@mutmutco/cli 3.42.0 → 3.44.0

package/dist/main.cjs

@@ -3410,7 +3410,7 @@ var program = new Command();
 
 // src/index.ts
 var import_promises7 = require("node:fs/promises");
-var import_node_fs29 = require("node:fs");
+var import_node_fs30 = require("node:fs");
 var import_node_child_process13 = require("node:child_process");
 
 // src/cli-shared.ts
@@ -4061,6 +4061,12 @@ function commandPath(cmd) {
   }
   return parts.join(" ") || cmd.name();
 }
+function jsonParity(cmd) {
+  if (!cmd.options.some((o) => o.long === "--json")) {
+    cmd.option("--json", "machine-readable output (default; accepted for parity)");
+  }
+  return cmd;
+}
 function mutating(cmd, planFn) {
   const marker = cmd;
   if (marker.__mmiMutating) return cmd;
@@ -5604,6 +5610,9 @@ function samePath(a, b) {
 function normPath(p) {
   return p.replace(/\\/g, "/").replace(/\/+$/, "").toLowerCase();
 }
+function toNativePath(p) {
+  return process.platform === "win32" ? p.replace(/\//g, "\\") : p;
+}
 function parseComposeLs(stdout) {
   const text = stdout.trim();
   if (!text) return [];
@@ -8910,9 +8919,10 @@ async function resolveWhoami(deps) {
   if (ghLogin) return { login: ghLogin, source: "github", sessionExpiresAt: session?.expiresAt };
   return { source: "unknown" };
 }
-function whoamiLine(report) {
+function whoamiLine(report, caveat) {
   if (!report.login) return null;
-  return `current human: ${report.login} (source: ${report.source}) \u2014 act for this login (e.g. claim --for ${report.login}); do not ask who the user is.`;
+  const line = `current human: ${report.login} (source: ${report.source}) \u2014 act for this login (e.g. claim --for ${report.login}); do not ask who the user is.`;
+  return caveat?.trim() ? `${line} ${caveat.trim()}` : line;
 }
 
 // src/command-ladder-hint.ts
@@ -9143,6 +9153,10 @@ async function waitForPrChecks(deps) {
     if (state === "failure") {
       failureStreak += 1;
       if (failureStreak >= PR_CHECKS_FAILURE_CONFIRMATIONS) {
+        const diagnosis = deps.diagnoseFailure ? await deps.diagnoseFailure().catch(() => null) : null;
+        if (diagnosis?.cause === "ci-budget-kill") {
+          return { policy, status: "failure", reason: diagnosis.reason, detail: "ci-budget-kill" };
+        }
         return { policy, status: "failure", reason, detail: "checks-failure" };
       }
       lastDetail = "confirming-failure";
@@ -9459,7 +9473,7 @@ function planManagedGitignore(current) {
 }
 
 // src/gate-budget.ts
-var BLESSED_RUN_WITH_BUDGET_SHA = "b6ec6e4eafcda73b543fc0754a6356551fe762a1";
+var BLESSED_RUN_WITH_BUDGET_SHA = "ea2cf8710949dec53566c29836e29cd7515a4e23";
 var REMOTE_USE = /^mutmutco\/MMI-Hub\/\.github\/actions\/run-with-budget@(\S+)$/;
 var LOCAL_USE = "./.github/actions/run-with-budget";
 var FULL_SHA = /^[0-9a-f]{40}$/;
@@ -11229,7 +11243,9 @@ async function collectWaveStatus(deps) {
     }
     const headText = await deps.fetchHeadText?.(wt.branch).catch(() => void 0);
     rows.push({
-      path: wt.path,
+      // #3338: emit NATIVE separators (see toNativePath). `-C wt.path` above and the `primary` compare
+      // below keep git's raw form — only the emitted value is converted.
+      path: toNativePath(wt.path),
       branch: wt.branch,
       primary: wt.path === primaryPath,
       dirty,
@@ -11615,6 +11631,25 @@ async function unlinkSubIssue(runGh, parentRef, childRef, defaultRepo) {
 ${stdout.trim() || "(empty)"}`);
   return result;
 }
+function parseParentIssueUrl(apiUrl) {
+  if (typeof apiUrl !== "string" || !apiUrl.trim()) return null;
+  const match = /\/repos\/([^/]+\/[^/]+)\/issues\/(\d+)\/?$/.exec(apiUrl.trim());
+  if (!match) return null;
+  const [, repo, number] = match;
+  return { repo, number: Number(number), url: `https://github.com/${repo}/issues/${number}` };
+}
+function resolveParentField(payload) {
+  if (!payload || typeof payload !== "object") {
+    return { parentReadError: "issue payload was empty or not an object" };
+  }
+  if (!("sub_issues_summary" in payload)) {
+    return { parentReadError: "issue payload carries no sub-issue fields \u2014 parent state is unknown, not absent" };
+  }
+  const raw = payload.parent_issue_url;
+  if (raw === void 0 || raw === null) return { parent: null };
+  const parsed = typeof raw === "string" ? parseParentIssueUrl(raw) : null;
+  return parsed ? { parent: parsed } : { parentReadError: `unrecognised parent_issue_url: ${JSON.stringify(raw)}` };
+}
 function parentLinkFields(result, error) {
   if (result) return { parent: result };
   if (error) return { parentLinkError: error };
@@ -13332,7 +13367,7 @@ function appendPublishDispatch(deploy, publish) {
     deployStatus: deploy.deployStatus === "failure" || publish.deployStatus === "failure" ? "failure" : deploy.deployStatus === "pending" || publish.deployStatus === "pending" ? "pending" : "success"
   };
 }
-async function watchOwnWorkflowRuns(deps, repo, targets, since, headSha) {
+async function watchOwnWorkflowRuns(deps, repo, targets, since, headSha, enumerateSha = false) {
   const workflowRuns = [];
   for (const target of targets) {
     try {
@@ -13342,8 +13377,68 @@ async function watchOwnWorkflowRuns(deps, repo, targets, since, headSha) {
       workflowRuns.push({ workflow: target.workflow, conclusion: "failure" });
     }
   }
+  if (!enumerateSha) return workflowRuns;
+  const seen = new Set(workflowRuns.map((r) => r.runId).filter((id) => typeof id === "number"));
+  workflowRuns.push(...await discoverShaWorkflowRuns(deps, repo, headSha, seen));
   return workflowRuns;
 }
+var NON_DEPLOY_EVENTS = /* @__PURE__ */ new Set([
+  "pull_request",
+  "pull_request_target",
+  "pull_request_review",
+  "pull_request_review_comment",
+  "schedule",
+  "issues",
+  "issue_comment",
+  "discussion",
+  "discussion_comment",
+  "fork",
+  "watch",
+  "star",
+  "public",
+  "gollum",
+  "create",
+  "delete"
+]);
+var SHA_ENUM_LIMIT = 50;
+var NON_FAILING_CONCLUSIONS = /* @__PURE__ */ new Set(["success", "skipped", "neutral"]);
+async function discoverShaWorkflowRuns(deps, repo, headSha, seenRunIds) {
+  const marker = `sha-enumeration(${headSha.slice(0, 7)})`;
+  let rows;
+  try {
+    rows = JSON.parse(await deps.run("gh", [
+      "run",
+      "list",
+      "--repo",
+      repo,
+      "--commit",
+      headSha,
+      "--limit",
+      String(SHA_ENUM_LIMIT),
+      "--json",
+      "databaseId,url,event,status,conclusion,workflowName"
+    ]));
+    if (!Array.isArray(rows)) throw new Error("run list did not return an array");
+  } catch {
+    return [{ workflow: marker, conclusion: "pending" }];
+  }
+  const extra = [];
+  if (rows.length >= SHA_ENUM_LIMIT) extra.push({ workflow: `${marker} truncated`, conclusion: "pending" });
+  for (const row of rows) {
+    if (typeof row.databaseId !== "number" || seenRunIds.has(row.databaseId)) continue;
+    if (NON_DEPLOY_EVENTS.has(row.event ?? "")) continue;
+    extra.push({
+      workflow: row.workflowName ?? `run:${row.databaseId}`,
+      runId: row.databaseId,
+      runUrl: row.url,
+      // An in-flight run is reported UNVERIFIED, never watched. Blocking on an arbitrary discovered run
+      // would let one long push workflow hang the release command and mask the failed rows behind it, and
+      // `gh run watch` has no timeout. The NAMED targets are the ones worth blocking on (also #3382 review).
+      conclusion: row.status === "completed" ? NON_FAILING_CONCLUSIONS.has(row.conclusion ?? "") ? "success" : "failure" : "pending"
+    });
+  }
+  return extra;
+}
 async function dispatchDeploy(deps, ctx, stage, ref, model, watch, autoRunSince, autoRunHeadSha, dispatchFailure = "throw", publishDir) {
   if (model === "tenant-container" || model === "solo-container") {
     const since = (deps.now ?? Date.now)();
@@ -13370,7 +13465,8 @@ async function dispatchDeploy(deps, ctx, stage, ref, model, watch, autoRunSince,
       ctx.repo,
       [{ workflow: "publish.yml", event: "release" }],
       since,
-      autoRunHeadSha
+      autoRunHeadSha,
+      true
     );
     const primary = workflowRuns[0];
     return { note, runId: primary?.runId, runUrl: primary?.runUrl, workflowRuns, deployStatus: aggregateWorkflowRuns(workflowRuns) };
@@ -13384,7 +13480,7 @@ async function dispatchDeploy(deps, ctx, stage, ref, model, watch, autoRunSince,
       { workflow: "deploy.yml", event: "release" },
       { workflow: "publish.yml", event: "release" }
     ];
-    const workflowRuns = await watchOwnWorkflowRuns(deps, HUB_REPO3, targets, since, autoRunHeadSha);
+    const workflowRuns = await watchOwnWorkflowRuns(deps, HUB_REPO3, targets, since, autoRunHeadSha, ref !== "rc");
     const primary = workflowRuns[0];
     return {
       note,
@@ -15386,8 +15482,7 @@ var LINK_RE = /\]\(([^)#\s]+?\.md)(?:#[^)]*)?\)/g;
 var CMD_RE = /`mmi-cli ((?:[a-z][a-z-]*)(?: [a-z][a-z-]*){0,3})/g;
 var RETIRED_RE = /\b(retired|historical|removed|deleted|gone|no longer|superseded|legacy)\b/i;
 var ROOT_DOCS = ["README.md", "architecture.md"];
-var SKIP_WALK = ["docs/Archive/", "docs/incidents/"];
-var PINNED_DOCS = ["docs/Reference/runtime-contracts.md"];
+var SKIP_WALK = ["docs/Archive/", "docs/incidents/", "docs/research/"];
 function stripFences(markdown) {
   let inFence = false;
   return markdown.split(/\r?\n/).map((line) => {
@@ -15413,14 +15508,9 @@ function extractPins(markdown) {
   });
   return pins;
 }
-function checkPins(root, readFile6) {
+function checkPins(root, readFile6, docs2) {
   const findings = [];
-  for (const doc of PINNED_DOCS) {
-    const markdown = readFile6((0, import_node_path16.join)(root, doc));
-    if (markdown == null) {
-      findings.push({ kind: "missing-doc", doc, line: 0, detail: doc });
-      continue;
-    }
+  for (const [doc, markdown] of Object.entries(docs2)) {
     for (const pin of extractPins(markdown)) {
       if ("malformed" in pin) {
         findings.push({ kind: "malformed-pin", doc, line: pin.line, detail: pin.text });
@@ -15493,13 +15583,18 @@ function checkRefs(root, deps, docs2) {
     const docDir = import_node_path16.posix.dirname(doc);
     for (const { target, line } of extractLinks(markdown)) {
       const resolved = import_node_path16.posix.normalize(import_node_path16.posix.join(docDir === "." ? "" : docDir, target));
+      if (resolved.startsWith("..")) {
+        candidates.push({ kind: "missing-link", doc, line, detail: target, escapesRoot: true });
+        continue;
+      }
       if (!exists((0, import_node_path16.join)(root, resolved))) {
         candidates.push({ kind: "missing-link", doc, line, detail: target, resolved });
       }
     }
   }
-  const ignored = candidates.length ? isIgnored(candidates.map((c) => c.kind === "missing-link" ? c.resolved : c.detail)) : /* @__PURE__ */ new Set();
-  const findings = candidates.filter((c) => !ignored.has(c.kind === "missing-link" ? c.resolved : c.detail)).map(({ resolved, ...finding }) => finding);
+  const queryable = candidates.filter((c) => !c.escapesRoot);
+  const ignored = queryable.length ? isIgnored(queryable.map((c) => c.kind === "missing-link" ? c.resolved : c.detail)) : /* @__PURE__ */ new Set();
+  const findings = candidates.filter((c) => c.escapesRoot || !ignored.has(c.kind === "missing-link" ? c.resolved : c.detail)).map(({ resolved: _resolved, escapesRoot: _escapesRoot, ...finding }) => finding);
   return { ok: findings.length === 0, findings };
 }
 function checkCommands(docs2, commandPaths) {
@@ -15544,10 +15639,12 @@ function defaultListDocs(root) {
   return [...ROOT_DOCS.filter((rel) => (0, import_node_fs18.existsSync)((0, import_node_path16.join)(root, rel))), ...docs2];
 }
 function defaultIsIgnored(root, relPaths, exec = import_node_child_process9.execFileSync) {
+  const inRepo = relPaths.filter((p) => !p.startsWith(".."));
+  if (inRepo.length === 0) return /* @__PURE__ */ new Set();
   try {
     const out = exec("git", ["check-ignore", "--stdin"], {
       cwd: root,
-      input: relPaths.join("\n"),
+      input: inRepo.join("\n"),
       encoding: "utf8"
     });
     return new Set(out.split(/\r?\n/).filter(Boolean));
@@ -15566,7 +15663,7 @@ function runDocRefs(root, deps = {}) {
     listDocs(root).map((rel) => [rel, readFile6((0, import_node_path16.join)(root, rel))]).filter(([, body]) => body != null)
   );
   const findings = [
-    ...checkPins(root, readFile6).findings,
+    ...checkPins(root, readFile6, docs2).findings,
     ...checkRefs(root, { exists, isIgnored }, docs2).findings
   ];
   if (commandPaths == null) {
@@ -17033,6 +17130,9 @@ function checkGithubPools(probe) {
   return lines;
 }
 
+// src/box-commands.ts
+var import_node_fs20 = require("node:fs");
+
 // src/box.ts
 var BOX_KEYS = {
   /** Opens every MM box INCLUDING the CI runner (`mmi-runner`). The general-purpose MM key. */
@@ -17134,6 +17234,12 @@ function formatSshRecipe(box) {
     `ssh -i "$kf" -o StrictHostKeyChecking=accept-new root@${box.address} 'hostname; uptime'`
   ].join("\n");
 }
+var SSH_RECIPE_AGENT_NOTE = "# agent callers: this is multi-line, so running it inline is denied (#1473/#2125).\n# Use `mmi-cli runtime box get <name> --ssh --script <path>` to write it to a file, then `bash <path>`.";
+function sshRecipeScript(box) {
+  return `#!/usr/bin/env bash
+${formatSshRecipe(box)}
+`;
+}
 
 // src/box-commands.ts
 var HETZNER_API = "https://api.hetzner.cloud/v1/servers";
@@ -17206,7 +17312,7 @@ function registerBoxCommands(program3) {
       await failGraceful(e.message);
     }
   });
-  box.command("get <name>").description("one box by name \u2014 its address and ssh key path; --ssh prints a ready-to-run connect recipe").option("--json", "machine-readable output").option("--ssh", "print a copy-paste ssh recipe (materializes the key to a temp file; never echoes it)").action(async (name, o) => {
+  box.command("get <name>").description("one box by name \u2014 its address and ssh key path; --ssh prints a ready-to-run connect recipe").option("--json", "machine-readable output").option("--ssh", "print a copy-paste ssh recipe (materializes the key to a temp file; never echoes it)").option("--script <path>", "with --ssh: write the recipe to <path> and print the one line to run \u2014 the runnable form for agent callers, whose transport denies a multi-line inline body (#3385)").action(async (name, o) => {
     try {
       const { boxes, incomplete } = await fetchInventory();
       const result = lookupBox(name, boxes, incomplete);
@@ -17222,8 +17328,16 @@ function registerBoxCommands(program3) {
         return;
       }
       const found = result.box;
+      if (o.script && !o.ssh) {
+        await failGraceful("runtime box get: --script requires --ssh (it writes the ssh connect recipe)");
+        return;
+      }
       if (o.json) console.log(JSON.stringify({ box: found, incomplete }, null, 2));
-      else if (o.ssh) console.log(formatSshRecipe(found));
+      else if (o.ssh && o.script) {
+        (0, import_node_fs20.writeFileSync)(o.script, sshRecipeScript(found), "utf8");
+        console.log(`wrote ${o.script} \u2014 run: bash "${o.script}"`);
+      } else if (o.ssh) console.log(`${formatSshRecipe(found)}
+${SSH_RECIPE_AGENT_NOTE}`);
       else console.log(formatBoxTable([found]));
       if (!o.json) warnIncomplete(incomplete);
       if (incomplete.length) process.exitCode = 1;
@@ -17243,7 +17357,7 @@ var ORG = "mutmutco";
 var DOC_START_MARKER = "<!-- schedules:inventory:start -->";
 var DOC_END_MARKER = "<!-- schedules:inventory:end -->";
 function isJervResource(name) {
-  return /^jerv/i.test(name);
+  return /^jerv-memory(?:-|$)/i.test(name);
 }
 function llmFromHeader(yamlText) {
   const m = /^#\s*llm:\s*(.+)$/im.exec(yamlText);
@@ -17350,6 +17464,11 @@ function awsScheduleRefs(payload) {
 }
 var DECLARED_ENTRIES = [
   { name: "mmi-backup (mm-central, mmi-fofu, zuber, mmi-oguz)", cadence: "17 2 * * *", executor: "box cron.d", llm: "no", resolved: "declared", source: "/etc/cron.d/mmi-backup \u2192 /opt/mmi-control/nightly-backup.sh (verify: mmi-cli runtime box get <box> --ssh)" },
+  // #3370: the floor under runner-hygiene.yml. That workflow runs ON the runner and needs checkout +
+  // setup-node before it can prune, so at 100% it dies at checkout and never prunes — the cleanup is
+  // unavailable exactly when it is needed. This one is root cron on the box: no checkout, no node, and
+  // a no-op below 90% disk, which is why 15 minutes is affordable.
+  { name: "mmi-runner-hygiene-oob (mmi-runner)", cadence: "*/15 * * * *", executor: "box cron.d", llm: "no", resolved: "declared", source: "/etc/cron.d/mmi-runner-hygiene \u2192 /opt/mmi-control/runner-hygiene-oob.sh; acts only at >=90% disk (verify: mmi-cli runtime box get mmi-runner --ssh)" },
   { name: "zuber-bake", cadence: "*:05/30 (every 30 min)", executor: "zuber systemd timer", llm: "no", resolved: "declared", source: "zuber-bake.timer \u2192 rolling overlay bake, metro tier, next ~6h window (verify over ssh)" },
   { name: "zuber-bake-full", cadence: "00:30 UTC (03:30 TRT, daily)", executor: "zuber systemd timer", llm: "no", resolved: "declared", source: "zuber-bake-full.timer \u2192 full 24h overlay rebuild, all 81 il (verify over ssh)" }
 ];
@@ -17944,7 +18063,7 @@ function withArmingReport(body) {
 function registerSchedulesLiftCommand(program3, deps = {}) {
   const schedules = program3.commands.find((c) => c.name() === "schedules");
   if (!schedules) throw new Error("schedules lift: registerSchedulesCommands must run first \u2014 the lift attaches to the `schedules` command");
-  schedules.command("register").alias("lift").description(`register this repo's eight-field workflow headers as SCHEDULE# registry rows (C2, #3186; renamed from \`lift\`, #3219) \u2014 a per-repo replace; aborts the whole registration on any header violation; exits 75 when the registry is unreachable (#3187). Registering does NOT arm the clock: the fleet-clock reconciler arms the rows within ${FLEET_CLOCK_RECONCILE_WINDOW}, and the success JSON carries an \`arming\` block saying so (#3281)`).option("--repo <name>", "bare repo name for the join key (defaults to the origin remote basename, case-preserved)").option("--dir <path>", "workflows directory to lift (defaults to .github/workflows)").option("--dry-run", "print the {repo, schedules} body that would be POSTed; never write").action(async (o) => {
+  jsonParity(schedules.command("register").alias("lift").description(`register this repo's eight-field workflow headers as SCHEDULE# registry rows (C2, #3186; renamed from \`lift\`, #3219) \u2014 a per-repo replace; aborts the whole registration on any header violation; exits 75 when the registry is unreachable (#3187). Registering does NOT arm the clock: the fleet-clock reconciler arms the rows within ${FLEET_CLOCK_RECONCILE_WINDOW}, and the success JSON carries an \`arming\` block saying so (#3281)`).option("--repo <name>", "bare repo name for the join key (defaults to the origin remote basename, case-preserved)").option("--dir <path>", "workflows directory to lift (defaults to .github/workflows)").option("--dry-run", "print the {repo, schedules} body that would be POSTed; never write")).action(async (o) => {
     try {
       const result = await runSchedulesLift({ repo: o.repo, dir: o.dir, dryRun: Boolean(o.dryRun) }, deps);
       if (o.dryRun) {
@@ -18423,7 +18542,7 @@ function registerQueryCommands(program3) {
 }
 
 // src/bootstrap-commands.ts
-var import_node_fs20 = require("node:fs");
+var import_node_fs21 = require("node:fs");
 
 // src/bootstrap-verify.ts
 var TRAIN_BRANCHES2 = ["development", "rc", "main"];
@@ -18971,7 +19090,7 @@ function registerBootstrapCommands(program3) {
       client: defaultGitHubClient(),
       projectMeta: meta,
       deployModel: typeof meta?.deployModel === "string" ? meta.deployModel : void 0,
-      readLocalFile: (path2) => path2 === "projects.json" && apiProjects != null ? apiProjects : (0, import_node_fs20.existsSync)(path2) ? (0, import_node_fs20.readFileSync)(path2, "utf8") : null,
+      readLocalFile: (path2) => path2 === "projects.json" && apiProjects != null ? apiProjects : (0, import_node_fs21.existsSync)(path2) ? (0, import_node_fs21.readFileSync)(path2, "utf8") : null,
       // requiredGcpApis is stored as an array by a JSON write, but `org project set --var KEY=VALUE` stores a raw
       // comma-string — accept either so the seeded value verifies regardless of how it was written.
       requiredGcpApis: (() => {
@@ -19022,12 +19141,12 @@ function registerBootstrapCommands(program3) {
       return fail(`bootstrap apply: ${e.message}`);
     }
     const manifestPath = "skills/bootstrap/seeds/manifest.json";
-    if (!(0, import_node_fs20.existsSync)(manifestPath)) return fail(`bootstrap apply: ${manifestPath} not found; bootstrap runs from the MMI-Hub repo root by design \u2014 it stamps org-level resources (Project, Ruleset, secrets, access) through the GitHub App, which is only authorized from the Hub checkout`);
-    const manifest = loadBootstrapSeeds((0, import_node_fs20.readFileSync)(manifestPath, "utf8"));
+    if (!(0, import_node_fs21.existsSync)(manifestPath)) return fail(`bootstrap apply: ${manifestPath} not found; bootstrap runs from the MMI-Hub repo root by design \u2014 it stamps org-level resources (Project, Ruleset, secrets, access) through the GitHub App, which is only authorized from the Hub checkout`);
+    const manifest = loadBootstrapSeeds((0, import_node_fs21.readFileSync)(manifestPath, "utf8"));
     const baseBranch = o.class === "content" ? "main" : "development";
     const slug = parsedRepo.slug;
     const gh = async (args) => execFileP2("gh", args, { timeout: 2e4 });
-    const readFile6 = (p) => (0, import_node_fs20.existsSync)(p) ? (0, import_node_fs20.readFileSync)(p, "utf8") : null;
+    const readFile6 = (p) => (0, import_node_fs21.existsSync)(p) ? (0, import_node_fs21.readFileSync)(p, "utf8") : null;
     const enc = (p) => p.split("/").map(encodeURIComponent).join("/");
     const rawVars = {};
     for (const value of cmdOpts.var ?? []) {
@@ -19223,11 +19342,11 @@ LIVE apply to ${repo}:
 }
 
 // src/stage-commands.ts
-var import_node_fs22 = require("node:fs");
+var import_node_fs23 = require("node:fs");
 var import_node_path20 = require("node:path");
 
 // src/port-registry.ts
-var import_node_fs21 = require("node:fs");
+var import_node_fs22 = require("node:fs");
 var import_node_path19 = require("node:path");
 
 // ../infra/port-geometry.mjs
@@ -19242,8 +19361,8 @@ function nextPortBlock(registry2) {
   return [base, base + PORT_SPAN];
 }
 function loadPortRegistry(path2) {
-  if (!(0, import_node_fs21.existsSync)(path2)) return {};
-  const raw = JSON.parse((0, import_node_fs21.readFileSync)(path2, "utf8"));
+  if (!(0, import_node_fs22.existsSync)(path2)) return {};
+  const raw = JSON.parse((0, import_node_fs22.readFileSync)(path2, "utf8"));
   const out = {};
   for (const [key, value] of Object.entries(raw)) {
     if (Array.isArray(value) && value.length === 2 && value.every((n) => typeof n === "number")) {
@@ -19257,9 +19376,9 @@ function ensurePortRange(repo, path2) {
   const existing = registry2[repo];
   if (existing) return existing;
   const range = nextPortBlock(registry2);
-  const raw = (0, import_node_fs21.existsSync)(path2) ? JSON.parse((0, import_node_fs21.readFileSync)(path2, "utf8")) : {};
+  const raw = (0, import_node_fs22.existsSync)(path2) ? JSON.parse((0, import_node_fs22.readFileSync)(path2, "utf8")) : {};
   raw[repo] = range;
-  (0, import_node_fs21.writeFileSync)(path2, JSON.stringify(raw, null, 2) + "\n", "utf8");
+  (0, import_node_fs22.writeFileSync)(path2, JSON.stringify(raw, null, 2) + "\n", "utf8");
   return range;
 }
 function portCursorSeed(registry2) {
@@ -19283,7 +19402,7 @@ function existingPortRange(repo, registry2) {
 function portRangeInfraAt(root, source) {
   const registryPath = (0, import_node_path19.join)(root, "infra", "port-ranges.json");
   const ddbScriptPath = (0, import_node_path19.join)(root, "infra", "port-ddb.mjs");
-  if (!(0, import_node_fs21.existsSync)(registryPath) || !(0, import_node_fs21.existsSync)(ddbScriptPath)) return null;
+  if (!(0, import_node_fs22.existsSync)(registryPath) || !(0, import_node_fs22.existsSync)(ddbScriptPath)) return null;
   return { root, source, registryPath, ddbScriptPath };
 }
 function resolvePortRangeInfra(cwd, packageDir) {
@@ -19472,8 +19591,8 @@ function registerStageCommands(program3) {
     const portRange = portRangeMeta && typeof portRangeMeta.start === "number" && typeof portRangeMeta.end === "number" ? [portRangeMeta.start, portRangeMeta.end] : void 0;
     return decideStage({
       registry: { deployModel: project2?.deployModel, portRange, error: read.ok ? void 0 : read.error },
-      hasCompose: (0, import_node_fs22.existsSync)((0, import_node_path20.join)(process.cwd(), "docker-compose.yml")),
-      hasEnvExample: (0, import_node_fs22.existsSync)((0, import_node_path20.join)(process.cwd(), ".env.example"))
+      hasCompose: (0, import_node_fs23.existsSync)((0, import_node_path20.join)(process.cwd(), "docker-compose.yml")),
+      hasEnvExample: (0, import_node_fs23.existsSync)((0, import_node_path20.join)(process.cwd(), ".env.example"))
     });
   }
   async function fetchStageVaultEnvMerge() {
@@ -19908,7 +20027,7 @@ function registerBoardCommands(program3) {
 }
 
 // src/merge-cleanup.ts
-var import_node_fs23 = require("node:fs");
+var import_node_fs24 = require("node:fs");
 var import_promises5 = require("node:fs/promises");
 var import_node_child_process11 = require("node:child_process");
 
@@ -20232,7 +20351,7 @@ async function applyGcPlan(plan, remote) {
       return cleanupPrMergeLocalBranch(branch.branch, {
         beforeWorktrees,
         startingPath: branch.worktreePath,
-        pathExists: (p) => (0, import_node_fs23.existsSync)(p),
+        pathExists: (p) => (0, import_node_fs24.existsSync)(p),
         execGit: async (args) => (await execFileP2("git", args, { timeout: GIT_TIMEOUT_MS })).stdout,
         teardownWorktreeStage,
         deferredStore,
@@ -20258,7 +20377,7 @@ async function applyGcPlan(plan, remote) {
   for (const wt of plan.worktreeDirs) {
     try {
       const cleanupTarget = resolveSafeSiblingWorktreeCleanupTarget(wt.path, siblingRoot, {
-        realpath: (path2) => (0, import_node_fs23.realpathSync)(path2)
+        realpath: (path2) => (0, import_node_fs24.realpathSync)(path2)
       });
       if (!cleanupTarget.ok) {
         result.failed.push(`${wt.path}: ${cleanupTarget.reason}`);
@@ -20385,13 +20504,13 @@ var realWorktreeDirRemover = {
   probe: (p) => {
     let st;
     try {
-      st = (0, import_node_fs23.lstatSync)(p);
+      st = (0, import_node_fs24.lstatSync)(p);
     } catch {
       return null;
     }
     if (st.isSymbolicLink()) return "link";
     try {
-      (0, import_node_fs23.readlinkSync)(p);
+      (0, import_node_fs24.readlinkSync)(p);
       return "link";
     } catch {
     }
@@ -20399,7 +20518,7 @@ var realWorktreeDirRemover = {
   },
   readdir: (p) => {
     try {
-      return (0, import_node_fs23.readdirSync)(p);
+      return (0, import_node_fs24.readdirSync)(p);
     } catch {
       return [];
     }
@@ -20408,9 +20527,9 @@ var realWorktreeDirRemover = {
   // leaving the target); a file symlink with unlink. rmdir first, fall back to unlink.
   detachLink: (p) => {
     try {
-      (0, import_node_fs23.rmdirSync)(p);
+      (0, import_node_fs24.rmdirSync)(p);
     } catch {
-      (0, import_node_fs23.unlinkSync)(p);
+      (0, import_node_fs24.unlinkSync)(p);
     }
   },
   removeTree: (p) => (0, import_promises5.rm)(p, { recursive: true, force: true, maxRetries: 5, retryDelay: 200 })
@@ -20443,9 +20562,9 @@ async function worktreeHasStageState(worktreePath) {
   }
 }
 function stageStateFileBelongsToWorktree(statePath, worktreePath) {
-  if (!(0, import_node_fs23.existsSync)(statePath)) return false;
+  if (!(0, import_node_fs24.existsSync)(statePath)) return false;
   try {
-    const state = JSON.parse((0, import_node_fs23.readFileSync)(statePath, "utf8"));
+    const state = JSON.parse((0, import_node_fs24.readFileSync)(statePath, "utf8"));
     const recordedCwd = typeof state.identity?.cwd === "string" ? state.identity.cwd : typeof state.cwd === "string" ? state.cwd : "";
     return Boolean(recordedCwd && isPathUnderDirectory(recordedCwd, worktreePath));
   } catch {
@@ -20534,12 +20653,15 @@ function parseRestPrSnapshot(json) {
 async function fetchRestPrSnapshot(prNumber, repo, gh = defaultGhApi) {
   return parseRestPrSnapshot(JSON.parse(await gh([`repos/${repo}/pulls/${prNumber}`])));
 }
+async function fetchHeadCheckRuns(headSha, repo, gh) {
+  const runsOut = await gh(["--paginate", `repos/${repo}/commits/${headSha}/check-runs?per_page=100`, "--jq", ".check_runs[] | {id, name, status, conclusion, app_id: .app.id}"]);
+  return dedupeLatestCheckRuns(parseNdjsonLines(runsOut));
+}
 async function fetchHeadCheckBuckets(headSha, repo, gh) {
-  const [runsOut, statusesOut] = await Promise.all([
-    gh(["--paginate", `repos/${repo}/commits/${headSha}/check-runs?per_page=100`, "--jq", ".check_runs[] | {id, name, status, conclusion, app_id: .app.id}"]),
+  const [runs, statusesOut] = await Promise.all([
+    fetchHeadCheckRuns(headSha, repo, gh),
     gh(["--paginate", `repos/${repo}/commits/${headSha}/status?per_page=100`, "--jq", ".statuses[] | {context, state}"])
   ]);
-  const runs = dedupeLatestCheckRuns(parseNdjsonLines(runsOut));
   const statuses = parseNdjsonLines(statusesOut);
   return [...runs.map(classifyCheckRun), ...statuses.map((s) => classifyCommitStatus(s.state))];
 }
@@ -20561,6 +20683,48 @@ async function pollRestPrMerged(prNumber, repo, gh = defaultGhApi) {
     return false;
   }
 }
+var CI_BUDGET_ANNOTATION_TITLE = "CI budget exceeded";
+function isErrorAnnotation(a) {
+  const level = a.annotation_level?.toLowerCase();
+  return level === "failure" || level === "error";
+}
+function classifyFailedChecks(failing) {
+  const budgetKilled = [];
+  const otherFailures = [];
+  for (const check of failing) {
+    const errors = check.annotations.filter(isErrorAnnotation);
+    const allBudget = errors.length > 0 && errors.every((a) => a.title?.trim() === CI_BUDGET_ANNOTATION_TITLE);
+    (allBudget ? budgetKilled : otherFailures).push(check.name);
+  }
+  if (budgetKilled.length && !otherFailures.length) {
+    return {
+      cause: "ci-budget-kill",
+      budgetKilled,
+      otherFailures,
+      reason: `${budgetKilled.length} check(s) were KILLED for wall-clock, not failed: ${budgetKilled.join(", ")}. No test failed \u2014 this is runner contention (concurrent gates sharing one runner). Rerun once the other gates drain (gh run rerun --failed); do not debug the diff.`
+    };
+  }
+  return {
+    cause: "checks-failure",
+    budgetKilled,
+    otherFailures,
+    reason: budgetKilled.length ? `checks failed: ${otherFailures.join(", ")}; separately, ${budgetKilled.join(", ")} was killed for wall-clock, not failed.` : `checks failed: ${otherFailures.join(", ") || "unknown"}.`
+  };
+}
+async function diagnoseFailedRestChecks(prNumber, repo, gh = defaultGhApi) {
+  try {
+    const snapshot = await fetchRestPrSnapshot(prNumber, repo, gh);
+    const failing = (await fetchHeadCheckRuns(snapshot.headSha, repo, gh)).filter((run) => classifyCheckRun(run) === "fail" && typeof run.id === "number");
+    if (!failing.length) return null;
+    const annotated = await Promise.all(failing.map(async (run) => ({
+      name: run.name ?? `check-run ${run.id}`,
+      annotations: JSON.parse(await gh([`repos/${repo}/check-runs/${run.id}/annotations`]))
+    })));
+    return classifyFailedChecks(annotated);
+  } catch {
+    return null;
+  }
+}
 async function fetchRestCorePool(gh = defaultGhApi) {
   try {
     const parsed = JSON.parse(await gh(["rate_limit"]));
@@ -20573,7 +20737,7 @@ async function fetchRestCorePool(gh = defaultGhApi) {
 }
 
 // src/worktree-lifecycle-commands.ts
-var import_node_fs24 = require("node:fs");
+var import_node_fs25 = require("node:fs");
 var import_node_path22 = require("node:path");
 var GH_TIMEOUT_MS = 2e4;
 var DEFAULT_BASE = "origin/development";
@@ -20659,17 +20823,39 @@ function classifyStaleLeaks(input) {
   }
   const knownPaths = new Set(input.worktrees.map((w) => w.path));
   for (const dir of input.orphanDirs) {
-    if (!knownPaths.has(dir)) {
-      leaks.push({
-        kind: "orphan-dir",
-        ref: dir,
-        detail: `directory under the worktrees root is not a registered worktree`,
-        remediation: `mmi-cli worktree gc --apply  (or: Remove-Item/rm -rf "${dir}")`
-      });
-    }
+    if (knownPaths.has(dir.path)) continue;
+    leaks.push({
+      kind: "orphan-dir",
+      ref: dir.path,
+      // Say only what the inspection proved. `orphaned-folder` proves the `.git` entry is gone while this
+      // repo's worktree metadata still points at the directory — NOT that the directory is empty; gc
+      // checks contents separately, at apply time.
+      detail: dir.reason === "dangling-gitdir" ? "this repo's worktree directory whose git metadata is gone" : "this repo's worktree metadata points here, but the .git entry is gone",
+      // gc --apply re-proves ownership before deleting anything; a raw `rm -rf` does not, so it is never
+      // offered here — following it on a mis-classified dir would destroy another repo's live worktree.
+      remediation: "mmi-cli worktree gc --apply"
+    });
   }
   return leaks;
 }
+var defaultOrphanDirScanDeps = {
+  listDirs: (root) => {
+    try {
+      return (0, import_node_fs25.readdirSync)(root, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => (0, import_node_path22.join)(root, e.name));
+    } catch {
+      return [];
+    }
+  },
+  inspect: inspectSiblingWorktreeDir
+};
+function scanOrphanDirs(worktreesRoot, worktreeGitRoot, deps = defaultOrphanDirScanDeps) {
+  const candidates = [];
+  for (const dir of deps.listDirs(worktreesRoot)) {
+    const { cleanup } = classifySiblingWorktreeDir(deps.inspect(dir, worktreeGitRoot));
+    if (cleanup) candidates.push({ path: dir, reason: cleanup.reason });
+  }
+  return candidates;
+}
 function formatStaleLeaks(leaks) {
   if (!leaks.length) return "worktree list --stale: no leaks found";
   const lines = [`worktree list --stale: ${leaks.length} leak(s)`];
@@ -20712,7 +20898,7 @@ function registerWorktreeCommands(program3) {
         return fail(`worktree land: refusing to land protected branch '${branch}'`, { code: ERROR_CODES.ERR_BAD_ENUM });
       }
       const gitFile = (0, import_node_path22.join)(wtPath, ".git");
-      const isLinked = (0, import_node_fs24.existsSync)(gitFile) && (0, import_node_fs24.statSync)(gitFile).isFile();
+      const isLinked = (0, import_node_fs25.existsSync)(gitFile) && (0, import_node_fs25.statSync)(gitFile).isFile();
       if (apply && !isLinked) {
         return fail("worktree land: run from inside the linked worktree you want to land (this is the primary checkout)");
       }
@@ -20801,7 +20987,7 @@ async function gatherWorktreeContext() {
   const porcelain = (await execFileP2("git", ["worktree", "list", "--porcelain"], { timeout: GIT_TIMEOUT_MS }).catch(() => ({ stdout: "" }))).stdout;
   const parsed = parseWorktreePorcelain(porcelain);
   const primaryPath = parsed[0]?.path ?? repoRoot2;
-  const worktrees = parsed.map((w) => ({ path: w.path, branch: w.branch, primary: w.path === primaryPath }));
+  const worktrees = parsed.map((w) => ({ path: toNativePath(w.path), branch: w.branch, primary: w.path === primaryPath }));
   const branchOut = (await execFileP2("git", ["branch", "--format=%(refname:short)"], { timeout: GIT_TIMEOUT_MS }).catch(() => ({ stdout: "" }))).stdout;
   const localBranches = branchOut.split(/\r?\n/).map((l) => l.trim()).filter(Boolean);
   const currentBranch2 = (await execFileP2("git", ["rev-parse", "--abbrev-ref", "HEAD"], { timeout: GIT_TIMEOUT_MS }).catch(() => ({ stdout: "" }))).stdout.trim() || void 0;
@@ -20827,18 +21013,10 @@ async function gatherWorktreeContext() {
     const s = readStageSummary(wt.path);
     if (s) stages.push({ path: wt.path, port: s.port });
   }
-  const orphanDirs = [];
   const wtRoot = siblingMmiWorktreesRoot(repoRoot2);
-  if ((0, import_node_fs24.existsSync)(wtRoot)) {
-    let entries = [];
-    try {
-      entries = (0, import_node_fs24.readdirSync)(wtRoot, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => (0, import_node_path22.join)(wtRoot, e.name));
-    } catch {
-    }
-    const known = new Set(worktrees.map((w) => w.path));
-    for (const dir of entries) {
-      if (!known.has(dir)) orphanDirs.push(dir);
-    }
+  let orphanDirs = [];
+  if ((0, import_node_fs25.existsSync)(wtRoot)) {
+    orphanDirs = scanOrphanDirs(wtRoot, await currentRepoWorktreeGitRoot(repoRoot2));
   }
   return { worktrees, localBranches, currentBranch: currentBranch2, openPrBranches, closedBranches, stages, orphanDirs };
 }
@@ -20857,7 +21035,7 @@ async function bestEffortGit(args, cwd, step, timeoutMs = GIT_TIMEOUT_MS) {
 }
 
 // src/issue-commands.ts
-var import_node_fs25 = require("node:fs");
+var import_node_fs26 = require("node:fs");
 var import_node_crypto5 = require("node:crypto");
 var ghRunner = async (args, timeoutMs) => (await execFileP2("gh", args, { timeout: timeoutMs })).stdout;
 async function editIssue(client, options, deps = {}) {
@@ -20871,7 +21049,7 @@ async function editIssue(client, options, deps = {}) {
   if (options.body !== void 0 || options.bodyFile !== void 0) {
     let body;
     if (options.bodyFile) {
-      const td = deps.textDeps ?? { readFile: (p, e) => Promise.resolve((0, import_node_fs25.readFileSync)(p, e)), readStdin: () => Promise.resolve("") };
+      const td = deps.textDeps ?? { readFile: (p, e) => Promise.resolve((0, import_node_fs26.readFileSync)(p, e)), readStdin: () => Promise.resolve("") };
       body = await resolveIssueBody({ body: options.body, bodyFile: options.bodyFile }, td);
     } else {
       body = options.body ?? "";
@@ -21136,6 +21314,7 @@ function validateBatchSpecs(specs) {
 async function createIssuesBatch(specs, options, deps = {}) {
   const ensureLabels = deps.ensureLabels ?? ensureLabelsExist;
   const client = deps.client ?? defaultGitHubClient();
+  const runCreate = deps.runCreate ?? (async (args) => (await execFileP2("gh", args, { timeout: GH_MUTATION_TIMEOUT_MS })).stdout);
   const validation = validateBatchSpecs(specs);
   if (!validation.ok) {
     const lines = validation.errors.map((e) => `  row ${e.row}: ${e.error}`).join("\n");
@@ -21172,20 +21351,33 @@ ${lines}`);
       if (rowKey) {
         body = appendIdempotencyMarker(body, rowKey);
       }
-      const args = buildIssueArgs({ type, title: spec.title, body, priority, repo: rowRepo(spec), labels: spec.labels });
+      const rowPriority = spec.priority ? priority : options.priority ?? priority;
+      const args = buildIssueArgs({ type, title: spec.title, body, priority: rowPriority, repo: rowRepo(spec), labels: spec.labels });
       const swapped = await bodyArgsViaFile(args);
+      let row;
       try {
-        const { stdout } = await execFileP2("gh", swapped.args, { timeout: GH_MUTATION_TIMEOUT_MS });
+        const stdout = await runCreate(swapped.args);
         const result = parseCreatedUrl(stdout);
-        created.push({ row: entry.row, number: result.number, url: result.url });
+        row = { row: entry.row, number: result.number, url: result.url };
+        created.push(row);
       } finally {
         await swapped.cleanup();
       }
-      if (spec.parent) {
+      if (deps.attach) {
+        const attached = await deps.attach(row.number, rowRepo(spec), rowPriority);
+        row.onBoard = attached.onBoard;
+        if (attached.projectItemId) row.projectItemId = attached.projectItemId;
+      }
+      const parentRef = spec.parent ?? options.parent;
+      if (parentRef) {
         try {
           const run = deps.runGh ?? ghRunner;
-          await linkSubIssue(run, spec.parent, `https://github.com/${rowRepo(spec)}/issues/${created[created.length - 1].number}`, rowRepo(spec));
-        } catch {
+          row.parent = await linkSubIssue(run, parentRef, row.url, rowRepo(spec));
+        } catch (e) {
+          const err = e;
+          row.parentLinkError = (err.stderr || err.message || String(e)).trim();
+          process.stderr.write(`warning: issue #${row.number} created but NOT linked under ${parentRef}: ${row.parentLinkError}
+`);
         }
       }
     } catch (e) {
@@ -21218,7 +21410,7 @@ function parseCloseReason(raw) {
   if (trimmed === "duplicateof" || trimmed === "duplicate") return { reason: "duplicate-of" };
   throw new Error(`unknown close reason "${raw}" \u2014 expected completed, not-planned, or duplicate-of`);
 }
-function registerIssueLifecycleCommands(program3) {
+function registerIssueLifecycleCommands(program3, deps = {}) {
   const issue2 = program3.commands.find((c) => c.name() === "issue");
   if (!issue2) return;
   mutating(
@@ -21341,9 +21533,9 @@ function registerIssueLifecycleCommands(program3) {
       return failGraceful(`issue unlink-child: ${(err.stderr || err.message || String(e)).trim()}${note ? ` (${note})` : ""}`);
     }
   });
-  extendCreateCommand(issue2);
+  extendCreateCommand(issue2, deps.attach);
 }
-function extendCreateCommand(issue2) {
+function extendCreateCommand(issue2, batchAttach) {
   const createCmd = issue2.commands.find((c) => c.name() === "create");
   if (!createCmd) return;
   createCmd.option("--batch <file.json>", "create multiple issues from a JSON array file (pre-validates all rows before creating any)").option("--idempotency-key <key>", "create-if-not-exists: skip creation when an issue with this key already exists (retried loops must not duplicate)");
@@ -21354,7 +21546,7 @@ function extendCreateCommand(issue2) {
     if (opts.batch) {
       let specs;
       try {
-        const raw = (0, import_node_fs25.readFileSync)(opts.batch, "utf8");
+        const raw = (0, import_node_fs26.readFileSync)(opts.batch, "utf8");
         specs = JSON.parse(raw);
         if (!Array.isArray(specs)) throw new Error("batch file must contain a JSON array");
       } catch (e) {
@@ -21366,13 +21558,27 @@ function extendCreateCommand(issue2) {
         return fail(`issue create --batch: validation failed (${validation.errors.length} error(s)):
 ${lines}`);
       }
+      const batchParent = opts.parent;
+      const batchPriority = opts.priority ? normalizePriority(opts.priority) : void 0;
       if (opts.dryRun || opts.validateOnly) {
-        const planned = validation.validated.map((v) => ({ row: v.row, type: v.type, title: v.spec.title, priority: v.priority, repo: v.spec.repo }));
+        const planned = validation.validated.map((v) => ({
+          row: v.row,
+          type: v.type,
+          title: v.spec.title,
+          priority: v.spec.priority ? v.priority : batchPriority ?? v.priority,
+          repo: v.spec.repo,
+          ...v.spec.parent ?? batchParent ? { parent: v.spec.parent ?? batchParent } : {}
+        }));
         console.log(JSON.stringify(opts.validateOnly ? { ok: true, planned } : { dry_run: true, planned }));
         return;
       }
       try {
-        const result = await createIssuesBatch(specs, { repo: opts.repo, idempotencyKey: opts.idempotencyKey });
+        const result = await createIssuesBatch(specs, {
+          repo: opts.repo,
+          idempotencyKey: opts.idempotencyKey,
+          parent: batchParent,
+          priority: batchPriority
+        }, { attach: batchAttach });
         console.log(JSON.stringify(result));
         if (result.failures.length) process.exitCode = 1;
       } catch (e) {
@@ -21398,11 +21604,11 @@ ${lines}`);
 }
 
 // src/train-commands.ts
-var import_node_fs27 = require("node:fs");
+var import_node_fs28 = require("node:fs");
 var import_node_path24 = require("node:path");
 
 // src/plugin-guard-io.ts
-var import_node_fs26 = require("node:fs");
+var import_node_fs27 = require("node:fs");
 var import_node_path23 = require("node:path");
 var import_node_os6 = require("node:os");
 
@@ -21537,7 +21743,7 @@ var installedPluginsPath2 = (surface = detectSurface(process.env)) => {
 };
 function readInstalledPlugins(surface = detectSurface(process.env)) {
   try {
-    return JSON.parse((0, import_node_fs26.readFileSync)(installedPluginsPath2(surface), "utf8"));
+    return JSON.parse((0, import_node_fs27.readFileSync)(installedPluginsPath2(surface), "utf8"));
   } catch {
     return null;
   }
@@ -21551,7 +21757,7 @@ function marketplaceCloneCandidates(surface, home) {
   }
   return [(0, import_node_path23.join)(home, ".claude", "plugins", "marketplaces", "mutmutco")];
 }
-function marketplaceClonePresent(surface, home, exists = import_node_fs26.existsSync) {
+function marketplaceClonePresent(surface, home, exists = import_node_fs27.existsSync) {
   return marketplaceCloneCandidates(surface, home).some(exists);
 }
 async function fetchNpmReleasedVersion() {
@@ -21578,7 +21784,7 @@ function snapshotPluginGuardInput(surface = detectSurface(process.env), isOrgRep
     isOrgRepo,
     installRecordPresent: hasUserInstallRecord(installed, MMI_PLUGIN_ID) || hasProjectInstallRecord(installed, MMI_PLUGIN_ID, process.cwd()),
     marketplaceClonePresent: marketplaceClonePresent(surface, (0, import_node_os6.homedir)()),
-    pluginCachePresent: (0, import_node_fs26.existsSync)((0, import_node_path23.join)((0, import_node_os6.homedir)(), homeDir, "plugins", "cache", "mutmutco", "mmi"))
+    pluginCachePresent: (0, import_node_fs27.existsSync)((0, import_node_path23.join)((0, import_node_os6.homedir)(), homeDir, "plugins", "cache", "mutmutco", "mmi"))
   };
 }
 function claudePluginGuardState(isOrgRepo) {
@@ -21713,7 +21919,7 @@ function formatTrainStatus(r) {
 // src/train-commands.ts
 function readRepoVersion() {
   try {
-    return JSON.parse((0, import_node_fs27.readFileSync)((0, import_node_path24.join)(process.cwd(), ".claude-plugin", "plugin.json"), "utf8")).version || void 0;
+    return JSON.parse((0, import_node_fs28.readFileSync)((0, import_node_path24.join)(process.cwd(), ".claude-plugin", "plugin.json"), "utf8")).version || void 0;
   } catch {
     return void 0;
   }
@@ -21924,12 +22130,14 @@ async function recommendNext(deps) {
   const load = deps?.loadConfig ?? loadConfig;
   const reader = deps?.readBoard ?? readBoard;
   const cfg = await load();
-  if (!cfg.sagaApiUrl) return null;
+  if (!cfg.sagaApiUrl) throw new Error("Hub API URL not configured \u2014 the board was NOT read (run `mmi-cli doctor`)");
   let report;
   try {
     report = await reader({ config: cfg });
-  } catch {
-    return null;
+  } catch (e) {
+    throw new Error(
+      `board unreachable \u2014 ${e.message}. This is NOT an empty board: confirm the ACTIVE gh account can see this repo (\`gh auth status\`, \`gh repo view <owner/repo>\`; \`gh auth switch --user <other>\` when more than one account is present).`
+    );
   }
   const claimable = report.primary.claimable;
   if (!claimable.length) return null;
@@ -22003,12 +22211,16 @@ async function collectOnboardStatus() {
   } else if (!board.ok) {
     nextCommand = "mmi-cli board read";
   } else {
-    const top = await recommendNext();
-    if (top) {
-      nextCommand = `mmi-cli board claim ${top.number}  # ${top.title}`;
-    } else {
-      nextCommand = "mmi-cli board read \u2014 no claimable items found";
+    let top = null;
+    let readError;
+    try {
+      top = await recommendNext();
+    } catch (e) {
+      readError = e.message;
     }
+    if (readError) nextCommand = `mmi-cli board read \u2014 ${readError}`;
+    else if (top) nextCommand = `mmi-cli board claim ${top.number}  # ${top.title}`;
+    else nextCommand = "mmi-cli board read \u2014 no claimable items found";
   }
   return { track, board, registry: registry2, secrets, nextCommand };
 }
@@ -22033,7 +22245,7 @@ function registerDiscoveryCommands(program3) {
     try {
       const item = await recommendNext();
       if (!item) {
-        console.log("No claimable board items found.");
+        console.log("No claimable board items found (board read OK).");
         return;
       }
       const priorityNote = item.priority ? ` [${item.priority}]` : "";
@@ -22800,14 +23012,30 @@ function doctorReportExitCode(checks) {
 // src/doctor-clean.ts
 function checkGithubAuth(probe) {
   const login = probe.login?.trim();
-  const ok = Boolean(login);
+  const authed = Boolean(login);
+  const reach = probe.reach;
+  if (authed && reach?.repo && reach.reachable === false) {
+    const rescuers = reach.otherAccountsThatCanSee ?? [];
+    return {
+      ok: false,
+      label: "github auth",
+      fix: rescuers.length ? `the active gh account (${login}) cannot see ${reach.repo}; another account is logged in \u2014 try: gh auth switch --user ${rescuers[0]}` : `the active gh account (${login}) cannot see ${reach.repo} \u2014 check org membership, or: gh auth login`,
+      verbose: [
+        `gh installed: ${probe.ghInstalled ? "yes" : "no"}`,
+        `authenticated as: ${login}`,
+        `can resolve ${reach.repo}: NO`,
+        rescuers.length ? `other gh accounts logged in: ${rescuers.join(", ")} \u2014 switching is the usual fix` : "no other gh account is logged in, so this is not a wrong-account mix-up"
+      ]
+    };
+  }
   return {
-    ok,
+    ok: authed,
     label: "github auth",
     fix: probe.ghInstalled ? 'run: gh auth login --hostname github.com --git-protocol https --web --scopes "project"' : "install GitHub CLI (https://cli.github.com), then: gh auth login",
     verbose: [
       `gh installed: ${probe.ghInstalled ? "yes" : "no"}`,
-      `authenticated as: ${login || "(none)"}`
+      `authenticated as: ${login || "(none)"}`,
+      ...reach?.repo ? [`can resolve ${reach.repo}: ${reach.reachable === true ? "yes" : "not probed"}`] : []
     ]
   };
 }
@@ -22980,17 +23208,22 @@ function gcReapable(plan) {
 }
 async function runDoctorClean(opts, io, deps) {
   const apply = Boolean(opts.apply);
-  const [login, isOrgRepo, released, callerArn] = await Promise.all([
+  const [login, isOrgRepo, released, callerArn, reach] = await Promise.all([
     deps.githubLogin(),
     deps.isOrgRepo(),
     opts.fast ? Promise.resolve(void 0) : deps.releasedVersion(),
-    opts.fast ? Promise.resolve(void 0) : deps.awsCallerArn()
+    opts.fast ? Promise.resolve(void 0) : deps.awsCallerArn(),
+    // #3365. Skipped on the banner/preflight lanes, which run on every SessionStart and must not pay a
+    // network round-trip — and on a bare `--fast`, whose contract is offline-safe. It DOES run on
+    // `--self`, which rides the fast lane but is the interactive "is my setup actually fine?" diagnostic,
+    // and is exactly where the wrong-active-account trap has to be caught. Fail-soft either way.
+    opts.banner || opts.preflight || opts.fast && !opts.self ? Promise.resolve(void 0) : deps.githubRepoReach?.() ?? Promise.resolve(void 0)
   ]);
   const ghInstalled2 = login ? true : await deps.ghInstalled();
   const installed = deps.installedPluginVersion();
   const checks = [];
   let restartPending = false;
-  checks.push(checkGithubAuth({ login, ghInstalled: ghInstalled2 }));
+  checks.push(checkGithubAuth({ login, ghInstalled: ghInstalled2, reach }));
   if (!opts.fast && !opts.banner && !opts.preflight && deps.githubPools) {
     checks.push(...checkGithubPools(await deps.githubPools()));
   }
@@ -23164,8 +23397,86 @@ async function runDoctorClean(opts, io, deps) {
   return exitCode;
 }
 
+// src/gh-account-visibility.ts
+function parseGhAuthAccounts(stdout) {
+  const accounts = [];
+  for (const raw of stdout.split(/\r?\n/)) {
+    const match = /Logged in to \S+ (?:account|as)\s+([A-Za-z0-9-]+)/.exec(raw);
+    if (!match?.[1]) continue;
+    accounts.push({ login: match[1], active: /\(active\)/.test(raw) });
+  }
+  return accounts;
+}
+function parseOriginRepo(remoteUrl) {
+  const url = remoteUrl.trim();
+  if (!url) return void 0;
+  const match = /github\.com[/:]([^/\s]+)\/([^/\s]+?)(?:\.git)?\/?$/.exec(url);
+  if (!match) return void 0;
+  return `${match[1]}/${match[2]}`;
+}
+function ghHostsConfigPath(env, platform2) {
+  const sep2 = platform2 === "win32" ? "\\" : "/";
+  const join24 = (...parts) => parts.join(sep2);
+  const explicit = env.GH_CONFIG_DIR?.trim();
+  if (explicit) return join24(explicit, "hosts.yml");
+  if (platform2 === "win32") {
+    const appData = (env.AppData ?? env.APPDATA)?.trim();
+    return appData ? join24(appData, "GitHub CLI", "hosts.yml") : void 0;
+  }
+  const xdg = env.XDG_CONFIG_HOME?.trim();
+  if (xdg) return join24(xdg, "gh", "hosts.yml");
+  const home = env.HOME?.trim();
+  return home ? join24(home, ".config", "gh", "hosts.yml") : void 0;
+}
+function parseGhHostsAccounts(yaml, host = "github.com") {
+  let hostIndent = null;
+  let usersIndent = null;
+  let loginIndent = null;
+  let activeLogin;
+  const logins = [];
+  for (const raw of yaml.split(/\r?\n/)) {
+    if (!raw.trim() || raw.trimStart().startsWith("#")) continue;
+    const indent = raw.length - raw.trimStart().length;
+    const keyMatch = /^"?([A-Za-z0-9._-]+)"?\s*:(.*)$/.exec(raw.trim());
+    if (!keyMatch) continue;
+    const key = keyMatch[1];
+    if (hostIndent === null) {
+      if (key === host) hostIndent = indent;
+      continue;
+    }
+    if (indent <= hostIndent) break;
+    if (usersIndent !== null && indent > usersIndent) {
+      if (loginIndent === null) loginIndent = indent;
+      if (indent === loginIndent && !/token/i.test(key)) logins.push(key);
+      continue;
+    }
+    usersIndent = null;
+    loginIndent = null;
+    if (key === "users") {
+      usersIndent = indent;
+      continue;
+    }
+    if (key === "user") {
+      const value = keyMatch[2].trim().replace(/^["']|["']$/g, "");
+      if (value) activeLogin = value;
+    }
+  }
+  const unique = [...new Set(logins)];
+  if (!unique.length && activeLogin) unique.push(activeLogin);
+  return unique.map((login) => ({ login, active: login === activeLogin }));
+}
+function ghAccountCaveat(announcedLogin, accounts) {
+  if (accounts.length <= 1) return void 0;
+  const active = accounts.find((a) => a.active)?.login;
+  if (active && active !== announcedLogin) {
+    return `NOTE: gh's active account is ${active}, not ${announcedLogin} \u2014 repo reads and pushes use ${active}. A repo that reads as "not found" is that mismatch, not lost access: gh auth switch --user ${announcedLogin}`;
+  }
+  const others = accounts.filter((a) => a.login !== active).map((a) => a.login);
+  return `NOTE: gh has ${accounts.length} accounts (active: ${active ?? "unknown"}; also ${others.join(", ")}) \u2014 a repo that reads as "not found" is usually the wrong active account, not lost access: gh auth status, then gh auth switch`;
+}
+
 // src/doctor-io.ts
-var import_node_fs28 = require("node:fs");
+var import_node_fs29 = require("node:fs");
 var import_node_os7 = require("node:os");
 var import_node_path25 = require("node:path");
 var import_node_child_process12 = require("node:child_process");
@@ -23175,7 +23486,7 @@ var MMI_PLUGIN_ID2 = "mmi@mutmutco";
 function installedClaudePluginVersion() {
   try {
     const file = JSON.parse(
-      (0, import_node_fs28.readFileSync)((0, import_node_path25.join)((0, import_node_os7.homedir)(), ".claude", "plugins", "installed_plugins.json"), "utf8")
+      (0, import_node_fs29.readFileSync)((0, import_node_path25.join)((0, import_node_os7.homedir)(), ".claude", "plugins", "installed_plugins.json"), "utf8")
     );
     const versions = (file.plugins?.[MMI_PLUGIN_ID2] ?? []).map((r) => r.version).filter((v) => Boolean(v));
     if (versions.length === 0) return void 0;
@@ -23202,7 +23513,7 @@ function readGitignore() {
   const path2 = gitignorePath();
   if (path2 === null) return null;
   try {
-    return (0, import_node_fs28.readFileSync)(path2, "utf8");
+    return (0, import_node_fs29.readFileSync)(path2, "utf8");
   } catch {
     return null;
   }
@@ -23211,7 +23522,7 @@ function writeGitignore(content) {
   const path2 = gitignorePath();
   if (path2 === null) return false;
   try {
-    (0, import_node_fs28.writeFileSync)(path2, content, "utf8");
+    (0, import_node_fs29.writeFileSync)(path2, content, "utf8");
     return true;
   } catch {
     return false;
@@ -23235,7 +23546,7 @@ async function repoRoot() {
 }
 function hasRepoLocalWorktrees() {
   const root = worktreeRootSync();
-  return root !== null && (0, import_node_fs28.existsSync)((0, import_node_path25.join)(root, ".worktrees"));
+  return root !== null && (0, import_node_fs29.existsSync)((0, import_node_path25.join)(root, ".worktrees"));
 }
 
 // src/index.ts
@@ -23256,10 +23567,31 @@ async function readDocsAuditFetch(repo) {
     verdict: row ? { repo: row.repo, date: row.date, shaRange: row.shaRange, outcome: row.outcome, checkerVendor: row.checkerVendor } : null
   };
 }
+async function githubRepoReachProbe() {
+  const remote = await execFileP2("git", ["remote", "get-url", "origin"], { timeout: GIT_TIMEOUT_MS }).then((r) => r.stdout).catch(() => "");
+  const repo = parseOriginRepo(remote);
+  if (!repo) return void 0;
+  const reachable = await execFileP2("gh", ["repo", "view", repo, "--json", "name"], { timeout: GH_MUTATION_TIMEOUT_MS }).then(() => true).catch(() => false);
+  if (reachable) return { repo, reachable: true };
+  const status = await execFileP2("gh", ["auth", "status"], { timeout: GH_MUTATION_TIMEOUT_MS }).then((r) => `${r.stdout}
+${r.stderr ?? ""}`).catch(() => "");
+  const others = parseGhAuthAccounts(status).filter((a) => !a.active).map((a) => a.login);
+  return { repo, reachable: false, otherAccountsThatCanSee: others };
+}
+function ghMultiAccountCaveat(announcedLogin) {
+  try {
+    const hostsPath = ghHostsConfigPath(process.env, process.platform);
+    if (!hostsPath || !(0, import_node_fs30.existsSync)(hostsPath)) return void 0;
+    return ghAccountCaveat(announcedLogin, parseGhHostsAccounts((0, import_node_fs30.readFileSync)(hostsPath, "utf8")));
+  } catch {
+    return void 0;
+  }
+}
 function mmiDoctorDeps() {
   return {
     githubLogin,
     ghInstalled,
+    githubRepoReach: githubRepoReachProbe,
     awsCallerArn,
     isOrgRepo: () => isOrgRepoRoot(),
     installedPluginVersion: installedClaudePluginVersion,
@@ -23463,18 +23795,18 @@ program2.hook("preAction", async (_thisCommand, actionCommand) => {
 var rules = program2.command("rules").description("org-managed .gitignore delivery");
 rules.command("gitignore").option("--write", "upsert the managed block into .gitignore (default: check only, non-zero exit on drift)").option("--json", "machine-readable output").description("verify (or --write) this repo's org-managed .gitignore block matches the SSOT").action((opts) => {
   const path2 = (0, import_node_path26.join)(process.cwd(), ".gitignore");
-  const current = (0, import_node_fs29.existsSync)(path2) ? (0, import_node_fs29.readFileSync)(path2, "utf8") : null;
+  const current = (0, import_node_fs30.existsSync)(path2) ? (0, import_node_fs30.readFileSync)(path2, "utf8") : null;
   const plan = planManagedGitignore(current);
   const drift = [...plan.added.map((l) => `+${l}`), ...plan.removed.map((l) => `-${l}`)].join(", ") || "block normalize";
   if (opts.json) {
-    if (opts.write && plan.changed) (0, import_node_fs29.writeFileSync)(path2, plan.content, "utf8");
+    if (opts.write && plan.changed) (0, import_node_fs30.writeFileSync)(path2, plan.content, "utf8");
     console.log(JSON.stringify(plan, null, 2));
     if (!opts.write && plan.changed) process.exitCode = 1;
     return;
   }
   if (opts.write) {
     if (plan.changed) {
-      (0, import_node_fs29.writeFileSync)(path2, plan.content, "utf8");
+      (0, import_node_fs30.writeFileSync)(path2, plan.content, "utf8");
       console.log(`mmi-cli org rules gitignore: updated .gitignore (${drift})`);
     } else {
       console.log("mmi-cli org rules gitignore: up to date");
@@ -23600,7 +23932,7 @@ gcCmd.option("--dry-run", "show what would be deleted (default)").option("--appl
   if (!Number.isFinite(limit) || limit < 1) return fail("worktree gc: --limit must be a positive integer");
   try {
     const plan = await gcPlan(o.remote, limit);
-    if (o.apply && !o.json) console.log(formatGcPlan(plan, false));
+    if (o.apply && !o.json) console.log(formatGcPlan(plan, true));
     let applyResult;
     if (o.apply) {
       const deferredStore = await createDeferredWorktreeStore();
@@ -23664,26 +23996,26 @@ function makeProvisionDeps(worktreeRoot, quiet, log) {
 function acquireWorktreeSetupLock(worktreeRoot) {
   const lockPath = repoRuntimeStatePath(worktreeRoot, "worktree-setup.lock");
   const take = () => {
-    const fd = (0, import_node_fs29.openSync)(lockPath, "wx");
+    const fd = (0, import_node_fs30.openSync)(lockPath, "wx");
     try {
-      (0, import_node_fs29.writeSync)(fd, String(Date.now()));
+      (0, import_node_fs30.writeSync)(fd, String(Date.now()));
     } finally {
-      (0, import_node_fs29.closeSync)(fd);
+      (0, import_node_fs30.closeSync)(fd);
     }
     return () => {
       try {
-        (0, import_node_fs29.rmSync)(lockPath, { force: true });
+        (0, import_node_fs30.rmSync)(lockPath, { force: true });
       } catch {
       }
     };
   };
   try {
-    (0, import_node_fs29.mkdirSync)((0, import_node_path26.dirname)(lockPath), { recursive: true });
+    (0, import_node_fs30.mkdirSync)((0, import_node_path26.dirname)(lockPath), { recursive: true });
     return take();
   } catch {
     try {
-      if (Date.now() - (0, import_node_fs29.statSync)(lockPath).mtimeMs > WORKTREE_SETUP_LOCK_TTL_MS) {
-        (0, import_node_fs29.rmSync)(lockPath, { force: true });
+      if (Date.now() - (0, import_node_fs30.statSync)(lockPath).mtimeMs > WORKTREE_SETUP_LOCK_TTL_MS) {
+        (0, import_node_fs30.rmSync)(lockPath, { force: true });
         return take();
       }
     } catch {
@@ -23693,7 +24025,7 @@ function acquireWorktreeSetupLock(worktreeRoot) {
 }
 var worktree = program2.command("worktree").description("self-provisioning worktrees \u2014 install deps + copy local-only config");
 withExamples(mutating(
-  worktree.command("create <branch-or-issue>").description("create a worktree from a base ref and provision it (install deps + copy local-only config); an issue ref derives the <issue>-<slug> branch, and --claim claims its board item (#2996, formerly worktree new)").option("--from <ref>", "base ref to branch from", "origin/development").option("--base <ref>", "alias of --from (git's own word for the base ref)").option("--path <path>", "worktree path (default: ../mmi-worktrees/<branch>)").option("--remote <name>", "remote to fetch when --from is a <remote>/<branch> ref", "origin").option("--slug <slug>", "issue-ref form: override the slug derived from the issue title").option("--claim", "issue-ref form: claim the issue's board item after provisioning").option("--for <login>", "with --claim: assign the board item to this login instead of @me"),
+  worktree.command("create <branch-or-issue>").description("create a worktree from a base ref and provision it (install deps + copy local-only config); an issue ref derives the <issue>-<slug> branch, and --claim claims its board item (#2996, formerly worktree new)").option("--from <ref>", "base ref to branch from", "origin/development").option("--base <ref>", "alias of --from (git's own word for the base ref)").option("--path <path>", "worktree path (default: ../mmi-worktrees/<branch> \u2014 authoritative; worktree gc/list scan only this root)").option("--remote <name>", "remote to fetch when --from is a <remote>/<branch> ref", "origin").option("--slug <slug>", "issue-ref form: override the slug derived from the issue title").option("--claim", "issue-ref form: claim the issue's board item after provisioning").option("--for <login>", "with --claim: assign the board item to this login instead of @me"),
   worktreeCreatePlan
 ).action(async (target, o, cmd) => {
   try {
@@ -24125,7 +24457,7 @@ project.command("set [owner/repo]").description("upsert project META (idempotent
   if (dupe) return fail(`org project set: KEY "${dupe}" was passed to both --var and --set; --set is an alias of --var, so pass each KEY once`);
   if (o.secretsFile) {
     try {
-      vars.push(`secrets=${(0, import_node_fs29.readFileSync)(o.secretsFile, "utf8")}`);
+      vars.push(`secrets=${(0, import_node_fs30.readFileSync)(o.secretsFile, "utf8")}`);
     } catch (e) {
       return fail(`org project set: cannot read --secrets-file ${o.secretsFile}: ${e.message}`);
     }
@@ -24391,11 +24723,14 @@ function resolveCreatePriority(raw, command) {
     });
   }
 }
-function resolveCreateType(raw, command) {
+function resolveCreateType(raw, command, labels) {
   if (raw === void 0 || raw === "") {
-    fail(`${command}: --type is required (bug | feature | task) unless --batch supplies it per row`, {
+    const nearMiss = labels?.find((l) => ISSUE_TYPES.includes(l));
+    const hint = nearMiss ? ` (you passed --label ${nearMiss} \u2014 did you mean --type ${nearMiss}?)` : "";
+    fail(`${command}: --type is required (bug | feature | task) unless --batch supplies it per row${hint}`, {
       code: ERROR_CODES.ERR_MISSING_FLAG,
-      offending_flag: "--type"
+      offending_flag: "--type",
+      ...nearMiss ? { corrected_command: `${command} --type ${nearMiss} \u2026` } : {}
     });
   }
   if (!ISSUE_TYPES.includes(raw)) {
@@ -24409,12 +24744,12 @@ function resolveCreateType(raw, command) {
 }
 var issue = program2.command("issue").description("issues \u2014 reliable create with structured output");
 withExamples(mutating(
-  issue.command("create").description("create an issue (type \u2192 label) and print {number,url,label} JSON").option("--type <type>", "bug | feature | task (sets the matching label; required unless --batch)").option("--title <title>", "issue title").option("--title-file <path|->", "read the issue title from a UTF-8 file, or from stdin with -").option("--body <body>", "issue body (markdown)").option("--body-file <path|->", "read issue body from a UTF-8 file, or from stdin with -").option("--priority <priority>", "urgent | high | medium | low (defaults to medium; sets the board Priority field only \u2014 never a priority:* label, #416)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--label <label...>", "extra label(s) to attach (repeatable; auto-created if missing)").option("--parent <ref>", "file as a native sub-issue of this parent (#123, owner/repo#123, or URL)").option("--no-related", "skip the auto related-issues comment"),
+  issue.command("create").description("create an issue (type \u2192 label) and print {number,url,label} JSON").option("--type <type>", "bug | feature | task (sets the matching label; required unless --batch)").option("--title <title>", "issue title").option("--title-file <path|->", "read the issue title from a UTF-8 file, or from stdin with -").option("--body <body>", "issue body (markdown)").option("--body-file <path|->", "read issue body from a UTF-8 file. `-` (stdin) needs a heredoc, which the agent inline-body guard denies (#1473/#2125) \u2014 prefer a real path; a title with backticks or newlines needs --title-file for the same reason (#3381)").option("--priority <priority>", "urgent | high | medium | low (defaults to medium; sets the board Priority field only \u2014 never a priority:* label, #416)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--label <label...>", "extra label(s) to attach (repeatable; auto-created if missing)").option("--parent <ref>", "file as a native sub-issue of this parent (#123, owner/repo#123, or URL)").option("--no-related", "skip the auto related-issues comment"),
   // --dry-run/--validate-only plan: validate --type + --priority (mirrors the action — a bad enum fails
   // ERR_BAD_ENUM, a missing priority defaults to medium) then echo the resolved create intent. Refs
   // (`--parent`) and title-source are validated by the action on a real run.
   (opts) => {
-    const type = resolveCreateType(opts.type, "issue create");
+    const type = resolveCreateType(opts.type, "issue create", opts.label);
     const priority = resolveCreatePriority(opts.priority, "issue create");
     return { command: "issue create", type, title: opts.title ?? opts.titleFile, priority, repo: opts.repo };
   }
@@ -24427,7 +24762,7 @@ withExamples(mutating(
   let extraLabels = [];
   let targetRepo2;
   try {
-    issueType = resolveCreateType(o.type, "issue create");
+    issueType = resolveCreateType(o.type, "issue create", o.label);
     title = await resolveIssueTitle({ title: o.title, titleFile: o.titleFile }, { readFile: import_promises7.readFile, readStdin });
     body = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises7.readFile, readStdin });
     if (o.idempotencyKey) body = appendIdempotencyMarker(body, o.idempotencyKey);
@@ -24482,6 +24817,16 @@ withExamples(mutating(
   "--type is one of bug|feature|task.",
   "--dry-run and --validate-only pre-validate the create plan before any issue is written."
 ]);
+async function readParentField(number, repo) {
+  let payload;
+  try {
+    payload = await ghJson(["api", `repos/${repo}/issues/${number}`]);
+  } catch (e) {
+    const err = e;
+    return { parentReadError: (err.stderr || err.message || String(e)).trim() };
+  }
+  return resolveParentField(payload);
+}
 issue.command("view <number>").description('read an issue as structured JSON \u2014 the mmi-cli path for non-board issue reads (#2347). --comments folds in every comment; --context also adds linkedPrs + children (the one-shot "load the whole item" read, #2894)').option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--json [fields...]", 'gh --json field list (overrides the default field set). Accepts commas, spaces, or repeated --json flags \u2014 in PowerShell an unquoted comma list is an array literal, so QUOTE it: --json "number,title,body,url"').option("--comments", 'include every comment (body + comments in one call) \u2014 the agentic "read the whole item before working it" read (#2894)').option("--context", "full working context in one call: implies --comments and also adds linkedPrs and, for an epic, a children summary (#2894)").action(async (number, o) => {
   const n = Number(number);
   if (!Number.isInteger(n) || n <= 0) return fail("issue view: <number> must be a positive integer");
@@ -24492,11 +24837,11 @@ issue.command("view <number>").description('read an issue as structured JSON \u2
     if (o.comments || o.context) {
       const boardProjectId = o.context ? await resolveBoardProjectId(o.repo) : void 0;
       const data2 = await runIssueViewContext(queryDeps(), { number: n, repo, comments: Boolean(o.comments), context: Boolean(o.context), jsonFields: fields, boardProjectId });
-      console.log(JSON.stringify(data2));
+      console.log(JSON.stringify({ ...data2, ...await readParentField(n, repo) }));
       return;
     }
     const data = await ghJson(["issue", "view", String(n), "--repo", repo, "--json", fields]);
-    console.log(JSON.stringify(data));
+    console.log(JSON.stringify({ ...data, ...await readParentField(n, repo) }));
   } catch (e) {
     const err = e;
     const raw = (err.stderr || err.message || String(e)).trim();
@@ -24542,7 +24887,7 @@ issue.command("discover-related").description("find related issues for an existi
     return fail(`issue discover-related: ${(err.stderr || err.message || String(e)).trim()}`);
   }
 });
-issue.command("link-child <parent> <child>").description("link an existing issue as a native sub-issue of a parent and print {parentNumber,subIssueNumber,totalCount} JSON").option("--repo <owner/repo>", "repo for bare refs on either side (defaults to the current repo)").action(async (parentRef, childRef, o) => {
+jsonParity(issue.command("link-child <parent> <child>").description("link an existing issue as a native sub-issue of a parent and print {parentNumber,subIssueNumber,totalCount} JSON").option("--repo <owner/repo>", "repo for bare refs on either side (defaults to the current repo)")).action(async (parentRef, childRef, o) => {
   const defaultRepo = await resolveRepo(o.repo);
   try {
     const result = await linkSubIssue(ghRunner2, parentRef, childRef, defaultRepo);
@@ -24553,7 +24898,7 @@ issue.command("link-child <parent> <child>").description("link an existing issue
     return fail(`issue link-child: ${(err.stderr || err.message || String(e)).trim()}${note ? ` (${note})` : ""}`);
   }
 });
-issue.command("comment <ref>").description("post a Markdown comment to an issue and print {number,repo,url,commentUrl} JSON").option("--body <body>", "comment body (markdown; prefer --body-file for multiline Markdown)").option("--body-file <path|->", "read comment body from a UTF-8 file, or from stdin with -").option("--repo <owner/repo>", "repo for a bare ref (defaults to the current repo)").action(async (ref, o) => {
+jsonParity(issue.command("comment <ref>").description("post a Markdown comment to an issue and print {number,repo,url,commentUrl} JSON").option("--body <body>", "comment body (markdown; prefer --body-file for multiline Markdown)").option("--body-file <path|->", "read comment body from a UTF-8 file, or from stdin with -").option("--repo <owner/repo>", "repo for a bare ref (defaults to the current repo)")).action(async (ref, o) => {
   let parsed;
   try {
     parsed = parseIssueRef(ref);
@@ -24576,7 +24921,7 @@ issue.command("comment <ref>").description("post a Markdown comment to an issue
     return fail(`issue comment: ${(err.stderr || err.message || String(e)).trim()}`);
   }
 });
-issue.command("check <ref>").description("tick (or with --off untick) a task-list checkbox in an issue/epic body by its item text and print {number,repo,item,checked,changed} JSON").requiredOption("--item <text>", "the checklist item to match \u2014 exact item text, else a unique substring").option("--off", "untick the item ([x] \u2192 [ ]) instead of ticking it").option("--repo <owner/repo>", "repo for a bare ref (defaults to the current repo)").action(async (ref, o) => {
+jsonParity(issue.command("check <ref>").description("tick (or with --off untick) a task-list checkbox in an issue/epic body by its item text and print {number,repo,item,checked,changed} JSON").requiredOption("--item <text>", "the checklist item to match \u2014 exact item text, else a unique substring").option("--off", "untick the item ([x] \u2192 [ ]) instead of ticking it").option("--repo <owner/repo>", "repo for a bare ref (defaults to the current repo)")).action(async (ref, o) => {
   let parsed;
   try {
     parsed = parseIssueRef(ref);
@@ -24761,10 +25106,10 @@ pr.command("view <number>").description("read a PR as structured JSON (merged st
 });
 async function listCiWorkflowPaths(cwd = process.cwd()) {
   const wfDir = (0, import_node_path26.join)(cwd, ".github", "workflows");
-  if (!(0, import_node_fs29.existsSync)(wfDir)) return [];
-  return (0, import_node_fs29.readdirSync)(wfDir).filter((name) => /\.(ya?ml)$/i.test(name)).filter((name) => {
+  if (!(0, import_node_fs30.existsSync)(wfDir)) return [];
+  return (0, import_node_fs30.readdirSync)(wfDir).filter((name) => /\.(ya?ml)$/i.test(name)).filter((name) => {
     try {
-      return workflowReportsPrChecks((0, import_node_fs29.readFileSync)((0, import_node_path26.join)(wfDir, name), "utf8"));
+      return workflowReportsPrChecks((0, import_node_fs30.readFileSync)((0, import_node_path26.join)(wfDir, name), "utf8"));
     } catch {
       return true;
     }
@@ -24792,15 +25137,15 @@ function ciAuditDeps() {
     readSeedFile: (path2) => {
       if (!root) return null;
       const fullPath = (0, import_node_path26.join)(root, path2);
-      return (0, import_node_fs29.existsSync)(fullPath) ? (0, import_node_fs29.readFileSync)(fullPath, "utf8") : null;
+      return (0, import_node_fs30.existsSync)(fullPath) ? (0, import_node_fs30.readFileSync)(fullPath, "utf8") : null;
     }
   };
 }
 function hubRoot() {
   const fromPkg = (0, import_node_path26.join)(__dirname, "..", "..");
   const marker = "skills/bootstrap/seeds/manifest.json";
-  if ((0, import_node_fs29.existsSync)((0, import_node_path26.join)(fromPkg, marker))) return fromPkg;
-  if ((0, import_node_fs29.existsSync)((0, import_node_path26.join)(process.cwd(), marker))) return process.cwd();
+  if ((0, import_node_fs30.existsSync)((0, import_node_path26.join)(fromPkg, marker))) return fromPkg;
+  if ((0, import_node_fs30.existsSync)((0, import_node_path26.join)(process.cwd(), marker))) return process.cwd();
   return null;
 }
 pr.command("ci-policy").description("report merge CI policy: wait-for-checks vs no-ci (for grind/build agents)").option("--json", "machine-readable output").option("--repo <owner/repo>", "target repo (defaults to the current checkout)").action(async (o) => {
@@ -24822,6 +25167,9 @@ pr.command("checks-wait <number>").description(`bounded wait for PR checks; skip
     pollChecks: () => pollRestPrChecks(number, repo),
     pollMergeable: () => pollRestPrMergeable(number, repo),
     pollRateLimit: () => fetchRestCorePool(),
+    // #3388: on a confirmed red, read the failing runs' annotations so a wall-clock budget kill stops
+    // reading as "your tests failed". One call per failing run, only at the verdict.
+    diagnoseFailure: () => diagnoseFailedRestChecks(number, repo),
     baseBranch,
     sleep: (ms) => new Promise((resolve5) => setTimeout(resolve5, ms)),
     log: (message) => console.warn(message),
@@ -24837,6 +25185,8 @@ pr.command("checks-wait <number>").description(`bounded wait for PR checks; skip
     printLine(`pr checks-wait: timeout \u2014 waited ${Math.round((result.waitedMs ?? 0) / 6e4)}m, last state: ${result.detail ?? "pending"}. No check failed; re-run to keep waiting, or pass --timeout <minutes>.`);
   } else if (result.status === "rate-limited") {
     printLine(`pr checks-wait: rate-limited \u2014 ${result.reason ?? "REST pool below floor"}. No check failed; re-run after the pool resets.`);
+  } else if (result.detail === "ci-budget-kill") {
+    printLine(`pr checks-wait: failure (wall-clock budget kill, NOT a test failure) \u2014 ${result.reason}`);
   } else printLine(`pr checks-wait: ${result.status}${result.reason ? ` \u2014 ${result.reason}` : ""}${result.detail ? ` (${result.detail})` : ""}`);
   if (result.status === "failure" || result.status === "conflicting") process.exitCode = 1;
   if (result.status === "timeout" || result.status === "rate-limited") process.exitCode = PR_CHECKS_TIMEOUT_EXIT_CODE;
@@ -24867,6 +25217,9 @@ pr.command("land <number>").description("agent merge path (#1440): train probe \
       // other base), so the fast-fail message's base branch is always 'development' here.
       pollMergeable: () => pollRestPrMergeable(prNumber, repo),
       pollRateLimit: () => fetchRestCorePool(),
+      // #3388: `pr land` is the batch path — the one most likely to self-DOS the shared runner and
+      // then read its own wall-clock kill as a broken diff.
+      diagnoseFailure: () => diagnoseFailedRestChecks(prNumber, repo),
       baseBranch: "development",
       sleep: (ms) => new Promise((resolve5) => setTimeout(resolve5, ms)),
       log: (message) => console.warn(message),
@@ -24934,7 +25287,7 @@ pr.command("land <number>").description("agent merge path (#1440): train probe \
   }
   if (result.status === "failed" || result.cleanupError) process.exitCode = 1;
 });
-pr.command("merge <number>").description("merge a PR (squash by default) and clean up its branch + worktree \u2014 no leftover local branch; on no-ci repos run pr ci-policy / checks-wait first (#1432)").option("--squash", "squash merge (default)").option("--merge", "create a merge commit").option("--rebase", "rebase merge").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--auto", "enable auto-merge \u2014 merge once the base-branch policy is satisfied (use for policy-gated repos)").option("--wait", `wait for checks to reach a terminal passing verdict before merging (default budget ${PR_CHECKS_TIMEOUT_MS / 6e4}m)`).option("--preserve-worktree", "keep the local PR worktree/stage/branch for an active multi-issue batch (#1888)").option("--force", "acknowledge and merge past a remaining prunable/severe scratch housekeeping block (advisory kept plans/ never blocks, #3012)").action(async (number, o) => {
+jsonParity(pr.command("merge <number>").description("merge a PR (squash by default) and clean up its branch + worktree \u2014 no leftover local branch; on no-ci repos run pr ci-policy / checks-wait first (#1432)").option("--squash", "squash merge (default)").option("--merge", "create a merge commit").option("--rebase", "rebase merge").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--auto", "enable auto-merge \u2014 merge once the base-branch policy is satisfied (use for policy-gated repos)").option("--wait", `wait for checks to reach a terminal passing verdict before merging (default budget ${PR_CHECKS_TIMEOUT_MS / 6e4}m)`).option("--preserve-worktree", "keep the local PR worktree/stage/branch for an active multi-issue batch (#1888)").option("--force", "acknowledge and merge past a remaining prunable/severe scratch housekeeping block (advisory kept plans/ never blocks, #3012)")).action(async (number, o) => {
   const method = o.rebase ? "--rebase" : o.merge ? "--merge" : "--squash";
   const repoArgs = o.repo ? ["--repo", o.repo] : [];
   const [headRef, baseRef, headRefOid] = (await execFileP2("gh", ["pr", "view", number, ...repoArgs, "--json", "headRefName,baseRefName,headRefOid", "--jq", '.headRefName + " " + .baseRefName + " " + (.headRefOid // "")'], { timeout: GC_GH_TIMEOUT_MS2 })).stdout.trim().split(/\s+/);
@@ -24953,6 +25306,7 @@ pr.command("merge <number>").description("merge a PR (squash by default) and cle
       pollChecks: () => pollRestPrChecks(number, repo),
       pollMergeable: () => pollRestPrMergeable(number, repo),
       pollRateLimit: () => fetchRestCorePool(),
+      diagnoseFailure: () => diagnoseFailedRestChecks(number, repo),
       baseBranch,
       sleep: (ms) => new Promise((resolve5) => setTimeout(resolve5, ms)),
       log: (message) => console.warn(message),
@@ -25039,7 +25393,7 @@ pr.command("merge <number>").description("merge a PR (squash by default) and cle
     localCleanup = await cleanupPrMergeLocalBranch(headRef, {
       beforeWorktrees,
       startingPath,
-      pathExists: (p) => (0, import_node_fs29.existsSync)(p),
+      pathExists: (p) => (0, import_node_fs30.existsSync)(p),
       execGit: async (args) => (await execFileP2("git", args, { timeout: GIT_TIMEOUT_MS })).stdout,
       teardownWorktreeStage,
       deferredStore,
@@ -25084,7 +25438,7 @@ pr.command("merge <number>").description("merge a PR (squash by default) and cle
 });
 registerQueryCommands(program2);
 registerWorktreeCommands(program2);
-registerIssueLifecycleCommands(program2);
+registerIssueLifecycleCommands(program2, { attach: attachToProject });
 registerTrainCommands(program2);
 registerDeployCommands(program2);
 registerDiscoveryCommands(program2);
@@ -25172,7 +25526,8 @@ function renderDeployLine(d) {
   else if (d.runUrl) parts.push(`run ${d.runUrl}`);
   if (d.deployStatus === "success") parts.push("deploy: SUCCEEDED");
   else if (d.deployStatus === "failure") parts.push("deploy: FAILED (promotion stands; retry the deploy, do not re-tag)");
-  else if (d.runId != null) parts.push(`deploy: dispatched (watch: gh run watch ${d.runId} --repo mutmutco/MMI-Hub --exit-status)`);
+  else if (d.runId != null) parts.push(`deploy: UNVERIFIED \u2014 dispatched, not resolved (watch: gh run watch ${d.runId} --repo mutmutco/MMI-Hub --exit-status)`);
+  else parts.push("deploy: UNVERIFIED \u2014 no run correlated or watched; resolve every workflow run on the release SHA before calling this release healthy (#3322)");
   return parts.join("; ");
 }
 function renderTrainApply(commandName, r) {
@@ -25342,7 +25697,7 @@ access.command("role [repo]").description("D14 train authority for a repo (serve
   const verdict = await fetchTrainAuthority(repo, registryClientDeps(cfg));
   if (!verdict.ok) {
     if (o.json) {
-      console.log(JSON.stringify({ repo, train: false, error: verdict.error }));
+      console.log(JSON.stringify({ repo, train: false, verified: false, error: verdict.error }));
       process.exitCode = 1;
       return;
     }
@@ -25350,7 +25705,7 @@ access.command("role [repo]").description("D14 train authority for a repo (serve
   }
   const a = verdict.authority;
   if (o.json) {
-    console.log(JSON.stringify(a));
+    console.log(JSON.stringify({ ...a, verified: true }));
     if (!a.train) process.exitCode = 1;
     return;
   }
@@ -25379,10 +25734,10 @@ access.command("audit").description("audit collaborator roles + train-branch pus
     targets = resolution.targets;
   }
   const derivedMatrix = registryProjects ? accessMatrixFromProjects(registryProjects) : {};
-  const fileMatrix = (0, import_node_fs29.existsSync)("access-matrix.json") ? loadAccessMatrix((0, import_node_fs29.readFileSync)("access-matrix.json", "utf8")) : {};
+  const fileMatrix = (0, import_node_fs30.existsSync)("access-matrix.json") ? loadAccessMatrix((0, import_node_fs30.readFileSync)("access-matrix.json", "utf8")) : {};
   const matrix = mergeAccessMatrix(fileMatrix, derivedMatrix);
   const derivedContracts = registryProjects ? dataAccessContractsFromProjects(registryProjects) : { consumers: {} };
-  const fileContracts = (0, import_node_fs29.existsSync)("data-access-contracts.json") ? loadDataAccessContracts((0, import_node_fs29.readFileSync)("data-access-contracts.json", "utf8")) : { consumers: {} };
+  const fileContracts = (0, import_node_fs30.existsSync)("data-access-contracts.json") ? loadDataAccessContracts((0, import_node_fs30.readFileSync)("data-access-contracts.json", "utf8")) : { consumers: {} };
   const dataAccess = mergeDataAccessContracts(fileContracts, derivedContracts);
   const report = await auditOrgAccess(targets, deps, matrix, dataAccess);
   console.log(o.json ? JSON.stringify(report, null, 2) : renderAccessReport(report));
@@ -25402,6 +25757,7 @@ program2.command("doctor").description("check onboarding gates and auto-heal CLI
       banner: opts.banner,
       preflight: opts.preflight,
       fast: opts.fast || opts.self,
+      self: opts.self,
       json: opts.json,
       verbose: opts.verbose
     },
@@ -25415,7 +25771,7 @@ function directoryBytes(path2) {
   let total = 0;
   let entries;
   try {
-    entries = (0, import_node_fs29.readdirSync)(path2, { withFileTypes: true });
+    entries = (0, import_node_fs30.readdirSync)(path2, { withFileTypes: true });
   } catch {
     return 0;
   }
@@ -25424,7 +25780,7 @@ function directoryBytes(path2) {
     if (entry.isDirectory()) total += directoryBytes(child2);
     else {
       try {
-        total += (0, import_node_fs29.statSync)(child2).size;
+        total += (0, import_node_fs30.statSync)(child2).size;
       } catch {
       }
     }
@@ -25432,25 +25788,25 @@ function directoryBytes(path2) {
   return total;
 }
 function listDirEntries(dir) {
-  return (0, import_node_fs29.readdirSync)(dir, { withFileTypes: true }).map((d) => ({ name: d.name, isDirectory: d.isDirectory() }));
+  return (0, import_node_fs30.readdirSync)(dir, { withFileTypes: true }).map((d) => ({ name: d.name, isDirectory: d.isDirectory() }));
 }
 function readInstalledPluginRefs(home) {
   const p = installedPluginsPath(home);
-  if (!(0, import_node_fs29.existsSync)(p)) return [];
+  if (!(0, import_node_fs30.existsSync)(p)) return [];
   try {
-    return installedPluginPaths((0, import_node_fs29.readFileSync)(p, "utf8"));
+    return installedPluginPaths((0, import_node_fs30.readFileSync)(p, "utf8"));
   } catch {
     return null;
   }
 }
 function pluginCacheFsDeps(home, dirBytes) {
   return {
-    exists: (p) => (0, import_node_fs29.existsSync)(p),
-    listVersionDirs: (root) => (0, import_node_fs29.readdirSync)(root, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name),
+    exists: (p) => (0, import_node_fs30.existsSync)(p),
+    listVersionDirs: (root) => (0, import_node_fs30.readdirSync)(root, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name),
     dirBytes,
-    listStagingDirs: (root) => (0, import_node_fs29.readdirSync)(root, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => {
+    listStagingDirs: (root) => (0, import_node_fs30.readdirSync)(root, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => {
       try {
-        return { name: d.name, mtimeMs: newestMtimeMs((0, import_node_path26.join)(root, d.name), listDirEntries, (p) => (0, import_node_fs29.statSync)(p).mtimeMs) };
+        return { name: d.name, mtimeMs: newestMtimeMs((0, import_node_path26.join)(root, d.name), listDirEntries, (p) => (0, import_node_fs30.statSync)(p).mtimeMs) };
       } catch {
         return { name: d.name, mtimeMs: Date.now() };
       }
@@ -25465,9 +25821,9 @@ function stagingApplyFsGuard(home) {
     referencedPaths: () => readInstalledPluginRefs(home),
     mtimeMs: (name) => {
       const p = (0, import_node_path26.join)(stagingRoot, name);
-      if (!(0, import_node_fs29.existsSync)(p)) return null;
+      if (!(0, import_node_fs30.existsSync)(p)) return null;
       try {
-        return newestMtimeMs(p, listDirEntries, (q) => (0, import_node_fs29.statSync)(q).mtimeMs);
+        return newestMtimeMs(p, listDirEntries, (q) => (0, import_node_fs30.statSync)(q).mtimeMs);
       } catch {
         return null;
       }
@@ -25483,7 +25839,7 @@ program2.command("plugin-prune").description(`prune stale cached MMI plugin vers
     { withBytes: true }
   );
   const anythingToDelete = plan.prune.length > 0 || plan.staging.length > 0;
-  const result = o.apply && anythingToDelete ? applyPluginCachePlan(plan, (p) => (0, import_node_fs29.rmSync)(p, { recursive: true, force: true }), stagingApplyFsGuard((0, import_node_os8.homedir)())) : void 0;
+  const result = o.apply && anythingToDelete ? applyPluginCachePlan(plan, (p) => (0, import_node_fs30.rmSync)(p, { recursive: true, force: true }), stagingApplyFsGuard((0, import_node_os8.homedir)())) : void 0;
   const warnings = plan.prune.length > 0 ? [CONCURRENT_SESSION_WARNING] : [];
   if (o.json) console.log(JSON.stringify({ ...plan, warnings, applied: result ?? null }));
   else console.log(renderPluginCachePlan(plan, result));
@@ -25508,7 +25864,7 @@ program2.command("session-start").description("run the SessionStart verbs (whoam
         hubSession: async () => hubAuthSession({ baseUrl: (await loadConfig()).sagaApiUrl ?? defaultHubUrl(), githubToken }),
         ghLogin: githubLogin
       });
-      const line = whoamiLine(report);
+      const line = whoamiLine(report, report.login ? ghMultiAccountCaveat(report.login) : void 0);
       if (line) io.log(line);
     },
     boardSlice: (io) => runBoardSlice(io, {