@mutmutco/cli 3.30.1 → 3.32.0

package/dist/main.cjs

@@ -4337,7 +4337,7 @@ function formatScratchGcPlan(plan, applied, applyResult) {
 function scratchGcBannerLine(safeAutoPruned, advisory) {
   const parts = [];
   if (safeAutoPruned > 0) parts.push(`pruned ${safeAutoPruned} scratch item(s)`);
-  if (advisory > 0) parts.push(`${advisory} kept scratch item(s) need review \u2014 \`mmi-cli gc --scratch --dry-run\``);
+  if (advisory > 0) parts.push(`${advisory} kept scratch item(s) need review \u2014 \`mmi-cli worktree gc --scratch --dry-run\``);
   return parts.length ? `[cleanup] ${parts.join("; ")}` : void 0;
 }
 function isLinkLike(path2, symbolic = false) {
@@ -4359,9 +4359,9 @@ function treeOlderThan(root, now, floor) {
     if (now - st.mtimeMs <= floor) return false;
     if (!st.isDirectory()) continue;
     for (const ent of (0, import_node_fs6.readdirSync)(current, { withFileTypes: true })) {
-      const child = (0, import_node_path4.join)(current, ent.name);
-      if (isLinkLike(child, ent.isSymbolicLink())) return false;
-      stack.push(child);
+      const child2 = (0, import_node_path4.join)(current, ent.name);
+      if (isLinkLike(child2, ent.isSymbolicLink())) return false;
+      stack.push(child2);
     }
   }
   return true;
@@ -4481,16 +4481,16 @@ function rootScratchDirSnapshot(root, readdir, stat2) {
     while (stack.length) {
       const current = stack.pop();
       for (const ent of readdir(current, { withFileTypes: true })) {
-        const child = (0, import_node_path4.join)(current, ent.name);
+        const child2 = (0, import_node_path4.join)(current, ent.name);
         if (ent.isSymbolicLink?.()) return null;
         try {
-          (0, import_node_fs6.readlinkSync)(child);
+          (0, import_node_fs6.readlinkSync)(child2);
           return null;
         } catch {
         }
-        const st = stat2(child);
+        const st = stat2(child2);
         mtimeMs = Math.max(mtimeMs, st.mtimeMs);
-        if (ent.isDirectory()) stack.push(child);
+        if (ent.isDirectory()) stack.push(child2);
         else if (ent.isFile()) bytes += st.size;
       }
     }
@@ -5156,7 +5156,7 @@ var import_node_fs10 = require("node:fs");
 
 // src/gc.ts
 var import_node_path7 = require("node:path");
-var DEFERRED_SWEEP_COMMAND = "mmi-cli gc sweep-deferred";
+var DEFERRED_SWEEP_COMMAND = "mmi-cli worktree gc sweep-deferred";
 var DEFERRED_NOTE = "Worktree cleanup queued (IDE lock). Detached sweep will retry automatically \u2014 no human action required.";
 var PRESERVED_WORKTREE_CONFIG = "mmi.preservedWorktreeBranch";
 var WORKTREE_LOCK_RE = /EPERM|EBUSY|EACCES|ENOTEMPTY|permission denied|access is denied|used by another process|resource busy|directory not empty/i;
@@ -5858,11 +5858,11 @@ function selectSafeWorktreeCwd(worktrees, targetPath, options) {
   return worktrees.find((w) => !samePath(w.path, targetPath) && exists(w.path))?.path;
 }
 function isPathUnderDirectory(childPath, parentPath) {
-  const child = normPath(childPath);
+  const child2 = normPath(childPath);
   const parent = normPath(parentPath);
-  if (!child || !parent) return false;
-  if (child === parent) return true;
-  return child.startsWith(`${parent}/`);
+  if (!child2 || !parent) return false;
+  if (child2 === parent) return true;
+  return child2.startsWith(`${parent}/`);
 }
 function planReleaseCwdBeforeWorktreeRemoval(targetPath, safeCwd, currentCwd) {
   if (!safeCwd || !isPathUnderDirectory(currentCwd, targetPath)) return void 0;
@@ -6113,7 +6113,7 @@ async function cleanupPrMergeLocalBranch(branch, options) {
   return report;
 }
 function formatGcPlan(plan, apply) {
-  const lines = [`mmi-cli gc: ${apply ? "apply" : "dry-run"}`];
+  const lines = [`mmi-cli worktree gc: ${apply ? "apply" : "dry-run"}`];
   if (!plan.branches.length && !plan.trackingRefs.length && !plan.worktreeDirs.length) lines.push("nothing to clean");
   if (plan.branches.length) {
     lines.push("local branches:");
@@ -6579,10 +6579,10 @@ async function secretsCapabilities(deps, opts) {
   } catch (e) {
     const message = e.message;
     if (isTimeoutError(e)) {
-      deps.err(`access capabilities: timed out after ${CAPABILITIES_TIMEOUT_MS}ms while aggregating vault scopes for ${repo}. No access conclusion was made; retry with a warm Hub or run scoped reads such as \`mmi-cli secrets list --repo ${repo}\` while investigating the slow source.`);
+      deps.err(`org access capabilities: timed out after ${CAPABILITIES_TIMEOUT_MS}ms while aggregating vault scopes for ${repo}. No access conclusion was made; retry with a warm Hub or run scoped reads such as \`mmi-cli secrets list --repo ${repo}\` while investigating the slow source.`);
       return;
     }
-    deps.err(`access capabilities: ${message}`);
+    deps.err(`org access capabilities: ${message}`);
     return;
   }
   if (!res.ok) {
@@ -6591,10 +6591,10 @@ async function secretsCapabilities(deps, opts) {
       deps.err(upgrade);
     } else if (res.status === 404) {
       deps.err(
-        "access capabilities: the Hub API did not recognize /secrets/capabilities (HTTP 404). This endpoint ships in the Hub, so a 404 means the deployed Hub predates this command and should answer once a Hub release carrying this command is deployed \u2014 it is not an authorization or missing-credential error."
+        "org access capabilities: the Hub API did not recognize /secrets/capabilities (HTTP 404). This endpoint ships in the Hub, so a 404 means the deployed Hub predates this command and should answer once a Hub release carrying this command is deployed \u2014 it is not an authorization or missing-credential error."
       );
     } else {
-      deps.err(`access capabilities failed: HTTP ${res.status}${await readErr(res)}`);
+      deps.err(`org access capabilities failed: HTTP ${res.status}${await readErr(res)}`);
     }
     return;
   }
@@ -7644,9 +7644,9 @@ function resolveBoardConfig(cfg) {
   const gap = diagnoseBoardConfigGap(cfg);
   if (gap) {
     throw gap.kind === "no-project-detected" ? new Error(
-      "no MMI project detected for this workspace (no Hub registry match for this repo, or no git origin in this folder); run `mmi-cli board read --repo <owner/repo>` to target a specific registered repo, or `mmi-cli project get <owner/repo>` to check registration"
+      "no MMI project detected for this workspace (no Hub registry match for this repo, or no git origin in this folder); run `mmi-cli board read --repo <owner/repo>` to target a specific registered repo, or `mmi-cli org project get <owner/repo>` to check registration"
     ) : new Error(
-      `Hub registry board META missing ${gap.missing.join(", ")}; run \`gh auth login\`, then \`mmi-cli project get <owner/repo>\`, or ask a master-admin to register/backfill board coords`
+      `Hub registry board META missing ${gap.missing.join(", ")}; run \`gh auth login\`, then \`mmi-cli org project get <owner/repo>\`, or ask a master-admin to register/backfill board coords`
     );
   }
   return {
@@ -9120,7 +9120,7 @@ function decidePrMergeNoCiGuard(checks, policyReason = "registry META ci:none")
     message: [
       `${staleNote} and are not green (${checks}).`,
       "Fix the checks or use `mmi-cli pr land` so the CLI waits.",
-      "Then correct registry META: `mmi-cli project set <owner/repo> --var requiredChecks=<check-run-display-names>`."
+      "Then correct registry META: `mmi-cli org project set <owner/repo> --var requiredChecks=<check-run-display-names>`."
     ].join(" ")
   };
 }
@@ -9277,31 +9277,45 @@ async function activateProductRuleset(repo, rulesetBody, client) {
 }
 
 // src/workflow-context.ts
-function parseWorkflowJobIds(yaml) {
+function parseWorkflowJobs(yaml) {
   const lines = yaml.split(/\r?\n/);
   let inJobs = false;
   let jobIndent = -1;
-  const ids = [];
+  const jobs = [];
+  let current = null;
   for (const line of lines) {
     if (!inJobs) {
       if (/^jobs:\s*$/.test(line)) inJobs = true;
       continue;
     }
     if (/^\S/.test(line) && !line.startsWith("#")) break;
-    const trimmed = line.trim();
-    if (!trimmed || trimmed.startsWith("#")) continue;
     const match = line.match(/^(\s+)([A-Za-z0-9_-]+):\s*$/);
-    if (!match) continue;
-    const indent = match[1].length;
-    if (jobIndent < 0) {
-      jobIndent = indent;
-      ids.push(match[2]);
-      continue;
+    if (match) {
+      const indent = match[1].length;
+      if (jobIndent < 0) jobIndent = indent;
+      if (indent === jobIndent) {
+        current = { id: match[2], body: line, indent };
+        jobs.push(current);
+        continue;
+      }
+      if (indent < jobIndent) break;
     }
-    if (indent === jobIndent) ids.push(match[2]);
-    else if (indent < jobIndent) break;
+    if (current) current.body += `
+${line}`;
   }
-  return ids;
+  return jobs;
+}
+function jobReportsPullRequestCheck(job) {
+  const lines = job.body.split(/\r?\n/).slice(1);
+  const propertyIndent = lines.filter((line) => line.trim() && !line.trimStart().startsWith("#")).map((line) => line.match(/^(\s+)/)?.[1].length ?? 0).filter((indent) => indent > job.indent).reduce((minimum, indent) => Math.min(minimum, indent), Number.POSITIVE_INFINITY);
+  if (!Number.isFinite(propertyIndent)) return true;
+  const directIf = lines.find((line) => {
+    const match = line.match(/^(\s*)if:\s*(.+)$/);
+    return match?.[1].length === propertyIndent;
+  });
+  if (!directIf) return true;
+  const expression = directIf.replace(/^\s*if:\s*/, "").trim().replace(/^\$\{\{\s*/, "").replace(/\s*\}\}$/, "").trim();
+  return !/^(?:github\.event_name\s*==\s*['"]push['"]|['"]push['"]\s*==\s*github\.event_name)$/.test(expression);
 }
 function workflowTriggersPullRequest(yaml) {
   const onBlock = extractOnBlock(yaml);
@@ -9340,7 +9354,9 @@ function collectPullRequestWorkflowContexts(workflows) {
   const contexts = /* @__PURE__ */ new Set();
   for (const wf of workflows) {
     if (!workflowTriggersPullRequest(wf.body)) continue;
-    for (const id of parseWorkflowJobIds(wf.body)) contexts.add(id);
+    for (const job of parseWorkflowJobs(wf.body)) {
+      if (jobReportsPullRequestCheck(job)) contexts.add(job.id);
+    }
   }
   return [...contexts].sort((a, b) => a.localeCompare(b));
 }
@@ -9926,7 +9942,13 @@ async function auditRepoCi(repo, deps) {
     label: "delete_branch_on_merge enabled",
     detail: info.delete_branch_on_merge === true ? void 0 : "false or unavailable"
   });
-  const hasGateWorkflow = repoClass === "hub" ? true : repoClass === "content" ? true : await contentExists(deps, repo, baseBranch, PRODUCT_GATE_PATH);
+  const hasCanonicalGateWorkflow = repoClass === "hub" ? true : repoClass === "content" ? true : await contentExists(deps, repo, baseBranch, PRODUCT_GATE_PATH);
+  let prWorkflowPaths = repoClass === "deployable" && hasCanonicalGateWorkflow ? [PRODUCT_GATE_PATH] : [];
+  if (repoClass === "deployable" && !hasCanonicalGateWorkflow) {
+    const listedWorkflowPaths = await listWorkflowPaths(deps, repo, baseBranch);
+    prWorkflowPaths = listedWorkflowPaths === void 0 ? [] : await filterPullRequestTriggered(deps, repo, baseBranch, listedWorkflowPaths);
+  }
+  const hasGateWorkflow = hasCanonicalGateWorkflow || prWorkflowPaths.length > 0;
   let emittedPrContexts;
   const getEmittedPrContexts = async () => {
     emittedPrContexts ??= await resolveEmittedPrContexts(deps, repo, baseBranch);
@@ -9939,7 +9961,7 @@ async function auditRepoCi(repo, deps) {
         ok: false,
         label: "registry no-ci contradicts PR workflows",
         detail: `registry META declares no-ci but pull_request workflows emit [${emitted.join(", ")}]`,
-        remediation: `Fix the workflows or correct registry META: mmi-cli project set ${repo} --var requiredChecks=${JSON.stringify(emitted)}`
+        remediation: `Fix the workflows or correct registry META: mmi-cli org project set ${repo} --var requiredChecks=${JSON.stringify(emitted)}`
       });
     }
   }
@@ -9947,7 +9969,7 @@ async function auditRepoCi(repo, deps) {
     checks.push({
       ok: hasGateWorkflow,
       label: `gate workflow committed on ${baseBranch}`,
-      detail: hasGateWorkflow ? `read ${PRODUCT_GATE_PATH} at refs/heads/${baseBranch}` : `missing ${PRODUCT_GATE_PATH} at refs/heads/${baseBranch}`,
+      detail: hasCanonicalGateWorkflow ? `read ${PRODUCT_GATE_PATH} at refs/heads/${baseBranch}` : prWorkflowPaths.length > 0 ? `read PR workflows at refs/heads/${baseBranch}: ${prWorkflowPaths.join(", ")}` : `missing ${PRODUCT_GATE_PATH} and no PR-triggered workflows at refs/heads/${baseBranch}`,
       remediation: `mmi-cli bootstrap apply ${repo} --class deployable --execute (seeds gate.yml)`
     });
     checks.push({
@@ -9989,7 +10011,7 @@ async function auditRepoCi(repo, deps) {
       }
     }
   }
-  const workflowPaths = hasGateWorkflow && repoClass === "deployable" ? [PRODUCT_GATE_PATH] : [];
+  const workflowPaths = repoClass === "deployable" ? prWorkflowPaths : [];
   const { policy, reason } = resolveMergeCiPolicy({
     workflowPaths,
     registryCi,
@@ -10000,7 +10022,7 @@ async function auditRepoCi(repo, deps) {
       ok: explicitNoCi,
       label: "registry META declares intentional no-ci",
       detail: explicitNoCi ? void 0 : "set ci:none and requiredChecks:[] in registry META",
-      remediation: `mmi-cli project set ${repo} --var ci=none --var requiredChecks=[]`
+      remediation: `mmi-cli org project set ${repo} --var ci=none --var requiredChecks=[]`
     });
   } else if (deployableGated) {
     checks.push({
@@ -10038,7 +10060,7 @@ async function auditRepoCi(repo, deps) {
           ok: trackExpectsRc === rcPresent,
           label: "release track matches branch topology",
           detail: trackExpectsRc === rcPresent ? void 0 : `registry resolves '${effectiveTrack}' but the rc branch ${rcPresent ? "exists" : "is absent"} \u2014 set release track '${wantTrack}'`,
-          remediation: trackExpectsRc === rcPresent ? void 0 : `mmi-cli project set ${repo} --release-track ${wantTrack}`
+          remediation: trackExpectsRc === rcPresent ? void 0 : `mmi-cli org project set ${repo} --release-track ${wantTrack}`
         });
       }
     }
@@ -10163,7 +10185,7 @@ async function seedGateYml(repo, deps, meta, result) {
   }
   const gate = meta?.gate;
   if (!gate || typeof gate === "object" && Object.keys(gate).length === 0) {
-    result.skipped.push(`gate.yml missing \u2014 no registry gate config; set \`mmi-cli project set ${repo} --var gate={...}\` first, then re-run reconcile`);
+    result.skipped.push(`gate.yml missing \u2014 no registry gate config; set \`mmi-cli org project set ${repo} --var gate={...}\` first, then re-run reconcile`);
     return;
   }
   const derivedVars = withDerivedRepoVars({ ...gateConfigToVars(gate), REPO_SLUG: parsed.slug }, parsed, "deployable", releaseTrack);
@@ -10364,20 +10386,20 @@ var import_node_util6 = require("node:util");
 var execFileP4 = (0, import_node_util6.promisify)(import_node_child_process7.execFile);
 var DOCKER_TIMEOUT_MS = 15e3;
 var EARLY_EXIT_GRACE_MS = 2e3;
-function waitForProcessStability(child, graceMs = EARLY_EXIT_GRACE_MS) {
+function waitForProcessStability(child2, graceMs = EARLY_EXIT_GRACE_MS) {
   return new Promise((resolve5, reject) => {
     let settled = false;
     const finish = (fn) => {
       if (settled) return;
       settled = true;
       clearTimeout(timer);
-      child.removeAllListeners("error");
-      child.removeAllListeners("exit");
+      child2.removeAllListeners("error");
+      child2.removeAllListeners("exit");
       fn();
     };
     const timer = setTimeout(() => finish(resolve5), graceMs);
-    child.on("error", (err) => finish(() => reject(new Error(`stage process failed to start: ${err.message}`))));
-    child.on("exit", (code, signal) => {
+    child2.on("error", (err) => finish(() => reject(new Error(`stage process failed to start: ${err.message}`))));
+    child2.on("exit", (code, signal) => {
       const detail = code != null ? `code ${code}` : signal ? `signal ${signal}` : "unknown reason";
       finish(() => reject(new Error(`stage process exited before health check (${detail})`)));
     });
@@ -10512,9 +10534,9 @@ function parseStagePortFlag(raw) {
   return port;
 }
 function pathUnder(childPath, parentPath) {
-  const child = normPath2(childPath);
+  const child2 = normPath2(childPath);
   const parent = normPath2(parentPath);
-  return Boolean(child && parent && (child === parent || child.startsWith(`${parent}/`)));
+  return Boolean(child2 && parent && (child2 === parent || child2.startsWith(`${parent}/`)));
 }
 function stageStateMatchesRequiredCwd(state, requiredCwd) {
   if (!state) return false;
@@ -10868,7 +10890,7 @@ async function startStage(config = {}, opts = {}) {
   let up = sub(config.up.trim());
   if (opts.forceRecreate) up = appendForceRecreate(up);
   const identity = await resolveStageIdentity(cwd);
-  const child = (0, import_node_child_process7.spawn)(up, {
+  const child2 = (0, import_node_child_process7.spawn)(up, {
     cwd,
     shell: true,
     // POSIX-only: the process group exists for the group-kill in stopStage. On win32 teardown is
@@ -10881,7 +10903,7 @@ async function startStage(config = {}, opts = {}) {
     env: { ...process.env, ...vaultProcessEnv, ...stageProcessEnv(stagePort, extraEnv) }
   });
   const state = {
-    pid: child.pid ?? 0,
+    pid: child2.pid ?? 0,
     command: up,
     cwd,
     statePath,
@@ -10895,7 +10917,7 @@ async function startStage(config = {}, opts = {}) {
   if (globalStatePath && globalStatePath !== statePath) writeState(globalStatePath, state);
   try {
     if (state.healthUrl) await waitForHealth(state.healthUrl, opts.timeoutMs ?? 6e4, config.healthAnyStatus);
-    else await waitForProcessStability(child);
+    else await waitForProcessStability(child2);
   } catch (e) {
     await cleanupStageState(state, [statePath, globalStatePath], opts.timeoutMs ?? 6e4, cwd);
     throw e;
@@ -10910,7 +10932,7 @@ async function startStage(config = {}, opts = {}) {
     message: `started stage pid ${state.pid}${stagePort != null ? ` on port ${stagePort}` : ""}`
   };
   opts.onReady?.(result);
-  child.unref();
+  child2.unref();
   return result;
 }
 async function runStage(config = {}, opts = {}) {
@@ -11127,7 +11149,7 @@ async function bodyArgsViaFile(args, deps = {}) {
   if (i === -1 || i + 1 >= args.length) return { args, cleanup: async () => {
   } };
   const write = deps.write ?? import_promises.writeFile;
-  const remove = deps.remove ?? import_promises.unlink;
+  const remove2 = deps.remove ?? import_promises.unlink;
   const ensureDir = deps.ensureDir ?? import_promises.mkdir;
   const dir = deps.dir ?? (0, import_node_os3.tmpdir)();
   const file = (0, import_node_path13.join)(dir, `mmi-gh-body-${process.pid}-${(0, import_node_crypto3.randomBytes)(4).toString("hex")}.md`);
@@ -11138,7 +11160,7 @@ async function bodyArgsViaFile(args, deps = {}) {
     args: [...args.slice(0, i), "--body-file", file, ...args.slice(i + 2)],
     cleanup: async () => {
       try {
-        await remove(file);
+        await remove2(file);
       } catch {
       }
     }
@@ -11353,9 +11375,9 @@ async function resolveIssueNodeId(runGh, ref, fallbackRepo) {
 }
 async function linkSubIssue(runGh, parentRef, childRef, defaultRepo) {
   const parent = parseIssueRef(parentRef);
-  const child = parseIssueRef(childRef);
+  const child2 = parseIssueRef(childRef);
   const parentId = await resolveIssueNodeId(runGh, parent, defaultRepo);
-  const subIssueId = await resolveIssueNodeId(runGh, child, defaultRepo);
+  const subIssueId = await resolveIssueNodeId(runGh, child2, defaultRepo);
   const stdout = await runGh(buildAddSubIssueArgs(parentId, subIssueId), GH_MUTATION_TIMEOUT_MS);
   const result = parseAddSubIssueResult(stdout);
   if (!result) throw new Error(`addSubIssue returned an unexpected response:
@@ -11390,9 +11412,9 @@ function parseRemoveSubIssueResult(stdout) {
 }
 async function unlinkSubIssue(runGh, parentRef, childRef, defaultRepo) {
   const parent = parseIssueRef(parentRef);
-  const child = parseIssueRef(childRef);
+  const child2 = parseIssueRef(childRef);
   const parentId = await resolveIssueNodeId(runGh, parent, defaultRepo);
-  const subIssueId = await resolveIssueNodeId(runGh, child, defaultRepo);
+  const subIssueId = await resolveIssueNodeId(runGh, child2, defaultRepo);
   const stdout = await runGh(buildRemoveSubIssueArgs(parentId, subIssueId), GH_MUTATION_TIMEOUT_MS);
   const result = parseRemoveSubIssueResult(stdout);
   if (!result) throw new Error(`removeSubIssue returned an unexpected response:
@@ -11463,6 +11485,235 @@ function applyChecklistCheck(body, query, checked) {
   return { ok: true, edit: setChecklistMarker(body, sel.item, checked), item: sel.item };
 }
 
+// src/command-taxonomy.ts
+var COMMAND_METADATA = /* @__PURE__ */ Symbol.for("mmi.commandTaxonomy.metadata");
+var PRIMARY_GROUPS = [
+  ["Orient", ["onboard", "status", "next", "doctor", "whoami", "commands", "explain"]],
+  ["Plan and work", ["board", "issue", "worktree", "stage"]],
+  ["Review and ship", ["pr", "ci", "rcand", "release", "hotfix", "train"]],
+  ["Setup and support", ["bootstrap", "secrets", "docs"]],
+  ["Coordinate and improve", ["wave", "report", "skill-lesson"]]
+];
+var OPERATIONAL_TOP_LEVEL = /* @__PURE__ */ new Set(["org", "runtime", "plugin"]);
+var SUPPORT_PRIMARY = /* @__PURE__ */ new Set(["doctor", "whoami", "commands", "explain", "docs", "wave", "report", "skill-lesson"]);
+var TOP_LEVEL_ORDER = /* @__PURE__ */ new Map();
+var HELP_GROUP_ORDER = /* @__PURE__ */ new Map();
+var topLevelPosition = 0;
+for (const [helpGroup, names] of PRIMARY_GROUPS) {
+  HELP_GROUP_ORDER.set(helpGroup, HELP_GROUP_ORDER.size);
+  for (const name of names) TOP_LEVEL_ORDER.set(name, topLevelPosition++);
+}
+HELP_GROUP_ORDER.set("Operations", HELP_GROUP_ORDER.size);
+HELP_GROUP_ORDER.set("Compatibility", HELP_GROUP_ORDER.size);
+HELP_GROUP_ORDER.set("Delegated", HELP_GROUP_ORDER.size);
+for (const name of OPERATIONAL_TOP_LEVEL) TOP_LEVEL_ORDER.set(name, topLevelPosition++);
+TOP_LEVEL_ORDER.set("lane", topLevelPosition++);
+TOP_LEVEL_ORDER.set("fusion", topLevelPosition++);
+var PATH_OVERRIDES = {
+  "board slice-refresh": { category: "internal", discovery: "hidden", help_group: "Operations" },
+  lane: { category: "delegated", discovery: "hidden", help_group: "Delegated", replacement: "jerv-cli lane" },
+  fusion: { category: "delegated", discovery: "hidden", help_group: "Delegated", replacement: "jerv-cli fusion" }
+};
+var HIDDEN_OPTIONS = {
+  "worktree create": ["--base"],
+  "org project doctor": ["--v2"],
+  "org project heal": ["--v2"],
+  "org project set": ["--set"]
+};
+function primaryMetadata(name) {
+  for (const [helpGroup, names] of PRIMARY_GROUPS) {
+    if (names.includes(name)) {
+      return {
+        category: SUPPORT_PRIMARY.has(name) ? "support" : "core",
+        discovery: "primary",
+        help_group: helpGroup
+      };
+    }
+  }
+  return void 0;
+}
+function topLevelMetadata(name) {
+  const primary = primaryMetadata(name);
+  if (primary) return primary;
+  if (name === "lane" || name === "fusion") return PATH_OVERRIDES[name];
+  if (!OPERATIONAL_TOP_LEVEL.has(name)) {
+    throw new Error(`command taxonomy: unclassified top-level command "${name}"`);
+  }
+  return {
+    category: name === "plugin" ? "internal" : "admin",
+    discovery: "all-only",
+    help_group: "Operations"
+  };
+}
+function setCommandMetadata(command, metadata) {
+  command[COMMAND_METADATA] = metadata;
+}
+function commandMetadata(command) {
+  return command[COMMAND_METADATA];
+}
+function classifyTree(command, path2, inherited) {
+  const metadata = PATH_OVERRIDES[path2] ?? inherited;
+  setCommandMetadata(command, metadata);
+  if (metadata.discovery !== "primary") {
+    command._hidden = true;
+  }
+  for (const option of command.options) {
+    if ((HIDDEN_OPTIONS[path2] ?? []).includes(option.long ?? option.short ?? "")) option.hideHelp();
+  }
+  for (const child2 of command.commands) {
+    const childPath = path2 ? `${path2} ${child2.name()}` : child2.name();
+    classifyTree(child2, childPath, PATH_OVERRIDES[childPath] ?? metadata);
+  }
+}
+function applyCommandTaxonomy(program3) {
+  for (const command of program3.commands) {
+    const metadata = topLevelMetadata(command.name());
+    command.helpGroup(metadata.help_group);
+    classifyTree(command, command.name(), metadata);
+  }
+  program3.configureHelp({
+    visibleCommands(command) {
+      const visible = command.commands.filter((child2) => !child2._hidden);
+      const helpCommand = command._getHelpCommand();
+      if (helpCommand && !helpCommand._hidden) visible.push(helpCommand);
+      if (command === program3) visible.sort((a, b) => commandTaxonomyRank(a.name()) - commandTaxonomyRank(b.name()));
+      return visible;
+    },
+    groupItems(unsortedItems, visibleItems, getGroup) {
+      const groups = /* @__PURE__ */ new Map();
+      for (const item of unsortedItems) {
+        const group = getGroup(item);
+        if (!groups.has(group)) groups.set(group, []);
+      }
+      for (const item of visibleItems) {
+        const group = getGroup(item);
+        if (!groups.has(group)) groups.set(group, []);
+        groups.get(group).push(item);
+      }
+      return new Map([...groups].sort(([left], [right]) => {
+        const leftRank = HELP_GROUP_ORDER.get(left) ?? Number.MAX_SAFE_INTEGER;
+        const rightRank = HELP_GROUP_ORDER.get(right) ?? Number.MAX_SAFE_INTEGER;
+        return leftRank - rightRank;
+      }));
+    }
+  });
+}
+function commandTaxonomyRank(name) {
+  return TOP_LEVEL_ORDER.get(name) ?? Number.MAX_SAFE_INTEGER;
+}
+function commandHelpGroupRank(group) {
+  return HELP_GROUP_ORDER.get(group) ?? Number.MAX_SAFE_INTEGER;
+}
+function isCanonicalSuggestion(metadata) {
+  return metadata.category !== "internal" && metadata.category !== "delegated" && metadata.category !== "shim" && metadata.category !== "obsolete";
+}
+
+// src/command-shims.ts
+var COMMAND_SHIMS = [
+  { legacy: "project deploy list", canonical: "org project deploy get", category: "shim" },
+  { legacy: "project resolve", canonical: "org project deploy get", category: "obsolete" },
+  { legacy: "tenant readiness", canonical: "runtime tenant status", category: "shim" },
+  { legacy: "secrets edit", canonical: "secrets set", category: "shim" },
+  { legacy: "registry org", canonical: "org config get", category: "shim" },
+  { legacy: "rules gitignore", canonical: "org rules gitignore", category: "shim" },
+  { legacy: "deploy status", canonical: "runtime deploy status", category: "shim" },
+  { legacy: "full-track readiness", canonical: "train readiness", category: "shim" },
+  { legacy: "docs-audit", canonical: "docs audit", category: "shim", subtree: true },
+  { legacy: "plugin-heal", canonical: "plugin heal", category: "shim" },
+  { legacy: "plugin-prune", canonical: "plugin prune", category: "shim" },
+  { legacy: "session-start", canonical: "plugin session-start", category: "shim" },
+  { legacy: "port-range", canonical: "stage port-range", category: "shim" },
+  { legacy: "schedules", canonical: "org schedules", category: "shim" },
+  { legacy: "guard", canonical: "plugin guard", category: "shim" },
+  { legacy: "project", canonical: "org project", category: "shim", subtree: true },
+  { legacy: "oauth", canonical: "org oauth", category: "shim", subtree: true },
+  { legacy: "access", canonical: "org access", category: "shim", subtree: true },
+  { legacy: "tenant", canonical: "runtime tenant", category: "shim", subtree: true },
+  { legacy: "box", canonical: "runtime box", category: "shim", subtree: true },
+  { legacy: "edge", canonical: "runtime edge", category: "shim", subtree: true },
+  { legacy: "gc", canonical: "worktree gc", category: "shim", subtree: true }
+];
+function rewriteLegacyArgv(argv) {
+  const commandArgs = argv.slice(2);
+  for (const shim of COMMAND_SHIMS) {
+    const legacy = shim.legacy.split(" ");
+    if (!legacy.every((token, index) => commandArgs[index] === token)) continue;
+    const canonical = shim.canonical.split(" ");
+    return {
+      argv: [...argv.slice(0, 2), ...canonical, ...commandArgs.slice(legacy.length)],
+      shim,
+      warning: `mmi-cli: \`${shim.legacy}\` moved to \`${shim.canonical}\`; use \`mmi-cli ${shim.canonical}\`.`
+    };
+  }
+  return { argv: [...argv] };
+}
+
+// src/command-consolidation.ts
+var COMMAND_NAMESPACES_CONSOLIDATED = /* @__PURE__ */ Symbol.for("mmi.commandNamespaces.consolidated");
+function child(parent, name) {
+  const found = parent.commands.find((command) => command.name() === name);
+  if (!found) throw new Error(`command consolidation: missing "${parent.name()} ${name}"`);
+  return found;
+}
+function detach(parent, command) {
+  const commands = parent.commands;
+  const index = commands.indexOf(command);
+  if (index < 0) throw new Error(`command consolidation: "${command.name()}" is not a child of "${parent.name()}"`);
+  commands.splice(index, 1);
+  return command;
+}
+function move(parent, destination, name, nextName = name) {
+  const command = detach(parent, child(parent, name));
+  command.name(nextName);
+  destination.addCommand(command);
+  return command;
+}
+function remove(parent, name) {
+  detach(parent, child(parent, name));
+}
+function consolidateCommandNamespaces(program3) {
+  const org = program3.command("org").description("organization projects, access, rules, credentials, and schedules");
+  const runtime = program3.command("runtime").description("tenant, deploy, box, and edge operations");
+  const plugin = program3.command("plugin").description("plugin lifecycle and guard operations");
+  move(program3, org, "project");
+  move(program3, org, "oauth");
+  move(program3, org, "access");
+  move(program3, org, "schedules");
+  const config = org.command("config").description("organization configuration");
+  const registry2 = child(program3, "registry");
+  move(registry2, config, "org", "get");
+  remove(program3, "registry");
+  const orgRules = org.command("rules").description("organization-managed repository rules");
+  const rules2 = child(program3, "rules");
+  move(rules2, orgRules, "gitignore");
+  remove(program3, "rules");
+  move(program3, runtime, "tenant");
+  const runtimeDeploy = runtime.command("deploy").description("runtime deployment status");
+  const deploy = child(program3, "deploy");
+  move(deploy, runtimeDeploy, "status");
+  remove(program3, "deploy");
+  move(program3, runtime, "box");
+  move(program3, runtime, "edge");
+  move(program3, plugin, "guard");
+  move(program3, plugin, "plugin-heal", "heal");
+  move(program3, plugin, "plugin-prune", "prune");
+  move(program3, plugin, "session-start");
+  const docs2 = child(program3, "docs");
+  move(program3, docs2, "docs-audit", "audit");
+  const train = child(program3, "train");
+  const fullTrack2 = child(program3, "full-track");
+  move(fullTrack2, train, "readiness");
+  remove(program3, "full-track");
+  const worktree2 = child(program3, "worktree");
+  move(program3, worktree2, "gc");
+  const stage = child(program3, "stage");
+  move(program3, stage, "port-range");
+  program3[COMMAND_NAMESPACES_CONSOLIDATED] = true;
+}
+function hasConsolidatedCommandNamespaces(program3) {
+  return program3[COMMAND_NAMESPACES_CONSOLIDATED] === true;
+}
+
 // src/command-manifest.ts
 var EXAMPLES = /* @__PURE__ */ Symbol.for("mmi.commandManifest.examples");
 var COMMON_MISTAKES = /* @__PURE__ */ Symbol.for("mmi.commandManifest.commonMistakes");
@@ -11502,17 +11753,24 @@ function buildOption(opt) {
   if (opt.description) out.description = opt.description;
   if (opt.defaultValue !== void 0) out.default = opt.defaultValue;
   if (opt.argChoices && opt.argChoices.length) out.enum = [...opt.argChoices];
+  if (opt.hidden) out.discovery = "all-only";
   return out;
 }
 function buildCommand(cmd, path2) {
+  const metadata = commandMetadata(cmd) ?? {
+    category: "core",
+    discovery: "primary",
+    help_group: "Plan and work"
+  };
   const out = {
     name: cmd.name(),
     path: path2,
     arguments: cmd.registeredArguments.map(buildArgument),
     options: cmd.options.map(buildOption),
     subcommands: cmd.commands.map(
-      (child) => buildCommand(child, path2 ? `${path2} ${child.name()}` : child.name())
-    )
+      (child2) => buildCommand(child2, path2 ? `${path2} ${child2.name()}` : child2.name())
+    ),
+    ...metadata
   };
   const description = cmd.description();
   if (description) out.description = description;
@@ -11522,39 +11780,140 @@ function buildCommand(cmd, path2) {
   if (commonMistakes) out.common_mistakes = commonMistakes;
   return out;
 }
+function findTreeCommand(root, path2) {
+  if (root.path === path2) return root;
+  for (const child2 of root.subcommands) {
+    const found = findTreeCommand(child2, path2);
+    if (found) return found;
+  }
+  return void 0;
+}
+function virtualCopy(source, path2, shim) {
+  return {
+    ...source,
+    name: path2.split(" ").at(-1),
+    path: path2,
+    category: shim.category,
+    discovery: "all-only",
+    help_group: "Compatibility",
+    replacement: source.path,
+    subcommands: shim.subtree ? source.subcommands.map((child2) => virtualCopy(child2, `${path2} ${child2.name}`, shim)) : []
+  };
+}
+function virtualParent(path2, shim) {
+  return {
+    name: path2.split(" ").at(-1),
+    path: path2,
+    description: `compatibility namespace; use mmi-cli ${shim.canonical}`,
+    arguments: [],
+    options: [],
+    subcommands: [],
+    category: "shim",
+    discovery: "all-only",
+    help_group: "Compatibility",
+    replacement: shim.canonical
+  };
+}
+function insertVirtualShim(root, shim) {
+  const canonical = findTreeCommand(root, shim.canonical);
+  if (!canonical) throw new Error(`command manifest: shim target missing "${shim.canonical}"`);
+  const parts = shim.legacy.split(" ");
+  let parent = root;
+  for (let index = 0; index < parts.length - 1; index += 1) {
+    const path2 = parts.slice(0, index + 1).join(" ");
+    let next = parent.subcommands.find((command) => command.name === parts[index]);
+    if (!next) {
+      next = virtualParent(path2, shim);
+      parent.subcommands.push(next);
+    }
+    parent = next;
+  }
+  const copy = virtualCopy(canonical, shim.legacy, shim);
+  const existingIndex = parent.subcommands.findIndex((command) => command.name === copy.name);
+  if (existingIndex >= 0) parent.subcommands[existingIndex] = copy;
+  else parent.subcommands.push(copy);
+}
+function addVirtualShims(root) {
+  for (const shim of COMMAND_SHIMS.filter((entry) => entry.subtree)) insertVirtualShim(root, shim);
+  for (const shim of COMMAND_SHIMS.filter((entry) => !entry.subtree)) insertVirtualShim(root, shim);
+}
+function primaryCopy(node, root = false) {
+  if (!root && node.discovery !== "primary") return void 0;
+  const subcommands = node.subcommands.map((child2) => primaryCopy(child2)).filter((child2) => Boolean(child2));
+  if (root) subcommands.sort((a, b) => commandTaxonomyRank(a.name) - commandTaxonomyRank(b.name));
+  return {
+    ...node,
+    options: node.options.filter((option) => option.discovery !== "all-only" && option.discovery !== "hidden"),
+    subcommands
+  };
+}
 function collectLeaves(node, acc) {
   if (node.subcommands.length === 0) {
     if (node.path) acc.push(node);
     return;
   }
-  for (const child of node.subcommands) collectLeaves(child, acc);
+  for (const child2 of node.subcommands) collectLeaves(child2, acc);
 }
 function buildCommandManifest(program3) {
   const tree = buildCommand(program3, "");
+  if (hasConsolidatedCommandNamespaces(program3)) addVirtualShims(tree);
   const index = [];
   collectLeaves(tree, index);
-  const manifest = { name: tree.name, tree, index, error_codes: ERROR_CODE_REFERENCE };
+  const primaryTree = primaryCopy(tree, true);
+  const primaryIndex = [];
+  collectLeaves(primaryTree, primaryIndex);
+  const manifest = {
+    schema_version: 2,
+    scope: "all",
+    name: tree.name,
+    tree,
+    index,
+    primary_tree: primaryTree,
+    primary_index: primaryIndex,
+    error_codes: ERROR_CODE_REFERENCE
+  };
   const version = program3.version();
   if (version) manifest.version = version;
   return manifest;
 }
+function primaryCommandManifest(manifest) {
+  return {
+    schema_version: manifest.schema_version,
+    scope: "primary",
+    name: manifest.name,
+    ...manifest.version ? { version: manifest.version } : {},
+    tree: manifest.primary_tree,
+    index: manifest.primary_index,
+    error_codes: manifest.error_codes
+  };
+}
 function argSignature(arg) {
   const inner = arg.variadic ? `${arg.name}...` : arg.name;
   return arg.required ? `<${inner}>` : `[${inner}]`;
 }
-function formatManifestHuman(manifest) {
-  const lines = [];
+function formatManifestHuman(manifest, options = {}) {
+  const root = options.all ? manifest.tree : manifest.primary_tree;
+  const lines = [`${manifest.name}${manifest.version ? ` v${manifest.version}` : ""} \u2014 ${root.description ?? ""}`];
   const render = (node, depth) => {
     const indent = "  ".repeat(depth);
     const args = node.arguments.map(argSignature).join(" ");
-    const head = depth === 0 ? `${node.name}${manifest.version ? ` v${manifest.version}` : ""}` : node.name + (args ? ` ${args}` : "");
+    const head = node.name + (args ? ` ${args}` : "");
     lines.push(node.description ? `${indent}${head} \u2014 ${node.description}` : `${indent}${head}`);
-    for (const opt of node.options) {
+    for (const opt of options.all ? node.options : []) {
       lines.push(`${indent}    ${opt.flags}${opt.description ? `  ${opt.description}` : ""}`);
     }
-    for (const child of node.subcommands) render(child, depth + 1);
+    if (options.all) for (const child2 of node.subcommands) render(child2, depth + 1);
   };
-  render(manifest.tree, 0);
+  let currentGroup;
+  const rootCommands = [...root.subcommands].sort((a, b) => commandHelpGroupRank(a.help_group) - commandHelpGroupRank(b.help_group) || commandTaxonomyRank(a.name) - commandTaxonomyRank(b.name));
+  for (const command of rootCommands) {
+    if (command.help_group !== currentGroup) {
+      currentGroup = command.help_group;
+      lines.push("", `${currentGroup}:`);
+    }
+    render(command, 1);
+  }
+  lines.push("", options.all ? "Use `mmi-cli explain <group|command>` for a focused map." : "Use `mmi-cli explain <group|command>` for detail or `mmi-cli commands --all` for operations and compatibility.");
   return lines.join("\n");
 }
 
@@ -11700,12 +12059,12 @@ function newestMtimeMs(path2, listDir, mtimeOf) {
     return newest;
   }
   for (const e of entries) {
-    const child = `${path2}/${e.name}`;
+    const child2 = `${path2}/${e.name}`;
     let m = 0;
-    if (e.isDirectory) m = newestMtimeMs(child, listDir, mtimeOf);
+    if (e.isDirectory) m = newestMtimeMs(child2, listDir, mtimeOf);
     else {
       try {
-        m = mtimeOf(child);
+        m = mtimeOf(child2);
       } catch {
         m = 0;
       }
@@ -11781,12 +12140,12 @@ function buildPluginCachePlan(home, running, deps, opts = {}) {
   const bytes = opts.withBytes ? prune.reduce((sum, v) => sum + deps.dirBytes(`${cacheRoot}/${v}`), 0) : 0;
   return { cacheRoot, present: true, keep, prune, bytes, running, ...stagingFields };
 }
-function applyPluginCachePlan(plan, remove, stagingGuard) {
+function applyPluginCachePlan(plan, remove2, stagingGuard) {
   const removed = [];
   const failed = [];
   for (const version of plan.prune) {
     try {
-      remove(`${plan.cacheRoot}/${version}`);
+      remove2(`${plan.cacheRoot}/${version}`);
       removed.push(version);
     } catch (e) {
       failed.push({ version, error: e.message });
@@ -11814,7 +12173,7 @@ function applyPluginCachePlan(plan, remove, stagingGuard) {
       }
     }
     try {
-      remove(`${plan.stagingRoot}/${s.name}`);
+      remove2(`${plan.stagingRoot}/${s.name}`);
       removedStaging.push(s.name);
     } catch (e) {
       failedStaging.push({ name: s.name, error: e.message });
@@ -11834,7 +12193,7 @@ var CONCURRENT_SESSION_WARNING = "only the version THIS session runs from is pro
 function renderPluginCachePlan(plan, applied) {
   const mb = (b) => `${(b / 1e6).toFixed(1)} MB`;
   if (!plan.present && plan.staging.length === 0) {
-    return `plugin-prune: no plugin cache at ${plan.cacheRoot} \u2014 nothing to prune`;
+    return `plugin prune: no plugin cache at ${plan.cacheRoot} \u2014 nothing to prune`;
   }
   const lines = [];
   if (plan.present) {
@@ -11983,11 +12342,11 @@ function trainPlan(command, options = {}) {
       { label: "verify operator is a master-admin org owner", command: "gh api orgs/<owner>/memberships/<login> --jq .role", gated: true },
       { label: "verify current branch is development", gated: true },
       rcandVersionStep(options),
-      { label: "verify registry META for this project", command: "mmi-cli project get <owner/repo>", gated: true },
+      { label: "verify registry META for this project", command: "mmi-cli org project get <owner/repo>", gated: true },
       { label: "preflight required rc secret names", command: "mmi-cli secrets preflight --stage rc --repo <owner/repo>", gated: true },
       { label: "merge development to rc", gated: true },
       { label: "trigger the deploy path for this repo model, returning Hub Actions run id/url data (and, with --watch, its outcome)", command: "tenant-container: gh workflow run tenant-deploy.yml ... then gh run list/watch; hub-serverless: no manual dispatch, deploy.yml auto-fires on rc push, correlate/watch that run", gated: true },
-      { label: "after a failed deploy, retry the existing rc ref (no re-tag/merge)", command: "mmi-cli tenant redeploy <owner/repo> rc --watch", gated: true }
+      { label: "after a failed deploy, retry the existing rc ref (no re-tag/merge)", command: "mmi-cli runtime tenant redeploy <owner/repo> rc --watch", gated: true }
     ];
   }
   if (command === "release") {
@@ -11995,7 +12354,7 @@ function trainPlan(command, options = {}) {
       return [
         { label: "verify operator is a master-admin org owner", command: "gh api orgs/<owner>/memberships/<login> --jq .role", gated: true },
         { label: "verify current branch is development", gated: true },
-        { label: "verify registry META for this project", command: "mmi-cli project get <owner/repo>", gated: true },
+        { label: "verify registry META for this project", command: "mmi-cli org project get <owner/repo>", gated: true },
         { label: "preflight required main secret names", command: "mmi-cli secrets preflight --stage main --repo <owner/repo>", gated: true },
         { label: "merge development to main", gated: true },
         { label: "fold the version bump into the release commit (Hub: full distribution set; app repos: root package manifest) \u2014 runs inside the apply step, no separate bump PR", gated: true },
@@ -12009,20 +12368,20 @@ function trainPlan(command, options = {}) {
         { label: "verify operator is a master-admin org owner", command: "gh api orgs/<owner>/memberships/<login> --jq .role", gated: true },
         { label: "verify current branch is development", gated: true },
         { label: "guard: refuse if origin/rc carries content not in development (a dev -> main release would drop it)", command: "git rev-list --count --right-only --cherry-pick --no-merges origin/development...origin/rc", gated: true },
-        { label: "verify registry META for this project", command: "mmi-cli project get <owner/repo>", gated: true },
+        { label: "verify registry META for this project", command: "mmi-cli org project get <owner/repo>", gated: true },
         { label: "preflight required main secret names", command: "mmi-cli secrets preflight --stage main --repo <owner/repo>", gated: true },
         { label: "merge development to main (rc skipped)", gated: true },
         { label: "fold the version bump into the release commit \u2014 runs inside the apply step, no separate bump PR", gated: true },
         { label: "tag release and publish GitHub Release", gated: true },
         { label: "trigger the deploy path for this repo model, returning Hub Actions run id/url data (and, with --watch, its outcome)", command: "tenant-container: gh workflow run tenant-deploy.yml ... then gh run list/watch", gated: true },
-        { label: "retire the rc runtime (rc is ephemeral \u2014 non-fatal, reported as rcRetirement)", command: "mmi-cli tenant control <owner/repo> rc retire", gated: true },
+        { label: "retire the rc runtime (rc is ephemeral \u2014 non-fatal, reported as rcRetirement)", command: "mmi-cli runtime tenant control <owner/repo> rc retire", gated: true },
         { label: "roll development forward and align rc to the released main", gated: true }
       ];
     }
     return [
       { label: "verify operator is a master-admin org owner", command: "gh api orgs/<owner>/memberships/<login> --jq .role", gated: true },
       { label: "verify current branch is rc", gated: true },
-      { label: "verify registry META for this project", command: "mmi-cli project get <owner/repo>", gated: true },
+      { label: "verify registry META for this project", command: "mmi-cli org project get <owner/repo>", gated: true },
       { label: "preflight required main secret names", command: "mmi-cli secrets preflight --stage main --repo <owner/repo>", gated: true },
       { label: "verify every main-only hotfix commit is covered by the rc candidate (the guard runs automatically inside the apply step below; --ack <sha> overrides a verified, trailer-less port)", command: "mmi-cli release --apply [--ack <sha>]", gated: true },
       { label: "merge rc to main", gated: true },
@@ -12393,7 +12752,7 @@ function requireProjectMetaForTrain(load, repo) {
   }
   if (load.status === "missing") {
     throw new Error(
-      `${label}: no registry META for ${repo} \u2014 train apply refused; bootstrap the project or verify META with \`mmi-cli project get\` before promoting.`
+      `${label}: no registry META for ${repo} \u2014 train apply refused; bootstrap the project or verify META with \`mmi-cli org project get\` before promoting.`
     );
   }
   return load.meta;
@@ -12707,7 +13066,7 @@ function partialTrainRecoveryError(cause, input) {
 partial train state: tag ${input.tag} is already pushed; origin/${branch} has not been pushed; ${releaseState}; deploy not dispatched.
 Recovery sequence:
   1. git push origin ${branch}` + releaseCommand + `
-  ${deployStep}. mmi-cli tenant redeploy ${input.repo} ${input.stage} --watch
+  ${deployStep}. mmi-cli runtime tenant redeploy ${input.repo} ${input.stage} --watch
 Do not delete or force-move the pushed tag; rerun the train only after confirming the branch, release, and deploy states above.`
   );
 }
@@ -12889,7 +13248,7 @@ async function dispatchDeploy(deps, ctx, stage, ref, model, watch, autoRunSince,
       if (dispatchFailure === "throw") throw e;
       const msg = e instanceof Error ? e.message : String(e);
       return {
-        note: `tenant-deploy dispatch FAILED: ${msg}. The promotion itself landed (merge/tag/Release pushed before the dispatch) \u2014 recover the deploy with \`mmi-cli tenant redeploy ${ctx.repo} ${stage}\`; never re-tag.`,
+        note: `tenant-deploy dispatch FAILED: ${msg}. The promotion itself landed (merge/tag/Release pushed before the dispatch) \u2014 recover the deploy with \`mmi-cli runtime tenant redeploy ${ctx.repo} ${stage}\`; never re-tag.`,
         deployStatus: "failure"
       };
     }
@@ -13476,14 +13835,14 @@ async function attemptRetire(deps, ctx) {
     return {
       status: "retired",
       category: "retired",
-      note: `rc runtime retired (tenant-control.yml${r.runUrl ? `, ${r.runUrl}` : ""}) \u2014 registry coords kept; /rcand or tenant redeploy recreates rc next cycle`
+      note: `rc runtime retired (tenant-control.yml${r.runUrl ? `, ${r.runUrl}` : ""}) \u2014 registry coords kept; /rcand or runtime tenant redeploy recreates rc next cycle`
     };
   }
   if (r.category === "wait-timeout") {
     return {
       status: "failed",
       category: "wait-timeout",
-      note: `rc retire dispatched but the run could not be observed \u2014 verify with: mmi-cli tenant control ${ctx.repo} rc status${r.runUrl ? ` (run ${r.runUrl})` : ""}`
+      note: `rc retire dispatched but the run could not be observed \u2014 verify with: mmi-cli runtime tenant control ${ctx.repo} rc status${r.runUrl ? ` (run ${r.runUrl})` : ""}`
     };
   }
   return { status: "failed", category: r.category ?? "transport-failed", note: r.note };
@@ -13498,7 +13857,7 @@ async function retireRcRuntime(deps, ctx, model, deployStatus, releasedRcSha) {
   if (deployStatus !== "success") {
     return {
       status: "skipped",
-      note: `prod deploy outcome unconfirmed (run without --watch) \u2014 rc runtime left untouched; after verifying prod, retire with: mmi-cli tenant control ${ctx.repo} rc retire`
+      note: `prod deploy outcome unconfirmed (run without --watch) \u2014 rc runtime left untouched; after verifying prod, retire with: mmi-cli runtime tenant control ${ctx.repo} rc retire`
     };
   }
   try {
@@ -13520,7 +13879,7 @@ async function retireRcRuntime(deps, ctx, model, deployStatus, releasedRcSha) {
     }
     const f = last;
     if (f.category === "wait-timeout") return f;
-    const note = `rc retirement failed (the release itself succeeded): ${f.note}. The rc runtime may be orphaned on the box \u2014 retire it with: mmi-cli tenant control ${ctx.repo} rc retire (or sweep all: mmi-cli tenant sweep-rc --retire --yes)`;
+    const note = `rc retirement failed (the release itself succeeded): ${f.note}. The rc runtime may be orphaned on the box \u2014 retire it with: mmi-cli runtime tenant control ${ctx.repo} rc retire (or sweep all: mmi-cli runtime tenant sweep-rc --retire --yes)`;
     return { status: "failed", category: f.category, note };
   } catch (e) {
     const err = e;
@@ -13563,7 +13922,7 @@ async function runTenantControl(deps, options) {
       dispatched: false,
       conclusion: "failure",
       category: action === "retire" ? transport ? "transport-failed" : "dispatch-rejected" : void 0,
-      note: transport ? `tenant control ${action} dispatch failed (transport) \u2014 safe to retry` : `tenant control ${action} rejected: ${d.error ?? "request rejected by the Hub"}`
+      note: transport ? `runtime tenant control ${action} dispatch failed (transport) \u2014 safe to retry` : `runtime tenant control ${action} rejected: ${d.error ?? "request rejected by the Hub"}`
     };
   }
   const { runId, runUrl } = await correlateControlRun(deps, since, [stage, action]);
@@ -13585,7 +13944,7 @@ async function runTenantControl(deps, options) {
   return result;
 }
 function renderTenantControl(r) {
-  const head = `tenant control ${r.repo} ${r.stage} ${r.action}: ${r.conclusion}${r.category ? ` (${r.category})` : ""}`;
+  const head = `runtime tenant control ${r.repo} ${r.stage} ${r.action}: ${r.conclusion}${r.category ? ` (${r.category})` : ""}`;
   const lines = [head];
   if (r.runUrl) lines.push(`  run: ${r.runUrl}`);
   if (r.serviceState) lines.push(`  serviceState: ${r.serviceState}`);
@@ -13746,7 +14105,7 @@ function pickRepo(p) {
 }
 async function sweepRcOrphans(deps, opts) {
   const projects = await deps.listProjects();
-  if (!projects) throw new Error("project list unavailable \u2014 Hub unreachable or this repo is not bootstrapped");
+  if (!projects) throw new Error("org project list unavailable \u2014 Hub unreachable or this repo is not bootstrapped");
   const targets = projects.filter(isRcBearingTenant);
   const stages = [];
   for (const p of targets) {
@@ -13783,7 +14142,7 @@ async function sweepRcOrphans(deps, opts) {
   };
 }
 function renderSweep(r) {
-  const lines = [`tenant sweep-rc: scanned ${r.scanned} tenant-container(s); ${r.running} rc runtime(s) running`];
+  const lines = [`runtime tenant sweep-rc: scanned ${r.scanned} tenant-container(s); ${r.running} rc runtime(s) running`];
   for (const s of r.stages) {
     let line = `  ${s.repo} rc: ${s.orphanCandidate ? "RUNNING" : s.serviceState}`;
     if (s.retired) line += ` -> ${s.retired}${s.category ? ` (${s.category}${s.reason ? `/${s.reason}` : ""})` : ""}`;
@@ -13791,7 +14150,7 @@ function renderSweep(r) {
     lines.push(line);
   }
   if (r.running > 0 && !r.retireAttempted) {
-    lines.push("Retire an orphan with: mmi-cli tenant control <owner/repo> rc retire (or sweep all running: mmi-cli tenant sweep-rc --retire --yes)");
+    lines.push("Retire an orphan with: mmi-cli runtime tenant control <owner/repo> rc retire (or sweep all running: mmi-cli runtime tenant sweep-rc --retire --yes)");
   }
   const undetermined = r.stages.filter((s) => s.serviceState === "unknown").length;
   if (undetermined > 0) {
@@ -14612,8 +14971,8 @@ async function auditOrgAccess(targets, deps, matrix = {}, dataAccess) {
         repo: OWNER2,
         kind: "empty-target-inventory",
         severity: "high",
-        detail: "access audit received an empty repo inventory \u2014 zero repos to audit; a green audit of nothing is a false pass",
-        remediation: `confirm the Hub registry is reachable and returns projects, then re-run \`mmi-cli access audit\`; or audit one repo explicitly with \`mmi-cli access audit --repo <owner/repo>\``
+        detail: "org access audit received an empty repo inventory \u2014 zero repos to audit; a green audit of nothing is a false pass",
+        remediation: `confirm the Hub registry is reachable and returns projects, then re-run \`mmi-cli org access audit\`; or audit one repo explicitly with \`mmi-cli org access audit --repo <owner/repo>\``
       }],
       repos: []
     };
@@ -14628,7 +14987,7 @@ async function auditOrgAccess(targets, deps, matrix = {}, dataAccess) {
       kind: "owner-baseline-unavailable",
       severity: "medium",
       detail: `could not resolve org owners (role=admin) from the GitHub API (${e.message}); the overgrant audit needs this baseline and was skipped to avoid false HIGH findings \u2014 re-run when the members API is reachable`,
-      remediation: `confirm the token can read GET /orgs/${OWNER2}/members?role=admin, then re-run \`mmi-cli access audit\``
+      remediation: `confirm the token can read GET /orgs/${OWNER2}/members?role=admin, then re-run \`mmi-cli org access audit\``
     });
     return { ok: degraded.every((f) => f.severity !== "high"), owners: [], orgFindings: degraded, repos: [] };
   }
@@ -14673,7 +15032,7 @@ function resolveOrgAuditTargets(registryProjects) {
         kind: "registry-unreadable",
         severity: "high",
         detail: "the project registry SSOT (Hub API) was unreachable or unconfigured \u2014 the audit target set is unknown; auditing the stale committed projects.json instead could pass green while missing live repos",
-        remediation: `confirm the Hub API base URL + token are configured and reachable, then re-run \`mmi-cli access audit\`; or audit one repo explicitly with \`mmi-cli access audit --repo <owner/repo>\``
+        remediation: `confirm the Hub API base URL + token are configured and reachable, then re-run \`mmi-cli org access audit\`; or audit one repo explicitly with \`mmi-cli org access audit --repo <owner/repo>\``
       }
     };
   }
@@ -14718,7 +15077,7 @@ function dataAccessContractsFromProjects(projects) {
   return { consumers };
 }
 function renderAccessReport(report) {
-  const lines = [`mmi-cli access audit: ${report.ok ? "OK" : "CHECK"} (owners: ${report.owners.map((o) => "@" + o).join(", ") || "none"})`];
+  const lines = [`mmi-cli org access audit: ${report.ok ? "OK" : "CHECK"} (owners: ${report.owners.map((o) => "@" + o).join(", ") || "none"})`];
   for (const finding of report.orgFindings ?? []) {
     lines.push(`  [${finding.severity}] ${finding.kind}: ${finding.detail}`);
     if (finding.remediation) lines.push(`      ${finding.remediation}`);
@@ -14858,20 +15217,20 @@ function docsAuditRecord(input) {
   const date = input.date.trim();
   const shaRange = input.shaRange.trim();
   const checkerVendor = input.checkerVendor.trim();
-  if (!repo) throw new Error("docs-audit record: repo is required");
-  if (!date) throw new Error("docs-audit record: date is required");
-  if (!isValidIsoDate(date)) throw new Error(`docs-audit record: date must be a real ISO date (YYYY-MM-DD), got "${date}"`);
-  if (!shaRange) throw new Error("docs-audit record: shaRange is required");
-  if (!checkerVendor) throw new Error("docs-audit record: checkerVendor is required");
+  if (!repo) throw new Error("docs audit record: repo is required");
+  if (!date) throw new Error("docs audit record: date is required");
+  if (!isValidIsoDate(date)) throw new Error(`docs audit record: date must be a real ISO date (YYYY-MM-DD), got "${date}"`);
+  if (!shaRange) throw new Error("docs audit record: shaRange is required");
+  if (!checkerVendor) throw new Error("docs audit record: checkerVendor is required");
   if (input.outcome.kind === "refreshed" && !(Number.isInteger(input.outcome.count) && input.outcome.count > 0)) {
-    throw new Error("docs-audit record: a `refreshed` outcome must carry a positive integer count");
+    throw new Error("docs audit record: a `refreshed` outcome must carry a positive integer count");
   }
   if (input.outcome.kind === "failed" && !input.outcome.reason.trim()) {
-    throw new Error("docs-audit record: a `failed` outcome must carry a reason");
+    throw new Error("docs audit record: a `failed` outcome must carry a reason");
   }
   const outcome = serializeOutcome(input.outcome);
   if (!isValidOutcomeWire(outcome)) {
-    throw new Error(`docs-audit record: outcome serialized to an invalid wire form "${outcome}"`);
+    throw new Error(`docs audit record: outcome serialized to an invalid wire form "${outcome}"`);
   }
   return { repo, date, shaRange, outcome, checkerVendor };
 }
@@ -14882,13 +15241,13 @@ function ageInDays(verdictDate, today) {
 }
 function docsAuditStatus(fetch2, opts) {
   if ("notArmed" in fetch2) {
-    return { ok: true, state: "not-armed", line: `docs-audit: ${opts.repo} janitor not armed (registry route not live yet)` };
+    return { ok: true, state: "not-armed", line: `docs audit: ${opts.repo} janitor not armed (registry route not live yet)` };
   }
   if (!fetch2.ok) {
-    return { ok: false, state: "error", line: `docs-audit: ${opts.repo} registry read failed \u2014 ${fetch2.error}` };
+    return { ok: false, state: "error", line: `docs audit: ${opts.repo} registry read failed \u2014 ${fetch2.error}` };
   }
   if (fetch2.verdict === null) {
-    return { ok: false, state: "missing", line: `docs-audit: ${opts.repo} no verdict on record \u2014 janitor blind or dead` };
+    return { ok: false, state: "missing", line: `docs audit: ${opts.repo} no verdict on record \u2014 janitor blind or dead` };
   }
   const verdict = fetch2.verdict;
   for (const field of ["repo", "shaRange", "checkerVendor"]) {
@@ -14898,7 +15257,7 @@ function docsAuditStatus(fetch2, opts) {
       return {
         ok: false,
         state: "malformed",
-        line: `docs-audit: ${opts.repo} malformed verdict ${field} (${shown}, expected a non-empty string) \u2014 registry record corrupt, treating as RED`
+        line: `docs audit: ${opts.repo} malformed verdict ${field} (${shown}, expected a non-empty string) \u2014 registry record corrupt, treating as RED`
       };
     }
   }
@@ -14906,29 +15265,29 @@ function docsAuditStatus(fetch2, opts) {
     return {
       ok: false,
       state: "malformed",
-      line: `docs-audit: ${opts.repo} malformed verdict date "${verdict.date}" \u2014 registry record corrupt, treating as RED`
+      line: `docs audit: ${opts.repo} malformed verdict date "${verdict.date}" \u2014 registry record corrupt, treating as RED`
     };
   }
   if (!isValidOutcomeWire(verdict.outcome)) {
     return {
       ok: false,
       state: "malformed",
-      line: `docs-audit: ${opts.repo} malformed verdict outcome "${verdict.outcome}" (expected clean|refreshed-N|failed) \u2014 registry record corrupt, treating as RED`
+      line: `docs audit: ${opts.repo} malformed verdict outcome "${verdict.outcome}" (expected clean|refreshed-N|failed) \u2014 registry record corrupt, treating as RED`
     };
   }
   if (!isValidIsoDate(opts.today)) {
-    throw new Error(`docs-audit status: today must be a real ISO date (YYYY-MM-DD), got "${opts.today}"`);
+    throw new Error(`docs audit status: today must be a real ISO date (YYYY-MM-DD), got "${opts.today}"`);
   }
   const cadence = opts.cadenceDays ?? 7;
   const grace = opts.graceDays ?? 3;
   const age = ageInDays(verdict.date, opts.today);
   if (age > cadence + grace) {
-    return { ok: false, state: "stale", line: `docs-audit: ${opts.repo} last verdict ${age}d old \u2014 janitor blind or dead` };
+    return { ok: false, state: "stale", line: `docs audit: ${opts.repo} last verdict ${age}d old \u2014 janitor blind or dead` };
   }
   if (verdict.outcome === "failed") {
-    return { ok: false, state: "failed", line: `docs-audit: ${opts.repo} last run FAILED (${verdict.date}) \u2014 janitor needs attention` };
+    return { ok: false, state: "failed", line: `docs audit: ${opts.repo} last run FAILED (${verdict.date}) \u2014 janitor needs attention` };
   }
-  return { ok: true, state: "clean", line: `docs-audit: ${opts.repo} ${verdict.outcome} (${verdict.date}, ${verdict.checkerVendor})` };
+  return { ok: true, state: "clean", line: `docs audit: ${opts.repo} ${verdict.outcome} (${verdict.date}, ${verdict.checkerVendor})` };
 }
 
 // src/project-readiness.ts
@@ -15042,7 +15401,7 @@ function appAttestationOf(meta) {
   return typeof at === "string" && at.length > 0 && typeof by === "string" && by.length > 0 ? { at, by } : null;
 }
 function attestedLine(att) {
-  return `App-owned readiness attested by @${att.by} on ${att.at.slice(0, 10)} \u2014 the static checklist is cleared (the doctor reads no product repo files); re-run \`mmi-cli project attest\` after app-owned structural changes.`;
+  return `App-owned readiness attested by @${att.by} on ${att.at.slice(0, 10)} \u2014 the static checklist is cleared (the doctor reads no product repo files); re-run \`mmi-cli org project attest\` after app-owned structural changes.`;
 }
 var CONTRACT_UNDECLARED_LINE = "No runtime secrets declared \u2014 declare requiredRuntimeSecrets (a per-stage name map) in the registry META, or attest the app needs none with an explicit empty stage map ({ dev: [], rc: [], main: [] }).";
 function appGapsFor(meta, model, slug, projectType, mainDeployFact) {
@@ -15053,19 +15412,19 @@ function appGapsFor(meta, model, slug, projectType, mainDeployFact) {
   if (projectType === "content" || model === "content") return ["Content repo: keep app-owned work to docs/content changes; release train does not apply."];
   if (projectType === "desktop-app") {
     return [
-      "Desktop app: no Hub deploy coords, Google OAuth, DWD, or tenant control by default; keep app-owned installer/packaging outside the tenant train.",
+      "Desktop app: no Hub deploy coords, Google OAuth, DWD, or runtime tenant control by default; keep app-owned installer/packaging outside the tenant train.",
       "Keep README.md and architecture.md explicit about the per-OS build and distribution path (installer, and any registry publish alongside it) so readiness does not guess web infra."
     ];
   }
   if (projectType === "desktop-game") {
     return [
-      "Desktop game: no Hub deploy coords, Google OAuth, DWD, or tenant control by default; keep app-owned release packaging outside the tenant train.",
+      "Desktop game: no Hub deploy coords, Google OAuth, DWD, or runtime tenant control by default; keep app-owned release packaging outside the tenant train.",
       "Keep README.md and architecture.md explicit about the game build/release path so readiness does not guess web infra."
     ];
   }
   if (projectType === "non-deployable" || model === "none") {
     return [
-      "Non-deployable repo: no Hub deploy coords, Google OAuth, DWD, or tenant control by default.",
+      "Non-deployable repo: no Hub deploy coords, Google OAuth, DWD, or runtime tenant control by default.",
       "Keep README.md and architecture.md explicit about the repo purpose and any project-admin workflow it still needs."
     ];
   }
@@ -15190,7 +15549,7 @@ function buildV2HealPatch(repoOrSlug, meta, mainDeployFact) {
       patch.requiredRuntimeSecrets = next;
     }
   }
-  const appOwnedGaps = confidentType ? appGapsFor(meta, model, slug, confidentType, mainDeployFact) : [`Project type is unset and not derivable \u2014 classify with \`mmi-cli project set ${repo} --project-type <web-app|hub-service|content|desktop-app|desktop-game|non-deployable|cli-tool|worker> --deploy-model <tenant-container|solo-container|hub-serverless|serverless|registry-publish|content|none>\` before heal completes the v2 fields (prevents defaulting a non-web repo to tenant-container).`];
+  const appOwnedGaps = confidentType ? appGapsFor(meta, model, slug, confidentType, mainDeployFact) : [`Project type is unset and not derivable \u2014 classify with \`mmi-cli org project set ${repo} --project-type <web-app|hub-service|content|desktop-app|desktop-game|non-deployable|cli-tool|worker> --deploy-model <tenant-container|solo-container|hub-serverless|serverless|registry-publish|content|none>\` before heal completes the v2 fields (prevents defaulting a non-web repo to tenant-container).`];
   if (boardRegistryGaps(meta).length) appOwnedGaps.unshift(boardRegistryGapMessage(repo));
   return { slug, patch, appOwnedGaps };
 }
@@ -15229,7 +15588,7 @@ async function buildV2Doctor(repoOrSlug, deps) {
       registryError: read.error,
       hubOwned: { meta: { ok: false, missing: [] }, deployCoords: degradedStage, deployState: degradedStage, secrets: degradedSecrets },
       autoHealAvailable: [],
-      appOwnedGaps: [`Hub registry read failed (${read.error}) \u2014 diagnosis degraded; nothing is known about META, coords, or gaps. Likely transient (cold start, network, or auth blip): retry \`mmi-cli project doctor\` shortly.`]
+      appOwnedGaps: [`Hub registry read failed (${read.error}) \u2014 diagnosis degraded; nothing is known about META, coords, or gaps. Likely transient (cold start, network, or auth blip): retry \`mmi-cli org project doctor\` shortly.`]
     };
   }
   const meta = read.project;
@@ -15456,37 +15815,37 @@ function parseSecretsCatalogVar(raw) {
   try {
     parsed = JSON.parse(raw);
   } catch {
-    throw new Error('project set: secrets must be JSON keyed by KEY, e.g. {"SCRAPER_API_KEY":{"key":"SCRAPER_API_KEY","purpose":"scrape provider key","group":"scraper","owner":"oguz","stages":[],"consumers":["box"]}}');
+    throw new Error('org project set: secrets must be JSON keyed by KEY, e.g. {"SCRAPER_API_KEY":{"key":"SCRAPER_API_KEY","purpose":"scrape provider key","group":"scraper","owner":"oguz","stages":[],"consumers":["box"]}}');
   }
   if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
-    throw new Error("project set: secrets must be a map keyed by canonical KEY");
+    throw new Error("org project set: secrets must be a map keyed by canonical KEY");
   }
   const nonEmpty = (v) => typeof v === "string" && v.trim().length > 0;
   const overrideMapKey = /^([A-Z_][A-Z0-9_]*)@(dev|rc|main)$/;
   for (const [mapKey, value] of Object.entries(parsed)) {
-    if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error(`project set: secrets["${mapKey}"] must be an object`);
+    if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error(`org project set: secrets["${mapKey}"] must be an object`);
     const e = value;
     if (typeof e.key !== "string" || !SECRET_ENV_NAME_RE.test(e.key)) {
-      throw new Error(`project set: secrets["${mapKey}"].key must be an env-name (UPPER_SNAKE)`);
+      throw new Error(`org project set: secrets["${mapKey}"].key must be an env-name (UPPER_SNAKE)`);
     }
     const override = overrideMapKey.exec(mapKey);
     if (override) {
       if (e.key !== override[1] || !Array.isArray(e.stages) || e.stages.length !== 1 || e.stages[0] !== override[2]) {
-        throw new Error(`project set: secrets["${mapKey}"] is an override entry (#2528) \u2014 key must be ${override[1]} and stages exactly ["${override[2]}"]`);
+        throw new Error(`org project set: secrets["${mapKey}"] is an override entry (#2528) \u2014 key must be ${override[1]} and stages exactly ["${override[2]}"]`);
       }
     } else if (e.key !== mapKey) {
-      throw new Error(`project set: secrets["${mapKey}"].key must equal the map key (or use the KEY@<stage> override form, #2528)`);
+      throw new Error(`org project set: secrets["${mapKey}"].key must equal the map key (or use the KEY@<stage> override form, #2528)`);
     }
-    if (!nonEmpty(e.purpose) || !nonEmpty(e.group) || !nonEmpty(e.owner)) throw new Error(`project set: secrets["${mapKey}"] needs non-empty purpose, group, owner`);
-    if (e.provider !== void 0 && !nonEmpty(e.provider)) throw new Error(`project set: secrets["${mapKey}"].provider must be a non-empty string`);
+    if (!nonEmpty(e.purpose) || !nonEmpty(e.group) || !nonEmpty(e.owner)) throw new Error(`org project set: secrets["${mapKey}"] needs non-empty purpose, group, owner`);
+    if (e.provider !== void 0 && !nonEmpty(e.provider)) throw new Error(`org project set: secrets["${mapKey}"].provider must be a non-empty string`);
     if (!Array.isArray(e.stages) || e.stages.some((s) => !RUNTIME_SECRET_STAGES.includes(s))) {
-      throw new Error(`project set: secrets["${mapKey}"].stages must be a subset of dev/rc/main ([] = shared)`);
+      throw new Error(`org project set: secrets["${mapKey}"].stages must be a subset of dev/rc/main ([] = shared)`);
     }
     if (!Array.isArray(e.consumers) || e.consumers.some((c) => !SECRET_CONSUMERS.includes(c))) {
-      throw new Error(`project set: secrets["${mapKey}"].consumers must be a subset of ${SECRET_CONSUMERS.join("/")}`);
+      throw new Error(`org project set: secrets["${mapKey}"].consumers must be a subset of ${SECRET_CONSUMERS.join("/")}`);
     }
     if (e.aliases !== void 0 && (!Array.isArray(e.aliases) || e.aliases.some((a) => typeof a !== "string"))) {
-      throw new Error(`project set: secrets["${mapKey}"].aliases must be a string array`);
+      throw new Error(`org project set: secrets["${mapKey}"].aliases must be a string array`);
     }
   }
   return parsed;
@@ -15496,19 +15855,19 @@ function parseRuntimeSecretsVar(raw) {
   try {
     parsed = JSON.parse(raw);
   } catch {
-    throw new Error('project set: requiredRuntimeSecrets must be JSON, e.g. {"dev":["KEY"],"rc":["KEY"],"main":["KEY"]}');
+    throw new Error('org project set: requiredRuntimeSecrets must be JSON, e.g. {"dev":["KEY"],"rc":["KEY"],"main":["KEY"]}');
   }
   if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
-    throw new Error("project set: requiredRuntimeSecrets must be a stage map (a flat array is not box-loadable)");
+    throw new Error("org project set: requiredRuntimeSecrets must be a stage map (a flat array is not box-loadable)");
   }
   const map = parsed;
   const out = {};
   for (const [stage, names] of Object.entries(map)) {
     if (!RUNTIME_SECRET_STAGES.includes(stage)) {
-      throw new Error(`project set: requiredRuntimeSecrets stage "${stage}" \u2014 expected only ${RUNTIME_SECRET_STAGES.join("/")}`);
+      throw new Error(`org project set: requiredRuntimeSecrets stage "${stage}" \u2014 expected only ${RUNTIME_SECRET_STAGES.join("/")}`);
     }
     if (!Array.isArray(names) || names.some((n) => typeof n !== "string" || !n.trim())) {
-      throw new Error(`project set: requiredRuntimeSecrets.${stage} must be an array of non-empty secret names`);
+      throw new Error(`org project set: requiredRuntimeSecrets.${stage} must be an array of non-empty secret names`);
     }
     out[stage] = names;
   }
@@ -15519,13 +15878,13 @@ function parseBuildSecretsVar(raw) {
   try {
     parsed = JSON.parse(raw);
   } catch {
-    throw new Error('project set: requiredBuildSecrets must be JSON, e.g. ["NODE_AUTH_TOKEN=@github-packages-token"]');
+    throw new Error('org project set: requiredBuildSecrets must be JSON, e.g. ["NODE_AUTH_TOKEN=@github-packages-token"]');
   }
   if (!Array.isArray(parsed)) {
-    throw new Error("project set: requiredBuildSecrets must be a flat array (build secrets are not stage-mapped)");
+    throw new Error("org project set: requiredBuildSecrets must be a flat array (build secrets are not stage-mapped)");
   }
   if (parsed.some((n) => typeof n !== "string" || !BUILD_SECRET_REF_RE.test(n) || n === "@github-packages-token")) {
-    throw new Error("project set: requiredBuildSecrets must be a flat array of ENVID=<ref> or bare <ref> strings");
+    throw new Error("org project set: requiredBuildSecrets must be a flat array of ENVID=<ref> or bare <ref> strings");
   }
   return parsed;
 }
@@ -15534,19 +15893,19 @@ function parseEdgeDomainsVar(raw) {
   try {
     parsed = JSON.parse(raw);
   } catch {
-    throw new Error('project set: edgeDomains must be JSON, e.g. {"dev":"dev.example.co","rc":"rc.example.co","main":"example.co"}');
+    throw new Error('org project set: edgeDomains must be JSON, e.g. {"dev":"dev.example.co","rc":"rc.example.co","main":"example.co"}');
   }
   if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
-    throw new Error("project set: edgeDomains must be a {dev,rc,main} map of domain strings");
+    throw new Error("org project set: edgeDomains must be a {dev,rc,main} map of domain strings");
   }
   const map = parsed;
   const out = {};
   for (const [stage, domain] of Object.entries(map)) {
     if (!RUNTIME_SECRET_STAGES.includes(stage)) {
-      throw new Error(`project set: edgeDomains stage "${stage}" \u2014 expected only ${RUNTIME_SECRET_STAGES.join("/")}`);
+      throw new Error(`org project set: edgeDomains stage "${stage}" \u2014 expected only ${RUNTIME_SECRET_STAGES.join("/")}`);
     }
     if (typeof domain !== "string" || !domain.trim()) {
-      throw new Error(`project set: edgeDomains.${stage} must be a non-empty domain string`);
+      throw new Error(`org project set: edgeDomains.${stage} must be a non-empty domain string`);
     }
     out[stage] = domain.trim();
   }
@@ -15558,19 +15917,19 @@ function parsePriorityOptionsVar(raw) {
   try {
     parsed = JSON.parse(raw);
   } catch {
-    throw new Error('project set: priorityOptions must be JSON, e.g. {"Urgent":"<id>","High":"<id>","Medium":"<id>","Low":"<id>"}');
+    throw new Error('org project set: priorityOptions must be JSON, e.g. {"Urgent":"<id>","High":"<id>","Medium":"<id>","Low":"<id>"}');
   }
   if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
-    throw new Error("project set: priorityOptions must be a {Urgent,High,Medium,Low} map of option-id strings");
+    throw new Error("org project set: priorityOptions must be a {Urgent,High,Medium,Low} map of option-id strings");
   }
   const map = parsed;
   const out = {};
   for (const [name, id] of Object.entries(map)) {
     if (!PRIORITY_OPTION_NAMES.includes(name)) {
-      throw new Error(`project set: priorityOptions "${name}" \u2014 expected only ${PRIORITY_OPTION_NAMES.join("/")}`);
+      throw new Error(`org project set: priorityOptions "${name}" \u2014 expected only ${PRIORITY_OPTION_NAMES.join("/")}`);
     }
     if (typeof id !== "string" || !id.trim()) {
-      throw new Error(`project set: priorityOptions.${name} must be a non-empty option-id string`);
+      throw new Error(`org project set: priorityOptions.${name} must be a non-empty option-id string`);
     }
     out[name] = id.trim();
   }
@@ -15581,7 +15940,7 @@ function parsePortRangeVar(raw) {
   try {
     parsed = JSON.parse(raw);
   } catch {
-    throw new Error('project set: portRange must be JSON, e.g. {"start":3700,"end":3710} or [3700,3710]');
+    throw new Error('org project set: portRange must be JSON, e.g. {"start":3700,"end":3710} or [3700,3710]');
   }
   let start;
   let end;
@@ -15590,12 +15949,12 @@ function parsePortRangeVar(raw) {
   } else if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
     ({ start, end } = parsed);
   } else {
-    throw new Error("project set: portRange must be {start,end} or a [start,end] tuple");
+    throw new Error("org project set: portRange must be {start,end} or a [start,end] tuple");
   }
   if (typeof start !== "number" || typeof end !== "number" || !Number.isFinite(start) || !Number.isFinite(end)) {
-    throw new Error("project set: portRange start/end must be finite numbers");
+    throw new Error("org project set: portRange start/end must be finite numbers");
   }
-  if (start > end) throw new Error("project set: portRange start must be <= end");
+  if (start > end) throw new Error("org project set: portRange start must be <= end");
   return { start, end };
 }
 function parseStatusOptionsVar(raw) {
@@ -15603,16 +15962,16 @@ function parseStatusOptionsVar(raw) {
   try {
     parsed = JSON.parse(raw);
   } catch {
-    throw new Error('project set: statusOptions must be JSON, e.g. {"Todo":"<id>","In Progress":"<id>","In Review":"<id>","Done":"<id>"}');
+    throw new Error('org project set: statusOptions must be JSON, e.g. {"Todo":"<id>","In Progress":"<id>","In Review":"<id>","Done":"<id>"}');
   }
   if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
-    throw new Error("project set: statusOptions must be a map of status name to option-id string");
+    throw new Error("org project set: statusOptions must be a map of status name to option-id string");
   }
   const map = parsed;
   const out = {};
   for (const [name, id] of Object.entries(map)) {
     if (typeof id !== "string" || !id.trim()) {
-      throw new Error(`project set: statusOptions.${name} must be a non-empty option-id string`);
+      throw new Error(`org project set: statusOptions.${name} must be a non-empty option-id string`);
     }
     out[name] = id.trim();
   }
@@ -15623,31 +15982,31 @@ function parseOauthVar(raw) {
   try {
     parsed = JSON.parse(raw);
   } catch {
-    throw new Error(`project set: oauth must be JSON, e.g. {"subdomains":["app"],"domains":["example.co"],"callbackPath":"${DEFAULT_CALLBACK_PATH}"}`);
+    throw new Error(`org project set: oauth must be JSON, e.g. {"subdomains":["app"],"domains":["example.co"],"callbackPath":"${DEFAULT_CALLBACK_PATH}"}`);
   }
   if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
-    throw new Error("project set: oauth must be a {subdomains,domains,callbackPath,fofuSubdomain} object");
+    throw new Error("org project set: oauth must be a {subdomains,domains,callbackPath,fofuSubdomain} object");
   }
   const map = parsed;
   const out = {};
   for (const [key, value] of Object.entries(map)) {
     if (key === "subdomains" || key === "domains") {
       if (!Array.isArray(value) || value.some((v) => typeof v !== "string" || !v.trim())) {
-        throw new Error(`project set: oauth.${key} must be an array of non-empty strings`);
+        throw new Error(`org project set: oauth.${key} must be an array of non-empty strings`);
       }
       out[key] = value.map((v) => v.trim());
     } else if (key === "callbackPath") {
-      if (typeof value !== "string" || !value.trim()) throw new Error("project set: oauth.callbackPath must be a non-empty string");
+      if (typeof value !== "string" || !value.trim()) throw new Error("org project set: oauth.callbackPath must be a non-empty string");
       const callbackPath = value.trim();
       if (callbackPath !== DEFAULT_CALLBACK_PATH) {
-        throw new Error(`project set: oauth.callbackPath must be "${DEFAULT_CALLBACK_PATH}" (got ${JSON.stringify(callbackPath)})`);
+        throw new Error(`org project set: oauth.callbackPath must be "${DEFAULT_CALLBACK_PATH}" (got ${JSON.stringify(callbackPath)})`);
       }
       out.callbackPath = callbackPath;
     } else if (key === "fofuSubdomain") {
-      if (typeof value !== "string") throw new Error('project set: oauth.fofuSubdomain must be a string ("" selects the apex fofu.ai)');
+      if (typeof value !== "string") throw new Error('org project set: oauth.fofuSubdomain must be a string ("" selects the apex fofu.ai)');
       out.fofuSubdomain = value.trim();
     } else {
-      throw new Error(`project set: oauth key "${key}" \u2014 expected only subdomains/domains/callbackPath/fofuSubdomain`);
+      throw new Error(`org project set: oauth key "${key}" \u2014 expected only subdomains/domains/callbackPath/fofuSubdomain`);
     }
   }
   return out;
@@ -15657,49 +16016,49 @@ function parseReposVar(raw) {
   try {
     parsed = JSON.parse(raw);
   } catch {
-    throw new Error('project set: repos must be a JSON array, e.g. ["mutmutco/mm-foo"]');
+    throw new Error('org project set: repos must be a JSON array, e.g. ["mutmutco/mm-foo"]');
   }
   if (!Array.isArray(parsed) || parsed.length === 0 || parsed.some((r) => typeof r !== "string" || !r.trim())) {
-    throw new Error("project set: repos must be a non-empty array of owner/name strings");
+    throw new Error("org project set: repos must be a non-empty array of owner/name strings");
   }
   return parsed.map((r) => r.trim());
 }
 function parsePublishRequiredVar(raw) {
   if (raw === "true") return true;
   if (raw === "false") return false;
-  throw new Error("project set: publishRequired must be true or false");
+  throw new Error("org project set: publishRequired must be true or false");
 }
 function parseFofuEnabledVar(raw) {
   if (raw === "true") return true;
   if (raw === "false") return false;
-  throw new Error("project set: fofuEnabled must be true or false");
+  throw new Error("org project set: fofuEnabled must be true or false");
 }
 function parseRuntimeVaultOnlyVar(raw) {
   if (raw === "true") return true;
   if (raw === "false") return false;
-  throw new Error("project set: runtimeVaultOnly must be true or false");
+  throw new Error("org project set: runtimeVaultOnly must be true or false");
 }
 function parseConsumesDesignSystemVar(raw) {
   if (raw === "fofu") return raw;
-  throw new Error('project set: consumesDesignSystem must be "fofu"');
+  throw new Error('org project set: consumesDesignSystem must be "fofu"');
 }
 function parsePublishDirVar(raw) {
   const v = raw.trim();
   if (v === "" || v === ".") {
-    throw new Error("project set: publishDir must be a non-empty relative subpath, e.g. packages/ui (omit it or --unset publishDir for the repo root)");
+    throw new Error("org project set: publishDir must be a non-empty relative subpath, e.g. packages/ui (omit it or --unset publishDir for the repo root)");
   }
   if (!/^[A-Za-z0-9._-]+(\/[A-Za-z0-9._-]+)*$/.test(v) || /(^|\/)\.\.(\/|$)/.test(v)) {
-    throw new Error('project set: publishDir must be a safe relative subpath \u2014 no leading slash, no ".." segment');
+    throw new Error('org project set: publishDir must be a safe relative subpath \u2014 no leading slash, no ".." segment');
   }
   return v;
 }
 function parseDsManifestPathVar(raw) {
   const v = raw.trim();
   if (v === "" || !/^[A-Za-z0-9._-]+(\/[A-Za-z0-9._-]+)*$/.test(v) || /(^|\/)\.\.(\/|$)/.test(v)) {
-    throw new Error('project set: dsManifestPath must be a safe relative path \u2014 no leading slash, no ".." segment');
+    throw new Error('org project set: dsManifestPath must be a safe relative path \u2014 no leading slash, no ".." segment');
   }
   if (v !== "package.json" && !v.endsWith("/package.json")) {
-    throw new Error("project set: dsManifestPath must point to a package.json, e.g. web/package.json");
+    throw new Error("org project set: dsManifestPath must point to a package.json, e.g. web/package.json");
   }
   return v;
 }
@@ -15708,10 +16067,10 @@ function parseRequiredChecksVar(raw) {
   try {
     parsed = JSON.parse(raw);
   } catch {
-    throw new Error('project set: requiredChecks must be a JSON array, e.g. ["gate"] or [] for an intentional no-ci repo');
+    throw new Error('org project set: requiredChecks must be a JSON array, e.g. ["gate"] or [] for an intentional no-ci repo');
   }
   if (!Array.isArray(parsed) || parsed.some((c) => typeof c !== "string" || !c.trim())) {
-    throw new Error("project set: requiredChecks must be a JSON array of non-empty check-context strings (use [] for none)");
+    throw new Error("org project set: requiredChecks must be a JSON array of non-empty check-context strings (use [] for none)");
   }
   return parsed.map((c) => c.trim());
 }
@@ -15720,22 +16079,22 @@ function parseGateVar(raw) {
   try {
     parsed = JSON.parse(raw);
   } catch {
-    throw new Error('project set: gate must be JSON, e.g. {"runtime":"python","cmd":"pytest","workdir":"app"}');
+    throw new Error('org project set: gate must be JSON, e.g. {"runtime":"python","cmd":"pytest","workdir":"app"}');
   }
   if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
-    throw new Error("project set: gate must be a {runtime,cmd,workdir,cacheDepPath,pyVersion} object");
+    throw new Error("org project set: gate must be a {runtime,cmd,workdir,cacheDepPath,pyVersion} object");
   }
   const map = parsed;
   const out = {};
   for (const [key, value] of Object.entries(map)) {
     if (key === "runtime") {
-      if (value !== "node" && value !== "python") throw new Error('project set: gate.runtime must be "node" or "python"');
+      if (value !== "node" && value !== "python") throw new Error('org project set: gate.runtime must be "node" or "python"');
       out.runtime = value;
     } else if (key === "cmd" || key === "workdir" || key === "cacheDepPath" || key === "pyVersion") {
-      if (typeof value !== "string" || !value.trim()) throw new Error(`project set: gate.${key} must be a non-empty string`);
+      if (typeof value !== "string" || !value.trim()) throw new Error(`org project set: gate.${key} must be a non-empty string`);
       out[key] = value.trim();
     } else {
-      throw new Error(`project set: gate key "${key}" \u2014 expected only runtime/cmd/workdir/cacheDepPath/pyVersion`);
+      throw new Error(`org project set: gate key "${key}" \u2014 expected only runtime/cmd/workdir/cacheDepPath/pyVersion`);
     }
   }
   return out;
@@ -15813,25 +16172,25 @@ function buildProjectSetPatch(input) {
   const patch = {};
   if (input.class) {
     if (input.class !== "deployable" && input.class !== "content") {
-      throw new Error("project set: --class must be deployable or content");
+      throw new Error("org project set: --class must be deployable or content");
     }
     patch.class = input.class;
   }
   if (input.projectType) {
     if (!isProjectType(input.projectType)) {
-      throw new Error(`project set: --project-type must be one of: ${PROJECT_TYPES.join(", ")}`);
+      throw new Error(`org project set: --project-type must be one of: ${PROJECT_TYPES.join(", ")}`);
     }
     patch.projectType = input.projectType;
   }
   if (input.deployModel) {
     if (!isDeployModel(input.deployModel)) {
-      throw new Error(`project set: --deploy-model must be one of: ${DEPLOY_MODELS.join(", ")}`);
+      throw new Error(`org project set: --deploy-model must be one of: ${DEPLOY_MODELS.join(", ")}`);
     }
     patch.deployModel = input.deployModel;
   }
   if (input.releaseTrack) {
     if (!isReleaseTrack(input.releaseTrack)) {
-      throw new Error(`project set: --release-track must be one of: ${RELEASE_TRACKS.join(", ")}`);
+      throw new Error(`org project set: --release-track must be one of: ${RELEASE_TRACKS.join(", ")}`);
     }
     patch.releaseTrack = input.releaseTrack;
   }
@@ -15840,16 +16199,16 @@ function buildProjectSetPatch(input) {
     if (eq <= 0) {
       const looksPositional = value.includes("/") || !value.includes("=");
       const hint = looksPositional ? " \u2014 if that is the [owner/repo] argument, put it BEFORE --var; a variadic flag swallows the tokens after it" : "";
-      throw new Error(`project set: --var must be KEY=VALUE (got "${value}")${hint}`);
+      throw new Error(`org project set: --var must be KEY=VALUE (got "${value}")${hint}`);
     }
     const key = value.slice(0, eq);
     const raw = value.slice(eq + 1);
     if (!SETTABLE_VAR_KEY_SET.has(key)) {
-      throw new Error(`project set: --var KEY "${key}" is not settable \u2014 allowed keys: ${SETTABLE_VAR_KEYS.join(", ")}`);
+      throw new Error(`org project set: --var KEY "${key}" is not settable \u2014 allowed keys: ${SETTABLE_VAR_KEYS.join(", ")}`);
     }
     if (key === "projectNumber") {
       const n = Number(raw);
-      if (!Number.isFinite(n)) throw new Error("project set: projectNumber must be numeric");
+      if (!Number.isFinite(n)) throw new Error("org project set: projectNumber must be numeric");
       patch[key] = n;
     } else if (key === "requiredRuntimeSecrets") {
       patch[key] = parseRuntimeSecretsVar(raw);
@@ -15882,7 +16241,7 @@ function buildProjectSetPatch(input) {
     } else if (key === "dsManifestPath") {
       patch[key] = parseDsManifestPathVar(raw);
     } else if (key === "ci") {
-      if (raw !== "none") throw new Error('project set: ci must be "none" (or use --unset ci to require checks)');
+      if (raw !== "none") throw new Error('org project set: ci must be "none" (or use --unset ci to require checks)');
       patch[key] = raw;
     } else if (key === "requiredChecks") {
       patch[key] = parseRequiredChecksVar(raw);
@@ -15894,7 +16253,7 @@ function buildProjectSetPatch(input) {
   }
   for (const key of input.unsets) {
     if (!UNSET_KEY_SET.has(key)) {
-      throw new Error(`project set: --unset must be one of: ${UNSET_KEYS.join(", ")}`);
+      throw new Error(`org project set: --unset must be one of: ${UNSET_KEYS.join(", ")}`);
     }
     patch[key] = null;
   }
@@ -15903,7 +16262,7 @@ function buildProjectSetPatch(input) {
     patch.edgeDomains = null;
   }
   if (Object.keys(patch).length === 0) {
-    throw new Error("project set: nothing to set - pass --class, --project-type, --deploy-model, --release-track, --var KEY=VALUE, --unset KEY, and/or --clear-web-profile");
+    throw new Error("org project set: nothing to set - pass --class, --project-type, --deploy-model, --release-track, --var KEY=VALUE, --unset KEY, and/or --clear-web-profile");
   }
   return patch;
 }
@@ -15915,36 +16274,36 @@ function buildSetDeployPatch(_slug, input) {
   const clean4 = (v) => typeof v === "string" && v.trim() !== "" ? v.trim() : void 0;
   const stage = clean4(input.stage);
   if (!stage || !DEPLOY_STAGES.includes(stage)) {
-    throw new Error(`project set-deploy: --stage must be one of: ${DEPLOY_STAGES.join(", ")}`);
+    throw new Error(`org project set-deploy: --stage must be one of: ${DEPLOY_STAGES.join(", ")}`);
   }
   const substrate = clean4(input.substrate);
   if (substrate !== void 0 && !DEPLOY_SUBSTRATES.includes(substrate)) {
-    throw new Error(`project set-deploy: --substrate must be one of: ${DEPLOY_SUBSTRATES.join(", ")}`);
+    throw new Error(`org project set-deploy: --substrate must be one of: ${DEPLOY_SUBSTRATES.join(", ")}`);
   }
   const sshHost = clean4(input.sshHost);
   const sshUser = clean4(input.sshUser);
   const deployPath = clean4(input.deployPath);
   const serviceName = clean4(input.service);
   for (const [label, v] of [["--ssh-host", sshHost], ["--ssh-user", sshUser], ["--deploy-path", deployPath], ["--service", serviceName]]) {
-    if (v !== void 0 && !DEPLOY_SHELL_SAFE_RE.test(v)) throw new Error(`project set-deploy: ${label} contains unsafe characters`);
+    if (v !== void 0 && !DEPLOY_SHELL_SAFE_RE.test(v)) throw new Error(`org project set-deploy: ${label} contains unsafe characters`);
   }
   let port;
   if (input.port !== void 0 && input.port !== null && `${input.port}`.trim() !== "") {
     port = Number(input.port);
-    if (!Number.isInteger(port) || port < 1 || port > 65535) throw new Error("project set-deploy: --port must be an integer 1..65535");
+    if (!Number.isInteger(port) || port < 1 || port > 65535) throw new Error("org project set-deploy: --port must be an integer 1..65535");
   }
   const domain = clean4(input.domain);
-  if (domain !== void 0 && !DEPLOY_DOMAIN_RE.test(domain)) throw new Error(`project set-deploy: --domain must be a DNS hostname, got ${JSON.stringify(input.domain)}`);
+  if (domain !== void 0 && !DEPLOY_DOMAIN_RE.test(domain)) throw new Error(`org project set-deploy: --domain must be a DNS hostname, got ${JSON.stringify(input.domain)}`);
   const aliases = (Array.isArray(input.aliases) ? input.aliases : []).map((a) => clean4(a)).filter((a) => a !== void 0);
   for (const a of aliases) {
-    if (!DEPLOY_DOMAIN_RE.test(a)) throw new Error(`project set-deploy: --alias must be a DNS hostname, got ${JSON.stringify(a)}`);
+    if (!DEPLOY_DOMAIN_RE.test(a)) throw new Error(`org project set-deploy: --alias must be a DNS hostname, got ${JSON.stringify(a)}`);
   }
   const uniqueAliases = [...new Set(aliases)];
   if (input.clearAliases && uniqueAliases.length) {
-    throw new Error("project set-deploy: --clear-aliases cannot be combined with --alias (they contradict)");
+    throw new Error("org project set-deploy: --clear-aliases cannot be combined with --alias (they contradict)");
   }
   if (input.noEnvFile !== void 0 && typeof input.noEnvFile !== "boolean") {
-    throw new Error("project set-deploy: --no-env-file must be true or false");
+    throw new Error("org project set-deploy: --no-env-file must be true or false");
   }
   return {
     stage,
@@ -16034,7 +16393,7 @@ function evaluatePromotionFilelessGuard(input) {
     return {
       ok: false,
       reason: `the ${branch} docker-compose.yml marks a service fileless (mmi.runtime-env: "true") but DEPLOY#${stage}.noEnvFile is not true \u2014 the ${stage} deploy would fail exit-78 ("compose is fileless but DEPLOY#${stage} noEnvFile is not true"). Fix BEFORE promoting, then re-run:
-  mmi-cli project set-deploy --stage ${stage} --no-env-file true   # register the fileless flag
+  mmi-cli org project set-deploy --stage ${stage} --no-env-file true   # register the fileless flag
   gh workflow run tenant-reconcile.yml --repo mutmutco/MMI-Hub     # re-render the box control script (#1056)
   (or pass --skip-compose-guard to override this preflight)`
     };
@@ -16058,11 +16417,11 @@ function vaultCleanupNote(slug) {
 function buildRetirePlan(input) {
   const target = input.target?.trim();
   if (!target) {
-    throw new Error("project retire: pass <owner/repo> or a slug to retire");
+    throw new Error("org project retire: pass <owner/repo> or a slug to retire");
   }
   const slug = retireSlugOf(target);
   if (!/^[a-z0-9][a-z0-9-]*$/.test(slug)) {
-    throw new Error(`project retire: "${target}" does not resolve to a valid slug`);
+    throw new Error(`org project retire: "${target}" does not resolve to a valid slug`);
   }
   const repo = target.includes("/") ? target : `mutmutco/${slug}`;
   return { slug, repo, apply: Boolean(input.apply), skipBoard: Boolean(input.skipBoard) };
@@ -16392,7 +16751,7 @@ function registerSecretsCommands(program3) {
     const ok = await secretsRequest(d, key, o);
     if (!ok) process.exitCode = 1;
   }));
-  secrets.command("declare <key>").description("project-admin self-declare: register a NEW secrets-catalog entry for your own repo (name/purpose/group/owner/consumers/stages metadata only \u2014 never a value); closes the declare-first master-only gap (MM-PM#261/#262). Catalog-declare only \u2014 wiring the key into requiredRuntimeSecrets stays master-only (`secrets request` to ask, or `project set --var requiredRuntimeSecrets=...`); dropped from self-serve after adversarial review found real escalation paths in that additive-merge logic (MMI-Hub#2780). Separate from `project set`, which stays master-only for this field.").requiredOption("--purpose <text>", "what this secret is for").requiredOption("--group <text>", "catalog grouping, e.g. database, auth").option("--owner <login>", "catalog owner login (default: your own resolved GitHub login)").option("--consumers <list>", "comma-separated consumers (default: box)").option("--stages <list>", "comma-separated dev/rc/main this entry applies to (default: none \u2014 one stageless shared value)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--json", "machine-readable output").action((key, o) => withSecrets(async (d) => {
+  secrets.command("declare <key>").description("project-admin self-declare: register a NEW secrets-catalog entry for your own repo (name/purpose/group/owner/consumers/stages metadata only \u2014 never a value); closes the declare-first master-only gap (MM-PM#261/#262). Catalog-declare only \u2014 wiring the key into requiredRuntimeSecrets stays master-only (`secrets request` to ask, or `org project set --var requiredRuntimeSecrets=...`); dropped from self-serve after adversarial review found real escalation paths in that additive-merge logic (MMI-Hub#2780). Separate from `org project set`, which stays master-only for this field.").requiredOption("--purpose <text>", "what this secret is for").requiredOption("--group <text>", "catalog grouping, e.g. database, auth").option("--owner <login>", "catalog owner login (default: your own resolved GitHub login)").option("--consumers <list>", "comma-separated consumers (default: box)").option("--stages <list>", "comma-separated dev/rc/main this entry applies to (default: none \u2014 one stageless shared value)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--json", "machine-readable output").action((key, o) => withSecrets(async (d) => {
     const owner = o.owner ?? await githubLogin();
     if (!owner) {
       fail("secrets declare: could not resolve your GitHub login for --owner; pass --owner explicitly");
@@ -16419,7 +16778,6 @@ function registerSecretsCommands(program3) {
     if (!ok) process.exitCode = 1;
   });
   secrets.command("set <key>").description("write/rotate a secret; value from stdin (never an argument). DECLARE-FIRST (#2528): the key must be a declared catalog coordinate \u2014 bare <KEY> = the stageless canonical, <stage>/<KEY> = a declared per-stage override; undeclared writes are rejected with the fix").option("--repo <owner/repo>", "target repo (defaults to the current repo)").action(setHandler);
-  secrets.command("edit <key>").description("alias for set \u2014 replace a secret value (read from stdin)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").action(setHandler);
   secrets.command("copy").description("copy provider keys between vault tiers (audit-logged; org-tier source is master-gated)").requiredOption("--from <stage>", "source tier: dev, rc, or main").requiredOption("--to <stage>", "destination tier: dev, rc, or main").requiredOption("--keys <names>", "comma-separated secret names (encryption keys blocked)").option("--dry-run", "report copies without writing").option("--repo <owner/repo>", "target repo (defaults to the current repo)").action((o) => withSecrets(async (d) => {
     const stages = ["dev", "rc", "main"];
     if (!stages.includes(o.from) || !stages.includes(o.to)) {
@@ -16766,14 +17124,14 @@ async function fetchInventory() {
     }
   });
   if (incomplete.length === PROJECTS.length) {
-    throw new Error(`box: could not read any Hetzner project \u2014
+    throw new Error(`runtime box: could not read any Hetzner project \u2014
   ${incomplete.join("\n  ")}`);
   }
   return { boxes: boxes.sort((a, b) => a.name.localeCompare(b.name)), incomplete };
 }
 function warnIncomplete(incomplete) {
-  for (const f of incomplete) console.error(`box: WARNING \u2014 ${f}`);
-  if (incomplete.length) console.error("box: this inventory is INCOMPLETE \u2014 boxes may be missing from it.");
+  for (const f of incomplete) console.error(`runtime box: WARNING \u2014 ${f}`);
+  if (incomplete.length) console.error("runtime box: this inventory is INCOMPLETE \u2014 boxes may be missing from it.");
 }
 function registerBoxCommands(program3) {
   const box = program3.command("box").description("the box inventory \u2014 which machines exist, their addresses, and the vault key that opens each (never key values)");
@@ -16798,12 +17156,12 @@ function registerBoxCommands(program3) {
       if (result.kind === "unknown") {
         warnIncomplete(result.reasons);
         await failGraceful(
-          `box: cannot confirm whether '${name}' exists \u2014 part of the inventory could not be read (see above). Refusing to answer "no such box" from a list I know is incomplete.`
+          `runtime box: cannot confirm whether '${name}' exists \u2014 part of the inventory could not be read (see above). Refusing to answer "no such box" from a list I know is incomplete.`
         );
         return;
       }
       if (result.kind === "absent") {
-        await failGraceful(`box: no box named '${name}'. Known boxes: ${result.known.join(", ") || "(none)"}`);
+        await failGraceful(`runtime box: no box named '${name}'. Known boxes: ${result.known.join(", ") || "(none)"}`);
         return;
       }
       const found = result.box;
@@ -16918,7 +17276,7 @@ function awsScheduleNames(payload) {
   return schedules.map((s) => s && typeof s === "object" ? s.Name : void 0).filter((n) => typeof n === "string" && !isJervResource(n));
 }
 var DECLARED_ENTRIES = [
-  { name: "mmi-backup (mm-central, mmi-fofu, zuber, mmi-oguz)", cadence: "17 2 * * *", executor: "box cron.d", llm: "no", resolved: "declared", source: "/etc/cron.d/mmi-backup \u2192 /opt/mmi-control/nightly-backup.sh (verify: mmi-cli box get <box> --ssh)" },
+  { name: "mmi-backup (mm-central, mmi-fofu, zuber, mmi-oguz)", cadence: "17 2 * * *", executor: "box cron.d", llm: "no", resolved: "declared", source: "/etc/cron.d/mmi-backup \u2192 /opt/mmi-control/nightly-backup.sh (verify: mmi-cli runtime box get <box> --ssh)" },
   { name: "zuber-bake", cadence: "*:05/30 (every 30 min)", executor: "zuber systemd timer", llm: "no", resolved: "declared", source: "zuber-bake.timer \u2192 rolling overlay bake, metro tier, next ~6h window (verify over ssh)" },
   { name: "zuber-bake-full", cadence: "00:30 UTC (03:30 TRT, daily)", executor: "zuber systemd timer", llm: "no", resolved: "declared", source: "zuber-bake-full.timer \u2192 full 24h overlay rebuild, all 81 il (verify over ssh)" }
 ];
@@ -16950,7 +17308,7 @@ function renderDocSection(entries, generatedAtIso) {
   }
   return [
     DOC_START_MARKER,
-    `_Generated by \`mmi-cli schedules --doc\` at ${generatedAtIso}. Never hand-edit this section._`,
+    `_Generated by \`mmi-cli org schedules --doc\` at ${generatedAtIso}. Never hand-edit this section._`,
     "",
     lines.join("\n"),
     DOC_END_MARKER
@@ -16960,7 +17318,7 @@ function spliceDoc(docText, generatedSection) {
   const start = docText.indexOf(DOC_START_MARKER);
   const end = docText.indexOf(DOC_END_MARKER);
   if (start === -1 || end === -1 || end < start) {
-    throw new Error(`schedules --doc: the target doc is missing the ${DOC_START_MARKER} / ${DOC_END_MARKER} markers \u2014 refusing to guess where the generated inventory goes.`);
+    throw new Error(`org schedules --doc: the target doc is missing the ${DOC_START_MARKER} / ${DOC_END_MARKER} markers \u2014 refusing to guess where the generated inventory goes.`);
   }
   return docText.slice(0, start) + generatedSection + docText.slice(end + DOC_END_MARKER.length);
 }
@@ -17168,11 +17526,11 @@ async function fetchNotebook(client = defaultGitHubClient(), readRegistry = defa
   };
 }
 function warnIncomplete2(incomplete) {
-  for (const f of incomplete) console.error(`schedules: WARNING \u2014 ${f}`);
-  if (incomplete.length) console.error("schedules: this notebook is INCOMPLETE \u2014 schedules may be missing from it.");
+  for (const f of incomplete) console.error(`org schedules: WARNING \u2014 ${f}`);
+  if (incomplete.length) console.error("org schedules: this notebook is INCOMPLETE \u2014 schedules may be missing from it.");
 }
 function reportDrift(drift) {
-  for (const d of drift) console.error(`schedules: DRIFT \u2014 ${d}`);
+  for (const d of drift) console.error(`org schedules: DRIFT \u2014 ${d}`);
 }
 function registerSchedulesCommands(program3) {
   program3.command("schedules").description("the org schedules notebook \u2014 every armed cron, timer, and scheduled LLM lane, resolved live (jerv side lives in jerv-cli schedules)").option("--json", "machine-readable output (consumed by jerv-cli schedules --all)").option("--doc <path>", "splice the generated inventory into the given doc between the schedules:inventory markers (docs/schedules.md)").action(async (o) => {
@@ -17181,14 +17539,14 @@ function registerSchedulesCommands(program3) {
       if (o.doc) {
         if (incomplete.length) {
           warnIncomplete2(incomplete);
-          await failGraceful("schedules --doc: refusing to regenerate the doc from an incomplete read (see warnings above).");
+          await failGraceful("org schedules --doc: refusing to regenerate the doc from an incomplete read (see warnings above).");
           return;
         }
         const docText = await (0, import_promises2.readFile)(o.doc, "utf8");
         const spliced = spliceDoc(docText, renderDocSection(entries, (/* @__PURE__ */ new Date()).toISOString()));
         await (0, import_promises2.writeFile)(o.doc, spliced, "utf8");
         reportDrift(drift);
-        console.log(`schedules: wrote ${entries.length} entries into ${o.doc}`);
+        console.log(`org schedules: wrote ${entries.length} entries into ${o.doc}`);
         return;
       }
       if (o.json) {
@@ -17435,15 +17793,15 @@ async function runIssueChildren(deps, epic, opts) {
   const seen = /* @__PURE__ */ new Set([childKey(repo, ref.number)]);
   for (const raw of await queryChildren(deps, owner, name, ref.number)) {
     if (out.length >= CHILDREN_MAX_TOTAL) break;
-    const child = shapeChildNode(raw, 1, boardProjectId);
-    out.push(child);
-    seen.add(childKey(child.repo, child.number));
+    const child2 = shapeChildNode(raw, 1, boardProjectId);
+    out.push(child2);
+    seen.add(childKey(child2.repo, child2.number));
   }
   if (!opts.recursive || out.length >= CHILDREN_MAX_TOTAL) return out;
   const queue = [];
-  for (const child of out) {
-    const sp = trySplitRepo(child.repo);
-    if (sp) queue.push({ owner: sp.owner, name: sp.name, number: child.number, depth: 1 });
+  for (const child2 of out) {
+    const sp = trySplitRepo(child2.repo);
+    if (sp) queue.push({ owner: sp.owner, name: sp.name, number: child2.number, depth: 1 });
   }
   while (queue.length && out.length < CHILDREN_MAX_TOTAL) {
     const frame = queue.shift();
@@ -17456,13 +17814,13 @@ async function runIssueChildren(deps, epic, opts) {
     }
     for (const raw of nodes) {
       if (out.length >= CHILDREN_MAX_TOTAL) break;
-      const child = shapeChildNode(raw, frame.depth + 1, boardProjectId);
-      const key = childKey(child.repo, child.number);
+      const child2 = shapeChildNode(raw, frame.depth + 1, boardProjectId);
+      const key = childKey(child2.repo, child2.number);
       if (seen.has(key)) continue;
       seen.add(key);
-      out.push(child);
-      const sp = trySplitRepo(child.repo);
-      if (sp) queue.push({ owner: sp.owner, name: sp.name, number: child.number, depth: frame.depth + 1 });
+      out.push(child2);
+      const sp = trySplitRepo(child2.repo);
+      if (sp) queue.push({ owner: sp.owner, name: sp.name, number: child2.number, depth: frame.depth + 1 });
     }
   }
   return out;
@@ -17810,9 +18168,12 @@ var DOC_PLACEHOLDER_PROMPTS = [
   "install, dev server",
   "lint, typecheck, repo gate script",
   "ports, env from vault not files",
-  "Describe the product/service",
-  "How to run, build, and test locally",
-  "System shape: components, data flow, deploy model",
+  "top-level dir/module: what it is, in one line",
+  "Owner/operator \u2014 who runs this day to day",
+  "one human-readable command/steps to get this running locally",
+  "the product/service/library, in one or two bullets",
+  "(top-level dir)",
+  "Languages, frameworks, datastores, major services",
   "Build/test commands, CI gate, deploy target"
 ];
 function unfilledDocPlaceholders(text) {
@@ -18210,7 +18571,7 @@ function registerBootstrapCommands(program3) {
       projectMeta: meta,
       deployModel: typeof meta?.deployModel === "string" ? meta.deployModel : void 0,
       readLocalFile: (path2) => path2 === "projects.json" && apiProjects != null ? apiProjects : (0, import_node_fs18.existsSync)(path2) ? (0, import_node_fs18.readFileSync)(path2, "utf8") : null,
-      // requiredGcpApis is stored as an array by a JSON write, but `project set --var KEY=VALUE` stores a raw
+      // requiredGcpApis is stored as an array by a JSON write, but `org project set --var KEY=VALUE` stores a raw
       // comma-string — accept either so the seeded value verifies regardless of how it was written.
       requiredGcpApis: (() => {
         const v = meta?.requiredGcpApis;
@@ -18745,7 +19106,7 @@ function registerStageCommands(program3) {
     const read = await fetchProjectBySlugChecked(slug, reg);
     const decision = decidePortRange({ metaReadOk: read.ok, metaPortRange: read.ok ? metaPortRange(read.project) : null });
     if (decision.action === "fail") {
-      return failGraceful(`port-range: ${decision.reason}${read.ok ? "" : ` (${read.error})`}`);
+      return failGraceful(`stage port-range: ${decision.reason}${read.ok ? "" : ` (${read.error})`}`);
     }
     if (decision.action === "return") {
       const [start2, end2] = decision.range;
@@ -18755,7 +19116,7 @@ function registerStageCommands(program3) {
     const infra = resolvePortRangeInfra(process.cwd(), __dirname);
     if (!infra) {
       return failGraceful(
-        `port-range: no MMI-Hub allocator files found (checked cwd ${process.cwd()}, sibling MMI-Hub dirs, and the installed package location); ensure the Hub's infra/port-ranges.json and infra/port-ddb.mjs are reachable`
+        `stage port-range: no MMI-Hub allocator files found (checked cwd ${process.cwd()}, sibling MMI-Hub dirs, and the installed package location); ensure the Hub's infra/port-ranges.json and infra/port-ddb.mjs are reachable`
       );
     }
     const path2 = infra.registryPath;
@@ -18768,7 +19129,7 @@ function registerStageCommands(program3) {
     const { range: [start, end], source } = await ensurePortRangeAtomic(repo, path2, allocate);
     const write = await upsertProject(slug, { portRange: { start, end } }, reg);
     if (!write.ok && source === "ddb") {
-      return failGraceful(`port-range: block [${start}, ${end}] was allocated (cursor advanced) but NOT recorded in the registry META (${write.error ?? `HTTP ${write.status}`}) \u2014 fix auth/connectivity and retry so the block is persisted; do not re-run blind`);
+      return failGraceful(`stage port-range: block [${start}, ${end}] was allocated (cursor advanced) but NOT recorded in the registry META (${write.error ?? `HTTP ${write.status}`}) \u2014 fix auth/connectivity and retry so the block is persisted; do not re-run blind`);
     }
     if (o.json) {
       printLine(JSON.stringify({ repo, portRange: [start, end], source: "allocated", persisted: write.ok, ...write.ok ? {} : { persistError: write.error ?? `HTTP ${write.status}` } }));
@@ -18808,7 +19169,7 @@ function registerStageCommands(program3) {
       },
       control: async ({ repo, action, host, ip }) => {
         const res = await tenantControl({ repo, stage: "dev", action, host, ip }, rcDeps);
-        if (!res.ok) throw new Error(`tenant control ${action} dispatch failed: ${res.body?.error ?? res.error ?? `HTTP ${res.status}`}`);
+        if (!res.ok) throw new Error(`runtime tenant control ${action} dispatch failed: ${res.body?.error ?? res.error ?? `HTTP ${res.status}`}`);
       }
     };
     try {
@@ -19418,7 +19779,7 @@ async function resolveBoardAdvanceForPr(prNumber, repoOption) {
   });
 }
 function renderGcApplyResult(result) {
-  const lines = ["gc apply result:"];
+  const lines = ["worktree gc apply result:"];
   lines.push(`  branches removed: ${result.removedBranches.length ? result.removedBranches.join(", ") : "none"}`);
   lines.push(`  remote branches removed: ${result.removedRemoteBranches.length ? result.removedRemoteBranches.join(", ") : "none"}`);
   lines.push(`  tracking refs removed: ${result.removedTrackingRefs.length ? result.removedTrackingRefs.join(", ") : "none"}`);
@@ -19463,7 +19824,7 @@ function evaluatePrMergeHousekeeping(report, context, force = false) {
   const detail = failed ? `scratch housekeeping failed${scratch?.error ? `: ${scratch.error}` : ""}` : `${prunable} prunable + ${unprunable} un-prunable scratch item(s) remain after cleanup`;
   return {
     blocked: true,
-    reason: `${context} housekeeping blocked merge: ${detail}. Run \`mmi-cli gc --scratch --apply\` to clear it, then retry \u2014 or re-run \`mmi-cli ${context} --force\` to acknowledge and land anyway. (Kept advisory plans/ scratch never blocks: it is gitignored and can never reach origin.)`
+    reason: `${context} housekeeping blocked merge: ${detail}. Run \`mmi-cli worktree gc --scratch --apply\` to clear it, then retry \u2014 or re-run \`mmi-cli ${context} --force\` to acknowledge and land anyway. (Kept advisory plans/ scratch never blocks: it is gitignored and can never reach origin.)`
   };
 }
 function assertPrMergeHousekeepingClean(startingPath, context, options = {}) {
@@ -19882,7 +20243,7 @@ function classifyStaleLeaks(input) {
       kind: "stale-worktree",
       ref: wt.branch,
       detail: `merged/closed branch ${wt.branch} still checked out at ${wt.path}`,
-      remediation: `cd "${wt.path}" && mmi-cli worktree land --apply  (or: mmi-cli gc --apply)`
+      remediation: `cd "${wt.path}" && mmi-cli worktree land --apply  (or: mmi-cli worktree gc --apply)`
     });
   }
   for (const branch of input.localBranches) {
@@ -19895,7 +20256,7 @@ function classifyStaleLeaks(input) {
       kind: "stale-branch",
       ref: branch,
       detail: `merged/closed branch ${branch} has no worktree`,
-      remediation: "mmi-cli gc --apply"
+      remediation: "mmi-cli worktree gc --apply"
     });
   }
   for (const wt of input.worktrees) {
@@ -19919,7 +20280,7 @@ function classifyStaleLeaks(input) {
         kind: "orphan-dir",
         ref: dir,
         detail: `directory under the worktrees root is not a registered worktree`,
-        remediation: `mmi-cli gc --apply  (or: Remove-Item/rm -rf "${dir}")`
+        remediation: `mmi-cli worktree gc --apply  (or: Remove-Item/rm -rf "${dir}")`
       });
     }
   }
@@ -20715,7 +21076,7 @@ function buildPluginGuardDecision(i) {
 }
 function buildGuardSessionStartLine(state, opts = {}) {
   if (state === "healthy" || state === "not-org") return { exitCode: 0 };
-  const recovery = opts.recovery ?? "mmi-cli plugin-heal";
+  const recovery = opts.recovery ?? "mmi-cli plugin heal";
   const restartHint = opts.restartHint ?? "restart your agent host / reload plugins";
   const reason = state === "no-install" ? "MMI plugin is not installed for this user/session" : "MMI plugin is installed but its marketplace/cache is unresolved";
   return {
@@ -21072,7 +21433,7 @@ function formatLastRun(r) {
 }
 function formatDeployStatus(r) {
   const lines = [
-    `deploy status \u2014 ${r.repo} (${r.slug}) stage ${r.stage}`,
+    `runtime deploy status \u2014 ${r.repo} (${r.slug}) stage ${r.stage}`,
     "",
     `running version: ${r.runningVersion ?? "none stamped"}`,
     `last deploy run: ${formatLastRun(r)}`,
@@ -21105,7 +21466,7 @@ function registerDeployCommands(program3) {
   const deploy = program3.command("deploy").description("per-stage deploy observability \u2014 last run, health, and running version (#2688)");
   deploy.command("status <stage>").description("last deploy run + runtime health probe + running version for a stage (defaults to the current repo)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--json", "machine-readable output").action(async (stage, o) => {
     if (!STAGES2.includes(stage)) {
-      return fail(`deploy status: <stage> must be dev, rc, or main`);
+      return fail(`runtime deploy status: <stage> must be dev, rc, or main`);
     }
     try {
       const cfg = await loadConfig();
@@ -21134,7 +21495,7 @@ function registerDeployCommands(program3) {
       }
       if (report.health?.ok === false) process.exitCode = 1;
     } catch (e) {
-      return failGraceful(`deploy status: ${e.message}`);
+      return failGraceful(`runtime deploy status: ${e.message}`);
     }
   });
 }
@@ -21253,7 +21614,7 @@ async function collectOnboardStatus() {
       if (read.ok && read.project) {
         registry2 = { ok: true, detail: `project "${read.project.name ?? slug}" registered` };
       } else if (read.ok) {
-        registry2 = { ok: false, detail: `repo "${slug}" not registered \u2014 run mmi-cli bootstrap or mmi-cli project set <owner/repo>` };
+        registry2 = { ok: false, detail: `repo "${slug}" not registered \u2014 run mmi-cli bootstrap or mmi-cli org project set <owner/repo>` };
       } else {
         registry2 = { ok: false, detail: `read failed: ${read.error}` };
       }
@@ -21280,7 +21641,7 @@ async function collectOnboardStatus() {
   if (!cfg.sagaApiUrl) {
     nextCommand = "mmi-cli doctor \u2014 fix Hub API URL configuration first";
   } else if (!registry2.ok) {
-    nextCommand = "mmi-cli project set <owner/repo>";
+    nextCommand = "mmi-cli org project set <owner/repo>";
   } else if (!board.ok) {
     nextCommand = "mmi-cli board read";
   } else {
@@ -21349,10 +21710,11 @@ var LOOP_PLAYBOOKS = {
   agent: {
     title: "Agent",
     steps: [
-      { label: "Resume continuity from Jerv's Memory", command: "jerv-cli resume" },
+      { label: "Orient in the current repository", command: "mmi-cli onboard" },
       { label: "Read the next board item", command: "mmi-cli board read" },
-      { label: "Create an isolated worktree from development", command: "mmi-cli worktree create feature/<issue-number>-<short-description> --from origin/development" },
+      { label: "Claim it and create an isolated worktree", command: "mmi-cli worktree create <issue-number> --claim --from origin/development" },
       { label: "Build and test in the touched package", command: "npm test && npm run build" },
+      { label: "Publish the branch", command: "git push -u origin HEAD" },
       { label: "Open the development-base PR", command: 'mmi-cli pr create --title "<title>" --body-file PR_BODY.md --base development' },
       { label: "Wait for checks and land to development", command: "mmi-cli pr checks-wait <PR-number> && mmi-cli pr land <PR-number>" },
       { label: "Release only after the gated train is authorized", command: "mmi-cli release --apply" }
@@ -21361,16 +21723,17 @@ var LOOP_PLAYBOOKS = {
   "start-work": {
     title: "Start Work",
     steps: [
-      { label: "Pull latest development", command: "git checkout development && git pull origin development" },
-      { label: "Create a feature branch", command: "git checkout -b feature/<issue-number>-<short-description>" },
-      { label: "Claim the board item", command: "mmi-cli board claim <issue-number>" },
+      { label: "Orient in the current repository", command: "mmi-cli onboard" },
+      { label: "Read the board item", command: "mmi-cli board show <issue-number>" },
+      { label: "Claim it and create the worktree from development", command: "mmi-cli worktree create <issue-number> --claim --from origin/development" },
       { label: "Start a local stage (deployable repos)", command: "mmi-cli stage run --apply" }
     ]
   },
   "ship-pr": {
     title: "Ship PR",
     steps: [
-      { label: "Push branch and open PR", command: "git push -u origin HEAD && gh pr create --fill --base development" },
+      { label: "Publish the branch", command: "git push -u origin HEAD" },
+      { label: "Open the development-base PR", command: 'mmi-cli pr create --title "<title>" --body-file PR_BODY.md --base development' },
       { label: "Wait for CI checks", command: "mmi-cli pr checks-wait <PR-number>" },
       { label: "Land the PR (merge to development)", command: "mmi-cli pr land <PR-number>" }
     ]
@@ -21378,9 +21741,9 @@ var LOOP_PLAYBOOKS = {
   "hotfix": {
     title: "Hotfix",
     steps: [
-      { label: "Start hotfix", command: "mmi-cli hotfix start" },
-      { label: "Apply fix commits", command: "git cherry-pick -x <commit-sha>" },
-      { label: "Release hotfix to production", command: "mmi-cli hotfix release" }
+      { label: "Create the main-base hotfix PR from an already-merged fix", command: "mmi-cli hotfix start --from <pr#|sha>" },
+      { label: "Wait for the hotfix PR checks", command: "mmi-cli pr checks-wait <PR-number>" },
+      { label: "After the PR is merged, run the gated release", command: "mmi-cli hotfix release <vX.Y.Z> --carries <pr#|sha>" }
     ]
   }
 };
@@ -21430,6 +21793,22 @@ function formatExplainCommand(cmd, rootName) {
   }
   return lines.join("\n").trimEnd();
 }
+function formatExplainGroup(cmd, rootName) {
+  const lines = [
+    `${rootName} ${cmd.path}${cmd.description ? ` \u2014 ${cmd.description}` : ""}`,
+    `Category: ${cmd.category} \xB7 Discovery: ${cmd.discovery}`,
+    "",
+    "Commands:"
+  ];
+  for (const child2 of cmd.subcommands) {
+    const args = child2.arguments.map((arg) => {
+      const name = arg.variadic ? `${arg.name}...` : arg.name;
+      return arg.required ? `<${name}>` : `[${name}]`;
+    }).join(" ");
+    lines.push(`  ${child2.path}${args ? ` ${args}` : ""}${child2.description ? ` \u2014 ${child2.description}` : ""}`);
+  }
+  return lines.join("\n");
+}
 function formatExplainLoop(playbook) {
   const lines = [`${playbook.title} loop:`];
   for (const step of playbook.steps) {
@@ -21439,7 +21818,15 @@ function formatExplainLoop(playbook) {
   return lines.join("\n");
 }
 function findCommandInManifest(manifest, commandPath2) {
-  return manifest.index.find((c) => c.path === commandPath2 || c.path.endsWith(` ${commandPath2}`));
+  const visit = (command) => {
+    if (command.path === commandPath2) return command;
+    for (const child2 of command.subcommands) {
+      const found = visit(child2);
+      if (found) return found;
+    }
+    return void 0;
+  };
+  return visit(manifest.tree);
 }
 function registerExplainCommand(program3) {
   program3.command("explain").description("print a command's purpose, flags, and examples from the live schema \u2014 one grounding call replaces trial-and-error").argument("[command...]", 'the command path to explain (e.g. "issue create")').option("--loop <name>", "print the canonical command sequence: agent | start-work | ship-pr | hotfix").action((commandArgs, opts) => {
@@ -21454,18 +21841,16 @@ function registerExplainCommand(program3) {
     }
     const manifest = buildCommandManifest(program3);
     if (!commandArgs.length) {
-      console.log(manifest.name + (manifest.version ? ` v${manifest.version}` : ""));
-      console.log(manifest.tree.description ?? "");
-      console.log("\nRun `mmi-cli commands` to list every subcommand + its flags.");
+      console.log(formatManifestHuman(manifest));
       return;
     }
     const commandPath2 = commandArgs.join(" ");
-    const leaf = findCommandInManifest(manifest, commandPath2);
-    if (!leaf) {
+    const command = findCommandInManifest(manifest, commandPath2);
+    if (!command) {
       fail(`explain: unknown command "${commandPath2}"`, { code: ERROR_CODES.ERR_NOT_FOUND });
       return;
     }
-    console.log(formatExplainCommand(leaf, manifest.name));
+    console.log(command.subcommands.length ? formatExplainGroup(command, manifest.name) : formatExplainCommand(command, manifest.name));
   });
 }
 
@@ -22102,7 +22487,7 @@ function checkClaudePlugin(probe) {
     return {
       ok: false,
       label: guardState === "no-install" ? "Claude plugin \u2014 not installed" : "Claude plugin \u2014 unresolved (marketplace/cache missing)",
-      fix: "run `mmi-cli plugin-heal` to reinstall the MMI marketplace + plugin, then restart Claude",
+      fix: "run `mmi-cli plugin heal` to reinstall the MMI marketplace + plugin, then restart Claude",
       verbose: evidence
     };
   }
@@ -22161,7 +22546,7 @@ function checkPluginCache(input) {
     // Lead with the versioned-cache framing when there are stale versions; otherwise report the staging litter
     // on its own so a cache with zero versioned dirs still gets an honest ✗.
     detail: input.stale.length ? `${input.cached} versions cached (${parts.join("; ")})` : parts.join("; "),
-    fix: "run `mmi-cli plugin-prune` to review, then `mmi-cli plugin-prune --apply` to delete",
+    fix: "run `mmi-cli plugin prune` to review, then `mmi-cli plugin prune --apply` to delete",
     verbose: evidence
   };
 }
@@ -22191,7 +22576,7 @@ function checkSchedules(probe) {
       ok: false,
       label: "schedules",
       detail: `${probe.incomplete.length} source(s) unreadable`,
-      fix: "run `mmi-cli schedules` for the full report \u2014 the notebook may be missing armed entries",
+      fix: "run `mmi-cli org schedules` for the full report \u2014 the notebook may be missing armed entries",
       verbose: evidence
     };
   }
@@ -22200,7 +22585,7 @@ function checkSchedules(probe) {
       ok: false,
       label: "schedules",
       detail: `${probe.drift.length} drift finding(s)`,
-      fix: "run `mmi-cli schedules` \u2014 file/registry/live disagree; each drift line names its per-class remedy, applied in the owning repo",
+      fix: "run `mmi-cli org schedules` \u2014 file/registry/live disagree; each drift line names its per-class remedy, applied in the owning repo",
       verbose: evidence
     };
   }
@@ -22556,11 +22941,13 @@ function allLongFlags() {
   if (cachedLongFlags) return cachedLongFlags;
   const acc = /* @__PURE__ */ new Set();
   const walk = (node) => {
+    if (!isCanonicalSuggestion(node)) return;
     for (const opt of node.options) {
+      if (opt.discovery) continue;
       const m = /--[\w-]+/.exec(opt.flags);
       if (m) acc.add(m[0]);
     }
-    for (const child of node.subcommands) walk(child);
+    for (const child2 of node.subcommands) walk(child2);
   };
   walk(buildCommandManifest(program2).tree);
   cachedLongFlags = [...acc];
@@ -22596,7 +22983,7 @@ function envelopeAwareWriteErr(str) {
   process.stderr.write(str);
 }
 var program2 = new Command();
-program2.name("mmi-cli").description("MMI Future CLI \u2014 org rules delivery, Jervaise-only continuity. The engine the plugin SessionStart hook drives.").version(resolveClientVersion()).configureOutput({ writeErr: envelopeAwareWriteErr }).showHelpAfterError("(run `mmi-cli commands` to list every subcommand + its flags, or `mmi-cli commands --json` to ground against it). If you expected this command to exist, your installed mmi-cli may be stale \u2014 update it (see: mmi-cli doctor)");
+program2.name("mmi-cli").description("MMI Future Hub CLI \u2014 the org control plane for agentic coding.").version(resolveClientVersion()).configureOutput({ writeErr: envelopeAwareWriteErr }).showHelpAfterError("(run `mmi-cli commands` for the agentic-coding map, `mmi-cli explain <command>` for detail, or `mmi-cli commands --json --primary` for machine discovery). If you expected this command to exist, your installed mmi-cli may be stale \u2014 update it (see: mmi-cli doctor)");
 function appActorDeps() {
   return {
     fetchSecret: async (key) => fetchSecretValue(makeSecretsDeps(await loadConfig()), key, { repo: APP_VAULT_REPO }),
@@ -22626,22 +23013,26 @@ rules.command("gitignore").option("--write", "upsert the managed block into .git
   if (opts.write) {
     if (plan.changed) {
       (0, import_node_fs27.writeFileSync)(path2, plan.content, "utf8");
-      console.log(`mmi-cli rules gitignore: updated .gitignore (${drift})`);
+      console.log(`mmi-cli org rules gitignore: updated .gitignore (${drift})`);
     } else {
-      console.log("mmi-cli rules gitignore: up to date");
+      console.log("mmi-cli org rules gitignore: up to date");
     }
     return;
   }
   if (plan.changed) {
-    console.error(`mmi-cli rules gitignore: managed block drift (${drift}) \u2014 run \`mmi-cli rules gitignore --write\` and commit`);
+    console.error(`mmi-cli org rules gitignore: managed block drift (${drift}) \u2014 run \`mmi-cli org rules gitignore --write\` and commit`);
     process.exitCode = 1;
   } else {
-    console.log("mmi-cli rules gitignore: up to date");
+    console.log("mmi-cli org rules gitignore: up to date");
   }
 });
-program2.command("commands").description("print the command manifest \u2014 every subcommand + its flags (ground against this instead of guessing)").option("--json", "machine-readable JSON: { name, version, tree, index } \u2014 index is a flat list of every leaf command path").action((o) => {
+program2.command("commands").description("print the grouped agentic-coding map; use --all for operational depth").option("--all", "include operational, internal, compatibility, and delegated depth").option("--json", "machine-readable command manifest").option("--primary", "with --json, emit only the compact primary tree and index").action((o) => {
   const manifest = buildCommandManifest(program2);
-  consoleIo.log(o.json ? JSON.stringify(manifest, null, 2) : formatManifestHuman(manifest));
+  if (o.json) {
+    consoleIo.log(JSON.stringify(o.primary ? primaryCommandManifest(manifest) : manifest, null, 2));
+    return;
+  }
+  consoleIo.log(formatManifestHuman(manifest, { all: o.all }));
 });
 async function runWhoami(io = consoleIo) {
   const cfg = await loadConfig();
@@ -22718,21 +23109,21 @@ gcCmd.command("sweep-deferred").description("retry IDE-locked deferred worktree
       );
       if (o.json) return console.log(JSON.stringify(result));
       if (!o.quiet || result.removed.length || result.stillDeferred.length || result.skipped.length) {
-        if (result.removed.length) console.log(`gc sweep-deferred: removed ${result.removed.length} worktree(s)`);
-        if (result.stillDeferred.length) console.log(`gc sweep-deferred: ${result.stillDeferred.length} still queued (will retry on next session)`);
-        if (result.skipped.length) console.log(`gc sweep-deferred: ${result.skipped.length} dropped (repurposed for different work since queued, left untouched)`);
-        if (!result.removed.length && !result.stillDeferred.length && !result.skipped.length) console.log("gc sweep-deferred: nothing queued");
+        if (result.removed.length) console.log(`worktree gc sweep-deferred: removed ${result.removed.length} worktree(s)`);
+        if (result.stillDeferred.length) console.log(`worktree gc sweep-deferred: ${result.stillDeferred.length} still queued (will retry on next session)`);
+        if (result.skipped.length) console.log(`worktree gc sweep-deferred: ${result.skipped.length} dropped (repurposed for different work since queued, left untouched)`);
+        if (!result.removed.length && !result.stillDeferred.length && !result.skipped.length) console.log("worktree gc sweep-deferred: nothing queued");
       }
     } catch (e) {
-      fail(`gc sweep-deferred: ${e.message}`);
+      fail(`worktree gc sweep-deferred: ${e.message}`);
     }
   }, DEFERRED_SWEEP_HARD_TIMEOUT_MS, () => {
-    console.error("gc sweep-deferred: exceeded hard timeout \u2014 exiting so the detached worker cannot leak (#2841)");
+    console.error("worktree gc sweep-deferred: exceeded hard timeout \u2014 exiting so the detached worker cannot leak (#2841)");
     process.exit(process.exitCode ?? 0);
   });
 });
 gcCmd.option("--dry-run", "show what would be deleted (default)").option("--apply", "delete only the listed clean merged/closed PR local+remote branches, linked worktrees, and stale tracking refs").option("--json", "machine-readable output").option("--scratch", "prune safe local scratch and plans whose current hash is confirmed synced to North Star (#1864) instead of git branches/refs").option("--remote <name>", "remote name", "origin").option("--limit <n>", "PRs to inspect per state", "200").action(async (o) => {
-  if (o.apply && o.dryRun) return fail("gc: choose either --dry-run or --apply");
+  if (o.apply && o.dryRun) return fail("worktree gc: choose either --dry-run or --apply");
   if (o.scratch) {
     try {
       const root = (await execFileP2("git", ["rev-parse", "--show-toplevel"], { timeout: GIT_TIMEOUT_MS }).catch(() => ({ stdout: "" }))).stdout.trim() || process.cwd();
@@ -22740,11 +23131,11 @@ gcCmd.option("--dry-run", "show what would be deleted (default)").option("--appl
       if (o.json) return console.log(JSON.stringify({ dryRun: !o.apply, ...run }, null, 2));
       return console.log(formatScratchGcPlan(run.plan, Boolean(o.apply), run.applied));
     } catch (e) {
-      return fail(`gc --scratch: ${e.message}`);
+      return fail(`worktree gc --scratch: ${e.message}`);
     }
   }
   const limit = Number.parseInt(o.limit, 10);
-  if (!Number.isFinite(limit) || limit < 1) return fail("gc: --limit must be a positive integer");
+  if (!Number.isFinite(limit) || limit < 1) return fail("worktree gc: --limit must be a positive integer");
   try {
     const plan = await gcPlan(o.remote, limit);
     if (o.apply && !o.json) console.log(formatGcPlan(plan, false));
@@ -22769,7 +23160,7 @@ ${renderGcApplyResult(applyResult)}`);
     }
     if (applyResult?.failed.length) process.exitCode = 1;
   } catch (e) {
-    fail(`gc: ${e.message}`);
+    fail(`worktree gc: ${e.message}`);
   }
 });
 var NPM_PROVISION_TIMEOUT_MS = 3e5;
@@ -22779,19 +23170,19 @@ function runWorktreeInstall(command, cwd, quiet) {
   const file = isWin2 ? "cmd.exe" : bin;
   const spawnArgs = isWin2 ? ["/c", bin, ...args] : args;
   return new Promise((resolve5, reject) => {
-    const child = (0, import_node_child_process12.spawn)(file, spawnArgs, { cwd, stdio: quiet ? "ignore" : "inherit", windowsHide: true });
+    const child2 = (0, import_node_child_process12.spawn)(file, spawnArgs, { cwd, stdio: quiet ? "ignore" : "inherit", windowsHide: true });
     const timer = setTimeout(() => {
       try {
-        child.kill();
+        child2.kill();
       } catch {
       }
       reject(new Error(`${command} timed out after ${NPM_PROVISION_TIMEOUT_MS}ms in ${cwd}`));
     }, NPM_PROVISION_TIMEOUT_MS);
-    child.on("error", (e) => {
+    child2.on("error", (e) => {
       clearTimeout(timer);
       reject(e);
     });
-    child.on("exit", (code) => {
+    child2.on("exit", (code) => {
       clearTimeout(timer);
       if (code === 0) resolve5();
       else reject(new Error(`${command} exited ${code} in ${cwd}`));
@@ -22969,7 +23360,7 @@ async function attachToProject(issueNumber, repo, priority) {
     return { onBoard: false };
   }
   if (!cfg.projectId) {
-    console.error(`issue create: board attach skipped \u2014 no Hub registry board META for ${targetRepo2 ?? "current repo"}; run \`mmi-cli project get ${targetRepo2 ?? "<owner/repo>"}\` and backfill board coords`);
+    console.error(`issue create: board attach skipped \u2014 no Hub registry board META for ${targetRepo2 ?? "current repo"}; run \`mmi-cli org project get ${targetRepo2 ?? "<owner/repo>"}\` and backfill board coords`);
     return { onBoard: false };
   }
   try {
@@ -23049,7 +23440,7 @@ docsAudit.command("record").description("write a dated janitor verdict for one r
     if (o.outcome === "clean") outcome = { kind: "clean" };
     else if (o.outcome === "refreshed") outcome = { kind: "refreshed", count: Number(o.count) };
     else if (o.outcome === "failed") outcome = { kind: "failed", reason: o.reason ?? "" };
-    else return failGraceful(`docs-audit record: --outcome must be clean|refreshed|failed, got "${o.outcome}"`);
+    else return failGraceful(`docs audit record: --outcome must be clean|refreshed|failed, got "${o.outcome}"`);
     const verdict = docsAuditRecord({ repo, date, shaRange: o.shaRange, outcome, checkerVendor: o.checkerVendor });
     await reportWrite("docs-audit record", await recordDocsAudit(verdict, registryClientDeps(await loadConfig())));
   } catch (e) {
@@ -23084,43 +23475,36 @@ tenant.command("control <owner/repo> <stage> <action>").description("run bounded
       const body = { ok: result.conclusion === "success", secrets: result.secrets, ssmStatus: result.conclusion === "success" ? "Success" : "Failed", raw: result.secretsRaw };
       const { lines, failure } = renderVerifySecrets(body);
       for (const line of lines) printLine(line);
-      if (failure) return failGraceful(`tenant control ${stage} verify-secrets: ${failure}`);
+      if (failure) return failGraceful(`runtime tenant control ${stage} verify-secrets: ${failure}`);
     } else {
       printLine(o.json ? JSON.stringify(result, null, 2) : renderTenantControl(result));
     }
     if (result.conclusion === "failure") {
-      return failGraceful(`tenant control ${stage} ${action}: ${result.category ?? "failed"} \u2014 ${result.note}`);
+      return failGraceful(`runtime tenant control ${stage} ${action}: ${result.category ?? "failed"} \u2014 ${result.note}`);
     }
   } catch (e) {
-    return failGraceful(`tenant control: ${e.message}`);
+    return failGraceful(`runtime tenant control: ${e.message}`);
   }
 });
 tenant.command("status <owner/repo> <stage>").description("read tenant runtime readiness without dispatching tenant-control: DEPLOY row, last deploy run, public URL probe, and TLS/Caddy/Cloudflare hints").action(async (repo, stage) => {
-  if (!["dev", "rc", "main"].includes(stage)) return fail("tenant status: <stage> must be dev, rc, or main");
-  const cfg = await loadConfig();
-  const result = await buildTenantRuntimeStatusFor(repo, stage, cfg);
-  console.log(JSON.stringify(result, null, 2));
-  if (result.publicProbe?.ok === false) process.exitCode = 1;
-});
-tenant.command("readiness <owner/repo> <stage>").description("alias for tenant status: read-only tenant runtime readiness").action(async (repo, stage) => {
-  if (!["dev", "rc", "main"].includes(stage)) return fail("tenant readiness: <stage> must be dev, rc, or main");
+  if (!["dev", "rc", "main"].includes(stage)) return fail("runtime tenant status: <stage> must be dev, rc, or main");
   const cfg = await loadConfig();
   const result = await buildTenantRuntimeStatusFor(repo, stage, cfg);
   console.log(JSON.stringify(result, null, 2));
   if (result.publicProbe?.ok === false) process.exitCode = 1;
 });
 tenant.command("redeploy <owner/repo> <stage>").description("re-dispatch the central tenant-deploy.yml for an already-promoted ref (no re-tag/merge); train-authority gated").option("--ref <ref>", "ref to deploy (defaults to the stage branch rc/main, or `development` for dev \u2014 the promoted/staging ref)").option("--watch", "block on the dispatched run and report its outcome (gh run watch --exit-status)").option("--json", "machine-readable output").action(async (repo, stage, o) => {
-  if (stage !== "dev" && stage !== "rc" && stage !== "main") return fail("tenant redeploy: <stage> must be dev, rc, or main");
+  if (stage !== "dev" && stage !== "rc" && stage !== "main") return fail("runtime tenant redeploy: <stage> must be dev, rc, or main");
   try {
     const result = await runTenantRedeploy(trainApplyDeps(), { repo, stage, ref: o.ref, watch: o.watch });
     return printLine(o.json ? JSON.stringify(result, null, 2) : renderTenantRedeploy(result));
   } catch (e) {
-    return failGraceful(`tenant redeploy: ${e.message}`);
+    return failGraceful(`runtime tenant redeploy: ${e.message}`);
   }
 });
 tenant.command("sweep-rc").description("discover (and optionally retire) running rc tenant runtimes across tenant-containers \u2014 orphan cleanup after a failed post-release retire (#942)").option("--retire", "retire every running rc runtime found (requires --yes) \u2014 WARNING: tears down a legitimately-staged rc too").option("--yes", "confirm the destructive --retire").option("--json", "machine-readable output").action(async (o) => {
   if (o.retire && !o.yes) {
-    return fail("tenant sweep-rc --retire is destructive (it tears down EVERY running rc, including one legitimately staged between /rcand and /release) \u2014 re-run with --yes to confirm");
+    return fail("runtime tenant sweep-rc --retire is destructive (it tears down EVERY running rc, including one legitimately staged between /rcand and /release) \u2014 re-run with --yes to confirm");
   }
   const cfg = await loadConfig();
   const cdeps = registryClientDeps(cfg);
@@ -23140,7 +23524,7 @@ tenant.command("sweep-rc").description("discover (and optionally retire) running
     }, { retire: !!o.retire });
     return printLine(o.json ? JSON.stringify(result) : renderSweep(result));
   } catch (e) {
-    return failGraceful(`tenant sweep-rc: ${e.message}`);
+    return failGraceful(`runtime tenant sweep-rc: ${e.message}`);
   }
 });
 async function resolveDnsBounded(host, timeoutMs = 3e3) {
@@ -23249,7 +23633,7 @@ async function projectTarget(commandName, explicitTarget) {
 project.command("list").description("list all projects (identity + board, never deploy coords)").option("--json", "machine-readable output").action(async (o) => {
   const cfg = await loadConfig();
   const projects = await fetchProjectsList(registryClientDeps(cfg));
-  if (!projects) return failGraceful("project list: Hub API unreachable or this repo is not bootstrapped");
+  if (!projects) return failGraceful("org project list: Hub API unreachable or this repo is not bootstrapped");
   if (o.json) {
     console.log(JSON.stringify(projects));
     return;
@@ -23262,16 +23646,16 @@ project.command("get [owner/repo]").description("a project's META (board ids + p
   const cfg = await loadConfig();
   let target;
   try {
-    target = await projectTarget("project get", repoOrSlug);
+    target = await projectTarget("org project get", repoOrSlug);
   } catch (e) {
     return fail(e.message);
   }
   const read = await fetchProjectBySlugChecked(slugOf(target), registryClientDeps(cfg));
   if (!read.ok) {
-    return failGraceful(`project get: Hub registry read failed (${read.error}) \u2014 likely transient (cold start, network, or auth blip); retry shortly`);
+    return failGraceful(`org project get: Hub registry read failed (${read.error}) \u2014 likely transient (cold start, network, or auth blip); retry shortly`);
   }
   if (!read.project) {
-    return failGraceful(`project get: no registry META for ${target} (unknown or unbootstrapped)`);
+    return failGraceful(`org project get: no registry META for ${target} (unknown or unbootstrapped)`);
   }
   console.log(JSON.stringify(read.project));
   if (!o.json) {
@@ -23282,55 +23666,31 @@ project.command("get [owner/repo]").description("a project's META (board ids + p
     console.error(
       `${m.name ?? target} \xB7 class ${m.class ?? "?"} \xB7 deploy ${m.deployModel ?? "?"}
 release track: ${track} \u2014 stages: ${stages}${note}
-deploys run centrally (tenant-deploy.yml); product repos carry no deploy files. Deploy coords are OIDC-gated \u2014 see \`project resolve\`.`
+deploys run centrally (tenant-deploy.yml); product repos carry no deploy files. Inspect nonsecret DEPLOY facts with \`mmi-cli org project deploy get\`; full coords remain OIDC-gated.`
     );
   }
 });
-project.command("resolve <owner/repo>").description("deploy coords for a stage \u2014 for diagnosis. NOTE: /deploy-coords is OIDC-gated (a deploy job\u2019s id-token), so a gh-token CLI cannot read it from a dev machine").option("--stage <main|rc>", "deploy stage", "main").option("--json", "machine-readable output").action((_repoOrRepo, o) => {
-  const msg = "project resolve: deploy coords are served only to a deploy workflow (GitHub OIDC id-token, repo-scoped). A gh-token CLI on a dev machine cannot read /deploy-coords; inspect nonsecret DEPLOY facts with `mmi-cli project deploy get`. Full coords stay OIDC-gated.";
-  if (o.json) {
-    console.log(JSON.stringify({ ok: false, stage: o.stage, error: msg }));
-    process.exitCode = 1;
-    return;
-  }
-  fail(msg);
-});
 var projectDeploy = project.command("deploy").description("read nonsecret DEPLOY# facts (domain, port, deploy path, substrate, host presence)");
 projectDeploy.command("get [owner/repo]").description("read nonsecret DEPLOY# facts for one project; defaults to the current repo").option("--stage <stage>", "dev | rc | main").option("--json", "machine-readable output").action(async (repoOrSlug, o) => {
   const cfg = await loadConfig();
   let target;
   try {
-    target = await projectTarget("project deploy get", repoOrSlug);
+    target = await projectTarget("org project deploy get", repoOrSlug);
   } catch (e) {
     return fail(e.message);
   }
   const out = await fetchDeployFactsBySlug(slugOf(target), registryClientDeps(cfg));
-  if (!out) return failGraceful(`project deploy get: Hub deploy facts read failed for ${target}`);
+  if (!out) return failGraceful(`org project deploy get: Hub deploy facts read failed for ${target}`);
   const stage = o.stage?.trim();
-  if (stage && !["dev", "rc", "main"].includes(stage)) return fail("project deploy get: --stage must be dev, rc, or main");
+  if (stage && !["dev", "rc", "main"].includes(stage)) return fail("org project deploy get: --stage must be dev, rc, or main");
   const payload = stage ? { slug: out.slug, stage, deploy: out.stages[stage] ?? null } : out;
   console.log(JSON.stringify(payload));
 });
-projectDeploy.command("list [owner/repo]").description("alias for project deploy get; lists all stages by default").option("--stage <stage>", "dev | rc | main").option("--json", "machine-readable output").action(async (repoOrSlug, o) => {
+project.command("doctor [owner/repo]").description("diagnose Hub v2 readiness for a repo without reading product repo files \u2014 appOwnedGaps are advisory templates; clear them with `org project attest`; defaults to the current repo").option("--v2", "compatibility flag; v2 readiness is the default").option("--json", "machine-readable output").action(async (repo, _o) => {
   const cfg = await loadConfig();
   let target;
   try {
-    target = await projectTarget("project deploy list", repoOrSlug);
-  } catch (e) {
-    return fail(e.message);
-  }
-  const out = await fetchDeployFactsBySlug(slugOf(target), registryClientDeps(cfg));
-  if (!out) return failGraceful(`project deploy list: Hub deploy facts read failed for ${target}`);
-  const stage = o.stage?.trim();
-  if (stage && !["dev", "rc", "main"].includes(stage)) return fail("project deploy list: --stage must be dev, rc, or main");
-  const payload = stage ? { slug: out.slug, stage, deploy: out.stages[stage] ?? null } : out;
-  console.log(JSON.stringify(payload));
-});
-project.command("doctor [owner/repo]").description("diagnose Hub v2 readiness for a repo without reading product repo files \u2014 appOwnedGaps are advisory templates; clear them with `project attest`; defaults to the current repo").option("--v2", "compatibility flag; v2 readiness is the default").option("--json", "machine-readable output").action(async (repo, _o) => {
-  const cfg = await loadConfig();
-  let target;
-  try {
-    target = await projectTarget("project doctor", repo);
+    target = await projectTarget("org project doctor", repo);
   } catch (e) {
     return fail(e.message);
   }
@@ -23342,7 +23702,7 @@ project.command("heal [owner/repo]").description("repair Hub-owned v2 readiness
   const cfg = await loadConfig();
   let target;
   try {
-    target = await projectTarget("project heal", repo);
+    target = await projectTarget("org project heal", repo);
   } catch (e) {
     return fail(e.message);
   }
@@ -23351,7 +23711,7 @@ project.command("heal [owner/repo]").description("repair Hub-owned v2 readiness
     fetchProject: (s) => fetchProjectBySlugChecked(s, reg),
     upsertProject: (s, patch) => upsertProject(s, patch, reg)
   });
-  if (out.status === "aborted") return failGraceful(`project heal: ${out.error}`);
+  if (out.status === "aborted") return failGraceful(`org project heal: ${out.error}`);
   if (out.status === "planned") {
     console.log(JSON.stringify({ ok: true, slug: out.slug, dryRun: true, patch: out.patch, appOwnedGaps: out.appOwnedGaps }));
     return;
@@ -23360,15 +23720,15 @@ project.command("heal [owner/repo]").description("repair Hub-owned v2 readiness
     console.log(JSON.stringify({ ok: true, slug: out.slug, applied: [], appOwnedGaps: out.appOwnedGaps }));
     return;
   }
-  if (out.status === "write-failed") return reportWrite("project heal", out.write);
+  if (out.status === "write-failed") return reportWrite("org project heal", out.write);
   console.log(JSON.stringify({ ok: true, slug: out.slug, applied: out.applied, appOwnedGaps: out.appOwnedGaps, result: out.result }));
 });
 project.command("readiness [owner/repo]").description("update the repo v2 readiness issue with Hub diagnosis and app-owned tasks; defaults to the current repo").option("--update-issue", "create/update the bounded v2 readiness issue section").option("--json", "machine-readable output").action(async (repo, o) => {
-  if (!o.updateIssue) return fail("project readiness: pass --update-issue");
+  if (!o.updateIssue) return fail("org project readiness: pass --update-issue");
   const cfg = await loadConfig();
   let target;
   try {
-    target = await projectTarget("project readiness", repo);
+    target = await projectTarget("org project readiness", repo);
   } catch (e) {
     return fail(e.message);
   }
@@ -23380,19 +23740,19 @@ project.command("attest [owner/repo]").description("attest this repo's app-owned
   const cfg = await loadConfig();
   let target;
   try {
-    target = await projectTarget("project attest", repoOrSlug);
+    target = await projectTarget("org project attest", repoOrSlug);
   } catch (e) {
     return fail(e.message);
   }
   const repo = target.includes("/") ? target : `mutmutco/${slugOf(target)}`;
   const res = await attestAppGaps(slugOf(target), repo, registryClientDeps(cfg));
-  return reportWrite("project attest", res);
+  return reportWrite("org project attest", res);
 });
 project.command("set [owner/repo]").description("upsert project META (idempotent merge; master-gated)").option("--class <class>", "deployable | content").option("--project-type <type>", `${PROJECT_TYPES.join(" | ")} (v2 capability shape)`).option("--deploy-model <model>", `${DEPLOY_MODELS.join(" | ")} (release/deploy path; none means no Hub deploy registration)`).option("--release-track <track>", `${RELEASE_TRACKS.join(" | ")} (branch topology; direct skips rc)`).option("--var <KEY=VALUE...>", settableVarHelp()).option("--set <KEY=VALUE...>", "alias of --var (one KEY=VALUE per flag; repeat the flag to set several)").option("--secrets-file <path>", "read the #2244 secrets catalog map (JSON) from a file and merge it per entry into the existing catalog (clear all with --unset secrets)").option("--unset <KEY...>", "META field to remove (repeatable): oauth, requiredRuntimeSecrets, requiredBuildSecrets, secrets, edgeDomains, requiredGcpApis, publishRequired").option("--clear-web-profile", "remove web-only registry fields (oauth, edgeDomains) for non-web/content projects").option("--json", "machine-readable output").action(async (repoOrSlug, o) => {
   const cfg = await loadConfig();
   let target;
   try {
-    target = await projectTarget("project set", repoOrSlug);
+    target = await projectTarget("org project set", repoOrSlug);
   } catch (e) {
     return fail(e.message);
   }
@@ -23401,12 +23761,12 @@ project.command("set [owner/repo]").description("upsert project META (idempotent
   const setAlias = o.set ?? [];
   const vars = [...o.var ?? [], ...setAlias];
   const dupe = duplicateVarKeyAcrossFlags(o.var ?? [], setAlias);
-  if (dupe) return fail(`project set: KEY "${dupe}" was passed to both --var and --set; --set is an alias of --var, so pass each KEY once`);
+  if (dupe) return fail(`org project set: KEY "${dupe}" was passed to both --var and --set; --set is an alias of --var, so pass each KEY once`);
   if (o.secretsFile) {
     try {
       vars.push(`secrets=${(0, import_node_fs27.readFileSync)(o.secretsFile, "utf8")}`);
     } catch (e) {
-      return fail(`project set: cannot read --secrets-file ${o.secretsFile}: ${e.message}`);
+      return fail(`org project set: cannot read --secrets-file ${o.secretsFile}: ${e.message}`);
     }
   }
   let patch;
@@ -23421,19 +23781,19 @@ project.command("set [owner/repo]").description("upsert project META (idempotent
       clearWebProfile: Boolean(o.clearWebProfile)
     });
   } catch (e) {
-    return fail(e.message.replace(/^project set: /, "project set: "));
+    return fail(e.message.replace(/^org project set: /, "org project set: "));
   }
   const existing = await fetchProjectBySlug(slug, registryClientDeps(cfg));
   const boardError = boardLinkWriteError(patch, existing);
-  if (boardError) return fail(`project set: ${boardError}`);
+  if (boardError) return fail(`org project set: ${boardError}`);
   const res = await upsertProject(slug, { ...patch, repo }, registryClientDeps(cfg));
-  return reportWrite("project set", res);
+  return reportWrite("org project set", res);
 });
 project.command("retire [owner/repo]").description("retire an orphaned registry slug (master-only): soft-delete the PROJECT# META row + drop the repo's board items; secrets/vault left alone. DRY-RUN by default \u2014 pass --apply to actually delete; defaults to the current repo").option("--apply", "actually delete (default is a dry-run preview of what would be removed)").option("--skip-board", "retire the registry META only \u2014 leave board items in place").option("--json", "machine-readable {slug, removedMeta, removedBoardItem} output").action(async (repoOrSlug, o) => {
   const cfg = await loadConfig();
   let target;
   try {
-    target = await projectTarget("project retire", repoOrSlug);
+    target = await projectTarget("org project retire", repoOrSlug);
   } catch (e) {
     return fail(e.message);
   }
@@ -23459,7 +23819,7 @@ project.command("retire [owner/repo]").description("retire an orphaned registry
     printLine(JSON.stringify(structured));
   } else {
     const verb = result.applied ? "retired" : "WOULD retire (dry-run; pass --apply to delete)";
-    printLine(`project retire: ${verb} ${result.slug} (${result.repo})`);
+    printLine(`org project retire: ${verb} ${result.slug} (${result.repo})`);
     if (result.applied) {
       printLine(`  META: ${result.removedMeta.ok ? `removed=${result.removedMeta.removed ?? "unknown"}` : `FAILED \u2014 ${result.removedMeta.error}`}`);
     } else {
@@ -23474,10 +23834,10 @@ project.command("retire [owner/repo]").description("retire an orphaned registry
     printLine(`  ${result.vaultNote}`);
   }
   if (result.applied && !result.removedMeta.ok) {
-    return failGraceful(`project retire: META delete failed \u2014 ${result.removedMeta.error}`);
+    return failGraceful(`org project retire: META delete failed \u2014 ${result.removedMeta.error}`);
   }
 });
-var fullTrack = program2.command("full-track").description("direct-to-full-track readiness audits");
+var fullTrack = program2.command("full-track").description("direct-to-train readiness audits");
 fullTrack.command("readiness <owner/repo>").description("aggregate branch topology, train authority, deploy facts, endpoint health, and rcand readiness for direct -> full switches").option("--json", "machine-readable output").action(async (repo, _o) => {
   const cfg = await loadConfig();
   const reg = registryClientDeps(cfg);
@@ -23490,7 +23850,7 @@ fullTrack.command("readiness <owner/repo>").description("aggregate branch topolo
     buildTenantRuntimeStatusFor(repo, "rc", cfg),
     buildTenantRuntimeStatusFor(repo, "main", cfg)
   ]);
-  if (!metaRead.ok) return failGraceful(`full-track readiness: Hub registry read failed (${metaRead.error})`);
+  if (!metaRead.ok) return failGraceful(`train readiness: Hub registry read failed (${metaRead.error})`);
   const report = buildFullTrackReadinessReport({
     repo,
     slug,
@@ -23502,18 +23862,18 @@ fullTrack.command("readiness <owner/repo>").description("aggregate branch topolo
   console.log(JSON.stringify(report, null, 2));
   if (!report.rcand.canApply) process.exitCode = 1;
 });
-project.command("set-deploy [owner/repo]").description("patch the DEPLOY#<stage> Hetzner deploy coords for a tenant (master-only) \u2014 omitted flags keep their stored value; seeds a freshly-bootstrapped tenant; defaults to the current repo").requiredOption("--stage <stage>", "dev | rc | main").option("--ssh-host <host>", "the box address the deploy ssh-es into; omit to keep the stored value (required only for a NEW hetzner-ssh row \u2014 `mmi-cli box list` finds it)").option("--ssh-user <user>", "ssh user; omit to leave the row unchanged (default root on a new row)").option("--port <port>", "loopback port the container binds / Caddy upstream (1..65535); omit to leave the row unchanged").option("--substrate <substrate>", "hetzner-ssh; omit to leave the row unchanged").option("--deploy-path <path>", "on-box per-stage release root; omit to leave the row unchanged (default /opt/mmi/<slug>/<stage> on a new row)").option("--service <name>", "systemd/compose service name; omit to leave the row unchanged (default the slug on a new row)").option("--domain <domain>", "canonical serving host; omit to leave the row unchanged").option("--alias <domain...>", "extra serving hostname the box Caddy answers (repeatable); omit to leave the stored aliases unchanged").option("--clear-aliases", "remove EVERY serving alias from the row (#2986) \u2014 omitting --alias preserves them, so clearing needs saying out loud").option("--no-env-file <bool>", "set the DEPLOY# fileless flag (true|false) \u2014 true = #2662 env passthrough, no .env symlink; omit to leave the row unchanged").option("--force", "skip the #2748 fileless-compose guard (flip noEnvFile=true even if the stage branch compose still declares env_file:)").option("--json", "machine-readable output").action(async (repoOrSlug, o) => {
+project.command("set-deploy [owner/repo]").description("patch the DEPLOY#<stage> Hetzner deploy coords for a tenant (master-only) \u2014 omitted flags keep their stored value; seeds a freshly-bootstrapped tenant; defaults to the current repo").requiredOption("--stage <stage>", "dev | rc | main").option("--ssh-host <host>", "the box address the deploy ssh-es into; omit to keep the stored value (required only for a NEW hetzner-ssh row \u2014 `mmi-cli runtime box list` finds it)").option("--ssh-user <user>", "ssh user; omit to leave the row unchanged (default root on a new row)").option("--port <port>", "loopback port the container binds / Caddy upstream (1..65535); omit to leave the row unchanged").option("--substrate <substrate>", "hetzner-ssh; omit to leave the row unchanged").option("--deploy-path <path>", "on-box per-stage release root; omit to leave the row unchanged (default /opt/mmi/<slug>/<stage> on a new row)").option("--service <name>", "systemd/compose service name; omit to leave the row unchanged (default the slug on a new row)").option("--domain <domain>", "canonical serving host; omit to leave the row unchanged").option("--alias <domain...>", "extra serving hostname the box Caddy answers (repeatable); omit to leave the stored aliases unchanged").option("--clear-aliases", "remove EVERY serving alias from the row (#2986) \u2014 omitting --alias preserves them, so clearing needs saying out loud").option("--no-env-file <bool>", "set the DEPLOY# fileless flag (true|false) \u2014 true = #2662 env passthrough, no .env symlink; omit to leave the row unchanged").option("--force", "skip the #2748 fileless-compose guard (flip noEnvFile=true even if the stage branch compose still declares env_file:)").option("--json", "machine-readable output").action(async (repoOrSlug, o) => {
   const cfg = await loadConfig();
   let target;
   try {
-    target = await projectTarget("project set-deploy", repoOrSlug);
+    target = await projectTarget("org project set-deploy", repoOrSlug);
   } catch (e) {
     return fail(e.message);
   }
   let noEnvFile;
   if (typeof o.envFile === "string") {
     const v = o.envFile.trim().toLowerCase();
-    if (v !== "true" && v !== "false") return fail("project set-deploy: --no-env-file must be true or false");
+    if (v !== "true" && v !== "false") return fail("org project set-deploy: --no-env-file must be true or false");
     noEnvFile = v === "true";
   }
   if (noEnvFile === true) {
@@ -23523,10 +23883,10 @@ project.command("set-deploy [owner/repo]").description("patch the DEPLOY#<stage>
       const sameRepo = !repoOrSlug || Boolean(cwdRepo) && (repoOrSlug.includes("/") ? cwdRepo.toLowerCase() === target.toLowerCase() : slugOf(cwdRepo) === slugOf(target));
       if (sameRepo) {
         const verdict = evaluateFilelessComposeGuard({ composeText: await readStageBranchCompose(branch), branch, force: Boolean(o.force) });
-        if (!verdict.ok) return fail(`project set-deploy: ${verdict.reason}`);
-        if (verdict.warn) console.error(`project set-deploy: ${verdict.warn}`);
+        if (!verdict.ok) return fail(`org project set-deploy: ${verdict.reason}`);
+        if (verdict.warn) console.error(`org project set-deploy: ${verdict.warn}`);
       } else {
-        console.error(`project set-deploy: --no-env-file guard skipped \u2014 run from the ${target} checkout to verify the ${branch} branch compose (#2748).`);
+        console.error(`org project set-deploy: --no-env-file guard skipped \u2014 run from the ${target} checkout to verify the ${branch} branch compose (#2748).`);
       }
     }
   }
@@ -23550,13 +23910,13 @@ project.command("set-deploy [owner/repo]").description("patch the DEPLOY#<stage>
     return fail(e.message);
   }
   const res = await setDeployCoords(slug, body, registryClientDeps(cfg));
-  return reportWrite("project set-deploy", res);
+  return reportWrite("org project set-deploy", res);
 });
 var registry = program2.command("registry").description("the DDB org registry \u2014 org-level constants");
 registry.command("org").description("the org config (account id, region, orgProjectId, sagaApiUrl)").option("--json", "machine-readable output").action(async (_o) => {
   const cfg = await loadConfig();
   const org = await fetchOrgConfig(registryClientDeps(cfg));
-  if (!org) return failGraceful("registry org: Hub API unreachable, unseeded, or this repo is not bootstrapped");
+  if (!org) return failGraceful("org config get: Hub API unreachable, unseeded, or this repo is not bootstrapped");
   console.log(JSON.stringify(org));
 });
 var oauth = program2.command("oauth").description("per-repo Google OAuth \u2014 plan the canonical URI set, verify the client is port-agnostic");
@@ -23568,7 +23928,7 @@ oauth.command("plan", { isDefault: true }).description("print the canonical JS o
   try {
     oc = parseOauthConfig(meta ?? {}, slug);
   } catch (e) {
-    return failGraceful(`oauth plan: ${e.message}`);
+    return failGraceful(`org oauth plan: ${e.message}`);
   }
   const origins = expectedJsOrigins(oc);
   const redirects = expectedRedirectUris(oc);
@@ -23586,18 +23946,18 @@ oauth.command("plan", { isDefault: true }).description("print the canonical JS o
   console.log(`
 SSM cred params (under /mmi-future/${slug}/):`);
   ssm.forEach((k) => console.log(`  ${k}`));
-  console.log("\nProvision/repair the Console client per docs/Guides/oauth-provision.md; store creds with `mmi-cli oauth set-creds`.");
+  console.log("\nProvision/repair the Console client per docs/Guides/oauth-provision.md; store creds with `mmi-cli org oauth set-creds`.");
 });
 oauth.command("set-creds").description('store the OAuth client into the canonical stageless GOOGLE_CLIENT_ID/SECRET pair (pipe the Console "Download JSON" on stdin)').option("--repo <owner/repo>", "target repo (defaults to the current repo)").action(async (o) => {
   const raw = await readStdin();
   if (!raw.trim()) {
-    return fail("oauth set-creds: pipe the Google client JSON on stdin \u2014 e.g.\n  mmi-cli oauth set-creds --repo <owner/repo> < client.json");
+    return fail("org oauth set-creds: pipe the Google client JSON on stdin \u2014 e.g.\n  mmi-cli org oauth set-creds --repo <owner/repo> < client.json");
   }
   let creds;
   try {
     creds = parseOauthClientJson(raw);
   } catch (e) {
-    return fail(`oauth set-creds: ${e.message}`);
+    return fail(`org oauth set-creds: ${e.message}`);
   }
   await withSecrets(async (d) => {
     for (const key of oauthSsmKeys()) {
@@ -23607,7 +23967,7 @@ oauth.command("set-creds").description('store the OAuth client into the canonica
         return;
       }
     }
-    console.log(`OAuth client stored in the ${oauthSsmKeys().length} canonical stageless keys. Run \`mmi-cli oauth verify\` to confirm the client is port-agnostic.`);
+    console.log(`OAuth client stored in the ${oauthSsmKeys().length} canonical stageless keys. Run \`mmi-cli org oauth verify\` to confirm the client is port-agnostic.`);
   });
 });
 oauth.command("verify").description("probe Google authorize with an arbitrary port (:9123) to confirm the client is port-agnostic").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--client-id <id>", "OAuth client_id (else read the stageless GOOGLE_CLIENT_ID from SSM)").option("--json", "machine-readable output").action(async (o) => {
@@ -23618,7 +23978,7 @@ oauth.command("verify").description("probe Google authorize with an arbitrary po
   try {
     oc = parseOauthConfig(meta ?? {}, slug);
   } catch (e) {
-    return failGraceful(`oauth verify: ${e.message}`);
+    return failGraceful(`org oauth verify: ${e.message}`);
   }
   let clientId = o.clientId;
   if (!clientId) {
@@ -23627,7 +23987,7 @@ oauth.command("verify").description("probe Google authorize with an arbitrary po
     });
   }
   if (!clientId) {
-    return failGraceful("oauth verify: no client_id (pass --client-id, or provision the repo so GOOGLE_CLIENT_ID exists)");
+    return failGraceful("org oauth verify: no client_id (pass --client-id, or provision the repo so GOOGLE_CLIENT_ID exists)");
   }
   const redirectUri = probeRedirectUri(oc.callbackPath);
   let body = "";
@@ -23635,7 +23995,7 @@ oauth.command("verify").description("probe Google authorize with an arbitrary po
     const res = await fetch(buildAuthorizeProbeUrl(clientId, redirectUri), { redirect: "follow", signal: AbortSignal.timeout(1e4) });
     body = await res.text();
   } catch (e) {
-    return failGraceful(`oauth verify: probe request failed: ${e.message}`);
+    return failGraceful(`org oauth verify: probe request failed: ${e.message}`);
   }
   const mismatch = authorizeBodyHasMismatch(body);
   if (o.json) {
@@ -24454,7 +24814,7 @@ function renderTrainApply(commandName, r) {
   return r.announceNote ? `${base}; announce: ${r.announceNote}` : base;
 }
 function renderTenantRedeploy(r) {
-  return `mmi-cli tenant redeploy: ${r.repo} ${r.stage} (ref=${r.ref}) [${r.deployModel}]; ${renderDeployLine(r)}`;
+  return `mmi-cli runtime tenant redeploy: ${r.repo} ${r.stage} (ref=${r.ref}) [${r.deployModel}]; ${renderDeployLine(r)}`;
 }
 async function resolveRcandPlanTargets() {
   try {
@@ -24594,7 +24954,7 @@ var access = program2.command("access").description("org access audit (read-only
 access.command("role [repo]").description("D14 train authority for a repo (server-side Hub check): master | project-admin | developer").option("--json", "machine-readable output").action(async (repoArg) => {
   const o = { json: rawFlag("--json") };
   const repo = repoArg ?? await resolveRepo();
-  if (!repo) return fail("access role: pass <owner/repo> or run inside a repo checkout");
+  if (!repo) return fail("org access role: pass <owner/repo> or run inside a repo checkout");
   const cfg = await loadConfig();
   const verdict = await fetchTrainAuthority(repo, registryClientDeps(cfg));
   if (!verdict.ok) {
@@ -24603,7 +24963,7 @@ access.command("role [repo]").description("D14 train authority for a repo (serve
       process.exitCode = 1;
       return;
     }
-    return failGraceful(`access role: ${verdict.error}`);
+    return failGraceful(`org access role: ${verdict.error}`);
   }
   const a = verdict.authority;
   if (o.json) {
@@ -24621,7 +24981,7 @@ access.command("audit").description("audit collaborator roles + train-branch pus
   const cfg = await loadConfig();
   const registryProjects = await fetchProjectsList(registryClientDeps(cfg));
   if (o.repo) {
-    if (o.class !== "deployable" && o.class !== "content") return failGraceful("access audit: --class must be deployable or content");
+    if (o.class !== "deployable" && o.class !== "content") return failGraceful("org access audit: --class must be deployable or content");
     const meta = registryProjects?.find((project2) => (project2.repos ?? []).some((repo) => repo.toLowerCase() === o.repo.toLowerCase())) ?? null;
     const repoClass = o.class;
     targets = [{ repo: o.repo, class: repoClass, releaseTrack: repoClass === "content" ? "trunk" : resolveReleaseTrack(meta, void 0, o.repo) }];
@@ -24647,7 +25007,7 @@ access.command("audit").description("audit collaborator roles + train-branch pus
 });
 access.command("capabilities").description("enumerate your effective vault reach \u2014 every credential NAME + tier + scope you can read/use across project + org/master tiers (names only, no values) (#1615)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--json", "machine-readable output").action((o) => withSecrets((d) => secretsCapabilities(d, o)));
 var isWin2 = process.platform === "win32";
-program2.command("doctor").description("check onboarding gates and auto-heal CLI/plugin wiring; use --verbose for the full audit checklist").option("--banner", "one-line resume summary; silent when all gates pass").option("--fast", "offline-safe fast lane; skips slow checks and network probes").option("--preflight", "eager version/plugin heal with upfront notice when stale; silent when healthy (#1871)").option("--verbose", "print the evidence behind every check \u2014 probes, resolved paths, versions compared, and the names behind each count (#2977)").option("--ci", "stable CI output contract; no color, exit 0 for clear/advisory-only, 1 for hard gaps, 2 for doctor/tool failure").option("--guide", "print the MMI Agentic Onboarding guide URL").option("--json", "machine-readable output (read-only inspection \u2014 performs no repairs)").option("--apply", "perform the same auto-repairs as the interactive run (combine with --json for a machine-readable repair run)").option("--no-repo-writes", "env/plugin repairs only \u2014 never mutate the repo working tree; report pending managed .gitignore repairs with the follow-up command (for train preflights)").option("--self", "verify CLI/plugin version parity, PATH, gh auth scopes, and hook wiring (offline-safe; suggests plugin-heal on a hard gap) (#2689)").addHelpText("after", "\nExit codes:\n  0  no hard gaps remain; advisory gaps may exist\n  1  one or more included hard checks failed\n  2  doctor/tool execution failed before a normal verdict\n\n--banner keeps the legacy SessionStart contract and returns 0 unless the process crashes.\n").action(async (opts) => {
+program2.command("doctor").description("check onboarding gates and auto-heal CLI/plugin wiring; use --verbose for the full audit checklist").option("--banner", "one-line resume summary; silent when all gates pass").option("--fast", "offline-safe fast lane; skips slow checks and network probes").option("--preflight", "eager version/plugin-heal with upfront notice when stale; silent when healthy (#1871)").option("--verbose", "print the evidence behind every check \u2014 probes, resolved paths, versions compared, and the names behind each count (#2977)").option("--ci", "stable CI output contract; no color, exit 0 for clear/advisory-only, 1 for hard gaps, 2 for doctor/tool failure").option("--guide", "print the MMI Agentic Onboarding guide URL").option("--json", "machine-readable output (read-only inspection \u2014 performs no repairs)").option("--apply", "perform the same auto-repairs as the interactive run (combine with --json for a machine-readable repair run)").option("--no-repo-writes", "env/plugin repairs only \u2014 never mutate the repo working tree; report pending managed .gitignore repairs with the follow-up command (for train preflights)").option("--self", "verify CLI/plugin version parity, PATH, gh auth scopes, and hook wiring (offline-safe; suggests plugin-heal on a hard gap) (#2689)").addHelpText("after", "\nExit codes:\n  0  no hard gaps remain; advisory gaps may exist\n  1  one or more included hard checks failed\n  2  doctor/tool execution failed before a normal verdict\n\n--banner keeps the legacy SessionStart contract and returns 0 unless the process crashes.\n").action(async (opts) => {
   if (opts.guide) {
     consoleIo.log("MMI Agentic Onboarding: docs/Architecture/agentic-dev-environment.md");
     return;
@@ -24677,11 +25037,11 @@ function directoryBytes(path2) {
     return 0;
   }
   for (const entry of entries) {
-    const child = (0, import_node_path23.join)(path2, entry.name);
-    if (entry.isDirectory()) total += directoryBytes(child);
+    const child2 = (0, import_node_path23.join)(path2, entry.name);
+    if (entry.isDirectory()) total += directoryBytes(child2);
     else {
       try {
-        total += (0, import_node_fs27.statSync)(child).size;
+        total += (0, import_node_fs27.statSync)(child2).size;
       } catch {
       }
     }
@@ -24748,7 +25108,7 @@ program2.command("plugin-prune").description(`prune stale cached MMI plugin vers
 });
 program2.command("session-start").description("run the SessionStart verbs (whoami, board slice, doctor) in one process").action(async () => {
   if (isInsideRepoSubdir(process.cwd())) {
-    console.error("[mmi-hook] session-start: cwd is a repository SUBDIRECTORY \u2014 skipping the SessionStart hook (spine/docs/plan/saga delivery); run it from the repo root.");
+    console.error("[mmi-hook] plugin session-start: cwd is a repository SUBDIRECTORY \u2014 skipping the SessionStart hook (spine/docs/plan/saga delivery); run it from the repo root.");
     appendHookActivity(process.cwd(), { event: "SessionStart", script: "session-start", outcome: "ran", action: "skip (repo subdirectory)" });
     return;
   }
@@ -24816,7 +25176,12 @@ program2.command("lane", { hidden: true }).action(() => {
 program2.command("fusion", { hidden: true }).action(() => {
   fail("fusion orchestration lives in jerv-cli \u2014 try: jerv-cli fusion --help");
 });
-program2.parseAsync().then(() => finishCliRun()).catch((e) => failGraceful(e.message));
+consolidateCommandNamespaces(program2);
+applyCommandTaxonomy(program2);
+var rewrittenArgv = rewriteLegacyArgv(process.argv);
+if (rewrittenArgv.warning) process.stderr.write(`${rewrittenArgv.warning}
+`);
+program2.parseAsync(rewrittenArgv.argv).then(() => finishCliRun()).catch((e) => failGraceful(e.message));
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   DEFAULT_PRIORITY,