@mutmutco/cli 3.56.0 → 3.58.0

package/dist/main.cjs

@@ -7331,9 +7331,116 @@ function defaultSpawn(command, args, env) {
   if (r.error) throw r.error;
   return r.status ?? 1;
 }
-async function secretsUse(deps, key, opts) {
+function classifyUseToken(token) {
+  if (!isValidSecretKey(token)) return "command";
+  const leaf = token.slice(token.lastIndexOf("/") + 1);
+  if (/^[A-Z][A-Z0-9_]*$/.test(leaf)) return "key";
+  return /^[A-Z]/.test(leaf) ? "ambiguous" : "command";
+}
+var USE_OWN_FLAGS = /* @__PURE__ */ new Set(["--repo", "--slug", "--name", "--key"]);
+function secretsUseTail(argv) {
+  for (let i = 0; i < argv.length - 1; i += 1) {
+    if (argv[i] === "secrets" && argv[i + 1] === "use") return argv.slice(i + 2);
+  }
+  return [];
+}
+function excessBareTokens(head) {
+  let excess = 0;
+  let positionalTaken = false;
+  for (let i = 0; i < head.length; ) {
+    const tok = head[i];
+    const eq = tok.indexOf("=");
+    const flag = eq === -1 ? tok : tok.slice(0, eq);
+    if (USE_OWN_FLAGS.has(flag)) {
+      if (flag === "--key") positionalTaken = true;
+      i += eq === -1 ? 2 : 1;
+      continue;
+    }
+    if (tok.startsWith("-")) {
+      i += 1;
+      continue;
+    }
+    if (positionalTaken) excess += 1;
+    else positionalTaken = true;
+    i += 1;
+  }
+  return excess;
+}
+function separatorIsOurs(head) {
+  return excessBareTokens(head) === 0;
+}
+function parseSecretsUseArgv(tail) {
+  const flags = {};
+  const keys = [];
+  const firstSep = tail.indexOf("--");
+  const sep2 = firstSep !== -1 && separatorIsOurs(tail.slice(0, firstSep)) ? firstSep : -1;
+  const head = sep2 === -1 ? tail : tail.slice(0, sep2);
+  let command = sep2 === -1 ? [] : tail.slice(sep2 + 1).slice();
+  for (let i = 0; i < head.length; ) {
+    const tok = head[i];
+    const eq = tok.indexOf("=");
+    const flag = eq === -1 ? tok : tok.slice(0, eq);
+    if (USE_OWN_FLAGS.has(flag)) {
+      const value = eq === -1 ? head[i + 1] : tok.slice(eq + 1);
+      if (value === void 0) return { kind: "error", error: `secrets use: ${flag} needs a value` };
+      if (flag === "--repo") flags.repo = value;
+      else if (flag === "--slug") flags.slug = value;
+      else if (flag === "--name") flags.name = value;
+      else keys.push(value);
+      i += eq === -1 ? 2 : 1;
+      continue;
+    }
+    if (tok === "--help" || tok === "-h") return { kind: "help" };
+    if (tok.startsWith("-")) {
+      return {
+        kind: "error",
+        error: `secrets use: unknown option ${tok}. \`use\` owns only --key, --repo, --slug and --name; the wrapped command's own flags go after \`--\`, following the command itself.`
+      };
+    }
+    if (keys.length === 0) {
+      keys.push(tok);
+      i += 1;
+      continue;
+    }
+    if (classifyUseToken(tok) !== "command") {
+      const fix = [...keys, tok].map((k) => `--key ${k}`).join(" ");
+      return {
+        kind: "error",
+        error: `secrets use: '${tok}' looks like a second secret key, but \`use\` takes one positional key, so it would be RUN as the command. Name each key explicitly:  mmi-cli secrets use ${fix} -- <command>   (if '${tok}' really is the command, put it after \`--\`)`
+      };
+    }
+    command = head.slice(i).slice();
+    break;
+  }
+  if (keys.length === 0) return { kind: "error", error: "secrets use: missing <key> (or --key <key>)" };
+  return { kind: "parsed", value: { keys, ...flags, command } };
+}
+function resolveUseEnvNames(keys, name) {
+  if (name && keys.length > 1) {
+    return { ok: false, error: `secrets use: --name renames ONE env var, but ${keys.length} keys were given \u2014 drop --name, or run one key per call.` };
+  }
+  const entries = keys.map((key) => ({
+    key,
+    envName: (name && keys.length === 1 ? name : secretLeafName(key)).toUpperCase().replace(/[^A-Z0-9_]/g, "_")
+  }));
+  const claimedBy = /* @__PURE__ */ new Map();
+  for (const e of entries) {
+    const prior = claimedBy.get(e.envName);
+    if (prior) {
+      return { ok: false, error: `secrets use: ${prior} and ${e.key} both inject as ${e.envName} \u2014 one would silently overwrite the other. Run one key per call.` };
+    }
+    claimedBy.set(e.envName, e.key);
+  }
+  return { ok: true, entries };
+}
+async function secretsUse(deps, keys, opts) {
   const command = opts.command ?? [];
+  const key = keys[0];
   if (command.length === 0) {
+    if (keys.length > 1) {
+      deps.err(`secrets use: ${keys.length} keys given but no command \u2014 multiple keys only make sense with \`-- <command>\`. For guidance on one key: mmi-cli secrets use ${key}`);
+      return false;
+    }
     const slug2 = await vaultSlug(deps, opts);
     const tier = classifyTier(slug2, key);
     const path2 = secretParamName(slug2, key);
@@ -7356,12 +7463,31 @@ async function secretsUse(deps, key, opts) {
     );
     return;
   }
-  if (!isValidSecretKey(key)) {
-    deps.err(`invalid secret key ${JSON.stringify(key)}`);
+  for (const k of keys) {
+    if (!isValidSecretKey(k)) {
+      deps.err(`invalid secret key ${JSON.stringify(k)}`);
+      return false;
+    }
+  }
+  const named = resolveUseEnvNames(keys, opts.name);
+  if (!named.ok) {
+    deps.err(named.error);
     return false;
   }
   const repo = await targetRepo(deps, opts);
   const slug = opts.slug?.toLowerCase();
+  const env = { ...process.env };
+  for (const { key: k, envName } of named.entries) {
+    const value = await fetchSecretForUse(deps, { repo, key: k, slug });
+    if (value == null) return false;
+    env[envName] = value;
+  }
+  const [cmd, ...args] = command;
+  const run = deps.spawn ?? defaultSpawn;
+  const code = run(cmd, args, env);
+  return code === 0;
+}
+async function fetchSecretForUse(deps, { repo, key, slug }) {
   const res = await deps.fetch(`${deps.apiUrl}/secrets/get`, {
     method: "POST",
     headers: await deps.headers({ "content-type": "application/json" }),
@@ -7373,23 +7499,19 @@ async function secretsUse(deps, key, opts) {
     if (res.status === 404 && body.code === "secret_not_found") {
       const guidance = resolveNotFoundGuidance({ key, repo, slug, report: await probeCapabilities(deps, repo) });
       for (const line of guidance.lines) deps.err(line);
-      return false;
+      return null;
     }
     deps.err(
       await upgradeMessage(res, body) ?? (res.status === 403 ? `secrets use: not authorized for ${key} (HTTP 403) \u2014 ask the master for a \`secrets grant\`${errorDetail(body)}` : `secrets use failed: HTTP ${res.status}${errorDetail(body)}`)
     );
-    return false;
+    return null;
   }
   const { value } = await res.json();
   if (!value) {
     deps.err(`secrets use: no value returned for ${key}`);
-    return false;
+    return null;
   }
-  const envName = (opts.name ?? secretLeafName(key)).toUpperCase().replace(/[^A-Z0-9_]/g, "_");
-  const [cmd, ...args] = command;
-  const run = deps.spawn ?? defaultSpawn;
-  const code = run(cmd, args, { ...process.env, [envName]: value });
-  return code === 0;
+  return value;
 }
 
 // src/report.ts
@@ -9251,9 +9373,10 @@ function checkMarketplaceAutoUpdate(probe) {
   if (!probe) return null;
   const evidence = [`${probe.name}: auto-update ${probe.effective ? "on" : "off"} \u2014 ${probe.reason}`];
   if (probe.effective) {
-    return { ok: true, label: `marketplace auto-update (${probe.name})`, detail: "on", verbose: evidence };
+    return { id: "marketplace-autoupdate", ok: true, label: `marketplace auto-update (${probe.name})`, detail: "on", verbose: evidence };
   }
   return {
+    id: "marketplace-autoupdate",
     ok: true,
     warn: true,
     label: `marketplace auto-update (${probe.name})`,
@@ -9266,18 +9389,24 @@ function checkMarketplaceCatalogRef(probe) {
   const label = `marketplace catalog ref (${probe.name})`;
   const evidence = [`${probe.name}: ${probe.reason}`, `auto-update: ${probe.autoUpdate ? "on" : "off"}`];
   if (probe.agrees) {
-    return { ok: true, label, detail: `${probe.ref}`, verbose: evidence };
+    return { id: "marketplace-catalog-ref", ok: true, label, detail: `${probe.ref}`, verbose: evidence };
   }
   const drift = probe.unpinned ? "unpinned" : `pinned to ${probe.ref}, not ${CATALOG_CONTENT_REF}`;
   if (probe.autoUpdate) {
     return {
+      id: "marketplace-catalog-ref",
       ok: false,
       label,
-      fix: `${drift} while auto-update is ON \u2014 this machine installs plugin releases advertised by a branch nobody released; ${CATALOG_REF_PIN_STEPS}`,
+      // #3574: `drift` moves to `detail`, matching the warn branch below, which always had it there. The
+      // ✗ branch carried it in `fix` only because `renderCheckLine` discarded `detail` on failure — one
+      // row, two conventions, decided by which field would actually print.
+      detail: `${drift} while auto-update is ON`,
+      fix: `this machine installs plugin releases advertised by a branch nobody released; ${CATALOG_REF_PIN_STEPS}`,
       verbose: evidence
     };
   }
   return {
+    id: "marketplace-catalog-ref",
     ok: true,
     warn: true,
     label,
@@ -9605,6 +9734,23 @@ function describePrMergeEnqueuedReason(checks) {
       };
   }
 }
+function decidePrMergeCleanupGate(input) {
+  const state = (input.state ?? "").trim().toUpperCase();
+  if (state === "MERGED") return { action: "cleanup" };
+  if (!state) {
+    return {
+      action: "refuse",
+      reason: "state-unreadable",
+      message: `could not read the PR's state after the merge attempt${input.stateError ? `: ${input.stateError}` : ""} \u2014 cleanup skipped because the merge is unproven`
+    };
+  }
+  if (input.autoRequested) return { action: "enqueued" };
+  return {
+    action: "refuse",
+    reason: "not-merged",
+    message: `the PR is ${state}, not MERGED \u2014 the merge did not happen, so the branch and worktree were left untouched`
+  };
+}
 function parseGhPrChecksOutput(stdout) {
   const text = stdout.trim();
   if (!text) return "no-checks-reported";
@@ -17716,10 +17862,30 @@ function registerSecretsCommands(program3) {
     if (!ok) process.exitCode = 1;
   }));
   secrets.command("rm <key>").description("remove a secret from your own full project vault; org-infra requires master or an exact grant. --slug _org removes an org-infra <provider>/<KEY> value (#3315)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--slug <slug>", "org-infra namespace (e.g. _org) for the value removal \u2014 master or an exact grant (#3315)").action((key, o) => withSecrets((d) => secretsRemove(d, key, o)));
-  secrets.command("use <key> [command...]").description("consume a secret KEYLESS: own-project full tree or an exactly granted org-infra key; injects into command env and never prints it. The wrapped command keeps its OWN flags (`-- node -e \u2026`, `-- curl -H \u2026`) with or without the `--`, because npm's PowerShell shim swallows `--` before the CLI sees it (#3436)").allowUnknownOption().option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--slug <slug>", "org-infra namespace (e.g. _org) for a granted org secret").option("--name <ENVVAR>", "env var name to inject under (default: the key leaf, UPPER_SNAKE)").action((key, command, o) => withSecrets(async (d) => {
-    const ok = await secretsUse(d, key, { ...o, command });
-    if (ok === false) process.exitCode = 1;
-  }));
+  secrets.command("use").usage("<key> | --key <key> [--key <key>\u2026]  [-- <command>] [--repo <owner/repo>] [--slug <slug>] [--name <ENVVAR>]").argument("[args...]", "one secret key (or use --key), then `--` and the command to run").description("consume secrets KEYLESS: own-project full tree or exactly granted org-infra keys; injects each into the command env and never prints one. ONE positional key, or several via repeated `--key` (#3561). The wrapped command keeps its OWN flags (`-- node -e \u2026`, `-- curl -H \u2026`) with or without the `--`, because npm's PowerShell shim swallows `--` before the CLI sees it (#3436)").allowUnknownOption().helpOption(false).addHelpText("after", [
+    "",
+    "Options:",
+    "  --key <key>          a secret key; repeat for several. The only form no shell can misread \u2014",
+    "                       `npm` and `slack/token` are BOTH valid key names and plausible commands.",
+    "  --repo <owner/repo>  target repo (defaults to the current repo)",
+    "  --slug <slug>        org-infra namespace (e.g. _org) for a granted org secret",
+    "  --name <ENVVAR>      env var to inject under, single key only (default: the key leaf, UPPER_SNAKE)",
+    "",
+    "These belong BEFORE the `--`. Everything after it is the wrapped command, untouched."
+  ].join("\n")).action(function() {
+    const parsed = parseSecretsUseArgv(secretsUseTail(process.argv));
+    if (parsed.kind === "help") return this.outputHelp();
+    return withSecrets(async (d) => {
+      if (parsed.kind === "error") {
+        d.err(parsed.error);
+        process.exitCode = 1;
+        return;
+      }
+      const { keys, command, ...o } = parsed.value;
+      const ok = await secretsUse(d, keys, { ...o, command });
+      if (ok === false) process.exitCode = 1;
+    });
+  });
   secrets.command("grant <repo> <login> <key>").description("MASTER-ONLY: grant a project-admin standing access to one specific org-infra secret").action((repo, login, key) => withSecrets((d) => secretsGrant(d, repo, login, key, {})));
   secrets.command("revoke <repo> <login> <key>").description("MASTER-ONLY: withdraw a previously granted org-infra secret access").action((repo, login, key) => withSecrets((d) => secretsRevoke(d, repo, login, key, {})));
 }
@@ -17864,11 +18030,11 @@ function renderPoolDetail(probe) {
 function checkGithubPools(probe) {
   if (!probe) return [];
   const lines = [];
-  lines.push(probe.personal ? { ok: true, label: "github pools (personal)", detail: renderPoolDetail(probe.personal) } : { ok: false, label: "github pools (personal)", fix: "rate_limit unreadable \u2014 check `gh auth status`" });
+  lines.push(probe.personal ? { id: "github-pools-personal", ok: true, label: "github pools (personal)", detail: renderPoolDetail(probe.personal) } : { id: "github-pools-personal", ok: false, label: "github pools (personal)", detail: "rate_limit unreadable", fix: "check `gh auth status`" });
   if (typeof probe.app === "string") {
-    lines.push({ ok: false, label: "github pools (app actor)", fix: probe.app });
+    lines.push({ id: "github-pools-app", ok: false, label: "github pools (app actor)", fix: probe.app });
   } else if (probe.app) {
-    lines.push({ ok: true, label: "github pools (app actor)", detail: renderPoolDetail(probe.app) });
+    lines.push({ id: "github-pools-app", ok: true, label: "github pools (app actor)", detail: renderPoolDetail(probe.app) });
   }
   return lines;
 }
@@ -18096,6 +18262,92 @@ var import_node_child_process10 = require("node:child_process");
 var import_node_util7 = require("node:util");
 
 // src/schedules.ts
+function cronFieldValues(field, min, max) {
+  const out = /* @__PURE__ */ new Set();
+  for (const part of field.split(",")) {
+    const [rangePart, stepPart] = part.split("/");
+    const step = stepPart === void 0 ? 1 : Number(stepPart);
+    if (!Number.isInteger(step) || step < 1) return null;
+    let lo;
+    let hi;
+    if (rangePart === "*" || rangePart === "?") {
+      lo = min;
+      hi = max;
+    } else if (rangePart.includes("-")) {
+      const [a, b] = rangePart.split("-");
+      lo = Number(a);
+      hi = Number(b);
+    } else {
+      lo = Number(rangePart);
+      hi = Number(rangePart);
+    }
+    if (!Number.isInteger(lo) || !Number.isInteger(hi) || lo < min || hi > max || lo > hi) return null;
+    for (let v = lo; v <= hi; v += step) out.add(v);
+  }
+  return out.size ? out : null;
+}
+function parseCronSpec(raw) {
+  const inner = raw.trim().replace(/^cron\(/i, "").replace(/\)$/, "").trim();
+  const f = inner.split(/\s+/);
+  if (f.length !== 5 && f.length !== 6) return null;
+  const aws = f.length === 6;
+  const [minute, hour, dom, month, dowRaw] = f;
+  const minutes = cronFieldValues(minute, 0, 59);
+  const hours = cronFieldValues(hour, 0, 23);
+  const doms = cronFieldValues(dom, 1, 31);
+  const months = cronFieldValues(month, 1, 12);
+  const dows = cronFieldValues(dowRaw, aws ? 1 : 0, aws ? 7 : 7);
+  if (!minutes || !hours || !doms || !months || !dows) return null;
+  const normalizedDow = new Set([...dows].map((d) => aws ? d - 1 : d % 7));
+  return {
+    minute: minutes,
+    hour: hours,
+    dom: doms,
+    month: months,
+    dow: normalizedDow,
+    domAny: dom === "*" || dom === "?",
+    dowAny: dowRaw === "*" || dowRaw === "?"
+  };
+}
+function cronMatches(spec, d) {
+  if (!spec.minute.has(d.getUTCMinutes())) return false;
+  if (!spec.hour.has(d.getUTCHours())) return false;
+  if (!spec.month.has(d.getUTCMonth() + 1)) return false;
+  const domHit = spec.dom.has(d.getUTCDate());
+  const dowHit = spec.dow.has(d.getUTCDay());
+  if (spec.domAny && spec.dowAny) return true;
+  if (spec.domAny) return dowHit;
+  if (spec.dowAny) return domHit;
+  return domHit || dowHit;
+}
+var FIRST_TICK_SCAN_DAYS = 400;
+function scheduleTickState(cadence, armedAt, now) {
+  if (!cadence || !armedAt) return {};
+  const armed = /* @__PURE__ */ new Date(`${armedAt}T00:00:00Z`);
+  if (Number.isNaN(armed.getTime())) return {};
+  const specs = splitCadence(cadence).flatMap((c) => [...c.match(/cron\([^)]*\)/gi) ?? [], ...extractCronTokens(c)]).map(parseCronSpec).filter((s) => s !== null);
+  if (!specs.length) return {};
+  const cursor = new Date(armed.getTime());
+  cursor.setUTCSeconds(0, 0);
+  const limit = armed.getTime() + FIRST_TICK_SCAN_DAYS * 864e5;
+  while (cursor.getTime() <= limit) {
+    if (specs.some((s) => cronMatches(s, cursor))) {
+      return { firstTickDue: cursor.toISOString(), ticked: cursor.getTime() <= now.getTime() };
+    }
+    cursor.setTime(cursor.getTime() + 6e4);
+  }
+  return {};
+}
+var WEEKDAY = ["Sun", "Mon", "Tue", "Wed", "Thu", "Fri", "Sat"];
+function resolvedLabel(entry, now) {
+  if (entry.resolved !== "live") return entry.resolved;
+  const { firstTickDue, ticked } = scheduleTickState(entry.cadence, entry.armedAt, now);
+  if (!firstTickDue) return entry.resolved;
+  const due = new Date(firstTickDue);
+  const armedDay = WEEKDAY[(/* @__PURE__ */ new Date(`${entry.armedAt}T00:00:00Z`)).getUTCDay()];
+  const dueStamp = `${firstTickDue.slice(0, 16).replace("T", " ")}Z`;
+  return ticked ? `live \u2014 first tick was due ${dueStamp}` : `live \u2014 awaiting first tick ${dueStamp} (armed ${armedDay}, fires ${WEEKDAY[due.getUTCDay()]})`;
+}
 var ORG = "mutmutco";
 var DOC_START_MARKER = "<!-- schedules:inventory:start -->";
 var DOC_END_MARKER = "<!-- schedules:inventory:end -->";
@@ -18253,19 +18505,23 @@ function sortEntries(entries) {
     (a, b) => a.executor.localeCompare(b.executor) || a.name.localeCompare(b.name)
   );
 }
-function formatSchedulesTable(entries) {
+function formatSchedulesTable(entries, now = /* @__PURE__ */ new Date()) {
   if (!entries.length) return "no armed org schedules found";
+  const resolvedOf = new Map(entries.map((e) => [e, resolvedLabel(e, now)]));
   const w = (pick, head) => Math.max(head.length, ...entries.map((e) => pick(e).length));
   const nameW = w((e) => e.name, "JOB");
   const cadW = w((e) => e.cadence, "CADENCE");
   const exeW = w((e) => e.executor, "EXECUTOR");
   const llmW = w((e) => e.llm, "LLM");
-  const resW = w((e) => e.resolved, "RESOLVED");
+  const resW = w((e) => resolvedOf.get(e) ?? e.resolved, "RESOLVED");
   const row = (n, c, x, l, r, s) => `${n.padEnd(nameW)}  ${c.padEnd(cadW)}  ${x.padEnd(exeW)}  ${l.padEnd(llmW)}  ${r.padEnd(resW)}  ${s}`;
   const lines = [row("JOB", "CADENCE", "EXECUTOR", "LLM", "RESOLVED", "SOURCE")];
-  for (const e of entries) lines.push(row(e.name, e.cadence, e.executor, e.llm, e.resolved, e.source));
+  for (const e of entries) lines.push(row(e.name, e.cadence, e.executor, e.llm, resolvedOf.get(e) ?? e.resolved, e.source));
   return lines.join("\n");
 }
+function withTickState(entry, now = /* @__PURE__ */ new Date()) {
+  return { ...entry, ...scheduleTickState(entry.cadence, entry.armedAt, now) };
+}
 function renderDocSection(entries, generatedAtIso) {
   const lines = [
     "| Job | Cadence | Executor | LLM | Resolved | Source |",
@@ -18625,7 +18881,8 @@ function registerSchedulesCommands(program3) {
         return;
       }
       if (o.json) {
-        console.log(JSON.stringify({ org: entries, incomplete, drift, reconciliation }, null, 2));
+        const now = /* @__PURE__ */ new Date();
+        console.log(JSON.stringify({ org: entries.map((e) => withTickState(e, now)), incomplete, drift, reconciliation }, null, 2));
       } else {
         console.log(formatSchedulesTable(entries));
         reportDrift(drift);
@@ -21808,6 +22065,97 @@ function formatStaleLeaks(leaks) {
 async function repoRootOf() {
   return (await execFileP2("git", ["rev-parse", "--show-toplevel"], { timeout: GIT_TIMEOUT_MS }).catch(() => ({ stdout: "" }))).stdout.trim() || process.cwd();
 }
+function classifyLandBranchMergeState(prs) {
+  if (!prs) return { state: "unknown", numbers: [] };
+  if (!prs.length) return { state: "no-pr", numbers: [] };
+  const pick = (s) => prs.filter((pr2) => pr2.state.toUpperCase() === s).map((pr2) => pr2.number);
+  const open2 = pick("OPEN");
+  if (open2.length) return { state: "open", numbers: open2 };
+  const known = /* @__PURE__ */ new Set(["OPEN", "CLOSED", "MERGED"]);
+  const unrecognised = prs.filter((pr2) => !known.has(pr2.state.toUpperCase()));
+  if (unrecognised.length) return { state: "unknown", numbers: prs.map((pr2) => pr2.number) };
+  const merged = pick("MERGED");
+  if (!merged.length) return { state: "closed-unmerged", numbers: prs.map((pr2) => pr2.number) };
+  if (merged.length < prs.length) return { state: "mixed", numbers: prs.map((pr2) => pr2.number) };
+  return { state: "merged", numbers: merged };
+}
+function describeLandMergeState(v) {
+  const refs = v.numbers.map((n) => `#${n}`).join(", ");
+  switch (v.state) {
+    case "merged":
+      return `PR ${refs} merged`;
+    case "closed-unmerged":
+      return `PR ${refs} CLOSED \u2014 NOT merged`;
+    case "mixed":
+      return `PR ${refs} \u2014 some merged, some CLOSED unmerged; which one owns the branch head is unproven`;
+    case "open":
+      return `PR ${refs} still OPEN \u2014 NOT merged`;
+    case "no-pr":
+      return "no pull request for this branch";
+    case "unknown":
+      return refs ? `PR ${refs} reported a pull-request state this CLI does not recognise \u2014 merge NOT confirmed` : "pull-request state could not be read \u2014 merge NOT confirmed";
+  }
+}
+function decideWorktreeLandRefCleanup(input) {
+  if (input.keepRemote) return { action: "proceed" };
+  const verdict = classifyLandBranchMergeState(input.prs);
+  const refs = verdict.numbers.map((n) => `#${n}`).join(", ");
+  if (verdict.state === "unknown") {
+    return verdict.numbers.length ? {
+      action: "keep-remote",
+      reason: "pr-state-unrecognised",
+      message: `pull request ${refs} for '${input.branch}' reported a state this CLI does not recognise \u2014 keeping the remote branch rather than deleting a ref whose merge is unproven`
+    } : {
+      action: "keep-remote",
+      reason: "pr-state-unreadable",
+      message: `could not read the pull-request state for '${input.branch}' \u2014 keeping the remote branch so an unmerged head ref cannot be deleted on a guess`
+    };
+  }
+  if (verdict.state === "open") {
+    return {
+      action: "refuse",
+      reason: "open-pr",
+      message: `'${input.branch}' still has an OPEN pull request (${refs}). Deleting its head ref would auto-close the PR and leave the work on no branch. Merge it first, or re-run with --keep-remote for a local-only clean`
+    };
+  }
+  if (verdict.state === "mixed") {
+    return {
+      action: "keep-remote",
+      reason: "mixed-pr-state",
+      message: `'${input.branch}' has both a merged and a closed-unmerged pull request (${refs}) and nothing here proves which owns the current head \u2014 keeping the remote branch rather than deleting a ref that may hold unmerged work`
+    };
+  }
+  if (verdict.state === "closed-unmerged") {
+    return {
+      action: "refuse",
+      reason: "unmerged-pr",
+      message: `'${input.branch}' has a pull request that never merged (${refs}). The remote branch is the only thing still holding that work. Re-run with --keep-remote for a local-only clean`
+    };
+  }
+  return { action: "proceed" };
+}
+async function fetchLandBranchPrs(branch, repo) {
+  try {
+    const { stdout } = await execFileP2("gh", [
+      "pr",
+      "list",
+      "--head",
+      branch,
+      "--state",
+      "all",
+      "--limit",
+      "20",
+      ...repo ? ["--repo", repo] : [],
+      "--json",
+      "number,state"
+    ], { timeout: GH_TIMEOUT_MS });
+    const parsed = JSON.parse(stdout.trim() || "null");
+    if (!Array.isArray(parsed)) return void 0;
+    return parsed.filter((pr2) => Boolean(pr2) && typeof pr2 === "object" && typeof pr2.number === "number" && typeof pr2.state === "string").map((pr2) => ({ number: pr2.number, state: pr2.state }));
+  } catch {
+    return void 0;
+  }
+}
 async function fetchIssueTitle(repo, number) {
   try {
     const { stdout } = await execFileP2("gh", ["issue", "view", String(number), "--repo", repo, "--json", "title", "--jq", ".title"], { timeout: GH_TIMEOUT_MS });
@@ -21869,6 +22217,18 @@ function registerWorktreeCommands(program3) {
       if (landDirty) {
         return fail(`worktree land: refusing to land '${branch}' \u2014 uncommitted changes in ${wtPath}; commit, stash, or remove the worktree manually`, { code: ERROR_CODES.ERR_BAD_ENUM });
       }
+      const landPrs = await fetchLandBranchPrs(branch);
+      const mergeVerdict = classifyLandBranchMergeState(landPrs);
+      const landRefs = decideWorktreeLandRefCleanup({
+        branch,
+        prs: landPrs,
+        keepRemote: Boolean(o.keepRemote)
+      });
+      if (landRefs.action === "refuse") {
+        return fail(`worktree land: ${landRefs.message}`, { code: ERROR_CODES.ERR_BAD_ENUM });
+      }
+      const keepRemoteBranch = Boolean(o.keepRemote) || landRefs.action === "keep-remote";
+      if (landRefs.action === "keep-remote") console.warn(`worktree land: ${landRefs.message}.`);
       const report = [];
       if (hasStage) {
         try {
@@ -21888,14 +22248,28 @@ function registerWorktreeCommands(program3) {
         status: removeOutcome.status === "removed" ? removeOutcome.recovery ? `done (${removeOutcome.recovery})` : "done" : `failed: ${removeOutcome.error ?? "lock held"} \u2014 run: git -C "${primaryCheckout}" worktree remove --force "${wtPath}"`
       });
       report.push(await bestEffortGit(["branch", "-D", branch], primaryCheckout, `delete local branch ${branch}`));
-      if (!o.keepRemote) {
+      if (!keepRemoteBranch) {
         report.push(await bestEffortGit(["push", o.remote, "--delete", branch], void 0, `delete remote branch ${branch}`, GH_MUTATION_TIMEOUT_MS));
+      } else if (!o.keepRemote) {
+        report.push({ step: `delete remote branch ${branch}`, status: `skipped: ${landRefs.action === "keep-remote" ? landRefs.reason : "kept"}` });
       }
       report.push(await bestEffortGit(["worktree", "prune"], primaryCheckout, "prune worktree metadata"));
-      const result = { dryRun: false, ...plan, ...o.keepRemote ? { keepRemote: true } : {}, report };
+      const result = {
+        dryRun: false,
+        ...plan,
+        ...o.keepRemote ? { keepRemote: true } : {},
+        // #3566: the merge outcome, machine-readable, so an orchestrator never has to infer it from the
+        // absence of an error. `merged` is the ONLY value that means the work reached the base branch.
+        mergeState: mergeVerdict.state,
+        prNumbers: mergeVerdict.numbers,
+        report
+      };
       if (o.json) return console.log(JSON.stringify(result, null, 2));
-      console.log(`worktree land: cleaned up branch ${branch}`);
+      console.log(`worktree land: cleaned up branch ${branch} (${describeLandMergeState(mergeVerdict)})`);
       for (const r of report) console.log(`  ${r.step}: ${r.status}`);
+      if (mergeVerdict.state !== "merged") {
+        console.warn(`worktree land: '${branch}' was cleaned up but NOT merged \u2014 ${describeLandMergeState(mergeVerdict)}. Do not report this work as shipped.`);
+      }
       if (report.some((r) => r.status.startsWith("failed"))) process.exitCode = 1;
     } catch (e) {
       return failGraceful(`worktree land: ${e.message}`);
@@ -22642,8 +23016,11 @@ var PLUGIN_SURFACE_HEAL = {
     updateRecipe: [CLAUDE_RECOVERY]
   }
 };
-function nonClaudeSurfaceHealMessage() {
-  return "No Hub-shipped MMI plugin on this host \u2014 the Hub is Claude-only since #2741.\n  Update the CLI instead: npm i -g @mutmutco/cli   (org rules ride an AGENTS.md authored outside the Hub)";
+function nonClaudeSurfaceHealMessage(surface) {
+  if (surface === "codex") {
+    return "Codex ships an MMI plugin (#3563). Install or repair it with:\n  codex plugin marketplace add mutmutco/MMI-Hub && codex plugin add mmi@mutmutco\n  Then run /hooks and TRUST the MMI hooks \u2014 bundled hooks are skipped until reviewed.\n  Update the CLI too: npm i -g @mutmutco/cli";
+  }
+  return "No Hub-shipped MMI plugin on this host \u2014 the Hub ships plugins for Claude and Codex only.\n  Update the CLI instead: npm i -g @mutmutco/cli   (org rules ride an AGENTS.md authored outside the Hub)";
 }
 function healStepAborts(step, ok) {
   return !ok && step.gated;
@@ -22840,7 +23217,7 @@ async function runGuard(readOrigin) {
 }
 async function runPluginHeal(surface = detectSurface(process.env)) {
   if (surfaceToken(surface) !== "claude") {
-    console.log(nonClaudeSurfaceHealMessage());
+    console.log(nonClaudeSurfaceHealMessage(surfaceToken(surface) ?? void 0));
     return;
   }
   const descriptor = PLUGIN_SURFACE_HEAL.claude;
@@ -23982,7 +24359,9 @@ function renderCheckLine(check) {
   if (check.ok) {
     return check.detail ? `\u2713 ${check.label} \u2014 ${check.detail}` : `\u2713 ${check.label}`;
   }
-  return check.fix ? `\u2717 ${check.label} \u2014 ${check.fix}` : `\u2717 ${check.label}`;
+  const head = check.detail ? `\u2717 ${check.label} \u2014 ${check.detail}` : `\u2717 ${check.label}`;
+  return check.fix ? `${head}
+${VERBOSE_INDENT}\u2192 ${check.fix}` : head;
 }
 function renderReport(checks, opts) {
   const lines = checks.map(renderCheckLine);
@@ -23996,7 +24375,8 @@ function renderTally(checks) {
 }
 function renderDoctorText(checks, opts) {
   const lines = [];
-  for (const check of checks) {
+  const shown = opts.verbose ? checks : checks.filter((c) => !c.ok || c.warn);
+  for (const check of shown) {
     lines.push(renderCheckLine(check));
     if (opts.verbose) {
       for (const evidence of check.verbose ?? []) lines.push(`${VERBOSE_INDENT}${evidence}`);
@@ -24019,6 +24399,7 @@ function checkGithubAuth(probe) {
     const rescuers = reach.otherAccountsThatCanSee ?? [];
     return {
       ok: false,
+      id: "github-auth",
       label: "github auth",
       fix: rescuers.length ? `the active gh account (${login}) cannot see ${reach.repo}; another account is logged in \u2014 try: gh auth switch --user ${rescuers[0]}` : `the active gh account (${login}) cannot see ${reach.repo} \u2014 check org membership, or: gh auth login`,
       verbose: [
@@ -24031,6 +24412,7 @@ function checkGithubAuth(probe) {
   }
   return {
     ok: authed,
+    id: "github-auth",
     label: "github auth",
     fix: probe.ghInstalled ? 'run: gh auth login --hostname github.com --git-protocol https --web --scopes "project"' : "install GitHub CLI (https://cli.github.com), then: gh auth login",
     verbose: [
@@ -24046,6 +24428,7 @@ function checkAwsIdentity(probe) {
   const arn = probe.callerArn?.trim();
   return {
     ok: !arn || !arn.endsWith(":root"),
+    id: "aws-identity",
     label: "aws identity",
     fix: "use a non-root IAM user/session profile (set AWS_PROFILE or run: aws sso login), then verify `aws sts get-caller-identity` is not :root",
     // Name the caller. A green "aws identity" says only "not root" — it does not say WHO, and "no AWS
@@ -24060,6 +24443,7 @@ function checkAwsIdentity(probe) {
 function checkRepoWorktrees(probe) {
   return {
     ok: !(probe.isOrgRepo && probe.hasRepoLocalWorktrees),
+    id: "repo-worktrees",
     label: "repo worktrees",
     fix: "repo-local `.worktrees/` is not the canonical path \u2014 use `mmi-cli worktree create <branch>` (sibling `../worktrees/`), then remove the in-repo `.worktrees/`",
     verbose: [
@@ -24078,11 +24462,12 @@ function checkWorktreeRoots(probe) {
     `scanned by worktree gc/list: ${probe.authoritative}`,
     ...probe.stray.length ? probe.stray.map((s) => `unreachable by any gc: ${s.path} \u2014 ${s.dirs} dir(s), ${formatBytes(s.bytes, s.partial)}`) : ["no other *worktrees* directory beside this repo"]
   ];
-  if (!probe.stray.length) return { ok: true, label: "worktree roots", verbose: evidence };
+  if (!probe.stray.length) return { ok: true, id: "worktree-roots", label: "worktree roots", verbose: evidence };
   const named = probe.stray.map((s) => `${s.path} (${s.dirs} dir(s), ${formatBytes(s.bytes, s.partial)})`).join("; ");
   const cutShort = probe.stray.some((s) => s.partial) ? " (a \u2265 figure is a floor \u2014 the size walk hit its time budget, so the real total is larger)" : "";
   return {
     ok: false,
+    id: "worktree-roots",
     label: "worktree roots",
     // #3485: report-only in EVERY mode means report-only in the exit code too. `worktree gc --root` does
     // exist and is the eventual fix, but this row is deliberately not a gate: the remedy is a human
@@ -24111,16 +24496,20 @@ function checkClaudePlugin(probe) {
   const trigger = pluginHealTrigger(probe);
   if (trigger === "unresolved") {
     return {
+      id: "claude-plugin",
       ok: false,
-      label: guardState === "no-install" ? "Claude plugin \u2014 not installed" : "Claude plugin \u2014 unresolved (marketplace/cache missing)",
+      label: "Claude plugin",
+      detail: guardState === "no-install" ? "not installed" : "unresolved (marketplace/cache missing)",
       fix: "run `mmi-cli doctor --apply` (or `mmi-cli plugin heal`) to reinstall the MMI marketplace + plugin, then restart Claude",
       verbose: evidence
     };
   }
   if (trigger === "behind") {
     return {
+      id: "claude-plugin",
       ok: false,
-      label: `Claude plugin ${installed} \u2192 ${released}`,
+      label: "Claude plugin",
+      detail: `${installed} \u2192 ${released}`,
       // Name the CLI verb that actually fixes it, like every other red row — `/plugin` is the manual
       // fallback, not the first resort (#3282).
       fix: "run `mmi-cli doctor --apply` (or `mmi-cli plugin heal`) to reinstall it, then restart Claude",
@@ -24128,7 +24517,7 @@ function checkClaudePlugin(probe) {
     };
   }
   if (!released) return null;
-  return { ok: true, label: installed ? `Claude plugin ${installed}` : "Claude plugin", verbose: evidence };
+  return { id: "claude-plugin", ok: true, label: "Claude plugin", ...installed ? { detail: installed } : {}, verbose: evidence };
 }
 function checkCliVersion(input, releasedNote) {
   const report = buildVersionLagReport(input);
@@ -24137,10 +24526,12 @@ function checkCliVersion(input, releasedNote) {
     `published: ${report.releasedVersion ?? "(not checked \u2014 offline or --fast)"}${report.releasedVersion && releasedNote ? ` ${releasedNote}` : ""}`
   ];
   if (!report.releasedVersion) return null;
-  if (report.ok) return { ok: true, label: `mmi-cli ${report.currentVersion}`, verbose: evidence };
+  if (report.ok) return { id: "cli-version", ok: true, label: "mmi-cli", detail: report.currentVersion, verbose: evidence };
   return {
+    id: "cli-version",
     ok: false,
-    label: `mmi-cli ${report.currentVersion} \u2192 ${report.releasedVersion}`,
+    label: "mmi-cli",
+    detail: `${report.currentVersion} \u2192 ${report.releasedVersion}`,
     fix: report.fix,
     verbose: evidence
   };
@@ -24154,6 +24545,7 @@ function checkPluginCache(input) {
   if (input.stale.length === 0 && input.staging.length === 0) {
     return {
       ok: true,
+      id: "plugin-cache",
       label: "plugin cache",
       detail: input.cached ? `${input.cached} version(s), nothing stale` : "no cache",
       verbose: evidence
@@ -24170,6 +24562,7 @@ function checkPluginCache(input) {
   }
   return {
     ok: false,
+    id: "plugin-cache",
     label: "plugin cache",
     // #3485: deliberately NOT `reportOnly`, and not in the closed set docs/doctor-contract.md enumerates.
     // A checker argued it qualifies because no `doctor --apply` clears it; I tagged it, then reverted.
@@ -24188,11 +24581,19 @@ function checkTrainSync(result) {
   const evidence = result.branches.length ? result.branches.map((b) => `${b.branch}: ${b.status}${b.reason ? ` (${b.reason})` : ""}`) : ["no local train branches to sync"];
   const problems = result.branches.filter((b) => b.status === "skipped" && (b.reason === "diverged" || b.reason === "ff-failed"));
   if (problems.length) {
-    return { ok: false, label: "train branches", fix: problems.map((b) => b.note).join("; "), verbose: evidence };
+    return {
+      ok: false,
+      id: "train-branches",
+      label: "train branches",
+      detail: problems.map((b) => `${b.branch} ${b.reason}`).join(", "),
+      fix: problems.map((b) => b.note).join("; "),
+      verbose: evidence
+    };
   }
   const moved = result.branches.filter((b) => b.status === "synced");
   return {
     ok: true,
+    id: "train-branches",
     label: "train branches",
     detail: moved.length ? `fast-forwarded ${moved.map((b) => b.branch).join(", ")}` : void 0,
     verbose: evidence
@@ -24209,6 +24610,7 @@ function checkSchedules(probe) {
   if (probe.incomplete.length) {
     return {
       ok: false,
+      id: "schedules",
       label: "schedules",
       // #3485: ruled report-only — an unreadable source is a read failure somewhere in the org, and
       // nothing in this checkout clears it.
@@ -24221,6 +24623,7 @@ function checkSchedules(probe) {
   if (probe.drift.length) {
     return {
       ok: false,
+      id: "schedules",
       label: "schedules",
       // #3485 ruled this row report-only because the drift classes are owned by other repos. #3492 makes
       // that conditional rather than blanket: when a finding IS clearable from this checkout — a
@@ -24233,16 +24636,17 @@ function checkSchedules(probe) {
       verbose: evidence
     };
   }
-  return { ok: true, label: "schedules", detail: `${probe.armed} armed`, verbose: evidence };
+  return { ok: true, id: "schedules", label: "schedules", detail: `${probe.armed} armed`, verbose: evidence };
 }
 function checkDocsAudit(probe) {
   if (!probe) return null;
   if (!probe.armed) {
-    return { ok: true, label: "docs-audit", detail: "janitor not armed", verbose: [probe.detail] };
+    return { ok: true, id: "docs-audit", label: "docs-audit", detail: "janitor not armed", verbose: [probe.detail] };
   }
   if (!probe.ok) {
     return {
       ok: false,
+      id: "docs-audit",
       label: "docs-audit",
       // #3485: ruled report-only — the remedy is re-running or re-arming the janitor in the repo that
       // owns it. `mmi-cli docs audit record` can write a verdict from here, but hand-writing one to clear
@@ -24252,7 +24656,7 @@ function checkDocsAudit(probe) {
       verbose: [probe.detail]
     };
   }
-  return { ok: true, label: "docs-audit", detail: probe.detail, verbose: [probe.detail] };
+  return { ok: true, id: "docs-audit", label: "docs-audit", detail: probe.detail, verbose: [probe.detail] };
 }
 function checkSessionPayload(probe) {
   if (!probe) return null;
@@ -24269,8 +24673,13 @@ function checkSessionPayload(probe) {
   if (status === "red") {
     return {
       ok: false,
+      id: "sessionstart-payload",
       label: "SessionStart payload",
-      fix: `${chars} characters exceeds the ${SESSION_PAYLOAD_CAP_CHARS}-character additionalContext cap \u2014 Claude Code truncates it to a ~2,000-character preview with no error, so agents are starting on partial doctrine; cut a block from the session-start banner`,
+      // #3574: the count belongs in `detail`, like the amber row below already had it. The red row put
+      // it in `fix` because the ✗ branch used to discard `detail`, which also left the head rendering as
+      // a bare `✗ SessionStart payload` with the one number that matters buried in the advice.
+      detail: `${chars} characters, over the ${SESSION_PAYLOAD_CAP_CHARS}-character cap`,
+      fix: `Claude Code truncates it to a ~2,000-character preview with no error, so agents are starting on partial doctrine; cut a block from the session-start banner`,
       verbose: evidence
     };
   }
@@ -24281,6 +24690,7 @@ function checkSessionPayload(probe) {
       // amber tier dead code on the one lane that runs every session — drift past the budget was
       // invisible until it became a truncation. Still ✓, still never moves the exit code.
       warn: true,
+      id: "sessionstart-payload",
       label: "SessionStart payload",
       detail: `amber \u2014 ${chars} characters, over the ${SESSION_PAYLOAD_BUDGET_CHARS}-character budget and ${SESSION_PAYLOAD_CAP_CHARS - chars} from the hard cap`,
       verbose: evidence
@@ -24288,6 +24698,7 @@ function checkSessionPayload(probe) {
   }
   return {
     ok: true,
+    id: "sessionstart-payload",
     label: "SessionStart payload",
     detail: `${chars} of ${SESSION_PAYLOAD_BUDGET_CHARS} budgeted characters`,
     verbose: evidence
@@ -24335,12 +24746,12 @@ async function runDoctorClean(opts, io, deps) {
       `managed block: ${gi.ok ? "present and current" : "missing or out of date"}`
     ];
     if (gi.ok) {
-      checks.push({ ok: true, label: "gitignore block", verbose: giEvidence });
+      checks.push({ ok: true, id: "gitignore-block", label: "gitignore block", verbose: giEvidence });
     } else if (applyRepo && gi.content && deps.writeGitignore(gi.content)) {
-      checks.push({ ok: true, label: "gitignore block", detail: "rewrote managed block", verbose: giEvidence });
+      checks.push({ ok: true, id: "gitignore-block", label: "gitignore block", detail: "rewrote managed block", verbose: giEvidence });
       restartPending = true;
     } else {
-      checks.push({ ok: false, label: "gitignore block", fix: "run `mmi-cli doctor --apply` to write the org-managed .gitignore block", verbose: giEvidence });
+      checks.push({ ok: false, id: "gitignore-block", label: "gitignore block", fix: "run `mmi-cli doctor --apply` to write the org-managed .gitignore block", verbose: giEvidence });
     }
   }
   const releasedNote = deps.releasedVersionNote?.();
@@ -24348,7 +24759,7 @@ async function runDoctorClean(opts, io, deps) {
   const healTrigger = pluginHealTrigger(pluginProbe);
   if (applyEnv && deps.healPlugin && healTrigger) {
     const heal = await deps.healPlugin();
-    const label = healTrigger === "behind" ? `Claude plugin ${installed} \u2192 ${released}` : "Claude plugin \u2014 reinstalled";
+    const measured = healTrigger === "behind" ? `${installed} \u2192 ${released}` : "unresolved install";
     const healEvidence = [
       `installed: ${installed ?? "(none)"}`,
       `released:  ${released ?? "(not checked \u2014 offline or --fast)"}`,
@@ -24356,13 +24767,16 @@ async function runDoctorClean(opts, io, deps) {
       `heal: ${heal.detail}`
     ];
     checks.push(heal.ok ? {
+      id: "claude-plugin",
       ok: true,
-      label,
-      detail: "reinstalled via the MMI marketplace (remove \u2192 add \u2192 install)",
+      label: "Claude plugin",
+      detail: `${measured} \u2014 reinstalled via the MMI marketplace (remove \u2192 add \u2192 install)`,
       verbose: healEvidence
     } : {
+      id: "claude-plugin",
       ok: false,
-      label,
+      label: "Claude plugin",
+      detail: measured,
       // #3489: a heal skipped because another doctor holds the env-heal lock is a real ✗ — this run did
       // not fix what it found — but it is not this invocation's to clear. The other process is doing it;
       // waiting is the correct response and a re-run finds it healed. A heal that RAN and failed is a
@@ -24385,13 +24799,16 @@ async function runDoctorClean(opts, io, deps) {
     const heal = await deps.updateCli(cliReport.releasedVersion);
     const healEvidence = [`running:  ${cliReport.currentVersion}`, `published: ${cliReport.releasedVersion}`, `heal: ${heal.detail}`];
     checks.push(heal.ok ? {
+      id: "cli-version",
       ok: true,
-      label: `mmi-cli ${cliReport.currentVersion} \u2192 ${cliReport.releasedVersion}`,
-      detail: "self-updated via npm install -g; the next mmi-cli invocation runs the new version",
+      label: "mmi-cli",
+      detail: `${cliReport.currentVersion} \u2192 ${cliReport.releasedVersion} \u2014 self-updated via npm install -g; the next mmi-cli invocation runs the new version`,
       verbose: healEvidence
     } : {
+      id: "cli-version",
       ok: false,
-      label: `mmi-cli ${cliReport.currentVersion} \u2192 ${cliReport.releasedVersion}`,
+      label: "mmi-cli",
+      detail: `${cliReport.currentVersion} \u2192 ${cliReport.releasedVersion}`,
       // #3489: same split as the plugin heal above — a lock-contention skip is not this run's gap.
       ...heal.skipped ? { reportOnly: true } : {},
       fix: heal.skipped ? `${heal.detail} \u2014 another doctor on this machine is updating it now; re-run once it finishes` : `self-update failed (${heal.detail}) \u2014 run \`${cliUpdateCommand(cliReport.releasedVersion)}\``,
@@ -24439,6 +24856,7 @@ async function runDoctorClean(opts, io, deps) {
       const message = e instanceof Error ? e.message : String(e);
       checks.push({
         ok: false,
+        id: "train-branches",
         label: "train branches",
         fix: `sync failed \u2014 ${message}`,
         verbose: [`sync threw: ${message}`, "no train branch was fast-forwarded this run"]
@@ -24455,6 +24873,7 @@ async function runDoctorClean(opts, io, deps) {
         if (r.removedWorktreeDirs.length) detailParts.push(`${r.removedWorktreeDirs.length} dead worktrees`);
         if (r.removedTrackingRefs.length) detailParts.push(`${r.removedTrackingRefs.length} stale refs`);
         checks.push({
+          id: "branches-worktrees",
           ok: true,
           label: "branches / worktrees",
           detail: reaped ? `reaped ${detailParts.join(", ")}` : "nothing stale",
@@ -24476,10 +24895,14 @@ async function runDoctorClean(opts, io, deps) {
           ...plan.trackingRefs.map((r) => `stale tracking ref: ${r.ref}`),
           ...plan.worktreeDirs.map((w) => `dead worktree: ${w.path} (${w.reason})`)
         ];
-        checks.push(n === 0 ? { ok: true, label: "branches / worktrees", verbose: ["nothing reapable"] } : {
+        checks.push(n === 0 ? { id: "branches-worktrees", ok: true, label: "branches / worktrees", verbose: ["nothing reapable"] } : {
+          id: "branches-worktrees",
           ok: false,
           label: "branches / worktrees",
-          fix: `${n} stale \u2014 run \`mmi-cli doctor --apply\` to reap merged branches, stale refs, and dead worktrees`,
+          // #3574: `${n} stale` was prepended to `fix` because the ✗ branch would not render `detail` —
+          // the same fact this row already puts in `detail` on its ✓ path four lines up. One convention now.
+          detail: `${n} stale`,
+          fix: "run `mmi-cli doctor --apply` to reap merged branches, stale refs, and dead worktrees",
           verbose: gcEvidence
         });
       }
@@ -24490,10 +24913,10 @@ async function runDoctorClean(opts, io, deps) {
     if (applyRepo && scratch.plan.safeAuto.length > 0) {
       const applied = deps.executeScratchGc(repoRoot2, { apply: true });
       const pruned = applied.applied?.pruned.length ?? 0;
-      checks.push({ ok: true, label: "scratch", detail: pruned ? `removed ${pruned} aged item(s)` : "nothing stale", verbose: scratchEvidence });
+      checks.push({ id: "scratch", ok: true, label: "scratch", detail: pruned ? `removed ${pruned} aged item(s)` : "nothing stale", verbose: scratchEvidence });
       if (pruned) restartPending = true;
     } else {
-      checks.push(scratch.plan.safeAuto.length === 0 ? { ok: true, label: "scratch", verbose: scratchEvidence } : { ok: false, label: "scratch", fix: `${scratch.plan.safeAuto.length} aged scratch item(s) \u2014 run \`mmi-cli doctor --apply\``, verbose: scratchEvidence });
+      checks.push(scratch.plan.safeAuto.length === 0 ? { id: "scratch", ok: true, label: "scratch", verbose: scratchEvidence } : { id: "scratch", ok: false, label: "scratch", detail: `${scratch.plan.safeAuto.length} aged item(s)`, fix: "run `mmi-cli doctor --apply`", verbose: scratchEvidence });
     }
   }
   const exitCode = doctorReportExitCode(checks);
@@ -26514,6 +26937,7 @@ pr.command("land <number>").description("agent merge path (#1440): train probe \
 jsonParity(pr.command("merge <number>").description("merge a PR (squash by default) and clean up its branch + worktree \u2014 no leftover local branch; on no-ci repos run pr ci-policy / checks-wait first (#1432)").option("--squash", "squash merge (default)").option("--merge", "create a merge commit").option("--rebase", "rebase merge").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--auto", "enable auto-merge \u2014 merge once the base-branch policy is satisfied (use for policy-gated repos)").option("--wait", `wait for checks to reach a terminal passing verdict before merging (default budget ${PR_CHECKS_TIMEOUT_MS / 6e4}m)`).option("--preserve-worktree", "keep the local PR worktree/stage/branch for an active multi-issue batch (#1888)").option("--force", "acknowledge and merge past a remaining prunable/severe scratch housekeeping block (advisory kept plans/ never blocks, #3012)")).action(async (number, o) => {
   const method = o.rebase ? "--rebase" : o.merge ? "--merge" : "--squash";
   const repoArgs = o.repo ? ["--repo", o.repo] : [];
+  const repoForPostCleanup = await resolveRepo(o.repo) ?? o.repo;
   const [headRef, baseRef, headRefOid] = (await execFileP2("gh", ["pr", "view", number, ...repoArgs, "--json", "headRefName,baseRefName,headRefOid", "--jq", '.headRefName + " " + .baseRefName + " " + (.headRefOid // "")'], { timeout: GC_GH_TIMEOUT_MS2 })).stdout.trim().split(/\s+/);
   const headIsProtected = isProtectedBranch(headRef);
   const startingPath = (await execFileP2("git", ["rev-parse", "--show-toplevel"], { timeout: GIT_TIMEOUT_MS }).catch(() => ({ stdout: "" }))).stdout.trim();
@@ -26589,18 +27013,37 @@ jsonParity(pr.command("merge <number>").description("merge a PR (squash by defau
     }
     if (!ghPrMergeLocalBranchDeleteWarning(message)) throw e;
   });
-  if (o.auto || upgradedToAuto) {
-    const state = (await execFileP2("gh", ["pr", "view", number, ...repoArgs, "--json", "state", "--jq", ".state"], { timeout: GC_GH_TIMEOUT_MS2 }).catch(() => ({ stdout: "" }))).stdout.trim();
-    if (state !== "MERGED") {
-      const enqueued = describePrMergeEnqueuedReason(await pollGhPrChecks(number, repoArgs).catch(() => void 0));
-      console.log(JSON.stringify({ mergeStatus: "auto-merge-enqueued", enqueuedReason: enqueued.reason, pr: number, branch: headRef, state: state || "unknown", upgradedToAuto: upgradedToAuto || void 0 }));
-      console.warn(`pr merge: PR #${number} is ENQUEUED, not merged \u2014 ${enqueued.message}.`);
-      if (upgradedToAuto && !o.auto) {
-        console.warn(`pr merge: exiting ${PR_MERGE_ENQUEUED_EXIT_CODE} so a chained command does not treat this as a completed merge.`);
-        process.exitCode = PR_MERGE_ENQUEUED_EXIT_CODE;
-      }
-      return;
+  const stateRead = await readGhPrStateWithRetry(
+    () => execFileP2("gh", ["pr", "view", number, ...repoArgs, "--json", "state", "--jq", ".state"], { timeout: GC_GH_TIMEOUT_MS2 }).then((r) => r.stdout)
+  );
+  const gate = decidePrMergeCleanupGate({
+    state: stateRead.ok ? stateRead.state : void 0,
+    stateError: stateRead.ok ? void 0 : stateRead.error,
+    autoRequested: Boolean(o.auto || upgradedToAuto)
+  });
+  if (gate.action === "enqueued") {
+    const state = stateRead.ok ? stateRead.state : "";
+    const enqueued = describePrMergeEnqueuedReason(await pollGhPrChecks(number, repoArgs).catch(() => void 0));
+    console.log(JSON.stringify({ mergeStatus: "auto-merge-enqueued", enqueuedReason: enqueued.reason, pr: number, branch: headRef, state: state || "unknown", upgradedToAuto: upgradedToAuto || void 0 }));
+    console.warn(`pr merge: PR #${number} is ENQUEUED, not merged \u2014 ${enqueued.message}.`);
+    if (upgradedToAuto && !o.auto) {
+      console.warn(`pr merge: exiting ${PR_MERGE_ENQUEUED_EXIT_CODE} so a chained command does not treat this as a completed merge.`);
+      process.exitCode = PR_MERGE_ENQUEUED_EXIT_CODE;
     }
+    return;
+  }
+  if (gate.action === "refuse") {
+    console.log(JSON.stringify({
+      mergeStatus: "not-merged",
+      reason: gate.reason,
+      pr: number,
+      branch: headRef,
+      state: stateRead.ok ? stateRead.state : "unknown",
+      cleanupStatus: "skipped"
+    }));
+    console.error(`pr merge: ${gate.message}. Nothing was deleted \u2014 re-check the PR and retry.`);
+    process.exitCode = 1;
+    return;
   }
   if (!remoteNotAttemptedReason) remoteDeleteAttempted = true;
   const remoteBranch = await buildPrMergeRemoteBranchCleanupReport(headRef, {
@@ -26641,7 +27084,7 @@ jsonParity(pr.command("merge <number>").description("merge a PR (squash by defau
       }
     };
   }
-  const boardAdvance = await advanceClosedIssuesToDone2(number, o.repo);
+  const boardAdvance = await advanceClosedIssuesToDone2(number, repoForPostCleanup);
   console.log(JSON.stringify({
     ...buildPrMergeResultPayload({
       number,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "3.56.0",
+  "version": "3.58.0",
   "description": "MMI Future CLI — the org dev toolbox (board, registry, keyless secrets, release train, bootstrap, doctor) and the cross-IDE engine the plugin's session-start hook drives.",
   "type": "module",
   "license": "UNLICENSED",
@@ -31,7 +31,7 @@
   },
   "scripts": {
     "build": "node build.mjs",
-    "test": "vitest run --reporter=default --reporter=../scripts/test-budget-reporter.mjs",
+    "test": "vitest run",
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {