@mutmutco/cli 3.34.0 → 3.35.0

package/dist/main.cjs

@@ -3408,8 +3408,8 @@ function useColor() {
 var program = new Command();
 
 // src/index.ts
-var import_promises6 = require("node:fs/promises");
-var import_node_fs27 = require("node:fs");
+var import_promises7 = require("node:fs/promises");
+var import_node_fs28 = require("node:fs");
 var import_node_child_process12 = require("node:child_process");
 
 // src/cli-shared.ts
@@ -4475,7 +4475,7 @@ function trackedPathStatus(c, realPath, repoAnchor) {
     return null;
   }
 }
-function rootScratchDirSnapshot(root, readdir, stat2) {
+function rootScratchDirSnapshot(root, readdir2, stat2) {
   try {
     const rootStat = stat2(root);
     let mtimeMs = rootStat.mtimeMs;
@@ -4483,7 +4483,7 @@ function rootScratchDirSnapshot(root, readdir, stat2) {
     const stack = [root];
     while (stack.length) {
       const current = stack.pop();
-      for (const ent of readdir(current, { withFileTypes: true })) {
+      for (const ent of readdir2(current, { withFileTypes: true })) {
         const child2 = (0, import_node_path4.join)(current, ent.name);
         if (ent.isSymbolicLink?.()) return null;
         try {
@@ -4503,13 +4503,13 @@ function rootScratchDirSnapshot(root, readdir, stat2) {
   }
 }
 function collectScratchSnapshot(repoRoot2, deps = {}) {
-  const readdir = deps.readdir ?? import_node_fs6.readdirSync;
+  const readdir2 = deps.readdir ?? import_node_fs6.readdirSync;
   const stat2 = deps.stat ?? import_node_fs6.statSync;
-  const readFile5 = deps.readFile ?? import_node_fs6.readFileSync;
+  const readFile6 = deps.readFile ?? import_node_fs6.readFileSync;
   const plansRoot = (0, import_node_path4.join)(repoRoot2, "plans");
   const rootScratchFiles = [];
   try {
-    for (const ent of readdir(repoRoot2, { withFileTypes: true })) {
+    for (const ent of readdir2(repoRoot2, { withFileTypes: true })) {
       const isDir = ent.isDirectory();
       const isFile = ent.isFile();
       if (!(isDir && ROOT_SCRATCH_DIRS.has(ent.name)) && !(isFile && ROOT_SCRATCH_FILE_PREFIXES.some((prefix) => ent.name.startsWith(prefix)))) {
@@ -4518,7 +4518,7 @@ function collectScratchSnapshot(repoRoot2, deps = {}) {
       const full = (0, import_node_path4.join)(repoRoot2, ent.name);
       try {
         if (isDir) {
-          const snap = rootScratchDirSnapshot(full, readdir, stat2);
+          const snap = rootScratchDirSnapshot(full, readdir2, stat2);
           if (snap) rootScratchFiles.push({ path: full, dir: repoRoot2, name: ent.name, mtimeMs: snap.mtimeMs, bytes: snap.bytes, kind: "dir" });
         } else {
           const st = stat2(full);
@@ -4531,12 +4531,12 @@ function collectScratchSnapshot(repoRoot2, deps = {}) {
   }
   const planMdFiles = [];
   try {
-    for (const ent of readdir(plansRoot, { withFileTypes: true })) {
+    for (const ent of readdir2(plansRoot, { withFileTypes: true })) {
       if (!ent.isFile() || !ent.name.endsWith(".md")) continue;
       const full = (0, import_node_path4.join)(plansRoot, ent.name);
       try {
         const st = stat2(full);
-        const raw = readFile5(full, "utf8");
+        const raw = readFile6(full, "utf8");
         planMdFiles.push({ path: full, dir: plansRoot, name: ent.name, mtimeMs: st.mtimeMs, bytes: st.size, kind: "file", hash: hashContent(normalizeEol(raw)) });
       } catch {
       }
@@ -4545,7 +4545,7 @@ function collectScratchSnapshot(repoRoot2, deps = {}) {
   }
   let planMeta = {};
   try {
-    planMeta = parseMeta(readFile5((0, import_node_path4.join)(plansRoot, ".plan-meta.json"), "utf8"));
+    planMeta = parseMeta(readFile6((0, import_node_path4.join)(plansRoot, ".plan-meta.json"), "utf8"));
   } catch {
     planMeta = {};
   }
@@ -4553,7 +4553,7 @@ function collectScratchSnapshot(repoRoot2, deps = {}) {
   const syncQueueSlugs = (() => {
     let queueRaw;
     try {
-      queueRaw = readFile5((0, import_node_path4.join)(plansRoot, ".sync-queue.json"), "utf8");
+      queueRaw = readFile6((0, import_node_path4.join)(plansRoot, ".sync-queue.json"), "utf8");
     } catch (e) {
       const code = typeof e === "object" && e && "code" in e ? String(e.code ?? "") : "";
       return code === "ENOENT" || code === "ENOTDIR" ? /* @__PURE__ */ new Set() : null;
@@ -5062,7 +5062,7 @@ async function fetchOrgConfig(deps) {
   }
 }
 async function postJson(pathSuffix, payload, deps, method = "POST", opts = {}) {
-  if (!deps.baseUrl) return { ok: false, status: 0, body: null, error: "no Hub API URL (set MMI_HUB_URL or use a current MMI CLI/plugin build)" };
+  if (!deps.baseUrl) return { ok: false, status: 0, body: null, error: "no Hub API URL (set MMI_HUB_URL or use a current MMI CLI/plugin build)", unreachable: "no-base-url" };
   const token = await deps.token();
   if (!token) return { ok: false, status: 0, body: null, error: "no Hub session token (run `gh auth login`)" };
   const timeoutMs = opts.timeoutMs ?? deps.timeoutMs ?? REGISTRY_FETCH_TIMEOUT_MS;
@@ -5081,7 +5081,7 @@ async function postJson(pathSuffix, payload, deps, method = "POST", opts = {}) {
     }
     return { ok: res.ok, status: res.status, body };
   } catch (e) {
-    return { ok: false, status: 0, body: null, error: e.message };
+    return { ok: false, status: 0, body: null, error: e.message, unreachable: "transport" };
   }
 }
 async function registerProject(payload, deps) {
@@ -5099,6 +5099,11 @@ async function setDeployCoords(slug, payload, deps) {
 async function recordDocsAudit(verdict, deps) {
   return postJson("/docs-audit/record", { ...verdict }, deps);
 }
+async function postSchedulesLift(repo, schedules, deps) {
+  const res = await postJson("/schedules/lift", { repo, schedules }, deps);
+  if (!res.ok && res.status === 404) return { ...res, unreachable: "route-absent" };
+  return res;
+}
 async function tenantControl(payload, deps) {
   return postJson("/tenant-control", payload, deps, "POST", { noRetry: true });
 }
@@ -9025,7 +9030,7 @@ function commandLadderHint() {
 }
 
 // src/index.ts
-var import_node_path23 = require("node:path");
+var import_node_path25 = require("node:path");
 
 // src/merge-ci-policy.ts
 function resolveMergeCiPolicy(input) {
@@ -9315,6 +9320,27 @@ function workflowTriggersPullRequest(yaml) {
   if (!onBlock) return false;
   return /\bpull_request\b/.test(onBlock);
 }
+function workflowTriggersSchedule(yaml) {
+  const onBlock = extractOnBlock(yaml);
+  if (!onBlock) return false;
+  if (/^(["']?)on\1:/.test(onBlock)) {
+    const value = onBlock.replace(/^(["']?)on\1:\s*/, "");
+    if (/^\s*\[/.test(value)) {
+      return /(^|[,\s\[])["']?schedule["']?([,\s\]]|$)/.test(value);
+    }
+    return /\bschedule["']?\s*:/.test(value);
+  }
+  const content = onBlock.split(/\r?\n/).filter((l) => {
+    const t = l.trim();
+    return t.length > 0 && !t.startsWith("#");
+  });
+  if (!content.length) return false;
+  const minIndent = Math.min(...content.map((l) => l.match(/^(\s*)/)?.[1].length ?? 0));
+  return content.some((line) => {
+    const indent = line.match(/^(\s*)/)?.[1].length ?? 0;
+    return indent === minIndent && /^\s*schedule\s*:/.test(line);
+  });
+}
 function workflowReportsPrChecks(yaml) {
   const onBlock = extractOnBlock(yaml);
   if (!onBlock) return false;
@@ -9330,6 +9356,9 @@ function extractOnBlock(yaml) {
       if (/^(["']?)on\1:\s*$/.test(line)) {
         inOn = true;
         onIndent = 0;
+      } else if (/^(["']?)on\1:\s+#/.test(line)) {
+        inOn = true;
+        onIndent = 0;
       } else if (/^(["']?)on\1:\s+\S/.test(line)) {
         return line;
       }
@@ -9476,6 +9505,63 @@ function planManagedGitignore(current) {
   return { changed, content, added, removed };
 }
 
+// src/gate-budget.ts
+var BLESSED_RUN_WITH_BUDGET_SHA = "b6ec6e4eafcda73b543fc0754a6356551fe762a1";
+var REMOTE_USE = /^mutmutco\/MMI-Hub\/\.github\/actions\/run-with-budget@(\S+)$/;
+var LOCAL_USE = "./.github/actions/run-with-budget";
+var FULL_SHA = /^[0-9a-f]{40}$/;
+var MAX_SECONDS_CEILING = 1800;
+function isGateWorkflowPath(path2) {
+  const base = path2.split(/[/\\]/).pop() ?? path2;
+  return /^(?:.+[-_.])?gate\.ya?ml$/i.test(base);
+}
+function checkGateBudget(files, opts = {}) {
+  const failures = [];
+  const notes = [];
+  for (const { path: path2, body } of files) {
+    const uses = [...body.matchAll(/^\s*-?\s*uses:\s*(\S+)/gm)].map((m) => m[1].replace(/^['"]|['"]$/g, "")).filter((ref) => ref.includes("run-with-budget"));
+    if (uses.length === 0) {
+      failures.push(`${path2}: check command does not run via run-with-budget \u2014 the gate has no wall-clock ceiling`);
+      continue;
+    }
+    for (const ref of uses) {
+      if (ref === LOCAL_USE) {
+        if (!opts.hubLocalAllowed) {
+          failures.push(`${path2}: local ${LOCAL_USE} reference \u2014 consume the org-shared action pinned by SHA (mutmutco/MMI-Hub/.github/actions/run-with-budget@<full sha>)`);
+        }
+        continue;
+      }
+      const remote = REMOTE_USE.exec(ref);
+      if (!remote) {
+        failures.push(`${path2}: unrecognized run-with-budget reference '${ref}' \u2014 use mutmutco/MMI-Hub/.github/actions/run-with-budget@<full sha>`);
+        continue;
+      }
+      if (!FULL_SHA.test(remote[1])) {
+        failures.push(`${path2}: run-with-budget pinned to '${remote[1]}' \u2014 pin the full 40-hex commit SHA, not a branch or tag`);
+        continue;
+      }
+      if (remote[1] !== BLESSED_RUN_WITH_BUDGET_SHA) {
+        notes.push(`${path2}: run-with-budget pinned to ${remote[1].slice(0, 12)} (blessed ${BLESSED_RUN_WITH_BUDGET_SHA.slice(0, 12)}) \u2014 valid but outdated`);
+      }
+    }
+    const ceilingLines = [...body.matchAll(/^\s*max-seconds:\s*(.+?)\s*$/gm)].map((m) => m[1].replace(/\s+#.*$/, ""));
+    if (ceilingLines.length === 0) {
+      failures.push(`${path2}: run-with-budget has no max-seconds input \u2014 the budget step guards nothing`);
+      continue;
+    }
+    for (const raw of ceilingLines) {
+      const literal = /^['"]?(\d+)['"]?$/.exec(raw);
+      const seconds = literal ? Number(literal[1]) : NaN;
+      if (!literal || seconds < 1) {
+        failures.push(`${path2}: max-seconds '${raw}' is not a literal positive integer`);
+      } else if (seconds > MAX_SECONDS_CEILING) {
+        failures.push(`${path2}: max-seconds ${seconds} exceeds the org ceiling ${MAX_SECONDS_CEILING} \u2014 a budget that generous guards nothing; measure the gate and set a real ceiling`);
+      }
+    }
+  }
+  return { ok: failures.length === 0, failures, notes };
+}
+
 // src/bootstrap-apply.ts
 function parseOwnerRepo(repo) {
   const trimmed = repo.trim();
@@ -9489,6 +9575,7 @@ function parseOwnerRepo(repo) {
   return { owner, name, slug: name.toLowerCase(), fullName: `${owner}/${name}` };
 }
 var DEFAULT_GATE_CMD = "npm run check";
+var DEFAULT_GATE_MAX_SECONDS = "300";
 var DEFAULT_GATE_PY_VERSION = "3.11";
 var GATE_RUNTIME_DEFAULTS = {
   node: { cmd: DEFAULT_GATE_CMD, install: "npm ci" },
@@ -9502,7 +9589,10 @@ function gateSeedVars(cls, releaseTrack, runtime = "node") {
     GATE_INSTALL_CMD: rt.install,
     GATE_WORKDIR: ".",
     GATE_CACHE_DEP_PATH: "package-lock.json",
-    GATE_PY_VERSION: DEFAULT_GATE_PY_VERSION
+    GATE_PY_VERSION: DEFAULT_GATE_PY_VERSION,
+    GATE_MAX_SECONDS: DEFAULT_GATE_MAX_SECONDS,
+    // The pin is the CLI's blessed SHA, not an operator knob — one central place to bump (#3178).
+    GATE_BUDGET_SHA: BLESSED_RUN_WITH_BUDGET_SHA
   };
   const track = releaseTrack ?? (cls === "content" ? "trunk" : "full");
   if (track === "trunk") {
@@ -9548,6 +9638,8 @@ function gateConfigToVars(gate) {
   if (typeof gate.workdir === "string" && gate.workdir.trim()) out.GATE_WORKDIR = gate.workdir;
   if (typeof gate.cacheDepPath === "string" && gate.cacheDepPath.trim()) out.GATE_CACHE_DEP_PATH = gate.cacheDepPath;
   if (typeof gate.pyVersion === "string" && gate.pyVersion.trim()) out.GATE_PY_VERSION = gate.pyVersion;
+  const seconds = typeof gate.maxSeconds === "number" ? String(gate.maxSeconds) : gate.maxSeconds;
+  if (typeof seconds === "string" && /^\d+$/.test(seconds.trim()) && Number(seconds) > 0) out.GATE_MAX_SECONDS = seconds.trim();
   return out;
 }
 function seedMatchesDeployModel(seed, deployModel) {
@@ -9609,10 +9701,10 @@ function labelsToPrune(orgLabelNames) {
   const org = new Set(orgLabelNames);
   return GITHUB_DEFAULT_LABELS.filter((name) => !org.has(name));
 }
-function resolveSeedContent(seed, vars, readFile5) {
-  if (seed.source === "self") return readFile5(seed.target);
+function resolveSeedContent(seed, vars, readFile6) {
+  if (seed.source === "self") return readFile6(seed.target);
   if (seed.source.startsWith("seed:")) {
-    const tmpl = readFile5(`skills/bootstrap/seeds/${seed.source.slice("seed:".length)}`);
+    const tmpl = readFile6(`skills/bootstrap/seeds/${seed.source.slice("seed:".length)}`);
     return tmpl == null ? null : renderSeed(tmpl, vars);
   }
   return null;
@@ -10028,11 +10120,22 @@ async function auditRepoCi(repo, deps) {
     const allPaths = await listWorkflowPaths(deps, repo, baseBranch) ?? [];
     const prPaths = await filterPullRequestTriggered(deps, repo, baseBranch, allPaths);
     const missing = [];
+    const gateBodies = [];
     for (const path2 of prPaths) {
       const body = await fetchFileContent(deps, repo, baseBranch, path2);
       if (body == null) continue;
+      if (isGateWorkflowPath(path2)) gateBodies.push({ path: path2, body });
       if (!/^\s*concurrency:/m.test(body) || !/cancel-in-progress:\s*true/.test(body)) missing.push(path2);
     }
+    if (gateBodies.length > 0) {
+      const budget = checkGateBudget(gateBodies, { hubLocalAllowed: repoClass === "hub" });
+      checks.push({
+        ok: budget.ok,
+        label: "gate runs under the org wall-clock budget (#3178)",
+        detail: [...budget.failures, ...budget.notes].join("; ") || void 0,
+        remediation: budget.ok ? void 0 : `Wrap the gate's check command in mutmutco/MMI-Hub/.github/actions/run-with-budget@${BLESSED_RUN_WITH_BUDGET_SHA} with a measured max-seconds \u2014 see skills/bootstrap/seeds/gate.template.yml`
+      });
+    }
     if (prPaths.length > 0) {
       checks.push({
         ok: missing.length === 0,
@@ -12338,6 +12441,8 @@ function parseVerifyBroker(stdout) {
 }
 
 // src/train-apply.ts
+var import_node_fs16 = require("node:fs");
+var import_node_path14 = require("node:path");
 function resolveDeployModel2(meta, repo) {
   const m = meta?.deployModel;
   if (isDeployModel(m)) return m;
@@ -13181,6 +13286,34 @@ async function dispatchDeploy(deps, ctx, stage, ref, model, watch, autoRunSince,
   }
   return { note: `no manual dispatch: ${model} repo deploys via its own push-triggered workflow`, deployStatus: "pending" };
 }
+function readLocalGateWorkflows() {
+  const dir = (0, import_node_path14.join)(".github", "workflows");
+  let names;
+  try {
+    names = (0, import_node_fs16.readdirSync)(dir);
+  } catch {
+    return null;
+  }
+  const files = [];
+  for (const name of names.filter(isGateWorkflowPath)) {
+    try {
+      files.push({ path: `${dir}/${name}`.replace(/\\/g, "/"), body: (0, import_node_fs16.readFileSync)((0, import_node_path14.join)(dir, name), "utf8") });
+    } catch {
+    }
+  }
+  return files;
+}
+function enforceGateBudget(deps, repo) {
+  const files = (deps.readGateWorkflows ?? readLocalGateWorkflows)();
+  if (files == null || files.length === 0) return;
+  const budget = checkGateBudget(files, { hubLocalAllowed: repo.toLowerCase() === "mutmutco/mmi-hub" });
+  for (const note of budget.notes) deps.warn?.(`gate budget: ${note}`);
+  if (!budget.ok) {
+    throw new Error(
+      `release refused \u2014 the gate runs without the org wall-clock budget (#3178): ${budget.failures.join("; ")}. Wrap the check command in the pinned run-with-budget step (see skills/bootstrap/seeds/gate.template.yml in MMI-Hub), or run \`mmi-cli ci audit --repo ${repo}\` for the full picture.`
+    );
+  }
+}
 async function preflight(deps, ctx, stage, meta) {
   const model = resolveDeployModel2(meta, ctx.repo);
   if (model === "content") {
@@ -13190,6 +13323,7 @@ async function preflight(deps, ctx, stage, meta) {
     throw new Error(`${ctx.repo} is not Hub-deployed (deployModel=none) \u2014 the release train does not apply; use the project's own release path`);
   }
   await deps.runSelf(["secrets", "preflight", "--stage", stage, "--repo", ctx.repo]);
+  enforceGateBudget(deps, ctx.repo);
   return model;
 }
 async function preflightMergeToMain(deps, deployModel, remoteRef, blockingPrefix, realignMessage) {
@@ -15030,8 +15164,8 @@ function renderAccessReport(report) {
 }
 
 // src/docs-index-command.ts
-var import_node_fs16 = require("node:fs");
-var import_node_path14 = require("node:path");
+var import_node_fs17 = require("node:fs");
+var import_node_path15 = require("node:path");
 var DOCS_INDEX_PATH = "docs/index.md";
 function isRoutableDocsPath(relPath) {
   const normalized = relPath.replace(/\\/g, "/");
@@ -15109,25 +15243,25 @@ function walkMarkdown(dir) {
   const stack = [dir];
   while (stack.length) {
     const current = stack.pop();
-    for (const entry of (0, import_node_fs16.readdirSync)(current, { withFileTypes: true })) {
-      const full = (0, import_node_path14.join)(current, entry.name);
+    for (const entry of (0, import_node_fs17.readdirSync)(current, { withFileTypes: true })) {
+      const full = (0, import_node_path15.join)(current, entry.name);
       if (entry.isDirectory()) {
         stack.push(full);
       } else if (entry.isFile() && entry.name.endsWith(".md")) {
-        out.push((0, import_node_path14.relative)(dir, full).split(import_node_path14.sep).join("/"));
+        out.push((0, import_node_path15.relative)(dir, full).split(import_node_path15.sep).join("/"));
       }
     }
   }
   return out;
 }
 function createDocsIndexDeps(repoRoot2) {
-  const docsDir = (0, import_node_path14.join)(repoRoot2, "docs");
-  const indexPath = (0, import_node_path14.join)(repoRoot2, DOCS_INDEX_PATH);
+  const docsDir = (0, import_node_path15.join)(repoRoot2, "docs");
+  const indexPath = (0, import_node_path15.join)(repoRoot2, DOCS_INDEX_PATH);
   return {
-    listDocs: () => (0, import_node_fs16.existsSync)(docsDir) ? walkMarkdown(docsDir).filter(isRoutableDocsPath).sort() : [],
-    readDoc: (relPath) => (0, import_node_fs16.readFileSync)((0, import_node_path14.join)(docsDir, relPath), "utf8"),
-    readIndex: () => (0, import_node_fs16.existsSync)(indexPath) ? (0, import_node_fs16.readFileSync)(indexPath, "utf8") : null,
-    writeIndex: (content) => (0, import_node_fs16.writeFileSync)(indexPath, content, "utf8")
+    listDocs: () => (0, import_node_fs17.existsSync)(docsDir) ? walkMarkdown(docsDir).filter(isRoutableDocsPath).sort() : [],
+    readDoc: (relPath) => (0, import_node_fs17.readFileSync)((0, import_node_path15.join)(docsDir, relPath), "utf8"),
+    readIndex: () => (0, import_node_fs17.existsSync)(indexPath) ? (0, import_node_fs17.readFileSync)(indexPath, "utf8") : null,
+    writeIndex: (content) => (0, import_node_fs17.writeFileSync)(indexPath, content, "utf8")
   };
 }
 
@@ -16054,8 +16188,8 @@ function writeError(res) {
 }
 
 // src/secrets-commands.ts
-var import_node_fs17 = require("node:fs");
-var import_node_path15 = require("node:path");
+var import_node_fs18 = require("node:fs");
+var import_node_path16 = require("node:path");
 var import_node_os5 = require("node:os");
 
 // src/project-runtime.ts
@@ -16179,18 +16313,18 @@ function collectMap(value, previous = []) {
   return [...previous, value];
 }
 async function decryptRailsCredentials(input) {
-  const appDir = (0, import_node_path15.resolve)(input.appDir ?? process.cwd());
+  const appDir = (0, import_node_path16.resolve)(input.appDir ?? process.cwd());
   const credentialsFile = input.credentialsFile ?? DEFAULT_RAILS_CREDENTIALS_FILE;
   const masterKeyFile = input.masterKeyFile ?? DEFAULT_RAILS_MASTER_KEY_FILE;
-  const credentialsPath = (0, import_node_path15.resolve)(appDir, credentialsFile);
-  const masterKeyPath = (0, import_node_path15.resolve)(appDir, masterKeyFile);
+  const credentialsPath = (0, import_node_path16.resolve)(appDir, credentialsFile);
+  const masterKeyPath = (0, import_node_path16.resolve)(appDir, masterKeyFile);
   const env = {
     ...process.env,
     MMI_RAILS_CREDENTIALS_FILE: credentialsPath,
     MMI_RAILS_MASTER_KEY_FILE: masterKeyPath
   };
-  if ((0, import_node_fs17.existsSync)(masterKeyPath)) {
-    env.RAILS_MASTER_KEY = (0, import_node_fs17.readFileSync)(masterKeyPath, "utf8").trim();
+  if ((0, import_node_fs18.existsSync)(masterKeyPath)) {
+    env.RAILS_MASTER_KEY = (0, import_node_fs18.readFileSync)(masterKeyPath, "utf8").trim();
   }
   const script = [
     'require "json"',
@@ -16200,9 +16334,9 @@ async function decryptRailsCredentials(input) {
     'config = ActiveSupport::EncryptedConfiguration.new(config_path: config_path, key_path: key_path, env_key: "RAILS_MASTER_KEY", raise_if_missing_key: true)',
     "puts JSON.generate(config.config)"
   ].join("\n");
-  const scriptDir = (0, import_node_fs17.mkdtempSync)((0, import_node_path15.join)((0, import_node_os5.tmpdir)(), "mmi-rails-decrypt-"));
-  const scriptPath = (0, import_node_path15.join)(scriptDir, "decrypt.rb");
-  (0, import_node_fs17.writeFileSync)(scriptPath, script, "utf8");
+  const scriptDir = (0, import_node_fs18.mkdtempSync)((0, import_node_path16.join)((0, import_node_os5.tmpdir)(), "mmi-rails-decrypt-"));
+  const scriptPath = (0, import_node_path16.join)(scriptDir, "decrypt.rb");
+  (0, import_node_fs18.writeFileSync)(scriptPath, script, "utf8");
   try {
     const args = ["exec", "ruby", scriptPath];
     const cmd = process.platform === "win32" ? "cmd.exe" : "bundle";
@@ -16214,7 +16348,7 @@ async function decryptRailsCredentials(input) {
     });
     return JSON.parse(stdout);
   } finally {
-    (0, import_node_fs17.rmSync)(scriptDir, { recursive: true, force: true });
+    (0, import_node_fs18.rmSync)(scriptDir, { recursive: true, force: true });
   }
 }
 async function readSecretStdin() {
@@ -16289,7 +16423,7 @@ function registerSecretsCommands(program3) {
   secrets.command("org-catalog").description("MASTER-ONLY: set the _org/<provider>/* catalog declarations from a JSON file (#2244)").requiredOption("--file <path>", 'JSON file: { "entries": { "<provider>/<KEY>": {key,purpose,group,owner,provider,stages[],consumers[]} } }').action((o) => withSecrets(async (d) => {
     let body;
     try {
-      body = (0, import_node_fs17.readFileSync)((0, import_node_path15.resolve)(o.file), "utf8");
+      body = (0, import_node_fs18.readFileSync)((0, import_node_path16.resolve)(o.file), "utf8");
     } catch (e) {
       return fail(`secrets org-catalog: cannot read --file ${o.file}: ${e.message}`);
     }
@@ -16392,7 +16526,7 @@ function registerSecretsCommands(program3) {
       {
         ...d,
         decryptRailsCredentials,
-        removeFile: (path2) => (0, import_node_fs17.unlinkSync)((0, import_node_path15.resolve)(o.appDir ?? process.cwd(), path2))
+        removeFile: (path2) => (0, import_node_fs18.unlinkSync)((0, import_node_path16.resolve)(o.appDir ?? process.cwd(), path2))
       },
       {
         repo: o.repo,
@@ -16911,6 +17045,10 @@ function spliceDoc(docText, generatedSection) {
   }
   return docText.slice(0, start) + generatedSection + docText.slice(end + DOC_END_MARKER.length);
 }
+var HARBOUR_LLM_LAUNCHERS = /* @__PURE__ */ new Set(["cursor-agent"]);
+function isHarbourLlmLauncher(executor) {
+  return HARBOUR_LLM_LAUNCHERS.has(executor);
+}
 function splitCadence(cadence) {
   return cadence.split("+").map((c) => c.replace(/\s+/g, " ").trim()).filter(Boolean);
 }
@@ -16972,6 +17110,38 @@ function reconcileGithubActions(liveGithub, registry2, readRepos) {
 function renderDrift(d) {
   return `${d.class}: ${d.name} (${d.executor}) \u2014 ${d.detail}; remedy: ${d.remedy}`;
 }
+function strayCronDrift(name) {
+  return {
+    class: "stray-cron",
+    name,
+    executor: "github-actions",
+    detail: "workflow still carries on: schedule",
+    remedy: "strip on: schedule \u2192 workflow_dispatch and let the harbour dispatcher fire on the registry cadence (docs/schedules.md rule 1)"
+  };
+}
+function strayCronDrifts(workflows) {
+  return workflows.filter((w) => workflowTriggersSchedule(w.yamlText)).map((w) => strayCronDrift(w.name)).sort((a, b) => a.name.localeCompare(b.name));
+}
+function unlauncheredLlmDrift(entry) {
+  if (entry.llm !== "yes") return null;
+  if (isHarbourLlmLauncher(entry.executor)) return null;
+  const allowed = [...HARBOUR_LLM_LAUNCHERS].join(", ");
+  return {
+    class: "unlaunchered-llm",
+    name: entry.name,
+    executor: entry.executor,
+    detail: `llm: yes with executor outside the harbour launcher set (${allowed})`,
+    remedy: `move the lane to executor: ${allowed} and run it through the Hub harbour key (docs/schedules.md rule 4)`
+  };
+}
+function unlauncheredLlmDrifts(entries) {
+  const drifts = [];
+  for (const e of entries) {
+    const d = unlauncheredLlmDrift(e);
+    if (d) drifts.push(d);
+  }
+  return drifts.sort((a, b) => a.name.localeCompare(b.name));
+}
 function assembleReconciliation(githubEntries2, readRepos, registry2) {
   if (registry2 === null) {
     return {
@@ -17006,10 +17176,11 @@ async function listWorkflows(client, repo) {
   }
 }
 async function repoWorkflowEntries(client, repo) {
-  const workflows = await listWorkflows(client, repo);
+  const workflowsList = await listWorkflows(client, repo);
   const entries = [];
   const failures = [];
-  for (const wf of workflows) {
+  const workflows = [];
+  for (const wf of workflowsList) {
     if (wf?.state !== "active" || typeof wf.path !== "string" || !wf.path) continue;
     if (!wf.path.startsWith(".github/workflows/")) continue;
     try {
@@ -17019,6 +17190,9 @@ async function repoWorkflowEntries(client, repo) {
       );
       if (typeof contents?.content !== "string" || contents.encoding !== "base64") continue;
       const text = Buffer.from(contents.content, "base64").toString("utf8");
+      const basename3 = wf.path.split("/").pop() ?? wf.path;
+      const name = `${repo}/${basename3.replace(/\.ya?ml$/, "")}`;
+      workflows.push({ name, yamlText: text });
       const entry = workflowEntry(repo, wf.path, text);
       if (entry) entries.push(entry);
     } catch (e) {
@@ -17027,19 +17201,20 @@ async function repoWorkflowEntries(client, repo) {
       else throw e;
     }
   }
-  return { entries, failures };
+  return { entries, failures, workflows };
 }
 async function githubEntries(client) {
   const entries = [];
   const incomplete = [];
   const drift = [];
   const readRepos = [];
+  const workflows = [];
   let repos;
   try {
     const listing = await client.restPaginate(`/orgs/${ORG}/repos?per_page=100`);
     repos = listing.filter((r) => typeof r?.name === "string" && r.archived !== true).map((r) => r.name).sort();
   } catch (e) {
-    return { entries, incomplete: [`github: could not list ${ORG} repos \u2014 ${e.message}`], drift, readRepos };
+    return { entries, incomplete: [`github: could not list ${ORG} repos \u2014 ${e.message}`], drift, reconciliation: [], readRepos };
   }
   const results = await Promise.all(
     repos.map(async (repo) => {
@@ -17055,12 +17230,15 @@ async function githubEntries(client) {
     else {
       readRepos.push(r.repo);
       entries.push(...r.entries);
+      workflows.push(...r.workflows);
       if (r.failures.length) {
         drift.push(`${r.repo}: ${r.failures.length} workflow record(s) listed active with no file on the default branch (deleted one-offs?) \u2014 deregister them: ${r.failures.map((f) => f.split(": ")[1]).join(", ")}`);
       }
     }
   }
-  return { entries, incomplete, drift, readRepos };
+  const reconciliation = [...strayCronDrifts(workflows), ...unlauncheredLlmDrifts(entries)];
+  drift.push(...reconciliation.map(renderDrift));
+  return { entries, incomplete, drift, reconciliation, readRepos };
 }
 async function awsJson(args) {
   const run = async () => {
@@ -17095,7 +17273,8 @@ async function awsEntries() {
   } catch (e) {
     incomplete.push(`aws: scheduler listing failed \u2014 ${e.message}`);
   }
-  return { entries, incomplete, drift: [] };
+  const reconciliation = unlauncheredLlmDrifts(entries);
+  return { entries, incomplete, drift: reconciliation.map(renderDrift), reconciliation };
 }
 async function defaultRegistryRead() {
   return fetchSchedulesList(registryClientDeps(await loadConfig()));
@@ -17111,7 +17290,7 @@ async function fetchNotebook(client = defaultGitHubClient(), readRegistry = defa
     entries: sortEntries([...gh.entries, ...aws.entries, ...DECLARED_ENTRIES]),
     incomplete: [...gh.incomplete, ...aws.incomplete, ...recon.incomplete],
     drift: [...gh.drift, ...aws.drift, ...recon.driftLines],
-    reconciliation: recon.reconciliation
+    reconciliation: [...gh.reconciliation, ...aws.reconciliation, ...recon.reconciliation]
   };
 }
 function warnIncomplete2(incomplete) {
@@ -17152,6 +17331,169 @@ function registerSchedulesCommands(program3) {
   });
 }
 
+// src/schedules-lift-command.ts
+var import_promises3 = require("node:fs/promises");
+var import_node_path17 = require("node:path");
+
+// src/schedules-lift.ts
+var SCHEDULE_HEADER_FIELDS = ["schedule", "what", "owner", "cadence", "executor", "llm", "output", "breaks", "kill"];
+function parseScheduleHeader(yamlText) {
+  const out = {};
+  for (const rawLine of yamlText.split("\n")) {
+    const m = /^#\s*(schedule|what|owner|cadence|executor|llm|output|breaks|kill):\s*(.+?)\s*$/.exec(rawLine);
+    if (m && out[m[1]] === void 0) out[m[1]] = m[2].trim();
+  }
+  return out;
+}
+function cadenceContainsCron(cadence, cron) {
+  const cadenceTokens = cadence.split(/\s+/).filter(Boolean);
+  const cronTokens = cron.split(/\s+/).filter(Boolean);
+  if (!cronTokens.length || cronTokens.length > cadenceTokens.length) return false;
+  return cadenceTokens.some((_, i) => i + cronTokens.length <= cadenceTokens.length && cronTokens.every((t, j) => cadenceTokens[i + j] === t));
+}
+function scheduleRecordFromWorkflow(repo, workflowPath, yamlText) {
+  const crons = extractWorkflowCrons(yamlText);
+  const header = parseScheduleHeader(yamlText);
+  if (!crons.length && !header.schedule) return null;
+  const basename3 = workflowPath.split("/").pop() ?? workflowPath;
+  const expectedId = `${repo}/${basename3.replace(/\.ya?ml$/, "")}`;
+  const missing = SCHEDULE_HEADER_FIELDS.filter((f) => !header[f]);
+  if (missing.length) {
+    throw new Error(`schedules lift: ${expectedId} (${workflowPath}) is a scheduled workflow but is missing the eight-field entry-template header field(s): ${missing.join(", ")} \u2014 see docs/schedules.md "The entry template".`);
+  }
+  const h = header;
+  if (h.schedule !== expectedId) {
+    throw new Error(`schedules lift: ${workflowPath} header \`schedule: ${h.schedule}\` must equal the join key \`${expectedId}\` (<repo>/<workflow-basename>).`);
+  }
+  for (const cron of crons) {
+    if (!cadenceContainsCron(h.cadence, cron)) {
+      throw new Error(`schedules lift: ${expectedId} cadence \`${h.cadence}\` does not contain the workflow cron \`${cron}\` (whole-token comparison) \u2014 the declared cadence disagrees with the actual schedule.`);
+    }
+  }
+  if (llmFromHeader(yamlText) === "unknown") {
+    throw new Error(`schedules lift: ${expectedId} header \`llm: ${h.llm}\` does not classify (yes / no / embeddings) \u2014 an unreadable declaration would register a row whose LLM column lies.`);
+  }
+  return {
+    id: expectedId,
+    what: h.what,
+    owner: h.owner,
+    cadence: h.cadence,
+    executor: h.executor,
+    llm: h.llm,
+    output: h.output,
+    breaks: h.breaks,
+    kill: h.kill,
+    repo,
+    sourcePath: workflowPath
+  };
+}
+function scheduleRecordsFromWorkflows(repo, files) {
+  const records = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const { path: path2, text } of files) {
+    const rec = scheduleRecordFromWorkflow(repo, path2, text);
+    if (!rec) continue;
+    if (seen.has(rec.id)) {
+      throw new Error(`schedules lift: duplicate schedule id \`${rec.id}\` \u2014 two workflow files in ${repo} share one join key (${rec.sourcePath}).`);
+    }
+    seen.add(rec.id);
+    records.push(rec);
+  }
+  return records.sort((a, b) => a.id.localeCompare(b.id));
+}
+
+// src/schedules-lift-command.ts
+var DEFAULT_WORKFLOWS_DIR = ".github/workflows";
+var SCHEDULE_REPO_RE = /^[A-Za-z0-9_.-]+$/;
+var SchedulesLiftUsageError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "SchedulesLiftUsageError";
+  }
+};
+var SCHEDULES_LIFT_EXIT_UNREACHABLE = 75;
+var RegistryUnreachableError = class extends Error {
+  exitCode = SCHEDULES_LIFT_EXIT_UNREACHABLE;
+  constructor(message) {
+    super(message);
+    this.name = "RegistryUnreachableError";
+  }
+};
+async function readWorkflowFiles(dir) {
+  let names;
+  try {
+    names = await (0, import_promises3.readdir)(dir);
+  } catch {
+    return [];
+  }
+  const files = [];
+  for (const name of names.sort()) {
+    if (!/\.ya?ml$/.test(name)) continue;
+    files.push({ path: `.github/workflows/${name}`, text: await (0, import_promises3.readFile)((0, import_node_path17.join)(dir, name), "utf8") });
+  }
+  return files;
+}
+function repoNameFromRemoteUrl(url) {
+  const base = url.trim().replace(/\.git$/, "").split(/[/:]/).filter(Boolean).pop();
+  return base ?? null;
+}
+async function defaultPostLift(repo, records) {
+  return postSchedulesLift(repo, records, registryClientDeps(await loadConfig()));
+}
+async function runSchedulesLift(opts, deps = {}) {
+  let repo = opts.repo?.trim();
+  if (!repo) {
+    const url = await (deps.originUrl ?? (() => gitOut(["remote", "get-url", "origin"])))();
+    repo = repoNameFromRemoteUrl(url) ?? void 0;
+    if (!repo) {
+      throw new Error("schedules lift: could not resolve the repo name from the origin remote \u2014 pass --repo <name>.");
+    }
+  }
+  if (!SCHEDULE_REPO_RE.test(repo)) {
+    throw new SchedulesLiftUsageError(`schedules lift: repo \`${repo}\` is not a bare repo segment (allowed: A-Z a-z 0-9 _ . -; no \`/\` or \`#\`) \u2014 the schedule id is <repo>/<name>, so a separator would form an invalid multi-segment id.`);
+  }
+  const dir = opts.dir ?? DEFAULT_WORKFLOWS_DIR;
+  const files = await (deps.readFiles ?? readWorkflowFiles)(dir);
+  if (!files.length) {
+    throw new Error(`schedules lift: no workflow files under ${dir} \u2014 refusing to post an empty lift (the route prunes; run from the repo checkout or pass --dir).`);
+  }
+  const records = scheduleRecordsFromWorkflows(repo, files);
+  const payload = { repo, schedules: records };
+  if (opts.dryRun) return { repo, records, payload };
+  const response = await (deps.postLift ?? defaultPostLift)(repo, records);
+  if (!response.ok) {
+    const unreachable = response.unreachable ?? (response.status === 404 ? "route-absent" : void 0);
+    if (unreachable) {
+      throw new RegistryUnreachableError(`schedules lift: registry unreachable (${unreachable}) \u2014 ${response.error ?? `HTTP ${response.status}`}`);
+    }
+    if (response.error) throw new Error(`schedules lift: ${response.error}`);
+    const detail = response.body?.error ?? "";
+    throw new Error(`schedules lift: HTTP ${response.status}${detail ? ` \u2014 ${detail}` : ""}`);
+  }
+  return { repo, records, payload, response };
+}
+function registerSchedulesLiftCommand(program3, deps = {}) {
+  const schedules = program3.commands.find((c) => c.name() === "schedules");
+  if (!schedules) throw new Error("schedules lift: registerSchedulesCommands must run first \u2014 the lift attaches to the `schedules` command");
+  schedules.command("lift").description("lift this repo's eight-field workflow headers into SCHEDULE# registry rows (C2, #3186) \u2014 a per-repo replace; aborts the whole lift on any header violation; exits 75 when the registry is unreachable (#3187)").option("--repo <name>", "bare repo name for the join key (defaults to the origin remote basename, case-preserved)").option("--dir <path>", "workflows directory to lift (defaults to .github/workflows)").option("--dry-run", "print the {repo, schedules} body that would be POSTed; never write").action(async (o) => {
+    try {
+      const result = await runSchedulesLift({ repo: o.repo, dir: o.dir, dryRun: Boolean(o.dryRun) }, deps);
+      if (o.dryRun) {
+        console.log(JSON.stringify(result.payload, null, 2));
+        return;
+      }
+      console.log(JSON.stringify(result.response?.body));
+    } catch (e) {
+      const err = e;
+      if (err instanceof RegistryUnreachableError) {
+        console.error(`mmi-cli ${err.message}`);
+        return await cleanExit(err.exitCode);
+      }
+      return await failGraceful(err.message);
+    }
+  });
+}
+
 // src/edge-tunnel.ts
 var HOSTNAME_RE = /^(?=.{1,253}$)([a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)(\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)+$/;
 var UPSTREAM_RE = /^https?:\/\/[^/\s]+(?::\d+)?(?:\/.*)?$/;
@@ -17611,7 +17953,7 @@ function registerQueryCommands(program3) {
 }
 
 // src/bootstrap-commands.ts
-var import_node_fs18 = require("node:fs");
+var import_node_fs19 = require("node:fs");
 
 // src/bootstrap-verify.ts
 var TRAIN_BRANCHES2 = ["development", "rc", "main"];
@@ -18159,7 +18501,7 @@ function registerBootstrapCommands(program3) {
       client: defaultGitHubClient(),
       projectMeta: meta,
       deployModel: typeof meta?.deployModel === "string" ? meta.deployModel : void 0,
-      readLocalFile: (path2) => path2 === "projects.json" && apiProjects != null ? apiProjects : (0, import_node_fs18.existsSync)(path2) ? (0, import_node_fs18.readFileSync)(path2, "utf8") : null,
+      readLocalFile: (path2) => path2 === "projects.json" && apiProjects != null ? apiProjects : (0, import_node_fs19.existsSync)(path2) ? (0, import_node_fs19.readFileSync)(path2, "utf8") : null,
       // requiredGcpApis is stored as an array by a JSON write, but `org project set --var KEY=VALUE` stores a raw
       // comma-string — accept either so the seeded value verifies regardless of how it was written.
       requiredGcpApis: (() => {
@@ -18210,12 +18552,12 @@ function registerBootstrapCommands(program3) {
       return fail(`bootstrap apply: ${e.message}`);
     }
     const manifestPath = "skills/bootstrap/seeds/manifest.json";
-    if (!(0, import_node_fs18.existsSync)(manifestPath)) return fail(`bootstrap apply: ${manifestPath} not found; bootstrap runs from the MMI-Hub repo root by design \u2014 it stamps org-level resources (Project, Ruleset, secrets, access) through the GitHub App, which is only authorized from the Hub checkout`);
-    const manifest = loadBootstrapSeeds((0, import_node_fs18.readFileSync)(manifestPath, "utf8"));
+    if (!(0, import_node_fs19.existsSync)(manifestPath)) return fail(`bootstrap apply: ${manifestPath} not found; bootstrap runs from the MMI-Hub repo root by design \u2014 it stamps org-level resources (Project, Ruleset, secrets, access) through the GitHub App, which is only authorized from the Hub checkout`);
+    const manifest = loadBootstrapSeeds((0, import_node_fs19.readFileSync)(manifestPath, "utf8"));
     const baseBranch = o.class === "content" ? "main" : "development";
     const slug = parsedRepo.slug;
     const gh = async (args) => execFileP2("gh", args, { timeout: 2e4 });
-    const readFile5 = (p) => (0, import_node_fs18.existsSync)(p) ? (0, import_node_fs18.readFileSync)(p, "utf8") : null;
+    const readFile6 = (p) => (0, import_node_fs19.existsSync)(p) ? (0, import_node_fs19.readFileSync)(p, "utf8") : null;
     const enc = (p) => p.split("/").map(encodeURIComponent).join("/");
     const rawVars = {};
     for (const value of cmdOpts.var ?? []) {
@@ -18293,7 +18635,7 @@ function registerBootstrapCommands(program3) {
       }
       const planned = planSeedAction(resolved, exists);
       const isBlock = resolved.source === "managed-block";
-      const content = planned.action === "create" || planned.action === "update" ? isBlock ? upsertManagedGitignoreBlock(remoteContent).content : resolveSeedContent(resolved, vars, readFile5) : null;
+      const content = planned.action === "create" || planned.action === "update" ? isBlock ? upsertManagedGitignoreBlock(remoteContent).content : resolveSeedContent(resolved, vars, readFile6) : null;
       const action = reconcileSeedAction(planned, content, isBlock, remoteContent);
       actions.push(action);
       if (o.execute && (action.action === "create" || action.action === "update")) {
@@ -18348,7 +18690,7 @@ function registerBootstrapCommands(program3) {
       }
       const rulesetSeed = manifest.seeds.find((s) => s.target === ".github/rulesets/mmi-product-required-checks.json");
       if (rulesetSeed) {
-        const rulesetContent = resolveSeedContent({ ...rulesetSeed, target: rulesetSeed.target.replace("{{REPO_SLUG}}", slug) }, vars, readFile5);
+        const rulesetContent = resolveSeedContent({ ...rulesetSeed, target: rulesetSeed.target.replace("{{REPO_SLUG}}", slug) }, vars, readFile6);
         if (rulesetContent) {
           try {
             const activation = await activateProductRuleset(repo, stripRulesetComment(rulesetContent), defaultGitHubClient());
@@ -18411,12 +18753,12 @@ LIVE apply to ${repo}:
 }
 
 // src/stage-commands.ts
-var import_node_fs20 = require("node:fs");
-var import_node_path17 = require("node:path");
+var import_node_fs21 = require("node:fs");
+var import_node_path19 = require("node:path");
 
 // src/port-registry.ts
-var import_node_fs19 = require("node:fs");
-var import_node_path16 = require("node:path");
+var import_node_fs20 = require("node:fs");
+var import_node_path18 = require("node:path");
 
 // ../infra/port-geometry.mjs
 var PORT_BLOCK = 100;
@@ -18430,8 +18772,8 @@ function nextPortBlock(registry2) {
   return [base, base + PORT_SPAN];
 }
 function loadPortRegistry(path2) {
-  if (!(0, import_node_fs19.existsSync)(path2)) return {};
-  const raw = JSON.parse((0, import_node_fs19.readFileSync)(path2, "utf8"));
+  if (!(0, import_node_fs20.existsSync)(path2)) return {};
+  const raw = JSON.parse((0, import_node_fs20.readFileSync)(path2, "utf8"));
   const out = {};
   for (const [key, value] of Object.entries(raw)) {
     if (Array.isArray(value) && value.length === 2 && value.every((n) => typeof n === "number")) {
@@ -18445,9 +18787,9 @@ function ensurePortRange(repo, path2) {
   const existing = registry2[repo];
   if (existing) return existing;
   const range = nextPortBlock(registry2);
-  const raw = (0, import_node_fs19.existsSync)(path2) ? JSON.parse((0, import_node_fs19.readFileSync)(path2, "utf8")) : {};
+  const raw = (0, import_node_fs20.existsSync)(path2) ? JSON.parse((0, import_node_fs20.readFileSync)(path2, "utf8")) : {};
   raw[repo] = range;
-  (0, import_node_fs19.writeFileSync)(path2, JSON.stringify(raw, null, 2) + "\n", "utf8");
+  (0, import_node_fs20.writeFileSync)(path2, JSON.stringify(raw, null, 2) + "\n", "utf8");
   return range;
 }
 function portCursorSeed(registry2) {
@@ -18469,22 +18811,22 @@ function existingPortRange(repo, registry2) {
   return registry2[repo] ?? null;
 }
 function portRangeInfraAt(root, source) {
-  const registryPath = (0, import_node_path16.join)(root, "infra", "port-ranges.json");
-  const ddbScriptPath = (0, import_node_path16.join)(root, "infra", "port-ddb.mjs");
-  if (!(0, import_node_fs19.existsSync)(registryPath) || !(0, import_node_fs19.existsSync)(ddbScriptPath)) return null;
+  const registryPath = (0, import_node_path18.join)(root, "infra", "port-ranges.json");
+  const ddbScriptPath = (0, import_node_path18.join)(root, "infra", "port-ddb.mjs");
+  if (!(0, import_node_fs20.existsSync)(registryPath) || !(0, import_node_fs20.existsSync)(ddbScriptPath)) return null;
   return { root, source, registryPath, ddbScriptPath };
 }
 function resolvePortRangeInfra(cwd, packageDir) {
   const direct = portRangeInfraAt(cwd, "cwd");
   if (direct) return direct;
-  for (let dir = cwd; ; dir = (0, import_node_path16.dirname)(dir)) {
-    const sibling = portRangeInfraAt((0, import_node_path16.join)(dir, "MMI-Hub"), "sibling-hub");
+  for (let dir = cwd; ; dir = (0, import_node_path18.dirname)(dir)) {
+    const sibling = portRangeInfraAt((0, import_node_path18.join)(dir, "MMI-Hub"), "sibling-hub");
     if (sibling) return sibling;
-    const parent = (0, import_node_path16.dirname)(dir);
+    const parent = (0, import_node_path18.dirname)(dir);
     if (parent === dir) break;
   }
   if (packageDir) {
-    const pkgRoot = (0, import_node_path16.join)(packageDir, "..", "..");
+    const pkgRoot = (0, import_node_path18.join)(packageDir, "..", "..");
     const pkgFrom = portRangeInfraAt(pkgRoot, "pkg-root");
     if (pkgFrom) return pkgFrom;
   }
@@ -18660,8 +19002,8 @@ function registerStageCommands(program3) {
     const portRange = portRangeMeta && typeof portRangeMeta.start === "number" && typeof portRangeMeta.end === "number" ? [portRangeMeta.start, portRangeMeta.end] : void 0;
     return decideStage({
       registry: { deployModel: project2?.deployModel, portRange, error: read.ok ? void 0 : read.error },
-      hasCompose: (0, import_node_fs20.existsSync)((0, import_node_path17.join)(process.cwd(), "docker-compose.yml")),
-      hasEnvExample: (0, import_node_fs20.existsSync)((0, import_node_path17.join)(process.cwd(), ".env.example"))
+      hasCompose: (0, import_node_fs21.existsSync)((0, import_node_path19.join)(process.cwd(), "docker-compose.yml")),
+      hasEnvExample: (0, import_node_fs21.existsSync)((0, import_node_path19.join)(process.cwd(), ".env.example"))
     });
   }
   async function fetchStageVaultEnvMerge() {
@@ -19099,8 +19441,8 @@ function registerBoardCommands(program3) {
 }
 
 // src/merge-cleanup.ts
-var import_node_fs21 = require("node:fs");
-var import_promises4 = require("node:fs/promises");
+var import_node_fs22 = require("node:fs");
+var import_promises5 = require("node:fs/promises");
 var import_node_child_process10 = require("node:child_process");
 
 // src/board-advance.ts
@@ -19186,23 +19528,23 @@ function boardAdvanceFailureMessage(result) {
 }
 
 // src/deferred-registry-store.ts
-var import_promises3 = require("node:fs/promises");
-var import_node_path18 = require("node:path");
+var import_promises4 = require("node:fs/promises");
+var import_node_path20 = require("node:path");
 var sleep = (ms) => new Promise((resolve5) => setTimeout(resolve5, ms));
 async function atomicWrite(target, contents) {
   const tmp = `${target}.tmp-${process.pid}-${Math.random().toString(36).slice(2)}`;
-  await (0, import_promises3.writeFile)(tmp, contents, "utf8");
+  await (0, import_promises4.writeFile)(tmp, contents, "utf8");
   try {
     await renameWithRetry(tmp, target);
   } catch (e) {
-    await (0, import_promises3.unlink)(tmp).catch(() => void 0);
+    await (0, import_promises4.unlink)(tmp).catch(() => void 0);
     throw e;
   }
 }
 async function renameWithRetry(from, to, attempts = 5, backoffMs = 20) {
   for (let i = 0; ; i++) {
     try {
-      await (0, import_promises3.rename)(from, to);
+      await (0, import_promises4.rename)(from, to);
       return;
     } catch (e) {
       const code = e.code;
@@ -19214,7 +19556,7 @@ async function renameWithRetry(from, to, attempts = 5, backoffMs = 20) {
 async function readStrict(registryPath) {
   let text;
   try {
-    text = await (0, import_promises3.readFile)(registryPath, "utf8");
+    text = await (0, import_promises4.readFile)(registryPath, "utf8");
   } catch (e) {
     if (e.code === "ENOENT") return [];
     throw e;
@@ -19225,15 +19567,15 @@ async function acquireLock(lockPath, opts, deadline) {
   for (; ; ) {
     let handle;
     try {
-      handle = await (0, import_promises3.open)(lockPath, "wx");
+      handle = await (0, import_promises4.open)(lockPath, "wx");
     } catch (e) {
       const code = e.code;
       if (code !== "EEXIST" && code !== "EPERM" && code !== "EBUSY" && code !== "EACCES") throw e;
       try {
-        const age = Date.now() - (await (0, import_promises3.stat)(lockPath)).mtimeMs;
+        const age = Date.now() - (await (0, import_promises4.stat)(lockPath)).mtimeMs;
         if (age > opts.staleMs) {
           try {
-            await (0, import_promises3.unlink)(lockPath);
+            await (0, import_promises4.unlink)(lockPath);
             continue;
           } catch (unlinkError) {
             const code2 = unlinkError.code;
@@ -19262,7 +19604,7 @@ async function acquireLock(lockPath, opts, deadline) {
 }
 async function lockHeldBy(lockPath, token) {
   try {
-    return await (0, import_promises3.readFile)(lockPath, "utf8") === token;
+    return await (0, import_promises4.readFile)(lockPath, "utf8") === token;
   } catch {
     return false;
   }
@@ -19270,7 +19612,7 @@ async function lockHeldBy(lockPath, token) {
 async function releaseLock(lockPath, guard) {
   await guard.handle.close().catch(() => void 0);
   if (await lockHeldBy(lockPath, guard.token)) {
-    await (0, import_promises3.unlink)(lockPath).catch(() => void 0);
+    await (0, import_promises4.unlink)(lockPath).catch(() => void 0);
   }
 }
 function makeDeferredWorktreeStore(registryPath, lockOpts = {}) {
@@ -19284,19 +19626,19 @@ function makeDeferredWorktreeStore(registryPath, lockOpts = {}) {
     // Lenient read for the sweep's initial fetch: any error (missing/corrupt) yields an empty queue.
     read: async () => {
       try {
-        return parseDeferredWorktreesFile(await (0, import_promises3.readFile)(registryPath, "utf8"));
+        return parseDeferredWorktreesFile(await (0, import_promises4.readFile)(registryPath, "utf8"));
       } catch {
         return [];
       }
     },
     // Standalone atomic write — THROWS on failure (no best-effort swallow, #2846).
     write: async (entries) => {
-      await (0, import_promises3.mkdir)((0, import_node_path18.dirname)(registryPath), { recursive: true });
+      await (0, import_promises4.mkdir)((0, import_node_path20.dirname)(registryPath), { recursive: true });
       await atomicWrite(registryPath, serializeDeferredWorktrees(entries));
     },
     // Serialized read-modify-write under the repo-wide lock (#2846).
     update: async (mutate) => {
-      await (0, import_promises3.mkdir)((0, import_node_path18.dirname)(registryPath), { recursive: true });
+      await (0, import_promises4.mkdir)((0, import_node_path20.dirname)(registryPath), { recursive: true });
       const deadline = Date.now() + opts.maxWaitMs;
       for (; ; ) {
         const guard = await acquireLock(lockPath, opts, deadline);
@@ -19423,7 +19765,7 @@ async function applyGcPlan(plan, remote) {
       return cleanupPrMergeLocalBranch(branch.branch, {
         beforeWorktrees,
         startingPath: branch.worktreePath,
-        pathExists: (p) => (0, import_node_fs21.existsSync)(p),
+        pathExists: (p) => (0, import_node_fs22.existsSync)(p),
         execGit: async (args) => (await execFileP2("git", args, { timeout: GIT_TIMEOUT_MS })).stdout,
         teardownWorktreeStage,
         deferredStore,
@@ -19449,7 +19791,7 @@ async function applyGcPlan(plan, remote) {
   for (const wt of plan.worktreeDirs) {
     try {
       const cleanupTarget = resolveSafeSiblingWorktreeCleanupTarget(wt.path, siblingRoot, {
-        realpath: (path2) => (0, import_node_fs21.realpathSync)(path2)
+        realpath: (path2) => (0, import_node_fs22.realpathSync)(path2)
       });
       if (!cleanupTarget.ok) {
         result.failed.push(`${wt.path}: ${cleanupTarget.reason}`);
@@ -19576,13 +19918,13 @@ var realWorktreeDirRemover = {
   probe: (p) => {
     let st;
     try {
-      st = (0, import_node_fs21.lstatSync)(p);
+      st = (0, import_node_fs22.lstatSync)(p);
     } catch {
       return null;
     }
     if (st.isSymbolicLink()) return "link";
     try {
-      (0, import_node_fs21.readlinkSync)(p);
+      (0, import_node_fs22.readlinkSync)(p);
       return "link";
     } catch {
     }
@@ -19590,7 +19932,7 @@ var realWorktreeDirRemover = {
   },
   readdir: (p) => {
     try {
-      return (0, import_node_fs21.readdirSync)(p);
+      return (0, import_node_fs22.readdirSync)(p);
     } catch {
       return [];
     }
@@ -19599,12 +19941,12 @@ var realWorktreeDirRemover = {
   // leaving the target); a file symlink with unlink. rmdir first, fall back to unlink.
   detachLink: (p) => {
     try {
-      (0, import_node_fs21.rmdirSync)(p);
+      (0, import_node_fs22.rmdirSync)(p);
     } catch {
-      (0, import_node_fs21.unlinkSync)(p);
+      (0, import_node_fs22.unlinkSync)(p);
     }
   },
-  removeTree: (p) => (0, import_promises4.rm)(p, { recursive: true, force: true, maxRetries: 5, retryDelay: 200 })
+  removeTree: (p) => (0, import_promises5.rm)(p, { recursive: true, force: true, maxRetries: 5, retryDelay: 200 })
 };
 async function resolvePrimaryCheckout(execGit) {
   try {
@@ -19634,9 +19976,9 @@ async function worktreeHasStageState(worktreePath) {
   }
 }
 function stageStateFileBelongsToWorktree(statePath, worktreePath) {
-  if (!(0, import_node_fs21.existsSync)(statePath)) return false;
+  if (!(0, import_node_fs22.existsSync)(statePath)) return false;
   try {
-    const state = JSON.parse((0, import_node_fs21.readFileSync)(statePath, "utf8"));
+    const state = JSON.parse((0, import_node_fs22.readFileSync)(statePath, "utf8"));
     const recordedCwd = typeof state.identity?.cwd === "string" ? state.identity.cwd : typeof state.cwd === "string" ? state.cwd : "";
     return Boolean(recordedCwd && isPathUnderDirectory(recordedCwd, worktreePath));
   } catch {
@@ -19764,8 +20106,8 @@ async function fetchRestCorePool(gh = defaultGhApi) {
 }
 
 // src/worktree-lifecycle-commands.ts
-var import_node_fs22 = require("node:fs");
-var import_node_path19 = require("node:path");
+var import_node_fs23 = require("node:fs");
+var import_node_path21 = require("node:path");
 var GH_TIMEOUT_MS = 2e4;
 var DEFAULT_BASE = "origin/development";
 var DEFAULT_REMOTE = "origin";
@@ -19902,13 +20244,13 @@ function registerWorktreeCommands(program3) {
       if (PROTECTED_BRANCHES2.has(branch)) {
         return fail(`worktree land: refusing to land protected branch '${branch}'`, { code: ERROR_CODES.ERR_BAD_ENUM });
       }
-      const gitFile = (0, import_node_path19.join)(wtPath, ".git");
-      const isLinked = (0, import_node_fs22.existsSync)(gitFile) && (0, import_node_fs22.statSync)(gitFile).isFile();
+      const gitFile = (0, import_node_path21.join)(wtPath, ".git");
+      const isLinked = (0, import_node_fs23.existsSync)(gitFile) && (0, import_node_fs23.statSync)(gitFile).isFile();
       if (apply && !isLinked) {
         return fail("worktree land: run from inside the linked worktree you want to land (this is the primary checkout)");
       }
       const commonDir = (await execFileP2("git", ["rev-parse", "--git-common-dir"], { timeout: GIT_TIMEOUT_MS }).catch(() => ({ stdout: "" }))).stdout.trim();
-      const primaryCheckout = commonDir ? (0, import_node_path19.dirname)(commonDir) : wtPath;
+      const primaryCheckout = commonDir ? (0, import_node_path21.dirname)(commonDir) : wtPath;
       const stageSummary = readStageSummary(wtPath);
       const hasStage = stageSummary != null;
       const steps = landSteps(branch, true, hasStage);
@@ -20020,10 +20362,10 @@ async function gatherWorktreeContext() {
   }
   const orphanDirs = [];
   const wtRoot = siblingMmiWorktreesRoot(repoRoot2);
-  if ((0, import_node_fs22.existsSync)(wtRoot)) {
+  if ((0, import_node_fs23.existsSync)(wtRoot)) {
     let entries = [];
     try {
-      entries = (0, import_node_fs22.readdirSync)(wtRoot, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => (0, import_node_path19.join)(wtRoot, e.name));
+      entries = (0, import_node_fs23.readdirSync)(wtRoot, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => (0, import_node_path21.join)(wtRoot, e.name));
     } catch {
     }
     const known = new Set(worktrees.map((w) => w.path));
@@ -20048,7 +20390,7 @@ async function bestEffortGit(args, cwd, step, timeoutMs = GIT_TIMEOUT_MS) {
 }
 
 // src/issue-commands.ts
-var import_node_fs23 = require("node:fs");
+var import_node_fs24 = require("node:fs");
 var import_node_crypto5 = require("node:crypto");
 var ghRunner = async (args, timeoutMs) => (await execFileP2("gh", args, { timeout: timeoutMs })).stdout;
 async function editIssue(client, options, deps = {}) {
@@ -20062,7 +20404,7 @@ async function editIssue(client, options, deps = {}) {
   if (options.body !== void 0 || options.bodyFile !== void 0) {
     let body;
     if (options.bodyFile) {
-      const td = deps.textDeps ?? { readFile: (p, e) => Promise.resolve((0, import_node_fs23.readFileSync)(p, e)), readStdin: () => Promise.resolve("") };
+      const td = deps.textDeps ?? { readFile: (p, e) => Promise.resolve((0, import_node_fs24.readFileSync)(p, e)), readStdin: () => Promise.resolve("") };
       body = await resolveIssueBody({ body: options.body, bodyFile: options.bodyFile }, td);
     } else {
       body = options.body ?? "";
@@ -20536,7 +20878,7 @@ function extendCreateCommand(issue2) {
     if (opts.batch) {
       let specs;
       try {
-        const raw = (0, import_node_fs23.readFileSync)(opts.batch, "utf8");
+        const raw = (0, import_node_fs24.readFileSync)(opts.batch, "utf8");
         specs = JSON.parse(raw);
         if (!Array.isArray(specs)) throw new Error("batch file must contain a JSON array");
       } catch (e) {
@@ -20580,12 +20922,12 @@ ${lines}`);
 }
 
 // src/train-commands.ts
-var import_node_fs25 = require("node:fs");
-var import_node_path21 = require("node:path");
+var import_node_fs26 = require("node:fs");
+var import_node_path23 = require("node:path");
 
 // src/plugin-guard-io.ts
-var import_node_fs24 = require("node:fs");
-var import_node_path20 = require("node:path");
+var import_node_fs25 = require("node:fs");
+var import_node_path22 = require("node:path");
 var import_node_os6 = require("node:os");
 
 // src/plugin-guard.ts
@@ -20715,11 +21057,11 @@ function runHostBin(bin, args, opts) {
 }
 var installedPluginsPath2 = (surface = detectSurface(process.env)) => {
   const homeDir = surface === "codex" ? ".codex" : ".claude";
-  return (0, import_node_path20.join)((0, import_node_os6.homedir)(), homeDir, "plugins", "installed_plugins.json");
+  return (0, import_node_path22.join)((0, import_node_os6.homedir)(), homeDir, "plugins", "installed_plugins.json");
 };
 function readInstalledPlugins(surface = detectSurface(process.env)) {
   try {
-    return JSON.parse((0, import_node_fs24.readFileSync)(installedPluginsPath2(surface), "utf8"));
+    return JSON.parse((0, import_node_fs25.readFileSync)(installedPluginsPath2(surface), "utf8"));
   } catch {
     return null;
   }
@@ -20727,13 +21069,13 @@ function readInstalledPlugins(surface = detectSurface(process.env)) {
 function marketplaceCloneCandidates(surface, home) {
   if (surface === "codex") {
     return [
-      (0, import_node_path20.join)(home, ".codex", ".tmp", "marketplaces", "mutmutco"),
-      (0, import_node_path20.join)(home, ".codex", "plugins", "marketplaces", "mutmutco")
+      (0, import_node_path22.join)(home, ".codex", ".tmp", "marketplaces", "mutmutco"),
+      (0, import_node_path22.join)(home, ".codex", "plugins", "marketplaces", "mutmutco")
     ];
   }
-  return [(0, import_node_path20.join)(home, ".claude", "plugins", "marketplaces", "mutmutco")];
+  return [(0, import_node_path22.join)(home, ".claude", "plugins", "marketplaces", "mutmutco")];
 }
-function marketplaceClonePresent(surface, home, exists = import_node_fs24.existsSync) {
+function marketplaceClonePresent(surface, home, exists = import_node_fs25.existsSync) {
   return marketplaceCloneCandidates(surface, home).some(exists);
 }
 async function fetchNpmReleasedVersion() {
@@ -20751,7 +21093,7 @@ function snapshotPluginGuardInput(surface = detectSurface(process.env), isOrgRep
     isOrgRepo,
     installRecordPresent: hasUserInstallRecord(installed, MMI_PLUGIN_ID) || hasProjectInstallRecord(installed, MMI_PLUGIN_ID, process.cwd()),
     marketplaceClonePresent: marketplaceClonePresent(surface, (0, import_node_os6.homedir)()),
-    pluginCachePresent: (0, import_node_fs24.existsSync)((0, import_node_path20.join)((0, import_node_os6.homedir)(), homeDir, "plugins", "cache", "mutmutco", "mmi"))
+    pluginCachePresent: (0, import_node_fs25.existsSync)((0, import_node_path22.join)((0, import_node_os6.homedir)(), homeDir, "plugins", "cache", "mutmutco", "mmi"))
   };
 }
 function claudePluginGuardState(isOrgRepo) {
@@ -20875,7 +21217,7 @@ function formatTrainStatus(r) {
 // src/train-commands.ts
 function readRepoVersion() {
   try {
-    return JSON.parse((0, import_node_fs25.readFileSync)((0, import_node_path21.join)(process.cwd(), ".claude-plugin", "plugin.json"), "utf8")).version || void 0;
+    return JSON.parse((0, import_node_fs26.readFileSync)((0, import_node_path23.join)(process.cwd(), ".claude-plugin", "plugin.json"), "utf8")).version || void 0;
   } catch {
     return void 0;
   }
@@ -21375,7 +21717,7 @@ function registerExplainCommand(program3) {
 }
 
 // src/pr-commands.ts
-var import_promises5 = require("node:fs/promises");
+var import_promises6 = require("node:fs/promises");
 var GC_GH_TIMEOUT_MS4 = 2e4;
 var CHECKS_WATCH_POLL_MS = 15e3;
 var CHECKS_WATCH_TIMEOUT_MS = 10 * 6e4;
@@ -21519,10 +21861,10 @@ function registerPrLifecycleCommands(program3) {
     let body;
     try {
       if (o.title || o.titleFile) {
-        title = await resolveIssueTitle({ title: o.title, titleFile: o.titleFile }, { readFile: import_promises5.readFile, readStdin });
+        title = await resolveIssueTitle({ title: o.title, titleFile: o.titleFile }, { readFile: import_promises6.readFile, readStdin });
       }
       if (o.body || o.bodyFile) {
-        body = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises5.readFile, readStdin });
+        body = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises6.readFile, readStdin });
       }
     } catch (e) {
       return fail(`pr edit: ${e.message}`);
@@ -21552,7 +21894,7 @@ function registerPrLifecycleCommands(program3) {
     }
     let body;
     try {
-      body = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises5.readFile, readStdin });
+      body = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises6.readFile, readStdin });
     } catch (e) {
       return fail(`pr comment: ${e.message}`);
     }
@@ -22105,7 +22447,7 @@ function checkSchedules(probe) {
       ok: false,
       label: "schedules",
       detail: `${probe.drift.length} drift finding(s)`,
-      fix: "run `mmi-cli org schedules` \u2014 file/registry/live disagree; each drift line names its per-class remedy, applied in the owning repo",
+      fix: "run `mmi-cli org schedules` \u2014 each drift line names its per-class remedy (file/registry/live mismatch or harbour enforcement), applied in the owning repo",
       verbose: evidence
     };
   }
@@ -22277,9 +22619,9 @@ async function runDoctorClean(opts, io, deps) {
 }
 
 // src/doctor-io.ts
-var import_node_fs26 = require("node:fs");
+var import_node_fs27 = require("node:fs");
 var import_node_os7 = require("node:os");
-var import_node_path22 = require("node:path");
+var import_node_path24 = require("node:path");
 var import_node_child_process11 = require("node:child_process");
 var import_node_util8 = require("node:util");
 var execFileP6 = (0, import_node_util8.promisify)(import_node_child_process11.execFile);
@@ -22287,7 +22629,7 @@ var MMI_PLUGIN_ID2 = "mmi@mutmutco";
 function installedClaudePluginVersion() {
   try {
     const file = JSON.parse(
-      (0, import_node_fs26.readFileSync)((0, import_node_path22.join)((0, import_node_os7.homedir)(), ".claude", "plugins", "installed_plugins.json"), "utf8")
+      (0, import_node_fs27.readFileSync)((0, import_node_path24.join)((0, import_node_os7.homedir)(), ".claude", "plugins", "installed_plugins.json"), "utf8")
     );
     const versions = (file.plugins?.[MMI_PLUGIN_ID2] ?? []).map((r) => r.version).filter((v) => Boolean(v));
     if (versions.length === 0) return void 0;
@@ -22308,13 +22650,13 @@ function worktreeRootSync() {
 }
 var gitignorePath = () => {
   const root = worktreeRootSync();
-  return root === null ? null : (0, import_node_path22.join)(root, ".gitignore");
+  return root === null ? null : (0, import_node_path24.join)(root, ".gitignore");
 };
 function readGitignore() {
   const path2 = gitignorePath();
   if (path2 === null) return null;
   try {
-    return (0, import_node_fs26.readFileSync)(path2, "utf8");
+    return (0, import_node_fs27.readFileSync)(path2, "utf8");
   } catch {
     return null;
   }
@@ -22323,7 +22665,7 @@ function writeGitignore(content) {
   const path2 = gitignorePath();
   if (path2 === null) return false;
   try {
-    (0, import_node_fs26.writeFileSync)(path2, content, "utf8");
+    (0, import_node_fs27.writeFileSync)(path2, content, "utf8");
     return true;
   } catch {
     return false;
@@ -22347,7 +22689,7 @@ async function repoRoot() {
 }
 function hasRepoLocalWorktrees() {
   const root = worktreeRootSync();
-  return root !== null && (0, import_node_fs26.existsSync)((0, import_node_path22.join)(root, ".worktrees"));
+  return root !== null && (0, import_node_fs27.existsSync)((0, import_node_path24.join)(root, ".worktrees"));
 }
 
 // src/index.ts
@@ -22520,19 +22862,19 @@ program2.hook("preAction", async (_thisCommand, actionCommand) => {
 });
 var rules = program2.command("rules").description("org-managed .gitignore delivery");
 rules.command("gitignore").option("--write", "upsert the managed block into .gitignore (default: check only, non-zero exit on drift)").option("--json", "machine-readable output").description("verify (or --write) this repo's org-managed .gitignore block matches the SSOT").action((opts) => {
-  const path2 = (0, import_node_path23.join)(process.cwd(), ".gitignore");
-  const current = (0, import_node_fs27.existsSync)(path2) ? (0, import_node_fs27.readFileSync)(path2, "utf8") : null;
+  const path2 = (0, import_node_path25.join)(process.cwd(), ".gitignore");
+  const current = (0, import_node_fs28.existsSync)(path2) ? (0, import_node_fs28.readFileSync)(path2, "utf8") : null;
   const plan = planManagedGitignore(current);
   const drift = [...plan.added.map((l) => `+${l}`), ...plan.removed.map((l) => `-${l}`)].join(", ") || "block normalize";
   if (opts.json) {
-    if (opts.write && plan.changed) (0, import_node_fs27.writeFileSync)(path2, plan.content, "utf8");
+    if (opts.write && plan.changed) (0, import_node_fs28.writeFileSync)(path2, plan.content, "utf8");
     console.log(JSON.stringify(plan, null, 2));
     if (!opts.write && plan.changed) process.exitCode = 1;
     return;
   }
   if (opts.write) {
     if (plan.changed) {
-      (0, import_node_fs27.writeFileSync)(path2, plan.content, "utf8");
+      (0, import_node_fs28.writeFileSync)(path2, plan.content, "utf8");
       console.log(`mmi-cli org rules gitignore: updated .gitignore (${drift})`);
     } else {
       console.log("mmi-cli org rules gitignore: up to date");
@@ -22722,26 +23064,26 @@ function makeProvisionDeps(worktreeRoot, quiet, log) {
 function acquireWorktreeSetupLock(worktreeRoot) {
   const lockPath = repoRuntimeStatePath(worktreeRoot, "worktree-setup.lock");
   const take = () => {
-    const fd = (0, import_node_fs27.openSync)(lockPath, "wx");
+    const fd = (0, import_node_fs28.openSync)(lockPath, "wx");
     try {
-      (0, import_node_fs27.writeSync)(fd, String(Date.now()));
+      (0, import_node_fs28.writeSync)(fd, String(Date.now()));
     } finally {
-      (0, import_node_fs27.closeSync)(fd);
+      (0, import_node_fs28.closeSync)(fd);
     }
     return () => {
       try {
-        (0, import_node_fs27.rmSync)(lockPath, { force: true });
+        (0, import_node_fs28.rmSync)(lockPath, { force: true });
       } catch {
       }
     };
   };
   try {
-    (0, import_node_fs27.mkdirSync)((0, import_node_path23.dirname)(lockPath), { recursive: true });
+    (0, import_node_fs28.mkdirSync)((0, import_node_path25.dirname)(lockPath), { recursive: true });
     return take();
   } catch {
     try {
-      if (Date.now() - (0, import_node_fs27.statSync)(lockPath).mtimeMs > WORKTREE_SETUP_LOCK_TTL_MS) {
-        (0, import_node_fs27.rmSync)(lockPath, { force: true });
+      if (Date.now() - (0, import_node_fs28.statSync)(lockPath).mtimeMs > WORKTREE_SETUP_LOCK_TTL_MS) {
+        (0, import_node_fs28.rmSync)(lockPath, { force: true });
         return take();
       }
     } catch {
@@ -22929,6 +23271,7 @@ registerSecretsCommands(program2);
 registerEdgeCommands(program2);
 registerBoxCommands(program2);
 registerSchedulesCommands(program2);
+registerSchedulesLiftCommand(program2);
 var docs = program2.command("docs").description("generated docs surfaces \u2014 the routing index (org knowledge layer)");
 docs.command("index").description("regenerate docs/index.md from the docs/ tree (--write, the default) or fail on drift (--check) \u2014 the generated routing index, never hand-maintained").option("--check", "compare against the committed docs/index.md and exit 1 on drift; never write").option("--write", "regenerate docs/index.md when it has drifted (the default)").action(async (o) => {
   try {
@@ -23161,7 +23504,7 @@ project.command("set [owner/repo]").description("upsert project META (idempotent
   if (dupe) return fail(`org project set: KEY "${dupe}" was passed to both --var and --set; --set is an alias of --var, so pass each KEY once`);
   if (o.secretsFile) {
     try {
-      vars.push(`secrets=${(0, import_node_fs27.readFileSync)(o.secretsFile, "utf8")}`);
+      vars.push(`secrets=${(0, import_node_fs28.readFileSync)(o.secretsFile, "utf8")}`);
     } catch (e) {
       return fail(`org project set: cannot read --secrets-file ${o.secretsFile}: ${e.message}`);
     }
@@ -23463,8 +23806,8 @@ withExamples(mutating(
   let extraLabels = [];
   try {
     issueType = resolveCreateType(o.type, "issue create");
-    title = await resolveIssueTitle({ title: o.title, titleFile: o.titleFile }, { readFile: import_promises6.readFile, readStdin });
-    body = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises6.readFile, readStdin });
+    title = await resolveIssueTitle({ title: o.title, titleFile: o.titleFile }, { readFile: import_promises7.readFile, readStdin });
+    body = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises7.readFile, readStdin });
     if (o.idempotencyKey) body = appendIdempotencyMarker(body, o.idempotencyKey);
     priority = resolveCreatePriority(o.priority, "issue create");
     extraLabels = [...o.label ?? []];
@@ -23600,7 +23943,7 @@ issue.command("comment <ref>").description("post a Markdown comment to an issue
   }
   let body;
   try {
-    body = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises6.readFile, readStdin });
+    body = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises7.readFile, readStdin });
   } catch (e) {
     return fail(`issue comment: ${e.message}`);
   }
@@ -23660,8 +24003,8 @@ program2.command("report").description("file a friction report on the Hub board
   let title;
   const sourceRepo = o.repo ?? await resolveRepo(void 0);
   try {
-    title = await resolveIssueTitle({ title: o.title, titleFile: o.titleFile }, { readFile: import_promises6.readFile, readStdin });
-    body = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises6.readFile, readStdin });
+    title = await resolveIssueTitle({ title: o.title, titleFile: o.titleFile }, { readFile: import_promises7.readFile, readStdin });
+    body = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises7.readFile, readStdin });
     priority = resolveCreatePriority(o.priority, "report");
     if (!ISSUE_TYPES.includes(o.type)) {
       throw new Error(`unknown issue type "${o.type}" \u2014 expected one of: ${ISSUE_TYPES.join(", ")}`);
@@ -23710,8 +24053,8 @@ program2.command("skill-lesson").description("file a skill-lesson on the Hub boa
   let args;
   try {
     skill = assertSkillName(o.skill);
-    rawBody = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises6.readFile, readStdin });
-    const rawTitle = await resolveIssueTitle({ title: o.title, titleFile: o.titleFile }, { readFile: import_promises6.readFile, readStdin });
+    rawBody = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises7.readFile, readStdin });
+    const rawTitle = await resolveIssueTitle({ title: o.title, titleFile: o.titleFile }, { readFile: import_promises7.readFile, readStdin });
     title = buildSkillLessonTitle(skill, rawTitle);
     priority = resolveCreatePriority(o.priority, "skill-lesson");
     body = buildSkillLessonBody(rawBody, sourceRepo, pluginSha);
@@ -23762,8 +24105,8 @@ withExamples(pr.command("create").description("create a PR and print {number,url
   let body;
   let title;
   try {
-    title = await resolveIssueTitle({ title: o.title, titleFile: o.titleFile }, { readFile: import_promises6.readFile, readStdin });
-    body = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises6.readFile, readStdin });
+    title = await resolveIssueTitle({ title: o.title, titleFile: o.titleFile }, { readFile: import_promises7.readFile, readStdin });
+    body = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises7.readFile, readStdin });
   } catch (e) {
     return fail(`pr create: ${e.message}`, e instanceof TextArgError ? { code: e.code, offending_flag: e.offendingFlag } : void 0);
   }
@@ -23798,11 +24141,11 @@ pr.command("view <number>").description("read a PR as structured JSON (merged st
   }
 });
 async function listCiWorkflowPaths(cwd = process.cwd()) {
-  const wfDir = (0, import_node_path23.join)(cwd, ".github", "workflows");
-  if (!(0, import_node_fs27.existsSync)(wfDir)) return [];
-  return (0, import_node_fs27.readdirSync)(wfDir).filter((name) => /\.(ya?ml)$/i.test(name)).filter((name) => {
+  const wfDir = (0, import_node_path25.join)(cwd, ".github", "workflows");
+  if (!(0, import_node_fs28.existsSync)(wfDir)) return [];
+  return (0, import_node_fs28.readdirSync)(wfDir).filter((name) => /\.(ya?ml)$/i.test(name)).filter((name) => {
     try {
-      return workflowReportsPrChecks((0, import_node_fs27.readFileSync)((0, import_node_path23.join)(wfDir, name), "utf8"));
+      return workflowReportsPrChecks((0, import_node_fs28.readFileSync)((0, import_node_path25.join)(wfDir, name), "utf8"));
     } catch {
       return true;
     }
@@ -23829,16 +24172,16 @@ function ciAuditDeps() {
     // gate re-seed step is skipped gracefully rather than failing mid-run.
     readSeedFile: (path2) => {
       if (!root) return null;
-      const fullPath = (0, import_node_path23.join)(root, path2);
-      return (0, import_node_fs27.existsSync)(fullPath) ? (0, import_node_fs27.readFileSync)(fullPath, "utf8") : null;
+      const fullPath = (0, import_node_path25.join)(root, path2);
+      return (0, import_node_fs28.existsSync)(fullPath) ? (0, import_node_fs28.readFileSync)(fullPath, "utf8") : null;
     }
   };
 }
 function hubRoot() {
-  const fromPkg = (0, import_node_path23.join)(__dirname, "..", "..");
+  const fromPkg = (0, import_node_path25.join)(__dirname, "..", "..");
   const marker = "skills/bootstrap/seeds/manifest.json";
-  if ((0, import_node_fs27.existsSync)((0, import_node_path23.join)(fromPkg, marker))) return fromPkg;
-  if ((0, import_node_fs27.existsSync)((0, import_node_path23.join)(process.cwd(), marker))) return process.cwd();
+  if ((0, import_node_fs28.existsSync)((0, import_node_path25.join)(fromPkg, marker))) return fromPkg;
+  if ((0, import_node_fs28.existsSync)((0, import_node_path25.join)(process.cwd(), marker))) return process.cwd();
   return null;
 }
 pr.command("ci-policy").description("report merge CI policy: wait-for-checks vs no-ci (for grind/build agents)").option("--json", "machine-readable output").option("--repo <owner/repo>", "target repo (defaults to the current checkout)").action(async (o) => {
@@ -24056,7 +24399,7 @@ pr.command("merge <number>").description("merge a PR (squash by default) and cle
     localCleanup = await cleanupPrMergeLocalBranch(headRef, {
       beforeWorktrees,
       startingPath,
-      pathExists: (p) => (0, import_node_fs27.existsSync)(p),
+      pathExists: (p) => (0, import_node_fs28.existsSync)(p),
       execGit: async (args) => (await execFileP2("git", args, { timeout: GIT_TIMEOUT_MS })).stdout,
       teardownWorktreeStage,
       deferredStore,
@@ -24166,8 +24509,8 @@ function trainApplyDeps() {
     // Slack release announcement (#883): Hub-only + best-effort inside announceRelease itself.
     announce: (args) => announceRelease({
       run: async (file, cmdArgs) => (await execFileP2(file, cmdArgs, { timeout: GH_TRAIN_TIMEOUT_MS })).stdout,
-      readFile: (path2) => (0, import_promises6.readFile)(path2, "utf8"),
-      removeFile: (path2) => (0, import_promises6.unlink)(path2)
+      readFile: (path2) => (0, import_promises7.readFile)(path2, "utf8"),
+      removeFile: (path2) => (0, import_promises7.unlink)(path2)
     }, args),
     fetchEdgeDomains: async (slug) => {
       const proj = await fetchProjectBySlug(slug, registryClientDeps(await loadConfig()));
@@ -24396,10 +24739,10 @@ access.command("audit").description("audit collaborator roles + train-branch pus
     targets = resolution.targets;
   }
   const derivedMatrix = registryProjects ? accessMatrixFromProjects(registryProjects) : {};
-  const fileMatrix = (0, import_node_fs27.existsSync)("access-matrix.json") ? loadAccessMatrix((0, import_node_fs27.readFileSync)("access-matrix.json", "utf8")) : {};
+  const fileMatrix = (0, import_node_fs28.existsSync)("access-matrix.json") ? loadAccessMatrix((0, import_node_fs28.readFileSync)("access-matrix.json", "utf8")) : {};
   const matrix = mergeAccessMatrix(fileMatrix, derivedMatrix);
   const derivedContracts = registryProjects ? dataAccessContractsFromProjects(registryProjects) : { consumers: {} };
-  const fileContracts = (0, import_node_fs27.existsSync)("data-access-contracts.json") ? loadDataAccessContracts((0, import_node_fs27.readFileSync)("data-access-contracts.json", "utf8")) : { consumers: {} };
+  const fileContracts = (0, import_node_fs28.existsSync)("data-access-contracts.json") ? loadDataAccessContracts((0, import_node_fs28.readFileSync)("data-access-contracts.json", "utf8")) : { consumers: {} };
   const dataAccess = mergeDataAccessContracts(fileContracts, derivedContracts);
   const report = await auditOrgAccess(targets, deps, matrix, dataAccess);
   console.log(o.json ? JSON.stringify(report, null, 2) : renderAccessReport(report));
@@ -24432,16 +24775,16 @@ function directoryBytes(path2) {
   let total = 0;
   let entries;
   try {
-    entries = (0, import_node_fs27.readdirSync)(path2, { withFileTypes: true });
+    entries = (0, import_node_fs28.readdirSync)(path2, { withFileTypes: true });
   } catch {
     return 0;
   }
   for (const entry of entries) {
-    const child2 = (0, import_node_path23.join)(path2, entry.name);
+    const child2 = (0, import_node_path25.join)(path2, entry.name);
     if (entry.isDirectory()) total += directoryBytes(child2);
     else {
       try {
-        total += (0, import_node_fs27.statSync)(child2).size;
+        total += (0, import_node_fs28.statSync)(child2).size;
       } catch {
       }
     }
@@ -24449,25 +24792,25 @@ function directoryBytes(path2) {
   return total;
 }
 function listDirEntries(dir) {
-  return (0, import_node_fs27.readdirSync)(dir, { withFileTypes: true }).map((d) => ({ name: d.name, isDirectory: d.isDirectory() }));
+  return (0, import_node_fs28.readdirSync)(dir, { withFileTypes: true }).map((d) => ({ name: d.name, isDirectory: d.isDirectory() }));
 }
 function readInstalledPluginRefs(home) {
   const p = installedPluginsPath(home);
-  if (!(0, import_node_fs27.existsSync)(p)) return [];
+  if (!(0, import_node_fs28.existsSync)(p)) return [];
   try {
-    return installedPluginPaths((0, import_node_fs27.readFileSync)(p, "utf8"));
+    return installedPluginPaths((0, import_node_fs28.readFileSync)(p, "utf8"));
   } catch {
     return null;
   }
 }
 function pluginCacheFsDeps(home, dirBytes) {
   return {
-    exists: (p) => (0, import_node_fs27.existsSync)(p),
-    listVersionDirs: (root) => (0, import_node_fs27.readdirSync)(root, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name),
+    exists: (p) => (0, import_node_fs28.existsSync)(p),
+    listVersionDirs: (root) => (0, import_node_fs28.readdirSync)(root, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name),
     dirBytes,
-    listStagingDirs: (root) => (0, import_node_fs27.readdirSync)(root, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => {
+    listStagingDirs: (root) => (0, import_node_fs28.readdirSync)(root, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => {
       try {
-        return { name: d.name, mtimeMs: newestMtimeMs((0, import_node_path23.join)(root, d.name), listDirEntries, (p) => (0, import_node_fs27.statSync)(p).mtimeMs) };
+        return { name: d.name, mtimeMs: newestMtimeMs((0, import_node_path25.join)(root, d.name), listDirEntries, (p) => (0, import_node_fs28.statSync)(p).mtimeMs) };
       } catch {
         return { name: d.name, mtimeMs: Date.now() };
       }
@@ -24481,10 +24824,10 @@ function stagingApplyFsGuard(home) {
   return {
     referencedPaths: () => readInstalledPluginRefs(home),
     mtimeMs: (name) => {
-      const p = (0, import_node_path23.join)(stagingRoot, name);
-      if (!(0, import_node_fs27.existsSync)(p)) return null;
+      const p = (0, import_node_path25.join)(stagingRoot, name);
+      if (!(0, import_node_fs28.existsSync)(p)) return null;
       try {
-        return newestMtimeMs(p, listDirEntries, (q) => (0, import_node_fs27.statSync)(q).mtimeMs);
+        return newestMtimeMs(p, listDirEntries, (q) => (0, import_node_fs28.statSync)(q).mtimeMs);
       } catch {
         return null;
       }
@@ -24500,7 +24843,7 @@ program2.command("plugin-prune").description(`prune stale cached MMI plugin vers
     { withBytes: true }
   );
   const anythingToDelete = plan.prune.length > 0 || plan.staging.length > 0;
-  const result = o.apply && anythingToDelete ? applyPluginCachePlan(plan, (p) => (0, import_node_fs27.rmSync)(p, { recursive: true, force: true }), stagingApplyFsGuard((0, import_node_os8.homedir)())) : void 0;
+  const result = o.apply && anythingToDelete ? applyPluginCachePlan(plan, (p) => (0, import_node_fs28.rmSync)(p, { recursive: true, force: true }), stagingApplyFsGuard((0, import_node_os8.homedir)())) : void 0;
   const warnings = plan.prune.length > 0 ? [CONCURRENT_SESSION_WARNING] : [];
   if (o.json) console.log(JSON.stringify({ ...plan, warnings, applied: result ?? null }));
   else console.log(renderPluginCachePlan(plan, result));