@mutmutco/cli 3.50.0 → 3.52.0

package/dist/main.cjs

@@ -33,6 +33,7 @@ __export(index_exports, {
   DEFAULT_PRIORITY: () => DEFAULT_PRIORITY,
   awsCallerArn: () => awsCallerArn,
   classifyParseError: () => classifyParseError,
+  envHealLockPath: () => envHealLockPath,
   gcPlan: () => gcPlan,
   isOrgRegisteredRepo: () => isOrgRegisteredRepo,
   registryClientDeps: () => registryClientDeps,
@@ -3409,8 +3410,8 @@ function useColor() {
 var program = new Command();
 
 // src/index.ts
-var import_promises7 = require("node:fs/promises");
-var import_node_fs30 = require("node:fs");
+var import_promises8 = require("node:fs/promises");
+var import_node_fs32 = require("node:fs");
 var import_node_child_process13 = require("node:child_process");
 
 // src/cli-shared.ts
@@ -3820,7 +3821,7 @@ async function fetchWithRetry(fetchImpl, url, init, opts = {}) {
   const attempts = opts.attempts ?? 3;
   const baseDelayMs = opts.baseDelayMs ?? 250;
   const retryOn = opts.retryOn ?? ((res) => res.status >= 500);
-  const sleep2 = opts.sleep ?? ((ms) => new Promise((resolve5) => setTimeout(resolve5, ms)));
+  const sleep3 = opts.sleep ?? ((ms) => new Promise((resolve5) => setTimeout(resolve5, ms)));
   let lastErr;
   for (let i = 0; i < attempts; i++) {
     const isLast = i === attempts - 1;
@@ -3828,14 +3829,14 @@ async function fetchWithRetry(fetchImpl, url, init, opts = {}) {
     try {
       const res = await fetchImpl(url, attemptInit);
       if (!isLast && retryOn(res)) {
-        await sleep2(baseDelayMs * 2 ** i);
+        await sleep3(baseDelayMs * 2 ** i);
         continue;
       }
       return res;
     } catch (e) {
       lastErr = e;
       if (isLast) throw e;
-      await sleep2(baseDelayMs * 2 ** i);
+      await sleep3(baseDelayMs * 2 ** i);
     }
   }
   throw lastErr;
@@ -3860,13 +3861,23 @@ function defaultHubSessionCachePath(env = process.env) {
   const base = env.XDG_STATE_HOME || (0, import_node_path3.join)((0, import_node_os.homedir)(), ".local", "state");
   return (0, import_node_path3.join)(base, "mmi-cli", "hub-session.json");
 }
+function roleFromToken(token) {
+  const part = token?.split(".")[1];
+  if (!part) return void 0;
+  try {
+    const claims = JSON.parse(Buffer.from(part, "base64url").toString("utf8"));
+    return claims.role === "owner" ? "owner" : void 0;
+  } catch {
+    return void 0;
+  }
+}
 function readCache(path2, apiUrl, now, githubTokenFingerprint) {
   try {
     const session = JSON.parse((0, import_node_fs3.readFileSync)(path2, "utf8"));
     if (!session.token || !session.expiresAt || session.apiUrl !== apiUrl) return null;
     if (session.githubTokenFingerprint !== githubTokenFingerprint) return null;
     if (new Date(session.expiresAt).getTime() <= now.getTime() + REFRESH_WINDOW_MS) return null;
-    return session;
+    return { ...session, role: roleFromToken(session.token) };
   } catch {
     return null;
   }
@@ -3913,6 +3924,9 @@ async function hubAuthSession(deps) {
       token: body.token,
       expiresAt: body.expiresAt,
       login: typeof body.login === "string" ? body.login : void 0,
+      // #3513: from the SIGNED token, not the response body — one rule at every hop, so the cache
+      // read and the network read cannot disagree about what counts as an assertion.
+      role: roleFromToken(body.token),
       apiUrl,
       githubTokenFingerprint
     };
@@ -5084,6 +5098,26 @@ var import_node_fs10 = require("node:fs");
 
 // src/gc.ts
 var import_node_path7 = require("node:path");
+var AGENT_ARTIFACT_PREFIXES = [".jerv/"];
+function classifyWorktreeDirt(porcelain) {
+  const lines = porcelain.split("\n").map((l) => l.trimEnd()).filter((l) => l.length > 0);
+  if (!lines.length) return "clean";
+  if (lines.some((l) => l.slice(0, 2) !== "??")) return "tracked-changes";
+  const isArtifact = (path2) => AGENT_ARTIFACT_PREFIXES.some((prefix) => (
+    // Equals the prefix without its trailing slash (`.jerv`) or sits under it (`.jerv/attest/x.json`);
+    // a sibling like `.jerv-lease.json` must NOT match by string-prefix alone.
+    path2 === prefix.slice(0, -1) || path2.startsWith(prefix)
+  ));
+  const untrackedPaths = lines.map((l) => {
+    let path2 = l.slice(3);
+    if (path2.length >= 2 && path2.startsWith('"') && path2.endsWith('"')) path2 = path2.slice(1, -1);
+    return path2;
+  });
+  return untrackedPaths.every(isArtifact) ? "artifacts-only" : "untracked-files";
+}
+function isRemovableDirt(dirt) {
+  return dirt === "clean" || dirt === "artifacts-only";
+}
 var DEFERRED_SWEEP_COMMAND = "mmi-cli worktree gc sweep-deferred";
 var DEFERRED_NOTE = "Worktree cleanup queued (IDE lock). Detached sweep will retry automatically \u2014 no human action required.";
 var PRESERVED_WORKTREE_CONFIG = "mmi.preservedWorktreeBranch";
@@ -5144,7 +5178,7 @@ async function sweepDeferredWorktrees(store, deps) {
   if (!entries.length) return { removed: [], stillDeferred: [], skipped: [] };
   let live;
   try {
-    live = parseWorktreePorcelain(await deps.git(["worktree", "list", "--porcelain"]));
+    live = parseWorktreePorcelainEntries(await deps.git(["worktree", "list", "--porcelain"]));
   } catch {
     return { removed: [], stillDeferred: entries, skipped: [] };
   }
@@ -5158,8 +5192,8 @@ async function sweepDeferredWorktrees(store, deps) {
       continue;
     }
     if (current) {
-      const dirty = (await deps.git(["-C", entry.path, "status", "--porcelain"]).catch(() => "dirty") || "").trim().length > 0;
-      if (dirty) {
+      const porcelain = await deps.git(["-C", entry.path, "status", "--porcelain"]).catch(() => void 0);
+      if (!isRemovableDirt(porcelain === void 0 ? "tracked-changes" : classifyWorktreeDirt(porcelain))) {
         stillDeferred.push(entry);
         continue;
       }
@@ -5179,7 +5213,7 @@ async function sweepDeferredWorktrees(store, deps) {
 async function sweepDeferredWorktreesWithRetry(store, deps, opts = {}) {
   const attempts = opts.attempts ?? 4;
   const backoff = opts.backoffMs ?? [500, 2e3, 5e3, 1e4];
-  const sleep2 = opts.sleep ?? defaultSleep;
+  const sleep3 = opts.sleep ?? defaultSleep;
   const removed = [];
   const skipped = [];
   let stillDeferred = [];
@@ -5189,7 +5223,7 @@ async function sweepDeferredWorktreesWithRetry(store, deps, opts = {}) {
     skipped.push(...result.skipped);
     stillDeferred = result.stillDeferred;
     if (!stillDeferred.length) break;
-    if (i < attempts - 1) await sleep2(backoff[Math.min(i, backoff.length - 1)]);
+    if (i < attempts - 1) await sleep3(backoff[Math.min(i, backoff.length - 1)]);
   }
   return { removed, stillDeferred, skipped };
 }
@@ -5281,7 +5315,7 @@ function buildRemoteBranchCleanupReport(branch, input) {
   return { name: branch, status: "not-attempted", reason: input.reason ?? "remote-check-unavailable" };
 }
 async function buildPrMergeRemoteBranchCleanupReport(branch, deps, input, options = {}) {
-  const sleep2 = options.sleep ?? defaultSleep;
+  const sleep3 = options.sleep ?? defaultSleep;
   const maxAttempts = options.maxAttempts ?? 5;
   const backoff = [500, 1e3, 1500, 2e3];
   if (!input.attempted) {
@@ -5292,7 +5326,7 @@ async function buildPrMergeRemoteBranchCleanupReport(branch, deps, input, option
   }
   let existsAfter = await deps.exists(branch, { prune: true });
   for (let i = 1; i < maxAttempts && existsAfter === true; i++) {
-    await sleep2(backoff[Math.min(i - 1, backoff.length - 1)]);
+    await sleep3(backoff[Math.min(i - 1, backoff.length - 1)]);
     existsAfter = await deps.exists(branch, { prune: true });
   }
   return buildRemoteBranchCleanupReport(branch, {
@@ -5688,7 +5722,7 @@ function parseBranchHeadRows(stdout) {
   }
   return out;
 }
-function parseWorktreePorcelain(stdout) {
+function parseWorktreePorcelainEntries(stdout) {
   const out = [];
   for (const block of stdout.split(/\r?\n(?=worktree )/)) {
     let path2 = "";
@@ -5697,15 +5731,24 @@ function parseWorktreePorcelain(stdout) {
       if (line.startsWith("worktree ")) path2 = line.slice("worktree ".length).trim();
       if (line.startsWith("branch refs/heads/")) branch = line.slice("branch refs/heads/".length).trim();
     }
-    if (path2 && branch) out.push({ path: path2, branch });
+    if (path2) out.push(branch ? { path: path2, branch } : { path: path2 });
   }
   return out;
 }
-function samePath(a, b) {
-  return a.replace(/\\/g, "/").replace(/\/+$/, "").toLowerCase() === b.replace(/\\/g, "/").replace(/\/+$/, "").toLowerCase();
+function parseWorktreePorcelain(stdout) {
+  return parseWorktreePorcelainEntries(stdout).filter(
+    (w) => typeof w.branch === "string"
+  );
+}
+function pathsAreCaseInsensitive(platform2 = process.platform) {
+  return platform2 === "win32" || platform2 === "darwin";
 }
-function normPath(p) {
-  return p.replace(/\\/g, "/").replace(/\/+$/, "").toLowerCase();
+function normPath(p, platform2 = process.platform) {
+  const unified = p.replace(/\\/g, "/").replace(/\/+$/, "");
+  return pathsAreCaseInsensitive(platform2) ? unified.toLowerCase() : unified;
+}
+function samePath(a, b, platform2 = process.platform) {
+  return normPath(a, platform2) === normPath(b, platform2);
 }
 function toNativePath(p) {
   return process.platform === "win32" ? p.replace(/\//g, "\\") : p;
@@ -5753,7 +5796,7 @@ function selectWorktreeComposeProjects(worktreePath, projects) {
   return names;
 }
 function deriveComposeProjectName(worktreePath) {
-  const norm = normPath(worktreePath);
+  const norm = normPath(worktreePath).toLowerCase();
   if (!norm) return void 0;
   const base = norm.slice(norm.lastIndexOf("/") + 1);
   const name = base.replace(/[^a-z0-9_-]+/g, "_").replace(/^[^a-z0-9]+/, "");
@@ -5862,9 +5905,10 @@ async function fastForwardCurrentBranch(git) {
 }
 async function returnCheckoutToBase(git, base, mergedBranch, currentBranch2) {
   if (currentBranch2 === mergedBranch) {
-    const dirty = (await git(["status", "--porcelain"]).catch(() => "dirty") || "").trim().length > 0;
-    if (dirty) {
-      return { report: { branch: base, switched: false, sync: "skipped", reason: "dirty-worktree" }, canDeleteBranch: false };
+    const porcelain = await git(["status", "--porcelain"]).catch(() => void 0);
+    const dirt = porcelain === void 0 ? "tracked-changes" : classifyWorktreeDirt(porcelain);
+    if (!isRemovableDirt(dirt)) {
+      return { report: { branch: base, switched: false, sync: "skipped", reason: dirt === "untracked-files" ? "untracked-files" : "dirty-worktree" }, canDeleteBranch: false };
     }
     try {
       await git(["checkout", base]);
@@ -5947,20 +5991,22 @@ async function cleanupPrMergeLocalBranch(branch, options) {
     return report;
   }
   const worktreeDirtyAtActTime = async (path2) => {
-    if (options.pathExists && !options.pathExists(path2)) return false;
-    if (options.isWorktreeDirty) return options.isWorktreeDirty(path2);
+    if (options.pathExists && !options.pathExists(path2)) return void 0;
+    if (options.isWorktreeDirty) return await options.isWorktreeDirty(path2) ? "tracked-changes" : void 0;
     try {
-      return (await options.execGit(["-C", path2, "status", "--porcelain"]) || "").trim().length > 0;
+      return classifyWorktreeDirt(await options.execGit(["-C", path2, "status", "--porcelain"]));
     } catch {
-      return true;
+      return "tracked-changes";
     }
   };
   if (wtPath && mainWorktreeTarget) {
     report.worktree = { path: wtPath, status: "not-attempted", reason: "main-worktree" };
   } else if (wtPath) {
-    if (await worktreeDirtyAtActTime(wtPath)) {
-      report.worktree = { path: wtPath, status: "not-attempted", reason: "dirty-worktree" };
-      report.localBranch = { name: branch, status: "not-attempted", reason: "dirty-worktree" };
+    const dirt = await worktreeDirtyAtActTime(wtPath);
+    if (dirt !== void 0 && !isRemovableDirt(dirt)) {
+      const reason = dirt === "untracked-files" ? "untracked-files" : "dirty-worktree";
+      report.worktree = { path: wtPath, status: "not-attempted", reason };
+      report.localBranch = { name: branch, status: "not-attempted", reason };
       return report;
     }
     const removeDeps = {
@@ -7443,7 +7489,7 @@ async function worktreeBranches() {
     let dirty = true;
     try {
       const { stdout: status } = await execFileP2("git", ["-C", w.path, "status", "--porcelain"], { timeout: GIT_TIMEOUT_MS });
-      dirty = status.trim().length > 0;
+      dirty = !isRemovableDirt(classifyWorktreeDirt(status));
     } catch {
       dirty = true;
     }
@@ -7859,6 +7905,12 @@ function parseIssueSelector(selector, defaultRepo) {
   if (local) return { repo: defaultRepo, number: Number(local[1]) };
   throw new Error(`expected an issue selector like 123, #123, owner/repo#123, or a GitHub issue URL`);
 }
+function sameRepo(itemRepo, selectorKey) {
+  const repo = itemRepo.toLowerCase();
+  if (repo === selectorKey) return true;
+  if (selectorKey.includes("/")) return false;
+  return repo.slice(repo.indexOf("/") + 1) === selectorKey;
+}
 function partitionBoardItems(items, viewer, currentRepo, writableRepos) {
   const empty = () => ({ userOwned: [], claimable: [], taken: [], unownedInFlight: [] });
   const groups = { primary: empty(), secondary: empty() };
@@ -7866,7 +7918,7 @@ function partitionBoardItems(items, viewer, currentRepo, writableRepos) {
   const repoKey = currentRepo.toLowerCase();
   for (const item of items) {
     if (!ACTIVE_STATUSES.has(item.status)) continue;
-    const scope = item.repository.toLowerCase() === repoKey ? "primary" : "secondary";
+    const scope = sameRepo(item.repository, repoKey) ? "primary" : "secondary";
     const assignees = item.assignees.map((a) => a.toLowerCase());
     const assignedToViewer = assignees.includes(viewerKey);
     if (assignedToViewer) {
@@ -8413,11 +8465,11 @@ var defaultRetrySleep = (ms) => new Promise((resolve5) => setTimeout(resolve5, m
 async function resolveProjectItemIdWithRetry(client, cfg, selector, opts = {}) {
   const attempts = Math.max(1, opts.attempts ?? 5);
   const delayMs = opts.delayMs ?? 300;
-  const sleep2 = opts.sleep ?? defaultRetrySleep;
+  const sleep3 = opts.sleep ?? defaultRetrySleep;
   for (let attempt = 0; attempt < attempts; attempt += 1) {
     const itemId = (await fetchIssueProjectItem(client, cfg, selector)).item?.itemId;
     if (itemId) return itemId;
-    if (attempt < attempts - 1) await sleep2(delayMs * (attempt + 1));
+    if (attempt < attempts - 1) await sleep3(delayMs * (attempt + 1));
   }
   return void 0;
 }
@@ -9000,9 +9052,196 @@ async function gatherStaleWorktreeWarning(gitRun = defaultGitRun) {
   }
 }
 
-// src/hook-activity.ts
+// src/released-version-cache.ts
 var import_node_fs12 = require("node:fs");
 var import_node_path10 = require("node:path");
+var RELEASED_VERSION_CACHE_MS = 24 * 36e5;
+function releasedVersionCachePath(runtimeRoot) {
+  return (0, import_node_path10.join)(runtimeRoot, "head-ts", ".released-version");
+}
+function readReleasedVersionCache(cachePath, now = Date.now(), read = import_node_fs12.readFileSync) {
+  let parsed;
+  try {
+    parsed = JSON.parse(read(cachePath, "utf8"));
+  } catch {
+    return void 0;
+  }
+  if (!parsed || typeof parsed !== "object") return void 0;
+  const { version, at } = parsed;
+  if (typeof version !== "string" || !version.trim()) return void 0;
+  if (typeof at !== "number" || !Number.isFinite(at)) return void 0;
+  const age = now - at;
+  if (age < 0 || age >= RELEASED_VERSION_CACHE_MS) return void 0;
+  return { version, at };
+}
+function writeReleasedVersionCache(cachePath, version, now = Date.now()) {
+  try {
+    (0, import_node_fs12.mkdirSync)((0, import_node_path10.dirname)(cachePath), { recursive: true });
+    (0, import_node_fs12.writeFileSync)(cachePath, JSON.stringify({ version, at: now }), "utf8");
+  } catch {
+  }
+}
+function cacheAgeHours(at, now = Date.now()) {
+  return Math.max(0, Math.floor((now - at) / 36e5));
+}
+function cachedReadNote(cachedAt, now = Date.now()) {
+  const hours = cacheAgeHours(cachedAt, now);
+  return `(cached ${hours < 1 ? "<1" : hours}h ago \u2014 the banner reads npm at most once a day)`;
+}
+
+// src/marketplace-autoupdate.ts
+var KNOWN_MARKETPLACES_RELATIVE = [".claude", "plugins", "known_marketplaces.json"];
+var MMI_MARKETPLACE_NAME = "mutmutco";
+function readFileSyncSafe(path2, read) {
+  try {
+    return read(path2, "utf8");
+  } catch {
+    return void 0;
+  }
+}
+var AUTO_UPDATE_DEFAULT_ON = /* @__PURE__ */ new Set([
+  "claude-plugins-official",
+  "claude-code-marketplace",
+  "claude-code-plugins",
+  "anthropic-marketplace",
+  "anthropic-plugins",
+  "agent-skills",
+  "anthropic-agent-skills"
+]);
+function resolveAutoUpdate(probe) {
+  const { name, registered, declared, settingsDeclared } = probe;
+  if (!registered) {
+    return { name, effective: false, reason: "not registered \u2014 nothing to update" };
+  }
+  if (typeof declared === "boolean") {
+    return { name, effective: declared, reason: `declared ${declared} in known_marketplaces.json` };
+  }
+  if (typeof settingsDeclared === "boolean") {
+    return { name, effective: settingsDeclared, reason: `declared ${settingsDeclared} under extraKnownMarketplaces.${name}` };
+  }
+  if (AUTO_UPDATE_DEFAULT_ON.has(name.toLowerCase())) {
+    return { name, effective: true, reason: "undeclared \u2014 an official Anthropic marketplace, on by default" };
+  }
+  return {
+    name,
+    effective: false,
+    reason: "undeclared \u2014 third-party marketplaces are OFF by default, so nothing auto-updates and no update notice ever prints"
+  };
+}
+function readKnownMarketplace(raw, name) {
+  if (!raw) return { registered: false };
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return { registered: false };
+  }
+  if (!parsed || typeof parsed !== "object") return { registered: false };
+  const entry = parsed[name];
+  if (!entry || typeof entry !== "object") return { registered: false };
+  const { autoUpdate, source } = entry;
+  const ref = source && typeof source === "object" ? source.ref : void 0;
+  return {
+    registered: true,
+    ...typeof autoUpdate === "boolean" ? { declared: autoUpdate } : {},
+    ...typeof ref === "string" && ref ? { ref } : {}
+  };
+}
+function readSettingsAutoUpdate(raw, name) {
+  if (!raw) return void 0;
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return void 0;
+  }
+  const extra = parsed?.extraKnownMarketplaces;
+  if (!extra || typeof extra !== "object") return void 0;
+  const entry = extra[name];
+  if (!entry || typeof entry !== "object") return void 0;
+  const { autoUpdate } = entry;
+  return typeof autoUpdate === "boolean" ? autoUpdate : void 0;
+}
+var AUTO_UPDATE_TOGGLE_STEPS = "`/plugin` \u2192 Marketplaces tab \u2192 select the marketplace \u2192 Enable auto-update";
+var CATALOG_CONTENT_REF = "main";
+var CATALOG_REF_PIN_STEPS = `add \`"ref": "${CATALOG_CONTENT_REF}"\` to this marketplace's \`source\` in ~/.claude/plugins/known_marketplaces.json, then restart Claude`;
+function resolveCatalogRef(probe) {
+  const { name, registered, ref, autoUpdate } = probe;
+  if (!registered) return void 0;
+  if (ref) {
+    const agrees = ref === CATALOG_CONTENT_REF;
+    return {
+      name,
+      ref,
+      autoUpdate,
+      unpinned: false,
+      agrees,
+      reason: agrees ? `pinned to ${ref} \u2014 catalog and plugin content come from the same branch` : `pinned to ${ref} \u2014 plugin content is pinned to ${CATALOG_CONTENT_REF}, so the two disagree`
+    };
+  }
+  return {
+    name,
+    autoUpdate,
+    unpinned: true,
+    agrees: false,
+    reason: `no ref pinned \u2014 the catalog is served from the repo's default branch while plugin content is pinned to ${CATALOG_CONTENT_REF}`
+  };
+}
+function checkMarketplaceAutoUpdate(probe) {
+  if (!probe) return null;
+  const evidence = [`${probe.name}: auto-update ${probe.effective ? "on" : "off"} \u2014 ${probe.reason}`];
+  if (probe.effective) {
+    return { ok: true, label: `marketplace auto-update (${probe.name})`, detail: "on", verbose: evidence };
+  }
+  return {
+    ok: true,
+    warn: true,
+    label: `marketplace auto-update (${probe.name})`,
+    detail: `off \u2014 this machine will not pick up a new plugin release on its own; turn it on with ${AUTO_UPDATE_TOGGLE_STEPS}`,
+    verbose: evidence
+  };
+}
+function checkMarketplaceCatalogRef(probe) {
+  if (!probe) return null;
+  const label = `marketplace catalog ref (${probe.name})`;
+  const evidence = [`${probe.name}: ${probe.reason}`, `auto-update: ${probe.autoUpdate ? "on" : "off"}`];
+  if (probe.agrees) {
+    return { ok: true, label, detail: `${probe.ref}`, verbose: evidence };
+  }
+  const drift = probe.unpinned ? "unpinned" : `pinned to ${probe.ref}, not ${CATALOG_CONTENT_REF}`;
+  if (probe.autoUpdate) {
+    return {
+      ok: false,
+      label,
+      fix: `${drift} while auto-update is ON \u2014 this machine installs plugin releases advertised by a branch nobody released; ${CATALOG_REF_PIN_STEPS}`,
+      verbose: evidence
+    };
+  }
+  return {
+    ok: true,
+    warn: true,
+    label,
+    detail: `${drift} \u2014 harmless while auto-update is off, and the thing to fix before turning it on; ${CATALOG_REF_PIN_STEPS}`,
+    verbose: evidence
+  };
+}
+function marketplaceRows(name, known, settings) {
+  const { registered, declared, ref } = readKnownMarketplace(known, name);
+  const autoUpdate = resolveAutoUpdate({
+    name,
+    registered,
+    declared,
+    settingsDeclared: readSettingsAutoUpdate(settings, name)
+  });
+  const rows = [checkMarketplaceAutoUpdate(autoUpdate), checkMarketplaceCatalogRef(
+    resolveCatalogRef({ name, registered, ref, autoUpdate: autoUpdate.effective })
+  )];
+  return rows.filter((r) => r !== null);
+}
+
+// src/hook-activity.ts
+var import_node_fs13 = require("node:fs");
+var import_node_path11 = require("node:path");
 var DEFAULT_SURFACE = "claude";
 function activityLogPath(cwd) {
   return repoRuntimeStatePath(cwd, "hooks", "activity.jsonl");
@@ -9015,16 +9254,16 @@ function appendHookActivity(cwd, entry) {
       surface: DEFAULT_SURFACE,
       ...entry
     };
-    (0, import_node_fs12.mkdirSync)((0, import_node_path10.dirname)(path2), { recursive: true });
-    (0, import_node_fs12.appendFileSync)(path2, `${JSON.stringify(line)}
+    (0, import_node_fs13.mkdirSync)((0, import_node_path11.dirname)(path2), { recursive: true });
+    (0, import_node_fs13.appendFileSync)(path2, `${JSON.stringify(line)}
 `, "utf8");
   } catch {
   }
 }
 
 // src/worktree.ts
-var import_node_fs13 = require("node:fs");
-var import_node_path11 = require("node:path");
+var import_node_fs14 = require("node:fs");
+var import_node_path12 = require("node:path");
 var LOCAL_ONLY_FILES = [".claude/settings.local.json"];
 var PKG = "package.json";
 var LOCKFILE = "package-lock.json";
@@ -9032,21 +9271,21 @@ var NODE_MODULES = "node_modules";
 var realFsProbe = {
   isDir: (p) => {
     try {
-      return (0, import_node_fs13.statSync)(p).isDirectory();
+      return (0, import_node_fs14.statSync)(p).isDirectory();
     } catch {
       return false;
     }
   },
   isFile: (p) => {
     try {
-      return (0, import_node_fs13.statSync)(p).isFile();
+      return (0, import_node_fs14.statSync)(p).isFile();
     } catch {
       return false;
     }
   },
   listDirs: (p) => {
     try {
-      return (0, import_node_fs13.readdirSync)(p, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name);
+      return (0, import_node_fs14.readdirSync)(p, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name);
     } catch {
       return [];
     }
@@ -9054,12 +9293,12 @@ var realFsProbe = {
 };
 function scanInstallDirs(root, fs2 = realFsProbe) {
   const factsFor = (dir) => {
-    const abs = dir ? (0, import_node_path11.join)(root, dir) : root;
+    const abs = dir ? (0, import_node_path12.join)(root, dir) : root;
     return {
       dir,
-      hasPackageJson: fs2.isFile((0, import_node_path11.join)(abs, PKG)),
-      hasLockfile: fs2.isFile((0, import_node_path11.join)(abs, LOCKFILE)),
-      hasNodeModules: fs2.isDir((0, import_node_path11.join)(abs, NODE_MODULES))
+      hasPackageJson: fs2.isFile((0, import_node_path12.join)(abs, PKG)),
+      hasLockfile: fs2.isFile((0, import_node_path12.join)(abs, LOCKFILE)),
+      hasNodeModules: fs2.isDir((0, import_node_path12.join)(abs, NODE_MODULES))
     };
   };
   const children = fs2.listDirs(root).filter((name) => name !== NODE_MODULES && name !== ".git");
@@ -9069,7 +9308,7 @@ function npmInstallTargets(dirs) {
   return dirs.filter((d) => d.hasPackageJson && !d.hasNodeModules).map((d) => ({ dir: d.dir, command: d.hasLockfile ? "npm ci" : "npm install" }));
 }
 function isLinkedWorktree(root, fs2 = realFsProbe) {
-  return fs2.isFile((0, import_node_path11.join)(root, ".git"));
+  return fs2.isFile((0, import_node_path12.join)(root, ".git"));
 }
 function worktreeAutoProvisionBanner(root, fs2 = realFsProbe) {
   if (!isLinkedWorktree(root, fs2)) return null;
@@ -9079,8 +9318,8 @@ function worktreeAutoProvisionBanner(root, fs2 = realFsProbe) {
   return `[worktree] provisioning tooling in the background (deps in ${where} + local config) \u2014 \`mmi-cli worktree setup\` to redo`;
 }
 function defaultCopyFile(from, to) {
-  (0, import_node_fs13.mkdirSync)((0, import_node_path11.dirname)(to), { recursive: true });
-  (0, import_node_fs13.copyFileSync)(from, to);
+  (0, import_node_fs14.mkdirSync)((0, import_node_path12.dirname)(to), { recursive: true });
+  (0, import_node_fs14.copyFileSync)(from, to);
 }
 async function provisionWorktree(worktreeRoot, deps) {
   const fs2 = deps.fs ?? realFsProbe;
@@ -9092,7 +9331,7 @@ async function provisionWorktree(worktreeRoot, deps) {
   const skippedInstall = allDirs.filter((d) => d.hasPackageJson && d.hasNodeModules).map((d) => d.dir);
   const installed = [];
   for (const target of targets) {
-    const cwd = target.dir ? (0, import_node_path11.join)(worktreeRoot, target.dir) : worktreeRoot;
+    const cwd = target.dir ? (0, import_node_path12.join)(worktreeRoot, target.dir) : worktreeRoot;
     log(`installing deps: ${target.command} in ${target.dir || "."}`);
     await deps.runInstall(target.command, cwd);
     installed.push(target);
@@ -9101,7 +9340,7 @@ async function provisionWorktree(worktreeRoot, deps) {
   const copySkipped = [];
   const primary = await deps.primaryCheckout();
   for (const rel of LOCAL_ONLY_FILES) {
-    const dest = (0, import_node_path11.join)(worktreeRoot, rel);
+    const dest = (0, import_node_path12.join)(worktreeRoot, rel);
     if (fs2.isFile(dest)) {
       copySkipped.push({ file: rel, reason: "already-present" });
       continue;
@@ -9110,24 +9349,30 @@ async function provisionWorktree(worktreeRoot, deps) {
       copySkipped.push({ file: rel, reason: "no-primary" });
       continue;
     }
-    if (!fs2.isFile((0, import_node_path11.join)(primary, rel))) {
+    if (!fs2.isFile((0, import_node_path12.join)(primary, rel))) {
       copySkipped.push({ file: rel, reason: "absent-in-primary" });
       continue;
     }
-    copyFile((0, import_node_path11.join)(primary, rel), dest);
+    copyFile((0, import_node_path12.join)(primary, rel), dest);
     copied.push(rel);
     log(`copied local config: ${rel}`);
   }
   return { worktree: worktreeRoot, installed, skippedInstall, copied, copySkipped };
 }
+function capWorktreeDirName(name, max = 40) {
+  if (name.length <= max) return name;
+  const hard = name.slice(0, max);
+  const lastDash = hard.lastIndexOf("-");
+  return (lastDash >= max - 12 ? hard.slice(0, lastDash) : hard).replace(/-+$/, "");
+}
 function defaultWorktreePath(repoRoot2, branch) {
-  const safe = branch.replace(/[/\\]+/g, "-");
-  return (0, import_node_path11.join)((0, import_node_path11.dirname)(repoRoot2), "mmi-worktrees", (0, import_node_path11.basename)(repoRoot2), safe);
+  const safe = capWorktreeDirName(branch.replace(/[/\\]+/g, "-"));
+  return (0, import_node_path12.join)((0, import_node_path12.dirname)(repoRoot2), "mmi-worktrees", (0, import_node_path12.basename)(repoRoot2), safe);
 }
 async function primaryCheckoutRootOf(git) {
   try {
     const out = (await git(["rev-parse", "--path-format=absolute", "--git-common-dir"])).trim();
-    return out ? (0, import_node_path11.dirname)(out) : void 0;
+    return out ? (0, import_node_path12.dirname)(out) : void 0;
   } catch {
     return void 0;
   }
@@ -9183,7 +9428,15 @@ async function resolveWhoami(deps) {
   } catch {
     session = void 0;
   }
-  if (session?.login) return { login: session.login, source: "hub-session", sessionExpiresAt: session.expiresAt };
+  if (session?.login) {
+    return {
+      login: session.login,
+      source: "hub-session",
+      sessionExpiresAt: session.expiresAt,
+      // Exact-match, and only here. The `github` branch below deliberately never carries a role.
+      ...session.role === "owner" ? { role: "owner" } : {}
+    };
+  }
   let ghLogin;
   try {
     ghLogin = await deps.ghLogin();
@@ -9198,6 +9451,10 @@ function whoamiLine(report, caveat) {
   const line = `current human: ${report.login} (source: ${report.source}) \u2014 act for this login (e.g. claim --for ${report.login}); do not ask who the user is.`;
   return caveat?.trim() ? `${line} ${caveat.trim()}` : line;
 }
+function authorityLine(report) {
+  if (report.source !== "hub-session" || report.role !== "owner" || !report.login) return null;
+  return `full authority: ${report.login} owns the org \u2014 doctrine, board, roles, matrix, skills and process are his to decide; never ask whether a change is his to make. Secret VALUES are still never echoed.`;
+}
 
 // src/command-ladder-hint.ts
 var COMMAND_LADDER_WRITES = [
@@ -9233,7 +9490,7 @@ function commandLadderHint() {
 }
 
 // src/index.ts
-var import_node_path27 = require("node:path");
+var import_node_path30 = require("node:path");
 
 // src/merge-ci-policy.ts
 function resolveMergeCiPolicy(input) {
@@ -9321,16 +9578,16 @@ function pollStateFromParsed(parsed) {
 }
 var PR_MERGEABLE_UNKNOWN_POLL_RETRIES = 4;
 var PR_MERGEABLE_UNKNOWN_POLL_MS = 3e3;
-async function resolveSettledMergeableState(pollMergeable, sleep2) {
+async function resolveSettledMergeableState(pollMergeable, sleep3) {
   for (let attempt = 1; attempt <= PR_MERGEABLE_UNKNOWN_POLL_RETRIES; attempt++) {
     const state = await pollMergeable();
     if (state !== "UNKNOWN") return state;
-    if (attempt < PR_MERGEABLE_UNKNOWN_POLL_RETRIES) await sleep2(PR_MERGEABLE_UNKNOWN_POLL_MS);
+    if (attempt < PR_MERGEABLE_UNKNOWN_POLL_RETRIES) await sleep3(PR_MERGEABLE_UNKNOWN_POLL_MS);
   }
   return "UNKNOWN";
 }
 function conflictingPrMessage(baseBranch) {
-  return `PR is CONFLICTING with ${baseBranch} \u2014 GitHub will not queue checks until the conflict is resolved. Resolve with: git fetch origin ${baseBranch} && git rebase origin/${baseBranch}`;
+  return `PR is CONFLICTING with ${baseBranch} \u2014 GitHub will not queue checks until the conflict is resolved. Resolve with: git fetch origin ${baseBranch} && git merge origin/${baseBranch} (merge, not rebase \u2014 a pushed branch cannot be rebased without a force-push, which doctrine forbids)`;
 }
 function conflictingResult(policy, baseBranch, waitedMs) {
   return { policy, status: "conflicting", reason: conflictingPrMessage(baseBranch), detail: "conflicting", waitedMs };
@@ -9686,6 +9943,12 @@ var MANAGED_GITIGNORE_LINES = [
   // and `.cursor/rules/` because a repo may want its rules tracked despite the wall.
   ".codex/",
   ".agents/",
+  // #3525: `jerv-cli fusion attest record` writes `.jerv/attest/<head>.attest.json` INTO the worktree,
+  // so every worktree that has ever passed the fusion gate reports `?? .jerv/` forever. `worktree land`
+  // refuses to clean a dirty worktree, which made the attestation artifact the gate requires the exact
+  // thing blocking the cleanup that gate's own worktree needs. Org-universal: every repo runs the same
+  // gate, so this belongs in the managed block rather than in one repo's own ignores.
+  ".jerv/",
   // #2321 doctrine: the canonical worktree home is the SIBLING `../mmi-worktrees/<RepoName>/<branch>` (outside the tree,
   // via `mmi-cli worktree create`), so a repo-local `.worktrees/` is NOT un-ignored org-wide — `mmi-cli
   // doctor` flags one explicitly instead (buildRepoLocalWorktreeCheck) rather than baking the fallback path
@@ -10079,10 +10342,10 @@ function labelsToPrune(orgLabelNames) {
   const org = new Set(orgLabelNames);
   return GITHUB_DEFAULT_LABELS.filter((name) => !org.has(name));
 }
-function resolveSeedContent(seed, vars, readFile6) {
-  if (seed.source === "self") return readFile6(seed.target);
+function resolveSeedContent(seed, vars, readFile7) {
+  if (seed.source === "self") return readFile7(seed.target);
   if (seed.source.startsWith("seed:")) {
-    const tmpl = readFile6(`skills/bootstrap/seeds/${seed.source.slice("seed:".length)}`);
+    const tmpl = readFile7(`skills/bootstrap/seeds/${seed.source.slice("seed:".length)}`);
     return tmpl == null ? null : renderSeed(tmpl, vars);
   }
   return null;
@@ -10748,8 +11011,8 @@ async function mergeAutoWithTransientRetry(prNumber, repo, deps) {
   if (first.mergeStatus !== "failed") return first;
   const ready = await deps.probeMergeReady(prNumber, repo).catch(() => ({ open: false, mergeable: false, checksPassing: false }));
   if (!ready.open || !ready.mergeable || !ready.checksPassing) return first;
-  const sleep2 = deps.sleep ?? ((ms) => new Promise((resolve5) => setTimeout(resolve5, ms)));
-  await sleep2(PR_LAND_MERGE_RETRY_DELAY_MS);
+  const sleep3 = deps.sleep ?? ((ms) => new Promise((resolve5) => setTimeout(resolve5, ms)));
+  await sleep3(PR_LAND_MERGE_RETRY_DELAY_MS);
   const retried = await deps.mergeAuto(prNumber, repo);
   if (retried.mergeStatus !== "failed") return retried;
   return { mergeStatus: "failed", error: `merge retry after transient failure also failed: ${retried.error ?? first.error ?? "unknown error"}` };
@@ -10759,13 +11022,13 @@ var AUTO_MERGE_CONFIRM_DELAY_MS = 3e3;
 async function confirmAutoMergeEnqueued(deps, options) {
   const retries = options?.retries ?? AUTO_MERGE_CONFIRM_RETRIES;
   const delayMs = options?.delayMs ?? AUTO_MERGE_CONFIRM_DELAY_MS;
-  const sleep2 = deps.sleep ?? ((ms) => new Promise((resolve5) => setTimeout(resolve5, ms)));
+  const sleep3 = deps.sleep ?? ((ms) => new Promise((resolve5) => setTimeout(resolve5, ms)));
   for (let attempt = 0; attempt < retries; attempt++) {
     if (await deps.readMerged().catch(() => false)) return "merged";
     const stuck = await deps.readAutoMergeRequest().then((s) => s.trim()).catch(() => "");
     if (stuck) return "enqueued";
     if (attempt < retries - 1) {
-      await sleep2(delayMs);
+      await sleep3(delayMs);
       await deps.reEnqueue().catch(() => {
       });
     }
@@ -10776,7 +11039,7 @@ async function confirmAutoMergeEnqueued(deps, options) {
 async function readGhPrStateWithRetry(fetchState, options) {
   const retries = options?.retries ?? PR_LAND_STATE_READ_RETRIES;
   const delayMs = options?.delayMs ?? PR_LAND_STATE_READ_DELAY_MS;
-  const sleep2 = options?.sleep ?? ((ms) => new Promise((resolve5) => setTimeout(resolve5, ms)));
+  const sleep3 = options?.sleep ?? ((ms) => new Promise((resolve5) => setTimeout(resolve5, ms)));
   let lastError = "empty state";
   for (let attempt = 0; attempt < retries; attempt++) {
     try {
@@ -10786,7 +11049,7 @@ async function readGhPrStateWithRetry(fetchState, options) {
     } catch (e) {
       lastError = String(e.message || "gh pr view failed");
     }
-    if (attempt < retries - 1) await sleep2(delayMs);
+    if (attempt < retries - 1) await sleep3(delayMs);
   }
   return { ok: false, error: lastError };
 }
@@ -10849,12 +11112,12 @@ async function runPrLand(prNumber, options, deps) {
 }
 
 // src/wave-status.ts
-var import_node_fs15 = require("node:fs");
+var import_node_fs16 = require("node:fs");
 
 // src/stage-runner.ts
 var import_node_child_process7 = require("node:child_process");
-var import_node_fs14 = require("node:fs");
-var import_node_path12 = require("node:path");
+var import_node_fs15 = require("node:fs");
+var import_node_path13 = require("node:path");
 var import_node_net = require("node:net");
 var import_node_util6 = require("node:util");
 
@@ -10993,11 +11256,11 @@ function appendForceRecreate(up) {
   return `${up.trimEnd()} --force-recreate`;
 }
 function stageStatePath(cwd = process.cwd()) {
-  return (0, import_node_path12.join)(cwd, "tmp", "stage", "state.json");
+  return (0, import_node_path13.join)(cwd, "tmp", "stage", "state.json");
 }
 function stageGlobalStatePath(cwd = process.cwd(), gitCommonDir = ".git") {
-  const dir = (0, import_node_path12.isAbsolute)(gitCommonDir) ? gitCommonDir : (0, import_node_path12.resolve)(cwd, gitCommonDir);
-  return (0, import_node_path12.join)(dir, "mmi", "stage", "state.json");
+  const dir = (0, import_node_path13.isAbsolute)(gitCommonDir) ? gitCommonDir : (0, import_node_path13.resolve)(cwd, gitCommonDir);
+  return (0, import_node_path13.join)(dir, "mmi", "stage", "state.json");
 }
 function normPath2(path2) {
   return path2.replace(/\\/g, "/").replace(/\/+$/, "").toLowerCase();
@@ -11221,14 +11484,14 @@ function stageProcessEnv(stagePort, extraEnv) {
 }
 async function ensureStageRuntimeEnv(config, opts, cwd) {
   if (!config.ensureEnv) return;
-  const target = (0, import_node_path12.join)(cwd, config.ensureEnv.target);
-  const example = (0, import_node_path12.join)(cwd, config.ensureEnv.example);
-  if (!(0, import_node_fs14.existsSync)(target) && (0, import_node_fs14.existsSync)(example)) {
-    (0, import_node_fs14.copyFileSync)(example, target);
-  } else if ((0, import_node_fs14.existsSync)(target) && (0, import_node_fs14.existsSync)(example)) {
-    const stale = detectStaleEnvFile((0, import_node_fs14.readFileSync)(example, "utf8"), (0, import_node_fs14.readFileSync)(target, "utf8"), {
-      exampleMtimeMs: (0, import_node_fs14.statSync)(example).mtimeMs,
-      targetMtimeMs: (0, import_node_fs14.statSync)(target).mtimeMs
+  const target = (0, import_node_path13.join)(cwd, config.ensureEnv.target);
+  const example = (0, import_node_path13.join)(cwd, config.ensureEnv.example);
+  if (!(0, import_node_fs15.existsSync)(target) && (0, import_node_fs15.existsSync)(example)) {
+    (0, import_node_fs15.copyFileSync)(example, target);
+  } else if ((0, import_node_fs15.existsSync)(target) && (0, import_node_fs15.existsSync)(example)) {
+    const stale = detectStaleEnvFile((0, import_node_fs15.readFileSync)(example, "utf8"), (0, import_node_fs15.readFileSync)(target, "utf8"), {
+      exampleMtimeMs: (0, import_node_fs15.statSync)(example).mtimeMs,
+      targetMtimeMs: (0, import_node_fs15.statSync)(target).mtimeMs
     });
     if (stale) {
       const msg = `stale ${config.ensureEnv.target} (${stale}) \u2014 delete it or refresh from ${config.ensureEnv.example} before re-running /stage`;
@@ -11236,8 +11499,8 @@ async function ensureStageRuntimeEnv(config, opts, cwd) {
       console.error(`mmi-cli stage: ${msg} (allowed via --allow-stale-env)`);
     }
   }
-  if (opts.vaultEnvMerge && Object.keys(opts.vaultEnvMerge).length && (0, import_node_fs14.existsSync)(target)) {
-    (0, import_node_fs14.writeFileSync)(target, mergeEnvSecretsIntoFile((0, import_node_fs14.readFileSync)(target, "utf8"), opts.vaultEnvMerge), "utf8");
+  if (opts.vaultEnvMerge && Object.keys(opts.vaultEnvMerge).length && (0, import_node_fs15.existsSync)(target)) {
+    (0, import_node_fs15.writeFileSync)(target, mergeEnvSecretsIntoFile((0, import_node_fs15.readFileSync)(target, "utf8"), opts.vaultEnvMerge), "utf8");
   }
 }
 async function gitText(cwd, args) {
@@ -11267,20 +11530,20 @@ async function resolveGlobalStatePath(cwd, explicit) {
   return void 0;
 }
 function readState(path2) {
-  if (!(0, import_node_fs14.existsSync)(path2)) return null;
+  if (!(0, import_node_fs15.existsSync)(path2)) return null;
   try {
-    return JSON.parse((0, import_node_fs14.readFileSync)(path2, "utf8"));
+    return JSON.parse((0, import_node_fs15.readFileSync)(path2, "utf8"));
   } catch {
     return null;
   }
 }
 function mkdirFor(path2) {
   const dir = path2.slice(0, Math.max(path2.lastIndexOf("/"), path2.lastIndexOf("\\")));
-  (0, import_node_fs14.mkdirSync)(dir, { recursive: true });
+  (0, import_node_fs15.mkdirSync)(dir, { recursive: true });
 }
 function writeState(path2, state) {
   mkdirFor(path2);
-  (0, import_node_fs14.writeFileSync)(path2, JSON.stringify(state, null, 2), "utf8");
+  (0, import_node_fs15.writeFileSync)(path2, JSON.stringify(state, null, 2), "utf8");
 }
 function writeStagePortReservation(port, cwd, statePath, globalStatePath, now) {
   const reservation = {
@@ -11300,7 +11563,7 @@ async function cleanupStageState(state, paths, timeoutMs, fallbackCwd) {
     await shell(state.teardown.command.trim(), state.teardown.cwd || state.cwd || fallbackCwd, Math.max(timeoutMs, 1e4));
   }
   for (const path2 of [...new Set(paths.filter((p) => Boolean(p)))]) {
-    (0, import_node_fs14.rmSync)(path2, { force: true });
+    (0, import_node_fs15.rmSync)(path2, { force: true });
   }
 }
 async function killTree(pid) {
@@ -11458,8 +11721,8 @@ async function runStage(config = {}, opts = {}) {
     await ensureStageRuntimeEnv(config, opts, cwd);
     if (build) await shell(sub(build), cwd, timeoutMs, stageProcessEnv(stagePort, extraEnv));
   } catch (e) {
-    (0, import_node_fs14.rmSync)(statePath, { force: true });
-    if (globalStatePath && globalStatePath !== statePath) (0, import_node_fs14.rmSync)(globalStatePath, { force: true });
+    (0, import_node_fs15.rmSync)(statePath, { force: true });
+    if (globalStatePath && globalStatePath !== statePath) (0, import_node_fs15.rmSync)(globalStatePath, { force: true });
     throw e;
   }
   const started = await startStage(config, {
@@ -11480,9 +11743,9 @@ function parseNextFromHead(headText) {
 }
 function readStageSummary(worktreePath) {
   const statePath = stageStatePath(worktreePath);
-  if (!(0, import_node_fs15.existsSync)(statePath)) return void 0;
+  if (!(0, import_node_fs16.existsSync)(statePath)) return void 0;
   try {
-    const state = JSON.parse((0, import_node_fs15.readFileSync)(statePath, "utf8"));
+    const state = JSON.parse((0, import_node_fs16.readFileSync)(statePath, "utf8"));
     const port = typeof state.port === "number" ? state.port : void 0;
     if (port == null || !Number.isInteger(port) || port <= 0) return void 0;
     return { port, url: typeof state.url === "string" ? state.url : void 0 };
@@ -11567,7 +11830,7 @@ async function executeWaveLand(plan, deps, opts = { preserveWorktree: true }) {
 }
 
 // src/index.ts
-var import_node_os8 = require("node:os");
+var import_node_os9 = require("node:os");
 
 // src/attach-to-project.ts
 async function resolveAutoAddBoardAttach(client, cfg, selector, priority, warn = (m) => process.stderr.write(m), retry = {}) {
@@ -11601,7 +11864,7 @@ async function resolveAutoAddBoardAttach(client, cfg, selector, priority, warn =
 // src/gh-create.ts
 var import_promises = require("node:fs/promises");
 var import_node_os3 = require("node:os");
-var import_node_path13 = require("node:path");
+var import_node_path14 = require("node:path");
 var import_node_crypto3 = require("node:crypto");
 var ISSUE_TYPES = ["bug", "feature", "task"];
 var GH_MUTATION_TIMEOUT_MS = 12e4;
@@ -11655,8 +11918,8 @@ async function bodyArgsViaFile(args, deps = {}) {
   const remove2 = deps.remove ?? import_promises.unlink;
   const ensureDir = deps.ensureDir ?? import_promises.mkdir;
   const dir = deps.dir ?? (0, import_node_os3.tmpdir)();
-  const file = (0, import_node_path13.join)(dir, `mmi-gh-body-${process.pid}-${(0, import_node_crypto3.randomBytes)(4).toString("hex")}.md`);
-  await ensureDir((0, import_node_path13.dirname)(file), { recursive: true }).catch(() => {
+  const file = (0, import_node_path14.join)(dir, `mmi-gh-body-${process.pid}-${(0, import_node_crypto3.randomBytes)(4).toString("hex")}.md`);
+  await ensureDir((0, import_node_path14.dirname)(file), { recursive: true }).catch(() => {
   });
   await write(file, args[i + 1], "utf8");
   return {
@@ -11723,23 +11986,61 @@ function parseExistingPr(stderr) {
   if (!match) return void 0;
   return { number: Number(match[1]), url: match[0] };
 }
-async function ghCreate(args) {
+var GH_CREATE_UPSTREAM_RETRIES = 3;
+var GH_CREATE_RETRY_BACKOFF_MS = [2e3, 5e3];
+function httpStatusCodes(stderr) {
+  const out = [];
+  for (const m of stderr.matchAll(/\bHTTP\/?\d*(?:\.\d)?\s+(\d{3})\b/g)) out.push(Number(m[1]));
+  for (const m of stderr.matchAll(/\b(\d{3})\s+Internal Server Error\b/g)) out.push(Number(m[1]));
+  return out;
+}
+function isUpstreamGitHubFault(stderr) {
+  const codes = httpStatusCodes(stderr);
+  if (codes.some((c) => c >= 400 && c < 500)) return false;
+  if (codes.some((c) => c >= 500 && c < 600)) return true;
+  return /Something went wrong while executing your query/.test(stderr) || /^\s*unexpected end of JSON input\s*$/m.test(stderr);
+}
+function mayRetryCreate(verb) {
+  return verb === "pr";
+}
+function upstreamFaultMessage(verb, stderr) {
+  const requestId = /\b([0-9A-F]{4}:[0-9A-F]{4,6}:[0-9A-F]+:[0-9A-F]+:[0-9A-F]+)\b/.exec(stderr)?.[1];
+  const advice = mayRetryCreate(verb) ? "Retrying is the right action" : "The write may have completed server-side before the error \u2014 VERIFY before retrying, or a retry will duplicate it";
+  return `gh ${verb} create failed: GitHub's API is failing (server-side 5xx) \u2014 this is NOT a problem with your diff or arguments. GitHub request ID: ${requestId ?? "unavailable"}. ${advice}; note githubstatus.com may still read green while this is happening.`;
+}
+async function ghCreate(args, deps = {}) {
+  const exec = deps.exec ?? execFileP2;
+  const sleep3 = deps.sleep ?? ((ms) => new Promise((resolve5) => setTimeout(resolve5, ms)));
   const swapped = await bodyArgsViaFile(args);
   try {
-    const { stdout } = await execFileP2("gh", swapped.args, { timeout: GH_MUTATION_TIMEOUT_MS });
-    return parseCreatedUrl(stdout);
-  } catch (e) {
-    const err = e;
-    const existing = parseExistingPr(`${err.stderr ?? ""}
-${err.message ?? ""}`);
-    if (existing) {
-      await swapped.cleanup();
-      console.warn(`${args[0]} create: a PR already exists for this branch \u2014 #${existing.number} (nothing to do)`);
-      return { ...existing, existing: true };
+    for (let attempt = 1; attempt <= GH_CREATE_UPSTREAM_RETRIES; attempt++) {
+      try {
+        const { stdout } = await exec("gh", swapped.args, { timeout: GH_MUTATION_TIMEOUT_MS });
+        return parseCreatedUrl(stdout);
+      } catch (e) {
+        const err = e;
+        const errText = `${err.stderr ?? ""}
+${err.message ?? ""}`;
+        const faultText = (err.stderr ?? "").trim() ? err.stderr : err.message ?? "";
+        const existing = args[0] === "pr" ? parseExistingPr(errText) : void 0;
+        if (existing) {
+          await swapped.cleanup();
+          console.warn(`${args[0]} create: a PR already exists for this branch \u2014 #${existing.number} (nothing to do)`);
+          return { ...existing, existing: true };
+        }
+        const note = timeoutKillNote(e, GH_MUTATION_TIMEOUT_MS);
+        if (isUpstreamGitHubFault(faultText) && mayRetryCreate(args[0]) && attempt < GH_CREATE_UPSTREAM_RETRIES) {
+          const waitMs = GH_CREATE_RETRY_BACKOFF_MS[attempt - 1];
+          console.warn(`gh ${args[0]} create: GitHub API server fault (attempt ${attempt}/${GH_CREATE_UPSTREAM_RETRIES}) \u2014 retrying in ${waitMs}ms`);
+          await sleep3(waitMs);
+          continue;
+        }
+        await swapped.cleanup();
+        if (isUpstreamGitHubFault(faultText)) return fail(upstreamFaultMessage(args[0], faultText));
+        return fail(`gh ${args[0]} create failed: ${(err.stderr || err.message || String(e)).trim()}${note ? ` (${note})` : ""}`);
+      }
     }
-    await swapped.cleanup();
-    const note = timeoutKillNote(e, GH_MUTATION_TIMEOUT_MS);
-    fail(`gh ${args[0]} create failed: ${(err.stderr || err.message || String(e)).trim()}${note ? ` (${note})` : ""}`);
+    throw new Error("ghCreate: retry loop exhausted without a verdict");
   } finally {
     await swapped.cleanup();
   }
@@ -12893,8 +13194,8 @@ function parseVerifyBroker(stdout) {
 }
 
 // src/train-apply.ts
-var import_node_fs16 = require("node:fs");
-var import_node_path14 = require("node:path");
+var import_node_fs17 = require("node:fs");
+var import_node_path15 = require("node:path");
 function resolveDeployModel2(meta, repo) {
   const m = meta?.deployModel;
   if (isDeployModel(m)) return m;
@@ -13003,7 +13304,7 @@ function mergeTreeConflictFiles(stdout) {
   return stdout.split("\n").map((s) => s.trim()).filter(Boolean).slice(1);
 }
 async function runMergeTreePreflight(deps, ours, theirs) {
-  const sleep2 = resolveSleep(deps);
+  const sleep3 = resolveSleep(deps);
   let lastError;
   for (let attempt = 0; attempt < MERGE_TREE_PREFLIGHT_ATTEMPTS; attempt++) {
     try {
@@ -13013,7 +13314,7 @@ async function runMergeTreePreflight(deps, ours, theirs) {
       lastError = e;
       const files = mergeTreeConflictFiles(String(e.stdout ?? ""));
       if (files.length > 0) return files;
-      if (attempt + 1 < MERGE_TREE_PREFLIGHT_ATTEMPTS) await sleep2(MERGE_TREE_PREFLIGHT_DELAY_MS);
+      if (attempt + 1 < MERGE_TREE_PREFLIGHT_ATTEMPTS) await sleep3(MERGE_TREE_PREFLIGHT_DELAY_MS);
     }
   }
   const msg = lastError?.message ?? String(lastError);
@@ -13217,7 +13518,7 @@ function isPersistentGitPushFailure(e) {
   return /non-fast-forward|\[rejected\]|failed to push|protected branch|hook declined|permission denied|could not read Username|authentication failed|Authentication failed|403 Forbidden|GH006|GH013/i.test(msg);
 }
 async function runGitWithRetry(deps, args, shouldRetry) {
-  const sleep2 = resolveSleep(deps);
+  const sleep3 = resolveSleep(deps);
   let lastError;
   for (let attempt = 1; attempt <= GIT_NETWORK_ATTEMPTS; attempt++) {
     try {
@@ -13225,7 +13526,7 @@ async function runGitWithRetry(deps, args, shouldRetry) {
     } catch (e) {
       lastError = e;
       if (attempt >= GIT_NETWORK_ATTEMPTS || !shouldRetry(e)) throw e;
-      await sleep2(GIT_NETWORK_RETRY_DELAY_MS * attempt);
+      await sleep3(GIT_NETWORK_RETRY_DELAY_MS * attempt);
     }
   }
   throw lastError;
@@ -13246,13 +13547,13 @@ var TRAIN_PR_ONLY_AUTOMATION_CONTEXTS = /* @__PURE__ */ new Set(["add-to-project
 var TRAIN_PR_AUTOMATION_GRACE_ATTEMPTS = 3;
 var TRAIN_FRESH_RUN_GRACE_ATTEMPTS = 4;
 async function correlateRun(deps, args) {
-  const sleep2 = resolveSleep(deps);
+  const sleep3 = resolveSleep(deps);
   const threshold = args.since - CORRELATE_SKEW_SLACK_MS;
   const repo = args.mode === "workflow" ? args.repo ?? HUB_REPO3 : HUB_REPO3;
   let lastError;
   let parsedAnyResponse = false;
   for (let attempt = 0; attempt < CORRELATE_ATTEMPTS; attempt++) {
-    if (attempt > 0) await sleep2(CORRELATE_DELAY_MS);
+    if (attempt > 0) await sleep3(CORRELATE_DELAY_MS);
     const listArgs = [
       "run",
       "list",
@@ -13445,13 +13746,13 @@ async function waitForRequiredTrainChecks(deps, ctx, sha, required, freshSince)
     const t = Date.parse(String(r.startedAt ?? ""));
     return !Number.isFinite(t) || t >= freshThreshold;
   };
-  const sleep2 = resolveSleep(deps);
+  const sleep3 = resolveSleep(deps);
   let lastStatus = "not checked";
   let lastError;
   const everObserved = /* @__PURE__ */ new Set();
   const autoSatisfied = /* @__PURE__ */ new Set();
   for (let attempt = 0; attempt < TRAIN_CHECK_ATTEMPTS; attempt++) {
-    if (attempt > 0) await sleep2(TRAIN_CHECK_DELAY_MS);
+    if (attempt > 0) await sleep3(TRAIN_CHECK_DELAY_MS);
     let checkRuns;
     let statuses;
     try {
@@ -13585,14 +13886,14 @@ function isTransientDispatchFailure(e) {
   return /timed? ?out|timeout|aborted|network|fetch failed|ECONNRESET|ECONNREFUSED|EAI_AGAIN/i.test(msg);
 }
 async function dispatchTenantDeployWithRetry(deps, input) {
-  const sleep2 = resolveSleep(deps);
+  const sleep3 = resolveSleep(deps);
   for (let attempt = 1; ; attempt++) {
     try {
       await deps.dispatchTenantDeploy(input);
       return;
     } catch (e) {
       if (attempt >= DISPATCH_ATTEMPTS || !isTransientDispatchFailure(e)) throw e;
-      await sleep2(DISPATCH_RETRY_DELAY_MS * attempt);
+      await sleep3(DISPATCH_RETRY_DELAY_MS * attempt);
     }
   }
 }
@@ -13612,9 +13913,9 @@ var PUBLISH_LOG_RETRY_ATTEMPTS = 4;
 var PUBLISH_LOG_RETRY_DELAY_MS = 6e3;
 async function reconcilePublishFailure(deps, runId) {
   if (runId == null) return "failure";
-  const sleep2 = resolveSleep(deps);
+  const sleep3 = resolveSleep(deps);
   for (let attempt = 0; attempt < PUBLISH_LOG_RETRY_ATTEMPTS; attempt++) {
-    if (attempt > 0) await sleep2(PUBLISH_LOG_RETRY_DELAY_MS);
+    if (attempt > 0) await sleep3(PUBLISH_LOG_RETRY_DELAY_MS);
     const log = await fetchControlRunLog(deps, runId);
     if (PUBLISH_IDEMPOTENT_MARKER.test(log)) return "success";
   }
@@ -13802,17 +14103,17 @@ async function dispatchDeploy(deps, ctx, stage, ref, model, watch, autoRunSince,
   return { note: `no manual dispatch: ${model} repo deploys via its own push-triggered workflow`, deployStatus: "pending" };
 }
 function readLocalGateWorkflows() {
-  const dir = (0, import_node_path14.join)(".github", "workflows");
+  const dir = (0, import_node_path15.join)(".github", "workflows");
   let names;
   try {
-    names = (0, import_node_fs16.readdirSync)(dir);
+    names = (0, import_node_fs17.readdirSync)(dir);
   } catch {
     return null;
   }
   const files = [];
   for (const name of names.filter(isGateWorkflowPath)) {
     try {
-      files.push({ path: `${dir}/${name}`.replace(/\\/g, "/"), body: (0, import_node_fs16.readFileSync)((0, import_node_path14.join)(dir, name), "utf8") });
+      files.push({ path: `${dir}/${name}`.replace(/\\/g, "/"), body: (0, import_node_fs17.readFileSync)((0, import_node_path15.join)(dir, name), "utf8") });
     } catch {
     }
   }
@@ -14408,13 +14709,13 @@ async function retireRcRuntime(deps, ctx, model, deployStatus, releasedRcSha) {
         note: `origin/rc moved past the released candidate (${releasedRcSha.slice(0, 7)} -> ${rcNow.slice(0, 7)}) \u2014 a new candidate is in flight; rc runtime left untouched`
       };
     }
-    const sleep2 = resolveSleep(deps);
+    const sleep3 = resolveSleep(deps);
     let last;
     for (let attempt = 1; attempt <= RETIRE_MAX_ATTEMPTS; attempt++) {
       last = await attemptRetire(deps, ctx);
       if (last.status === "retired") return last;
       if (last.category !== "transport-failed" || attempt === RETIRE_MAX_ATTEMPTS) break;
-      await sleep2(RETIRE_BACKOFF_MS * attempt);
+      await sleep3(RETIRE_BACKOFF_MS * attempt);
     }
     const f = last;
     if (f.category === "wait-timeout") return f;
@@ -14945,9 +15246,9 @@ Merge this PR (human-initiated), then run \`mmi-cli hotfix release ${tag}\`.`
   return { ...ctx, command: "hotfix-start", tag, version, branch, source: label, prUrl, reused: Boolean(remoteBranch), notes };
 }
 async function watchReleaseRun(deps, ctx, workflow, sha) {
-  const sleep2 = sleeper(deps);
+  const sleep3 = sleeper(deps);
   for (let attempt = 0; attempt < HOTFIX_RUN_FIND_ATTEMPTS; attempt++) {
-    if (attempt > 0) await sleep2(HOTFIX_RUN_FIND_DELAY_MS);
+    if (attempt > 0) await sleep3(HOTFIX_RUN_FIND_DELAY_MS);
     let rows;
     try {
       const out = await deps.run("gh", [
@@ -15085,7 +15386,7 @@ async function runHotfixRelease(deps, versionInput, options = {}) {
     try {
       await deps.run("git", ["-c", "advice.detachedHead=false", "checkout", tag]);
       const verifyArgs = ["scripts/release-distribution.mjs", "verify", version, ...publishSucceeded ? [] : ["--skip-npm-view"]];
-      const sleep2 = sleeper(deps);
+      const sleep3 = sleeper(deps);
       let attempt = 0;
       for (; ; ) {
         attempt++;
@@ -15094,7 +15395,7 @@ async function runHotfixRelease(deps, versionInput, options = {}) {
           break;
         } catch (err) {
           if (attempt >= HOTFIX_VERIFY_ATTEMPTS) throw err;
-          await sleep2(HOTFIX_VERIFY_RETRY_MS);
+          await sleep3(HOTFIX_VERIFY_RETRY_MS);
         }
       }
       const retried = attempt > 1 ? `, after ${attempt} attempts (npm propagation lag)` : "";
@@ -15709,8 +16010,8 @@ function renderAccessReport(report) {
 }
 
 // src/docs-index-command.ts
-var import_node_fs17 = require("node:fs");
-var import_node_path15 = require("node:path");
+var import_node_fs18 = require("node:fs");
+var import_node_path16 = require("node:path");
 var DOCS_INDEX_PATH = "docs/index.md";
 function isRoutableDocsPath(relPath) {
   const normalized = relPath.replace(/\\/g, "/");
@@ -15792,32 +16093,32 @@ function walkMarkdown(dir) {
   const stack = [dir];
   while (stack.length) {
     const current = stack.pop();
-    for (const entry of (0, import_node_fs17.readdirSync)(current, { withFileTypes: true })) {
-      const full = (0, import_node_path15.join)(current, entry.name);
+    for (const entry of (0, import_node_fs18.readdirSync)(current, { withFileTypes: true })) {
+      const full = (0, import_node_path16.join)(current, entry.name);
       if (entry.isDirectory()) {
         stack.push(full);
       } else if (entry.isFile() && entry.name.endsWith(".md")) {
-        out.push((0, import_node_path15.relative)(dir, full).split(import_node_path15.sep).join("/"));
+        out.push((0, import_node_path16.relative)(dir, full).split(import_node_path16.sep).join("/"));
       }
     }
   }
   return out;
 }
 function createDocsIndexDeps(repoRoot2) {
-  const docsDir = (0, import_node_path15.join)(repoRoot2, "docs");
-  const indexPath = (0, import_node_path15.join)(repoRoot2, DOCS_INDEX_PATH);
+  const docsDir = (0, import_node_path16.join)(repoRoot2, "docs");
+  const indexPath = (0, import_node_path16.join)(repoRoot2, DOCS_INDEX_PATH);
   return {
-    listDocs: () => (0, import_node_fs17.existsSync)(docsDir) ? walkMarkdown(docsDir).filter(isRoutableDocsPath).sort() : [],
-    readDoc: (relPath) => (0, import_node_fs17.readFileSync)((0, import_node_path15.join)(docsDir, relPath), "utf8"),
-    readIndex: () => (0, import_node_fs17.existsSync)(indexPath) ? (0, import_node_fs17.readFileSync)(indexPath, "utf8") : null,
-    writeIndex: (content) => (0, import_node_fs17.writeFileSync)(indexPath, content, "utf8")
+    listDocs: () => (0, import_node_fs18.existsSync)(docsDir) ? walkMarkdown(docsDir).filter(isRoutableDocsPath).sort() : [],
+    readDoc: (relPath) => (0, import_node_fs18.readFileSync)((0, import_node_path16.join)(docsDir, relPath), "utf8"),
+    readIndex: () => (0, import_node_fs18.existsSync)(indexPath) ? (0, import_node_fs18.readFileSync)(indexPath, "utf8") : null,
+    writeIndex: (content) => (0, import_node_fs18.writeFileSync)(indexPath, content, "utf8")
   };
 }
 
 // src/doc-refs-core.ts
 var import_node_child_process9 = require("node:child_process");
-var import_node_fs18 = require("node:fs");
-var import_node_path16 = require("node:path");
+var import_node_fs19 = require("node:fs");
+var import_node_path17 = require("node:path");
 var PIN_RE = /<!--\s*pinned by\s+([^:]+?)\s*:\s*"([^"]+)"[^"]*-->/;
 var PIN_MENTION_RE = /<!--\s*pinned by\b/;
 var REF_RE = /`([A-Za-z0-9_./-]+\.[A-Za-z0-9]+)(?::\d+)?`/g;
@@ -15851,7 +16152,7 @@ function extractPins(markdown) {
   });
   return pins;
 }
-function checkPins(root, readFile6, docs2) {
+function checkPins(root, readFile7, docs2) {
   const findings = [];
   for (const [doc, markdown] of Object.entries(docs2)) {
     for (const pin of extractPins(markdown)) {
@@ -15859,7 +16160,7 @@ function checkPins(root, readFile6, docs2) {
         findings.push({ kind: "malformed-pin", doc, line: pin.line, detail: pin.text });
         continue;
       }
-      const source = readFile6((0, import_node_path16.join)(root, pin.file));
+      const source = readFile7((0, import_node_path17.join)(root, pin.file));
       if (source == null) {
         findings.push({ kind: "missing-test", doc, line: pin.line, detail: pin.file });
         continue;
@@ -15920,17 +16221,17 @@ function checkRefs(root, deps, docs2) {
   for (const [doc, markdown] of Object.entries(docs2)) {
     for (const { ref, line } of extractRefs(markdown)) {
       const first = ref.split("/")[0];
-      if (!exists((0, import_node_path16.join)(root, first))) continue;
-      if (!exists((0, import_node_path16.join)(root, ref))) candidates.push({ kind: "missing-path", doc, line, detail: ref });
+      if (!exists((0, import_node_path17.join)(root, first))) continue;
+      if (!exists((0, import_node_path17.join)(root, ref))) candidates.push({ kind: "missing-path", doc, line, detail: ref });
     }
-    const docDir = import_node_path16.posix.dirname(doc);
+    const docDir = import_node_path17.posix.dirname(doc);
     for (const { target, line } of extractLinks(markdown)) {
-      const resolved = import_node_path16.posix.normalize(import_node_path16.posix.join(docDir === "." ? "" : docDir, target));
+      const resolved = import_node_path17.posix.normalize(import_node_path17.posix.join(docDir === "." ? "" : docDir, target));
       if (resolved.startsWith("..")) {
         candidates.push({ kind: "missing-link", doc, line, detail: target, escapesRoot: true });
         continue;
       }
-      if (!exists((0, import_node_path16.join)(root, resolved))) {
+      if (!exists((0, import_node_path17.join)(root, resolved))) {
         candidates.push({ kind: "missing-link", doc, line, detail: target, resolved });
       }
     }
@@ -15964,22 +16265,22 @@ function checkCommands(docs2, commandPaths) {
   return { ok: findings.length === 0, findings };
 }
 function readFileOrNull(path2) {
-  return (0, import_node_fs18.existsSync)(path2) ? (0, import_node_fs18.readFileSync)(path2, "utf8") : null;
+  return (0, import_node_fs19.existsSync)(path2) ? (0, import_node_fs19.readFileSync)(path2, "utf8") : null;
 }
 function walk(dir, root, out) {
-  for (const entry of (0, import_node_fs18.readdirSync)(dir)) {
-    const full = (0, import_node_path16.join)(dir, entry);
-    if ((0, import_node_fs18.statSync)(full).isDirectory()) walk(full, root, out);
+  for (const entry of (0, import_node_fs19.readdirSync)(dir)) {
+    const full = (0, import_node_path17.join)(dir, entry);
+    if ((0, import_node_fs19.statSync)(full).isDirectory()) walk(full, root, out);
     else if (entry.endsWith(".md")) out.push(full.slice(root.length + 1).replaceAll("\\", "/"));
   }
   return out;
 }
 function defaultListDocs(root) {
-  const docsDir = (0, import_node_path16.join)(root, "docs");
-  const docs2 = ((0, import_node_fs18.existsSync)(docsDir) ? walk(docsDir, root, []) : []).filter(
+  const docsDir = (0, import_node_path17.join)(root, "docs");
+  const docs2 = ((0, import_node_fs19.existsSync)(docsDir) ? walk(docsDir, root, []) : []).filter(
     (rel) => !SKIP_WALK.some((skip) => rel.startsWith(skip))
   );
-  return [...ROOT_DOCS.filter((rel) => (0, import_node_fs18.existsSync)((0, import_node_path16.join)(root, rel))), ...docs2];
+  return [...ROOT_DOCS.filter((rel) => (0, import_node_fs19.existsSync)((0, import_node_path17.join)(root, rel))), ...docs2];
 }
 function defaultIsIgnored(root, relPaths, exec = import_node_child_process9.execFileSync) {
   const inRepo = relPaths.filter((p) => !p.startsWith(".."));
@@ -15997,16 +16298,16 @@ function defaultIsIgnored(root, relPaths, exec = import_node_child_process9.exec
   }
 }
 function runDocRefs(root, deps = {}) {
-  const readFile6 = deps.readFile ?? readFileOrNull;
-  const exists = deps.exists ?? import_node_fs18.existsSync;
+  const readFile7 = deps.readFile ?? readFileOrNull;
+  const exists = deps.exists ?? import_node_fs19.existsSync;
   const listDocs = deps.listDocs ?? defaultListDocs;
   const isIgnored = deps.isIgnored ?? ((paths) => defaultIsIgnored(root, paths));
   const commandPaths = deps.commandPaths ?? null;
   const docs2 = Object.fromEntries(
-    listDocs(root).map((rel) => [rel, readFile6((0, import_node_path16.join)(root, rel))]).filter(([, body]) => body != null)
+    listDocs(root).map((rel) => [rel, readFile7((0, import_node_path17.join)(root, rel))]).filter(([, body]) => body != null)
   );
   const findings = [
-    ...checkPins(root, readFile6, docs2).findings,
+    ...checkPins(root, readFile7, docs2).findings,
     ...checkRefs(root, { exists, isIgnored }, docs2).findings
   ];
   if (commandPaths == null) {
@@ -16078,7 +16379,28 @@ function docsAuditStatus(fetch2, opts) {
   if (!fetch2.ok) {
     return { ok: false, state: "error", line: `docs audit: ${opts.repo} registry read failed \u2014 ${fetch2.error}` };
   }
+  if (!isValidIsoDate(opts.today)) {
+    throw new Error(`docs audit status: today must be a real ISO date (YYYY-MM-DD), got "${opts.today}"`);
+  }
   if (fetch2.verdict === null) {
+    const armedAt = opts.armedAt;
+    if (armedAt && isValidIsoDate(armedAt)) {
+      const cadenceDays = opts.cadenceDays ?? 7;
+      const graceDays = opts.graceDays ?? 3;
+      const sinceArmed = ageInDays(armedAt, opts.today);
+      if (sinceArmed <= cadenceDays + graceDays) {
+        return {
+          ok: true,
+          state: "awaiting-first-tick",
+          line: `docs audit: ${opts.repo} armed ${armedAt} (${sinceArmed}d ago) \u2014 no verdict expected until the first tick`
+        };
+      }
+      return {
+        ok: false,
+        state: "missing",
+        line: `docs audit: ${opts.repo} no verdict on record ${sinceArmed}d after arming ${armedAt} \u2014 janitor blind or dead`
+      };
+    }
     return { ok: false, state: "missing", line: `docs audit: ${opts.repo} no verdict on record \u2014 janitor blind or dead` };
   }
   const verdict = fetch2.verdict;
@@ -16107,9 +16429,6 @@ function docsAuditStatus(fetch2, opts) {
       line: `docs audit: ${opts.repo} malformed verdict outcome "${verdict.outcome}" (expected clean|refreshed-N|failed) \u2014 registry record corrupt, treating as RED`
     };
   }
-  if (!isValidIsoDate(opts.today)) {
-    throw new Error(`docs audit status: today must be a real ISO date (YYYY-MM-DD), got "${opts.today}"`);
-  }
   const cadence = opts.cadenceDays ?? 7;
   const grace = opts.graceDays ?? 3;
   const age = ageInDays(verdict.date, opts.today);
@@ -16945,8 +17264,8 @@ function writeError(res) {
 }
 
 // src/secrets-commands.ts
-var import_node_fs19 = require("node:fs");
-var import_node_path17 = require("node:path");
+var import_node_fs20 = require("node:fs");
+var import_node_path18 = require("node:path");
 var import_node_os5 = require("node:os");
 
 // src/project-runtime.ts
@@ -17063,25 +17382,25 @@ var DEFAULT_RAILS_CREDENTIALS_FILE = "config/credentials.yml.enc";
 var DEFAULT_RAILS_MASTER_KEY_FILE = "config/master.key";
 function resolvePreflightRepoScope(optRepo, cwdRepo) {
   const targetRepo2 = optRepo ? optRepo.includes("/") ? optRepo : `mutmutco/${optRepo}` : cwdRepo;
-  const sameRepo = !optRepo || Boolean(cwdRepo) && Boolean(targetRepo2) && cwdRepo.toLowerCase() === targetRepo2.toLowerCase();
-  return { targetRepo: targetRepo2, sameRepo };
+  const sameRepo2 = !optRepo || Boolean(cwdRepo) && Boolean(targetRepo2) && cwdRepo.toLowerCase() === targetRepo2.toLowerCase();
+  return { targetRepo: targetRepo2, sameRepo: sameRepo2 };
 }
 function collectMap(value, previous = []) {
   return [...previous, value];
 }
 async function decryptRailsCredentials(input) {
-  const appDir = (0, import_node_path17.resolve)(input.appDir ?? process.cwd());
+  const appDir = (0, import_node_path18.resolve)(input.appDir ?? process.cwd());
   const credentialsFile = input.credentialsFile ?? DEFAULT_RAILS_CREDENTIALS_FILE;
   const masterKeyFile = input.masterKeyFile ?? DEFAULT_RAILS_MASTER_KEY_FILE;
-  const credentialsPath = (0, import_node_path17.resolve)(appDir, credentialsFile);
-  const masterKeyPath = (0, import_node_path17.resolve)(appDir, masterKeyFile);
+  const credentialsPath = (0, import_node_path18.resolve)(appDir, credentialsFile);
+  const masterKeyPath = (0, import_node_path18.resolve)(appDir, masterKeyFile);
   const env = {
     ...process.env,
     MMI_RAILS_CREDENTIALS_FILE: credentialsPath,
     MMI_RAILS_MASTER_KEY_FILE: masterKeyPath
   };
-  if ((0, import_node_fs19.existsSync)(masterKeyPath)) {
-    env.RAILS_MASTER_KEY = (0, import_node_fs19.readFileSync)(masterKeyPath, "utf8").trim();
+  if ((0, import_node_fs20.existsSync)(masterKeyPath)) {
+    env.RAILS_MASTER_KEY = (0, import_node_fs20.readFileSync)(masterKeyPath, "utf8").trim();
   }
   const script = [
     'require "json"',
@@ -17091,9 +17410,9 @@ async function decryptRailsCredentials(input) {
     'config = ActiveSupport::EncryptedConfiguration.new(config_path: config_path, key_path: key_path, env_key: "RAILS_MASTER_KEY", raise_if_missing_key: true)',
     "puts JSON.generate(config.config)"
   ].join("\n");
-  const scriptDir = (0, import_node_fs19.mkdtempSync)((0, import_node_path17.join)((0, import_node_os5.tmpdir)(), "mmi-rails-decrypt-"));
-  const scriptPath = (0, import_node_path17.join)(scriptDir, "decrypt.rb");
-  (0, import_node_fs19.writeFileSync)(scriptPath, script, "utf8");
+  const scriptDir = (0, import_node_fs20.mkdtempSync)((0, import_node_path18.join)((0, import_node_os5.tmpdir)(), "mmi-rails-decrypt-"));
+  const scriptPath = (0, import_node_path18.join)(scriptDir, "decrypt.rb");
+  (0, import_node_fs20.writeFileSync)(scriptPath, script, "utf8");
   try {
     const args = ["exec", "ruby", scriptPath];
     const cmd = process.platform === "win32" ? "cmd.exe" : "bundle";
@@ -17105,7 +17424,7 @@ async function decryptRailsCredentials(input) {
     });
     return JSON.parse(stdout);
   } finally {
-    (0, import_node_fs19.rmSync)(scriptDir, { recursive: true, force: true });
+    (0, import_node_fs20.rmSync)(scriptDir, { recursive: true, force: true });
   }
 }
 async function readSecretStdin() {
@@ -17195,7 +17514,7 @@ function registerSecretsCommands(program3) {
     let body;
     if (o.file) {
       try {
-        body = (0, import_node_fs19.readFileSync)((0, import_node_path17.resolve)(o.file), "utf8");
+        body = (0, import_node_fs20.readFileSync)((0, import_node_path18.resolve)(o.file), "utf8");
       } catch (e) {
         return fail(`secrets org-catalog: cannot read --file ${o.file}: ${e.message}`);
       }
@@ -17229,11 +17548,11 @@ function registerSecretsCommands(program3) {
       const stage = o.stage;
       const branch = promotionSourceBranch(stage, resolveReleaseTrack(meta, void 0, repo));
       const cwdRepo = repoFromRemoteUrl((await execFileP2("git", ["remote", "get-url", "origin"]).catch(() => ({ stdout: "" }))).stdout);
-      const { sameRepo } = resolvePreflightRepoScope(o.repo, cwdRepo);
+      const { sameRepo: sameRepo2 } = resolvePreflightRepoScope(o.repo, cwdRepo);
       const facts = await fetchDeployFactsBySlug(slug, regDeps);
       const fact = facts?.stages?.[stage] ?? null;
-      const composeText = sameRepo ? await readStageBranchCompose(branch) : null;
-      const verdict = evaluatePromotionFilelessGuard({ composeText, branch, stage, fact, sameRepo: Boolean(sameRepo), force: false, repo });
+      const composeText = sameRepo2 ? await readStageBranchCompose(branch) : null;
+      const verdict = evaluatePromotionFilelessGuard({ composeText, branch, stage, fact, sameRepo: Boolean(sameRepo2), force: false, repo });
       if (!verdict.ok) {
         d.err(`secrets preflight: ${verdict.reason}`);
         filelessOk = false;
@@ -17300,7 +17619,7 @@ function registerSecretsCommands(program3) {
       {
         ...d,
         decryptRailsCredentials,
-        removeFile: (path2) => (0, import_node_fs19.unlinkSync)((0, import_node_path17.resolve)(o.appDir ?? process.cwd(), path2))
+        removeFile: (path2) => (0, import_node_fs20.unlinkSync)((0, import_node_path18.resolve)(o.appDir ?? process.cwd(), path2))
       },
       {
         repo: o.repo,
@@ -17474,7 +17793,7 @@ function checkGithubPools(probe) {
 }
 
 // src/box-commands.ts
-var import_node_fs20 = require("node:fs");
+var import_node_fs21 = require("node:fs");
 
 // src/box.ts
 var BOX_KEYS = {
@@ -17677,7 +17996,7 @@ function registerBoxCommands(program3) {
       }
       if (o.json) console.log(JSON.stringify({ box: found, incomplete }, null, 2));
       else if (o.ssh && o.script) {
-        (0, import_node_fs20.writeFileSync)(o.script, sshRecipeScript(found), "utf8");
+        (0, import_node_fs21.writeFileSync)(o.script, sshRecipeScript(found), "utf8");
         console.log(`wrote ${o.script} \u2014 run: bash "${o.script}"`);
       } else if (o.ssh) console.log(`${formatSshRecipe(found)}
 ${SSH_RECIPE_AGENT_NOTE}`);
@@ -17775,7 +18094,7 @@ function lambdaTargetFromArn(arn) {
 }
 function awsScheduleEntry(payload) {
   if (!payload || typeof payload !== "object") return null;
-  const { Name, ScheduleExpression, State, Target, Description } = payload;
+  const { Name, ScheduleExpression, State, Target, Description, CreationDate } = payload;
   if (typeof Name !== "string" || typeof ScheduleExpression !== "string") return null;
   if (State !== "ENABLED" || isJervResource(Name)) return null;
   let target = "";
@@ -17798,6 +18117,7 @@ function awsScheduleEntry(payload) {
   }
   const sourceBase = `aws scheduler schedule ${Name} (eu-central-1)`;
   const source = qualifier && target ? `${sourceBase} \u2192 ${target}:${qualifier}` : sourceBase;
+  const armedAt = armedAtFromCreationDate(CreationDate);
   return {
     name: Name,
     cadence: ScheduleExpression,
@@ -17805,9 +18125,25 @@ function awsScheduleEntry(payload) {
     llm: readLlmDeclaration(typeof Description === "string" ? Description : void 0),
     resolved: "live",
     source,
-    ...scheduleId ? { scheduleId } : {}
+    ...scheduleId ? { scheduleId } : {},
+    ...armedAt ? { armedAt } : {}
   };
 }
+function armedAtFromCreationDate(creationDate) {
+  if (creationDate instanceof Date) {
+    return Number.isNaN(creationDate.getTime()) ? void 0 : creationDate.toISOString().slice(0, 10);
+  }
+  if (typeof creationDate === "string" && creationDate.trim()) {
+    const parsed = Date.parse(creationDate);
+    return Number.isNaN(parsed) ? void 0 : new Date(parsed).toISOString().slice(0, 10);
+  }
+  if (typeof creationDate === "number" && Number.isFinite(creationDate)) {
+    const ms = creationDate > 1e12 ? creationDate : creationDate * 1e3;
+    const date = new Date(ms);
+    return Number.isNaN(date.getTime()) ? void 0 : date.toISOString().slice(0, 10);
+  }
+  return void 0;
+}
 function awsScheduleRefs(payload) {
   if (!payload || typeof payload !== "object") return [];
   const { Schedules: schedules } = payload;
@@ -17873,6 +18209,12 @@ function spliceDoc(docText, generatedSection) {
   }
   return docText.slice(0, start) + generatedSection + docText.slice(end + DOC_END_MARKER.length);
 }
+function driftClearableFrom(drift, repoName) {
+  if (drift.class !== "file-vs-registry-stale") return false;
+  const slash = drift.name.indexOf("/");
+  if (slash <= 0) return false;
+  return drift.name.slice(0, slash).toLowerCase() === repoName.toLowerCase();
+}
 var HARBOUR_LLM_LAUNCHERS = /* @__PURE__ */ new Set(["cursor-agent"]);
 function isHarbourLlmLauncher(executor) {
   return HARBOUR_LLM_LAUNCHERS.has(executor);
@@ -18253,9 +18595,105 @@ function registerSchedulesCommands(program3) {
   });
 }
 
-// src/schedules-lift-command.ts
+// src/file-lock.ts
 var import_promises3 = require("node:fs/promises");
-var import_node_path18 = require("node:path");
+var import_node_path19 = require("node:path");
+var sleep = (ms) => new Promise((resolve5) => setTimeout(resolve5, ms));
+var IMMEDIATE_RETRY_BUDGET = 3;
+var FileLockBusyError = class extends Error {
+  lockPath;
+  constructor(label, lockPath, maxWaitMs) {
+    super(`${label} busy: ${lockPath} held longer than ${maxWaitMs}ms`);
+    this.name = "FileLockBusyError";
+    this.lockPath = lockPath;
+  }
+};
+function resolveFileLockOpts(opts = {}) {
+  return {
+    staleMs: opts.staleMs ?? 3e4,
+    retryMs: opts.retryMs ?? 50,
+    maxWaitMs: opts.maxWaitMs ?? 5e3,
+    label: opts.label ?? "file lock"
+  };
+}
+async function acquireFileLock(lockPath, opts, deadline) {
+  let immediateRetries = 0;
+  for (; ; ) {
+    let handle;
+    try {
+      handle = await (0, import_promises3.open)(lockPath, "wx");
+    } catch (e) {
+      const code = e.code;
+      if (code !== "EEXIST" && code !== "EPERM" && code !== "EBUSY" && code !== "EACCES") throw e;
+      const retryNow = async () => {
+        if (Date.now() >= deadline) throw new FileLockBusyError(opts.label, lockPath, opts.maxWaitMs);
+        if (++immediateRetries > IMMEDIATE_RETRY_BUDGET) await sleep(opts.retryMs);
+      };
+      try {
+        const age = Date.now() - (await (0, import_promises3.stat)(lockPath)).mtimeMs;
+        if (age > opts.staleMs) {
+          try {
+            await (0, import_promises3.unlink)(lockPath);
+            await retryNow();
+            continue;
+          } catch (unlinkError) {
+            if (unlinkError instanceof FileLockBusyError) throw unlinkError;
+            const unlinkCode = unlinkError.code;
+            if (unlinkCode === "ENOENT") {
+              await retryNow();
+              continue;
+            }
+          }
+        }
+      } catch (statError) {
+        if (statError instanceof FileLockBusyError) throw statError;
+        if (statError.code !== "ENOENT") throw statError;
+        await retryNow();
+        continue;
+      }
+      if (Date.now() >= deadline) {
+        throw new FileLockBusyError(opts.label, lockPath, opts.maxWaitMs);
+      }
+      await sleep(opts.retryMs);
+      continue;
+    }
+    const token = `${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}`;
+    try {
+      await handle.writeFile(token);
+    } catch (e) {
+      await handle.close().catch(() => void 0);
+      throw e;
+    }
+    return { token, handle };
+  }
+}
+async function fileLockHeldBy(lockPath, token) {
+  try {
+    return await (0, import_promises3.readFile)(lockPath, "utf8") === token;
+  } catch {
+    return false;
+  }
+}
+async function releaseFileLock(lockPath, guard) {
+  await guard.handle.close().catch(() => void 0);
+  if (await fileLockHeldBy(lockPath, guard.token)) {
+    await (0, import_promises3.unlink)(lockPath).catch(() => void 0);
+  }
+}
+async function withFileLock(lockPath, opts, fn) {
+  const resolved = resolveFileLockOpts(opts);
+  await (0, import_promises3.mkdir)((0, import_node_path19.dirname)(lockPath), { recursive: true }).catch(() => void 0);
+  const guard = await acquireFileLock(lockPath, resolved, Date.now() + resolved.maxWaitMs);
+  try {
+    return await fn();
+  } finally {
+    await releaseFileLock(lockPath, guard);
+  }
+}
+
+// src/schedules-lift-command.ts
+var import_promises4 = require("node:fs/promises");
+var import_node_path20 = require("node:path");
 
 // src/schedules-lift.ts
 var SCHEDULE_HEADER_FIELDS = ["schedule", "what", "owner", "cadence", "executor", "llm", "output", "breaks", "kill"];
@@ -18354,14 +18792,14 @@ var RegistryUnreachableError = class extends Error {
 async function readWorkflowFiles(dir) {
   let names;
   try {
-    names = await (0, import_promises3.readdir)(dir);
+    names = await (0, import_promises4.readdir)(dir);
   } catch {
     return [];
   }
   const files = [];
   for (const name of names.sort()) {
     if (!/\.ya?ml$/.test(name)) continue;
-    files.push({ path: `.github/workflows/${name}`, text: await (0, import_promises3.readFile)((0, import_node_path18.join)(dir, name), "utf8") });
+    files.push({ path: `.github/workflows/${name}`, text: await (0, import_promises4.readFile)((0, import_node_path20.join)(dir, name), "utf8") });
   }
   return files;
 }
@@ -18903,7 +19341,7 @@ function registerQueryCommands(program3) {
 }
 
 // src/bootstrap-commands.ts
-var import_node_fs21 = require("node:fs");
+var import_node_fs22 = require("node:fs");
 
 // src/bootstrap-verify.ts
 var TRAIN_BRANCHES2 = ["development", "rc", "main"];
@@ -19451,7 +19889,7 @@ function registerBootstrapCommands(program3) {
       client: defaultGitHubClient(),
       projectMeta: meta,
       deployModel: typeof meta?.deployModel === "string" ? meta.deployModel : void 0,
-      readLocalFile: (path2) => path2 === "projects.json" && apiProjects != null ? apiProjects : (0, import_node_fs21.existsSync)(path2) ? (0, import_node_fs21.readFileSync)(path2, "utf8") : null,
+      readLocalFile: (path2) => path2 === "projects.json" && apiProjects != null ? apiProjects : (0, import_node_fs22.existsSync)(path2) ? (0, import_node_fs22.readFileSync)(path2, "utf8") : null,
       // requiredGcpApis is stored as an array by a JSON write, but `org project set --var KEY=VALUE` stores a raw
       // comma-string — accept either so the seeded value verifies regardless of how it was written.
       requiredGcpApis: (() => {
@@ -19502,12 +19940,12 @@ function registerBootstrapCommands(program3) {
       return fail(`bootstrap apply: ${e.message}`);
     }
     const manifestPath = "skills/bootstrap/seeds/manifest.json";
-    if (!(0, import_node_fs21.existsSync)(manifestPath)) return fail(`bootstrap apply: ${manifestPath} not found; bootstrap runs from the MMI-Hub repo root by design \u2014 it stamps org-level resources (Project, Ruleset, secrets, access) through the GitHub App, which is only authorized from the Hub checkout`);
-    const manifest = loadBootstrapSeeds((0, import_node_fs21.readFileSync)(manifestPath, "utf8"));
+    if (!(0, import_node_fs22.existsSync)(manifestPath)) return fail(`bootstrap apply: ${manifestPath} not found; bootstrap runs from the MMI-Hub repo root by design \u2014 it stamps org-level resources (Project, Ruleset, secrets, access) through the GitHub App, which is only authorized from the Hub checkout`);
+    const manifest = loadBootstrapSeeds((0, import_node_fs22.readFileSync)(manifestPath, "utf8"));
     const baseBranch = o.class === "content" ? "main" : "development";
     const slug = parsedRepo.slug;
     const gh = async (args) => execFileP2("gh", args, { timeout: 2e4 });
-    const readFile6 = (p) => (0, import_node_fs21.existsSync)(p) ? (0, import_node_fs21.readFileSync)(p, "utf8") : null;
+    const readFile7 = (p) => (0, import_node_fs22.existsSync)(p) ? (0, import_node_fs22.readFileSync)(p, "utf8") : null;
     const enc = (p) => p.split("/").map(encodeURIComponent).join("/");
     const rawVars = {};
     for (const value of cmdOpts.var ?? []) {
@@ -19585,7 +20023,7 @@ function registerBootstrapCommands(program3) {
       }
       const planned = planSeedAction(resolved, exists);
       const isBlock = resolved.source === "managed-block";
-      const content = planned.action === "create" || planned.action === "update" ? isBlock ? upsertManagedGitignoreBlock(remoteContent).content : resolveSeedContent(resolved, vars, readFile6) : null;
+      const content = planned.action === "create" || planned.action === "update" ? isBlock ? upsertManagedGitignoreBlock(remoteContent).content : resolveSeedContent(resolved, vars, readFile7) : null;
       const action = reconcileSeedAction(planned, content, isBlock, remoteContent);
       actions.push(action);
       if (o.execute && (action.action === "create" || action.action === "update")) {
@@ -19640,7 +20078,7 @@ function registerBootstrapCommands(program3) {
       }
       const rulesetSeed = manifest.seeds.find((s) => s.target === ".github/rulesets/mmi-product-required-checks.json");
       if (rulesetSeed) {
-        const rulesetContent = resolveSeedContent({ ...rulesetSeed, target: rulesetSeed.target.replace("{{REPO_SLUG}}", slug) }, vars, readFile6);
+        const rulesetContent = resolveSeedContent({ ...rulesetSeed, target: rulesetSeed.target.replace("{{REPO_SLUG}}", slug) }, vars, readFile7);
         if (rulesetContent) {
           try {
             const activation = await activateProductRuleset(repo, stripRulesetComment(rulesetContent), defaultGitHubClient());
@@ -19703,12 +20141,12 @@ LIVE apply to ${repo}:
 }
 
 // src/stage-commands.ts
-var import_node_fs23 = require("node:fs");
-var import_node_path20 = require("node:path");
+var import_node_fs24 = require("node:fs");
+var import_node_path22 = require("node:path");
 
 // src/port-registry.ts
-var import_node_fs22 = require("node:fs");
-var import_node_path19 = require("node:path");
+var import_node_fs23 = require("node:fs");
+var import_node_path21 = require("node:path");
 
 // ../infra/port-geometry.mjs
 var PORT_BLOCK = 100;
@@ -19722,8 +20160,8 @@ function nextPortBlock(registry2) {
   return [base, base + PORT_SPAN];
 }
 function loadPortRegistry(path2) {
-  if (!(0, import_node_fs22.existsSync)(path2)) return {};
-  const raw = JSON.parse((0, import_node_fs22.readFileSync)(path2, "utf8"));
+  if (!(0, import_node_fs23.existsSync)(path2)) return {};
+  const raw = JSON.parse((0, import_node_fs23.readFileSync)(path2, "utf8"));
   const out = {};
   for (const [key, value] of Object.entries(raw)) {
     if (Array.isArray(value) && value.length === 2 && value.every((n) => typeof n === "number")) {
@@ -19737,9 +20175,9 @@ function ensurePortRange(repo, path2) {
   const existing = registry2[repo];
   if (existing) return existing;
   const range = nextPortBlock(registry2);
-  const raw = (0, import_node_fs22.existsSync)(path2) ? JSON.parse((0, import_node_fs22.readFileSync)(path2, "utf8")) : {};
+  const raw = (0, import_node_fs23.existsSync)(path2) ? JSON.parse((0, import_node_fs23.readFileSync)(path2, "utf8")) : {};
   raw[repo] = range;
-  (0, import_node_fs22.writeFileSync)(path2, JSON.stringify(raw, null, 2) + "\n", "utf8");
+  (0, import_node_fs23.writeFileSync)(path2, JSON.stringify(raw, null, 2) + "\n", "utf8");
   return range;
 }
 function portCursorSeed(registry2) {
@@ -19761,22 +20199,22 @@ function existingPortRange(repo, registry2) {
   return registry2[repo] ?? null;
 }
 function portRangeInfraAt(root, source) {
-  const registryPath = (0, import_node_path19.join)(root, "infra", "port-ranges.json");
-  const ddbScriptPath = (0, import_node_path19.join)(root, "infra", "port-ddb.mjs");
-  if (!(0, import_node_fs22.existsSync)(registryPath) || !(0, import_node_fs22.existsSync)(ddbScriptPath)) return null;
+  const registryPath = (0, import_node_path21.join)(root, "infra", "port-ranges.json");
+  const ddbScriptPath = (0, import_node_path21.join)(root, "infra", "port-ddb.mjs");
+  if (!(0, import_node_fs23.existsSync)(registryPath) || !(0, import_node_fs23.existsSync)(ddbScriptPath)) return null;
   return { root, source, registryPath, ddbScriptPath };
 }
 function resolvePortRangeInfra(cwd, packageDir) {
   const direct = portRangeInfraAt(cwd, "cwd");
   if (direct) return direct;
-  for (let dir = cwd; ; dir = (0, import_node_path19.dirname)(dir)) {
-    const sibling = portRangeInfraAt((0, import_node_path19.join)(dir, "MMI-Hub"), "sibling-hub");
+  for (let dir = cwd; ; dir = (0, import_node_path21.dirname)(dir)) {
+    const sibling = portRangeInfraAt((0, import_node_path21.join)(dir, "MMI-Hub"), "sibling-hub");
     if (sibling) return sibling;
-    const parent = (0, import_node_path19.dirname)(dir);
+    const parent = (0, import_node_path21.dirname)(dir);
     if (parent === dir) break;
   }
   if (packageDir) {
-    const pkgRoot = (0, import_node_path19.join)(packageDir, "..", "..");
+    const pkgRoot = (0, import_node_path21.join)(packageDir, "..", "..");
     const pkgFrom = portRangeInfraAt(pkgRoot, "pkg-root");
     if (pkgFrom) return pkgFrom;
   }
@@ -19952,8 +20390,8 @@ function registerStageCommands(program3) {
     const portRange = portRangeMeta && typeof portRangeMeta.start === "number" && typeof portRangeMeta.end === "number" ? [portRangeMeta.start, portRangeMeta.end] : void 0;
     return decideStage({
       registry: { deployModel: project2?.deployModel, portRange, error: read.ok ? void 0 : read.error },
-      hasCompose: (0, import_node_fs23.existsSync)((0, import_node_path20.join)(process.cwd(), "docker-compose.yml")),
-      hasEnvExample: (0, import_node_fs23.existsSync)((0, import_node_path20.join)(process.cwd(), ".env.example"))
+      hasCompose: (0, import_node_fs24.existsSync)((0, import_node_path22.join)(process.cwd(), "docker-compose.yml")),
+      hasEnvExample: (0, import_node_fs24.existsSync)((0, import_node_path22.join)(process.cwd(), ".env.example"))
     });
   }
   async function fetchStageVaultEnvMerge() {
@@ -20388,9 +20826,9 @@ function registerBoardCommands(program3) {
 }
 
 // src/merge-cleanup.ts
-var import_node_fs24 = require("node:fs");
-var import_promises5 = require("node:fs/promises");
-var import_node_path22 = require("node:path");
+var import_node_fs25 = require("node:fs");
+var import_promises6 = require("node:fs/promises");
+var import_node_path24 = require("node:path");
 var import_node_child_process11 = require("node:child_process");
 
 // src/board-advance.ts
@@ -20476,117 +20914,64 @@ function boardAdvanceFailureMessage(result) {
 }
 
 // src/deferred-registry-store.ts
-var import_promises4 = require("node:fs/promises");
-var import_node_path21 = require("node:path");
-var sleep = (ms) => new Promise((resolve5) => setTimeout(resolve5, ms));
+var import_promises5 = require("node:fs/promises");
+var import_node_path23 = require("node:path");
+var sleep2 = (ms) => new Promise((resolve5) => setTimeout(resolve5, ms));
 async function atomicWrite(target, contents) {
   const tmp = `${target}.tmp-${process.pid}-${Math.random().toString(36).slice(2)}`;
-  await (0, import_promises4.writeFile)(tmp, contents, "utf8");
+  await (0, import_promises5.writeFile)(tmp, contents, "utf8");
   try {
     await renameWithRetry(tmp, target);
   } catch (e) {
-    await (0, import_promises4.unlink)(tmp).catch(() => void 0);
+    await (0, import_promises5.unlink)(tmp).catch(() => void 0);
     throw e;
   }
 }
 async function renameWithRetry(from, to, attempts = 5, backoffMs = 20) {
   for (let i = 0; ; i++) {
     try {
-      await (0, import_promises4.rename)(from, to);
+      await (0, import_promises5.rename)(from, to);
       return;
     } catch (e) {
       const code = e.code;
       if (i >= attempts - 1 || code !== "EPERM" && code !== "EACCES" && code !== "EBUSY") throw e;
-      await sleep(backoffMs);
+      await sleep2(backoffMs);
     }
   }
 }
 async function readStrict(registryPath) {
   let text;
   try {
-    text = await (0, import_promises4.readFile)(registryPath, "utf8");
+    text = await (0, import_promises5.readFile)(registryPath, "utf8");
   } catch (e) {
     if (e.code === "ENOENT") return [];
     throw e;
   }
   return parseDeferredWorktreesFile(text);
 }
-async function acquireLock(lockPath, opts, deadline) {
-  for (; ; ) {
-    let handle;
-    try {
-      handle = await (0, import_promises4.open)(lockPath, "wx");
-    } catch (e) {
-      const code = e.code;
-      if (code !== "EEXIST" && code !== "EPERM" && code !== "EBUSY" && code !== "EACCES") throw e;
-      try {
-        const age = Date.now() - (await (0, import_promises4.stat)(lockPath)).mtimeMs;
-        if (age > opts.staleMs) {
-          try {
-            await (0, import_promises4.unlink)(lockPath);
-            continue;
-          } catch (unlinkError) {
-            const code2 = unlinkError.code;
-            if (code2 === "ENOENT") continue;
-          }
-        }
-      } catch (statError) {
-        if (statError.code !== "ENOENT") throw statError;
-        continue;
-      }
-      if (Date.now() >= deadline) {
-        throw new Error(`deferred registry lock busy: ${lockPath} held longer than ${opts.maxWaitMs}ms`);
-      }
-      await sleep(opts.retryMs);
-      continue;
-    }
-    const token = `${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}`;
-    try {
-      await handle.writeFile(token);
-    } catch (e) {
-      await handle.close().catch(() => void 0);
-      throw e;
-    }
-    return { token, handle };
-  }
-}
-async function lockHeldBy(lockPath, token) {
-  try {
-    return await (0, import_promises4.readFile)(lockPath, "utf8") === token;
-  } catch {
-    return false;
-  }
-}
-async function releaseLock(lockPath, guard) {
-  await guard.handle.close().catch(() => void 0);
-  if (await lockHeldBy(lockPath, guard.token)) {
-    await (0, import_promises4.unlink)(lockPath).catch(() => void 0);
-  }
-}
+var acquireLock = acquireFileLock;
+var lockHeldBy = fileLockHeldBy;
+var releaseLock = releaseFileLock;
 function makeDeferredWorktreeStore(registryPath, lockOpts = {}) {
-  const opts = {
-    staleMs: lockOpts.staleMs ?? 3e4,
-    retryMs: lockOpts.retryMs ?? 50,
-    maxWaitMs: lockOpts.maxWaitMs ?? 5e3
-  };
+  const opts = resolveFileLockOpts({ ...lockOpts, label: "deferred registry lock" });
   const lockPath = `${registryPath}.lock`;
   return {
     // Lenient read for the sweep's initial fetch: any error (missing/corrupt) yields an empty queue.
     read: async () => {
       try {
-        return parseDeferredWorktreesFile(await (0, import_promises4.readFile)(registryPath, "utf8"));
+        return parseDeferredWorktreesFile(await (0, import_promises5.readFile)(registryPath, "utf8"));
       } catch {
         return [];
       }
     },
     // Standalone atomic write — THROWS on failure (no best-effort swallow, #2846).
     write: async (entries) => {
-      await (0, import_promises4.mkdir)((0, import_node_path21.dirname)(registryPath), { recursive: true });
+      await (0, import_promises5.mkdir)((0, import_node_path23.dirname)(registryPath), { recursive: true });
       await atomicWrite(registryPath, serializeDeferredWorktrees(entries));
     },
     // Serialized read-modify-write under the repo-wide lock (#2846).
     update: async (mutate) => {
-      await (0, import_promises4.mkdir)((0, import_node_path21.dirname)(registryPath), { recursive: true });
+      await (0, import_promises5.mkdir)((0, import_node_path23.dirname)(registryPath), { recursive: true });
       const deadline = Date.now() + opts.maxWaitMs;
       for (; ; ) {
         const guard = await acquireLock(lockPath, opts, deadline);
@@ -20603,7 +20988,7 @@ function makeDeferredWorktreeStore(registryPath, lockOpts = {}) {
         if (Date.now() >= deadline) {
           throw new Error(`deferred registry lock contention: ${lockPath} lost to a concurrent holder past ${opts.maxWaitMs}ms`);
         }
-        await sleep(opts.retryMs);
+        await sleep2(opts.retryMs);
       }
     }
   };
@@ -20650,11 +21035,17 @@ function renderGcApplyResult(result) {
   lines.push(`  remote branches removed: ${result.removedRemoteBranches.length ? result.removedRemoteBranches.join(", ") : "none"}`);
   lines.push(`  tracking refs removed: ${result.removedTrackingRefs.length ? result.removedTrackingRefs.join(", ") : "none"}`);
   lines.push(`  dead sibling dirs removed: ${result.removedWorktreeDirs.length ? result.removedWorktreeDirs.join(", ") : "none"}`);
-  lines.push(`  worktrees pruned: ${result.pruned ? "yes" : "no"}`);
+  lines.push(`  stale registrations pruned: ${result.pruned ? "yes" : "no"} (clears registrations only \u2014 never deletes a directory)`);
   if (result.failed.length) {
     lines.push(`  failed (${result.failed.length}):`);
     for (const f of result.failed) lines.push(`    - ${f}`);
   }
+  const removedNothing = result.removedBranches.length === 0 && result.removedRemoteBranches.length === 0 && result.removedTrackingRefs.length === 0 && result.removedWorktreeDirs.length === 0;
+  if (removedNothing) {
+    lines.push("  NOTHING WAS REMOVED. A stale worktree whose directory still exists is not reachable by");
+    lines.push("  this verb \u2014 remove it from inside it with `mmi-cli worktree land --apply`, or delete the");
+    lines.push("  directory and re-run to clear its registration.");
+  }
   return lines.join("\n");
 }
 async function deleteReviewedRemoteBranch(remote, branch, expectedHeadOid) {
@@ -20713,7 +21104,7 @@ async function applyGcPlan(plan, remote, opts = {}) {
       return cleanupPrMergeLocalBranch(branch.branch, {
         beforeWorktrees,
         startingPath: branch.worktreePath,
-        pathExists: (p) => (0, import_node_fs24.existsSync)(p),
+        pathExists: (p) => (0, import_node_fs25.existsSync)(p),
         execGit: async (args) => (await execFileP2("git", args, { timeout: GIT_TIMEOUT_MS })).stdout,
         teardownWorktreeStage,
         deferredStore,
@@ -20735,12 +21126,12 @@ async function applyGcPlan(plan, remote, opts = {}) {
   const removeDeps = worktreeRemoveDeps(async (args) => (await execFileP2("git", args, { timeout: GIT_TIMEOUT_MS })).stdout);
   const repoRoot2 = (await execFileP2("git", ["rev-parse", "--show-toplevel"], { timeout: GIT_TIMEOUT_MS }).catch(() => ({ stdout: "" }))).stdout.trim() || process.cwd();
   const worktreeGitRoot = await currentRepoWorktreeGitRoot(repoRoot2);
-  const primaryRepoRoot = worktreeGitRoot ? (0, import_node_path22.dirname)((0, import_node_path22.dirname)(worktreeGitRoot)) : repoRoot2;
+  const primaryRepoRoot = worktreeGitRoot ? (0, import_node_path24.dirname)((0, import_node_path24.dirname)(worktreeGitRoot)) : repoRoot2;
   const siblingRoot = opts.root ? resolveExplicitScanRoot(opts.root, primaryRepoRoot) : siblingMmiWorktreesRoot(primaryRepoRoot);
   for (const wt of plan.worktreeDirs) {
     try {
       const cleanupTarget = resolveSafeSiblingWorktreeCleanupTarget(wt.path, siblingRoot, {
-        realpath: (path2) => (0, import_node_fs24.realpathSync)(path2)
+        realpath: (path2) => (0, import_node_fs25.realpathSync)(path2)
       });
       if (!cleanupTarget.ok) {
         result.failed.push(`${wt.path}: ${cleanupTarget.reason}`);
@@ -20901,13 +21292,13 @@ var realWorktreeDirRemover = {
   probe: (p) => {
     let st;
     try {
-      st = (0, import_node_fs24.lstatSync)(p);
+      st = (0, import_node_fs25.lstatSync)(p);
     } catch {
       return null;
     }
     if (st.isSymbolicLink()) return "link";
     try {
-      (0, import_node_fs24.readlinkSync)(p);
+      (0, import_node_fs25.readlinkSync)(p);
       return "link";
     } catch {
     }
@@ -20915,7 +21306,7 @@ var realWorktreeDirRemover = {
   },
   readdir: (p) => {
     try {
-      return (0, import_node_fs24.readdirSync)(p);
+      return (0, import_node_fs25.readdirSync)(p);
     } catch {
       return [];
     }
@@ -20924,12 +21315,12 @@ var realWorktreeDirRemover = {
   // leaving the target); a file symlink with unlink. rmdir first, fall back to unlink.
   detachLink: (p) => {
     try {
-      (0, import_node_fs24.rmdirSync)(p);
+      (0, import_node_fs25.rmdirSync)(p);
     } catch {
-      (0, import_node_fs24.unlinkSync)(p);
+      (0, import_node_fs25.unlinkSync)(p);
     }
   },
-  removeTree: (p) => (0, import_promises5.rm)(p, { recursive: true, force: true, maxRetries: 5, retryDelay: 200 })
+  removeTree: (p) => (0, import_promises6.rm)(p, { recursive: true, force: true, maxRetries: 5, retryDelay: 200 })
 };
 async function resolvePrimaryCheckout(execGit) {
   try {
@@ -20959,9 +21350,9 @@ async function worktreeHasStageState(worktreePath) {
   }
 }
 function stageStateFileBelongsToWorktree(statePath, worktreePath) {
-  if (!(0, import_node_fs24.existsSync)(statePath)) return false;
+  if (!(0, import_node_fs25.existsSync)(statePath)) return false;
   try {
-    const state = JSON.parse((0, import_node_fs24.readFileSync)(statePath, "utf8"));
+    const state = JSON.parse((0, import_node_fs25.readFileSync)(statePath, "utf8"));
     const recordedCwd = typeof state.identity?.cwd === "string" ? state.identity.cwd : typeof state.cwd === "string" ? state.cwd : "";
     return Boolean(recordedCwd && isPathUnderDirectory(recordedCwd, worktreePath));
   } catch {
@@ -21168,8 +21559,8 @@ async function fetchRestCorePool(gh = defaultGhApi) {
 }
 
 // src/worktree-lifecycle-commands.ts
-var import_node_fs25 = require("node:fs");
-var import_node_path23 = require("node:path");
+var import_node_fs26 = require("node:fs");
+var import_node_path25 = require("node:path");
 var GH_TIMEOUT_MS = 2e4;
 var DEFAULT_BASE = "origin/development";
 var DEFAULT_REMOTE = "origin";
@@ -21272,7 +21663,7 @@ function classifyStaleLeaks(input) {
 var defaultOrphanDirScanDeps = {
   listDirs: (root) => {
     try {
-      return (0, import_node_fs25.readdirSync)(root, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => (0, import_node_path23.join)(root, e.name));
+      return (0, import_node_fs26.readdirSync)(root, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => (0, import_node_path25.join)(root, e.name));
     } catch {
       return [];
     }
@@ -21328,13 +21719,13 @@ function registerWorktreeCommands(program3) {
       if (PROTECTED_BRANCHES2.has(branch)) {
         return fail(`worktree land: refusing to land protected branch '${branch}'`, { code: ERROR_CODES.ERR_BAD_ENUM });
       }
-      const gitFile = (0, import_node_path23.join)(wtPath, ".git");
-      const isLinked = (0, import_node_fs25.existsSync)(gitFile) && (0, import_node_fs25.statSync)(gitFile).isFile();
+      const gitFile = (0, import_node_path25.join)(wtPath, ".git");
+      const isLinked = (0, import_node_fs26.existsSync)(gitFile) && (0, import_node_fs26.statSync)(gitFile).isFile();
       if (apply && !isLinked) {
         return fail("worktree land: run from inside the linked worktree you want to land (this is the primary checkout)");
       }
       const commonDir = (await execFileP2("git", ["rev-parse", "--git-common-dir"], { timeout: GIT_TIMEOUT_MS }).catch(() => ({ stdout: "" }))).stdout.trim();
-      const primaryCheckout = commonDir ? (0, import_node_path23.dirname)(commonDir) : wtPath;
+      const primaryCheckout = commonDir ? (0, import_node_path25.dirname)(commonDir) : wtPath;
       const stageSummary = readStageSummary(wtPath);
       const hasStage = stageSummary != null;
       const steps = landSteps(branch, true, hasStage);
@@ -21445,10 +21836,10 @@ async function gatherWorktreeContext() {
     if (s) stages.push({ path: wt.path, port: s.port });
   }
   const worktreeGitRoot = await currentRepoWorktreeGitRoot(repoRoot2);
-  const primaryRepoRoot = worktreeGitRoot ? (0, import_node_path23.dirname)((0, import_node_path23.dirname)(worktreeGitRoot)) : repoRoot2;
+  const primaryRepoRoot = worktreeGitRoot ? (0, import_node_path25.dirname)((0, import_node_path25.dirname)(worktreeGitRoot)) : repoRoot2;
   const wtRoot = siblingMmiWorktreesRoot(primaryRepoRoot);
   let orphanDirs = [];
-  if ((0, import_node_fs25.existsSync)(wtRoot)) {
+  if ((0, import_node_fs26.existsSync)(wtRoot)) {
     orphanDirs = scanOrphanDirs(wtRoot, worktreeGitRoot, {
       ...defaultOrphanDirScanDeps,
       listDirs: (root) => worktreeScanDirs(root, primaryRepoRoot, defaultOrphanDirScanDeps.listDirs, isRepoCheckoutDir)
@@ -21471,7 +21862,7 @@ async function bestEffortGit(args, cwd, step, timeoutMs = GIT_TIMEOUT_MS) {
 }
 
 // src/issue-commands.ts
-var import_node_fs26 = require("node:fs");
+var import_node_fs27 = require("node:fs");
 var import_node_crypto5 = require("node:crypto");
 var ghRunner = async (args, timeoutMs) => (await execFileP2("gh", args, { timeout: timeoutMs })).stdout;
 async function editIssue(client, options, deps = {}) {
@@ -21485,7 +21876,7 @@ async function editIssue(client, options, deps = {}) {
   if (options.body !== void 0 || options.bodyFile !== void 0) {
     let body;
     if (options.bodyFile) {
-      const td = deps.textDeps ?? { readFile: (p, e) => Promise.resolve((0, import_node_fs26.readFileSync)(p, e)), readStdin: () => Promise.resolve("") };
+      const td = deps.textDeps ?? { readFile: (p, e) => Promise.resolve((0, import_node_fs27.readFileSync)(p, e)), readStdin: () => Promise.resolve("") };
       body = await resolveIssueBody({ body: options.body, bodyFile: options.bodyFile }, td);
     } else {
       body = options.body ?? "";
@@ -21982,7 +22373,7 @@ function extendCreateCommand(issue2, batchAttach) {
     if (opts.batch) {
       let specs;
       try {
-        const raw = (0, import_node_fs26.readFileSync)(opts.batch, "utf8");
+        const raw = (0, import_node_fs27.readFileSync)(opts.batch, "utf8");
         specs = JSON.parse(raw);
         if (!Array.isArray(specs)) throw new Error("batch file must contain a JSON array");
       } catch (e) {
@@ -22040,12 +22431,12 @@ ${lines}`);
 }
 
 // src/train-commands.ts
-var import_node_fs28 = require("node:fs");
-var import_node_path25 = require("node:path");
+var import_node_fs29 = require("node:fs");
+var import_node_path27 = require("node:path");
 
 // src/plugin-guard-io.ts
-var import_node_fs27 = require("node:fs");
-var import_node_path24 = require("node:path");
+var import_node_fs28 = require("node:fs");
+var import_node_path26 = require("node:path");
 var import_node_os6 = require("node:os");
 
 // src/plugin-guard.ts
@@ -22175,11 +22566,11 @@ function runHostBin(bin, args, opts) {
 }
 var installedPluginsPath2 = (surface = detectSurface(process.env)) => {
   const homeDir = surface === "codex" ? ".codex" : ".claude";
-  return (0, import_node_path24.join)((0, import_node_os6.homedir)(), homeDir, "plugins", "installed_plugins.json");
+  return (0, import_node_path26.join)((0, import_node_os6.homedir)(), homeDir, "plugins", "installed_plugins.json");
 };
 function readInstalledPlugins(surface = detectSurface(process.env)) {
   try {
-    return JSON.parse((0, import_node_fs27.readFileSync)(installedPluginsPath2(surface), "utf8"));
+    return JSON.parse((0, import_node_fs28.readFileSync)(installedPluginsPath2(surface), "utf8"));
   } catch {
     return null;
   }
@@ -22187,13 +22578,13 @@ function readInstalledPlugins(surface = detectSurface(process.env)) {
 function marketplaceCloneCandidates(surface, home) {
   if (surface === "codex") {
     return [
-      (0, import_node_path24.join)(home, ".codex", ".tmp", "marketplaces", "mutmutco"),
-      (0, import_node_path24.join)(home, ".codex", "plugins", "marketplaces", "mutmutco")
+      (0, import_node_path26.join)(home, ".codex", ".tmp", "marketplaces", "mutmutco"),
+      (0, import_node_path26.join)(home, ".codex", "plugins", "marketplaces", "mutmutco")
     ];
   }
-  return [(0, import_node_path24.join)(home, ".claude", "plugins", "marketplaces", "mutmutco")];
+  return [(0, import_node_path26.join)(home, ".claude", "plugins", "marketplaces", "mutmutco")];
 }
-function marketplaceClonePresent(surface, home, exists = import_node_fs27.existsSync) {
+function marketplaceClonePresent(surface, home, exists = import_node_fs28.existsSync) {
   return marketplaceCloneCandidates(surface, home).some(exists);
 }
 async function fetchNpmReleasedVersion() {
@@ -22221,7 +22612,7 @@ function snapshotPluginGuardInput(surface = detectSurface(process.env), isOrgRep
     isOrgRepo,
     installRecordPresent: hasUserInstallRecord(installed, MMI_PLUGIN_ID) || hasProjectInstallRecord(installed, MMI_PLUGIN_ID, process.cwd()),
     marketplaceClonePresent: marketplaceClonePresent(surface, (0, import_node_os6.homedir)()),
-    pluginCachePresent: (0, import_node_fs27.existsSync)((0, import_node_path24.join)((0, import_node_os6.homedir)(), homeDir, "plugins", "cache", "mutmutco", "mmi"))
+    pluginCachePresent: (0, import_node_fs28.existsSync)((0, import_node_path26.join)((0, import_node_os6.homedir)(), homeDir, "plugins", "cache", "mutmutco", "mmi"))
   };
 }
 function claudePluginGuardState(isOrgRepo) {
@@ -22356,7 +22747,7 @@ function formatTrainStatus(r) {
 // src/train-commands.ts
 function readRepoVersion() {
   try {
-    return JSON.parse((0, import_node_fs28.readFileSync)((0, import_node_path25.join)(process.cwd(), ".claude-plugin", "plugin.json"), "utf8")).version || void 0;
+    return JSON.parse((0, import_node_fs29.readFileSync)((0, import_node_path27.join)(process.cwd(), ".claude-plugin", "plugin.json"), "utf8")).version || void 0;
   } catch {
     return void 0;
   }
@@ -22502,6 +22893,9 @@ function registerDeployCommands(program3) {
 }
 
 // src/discovery-commands.ts
+var import_node_fs30 = require("node:fs");
+var import_node_os7 = require("node:os");
+var import_node_path28 = require("node:path");
 var GC_GH_TIMEOUT_MS3 = 2e4;
 async function collectStatus() {
   let branch = "";
@@ -22586,6 +22980,23 @@ async function recommendNext(deps) {
   const top = sorted[0];
   return { number: top.number, title: top.title, url: top.url, priority: top.priority, repo: top.repository };
 }
+function onboardPluginGate(deps) {
+  const { registered, declared, ref } = readKnownMarketplace(deps.readKnown(), MMI_MARKETPLACE_NAME);
+  if (!registered) {
+    return { ok: false, detail: `${MMI_MARKETPLACE_NAME} marketplace not registered on this machine` };
+  }
+  const autoUpdate = resolveAutoUpdate({
+    name: MMI_MARKETPLACE_NAME,
+    registered,
+    declared,
+    settingsDeclared: readSettingsAutoUpdate(deps.readSettings(), MMI_MARKETPLACE_NAME)
+  }).effective;
+  const catalog = resolveCatalogRef({ name: MMI_MARKETPLACE_NAME, registered, ref, autoUpdate });
+  const gaps = [];
+  if (!autoUpdate) gaps.push(`auto-update is off \u2014 turn it on with ${AUTO_UPDATE_TOGGLE_STEPS}`);
+  if (catalog && !catalog.agrees) gaps.push(`the catalog is ${catalog.unpinned ? "unpinned" : `pinned to ${catalog.ref}`} \u2014 ${CATALOG_REF_PIN_STEPS}`);
+  return gaps.length === 0 ? { ok: true, detail: `auto-update on, catalog pinned to ${catalog?.ref}` } : { ok: false, detail: gaps.join("; ") };
+}
 async function collectOnboardStatus() {
   const cfg = await loadConfig();
   let track = "unknown";
@@ -22659,7 +23070,12 @@ async function collectOnboardStatus() {
     else if (top) nextCommand = `mmi-cli board claim ${top.number}  # ${top.title}`;
     else nextCommand = "mmi-cli board read \u2014 no claimable items found";
   }
-  return { track, board, registry: registry2, secrets, nextCommand };
+  const home = (0, import_node_os7.homedir)();
+  const plugin = onboardPluginGate({
+    readKnown: () => readFileSyncSafe((0, import_node_path28.join)(home, ...KNOWN_MARKETPLACES_RELATIVE), import_node_fs30.readFileSync),
+    readSettings: () => readFileSyncSafe((0, import_node_path28.join)(home, ".claude", "settings.json"), import_node_fs30.readFileSync)
+  });
+  return { track, board, registry: registry2, secrets, plugin, nextCommand };
 }
 function registerDiscoveryCommands(program3) {
   program3.command("status").description("unified repo snapshot: branch, worktrees, open PRs (yours), claimed board items, stage state").option("--json", "machine-readable output").action(async (o) => {
@@ -22703,6 +23119,7 @@ function registerDiscoveryCommands(program3) {
         console.log(`Board: ${report.board.ok ? "\u2713" : "\u2717"} ${report.board.detail}`);
         console.log(`Registry: ${report.registry.ok ? "\u2713" : "\u2717"} ${report.registry.detail}`);
         console.log(`Secrets: ${report.secrets.ok ? "\u2713" : "\u2717"} ${report.secrets.detail}`);
+        console.log(`Plugin:   ${report.plugin.ok ? "\u2713" : "\u2717"} ${report.plugin.detail}`);
         console.log(`
 Next command: ${report.nextCommand}`);
       }
@@ -22862,7 +23279,7 @@ function registerExplainCommand(program3) {
 }
 
 // src/pr-commands.ts
-var import_promises6 = require("node:fs/promises");
+var import_promises7 = require("node:fs/promises");
 var GC_GH_TIMEOUT_MS4 = 2e4;
 var CHECKS_WATCH_POLL_MS = 15e3;
 var CHECKS_WATCH_TIMEOUT_MS = 10 * 6e4;
@@ -23006,10 +23423,10 @@ function registerPrLifecycleCommands(program3) {
     let body;
     try {
       if (o.title || o.titleFile) {
-        title = await resolveIssueTitle({ title: o.title, titleFile: o.titleFile }, { readFile: import_promises6.readFile, readStdin });
+        title = await resolveIssueTitle({ title: o.title, titleFile: o.titleFile }, { readFile: import_promises7.readFile, readStdin });
       }
       if (o.body || o.bodyFile) {
-        body = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises6.readFile, readStdin });
+        body = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises7.readFile, readStdin });
       }
     } catch (e) {
       return fail(`pr edit: ${e.message}`);
@@ -23039,7 +23456,7 @@ function registerPrLifecycleCommands(program3) {
     }
     let body;
     try {
-      body = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises6.readFile, readStdin });
+      body = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises7.readFile, readStdin });
     } catch (e) {
       return fail(`pr comment: ${e.message}`);
     }
@@ -23443,7 +23860,7 @@ function renderDoctorText(checks, opts) {
   return lines.join("\n");
 }
 function doctorReportExitCode(checks) {
-  return checks.some((c) => !c.ok) ? 1 : 0;
+  return checks.some((c) => !c.ok && !c.reportOnly) ? 1 : 0;
 }
 
 // src/doctor-clean.ts
@@ -23477,6 +23894,7 @@ function checkGithubAuth(probe) {
   };
 }
 function checkAwsIdentity(probe) {
+  if (probe.probed === false) return null;
   if (!probe.isOrgRepo) return null;
   const arn = probe.callerArn?.trim();
   return {
@@ -23485,7 +23903,11 @@ function checkAwsIdentity(probe) {
     fix: "use a non-root IAM user/session profile (set AWS_PROFILE or run: aws sso login), then verify `aws sts get-caller-identity` is not :root",
     // Name the caller. A green "aws identity" says only "not root" — it does not say WHO, and "no AWS
     // configured at all" is also green here. Under --verbose those two must not look the same.
-    verbose: [`caller: ${arn || "(no AWS identity configured \u2014 allowed)"}`]
+    //
+    // #3485: the empty case says "not resolved", never "not configured". `awsCallerArn` returns undefined
+    // for ANY failure — expired SSO, no `aws` binary, a timeout — so asserting "no AWS identity configured"
+    // is the same false-fact green this issue is about, one layer down. Evidence states what was observed.
+    verbose: [`caller: ${arn || "(none resolved \u2014 no AWS configured, or the probe failed; either is allowed)"}`]
   };
 }
 function checkRepoWorktrees(probe) {
@@ -23515,6 +23937,11 @@ function checkWorktreeRoots(probe) {
   return {
     ok: false,
     label: "worktree roots",
+    // #3485: report-only in EVERY mode means report-only in the exit code too. `worktree gc --root` does
+    // exist and is the eventual fix, but this row is deliberately not a gate: the remedy is a human
+    // review of directories that may hold unlanded work, and a size-based auto-sweep once nearly deleted
+    // an unlanded correctness fix. Counting it made `mmi-cli doctor` exit 1 until someone swept by hand.
+    reportOnly: true,
     // The fix is a review, never a delete: `gc --root` still refuses anything it cannot classify as dead,
     // and doctor itself — with or without --apply — never touches these directories.
     fix: `${probe.stray.length} worktrees root(s) outside ${probe.authoritative} \u2014 ${named}; no gc scans them. Review, then sweep deliberately from the owning repo with \`mmi-cli worktree gc --root <path> --apply\` (report-only here: doctor never deletes these)${cutShort}`,
@@ -23530,7 +23957,8 @@ function checkClaudePlugin(probe) {
   const { installed, released, guardState } = probe;
   const evidence = [
     `installed: ${installed ?? "(none)"}`,
-    `released:  ${released ?? "(not checked \u2014 offline or --fast)"}`,
+    // #3485 item 7: when the value was reused from the banner's once-a-day cache, say so and say how old.
+    `released:  ${released ?? "(not checked \u2014 offline or --fast)"}${released && probe.releasedNote ? ` ${probe.releasedNote}` : ""}`,
     `resolvable: ${guardState}`
   ];
   const trigger = pluginHealTrigger(probe);
@@ -23552,15 +23980,16 @@ function checkClaudePlugin(probe) {
       verbose: evidence
     };
   }
+  if (!released) return null;
   return { ok: true, label: installed ? `Claude plugin ${installed}` : "Claude plugin", verbose: evidence };
 }
-function checkCliVersion(input) {
+function checkCliVersion(input, releasedNote) {
   const report = buildVersionLagReport(input);
   const evidence = [
     `running:  ${report.currentVersion}`,
-    `published: ${report.releasedVersion ?? "(not checked \u2014 offline or --fast)"}`
+    `published: ${report.releasedVersion ?? "(not checked \u2014 offline or --fast)"}${report.releasedVersion && releasedNote ? ` ${releasedNote}` : ""}`
   ];
-  if (!report.releasedVersion) return { ok: true, label: `mmi-cli ${report.currentVersion}`, verbose: evidence };
+  if (!report.releasedVersion) return null;
   if (report.ok) return { ok: true, label: `mmi-cli ${report.currentVersion}`, verbose: evidence };
   return {
     ok: false,
@@ -23595,6 +24024,12 @@ function checkPluginCache(input) {
   return {
     ok: false,
     label: "plugin cache",
+    // #3485: deliberately NOT `reportOnly`, and not in the closed set docs/doctor-contract.md enumerates.
+    // A checker argued it qualifies because no `doctor --apply` clears it; I tagged it, then reverted.
+    // `mmi-cli plugin prune --apply` clears it in one command and a re-run goes green, so this is an
+    // ordinary red the operator is expected to act on. "The doctor cannot heal it automatically" was never
+    // the bar — see the contract for why report-only is a per-row ruling rather than a rule you can apply
+    // from here.
     // Lead with the versioned-cache framing when there are stale versions; otherwise report the staging litter
     // on its own so a cache with zero versioned dirs still gets an honest ✗.
     detail: input.stale.length ? `${input.cached} versions cached (${parts.join("; ")})` : parts.join("; "),
@@ -23623,10 +24058,14 @@ function checkSchedules(probe) {
     ...probe.incomplete.map((i) => `incomplete: ${i}`),
     ...probe.drift.map((d) => `drift: ${d}`)
   ];
+  const clearableHere = probe.clearableHere ?? 0;
   if (probe.incomplete.length) {
     return {
       ok: false,
       label: "schedules",
+      // #3485: ruled report-only — an unreadable source is a read failure somewhere in the org, and
+      // nothing in this checkout clears it.
+      reportOnly: true,
       detail: `${probe.incomplete.length} source(s) unreadable`,
       fix: "run `mmi-cli org schedules` for the full report \u2014 the notebook may be missing armed entries",
       verbose: evidence
@@ -23636,8 +24075,14 @@ function checkSchedules(probe) {
     return {
       ok: false,
       label: "schedules",
+      // #3485 ruled this row report-only because the drift classes are owned by other repos. #3492 makes
+      // that conditional rather than blanket: when a finding IS clearable from this checkout — a
+      // `file-vs-registry-stale` row for this repo, one `org schedules register` away — the row gates
+      // like any other actionable red. Exempting a fault the operator can fix in one command is the
+      // tolerated-red failure the tier exists to prevent, not an instance of it.
+      ...clearableHere > 0 ? {} : { reportOnly: true },
       detail: `${probe.drift.length} drift finding(s)`,
-      fix: "run `mmi-cli org schedules` \u2014 each drift line names its per-class remedy (file/registry/live mismatch or harbour enforcement), applied in the owning repo",
+      fix: clearableHere > 0 ? `${clearableHere} of ${probe.drift.length} clearable from this repo \u2014 from an up-to-date checkout run \`mmi-cli org schedules register\` here, then \`mmi-cli org schedules\` for the rest (each line names its own per-class remedy, applied in the owning repo)` : "run `mmi-cli org schedules` \u2014 each drift line names its per-class remedy (file/registry/live mismatch or harbour enforcement), applied in the owning repo",
       verbose: evidence
     };
   }
@@ -23652,6 +24097,10 @@ function checkDocsAudit(probe) {
     return {
       ok: false,
       label: "docs-audit",
+      // #3485: ruled report-only — the remedy is re-running or re-arming the janitor in the repo that
+      // owns it. `mmi-cli docs audit record` can write a verdict from here, but hand-writing one to clear
+      // a dead-man check defeats the check (#3067 pillar 4: silence is an alarm, never a success).
+      reportOnly: true,
       fix: `${probe.detail} \u2014 re-run the janitor in the owning repo or re-arm its schedule (the remedy never lives in this doctor)`,
       verbose: [probe.detail]
     };
@@ -23705,12 +24154,15 @@ function gcReapable(plan) {
   return plan.branches.length + plan.trackingRefs.length + plan.worktreeDirs.length;
 }
 async function runDoctorClean(opts, io, deps) {
-  const apply = Boolean(opts.apply);
+  const applyEnv = Boolean(opts.apply) || Boolean(opts.preflight);
+  const applyRepo = Boolean(opts.apply) && opts.repoWrites !== false;
+  const probeReleased = !opts.fast || Boolean(opts.self);
+  const probeAws = !opts.fast && !opts.banner;
   const [login, isOrgRepo, released, callerArn, reach] = await Promise.all([
     deps.githubLogin(),
     deps.isOrgRepo(),
-    opts.fast ? Promise.resolve(void 0) : deps.releasedVersion(),
-    opts.fast ? Promise.resolve(void 0) : deps.awsCallerArn(),
+    probeReleased ? deps.releasedVersion() : Promise.resolve(void 0),
+    probeAws ? deps.awsCallerArn() : Promise.resolve(void 0),
     // #3365. Skipped on the banner/preflight lanes, which run on every SessionStart and must not pay a
     // network round-trip — and on a bare `--fast`, whose contract is offline-safe. It DOES run on
     // `--self`, which rides the fast lane but is the interactive "is my setup actually fine?" diagnostic,
@@ -23725,7 +24177,7 @@ async function runDoctorClean(opts, io, deps) {
   if (!opts.fast && !opts.banner && !opts.preflight && deps.githubPools) {
     checks.push(...checkGithubPools(await deps.githubPools()));
   }
-  const aws = checkAwsIdentity({ isOrgRepo, callerArn });
+  const aws = checkAwsIdentity({ isOrgRepo, probed: probeAws, callerArn });
   if (aws) checks.push(aws);
   checks.push(checkRepoWorktrees({ isOrgRepo, hasRepoLocalWorktrees: deps.hasRepoLocalWorktrees() }));
   if (isOrgRepo) {
@@ -23737,16 +24189,17 @@ async function runDoctorClean(opts, io, deps) {
     ];
     if (gi.ok) {
       checks.push({ ok: true, label: "gitignore block", verbose: giEvidence });
-    } else if (apply && gi.content && deps.writeGitignore(gi.content)) {
+    } else if (applyRepo && gi.content && deps.writeGitignore(gi.content)) {
       checks.push({ ok: true, label: "gitignore block", detail: "rewrote managed block", verbose: giEvidence });
       restartPending = true;
     } else {
       checks.push({ ok: false, label: "gitignore block", fix: "run `mmi-cli doctor --apply` to write the org-managed .gitignore block", verbose: giEvidence });
     }
   }
-  const pluginProbe = { installed, released, guardState: deps.pluginGuardState(isOrgRepo) };
+  const releasedNote = deps.releasedVersionNote?.();
+  const pluginProbe = { installed, released, guardState: deps.pluginGuardState(isOrgRepo), releasedNote };
   const healTrigger = pluginHealTrigger(pluginProbe);
-  if (apply && deps.healPlugin && healTrigger) {
+  if (applyEnv && deps.healPlugin && healTrigger) {
     const heal = await deps.healPlugin();
     const label = healTrigger === "behind" ? `Claude plugin ${installed} \u2192 ${released}` : "Claude plugin \u2014 reinstalled";
     const healEvidence = [
@@ -23763,18 +24216,25 @@ async function runDoctorClean(opts, io, deps) {
     } : {
       ok: false,
       label,
-      fix: `auto-heal failed (${heal.detail}) \u2014 run \`mmi-cli plugin heal\`, then restart Claude`,
+      // #3489: a heal skipped because another doctor holds the env-heal lock is a real ✗ — this run did
+      // not fix what it found — but it is not this invocation's to clear. The other process is doing it;
+      // waiting is the correct response and a re-run finds it healed. A heal that RAN and failed is a
+      // genuine gap and still gates.
+      ...heal.skipped ? { reportOnly: true } : {},
+      fix: heal.skipped ? `${heal.detail} \u2014 another doctor on this machine is healing it now; re-run once it finishes` : `auto-heal failed (${heal.detail}) \u2014 run \`mmi-cli plugin heal\`, then restart Claude`,
       verbose: healEvidence
     });
-    restartPending = true;
+    if (!heal.skipped) restartPending = true;
   } else {
     const plugin = checkClaudePlugin(pluginProbe);
-    checks.push(plugin);
-    if (!plugin.ok) restartPending = true;
+    if (plugin) {
+      checks.push(plugin);
+      if (!plugin.ok) restartPending = true;
+    }
   }
   const cliInput = { currentVersion: deps.currentCliVersion(), releasedVersion: released };
   const cliReport = buildVersionLagReport(cliInput);
-  if (apply && deps.updateCli && versionAutoUpdateAction(cliReport) === "npm") {
+  if (applyEnv && deps.updateCli && versionAutoUpdateAction(cliReport) === "npm") {
     const heal = await deps.updateCli(cliReport.releasedVersion);
     const healEvidence = [`running:  ${cliReport.currentVersion}`, `published: ${cliReport.releasedVersion}`, `heal: ${heal.detail}`];
     checks.push(heal.ok ? {
@@ -23785,17 +24245,48 @@ async function runDoctorClean(opts, io, deps) {
     } : {
       ok: false,
       label: `mmi-cli ${cliReport.currentVersion} \u2192 ${cliReport.releasedVersion}`,
-      fix: `self-update failed (${heal.detail}) \u2014 run \`${cliUpdateCommand(cliReport.releasedVersion)}\``,
+      // #3489: same split as the plugin heal above — a lock-contention skip is not this run's gap.
+      ...heal.skipped ? { reportOnly: true } : {},
+      fix: heal.skipped ? `${heal.detail} \u2014 another doctor on this machine is updating it now; re-run once it finishes` : `self-update failed (${heal.detail}) \u2014 run \`${cliUpdateCommand(cliReport.releasedVersion)}\``,
       verbose: healEvidence
     });
   } else {
-    checks.push(checkCliVersion(cliInput));
+    const cli = checkCliVersion(cliInput, releasedNote);
+    if (cli) checks.push(cli);
+  }
+  const cacheProbe = deps.pluginCache();
+  const cacheStale = cacheProbe.stale.length > 0 || cacheProbe.staging.length > 0;
+  if (applyEnv && deps.prunePluginCache && cacheStale) {
+    const pruned = await deps.prunePluginCache();
+    const removed = pruned.removed ?? [];
+    const pruneEvidence = [
+      `cached versions: ${cacheProbe.cached}`,
+      `stale: ${cacheProbe.stale.length ? cacheProbe.stale.join(", ") : "(none)"}`,
+      `orphaned staging dirs: ${cacheProbe.staging.length ? cacheProbe.staging.join(", ") : "(none)"}`,
+      `prune: ${pruned.detail}`,
+      ...removed.map((r) => `removed: ${r}`)
+    ];
+    checks.push(pruned.ok ? {
+      ok: true,
+      label: "plugin cache",
+      detail: removed.length ? `pruned ${removed.length} stale entr${removed.length === 1 ? "y" : "ies"}` : "nothing to prune",
+      verbose: pruneEvidence
+    } : {
+      ok: false,
+      label: "plugin cache",
+      // Same split as the other env heals (#3489): a contention skip is not this run's gap.
+      ...pruned.skipped ? { reportOnly: true } : {},
+      fix: pruned.skipped ? `${pruned.detail} \u2014 another doctor on this machine is pruning it now; re-run once it finishes` : `prune failed (${pruned.detail}) \u2014 run \`mmi-cli plugin prune --apply\``,
+      verbose: pruneEvidence
+    });
+  } else {
+    checks.push(checkPluginCache(cacheProbe));
   }
-  checks.push(checkPluginCache(deps.pluginCache()));
   if (deps.sessionPayload) {
     const payload = checkSessionPayload(deps.sessionPayload());
     if (payload) checks.push(payload);
   }
+  if (deps.marketplaceRows) checks.push(...deps.marketplaceRows());
   if (!opts.fast && !opts.banner && !opts.preflight) {
     const probe = await deps.schedulesNotebook().catch((e) => ({
       armed: 0,
@@ -23821,7 +24312,7 @@ async function runDoctorClean(opts, io, deps) {
     const roots = checkWorktreeRoots(probe);
     if (roots) checks.push(roots);
   }
-  if (isOrgRepo && !opts.fast && !opts.banner) {
+  if (isOrgRepo && !opts.fast && !opts.banner && !opts.preflight) {
     try {
       checks.push(checkTrainSync(await deps.syncTrain()));
     } catch (e) {
@@ -23836,7 +24327,7 @@ async function runDoctorClean(opts, io, deps) {
     const repoRoot2 = await deps.repoRoot();
     try {
       const plan = await deps.gcPlan("origin", 200);
-      if (apply) {
+      if (applyRepo) {
         const r = await deps.applyGcPlan(plan, "origin");
         const reaped = r.removedBranches.length + r.removedRemoteBranches.length + r.removedWorktreeDirs.length + r.removedTrackingRefs.length;
         const detailParts = [];
@@ -23876,7 +24367,7 @@ async function runDoctorClean(opts, io, deps) {
     }
     const scratch = deps.executeScratchGc(repoRoot2, { apply: false });
     const scratchEvidence = scratch.plan.safeAuto.length ? scratch.plan.safeAuto.map((c) => `aged: ${c.path} (${c.reason})`) : ["nothing aged"];
-    if (apply && scratch.plan.safeAuto.length > 0) {
+    if (applyRepo && scratch.plan.safeAuto.length > 0) {
       const applied = deps.executeScratchGc(repoRoot2, { apply: true });
       const pruned = applied.applied?.pruned.length ?? 0;
       checks.push({ ok: true, label: "scratch", detail: pruned ? `removed ${pruned} aged item(s)` : "nothing stale", verbose: scratchEvidence });
@@ -23923,17 +24414,17 @@ function parseOriginRepo(remoteUrl) {
 }
 function ghHostsConfigPath(env, platform2) {
   const sep2 = platform2 === "win32" ? "\\" : "/";
-  const join24 = (...parts) => parts.join(sep2);
+  const join26 = (...parts) => parts.join(sep2);
   const explicit = env.GH_CONFIG_DIR?.trim();
-  if (explicit) return join24(explicit, "hosts.yml");
+  if (explicit) return join26(explicit, "hosts.yml");
   if (platform2 === "win32") {
     const appData = (env.AppData ?? env.APPDATA)?.trim();
-    return appData ? join24(appData, "GitHub CLI", "hosts.yml") : void 0;
+    return appData ? join26(appData, "GitHub CLI", "hosts.yml") : void 0;
   }
   const xdg = env.XDG_CONFIG_HOME?.trim();
-  if (xdg) return join24(xdg, "gh", "hosts.yml");
+  if (xdg) return join26(xdg, "gh", "hosts.yml");
   const home = env.HOME?.trim();
-  return home ? join24(home, ".config", "gh", "hosts.yml") : void 0;
+  return home ? join26(home, ".config", "gh", "hosts.yml") : void 0;
 }
 function parseGhHostsAccounts(yaml, host = "github.com") {
   let hostIndent = null;
@@ -23983,9 +24474,9 @@ function ghAccountCaveat(announcedLogin, accounts) {
 }
 
 // src/doctor-io.ts
-var import_node_fs29 = require("node:fs");
-var import_node_os7 = require("node:os");
-var import_node_path26 = require("node:path");
+var import_node_fs31 = require("node:fs");
+var import_node_os8 = require("node:os");
+var import_node_path29 = require("node:path");
 var import_node_child_process12 = require("node:child_process");
 var import_node_util8 = require("node:util");
 var execFileP6 = (0, import_node_util8.promisify)(import_node_child_process12.execFile);
@@ -23993,7 +24484,7 @@ var MMI_PLUGIN_ID2 = "mmi@mutmutco";
 function installedClaudePluginVersion() {
   try {
     const file = JSON.parse(
-      (0, import_node_fs29.readFileSync)((0, import_node_path26.join)((0, import_node_os7.homedir)(), ".claude", "plugins", "installed_plugins.json"), "utf8")
+      (0, import_node_fs31.readFileSync)((0, import_node_path29.join)((0, import_node_os8.homedir)(), ".claude", "plugins", "installed_plugins.json"), "utf8")
     );
     const versions = (file.plugins?.[MMI_PLUGIN_ID2] ?? []).map((r) => r.version).filter((v) => Boolean(v));
     if (versions.length === 0) return void 0;
@@ -24014,13 +24505,13 @@ function worktreeRootSync() {
 }
 var gitignorePath = () => {
   const root = worktreeRootSync();
-  return root === null ? null : (0, import_node_path26.join)(root, ".gitignore");
+  return root === null ? null : (0, import_node_path29.join)(root, ".gitignore");
 };
 function readGitignore() {
   const path2 = gitignorePath();
   if (path2 === null) return null;
   try {
-    return (0, import_node_fs29.readFileSync)(path2, "utf8");
+    return (0, import_node_fs31.readFileSync)(path2, "utf8");
   } catch {
     return null;
   }
@@ -24029,7 +24520,7 @@ function writeGitignore(content) {
   const path2 = gitignorePath();
   if (path2 === null) return false;
   try {
-    (0, import_node_fs29.writeFileSync)(path2, content, "utf8");
+    (0, import_node_fs31.writeFileSync)(path2, content, "utf8");
     return true;
   } catch {
     return false;
@@ -24053,7 +24544,7 @@ async function repoRoot() {
 }
 function hasRepoLocalWorktrees() {
   const root = worktreeRootSync();
-  return root !== null && (0, import_node_fs29.existsSync)((0, import_node_path26.join)(root, ".worktrees"));
+  return root !== null && (0, import_node_fs31.existsSync)((0, import_node_path29.join)(root, ".worktrees"));
 }
 
 // src/index.ts
@@ -24088,13 +24579,61 @@ ${r.stderr ?? ""}`).catch(() => "");
 function ghMultiAccountCaveat(announcedLogin) {
   try {
     const hostsPath = ghHostsConfigPath(process.env, process.platform);
-    if (!hostsPath || !(0, import_node_fs30.existsSync)(hostsPath)) return void 0;
-    return ghAccountCaveat(announcedLogin, parseGhHostsAccounts((0, import_node_fs30.readFileSync)(hostsPath, "utf8")));
+    if (!hostsPath || !(0, import_node_fs32.existsSync)(hostsPath)) return void 0;
+    return ghAccountCaveat(announcedLogin, parseGhHostsAccounts((0, import_node_fs32.readFileSync)(hostsPath, "utf8")));
   } catch {
     return void 0;
   }
 }
-function mmiDoctorDeps() {
+var ENV_HEAL_LOCK_STALE_MS = 10 * 6e4;
+var ENV_HEAL_LOCK_MAX_WAIT_MS = 2 * 6e4;
+function envHealLockPath(home) {
+  return (0, import_node_path30.join)(home, ".claude", "plugins", ".mmi-env-heal.lock");
+}
+async function withEnvHealLock(what, run) {
+  try {
+    return await withFileLock(
+      envHealLockPath((0, import_node_os9.homedir)()),
+      { staleMs: ENV_HEAL_LOCK_STALE_MS, maxWaitMs: ENV_HEAL_LOCK_MAX_WAIT_MS, label: "mmi env-heal lock" },
+      run
+    );
+  } catch (e) {
+    if (e instanceof FileLockBusyError) {
+      return { ok: false, skipped: true, detail: `${what} skipped \u2014 ${e.message}` };
+    }
+    return { ok: false, detail: `${what} could not take the env-heal lock \u2014 ${e.message}` };
+  }
+}
+function docsJanitorScheduleId(repo) {
+  return `${repo.split("/").pop()}/docs-janitor`;
+}
+function throttledReleasedVersion() {
+  let note;
+  return {
+    note: () => note,
+    read: async () => {
+      const cachePath = releasedVersionCachePath(repoRuntimeStatePath(process.cwd()));
+      const cached = readReleasedVersionCache(cachePath);
+      if (cached) {
+        note = cachedReadNote(cached.at);
+        return cached.version;
+      }
+      const live = await fetchNpmReleasedVersion();
+      if (live) writeReleasedVersionCache(cachePath, live);
+      note = void 0;
+      return live;
+    }
+  };
+}
+function mmiDoctorDeps(opts = {}) {
+  const throttled = opts.throttleReleasedRead ? throttledReleasedVersion() : void 0;
+  let notebook;
+  const notebookOnce = () => notebook ??= fetchNotebook();
+  const docsJanitorArmedAt = async (repo) => {
+    const wanted = docsJanitorScheduleId(repo);
+    const { entries } = await notebookOnce();
+    return entries.find((e) => e.scheduleId === wanted)?.armedAt;
+  };
   return {
     githubLogin,
     ghInstalled,
@@ -24103,12 +24642,17 @@ function mmiDoctorDeps() {
     isOrgRepo: () => isOrgRepoRoot(),
     installedPluginVersion: installedClaudePluginVersion,
     pluginGuardState: claudePluginGuardState,
-    releasedVersion: fetchNpmReleasedVersion,
+    releasedVersion: throttled ? throttled.read : fetchNpmReleasedVersion,
+    releasedVersionNote: throttled ? throttled.note : void 0,
     // #3272: the --apply self-heal for a stale running CLI — npm global, shadows any plugin shim (#2879).
-    updateCli: npmSelfUpdateCli,
+    // #3489: serialised. Both heals mutate machine-global state (the npm global prefix; the Claude
+    // marketplace clone + plugin cache) and neither is idempotent under concurrency. They share ONE lock
+    // rather than one each, because they are not independent: the plugin heal reinstalls a bundle that
+    // carries a CLI shim, so a concurrent npm global install races the same PATH surface.
+    updateCli: (target) => withEnvHealLock("npm global CLI self-update", () => npmSelfUpdateCli(target)),
     // #3282: the --apply self-heal for a stale/unresolved Claude plugin — the same marketplace reinstall
     // `mmi-cli plugin heal` drives. Takes effect on the next Claude reload, so the row asks for a restart.
-    healPlugin: () => healClaudePluginForDoctor(),
+    healPlugin: () => withEnvHealLock("Claude plugin reinstall", () => healClaudePluginForDoctor()),
     currentCliVersion: resolveClientVersion,
     readGitignore,
     writeGitignore,
@@ -24144,9 +24688,9 @@ function mmiDoctorDeps() {
     },
     pluginCache: () => {
       const plan = buildPluginCachePlan(
-        (0, import_node_os8.homedir)(),
+        (0, import_node_os9.homedir)(),
         runningPluginVersion(process.env, resolveClientVersion()),
-        pluginCacheFsDeps((0, import_node_os8.homedir)(), () => 0)
+        pluginCacheFsDeps((0, import_node_os9.homedir)(), () => 0)
       );
       return {
         stale: plan.prune,
@@ -24156,16 +24700,45 @@ function mmiDoctorDeps() {
         stagingBytes: plan.stagingBytes
       };
     },
+    // #3485 wave 2 item 11: the --apply reap, through the SAME plan + reaper `plugin prune --apply` drives.
+    // The plan's own keep-policy refuses the running and newest versions, so this cannot delete what is
+    // loaded. Under the #3489 env-heal lock: deleting cache dirs while another doctor is mid-reinstall is
+    // the same machine-global hazard the lock exists for.
+    prunePluginCache: () => withEnvHealLock("plugin cache prune", async () => {
+      const plan = buildPluginCachePlan(
+        (0, import_node_os9.homedir)(),
+        runningPluginVersion(process.env, resolveClientVersion()),
+        pluginCacheFsDeps((0, import_node_os9.homedir)(), directoryBytes),
+        { withBytes: true }
+      );
+      const result = applyPluginCachePlan(
+        plan,
+        (p) => (0, import_node_fs32.rmSync)(p, { recursive: true, force: true }),
+        stagingApplyFsGuard((0, import_node_os9.homedir)())
+      );
+      const removed = [...result.removed, ...result.removedStaging ?? []];
+      if (result.failed.length) {
+        return {
+          ok: false,
+          removed,
+          detail: `${removed.length} removed, ${result.failed.length} failed \u2014 ${result.failed.map((f) => `${f.version}: ${f.error}`).join("; ")}`
+        };
+      }
+      return { ok: true, removed, detail: removed.length ? `removed ${removed.join(", ")}` : "nothing to prune" };
+    }),
     // #3008: the schedules-notebook drift probe, compacted for the check. Full doctor only — the gather in
     // runDoctorClean skips this dep entirely on fast/banner/preflight runs.
     schedulesNotebook: async () => {
-      const { entries, incomplete, drift } = await fetchNotebook();
+      const { entries, incomplete, drift, reconciliation } = await notebookOnce();
+      const repoName = await repoSlug().catch(() => "");
+      const clearableHere = repoName ? reconciliation.filter((d) => driftClearableFrom(d, repoName)).length : 0;
       return {
         armed: entries.length,
         live: entries.filter((e) => e.resolved === "live").length,
         declared: entries.filter((e) => e.resolved === "declared").length,
         incomplete,
-        drift
+        drift,
+        clearableHere
       };
     },
     // #3075: the docs-audit dead-man verdict probe, compacted for the check. Full doctor only, exactly like
@@ -24174,7 +24747,8 @@ function mmiDoctorDeps() {
     docsAudit: async () => {
       const repo = await currentRepoFullName();
       const today = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
-      const status = docsAuditStatus(await readDocsAuditFetch(repo), { repo, today });
+      const armedAt = await docsJanitorArmedAt(repo).catch(() => void 0);
+      const status = docsAuditStatus(await readDocsAuditFetch(repo), { repo, today, armedAt });
       return { armed: status.state !== "not-armed", ok: status.ok, detail: status.line };
     },
     // #3471: the competing-worktrees-roots probe. Full doctor only (the gather skips it on
@@ -24183,7 +24757,21 @@ function mmiDoctorDeps() {
     worktreeRoots: async () => worktreeRootsProbe(await repoRoot()),
     // #3470: what the SessionStart hook LAST emitted, measured at emission by the session-start verb below.
     // A local record read — cheap enough for every lane, including the banner.
-    sessionPayload: () => readSessionPayload(process.cwd())
+    sessionPayload: () => readSessionPayload(process.cwd()),
+    // #3485 items 9 and 8: why the MMI plugin has never printed an "updated — please restart" notice, and
+    // which branch it would pick one up from. Two local file reads, no network, fail-soft to no rows.
+    marketplaceRows: () => {
+      try {
+        const home = (0, import_node_os9.homedir)();
+        return marketplaceRows(
+          MMI_MARKETPLACE_NAME,
+          readFileSyncSafe((0, import_node_path30.join)(home, ...KNOWN_MARKETPLACES_RELATIVE), import_node_fs32.readFileSync),
+          readFileSyncSafe((0, import_node_path30.join)(home, ".claude", "settings.json"), import_node_fs32.readFileSync)
+        );
+      } catch {
+        return [];
+      }
+    }
   };
 }
 async function requireFreshTrainCli(commandName) {
@@ -24308,19 +24896,19 @@ program2.hook("preAction", async (_thisCommand, actionCommand) => {
 });
 var rules = program2.command("rules").description("org-managed .gitignore delivery");
 rules.command("gitignore").option("--write", "upsert the managed block into .gitignore (default: check only, non-zero exit on drift)").option("--json", "machine-readable output").description("verify (or --write) this repo's org-managed .gitignore block matches the SSOT").action((opts) => {
-  const path2 = (0, import_node_path27.join)(process.cwd(), ".gitignore");
-  const current = (0, import_node_fs30.existsSync)(path2) ? (0, import_node_fs30.readFileSync)(path2, "utf8") : null;
+  const path2 = (0, import_node_path30.join)(process.cwd(), ".gitignore");
+  const current = (0, import_node_fs32.existsSync)(path2) ? (0, import_node_fs32.readFileSync)(path2, "utf8") : null;
   const plan = planManagedGitignore(current);
   const drift = [...plan.added.map((l) => `+${l}`), ...plan.removed.map((l) => `-${l}`)].join(", ") || "block normalize";
   if (opts.json) {
-    if (opts.write && plan.changed) (0, import_node_fs30.writeFileSync)(path2, plan.content, "utf8");
+    if (opts.write && plan.changed) (0, import_node_fs32.writeFileSync)(path2, plan.content, "utf8");
     console.log(JSON.stringify(plan, null, 2));
     if (!opts.write && plan.changed) process.exitCode = 1;
     return;
   }
   if (opts.write) {
     if (plan.changed) {
-      (0, import_node_fs30.writeFileSync)(path2, plan.content, "utf8");
+      (0, import_node_fs32.writeFileSync)(path2, plan.content, "utf8");
       console.log(`mmi-cli org rules gitignore: updated .gitignore (${drift})`);
     } else {
       console.log("mmi-cli org rules gitignore: up to date");
@@ -24446,8 +25034,8 @@ gcCmd.option("--dry-run", "show what would be deleted (default)").option("--appl
   if (!Number.isFinite(limit) || limit < 1) return fail("worktree gc: --limit must be a positive integer");
   let root;
   if (o.root !== void 0) {
-    root = (0, import_node_path27.resolve)(o.root);
-    if (!(0, import_node_fs30.existsSync)(root) || !(0, import_node_fs30.statSync)(root).isDirectory()) return fail(`worktree gc: --root ${o.root} is not a directory`);
+    root = (0, import_node_path30.resolve)(o.root);
+    if (!(0, import_node_fs32.existsSync)(root) || !(0, import_node_fs32.statSync)(root).isDirectory()) return fail(`worktree gc: --root ${o.root} is not a directory`);
     const gcRepoRoot = (await execFileP2("git", ["rev-parse", "--show-toplevel"], { timeout: GIT_TIMEOUT_MS }).catch(() => ({ stdout: "" }))).stdout.trim() || process.cwd();
     if (isPathUnderDirectory(gcRepoRoot, root)) {
       return fail(`worktree gc: --root ${root} contains this checkout \u2014 name a worktrees root, not the repo or an ancestor of it`);
@@ -24521,26 +25109,26 @@ function makeProvisionDeps(worktreeRoot, quiet, log) {
 function acquireWorktreeSetupLock(worktreeRoot) {
   const lockPath = repoRuntimeStatePath(worktreeRoot, "worktree-setup.lock");
   const take = () => {
-    const fd = (0, import_node_fs30.openSync)(lockPath, "wx");
+    const fd = (0, import_node_fs32.openSync)(lockPath, "wx");
     try {
-      (0, import_node_fs30.writeSync)(fd, String(Date.now()));
+      (0, import_node_fs32.writeSync)(fd, String(Date.now()));
     } finally {
-      (0, import_node_fs30.closeSync)(fd);
+      (0, import_node_fs32.closeSync)(fd);
     }
     return () => {
       try {
-        (0, import_node_fs30.rmSync)(lockPath, { force: true });
+        (0, import_node_fs32.rmSync)(lockPath, { force: true });
       } catch {
       }
     };
   };
   try {
-    (0, import_node_fs30.mkdirSync)((0, import_node_path27.dirname)(lockPath), { recursive: true });
+    (0, import_node_fs32.mkdirSync)((0, import_node_path30.dirname)(lockPath), { recursive: true });
     return take();
   } catch {
     try {
-      if (Date.now() - (0, import_node_fs30.statSync)(lockPath).mtimeMs > WORKTREE_SETUP_LOCK_TTL_MS) {
-        (0, import_node_fs30.rmSync)(lockPath, { force: true });
+      if (Date.now() - (0, import_node_fs32.statSync)(lockPath).mtimeMs > WORKTREE_SETUP_LOCK_TTL_MS) {
+        (0, import_node_fs32.rmSync)(lockPath, { force: true });
         return take();
       }
     } catch {
@@ -24982,7 +25570,7 @@ project.command("set [owner/repo]").description("upsert project META (idempotent
   if (dupe) return fail(`org project set: KEY "${dupe}" was passed to both --var and --set; --set is an alias of --var, so pass each KEY once`);
   if (o.secretsFile) {
     try {
-      vars.push(`secrets=${(0, import_node_fs30.readFileSync)(o.secretsFile, "utf8")}`);
+      vars.push(`secrets=${(0, import_node_fs32.readFileSync)(o.secretsFile, "utf8")}`);
     } catch (e) {
       return fail(`org project set: cannot read --secrets-file ${o.secretsFile}: ${e.message}`);
     }
@@ -25098,8 +25686,8 @@ project.command("set-deploy [owner/repo]").description("patch a tenant DEPLOY ro
     const branch = DEPLOY_STAGE_BRANCH[o.stage.trim().toLowerCase()];
     if (branch) {
       const cwdRepo = repoFromRemoteUrl(await gitOut(["remote", "get-url", "origin"]).catch(() => ""));
-      const sameRepo = !repoOrSlug || Boolean(cwdRepo) && (repoOrSlug.includes("/") ? cwdRepo.toLowerCase() === target.toLowerCase() : slugOf(cwdRepo) === slugOf(target));
-      if (sameRepo) {
+      const sameRepo2 = !repoOrSlug || Boolean(cwdRepo) && (repoOrSlug.includes("/") ? cwdRepo.toLowerCase() === target.toLowerCase() : slugOf(cwdRepo) === slugOf(target));
+      if (sameRepo2) {
         const verdict = evaluateFilelessComposeGuard({ composeText: await readStageBranchCompose(branch), branch, force: Boolean(o.force), noEnvFile });
         if (!verdict.ok) return fail(`org project set-deploy: ${verdict.reason}
 ${filelessTransitionGuide(target, o.stage)}`);
@@ -25296,8 +25884,8 @@ withExamples(mutating(
   let targetRepo2;
   try {
     issueType = resolveCreateType(o.type, "issue create", o.label);
-    title = await resolveIssueTitle({ title: o.title, titleFile: o.titleFile }, { readFile: import_promises7.readFile, readStdin });
-    body = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises7.readFile, readStdin });
+    title = await resolveIssueTitle({ title: o.title, titleFile: o.titleFile }, { readFile: import_promises8.readFile, readStdin });
+    body = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises8.readFile, readStdin });
     if (o.idempotencyKey) body = appendIdempotencyMarker(body, o.idempotencyKey);
     priority = resolveCreatePriority(o.priority, "issue create");
     extraLabels = [...o.label ?? []];
@@ -25440,7 +26028,7 @@ jsonParity(issue.command("comment <ref>").description("post a Markdown comment t
   }
   let body;
   try {
-    body = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises7.readFile, readStdin });
+    body = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises8.readFile, readStdin });
   } catch (e) {
     return fail(`issue comment: ${e.message}`);
   }
@@ -25500,8 +26088,8 @@ program2.command("report").description("file a friction report on the Hub board
   let title;
   const sourceRepo = o.repo ?? await resolveRepo(void 0);
   try {
-    title = await resolveIssueTitle({ title: o.title, titleFile: o.titleFile }, { readFile: import_promises7.readFile, readStdin });
-    body = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises7.readFile, readStdin });
+    title = await resolveIssueTitle({ title: o.title, titleFile: o.titleFile }, { readFile: import_promises8.readFile, readStdin });
+    body = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises8.readFile, readStdin });
     priority = resolveCreatePriority(o.priority, "report");
     if (!ISSUE_TYPES.includes(o.type)) {
       throw new Error(`unknown issue type "${o.type}" \u2014 expected one of: ${ISSUE_TYPES.join(", ")}`);
@@ -25550,8 +26138,8 @@ program2.command("skill-lesson").description("file a skill-lesson on the Hub boa
   let args;
   try {
     skill = assertSkillName(o.skill);
-    rawBody = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises7.readFile, readStdin });
-    const rawTitle = await resolveIssueTitle({ title: o.title, titleFile: o.titleFile }, { readFile: import_promises7.readFile, readStdin });
+    rawBody = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises8.readFile, readStdin });
+    const rawTitle = await resolveIssueTitle({ title: o.title, titleFile: o.titleFile }, { readFile: import_promises8.readFile, readStdin });
     title = buildSkillLessonTitle(skill, rawTitle);
     priority = resolveCreatePriority(o.priority, "skill-lesson");
     body = buildSkillLessonBody(rawBody, sourceRepo, pluginSha);
@@ -25602,8 +26190,8 @@ withExamples(pr.command("create").description("create a PR and print {number,url
   let body;
   let title;
   try {
-    title = await resolveIssueTitle({ title: o.title, titleFile: o.titleFile }, { readFile: import_promises7.readFile, readStdin });
-    body = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises7.readFile, readStdin });
+    title = await resolveIssueTitle({ title: o.title, titleFile: o.titleFile }, { readFile: import_promises8.readFile, readStdin });
+    body = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises8.readFile, readStdin });
   } catch (e) {
     return fail(`pr create: ${e.message}`, e instanceof TextArgError ? { code: e.code, offending_flag: e.offendingFlag } : void 0);
   }
@@ -25638,11 +26226,11 @@ pr.command("view <number>").description("read a PR as structured JSON (merged st
   }
 });
 async function listCiWorkflowPaths(cwd = process.cwd()) {
-  const wfDir = (0, import_node_path27.join)(cwd, ".github", "workflows");
-  if (!(0, import_node_fs30.existsSync)(wfDir)) return [];
-  return (0, import_node_fs30.readdirSync)(wfDir).filter((name) => /\.(ya?ml)$/i.test(name)).filter((name) => {
+  const wfDir = (0, import_node_path30.join)(cwd, ".github", "workflows");
+  if (!(0, import_node_fs32.existsSync)(wfDir)) return [];
+  return (0, import_node_fs32.readdirSync)(wfDir).filter((name) => /\.(ya?ml)$/i.test(name)).filter((name) => {
     try {
-      return workflowReportsPrChecks((0, import_node_fs30.readFileSync)((0, import_node_path27.join)(wfDir, name), "utf8"));
+      return workflowReportsPrChecks((0, import_node_fs32.readFileSync)((0, import_node_path30.join)(wfDir, name), "utf8"));
     } catch {
       return true;
     }
@@ -25669,16 +26257,16 @@ function ciAuditDeps() {
     // gate re-seed step is skipped gracefully rather than failing mid-run.
     readSeedFile: (path2) => {
       if (!root) return null;
-      const fullPath = (0, import_node_path27.join)(root, path2);
-      return (0, import_node_fs30.existsSync)(fullPath) ? (0, import_node_fs30.readFileSync)(fullPath, "utf8") : null;
+      const fullPath = (0, import_node_path30.join)(root, path2);
+      return (0, import_node_fs32.existsSync)(fullPath) ? (0, import_node_fs32.readFileSync)(fullPath, "utf8") : null;
     }
   };
 }
 function hubRoot() {
-  const fromPkg = (0, import_node_path27.join)(__dirname, "..", "..");
+  const fromPkg = (0, import_node_path30.join)(__dirname, "..", "..");
   const marker = "skills/bootstrap/seeds/manifest.json";
-  if ((0, import_node_fs30.existsSync)((0, import_node_path27.join)(fromPkg, marker))) return fromPkg;
-  if ((0, import_node_fs30.existsSync)((0, import_node_path27.join)(process.cwd(), marker))) return process.cwd();
+  if ((0, import_node_fs32.existsSync)((0, import_node_path30.join)(fromPkg, marker))) return fromPkg;
+  if ((0, import_node_fs32.existsSync)((0, import_node_path30.join)(process.cwd(), marker))) return process.cwd();
   return null;
 }
 pr.command("ci-policy").description("report merge CI policy: wait-for-checks vs no-ci (for grind/build agents)").option("--json", "machine-readable output").option("--repo <owner/repo>", "target repo (defaults to the current checkout)").action(async (o) => {
@@ -25928,7 +26516,7 @@ jsonParity(pr.command("merge <number>").description("merge a PR (squash by defau
     localCleanup = await cleanupPrMergeLocalBranch(headRef, {
       beforeWorktrees,
       startingPath,
-      pathExists: (p) => (0, import_node_fs30.existsSync)(p),
+      pathExists: (p) => (0, import_node_fs32.existsSync)(p),
       execGit: async (args) => (await execFileP2("git", args, { timeout: GIT_TIMEOUT_MS })).stdout,
       teardownWorktreeStage,
       deferredStore,
@@ -26038,8 +26626,8 @@ function trainApplyDeps() {
     // Slack release announcement (#883): Hub-only + best-effort inside announceRelease itself.
     announce: (args) => announceRelease({
       run: async (file, cmdArgs) => (await execFileP2(file, cmdArgs, { timeout: GH_TRAIN_TIMEOUT_MS })).stdout,
-      readFile: (path2) => (0, import_promises7.readFile)(path2, "utf8"),
-      removeFile: (path2) => (0, import_promises7.unlink)(path2)
+      readFile: (path2) => (0, import_promises8.readFile)(path2, "utf8"),
+      removeFile: (path2) => (0, import_promises8.unlink)(path2)
     }, args),
     fetchEdgeDomains: async (slug) => {
       const proj = await fetchProjectBySlug(slug, registryClientDeps(await loadConfig()));
@@ -26269,10 +26857,10 @@ access.command("audit").description("audit collaborator roles + train-branch pus
     targets = resolution.targets;
   }
   const derivedMatrix = registryProjects ? accessMatrixFromProjects(registryProjects) : {};
-  const fileMatrix = (0, import_node_fs30.existsSync)("access-matrix.json") ? loadAccessMatrix((0, import_node_fs30.readFileSync)("access-matrix.json", "utf8")) : {};
+  const fileMatrix = (0, import_node_fs32.existsSync)("access-matrix.json") ? loadAccessMatrix((0, import_node_fs32.readFileSync)("access-matrix.json", "utf8")) : {};
   const matrix = mergeAccessMatrix(fileMatrix, derivedMatrix);
   const derivedContracts = registryProjects ? dataAccessContractsFromProjects(registryProjects) : { consumers: {} };
-  const fileContracts = (0, import_node_fs30.existsSync)("data-access-contracts.json") ? loadDataAccessContracts((0, import_node_fs30.readFileSync)("data-access-contracts.json", "utf8")) : { consumers: {} };
+  const fileContracts = (0, import_node_fs32.existsSync)("data-access-contracts.json") ? loadDataAccessContracts((0, import_node_fs32.readFileSync)("data-access-contracts.json", "utf8")) : { consumers: {} };
   const dataAccess = mergeDataAccessContracts(fileContracts, derivedContracts);
   const report = await auditOrgAccess(targets, deps, matrix, dataAccess);
   console.log(o.json ? JSON.stringify(report, null, 2) : renderAccessReport(report));
@@ -26280,15 +26868,15 @@ access.command("audit").description("audit collaborator roles + train-branch pus
 });
 access.command("capabilities").description("enumerate your effective vault reach \u2014 every credential NAME + tier + scope you can read/use across project + org/master tiers (names only, no values) (#1615)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--json", "machine-readable output").action((o) => withSecrets((d) => secretsCapabilities(d, o)));
 var isWin2 = process.platform === "win32";
-program2.command("doctor").description("check onboarding gates and auto-heal CLI/plugin wiring; use --verbose for the full audit checklist").option("--banner", "one-line resume summary; silent when all gates pass").option("--fast", "offline-safe fast lane; skips slow checks and network probes").option("--preflight", "eager version/plugin-heal with upfront notice when stale; silent when healthy (#1871)").option("--verbose", "print the evidence behind every check \u2014 probes, resolved paths, versions compared, and the names behind each count (#2977)").option("--ci", "stable CI output contract; no color, exit 0 for clear/advisory-only, 1 for hard gaps, 2 for doctor/tool failure").option("--guide", "print the MMI Agentic Onboarding guide URL").option("--json", "machine-readable output (read-only inspection \u2014 performs no repairs)").option("--apply", "perform the same auto-repairs as the interactive run (combine with --json for a machine-readable repair run)").option("--no-repo-writes", "env/plugin repairs only \u2014 never mutate the repo working tree; report pending managed .gitignore repairs with the follow-up command (for train preflights)").option("--self", "verify CLI/plugin version parity, PATH, gh auth scopes, and hook wiring (offline-safe; suggests plugin-heal on a hard gap) (#2689)").addHelpText("after", "\nExit codes:\n  0  no hard gaps remain; advisory gaps may exist\n  1  one or more included hard checks failed\n  2  doctor/tool execution failed before a normal verdict\n\n--banner keeps the legacy SessionStart contract and returns 0 unless the process crashes.\n").action(async (opts) => {
+program2.command("doctor").description("check onboarding gates and auto-heal CLI/plugin wiring; use --verbose for the full audit checklist").option("--banner", "one-line resume summary; silent when all gates pass").option("--fast", "offline-safe fast lane; skips slow checks and network probes").option("--preflight", "eager version/plugin-heal (env repairs only \u2014 never the repo working tree) with upfront notice when stale; silent when healthy (#1871)").option("--verbose", "print the evidence behind every check \u2014 probes, resolved paths, versions compared, and the names behind each count (#2977)").option("--guide", "print the MMI Agentic Onboarding guide URL").option("--json", "machine-readable output (read-only inspection \u2014 performs no repairs)").option("--apply", "perform the same auto-repairs as the interactive run (combine with --json for a machine-readable repair run)").option("--no-repo-writes", "env/plugin repairs only \u2014 never mutate the repo working tree; report pending managed .gitignore repairs with the follow-up command (for train preflights)").option("--self", "verify CLI/plugin version parity and gh auth reach; suggests plugin-heal on a hard gap (reads the published version, so not offline-safe) (#2689)").addHelpText("after", "\nExit codes:\n  0  no hard gaps remain; advisory gaps may exist\n  1  one or more included hard checks failed\n\nThree rows (worktree roots, schedules, docs-audit) are report-only: they still print \u2717 with their fix,\nbut never move the exit code, because their remedy is a deliberate human review or lives in the repo\nthat owns the fault. Every other red row gates, including ones only you can clear by hand (#3485).\n\n--banner keeps the legacy SessionStart contract and returns 0 unless the process crashes.\n").action(async (opts) => {
   if (opts.guide) {
     consoleIo.log("MMI Agentic Onboarding: docs/Architecture/agentic-dev-environment.md");
     return;
   }
-  const noRepoWrites = opts.repoWrites === false;
   process.exitCode = await runDoctorClean(
     {
-      apply: Boolean(opts.apply) && !noRepoWrites,
+      apply: Boolean(opts.apply),
+      repoWrites: opts.repoWrites,
       banner: opts.banner,
       preflight: opts.preflight,
       fast: opts.fast || opts.self,
@@ -26306,16 +26894,16 @@ function directoryBytes(path2) {
   let total = 0;
   let entries;
   try {
-    entries = (0, import_node_fs30.readdirSync)(path2, { withFileTypes: true });
+    entries = (0, import_node_fs32.readdirSync)(path2, { withFileTypes: true });
   } catch {
     return 0;
   }
   for (const entry of entries) {
-    const child2 = (0, import_node_path27.join)(path2, entry.name);
+    const child2 = (0, import_node_path30.join)(path2, entry.name);
     if (entry.isDirectory()) total += directoryBytes(child2);
     else {
       try {
-        total += (0, import_node_fs30.statSync)(child2).size;
+        total += (0, import_node_fs32.statSync)(child2).size;
       } catch {
       }
     }
@@ -26323,25 +26911,25 @@ function directoryBytes(path2) {
   return total;
 }
 function listDirEntries(dir) {
-  return (0, import_node_fs30.readdirSync)(dir, { withFileTypes: true }).map((d) => ({ name: d.name, isDirectory: d.isDirectory() }));
+  return (0, import_node_fs32.readdirSync)(dir, { withFileTypes: true }).map((d) => ({ name: d.name, isDirectory: d.isDirectory() }));
 }
 function readInstalledPluginRefs(home) {
   const p = installedPluginsPath(home);
-  if (!(0, import_node_fs30.existsSync)(p)) return [];
+  if (!(0, import_node_fs32.existsSync)(p)) return [];
   try {
-    return installedPluginPaths((0, import_node_fs30.readFileSync)(p, "utf8"));
+    return installedPluginPaths((0, import_node_fs32.readFileSync)(p, "utf8"));
   } catch {
     return null;
   }
 }
 function pluginCacheFsDeps(home, dirBytes) {
   return {
-    exists: (p) => (0, import_node_fs30.existsSync)(p),
-    listVersionDirs: (root) => (0, import_node_fs30.readdirSync)(root, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name),
+    exists: (p) => (0, import_node_fs32.existsSync)(p),
+    listVersionDirs: (root) => (0, import_node_fs32.readdirSync)(root, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name),
     dirBytes,
-    listStagingDirs: (root) => (0, import_node_fs30.readdirSync)(root, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => {
+    listStagingDirs: (root) => (0, import_node_fs32.readdirSync)(root, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => {
       try {
-        return { name: d.name, mtimeMs: newestMtimeMs((0, import_node_path27.join)(root, d.name), listDirEntries, (p) => (0, import_node_fs30.statSync)(p).mtimeMs) };
+        return { name: d.name, mtimeMs: newestMtimeMs((0, import_node_path30.join)(root, d.name), listDirEntries, (p) => (0, import_node_fs32.statSync)(p).mtimeMs) };
       } catch {
         return { name: d.name, mtimeMs: Date.now() };
       }
@@ -26355,10 +26943,10 @@ function stagingApplyFsGuard(home) {
   return {
     referencedPaths: () => readInstalledPluginRefs(home),
     mtimeMs: (name) => {
-      const p = (0, import_node_path27.join)(stagingRoot, name);
-      if (!(0, import_node_fs30.existsSync)(p)) return null;
+      const p = (0, import_node_path30.join)(stagingRoot, name);
+      if (!(0, import_node_fs32.existsSync)(p)) return null;
       try {
-        return newestMtimeMs(p, listDirEntries, (q) => (0, import_node_fs30.statSync)(q).mtimeMs);
+        return newestMtimeMs(p, listDirEntries, (q) => (0, import_node_fs32.statSync)(q).mtimeMs);
       } catch {
         return null;
       }
@@ -26368,13 +26956,13 @@ function stagingApplyFsGuard(home) {
 }
 program2.command("plugin-prune").description(`prune stale cached MMI plugin versions (keeps running + newest, ${PLUGIN_CACHE_KEEP} total) and orphaned temp_git_* staging dirs; dry-run unless --apply (#2903, #2990)`).option("--apply", "actually delete the stale version dirs + orphaned staging dirs (default: report only)").option("--json", "machine-readable output").action((o) => {
   const plan = buildPluginCachePlan(
-    (0, import_node_os8.homedir)(),
+    (0, import_node_os9.homedir)(),
     runningPluginVersion(process.env, resolveClientVersion()),
-    pluginCacheFsDeps((0, import_node_os8.homedir)(), directoryBytes),
+    pluginCacheFsDeps((0, import_node_os9.homedir)(), directoryBytes),
     { withBytes: true }
   );
   const anythingToDelete = plan.prune.length > 0 || plan.staging.length > 0;
-  const result = o.apply && anythingToDelete ? applyPluginCachePlan(plan, (p) => (0, import_node_fs30.rmSync)(p, { recursive: true, force: true }), stagingApplyFsGuard((0, import_node_os8.homedir)())) : void 0;
+  const result = o.apply && anythingToDelete ? applyPluginCachePlan(plan, (p) => (0, import_node_fs32.rmSync)(p, { recursive: true, force: true }), stagingApplyFsGuard((0, import_node_os9.homedir)())) : void 0;
   const warnings = plan.prune.length > 0 ? [CONCURRENT_SESSION_WARNING] : [];
   if (o.json) console.log(JSON.stringify({ ...plan, warnings, applied: result ?? null }));
   else console.log(renderPluginCachePlan(plan, result));
@@ -26403,6 +26991,8 @@ program2.command("session-start").description("run the SessionStart verbs (whoam
       });
       const line = whoamiLine(report, report.login ? ghMultiAccountCaveat(report.login) : void 0);
       if (line) io.log(line);
+      const authority = authorityLine(report);
+      if (authority) io.log(authority);
     },
     boardSlice: (io) => runBoardSlice(io, {
       loadConfig: () => loadConfigForRepo(),
@@ -26432,8 +27022,10 @@ program2.command("session-start").description("run the SessionStart verbs (whoam
       const line = localTrainSyncBannerLine(result);
       if (line) io.log(line);
     },
+    // #3485 item 7: the ONLY lane that throttles the npm read — it runs on every session start, on a
+    // blocking hook. Every interactive lane still reads live.
     doctor: async (io) => {
-      await runDoctorClean({ banner: true }, io, mmiDoctorDeps());
+      await runDoctorClean({ banner: true }, io, mmiDoctorDeps({ throttleReleasedRead: true }));
     }
   });
   await runSessionStart(parallel, sequential, bannerIo);
@@ -26456,6 +27048,7 @@ program2.parseAsync(process.argv).then(() => finishCliRun()).catch((e) => failGr
   DEFAULT_PRIORITY,
   awsCallerArn,
   classifyParseError,
+  envHealLockPath,
   gcPlan,
   isOrgRegisteredRepo,
   registryClientDeps,