@mutmutco/cli 3.31.0 → 3.33.0

package/dist/main.cjs

@@ -3520,7 +3520,10 @@ async function cleanExit(code) {
   await new Promise((resolve5) => setImmediate(resolve5));
   process.exit(code);
 }
-var CLI_EXIT_WATCHDOG_MS = 1e4;
+var CLI_EXIT_WATCHDOG_MS = (() => {
+  const testOverride = Number(process.env.MMI_CLI_TEST_EXIT_WATCHDOG_MS);
+  return process.env.NODE_ENV === "test" && Number.isFinite(testOverride) && testOverride >= 25 ? testOverride : 1e4;
+})();
 async function finishCliRun(watchdogMs = CLI_EXIT_WATCHDOG_MS) {
   const timer = setTimeout(() => {
     console.error(
@@ -4337,7 +4340,7 @@ function formatScratchGcPlan(plan, applied, applyResult) {
 function scratchGcBannerLine(safeAutoPruned, advisory) {
   const parts = [];
   if (safeAutoPruned > 0) parts.push(`pruned ${safeAutoPruned} scratch item(s)`);
-  if (advisory > 0) parts.push(`${advisory} kept scratch item(s) need review \u2014 \`mmi-cli gc --scratch --dry-run\``);
+  if (advisory > 0) parts.push(`${advisory} kept scratch item(s) need review \u2014 \`mmi-cli worktree gc --scratch --dry-run\``);
   return parts.length ? `[cleanup] ${parts.join("; ")}` : void 0;
 }
 function isLinkLike(path2, symbolic = false) {
@@ -4359,9 +4362,9 @@ function treeOlderThan(root, now, floor) {
     if (now - st.mtimeMs <= floor) return false;
     if (!st.isDirectory()) continue;
     for (const ent of (0, import_node_fs6.readdirSync)(current, { withFileTypes: true })) {
-      const child = (0, import_node_path4.join)(current, ent.name);
-      if (isLinkLike(child, ent.isSymbolicLink())) return false;
-      stack.push(child);
+      const child2 = (0, import_node_path4.join)(current, ent.name);
+      if (isLinkLike(child2, ent.isSymbolicLink())) return false;
+      stack.push(child2);
     }
   }
   return true;
@@ -4481,16 +4484,16 @@ function rootScratchDirSnapshot(root, readdir, stat2) {
     while (stack.length) {
       const current = stack.pop();
       for (const ent of readdir(current, { withFileTypes: true })) {
-        const child = (0, import_node_path4.join)(current, ent.name);
+        const child2 = (0, import_node_path4.join)(current, ent.name);
         if (ent.isSymbolicLink?.()) return null;
         try {
-          (0, import_node_fs6.readlinkSync)(child);
+          (0, import_node_fs6.readlinkSync)(child2);
           return null;
         } catch {
         }
-        const st = stat2(child);
+        const st = stat2(child2);
         mtimeMs = Math.max(mtimeMs, st.mtimeMs);
-        if (ent.isDirectory()) stack.push(child);
+        if (ent.isDirectory()) stack.push(child2);
         else if (ent.isFile()) bytes += st.size;
       }
     }
@@ -4928,7 +4931,8 @@ function retriedFetch(deps, url, init) {
   const headers = { ...clientVersionHeaders(), ...init.headers };
   return fetchWithRetry(deps.fetch ?? fetch, url, { ...init, headers }, {
     attempts: RETRY_ATTEMPTS,
-    timeoutMs: deps.timeoutMs ?? REGISTRY_FETCH_TIMEOUT_MS
+    timeoutMs: deps.timeoutMs ?? REGISTRY_FETCH_TIMEOUT_MS,
+    sleep: deps.retrySleep
   });
 }
 async function fetchTrainAuthority(repo, deps) {
@@ -4992,23 +4996,6 @@ async function fetchProjectBySlug(slug, deps) {
   const res = await fetchProjectBySlugChecked(slug, deps);
   return res.ok ? res.project : null;
 }
-async function fetchDeployStatusBySlug(slug, deps) {
-  if (!deps.baseUrl || !slug) return null;
-  const token = await deps.token();
-  if (!token) return null;
-  try {
-    const res = await retriedFetch(deps, `${deps.baseUrl.replace(/\/$/, "")}/projects/${encodeURIComponent(slug)}/deploy-status`, {
-      method: "GET",
-      headers: { Authorization: `Bearer ${token}` }
-    });
-    if (!res.ok) return null;
-    const body = await res.json();
-    if (!body?.stages) return null;
-    return { stages: body.stages, deployState: body.deployState ?? {} };
-  } catch {
-    return null;
-  }
-}
 async function fetchDeployFactsBySlug(slug, deps) {
   if (!deps.baseUrl || !slug) return null;
   const token = await deps.token();
@@ -5079,8 +5066,8 @@ async function postJson(pathSuffix, payload, deps, method = "POST", opts = {}) {
   const token = await deps.token();
   if (!token) return { ok: false, status: 0, body: null, error: "no Hub session token (run `gh auth login`)" };
   const timeoutMs = opts.timeoutMs ?? deps.timeoutMs ?? REGISTRY_FETCH_TIMEOUT_MS;
-  const sendOnce = (url, init) => fetchWithRetry(deps.fetch ?? fetch, url, init, { attempts: 1, timeoutMs });
-  const send = opts.noRetry ? sendOnce : (url, init) => fetchWithRetry(deps.fetch ?? fetch, url, init, { attempts: RETRY_ATTEMPTS, timeoutMs });
+  const sendOnce = (url, init) => fetchWithRetry(deps.fetch ?? fetch, url, init, { attempts: 1, timeoutMs, sleep: deps.retrySleep });
+  const send = opts.noRetry ? sendOnce : (url, init) => fetchWithRetry(deps.fetch ?? fetch, url, init, { attempts: RETRY_ATTEMPTS, timeoutMs, sleep: deps.retrySleep });
   try {
     const res = await send(`${deps.baseUrl.replace(/\/$/, "")}${pathSuffix}`, {
       method,
@@ -5106,9 +5093,6 @@ async function upsertProject(slug, patch, deps) {
 async function retireProject(slug, deps) {
   return postJson(`/projects/${encodeURIComponent(slug)}`, {}, deps, "DELETE", { noRetry: true });
 }
-async function attestAppGaps(slug, repo, deps) {
-  return postJson(`/projects/${encodeURIComponent(slug)}/attest-app`, { repo }, deps);
-}
 async function setDeployCoords(slug, payload, deps) {
   return postJson(`/projects/${encodeURIComponent(slug)}/deploy`, payload, deps);
 }
@@ -5118,6 +5102,9 @@ async function recordDocsAudit(verdict, deps) {
 async function tenantControl(payload, deps) {
   return postJson("/tenant-control", payload, deps, "POST", { noRetry: true });
 }
+async function tenantReconcile(payload, deps) {
+  return postJson("/tenant-reconcile", payload, deps, "POST", { noRetry: true });
+}
 async function tenantDeploy(payload, deps) {
   return postJson("/tenant-deploy", payload, deps, "POST", { noRetry: true, timeoutMs: TENANT_DEPLOY_TIMEOUT_MS });
 }
@@ -5156,7 +5143,7 @@ var import_node_fs10 = require("node:fs");
 
 // src/gc.ts
 var import_node_path7 = require("node:path");
-var DEFERRED_SWEEP_COMMAND = "mmi-cli gc sweep-deferred";
+var DEFERRED_SWEEP_COMMAND = "mmi-cli worktree gc sweep-deferred";
 var DEFERRED_NOTE = "Worktree cleanup queued (IDE lock). Detached sweep will retry automatically \u2014 no human action required.";
 var PRESERVED_WORKTREE_CONFIG = "mmi.preservedWorktreeBranch";
 var WORKTREE_LOCK_RE = /EPERM|EBUSY|EACCES|ENOTEMPTY|permission denied|access is denied|used by another process|resource busy|directory not empty/i;
@@ -5858,11 +5845,11 @@ function selectSafeWorktreeCwd(worktrees, targetPath, options) {
   return worktrees.find((w) => !samePath(w.path, targetPath) && exists(w.path))?.path;
 }
 function isPathUnderDirectory(childPath, parentPath) {
-  const child = normPath(childPath);
+  const child2 = normPath(childPath);
   const parent = normPath(parentPath);
-  if (!child || !parent) return false;
-  if (child === parent) return true;
-  return child.startsWith(`${parent}/`);
+  if (!child2 || !parent) return false;
+  if (child2 === parent) return true;
+  return child2.startsWith(`${parent}/`);
 }
 function planReleaseCwdBeforeWorktreeRemoval(targetPath, safeCwd, currentCwd) {
   if (!safeCwd || !isPathUnderDirectory(currentCwd, targetPath)) return void 0;
@@ -6113,7 +6100,7 @@ async function cleanupPrMergeLocalBranch(branch, options) {
   return report;
 }
 function formatGcPlan(plan, apply) {
-  const lines = [`mmi-cli gc: ${apply ? "apply" : "dry-run"}`];
+  const lines = [`mmi-cli worktree gc: ${apply ? "apply" : "dry-run"}`];
   if (!plan.branches.length && !plan.trackingRefs.length && !plan.worktreeDirs.length) lines.push("nothing to clean");
   if (plan.branches.length) {
     lines.push("local branches:");
@@ -6202,9 +6189,6 @@ function resolveDeployModel(meta, repo) {
   if (projectType === "cli-tool") return "registry-publish";
   return "tenant-container";
 }
-function projectTypeClearsWebProfile(projectType, deployModel) {
-  return projectType === "content" || projectType === "desktop-app" || projectType === "desktop-game" || projectType === "non-deployable" || projectType === "cli-tool" || deployModel === "content" || deployModel === "none" || deployModel === "registry-publish";
-}
 function inferReleaseTrackFromBranches(hints) {
   if (hints.hasRcBranch) return void 0;
   if (hints.hasDevelopmentBranch && hints.hasMainBranch) return "direct";
@@ -6579,10 +6563,10 @@ async function secretsCapabilities(deps, opts) {
   } catch (e) {
     const message = e.message;
     if (isTimeoutError(e)) {
-      deps.err(`access capabilities: timed out after ${CAPABILITIES_TIMEOUT_MS}ms while aggregating vault scopes for ${repo}. No access conclusion was made; retry with a warm Hub or run scoped reads such as \`mmi-cli secrets list --repo ${repo}\` while investigating the slow source.`);
+      deps.err(`org access capabilities: timed out after ${CAPABILITIES_TIMEOUT_MS}ms while aggregating vault scopes for ${repo}. No access conclusion was made; retry with a warm Hub or run scoped reads such as \`mmi-cli secrets list --repo ${repo}\` while investigating the slow source.`);
       return;
     }
-    deps.err(`access capabilities: ${message}`);
+    deps.err(`org access capabilities: ${message}`);
     return;
   }
   if (!res.ok) {
@@ -6591,10 +6575,10 @@ async function secretsCapabilities(deps, opts) {
       deps.err(upgrade);
     } else if (res.status === 404) {
       deps.err(
-        "access capabilities: the Hub API did not recognize /secrets/capabilities (HTTP 404). This endpoint ships in the Hub, so a 404 means the deployed Hub predates this command and should answer once a Hub release carrying this command is deployed \u2014 it is not an authorization or missing-credential error."
+        "org access capabilities: the Hub API did not recognize /secrets/capabilities (HTTP 404). This endpoint ships in the Hub, so a 404 means the deployed Hub predates this command and should answer once a Hub release carrying this command is deployed \u2014 it is not an authorization or missing-credential error."
       );
     } else {
-      deps.err(`access capabilities failed: HTTP ${res.status}${await readErr(res)}`);
+      deps.err(`org access capabilities failed: HTTP ${res.status}${await readErr(res)}`);
     }
     return;
   }
@@ -7172,9 +7156,10 @@ async function secretsUse(deps, key, opts) {
         "",
         "Consume it WITHOUT committing it:",
         `  \u2022 Keyless run: \`mmi-cli secrets use ${key}${opts.slug ? ` --slug ${opts.slug}` : ""} -- <command>\` injects it into the command's env (never printed). A granted non-master can USE an org secret this way.`,
-        `  \u2022 Runtime / agents: read it keylessly at runtime via the box's OIDC role. Never bake it into an image or commit it.`,
+        "  \u2022 Runtime: the central deploy injects the declared stage env; broker consumers use the workload's scoped runtime token. Never bake a value into an image or commit it.",
         `  \u2022 CI (GitHub Actions): the workflow assumes its OIDC role and runs \`aws ssm get-parameter --with-decryption --name ${path2}\` \u2014 no GitHub secret.`,
-        tier === "project" ? "  \u2022 One stageless value per repo (/mmi-future/<slug>/<KEY>) \u2014 no dev/rc/main copies. Project-admins self-serve their repo keys." : "  \u2022 Org-infra/cross-slug keys remain master-gated unless granted; project-admins self-serve their own repo keys."
+        "  \u2022 Own project: the stageless canonical and any declared dev/rc/main overrides are project-admin self-service.",
+        "  \u2022 Org-infra/cross-slug keys remain master-gated unless exactly granted."
       ].join("\n")
     );
     return;
@@ -7644,9 +7629,9 @@ function resolveBoardConfig(cfg) {
   const gap = diagnoseBoardConfigGap(cfg);
   if (gap) {
     throw gap.kind === "no-project-detected" ? new Error(
-      "no MMI project detected for this workspace (no Hub registry match for this repo, or no git origin in this folder); run `mmi-cli board read --repo <owner/repo>` to target a specific registered repo, or `mmi-cli project get <owner/repo>` to check registration"
+      "no MMI project detected for this workspace (no Hub registry match for this repo, or no git origin in this folder); run `mmi-cli board read --repo <owner/repo>` to target a specific registered repo, or `mmi-cli org project get <owner/repo>` to check registration"
     ) : new Error(
-      `Hub registry board META missing ${gap.missing.join(", ")}; run \`gh auth login\`, then \`mmi-cli project get <owner/repo>\`, or ask a master-admin to register/backfill board coords`
+      `Hub registry board META missing ${gap.missing.join(", ")}; run \`gh auth login\`, then \`mmi-cli org project get <owner/repo>\`, or ask a master-admin to register/backfill board coords`
     );
   }
   return {
@@ -9120,7 +9105,7 @@ function decidePrMergeNoCiGuard(checks, policyReason = "registry META ci:none")
     message: [
       `${staleNote} and are not green (${checks}).`,
       "Fix the checks or use `mmi-cli pr land` so the CLI waits.",
-      "Then correct registry META: `mmi-cli project set <owner/repo> --var requiredChecks=<check-run-display-names>`."
+      "Then correct registry META: `mmi-cli org project set <owner/repo> --var requiredChecks=<check-run-display-names>`."
     ].join(" ")
   };
 }
@@ -9961,7 +9946,7 @@ async function auditRepoCi(repo, deps) {
         ok: false,
         label: "registry no-ci contradicts PR workflows",
         detail: `registry META declares no-ci but pull_request workflows emit [${emitted.join(", ")}]`,
-        remediation: `Fix the workflows or correct registry META: mmi-cli project set ${repo} --var requiredChecks=${JSON.stringify(emitted)}`
+        remediation: `Fix the workflows or correct registry META: mmi-cli org project set ${repo} --var requiredChecks=${JSON.stringify(emitted)}`
       });
     }
   }
@@ -10022,7 +10007,7 @@ async function auditRepoCi(repo, deps) {
       ok: explicitNoCi,
       label: "registry META declares intentional no-ci",
       detail: explicitNoCi ? void 0 : "set ci:none and requiredChecks:[] in registry META",
-      remediation: `mmi-cli project set ${repo} --var ci=none --var requiredChecks=[]`
+      remediation: `mmi-cli org project set ${repo} --var ci=none --var requiredChecks=[]`
     });
   } else if (deployableGated) {
     checks.push({
@@ -10060,7 +10045,7 @@ async function auditRepoCi(repo, deps) {
           ok: trackExpectsRc === rcPresent,
           label: "release track matches branch topology",
           detail: trackExpectsRc === rcPresent ? void 0 : `registry resolves '${effectiveTrack}' but the rc branch ${rcPresent ? "exists" : "is absent"} \u2014 set release track '${wantTrack}'`,
-          remediation: trackExpectsRc === rcPresent ? void 0 : `mmi-cli project set ${repo} --release-track ${wantTrack}`
+          remediation: trackExpectsRc === rcPresent ? void 0 : `mmi-cli org project set ${repo} --release-track ${wantTrack}`
         });
       }
     }
@@ -10185,7 +10170,7 @@ async function seedGateYml(repo, deps, meta, result) {
   }
   const gate = meta?.gate;
   if (!gate || typeof gate === "object" && Object.keys(gate).length === 0) {
-    result.skipped.push(`gate.yml missing \u2014 no registry gate config; set \`mmi-cli project set ${repo} --var gate={...}\` first, then re-run reconcile`);
+    result.skipped.push(`gate.yml missing \u2014 no registry gate config; set \`mmi-cli org project set ${repo} --var gate={...}\` first, then re-run reconcile`);
     return;
   }
   const derivedVars = withDerivedRepoVars({ ...gateConfigToVars(gate), REPO_SLUG: parsed.slug }, parsed, "deployable", releaseTrack);
@@ -10386,20 +10371,27 @@ var import_node_util6 = require("node:util");
 var execFileP4 = (0, import_node_util6.promisify)(import_node_child_process7.execFile);
 var DOCKER_TIMEOUT_MS = 15e3;
 var EARLY_EXIT_GRACE_MS = 2e3;
-function waitForProcessStability(child, graceMs = EARLY_EXIT_GRACE_MS) {
+function earlyExitGraceMs() {
+  if (process.env.NODE_ENV === "test") {
+    const testOverride = Number(process.env.MMI_CLI_TEST_EARLY_EXIT_GRACE_MS);
+    if (Number.isFinite(testOverride) && testOverride >= 25) return testOverride;
+  }
+  return EARLY_EXIT_GRACE_MS;
+}
+function waitForProcessStability(child2, graceMs = earlyExitGraceMs()) {
   return new Promise((resolve5, reject) => {
     let settled = false;
     const finish = (fn) => {
       if (settled) return;
       settled = true;
       clearTimeout(timer);
-      child.removeAllListeners("error");
-      child.removeAllListeners("exit");
+      child2.removeAllListeners("error");
+      child2.removeAllListeners("exit");
       fn();
     };
     const timer = setTimeout(() => finish(resolve5), graceMs);
-    child.on("error", (err) => finish(() => reject(new Error(`stage process failed to start: ${err.message}`))));
-    child.on("exit", (code, signal) => {
+    child2.on("error", (err) => finish(() => reject(new Error(`stage process failed to start: ${err.message}`))));
+    child2.on("exit", (code, signal) => {
       const detail = code != null ? `code ${code}` : signal ? `signal ${signal}` : "unknown reason";
       finish(() => reject(new Error(`stage process exited before health check (${detail})`)));
     });
@@ -10534,9 +10526,9 @@ function parseStagePortFlag(raw) {
   return port;
 }
 function pathUnder(childPath, parentPath) {
-  const child = normPath2(childPath);
+  const child2 = normPath2(childPath);
   const parent = normPath2(parentPath);
-  return Boolean(child && parent && (child === parent || child.startsWith(`${parent}/`)));
+  return Boolean(child2 && parent && (child2 === parent || child2.startsWith(`${parent}/`)));
 }
 function stageStateMatchesRequiredCwd(state, requiredCwd) {
   if (!state) return false;
@@ -10890,7 +10882,7 @@ async function startStage(config = {}, opts = {}) {
   let up = sub(config.up.trim());
   if (opts.forceRecreate) up = appendForceRecreate(up);
   const identity = await resolveStageIdentity(cwd);
-  const child = (0, import_node_child_process7.spawn)(up, {
+  const child2 = (0, import_node_child_process7.spawn)(up, {
     cwd,
     shell: true,
     // POSIX-only: the process group exists for the group-kill in stopStage. On win32 teardown is
@@ -10903,7 +10895,7 @@ async function startStage(config = {}, opts = {}) {
     env: { ...process.env, ...vaultProcessEnv, ...stageProcessEnv(stagePort, extraEnv) }
   });
   const state = {
-    pid: child.pid ?? 0,
+    pid: child2.pid ?? 0,
     command: up,
     cwd,
     statePath,
@@ -10917,7 +10909,7 @@ async function startStage(config = {}, opts = {}) {
   if (globalStatePath && globalStatePath !== statePath) writeState(globalStatePath, state);
   try {
     if (state.healthUrl) await waitForHealth(state.healthUrl, opts.timeoutMs ?? 6e4, config.healthAnyStatus);
-    else await waitForProcessStability(child);
+    else await waitForProcessStability(child2);
   } catch (e) {
     await cleanupStageState(state, [statePath, globalStatePath], opts.timeoutMs ?? 6e4, cwd);
     throw e;
@@ -10932,7 +10924,7 @@ async function startStage(config = {}, opts = {}) {
     message: `started stage pid ${state.pid}${stagePort != null ? ` on port ${stagePort}` : ""}`
   };
   opts.onReady?.(result);
-  child.unref();
+  child2.unref();
   return result;
 }
 async function runStage(config = {}, opts = {}) {
@@ -11149,7 +11141,7 @@ async function bodyArgsViaFile(args, deps = {}) {
   if (i === -1 || i + 1 >= args.length) return { args, cleanup: async () => {
   } };
   const write = deps.write ?? import_promises.writeFile;
-  const remove = deps.remove ?? import_promises.unlink;
+  const remove2 = deps.remove ?? import_promises.unlink;
   const ensureDir = deps.ensureDir ?? import_promises.mkdir;
   const dir = deps.dir ?? (0, import_node_os3.tmpdir)();
   const file = (0, import_node_path13.join)(dir, `mmi-gh-body-${process.pid}-${(0, import_node_crypto3.randomBytes)(4).toString("hex")}.md`);
@@ -11160,7 +11152,7 @@ async function bodyArgsViaFile(args, deps = {}) {
     args: [...args.slice(0, i), "--body-file", file, ...args.slice(i + 2)],
     cleanup: async () => {
       try {
-        await remove(file);
+        await remove2(file);
       } catch {
       }
     }
@@ -11375,9 +11367,9 @@ async function resolveIssueNodeId(runGh, ref, fallbackRepo) {
 }
 async function linkSubIssue(runGh, parentRef, childRef, defaultRepo) {
   const parent = parseIssueRef(parentRef);
-  const child = parseIssueRef(childRef);
+  const child2 = parseIssueRef(childRef);
   const parentId = await resolveIssueNodeId(runGh, parent, defaultRepo);
-  const subIssueId = await resolveIssueNodeId(runGh, child, defaultRepo);
+  const subIssueId = await resolveIssueNodeId(runGh, child2, defaultRepo);
   const stdout = await runGh(buildAddSubIssueArgs(parentId, subIssueId), GH_MUTATION_TIMEOUT_MS);
   const result = parseAddSubIssueResult(stdout);
   if (!result) throw new Error(`addSubIssue returned an unexpected response:
@@ -11412,9 +11404,9 @@ function parseRemoveSubIssueResult(stdout) {
 }
 async function unlinkSubIssue(runGh, parentRef, childRef, defaultRepo) {
   const parent = parseIssueRef(parentRef);
-  const child = parseIssueRef(childRef);
+  const child2 = parseIssueRef(childRef);
   const parentId = await resolveIssueNodeId(runGh, parent, defaultRepo);
-  const subIssueId = await resolveIssueNodeId(runGh, child, defaultRepo);
+  const subIssueId = await resolveIssueNodeId(runGh, child2, defaultRepo);
   const stdout = await runGh(buildRemoveSubIssueArgs(parentId, subIssueId), GH_MUTATION_TIMEOUT_MS);
   const result = parseRemoveSubIssueResult(stdout);
   if (!result) throw new Error(`removeSubIssue returned an unexpected response:
@@ -11485,6 +11477,126 @@ function applyChecklistCheck(body, query, checked) {
   return { ok: true, edit: setChecklistMarker(body, sel.item, checked), item: sel.item };
 }
 
+// src/command-taxonomy.ts
+var COMMAND_METADATA = /* @__PURE__ */ Symbol.for("mmi.commandTaxonomy.metadata");
+var PRIMARY_GROUPS = [
+  ["Orient", ["onboard", "status", "next", "doctor", "whoami", "commands", "explain"]],
+  ["Plan and work", ["board", "issue", "worktree", "stage"]],
+  ["Review and ship", ["pr", "ci", "rcand", "release", "hotfix", "train"]],
+  ["Setup and support", ["bootstrap", "secrets", "docs"]],
+  ["Coordinate and improve", ["wave", "report", "skill-lesson"]]
+];
+var OPERATIONAL_TOP_LEVEL = /* @__PURE__ */ new Set(["org", "runtime", "plugin"]);
+var SUPPORT_PRIMARY = /* @__PURE__ */ new Set(["doctor", "whoami", "commands", "explain", "docs", "wave", "report", "skill-lesson"]);
+var TOP_LEVEL_ORDER = /* @__PURE__ */ new Map();
+var HELP_GROUP_ORDER = /* @__PURE__ */ new Map();
+var topLevelPosition = 0;
+for (const [helpGroup, names] of PRIMARY_GROUPS) {
+  HELP_GROUP_ORDER.set(helpGroup, HELP_GROUP_ORDER.size);
+  for (const name of names) TOP_LEVEL_ORDER.set(name, topLevelPosition++);
+}
+HELP_GROUP_ORDER.set("Operations", HELP_GROUP_ORDER.size);
+for (const name of OPERATIONAL_TOP_LEVEL) TOP_LEVEL_ORDER.set(name, topLevelPosition++);
+var PATH_OVERRIDES = {
+  "board slice-refresh": { category: "internal", discovery: "hidden", help_group: "Operations" },
+  "secrets find": { category: "admin", discovery: "all-only", help_group: "Operations" },
+  "secrets catalog": { category: "admin", discovery: "all-only", help_group: "Operations" },
+  "secrets doctor": { category: "admin", discovery: "all-only", help_group: "Operations" },
+  "secrets org-catalog": { category: "admin", discovery: "all-only", help_group: "Operations" },
+  "secrets grant": { category: "admin", discovery: "all-only", help_group: "Operations" },
+  "secrets revoke": { category: "admin", discovery: "all-only", help_group: "Operations" }
+};
+var HIDDEN_OPTIONS = {
+  "worktree create": ["--base"],
+  "org project set": ["--set"]
+};
+function primaryMetadata(name) {
+  for (const [helpGroup, names] of PRIMARY_GROUPS) {
+    if (names.includes(name)) {
+      return {
+        category: SUPPORT_PRIMARY.has(name) ? "support" : "core",
+        discovery: "primary",
+        help_group: helpGroup
+      };
+    }
+  }
+  return void 0;
+}
+function topLevelMetadata(name) {
+  const primary = primaryMetadata(name);
+  if (primary) return primary;
+  if (!OPERATIONAL_TOP_LEVEL.has(name)) {
+    throw new Error(`command taxonomy: unclassified top-level command "${name}"`);
+  }
+  return {
+    category: name === "plugin" ? "internal" : "admin",
+    discovery: "all-only",
+    help_group: "Operations"
+  };
+}
+function setCommandMetadata(command, metadata) {
+  command[COMMAND_METADATA] = metadata;
+}
+function commandMetadata(command) {
+  return command[COMMAND_METADATA];
+}
+function classifyTree(command, path2, inherited) {
+  const metadata = PATH_OVERRIDES[path2] ?? inherited;
+  setCommandMetadata(command, metadata);
+  if (metadata.discovery !== "primary") {
+    command._hidden = true;
+  }
+  for (const option of command.options) {
+    if ((HIDDEN_OPTIONS[path2] ?? []).includes(option.long ?? option.short ?? "")) option.hideHelp();
+  }
+  for (const child2 of command.commands) {
+    const childPath = path2 ? `${path2} ${child2.name()}` : child2.name();
+    classifyTree(child2, childPath, PATH_OVERRIDES[childPath] ?? metadata);
+  }
+}
+function applyCommandTaxonomy(program3) {
+  for (const command of program3.commands) {
+    const metadata = topLevelMetadata(command.name());
+    command.helpGroup(metadata.help_group);
+    classifyTree(command, command.name(), metadata);
+  }
+  program3.configureHelp({
+    visibleCommands(command) {
+      const visible = command.commands.filter((child2) => !child2._hidden);
+      const helpCommand = command._getHelpCommand();
+      if (helpCommand && !helpCommand._hidden) visible.push(helpCommand);
+      if (command === program3) visible.sort((a, b) => commandTaxonomyRank(a.name()) - commandTaxonomyRank(b.name()));
+      return visible;
+    },
+    groupItems(unsortedItems, visibleItems, getGroup) {
+      const groups = /* @__PURE__ */ new Map();
+      for (const item of unsortedItems) {
+        const group = getGroup(item);
+        if (!groups.has(group)) groups.set(group, []);
+      }
+      for (const item of visibleItems) {
+        const group = getGroup(item);
+        if (!groups.has(group)) groups.set(group, []);
+        groups.get(group).push(item);
+      }
+      return new Map([...groups].sort(([left], [right]) => {
+        const leftRank = HELP_GROUP_ORDER.get(left) ?? Number.MAX_SAFE_INTEGER;
+        const rightRank = HELP_GROUP_ORDER.get(right) ?? Number.MAX_SAFE_INTEGER;
+        return leftRank - rightRank;
+      }));
+    }
+  });
+}
+function commandTaxonomyRank(name) {
+  return TOP_LEVEL_ORDER.get(name) ?? Number.MAX_SAFE_INTEGER;
+}
+function commandHelpGroupRank(group) {
+  return HELP_GROUP_ORDER.get(group) ?? Number.MAX_SAFE_INTEGER;
+}
+function isCanonicalSuggestion(metadata) {
+  return metadata.category !== "internal";
+}
+
 // src/command-manifest.ts
 var EXAMPLES = /* @__PURE__ */ Symbol.for("mmi.commandManifest.examples");
 var COMMON_MISTAKES = /* @__PURE__ */ Symbol.for("mmi.commandManifest.commonMistakes");
@@ -11524,17 +11636,24 @@ function buildOption(opt) {
   if (opt.description) out.description = opt.description;
   if (opt.defaultValue !== void 0) out.default = opt.defaultValue;
   if (opt.argChoices && opt.argChoices.length) out.enum = [...opt.argChoices];
+  if (opt.hidden) out.discovery = "all-only";
   return out;
 }
 function buildCommand(cmd, path2) {
+  const metadata = commandMetadata(cmd) ?? {
+    category: "core",
+    discovery: "primary",
+    help_group: "Plan and work"
+  };
   const out = {
     name: cmd.name(),
     path: path2,
     arguments: cmd.registeredArguments.map(buildArgument),
     options: cmd.options.map(buildOption),
     subcommands: cmd.commands.map(
-      (child) => buildCommand(child, path2 ? `${path2} ${child.name()}` : child.name())
-    )
+      (child2) => buildCommand(child2, path2 ? `${path2} ${child2.name()}` : child2.name())
+    ),
+    ...metadata
   };
   const description = cmd.description();
   if (description) out.description = description;
@@ -11544,42 +11663,146 @@ function buildCommand(cmd, path2) {
   if (commonMistakes) out.common_mistakes = commonMistakes;
   return out;
 }
+function primaryCopy(node, root = false) {
+  if (!root && node.discovery !== "primary") return void 0;
+  const subcommands = node.subcommands.map((child2) => primaryCopy(child2)).filter((child2) => Boolean(child2));
+  if (root) subcommands.sort((a, b) => commandTaxonomyRank(a.name) - commandTaxonomyRank(b.name));
+  return {
+    ...node,
+    options: node.options.filter((option) => option.discovery !== "all-only" && option.discovery !== "hidden"),
+    subcommands
+  };
+}
 function collectLeaves(node, acc) {
   if (node.subcommands.length === 0) {
     if (node.path) acc.push(node);
     return;
   }
-  for (const child of node.subcommands) collectLeaves(child, acc);
+  for (const child2 of node.subcommands) collectLeaves(child2, acc);
 }
 function buildCommandManifest(program3) {
   const tree = buildCommand(program3, "");
   const index = [];
   collectLeaves(tree, index);
-  const manifest = { name: tree.name, tree, index, error_codes: ERROR_CODE_REFERENCE };
+  const primaryTree = primaryCopy(tree, true);
+  const primaryIndex = [];
+  collectLeaves(primaryTree, primaryIndex);
+  const manifest = {
+    schema_version: 2,
+    scope: "all",
+    name: tree.name,
+    tree,
+    index,
+    primary_tree: primaryTree,
+    primary_index: primaryIndex,
+    error_codes: ERROR_CODE_REFERENCE
+  };
   const version = program3.version();
   if (version) manifest.version = version;
   return manifest;
 }
+function primaryCommandManifest(manifest) {
+  return {
+    schema_version: manifest.schema_version,
+    scope: "primary",
+    name: manifest.name,
+    ...manifest.version ? { version: manifest.version } : {},
+    tree: manifest.primary_tree,
+    index: manifest.primary_index,
+    error_codes: manifest.error_codes
+  };
+}
 function argSignature(arg) {
   const inner = arg.variadic ? `${arg.name}...` : arg.name;
   return arg.required ? `<${inner}>` : `[${inner}]`;
 }
-function formatManifestHuman(manifest) {
-  const lines = [];
+function formatManifestHuman(manifest, options = {}) {
+  const root = options.all ? manifest.tree : manifest.primary_tree;
+  const lines = [`${manifest.name}${manifest.version ? ` v${manifest.version}` : ""} \u2014 ${root.description ?? ""}`];
   const render = (node, depth) => {
     const indent = "  ".repeat(depth);
     const args = node.arguments.map(argSignature).join(" ");
-    const head = depth === 0 ? `${node.name}${manifest.version ? ` v${manifest.version}` : ""}` : node.name + (args ? ` ${args}` : "");
+    const head = node.name + (args ? ` ${args}` : "");
     lines.push(node.description ? `${indent}${head} \u2014 ${node.description}` : `${indent}${head}`);
-    for (const opt of node.options) {
+    for (const opt of options.all ? node.options : []) {
       lines.push(`${indent}    ${opt.flags}${opt.description ? `  ${opt.description}` : ""}`);
     }
-    for (const child of node.subcommands) render(child, depth + 1);
+    if (options.all) for (const child2 of node.subcommands) render(child2, depth + 1);
   };
-  render(manifest.tree, 0);
+  let currentGroup;
+  const rootCommands = [...root.subcommands].sort((a, b) => commandHelpGroupRank(a.help_group) - commandHelpGroupRank(b.help_group) || commandTaxonomyRank(a.name) - commandTaxonomyRank(b.name));
+  for (const command of rootCommands) {
+    if (command.help_group !== currentGroup) {
+      currentGroup = command.help_group;
+      lines.push("", `${currentGroup}:`);
+    }
+    render(command, 1);
+  }
+  lines.push("", options.all ? "Use `mmi-cli explain <group|command>` for a focused map." : "Use `mmi-cli explain <group|command>` for detail or `mmi-cli commands --all` for operational depth.");
   return lines.join("\n");
 }
 
+// src/command-consolidation.ts
+function child(parent, name) {
+  const found = parent.commands.find((command) => command.name() === name);
+  if (!found) throw new Error(`command consolidation: missing "${parent.name()} ${name}"`);
+  return found;
+}
+function detach(parent, command) {
+  const commands = parent.commands;
+  const index = commands.indexOf(command);
+  if (index < 0) throw new Error(`command consolidation: "${command.name()}" is not a child of "${parent.name()}"`);
+  commands.splice(index, 1);
+  return command;
+}
+function move(parent, destination, name, nextName = name) {
+  const command = detach(parent, child(parent, name));
+  command.name(nextName);
+  destination.addCommand(command);
+  return command;
+}
+function remove(parent, name) {
+  detach(parent, child(parent, name));
+}
+function consolidateCommandNamespaces(program3) {
+  const org = program3.command("org").description("organization projects, access, rules, credentials, and schedules");
+  const runtime = program3.command("runtime").description("tenant, deploy, box, and edge operations");
+  const plugin = program3.command("plugin").description("plugin lifecycle and guard operations");
+  move(program3, org, "project");
+  move(program3, org, "oauth");
+  move(program3, org, "access");
+  move(program3, org, "schedules");
+  const config = org.command("config").description("organization configuration");
+  const registry2 = child(program3, "registry");
+  move(registry2, config, "org", "get");
+  remove(program3, "registry");
+  const orgRules = org.command("rules").description("organization-managed repository rules");
+  const rules2 = child(program3, "rules");
+  move(rules2, orgRules, "gitignore");
+  remove(program3, "rules");
+  move(program3, runtime, "tenant");
+  const runtimeDeploy = runtime.command("deploy").description("runtime deployment status");
+  const deploy = child(program3, "deploy");
+  move(deploy, runtimeDeploy, "status");
+  remove(program3, "deploy");
+  move(program3, runtime, "box");
+  move(program3, runtime, "edge");
+  move(program3, plugin, "guard");
+  move(program3, plugin, "plugin-heal", "heal");
+  move(program3, plugin, "plugin-prune", "prune");
+  move(program3, plugin, "session-start");
+  const docs2 = child(program3, "docs");
+  move(program3, docs2, "docs-audit", "audit");
+  const train = child(program3, "train");
+  const fullTrack2 = child(program3, "full-track");
+  move(fullTrack2, train, "readiness");
+  remove(program3, "full-track");
+  const worktree2 = child(program3, "worktree");
+  move(program3, worktree2, "gc");
+  const stage = child(program3, "stage");
+  move(program3, stage, "port-range");
+}
+
 // src/version-lag.ts
 var VERSION_LABEL = "installed plugin/adapter cache freshness";
 var VERSION_FIX = "update the MMI plugin via /plugin; standalone npm CLI: npm install -g @mutmutco/cli@latest";
@@ -11722,12 +11945,12 @@ function newestMtimeMs(path2, listDir, mtimeOf) {
     return newest;
   }
   for (const e of entries) {
-    const child = `${path2}/${e.name}`;
+    const child2 = `${path2}/${e.name}`;
     let m = 0;
-    if (e.isDirectory) m = newestMtimeMs(child, listDir, mtimeOf);
+    if (e.isDirectory) m = newestMtimeMs(child2, listDir, mtimeOf);
     else {
       try {
-        m = mtimeOf(child);
+        m = mtimeOf(child2);
       } catch {
         m = 0;
       }
@@ -11803,12 +12026,12 @@ function buildPluginCachePlan(home, running, deps, opts = {}) {
   const bytes = opts.withBytes ? prune.reduce((sum, v) => sum + deps.dirBytes(`${cacheRoot}/${v}`), 0) : 0;
   return { cacheRoot, present: true, keep, prune, bytes, running, ...stagingFields };
 }
-function applyPluginCachePlan(plan, remove, stagingGuard) {
+function applyPluginCachePlan(plan, remove2, stagingGuard) {
   const removed = [];
   const failed = [];
   for (const version of plan.prune) {
     try {
-      remove(`${plan.cacheRoot}/${version}`);
+      remove2(`${plan.cacheRoot}/${version}`);
       removed.push(version);
     } catch (e) {
       failed.push({ version, error: e.message });
@@ -11836,7 +12059,7 @@ function applyPluginCachePlan(plan, remove, stagingGuard) {
       }
     }
     try {
-      remove(`${plan.stagingRoot}/${s.name}`);
+      remove2(`${plan.stagingRoot}/${s.name}`);
       removedStaging.push(s.name);
     } catch (e) {
       failedStaging.push({ name: s.name, error: e.message });
@@ -11856,7 +12079,7 @@ var CONCURRENT_SESSION_WARNING = "only the version THIS session runs from is pro
 function renderPluginCachePlan(plan, applied) {
   const mb = (b) => `${(b / 1e6).toFixed(1)} MB`;
   if (!plan.present && plan.staging.length === 0) {
-    return `plugin-prune: no plugin cache at ${plan.cacheRoot} \u2014 nothing to prune`;
+    return `plugin prune: no plugin cache at ${plan.cacheRoot} \u2014 nothing to prune`;
   }
   const lines = [];
   if (plan.present) {
@@ -12005,11 +12228,11 @@ function trainPlan(command, options = {}) {
       { label: "verify operator is a master-admin org owner", command: "gh api orgs/<owner>/memberships/<login> --jq .role", gated: true },
       { label: "verify current branch is development", gated: true },
       rcandVersionStep(options),
-      { label: "verify registry META for this project", command: "mmi-cli project get <owner/repo>", gated: true },
+      { label: "verify registry META for this project", command: "mmi-cli org project get <owner/repo>", gated: true },
       { label: "preflight required rc secret names", command: "mmi-cli secrets preflight --stage rc --repo <owner/repo>", gated: true },
       { label: "merge development to rc", gated: true },
       { label: "trigger the deploy path for this repo model, returning Hub Actions run id/url data (and, with --watch, its outcome)", command: "tenant-container: gh workflow run tenant-deploy.yml ... then gh run list/watch; hub-serverless: no manual dispatch, deploy.yml auto-fires on rc push, correlate/watch that run", gated: true },
-      { label: "after a failed deploy, retry the existing rc ref (no re-tag/merge)", command: "mmi-cli tenant redeploy <owner/repo> rc --watch", gated: true }
+      { label: "after a failed deploy, retry the existing rc ref (no re-tag/merge)", command: "mmi-cli runtime tenant redeploy <owner/repo> rc --watch", gated: true }
     ];
   }
   if (command === "release") {
@@ -12017,7 +12240,7 @@ function trainPlan(command, options = {}) {
       return [
         { label: "verify operator is a master-admin org owner", command: "gh api orgs/<owner>/memberships/<login> --jq .role", gated: true },
         { label: "verify current branch is development", gated: true },
-        { label: "verify registry META for this project", command: "mmi-cli project get <owner/repo>", gated: true },
+        { label: "verify registry META for this project", command: "mmi-cli org project get <owner/repo>", gated: true },
         { label: "preflight required main secret names", command: "mmi-cli secrets preflight --stage main --repo <owner/repo>", gated: true },
         { label: "merge development to main", gated: true },
         { label: "fold the version bump into the release commit (Hub: full distribution set; app repos: root package manifest) \u2014 runs inside the apply step, no separate bump PR", gated: true },
@@ -12031,20 +12254,20 @@ function trainPlan(command, options = {}) {
         { label: "verify operator is a master-admin org owner", command: "gh api orgs/<owner>/memberships/<login> --jq .role", gated: true },
         { label: "verify current branch is development", gated: true },
         { label: "guard: refuse if origin/rc carries content not in development (a dev -> main release would drop it)", command: "git rev-list --count --right-only --cherry-pick --no-merges origin/development...origin/rc", gated: true },
-        { label: "verify registry META for this project", command: "mmi-cli project get <owner/repo>", gated: true },
+        { label: "verify registry META for this project", command: "mmi-cli org project get <owner/repo>", gated: true },
         { label: "preflight required main secret names", command: "mmi-cli secrets preflight --stage main --repo <owner/repo>", gated: true },
         { label: "merge development to main (rc skipped)", gated: true },
         { label: "fold the version bump into the release commit \u2014 runs inside the apply step, no separate bump PR", gated: true },
         { label: "tag release and publish GitHub Release", gated: true },
         { label: "trigger the deploy path for this repo model, returning Hub Actions run id/url data (and, with --watch, its outcome)", command: "tenant-container: gh workflow run tenant-deploy.yml ... then gh run list/watch", gated: true },
-        { label: "retire the rc runtime (rc is ephemeral \u2014 non-fatal, reported as rcRetirement)", command: "mmi-cli tenant control <owner/repo> rc retire", gated: true },
+        { label: "retire the rc runtime (rc is ephemeral \u2014 non-fatal, reported as rcRetirement)", command: "mmi-cli runtime tenant control <owner/repo> rc retire", gated: true },
         { label: "roll development forward and align rc to the released main", gated: true }
       ];
     }
     return [
       { label: "verify operator is a master-admin org owner", command: "gh api orgs/<owner>/memberships/<login> --jq .role", gated: true },
       { label: "verify current branch is rc", gated: true },
-      { label: "verify registry META for this project", command: "mmi-cli project get <owner/repo>", gated: true },
+      { label: "verify registry META for this project", command: "mmi-cli org project get <owner/repo>", gated: true },
       { label: "preflight required main secret names", command: "mmi-cli secrets preflight --stage main --repo <owner/repo>", gated: true },
       { label: "verify every main-only hotfix commit is covered by the rc candidate (the guard runs automatically inside the apply step below; --ack <sha> overrides a verified, trailer-less port)", command: "mmi-cli release --apply [--ack <sha>]", gated: true },
       { label: "merge rc to main", gated: true },
@@ -12112,6 +12335,14 @@ function parseVerifySecrets(stdout) {
   }
   return out;
 }
+function parseVerifyBroker(stdout) {
+  const out = [];
+  for (const line of stdout.split("\n")) {
+    const match = /^(\S+):\s*(reachable|missing|denied|error)\b/.exec(line.trim());
+    if (match) out.push({ key: match[1], status: match[2] });
+  }
+  return out;
+}
 
 // src/train-apply.ts
 function resolveDeployModel2(meta, repo) {
@@ -12395,7 +12626,7 @@ function classifyProjectGetFailure(text) {
 }
 async function loadProjectMeta(deps, ctx) {
   try {
-    const out = await deps.runSelf(["project", "get", ctx.repo]);
+    const out = await deps.runSelf(["org", "project", "get", ctx.repo]);
     const parsed = JSON.parse(out);
     if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
       return { status: "read-error", error: "invalid registry META JSON" };
@@ -12415,7 +12646,7 @@ function requireProjectMetaForTrain(load, repo) {
   }
   if (load.status === "missing") {
     throw new Error(
-      `${label}: no registry META for ${repo} \u2014 train apply refused; bootstrap the project or verify META with \`mmi-cli project get\` before promoting.`
+      `${label}: no registry META for ${repo} \u2014 train apply refused; bootstrap the project or verify META with \`mmi-cli org project get\` before promoting.`
     );
   }
   return load.meta;
@@ -12514,6 +12745,9 @@ function correlatePublishRun(deps, since, titleIncludes) {
 function correlateControlRun(deps, since, titleIncludes) {
   return correlateRun(deps, { workflow: "tenant-control.yml", since, mode: "dispatch", titleIncludes });
 }
+function correlateReconcileRun(deps, since, titleIncludes) {
+  return correlateRun(deps, { workflow: "tenant-reconcile.yml", since, mode: "dispatch", titleIncludes });
+}
 async function correlateWorkflowRun(deps, args) {
   return correlateRun(deps, { ...args, mode: "workflow" });
 }
@@ -12729,7 +12963,7 @@ function partialTrainRecoveryError(cause, input) {
 partial train state: tag ${input.tag} is already pushed; origin/${branch} has not been pushed; ${releaseState}; deploy not dispatched.
 Recovery sequence:
   1. git push origin ${branch}` + releaseCommand + `
-  ${deployStep}. mmi-cli tenant redeploy ${input.repo} ${input.stage} --watch
+  ${deployStep}. mmi-cli runtime tenant redeploy ${input.repo} ${input.stage} --watch
 Do not delete or force-move the pushed tag; rerun the train only after confirming the branch, release, and deploy states above.`
   );
 }
@@ -12911,7 +13145,7 @@ async function dispatchDeploy(deps, ctx, stage, ref, model, watch, autoRunSince,
       if (dispatchFailure === "throw") throw e;
       const msg = e instanceof Error ? e.message : String(e);
       return {
-        note: `tenant-deploy dispatch FAILED: ${msg}. The promotion itself landed (merge/tag/Release pushed before the dispatch) \u2014 recover the deploy with \`mmi-cli tenant redeploy ${ctx.repo} ${stage}\`; never re-tag.`,
+        note: `tenant-deploy dispatch FAILED: ${msg}. The promotion itself landed (merge/tag/Release pushed before the dispatch) \u2014 recover the deploy with \`mmi-cli runtime tenant redeploy ${ctx.repo} ${stage}\`; never re-tag.`,
         deployStatus: "failure"
       };
     }
@@ -13498,14 +13732,14 @@ async function attemptRetire(deps, ctx) {
     return {
       status: "retired",
       category: "retired",
-      note: `rc runtime retired (tenant-control.yml${r.runUrl ? `, ${r.runUrl}` : ""}) \u2014 registry coords kept; /rcand or tenant redeploy recreates rc next cycle`
+      note: `rc runtime retired (tenant-control.yml${r.runUrl ? `, ${r.runUrl}` : ""}) \u2014 registry coords kept; /rcand or runtime tenant redeploy recreates rc next cycle`
     };
   }
   if (r.category === "wait-timeout") {
     return {
       status: "failed",
       category: "wait-timeout",
-      note: `rc retire dispatched but the run could not be observed \u2014 verify with: mmi-cli tenant control ${ctx.repo} rc status${r.runUrl ? ` (run ${r.runUrl})` : ""}`
+      note: `rc retire dispatched but the run could not be observed \u2014 verify with: mmi-cli runtime tenant control ${ctx.repo} rc status${r.runUrl ? ` (run ${r.runUrl})` : ""}`
     };
   }
   return { status: "failed", category: r.category ?? "transport-failed", note: r.note };
@@ -13520,7 +13754,7 @@ async function retireRcRuntime(deps, ctx, model, deployStatus, releasedRcSha) {
   if (deployStatus !== "success") {
     return {
       status: "skipped",
-      note: `prod deploy outcome unconfirmed (run without --watch) \u2014 rc runtime left untouched; after verifying prod, retire with: mmi-cli tenant control ${ctx.repo} rc retire`
+      note: `prod deploy outcome unconfirmed (run without --watch) \u2014 rc runtime left untouched; after verifying prod, retire with: mmi-cli runtime tenant control ${ctx.repo} rc retire`
     };
   }
   try {
@@ -13542,7 +13776,7 @@ async function retireRcRuntime(deps, ctx, model, deployStatus, releasedRcSha) {
     }
     const f = last;
     if (f.category === "wait-timeout") return f;
-    const note = `rc retirement failed (the release itself succeeded): ${f.note}. The rc runtime may be orphaned on the box \u2014 retire it with: mmi-cli tenant control ${ctx.repo} rc retire (or sweep all: mmi-cli tenant sweep-rc --retire --yes)`;
+    const note = `rc retirement failed (the release itself succeeded): ${f.note}. The rc runtime may be orphaned on the box \u2014 retire it with: mmi-cli runtime tenant control ${ctx.repo} rc retire (or sweep all: mmi-cli runtime tenant sweep-rc --retire --yes)`;
     return { status: "failed", category: f.category, note };
   } catch (e) {
     const err = e;
@@ -13569,8 +13803,36 @@ async function runTenantRedeploy(deps, options) {
   const d = await dispatchDeploy(deps, ctx, stage, ref, deployModel, watch);
   return { ...ctx, command: "tenant-redeploy", stage, ref, deployModel, dispatch: d.note, runId: d.runId, runUrl: d.runUrl, workflowRuns: d.workflowRuns, deployStatus: d.deployStatus };
 }
+async function runTenantReconcile(deps, options) {
+  const parts = options.repo.split("/");
+  if (parts.length !== 2 || !parts[0] || !parts[1]) throw new Error(`repo must be owner/name, got ${options.repo}`);
+  if (!["dev", "rc", "main"].includes(options.stage)) throw new Error(`stage must be dev, rc, or main, got ${options.stage}`);
+  if (!deps.dispatchTenantReconcile) throw new Error("tenant reconcile dispatch is unavailable");
+  const stage = options.stage;
+  const base = { command: "tenant-reconcile", repo: options.repo, stage };
+  const since = (deps.now ?? Date.now)();
+  const dispatched = await deps.dispatchTenantReconcile({ repo: options.repo, stage });
+  if (!dispatched.ok) {
+    return {
+      ...base,
+      dispatched: false,
+      conclusion: "failure",
+      note: `tenant reconcile rejected: ${dispatched.error ?? "request rejected by the Hub"}`
+    };
+  }
+  const slug = parts[1].toLowerCase();
+  const run = await correlateReconcileRun(deps, since, [slug, stage]);
+  const conclusion = options.watch ?? true ? await watchTenantRun(deps, run.runId) : "pending";
+  return {
+    ...base,
+    dispatched: true,
+    ...run,
+    conclusion,
+    note: conclusion === "success" ? "tenant-reconcile run succeeded" : conclusion === "failure" ? "tenant-reconcile run failed \u2014 inspect the run before redeploying" : "tenant-reconcile dispatched but not confirmed \u2014 do not redeploy until the run succeeds"
+  };
+}
 function tenantControlWatches(action) {
-  return action === "status" || action === "retire" || action === "verify-secrets";
+  return action === "status" || action === "retire" || action === "verify-secrets" || action === "verify-broker";
 }
 async function runTenantControl(deps, options) {
   const { repo, stage, action } = options;
@@ -13585,7 +13847,7 @@ async function runTenantControl(deps, options) {
       dispatched: false,
       conclusion: "failure",
       category: action === "retire" ? transport ? "transport-failed" : "dispatch-rejected" : void 0,
-      note: transport ? `tenant control ${action} dispatch failed (transport) \u2014 safe to retry` : `tenant control ${action} rejected: ${d.error ?? "request rejected by the Hub"}`
+      note: transport ? `runtime tenant control ${action} dispatch failed (transport) \u2014 safe to retry` : `runtime tenant control ${action} rejected: ${d.error ?? "request rejected by the Hub"}`
     };
   }
   const { runId, runUrl } = await correlateControlRun(deps, since, [stage, action]);
@@ -13594,20 +13856,23 @@ async function runTenantControl(deps, options) {
   if (action === "retire") {
     result.category = conclusion === "success" ? "retired" : conclusion === "failure" ? "control-run-failed" : "wait-timeout";
   }
-  if (watch && runId != null && conclusion === "success" && (action === "status" || action === "verify-secrets")) {
+  if (watch && runId != null && conclusion === "success" && (action === "status" || action === "verify-secrets" || action === "verify-broker")) {
     const output = extractControlOutputFromLog(await fetchControlRunLog(deps, runId));
     if (action === "status") {
       result.serviceState = parseStatusSnippet(output).serviceState;
-    } else {
+    } else if (action === "verify-secrets") {
       result.secrets = parseVerifySecrets(output);
       result.secretsRaw = output;
+    } else {
+      result.broker = parseVerifyBroker(output);
+      result.brokerRaw = output;
     }
   }
   result.note = conclusion === "success" ? `tenant-control ${action} run succeeded` : conclusion === "failure" ? `tenant-control ${action} run failed \u2014 inspect the run` : runId == null ? `dispatched tenant-control.yml (${action}) \u2014 run not correlated; check the Actions tab` : `dispatched tenant-control.yml (${action}) \u2014 not watched`;
   return result;
 }
 function renderTenantControl(r) {
-  const head = `tenant control ${r.repo} ${r.stage} ${r.action}: ${r.conclusion}${r.category ? ` (${r.category})` : ""}`;
+  const head = `runtime tenant control ${r.repo} ${r.stage} ${r.action}: ${r.conclusion}${r.category ? ` (${r.category})` : ""}`;
   const lines = [head];
   if (r.runUrl) lines.push(`  run: ${r.runUrl}`);
   if (r.serviceState) lines.push(`  serviceState: ${r.serviceState}`);
@@ -13650,6 +13915,26 @@ function renderVerifySecrets(body) {
   return { lines, failure: null };
 }
 
+// src/tenant-verify-broker.ts
+function renderVerifyBroker(input) {
+  if (input.broker.length === 0) {
+    const raw = input.raw?.trim();
+    if (raw?.startsWith("no broker-readable runtime secrets declared")) return { lines: [raw], failure: null };
+    return {
+      lines: raw ? raw.split("\n") : ["verify-broker: no per-key verdicts returned"],
+      failure: "verify-broker returned no per-key verdicts, so broker access was not verified"
+    };
+  }
+  const lines = input.broker.map((item) => `${item.key}: ${item.status}`);
+  const reachable = input.broker.filter((item) => item.status === "reachable").length;
+  const bad = input.broker.length - reachable;
+  lines.push(`verify-broker: ${reachable} reachable, ${bad} failed`);
+  return {
+    lines,
+    failure: bad > 0 ? `${bad} of ${input.broker.length} broker read(s) failed; redeploy refreshes an expired runtime token` : null
+  };
+}
+
 // src/hotfix-coverage.ts
 var import_node_child_process8 = require("node:child_process");
 var CHERRY_TRAILER = /\(cherry picked from commit ([0-9a-f]{7,40})\)/g;
@@ -13768,7 +14053,7 @@ function pickRepo(p) {
 }
 async function sweepRcOrphans(deps, opts) {
   const projects = await deps.listProjects();
-  if (!projects) throw new Error("project list unavailable \u2014 Hub unreachable or this repo is not bootstrapped");
+  if (!projects) throw new Error("org project list unavailable \u2014 Hub unreachable or this repo is not bootstrapped");
   const targets = projects.filter(isRcBearingTenant);
   const stages = [];
   for (const p of targets) {
@@ -13805,7 +14090,7 @@ async function sweepRcOrphans(deps, opts) {
   };
 }
 function renderSweep(r) {
-  const lines = [`tenant sweep-rc: scanned ${r.scanned} tenant-container(s); ${r.running} rc runtime(s) running`];
+  const lines = [`runtime tenant sweep-rc: scanned ${r.scanned} tenant-container(s); ${r.running} rc runtime(s) running`];
   for (const s of r.stages) {
     let line = `  ${s.repo} rc: ${s.orphanCandidate ? "RUNNING" : s.serviceState}`;
     if (s.retired) line += ` -> ${s.retired}${s.category ? ` (${s.category}${s.reason ? `/${s.reason}` : ""})` : ""}`;
@@ -13813,7 +14098,7 @@ function renderSweep(r) {
     lines.push(line);
   }
   if (r.running > 0 && !r.retireAttempted) {
-    lines.push("Retire an orphan with: mmi-cli tenant control <owner/repo> rc retire (or sweep all running: mmi-cli tenant sweep-rc --retire --yes)");
+    lines.push("Retire an orphan with: mmi-cli runtime tenant control <owner/repo> rc retire (or sweep all running: mmi-cli runtime tenant sweep-rc --retire --yes)");
   }
   const undetermined = r.stages.filter((s) => s.serviceState === "unknown").length;
   if (undetermined > 0) {
@@ -14634,8 +14919,8 @@ async function auditOrgAccess(targets, deps, matrix = {}, dataAccess) {
         repo: OWNER2,
         kind: "empty-target-inventory",
         severity: "high",
-        detail: "access audit received an empty repo inventory \u2014 zero repos to audit; a green audit of nothing is a false pass",
-        remediation: `confirm the Hub registry is reachable and returns projects, then re-run \`mmi-cli access audit\`; or audit one repo explicitly with \`mmi-cli access audit --repo <owner/repo>\``
+        detail: "org access audit received an empty repo inventory \u2014 zero repos to audit; a green audit of nothing is a false pass",
+        remediation: `confirm the Hub registry is reachable and returns projects, then re-run \`mmi-cli org access audit\`; or audit one repo explicitly with \`mmi-cli org access audit --repo <owner/repo>\``
       }],
       repos: []
     };
@@ -14650,7 +14935,7 @@ async function auditOrgAccess(targets, deps, matrix = {}, dataAccess) {
       kind: "owner-baseline-unavailable",
       severity: "medium",
       detail: `could not resolve org owners (role=admin) from the GitHub API (${e.message}); the overgrant audit needs this baseline and was skipped to avoid false HIGH findings \u2014 re-run when the members API is reachable`,
-      remediation: `confirm the token can read GET /orgs/${OWNER2}/members?role=admin, then re-run \`mmi-cli access audit\``
+      remediation: `confirm the token can read GET /orgs/${OWNER2}/members?role=admin, then re-run \`mmi-cli org access audit\``
     });
     return { ok: degraded.every((f) => f.severity !== "high"), owners: [], orgFindings: degraded, repos: [] };
   }
@@ -14672,14 +14957,10 @@ function loadAccessTargets(projectsJson) {
   const seen = /* @__PURE__ */ new Set();
   const targets = [];
   for (const project2 of projects) {
-    const embeddedContent = new Set(
-      (project2.fanoutTargets ?? []).filter((r) => r.class === "content" && r.repo).map((r) => r.repo.toLowerCase())
-    );
     for (const repo of project2.repos ?? []) {
       if (seen.has(repo)) continue;
       seen.add(repo);
-      const repoName = repo.split("/").pop()?.toLowerCase() ?? repo.toLowerCase();
-      const cls = project2.class === "content" || project2.deployModel === "content" || embeddedContent.has(repo.toLowerCase()) || embeddedContent.has(repoName) ? "content" : "deployable";
+      const cls = project2.class === "content" || project2.deployModel === "content" ? "content" : "deployable";
       const releaseTrack = cls === "content" ? "trunk" : resolveReleaseTrack(project2, void 0, repo);
       targets.push({ repo, class: cls, releaseTrack });
     }
@@ -14695,7 +14976,7 @@ function resolveOrgAuditTargets(registryProjects) {
         kind: "registry-unreadable",
         severity: "high",
         detail: "the project registry SSOT (Hub API) was unreachable or unconfigured \u2014 the audit target set is unknown; auditing the stale committed projects.json instead could pass green while missing live repos",
-        remediation: `confirm the Hub API base URL + token are configured and reachable, then re-run \`mmi-cli access audit\`; or audit one repo explicitly with \`mmi-cli access audit --repo <owner/repo>\``
+        remediation: `confirm the Hub API base URL + token are configured and reachable, then re-run \`mmi-cli org access audit\`; or audit one repo explicitly with \`mmi-cli org access audit --repo <owner/repo>\``
       }
     };
   }
@@ -14740,7 +15021,7 @@ function dataAccessContractsFromProjects(projects) {
   return { consumers };
 }
 function renderAccessReport(report) {
-  const lines = [`mmi-cli access audit: ${report.ok ? "OK" : "CHECK"} (owners: ${report.owners.map((o) => "@" + o).join(", ") || "none"})`];
+  const lines = [`mmi-cli org access audit: ${report.ok ? "OK" : "CHECK"} (owners: ${report.owners.map((o) => "@" + o).join(", ") || "none"})`];
   for (const finding of report.orgFindings ?? []) {
     lines.push(`  [${finding.severity}] ${finding.kind}: ${finding.detail}`);
     if (finding.remediation) lines.push(`      ${finding.remediation}`);
@@ -14759,9 +15040,13 @@ function renderAccessReport(report) {
 var import_node_fs16 = require("node:fs");
 var import_node_path14 = require("node:path");
 var DOCS_INDEX_PATH = "docs/index.md";
+function isRoutableDocsPath(relPath) {
+  const normalized = relPath.replace(/\\/g, "/");
+  return normalized !== "index.md" && normalized.split("/")[0]?.toLowerCase() !== "archive";
+}
 var GENERATED_HEADER = "<!-- Generated by `mmi-cli docs index --write`. Do not edit by hand. -->";
-function escapeCell(text) {
-  return text.replace(/\r?\n/g, " ").replace(/\|/g, "\\|").replace(/\s+/g, " ").trim();
+function plainInline(text) {
+  return text.replace(/\r?\n/g, " ").replace(/!\[([^\]]*)\]\([^)]*\)/g, "$1").replace(/\[([^\]]+)\]\([^)]*\)/g, "$1").replace(/`/g, "").replace(/\*+/g, "").replace(/~~/g, "").replace(/__([^_]+)__/g, "$1").replace(/(^|[\s(])_([^_]+)_($|[\s).,!?:;])/g, "$1$2$3").replace(/^>\s*/, "").replace(/\\([\\`*_\[\]{}()#+.!|>-])/g, "$1").replace(/\s+/g, " ").trim();
 }
 function extractDocMeta(relPath, raw) {
   const lines = raw.split(/\r?\n/);
@@ -14789,7 +15074,7 @@ function extractDocMeta(relPath, raw) {
       break;
     }
     if (trimmed.startsWith("#")) continue;
-    scope = escapeCell(trimmed);
+    scope = plainInline(trimmed);
     break;
   }
   if (!title) {
@@ -14801,16 +15086,16 @@ function extractDocMeta(relPath, raw) {
 function renderDocsIndex(entries) {
   const lines = [
     GENERATED_HEADER,
+    "",
     "# Documentation index",
     "",
     "Generated from the `docs/` tree by `mmi-cli docs index --write`. `--check` fails on drift, so this index",
     "can never diverge from the records it lists.",
-    "",
-    "| Document | Scope |",
-    "| --- | --- |"
+    ""
   ];
   for (const entry of entries) {
-    lines.push(`| [${escapeCell(entry.title)}](${entry.path}) | ${entry.scope} |`);
+    const link = `[${plainInline(entry.title)}](${entry.path})`;
+    lines.push(entry.scope ? `- ${link} \u2014 ${plainInline(entry.scope)}` : `- ${link}`);
   }
   return lines.join("\n") + "\n";
 }
@@ -14846,7 +15131,7 @@ function createDocsIndexDeps(repoRoot2) {
   const docsDir = (0, import_node_path14.join)(repoRoot2, "docs");
   const indexPath = (0, import_node_path14.join)(repoRoot2, DOCS_INDEX_PATH);
   return {
-    listDocs: () => (0, import_node_fs16.existsSync)(docsDir) ? walkMarkdown(docsDir).filter((p) => p !== "index.md").sort() : [],
+    listDocs: () => (0, import_node_fs16.existsSync)(docsDir) ? walkMarkdown(docsDir).filter(isRoutableDocsPath).sort() : [],
     readDoc: (relPath) => (0, import_node_fs16.readFileSync)((0, import_node_path14.join)(docsDir, relPath), "utf8"),
     readIndex: () => (0, import_node_fs16.existsSync)(indexPath) ? (0, import_node_fs16.readFileSync)(indexPath, "utf8") : null,
     writeIndex: (content) => (0, import_node_fs16.writeFileSync)(indexPath, content, "utf8")
@@ -14880,20 +15165,20 @@ function docsAuditRecord(input) {
   const date = input.date.trim();
   const shaRange = input.shaRange.trim();
   const checkerVendor = input.checkerVendor.trim();
-  if (!repo) throw new Error("docs-audit record: repo is required");
-  if (!date) throw new Error("docs-audit record: date is required");
-  if (!isValidIsoDate(date)) throw new Error(`docs-audit record: date must be a real ISO date (YYYY-MM-DD), got "${date}"`);
-  if (!shaRange) throw new Error("docs-audit record: shaRange is required");
-  if (!checkerVendor) throw new Error("docs-audit record: checkerVendor is required");
+  if (!repo) throw new Error("docs audit record: repo is required");
+  if (!date) throw new Error("docs audit record: date is required");
+  if (!isValidIsoDate(date)) throw new Error(`docs audit record: date must be a real ISO date (YYYY-MM-DD), got "${date}"`);
+  if (!shaRange) throw new Error("docs audit record: shaRange is required");
+  if (!checkerVendor) throw new Error("docs audit record: checkerVendor is required");
   if (input.outcome.kind === "refreshed" && !(Number.isInteger(input.outcome.count) && input.outcome.count > 0)) {
-    throw new Error("docs-audit record: a `refreshed` outcome must carry a positive integer count");
+    throw new Error("docs audit record: a `refreshed` outcome must carry a positive integer count");
   }
   if (input.outcome.kind === "failed" && !input.outcome.reason.trim()) {
-    throw new Error("docs-audit record: a `failed` outcome must carry a reason");
+    throw new Error("docs audit record: a `failed` outcome must carry a reason");
   }
   const outcome = serializeOutcome(input.outcome);
   if (!isValidOutcomeWire(outcome)) {
-    throw new Error(`docs-audit record: outcome serialized to an invalid wire form "${outcome}"`);
+    throw new Error(`docs audit record: outcome serialized to an invalid wire form "${outcome}"`);
   }
   return { repo, date, shaRange, outcome, checkerVendor };
 }
@@ -14904,13 +15189,13 @@ function ageInDays(verdictDate, today) {
 }
 function docsAuditStatus(fetch2, opts) {
   if ("notArmed" in fetch2) {
-    return { ok: true, state: "not-armed", line: `docs-audit: ${opts.repo} janitor not armed (registry route not live yet)` };
+    return { ok: true, state: "not-armed", line: `docs audit: ${opts.repo} janitor not armed (registry route not live yet)` };
   }
   if (!fetch2.ok) {
-    return { ok: false, state: "error", line: `docs-audit: ${opts.repo} registry read failed \u2014 ${fetch2.error}` };
+    return { ok: false, state: "error", line: `docs audit: ${opts.repo} registry read failed \u2014 ${fetch2.error}` };
   }
   if (fetch2.verdict === null) {
-    return { ok: false, state: "missing", line: `docs-audit: ${opts.repo} no verdict on record \u2014 janitor blind or dead` };
+    return { ok: false, state: "missing", line: `docs audit: ${opts.repo} no verdict on record \u2014 janitor blind or dead` };
   }
   const verdict = fetch2.verdict;
   for (const field of ["repo", "shaRange", "checkerVendor"]) {
@@ -14920,7 +15205,7 @@ function docsAuditStatus(fetch2, opts) {
       return {
         ok: false,
         state: "malformed",
-        line: `docs-audit: ${opts.repo} malformed verdict ${field} (${shown}, expected a non-empty string) \u2014 registry record corrupt, treating as RED`
+        line: `docs audit: ${opts.repo} malformed verdict ${field} (${shown}, expected a non-empty string) \u2014 registry record corrupt, treating as RED`
       };
     }
   }
@@ -14928,450 +15213,29 @@ function docsAuditStatus(fetch2, opts) {
     return {
       ok: false,
       state: "malformed",
-      line: `docs-audit: ${opts.repo} malformed verdict date "${verdict.date}" \u2014 registry record corrupt, treating as RED`
+      line: `docs audit: ${opts.repo} malformed verdict date "${verdict.date}" \u2014 registry record corrupt, treating as RED`
     };
   }
   if (!isValidOutcomeWire(verdict.outcome)) {
     return {
       ok: false,
       state: "malformed",
-      line: `docs-audit: ${opts.repo} malformed verdict outcome "${verdict.outcome}" (expected clean|refreshed-N|failed) \u2014 registry record corrupt, treating as RED`
+      line: `docs audit: ${opts.repo} malformed verdict outcome "${verdict.outcome}" (expected clean|refreshed-N|failed) \u2014 registry record corrupt, treating as RED`
     };
   }
   if (!isValidIsoDate(opts.today)) {
-    throw new Error(`docs-audit status: today must be a real ISO date (YYYY-MM-DD), got "${opts.today}"`);
+    throw new Error(`docs audit status: today must be a real ISO date (YYYY-MM-DD), got "${opts.today}"`);
   }
   const cadence = opts.cadenceDays ?? 7;
   const grace = opts.graceDays ?? 3;
   const age = ageInDays(verdict.date, opts.today);
   if (age > cadence + grace) {
-    return { ok: false, state: "stale", line: `docs-audit: ${opts.repo} last verdict ${age}d old \u2014 janitor blind or dead` };
+    return { ok: false, state: "stale", line: `docs audit: ${opts.repo} last verdict ${age}d old \u2014 janitor blind or dead` };
   }
   if (verdict.outcome === "failed") {
-    return { ok: false, state: "failed", line: `docs-audit: ${opts.repo} last run FAILED (${verdict.date}) \u2014 janitor needs attention` };
-  }
-  return { ok: true, state: "clean", line: `docs-audit: ${opts.repo} ${verdict.outcome} (${verdict.date}, ${verdict.checkerVendor})` };
-}
-
-// src/project-readiness.ts
-function stagesForTrack(meta) {
-  return branchesForTrack(resolveReleaseTrack(meta)).map((b) => b === "development" ? "dev" : b);
-}
-function stageInTrack(meta, stage) {
-  return stagesForTrack(meta).includes(stage);
-}
-function dnsErrorToResolution(code) {
-  return code === "ENOTFOUND" || code === "EAI_NONAME" ? false : void 0;
-}
-var STAGES = ["dev", "rc", "main"];
-var DEFAULT_RUNTIME_SECRET_NAMES2 = ["GOOGLE_CLIENT_ID", "GOOGLE_CLIENT_SECRET"];
-function boardRegistryGaps(meta) {
-  if (!meta?.projectId) return [];
-  if (meta.projectNumber != null) return [];
-  return ["projectNumber"];
-}
-function previewRegistryMetaMerge(existing, patch) {
-  const out = { ...existing ?? {} };
-  for (const [key, value] of Object.entries(patch)) {
-    if (value === null) delete out[key];
-    else out[key] = value;
-  }
-  return out;
-}
-function boardLinkWriteError(patch, existing) {
-  const patchHasProjectId = typeof patch.projectId === "string" && patch.projectId.length > 0;
-  const patchHasProjectNumber = typeof patch.projectNumber === "number" && Number.isFinite(patch.projectNumber);
-  if (patchHasProjectId && !patchHasProjectNumber && existing?.projectNumber == null) {
-    return "projectId requires projectNumber in registry META \u2014 pass projectNumber with board coords";
-  }
-  if (patch.projectNumber === null && boardRegistryGaps(previewRegistryMetaMerge(existing, patch)).length) {
-    return "projectId requires projectNumber in registry META \u2014 pass projectNumber with board coords";
-  }
-  return null;
-}
-function boardRegistryGapMessage(repo) {
-  return `Board META incomplete for ${repo}: registry has projectId but no projectNumber \u2014 board claim and auto-add will fail until projectNumber is backfilled (re-run \`node infra/migrate/seed-registry.mjs\` or \`mmi-cli bootstrap apply --execute\` with board vars)`;
-}
-var slugOfRepo = slugOf;
-function repoFrom(repoOrSlug, slug) {
-  return repoOrSlug.includes("/") ? repoOrSlug : `mutmutco/${slug}`;
-}
-function defaultSubdomain(slug) {
-  return slug.replace(/^[a-z]+-/, "");
-}
-function projectRequiresGoogleOAuth(meta, model) {
-  if (!meta || model === "content" || model === "none" || meta.deployModel === "content" || meta.deployModel === "none" || meta.class === "content") return false;
-  const projectType = resolveProjectType(meta, meta.repos?.[0] ?? "");
-  if (projectType !== "web-app") return false;
-  return Boolean(meta.oauth && typeof meta.oauth === "object");
-}
-function declaresNoPublicEdge(meta) {
-  const ed = meta?.edgeDomains;
-  return Boolean(ed && typeof ed === "object" && !Array.isArray(ed) && Object.keys(ed).length === 0);
-}
-function declaresWorker(meta) {
-  return meta?.projectType === "worker";
-}
-function isCentralContainerModel(model) {
-  return model === "tenant-container" || model === "solo-container";
-}
-function isNoEdgeTenantWorker(meta, model) {
-  return isCentralContainerModel(model) && (declaresNoPublicEdge(meta) || declaresWorker(meta));
-}
-function projectRequiresDeployCoords(model, stage, meta) {
-  if (!isCentralContainerModel(model)) return false;
-  if (stage && isNoEdgeTenantWorker(meta, model)) return stage === "main";
-  return true;
-}
-function projectRequiresDeployState(model, stage) {
-  return model === "hub-serverless" && stage !== "dev";
-}
-function stageRequiredSecrets(stage, meta) {
-  const contract = meta.requiredRuntimeSecrets;
-  const extra = !Array.isArray(contract) && Array.isArray(contract?.[stage]) ? contract[stage] ?? [] : [];
-  const model = resolveDeployModel(meta, meta.repos?.[0] ?? "");
-  if (isNoEdgeTenantWorker(meta, model) && stage !== "main") return [];
-  const defaults = projectRequiresGoogleOAuth(meta, model) ? DEFAULT_RUNTIME_SECRET_NAMES2 : [];
-  return [.../* @__PURE__ */ new Set([...defaults, ...extra])];
-}
-function stageKey2(stage, key) {
-  return key.includes("/") ? key : `${stage}/${key}`;
-}
-function materializedRuntimeSecretName(entry) {
-  return entry.includes(":") ? entry.split(":").pop() : entry;
-}
-function runtimeSecretStreamGap(stage, meta, presentSecrets) {
-  const streamed = new Set(
-    (contractByStage(meta.requiredRuntimeSecrets)[stage] ?? []).map(materializedRuntimeSecretName)
-  );
-  const seen = /* @__PURE__ */ new Set();
-  const gap = [];
-  for (const name of stageRequiredSecrets(stage, meta).map(materializedRuntimeSecretName)) {
-    if (seen.has(name)) continue;
-    seen.add(name);
-    if (!streamed.has(name) && (presentSecrets.has(stageKey2(stage, name)) || presentSecrets.has(name))) gap.push(name);
-  }
-  return gap;
-}
-function hasRuntimeSecretContract(contract) {
-  if (!contract || typeof contract !== "object" || Array.isArray(contract)) return false;
-  return ["dev", "rc", "main"].some((stage) => Array.isArray(contract[stage]));
-}
-function appAttestationOf(meta) {
-  const a = meta?.appAttested;
-  if (!a || typeof a !== "object" || Array.isArray(a)) return null;
-  const { at, by } = a;
-  return typeof at === "string" && at.length > 0 && typeof by === "string" && by.length > 0 ? { at, by } : null;
-}
-function attestedLine(att) {
-  return `App-owned readiness attested by @${att.by} on ${att.at.slice(0, 10)} \u2014 the static checklist is cleared (the doctor reads no product repo files); re-run \`mmi-cli project attest\` after app-owned structural changes.`;
-}
-var CONTRACT_UNDECLARED_LINE = "No runtime secrets declared \u2014 declare requiredRuntimeSecrets (a per-stage name map) in the registry META, or attest the app needs none with an explicit empty stage map ({ dev: [], rc: [], main: [] }).";
-function appGapsFor(meta, model, slug, projectType, mainDeployFact) {
-  const attested = appAttestationOf(meta);
-  const isTenantWeb = !(projectType === "content" || model === "content") && projectType !== "desktop-app" && projectType !== "desktop-game" && projectType !== "cli-tool" && !(projectType === "non-deployable" || model === "none") && model !== "hub-serverless" && model !== "serverless" && model !== "registry-publish";
-  const contractUndeclared = isTenantWeb && Boolean(meta) && !hasRuntimeSecretContract(meta?.requiredRuntimeSecrets);
-  if (attested) return contractUndeclared ? [attestedLine(attested), CONTRACT_UNDECLARED_LINE] : [attestedLine(attested)];
-  if (projectType === "content" || model === "content") return ["Content repo: keep app-owned work to docs/content changes; release train does not apply."];
-  if (projectType === "desktop-app") {
-    return [
-      "Desktop app: no Hub deploy coords, Google OAuth, DWD, or tenant control by default; keep app-owned installer/packaging outside the tenant train.",
-      "Keep README.md and architecture.md explicit about the per-OS build and distribution path (installer, and any registry publish alongside it) so readiness does not guess web infra."
-    ];
-  }
-  if (projectType === "desktop-game") {
-    return [
-      "Desktop game: no Hub deploy coords, Google OAuth, DWD, or tenant control by default; keep app-owned release packaging outside the tenant train.",
-      "Keep README.md and architecture.md explicit about the game build/release path so readiness does not guess web infra."
-    ];
-  }
-  if (projectType === "non-deployable" || model === "none") {
-    return [
-      "Non-deployable repo: no Hub deploy coords, Google OAuth, DWD, or tenant control by default.",
-      "Keep README.md and architecture.md explicit about the repo purpose and any project-admin workflow it still needs."
-    ];
-  }
-  if (model === "hub-serverless") {
-    return [
-      "Hub serverless deploy stays on the Hub-owned workflows; deploy.yml stamps per-stage deploy state onto state-only DEPLOY# rows (no tenant coords).",
-      "Make runtime config fail clearly for missing required env in prod/rc instead of relying on hidden defaults."
-    ];
-  }
-  if (model === "serverless") {
-    return [
-      "Serverless deploys use the central serverless path; do not add tenant compose or box plumbing.",
-      "Make runtime config fail clearly for missing required env in prod/rc instead of relying on hidden defaults.",
-      "Keep app-owned README.md and architecture.md aligned with v2 central deploy/secrets reality."
-    ];
-  }
-  if (projectType === "cli-tool" || model === "registry-publish") {
-    return [
-      "Distributable CLI/plugin: ship a publishable package.json (name, version, bin/exports) \u2014 release publishes to npm (plugin-marketplace publish is future work when a plugin tenant lands), not a box deploy; no Hub deploy coords, edge, or OAuth.",
-      "Keep the published version in lockstep with the release tag; make the publish idempotent (skip when the version is already on the registry).",
-      "Keep app-owned README.md and architecture.md aligned with the registry-publish release path."
-    ];
-  }
-  const gaps = [
-    'Ensure the compose is fileless (#2662) \u2014 drop env_file: and mark each runtime-secret service with the mmi.runtime-env: "true" label; the box injects coords + declared runtime secrets into the container process env at deploy (no .env on disk); the app reads plain environment variables and never self-loads SSM.',
-    "Make app config fail clearly for missing required env in prod/rc instead of relying on hidden defaults.",
-    "Keep app-owned README.md and architecture.md aligned with v2 central deploy/secrets reality."
-  ];
-  if (isNoEdgeTenantWorker(meta, model)) {
-    gaps.unshift("No public edge (worker/outbound-only tenant \u2014 `projectType: worker` or `edgeDomains: {}`): skip Cloudflare edge auto-heal, OAuth defaults, and dev/rc remote deploy coords unless META explicitly adds them.");
-  }
-  if (contractUndeclared) {
-    gaps.unshift(CONTRACT_UNDECLARED_LINE);
-  }
-  if (slug === "mmi-katip") {
-    gaps.push("Katip-specific app plan: declare Google Workspace service-account requirements, use the service account numeric OAuth2 client ID for DWD, remove prod-hidden impersonation defaults, and make non-critical Google Workspace failures degrade instead of crash-looping.");
-  }
-  if (model === "solo-container" || model === "tenant-container") {
-    if (typeof mainDeployFact?.port === "number") {
-      gaps.push(`Seed DEPLOY#main healthUrl to http://127.0.0.1:${mainDeployFact.port}/health during bootstrap (tenant reconcile/control health gate \u2014 #1202; port read from DEPLOY#main).`);
-    } else if (!appAttestationOf(meta)) {
-      gaps.push("Seed DEPLOY#main healthUrl from the DEPLOY#main edgeVhost.port during bootstrap (tenant reconcile/control health gate \u2014 #1202); doctor has no committed DEPLOY port to cite yet.");
-    }
-  }
-  if (!meta) gaps.unshift("No app-owned repo changes can be planned precisely until Hub registry META exists.");
-  return gaps;
-}
-function edgeDomainsByStage(meta) {
-  const ed = meta?.edgeDomains;
-  if (!ed || typeof ed !== "object" || Array.isArray(ed)) return {};
-  const out = {};
-  for (const stage of STAGES) {
-    const v = ed[stage];
-    if (typeof v === "string" && v.trim()) out[stage] = v.trim();
-  }
-  return out;
-}
-async function probeEdgeDomains(meta, resolveDns) {
-  const byStage = edgeDomainsByStage(meta);
-  const results = await Promise.all(
-    Object.entries(byStage).map(async ([stage, host]) => {
-      let resolved;
-      try {
-        resolved = await resolveDns(host);
-      } catch {
-        resolved = void 0;
-      }
-      return resolved === false ? { stage, host } : void 0;
-    })
-  );
-  return results.filter((r) => r !== void 0);
-}
-function contractByStage(contract) {
-  return contract && !Array.isArray(contract) ? contract : {};
-}
-function ensureStageNames(names, required) {
-  return [.../* @__PURE__ */ new Set([...names ?? [], ...required])];
-}
-function sameNames(a, b) {
-  const left = new Set(a ?? []);
-  const right = new Set(b ?? []);
-  if (left.size !== right.size) return false;
-  return [...left].every((name) => right.has(name));
-}
-function sameStageContract(a, b) {
-  return STAGES.every((stage) => sameNames(a[stage], b[stage]));
-}
-function buildV2HealPatch(repoOrSlug, meta, mainDeployFact) {
-  const slug = slugOfRepo(repoOrSlug);
-  const repo = repoFrom(repoOrSlug, slug);
-  const sub = defaultSubdomain(slug);
-  const patch = {};
-  const confidentType = resolveProjectTypeConfident(meta, repo);
-  const projectType = confidentType ?? resolveProjectType(meta, repo);
-  const model = resolveDeployModel(meta, repo);
-  if (confidentType && !meta?.class) patch.class = confidentType === "content" ? "content" : "deployable";
-  if (confidentType) {
-    if (!meta?.projectType) patch.projectType = confidentType;
-    if (!meta?.deployModel) patch.deployModel = model;
-  }
-  if (!meta?.vaultPath) patch.vaultPath = `/mmi-future/${slug}`;
-  if (confidentType && !meta?.edgeDomains && model === "tenant-container" && projectType !== "worker") {
-    patch.edgeDomains = {
-      dev: `dev.${sub}.mutatismutandis.co`,
-      rc: `rc.${sub}.mutatismutandis.co`,
-      main: `${sub}.mutatismutandis.co`
-    };
+    return { ok: false, state: "failed", line: `docs audit: ${opts.repo} last run FAILED (${verdict.date}) \u2014 janitor needs attention` };
   }
-  if (meta && projectTypeClearsWebProfile(projectType, model)) {
-    if (meta.oauth !== void 0) patch.oauth = null;
-    if (meta.edgeDomains !== void 0) patch.edgeDomains = null;
-  }
-  if (slug === "mmi-katip") {
-    const required = ["GOOGLE_IMPERSONATE_USER", "GOOGLE_ADMIN_USER"];
-    const current = contractByStage(meta?.requiredRuntimeSecrets);
-    const next = {
-      dev: ensureStageNames(current.dev, required),
-      rc: ensureStageNames(current.rc, required),
-      main: ensureStageNames(current.main, required)
-    };
-    if (!sameStageContract(current, next)) {
-      patch.requiredRuntimeSecrets = next;
-    }
-  }
-  const appOwnedGaps = confidentType ? appGapsFor(meta, model, slug, confidentType, mainDeployFact) : [`Project type is unset and not derivable \u2014 classify with \`mmi-cli project set ${repo} --project-type <web-app|hub-service|content|desktop-app|desktop-game|non-deployable|cli-tool|worker> --deploy-model <tenant-container|solo-container|hub-serverless|serverless|registry-publish|content|none>\` before heal completes the v2 fields (prevents defaulting a non-web repo to tenant-container).`];
-  if (boardRegistryGaps(meta).length) appOwnedGaps.unshift(boardRegistryGapMessage(repo));
-  return { slug, patch, appOwnedGaps };
-}
-async function runV2Heal(repoOrSlug, opts, deps) {
-  const slug = slugOfRepo(repoOrSlug);
-  const read = await deps.fetchProject(slug);
-  if (!read.ok) {
-    return { status: "aborted", slug, error: `registry read failed for ${slug} (${read.error}) \u2014 aborting; a failed read must not be treated as a missing project` };
-  }
-  const plan = buildV2HealPatch(repoOrSlug, read.project);
-  if (!opts.apply) return { status: "planned", slug, patch: plan.patch, appOwnedGaps: plan.appOwnedGaps };
-  if (!Object.keys(plan.patch).length) return { status: "noop", slug, appOwnedGaps: plan.appOwnedGaps };
-  const write = await deps.upsertProject(slug, plan.patch);
-  if (!write.ok) return { status: "write-failed", slug, write };
-  return { status: "applied", slug, applied: Object.keys(plan.patch), appOwnedGaps: plan.appOwnedGaps, result: write.body };
-}
-async function buildV2Doctor(repoOrSlug, deps) {
-  const slug = slugOfRepo(repoOrSlug);
-  const repo = repoFrom(repoOrSlug, slug);
-  const read = await deps.getProject(slug);
-  if (!read.ok) {
-    const degradedSecrets = {
-      dev: { required: [], present: [], missing: [] },
-      rc: { required: [], present: [], missing: [] },
-      main: { required: [], present: [], missing: [] }
-    };
-    const degradedStage = {
-      dev: { ok: false, required: false },
-      rc: { ok: false, required: false },
-      main: { ok: false, required: false }
-    };
-    return {
-      ok: false,
-      repo,
-      slug,
-      registryError: read.error,
-      hubOwned: { meta: { ok: false, missing: [] }, deployCoords: degradedStage, deployState: degradedStage, secrets: degradedSecrets },
-      autoHealAvailable: [],
-      appOwnedGaps: [`Hub registry read failed (${read.error}) \u2014 diagnosis degraded; nothing is known about META, coords, or gaps. Likely transient (cold start, network, or auth blip): retry \`mmi-cli project doctor\` shortly.`]
-    };
-  }
-  const meta = read.project;
-  const projectType = resolveProjectType(meta, repo);
-  const model = resolveDeployModel(meta, repo);
-  const mainDeployFact = meta && deps.getDeployFact ? await deps.getDeployFact(slug, "main") : null;
-  const autoHeal = buildV2HealPatch(repo, meta, mainDeployFact);
-  if (!meta) {
-    const emptySecrets = {
-      dev: { required: [], present: [], missing: [] },
-      rc: { required: [], present: [], missing: [] },
-      main: { required: [], present: [], missing: [] }
-    };
-    const emptyCoords = {
-      dev: { ok: false, required: true },
-      rc: { ok: false, required: true },
-      main: { ok: false, required: true }
-    };
-    const emptyState = Object.fromEntries(STAGES.map((stage) => {
-      const required = projectRequiresDeployState(model, stage);
-      return [stage, { required, ok: !required }];
-    }));
-    return {
-      ok: false,
-      repo,
-      slug,
-      hubOwned: { meta: { ok: false, missing: [`PROJECT#${slug}/META`] }, deployCoords: emptyCoords, deployState: emptyState, secrets: emptySecrets },
-      autoHealAvailable: Object.keys(autoHeal.patch),
-      appOwnedGaps: autoHeal.appOwnedGaps
-    };
-  }
-  let presentSecrets = /* @__PURE__ */ new Set();
-  let secretsError;
-  try {
-    presentSecrets = new Set(await deps.listSecrets(repo));
-  } catch (e) {
-    secretsError = e?.message || "secrets list failed";
-  }
-  const deployCoords = Object.fromEntries(await Promise.all(STAGES.map(async (stage) => {
-    const required = stageInTrack(meta, stage) && projectRequiresDeployCoords(model, stage, meta);
-    return [stage, { required, ok: required ? await deps.hasDeployCoords(slug, stage) : true }];
-  })));
-  const deployState = Object.fromEntries(await Promise.all(STAGES.map(async (stage) => {
-    const required = stageInTrack(meta, stage) && projectRequiresDeployState(model, stage);
-    return [stage, { required, ok: required ? await deps.hasDeployState(slug, stage) : true }];
-  })));
-  const secrets = Object.fromEntries(STAGES.map((stage) => {
-    const names = stageInTrack(meta, stage) ? stageRequiredSecrets(stage, meta) : [];
-    const satisfied = (key) => presentSecrets.has(stageKey2(stage, key)) || !key.includes("/") && presentSecrets.has(key);
-    const required = names.map((key) => stageKey2(stage, key));
-    const present = names.filter(satisfied).map((key) => stageKey2(stage, key));
-    const missing = names.filter((key) => !satisfied(key)).map((key) => stageKey2(stage, key));
-    return [stage, { required, present, missing }];
-  }));
-  const runtimeSecretStreamWarnings = Object.fromEntries(STAGES.map((stage) => [
-    stage,
-    stageInTrack(meta, stage) ? runtimeSecretStreamGap(stage, meta, presentSecrets) : []
-  ]));
-  const runtimeSecretStreamWarningRows = STAGES.map((stage) => ({ stage, names: runtimeSecretStreamWarnings[stage] })).filter((row) => row.names.length > 0);
-  const metaMissing = ["class", "projectType", "deployModel", "vaultPath"].filter((key) => meta[key] === void 0).concat(boardRegistryGaps(meta));
-  const ok = !secretsError && metaMissing.length === 0 && Object.values(deployCoords).every((v) => v.ok) && Object.values(secrets).every((v) => v.missing.length === 0);
-  const edgeDomainWarnings = deps.resolveDns ? await probeEdgeDomains(meta, deps.resolveDns) : [];
-  return {
-    ok,
-    repo,
-    slug,
-    class: meta.class,
-    projectType,
-    deployModel: model,
-    hubOwned: { meta: { ok: metaMissing.length === 0, missing: metaMissing }, deployCoords, deployState, secrets },
-    secretsError,
-    autoHealAvailable: Object.keys(autoHeal.patch),
-    appOwnedGaps: autoHeal.appOwnedGaps,
-    ...edgeDomainWarnings.length ? { edgeDomainWarnings } : {},
-    ...runtimeSecretStreamWarningRows.length ? { runtimeSecretStreamWarnings: runtimeSecretStreamWarningRows } : {},
-    appAttested: appAttestationOf(meta) ?? void 0
-  };
-}
-function renderReadinessIssueBody(existingBody, report, opts = {}) {
-  const start = "<!-- mmi-v2-readiness:start -->";
-  const end = "<!-- mmi-v2-readiness:end -->";
-  const stageLines = STAGES.map((stage) => {
-    const coordState = report.hubOwned.deployCoords[stage];
-    const coords = !coordState.required ? "coords n/a" : coordState.ok ? "coords ok" : "coords missing/unverified";
-    const state = report.hubOwned.deployState[stage];
-    const statePart = !state.required ? [] : [state.ok ? "deploy state stamped" : "deploy state not stamped"];
-    const missing = report.hubOwned.secrets[stage].missing;
-    return `- ${stage}: ${[coords, ...statePart].join("; ")}; ${missing.length ? `missing ${missing.join(", ")}` : "required secret names present"}`;
-  });
-  const section = [
-    start,
-    "## Hub v2 readiness",
-    "",
-    `Repo: ${report.repo}`,
-    `Project type: ${report.projectType ?? "(unresolved)"}`,
-    `Deploy model: ${report.deployModel ?? "(unresolved)"}`,
-    `Overall: ${report.ok ? "ready" : "not ready"}`,
-    "",
-    "### Hub-owned diagnosis",
-    `- META: ${report.hubOwned.meta.ok ? "ok" : `missing ${report.hubOwned.meta.missing.join(", ")}`}`,
-    ...stageLines,
-    ...report.secretsError ? [`- secrets UNVERIFIED (treated as not ready): ${report.secretsError}`] : [],
-    ...(report.edgeDomainWarnings ?? []).map(
-      (w) => `- \u26A0 edge domain does not resolve in DNS (advisory): ${w.stage} \u2192 ${w.host}; verify the registry edgeDomains value against the live public host`
-    ),
-    ...(report.runtimeSecretStreamWarnings ?? []).map(
-      (w) => `- \u26A0 required secrets provisioned but not in requiredRuntimeSecrets (advisory): ${w.stage} \u2192 ${w.names.join(", ")}; add them to the registry stream list or they will not be materialized into tenant.env`
-    ),
-    "",
-    "### Auto-heal applied / available",
-    ...opts.healed?.length ? opts.healed.map((x) => `- ${x}`) : report.autoHealAvailable.map((x) => `- ${x}`),
-    "",
-    "### App-owned implementation plan",
-    ...report.appOwnedGaps.map((x) => `- ${x}`),
-    end
-  ].join("\n");
-  const re = new RegExp(`${start}[\\s\\S]*?${end}`);
-  return re.test(existingBody) ? existingBody.replace(re, () => section) : `${existingBody.trim()}
-
-${section}`.trim();
+  return { ok: true, state: "clean", line: `docs audit: ${opts.repo} ${verdict.outcome} (${verdict.date}, ${verdict.checkerVendor})` };
 }
 
 // src/oauth.ts
@@ -15381,7 +15245,7 @@ var ENV_PREFIXES = ["", "dev", "rc"];
 var LOOPBACK = ["http://localhost", "http://127.0.0.1"];
 var SSM_NAMES = ["GOOGLE_CLIENT_ID", "GOOGLE_CLIENT_SECRET"];
 var uniq = (xs) => [...new Set(xs)];
-function defaultSubdomain2(slug) {
+function defaultSubdomain(slug) {
   const i = slug.indexOf("-");
   return i === -1 ? slug : slug.slice(i + 1);
 }
@@ -15434,7 +15298,7 @@ function parseOauthConfig(mmiConfig, slug) {
     throw new Error("oauth must be an object when configured");
   }
   const raw = rawUnknown;
-  const subdomains = Array.isArray(raw.subdomains) && raw.subdomains.length > 0 ? raw.subdomains.map(String) : [defaultSubdomain2(slug)];
+  const subdomains = Array.isArray(raw.subdomains) && raw.subdomains.length > 0 ? raw.subdomains.map(String) : [defaultSubdomain(slug)];
   const domains = Array.isArray(raw.domains) && raw.domains.length > 0 ? raw.domains.map(String) : [...DEFAULT_DOMAINS];
   const callbackPath = typeof raw.callbackPath === "string" && raw.callbackPath ? raw.callbackPath : DEFAULT_CALLBACK_PATH;
   if (!callbackPath.startsWith("/")) {
@@ -15445,7 +15309,7 @@ function parseOauthConfig(mmiConfig, slug) {
   }
   const meta = mmiConfig ?? {};
   const rawFofuSub = raw.fofuSubdomain;
-  const fofuSubdomain = meta.fofuEnabled === true ? typeof rawFofuSub === "string" ? rawFofuSub : defaultSubdomain2(slug) : void 0;
+  const fofuSubdomain = meta.fofuEnabled === true ? typeof rawFofuSub === "string" ? rawFofuSub : defaultSubdomain(slug) : void 0;
   return { subdomains, domains, callbackPath, fofuSubdomain };
 }
 function probeRedirectUri(callbackPath, port = 9123) {
@@ -15473,42 +15337,62 @@ var RUNTIME_SECRET_STAGES = ["dev", "rc", "main"];
 var SECRET_CONSUMERS = ["runtime", "build", "lambda", "actions", "agent", "box"];
 var SECRET_ENV_NAME_RE = /^[A-Za-z][A-Za-z0-9_]*$/;
 var BUILD_SECRET_REF_RE = /^(?:[A-Z_][A-Z0-9_]*=)?(?:[A-Z_][A-Z0-9_]*|(?:mm-fofu|_org\/[a-z0-9][a-z0-9-]*):[A-Z_][A-Z0-9_]*|@github-packages-token)$/;
+function previewRegistryMetaMerge(existing, patch) {
+  const out = { ...existing ?? {} };
+  for (const [key, value] of Object.entries(patch)) {
+    if (value === null) delete out[key];
+    else out[key] = value;
+  }
+  return out;
+}
+function boardLinkWriteError(patch, existing) {
+  const patchHasProjectId = typeof patch.projectId === "string" && patch.projectId.length > 0;
+  const patchHasProjectNumber = typeof patch.projectNumber === "number" && Number.isFinite(patch.projectNumber);
+  if (patchHasProjectId && !patchHasProjectNumber && existing?.projectNumber == null) {
+    return "projectId requires projectNumber in registry META \u2014 pass projectNumber with board coords";
+  }
+  const preview = previewRegistryMetaMerge(existing, patch);
+  if (patch.projectNumber === null && preview.projectId && preview.projectNumber == null) {
+    return "projectId requires projectNumber in registry META \u2014 pass projectNumber with board coords";
+  }
+  return null;
+}
 function parseSecretsCatalogVar(raw) {
   let parsed;
   try {
     parsed = JSON.parse(raw);
   } catch {
-    throw new Error('project set: secrets must be JSON keyed by KEY, e.g. {"SCRAPER_API_KEY":{"key":"SCRAPER_API_KEY","purpose":"scrape provider key","group":"scraper","owner":"oguz","stages":[],"consumers":["box"]}}');
+    throw new Error('org project set: secrets must be JSON keyed by KEY, e.g. {"SCRAPER_API_KEY":{"key":"SCRAPER_API_KEY","purpose":"scrape provider key","group":"scraper","owner":"oguz","stages":[],"consumers":["box"]}}');
   }
   if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
-    throw new Error("project set: secrets must be a map keyed by canonical KEY");
+    throw new Error("org project set: secrets must be a map keyed by canonical KEY");
   }
   const nonEmpty = (v) => typeof v === "string" && v.trim().length > 0;
   const overrideMapKey = /^([A-Z_][A-Z0-9_]*)@(dev|rc|main)$/;
   for (const [mapKey, value] of Object.entries(parsed)) {
-    if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error(`project set: secrets["${mapKey}"] must be an object`);
+    if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error(`org project set: secrets["${mapKey}"] must be an object`);
     const e = value;
     if (typeof e.key !== "string" || !SECRET_ENV_NAME_RE.test(e.key)) {
-      throw new Error(`project set: secrets["${mapKey}"].key must be an env-name (UPPER_SNAKE)`);
+      throw new Error(`org project set: secrets["${mapKey}"].key must be an env-name (UPPER_SNAKE)`);
     }
     const override = overrideMapKey.exec(mapKey);
     if (override) {
       if (e.key !== override[1] || !Array.isArray(e.stages) || e.stages.length !== 1 || e.stages[0] !== override[2]) {
-        throw new Error(`project set: secrets["${mapKey}"] is an override entry (#2528) \u2014 key must be ${override[1]} and stages exactly ["${override[2]}"]`);
+        throw new Error(`org project set: secrets["${mapKey}"] is an override entry (#2528) \u2014 key must be ${override[1]} and stages exactly ["${override[2]}"]`);
       }
     } else if (e.key !== mapKey) {
-      throw new Error(`project set: secrets["${mapKey}"].key must equal the map key (or use the KEY@<stage> override form, #2528)`);
+      throw new Error(`org project set: secrets["${mapKey}"].key must equal the map key (or use the KEY@<stage> override form, #2528)`);
     }
-    if (!nonEmpty(e.purpose) || !nonEmpty(e.group) || !nonEmpty(e.owner)) throw new Error(`project set: secrets["${mapKey}"] needs non-empty purpose, group, owner`);
-    if (e.provider !== void 0 && !nonEmpty(e.provider)) throw new Error(`project set: secrets["${mapKey}"].provider must be a non-empty string`);
+    if (!nonEmpty(e.purpose) || !nonEmpty(e.group) || !nonEmpty(e.owner)) throw new Error(`org project set: secrets["${mapKey}"] needs non-empty purpose, group, owner`);
+    if (e.provider !== void 0 && !nonEmpty(e.provider)) throw new Error(`org project set: secrets["${mapKey}"].provider must be a non-empty string`);
     if (!Array.isArray(e.stages) || e.stages.some((s) => !RUNTIME_SECRET_STAGES.includes(s))) {
-      throw new Error(`project set: secrets["${mapKey}"].stages must be a subset of dev/rc/main ([] = shared)`);
+      throw new Error(`org project set: secrets["${mapKey}"].stages must be a subset of dev/rc/main ([] = shared)`);
     }
     if (!Array.isArray(e.consumers) || e.consumers.some((c) => !SECRET_CONSUMERS.includes(c))) {
-      throw new Error(`project set: secrets["${mapKey}"].consumers must be a subset of ${SECRET_CONSUMERS.join("/")}`);
+      throw new Error(`org project set: secrets["${mapKey}"].consumers must be a subset of ${SECRET_CONSUMERS.join("/")}`);
     }
     if (e.aliases !== void 0 && (!Array.isArray(e.aliases) || e.aliases.some((a) => typeof a !== "string"))) {
-      throw new Error(`project set: secrets["${mapKey}"].aliases must be a string array`);
+      throw new Error(`org project set: secrets["${mapKey}"].aliases must be a string array`);
     }
   }
   return parsed;
@@ -15518,19 +15402,19 @@ function parseRuntimeSecretsVar(raw) {
   try {
     parsed = JSON.parse(raw);
   } catch {
-    throw new Error('project set: requiredRuntimeSecrets must be JSON, e.g. {"dev":["KEY"],"rc":["KEY"],"main":["KEY"]}');
+    throw new Error('org project set: requiredRuntimeSecrets must be JSON, e.g. {"dev":["KEY"],"rc":["KEY"],"main":["KEY"]}');
   }
   if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
-    throw new Error("project set: requiredRuntimeSecrets must be a stage map (a flat array is not box-loadable)");
+    throw new Error("org project set: requiredRuntimeSecrets must be a stage map (a flat array is not box-loadable)");
   }
   const map = parsed;
   const out = {};
   for (const [stage, names] of Object.entries(map)) {
     if (!RUNTIME_SECRET_STAGES.includes(stage)) {
-      throw new Error(`project set: requiredRuntimeSecrets stage "${stage}" \u2014 expected only ${RUNTIME_SECRET_STAGES.join("/")}`);
+      throw new Error(`org project set: requiredRuntimeSecrets stage "${stage}" \u2014 expected only ${RUNTIME_SECRET_STAGES.join("/")}`);
     }
     if (!Array.isArray(names) || names.some((n) => typeof n !== "string" || !n.trim())) {
-      throw new Error(`project set: requiredRuntimeSecrets.${stage} must be an array of non-empty secret names`);
+      throw new Error(`org project set: requiredRuntimeSecrets.${stage} must be an array of non-empty secret names`);
     }
     out[stage] = names;
   }
@@ -15541,13 +15425,13 @@ function parseBuildSecretsVar(raw) {
   try {
     parsed = JSON.parse(raw);
   } catch {
-    throw new Error('project set: requiredBuildSecrets must be JSON, e.g. ["NODE_AUTH_TOKEN=@github-packages-token"]');
+    throw new Error('org project set: requiredBuildSecrets must be JSON, e.g. ["NODE_AUTH_TOKEN=@github-packages-token"]');
   }
   if (!Array.isArray(parsed)) {
-    throw new Error("project set: requiredBuildSecrets must be a flat array (build secrets are not stage-mapped)");
+    throw new Error("org project set: requiredBuildSecrets must be a flat array (build secrets are not stage-mapped)");
   }
   if (parsed.some((n) => typeof n !== "string" || !BUILD_SECRET_REF_RE.test(n) || n === "@github-packages-token")) {
-    throw new Error("project set: requiredBuildSecrets must be a flat array of ENVID=<ref> or bare <ref> strings");
+    throw new Error("org project set: requiredBuildSecrets must be a flat array of ENVID=<ref> or bare <ref> strings");
   }
   return parsed;
 }
@@ -15556,19 +15440,19 @@ function parseEdgeDomainsVar(raw) {
   try {
     parsed = JSON.parse(raw);
   } catch {
-    throw new Error('project set: edgeDomains must be JSON, e.g. {"dev":"dev.example.co","rc":"rc.example.co","main":"example.co"}');
+    throw new Error('org project set: edgeDomains must be JSON, e.g. {"dev":"dev.example.co","rc":"rc.example.co","main":"example.co"}');
   }
   if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
-    throw new Error("project set: edgeDomains must be a {dev,rc,main} map of domain strings");
+    throw new Error("org project set: edgeDomains must be a {dev,rc,main} map of domain strings");
   }
   const map = parsed;
   const out = {};
   for (const [stage, domain] of Object.entries(map)) {
     if (!RUNTIME_SECRET_STAGES.includes(stage)) {
-      throw new Error(`project set: edgeDomains stage "${stage}" \u2014 expected only ${RUNTIME_SECRET_STAGES.join("/")}`);
+      throw new Error(`org project set: edgeDomains stage "${stage}" \u2014 expected only ${RUNTIME_SECRET_STAGES.join("/")}`);
     }
     if (typeof domain !== "string" || !domain.trim()) {
-      throw new Error(`project set: edgeDomains.${stage} must be a non-empty domain string`);
+      throw new Error(`org project set: edgeDomains.${stage} must be a non-empty domain string`);
     }
     out[stage] = domain.trim();
   }
@@ -15580,19 +15464,19 @@ function parsePriorityOptionsVar(raw) {
   try {
     parsed = JSON.parse(raw);
   } catch {
-    throw new Error('project set: priorityOptions must be JSON, e.g. {"Urgent":"<id>","High":"<id>","Medium":"<id>","Low":"<id>"}');
+    throw new Error('org project set: priorityOptions must be JSON, e.g. {"Urgent":"<id>","High":"<id>","Medium":"<id>","Low":"<id>"}');
   }
   if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
-    throw new Error("project set: priorityOptions must be a {Urgent,High,Medium,Low} map of option-id strings");
+    throw new Error("org project set: priorityOptions must be a {Urgent,High,Medium,Low} map of option-id strings");
   }
   const map = parsed;
   const out = {};
   for (const [name, id] of Object.entries(map)) {
     if (!PRIORITY_OPTION_NAMES.includes(name)) {
-      throw new Error(`project set: priorityOptions "${name}" \u2014 expected only ${PRIORITY_OPTION_NAMES.join("/")}`);
+      throw new Error(`org project set: priorityOptions "${name}" \u2014 expected only ${PRIORITY_OPTION_NAMES.join("/")}`);
     }
     if (typeof id !== "string" || !id.trim()) {
-      throw new Error(`project set: priorityOptions.${name} must be a non-empty option-id string`);
+      throw new Error(`org project set: priorityOptions.${name} must be a non-empty option-id string`);
     }
     out[name] = id.trim();
   }
@@ -15603,7 +15487,7 @@ function parsePortRangeVar(raw) {
   try {
     parsed = JSON.parse(raw);
   } catch {
-    throw new Error('project set: portRange must be JSON, e.g. {"start":3700,"end":3710} or [3700,3710]');
+    throw new Error('org project set: portRange must be JSON, e.g. {"start":3700,"end":3710} or [3700,3710]');
   }
   let start;
   let end;
@@ -15612,12 +15496,12 @@ function parsePortRangeVar(raw) {
   } else if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
     ({ start, end } = parsed);
   } else {
-    throw new Error("project set: portRange must be {start,end} or a [start,end] tuple");
+    throw new Error("org project set: portRange must be {start,end} or a [start,end] tuple");
   }
   if (typeof start !== "number" || typeof end !== "number" || !Number.isFinite(start) || !Number.isFinite(end)) {
-    throw new Error("project set: portRange start/end must be finite numbers");
+    throw new Error("org project set: portRange start/end must be finite numbers");
   }
-  if (start > end) throw new Error("project set: portRange start must be <= end");
+  if (start > end) throw new Error("org project set: portRange start must be <= end");
   return { start, end };
 }
 function parseStatusOptionsVar(raw) {
@@ -15625,16 +15509,16 @@ function parseStatusOptionsVar(raw) {
   try {
     parsed = JSON.parse(raw);
   } catch {
-    throw new Error('project set: statusOptions must be JSON, e.g. {"Todo":"<id>","In Progress":"<id>","In Review":"<id>","Done":"<id>"}');
+    throw new Error('org project set: statusOptions must be JSON, e.g. {"Todo":"<id>","In Progress":"<id>","In Review":"<id>","Done":"<id>"}');
   }
   if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
-    throw new Error("project set: statusOptions must be a map of status name to option-id string");
+    throw new Error("org project set: statusOptions must be a map of status name to option-id string");
   }
   const map = parsed;
   const out = {};
   for (const [name, id] of Object.entries(map)) {
     if (typeof id !== "string" || !id.trim()) {
-      throw new Error(`project set: statusOptions.${name} must be a non-empty option-id string`);
+      throw new Error(`org project set: statusOptions.${name} must be a non-empty option-id string`);
     }
     out[name] = id.trim();
   }
@@ -15645,31 +15529,31 @@ function parseOauthVar(raw) {
   try {
     parsed = JSON.parse(raw);
   } catch {
-    throw new Error(`project set: oauth must be JSON, e.g. {"subdomains":["app"],"domains":["example.co"],"callbackPath":"${DEFAULT_CALLBACK_PATH}"}`);
+    throw new Error(`org project set: oauth must be JSON, e.g. {"subdomains":["app"],"domains":["example.co"],"callbackPath":"${DEFAULT_CALLBACK_PATH}"}`);
   }
   if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
-    throw new Error("project set: oauth must be a {subdomains,domains,callbackPath,fofuSubdomain} object");
+    throw new Error("org project set: oauth must be a {subdomains,domains,callbackPath,fofuSubdomain} object");
   }
   const map = parsed;
   const out = {};
   for (const [key, value] of Object.entries(map)) {
     if (key === "subdomains" || key === "domains") {
       if (!Array.isArray(value) || value.some((v) => typeof v !== "string" || !v.trim())) {
-        throw new Error(`project set: oauth.${key} must be an array of non-empty strings`);
+        throw new Error(`org project set: oauth.${key} must be an array of non-empty strings`);
       }
       out[key] = value.map((v) => v.trim());
     } else if (key === "callbackPath") {
-      if (typeof value !== "string" || !value.trim()) throw new Error("project set: oauth.callbackPath must be a non-empty string");
+      if (typeof value !== "string" || !value.trim()) throw new Error("org project set: oauth.callbackPath must be a non-empty string");
       const callbackPath = value.trim();
       if (callbackPath !== DEFAULT_CALLBACK_PATH) {
-        throw new Error(`project set: oauth.callbackPath must be "${DEFAULT_CALLBACK_PATH}" (got ${JSON.stringify(callbackPath)})`);
+        throw new Error(`org project set: oauth.callbackPath must be "${DEFAULT_CALLBACK_PATH}" (got ${JSON.stringify(callbackPath)})`);
       }
       out.callbackPath = callbackPath;
     } else if (key === "fofuSubdomain") {
-      if (typeof value !== "string") throw new Error('project set: oauth.fofuSubdomain must be a string ("" selects the apex fofu.ai)');
+      if (typeof value !== "string") throw new Error('org project set: oauth.fofuSubdomain must be a string ("" selects the apex fofu.ai)');
       out.fofuSubdomain = value.trim();
     } else {
-      throw new Error(`project set: oauth key "${key}" \u2014 expected only subdomains/domains/callbackPath/fofuSubdomain`);
+      throw new Error(`org project set: oauth key "${key}" \u2014 expected only subdomains/domains/callbackPath/fofuSubdomain`);
     }
   }
   return out;
@@ -15679,49 +15563,49 @@ function parseReposVar(raw) {
   try {
     parsed = JSON.parse(raw);
   } catch {
-    throw new Error('project set: repos must be a JSON array, e.g. ["mutmutco/mm-foo"]');
+    throw new Error('org project set: repos must be a JSON array, e.g. ["mutmutco/mm-foo"]');
   }
   if (!Array.isArray(parsed) || parsed.length === 0 || parsed.some((r) => typeof r !== "string" || !r.trim())) {
-    throw new Error("project set: repos must be a non-empty array of owner/name strings");
+    throw new Error("org project set: repos must be a non-empty array of owner/name strings");
   }
   return parsed.map((r) => r.trim());
 }
 function parsePublishRequiredVar(raw) {
   if (raw === "true") return true;
   if (raw === "false") return false;
-  throw new Error("project set: publishRequired must be true or false");
+  throw new Error("org project set: publishRequired must be true or false");
 }
 function parseFofuEnabledVar(raw) {
   if (raw === "true") return true;
   if (raw === "false") return false;
-  throw new Error("project set: fofuEnabled must be true or false");
+  throw new Error("org project set: fofuEnabled must be true or false");
 }
 function parseRuntimeVaultOnlyVar(raw) {
   if (raw === "true") return true;
   if (raw === "false") return false;
-  throw new Error("project set: runtimeVaultOnly must be true or false");
+  throw new Error("org project set: runtimeVaultOnly must be true or false");
 }
 function parseConsumesDesignSystemVar(raw) {
   if (raw === "fofu") return raw;
-  throw new Error('project set: consumesDesignSystem must be "fofu"');
+  throw new Error('org project set: consumesDesignSystem must be "fofu"');
 }
 function parsePublishDirVar(raw) {
   const v = raw.trim();
   if (v === "" || v === ".") {
-    throw new Error("project set: publishDir must be a non-empty relative subpath, e.g. packages/ui (omit it or --unset publishDir for the repo root)");
+    throw new Error("org project set: publishDir must be a non-empty relative subpath, e.g. packages/ui (omit it or --unset publishDir for the repo root)");
   }
   if (!/^[A-Za-z0-9._-]+(\/[A-Za-z0-9._-]+)*$/.test(v) || /(^|\/)\.\.(\/|$)/.test(v)) {
-    throw new Error('project set: publishDir must be a safe relative subpath \u2014 no leading slash, no ".." segment');
+    throw new Error('org project set: publishDir must be a safe relative subpath \u2014 no leading slash, no ".." segment');
   }
   return v;
 }
 function parseDsManifestPathVar(raw) {
   const v = raw.trim();
   if (v === "" || !/^[A-Za-z0-9._-]+(\/[A-Za-z0-9._-]+)*$/.test(v) || /(^|\/)\.\.(\/|$)/.test(v)) {
-    throw new Error('project set: dsManifestPath must be a safe relative path \u2014 no leading slash, no ".." segment');
+    throw new Error('org project set: dsManifestPath must be a safe relative path \u2014 no leading slash, no ".." segment');
   }
   if (v !== "package.json" && !v.endsWith("/package.json")) {
-    throw new Error("project set: dsManifestPath must point to a package.json, e.g. web/package.json");
+    throw new Error("org project set: dsManifestPath must point to a package.json, e.g. web/package.json");
   }
   return v;
 }
@@ -15730,10 +15614,10 @@ function parseRequiredChecksVar(raw) {
   try {
     parsed = JSON.parse(raw);
   } catch {
-    throw new Error('project set: requiredChecks must be a JSON array, e.g. ["gate"] or [] for an intentional no-ci repo');
+    throw new Error('org project set: requiredChecks must be a JSON array, e.g. ["gate"] or [] for an intentional no-ci repo');
   }
   if (!Array.isArray(parsed) || parsed.some((c) => typeof c !== "string" || !c.trim())) {
-    throw new Error("project set: requiredChecks must be a JSON array of non-empty check-context strings (use [] for none)");
+    throw new Error("org project set: requiredChecks must be a JSON array of non-empty check-context strings (use [] for none)");
   }
   return parsed.map((c) => c.trim());
 }
@@ -15742,22 +15626,22 @@ function parseGateVar(raw) {
   try {
     parsed = JSON.parse(raw);
   } catch {
-    throw new Error('project set: gate must be JSON, e.g. {"runtime":"python","cmd":"pytest","workdir":"app"}');
+    throw new Error('org project set: gate must be JSON, e.g. {"runtime":"python","cmd":"pytest","workdir":"app"}');
   }
   if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
-    throw new Error("project set: gate must be a {runtime,cmd,workdir,cacheDepPath,pyVersion} object");
+    throw new Error("org project set: gate must be a {runtime,cmd,workdir,cacheDepPath,pyVersion} object");
   }
   const map = parsed;
   const out = {};
   for (const [key, value] of Object.entries(map)) {
     if (key === "runtime") {
-      if (value !== "node" && value !== "python") throw new Error('project set: gate.runtime must be "node" or "python"');
+      if (value !== "node" && value !== "python") throw new Error('org project set: gate.runtime must be "node" or "python"');
       out.runtime = value;
     } else if (key === "cmd" || key === "workdir" || key === "cacheDepPath" || key === "pyVersion") {
-      if (typeof value !== "string" || !value.trim()) throw new Error(`project set: gate.${key} must be a non-empty string`);
+      if (typeof value !== "string" || !value.trim()) throw new Error(`org project set: gate.${key} must be a non-empty string`);
       out[key] = value.trim();
     } else {
-      throw new Error(`project set: gate key "${key}" \u2014 expected only runtime/cmd/workdir/cacheDepPath/pyVersion`);
+      throw new Error(`org project set: gate key "${key}" \u2014 expected only runtime/cmd/workdir/cacheDepPath/pyVersion`);
     }
   }
   return out;
@@ -15835,25 +15719,25 @@ function buildProjectSetPatch(input) {
   const patch = {};
   if (input.class) {
     if (input.class !== "deployable" && input.class !== "content") {
-      throw new Error("project set: --class must be deployable or content");
+      throw new Error("org project set: --class must be deployable or content");
     }
     patch.class = input.class;
   }
   if (input.projectType) {
     if (!isProjectType(input.projectType)) {
-      throw new Error(`project set: --project-type must be one of: ${PROJECT_TYPES.join(", ")}`);
+      throw new Error(`org project set: --project-type must be one of: ${PROJECT_TYPES.join(", ")}`);
     }
     patch.projectType = input.projectType;
   }
   if (input.deployModel) {
     if (!isDeployModel(input.deployModel)) {
-      throw new Error(`project set: --deploy-model must be one of: ${DEPLOY_MODELS.join(", ")}`);
+      throw new Error(`org project set: --deploy-model must be one of: ${DEPLOY_MODELS.join(", ")}`);
     }
     patch.deployModel = input.deployModel;
   }
   if (input.releaseTrack) {
     if (!isReleaseTrack(input.releaseTrack)) {
-      throw new Error(`project set: --release-track must be one of: ${RELEASE_TRACKS.join(", ")}`);
+      throw new Error(`org project set: --release-track must be one of: ${RELEASE_TRACKS.join(", ")}`);
     }
     patch.releaseTrack = input.releaseTrack;
   }
@@ -15862,16 +15746,16 @@ function buildProjectSetPatch(input) {
     if (eq <= 0) {
       const looksPositional = value.includes("/") || !value.includes("=");
       const hint = looksPositional ? " \u2014 if that is the [owner/repo] argument, put it BEFORE --var; a variadic flag swallows the tokens after it" : "";
-      throw new Error(`project set: --var must be KEY=VALUE (got "${value}")${hint}`);
+      throw new Error(`org project set: --var must be KEY=VALUE (got "${value}")${hint}`);
     }
     const key = value.slice(0, eq);
     const raw = value.slice(eq + 1);
     if (!SETTABLE_VAR_KEY_SET.has(key)) {
-      throw new Error(`project set: --var KEY "${key}" is not settable \u2014 allowed keys: ${SETTABLE_VAR_KEYS.join(", ")}`);
+      throw new Error(`org project set: --var KEY "${key}" is not settable \u2014 allowed keys: ${SETTABLE_VAR_KEYS.join(", ")}`);
     }
     if (key === "projectNumber") {
       const n = Number(raw);
-      if (!Number.isFinite(n)) throw new Error("project set: projectNumber must be numeric");
+      if (!Number.isFinite(n)) throw new Error("org project set: projectNumber must be numeric");
       patch[key] = n;
     } else if (key === "requiredRuntimeSecrets") {
       patch[key] = parseRuntimeSecretsVar(raw);
@@ -15904,7 +15788,7 @@ function buildProjectSetPatch(input) {
     } else if (key === "dsManifestPath") {
       patch[key] = parseDsManifestPathVar(raw);
     } else if (key === "ci") {
-      if (raw !== "none") throw new Error('project set: ci must be "none" (or use --unset ci to require checks)');
+      if (raw !== "none") throw new Error('org project set: ci must be "none" (or use --unset ci to require checks)');
       patch[key] = raw;
     } else if (key === "requiredChecks") {
       patch[key] = parseRequiredChecksVar(raw);
@@ -15916,7 +15800,7 @@ function buildProjectSetPatch(input) {
   }
   for (const key of input.unsets) {
     if (!UNSET_KEY_SET.has(key)) {
-      throw new Error(`project set: --unset must be one of: ${UNSET_KEYS.join(", ")}`);
+      throw new Error(`org project set: --unset must be one of: ${UNSET_KEYS.join(", ")}`);
     }
     patch[key] = null;
   }
@@ -15925,7 +15809,7 @@ function buildProjectSetPatch(input) {
     patch.edgeDomains = null;
   }
   if (Object.keys(patch).length === 0) {
-    throw new Error("project set: nothing to set - pass --class, --project-type, --deploy-model, --release-track, --var KEY=VALUE, --unset KEY, and/or --clear-web-profile");
+    throw new Error("org project set: nothing to set - pass --class, --project-type, --deploy-model, --release-track, --var KEY=VALUE, --unset KEY, and/or --clear-web-profile");
   }
   return patch;
 }
@@ -15937,36 +15821,36 @@ function buildSetDeployPatch(_slug, input) {
   const clean4 = (v) => typeof v === "string" && v.trim() !== "" ? v.trim() : void 0;
   const stage = clean4(input.stage);
   if (!stage || !DEPLOY_STAGES.includes(stage)) {
-    throw new Error(`project set-deploy: --stage must be one of: ${DEPLOY_STAGES.join(", ")}`);
+    throw new Error(`org project set-deploy: --stage must be one of: ${DEPLOY_STAGES.join(", ")}`);
   }
   const substrate = clean4(input.substrate);
   if (substrate !== void 0 && !DEPLOY_SUBSTRATES.includes(substrate)) {
-    throw new Error(`project set-deploy: --substrate must be one of: ${DEPLOY_SUBSTRATES.join(", ")}`);
+    throw new Error(`org project set-deploy: --substrate must be one of: ${DEPLOY_SUBSTRATES.join(", ")}`);
   }
   const sshHost = clean4(input.sshHost);
   const sshUser = clean4(input.sshUser);
   const deployPath = clean4(input.deployPath);
   const serviceName = clean4(input.service);
   for (const [label, v] of [["--ssh-host", sshHost], ["--ssh-user", sshUser], ["--deploy-path", deployPath], ["--service", serviceName]]) {
-    if (v !== void 0 && !DEPLOY_SHELL_SAFE_RE.test(v)) throw new Error(`project set-deploy: ${label} contains unsafe characters`);
+    if (v !== void 0 && !DEPLOY_SHELL_SAFE_RE.test(v)) throw new Error(`org project set-deploy: ${label} contains unsafe characters`);
   }
   let port;
   if (input.port !== void 0 && input.port !== null && `${input.port}`.trim() !== "") {
     port = Number(input.port);
-    if (!Number.isInteger(port) || port < 1 || port > 65535) throw new Error("project set-deploy: --port must be an integer 1..65535");
+    if (!Number.isInteger(port) || port < 1 || port > 65535) throw new Error("org project set-deploy: --port must be an integer 1..65535");
   }
   const domain = clean4(input.domain);
-  if (domain !== void 0 && !DEPLOY_DOMAIN_RE.test(domain)) throw new Error(`project set-deploy: --domain must be a DNS hostname, got ${JSON.stringify(input.domain)}`);
+  if (domain !== void 0 && !DEPLOY_DOMAIN_RE.test(domain)) throw new Error(`org project set-deploy: --domain must be a DNS hostname, got ${JSON.stringify(input.domain)}`);
   const aliases = (Array.isArray(input.aliases) ? input.aliases : []).map((a) => clean4(a)).filter((a) => a !== void 0);
   for (const a of aliases) {
-    if (!DEPLOY_DOMAIN_RE.test(a)) throw new Error(`project set-deploy: --alias must be a DNS hostname, got ${JSON.stringify(a)}`);
+    if (!DEPLOY_DOMAIN_RE.test(a)) throw new Error(`org project set-deploy: --alias must be a DNS hostname, got ${JSON.stringify(a)}`);
   }
   const uniqueAliases = [...new Set(aliases)];
   if (input.clearAliases && uniqueAliases.length) {
-    throw new Error("project set-deploy: --clear-aliases cannot be combined with --alias (they contradict)");
+    throw new Error("org project set-deploy: --clear-aliases cannot be combined with --alias (they contradict)");
   }
   if (input.noEnvFile !== void 0 && typeof input.noEnvFile !== "boolean") {
-    throw new Error("project set-deploy: --no-env-file must be true or false");
+    throw new Error("org project set-deploy: --no-env-file must be true or false");
   }
   return {
     stage,
@@ -15984,17 +15868,44 @@ function buildSetDeployPatch(_slug, input) {
   };
 }
 var DEPLOY_STAGE_BRANCH = { dev: "development", rc: "rc", main: "main" };
+function filelessTransitionGuide(repo, stage) {
+  const authority = stage === "main" ? "Authority: main is master-admin only." : "Authority: a project-admin may complete this for their own repo; master may also do it.";
+  return [
+    `Fileless transition for ${repo} (${stage}):`,
+    `  ${authority}`,
+    `  mmi-cli org access role ${repo}`,
+    `  mmi-cli secrets list --repo ${repo}                         # names/capabilities only`,
+    `  mmi-cli secrets preflight --repo ${repo} --stage ${stage}`,
+    `  mmi-cli org project set-deploy ${repo} --stage ${stage} --no-env-file true`,
+    `  mmi-cli runtime tenant reconcile ${repo} ${stage} --watch`,
+    `  mmi-cli runtime tenant redeploy ${repo} ${stage} --watch`,
+    `  mmi-cli runtime tenant control ${repo} ${stage} verify-secrets --watch`,
+    `  mmi-cli runtime tenant control ${repo} ${stage} verify-broker --watch   # broker consumers`,
+    "  Missing/undeclared key (project-admin own project):",
+    `    mmi-cli secrets declare <KEY> --repo ${repo} --purpose "<purpose>" --group "<group>" --consumers runtime --stages ${stage}`,
+    `    mmi-cli secrets set ${stage}/<KEY> --repo ${repo}   # value from secure prompt/stdin; never argv/stdout`,
+    `    mmi-cli secrets request <KEY> --repo ${repo} --reason "wire requiredRuntimeSecrets for ${stage}"   # only if env injection needs master wiring`,
+    "  Runbook: https://github.com/mutmutco/MMI-Hub/blob/development/docs/Guides/tenant-fileless-migration.md"
+  ].join("\n");
+}
 function composeDeclaresEnvFile(composeText) {
   return composeText.split(/\r?\n/).some((line) => /^\s*env_file\s*:/.test(line));
 }
 function composeHasRuntimeEnvLabel(composeText) {
-  return /mmi\.runtime-env/.test(composeText);
+  return composeText.split(/\r?\n/).some((raw) => {
+    const line = raw.replace(/(^|\s)#.*$/, "$1");
+    return /(^|[\s"'])mmi\.runtime-env\s*:\s*["']?true["']?\s*$/.test(line) || /mmi\.runtime-env\s*=\s*["']?true["']?\s*$/.test(line);
+  });
 }
 function evaluateFilelessComposeGuard(input) {
   if (input.force) return { ok: true, warn: `--force: skipping the fileless-compose guard for ${input.branch}` };
   if (input.composeText === null) {
-    return { ok: true, warn: `could not read docker-compose.yml on ${input.branch} \u2014 skipping the fileless-compose guard (run from the target repo checkout with the branch fetched to enable it)` };
+    return { ok: false, reason: `could not read docker-compose.yml on ${input.branch} \u2014 refusing to change noEnvFile without verifying the target branch compose. Run from the target repo checkout with origin/${input.branch} fetched, or use --force only after an independent verification.` };
+  }
+  if (input.noEnvFile === false && composeHasRuntimeEnvLabel(input.composeText)) {
+    return { ok: false, reason: `the ${input.branch} branch marks a service mmi.runtime-env=true \u2014 setting noEnvFile=false would make the box take the legacy path and refuse this fileless compose (exit 78). Keep noEnvFile=true or land a verified legacy compose first.` };
   }
+  if (input.noEnvFile === false) return { ok: true };
   if (composeDeclaresEnvFile(input.composeText)) {
     return {
       ok: false,
@@ -16056,15 +15967,16 @@ function evaluatePromotionFilelessGuard(input) {
     return {
       ok: false,
       reason: `the ${branch} docker-compose.yml marks a service fileless (mmi.runtime-env: "true") but DEPLOY#${stage}.noEnvFile is not true \u2014 the ${stage} deploy would fail exit-78 ("compose is fileless but DEPLOY#${stage} noEnvFile is not true"). Fix BEFORE promoting, then re-run:
-  mmi-cli project set-deploy --stage ${stage} --no-env-file true   # register the fileless flag
-  gh workflow run tenant-reconcile.yml --repo mutmutco/MMI-Hub     # re-render the box control script (#1056)
-  (or pass --skip-compose-guard to override this preflight)`
+${filelessTransitionGuide(input.repo ?? "<owner/repo>", stage)}
+Override only after independent verification: --skip-compose-guard`
     };
   }
   if (noEnvFile && composeDeclaresEnvFile(input.composeText)) {
     return {
       ok: false,
-      reason: `DEPLOY#${stage}.noEnvFile is true but the ${branch} docker-compose.yml still declares env_file: \u2014 the box writes no .env, so docker compose dies on the missing file. Land the fileless compose (drop env_file:, add the mmi.runtime-env label) on ${branch}, or set-deploy --no-env-file false (or --skip-compose-guard to override).`
+      reason: `DEPLOY#${stage}.noEnvFile is true but the ${branch} docker-compose.yml still declares env_file: \u2014 the box writes no .env, so docker compose dies on the missing file. Land the fileless compose (drop env_file:, add the mmi.runtime-env label) on ${branch}.
+${filelessTransitionGuide(input.repo ?? "<owner/repo>", stage)}
+Rollback only after independent verification: set-deploy --no-env-file false; preflight override: --skip-compose-guard.`
     };
   }
   return { ok: true };
@@ -16080,11 +15992,11 @@ function vaultCleanupNote(slug) {
 function buildRetirePlan(input) {
   const target = input.target?.trim();
   if (!target) {
-    throw new Error("project retire: pass <owner/repo> or a slug to retire");
+    throw new Error("org project retire: pass <owner/repo> or a slug to retire");
   }
   const slug = retireSlugOf(target);
   if (!/^[a-z0-9][a-z0-9-]*$/.test(slug)) {
-    throw new Error(`project retire: "${target}" does not resolve to a valid slug`);
+    throw new Error(`org project retire: "${target}" does not resolve to a valid slug`);
   }
   const repo = target.includes("/") ? target : `mutmutco/${slug}`;
   return { slug, repo, apply: Boolean(input.apply), skipBoard: Boolean(input.skipBoard) };
@@ -16153,6 +16065,27 @@ var import_node_fs17 = require("node:fs");
 var import_node_path15 = require("node:path");
 var import_node_os5 = require("node:os");
 
+// src/project-runtime.ts
+function hasRuntimeSecretContract(contract) {
+  if (!contract || typeof contract !== "object" || Array.isArray(contract)) return false;
+  return ["dev", "rc", "main"].some((stage) => Array.isArray(contract[stage]));
+}
+function projectRequiresGoogleOAuth(meta, model) {
+  if (!meta || model === "content" || model === "none" || meta.deployModel === "content" || meta.deployModel === "none" || meta.class === "content") return false;
+  const projectType = resolveProjectType(meta, meta.repos?.[0] ?? "");
+  return projectType === "web-app" && Boolean(meta.oauth && typeof meta.oauth === "object");
+}
+function edgeDomainsByStage(meta) {
+  const edgeDomains = meta?.edgeDomains;
+  if (!edgeDomains || typeof edgeDomains !== "object" || Array.isArray(edgeDomains)) return {};
+  const out = {};
+  for (const stage of ["dev", "rc", "main"]) {
+    const value = edgeDomains[stage];
+    if (typeof value === "string" && value.trim()) out[stage] = value.trim();
+  }
+  return out;
+}
+
 // src/secrets-diff.ts
 var TIMEOUT_MS2 = 8e3;
 var OWNER3 = "mutmutco";
@@ -16324,13 +16257,13 @@ async function withSecrets(run) {
   await run(makeSecretsDeps(cfg));
 }
 function registerSecretsCommands(program3) {
-  const secrets = program3.command("secrets").description("two-tier project secrets \u2014 self-serve your repo dev/* tier; org tier is master-gated");
+  const secrets = program3.command("secrets").description("project vault \u2014 project-admins self-serve their own repo's full tree (stageless + dev/rc/main); org-infra namespaces are master-gated");
   secrets.command("where").description("print where this repo's secrets live \u2014 the two-tier vault layout + well-known keys (no values)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--json", "machine-readable output").action((o) => withSecrets((d) => secretsWhere(d, o)));
   secrets.command("list").description("list secret NAMES + tier for this repo (never values)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--json", "machine-readable output").action((o) => withSecrets((d) => secretsList(d, o)));
-  secrets.command("find <intent>").description("resolve a plain-language intent to the canonical secret(s) + the exact get command (master-only, #2244)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--json", "machine-readable output").action((intent, o) => withSecrets(async (d) => {
+  secrets.command("find <intent>").description("resolve a plain-language intent to canonical secret names + the exact keyless-use command (master-only, #2244)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--json", "machine-readable output").action((intent, o) => withSecrets(async (d) => {
     if (!await secretsFind(d, intent, o)) process.exitCode = 1;
   }));
-  secrets.command("catalog").description("the secret catalog \u2014 grouped, with each secret's exact get command (master-only, #2244)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--drift", "include the bidirectional reconciler drift report").option("--json", "machine-readable output").action((o) => withSecrets((d) => secretsCatalog(d, o)));
+  secrets.command("catalog").description("the secret catalog \u2014 grouped, with each secret's exact keyless-use command (master-only, #2244)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--drift", "include the bidirectional reconciler drift report").option("--json", "machine-readable output").action((o) => withSecrets((d) => secretsCatalog(d, o)));
   secrets.command("doctor").description("vault drift report \u2014 declared-missing / orphan / off-scheme / duplicate (master-only, #2244)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--json", "machine-readable output").action((o) => withSecrets(async (d) => {
     if (!await secretsDoctor(d, o)) process.exitCode = 1;
   }));
@@ -16399,7 +16332,7 @@ function registerSecretsCommands(program3) {
       const facts = await fetchDeployFactsBySlug(slug, regDeps);
       const fact = facts?.stages?.[stage] ?? null;
       const composeText = sameRepo ? await readStageBranchCompose(branch) : null;
-      const verdict = evaluatePromotionFilelessGuard({ composeText, branch, stage, fact, sameRepo: Boolean(sameRepo), force: false });
+      const verdict = evaluatePromotionFilelessGuard({ composeText, branch, stage, fact, sameRepo: Boolean(sameRepo), force: false, repo });
       if (!verdict.ok) {
         d.err(`secrets preflight: ${verdict.reason}`);
         filelessOk = false;
@@ -16414,7 +16347,7 @@ function registerSecretsCommands(program3) {
     const ok = await secretsRequest(d, key, o);
     if (!ok) process.exitCode = 1;
   }));
-  secrets.command("declare <key>").description("project-admin self-declare: register a NEW secrets-catalog entry for your own repo (name/purpose/group/owner/consumers/stages metadata only \u2014 never a value); closes the declare-first master-only gap (MM-PM#261/#262). Catalog-declare only \u2014 wiring the key into requiredRuntimeSecrets stays master-only (`secrets request` to ask, or `project set --var requiredRuntimeSecrets=...`); dropped from self-serve after adversarial review found real escalation paths in that additive-merge logic (MMI-Hub#2780). Separate from `project set`, which stays master-only for this field.").requiredOption("--purpose <text>", "what this secret is for").requiredOption("--group <text>", "catalog grouping, e.g. database, auth").option("--owner <login>", "catalog owner login (default: your own resolved GitHub login)").option("--consumers <list>", "comma-separated consumers (default: box)").option("--stages <list>", "comma-separated dev/rc/main this entry applies to (default: none \u2014 one stageless shared value)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--json", "machine-readable output").action((key, o) => withSecrets(async (d) => {
+  secrets.command("declare <key>").description("project-admin self-declare: register a NEW secrets-catalog entry for your own repo (name/purpose/group/owner/consumers/stages metadata only \u2014 never a value); closes the declare-first master-only gap (MM-PM#261/#262). Catalog-declare only \u2014 wiring the key into requiredRuntimeSecrets stays master-only (`secrets request` to ask, or `org project set --var requiredRuntimeSecrets=...`); dropped from self-serve after adversarial review found real escalation paths in that additive-merge logic (MMI-Hub#2780). Separate from `org project set`, which stays master-only for this field.").requiredOption("--purpose <text>", "what this secret is for").requiredOption("--group <text>", "catalog grouping, e.g. database, auth").option("--owner <login>", "catalog owner login (default: your own resolved GitHub login)").option("--consumers <list>", "comma-separated consumers (default: box)").option("--stages <list>", "comma-separated dev/rc/main this entry applies to (default: none \u2014 one stageless shared value)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--json", "machine-readable output").action((key, o) => withSecrets(async (d) => {
     const owner = o.owner ?? await githubLogin();
     if (!owner) {
       fail("secrets declare: could not resolve your GitHub login for --owner; pass --owner explicitly");
@@ -16441,8 +16374,7 @@ function registerSecretsCommands(program3) {
     if (!ok) process.exitCode = 1;
   });
   secrets.command("set <key>").description("write/rotate a secret; value from stdin (never an argument). DECLARE-FIRST (#2528): the key must be a declared catalog coordinate \u2014 bare <KEY> = the stageless canonical, <stage>/<KEY> = a declared per-stage override; undeclared writes are rejected with the fix").option("--repo <owner/repo>", "target repo (defaults to the current repo)").action(setHandler);
-  secrets.command("edit <key>").description("alias for set \u2014 replace a secret value (read from stdin)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").action(setHandler);
-  secrets.command("copy").description("copy provider keys between vault tiers (audit-logged; org-tier source is master-gated)").requiredOption("--from <stage>", "source tier: dev, rc, or main").requiredOption("--to <stage>", "destination tier: dev, rc, or main").requiredOption("--keys <names>", "comma-separated secret names (encryption keys blocked)").option("--dry-run", "report copies without writing").option("--repo <owner/repo>", "target repo (defaults to the current repo)").action((o) => withSecrets(async (d) => {
+  secrets.command("copy").description("copy provider keys between stages in your own project vault (audit-logged; encryption keys blocked)").requiredOption("--from <stage>", "source tier: dev, rc, or main").requiredOption("--to <stage>", "destination tier: dev, rc, or main").requiredOption("--keys <names>", "comma-separated secret names (encryption keys blocked)").option("--dry-run", "report copies without writing").option("--repo <owner/repo>", "target repo (defaults to the current repo)").action((o) => withSecrets(async (d) => {
     const stages = ["dev", "rc", "main"];
     if (!stages.includes(o.from) || !stages.includes(o.to)) {
       return fail("secrets copy: --from and --to must be dev, rc, or main");
@@ -16482,13 +16414,13 @@ function registerSecretsCommands(program3) {
     );
     if (!ok) process.exitCode = 1;
   }));
-  secrets.command("rm <key>").description("remove a secret (project tier self-serve; org tier needs a grant)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").action((key, o) => withSecrets((d) => secretsRemove(d, key, o)));
-  secrets.command("use <key> [command...]").description("consume a secret KEYLESS: `use <key> -- <cmd>` injects it into the command env (never printed); a granted non-master can use an org secret. No command prints guidance only.").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--slug <slug>", "org-infra namespace (e.g. _org) for a granted org secret").option("--name <ENVVAR>", "env var name to inject under (default: the key leaf, UPPER_SNAKE)").action((key, command, o) => withSecrets(async (d) => {
+  secrets.command("rm <key>").description("remove a secret from your own full project vault; org-infra requires master or an exact grant").option("--repo <owner/repo>", "target repo (defaults to the current repo)").action((key, o) => withSecrets((d) => secretsRemove(d, key, o)));
+  secrets.command("use <key> [command...]").description("consume a secret KEYLESS: own-project full tree or an exactly granted org-infra key; injects into command env and never prints it").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--slug <slug>", "org-infra namespace (e.g. _org) for a granted org secret").option("--name <ENVVAR>", "env var name to inject under (default: the key leaf, UPPER_SNAKE)").action((key, command, o) => withSecrets(async (d) => {
     const ok = await secretsUse(d, key, { ...o, command });
     if (ok === false) process.exitCode = 1;
   }));
-  secrets.command("grant <repo> <login> <key>").description("MASTER-ONLY: grant a project-admin standing access to a specific org-tier secret").action((repo, login, key) => withSecrets((d) => secretsGrant(d, repo, login, key, {})));
-  secrets.command("revoke <repo> <login> <key>").description("MASTER-ONLY: withdraw a previously granted org-tier secret access").action((repo, login, key) => withSecrets((d) => secretsRevoke(d, repo, login, key, {})));
+  secrets.command("grant <repo> <login> <key>").description("MASTER-ONLY: grant a project-admin standing access to one specific org-infra secret").action((repo, login, key) => withSecrets((d) => secretsGrant(d, repo, login, key, {})));
+  secrets.command("revoke <repo> <login> <key>").description("MASTER-ONLY: withdraw a previously granted org-infra secret access").action((repo, login, key) => withSecrets((d) => secretsRevoke(d, repo, login, key, {})));
 }
 
 // src/app-actor.ts
@@ -16788,14 +16720,14 @@ async function fetchInventory() {
     }
   });
   if (incomplete.length === PROJECTS.length) {
-    throw new Error(`box: could not read any Hetzner project \u2014
+    throw new Error(`runtime box: could not read any Hetzner project \u2014
   ${incomplete.join("\n  ")}`);
   }
   return { boxes: boxes.sort((a, b) => a.name.localeCompare(b.name)), incomplete };
 }
 function warnIncomplete(incomplete) {
-  for (const f of incomplete) console.error(`box: WARNING \u2014 ${f}`);
-  if (incomplete.length) console.error("box: this inventory is INCOMPLETE \u2014 boxes may be missing from it.");
+  for (const f of incomplete) console.error(`runtime box: WARNING \u2014 ${f}`);
+  if (incomplete.length) console.error("runtime box: this inventory is INCOMPLETE \u2014 boxes may be missing from it.");
 }
 function registerBoxCommands(program3) {
   const box = program3.command("box").description("the box inventory \u2014 which machines exist, their addresses, and the vault key that opens each (never key values)");
@@ -16820,12 +16752,12 @@ function registerBoxCommands(program3) {
       if (result.kind === "unknown") {
         warnIncomplete(result.reasons);
         await failGraceful(
-          `box: cannot confirm whether '${name}' exists \u2014 part of the inventory could not be read (see above). Refusing to answer "no such box" from a list I know is incomplete.`
+          `runtime box: cannot confirm whether '${name}' exists \u2014 part of the inventory could not be read (see above). Refusing to answer "no such box" from a list I know is incomplete.`
         );
         return;
       }
       if (result.kind === "absent") {
-        await failGraceful(`box: no box named '${name}'. Known boxes: ${result.known.join(", ") || "(none)"}`);
+        await failGraceful(`runtime box: no box named '${name}'. Known boxes: ${result.known.join(", ") || "(none)"}`);
         return;
       }
       const found = result.box;
@@ -16940,7 +16872,7 @@ function awsScheduleNames(payload) {
   return schedules.map((s) => s && typeof s === "object" ? s.Name : void 0).filter((n) => typeof n === "string" && !isJervResource(n));
 }
 var DECLARED_ENTRIES = [
-  { name: "mmi-backup (mm-central, mmi-fofu, zuber, mmi-oguz)", cadence: "17 2 * * *", executor: "box cron.d", llm: "no", resolved: "declared", source: "/etc/cron.d/mmi-backup \u2192 /opt/mmi-control/nightly-backup.sh (verify: mmi-cli box get <box> --ssh)" },
+  { name: "mmi-backup (mm-central, mmi-fofu, zuber, mmi-oguz)", cadence: "17 2 * * *", executor: "box cron.d", llm: "no", resolved: "declared", source: "/etc/cron.d/mmi-backup \u2192 /opt/mmi-control/nightly-backup.sh (verify: mmi-cli runtime box get <box> --ssh)" },
   { name: "zuber-bake", cadence: "*:05/30 (every 30 min)", executor: "zuber systemd timer", llm: "no", resolved: "declared", source: "zuber-bake.timer \u2192 rolling overlay bake, metro tier, next ~6h window (verify over ssh)" },
   { name: "zuber-bake-full", cadence: "00:30 UTC (03:30 TRT, daily)", executor: "zuber systemd timer", llm: "no", resolved: "declared", source: "zuber-bake-full.timer \u2192 full 24h overlay rebuild, all 81 il (verify over ssh)" }
 ];
@@ -16972,7 +16904,7 @@ function renderDocSection(entries, generatedAtIso) {
   }
   return [
     DOC_START_MARKER,
-    `_Generated by \`mmi-cli schedules --doc\` at ${generatedAtIso}. Never hand-edit this section._`,
+    `_Generated by \`mmi-cli org schedules --doc\` at ${generatedAtIso}. Never hand-edit this section._`,
     "",
     lines.join("\n"),
     DOC_END_MARKER
@@ -16982,7 +16914,7 @@ function spliceDoc(docText, generatedSection) {
   const start = docText.indexOf(DOC_START_MARKER);
   const end = docText.indexOf(DOC_END_MARKER);
   if (start === -1 || end === -1 || end < start) {
-    throw new Error(`schedules --doc: the target doc is missing the ${DOC_START_MARKER} / ${DOC_END_MARKER} markers \u2014 refusing to guess where the generated inventory goes.`);
+    throw new Error(`org schedules --doc: the target doc is missing the ${DOC_START_MARKER} / ${DOC_END_MARKER} markers \u2014 refusing to guess where the generated inventory goes.`);
   }
   return docText.slice(0, start) + generatedSection + docText.slice(end + DOC_END_MARKER.length);
 }
@@ -17190,11 +17122,11 @@ async function fetchNotebook(client = defaultGitHubClient(), readRegistry = defa
   };
 }
 function warnIncomplete2(incomplete) {
-  for (const f of incomplete) console.error(`schedules: WARNING \u2014 ${f}`);
-  if (incomplete.length) console.error("schedules: this notebook is INCOMPLETE \u2014 schedules may be missing from it.");
+  for (const f of incomplete) console.error(`org schedules: WARNING \u2014 ${f}`);
+  if (incomplete.length) console.error("org schedules: this notebook is INCOMPLETE \u2014 schedules may be missing from it.");
 }
 function reportDrift(drift) {
-  for (const d of drift) console.error(`schedules: DRIFT \u2014 ${d}`);
+  for (const d of drift) console.error(`org schedules: DRIFT \u2014 ${d}`);
 }
 function registerSchedulesCommands(program3) {
   program3.command("schedules").description("the org schedules notebook \u2014 every armed cron, timer, and scheduled LLM lane, resolved live (jerv side lives in jerv-cli schedules)").option("--json", "machine-readable output (consumed by jerv-cli schedules --all)").option("--doc <path>", "splice the generated inventory into the given doc between the schedules:inventory markers (docs/schedules.md)").action(async (o) => {
@@ -17203,14 +17135,14 @@ function registerSchedulesCommands(program3) {
       if (o.doc) {
         if (incomplete.length) {
           warnIncomplete2(incomplete);
-          await failGraceful("schedules --doc: refusing to regenerate the doc from an incomplete read (see warnings above).");
+          await failGraceful("org schedules --doc: refusing to regenerate the doc from an incomplete read (see warnings above).");
           return;
         }
         const docText = await (0, import_promises2.readFile)(o.doc, "utf8");
         const spliced = spliceDoc(docText, renderDocSection(entries, (/* @__PURE__ */ new Date()).toISOString()));
         await (0, import_promises2.writeFile)(o.doc, spliced, "utf8");
         reportDrift(drift);
-        console.log(`schedules: wrote ${entries.length} entries into ${o.doc}`);
+        console.log(`org schedules: wrote ${entries.length} entries into ${o.doc}`);
         return;
       }
       if (o.json) {
@@ -17457,15 +17389,15 @@ async function runIssueChildren(deps, epic, opts) {
   const seen = /* @__PURE__ */ new Set([childKey(repo, ref.number)]);
   for (const raw of await queryChildren(deps, owner, name, ref.number)) {
     if (out.length >= CHILDREN_MAX_TOTAL) break;
-    const child = shapeChildNode(raw, 1, boardProjectId);
-    out.push(child);
-    seen.add(childKey(child.repo, child.number));
+    const child2 = shapeChildNode(raw, 1, boardProjectId);
+    out.push(child2);
+    seen.add(childKey(child2.repo, child2.number));
   }
   if (!opts.recursive || out.length >= CHILDREN_MAX_TOTAL) return out;
   const queue = [];
-  for (const child of out) {
-    const sp = trySplitRepo(child.repo);
-    if (sp) queue.push({ owner: sp.owner, name: sp.name, number: child.number, depth: 1 });
+  for (const child2 of out) {
+    const sp = trySplitRepo(child2.repo);
+    if (sp) queue.push({ owner: sp.owner, name: sp.name, number: child2.number, depth: 1 });
   }
   while (queue.length && out.length < CHILDREN_MAX_TOTAL) {
     const frame = queue.shift();
@@ -17478,13 +17410,13 @@ async function runIssueChildren(deps, epic, opts) {
     }
     for (const raw of nodes) {
       if (out.length >= CHILDREN_MAX_TOTAL) break;
-      const child = shapeChildNode(raw, frame.depth + 1, boardProjectId);
-      const key = childKey(child.repo, child.number);
+      const child2 = shapeChildNode(raw, frame.depth + 1, boardProjectId);
+      const key = childKey(child2.repo, child2.number);
       if (seen.has(key)) continue;
       seen.add(key);
-      out.push(child);
-      const sp = trySplitRepo(child.repo);
-      if (sp) queue.push({ owner: sp.owner, name: sp.name, number: child.number, depth: frame.depth + 1 });
+      out.push(child2);
+      const sp = trySplitRepo(child2.repo);
+      if (sp) queue.push({ owner: sp.owner, name: sp.name, number: child2.number, depth: frame.depth + 1 });
     }
   }
   return out;
@@ -18235,7 +18167,7 @@ function registerBootstrapCommands(program3) {
       projectMeta: meta,
       deployModel: typeof meta?.deployModel === "string" ? meta.deployModel : void 0,
       readLocalFile: (path2) => path2 === "projects.json" && apiProjects != null ? apiProjects : (0, import_node_fs18.existsSync)(path2) ? (0, import_node_fs18.readFileSync)(path2, "utf8") : null,
-      // requiredGcpApis is stored as an array by a JSON write, but `project set --var KEY=VALUE` stores a raw
+      // requiredGcpApis is stored as an array by a JSON write, but `org project set --var KEY=VALUE` stores a raw
       // comma-string — accept either so the seeded value verifies regardless of how it was written.
       requiredGcpApis: (() => {
         const v = meta?.requiredGcpApis;
@@ -18267,7 +18199,7 @@ function registerBootstrapCommands(program3) {
     else console.log(renderOrgRulesetDriftReport(plan));
     if (plan.action !== "noop") process.exitCode = 1;
   });
-  bootstrap.command("apply <repo>").description("run from the MMI-Hub repo root: idempotent seed apply from skills/bootstrap/seeds/manifest.json; dry-run unless --execute (live, master-gated)").option("--class <class>", "deployable | content", "deployable").option("--project-type <type>", `${PROJECT_TYPES.join(" | ")} (v2 capability shape)`).option("--deploy-model <model>", `${DEPLOY_MODELS.join(" | ")} (release/deploy path)`).option("--release-track <track>", `${RELEASE_TRACKS.join(" | ")} (branch topology; direct skips rc)`).option("--execute", "LIVE apply via gh (master-gated) \u2014 stamps seed files + labels into the repo").option("--var <KEY=VALUE...>", "placeholder values for repo-owned templates (repeatable)").option("--json", "machine-readable output").action(async (repo, cmdOpts) => {
+  bootstrap.command("apply <repo>").description("run from the MMI-Hub repo root: idempotent seed apply from skills/bootstrap/seeds/manifest.json; dry-run unless --execute (live, master-gated)").option("--class <class>", "deployable | content", "deployable").option("--project-type <type>", `${PROJECT_TYPES.join(" | ")} (capability shape)`).option("--deploy-model <model>", `${DEPLOY_MODELS.join(" | ")} (release/deploy path)`).option("--release-track <track>", `${RELEASE_TRACKS.join(" | ")} (branch topology; direct skips rc)`).option("--execute", "LIVE apply via gh (master-gated) \u2014 stamps seed files + labels into the repo").option("--var <KEY=VALUE...>", "placeholder values for repo-owned templates (repeatable)").option("--json", "machine-readable output").action(async (repo, cmdOpts) => {
     const o = {
       class: rawValue("--class", "deployable"),
       projectType: rawValue("--project-type", ""),
@@ -18583,12 +18515,12 @@ async function ensurePortRangeAtomic(repo, path2, allocate, opts = {}) {
 function shellFor(platform2 = process.platform) {
   return platform2 === "win32" ? "powershell" : "bash";
 }
-function isCentralContainerModel2(model) {
+function isCentralContainerModel(model) {
   return model === "tenant-container" || model === "solo-container";
 }
 function deriveStageGap(inputs) {
   const missing = [];
-  if (!isCentralContainerModel2(inputs.deployModel)) {
+  if (!isCentralContainerModel(inputs.deployModel)) {
     return `local stage default applies to central-container repos only (tenant-container/solo-container; registry deployModel = ${inputs.deployModel ?? "unset"})`;
   }
   if (!inputs.hasCompose) missing.push("docker-compose.yml");
@@ -18770,7 +18702,7 @@ function registerStageCommands(program3) {
     const read = await fetchProjectBySlugChecked(slug, reg);
     const decision = decidePortRange({ metaReadOk: read.ok, metaPortRange: read.ok ? metaPortRange(read.project) : null });
     if (decision.action === "fail") {
-      return failGraceful(`port-range: ${decision.reason}${read.ok ? "" : ` (${read.error})`}`);
+      return failGraceful(`stage port-range: ${decision.reason}${read.ok ? "" : ` (${read.error})`}`);
     }
     if (decision.action === "return") {
       const [start2, end2] = decision.range;
@@ -18780,7 +18712,7 @@ function registerStageCommands(program3) {
     const infra = resolvePortRangeInfra(process.cwd(), __dirname);
     if (!infra) {
       return failGraceful(
-        `port-range: no MMI-Hub allocator files found (checked cwd ${process.cwd()}, sibling MMI-Hub dirs, and the installed package location); ensure the Hub's infra/port-ranges.json and infra/port-ddb.mjs are reachable`
+        `stage port-range: no MMI-Hub allocator files found (checked cwd ${process.cwd()}, sibling MMI-Hub dirs, and the installed package location); ensure the Hub's infra/port-ranges.json and infra/port-ddb.mjs are reachable`
       );
     }
     const path2 = infra.registryPath;
@@ -18793,7 +18725,7 @@ function registerStageCommands(program3) {
     const { range: [start, end], source } = await ensurePortRangeAtomic(repo, path2, allocate);
     const write = await upsertProject(slug, { portRange: { start, end } }, reg);
     if (!write.ok && source === "ddb") {
-      return failGraceful(`port-range: block [${start}, ${end}] was allocated (cursor advanced) but NOT recorded in the registry META (${write.error ?? `HTTP ${write.status}`}) \u2014 fix auth/connectivity and retry so the block is persisted; do not re-run blind`);
+      return failGraceful(`stage port-range: block [${start}, ${end}] was allocated (cursor advanced) but NOT recorded in the registry META (${write.error ?? `HTTP ${write.status}`}) \u2014 fix auth/connectivity and retry so the block is persisted; do not re-run blind`);
     }
     if (o.json) {
       printLine(JSON.stringify({ repo, portRange: [start, end], source: "allocated", persisted: write.ok, ...write.ok ? {} : { persistError: write.error ?? `HTTP ${write.status}` } }));
@@ -18833,7 +18765,7 @@ function registerStageCommands(program3) {
       },
       control: async ({ repo, action, host, ip }) => {
         const res = await tenantControl({ repo, stage: "dev", action, host, ip }, rcDeps);
-        if (!res.ok) throw new Error(`tenant control ${action} dispatch failed: ${res.body?.error ?? res.error ?? `HTTP ${res.status}`}`);
+        if (!res.ok) throw new Error(`runtime tenant control ${action} dispatch failed: ${res.body?.error ?? res.error ?? `HTTP ${res.status}`}`);
       }
     };
     try {
@@ -19060,7 +18992,7 @@ function registerBoardCommands(program3) {
       expected: [...BOARD_STATUSES]
     });
   }
-  async function runBulkMove(issueRefs, o, status, failLabel) {
+  async function runBulkMove(issueRefs, o, status) {
     try {
       const bulk = await moveBoardIssues({
         config: await loadConfigForBoardSelector2(issueRefs[0], o.repo),
@@ -19078,7 +19010,7 @@ function registerBoardCommands(program3) {
       }
       if (bulk.failed > 0) process.exitCode = 1;
     } catch (e) {
-      return failGraceful(`${failLabel} failed: ${e.message}`);
+      return failGraceful(`board move failed: ${e.message}`);
     }
   }
   withExamples(mutating(
@@ -19100,7 +19032,7 @@ function registerBoardCommands(program3) {
       }
       return;
     }
-    await runBulkMove(issueRefs, o, canonicalStatus, "board move");
+    await runBulkMove(issueRefs, o, canonicalStatus);
   }), [
     'mmi-cli board move "In Progress" 2680',
     "mmi-cli board move Done 2680 2681 2682"
@@ -19133,19 +19065,6 @@ function registerBoardCommands(program3) {
       return failGraceful(`board set-priority failed: ${e.message}`);
     }
   });
-  mutating(board.command("done <issues...>").description("set one or more board items' Status to Done (does not close the GitHub issue; use `gh issue close`)").option("--json", "machine-readable output").option("--repo <owner/repo>", "current repo for local issue numbers (defaults to git origin)").option("--allow-partial", "return success JSON if the item resolves but the status move fails")).action(async (issueRefs, o) => {
-    if (issueRefs.length === 1) {
-      try {
-        const result = await moveBoardItem({ config: await loadConfigForBoardSelector2(issueRefs[0], o.repo), selector: issueRefs[0], status: "Done", repo: o.repo, allowPartial: o.allowPartial });
-        if (o.json) return console.log(JSON.stringify(result));
-        console.log(result.partial ? `Partially moved ${result.item.ref}: ${result.warning}` : `Moved ${result.item.ref} -> Done`);
-      } catch (e) {
-        return failGraceful(`board done failed: ${e.message}`);
-      }
-      return;
-    }
-    await runBulkMove(issueRefs, o, "Done", "board done");
-  });
   board.command("unclaim <issue>").description("clear the assignee and reset the board Status (defaults to Todo) \u2014 the inverse of claim").option("--json", "machine-readable output").option("--repo <owner/repo>", "current repo for local issue numbers (defaults to git origin)").option("--to-status <status>", `set Status after unclaim (default Todo; one of ${BOARD_STATUSES.join(", ")})`).option("--allow-partial", "return success JSON if the assignee clear or status move fails").action(async (issueRef, o) => {
     const toStatus = o.toStatus ? resolveBoardStatus(o.toStatus) : void 0;
     try {
@@ -19443,7 +19362,7 @@ async function resolveBoardAdvanceForPr(prNumber, repoOption) {
   });
 }
 function renderGcApplyResult(result) {
-  const lines = ["gc apply result:"];
+  const lines = ["worktree gc apply result:"];
   lines.push(`  branches removed: ${result.removedBranches.length ? result.removedBranches.join(", ") : "none"}`);
   lines.push(`  remote branches removed: ${result.removedRemoteBranches.length ? result.removedRemoteBranches.join(", ") : "none"}`);
   lines.push(`  tracking refs removed: ${result.removedTrackingRefs.length ? result.removedTrackingRefs.join(", ") : "none"}`);
@@ -19488,7 +19407,7 @@ function evaluatePrMergeHousekeeping(report, context, force = false) {
   const detail = failed ? `scratch housekeeping failed${scratch?.error ? `: ${scratch.error}` : ""}` : `${prunable} prunable + ${unprunable} un-prunable scratch item(s) remain after cleanup`;
   return {
     blocked: true,
-    reason: `${context} housekeeping blocked merge: ${detail}. Run \`mmi-cli gc --scratch --apply\` to clear it, then retry \u2014 or re-run \`mmi-cli ${context} --force\` to acknowledge and land anyway. (Kept advisory plans/ scratch never blocks: it is gitignored and can never reach origin.)`
+    reason: `${context} housekeeping blocked merge: ${detail}. Run \`mmi-cli worktree gc --scratch --apply\` to clear it, then retry \u2014 or re-run \`mmi-cli ${context} --force\` to acknowledge and land anyway. (Kept advisory plans/ scratch never blocks: it is gitignored and can never reach origin.)`
   };
 }
 function assertPrMergeHousekeepingClean(startingPath, context, options = {}) {
@@ -19650,7 +19569,7 @@ async function remoteBranchExists2(branch, options = {}) {
 }
 var COMPOSE_TIMEOUT_MS = 12e4;
 function spawnDeferredGcSweep() {
-  spawnDetachedSelf(["gc", "sweep-deferred", "--quiet"], { spawn: import_node_child_process10.spawn, execPath: process.execPath, scriptPath: process.argv[1] });
+  spawnDetachedSelf(["worktree", "gc", "sweep-deferred", "--quiet"], { spawn: import_node_child_process10.spawn, execPath: process.execPath, scriptPath: process.argv[1] });
 }
 async function createDeferredWorktreeStore() {
   try {
@@ -19907,7 +19826,7 @@ function classifyStaleLeaks(input) {
       kind: "stale-worktree",
       ref: wt.branch,
       detail: `merged/closed branch ${wt.branch} still checked out at ${wt.path}`,
-      remediation: `cd "${wt.path}" && mmi-cli worktree land --apply  (or: mmi-cli gc --apply)`
+      remediation: `cd "${wt.path}" && mmi-cli worktree land --apply  (or: mmi-cli worktree gc --apply)`
     });
   }
   for (const branch of input.localBranches) {
@@ -19920,7 +19839,7 @@ function classifyStaleLeaks(input) {
       kind: "stale-branch",
       ref: branch,
       detail: `merged/closed branch ${branch} has no worktree`,
-      remediation: "mmi-cli gc --apply"
+      remediation: "mmi-cli worktree gc --apply"
     });
   }
   for (const wt of input.worktrees) {
@@ -19944,7 +19863,7 @@ function classifyStaleLeaks(input) {
         kind: "orphan-dir",
         ref: dir,
         detail: `directory under the worktrees root is not a registered worktree`,
-        remediation: `mmi-cli gc --apply  (or: Remove-Item/rm -rf "${dir}")`
+        remediation: `mmi-cli worktree gc --apply  (or: Remove-Item/rm -rf "${dir}")`
       });
     }
   }
@@ -20738,9 +20657,9 @@ function buildPluginGuardDecision(i) {
   if (!i.marketplaceClonePresent || !i.pluginCachePresent) return { state: "unresolved" };
   return { state: "healthy" };
 }
-function buildGuardSessionStartLine(state, opts = {}) {
+function buildPluginGuardLine(state, opts = {}) {
   if (state === "healthy" || state === "not-org") return { exitCode: 0 };
-  const recovery = opts.recovery ?? "mmi-cli plugin-heal";
+  const recovery = opts.recovery ?? "mmi-cli plugin heal";
   const restartHint = opts.restartHint ?? "restart your agent host / reload plugins";
   const reason = state === "no-install" ? "MMI plugin is not installed for this user/session" : "MMI plugin is installed but its marketplace/cache is unresolved";
   return {
@@ -20945,8 +20864,7 @@ async function applyPluginHeal(surface, log, opts) {
   }
   return true;
 }
-async function runGuard(opts = {}, readOrigin) {
-  void opts;
+async function runGuard(readOrigin) {
   try {
     const surface = detectSurface(process.env);
     if (surfaceToken(surface) !== "claude") {
@@ -20956,7 +20874,7 @@ async function runGuard(opts = {}, readOrigin) {
     const isOrgRepo = readOrigin ? await isOrgRepoRoot(readOrigin) : await isOrgRepoRoot();
     const input = snapshotPluginGuardInput(surface, isOrgRepo);
     const { state } = buildPluginGuardDecision(input);
-    const { line, exitCode } = buildGuardSessionStartLine(state);
+    const { line, exitCode } = buildPluginGuardLine(state);
     if (line) console.error(line);
     process.exitCode = exitCode;
   } catch {
@@ -21097,7 +21015,7 @@ function formatLastRun(r) {
 }
 function formatDeployStatus(r) {
   const lines = [
-    `deploy status \u2014 ${r.repo} (${r.slug}) stage ${r.stage}`,
+    `runtime deploy status \u2014 ${r.repo} (${r.slug}) stage ${r.stage}`,
     "",
     `running version: ${r.runningVersion ?? "none stamped"}`,
     `last deploy run: ${formatLastRun(r)}`,
@@ -21112,7 +21030,7 @@ function formatDeployStatus(r) {
 }
 
 // src/deploy-commands.ts
-var STAGES2 = ["dev", "rc", "main"];
+var STAGES = ["dev", "rc", "main"];
 async function probeHttpBounded(url, timeoutMs = 5e3) {
   const controller = new AbortController();
   const timeout = setTimeout(() => controller.abort(), timeoutMs);
@@ -21129,8 +21047,8 @@ async function probeHttpBounded(url, timeoutMs = 5e3) {
 function registerDeployCommands(program3) {
   const deploy = program3.command("deploy").description("per-stage deploy observability \u2014 last run, health, and running version (#2688)");
   deploy.command("status <stage>").description("last deploy run + runtime health probe + running version for a stage (defaults to the current repo)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--json", "machine-readable output").action(async (stage, o) => {
-    if (!STAGES2.includes(stage)) {
-      return fail(`deploy status: <stage> must be dev, rc, or main`);
+    if (!STAGES.includes(stage)) {
+      return fail(`runtime deploy status: <stage> must be dev, rc, or main`);
     }
     try {
       const cfg = await loadConfig();
@@ -21159,7 +21077,7 @@ function registerDeployCommands(program3) {
       }
       if (report.health?.ok === false) process.exitCode = 1;
     } catch (e) {
-      return failGraceful(`deploy status: ${e.message}`);
+      return failGraceful(`runtime deploy status: ${e.message}`);
     }
   });
 }
@@ -21278,7 +21196,7 @@ async function collectOnboardStatus() {
       if (read.ok && read.project) {
         registry2 = { ok: true, detail: `project "${read.project.name ?? slug}" registered` };
       } else if (read.ok) {
-        registry2 = { ok: false, detail: `repo "${slug}" not registered \u2014 run mmi-cli bootstrap or mmi-cli project set <owner/repo>` };
+        registry2 = { ok: false, detail: `repo "${slug}" not registered \u2014 run mmi-cli bootstrap or mmi-cli org project set <owner/repo>` };
       } else {
         registry2 = { ok: false, detail: `read failed: ${read.error}` };
       }
@@ -21305,7 +21223,7 @@ async function collectOnboardStatus() {
   if (!cfg.sagaApiUrl) {
     nextCommand = "mmi-cli doctor \u2014 fix Hub API URL configuration first";
   } else if (!registry2.ok) {
-    nextCommand = "mmi-cli project set <owner/repo>";
+    nextCommand = "mmi-cli org project set <owner/repo>";
   } else if (!board.ok) {
     nextCommand = "mmi-cli board read";
   } else {
@@ -21374,10 +21292,11 @@ var LOOP_PLAYBOOKS = {
   agent: {
     title: "Agent",
     steps: [
-      { label: "Resume continuity from Jerv's Memory", command: "jerv-cli resume" },
+      { label: "Orient in the current repository", command: "mmi-cli onboard" },
       { label: "Read the next board item", command: "mmi-cli board read" },
-      { label: "Create an isolated worktree from development", command: "mmi-cli worktree create feature/<issue-number>-<short-description> --from origin/development" },
+      { label: "Claim it and create an isolated worktree", command: "mmi-cli worktree create <issue-number> --claim --from origin/development" },
       { label: "Build and test in the touched package", command: "npm test && npm run build" },
+      { label: "Publish the branch", command: "git push -u origin HEAD" },
       { label: "Open the development-base PR", command: 'mmi-cli pr create --title "<title>" --body-file PR_BODY.md --base development' },
       { label: "Wait for checks and land to development", command: "mmi-cli pr checks-wait <PR-number> && mmi-cli pr land <PR-number>" },
       { label: "Release only after the gated train is authorized", command: "mmi-cli release --apply" }
@@ -21386,16 +21305,17 @@ var LOOP_PLAYBOOKS = {
   "start-work": {
     title: "Start Work",
     steps: [
-      { label: "Pull latest development", command: "git checkout development && git pull origin development" },
-      { label: "Create a feature branch", command: "git checkout -b feature/<issue-number>-<short-description>" },
-      { label: "Claim the board item", command: "mmi-cli board claim <issue-number>" },
+      { label: "Orient in the current repository", command: "mmi-cli onboard" },
+      { label: "Read the board item", command: "mmi-cli board show <issue-number>" },
+      { label: "Claim it and create the worktree from development", command: "mmi-cli worktree create <issue-number> --claim --from origin/development" },
       { label: "Start a local stage (deployable repos)", command: "mmi-cli stage run --apply" }
     ]
   },
   "ship-pr": {
     title: "Ship PR",
     steps: [
-      { label: "Push branch and open PR", command: "git push -u origin HEAD && gh pr create --fill --base development" },
+      { label: "Publish the branch", command: "git push -u origin HEAD" },
+      { label: "Open the development-base PR", command: 'mmi-cli pr create --title "<title>" --body-file PR_BODY.md --base development' },
       { label: "Wait for CI checks", command: "mmi-cli pr checks-wait <PR-number>" },
       { label: "Land the PR (merge to development)", command: "mmi-cli pr land <PR-number>" }
     ]
@@ -21403,9 +21323,9 @@ var LOOP_PLAYBOOKS = {
   "hotfix": {
     title: "Hotfix",
     steps: [
-      { label: "Start hotfix", command: "mmi-cli hotfix start" },
-      { label: "Apply fix commits", command: "git cherry-pick -x <commit-sha>" },
-      { label: "Release hotfix to production", command: "mmi-cli hotfix release" }
+      { label: "Create the main-base hotfix PR from an already-merged fix", command: "mmi-cli hotfix start --from <pr#|sha>" },
+      { label: "Wait for the hotfix PR checks", command: "mmi-cli pr checks-wait <PR-number>" },
+      { label: "After the PR is merged, run the gated release", command: "mmi-cli hotfix release <vX.Y.Z> --carries <pr#|sha>" }
     ]
   }
 };
@@ -21455,6 +21375,22 @@ function formatExplainCommand(cmd, rootName) {
   }
   return lines.join("\n").trimEnd();
 }
+function formatExplainGroup(cmd, rootName) {
+  const lines = [
+    `${rootName} ${cmd.path}${cmd.description ? ` \u2014 ${cmd.description}` : ""}`,
+    `Category: ${cmd.category} \xB7 Discovery: ${cmd.discovery}`,
+    "",
+    "Commands:"
+  ];
+  for (const child2 of cmd.subcommands) {
+    const args = child2.arguments.map((arg) => {
+      const name = arg.variadic ? `${arg.name}...` : arg.name;
+      return arg.required ? `<${name}>` : `[${name}]`;
+    }).join(" ");
+    lines.push(`  ${child2.path}${args ? ` ${args}` : ""}${child2.description ? ` \u2014 ${child2.description}` : ""}`);
+  }
+  return lines.join("\n");
+}
 function formatExplainLoop(playbook) {
   const lines = [`${playbook.title} loop:`];
   for (const step of playbook.steps) {
@@ -21464,7 +21400,15 @@ function formatExplainLoop(playbook) {
   return lines.join("\n");
 }
 function findCommandInManifest(manifest, commandPath2) {
-  return manifest.index.find((c) => c.path === commandPath2 || c.path.endsWith(` ${commandPath2}`));
+  const visit = (command) => {
+    if (command.path === commandPath2) return command;
+    for (const child2 of command.subcommands) {
+      const found = visit(child2);
+      if (found) return found;
+    }
+    return void 0;
+  };
+  return visit(manifest.tree);
 }
 function registerExplainCommand(program3) {
   program3.command("explain").description("print a command's purpose, flags, and examples from the live schema \u2014 one grounding call replaces trial-and-error").argument("[command...]", 'the command path to explain (e.g. "issue create")').option("--loop <name>", "print the canonical command sequence: agent | start-work | ship-pr | hotfix").action((commandArgs, opts) => {
@@ -21479,18 +21423,16 @@ function registerExplainCommand(program3) {
     }
     const manifest = buildCommandManifest(program3);
     if (!commandArgs.length) {
-      console.log(manifest.name + (manifest.version ? ` v${manifest.version}` : ""));
-      console.log(manifest.tree.description ?? "");
-      console.log("\nRun `mmi-cli commands` to list every subcommand + its flags.");
+      console.log(formatManifestHuman(manifest));
       return;
     }
     const commandPath2 = commandArgs.join(" ");
-    const leaf = findCommandInManifest(manifest, commandPath2);
-    if (!leaf) {
+    const command = findCommandInManifest(manifest, commandPath2);
+    if (!command) {
       fail(`explain: unknown command "${commandPath2}"`, { code: ERROR_CODES.ERR_NOT_FOUND });
       return;
     }
-    console.log(formatExplainCommand(leaf, manifest.name));
+    console.log(command.subcommands.length ? formatExplainGroup(command, manifest.name) : formatExplainCommand(command, manifest.name));
   });
 }
 
@@ -22127,7 +22069,7 @@ function checkClaudePlugin(probe) {
     return {
       ok: false,
       label: guardState === "no-install" ? "Claude plugin \u2014 not installed" : "Claude plugin \u2014 unresolved (marketplace/cache missing)",
-      fix: "run `mmi-cli plugin-heal` to reinstall the MMI marketplace + plugin, then restart Claude",
+      fix: "run `mmi-cli plugin heal` to reinstall the MMI marketplace + plugin, then restart Claude",
       verbose: evidence
     };
   }
@@ -22186,7 +22128,7 @@ function checkPluginCache(input) {
     // Lead with the versioned-cache framing when there are stale versions; otherwise report the staging litter
     // on its own so a cache with zero versioned dirs still gets an honest ✗.
     detail: input.stale.length ? `${input.cached} versions cached (${parts.join("; ")})` : parts.join("; "),
-    fix: "run `mmi-cli plugin-prune` to review, then `mmi-cli plugin-prune --apply` to delete",
+    fix: "run `mmi-cli plugin prune` to review, then `mmi-cli plugin prune --apply` to delete",
     verbose: evidence
   };
 }
@@ -22216,7 +22158,7 @@ function checkSchedules(probe) {
       ok: false,
       label: "schedules",
       detail: `${probe.incomplete.length} source(s) unreadable`,
-      fix: "run `mmi-cli schedules` for the full report \u2014 the notebook may be missing armed entries",
+      fix: "run `mmi-cli org schedules` for the full report \u2014 the notebook may be missing armed entries",
       verbose: evidence
     };
   }
@@ -22225,7 +22167,7 @@ function checkSchedules(probe) {
       ok: false,
       label: "schedules",
       detail: `${probe.drift.length} drift finding(s)`,
-      fix: "run `mmi-cli schedules` \u2014 file/registry/live disagree; each drift line names its per-class remedy, applied in the owning repo",
+      fix: "run `mmi-cli org schedules` \u2014 file/registry/live disagree; each drift line names its per-class remedy, applied in the owning repo",
       verbose: evidence
     };
   }
@@ -22581,11 +22523,13 @@ function allLongFlags() {
   if (cachedLongFlags) return cachedLongFlags;
   const acc = /* @__PURE__ */ new Set();
   const walk = (node) => {
+    if (!isCanonicalSuggestion(node)) return;
     for (const opt of node.options) {
+      if (opt.discovery) continue;
       const m = /--[\w-]+/.exec(opt.flags);
       if (m) acc.add(m[0]);
     }
-    for (const child of node.subcommands) walk(child);
+    for (const child2 of node.subcommands) walk(child2);
   };
   walk(buildCommandManifest(program2).tree);
   cachedLongFlags = [...acc];
@@ -22621,7 +22565,7 @@ function envelopeAwareWriteErr(str) {
   process.stderr.write(str);
 }
 var program2 = new Command();
-program2.name("mmi-cli").description("MMI Future CLI \u2014 org rules delivery, Jervaise-only continuity. The engine the plugin SessionStart hook drives.").version(resolveClientVersion()).configureOutput({ writeErr: envelopeAwareWriteErr }).showHelpAfterError("(run `mmi-cli commands` to list every subcommand + its flags, or `mmi-cli commands --json` to ground against it). If you expected this command to exist, your installed mmi-cli may be stale \u2014 update it (see: mmi-cli doctor)");
+program2.name("mmi-cli").description("MMI Future Hub CLI \u2014 the org control plane for agentic coding.").version(resolveClientVersion()).configureOutput({ writeErr: envelopeAwareWriteErr }).showHelpAfterError("(run `mmi-cli commands` for the agentic-coding map, `mmi-cli explain <command>` for detail, or `mmi-cli commands --json --primary` for machine discovery). If you expected this command to exist, your installed mmi-cli may be stale \u2014 update it (see: mmi-cli doctor)");
 function appActorDeps() {
   return {
     fetchSecret: async (key) => fetchSecretValue(makeSecretsDeps(await loadConfig()), key, { repo: APP_VAULT_REPO }),
@@ -22651,22 +22595,26 @@ rules.command("gitignore").option("--write", "upsert the managed block into .git
   if (opts.write) {
     if (plan.changed) {
       (0, import_node_fs27.writeFileSync)(path2, plan.content, "utf8");
-      console.log(`mmi-cli rules gitignore: updated .gitignore (${drift})`);
+      console.log(`mmi-cli org rules gitignore: updated .gitignore (${drift})`);
     } else {
-      console.log("mmi-cli rules gitignore: up to date");
+      console.log("mmi-cli org rules gitignore: up to date");
     }
     return;
   }
   if (plan.changed) {
-    console.error(`mmi-cli rules gitignore: managed block drift (${drift}) \u2014 run \`mmi-cli rules gitignore --write\` and commit`);
+    console.error(`mmi-cli org rules gitignore: managed block drift (${drift}) \u2014 run \`mmi-cli org rules gitignore --write\` and commit`);
     process.exitCode = 1;
   } else {
-    console.log("mmi-cli rules gitignore: up to date");
+    console.log("mmi-cli org rules gitignore: up to date");
   }
 });
-program2.command("commands").description("print the command manifest \u2014 every subcommand + its flags (ground against this instead of guessing)").option("--json", "machine-readable JSON: { name, version, tree, index } \u2014 index is a flat list of every leaf command path").action((o) => {
+program2.command("commands").description("print the grouped agentic-coding map; use --all for operational depth").option("--all", "include operational and internal depth").option("--json", "machine-readable command manifest").option("--primary", "with --json, emit only the compact primary tree and index").action((o) => {
   const manifest = buildCommandManifest(program2);
-  consoleIo.log(o.json ? JSON.stringify(manifest, null, 2) : formatManifestHuman(manifest));
+  if (o.json) {
+    consoleIo.log(JSON.stringify(o.primary ? primaryCommandManifest(manifest) : manifest, null, 2));
+    return;
+  }
+  consoleIo.log(formatManifestHuman(manifest, { all: o.all }));
 });
 async function runWhoami(io = consoleIo) {
   const cfg = await loadConfig();
@@ -22743,21 +22691,21 @@ gcCmd.command("sweep-deferred").description("retry IDE-locked deferred worktree
       );
       if (o.json) return console.log(JSON.stringify(result));
       if (!o.quiet || result.removed.length || result.stillDeferred.length || result.skipped.length) {
-        if (result.removed.length) console.log(`gc sweep-deferred: removed ${result.removed.length} worktree(s)`);
-        if (result.stillDeferred.length) console.log(`gc sweep-deferred: ${result.stillDeferred.length} still queued (will retry on next session)`);
-        if (result.skipped.length) console.log(`gc sweep-deferred: ${result.skipped.length} dropped (repurposed for different work since queued, left untouched)`);
-        if (!result.removed.length && !result.stillDeferred.length && !result.skipped.length) console.log("gc sweep-deferred: nothing queued");
+        if (result.removed.length) console.log(`worktree gc sweep-deferred: removed ${result.removed.length} worktree(s)`);
+        if (result.stillDeferred.length) console.log(`worktree gc sweep-deferred: ${result.stillDeferred.length} still queued (will retry on next session)`);
+        if (result.skipped.length) console.log(`worktree gc sweep-deferred: ${result.skipped.length} dropped (repurposed for different work since queued, left untouched)`);
+        if (!result.removed.length && !result.stillDeferred.length && !result.skipped.length) console.log("worktree gc sweep-deferred: nothing queued");
       }
     } catch (e) {
-      fail(`gc sweep-deferred: ${e.message}`);
+      fail(`worktree gc sweep-deferred: ${e.message}`);
     }
   }, DEFERRED_SWEEP_HARD_TIMEOUT_MS, () => {
-    console.error("gc sweep-deferred: exceeded hard timeout \u2014 exiting so the detached worker cannot leak (#2841)");
+    console.error("worktree gc sweep-deferred: exceeded hard timeout \u2014 exiting so the detached worker cannot leak (#2841)");
     process.exit(process.exitCode ?? 0);
   });
 });
 gcCmd.option("--dry-run", "show what would be deleted (default)").option("--apply", "delete only the listed clean merged/closed PR local+remote branches, linked worktrees, and stale tracking refs").option("--json", "machine-readable output").option("--scratch", "prune safe local scratch and plans whose current hash is confirmed synced to North Star (#1864) instead of git branches/refs").option("--remote <name>", "remote name", "origin").option("--limit <n>", "PRs to inspect per state", "200").action(async (o) => {
-  if (o.apply && o.dryRun) return fail("gc: choose either --dry-run or --apply");
+  if (o.apply && o.dryRun) return fail("worktree gc: choose either --dry-run or --apply");
   if (o.scratch) {
     try {
       const root = (await execFileP2("git", ["rev-parse", "--show-toplevel"], { timeout: GIT_TIMEOUT_MS }).catch(() => ({ stdout: "" }))).stdout.trim() || process.cwd();
@@ -22765,11 +22713,11 @@ gcCmd.option("--dry-run", "show what would be deleted (default)").option("--appl
       if (o.json) return console.log(JSON.stringify({ dryRun: !o.apply, ...run }, null, 2));
       return console.log(formatScratchGcPlan(run.plan, Boolean(o.apply), run.applied));
     } catch (e) {
-      return fail(`gc --scratch: ${e.message}`);
+      return fail(`worktree gc --scratch: ${e.message}`);
     }
   }
   const limit = Number.parseInt(o.limit, 10);
-  if (!Number.isFinite(limit) || limit < 1) return fail("gc: --limit must be a positive integer");
+  if (!Number.isFinite(limit) || limit < 1) return fail("worktree gc: --limit must be a positive integer");
   try {
     const plan = await gcPlan(o.remote, limit);
     if (o.apply && !o.json) console.log(formatGcPlan(plan, false));
@@ -22794,7 +22742,7 @@ ${renderGcApplyResult(applyResult)}`);
     }
     if (applyResult?.failed.length) process.exitCode = 1;
   } catch (e) {
-    fail(`gc: ${e.message}`);
+    fail(`worktree gc: ${e.message}`);
   }
 });
 var NPM_PROVISION_TIMEOUT_MS = 3e5;
@@ -22804,19 +22752,19 @@ function runWorktreeInstall(command, cwd, quiet) {
   const file = isWin2 ? "cmd.exe" : bin;
   const spawnArgs = isWin2 ? ["/c", bin, ...args] : args;
   return new Promise((resolve5, reject) => {
-    const child = (0, import_node_child_process12.spawn)(file, spawnArgs, { cwd, stdio: quiet ? "ignore" : "inherit", windowsHide: true });
+    const child2 = (0, import_node_child_process12.spawn)(file, spawnArgs, { cwd, stdio: quiet ? "ignore" : "inherit", windowsHide: true });
     const timer = setTimeout(() => {
       try {
-        child.kill();
+        child2.kill();
       } catch {
       }
       reject(new Error(`${command} timed out after ${NPM_PROVISION_TIMEOUT_MS}ms in ${cwd}`));
     }, NPM_PROVISION_TIMEOUT_MS);
-    child.on("error", (e) => {
+    child2.on("error", (e) => {
       clearTimeout(timer);
       reject(e);
     });
-    child.on("exit", (code) => {
+    child2.on("exit", (code) => {
       clearTimeout(timer);
       if (code === 0) resolve5();
       else reject(new Error(`${command} exited ${code} in ${cwd}`));
@@ -22994,7 +22942,7 @@ async function attachToProject(issueNumber, repo, priority) {
     return { onBoard: false };
   }
   if (!cfg.projectId) {
-    console.error(`issue create: board attach skipped \u2014 no Hub registry board META for ${targetRepo2 ?? "current repo"}; run \`mmi-cli project get ${targetRepo2 ?? "<owner/repo>"}\` and backfill board coords`);
+    console.error(`issue create: board attach skipped \u2014 no Hub registry board META for ${targetRepo2 ?? "current repo"}; run \`mmi-cli org project get ${targetRepo2 ?? "<owner/repo>"}\` and backfill board coords`);
     return { onBoard: false };
   }
   try {
@@ -23074,7 +23022,7 @@ docsAudit.command("record").description("write a dated janitor verdict for one r
     if (o.outcome === "clean") outcome = { kind: "clean" };
     else if (o.outcome === "refreshed") outcome = { kind: "refreshed", count: Number(o.count) };
     else if (o.outcome === "failed") outcome = { kind: "failed", reason: o.reason ?? "" };
-    else return failGraceful(`docs-audit record: --outcome must be clean|refreshed|failed, got "${o.outcome}"`);
+    else return failGraceful(`docs audit record: --outcome must be clean|refreshed|failed, got "${o.outcome}"`);
     const verdict = docsAuditRecord({ repo, date, shaRange: o.shaRange, outcome, checkerVendor: o.checkerVendor });
     await reportWrite("docs-audit record", await recordDocsAudit(verdict, registryClientDeps(await loadConfig())));
   } catch (e) {
@@ -23102,50 +23050,56 @@ async function reportWrite(label, res) {
   return failGraceful(`${label}: HTTP ${res.status}${detail ? ` \u2014 ${detail}` : ""}`);
 }
 var tenant = program2.command("tenant").description("tenant runtime control through Hub authority");
-tenant.command("control <owner/repo> <stage> <action>").description("run bounded service control (status/start/stop/restart, rc-only retire, read-only verify-secrets) for a tenant via the central tenant-control.yml workflow; project-admin dev/rc, master main").option("--watch", "block on the dispatched run and report its conclusion (status/retire/verify-secrets watch by default)").option("--json", "machine-readable output").action(async (repo, stage, action, o) => {
+tenant.command("control <owner/repo> <stage> <action>").description("bounded tenant control plus value-free vault/broker verification; project-admin own dev/rc, master main").option("--watch", "block on the dispatched run and report its conclusion (status/retire/verify-secrets/verify-broker watch by default)").option("--json", "machine-readable output").action(async (repo, stage, action, o) => {
   try {
     const result = await runTenantControl(trainApplyDeps(), { repo, stage, action, watch: o.watch });
     if (!o.json && action === "verify-secrets" && result.secrets) {
       const body = { ok: result.conclusion === "success", secrets: result.secrets, ssmStatus: result.conclusion === "success" ? "Success" : "Failed", raw: result.secretsRaw };
       const { lines, failure } = renderVerifySecrets(body);
       for (const line of lines) printLine(line);
-      if (failure) return failGraceful(`tenant control ${stage} verify-secrets: ${failure}`);
+      if (failure) return failGraceful(`runtime tenant control ${stage} verify-secrets: ${failure}`);
+    } else if (!o.json && action === "verify-broker" && result.broker) {
+      const { lines, failure } = renderVerifyBroker({ broker: result.broker, raw: result.brokerRaw });
+      for (const line of lines) printLine(line);
+      if (failure) return failGraceful(`runtime tenant control ${stage} verify-broker: ${failure}`);
     } else {
       printLine(o.json ? JSON.stringify(result, null, 2) : renderTenantControl(result));
     }
     if (result.conclusion === "failure") {
-      return failGraceful(`tenant control ${stage} ${action}: ${result.category ?? "failed"} \u2014 ${result.note}`);
+      return failGraceful(`runtime tenant control ${stage} ${action}: ${result.category ?? "failed"} \u2014 ${result.note}`);
     }
   } catch (e) {
-    return failGraceful(`tenant control: ${e.message}`);
+    return failGraceful(`runtime tenant control: ${e.message}`);
   }
 });
-tenant.command("status <owner/repo> <stage>").description("read tenant runtime readiness without dispatching tenant-control: DEPLOY row, last deploy run, public URL probe, and TLS/Caddy/Cloudflare hints").action(async (repo, stage) => {
-  if (!["dev", "rc", "main"].includes(stage)) return fail("tenant status: <stage> must be dev, rc, or main");
-  const cfg = await loadConfig();
-  const result = await buildTenantRuntimeStatusFor(repo, stage, cfg);
-  console.log(JSON.stringify(result, null, 2));
-  if (result.publicProbe?.ok === false) process.exitCode = 1;
+tenant.command("reconcile <owner/repo> <stage>").description("re-render this tenant stage's generated box assets from registry truth; project-admin own dev/rc, master main; watches by default").option("--watch", "wait for the tenant-reconcile.yml run (default)").option("--no-watch", "return after dispatch; do not redeploy until the reconcile run succeeds").option("--json", "machine-readable output").action(async (repo, stage, o) => {
+  try {
+    const result = await runTenantReconcile(trainApplyDeps(), { repo, stage, watch: o.watch });
+    printLine(o.json ? JSON.stringify(result, null, 2) : `${result.note}${result.runUrl ? ` \u2014 ${result.runUrl}` : ""}`);
+    if (result.conclusion === "failure" || !result.dispatched) process.exitCode = 1;
+  } catch (e) {
+    return failGraceful(`runtime tenant reconcile: ${e.message}`);
+  }
 });
-tenant.command("readiness <owner/repo> <stage>").description("alias for tenant status: read-only tenant runtime readiness").action(async (repo, stage) => {
-  if (!["dev", "rc", "main"].includes(stage)) return fail("tenant readiness: <stage> must be dev, rc, or main");
+tenant.command("status <owner/repo> <stage>").description("read tenant runtime readiness without dispatching tenant-control: DEPLOY row, last deploy run, public URL probe, and TLS/Caddy/Cloudflare hints").action(async (repo, stage) => {
+  if (!["dev", "rc", "main"].includes(stage)) return fail("runtime tenant status: <stage> must be dev, rc, or main");
   const cfg = await loadConfig();
   const result = await buildTenantRuntimeStatusFor(repo, stage, cfg);
   console.log(JSON.stringify(result, null, 2));
   if (result.publicProbe?.ok === false) process.exitCode = 1;
 });
 tenant.command("redeploy <owner/repo> <stage>").description("re-dispatch the central tenant-deploy.yml for an already-promoted ref (no re-tag/merge); train-authority gated").option("--ref <ref>", "ref to deploy (defaults to the stage branch rc/main, or `development` for dev \u2014 the promoted/staging ref)").option("--watch", "block on the dispatched run and report its outcome (gh run watch --exit-status)").option("--json", "machine-readable output").action(async (repo, stage, o) => {
-  if (stage !== "dev" && stage !== "rc" && stage !== "main") return fail("tenant redeploy: <stage> must be dev, rc, or main");
+  if (stage !== "dev" && stage !== "rc" && stage !== "main") return fail("runtime tenant redeploy: <stage> must be dev, rc, or main");
   try {
     const result = await runTenantRedeploy(trainApplyDeps(), { repo, stage, ref: o.ref, watch: o.watch });
     return printLine(o.json ? JSON.stringify(result, null, 2) : renderTenantRedeploy(result));
   } catch (e) {
-    return failGraceful(`tenant redeploy: ${e.message}`);
+    return failGraceful(`runtime tenant redeploy: ${e.message}`);
   }
 });
 tenant.command("sweep-rc").description("discover (and optionally retire) running rc tenant runtimes across tenant-containers \u2014 orphan cleanup after a failed post-release retire (#942)").option("--retire", "retire every running rc runtime found (requires --yes) \u2014 WARNING: tears down a legitimately-staged rc too").option("--yes", "confirm the destructive --retire").option("--json", "machine-readable output").action(async (o) => {
   if (o.retire && !o.yes) {
-    return fail("tenant sweep-rc --retire is destructive (it tears down EVERY running rc, including one legitimately staged between /rcand and /release) \u2014 re-run with --yes to confirm");
+    return fail("runtime tenant sweep-rc --retire is destructive (it tears down EVERY running rc, including one legitimately staged between /rcand and /release) \u2014 re-run with --yes to confirm");
   }
   const cfg = await loadConfig();
   const cdeps = registryClientDeps(cfg);
@@ -23165,17 +23119,9 @@ tenant.command("sweep-rc").description("discover (and optionally retire) running
     }, { retire: !!o.retire });
     return printLine(o.json ? JSON.stringify(result) : renderSweep(result));
   } catch (e) {
-    return failGraceful(`tenant sweep-rc: ${e.message}`);
+    return failGraceful(`runtime tenant sweep-rc: ${e.message}`);
   }
 });
-async function resolveDnsBounded(host, timeoutMs = 3e3) {
-  const { lookup } = await import("node:dns/promises");
-  const probe = lookup(host).then(() => true).catch((e) => dnsErrorToResolution(e?.code));
-  const timeout = new Promise((resolve5) => {
-    setTimeout(() => resolve5(void 0), timeoutMs).unref?.();
-  });
-  return Promise.race([probe, timeout]);
-}
 async function probeHttpBounded2(url, timeoutMs = 5e3) {
   const controller = new AbortController();
   const timeout = setTimeout(() => controller.abort(), timeoutMs);
@@ -23206,75 +23152,14 @@ async function buildTenantRuntimeStatusFor(target, stage, cfg) {
     lastTenantDeployRun: (await fetchLastTenantDeployRun(slug, stage)).run
   });
 }
-async function v2ReadinessDeps(cfg) {
-  const reg = registryClientDeps(cfg);
-  return {
-    resolveDns: (host) => resolveDnsBounded(host),
-    // Checked read (#727/#733): the doctor distinguishes a FAILED read (degraded report) from a 404.
-    getProject: (slug) => fetchProjectBySlugChecked(slug, reg),
-    hasDeployCoords: async (slug, stage) => {
-      const status = await fetchDeployStatusBySlug(slug, reg);
-      return Boolean(status?.stages[stage]);
-    },
-    hasDeployState: async (slug, stage) => {
-      const status = await fetchDeployStatusBySlug(slug, reg);
-      return Boolean(status?.deployState[stage]);
-    },
-    getDeployFact: async (slug, stage) => {
-      const facts = await fetchDeployFactsBySlug(slug, reg);
-      const fact = facts?.stages[stage];
-      return fact ? { port: fact.port, domain: fact.domain } : null;
-    },
-    listSecrets: async (targetRepo2) => {
-      const apiUrl = cfg.sagaApiUrl;
-      if (!apiUrl) throw new Error("Hub API URL not configured \u2014 cannot verify secret names (set sagaApiUrl)");
-      const qs = new URLSearchParams({ repo: targetRepo2 }).toString();
-      const res = await fetchWithRetry(fetch, `${apiUrl.replace(/\/$/, "")}/secrets/list?${qs}`, {
-        method: "GET",
-        headers: await hubHeaders()
-      }, { attempts: 2, timeoutMs: 5e3 });
-      if (!res.ok) throw new Error(`secrets list failed for ${targetRepo2}: HTTP ${res.status}`);
-      const body = await res.json();
-      return (body.secrets ?? []).map((s) => s.key).filter(Boolean);
-    }
-  };
-}
-async function updateV2ReadinessIssue(repo, report, healed) {
-  const title = "v2 readiness: central deploy + secrets alignment";
-  const freshBody = renderReadinessIssueBody("", report, { healed });
-  const list = await execFileP2("gh", ["issue", "list", "--repo", repo, "--state", "open", "--search", "v2 readiness in:title", "--json", "number,title", "--limit", "20"], { timeout: 2e4 });
-  const issues = JSON.parse(list.stdout || "[]");
-  const existing = issues.find((i) => i.title.toLowerCase().includes("v2 readiness"));
-  if (!existing) {
-    const create = await bodyArgsViaFile(["issue", "create", "--repo", repo, "--title", title, "--body", freshBody, "--label", "feature"]);
-    try {
-      const created = await execFileP2("gh", create.args, { timeout: GH_MUTATION_TIMEOUT_MS });
-      const url = created.stdout.trim();
-      const number = Number(url.match(/\/issues\/(\d+)$/)?.[1] ?? 0);
-      return { number, url, action: "created" };
-    } finally {
-      await create.cleanup();
-    }
-  }
-  const view = await execFileP2("gh", ["issue", "view", String(existing.number), "--repo", repo, "--json", "body,url", "--jq", "{body:.body,url:.url}"], { timeout: 2e4 });
-  const current = JSON.parse(view.stdout || "{}");
-  const nextBody = renderReadinessIssueBody(current.body ?? "", report, { healed });
-  const edit = await bodyArgsViaFile(["issue", "edit", String(existing.number), "--repo", repo, "--body", nextBody]);
-  try {
-    await execFileP2("gh", edit.args, { timeout: GH_MUTATION_TIMEOUT_MS });
-  } finally {
-    await edit.cleanup();
-  }
-  return { number: existing.number, url: current.url ?? `https://github.com/${repo}/issues/${existing.number}`, action: "updated" };
-}
-var project = program2.command("project").description("the DDB org registry \u2014 list/get projects (any member); attest is project-admin; set is master-only");
+var project = program2.command("project").description("the DDB org registry \u2014 list/get projects (any member); set is master-only");
 async function projectTarget(commandName, explicitTarget) {
   return requireProjectTarget(commandName, explicitTarget, explicitTarget ? void 0 : await resolveRepo());
 }
 project.command("list").description("list all projects (identity + board, never deploy coords)").option("--json", "machine-readable output").action(async (o) => {
   const cfg = await loadConfig();
   const projects = await fetchProjectsList(registryClientDeps(cfg));
-  if (!projects) return failGraceful("project list: Hub API unreachable or this repo is not bootstrapped");
+  if (!projects) return failGraceful("org project list: Hub API unreachable or this repo is not bootstrapped");
   if (o.json) {
     console.log(JSON.stringify(projects));
     return;
@@ -23287,16 +23172,16 @@ project.command("get [owner/repo]").description("a project's META (board ids + p
   const cfg = await loadConfig();
   let target;
   try {
-    target = await projectTarget("project get", repoOrSlug);
+    target = await projectTarget("org project get", repoOrSlug);
   } catch (e) {
     return fail(e.message);
   }
   const read = await fetchProjectBySlugChecked(slugOf(target), registryClientDeps(cfg));
   if (!read.ok) {
-    return failGraceful(`project get: Hub registry read failed (${read.error}) \u2014 likely transient (cold start, network, or auth blip); retry shortly`);
+    return failGraceful(`org project get: Hub registry read failed (${read.error}) \u2014 likely transient (cold start, network, or auth blip); retry shortly`);
   }
   if (!read.project) {
-    return failGraceful(`project get: no registry META for ${target} (unknown or unbootstrapped)`);
+    return failGraceful(`org project get: no registry META for ${target} (unknown or unbootstrapped)`);
   }
   console.log(JSON.stringify(read.project));
   if (!o.json) {
@@ -23307,117 +23192,31 @@ project.command("get [owner/repo]").description("a project's META (board ids + p
     console.error(
       `${m.name ?? target} \xB7 class ${m.class ?? "?"} \xB7 deploy ${m.deployModel ?? "?"}
 release track: ${track} \u2014 stages: ${stages}${note}
-deploys run centrally (tenant-deploy.yml); product repos carry no deploy files. Deploy coords are OIDC-gated \u2014 see \`project resolve\`.`
+deploys run centrally (tenant-deploy.yml); product repos carry no deploy files. Inspect nonsecret DEPLOY facts with \`mmi-cli org project deploy get\`; full coords remain OIDC-gated.`
     );
   }
 });
-project.command("resolve <owner/repo>").description("deploy coords for a stage \u2014 for diagnosis. NOTE: /deploy-coords is OIDC-gated (a deploy job\u2019s id-token), so a gh-token CLI cannot read it from a dev machine").option("--stage <main|rc>", "deploy stage", "main").option("--json", "machine-readable output").action((_repoOrRepo, o) => {
-  const msg = "project resolve: deploy coords are served only to a deploy workflow (GitHub OIDC id-token, repo-scoped). A gh-token CLI on a dev machine cannot read /deploy-coords; inspect nonsecret DEPLOY facts with `mmi-cli project deploy get`. Full coords stay OIDC-gated.";
-  if (o.json) {
-    console.log(JSON.stringify({ ok: false, stage: o.stage, error: msg }));
-    process.exitCode = 1;
-    return;
-  }
-  fail(msg);
-});
 var projectDeploy = project.command("deploy").description("read nonsecret DEPLOY# facts (domain, port, deploy path, substrate, host presence)");
 projectDeploy.command("get [owner/repo]").description("read nonsecret DEPLOY# facts for one project; defaults to the current repo").option("--stage <stage>", "dev | rc | main").option("--json", "machine-readable output").action(async (repoOrSlug, o) => {
   const cfg = await loadConfig();
   let target;
   try {
-    target = await projectTarget("project deploy get", repoOrSlug);
-  } catch (e) {
-    return fail(e.message);
-  }
-  const out = await fetchDeployFactsBySlug(slugOf(target), registryClientDeps(cfg));
-  if (!out) return failGraceful(`project deploy get: Hub deploy facts read failed for ${target}`);
-  const stage = o.stage?.trim();
-  if (stage && !["dev", "rc", "main"].includes(stage)) return fail("project deploy get: --stage must be dev, rc, or main");
-  const payload = stage ? { slug: out.slug, stage, deploy: out.stages[stage] ?? null } : out;
-  console.log(JSON.stringify(payload));
-});
-projectDeploy.command("list [owner/repo]").description("alias for project deploy get; lists all stages by default").option("--stage <stage>", "dev | rc | main").option("--json", "machine-readable output").action(async (repoOrSlug, o) => {
-  const cfg = await loadConfig();
-  let target;
-  try {
-    target = await projectTarget("project deploy list", repoOrSlug);
+    target = await projectTarget("org project deploy get", repoOrSlug);
   } catch (e) {
     return fail(e.message);
   }
   const out = await fetchDeployFactsBySlug(slugOf(target), registryClientDeps(cfg));
-  if (!out) return failGraceful(`project deploy list: Hub deploy facts read failed for ${target}`);
+  if (!out) return failGraceful(`org project deploy get: Hub deploy facts read failed for ${target}`);
   const stage = o.stage?.trim();
-  if (stage && !["dev", "rc", "main"].includes(stage)) return fail("project deploy list: --stage must be dev, rc, or main");
+  if (stage && !["dev", "rc", "main"].includes(stage)) return fail("org project deploy get: --stage must be dev, rc, or main");
   const payload = stage ? { slug: out.slug, stage, deploy: out.stages[stage] ?? null } : out;
   console.log(JSON.stringify(payload));
 });
-project.command("doctor [owner/repo]").description("diagnose Hub v2 readiness for a repo without reading product repo files \u2014 appOwnedGaps are advisory templates; clear them with `project attest`; defaults to the current repo").option("--v2", "compatibility flag; v2 readiness is the default").option("--json", "machine-readable output").action(async (repo, _o) => {
+project.command("set [owner/repo]").description("upsert project META (idempotent merge; master-gated)").option("--class <class>", "deployable | content").option("--project-type <type>", `${PROJECT_TYPES.join(" | ")} (capability shape)`).option("--deploy-model <model>", `${DEPLOY_MODELS.join(" | ")} (release/deploy path; none means no Hub deploy registration)`).option("--release-track <track>", `${RELEASE_TRACKS.join(" | ")} (branch topology; direct skips rc)`).option("--var <KEY=VALUE...>", settableVarHelp()).option("--set <KEY=VALUE...>", "alias of --var (one KEY=VALUE per flag; repeat the flag to set several)").option("--secrets-file <path>", "read the #2244 secrets catalog map (JSON) from a file and merge it per entry into the existing catalog (clear all with --unset secrets)").option("--unset <KEY...>", "META field to remove (repeatable): oauth, requiredRuntimeSecrets, requiredBuildSecrets, secrets, edgeDomains, requiredGcpApis, publishRequired").option("--clear-web-profile", "remove web-only registry fields (oauth, edgeDomains) for non-web/content projects").option("--json", "machine-readable output").action(async (repoOrSlug, o) => {
   const cfg = await loadConfig();
   let target;
   try {
-    target = await projectTarget("project doctor", repo);
-  } catch (e) {
-    return fail(e.message);
-  }
-  const report = await buildV2Doctor(target, await v2ReadinessDeps(cfg));
-  console.log(JSON.stringify(report));
-  if (!report.ok) process.exitCode = 1;
-});
-project.command("heal [owner/repo]").description("repair Hub-owned v2 readiness state only; never product repo files; defaults to the current repo").option("--v2", "compatibility flag; v2 readiness is the default").option("--apply", "apply the Hub-owned registry patch").option("--json", "machine-readable output").action(async (repo, o) => {
-  const cfg = await loadConfig();
-  let target;
-  try {
-    target = await projectTarget("project heal", repo);
-  } catch (e) {
-    return fail(e.message);
-  }
-  const reg = registryClientDeps(cfg);
-  const out = await runV2Heal(target, { apply: o.apply }, {
-    fetchProject: (s) => fetchProjectBySlugChecked(s, reg),
-    upsertProject: (s, patch) => upsertProject(s, patch, reg)
-  });
-  if (out.status === "aborted") return failGraceful(`project heal: ${out.error}`);
-  if (out.status === "planned") {
-    console.log(JSON.stringify({ ok: true, slug: out.slug, dryRun: true, patch: out.patch, appOwnedGaps: out.appOwnedGaps }));
-    return;
-  }
-  if (out.status === "noop") {
-    console.log(JSON.stringify({ ok: true, slug: out.slug, applied: [], appOwnedGaps: out.appOwnedGaps }));
-    return;
-  }
-  if (out.status === "write-failed") return reportWrite("project heal", out.write);
-  console.log(JSON.stringify({ ok: true, slug: out.slug, applied: out.applied, appOwnedGaps: out.appOwnedGaps, result: out.result }));
-});
-project.command("readiness [owner/repo]").description("update the repo v2 readiness issue with Hub diagnosis and app-owned tasks; defaults to the current repo").option("--update-issue", "create/update the bounded v2 readiness issue section").option("--json", "machine-readable output").action(async (repo, o) => {
-  if (!o.updateIssue) return fail("project readiness: pass --update-issue");
-  const cfg = await loadConfig();
-  let target;
-  try {
-    target = await projectTarget("project readiness", repo);
-  } catch (e) {
-    return fail(e.message);
-  }
-  const report = await buildV2Doctor(target, await v2ReadinessDeps(cfg));
-  const issue2 = await updateV2ReadinessIssue(target, report, []);
-  console.log(JSON.stringify({ ok: true, repo: target, issue: issue2, ready: report.ok }));
-});
-project.command("attest [owner/repo]").description("attest this repo's app-owned v2 readiness work is done (project-admin of the repo or master) \u2014 clears doctor's static appOwnedGaps; re-running overwrites; defaults to the current repo").option("--json", "machine-readable output").action(async (repoOrSlug) => {
-  const cfg = await loadConfig();
-  let target;
-  try {
-    target = await projectTarget("project attest", repoOrSlug);
-  } catch (e) {
-    return fail(e.message);
-  }
-  const repo = target.includes("/") ? target : `mutmutco/${slugOf(target)}`;
-  const res = await attestAppGaps(slugOf(target), repo, registryClientDeps(cfg));
-  return reportWrite("project attest", res);
-});
-project.command("set [owner/repo]").description("upsert project META (idempotent merge; master-gated)").option("--class <class>", "deployable | content").option("--project-type <type>", `${PROJECT_TYPES.join(" | ")} (v2 capability shape)`).option("--deploy-model <model>", `${DEPLOY_MODELS.join(" | ")} (release/deploy path; none means no Hub deploy registration)`).option("--release-track <track>", `${RELEASE_TRACKS.join(" | ")} (branch topology; direct skips rc)`).option("--var <KEY=VALUE...>", settableVarHelp()).option("--set <KEY=VALUE...>", "alias of --var (one KEY=VALUE per flag; repeat the flag to set several)").option("--secrets-file <path>", "read the #2244 secrets catalog map (JSON) from a file and merge it per entry into the existing catalog (clear all with --unset secrets)").option("--unset <KEY...>", "META field to remove (repeatable): oauth, requiredRuntimeSecrets, requiredBuildSecrets, secrets, edgeDomains, requiredGcpApis, publishRequired").option("--clear-web-profile", "remove web-only registry fields (oauth, edgeDomains) for non-web/content projects").option("--json", "machine-readable output").action(async (repoOrSlug, o) => {
-  const cfg = await loadConfig();
-  let target;
-  try {
-    target = await projectTarget("project set", repoOrSlug);
+    target = await projectTarget("org project set", repoOrSlug);
   } catch (e) {
     return fail(e.message);
   }
@@ -23426,12 +23225,12 @@ project.command("set [owner/repo]").description("upsert project META (idempotent
   const setAlias = o.set ?? [];
   const vars = [...o.var ?? [], ...setAlias];
   const dupe = duplicateVarKeyAcrossFlags(o.var ?? [], setAlias);
-  if (dupe) return fail(`project set: KEY "${dupe}" was passed to both --var and --set; --set is an alias of --var, so pass each KEY once`);
+  if (dupe) return fail(`org project set: KEY "${dupe}" was passed to both --var and --set; --set is an alias of --var, so pass each KEY once`);
   if (o.secretsFile) {
     try {
       vars.push(`secrets=${(0, import_node_fs27.readFileSync)(o.secretsFile, "utf8")}`);
     } catch (e) {
-      return fail(`project set: cannot read --secrets-file ${o.secretsFile}: ${e.message}`);
+      return fail(`org project set: cannot read --secrets-file ${o.secretsFile}: ${e.message}`);
     }
   }
   let patch;
@@ -23446,19 +23245,19 @@ project.command("set [owner/repo]").description("upsert project META (idempotent
       clearWebProfile: Boolean(o.clearWebProfile)
     });
   } catch (e) {
-    return fail(e.message.replace(/^project set: /, "project set: "));
+    return fail(e.message.replace(/^org project set: /, "org project set: "));
   }
   const existing = await fetchProjectBySlug(slug, registryClientDeps(cfg));
   const boardError = boardLinkWriteError(patch, existing);
-  if (boardError) return fail(`project set: ${boardError}`);
+  if (boardError) return fail(`org project set: ${boardError}`);
   const res = await upsertProject(slug, { ...patch, repo }, registryClientDeps(cfg));
-  return reportWrite("project set", res);
+  return reportWrite("org project set", res);
 });
 project.command("retire [owner/repo]").description("retire an orphaned registry slug (master-only): soft-delete the PROJECT# META row + drop the repo's board items; secrets/vault left alone. DRY-RUN by default \u2014 pass --apply to actually delete; defaults to the current repo").option("--apply", "actually delete (default is a dry-run preview of what would be removed)").option("--skip-board", "retire the registry META only \u2014 leave board items in place").option("--json", "machine-readable {slug, removedMeta, removedBoardItem} output").action(async (repoOrSlug, o) => {
   const cfg = await loadConfig();
   let target;
   try {
-    target = await projectTarget("project retire", repoOrSlug);
+    target = await projectTarget("org project retire", repoOrSlug);
   } catch (e) {
     return fail(e.message);
   }
@@ -23484,7 +23283,7 @@ project.command("retire [owner/repo]").description("retire an orphaned registry
     printLine(JSON.stringify(structured));
   } else {
     const verb = result.applied ? "retired" : "WOULD retire (dry-run; pass --apply to delete)";
-    printLine(`project retire: ${verb} ${result.slug} (${result.repo})`);
+    printLine(`org project retire: ${verb} ${result.slug} (${result.repo})`);
     if (result.applied) {
       printLine(`  META: ${result.removedMeta.ok ? `removed=${result.removedMeta.removed ?? "unknown"}` : `FAILED \u2014 ${result.removedMeta.error}`}`);
     } else {
@@ -23499,10 +23298,10 @@ project.command("retire [owner/repo]").description("retire an orphaned registry
     printLine(`  ${result.vaultNote}`);
   }
   if (result.applied && !result.removedMeta.ok) {
-    return failGraceful(`project retire: META delete failed \u2014 ${result.removedMeta.error}`);
+    return failGraceful(`org project retire: META delete failed \u2014 ${result.removedMeta.error}`);
   }
 });
-var fullTrack = program2.command("full-track").description("direct-to-full-track readiness audits");
+var fullTrack = program2.command("full-track").description("direct-to-train readiness audits");
 fullTrack.command("readiness <owner/repo>").description("aggregate branch topology, train authority, deploy facts, endpoint health, and rcand readiness for direct -> full switches").option("--json", "machine-readable output").action(async (repo, _o) => {
   const cfg = await loadConfig();
   const reg = registryClientDeps(cfg);
@@ -23515,7 +23314,7 @@ fullTrack.command("readiness <owner/repo>").description("aggregate branch topolo
     buildTenantRuntimeStatusFor(repo, "rc", cfg),
     buildTenantRuntimeStatusFor(repo, "main", cfg)
   ]);
-  if (!metaRead.ok) return failGraceful(`full-track readiness: Hub registry read failed (${metaRead.error})`);
+  if (!metaRead.ok) return failGraceful(`train readiness: Hub registry read failed (${metaRead.error})`);
   const report = buildFullTrackReadinessReport({
     repo,
     slug,
@@ -23527,31 +23326,37 @@ fullTrack.command("readiness <owner/repo>").description("aggregate branch topolo
   console.log(JSON.stringify(report, null, 2));
   if (!report.rcand.canApply) process.exitCode = 1;
 });
-project.command("set-deploy [owner/repo]").description("patch the DEPLOY#<stage> Hetzner deploy coords for a tenant (master-only) \u2014 omitted flags keep their stored value; seeds a freshly-bootstrapped tenant; defaults to the current repo").requiredOption("--stage <stage>", "dev | rc | main").option("--ssh-host <host>", "the box address the deploy ssh-es into; omit to keep the stored value (required only for a NEW hetzner-ssh row \u2014 `mmi-cli box list` finds it)").option("--ssh-user <user>", "ssh user; omit to leave the row unchanged (default root on a new row)").option("--port <port>", "loopback port the container binds / Caddy upstream (1..65535); omit to leave the row unchanged").option("--substrate <substrate>", "hetzner-ssh; omit to leave the row unchanged").option("--deploy-path <path>", "on-box per-stage release root; omit to leave the row unchanged (default /opt/mmi/<slug>/<stage> on a new row)").option("--service <name>", "systemd/compose service name; omit to leave the row unchanged (default the slug on a new row)").option("--domain <domain>", "canonical serving host; omit to leave the row unchanged").option("--alias <domain...>", "extra serving hostname the box Caddy answers (repeatable); omit to leave the stored aliases unchanged").option("--clear-aliases", "remove EVERY serving alias from the row (#2986) \u2014 omitting --alias preserves them, so clearing needs saying out loud").option("--no-env-file <bool>", "set the DEPLOY# fileless flag (true|false) \u2014 true = #2662 env passthrough, no .env symlink; omit to leave the row unchanged").option("--force", "skip the #2748 fileless-compose guard (flip noEnvFile=true even if the stage branch compose still declares env_file:)").option("--json", "machine-readable output").action(async (repoOrSlug, o) => {
+project.command("set-deploy [owner/repo]").description("patch a tenant DEPLOY row \u2014 project-admin may set only --no-env-file on their own existing dev/rc row; master may seed/change all coords and main; defaults to the current repo").requiredOption("--stage <stage>", "dev | rc | main").option("--ssh-host <host>", "the box address the deploy ssh-es into; omit to keep the stored value (required only for a NEW hetzner-ssh row \u2014 `mmi-cli runtime box list` finds it)").option("--ssh-user <user>", "ssh user; omit to leave the row unchanged (default root on a new row)").option("--port <port>", "loopback port the container binds / Caddy upstream (1..65535); omit to leave the row unchanged").option("--substrate <substrate>", "hetzner-ssh; omit to leave the row unchanged").option("--deploy-path <path>", "on-box per-stage release root; omit to leave the row unchanged (default /opt/mmi/<slug>/<stage> on a new row)").option("--service <name>", "systemd/compose service name; omit to leave the row unchanged (default the slug on a new row)").option("--domain <domain>", "canonical serving host; omit to leave the row unchanged").option("--alias <domain...>", "extra serving hostname the box Caddy answers (repeatable); omit to leave the stored aliases unchanged").option("--clear-aliases", "remove EVERY serving alias from the row (#2986) \u2014 omitting --alias preserves them, so clearing needs saying out loud").option("--no-env-file <bool>", "set the DEPLOY# fileless flag (true|false) \u2014 own-repo project-admin dev/rc; master main; true = env passthrough with no .env symlink").option("--force", "explicit recovery override: skip fileless-compose verification only after independent proof").option("--json", "machine-readable output").action(async (repoOrSlug, o) => {
   const cfg = await loadConfig();
   let target;
   try {
-    target = await projectTarget("project set-deploy", repoOrSlug);
+    target = await projectTarget("org project set-deploy", repoOrSlug);
   } catch (e) {
     return fail(e.message);
   }
   let noEnvFile;
   if (typeof o.envFile === "string") {
     const v = o.envFile.trim().toLowerCase();
-    if (v !== "true" && v !== "false") return fail("project set-deploy: --no-env-file must be true or false");
+    if (v !== "true" && v !== "false") return fail("org project set-deploy: --no-env-file must be true or false");
     noEnvFile = v === "true";
   }
-  if (noEnvFile === true) {
+  if (noEnvFile !== void 0) {
     const branch = DEPLOY_STAGE_BRANCH[o.stage.trim().toLowerCase()];
     if (branch) {
       const cwdRepo = repoFromRemoteUrl(await gitOut(["remote", "get-url", "origin"]).catch(() => ""));
       const sameRepo = !repoOrSlug || Boolean(cwdRepo) && (repoOrSlug.includes("/") ? cwdRepo.toLowerCase() === target.toLowerCase() : slugOf(cwdRepo) === slugOf(target));
       if (sameRepo) {
-        const verdict = evaluateFilelessComposeGuard({ composeText: await readStageBranchCompose(branch), branch, force: Boolean(o.force) });
-        if (!verdict.ok) return fail(`project set-deploy: ${verdict.reason}`);
-        if (verdict.warn) console.error(`project set-deploy: ${verdict.warn}`);
+        const verdict = evaluateFilelessComposeGuard({ composeText: await readStageBranchCompose(branch), branch, force: Boolean(o.force), noEnvFile });
+        if (!verdict.ok) return fail(`org project set-deploy: ${verdict.reason}
+${filelessTransitionGuide(target, o.stage)}`);
+        if (verdict.warn) console.error(`org project set-deploy: ${verdict.warn}`);
+      } else if (!o.force) {
+        return fail(
+          `org project set-deploy: cannot verify ${target} ${branch} from this checkout \u2014 refusing to change noEnvFile. Run from the target repo with origin/${branch} fetched.
+${filelessTransitionGuide(target, o.stage)}`
+        );
       } else {
-        console.error(`project set-deploy: --no-env-file guard skipped \u2014 run from the ${target} checkout to verify the ${branch} branch compose (#2748).`);
+        console.error(`org project set-deploy: --force: skipping cross-repo fileless-compose verification for ${target} ${branch}.`);
       }
     }
   }
@@ -23571,17 +23376,18 @@ project.command("set-deploy [owner/repo]").description("patch the DEPLOY#<stage>
       clearAliases: o.clearAliases,
       noEnvFile
     });
+    if (target.includes("/")) body.repo = target;
   } catch (e) {
     return fail(e.message);
   }
   const res = await setDeployCoords(slug, body, registryClientDeps(cfg));
-  return reportWrite("project set-deploy", res);
+  return reportWrite("org project set-deploy", res);
 });
 var registry = program2.command("registry").description("the DDB org registry \u2014 org-level constants");
 registry.command("org").description("the org config (account id, region, orgProjectId, sagaApiUrl)").option("--json", "machine-readable output").action(async (_o) => {
   const cfg = await loadConfig();
   const org = await fetchOrgConfig(registryClientDeps(cfg));
-  if (!org) return failGraceful("registry org: Hub API unreachable, unseeded, or this repo is not bootstrapped");
+  if (!org) return failGraceful("org config get: Hub API unreachable, unseeded, or this repo is not bootstrapped");
   console.log(JSON.stringify(org));
 });
 var oauth = program2.command("oauth").description("per-repo Google OAuth \u2014 plan the canonical URI set, verify the client is port-agnostic");
@@ -23593,7 +23399,7 @@ oauth.command("plan", { isDefault: true }).description("print the canonical JS o
   try {
     oc = parseOauthConfig(meta ?? {}, slug);
   } catch (e) {
-    return failGraceful(`oauth plan: ${e.message}`);
+    return failGraceful(`org oauth plan: ${e.message}`);
   }
   const origins = expectedJsOrigins(oc);
   const redirects = expectedRedirectUris(oc);
@@ -23611,18 +23417,18 @@ oauth.command("plan", { isDefault: true }).description("print the canonical JS o
   console.log(`
 SSM cred params (under /mmi-future/${slug}/):`);
   ssm.forEach((k) => console.log(`  ${k}`));
-  console.log("\nProvision/repair the Console client per docs/Guides/oauth-provision.md; store creds with `mmi-cli oauth set-creds`.");
+  console.log("\nProvision/repair the Console client per docs/Guides/oauth-provision.md; store creds with `mmi-cli org oauth set-creds`.");
 });
 oauth.command("set-creds").description('store the OAuth client into the canonical stageless GOOGLE_CLIENT_ID/SECRET pair (pipe the Console "Download JSON" on stdin)').option("--repo <owner/repo>", "target repo (defaults to the current repo)").action(async (o) => {
   const raw = await readStdin();
   if (!raw.trim()) {
-    return fail("oauth set-creds: pipe the Google client JSON on stdin \u2014 e.g.\n  mmi-cli oauth set-creds --repo <owner/repo> < client.json");
+    return fail("org oauth set-creds: pipe the Google client JSON on stdin \u2014 e.g.\n  mmi-cli org oauth set-creds --repo <owner/repo> < client.json");
   }
   let creds;
   try {
     creds = parseOauthClientJson(raw);
   } catch (e) {
-    return fail(`oauth set-creds: ${e.message}`);
+    return fail(`org oauth set-creds: ${e.message}`);
   }
   await withSecrets(async (d) => {
     for (const key of oauthSsmKeys()) {
@@ -23632,7 +23438,7 @@ oauth.command("set-creds").description('store the OAuth client into the canonica
         return;
       }
     }
-    console.log(`OAuth client stored in the ${oauthSsmKeys().length} canonical stageless keys. Run \`mmi-cli oauth verify\` to confirm the client is port-agnostic.`);
+    console.log(`OAuth client stored in the ${oauthSsmKeys().length} canonical stageless keys. Run \`mmi-cli org oauth verify\` to confirm the client is port-agnostic.`);
   });
 });
 oauth.command("verify").description("probe Google authorize with an arbitrary port (:9123) to confirm the client is port-agnostic").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--client-id <id>", "OAuth client_id (else read the stageless GOOGLE_CLIENT_ID from SSM)").option("--json", "machine-readable output").action(async (o) => {
@@ -23643,7 +23449,7 @@ oauth.command("verify").description("probe Google authorize with an arbitrary po
   try {
     oc = parseOauthConfig(meta ?? {}, slug);
   } catch (e) {
-    return failGraceful(`oauth verify: ${e.message}`);
+    return failGraceful(`org oauth verify: ${e.message}`);
   }
   let clientId = o.clientId;
   if (!clientId) {
@@ -23652,7 +23458,7 @@ oauth.command("verify").description("probe Google authorize with an arbitrary po
     });
   }
   if (!clientId) {
-    return failGraceful("oauth verify: no client_id (pass --client-id, or provision the repo so GOOGLE_CLIENT_ID exists)");
+    return failGraceful("org oauth verify: no client_id (pass --client-id, or provision the repo so GOOGLE_CLIENT_ID exists)");
   }
   const redirectUri = probeRedirectUri(oc.callbackPath);
   let body = "";
@@ -23660,7 +23466,7 @@ oauth.command("verify").description("probe Google authorize with an arbitrary po
     const res = await fetch(buildAuthorizeProbeUrl(clientId, redirectUri), { redirect: "follow", signal: AbortSignal.timeout(1e4) });
     body = await res.text();
   } catch (e) {
-    return failGraceful(`oauth verify: probe request failed: ${e.message}`);
+    return failGraceful(`org oauth verify: probe request failed: ${e.message}`);
   }
   const mismatch = authorizeBodyHasMismatch(body);
   if (o.json) {
@@ -24418,6 +24224,12 @@ function trainApplyDeps() {
       const body = res.body;
       return { ok: false, category: body?.category, error: body?.error ?? res.error };
     },
+    dispatchTenantReconcile: async ({ repo, stage }) => {
+      const res = await tenantReconcile({ repo, stage }, registryClientDeps(await loadConfig()));
+      if (res.ok) return { ok: true };
+      const body = res.body;
+      return { ok: false, category: body?.category, error: body?.error ?? res.error };
+    },
     // Hotfix-coverage guard (#958): runs against the local clone via real git. manifestPaths exempts the
     // release version fold (#976) — a main-only commit touching ONLY the root package manifest is the
     // fold's version metadata, which the candidate replaces with its own. (The Hub's wider distribution
@@ -24479,7 +24291,7 @@ function renderTrainApply(commandName, r) {
   return r.announceNote ? `${base}; announce: ${r.announceNote}` : base;
 }
 function renderTenantRedeploy(r) {
-  return `mmi-cli tenant redeploy: ${r.repo} ${r.stage} (ref=${r.ref}) [${r.deployModel}]; ${renderDeployLine(r)}`;
+  return `mmi-cli runtime tenant redeploy: ${r.repo} ${r.stage} (ref=${r.ref}) [${r.deployModel}]; ${renderDeployLine(r)}`;
 }
 async function resolveRcandPlanTargets() {
   try {
@@ -24619,7 +24431,7 @@ var access = program2.command("access").description("org access audit (read-only
 access.command("role [repo]").description("D14 train authority for a repo (server-side Hub check): master | project-admin | developer").option("--json", "machine-readable output").action(async (repoArg) => {
   const o = { json: rawFlag("--json") };
   const repo = repoArg ?? await resolveRepo();
-  if (!repo) return fail("access role: pass <owner/repo> or run inside a repo checkout");
+  if (!repo) return fail("org access role: pass <owner/repo> or run inside a repo checkout");
   const cfg = await loadConfig();
   const verdict = await fetchTrainAuthority(repo, registryClientDeps(cfg));
   if (!verdict.ok) {
@@ -24628,7 +24440,7 @@ access.command("role [repo]").description("D14 train authority for a repo (serve
       process.exitCode = 1;
       return;
     }
-    return failGraceful(`access role: ${verdict.error}`);
+    return failGraceful(`org access role: ${verdict.error}`);
   }
   const a = verdict.authority;
   if (o.json) {
@@ -24646,7 +24458,7 @@ access.command("audit").description("audit collaborator roles + train-branch pus
   const cfg = await loadConfig();
   const registryProjects = await fetchProjectsList(registryClientDeps(cfg));
   if (o.repo) {
-    if (o.class !== "deployable" && o.class !== "content") return failGraceful("access audit: --class must be deployable or content");
+    if (o.class !== "deployable" && o.class !== "content") return failGraceful("org access audit: --class must be deployable or content");
     const meta = registryProjects?.find((project2) => (project2.repos ?? []).some((repo) => repo.toLowerCase() === o.repo.toLowerCase())) ?? null;
     const repoClass = o.class;
     targets = [{ repo: o.repo, class: repoClass, releaseTrack: repoClass === "content" ? "trunk" : resolveReleaseTrack(meta, void 0, o.repo) }];
@@ -24672,7 +24484,7 @@ access.command("audit").description("audit collaborator roles + train-branch pus
 });
 access.command("capabilities").description("enumerate your effective vault reach \u2014 every credential NAME + tier + scope you can read/use across project + org/master tiers (names only, no values) (#1615)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--json", "machine-readable output").action((o) => withSecrets((d) => secretsCapabilities(d, o)));
 var isWin2 = process.platform === "win32";
-program2.command("doctor").description("check onboarding gates and auto-heal CLI/plugin wiring; use --verbose for the full audit checklist").option("--banner", "one-line resume summary; silent when all gates pass").option("--fast", "offline-safe fast lane; skips slow checks and network probes").option("--preflight", "eager version/plugin heal with upfront notice when stale; silent when healthy (#1871)").option("--verbose", "print the evidence behind every check \u2014 probes, resolved paths, versions compared, and the names behind each count (#2977)").option("--ci", "stable CI output contract; no color, exit 0 for clear/advisory-only, 1 for hard gaps, 2 for doctor/tool failure").option("--guide", "print the MMI Agentic Onboarding guide URL").option("--json", "machine-readable output (read-only inspection \u2014 performs no repairs)").option("--apply", "perform the same auto-repairs as the interactive run (combine with --json for a machine-readable repair run)").option("--no-repo-writes", "env/plugin repairs only \u2014 never mutate the repo working tree; report pending managed .gitignore repairs with the follow-up command (for train preflights)").option("--self", "verify CLI/plugin version parity, PATH, gh auth scopes, and hook wiring (offline-safe; suggests plugin-heal on a hard gap) (#2689)").addHelpText("after", "\nExit codes:\n  0  no hard gaps remain; advisory gaps may exist\n  1  one or more included hard checks failed\n  2  doctor/tool execution failed before a normal verdict\n\n--banner keeps the legacy SessionStart contract and returns 0 unless the process crashes.\n").action(async (opts) => {
+program2.command("doctor").description("check onboarding gates and auto-heal CLI/plugin wiring; use --verbose for the full audit checklist").option("--banner", "one-line resume summary; silent when all gates pass").option("--fast", "offline-safe fast lane; skips slow checks and network probes").option("--preflight", "eager version/plugin-heal with upfront notice when stale; silent when healthy (#1871)").option("--verbose", "print the evidence behind every check \u2014 probes, resolved paths, versions compared, and the names behind each count (#2977)").option("--ci", "stable CI output contract; no color, exit 0 for clear/advisory-only, 1 for hard gaps, 2 for doctor/tool failure").option("--guide", "print the MMI Agentic Onboarding guide URL").option("--json", "machine-readable output (read-only inspection \u2014 performs no repairs)").option("--apply", "perform the same auto-repairs as the interactive run (combine with --json for a machine-readable repair run)").option("--no-repo-writes", "env/plugin repairs only \u2014 never mutate the repo working tree; report pending managed .gitignore repairs with the follow-up command (for train preflights)").option("--self", "verify CLI/plugin version parity, PATH, gh auth scopes, and hook wiring (offline-safe; suggests plugin-heal on a hard gap) (#2689)").addHelpText("after", "\nExit codes:\n  0  no hard gaps remain; advisory gaps may exist\n  1  one or more included hard checks failed\n  2  doctor/tool execution failed before a normal verdict\n\n--banner keeps the legacy SessionStart contract and returns 0 unless the process crashes.\n").action(async (opts) => {
   if (opts.guide) {
     consoleIo.log("MMI Agentic Onboarding: docs/Architecture/agentic-dev-environment.md");
     return;
@@ -24691,7 +24503,7 @@ program2.command("doctor").description("check onboarding gates and auto-heal CLI
     mmiDoctorDeps()
   );
 });
-program2.command("guard").description("detect a pruned/unresolved MMI plugin on disk; loud one-line stderr at session start").option("--session-start", "run in user-scope SessionStart mode").action((opts) => runGuard({ sessionStart: opts.sessionStart }));
+program2.command("guard").description("detect a pruned/unresolved MMI plugin on disk").action(() => runGuard());
 program2.command("plugin-heal").description("reinstall + re-enable the MMI plugin (recover from a marketplace prune)").action(() => runPluginHeal());
 function directoryBytes(path2) {
   let total = 0;
@@ -24702,11 +24514,11 @@ function directoryBytes(path2) {
     return 0;
   }
   for (const entry of entries) {
-    const child = (0, import_node_path23.join)(path2, entry.name);
-    if (entry.isDirectory()) total += directoryBytes(child);
+    const child2 = (0, import_node_path23.join)(path2, entry.name);
+    if (entry.isDirectory()) total += directoryBytes(child2);
     else {
       try {
-        total += (0, import_node_fs27.statSync)(child).size;
+        total += (0, import_node_fs27.statSync)(child2).size;
       } catch {
       }
     }
@@ -24773,7 +24585,7 @@ program2.command("plugin-prune").description(`prune stale cached MMI plugin vers
 });
 program2.command("session-start").description("run the SessionStart verbs (whoami, board slice, doctor) in one process").action(async () => {
   if (isInsideRepoSubdir(process.cwd())) {
-    console.error("[mmi-hook] session-start: cwd is a repository SUBDIRECTORY \u2014 skipping the SessionStart hook (spine/docs/plan/saga delivery); run it from the repo root.");
+    console.error("[mmi-hook] plugin session-start: cwd is a repository SUBDIRECTORY \u2014 skipping the SessionStart hook (spine/docs/plan/saga delivery); run it from the repo root.");
     appendHookActivity(process.cwd(), { event: "SessionStart", script: "session-start", outcome: "ran", action: "skip (repo subdirectory)" });
     return;
   }
@@ -24835,13 +24647,9 @@ program2.command("session-start").description("run the SessionStart verbs (whoam
   appendHookActivity(process.cwd(), { event: "SessionStart", script: "session-start", outcome: "ran", action: "session-start hook completed" });
 });
 installProcessBackstop();
-program2.command("lane", { hidden: true }).action(() => {
-  fail("lane orchestration lives in jerv-cli \u2014 try: jerv-cli lane --help");
-});
-program2.command("fusion", { hidden: true }).action(() => {
-  fail("fusion orchestration lives in jerv-cli \u2014 try: jerv-cli fusion --help");
-});
-program2.parseAsync().then(() => finishCliRun()).catch((e) => failGraceful(e.message));
+consolidateCommandNamespaces(program2);
+applyCommandTaxonomy(program2);
+program2.parseAsync(process.argv).then(() => finishCliRun()).catch((e) => failGraceful(e.message));
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   DEFAULT_PRIORITY,