath = (0, import_node_path16.resolve)(appDir, credentialsFile);
-  const masterKeyPath = (0, import_node_path16.resolve)(appDir, masterKeyFile);
+  const credentialsPath = (0, import_node_path15.resolve)(appDir, credentialsFile);
+  const masterKeyPath = (0, import_node_path15.resolve)(appDir, masterKeyFile);
   const env = {
     ...process.env,
     MMI_RAILS_CREDENTIALS_FILE: credentialsPath,
     MMI_RAILS_MASTER_KEY_FILE: masterKeyPath
   };
-  if ((0, import_node_fs18.existsSync)(masterKeyPath)) {
-    env.RAILS_MASTER_KEY = (0, import_node_fs18.readFileSync)(masterKeyPath, "utf8").trim();
+  if ((0, import_node_fs17.existsSync)(masterKeyPath)) {
+    env.RAILS_MASTER_KEY = (0, import_node_fs17.readFileSync)(masterKeyPath, "utf8").trim();
   }
   const script = [
     'require "json"',
@@ -16068,9 +16252,9 @@ async function decryptRailsCredentials(input) {
     'config = ActiveSupport::EncryptedConfiguration.new(config_path: config_path, key_path: key_path, env_key: "RAILS_MASTER_KEY", raise_if_missing_key: true)',
     "puts JSON.generate(config.config)"
   ].join("\n");
-  const scriptDir = (0, import_node_fs18.mkdtempSync)((0, import_node_path16.join)((0, import_node_os6.tmpdir)(), "mmi-rails-decrypt-"));
-  const scriptPath = (0, import_node_path16.join)(scriptDir, "decrypt.rb");
-  (0, import_node_fs18.writeFileSync)(scriptPath, script, "utf8");
+  const scriptDir = (0, import_node_fs17.mkdtempSync)((0, import_node_path15.join)((0, import_node_os5.tmpdir)(), "mmi-rails-decrypt-"));
+  const scriptPath = (0, import_node_path15.join)(scriptDir, "decrypt.rb");
+  (0, import_node_fs17.writeFileSync)(scriptPath, script, "utf8");
   try {
     const args = ["exec", "ruby", scriptPath];
     const cmd = process.platform === "win32" ? "cmd.exe" : "bundle";
@@ -16082,7 +16266,7 @@ async function decryptRailsCredentials(input) {
     });
     return JSON.parse(stdout);
   } finally {
-    (0, import_node_fs18.rmSync)(scriptDir, { recursive: true, force: true });
+    (0, import_node_fs17.rmSync)(scriptDir, { recursive: true, force: true });
   }
 }
 async function readSecretStdin() {
@@ -16157,7 +16341,7 @@ function registerSecretsCommands(program3) {
   secrets.command("org-catalog").description("MASTER-ONLY: set the _org/<provider>/* catalog declarations from a JSON file (#2244)").requiredOption("--file <path>", 'JSON file: { "entries": { "<provider>/<KEY>": {key,purpose,group,owner,provider,stages[],consumers[]} } }').action((o) => withSecrets(async (d) => {
     let body;
     try {
-      body = (0, import_node_fs18.readFileSync)((0, import_node_path16.resolve)(o.file), "utf8");
+      body = (0, import_node_fs17.readFileSync)((0, import_node_path15.resolve)(o.file), "utf8");
     } catch (e) {
       return fail(`secrets org-catalog: cannot read --file ${o.file}: ${e.message}`);
     }
@@ -16261,7 +16445,7 @@ function registerSecretsCommands(program3) {
       {
         ...d,
         decryptRailsCredentials,
-        removeFile: (path2) => (0, import_node_fs18.unlinkSync)((0, import_node_path16.resolve)(o.appDir ?? process.cwd(), path2))
+        removeFile: (path2) => (0, import_node_fs17.unlinkSync)((0, import_node_path15.resolve)(o.appDir ?? process.cwd(), path2))
       },
       {
         repo: o.repo,
@@ -16286,7 +16470,7 @@ function registerSecretsCommands(program3) {
 }
 
 // src/app-actor.ts
-var import_node_crypto5 = require("node:crypto");
+var import_node_crypto4 = require("node:crypto");
 var APP_ACTOR_ENV = "MMI_ACTOR";
 var APP_VAULT_REPO = "mutmutco/MMI-Hub";
 var APP_VAULT_KEYS = ["GITHUB_APP_ID", "GITHUB_APP_INSTALLATION_ID", "GITHUB_APP_PRIVATE_KEY"];
@@ -16330,7 +16514,7 @@ function mintAppJwt(appId, privateKeyPem, nowSec) {
     exp: now + APP_JWT_TTL_S,
     iss: appId
   }));
-  const signer = (0, import_node_crypto5.createSign)("RSA-SHA256");
+  const signer = (0, import_node_crypto4.createSign)("RSA-SHA256");
   signer.update(`${header}.${payload}`);
   return `${header}.${payload}.${signer.sign(privateKeyPem, "base64url")}`;
 }
@@ -16636,7 +16820,7 @@ function registerBoxCommands(program3) {
 
 // src/schedules-commands.ts
 var import_promises2 = require("node:fs/promises");
-var import_node_child_process10 = require("node:child_process");
+var import_node_child_process9 = require("node:child_process");
 var import_node_util7 = require("node:util");
 
 // src/schedules.ts
@@ -16780,9 +16964,82 @@ function spliceDoc(docText, generatedSection) {
   }
   return docText.slice(0, start) + generatedSection + docText.slice(end + DOC_END_MARKER.length);
 }
+function splitCadence(cadence) {
+  return cadence.split("+").map((c) => c.replace(/\s+/g, " ").trim()).filter(Boolean);
+}
+var CRON_FIELD = "[0-9*/,-]+";
+var CRON_TOKEN_RE = new RegExp(`${CRON_FIELD}(?:\\s+${CRON_FIELD}){4}`, "g");
+function extractCronTokens(cadence) {
+  const out = /* @__PURE__ */ new Set();
+  for (const m of cadence.match(CRON_TOKEN_RE) ?? []) out.add(m.replace(/\s+/g, " ").trim());
+  return out;
+}
+function cadenceStale(registryCadence, liveCadence) {
+  const registered = extractCronTokens(registryCadence);
+  const liveCrons = splitCadence(liveCadence);
+  if (!liveCrons.length) return false;
+  return !liveCrons.every((cron) => registered.has(cron));
+}
+function reconcileGithubActions(liveGithub, registry2, readRepos) {
+  const registryGithub = registry2.filter((r) => r.executor === "github-actions");
+  const liveByName = new Map(liveGithub.map((e) => [e.name, e]));
+  const registryById = new Map(registryGithub.map((r) => [r.id, r]));
+  const drifts = [];
+  for (const e of liveGithub) {
+    if (!registryById.has(e.name)) {
+      drifts.push({
+        class: "live-but-unregistered",
+        name: e.name,
+        executor: e.executor,
+        detail: "armed with no SCHEDULE# row",
+        remedy: 'add the eight-field header (docs/schedules.md "The entry template") and re-run the schedules lift so it registers a SCHEDULE# row'
+      });
+    }
+  }
+  for (const r of registryGithub) {
+    const live = liveByName.get(r.id);
+    if (live) {
+      if (cadenceStale(r.cadence, live.cadence)) {
+        drifts.push({
+          class: "file-vs-registry-stale",
+          name: r.id,
+          executor: r.executor || live.executor,
+          detail: `live cadence \`${live.cadence}\` disagrees with registered \`${r.cadence}\``,
+          remedy: "re-run the schedules lift to refresh the SCHEDULE# row from the current header/cron"
+        });
+      }
+      continue;
+    }
+    if (readRepos.has(r.repo)) {
+      drifts.push({
+        class: "registered-but-dead",
+        name: r.id,
+        executor: r.executor || "github-actions",
+        detail: "registered with no armed workflow",
+        remedy: `remove it from ${r.repo} (or re-arm the workflow), then re-run the schedules lift to prune the stale SCHEDULE# row`
+      });
+    }
+  }
+  return drifts.sort((a, b) => a.class.localeCompare(b.class) || a.name.localeCompare(b.name));
+}
+function renderDrift(d) {
+  return `${d.class}: ${d.name} (${d.executor}) \u2014 ${d.detail}; remedy: ${d.remedy}`;
+}
+function assembleReconciliation(githubEntries2, readRepos, registry2) {
+  if (registry2 === null) {
+    return {
+      reconciliation: [],
+      driftLines: [],
+      incomplete: ["registry: could not read GET /schedules/list \u2014 reconciliation skipped (Hub API unreachable or not authenticated)"]
+    };
+  }
+  const live = githubEntries2.filter((e) => e.executor === "github-actions");
+  const drifts = reconcileGithubActions(live, registry2, readRepos);
+  return { reconciliation: drifts, driftLines: drifts.map(renderDrift), incomplete: [] };
+}
 
 // src/schedules-commands.ts
-var execFileP5 = (0, import_node_util7.promisify)(import_node_child_process10.execFile);
+var execFileP5 = (0, import_node_util7.promisify)(import_node_child_process9.execFile);
 var AWS_REGION = "eu-central-1";
 var AWS_TIMEOUT_MS = 3e4;
 var AWS_RETRY_DELAY_MS = 1500;
@@ -16829,12 +17086,13 @@ async function githubEntries(client) {
   const entries = [];
   const incomplete = [];
   const drift = [];
+  const readRepos = [];
   let repos;
   try {
     const listing = await client.restPaginate(`/orgs/${ORG}/repos?per_page=100`);
     repos = listing.filter((r) => typeof r?.name === "string" && r.archived !== true).map((r) => r.name).sort();
   } catch (e) {
-    return { entries, incomplete: [`github: could not list ${ORG} repos \u2014 ${e.message}`], drift };
+    return { entries, incomplete: [`github: could not list ${ORG} repos \u2014 ${e.message}`], drift, readRepos };
   }
   const results = await Promise.all(
     repos.map(async (repo) => {
@@ -16848,13 +17106,14 @@ async function githubEntries(client) {
   for (const r of results) {
     if ("error" in r) incomplete.push(`github: ${r.repo}: ${r.error}`);
     else {
+      readRepos.push(r.repo);
       entries.push(...r.entries);
       if (r.failures.length) {
         drift.push(`${r.repo}: ${r.failures.length} workflow record(s) listed active with no file on the default branch (deleted one-offs?) \u2014 deregister them: ${r.failures.map((f) => f.split(": ")[1]).join(", ")}`);
       }
     }
   }
-  return { entries, incomplete, drift };
+  return { entries, incomplete, drift, readRepos };
 }
 async function awsJson(args) {
   const run = async () => {
@@ -16891,12 +17150,21 @@ async function awsEntries() {
   }
   return { entries, incomplete, drift: [] };
 }
-async function fetchNotebook(client = defaultGitHubClient()) {
-  const [gh, aws] = await Promise.all([githubEntries(client), awsEntries()]);
+async function defaultRegistryRead() {
+  return fetchSchedulesList(registryClientDeps(await loadConfig()));
+}
+async function fetchNotebook(client = defaultGitHubClient(), readRegistry = defaultRegistryRead) {
+  const [gh, aws, registry2] = await Promise.all([
+    githubEntries(client),
+    awsEntries(),
+    readRegistry().catch(() => null)
+  ]);
+  const recon = assembleReconciliation(gh.entries, new Set(gh.readRepos), registry2);
   return {
     entries: sortEntries([...gh.entries, ...aws.entries, ...DECLARED_ENTRIES]),
-    incomplete: [...gh.incomplete, ...aws.incomplete],
-    drift: [...gh.drift, ...aws.drift]
+    incomplete: [...gh.incomplete, ...aws.incomplete, ...recon.incomplete],
+    drift: [...gh.drift, ...aws.drift, ...recon.driftLines],
+    reconciliation: recon.reconciliation
   };
 }
 function warnIncomplete2(incomplete) {
@@ -16909,7 +17177,7 @@ function reportDrift(drift) {
 function registerSchedulesCommands(program3) {
   program3.command("schedules").description("the org schedules notebook \u2014 every armed cron, timer, and scheduled LLM lane, resolved live (jerv side lives in jerv-cli schedules)").option("--json", "machine-readable output (consumed by jerv-cli schedules --all)").option("--doc <path>", "splice the generated inventory into the given doc between the schedules:inventory markers (docs/schedules.md)").action(async (o) => {
     try {
-      const { entries, incomplete, drift } = await fetchNotebook();
+      const { entries, incomplete, drift, reconciliation } = await fetchNotebook();
       if (o.doc) {
         if (incomplete.length) {
           warnIncomplete2(incomplete);
@@ -16924,7 +17192,7 @@ function registerSchedulesCommands(program3) {
         return;
       }
       if (o.json) {
-        console.log(JSON.stringify({ org: entries, incomplete, drift }, null, 2));
+        console.log(JSON.stringify({ org: entries, incomplete, drift, reconciliation }, null, 2));
       } else {
         console.log(formatSchedulesTable(entries));
         reportDrift(drift);
@@ -17396,11 +17664,11 @@ function registerQueryCommands(program3) {
 }
 
 // src/bootstrap-commands.ts
-var import_node_fs19 = require("node:fs");
+var import_node_fs18 = require("node:fs");
 
 // src/bootstrap-verify.ts
 var TRAIN_BRANCHES2 = ["development", "rc", "main"];
-var requiredDocs = ["README.md", "architecture.md"];
+var requiredDocs = ["README.md", "architecture.md", "docs/decisions/README.md"];
 var requiredIssueTemplates = [
   ".github/ISSUE_TEMPLATE/bug.yml",
   ".github/ISSUE_TEMPLATE/feature.yml",
@@ -17561,7 +17829,6 @@ async function verifyBootstrap(repo, repoClass, deps, releaseTrack) {
   const repoInfo = await restJson3(deps, `repos/${repo}`, {});
   checks.push({ ok: Boolean(repoInfo.default_branch), label: "repo exists" });
   checks.push({ ok: repoInfo.default_branch === baseBranch, label: `default branch is ${baseBranch}`, detail: repoInfo.default_branch || "missing" });
-  checks.push({ ok: repoInfo.has_wiki === true, label: "wiki enabled", detail: repoInfo.has_wiki === true ? void 0 : "has_wiki is false or unavailable" });
   const branchList = await restPagedJson2(deps, `repos/${repo}/branches`, []);
   const branchNames = new Set(branchList.map((b) => b.name));
   for (const branch of branchesWanted) {
@@ -17763,8 +18030,6 @@ async function verifyBootstrap(repo, repoClass, deps, releaseTrack) {
       });
     }
   }
-  const fanout = repo === "mutmutco/MMI-Hub" ? true : localRegistryCheck(deps, ".github/fanout-targets.json", (json) => Array.isArray(json?.repos) && json.repos.some((r) => repoRefsMatch(r.repo ?? "", repo.split("/")[1]) && r.branch === baseBranch));
-  if (fanout != null) checks.push({ ok: fanout, label: `fanout target registered on ${baseBranch}` });
   const projectRegistry = localRegistryCheck(deps, "projects.json", (json) => Array.isArray(json?.projects) && projectRegistryIncludesRepo(json.projects, repo));
   if (projectRegistry != null) checks.push({ ok: projectRegistry, label: "project registry includes repo" });
   const rulesetList = await restJson3(deps, `repos/${repo}/rulesets?includes_parents=true`, []);
@@ -17944,7 +18209,7 @@ function registerBootstrapCommands(program3) {
       client: defaultGitHubClient(),
       projectMeta: meta,
       deployModel: typeof meta?.deployModel === "string" ? meta.deployModel : void 0,
-      readLocalFile: (path2) => path2 === "projects.json" && apiProjects != null ? apiProjects : (0, import_node_fs19.existsSync)(path2) ? (0, import_node_fs19.readFileSync)(path2, "utf8") : null,
+      readLocalFile: (path2) => path2 === "projects.json" && apiProjects != null ? apiProjects : (0, import_node_fs18.existsSync)(path2) ? (0, import_node_fs18.readFileSync)(path2, "utf8") : null,
       // requiredGcpApis is stored as an array by a JSON write, but `project set --var KEY=VALUE` stores a raw
       // comma-string — accept either so the seeded value verifies regardless of how it was written.
       requiredGcpApis: (() => {
@@ -17995,12 +18260,12 @@ function registerBootstrapCommands(program3) {
       return fail(`bootstrap apply: ${e.message}`);
     }
     const manifestPath = "skills/bootstrap/seeds/manifest.json";
-    if (!(0, import_node_fs19.existsSync)(manifestPath)) return fail(`bootstrap apply: ${manifestPath} not found; bootstrap runs from the MMI-Hub repo root by design \u2014 it stamps org-level resources (Project, Ruleset, secrets, access) through the GitHub App, which is only authorized from the Hub checkout`);
-    const manifest = loadBootstrapSeeds((0, import_node_fs19.readFileSync)(manifestPath, "utf8"));
+    if (!(0, import_node_fs18.existsSync)(manifestPath)) return fail(`bootstrap apply: ${manifestPath} not found; bootstrap runs from the MMI-Hub repo root by design \u2014 it stamps org-level resources (Project, Ruleset, secrets, access) through the GitHub App, which is only authorized from the Hub checkout`);
+    const manifest = loadBootstrapSeeds((0, import_node_fs18.readFileSync)(manifestPath, "utf8"));
     const baseBranch = o.class === "content" ? "main" : "development";
     const slug = parsedRepo.slug;
     const gh = async (args) => execFileP2("gh", args, { timeout: 2e4 });
-    const readFile5 = (p) => (0, import_node_fs19.existsSync)(p) ? (0, import_node_fs19.readFileSync)(p, "utf8") : null;
+    const readFile5 = (p) => (0, import_node_fs18.existsSync)(p) ? (0, import_node_fs18.readFileSync)(p, "utf8") : null;
     const enc = (p) => p.split("/").map(encodeURIComponent).join("/");
     const rawVars = {};
     for (const value of cmdOpts.var ?? []) {
@@ -18062,21 +18327,19 @@ function registerBootstrapCommands(program3) {
       let exists = false;
       let sha;
       let remoteContent = null;
-      if (resolved.source !== "fanout") {
+      try {
+        const r = await gh(["api", `repos/${repo}/contents/${enc(resolved.target)}?ref=${seedPlan.ref}`]);
+        exists = true;
         try {
-          const r = await gh(["api", `repos/${repo}/contents/${enc(resolved.target)}?ref=${seedPlan.ref}`]);
-          exists = true;
-          try {
-            const parsed = JSON.parse(r.stdout);
-            sha = parsed.sha;
-            if (parsed.encoding === "base64" && typeof parsed.content === "string") {
-              remoteContent = Buffer.from(parsed.content, "base64").toString("utf8");
-            }
-          } catch {
+          const parsed = JSON.parse(r.stdout);
+          sha = parsed.sha;
+          if (parsed.encoding === "base64" && typeof parsed.content === "string") {
+            remoteContent = Buffer.from(parsed.content, "base64").toString("utf8");
           }
         } catch {
-          exists = false;
         }
+      } catch {
+        exists = false;
       }
       const planned = planSeedAction(resolved, exists);
       const isBlock = resolved.source === "managed-block";
@@ -18094,7 +18357,7 @@ function registerBootstrapCommands(program3) {
       await gh(["api", "-X", "PATCH", `repos/${repo}`, "-f", "allow_auto_merge=true", "-f", "allow_squash_merge=true", "-f", "delete_branch_on_merge=true"]).catch(() => {
       });
       const openPrs = await gh(["pr", "list", "--repo", repo, "--head", seedPlan.branch, "--base", baseBranch, "--state", "open", "--json", "number,url"]);
-      const prDecision = decideFanoutPrAction(JSON.parse(openPrs.stdout || "[]"));
+      const prDecision = decideSeedPrAction(JSON.parse(openPrs.stdout || "[]"));
       if (prDecision.action === "reuse") {
         seedPrUrl = prDecision.url;
       } else {
@@ -18187,83 +18450,7 @@ function registerBootstrapCommands(program3) {
         applied.push(`ddb register ${registerPayload.slug} (failed: ${why})`);
       }
     }
-    let fanoutPrUrl;
-    if (o.execute) {
-      const fanoutEntry = {
-        repo: parsedRepo.name,
-        slug,
-        projectId: vars.PROJECT_ID || void 0,
-        wikiRepo: vars.WIKI_REPO || parsedRepo.fullName,
-        branch: baseBranch,
-        cls: o.class,
-        name: vars.NAME || parsedRepo.name
-      };
-      const readHubFile = async (path2) => {
-        const r = await gh(["api", `repos/${HUB_REPO}/contents/${enc(path2)}?ref=development`]);
-        const parsed = JSON.parse(r.stdout);
-        if (parsed.encoding !== "base64" || typeof parsed.content !== "string" || !parsed.sha) {
-          throw new Error(`could not read ${HUB_REPO}/${path2}`);
-        }
-        return { content: Buffer.from(parsed.content, "base64").toString("utf8"), sha: parsed.sha };
-      };
-      try {
-        const fanoutFile = await readHubFile(".github/fanout-targets.json");
-        const projectsFile = await readHubFile("projects.json");
-        const plan = planFanoutRegistration(fanoutFile.content, projectsFile.content, fanoutEntry);
-        if (!plan.changed) {
-          applied.push(`fanout: already registered (${parsedRepo.name})`);
-        } else {
-          const branchName = `bootstrap-register-fanout-${slug}`;
-          const headSha = (await gh(["api", `repos/${HUB_REPO}/git/ref/heads/development`, "--jq", ".object.sha"])).stdout.trim();
-          try {
-            await gh(["api", "-X", "POST", `repos/${HUB_REPO}/git/refs`, "-f", `ref=refs/heads/${branchName}`, "-f", `sha=${headSha}`]);
-          } catch (e) {
-            if (!/Reference already exists|already exists/i.test(String(e.message ?? ""))) throw e;
-          }
-          const branchFileSha = async (path2) => {
-            try {
-              const r = await gh(["api", `repos/${HUB_REPO}/contents/${enc(path2)}?ref=${branchName}`, "--jq", ".sha"]);
-              return r.stdout.trim() || void 0;
-            } catch (e) {
-              if (/404|Not Found/i.test(String(e.message ?? ""))) return void 0;
-              throw e;
-            }
-          };
-          const fanoutBranchSha = await branchFileSha(".github/fanout-targets.json");
-          const projectsBranchSha = await branchFileSha("projects.json");
-          await gh(contentPutArgs(HUB_REPO, ".github/fanout-targets.json", plan.fanoutTargets, branchName, fanoutBranchSha));
-          await gh(contentPutArgs(HUB_REPO, "projects.json", plan.projects, branchName, projectsBranchSha));
-          const openPrs = await gh(["pr", "list", "--repo", HUB_REPO, "--head", branchName, "--base", "development", "--state", "open", "--json", "number,url"]);
-          const prDecision = decideFanoutPrAction(JSON.parse(openPrs.stdout || "[]"));
-          if (prDecision.action === "reuse") {
-            fanoutPrUrl = prDecision.url;
-          } else {
-            const created = await ghCreate([
-              "pr",
-              "create",
-              "--repo",
-              HUB_REPO,
-              "--base",
-              "development",
-              "--head",
-              branchName,
-              "--title",
-              `bootstrap: register ${parsedRepo.name} for the org-managed .gitignore fanout`,
-              "--body",
-              `Auto-opened by \`mmi-cli bootstrap apply --execute ${repo}\` (#933): adds ${parsedRepo.name} to projects.json + .github/fanout-targets.json so the org-managed .gitignore block reaches it (hub-v3 retired the whole-spine fanout).`
-            ]);
-            fanoutPrUrl = created.url;
-          }
-          await gh(["pr", "merge", fanoutPrUrl, "--repo", HUB_REPO, "--auto", "--squash"]).catch((e) => {
-            if (!/already/i.test(String(e.message ?? ""))) throw e;
-          });
-          applied.push(`fanout: PR ${fanoutPrUrl} (auto-merge enabled)`);
-        }
-      } catch (e) {
-        return failGraceful(`bootstrap apply: fanout registration failed: ${e.message}`);
-      }
-    }
-    if (o.json) console.log(JSON.stringify({ repo, class: o.class, execute: o.execute, seedDelivery: seedPlan.mode, seedPrUrl, actions, applied, ddbWrites, fanoutPrUrl }, null, 2));
+    if (o.json) console.log(JSON.stringify({ repo, class: o.class, execute: o.execute, seedDelivery: seedPlan.mode, seedPrUrl, actions, applied, ddbWrites }, null, 2));
     else {
       console.log(renderSeedPlan(actions));
       if (o.execute) console.log(`
@@ -18274,13 +18461,13 @@ LIVE apply to ${repo}:
 }
 
 // src/stage-commands.ts
-var import_node_fs21 = require("node:fs");
-var import_node_path18 = require("node:path");
-
-// src/port-registry.ts
 var import_node_fs20 = require("node:fs");
 var import_node_path17 = require("node:path");
 
+// src/port-registry.ts
+var import_node_fs19 = require("node:fs");
+var import_node_path16 = require("node:path");
+
 // ../infra/port-geometry.mjs
 var PORT_BLOCK = 100;
 var PORT_SPAN = 10;
@@ -18293,8 +18480,8 @@ function nextPortBlock(registry2) {
   return [base, base + PORT_SPAN];
 }
 function loadPortRegistry(path2) {
-  if (!(0, import_node_fs20.existsSync)(path2)) return {};
-  const raw = JSON.parse((0, import_node_fs20.readFileSync)(path2, "utf8"));
+  if (!(0, import_node_fs19.existsSync)(path2)) return {};
+  const raw = JSON.parse((0, import_node_fs19.readFileSync)(path2, "utf8"));
   const out = {};
   for (const [key, value] of Object.entries(raw)) {
     if (Array.isArray(value) && value.length === 2 && value.every((n) => typeof n === "number")) {
@@ -18308,9 +18495,9 @@ function ensurePortRange(repo, path2) {
   const existing = registry2[repo];
   if (existing) return existing;
   const range = nextPortBlock(registry2);
-  const raw = (0, import_node_fs20.existsSync)(path2) ? JSON.parse((0, import_node_fs20.readFileSync)(path2, "utf8")) : {};
+  const raw = (0, import_node_fs19.existsSync)(path2) ? JSON.parse((0, import_node_fs19.readFileSync)(path2, "utf8")) : {};
   raw[repo] = range;
-  (0, import_node_fs20.writeFileSync)(path2, JSON.stringify(raw, null, 2) + "\n", "utf8");
+  (0, import_node_fs19.writeFileSync)(path2, JSON.stringify(raw, null, 2) + "\n", "utf8");
   return range;
 }
 function portCursorSeed(registry2) {
@@ -18332,22 +18519,22 @@ function existingPortRange(repo, registry2) {
   return registry2[repo] ?? null;
 }
 function portRangeInfraAt(root, source) {
-  const registryPath = (0, import_node_path17.join)(root, "infra", "port-ranges.json");
-  const ddbScriptPath = (0, import_node_path17.join)(root, "infra", "port-ddb.mjs");
-  if (!(0, import_node_fs20.existsSync)(registryPath) || !(0, import_node_fs20.existsSync)(ddbScriptPath)) return null;
+  const registryPath = (0, import_node_path16.join)(root, "infra", "port-ranges.json");
+  const ddbScriptPath = (0, import_node_path16.join)(root, "infra", "port-ddb.mjs");
+  if (!(0, import_node_fs19.existsSync)(registryPath) || !(0, import_node_fs19.existsSync)(ddbScriptPath)) return null;
   return { root, source, registryPath, ddbScriptPath };
 }
 function resolvePortRangeInfra(cwd, packageDir) {
   const direct = portRangeInfraAt(cwd, "cwd");
   if (direct) return direct;
-  for (let dir = cwd; ; dir = (0, import_node_path17.dirname)(dir)) {
-    const sibling = portRangeInfraAt((0, import_node_path17.join)(dir, "MMI-Hub"), "sibling-hub");
+  for (let dir = cwd; ; dir = (0, import_node_path16.dirname)(dir)) {
+    const sibling = portRangeInfraAt((0, import_node_path16.join)(dir, "MMI-Hub"), "sibling-hub");
     if (sibling) return sibling;
-    const parent = (0, import_node_path17.dirname)(dir);
+    const parent = (0, import_node_path16.dirname)(dir);
     if (parent === dir) break;
   }
   if (packageDir) {
-    const pkgRoot = (0, import_node_path17.join)(packageDir, "..", "..");
+    const pkgRoot = (0, import_node_path16.join)(packageDir, "..", "..");
     const pkgFrom = portRangeInfraAt(pkgRoot, "pkg-root");
     if (pkgFrom) return pkgFrom;
   }
@@ -18523,8 +18710,8 @@ function registerStageCommands(program3) {
     const portRange = portRangeMeta && typeof portRangeMeta.start === "number" && typeof portRangeMeta.end === "number" ? [portRangeMeta.start, portRangeMeta.end] : void 0;
     return decideStage({
       registry: { deployModel: project2?.deployModel, portRange, error: read.ok ? void 0 : read.error },
-      hasCompose: (0, import_node_fs21.existsSync)((0, import_node_path18.join)(process.cwd(), "docker-compose.yml")),
-      hasEnvExample: (0, import_node_fs21.existsSync)((0, import_node_path18.join)(process.cwd(), ".env.example"))
+      hasCompose: (0, import_node_fs20.existsSync)((0, import_node_path17.join)(process.cwd(), "docker-compose.yml")),
+      hasEnvExample: (0, import_node_fs20.existsSync)((0, import_node_path17.join)(process.cwd(), ".env.example"))
     });
   }
   async function fetchStageVaultEnvMerge() {
@@ -18848,6 +19035,27 @@ function registerBoardCommands(program3) {
       expected: [...BOARD_STATUSES]
     });
   }
+  async function runBulkMove(issueRefs, o, status, failLabel) {
+    try {
+      const bulk = await moveBoardIssues({
+        config: await loadConfigForBoardSelector2(issueRefs[0], o.repo),
+        selectors: issueRefs,
+        status,
+        repo: o.repo,
+        allowPartial: o.allowPartial
+      });
+      if (o.json) {
+        console.log(JSON.stringify(bulk.results));
+      } else {
+        for (const result of bulk.results) {
+          console.log(result.moved ? result.partial ? `Partially moved ${result.ref}: ${result.warning}` : `Moved ${result.ref} -> ${result.status}` : `Skipped ${result.ref}: ${result.reason}`);
+        }
+      }
+      if (bulk.failed > 0) process.exitCode = 1;
+    } catch (e) {
+      return failGraceful(`${failLabel} failed: ${e.message}`);
+    }
+  }
   withExamples(mutating(
     board.command("move <status> <issues...>").description(`move one or more board items to a Status: ${BOARD_STATUSES.join(", ")} (quote multi-word statuses)`).option("--json", "machine-readable output").option("--repo <owner/repo>", "current repo for local issue numbers (defaults to git origin)").option("--allow-partial", "return success JSON if the item resolves but the status move fails"),
     (_opts, args) => {
@@ -18867,25 +19075,7 @@ function registerBoardCommands(program3) {
       }
       return;
     }
-    try {
-      const bulk = await moveBoardIssues({
-        config: await loadConfigForBoardSelector2(issueRefs[0], o.repo),
-        selectors: issueRefs,
-        status: canonicalStatus,
-        repo: o.repo,
-        allowPartial: o.allowPartial
-      });
-      if (o.json) {
-        console.log(JSON.stringify(bulk.results));
-      } else {
-        for (const result of bulk.results) {
-          console.log(result.moved ? result.partial ? `Partially moved ${result.ref}: ${result.warning}` : `Moved ${result.ref} -> ${result.status}` : `Skipped ${result.ref}: ${result.reason}`);
-        }
-      }
-      if (bulk.failed > 0) process.exitCode = 1;
-    } catch (e) {
-      return failGraceful(`board move failed: ${e.message}`);
-    }
+    await runBulkMove(issueRefs, o, canonicalStatus, "board move");
   }), [
     'mmi-cli board move "In Progress" 2680',
     "mmi-cli board move Done 2680 2681 2682"
@@ -18929,25 +19119,7 @@ function registerBoardCommands(program3) {
       }
       return;
     }
-    try {
-      const bulk = await moveBoardIssues({
-        config: await loadConfigForBoardSelector2(issueRefs[0], o.repo),
-        selectors: issueRefs,
-        status: "Done",
-        repo: o.repo,
-        allowPartial: o.allowPartial
-      });
-      if (o.json) {
-        console.log(JSON.stringify(bulk.results));
-      } else {
-        for (const result of bulk.results) {
-          console.log(result.moved ? result.partial ? `Partially moved ${result.ref}: ${result.warning}` : `Moved ${result.ref} -> ${result.status}` : `Skipped ${result.ref}: ${result.reason}`);
-        }
-      }
-      if (bulk.failed > 0) process.exitCode = 1;
-    } catch (e) {
-      return failGraceful(`board done failed: ${e.message}`);
-    }
+    await runBulkMove(issueRefs, o, "Done", "board done");
   });
   board.command("unclaim <issue>").description("clear the assignee and reset the board Status (defaults to Todo) \u2014 the inverse of claim").option("--json", "machine-readable output").option("--repo <owner/repo>", "current repo for local issue numbers (defaults to git origin)").option("--to-status <status>", `set Status after unclaim (default Todo; one of ${BOARD_STATUSES.join(", ")})`).option("--allow-partial", "return success JSON if the assignee clear or status move fails").action(async (issueRef, o) => {
     const toStatus = o.toStatus ? resolveBoardStatus(o.toStatus) : void 0;
@@ -18990,9 +19162,9 @@ function registerBoardCommands(program3) {
 }
 
 // src/merge-cleanup.ts
-var import_node_fs22 = require("node:fs");
+var import_node_fs21 = require("node:fs");
 var import_promises4 = require("node:fs/promises");
-var import_node_child_process11 = require("node:child_process");
+var import_node_child_process10 = require("node:child_process");
 
 // src/board-advance.ts
 function repoOf2(ref) {
@@ -19078,7 +19250,7 @@ function boardAdvanceFailureMessage(result) {
 
 // src/deferred-registry-store.ts
 var import_promises3 = require("node:fs/promises");
-var import_node_path19 = require("node:path");
+var import_node_path18 = require("node:path");
 var sleep = (ms) => new Promise((resolve5) => setTimeout(resolve5, ms));
 async function atomicWrite(target, contents) {
   const tmp = `${target}.tmp-${process.pid}-${Math.random().toString(36).slice(2)}`;
@@ -19182,12 +19354,12 @@ function makeDeferredWorktreeStore(registryPath, lockOpts = {}) {
     },
     // Standalone atomic write — THROWS on failure (no best-effort swallow, #2846).
     write: async (entries) => {
-      await (0, import_promises3.mkdir)((0, import_node_path19.dirname)(registryPath), { recursive: true });
+      await (0, import_promises3.mkdir)((0, import_node_path18.dirname)(registryPath), { recursive: true });
       await atomicWrite(registryPath, serializeDeferredWorktrees(entries));
     },
     // Serialized read-modify-write under the repo-wide lock (#2846).
     update: async (mutate) => {
-      await (0, import_promises3.mkdir)((0, import_node_path19.dirname)(registryPath), { recursive: true });
+      await (0, import_promises3.mkdir)((0, import_node_path18.dirname)(registryPath), { recursive: true });
       const deadline = Date.now() + opts.maxWaitMs;
       for (; ; ) {
         const guard = await acquireLock(lockPath, opts, deadline);
@@ -19281,12 +19453,24 @@ async function deleteReviewedRemoteBranch(remote, branch, expectedHeadOid) {
   }
   return "deleted";
 }
-function assertPrMergeHousekeepingClean(startingPath, context) {
-  const housekeeping = buildPrMergeScratchHousekeeping(startingPath || process.cwd());
-  const scratchStatus = housekeeping.scratch?.status;
-  if (scratchStatus === "warnings" || scratchStatus === "failed") {
-    throw new Error(`${context} housekeeping blocked merge: scratch ${scratchStatus}; run mmi-cli gc --scratch --dry-run`);
-  }
+function evaluatePrMergeHousekeeping(report, context, force = false) {
+  const scratch = report.scratch;
+  const failed = scratch?.status === "failed";
+  const prunable = scratch?.safeAuto ?? 0;
+  const unprunable = scratch?.skipped ?? 0;
+  if (!(failed || prunable > 0 || unprunable > 0)) return { blocked: false };
+  if (force) return { blocked: false };
+  const detail = failed ? `scratch housekeeping failed${scratch?.error ? `: ${scratch.error}` : ""}` : `${prunable} prunable + ${unprunable} un-prunable scratch item(s) remain after cleanup`;
+  return {
+    blocked: true,
+    reason: `${context} housekeeping blocked merge: ${detail}. Run \`mmi-cli gc --scratch --apply\` to clear it, then retry \u2014 or re-run \`mmi-cli ${context} --force\` to acknowledge and land anyway. (Kept advisory plans/ scratch never blocks: it is gitignored and can never reach origin.)`
+  };
+}
+function assertPrMergeHousekeepingClean(startingPath, context, options = {}) {
+  const build = options.buildHousekeeping ?? ((repoRoot2) => buildPrMergeScratchHousekeeping(repoRoot2));
+  const housekeeping = build(startingPath || process.cwd());
+  const verdict = evaluatePrMergeHousekeeping(housekeeping, context, options.force);
+  if (verdict.blocked) throw new Error(verdict.reason);
   return housekeeping;
 }
 async function applyGcPlan(plan, remote) {
@@ -19297,16 +19481,21 @@ async function applyGcPlan(plan, remote) {
   const deferredStore = await createDeferredWorktreeStore();
   const branchTracking = await applyBranchAndTrackingCleanup(plan, {
     localBranchHeads,
-    cleanupBranch: (branch, expectedHeadOid) => cleanupPrMergeLocalBranch(branch.branch, {
-      beforeWorktrees,
-      startingPath: branch.worktreePath,
-      pathExists: (p) => (0, import_node_fs22.existsSync)(p),
-      execGit: async (args) => (await execFileP2("git", args, { timeout: GIT_TIMEOUT_MS })).stdout,
-      teardownWorktreeStage,
-      deferredStore,
-      expectedHeadOid,
-      removeWorktreeDir: worktreeRemoveDeps(async (args) => (await execFileP2("git", args, { timeout: GIT_TIMEOUT_MS })).stdout).removeWorktreeDir
-    }),
+    cleanupBranch: (branch, expectedHeadOid) => {
+      const wtDeps = worktreeRemoveDeps(async (args) => (await execFileP2("git", args, { timeout: GIT_TIMEOUT_MS })).stdout);
+      return cleanupPrMergeLocalBranch(branch.branch, {
+        beforeWorktrees,
+        startingPath: branch.worktreePath,
+        pathExists: (p) => (0, import_node_fs21.existsSync)(p),
+        execGit: async (args) => (await execFileP2("git", args, { timeout: GIT_TIMEOUT_MS })).stdout,
+        teardownWorktreeStage,
+        deferredStore,
+        expectedHeadOid,
+        detachReparsePoints: wtDeps.detachReparsePoints,
+        // #3064: junction-safe teardown
+        removeWorktreeDir: wtDeps.removeWorktreeDir
+      });
+    },
     cleanupRemoteBranch: (branch, expectedHeadOid) => deleteReviewedRemoteBranch(remote, branch.branch, expectedHeadOid),
     cleanupTrackingRefs: (trackingRefs, unsafeBranches) => applyTrackingRefCleanup(trackingRefs, remote, unsafeBranches, {
       execGit: async (args) => (await execFileP2("git", args, { timeout: GIT_TIMEOUT_MS })).stdout
@@ -19323,7 +19512,7 @@ async function applyGcPlan(plan, remote) {
   for (const wt of plan.worktreeDirs) {
     try {
       const cleanupTarget = resolveSafeSiblingWorktreeCleanupTarget(wt.path, siblingRoot, {
-        realpath: (path2) => (0, import_node_fs22.realpathSync)(path2)
+        realpath: (path2) => (0, import_node_fs21.realpathSync)(path2)
       });
       if (!cleanupTarget.ok) {
         result.failed.push(`${wt.path}: ${cleanupTarget.reason}`);
@@ -19436,7 +19625,7 @@ async function remoteBranchExists2(branch, options = {}) {
 }
 var COMPOSE_TIMEOUT_MS = 12e4;
 function spawnDeferredGcSweep() {
-  spawnDetachedSelf(["gc", "sweep-deferred", "--quiet"], { spawn: import_node_child_process11.spawn, execPath: process.execPath, scriptPath: process.argv[1] });
+  spawnDetachedSelf(["gc", "sweep-deferred", "--quiet"], { spawn: import_node_child_process10.spawn, execPath: process.execPath, scriptPath: process.argv[1] });
 }
 async function createDeferredWorktreeStore() {
   try {
@@ -19450,13 +19639,13 @@ var realWorktreeDirRemover = {
   probe: (p) => {
     let st;
     try {
-      st = (0, import_node_fs22.lstatSync)(p);
+      st = (0, import_node_fs21.lstatSync)(p);
     } catch {
       return null;
     }
     if (st.isSymbolicLink()) return "link";
     try {
-      (0, import_node_fs22.readlinkSync)(p);
+      (0, import_node_fs21.readlinkSync)(p);
       return "link";
     } catch {
     }
@@ -19464,7 +19653,7 @@ var realWorktreeDirRemover = {
   },
   readdir: (p) => {
     try {
-      return (0, import_node_fs22.readdirSync)(p);
+      return (0, import_node_fs21.readdirSync)(p);
     } catch {
       return [];
     }
@@ -19473,9 +19662,9 @@ var realWorktreeDirRemover = {
   // leaving the target); a file symlink with unlink. rmdir first, fall back to unlink.
   detachLink: (p) => {
     try {
-      (0, import_node_fs22.rmdirSync)(p);
+      (0, import_node_fs21.rmdirSync)(p);
     } catch {
-      (0, import_node_fs22.unlinkSync)(p);
+      (0, import_node_fs21.unlinkSync)(p);
     }
   },
   removeTree: (p) => (0, import_promises4.rm)(p, { recursive: true, force: true, maxRetries: 5, retryDelay: 200 })
@@ -19491,6 +19680,9 @@ function worktreeRemoveDeps(execGit) {
   return {
     git: execGit,
     sleep: (ms) => new Promise((resolve5) => setTimeout(resolve5, ms)),
+    // #3064: unlink any reparse point (esp. a `node_modules` junction to base) before the git-native
+    // `worktree remove --force`, which would otherwise recurse through it and empty the base checkout.
+    detachReparsePoints: (worktreePath) => detachReparsePoints(worktreePath, realWorktreeDirRemover),
     removeWorktreeDir: async (worktreePath) => removeWorktreeTree(worktreePath, await resolvePrimaryCheckout(execGit), realWorktreeDirRemover)
   };
 }
@@ -19505,9 +19697,9 @@ async function worktreeHasStageState(worktreePath) {
   }
 }
 function stageStateFileBelongsToWorktree(statePath, worktreePath) {
-  if (!(0, import_node_fs22.existsSync)(statePath)) return false;
+  if (!(0, import_node_fs21.existsSync)(statePath)) return false;
   try {
-    const state = JSON.parse((0, import_node_fs22.readFileSync)(statePath, "utf8"));
+    const state = JSON.parse((0, import_node_fs21.readFileSync)(statePath, "utf8"));
     const recordedCwd = typeof state.identity?.cwd === "string" ? state.identity.cwd : typeof state.cwd === "string" ? state.cwd : "";
     return Boolean(recordedCwd && isPathUnderDirectory(recordedCwd, worktreePath));
   } catch {
@@ -19635,9 +19827,8 @@ async function fetchRestCorePool(gh = defaultGhApi) {
 }
 
 // src/worktree-lifecycle-commands.ts
-var import_node_fs23 = require("node:fs");
-var import_promises5 = require("node:fs/promises");
-var import_node_path20 = require("node:path");
+var import_node_fs22 = require("node:fs");
+var import_node_path19 = require("node:path");
 var GH_TIMEOUT_MS = 2e4;
 var DEFAULT_BASE = "origin/development";
 var DEFAULT_REMOTE = "origin";
@@ -19775,13 +19966,13 @@ function registerWorktreeCommands(program3) {
       if (PROTECTED_BRANCHES2.has(branch)) {
         return fail(`worktree land: refusing to land protected branch '${branch}'`, { code: ERROR_CODES.ERR_BAD_ENUM });
       }
-      const gitFile = (0, import_node_path20.join)(wtPath, ".git");
-      const isLinked = (0, import_node_fs23.existsSync)(gitFile) && (0, import_node_fs23.statSync)(gitFile).isFile();
+      const gitFile = (0, import_node_path19.join)(wtPath, ".git");
+      const isLinked = (0, import_node_fs22.existsSync)(gitFile) && (0, import_node_fs22.statSync)(gitFile).isFile();
       if (apply && !isLinked) {
         return fail("worktree land: run from inside the linked worktree you want to land (this is the primary checkout)");
       }
       const commonDir = (await execFileP2("git", ["rev-parse", "--git-common-dir"], { timeout: GIT_TIMEOUT_MS }).catch(() => ({ stdout: "" }))).stdout.trim();
-      const primaryCheckout = commonDir ? (0, import_node_path20.dirname)(commonDir) : wtPath;
+      const primaryCheckout = commonDir ? (0, import_node_path19.dirname)(commonDir) : wtPath;
       const stageSummary = readStageSummary(wtPath);
       const hasStage = stageSummary != null;
       const steps = landSteps(branch, true, hasStage);
@@ -19817,11 +20008,10 @@ function registerWorktreeCommands(program3) {
         }
       }
       releaseCwdIfUnderWorktree(wtPath, primaryCheckout);
-      const removeOutcome = await removeWorktreeWithRecovery(wtPath, {
-        git: async (args) => (await execFileP2("git", ["-C", primaryCheckout, ...args], { timeout: GIT_TIMEOUT_MS })).stdout,
-        sleep: (ms) => new Promise((resolve5) => setTimeout(resolve5, ms)),
-        removeWorktreeDir: (p) => (0, import_promises5.rm)(p, { recursive: true, force: true, maxRetries: 5, retryDelay: 200 })
-      });
+      const removeOutcome = await removeWorktreeWithRecovery(
+        wtPath,
+        worktreeRemoveDeps(async (args) => (await execFileP2("git", ["-C", primaryCheckout, ...args], { timeout: GIT_TIMEOUT_MS })).stdout)
+      );
       report.push({
         step: "remove worktree",
         status: removeOutcome.status === "removed" ? removeOutcome.recovery ? `done (${removeOutcome.recovery})` : "done" : `failed: ${removeOutcome.error ?? "lock held"} \u2014 run: git -C "${primaryCheckout}" worktree remove --force "${wtPath}"`
@@ -19894,10 +20084,10 @@ async function gatherWorktreeContext() {
   }
   const orphanDirs = [];
   const wtRoot = siblingMmiWorktreesRoot(repoRoot2);
-  if ((0, import_node_fs23.existsSync)(wtRoot)) {
+  if ((0, import_node_fs22.existsSync)(wtRoot)) {
     let entries = [];
     try {
-      entries = (0, import_node_fs23.readdirSync)(wtRoot, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => (0, import_node_path20.join)(wtRoot, e.name));
+      entries = (0, import_node_fs22.readdirSync)(wtRoot, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => (0, import_node_path19.join)(wtRoot, e.name));
     } catch {
     }
     const known = new Set(worktrees.map((w) => w.path));
@@ -19922,8 +20112,8 @@ async function bestEffortGit(args, cwd, step, timeoutMs = GIT_TIMEOUT_MS) {
 }
 
 // src/issue-commands.ts
-var import_node_fs24 = require("node:fs");
-var import_node_crypto6 = require("node:crypto");
+var import_node_fs23 = require("node:fs");
+var import_node_crypto5 = require("node:crypto");
 var ghRunner = async (args, timeoutMs) => (await execFileP2("gh", args, { timeout: timeoutMs })).stdout;
 async function editIssue(client, options, deps = {}) {
   const parsed = parseIssueRef(options.ref);
@@ -19937,7 +20127,7 @@ async function editIssue(client, options, deps = {}) {
   if (options.body !== void 0 || options.bodyFile !== void 0) {
     let body;
     if (options.bodyFile) {
-      const td = deps.textDeps ?? { readFile: (p, e) => Promise.resolve((0, import_node_fs24.readFileSync)(p, e)), readStdin: () => Promise.resolve("") };
+      const td = deps.textDeps ?? { readFile: (p, e) => Promise.resolve((0, import_node_fs23.readFileSync)(p, e)), readStdin: () => Promise.resolve("") };
       body = await resolveIssueBody({ body: options.body, bodyFile: options.bodyFile }, td);
     } else {
       body = options.body ?? "";
@@ -20172,7 +20362,7 @@ function rowIdempotencyKey(batchKey, spec) {
   const identity = `${spec.type}
 ${spec.title.trim()}
 ${spec.body ?? ""}`;
-  const hash = (0, import_node_crypto6.createHash)("sha256").update(identity).digest("hex").slice(0, 16);
+  const hash = (0, import_node_crypto5.createHash)("sha256").update(identity).digest("hex").slice(0, 16);
   return `${batchKey}:${hash}`;
 }
 var BATCH_SPEC_KEYS = /* @__PURE__ */ new Set(["type", "title", "body", "priority", "labels", "northStar", "parent", "repo"]);
@@ -20464,7 +20654,7 @@ function extendCreateCommand(issue2) {
     if (opts.batch) {
       let specs;
       try {
-        const raw = (0, import_node_fs24.readFileSync)(opts.batch, "utf8");
+        const raw = (0, import_node_fs23.readFileSync)(opts.batch, "utf8");
         specs = JSON.parse(raw);
         if (!Array.isArray(specs)) throw new Error("batch file must contain a JSON array");
       } catch (e) {
@@ -20508,13 +20698,13 @@ ${lines}`);
 }
 
 // src/train-commands.ts
-var import_node_fs26 = require("node:fs");
-var import_node_path22 = require("node:path");
-
-// src/plugin-guard-io.ts
 var import_node_fs25 = require("node:fs");
 var import_node_path21 = require("node:path");
-var import_node_os7 = require("node:os");
+
+// src/plugin-guard-io.ts
+var import_node_fs24 = require("node:fs");
+var import_node_path20 = require("node:path");
+var import_node_os6 = require("node:os");
 
 // src/plugin-guard.ts
 function buildPluginGuardDecision(i) {
@@ -20641,13 +20831,13 @@ var NPM_VIEW_TIMEOUT_MS = 15e3;
 function runHostBin(bin, args, opts) {
   return isWin ? execFileP2("cmd.exe", ["/c", bin, ...args], opts) : execFileP2(bin, args, opts);
 }
-var installedPluginsPath = (surface = detectSurface(process.env)) => {
+var installedPluginsPath2 = (surface = detectSurface(process.env)) => {
   const homeDir = surface === "codex" ? ".codex" : ".claude";
-  return (0, import_node_path21.join)((0, import_node_os7.homedir)(), homeDir, "plugins", "installed_plugins.json");
+  return (0, import_node_path20.join)((0, import_node_os6.homedir)(), homeDir, "plugins", "installed_plugins.json");
 };
 function readInstalledPlugins(surface = detectSurface(process.env)) {
   try {
-    return JSON.parse((0, import_node_fs25.readFileSync)(installedPluginsPath(surface), "utf8"));
+    return JSON.parse((0, import_node_fs24.readFileSync)(installedPluginsPath2(surface), "utf8"));
   } catch {
     return null;
   }
@@ -20655,13 +20845,13 @@ function readInstalledPlugins(surface = detectSurface(process.env)) {
 function marketplaceCloneCandidates(surface, home) {
   if (surface === "codex") {
     return [
-      (0, import_node_path21.join)(home, ".codex", ".tmp", "marketplaces", "mutmutco"),
-      (0, import_node_path21.join)(home, ".codex", "plugins", "marketplaces", "mutmutco")
+      (0, import_node_path20.join)(home, ".codex", ".tmp", "marketplaces", "mutmutco"),
+      (0, import_node_path20.join)(home, ".codex", "plugins", "marketplaces", "mutmutco")
     ];
   }
-  return [(0, import_node_path21.join)(home, ".claude", "plugins", "marketplaces", "mutmutco")];
+  return [(0, import_node_path20.join)(home, ".claude", "plugins", "marketplaces", "mutmutco")];
 }
-function marketplaceClonePresent(surface, home, exists = import_node_fs25.existsSync) {
+function marketplaceClonePresent(surface, home, exists = import_node_fs24.existsSync) {
   return marketplaceCloneCandidates(surface, home).some(exists);
 }
 async function fetchNpmReleasedVersion() {
@@ -20678,8 +20868,8 @@ function snapshotPluginGuardInput(surface = detectSurface(process.env), isOrgRep
   return {
     isOrgRepo,
     installRecordPresent: hasUserInstallRecord(installed, MMI_PLUGIN_ID) || hasProjectInstallRecord(installed, MMI_PLUGIN_ID, process.cwd()),
-    marketplaceClonePresent: marketplaceClonePresent(surface, (0, import_node_os7.homedir)()),
-    pluginCachePresent: (0, import_node_fs25.existsSync)((0, import_node_path21.join)((0, import_node_os7.homedir)(), homeDir, "plugins", "cache", "mutmutco", "mmi"))
+    marketplaceClonePresent: marketplaceClonePresent(surface, (0, import_node_os6.homedir)()),
+    pluginCachePresent: (0, import_node_fs24.existsSync)((0, import_node_path20.join)((0, import_node_os6.homedir)(), homeDir, "plugins", "cache", "mutmutco", "mmi"))
   };
 }
 function claudePluginGuardState(isOrgRepo) {
@@ -20804,7 +20994,7 @@ function formatTrainStatus(r) {
 // src/train-commands.ts
 function readRepoVersion() {
   try {
-    return JSON.parse((0, import_node_fs26.readFileSync)((0, import_node_path22.join)(process.cwd(), ".claude-plugin", "plugin.json"), "utf8")).version || void 0;
+    return JSON.parse((0, import_node_fs25.readFileSync)((0, import_node_path21.join)(process.cwd(), ".claude-plugin", "plugin.json"), "utf8")).version || void 0;
   } catch {
     return void 0;
   }
@@ -21280,7 +21470,7 @@ function registerExplainCommand(program3) {
 }
 
 // src/pr-commands.ts
-var import_promises6 = require("node:fs/promises");
+var import_promises5 = require("node:fs/promises");
 var GC_GH_TIMEOUT_MS4 = 2e4;
 var CHECKS_WATCH_POLL_MS = 15e3;
 var CHECKS_WATCH_TIMEOUT_MS = 10 * 6e4;
@@ -21424,10 +21614,10 @@ function registerPrLifecycleCommands(program3) {
     let body;
     try {
       if (o.title || o.titleFile) {
-        title = await resolveIssueTitle({ title: o.title, titleFile: o.titleFile }, { readFile: import_promises6.readFile, readStdin });
+        title = await resolveIssueTitle({ title: o.title, titleFile: o.titleFile }, { readFile: import_promises5.readFile, readStdin });
       }
       if (o.body || o.bodyFile) {
-        body = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises6.readFile, readStdin });
+        body = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises5.readFile, readStdin });
       }
     } catch (e) {
       return fail(`pr edit: ${e.message}`);
@@ -21457,7 +21647,7 @@ function registerPrLifecycleCommands(program3) {
     }
     let body;
     try {
-      body = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises6.readFile, readStdin });
+      body = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises5.readFile, readStdin });
     } catch (e) {
       return fail(`pr comment: ${e.message}`);
     }
@@ -21945,9 +22135,10 @@ function checkCliVersion(input) {
 function checkPluginCache(input) {
   const evidence = [
     `cached versions: ${input.cached}`,
-    `stale: ${input.stale.length ? input.stale.join(", ") : "(none)"}`
+    `stale: ${input.stale.length ? input.stale.join(", ") : "(none)"}`,
+    `orphaned staging dirs: ${input.staging.length ? input.staging.join(", ") : "(none)"}`
   ];
-  if (input.stale.length === 0) {
+  if (input.stale.length === 0 && input.staging.length === 0) {
     return {
       ok: true,
       label: "plugin cache",
@@ -21955,11 +22146,21 @@ function checkPluginCache(input) {
       verbose: evidence
     };
   }
-  const size = input.bytes > 0 ? `, ${(input.bytes / 1e6).toFixed(1)} MB` : "";
+  const parts = [];
+  if (input.stale.length) {
+    const size = input.bytes > 0 ? `, ${(input.bytes / 1e6).toFixed(1)} MB` : "";
+    parts.push(`${input.stale.length} stale${size}`);
+  }
+  if (input.staging.length) {
+    const size = input.stagingBytes > 0 ? `, ${(input.stagingBytes / 1e6).toFixed(1)} MB` : "";
+    parts.push(`${input.staging.length} orphaned staging dir(s)${size}`);
+  }
   return {
     ok: false,
     label: "plugin cache",
-    detail: `${input.cached} versions cached (${input.stale.length} stale${size})`,
+    // Lead with the versioned-cache framing when there are stale versions; otherwise report the staging litter
+    // on its own so a cache with zero versioned dirs still gets an honest ✗.
+    detail: input.stale.length ? `${input.cached} versions cached (${parts.join("; ")})` : parts.join("; "),
     fix: "run `mmi-cli plugin-prune` to review, then `mmi-cli plugin-prune --apply` to delete",
     verbose: evidence
   };
@@ -21999,12 +22200,27 @@ function checkSchedules(probe) {
       ok: false,
       label: "schedules",
       detail: `${probe.drift.length} drift finding(s)`,
-      fix: "run `mmi-cli schedules` \u2014 something dead is still registered; fix it in the owning repo",
+      fix: "run `mmi-cli schedules` \u2014 file/registry/live disagree; each drift line names its per-class remedy, applied in the owning repo",
       verbose: evidence
     };
   }
   return { ok: true, label: "schedules", detail: `${probe.armed} armed`, verbose: evidence };
 }
+function checkDocsAudit(probe) {
+  if (!probe) return null;
+  if (!probe.armed) {
+    return { ok: true, label: "docs-audit", detail: "janitor not armed", verbose: [probe.detail] };
+  }
+  if (!probe.ok) {
+    return {
+      ok: false,
+      label: "docs-audit",
+      fix: `${probe.detail} \u2014 re-run the janitor in the owning repo or re-arm its schedule (the remedy never lives in this doctor)`,
+      verbose: [probe.detail]
+    };
+  }
+  return { ok: true, label: "docs-audit", detail: probe.detail, verbose: [probe.detail] };
+}
 function planGitignore(current) {
   const { content, changed } = upsertManagedGitignoreBlock(current);
   return changed ? { ok: false, content } : { ok: true };
@@ -22063,6 +22279,15 @@ async function runDoctorClean(opts, io, deps) {
     const sched = checkSchedules(probe);
     if (sched) checks.push(sched);
   }
+  if (!opts.fast && !opts.banner && !opts.preflight && deps.docsAudit) {
+    const probe = await deps.docsAudit().catch((e) => ({
+      armed: true,
+      ok: false,
+      detail: `docs-audit probe failed \u2014 ${e.message}`
+    }));
+    const docsAudit2 = checkDocsAudit(probe);
+    if (docsAudit2) checks.push(docsAudit2);
+  }
   if (isOrgRepo && !opts.fast && !opts.banner) {
     try {
       checks.push(checkTrainSync(await deps.syncTrain()));
@@ -22147,17 +22372,17 @@ async function runDoctorClean(opts, io, deps) {
 }
 
 // src/doctor-io.ts
-var import_node_fs27 = require("node:fs");
-var import_node_os8 = require("node:os");
-var import_node_path23 = require("node:path");
-var import_node_child_process12 = require("node:child_process");
+var import_node_fs26 = require("node:fs");
+var import_node_os7 = require("node:os");
+var import_node_path22 = require("node:path");
+var import_node_child_process11 = require("node:child_process");
 var import_node_util8 = require("node:util");
-var execFileP6 = (0, import_node_util8.promisify)(import_node_child_process12.execFile);
+var execFileP6 = (0, import_node_util8.promisify)(import_node_child_process11.execFile);
 var MMI_PLUGIN_ID2 = "mmi@mutmutco";
 function installedClaudePluginVersion() {
   try {
     const file = JSON.parse(
-      (0, import_node_fs27.readFileSync)((0, import_node_path23.join)((0, import_node_os8.homedir)(), ".claude", "plugins", "installed_plugins.json"), "utf8")
+      (0, import_node_fs26.readFileSync)((0, import_node_path22.join)((0, import_node_os7.homedir)(), ".claude", "plugins", "installed_plugins.json"), "utf8")
     );
     const versions = (file.plugins?.[MMI_PLUGIN_ID2] ?? []).map((r) => r.version).filter((v) => Boolean(v));
     if (versions.length === 0) return void 0;
@@ -22168,7 +22393,7 @@ function installedClaudePluginVersion() {
 }
 function worktreeRootSync() {
   try {
-    const out = (0, import_node_child_process12.execFileSync)("git", ["rev-parse", "--show-toplevel"], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
+    const out = (0, import_node_child_process11.execFileSync)("git", ["rev-parse", "--show-toplevel"], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
     let root = out.endsWith("\n") ? out.slice(0, -1) : out;
     if (process.platform === "win32" && root.endsWith("\r")) root = root.slice(0, -1);
     return root || null;
@@ -22178,13 +22403,13 @@ function worktreeRootSync() {
 }
 var gitignorePath = () => {
   const root = worktreeRootSync();
-  return root === null ? null : (0, import_node_path23.join)(root, ".gitignore");
+  return root === null ? null : (0, import_node_path22.join)(root, ".gitignore");
 };
 function readGitignore() {
   const path2 = gitignorePath();
   if (path2 === null) return null;
   try {
-    return (0, import_node_fs27.readFileSync)(path2, "utf8");
+    return (0, import_node_fs26.readFileSync)(path2, "utf8");
   } catch {
     return null;
   }
@@ -22193,7 +22418,7 @@ function writeGitignore(content) {
   const path2 = gitignorePath();
   if (path2 === null) return false;
   try {
-    (0, import_node_fs27.writeFileSync)(path2, content, "utf8");
+    (0, import_node_fs26.writeFileSync)(path2, content, "utf8");
     return true;
   } catch {
     return false;
@@ -22217,11 +22442,27 @@ async function repoRoot() {
 }
 function hasRepoLocalWorktrees() {
   const root = worktreeRootSync();
-  return root !== null && (0, import_node_fs27.existsSync)((0, import_node_path23.join)(root, ".worktrees"));
+  return root !== null && (0, import_node_fs26.existsSync)((0, import_node_path22.join)(root, ".worktrees"));
 }
 
 // src/index.ts
 var execFileGitRun = async (file, args) => (await execFileP2(file, args, { timeout: GIT_TIMEOUT_MS })).stdout;
+async function currentRepoFullName() {
+  const remote = (await gitOut(["remote", "get-url", "origin"])).replace(/\.git$/, "");
+  const parts = remote.split(/[:/]/).filter(Boolean);
+  if (parts.length >= 2) return `${parts[parts.length - 2]}/${parts[parts.length - 1]}`;
+  return `mutmutco/${await repoSlug()}`;
+}
+async function readDocsAuditFetch(repo) {
+  const list = await fetchDocsAuditList(registryClientDeps(await loadConfig()));
+  if ("notArmed" in list) return { notArmed: true };
+  if (!list.ok) return { ok: false, error: list.error };
+  const row = list.rows.find((r) => r.repo === repo);
+  return {
+    ok: true,
+    verdict: row ? { repo: row.repo, date: row.date, shaRange: row.shaRange, outcome: row.outcome, checkerVendor: row.checkerVendor } : null
+  };
+}
 function mmiDoctorDeps() {
   return {
     githubLogin,
@@ -22265,12 +22506,18 @@ function mmiDoctorDeps() {
       return { personal, app };
     },
     pluginCache: () => {
-      const plan = buildPluginCachePlan((0, import_node_os9.homedir)(), runningPluginVersion(process.env, resolveClientVersion()), {
-        exists: (p) => (0, import_node_fs28.existsSync)(p),
-        listVersionDirs: (root) => (0, import_node_fs28.readdirSync)(root, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name),
-        dirBytes: () => 0
-      });
-      return { stale: plan.prune, bytes: plan.bytes, cached: plan.keep.length + plan.prune.length };
+      const plan = buildPluginCachePlan(
+        (0, import_node_os8.homedir)(),
+        runningPluginVersion(process.env, resolveClientVersion()),
+        pluginCacheFsDeps((0, import_node_os8.homedir)(), () => 0)
+      );
+      return {
+        stale: plan.prune,
+        bytes: plan.bytes,
+        cached: plan.keep.length + plan.prune.length,
+        staging: plan.staging.map((s) => s.name),
+        stagingBytes: plan.stagingBytes
+      };
     },
     // #3008: the schedules-notebook drift probe, compacted for the check. Full doctor only — the gather in
     // runDoctorClean skips this dep entirely on fast/banner/preflight runs.
@@ -22283,6 +22530,15 @@ function mmiDoctorDeps() {
         incomplete,
         drift
       };
+    },
+    // #3075: the docs-audit dead-man verdict probe, compacted for the check. Full doctor only, exactly like
+    // schedulesNotebook — a registry read the SessionStart banner / --preflight / --fast lanes never pay for.
+    // The 404/absent route maps to `armed:false` (an informational "not armed" line), never a false RED.
+    docsAudit: async () => {
+      const repo = await currentRepoFullName();
+      const today = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
+      const status = docsAuditStatus(await readDocsAuditFetch(repo), { repo, today });
+      return { armed: status.state !== "not-armed", ok: status.ok, detail: status.line };
     }
   };
 }
@@ -22357,19 +22613,19 @@ program2.hook("preAction", async (_thisCommand, actionCommand) => {
 });
 var rules = program2.command("rules").description("org-managed .gitignore delivery");
 rules.command("gitignore").option("--write", "upsert the managed block into .gitignore (default: check only, non-zero exit on drift)").option("--json", "machine-readable output").description("verify (or --write) this repo's org-managed .gitignore block matches the SSOT").action((opts) => {
-  const path2 = (0, import_node_path24.join)(process.cwd(), ".gitignore");
-  const current = (0, import_node_fs28.existsSync)(path2) ? (0, import_node_fs28.readFileSync)(path2, "utf8") : null;
+  const path2 = (0, import_node_path23.join)(process.cwd(), ".gitignore");
+  const current = (0, import_node_fs27.existsSync)(path2) ? (0, import_node_fs27.readFileSync)(path2, "utf8") : null;
   const plan = planManagedGitignore(current);
   const drift = [...plan.added.map((l) => `+${l}`), ...plan.removed.map((l) => `-${l}`)].join(", ") || "block normalize";
   if (opts.json) {
-    if (opts.write && plan.changed) (0, import_node_fs28.writeFileSync)(path2, plan.content, "utf8");
+    if (opts.write && plan.changed) (0, import_node_fs27.writeFileSync)(path2, plan.content, "utf8");
     console.log(JSON.stringify(plan, null, 2));
     if (!opts.write && plan.changed) process.exitCode = 1;
     return;
   }
   if (opts.write) {
     if (plan.changed) {
-      (0, import_node_fs28.writeFileSync)(path2, plan.content, "utf8");
+      (0, import_node_fs27.writeFileSync)(path2, plan.content, "utf8");
       console.log(`mmi-cli rules gitignore: updated .gitignore (${drift})`);
     } else {
       console.log("mmi-cli rules gitignore: up to date");
@@ -22523,7 +22779,7 @@ function runWorktreeInstall(command, cwd, quiet) {
   const file = isWin2 ? "cmd.exe" : bin;
   const spawnArgs = isWin2 ? ["/c", bin, ...args] : args;
   return new Promise((resolve5, reject) => {
-    const child = (0, import_node_child_process13.spawn)(file, spawnArgs, { cwd, stdio: quiet ? "ignore" : "inherit", windowsHide: true });
+    const child = (0, import_node_child_process12.spawn)(file, spawnArgs, { cwd, stdio: quiet ? "ignore" : "inherit", windowsHide: true });
     const timer = setTimeout(() => {
       try {
         child.kill();
@@ -22545,7 +22801,7 @@ function runWorktreeInstall(command, cwd, quiet) {
 async function primaryCheckoutRoot(worktreeRoot) {
   try {
     const out = (await execFileP2("git", ["-C", worktreeRoot, "rev-parse", "--path-format=absolute", "--git-common-dir"], { timeout: GIT_TIMEOUT_MS })).stdout.trim();
-    return out ? (0, import_node_path24.dirname)(out) : void 0;
+    return out ? (0, import_node_path23.dirname)(out) : void 0;
   } catch {
     return void 0;
   }
@@ -22560,26 +22816,26 @@ function makeProvisionDeps(worktreeRoot, quiet, log) {
 function acquireWorktreeSetupLock(worktreeRoot) {
   const lockPath = repoRuntimeStatePath(worktreeRoot, "worktree-setup.lock");
   const take = () => {
-    const fd = (0, import_node_fs28.openSync)(lockPath, "wx");
+    const fd = (0, import_node_fs27.openSync)(lockPath, "wx");
     try {
-      (0, import_node_fs28.writeSync)(fd, String(Date.now()));
+      (0, import_node_fs27.writeSync)(fd, String(Date.now()));
     } finally {
-      (0, import_node_fs28.closeSync)(fd);
+      (0, import_node_fs27.closeSync)(fd);
     }
     return () => {
       try {
-        (0, import_node_fs28.rmSync)(lockPath, { force: true });
+        (0, import_node_fs27.rmSync)(lockPath, { force: true });
       } catch {
       }
     };
   };
   try {
-    (0, import_node_fs28.mkdirSync)((0, import_node_path24.dirname)(lockPath), { recursive: true });
+    (0, import_node_fs27.mkdirSync)((0, import_node_path23.dirname)(lockPath), { recursive: true });
     return take();
   } catch {
     try {
-      if (Date.now() - (0, import_node_fs28.statSync)(lockPath).mtimeMs > WORKTREE_SETUP_LOCK_TTL_MS) {
-        (0, import_node_fs28.rmSync)(lockPath, { force: true });
+      if (Date.now() - (0, import_node_fs27.statSync)(lockPath).mtimeMs > WORKTREE_SETUP_LOCK_TTL_MS) {
+        (0, import_node_fs27.rmSync)(lockPath, { force: true });
         return take();
       }
     } catch {
@@ -22759,7 +23015,7 @@ function scheduleRelatedDiscovery(o) {
   try {
     const args = ["issue", "discover-related", "--number", String(o.number), "--title", o.title, "--body", o.body, "--fail-soft"];
     if (o.repo) args.push("--repo", o.repo);
-    spawnDetachedSelf(args, { spawn: import_node_child_process13.spawn, execPath: process.execPath, scriptPath: process.argv[1] }, { cwd: process.cwd() });
+    spawnDetachedSelf(args, { spawn: import_node_child_process12.spawn, execPath: process.execPath, scriptPath: process.argv[1] }, { cwd: process.cwd() });
   } catch {
   }
 }
@@ -22767,6 +23023,50 @@ registerSecretsCommands(program2);
 registerEdgeCommands(program2);
 registerBoxCommands(program2);
 registerSchedulesCommands(program2);
+var docs = program2.command("docs").description("generated docs surfaces \u2014 the routing index (org knowledge layer)");
+docs.command("index").description("regenerate docs/index.md from the docs/ tree (--write, the default) or fail on drift (--check) \u2014 the generated routing index, never hand-maintained").option("--check", "compare against the committed docs/index.md and exit 1 on drift; never write").option("--write", "regenerate docs/index.md when it has drifted (the default)").action(async (o) => {
+  try {
+    const root = await repoRoot();
+    const result = docsIndex(createDocsIndexDeps(root), { check: Boolean(o.check) });
+    if (o.check) {
+      if (result.drift) {
+        return failGraceful(`docs index: ${DOCS_INDEX_PATH} is stale \u2014 run \`mmi-cli docs index --write\` and commit the result`);
+      }
+      console.log(`docs index: ${DOCS_INDEX_PATH} is current`);
+      return;
+    }
+    console.log(result.wrote ? `docs index: wrote ${DOCS_INDEX_PATH}` : `docs index: ${DOCS_INDEX_PATH} already current`);
+  } catch (e) {
+    await failGraceful(e.message);
+  }
+});
+var docsAudit = program2.command("docs-audit").description("the docs janitor verdict ledger \u2014 record a dated run verdict, or read the dead-man status back");
+docsAudit.command("record").description("write a dated janitor verdict for one repo to the registry ledger (master-only server-side)").option("--repo <owner/name>", "the repo the verdict is for (default: the current repo)").option("--date <YYYY-MM-DD>", "the ISO day the run examined (default: today)").requiredOption("--sha-range <a..b>", "the git range the janitor read (e.g. <lastVerdictSha>..HEAD)").requiredOption("--outcome <kind>", "clean | refreshed | failed").option("--count <n>", "docs refreshed (required when --outcome refreshed)").option("--reason <text>", "why the run failed (required when --outcome failed)").requiredOption("--checker-vendor <vendor>", "which vendor's model actually ran the check").action(async (o) => {
+  try {
+    const repo = o.repo ?? await currentRepoFullName();
+    const date = o.date ?? (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
+    let outcome;
+    if (o.outcome === "clean") outcome = { kind: "clean" };
+    else if (o.outcome === "refreshed") outcome = { kind: "refreshed", count: Number(o.count) };
+    else if (o.outcome === "failed") outcome = { kind: "failed", reason: o.reason ?? "" };
+    else return failGraceful(`docs-audit record: --outcome must be clean|refreshed|failed, got "${o.outcome}"`);
+    const verdict = docsAuditRecord({ repo, date, shaRange: o.shaRange, outcome, checkerVendor: o.checkerVendor });
+    await reportWrite("docs-audit record", await recordDocsAudit(verdict, registryClientDeps(await loadConfig())));
+  } catch (e) {
+    await failGraceful(e.message);
+  }
+});
+docsAudit.command("status").description("read the janitor dead-man verdict back for one repo \u2014 missing/stale/failed is RED; a not-yet-armed registry route is an informational exit 0").option("--repo <owner/name>", "the repo to check (default: the current repo)").action(async (o) => {
+  try {
+    const repo = o.repo ?? await currentRepoFullName();
+    const today = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
+    const result = docsAuditStatus(await readDocsAuditFetch(repo), { repo, today });
+    console.log(result.line);
+    if (!result.ok) process.exitCode = 1;
+  } catch (e) {
+    await failGraceful(e.message);
+  }
+});
 async function reportWrite(label, res) {
   if (res.ok) {
     console.log(JSON.stringify(res.body));
@@ -23104,7 +23404,7 @@ project.command("set [owner/repo]").description("upsert project META (idempotent
   if (dupe) return fail(`project set: KEY "${dupe}" was passed to both --var and --set; --set is an alias of --var, so pass each KEY once`);
   if (o.secretsFile) {
     try {
-      vars.push(`secrets=${(0, import_node_fs28.readFileSync)(o.secretsFile, "utf8")}`);
+      vars.push(`secrets=${(0, import_node_fs27.readFileSync)(o.secretsFile, "utf8")}`);
     } catch (e) {
       return fail(`project set: cannot read --secrets-file ${o.secretsFile}: ${e.message}`);
     }
@@ -23400,8 +23700,8 @@ withExamples(mutating(
   let extraLabels = [];
   try {
     issueType = resolveCreateType(o.type, "issue create");
-    title = await resolveIssueTitle({ title: o.title, titleFile: o.titleFile }, { readFile: import_promises7.readFile, readStdin });
-    body = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises7.readFile, readStdin });
+    title = await resolveIssueTitle({ title: o.title, titleFile: o.titleFile }, { readFile: import_promises6.readFile, readStdin });
+    body = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises6.readFile, readStdin });
     if (o.northStar !== void 0) {
       northStarSlug = normalizeNorthStarSlug(o.northStar);
       body = appendNorthStarLine(body, northStarSlug);
@@ -23546,7 +23846,7 @@ issue.command("comment <ref>").description("post a Markdown comment to an issue
   }
   let body;
   try {
-    body = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises7.readFile, readStdin });
+    body = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises6.readFile, readStdin });
   } catch (e) {
     return fail(`issue comment: ${e.message}`);
   }
@@ -23606,8 +23906,8 @@ program2.command("report").description("file a friction report on the Hub board
   let title;
   const sourceRepo = o.repo ?? await resolveRepo(void 0);
   try {
-    title = await resolveIssueTitle({ title: o.title, titleFile: o.titleFile }, { readFile: import_promises7.readFile, readStdin });
-    body = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises7.readFile, readStdin });
+    title = await resolveIssueTitle({ title: o.title, titleFile: o.titleFile }, { readFile: import_promises6.readFile, readStdin });
+    body = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises6.readFile, readStdin });
     priority = resolveCreatePriority(o.priority, "report");
     if (!ISSUE_TYPES.includes(o.type)) {
       throw new Error(`unknown issue type "${o.type}" \u2014 expected one of: ${ISSUE_TYPES.join(", ")}`);
@@ -23656,8 +23956,8 @@ program2.command("skill-lesson").description("file a skill-lesson on the Hub boa
   let args;
   try {
     skill = assertSkillName(o.skill);
-    rawBody = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises7.readFile, readStdin });
-    const rawTitle = await resolveIssueTitle({ title: o.title, titleFile: o.titleFile }, { readFile: import_promises7.readFile, readStdin });
+    rawBody = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises6.readFile, readStdin });
+    const rawTitle = await resolveIssueTitle({ title: o.title, titleFile: o.titleFile }, { readFile: import_promises6.readFile, readStdin });
     title = buildSkillLessonTitle(skill, rawTitle);
     priority = resolveCreatePriority(o.priority, "skill-lesson");
     body = buildSkillLessonBody(rawBody, sourceRepo, pluginSha);
@@ -23708,11 +24008,12 @@ withExamples(pr.command("create").description("create a PR and print {number,url
   let body;
   let title;
   try {
-    title = await resolveIssueTitle({ title: o.title, titleFile: o.titleFile }, { readFile: import_promises7.readFile, readStdin });
-    body = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises7.readFile, readStdin });
+    title = await resolveIssueTitle({ title: o.title, titleFile: o.titleFile }, { readFile: import_promises6.readFile, readStdin });
+    body = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises6.readFile, readStdin });
   } catch (e) {
     return fail(`pr create: ${e.message}`, e instanceof TextArgError ? { code: e.code, offending_flag: e.offendingFlag } : void 0);
   }
+  body = normalizeClosingDirectives(body);
   const created = await ghCreate(buildPrArgs({ title, body, base: o.base, head: o.head, repo: o.repo, draft: o.draft }));
   console.log(JSON.stringify(created));
 }), [
@@ -23743,11 +24044,11 @@ pr.command("view <number>").description("read a PR as structured JSON (merged st
   }
 });
 async function listCiWorkflowPaths(cwd = process.cwd()) {
-  const wfDir = (0, import_node_path24.join)(cwd, ".github", "workflows");
-  if (!(0, import_node_fs28.existsSync)(wfDir)) return [];
-  return (0, import_node_fs28.readdirSync)(wfDir).filter((name) => /\.(ya?ml)$/i.test(name)).filter((name) => {
+  const wfDir = (0, import_node_path23.join)(cwd, ".github", "workflows");
+  if (!(0, import_node_fs27.existsSync)(wfDir)) return [];
+  return (0, import_node_fs27.readdirSync)(wfDir).filter((name) => /\.(ya?ml)$/i.test(name)).filter((name) => {
     try {
-      return workflowReportsPrChecks((0, import_node_fs28.readFileSync)((0, import_node_path24.join)(wfDir, name), "utf8"));
+      return workflowReportsPrChecks((0, import_node_fs27.readFileSync)((0, import_node_path23.join)(wfDir, name), "utf8"));
     } catch {
       return true;
     }
@@ -23774,16 +24075,16 @@ function ciAuditDeps() {
     // gate re-seed step is skipped gracefully rather than failing mid-run.
     readSeedFile: (path2) => {
       if (!root) return null;
-      const fullPath = (0, import_node_path24.join)(root, path2);
-      return (0, import_node_fs28.existsSync)(fullPath) ? (0, import_node_fs28.readFileSync)(fullPath, "utf8") : null;
+      const fullPath = (0, import_node_path23.join)(root, path2);
+      return (0, import_node_fs27.existsSync)(fullPath) ? (0, import_node_fs27.readFileSync)(fullPath, "utf8") : null;
     }
   };
 }
 function hubRoot() {
-  const fromPkg = (0, import_node_path24.join)(__dirname, "..", "..");
+  const fromPkg = (0, import_node_path23.join)(__dirname, "..", "..");
   const marker = "skills/bootstrap/seeds/manifest.json";
-  if ((0, import_node_fs28.existsSync)((0, import_node_path24.join)(fromPkg, marker))) return fromPkg;
-  if ((0, import_node_fs28.existsSync)((0, import_node_path24.join)(process.cwd(), marker))) return process.cwd();
+  if ((0, import_node_fs27.existsSync)((0, import_node_path23.join)(fromPkg, marker))) return fromPkg;
+  if ((0, import_node_fs27.existsSync)((0, import_node_path23.join)(process.cwd(), marker))) return process.cwd();
   return null;
 }
 pr.command("ci-policy").description("report merge CI policy: wait-for-checks vs no-ci (for grind/build agents)").option("--json", "machine-readable output").option("--repo <owner/repo>", "target repo (defaults to the current checkout)").action(async (o) => {
@@ -23824,10 +24125,10 @@ pr.command("checks-wait <number>").description(`bounded wait for PR checks; skip
   if (result.status === "failure" || result.status === "conflicting") process.exitCode = 1;
   if (result.status === "timeout" || result.status === "rate-limited") process.exitCode = PR_CHECKS_TIMEOUT_EXIT_CODE;
 });
-pr.command("land <number>").description("agent merge path (#1440): train probe \u2192 checks-wait \u2192 merge --auto \u2192 poll enqueued \u2014 development PRs only").option("--json", "machine-readable output").option("--repo <owner/repo>", "target repo (defaults to the PR repo)").option("--no-require-train", "skip train-authority preflight (not recommended for autonomous agents)").option("--preserve-worktree", "after merge, keep the local PR worktree/stage/branch for an active batch (#1888)").action(async (number, o) => {
+pr.command("land <number>").description("agent merge path (#1440): train probe \u2192 checks-wait \u2192 merge --auto \u2192 poll enqueued \u2014 development PRs only").option("--json", "machine-readable output").option("--repo <owner/repo>", "target repo (defaults to the PR repo)").option("--no-require-train", "skip train-authority preflight (not recommended for autonomous agents)").option("--preserve-worktree", "after merge, keep the local PR worktree/stage/branch for an active batch (#1888)").option("--force", "acknowledge and land past a remaining prunable/severe scratch housekeeping block (advisory kept plans/ never blocks, #3012)").action(async (number, o) => {
   const repoArgs = o.repo ? ["--repo", o.repo] : [];
   const startingPath = (await execFileP2("git", ["rev-parse", "--show-toplevel"], { timeout: GIT_TIMEOUT_MS }).catch(() => ({ stdout: "" }))).stdout.trim();
-  assertPrMergeHousekeepingClean(startingPath || process.cwd(), "pr land");
+  assertPrMergeHousekeepingClean(startingPath || process.cwd(), "pr land", { force: o.force });
   const result = await runPrLand(number, { repo: o.repo, requireTrain: o.requireTrain !== false }, {
     resolveRepo: async (prNumber, repoOpt) => {
       const args = repoOpt ? ["--repo", repoOpt] : repoArgs;
@@ -23917,13 +24218,13 @@ pr.command("land <number>").description("agent merge path (#1440): train probe \
   }
   if (result.status === "failed" || result.cleanupError) process.exitCode = 1;
 });
-pr.command("merge <number>").description("merge a PR (squash by default) and clean up its branch + worktree \u2014 no leftover local branch; on no-ci repos run pr ci-policy / checks-wait first (#1432)").option("--squash", "squash merge (default)").option("--merge", "create a merge commit").option("--rebase", "rebase merge").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--auto", "enable auto-merge \u2014 merge once the base-branch policy is satisfied (use for policy-gated repos)").option("--preserve-worktree", "keep the local PR worktree/stage/branch for an active multi-issue batch (#1888)").action(async (number, o) => {
+pr.command("merge <number>").description("merge a PR (squash by default) and clean up its branch + worktree \u2014 no leftover local branch; on no-ci repos run pr ci-policy / checks-wait first (#1432)").option("--squash", "squash merge (default)").option("--merge", "create a merge commit").option("--rebase", "rebase merge").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--auto", "enable auto-merge \u2014 merge once the base-branch policy is satisfied (use for policy-gated repos)").option("--preserve-worktree", "keep the local PR worktree/stage/branch for an active multi-issue batch (#1888)").option("--force", "acknowledge and merge past a remaining prunable/severe scratch housekeeping block (advisory kept plans/ never blocks, #3012)").action(async (number, o) => {
   const method = o.rebase ? "--rebase" : o.merge ? "--merge" : "--squash";
   const repoArgs = o.repo ? ["--repo", o.repo] : [];
   const [headRef, baseRef, headRefOid] = (await execFileP2("gh", ["pr", "view", number, ...repoArgs, "--json", "headRefName,baseRefName,headRefOid", "--jq", '.headRefName + " " + .baseRefName + " " + (.headRefOid // "")'], { timeout: GC_GH_TIMEOUT_MS2 })).stdout.trim().split(/\s+/);
   const headIsProtected = isProtectedBranch(headRef);
   const startingPath = (await execFileP2("git", ["rev-parse", "--show-toplevel"], { timeout: GIT_TIMEOUT_MS }).catch(() => ({ stdout: "" }))).stdout.trim();
-  const housekeeping = assertPrMergeHousekeepingClean(startingPath || process.cwd(), "pr merge");
+  const housekeeping = assertPrMergeHousekeepingClean(startingPath || process.cwd(), "pr merge", { force: o.force });
   const beforeWorktrees = parseWorktreePorcelain(
     (await execFileP2("git", ["worktree", "list", "--porcelain"], { timeout: GIT_TIMEOUT_MS }).catch(() => ({ stdout: "" }))).stdout
   );
@@ -23997,15 +24298,18 @@ pr.command("merge <number>").description("merge a PR (squash by default) and cle
   const deferredStore = await createDeferredWorktreeStore();
   let localCleanup;
   try {
+    const wtDeps = worktreeRemoveDeps(async (args) => (await execFileP2("git", args, { timeout: GIT_TIMEOUT_MS })).stdout);
     localCleanup = await cleanupPrMergeLocalBranch(headRef, {
       beforeWorktrees,
       startingPath,
-      pathExists: (p) => (0, import_node_fs28.existsSync)(p),
+      pathExists: (p) => (0, import_node_fs27.existsSync)(p),
       execGit: async (args) => (await execFileP2("git", args, { timeout: GIT_TIMEOUT_MS })).stdout,
       teardownWorktreeStage,
       deferredStore,
       expectedHeadOid: headRefOid || void 0,
-      removeWorktreeDir: worktreeRemoveDeps(async (args) => (await execFileP2("git", args, { timeout: GIT_TIMEOUT_MS })).stdout).removeWorktreeDir,
+      detachReparsePoints: wtDeps.detachReparsePoints,
+      // #3064: junction-safe teardown
+      removeWorktreeDir: wtDeps.removeWorktreeDir,
       // After merge, return the local checkout to the (fast-forwarded) branch the PR merged into so
       // grind/build never leave the primary parked on a dead feature branch (#1606).
       returnToBranch: baseRef,
@@ -24094,6 +24398,7 @@ function trainApplyDeps() {
     // fold's version metadata, which the candidate replaces with its own. (The Hub's wider distribution
     // set never reaches this guard: the Hub is direct-track.)
     hotfixCoverage: (input) => checkHotfixCoverage({ ...input, manifestPaths: ["package.json", "package-lock.json"] }),
+    hotfixCarries: (input) => checkHotfixCarries(input),
     // #2737: enqueue GitHub auto-merge on the `main -> development` alignment PR the release opens, so the
     // train lands the back-merge itself instead of leaving a manual step. Same enqueue path `pr land` uses,
     // but method `--merge` (NOT squash): the misalignment guard needs the merge parentage to survive.
@@ -24101,8 +24406,8 @@ function trainApplyDeps() {
     // Slack release announcement (#883): Hub-only + best-effort inside announceRelease itself.
     announce: (args) => announceRelease({
       run: async (file, cmdArgs) => (await execFileP2(file, cmdArgs, { timeout: GH_TRAIN_TIMEOUT_MS })).stdout,
-      readFile: (path2) => (0, import_promises7.readFile)(path2, "utf8"),
-      removeFile: (path2) => (0, import_promises7.unlink)(path2)
+      readFile: (path2) => (0, import_promises6.readFile)(path2, "utf8"),
+      removeFile: (path2) => (0, import_promises6.unlink)(path2)
     }, args),
     fetchEdgeDomains: async (slug) => {
       const proj = await fetchProjectBySlug(slug, registryClientDeps(await loadConfig()));
@@ -24249,7 +24554,7 @@ var hotfixCmd = program2.command("hotfix").description("stepwise hotfix orchestr
   console.log(o.json ? JSON.stringify({ command: "hotfix", steps }, null, 2) : renderSteps("mmi-cli hotfix: dry-run plan", steps));
 });
 hotfixCmd.command("start").description("cherry-pick a merged development PR (or SHA) onto hotfix/vX.Y.Z from origin/main, bump the distribution, open the main-base PR").requiredOption("--from <pr#|sha>", "merged development PR number or commit SHA to cherry-pick").option("--json", "machine-readable output").action(async (o) => runHotfixSub("start", () => runHotfixStart(trainApplyDeps(), { from: o.from }), o.json, renderHotfixStart));
-hotfixCmd.command("release <version>").description("after the hotfix PR is merged + checks green: tag, GitHub Release, watch deploy/publish, verify distribution (idempotent)").option("--json", "machine-readable output").option("--announce-summary-file <path>", "agent-curated summary lines for the Hub Slack announcement (#883)").action(async (version, o) => runHotfixSub("release", () => runHotfixRelease(trainApplyDeps(), version, { announceSummaryFile: o.announceSummaryFile }), o.json, renderHotfixRelease));
+hotfixCmd.command("release <version>").description("after the hotfix PR is merged + checks green: tag, GitHub Release, watch deploy/publish, verify distribution (idempotent)").option("--json", "machine-readable output").option("--announce-summary-file <path>", "agent-curated summary lines for the Hub Slack announcement (#883)").option("--carries <pr#|sha[,pr#|sha...]>", "declared fix target(s) this hotfix must carry; each must be proven present before tagging (#3056)").action(async (version, o) => runHotfixSub("release", () => runHotfixRelease(trainApplyDeps(), version, { announceSummaryFile: o.announceSummaryFile, carries: o.carries ? [o.carries] : [] }), o.json, renderHotfixRelease));
 hotfixCmd.command("status [version]").description("derive the full hotfix pipeline state from live git/gh reads and name the exact next subcommand").option("--json", "machine-readable output").action(async (version, o) => runHotfixSub("status", () => runHotfixStatus(trainApplyDeps(), version), o.json, renderHotfixStatus));
 var ci = program2.command("ci").description("org CI + merge-readiness audit and reconcile");
 ci.command("audit").description("read-only fleet scan: gate workflow, ruleset contexts, auto-merge, registry META (#1440)").option("--json", "machine-readable output").option("--markdown", "fleet summary table for issue comments").option("--repo <owner/repo>", "audit one repo instead of the full registry").action(async (o) => {
@@ -24284,43 +24589,6 @@ ${r.repo}: applied=[${r.applied.join("; ")}] skipped=[${r.skipped.join("; ")}]${
   }
   if (!audit.ok) process.exitCode = 1;
 });
-var wiki = program2.command("wiki").description("release wiki lane \u2014 publish generated pages via a short-lived, repo-scoped minted token");
-wiki.command("publish <pages-dir>").description("mint a 1h repo-scoped contents:write token (master-gated) and publish the generated .md pages to <repo>.wiki.git; the token stays in memory (never printed/committed). Runs from any org repo checkout \u2014 the publisher ships inside mmi-cli, no repo-local script required. Fails loud on the credential gap \u2014 never a silent skip").option("--repo <owner/repo>", "target repo (defaults to the cwd repo)").option("--json", "machine-readable output").action(async (pagesDir, o) => {
-  const repo = await resolveRepo(o.repo);
-  if (!repo) return fail("wiki publish: could not determine the target repo (pass --repo owner/name)");
-  const cfg = await loadConfig();
-  const ok = await wikiPublish(
-    {
-      mint: (r) => mintWikiToken(r, registryClientDeps(cfg)),
-      publish: (o2) => publishWikiViaGit(realWikiGitPublishDeps(), o2),
-      log: (msg) => console.log(msg),
-      err: (msg) => console.error(msg)
-    },
-    { repo, pagesDir, json: o.json }
-  );
-  if (!ok) process.exitCode = 1;
-});
-wiki.command("plan").description("compute the release wiki plan for the cwd repo \u2014 collect its opt-in `wiki:page` pages, read the previous incremental stamp from <repo>.wiki.git (scoped minted token), and print a JSON plan naming which pages changed plus the fresh full stamp. Runs from ANY org repo checkout (no repo-local script). Fails loud on the credential/read gap \u2014 never a silent skip").option("--repo <owner/repo>", "target repo (defaults to the cwd repo)").action(async (o) => {
-  const repo = await resolveRepo(o.repo);
-  if (!repo) return fail("wiki plan: could not determine the target repo (pass --repo owner/name)");
-  const cfg = await loadConfig();
-  const readers = fsReaders(process.cwd());
-  const ok = await wikiPlan(
-    {
-      collectPages: () => collectFeaturePages(readers),
-      readSource: (p) => readers.readDoc(p),
-      mintAndReadStamp: async (r) => {
-        const minted = await mintWikiToken(r, registryClientDeps(cfg));
-        if (!minted.ok) return { ok: false, error: minted.error };
-        return readWikiStampViaGit(realWikiGitPublishDeps(), { repo: r, token: minted.mint.token });
-      },
-      out: (json) => console.log(json),
-      err: (msg) => console.error(msg)
-    },
-    { repo }
-  );
-  if (!ok) process.exitCode = 1;
-});
 registerBootstrapCommands(program2);
 var access = program2.command("access").description("org access audit (read-only)");
 access.command("role [repo]").description("D14 train authority for a repo (server-side Hub check): master | project-admin | developer").option("--json", "machine-readable output").action(async (repoArg) => {
@@ -24358,16 +24626,20 @@ access.command("audit").description("audit collaborator roles + train-branch pus
     const repoClass = o.class;
     targets = [{ repo: o.repo, class: repoClass, releaseTrack: repoClass === "content" ? "trunk" : resolveReleaseTrack(meta, void 0, o.repo) }];
   } else {
-    const projectsJson = registryProjects ? JSON.stringify({ projects: registryProjects }) : (0, import_node_fs28.existsSync)("projects.json") ? (0, import_node_fs28.readFileSync)("projects.json", "utf8") : null;
-    if (!projectsJson) return failGraceful("access audit: no project registry \u2014 Hub API unreachable and projects.json not found; run from the MMI-Hub repo root or pass --repo <owner/repo>");
-    const fanoutJson = (0, import_node_fs28.existsSync)(".github/fanout-targets.json") ? (0, import_node_fs28.readFileSync)(".github/fanout-targets.json", "utf8") : null;
-    targets = loadAccessTargets(projectsJson, fanoutJson);
+    const resolution = resolveOrgAuditTargets(registryProjects);
+    if (!resolution.ok) {
+      const report2 = { ok: false, owners: [], orgFindings: [resolution.finding], repos: [] };
+      console.log(o.json ? JSON.stringify(report2, null, 2) : renderAccessReport(report2));
+      process.exitCode = 1;
+      return;
+    }
+    targets = resolution.targets;
   }
   const derivedMatrix = registryProjects ? accessMatrixFromProjects(registryProjects) : {};
-  const fileMatrix = (0, import_node_fs28.existsSync)("access-matrix.json") ? loadAccessMatrix((0, import_node_fs28.readFileSync)("access-matrix.json", "utf8")) : {};
+  const fileMatrix = (0, import_node_fs27.existsSync)("access-matrix.json") ? loadAccessMatrix((0, import_node_fs27.readFileSync)("access-matrix.json", "utf8")) : {};
   const matrix = mergeAccessMatrix(fileMatrix, derivedMatrix);
   const derivedContracts = registryProjects ? dataAccessContractsFromProjects(registryProjects) : { consumers: {} };
-  const fileContracts = (0, import_node_fs28.existsSync)("data-access-contracts.json") ? loadDataAccessContracts((0, import_node_fs28.readFileSync)("data-access-contracts.json", "utf8")) : { consumers: {} };
+  const fileContracts = (0, import_node_fs27.existsSync)("data-access-contracts.json") ? loadDataAccessContracts((0, import_node_fs27.readFileSync)("data-access-contracts.json", "utf8")) : { consumers: {} };
   const dataAccess = mergeDataAccessContracts(fileContracts, derivedContracts);
   const report = await auditOrgAccess(targets, deps, matrix, dataAccess);
   console.log(o.json ? JSON.stringify(report, null, 2) : renderAccessReport(report));
@@ -24377,7 +24649,7 @@ access.command("capabilities").description("enumerate your effective vault reach
 var isWin2 = process.platform === "win32";
 program2.command("doctor").description("check onboarding gates and auto-heal CLI/plugin wiring; use --verbose for the full audit checklist").option("--banner", "one-line resume summary; silent when all gates pass").option("--fast", "offline-safe fast lane; skips slow checks and network probes").option("--preflight", "eager version/plugin heal with upfront notice when stale; silent when healthy (#1871)").option("--verbose", "print the evidence behind every check \u2014 probes, resolved paths, versions compared, and the names behind each count (#2977)").option("--ci", "stable CI output contract; no color, exit 0 for clear/advisory-only, 1 for hard gaps, 2 for doctor/tool failure").option("--guide", "print the MMI Agentic Onboarding guide URL").option("--json", "machine-readable output (read-only inspection \u2014 performs no repairs)").option("--apply", "perform the same auto-repairs as the interactive run (combine with --json for a machine-readable repair run)").option("--no-repo-writes", "env/plugin repairs only \u2014 never mutate the repo working tree; report pending managed .gitignore repairs with the follow-up command (for train preflights)").option("--self", "verify CLI/plugin version parity, PATH, gh auth scopes, and hook wiring (offline-safe; suggests plugin-heal on a hard gap) (#2689)").addHelpText("after", "\nExit codes:\n  0  no hard gaps remain; advisory gaps may exist\n  1  one or more included hard checks failed\n  2  doctor/tool execution failed before a normal verdict\n\n--banner keeps the legacy SessionStart contract and returns 0 unless the process crashes.\n").action(async (opts) => {
   if (opts.guide) {
-    consoleIo.log("MMI Agentic Onboarding: https://github.com/mutmutco/MMI-Hub/wiki/Agentic-Dev-Environment-Guide");
+    consoleIo.log("MMI Agentic Onboarding: docs/Architecture/agentic-dev-environment.md");
     return;
   }
   const noRepoWrites = opts.repoWrites === false;
@@ -24400,33 +24672,79 @@ function directoryBytes(path2) {
   let total = 0;
   let entries;
   try {
-    entries = (0, import_node_fs28.readdirSync)(path2, { withFileTypes: true });
+    entries = (0, import_node_fs27.readdirSync)(path2, { withFileTypes: true });
   } catch {
     return 0;
   }
   for (const entry of entries) {
-    const child = (0, import_node_path24.join)(path2, entry.name);
+    const child = (0, import_node_path23.join)(path2, entry.name);
     if (entry.isDirectory()) total += directoryBytes(child);
     else {
       try {
-        total += (0, import_node_fs28.statSync)(child).size;
+        total += (0, import_node_fs27.statSync)(child).size;
       } catch {
       }
     }
   }
   return total;
 }
-program2.command("plugin-prune").description(`prune stale cached MMI plugin versions \u2014 keeps the running one + the newest (${PLUGIN_CACHE_KEEP} total); dry-run unless --apply (#2903)`).option("--apply", "actually delete the stale version dirs (default: report only)").option("--json", "machine-readable output").action((o) => {
-  const plan = buildPluginCachePlan((0, import_node_os9.homedir)(), runningPluginVersion(process.env, resolveClientVersion()), {
-    exists: (p) => (0, import_node_fs28.existsSync)(p),
-    listVersionDirs: (root) => (0, import_node_fs28.readdirSync)(root, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name),
-    dirBytes: directoryBytes
-  }, { withBytes: true });
-  const result = o.apply && plan.prune.length > 0 ? applyPluginCachePlan(plan, (p) => (0, import_node_fs28.rmSync)(p, { recursive: true, force: true })) : void 0;
+function listDirEntries(dir) {
+  return (0, import_node_fs27.readdirSync)(dir, { withFileTypes: true }).map((d) => ({ name: d.name, isDirectory: d.isDirectory() }));
+}
+function readInstalledPluginRefs(home) {
+  const p = installedPluginsPath(home);
+  if (!(0, import_node_fs27.existsSync)(p)) return [];
+  try {
+    return installedPluginPaths((0, import_node_fs27.readFileSync)(p, "utf8"));
+  } catch {
+    return null;
+  }
+}
+function pluginCacheFsDeps(home, dirBytes) {
+  return {
+    exists: (p) => (0, import_node_fs27.existsSync)(p),
+    listVersionDirs: (root) => (0, import_node_fs27.readdirSync)(root, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name),
+    dirBytes,
+    listStagingDirs: (root) => (0, import_node_fs27.readdirSync)(root, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => {
+      try {
+        return { name: d.name, mtimeMs: newestMtimeMs((0, import_node_path23.join)(root, d.name), listDirEntries, (p) => (0, import_node_fs27.statSync)(p).mtimeMs) };
+      } catch {
+        return { name: d.name, mtimeMs: Date.now() };
+      }
+    }),
+    readInstalledPluginPaths: () => readInstalledPluginRefs(home),
+    now: () => Date.now()
+  };
+}
+function stagingApplyFsGuard(home) {
+  const stagingRoot = pluginCacheStagingRoot(home);
+  return {
+    referencedPaths: () => readInstalledPluginRefs(home),
+    mtimeMs: (name) => {
+      const p = (0, import_node_path23.join)(stagingRoot, name);
+      if (!(0, import_node_fs27.existsSync)(p)) return null;
+      try {
+        return newestMtimeMs(p, listDirEntries, (q) => (0, import_node_fs27.statSync)(q).mtimeMs);
+      } catch {
+        return null;
+      }
+    },
+    now: () => Date.now()
+  };
+}
+program2.command("plugin-prune").description(`prune stale cached MMI plugin versions (keeps running + newest, ${PLUGIN_CACHE_KEEP} total) and orphaned temp_git_* staging dirs; dry-run unless --apply (#2903, #2990)`).option("--apply", "actually delete the stale version dirs + orphaned staging dirs (default: report only)").option("--json", "machine-readable output").action((o) => {
+  const plan = buildPluginCachePlan(
+    (0, import_node_os8.homedir)(),
+    runningPluginVersion(process.env, resolveClientVersion()),
+    pluginCacheFsDeps((0, import_node_os8.homedir)(), directoryBytes),
+    { withBytes: true }
+  );
+  const anythingToDelete = plan.prune.length > 0 || plan.staging.length > 0;
+  const result = o.apply && anythingToDelete ? applyPluginCachePlan(plan, (p) => (0, import_node_fs27.rmSync)(p, { recursive: true, force: true }), stagingApplyFsGuard((0, import_node_os8.homedir)())) : void 0;
   const warnings = plan.prune.length > 0 ? [CONCURRENT_SESSION_WARNING] : [];
   if (o.json) console.log(JSON.stringify({ ...plan, warnings, applied: result ?? null }));
   else console.log(renderPluginCachePlan(plan, result));
-  if (result?.failed.length) process.exitCode = 1;
+  if (result?.failed.length || result?.failedStaging.length) process.exitCode = 1;
 });
 program2.command("session-start").description("run the SessionStart verbs (whoami, board slice, doctor) in one process").action(async () => {
   if (isInsideRepoSubdir(process.cwd())) {
@@ -24455,7 +24773,7 @@ program2.command("session-start").description("run the SessionStart verbs (whoam
       readBoard,
       // #1813: warm the slice cache out-of-band (detached) so the ~20s live read
       // never costs banner time and next session's glance renders instantly within budget.
-      scheduleRefresh: () => spawnDetachedSelf(["board", "slice-refresh", "--quiet"], { spawn: import_node_child_process13.spawn, execPath: process.execPath, scriptPath: process.argv[1] })
+      scheduleRefresh: () => spawnDetachedSelf(["board", "slice-refresh", "--quiet"], { spawn: import_node_child_process12.spawn, execPath: process.execPath, scriptPath: process.argv[1] })
     }),
     // command-ladder hint (#2609): compact gh→mmi-cli cheat sheet so agents reach for mmi-cli first,
     // not after a denied gh call. <1KB, pure in-memory — no network, no fs, fail-soft.
@@ -24486,12 +24804,18 @@ program2.command("session-start").description("run the SessionStart verbs (whoam
   for (const line of scratchGcLines(process.cwd())) consoleIo.log(line);
   const worktreeBanner = worktreeAutoProvisionBanner(process.cwd());
   if (worktreeBanner) {
-    spawnDetachedSelf(["worktree", "setup", "--quiet"], { spawn: import_node_child_process13.spawn, execPath: process.execPath, scriptPath: process.argv[1] });
+    spawnDetachedSelf(["worktree", "setup", "--quiet"], { spawn: import_node_child_process12.spawn, execPath: process.execPath, scriptPath: process.argv[1] });
     consoleIo.log(worktreeBanner);
   }
   appendHookActivity(process.cwd(), { event: "SessionStart", script: "session-start", outcome: "ran", action: "session-start hook completed" });
 });
 installProcessBackstop();
+program2.command("lane", { hidden: true }).action(() => {
+  fail("lane orchestration lives in jerv-cli \u2014 try: jerv-cli lane --help");
+});
+program2.command("fusion", { hidden: true }).action(() => {
+  fail("fusion orchestration lives in jerv-cli \u2014 try: jerv-cli fusion --help");
+});
 program2.parseAsync().then(() => finishCliRun()).catch((e) => failGraceful(e.message));
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {