@mutmutco/cli 3.75.0 → 3.76.0

package/dist/main.cjs

@@ -3579,7 +3579,12 @@ var ERROR_CODES = {
   /** Missing / rejected credentials on a path that needs auth. */
   ERR_NO_AUTH: "ERR_NO_AUTH",
   /** The operation partially succeeded (some units done, some failed). */
-  ERR_PARTIAL: "ERR_PARTIAL"
+  ERR_PARTIAL: "ERR_PARTIAL",
+  /** The request was well-formed and every referent resolved, but the target's CURRENT STATE forbids the
+   *  mutation (HTTP 409 semantics) — e.g. reparenting an issue that already has a parent. Deliberately not
+   *  one code per API constraint: retry is futile until the named state is changed, and that is the fact a
+   *  caller has to act on, whichever rule produced it. */
+  ERR_STATE_CONFLICT: "ERR_STATE_CONFLICT"
 };
 var ERROR_CODE_REFERENCE = [
   {
@@ -3621,6 +3626,11 @@ var ERROR_CODE_REFERENCE = [
     code: ERROR_CODES.ERR_PARTIAL,
     meaning: "A batch operation completed some units and failed others.",
     typical_fix: "Read the per-unit results, fix the failed inputs, and rerun only the failed units."
+  },
+  {
+    code: ERROR_CODES.ERR_STATE_CONFLICT,
+    meaning: "The request was valid and every referent resolved, but the target resource's current state forbids it.",
+    typical_fix: "A plain retry fails identically. Read the state field the envelope names (e.g. `current_parent`), change that state deliberately with the command that owns it, then retry."
   }
 ];
 function buildErrorEnvelope(message, payload) {
@@ -3629,6 +3639,7 @@ function buildErrorEnvelope(message, payload) {
   if (payload.expected !== void 0) env.expected = payload.expected;
   if (payload.did_you_mean !== void 0) env.did_you_mean = payload.did_you_mean;
   if (payload.corrected_command !== void 0) env.corrected_command = payload.corrected_command;
+  if (payload.current_parent !== void 0) env.current_parent = payload.current_parent;
   return env;
 }
 function formatErrorEnvelope(message, payload) {
@@ -4067,11 +4078,18 @@ function fail(msg, payload) {
   }
   hardExit(1);
 }
-function planMutation(opts, args, commandName, planFn) {
+async function failGracefulEnvelope(msg, payload) {
+  if (payload && argvWantsMachineFailure()) {
+    console.error(formatErrorEnvelope(msg, payload));
+    return cleanExit(1);
+  }
+  return failGraceful(msg);
+}
+async function planMutation(opts, args, commandName, planFn) {
   const validateOnly = opts.validateOnly === true;
   const dryRun = opts.dryRun === true;
   if (!validateOnly && !dryRun) return null;
-  const planned = planFn ? planFn(opts, args) : { command: commandName, args };
+  const planned = planFn ? await planFn(opts, args) : { command: commandName, args };
   return validateOnly ? { ok: true, planned } : { dry_run: true, planned };
 }
 function commandPath(cmd) {
@@ -4097,11 +4115,11 @@ function mutating(cmd, planFn) {
   cmd.option("--dry-run", "resolve + validate, print the planned action as JSON, and exit without writing");
   cmd.option("--validate-only", "validate flags/enums/refs, print {ok,planned} or the C2 error envelope, and exit without writing");
   const registerAction = cmd.action.bind(cmd);
-  cmd.action = ((handler) => registerAction((...actionArgs) => {
+  cmd.action = ((handler) => registerAction(async (...actionArgs) => {
     const command = actionArgs[actionArgs.length - 1];
     const opts = command.opts();
     const positionals = actionArgs.slice(0, -2);
-    const out = planMutation(opts, positionals, commandPath(command), planFn);
+    const out = await planMutation(opts, positionals, commandPath(command), planFn);
     if (out) {
       console.log(JSON.stringify(out));
       return;
@@ -4128,6 +4146,97 @@ function printLine(value) {
 `);
 }
 
+// src/issue-surface.ts
+var SURFACE_PREFIX = "surface:";
+var SURFACE_READ_TIMEOUT_MS = 1e4;
+function labelsCarrySurface(labels) {
+  return (labels ?? []).some((l) => l.trim().toLowerCase().startsWith(SURFACE_PREFIX));
+}
+function surfaceLabel(value) {
+  const v = value.trim();
+  return v.toLowerCase().startsWith(SURFACE_PREFIX) ? v : `${SURFACE_PREFIX}${v}`;
+}
+async function readRepoSurfaceLabels(repo, deps = {}) {
+  const run = deps.run ?? execFileP2;
+  try {
+    const { stdout } = await run(
+      "gh",
+      ["label", "list", "--repo", repo, "--limit", "1000", "--json", "name"],
+      { timeout: SURFACE_READ_TIMEOUT_MS }
+    );
+    const parsed = JSON.parse(stdout);
+    if (!Array.isArray(parsed)) return void 0;
+    return parsed.map((l) => l.name).filter((n) => typeof n === "string" && n.toLowerCase().startsWith(SURFACE_PREFIX));
+  } catch {
+    return void 0;
+  }
+}
+async function checkSurfaceRequirement(input, deps = {}) {
+  if (input.waiver) {
+    const reason = input.waiver.reason.trim();
+    if (!reason) {
+      return {
+        enforcing: false,
+        refusal: {
+          message: `${input.command ?? "issue create"}: a surface waiver without a reason is not a ruling \u2014 declare WHY this filing is genuinely surface-less, or drop the waiver and let the preflight run`,
+          payload: {
+            code: ERROR_CODES.ERR_MISSING_FLAG,
+            offending_flag: "waiver.reason",
+            expected: ["a non-empty waiver reason"]
+          }
+        }
+      };
+    }
+    return {
+      enforcing: false,
+      waiver: { applied: true, reason }
+    };
+  }
+  const read = deps.read ?? readRepoSurfaceLabels;
+  const known = await read(input.repo, { run: deps.run });
+  if (known === void 0) {
+    return {
+      enforcing: false,
+      warn: `warning: could not read ${input.repo}'s labels, so the surface-label requirement was not checked; if that board enforces one surface:* label per open issue, add one with \`mmi-cli issue edit <n> --add-label surface:<value>\``
+    };
+  }
+  if (known.length === 0) return { enforcing: false };
+  if (labelsCarrySurface(input.labels)) return { enforcing: true };
+  const command = input.command ?? "issue create";
+  const where = input.rowLabel ? `${input.rowLabel}: ` : "";
+  return {
+    enforcing: true,
+    refusal: {
+      message: `${command}: ${where}${input.repo} requires every open issue to carry exactly one surface:* label, and this one sets none \u2014 filing it unlabeled reds the board check on every open PR in that repo. Pass --surface <value>, or --no-surface if this filing is genuinely exempt`,
+      payload: {
+        code: ERROR_CODES.ERR_MISSING_FLAG,
+        offending_flag: "--surface",
+        // Advisory, not a closed enum: the board rule is "exactly one surface:* label", whatever its value.
+        expected: [...known].sort()
+      }
+    }
+  };
+}
+function conflictingSurfaceInputs(surfaceFlag, labels) {
+  if (!surfaceFlag) return void 0;
+  const wanted = surfaceLabel(surfaceFlag).toLowerCase();
+  const fromLabels = (labels ?? []).map((l) => l.trim()).filter((l) => l.toLowerCase().startsWith(SURFACE_PREFIX));
+  const disagreeing = fromLabels.filter((l) => l.toLowerCase() !== wanted);
+  if (!disagreeing.length) return void 0;
+  return {
+    message: `issue create: --surface ${surfaceLabel(surfaceFlag)} contradicts --label ${disagreeing.join(", ")} \u2014 an issue carries exactly one surface, so name it once`,
+    payload: {
+      code: ERROR_CODES.ERR_CONFLICTING_FLAGS,
+      offending_flag: "--surface",
+      expected: [surfaceLabel(surfaceFlag), ...disagreeing]
+    }
+  };
+}
+async function surfaceLabelApplies(repo, deps = {}) {
+  const known = await (deps.read ?? readRepoSurfaceLabels)(repo, { run: deps.run });
+  return (known?.length ?? 0) > 0;
+}
+
 // src/session-start.ts
 var import_node_fs8 = require("node:fs");
 var import_node_path6 = require("node:path");
@@ -6378,10 +6487,12 @@ async function primaryCheckoutRootOf(git2) {
     return void 0;
   }
 }
+var SHA_LIKE_RE = /^[0-9a-f]{7,40}$/i;
 function resolveWorktreeBase(from, remote) {
   const remotePrefix = `${remote}/`;
-  const fetchBranch = from.startsWith(remotePrefix) ? from.slice(remotePrefix.length) : void 0;
-  return { base: from, fetchBranch };
+  if (from.startsWith(remotePrefix)) return { base: from, fetchBranch: from.slice(remotePrefix.length) };
+  if (SHA_LIKE_RE.test(from)) return { base: from };
+  return { base: from, fetchBranch: from, preferRemote: `${remotePrefix}${from}` };
 }
 var GIT_CONFIG_LOCK_RE = /could not lock config file|unable to write upstream branch configuration/i;
 function isGitConfigLockError(error) {
@@ -6491,7 +6602,7 @@ function commandLadderHint() {
 }
 
 // src/index.ts
-var import_node_path31 = require("node:path");
+var import_node_path32 = require("node:path");
 
 // src/merge-ci-policy.ts
 function resolveMergeCiPolicy(input) {
@@ -6776,22 +6887,80 @@ function patchRulesetRequiredContexts(body, contexts) {
 function findProductRuleset(rulesets) {
   return rulesets.find((r) => r.name === PRODUCT_RULESET_NAME);
 }
-async function latestCompletedGateRun(repo, client, query) {
-  const res = await client.rest(
-    "GET",
-    `repos/${repo}/actions/workflows/gate.yml/runs?status=completed&per_page=1${query}`,
-    { timeoutMs: 2e4 }
-  );
-  return res?.workflow_runs?.[0];
+async function completedGateRuns(repo, client, query, perPage = 1, gateFiles = DEFAULT_GATE_FILES) {
+  const merged = [];
+  let lastError;
+  let anyRead = false;
+  for (const file of gateFiles) {
+    try {
+      const res = await client.rest(
+        "GET",
+        `repos/${repo}/actions/workflows/${encodeURIComponent(file)}/runs?status=completed&per_page=${perPage}${query}`,
+        { timeoutMs: 2e4 }
+      );
+      anyRead = true;
+      merged.push(...res?.workflow_runs ?? []);
+    } catch (e) {
+      lastError = e;
+    }
+  }
+  if (!anyRead && lastError) throw lastError;
+  return merged.sort((a, b) => Date.parse(b.updated_at ?? "") - Date.parse(a.updated_at ?? ""));
 }
-async function gateIsProvenGreen(repo, client, baseBranch) {
+var GATE_STREAK_PAGE = 30;
+var DEFAULT_GATE_FILES = ["gate.yml"];
+async function readDefaultBranchGate(repo, client, baseBranch, now = Date.now(), gateFiles = DEFAULT_GATE_FILES) {
+  const named = gateFiles.length === 1 ? gateFiles[0] : `[${gateFiles.join(", ")}]`;
+  let runs;
+  let onBaseBranch = true;
   try {
-    const onBase = await latestCompletedGateRun(repo, client, `&branch=${encodeURIComponent(baseBranch)}`);
-    const latest = onBase ?? await latestCompletedGateRun(repo, client, "");
-    return latest?.conclusion === "success";
-  } catch {
-    return false;
+    runs = await completedGateRuns(repo, client, `&branch=${encodeURIComponent(baseBranch)}`, GATE_STREAK_PAGE, gateFiles);
+    if (!runs.length) {
+      runs = await completedGateRuns(repo, client, "", GATE_STREAK_PAGE, gateFiles);
+      onBaseBranch = false;
+    }
+  } catch (e) {
+    return { state: "unknown", detail: `${named} run history unreadable \u2014 ${e.message}` };
+  }
+  const latest = runs[0];
+  if (!latest) {
+    return {
+      state: "unknown",
+      detail: `no completed ${named} run on ${baseBranch} or any branch \u2014 a freshly seeded gate and a gate that cannot pass look the same from here`
+    };
   }
+  const where = onBaseBranch ? baseBranch : `${latest.head_branch ?? "any branch"} (no completed run on ${baseBranch})`;
+  const common = {
+    conclusion: latest.conclusion ?? void 0,
+    branch: latest.head_branch ?? void 0,
+    runUrl: latest.html_url ?? void 0
+  };
+  if (latest.conclusion === "success") {
+    return { ...common, state: "green", detail: `latest completed ${named} run on ${where} succeeded at ${latest.updated_at ?? "unknown time"}` };
+  }
+  let since = latest;
+  let bounded = runs.length >= GATE_STREAK_PAGE;
+  for (const run of runs) {
+    if (run.conclusion === "success") {
+      bounded = false;
+      break;
+    }
+    since = run;
+  }
+  const sinceAt = since.updated_at ?? latest.updated_at ?? void 0;
+  const redDays = sinceAt ? Math.max(0, Math.floor((now - Date.parse(sinceAt)) / 864e5)) : void 0;
+  const age = redDays == null ? "unknown duration" : `${redDays} day${redDays === 1 ? "" : "s"}${bounded ? " or longer" : ""}`;
+  return {
+    ...common,
+    state: "red",
+    redSince: sinceAt,
+    redDays,
+    redSinceBounded: bounded,
+    detail: `gate.yml is failing on ${where} \u2014 ${latest.conclusion ?? "not successful"} since ${sinceAt ?? "an unknown time"} (${age})`
+  };
+}
+async function gateIsProvenGreen(repo, client, baseBranch, gateFiles = DEFAULT_GATE_FILES) {
+  return (await readDefaultBranchGate(repo, client, baseBranch, Date.now(), gateFiles)).state === "green";
 }
 async function activateProductRuleset(repo, rulesetBody, client, enforcement = "active") {
   const body = { ...rulesetBody, enforcement };
@@ -6919,6 +7088,16 @@ function collectPullRequestWorkflowContexts(workflows) {
   }
   return [...contexts].sort((a, b) => a.localeCompare(b));
 }
+function pathFilteredPullRequestWorkflows(workflows) {
+  const filtered = [];
+  for (const wf of workflows) {
+    if (!workflowTriggersPullRequest(wf.body)) continue;
+    const onBlock = extractOnBlock(wf.body);
+    if (!onBlock) continue;
+    if (/^\s*paths(-ignore)?\s*:/m.test(onBlock)) filtered.push(wf.path);
+  }
+  return filtered.sort((a, b) => a.localeCompare(b));
+}
 function contextsMatchRuleset(required, emitted) {
   if (required.size !== emitted.size) return false;
   for (const c of required) if (!emitted.has(c)) return false;
@@ -7732,29 +7911,32 @@ function decideSeedDelivery(branchRules) {
   if (gating.length) return { mode: "pr", reason: `base branch is protected (${gating.join(", ")}) \u2014 seed via a branch + PR` };
   return { mode: "direct", reason: "base branch is unprotected \u2014 direct PUT is safe" };
 }
-function planSeedDelivery(branchRules, slug, baseBranch) {
+function planSeedDelivery(branchRules, slug, baseBranch, branchPrefix = "bootstrap-seed") {
   const decision = decideSeedDelivery(branchRules);
   if (decision.mode === "pr") {
-    const branch = `bootstrap-seed-${slug}`;
+    const branch = `${branchPrefix}-${slug}`;
     return { mode: "pr", ref: branch, branch, reason: decision.reason };
   }
   return { mode: "direct", ref: baseBranch, reason: decision.reason };
 }
-function contentPutArgs(repo, path2, content, branch, sha) {
-  const args = [
+function contentPutBody(path2, content, branch, sha) {
+  const body = {
+    message: `bootstrap: seed ${path2}`,
+    content: Buffer.from(content, "utf8").toString("base64"),
+    branch
+  };
+  if (sha) body.sha = sha;
+  return body;
+}
+function contentPutInputArgs(repo, path2, inputFile) {
+  return [
     "api",
     "-X",
     "PUT",
     `repos/${repo}/contents/${path2.split("/").map(encodeURIComponent).join("/")}`,
-    "-f",
-    `message=bootstrap: seed ${path2}`,
-    "-f",
-    `content=${Buffer.from(content, "utf8").toString("base64")}`,
-    "-f",
-    `branch=${branch}`
+    "--input",
+    inputFile
   ];
-  if (sha) args.push("-f", `sha=${sha}`);
-  return args;
 }
 
 // src/ci-audit.ts
@@ -7764,6 +7946,9 @@ var PRODUCT_GATE_PATH = ".github/workflows/gate.yml";
 var PRODUCT_RULESET_REF = ".github/rulesets/mmi-product-required-checks.json";
 var GATE_TEMPLATE_SEED = "seed:gate.template.yml";
 var RULESET_TEMPLATE_SEED = "seed:mmi-product-required-checks.template.json";
+var RULESET_REFERENCE_MATCH_LABEL = "committed ruleset reference matches the live ruleset (#3816)";
+var GATE_GREEN_ON_BASE_LABEL = "gate is green on the default branch (#3819)";
+var RECONCILE_SEED_BRANCH_PREFIX = "ci-reconcile-ruleset-ref";
 function slugFromRepo(repo) {
   return (repo.includes("/") ? repo.split("/")[1] : repo).toLowerCase();
 }
@@ -7777,6 +7962,9 @@ function classifyRepo(repo, meta) {
 function rulesetStatusChecks(rulesets) {
   return new Set(rulesets.flatMap((ruleset) => (ruleset.rules || []).filter((rule) => rule.type === "required_status_checks").flatMap((rule) => rule.parameters?.required_status_checks || []).map((check) => check.context).filter((context) => Boolean(context))));
 }
+function sortedUnique(values) {
+  return [...new Set(values)].sort((a, b) => a.localeCompare(b));
+}
 async function restJson(deps, path2, fallback) {
   try {
     return await deps.client.rest("GET", path2) ?? fallback;
@@ -7820,6 +8008,11 @@ async function listWorkflowPaths(deps, repo, branch) {
     return e?.status === 404 ? [] : void 0;
   }
 }
+var AGENT_PR_BOOKKEEPING_CONTEXTS = /* @__PURE__ */ new Set(["guard", "verdict"]);
+function gateWorkflowFiles(prWorkflowPaths) {
+  const files = prWorkflowPaths.map((p) => p.slice(p.lastIndexOf("/") + 1)).filter((f) => f !== "agent-pr.yml");
+  return files.length ? files : DEFAULT_GATE_FILES;
+}
 async function resolveEmittedPrContexts(deps, repo, branch) {
   const paths = await listWorkflowPaths(deps, repo, branch) ?? [];
   const workflows = [];
@@ -7946,7 +8139,7 @@ async function auditRepoCi(repo, deps) {
     return emittedPrContexts;
   };
   if (explicitNoCi) {
-    const emitted = await getEmittedPrContexts();
+    const emitted = (await getEmittedPrContexts()).filter((c) => !AGENT_PR_BOOKKEEPING_CONTEXTS.has(c));
     if (emitted.length > 0) {
       checks.push({
         ok: false,
@@ -8001,6 +8194,34 @@ async function auditRepoCi(repo, deps) {
         });
       }
     }
+    const productRuleset = rulesets.find((r) => r.name === PRODUCT_RULESET_NAME);
+    const committedReferenceRaw = await fetchFileContent(deps, repo, baseBranch, PRODUCT_RULESET_REF);
+    if (productRuleset && committedReferenceRaw != null) {
+      let committedContexts = null;
+      try {
+        committedContexts = rulesetRequiredContexts(stripRulesetComment(committedReferenceRaw));
+      } catch {
+        committedContexts = null;
+      }
+      const live = sortedUnique(rulesetRequiredContexts(productRuleset));
+      const declared = committedContexts == null ? null : sortedUnique(committedContexts);
+      const aligned = declared != null && declared.length === live.length && declared.every((c, i) => c === live[i]);
+      checks.push({
+        ok: aligned,
+        label: RULESET_REFERENCE_MATCH_LABEL,
+        detail: aligned ? `[${live.join(", ")}] on both sides` : declared == null ? `${PRODUCT_RULESET_REF} on ${baseBranch} is not parseable JSON \u2014 it cannot be compared to the live ruleset` : `${PRODUCT_RULESET_REF} declares [${declared.join(", ")}] but the live ${PRODUCT_RULESET_NAME} ruleset requires [${live.join(", ")}]`,
+        remediation: aligned ? void 0 : `mmi-cli ci reconcile --repo ${repo} --apply`
+      });
+    }
+  }
+  if (deployableGated || repoClass === "hub") {
+    const gate = await readDefaultBranchGate(repo, deps.client, baseBranch, Date.now(), gateWorkflowFiles(prWorkflowPaths));
+    checks.push({
+      ok: gate.state !== "red",
+      label: GATE_GREEN_ON_BASE_LABEL,
+      detail: gate.state === "green" ? void 0 : gate.detail,
+      remediation: gate.state === "red" ? `Fix the gate in ${repo} \u2014 it blocks every PR there, and ${PRODUCT_RULESET_NAME} activation is held back by the #3694 guard until it is green${gate.runUrl ? ` (${gate.runUrl})` : ""}` : void 0
+    });
   }
   const workflowPaths = repoClass === "deployable" ? prWorkflowPaths : [];
   const { policy, reason } = resolveMergeCiPolicy({
@@ -8022,16 +8243,21 @@ async function auditRepoCi(repo, deps) {
       detail: `${policy} (${reason})`
     });
   }
+  const NO_CANCEL_WAIVER = /ci-audit:\s*allow-no-cancel-in-progress\b[^\n]*#\d+/i;
   if (deployableGated || repoClass === "hub") {
     const allPaths = await listWorkflowPaths(deps, repo, baseBranch) ?? [];
     const prPaths = await filterPullRequestTriggered(deps, repo, baseBranch, allPaths);
     const missing = [];
+    const waived = [];
     const gateBodies = [];
     for (const path2 of prPaths) {
       const body = await fetchFileContent(deps, repo, baseBranch, path2);
       if (body == null) continue;
       if (isGateWorkflowPath(path2)) gateBodies.push({ path: path2, body });
-      if (!/^\s*concurrency:/m.test(body) || !/cancel-in-progress:\s*true/.test(body)) missing.push(path2);
+      if (!/^\s*concurrency:/m.test(body) || !/cancel-in-progress:\s*true/.test(body)) {
+        if (NO_CANCEL_WAIVER.test(body)) waived.push(path2);
+        else missing.push(path2);
+      }
     }
     if (gateBodies.length > 0) {
       const budget = checkGateBudget(gateBodies, { hubLocalAllowed: repoClass === "hub" });
@@ -8043,10 +8269,14 @@ async function auditRepoCi(repo, deps) {
       });
     }
     if (prPaths.length > 0) {
+      const waivedNote = waived.length ? `${waived.length} waived by declared marker: ${waived.join(", ")}` : void 0;
       checks.push({
         ok: missing.length === 0,
         label: "PR workflows cancel superseded runs (#3001)",
-        detail: missing.length ? `missing per-PR concurrency cancel-in-progress: ${missing.join(", ")}` : void 0,
+        detail: [
+          missing.length ? `missing per-PR concurrency cancel-in-progress: ${missing.join(", ")}` : void 0,
+          waivedNote
+        ].filter(Boolean).join("; ") || void 0,
         remediation: missing.length ? `Add the per-PR concurrency block from skills/bootstrap/seeds/gate.template.yml (group: <workflow>-PR-or-ref, cancel-in-progress: true) to: ${missing.join(", ")}` : void 0
       });
     }
@@ -8070,24 +8300,38 @@ async function auditRepoCi(repo, deps) {
   const ok = checks.every((c) => c.ok);
   return { repo, class: repoClass, mergePolicy: policy, ok, checks, explicitNoCi };
 }
+var REGISTRY_UNREADABLE_DETAIL = `the registry roster read returned nothing \u2014 the fleet was NOT audited. 0 repos read from the registry; the number left unaudited is unknown because the roster is what names them. This is "cannot audit the fleet", never "the fleet is green". Under GitHub Actions the CLI needs a CI Hub session (MMI_HUB_TOKEN, minted from the job's OIDC claim via POST /auth/session-ci) \u2014 an App installation token has no /user identity and can never pass /auth/session (#3215).`;
 async function auditOrgCi(deps, repoFilter) {
+  if (repoFilter) {
+    const report = await auditRepoCi(repoFilter, deps);
+    return { ok: report.ok, scope: "single-repo", repos: [report] };
+  }
   const projects = await deps.listProjects();
-  if (!projects) {
-    const single = repoFilter ?? HUB_REPO;
-    const report = await auditRepoCi(single, deps);
-    return { ok: report.ok, repos: [report] };
+  if (!projects || projects.length === 0) {
+    return { ok: false, scope: "registry-unreadable", repos: [], scopeDetail: REGISTRY_UNREADABLE_DETAIL };
   }
-  const targets = repoFilter ? [repoFilter] : collectRegistryRepos(projects);
+  const targets = collectRegistryRepos(projects);
   const repos = [];
   for (const repo of targets) {
     repos.push(await auditRepoCi(repo, deps));
   }
-  return { ok: repos.every((r) => r.ok), repos };
+  return { ok: repos.every((r) => r.ok), scope: "fleet", repos };
+}
+function renderCiAuditScopeLine(report) {
+  if (report.scope === "registry-unreadable") {
+    return `scope: REGISTRY UNREADABLE \u2014 repos audited: 0 \u2014 ${report.scopeDetail ?? REGISTRY_UNREADABLE_DETAIL}`;
+  }
+  if (report.scope === "single-repo") {
+    return `scope: single-repo (explicit --repo) \u2014 repos audited: ${report.repos.length} \u2014 this is NOT a fleet verdict`;
+  }
+  return `scope: fleet (registry roster) \u2014 repos audited: ${report.repos.length}`;
 }
 function renderCiAuditMarkdown(report) {
   const lines = [
     `# CI merge-readiness audit`,
     "",
+    renderCiAuditScopeLine(report),
+    "",
     `Fleet: ${report.ok ? "OK" : "GAPS"} (${report.repos.filter((r) => r.ok).length}/${report.repos.length} repos ready)`,
     "",
     "| Repo | Class | Policy | OK | Top gap |",
@@ -8100,7 +8344,10 @@ function renderCiAuditMarkdown(report) {
   return lines.join("\n");
 }
 function renderCiAuditText(report) {
-  const lines = [`mmi-cli ci audit: ${report.ok ? "OK" : "GAPS"} (${report.repos.length} repos)`];
+  const lines = [
+    `mmi-cli ci audit: ${report.ok ? "OK" : "GAPS"} (${report.repos.length} repos)`,
+    renderCiAuditScopeLine(report)
+  ];
   for (const r of report.repos) {
     lines.push(`
 ${r.repo} (${r.class}, policy=${r.mergePolicy}) ${r.ok ? "OK" : "GAP"}`);
@@ -8148,6 +8395,17 @@ async function fetchRulesetSeedBody(deps, repo) {
     return null;
   }
 }
+async function readLiveProductContexts(deps, repo) {
+  try {
+    const list = await deps.client.rest("GET", `repos/${repo}/rulesets`, { timeoutMs: 2e4 });
+    const existing = findProductRuleset(list ?? []);
+    if (existing?.id == null) return null;
+    const detail = await deps.client.rest("GET", `repos/${repo}/rulesets/${existing.id}`, { timeoutMs: 2e4 });
+    return sortedUnique(rulesetRequiredContexts(detail));
+  } catch {
+    return null;
+  }
+}
 async function contentSha(deps, repo, branch, path2) {
   try {
     const encodedPath = path2.split("/").map(encodeURIComponent).join("/");
@@ -8173,48 +8431,101 @@ async function putSeedFile(deps, repo, path2, content, branch) {
   if (sha) body.sha = sha;
   await deps.client.rest("PUT", `repos/${repo}/contents/${encodedPath}`, { body });
 }
+async function deliverSeedFile(deps, repo, path2, content, baseBranch) {
+  let branchRules = [];
+  try {
+    branchRules = await deps.client.rest("GET", `repos/${repo}/rules/branches/${encodeURIComponent(baseBranch)}`);
+  } catch {
+    branchRules = [];
+  }
+  const plan = planSeedDelivery(branchRules, slugFromRepo(repo), baseBranch, RECONCILE_SEED_BRANCH_PREFIX);
+  if (plan.mode === "direct" || !plan.branch) {
+    await putSeedFile(deps, repo, path2, content, baseBranch);
+    return { plan };
+  }
+  const head = await deps.client.rest("GET", `repos/${repo}/git/ref/heads/${encodeURIComponent(baseBranch)}`);
+  const sha = head?.object?.sha;
+  if (!sha) throw new Error(`cannot resolve ${baseBranch} head on ${repo} \u2014 seed branch not cut`);
+  try {
+    await deps.client.rest("POST", `repos/${repo}/git/refs`, { body: { ref: `refs/heads/${plan.branch}`, sha } });
+  } catch (e) {
+    if (!/Reference already exists|already exists/i.test(String(e.message ?? ""))) throw e;
+  }
+  await putSeedFile(deps, repo, path2, content, plan.branch);
+  const owner = repo.includes("/") ? repo.split("/")[0] : "mutmutco";
+  const open2 = await deps.client.rest(
+    "GET",
+    `repos/${repo}/pulls?state=open&base=${encodeURIComponent(baseBranch)}&head=${encodeURIComponent(`${owner}:${plan.branch}`)}`
+  ).catch(() => []);
+  const decision = decideSeedPrAction((open2 ?? []).map((pr2) => ({ url: pr2?.html_url })));
+  if (decision.action === "reuse") return { plan, prUrl: decision.url };
+  const created = await deps.client.rest("POST", `repos/${repo}/pulls`, {
+    body: {
+      title: `chore: reconcile ${path2} with the live ${PRODUCT_RULESET_NAME} ruleset (#3816)`,
+      head: plan.branch,
+      base: baseBranch,
+      body: `\`mmi-cli ci reconcile --apply\` brings this repo's committed ruleset reference into agreement with its LIVE \`${PRODUCT_RULESET_NAME}\` ruleset.
+
+The base branch is protected, so the reference cannot be written directly \u2014 the same branch+PR seed delivery \`bootstrap apply\` uses (#2286.1). Refs mutmutco/MMI-Hub#3816.
+`
+    }
+  });
+  return { plan, prUrl: created?.html_url };
+}
 async function seedGateYml(repo, deps, meta, result) {
   const baseBranch = "development";
   const releaseTrack = isReleaseTrack(meta?.releaseTrack) ? meta?.releaseTrack : void 0;
   const parsed = parseOwnerRepo(repo);
+  const refOnlyVars = () => withDerivedRepoVars({ REPO_SLUG: parsed.slug }, parsed, "deployable", releaseTrack);
   if (await contentExists(deps, repo, baseBranch, PRODUCT_GATE_PATH)) {
-    await seedRulesetRefIfMissing(repo, deps, withDerivedRepoVars({ REPO_SLUG: parsed.slug }, parsed, "deployable", releaseTrack), baseBranch, result);
-    return;
+    return await seedRulesetRefIfMissing(repo, deps, refOnlyVars(), baseBranch, result);
   }
   if (!deps.readSeedFile && !deps.renderSeed) {
     result.skipped.push(`gate.yml missing but no seed-template source wired \u2014 run bootstrap apply`);
-    return;
+    return "none";
+  }
+  const prTriggered = await prTriggeredWorkflowsOnRef(deps, repo, baseBranch, "deployable");
+  if (prTriggered === void 0) {
+    result.skipped.push("gate.yml missing and the workflows listing is unreadable \u2014 never seeding a gate on UNKNOWN");
+    return "none";
+  }
+  if (prTriggered.length > 0) {
+    return await seedRulesetRefIfMissing(repo, deps, refOnlyVars(), baseBranch, result);
   }
   const gate = meta?.gate;
   if (!gate || typeof gate === "object" && Object.keys(gate).length === 0) {
     result.skipped.push(`gate.yml missing \u2014 no registry gate config; set \`mmi-cli org project set ${repo} --var gate={...}\` first, then re-run reconcile`);
-    return;
+    return "none";
   }
   const derivedVars = withDerivedRepoVars({ ...gateConfigToVars(gate), REPO_SLUG: parsed.slug }, parsed, "deployable", releaseTrack);
   const rendered = renderSeedBody(deps, GATE_TEMPLATE_SEED, PRODUCT_GATE_PATH, derivedVars);
   if (rendered == null) {
     result.errors.push(`gate.yml re-seed: could not render ${GATE_TEMPLATE_SEED} (template unreadable or unfilled)`);
-    return;
+    return "none";
   }
   try {
     await putSeedFile(deps, repo, PRODUCT_GATE_PATH, rendered, baseBranch);
     result.applied.push(`seeded ${PRODUCT_GATE_PATH}`);
   } catch (e) {
     result.errors.push(`gate.yml re-seed failed: ${e.message}`);
-    return;
+    return "none";
   }
-  await seedRulesetRefIfMissing(repo, deps, derivedVars, baseBranch, result);
+  return await seedRulesetRefIfMissing(repo, deps, derivedVars, baseBranch, result);
 }
 async function seedRulesetRefIfMissing(repo, deps, derivedVars, baseBranch, result) {
-  if (await contentExists(deps, repo, baseBranch, PRODUCT_RULESET_REF)) return;
-  if (!deps.readSeedFile && !deps.renderSeed) return;
+  if (await contentExists(deps, repo, baseBranch, PRODUCT_RULESET_REF)) return "committed";
+  if (!deps.readSeedFile && !deps.renderSeed) return "none";
   const rulesetBody = renderSeedBody(deps, RULESET_TEMPLATE_SEED, PRODUCT_RULESET_REF, derivedVars);
-  if (rulesetBody == null) return;
+  if (rulesetBody == null) return "none";
   try {
-    await putSeedFile(deps, repo, PRODUCT_RULESET_REF, rulesetBody, baseBranch);
-    result.applied.push(`seeded ${PRODUCT_RULESET_REF}`);
+    const { plan, prUrl } = await deliverSeedFile(deps, repo, PRODUCT_RULESET_REF, rulesetBody, baseBranch);
+    result.applied.push(
+      `seeded ${PRODUCT_RULESET_REF}` + (plan.mode === "direct" ? ` (committed to ${baseBranch})` : ` (${plan.reason}${prUrl ? ` \u2014 ${prUrl}` : ""})`)
+    );
+    return plan.mode === "direct" ? "committed" : "pending";
   } catch (e) {
     result.errors.push(`ruleset reference seed failed: ${e.message}`);
+    return "none";
   }
 }
 async function parkProductRuleset(repo, deps) {
@@ -8248,19 +8559,47 @@ async function applyCiReconcileRepo(repo, deps) {
   const meta = await deps.getProjectMeta(slugFromRepo(repo));
   const report = await auditRepoCi(repo, deps);
   if (report.class !== "deployable" || report.explicitNoCi) return merge;
-  await seedGateYml(repo, deps, meta, merge);
+  const refDelivery = await seedGateYml(repo, deps, meta, merge);
+  const baseBranch = "development";
   const driftCheck = report.checks.find((c) => c.label === "required check contexts match PR workflows");
   const requiredCheck = report.checks.find((c) => c.label === "product required status checks active");
-  if (requiredCheck?.ok && (driftCheck?.ok ?? true)) {
-    merge.skipped.push("product ruleset already active and aligned");
+  const referenceCheck = report.checks.find((c) => c.label === RULESET_REFERENCE_MATCH_LABEL);
+  if (requiredCheck?.ok && (driftCheck?.ok ?? true) && (referenceCheck?.ok ?? true)) {
+    merge.skipped.push("product ruleset already active, aligned, and matching its committed reference");
     return merge;
   }
   const raw = await fetchRulesetSeedBody(deps, repo);
   if (!raw) {
-    merge.errors.push(`missing ${PRODUCT_RULESET_REF} on development \u2014 run bootstrap apply first`);
+    if (refDelivery === "pending") {
+      merge.skipped.push(
+        `${PRODUCT_RULESET_REF} was delivered on a seed branch this run \u2014 the base branch is protected, so it lands when that PR merges; re-run the reconcile then to activate the ruleset`
+      );
+    } else {
+      merge.errors.push(`missing ${PRODUCT_RULESET_REF} on development \u2014 run bootstrap apply first`);
+    }
     return merge;
   }
-  if (!await gateIsProvenGreen(repo, deps.client, "development")) {
+  const activationNeeded = !requiredCheck?.ok || !(driftCheck?.ok ?? true);
+  const prWorkflows = await prTriggeredWorkflowsOnRef(deps, repo, baseBranch, "deployable") ?? [];
+  const gateFiles = gateWorkflowFiles(prWorkflows);
+  const allPrWorkflows = await listWorkflowPaths(deps, repo, baseBranch) ?? [];
+  if (activationNeeded) {
+    const bodies = [];
+    for (const path2 of allPrWorkflows) {
+      const body = await fetchFileContent(deps, repo, baseBranch, path2);
+      if (body) bodies.push({ path: path2, body });
+    }
+    const filteredPaths = new Set(pathFilteredPullRequestWorkflows(bodies).filter((p) => !p.endsWith("/agent-pr.yml")));
+    const safeContexts = new Set(collectPullRequestWorkflowContexts(bodies.filter((b) => !filteredPaths.has(b.path))));
+    const unsafe = collectPullRequestWorkflowContexts(bodies.filter((b) => filteredPaths.has(b.path))).filter((c) => !safeContexts.has(c));
+    if (unsafe.length) {
+      merge.skipped.push(
+        `product ruleset left non-enforcing \u2014 [${unsafe.join(", ")}] ${unsafe.length === 1 ? "is" : "are"} emitted ONLY by path-filtered workflow(s) (${[...filteredPaths].join(", ")}), so the context is not reported on a PR outside those paths and requiring it would block that PR forever (#3836). Give the gate a companion job that runs unconditionally, then re-run this command`
+      );
+      return merge;
+    }
+  }
+  if (activationNeeded && !await gateIsProvenGreen(repo, deps.client, baseBranch, gateFiles)) {
     merge.skipped.push(
       "product ruleset left non-enforcing \u2014 the gate is not green on development; activating it would block every PR (#3694)"
     );
@@ -8268,29 +8607,55 @@ async function applyCiReconcileRepo(repo, deps) {
   }
   try {
     let body = stripRulesetComment(raw);
-    if (!driftCheck?.ok) {
-      const baseBranch = "development";
+    let targetContexts;
+    if (!(driftCheck?.ok ?? true)) {
       const emitted = registryRequiredContexts(meta) ?? await resolveEmittedPrContexts(deps, repo, baseBranch);
       if (!emitted.length) {
         merge.errors.push("cannot reconcile ruleset contexts \u2014 no PR workflow job ids found");
         return merge;
       }
+      targetContexts = emitted;
       body = patchRulesetRequiredContexts(body, emitted);
-      const activation2 = await activateProductRuleset(repo, body, deps.client);
-      if (activation2.action === "skipped") merge.skipped.push(activation2.detail ?? "product ruleset");
-      else merge.applied.push(`product ruleset ${activation2.action}${activation2.detail ? `: ${activation2.detail}` : ""}`);
+    } else if (!(referenceCheck?.ok ?? true)) {
+      const live = await readLiveProductContexts(deps, repo);
+      if (live == null) {
+        merge.errors.push(`cannot read the live ${PRODUCT_RULESET_NAME} ruleset \u2014 ${PRODUCT_RULESET_REF} left untouched`);
+        return merge;
+      }
+      targetContexts = live;
+      body = patchRulesetRequiredContexts(body, live);
+    } else {
+      targetContexts = rulesetRequiredContexts(body);
+    }
+    if (!(referenceCheck?.ok ?? true) || !(driftCheck?.ok ?? true)) {
+      let comment;
       try {
-        await putSeedFile(deps, repo, PRODUCT_RULESET_REF, `${JSON.stringify(body, null, 2)}
-`, baseBranch);
-        merge.applied.push(`reconciled ${PRODUCT_RULESET_REF} contexts \u2192 [${emitted.join(", ")}]`);
+        comment = JSON.parse(raw)._comment;
+      } catch {
+        comment = void 0;
+      }
+      const fileBody = comment === void 0 ? body : { _comment: comment, ...body };
+      try {
+        const { plan, prUrl } = await deliverSeedFile(
+          deps,
+          repo,
+          PRODUCT_RULESET_REF,
+          `${JSON.stringify(fileBody, null, 2)}
+`,
+          baseBranch
+        );
+        merge.applied.push(
+          plan.mode === "pr" ? `${PRODUCT_RULESET_REF} contexts \u2192 [${targetContexts.join(", ")}] delivered on ${plan.branch} (${plan.reason})${prUrl ? `: ${prUrl}` : ""}` : `reconciled ${PRODUCT_RULESET_REF} contexts \u2192 [${targetContexts.join(", ")}]`
+        );
       } catch (e) {
-        merge.errors.push(`ruleset reference commit failed (live ruleset updated): ${e.message}`);
+        merge.errors.push(`ruleset reference delivery failed: ${e.message}`);
       }
-      return merge;
     }
-    const activation = await activateProductRuleset(repo, body, deps.client);
-    if (activation.action === "skipped") merge.skipped.push(activation.detail ?? "product ruleset");
-    else merge.applied.push(`product ruleset ${activation.action}${activation.detail ? `: ${activation.detail}` : ""}`);
+    if (activationNeeded) {
+      const activation = await activateProductRuleset(repo, body, deps.client);
+      if (activation.action === "skipped") merge.skipped.push(activation.detail ?? "product ruleset");
+      else merge.applied.push(`product ruleset ${activation.action}${activation.detail ? `: ${activation.detail}` : ""}`);
+    }
   } catch (e) {
     merge.errors.push(e.message);
   }
@@ -9147,7 +9512,7 @@ async function executeWaveLand(plan, deps, opts = { preserveWorktree: true }) {
 }
 
 // src/index.ts
-var import_node_os12 = require("node:os");
+var import_node_os13 = require("node:os");
 
 // src/board.ts
 var import_node_child_process8 = require("node:child_process");
@@ -11079,6 +11444,16 @@ async function fetchSecretForUse(deps, { repo, key, slug }) {
 
 // src/report.ts
 var HUB_REPO2 = "mutmutco/MMI-Hub";
+var REPORT_LABEL = "report";
+var REPORT_SURFACE_WAIVER_REASON = "Hub-only friction filing; attribution repo is footer-only; no honest single surface";
+function preflightReportSurface() {
+  return checkSurfaceRequirement({
+    repo: HUB_REPO2,
+    labels: [REPORT_LABEL],
+    command: "report",
+    waiver: { reason: REPORT_SURFACE_WAIVER_REASON }
+  });
+}
 function findDuplicateReport(source, openReports, threshold = 0.6) {
   const normalizedTitle = normalizeTitle(source.title);
   let best;
@@ -11561,6 +11936,49 @@ function resolveParentField(payload) {
   const parsed = typeof raw === "string" ? parseParentIssueUrl(raw) : null;
   return parsed ? { parent: parsed } : { parentReadError: `unrecognised parent_issue_url: ${JSON.stringify(raw)}` };
 }
+async function readIssueParent(runGh, repo, number) {
+  try {
+    const stdout = await runGh(["api", `repos/${repo}/issues/${number}`], RESOLVE_ID_TIMEOUT_MS);
+    const resolved = resolveParentField(JSON.parse(stdout));
+    return "parent" in resolved ? resolved.parent : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function isParentConflictMessage(text) {
+  return typeof text === "string" && /sub[- ]?issue may only have one parent/i.test(text);
+}
+function buildReparentConflictPayload(input) {
+  const { childRepo, childNumber, requestedParent, currentParent, offendingFlag } = input;
+  const child2 = `${childRepo}#${childNumber}`;
+  const payload = { code: ERROR_CODES.ERR_STATE_CONFLICT };
+  if (offendingFlag) payload.offending_flag = offendingFlag;
+  if (!currentParent) {
+    return {
+      message: currentParent === null ? `${child2} cannot be reparented under ${requestedParent} \u2014 GitHub refused it under the one-parent rule, but reading the issue back showed no parent at all. Something changed it concurrently; re-read with \`mmi-cli issue view ${childNumber} --repo ${childRepo}\` and retry` : `${child2} cannot be reparented under ${requestedParent} \u2014 GitHub allows a sub-issue exactly one parent and it already has one. Its current parent could not be read; check with \`mmi-cli issue view ${childNumber} --repo ${childRepo}\``,
+      payload
+    };
+  }
+  const current = `${currentParent.repo}#${currentParent.number}`;
+  const sameRepo2 = currentParent.repo.toLowerCase() === childRepo.toLowerCase();
+  const repoFlag = ` --repo ${childRepo}`;
+  payload.current_parent = current;
+  const requested = parseIssueRef(requestedParent);
+  const alreadyThere = currentParent.number === requested.number && (requested.repo ?? childRepo).toLowerCase() === currentParent.repo.toLowerCase();
+  if (!alreadyThere) {
+    payload.corrected_command = `mmi-cli issue unlink-child ${sameRepo2 ? String(currentParent.number) : current} ${childNumber}${repoFlag} && mmi-cli issue edit ${childNumber}${repoFlag} --parent ${requestedParent}`;
+  }
+  return {
+    message: alreadyThere ? `${child2} is already a sub-issue of ${current} \u2014 GitHub allows a sub-issue exactly one parent, so this reparent is a no-op it refuses rather than performs; nothing to do` : `${child2} already has a parent (${current}) \u2014 GitHub allows a sub-issue exactly one parent. Reparenting it under ${requestedParent} would REMOVE it from ${current}; unlink it there first if that is what you want`,
+    payload
+  };
+}
+async function classifyReparentFailure(e, runGh, childRepo, childNumber, requestedParent, offendingFlag) {
+  const err = e;
+  if (!isParentConflictMessage((err.stderr || err.message || String(e)).trim())) return void 0;
+  const currentParent = await readIssueParent(runGh, childRepo, childNumber);
+  return buildReparentConflictPayload({ childRepo, childNumber, requestedParent, currentParent, offendingFlag });
+}
 function parentLinkFields(result, error) {
   if (result) return { parent: result };
   if (error) return { parentLinkError: error };
@@ -15164,17 +15582,23 @@ function partialTrainRecoveryError(cause, input) {
   const causeMessage = cause instanceof Error ? cause.message : String(cause);
   const branch = input.stage;
   const releaseState = input.stage === "rc" ? "GitHub Release n/a" : "GitHub Release not created";
-  const releaseCommand = input.stage === "main" ? `
-  2. gh release create ${input.tag} --target main --generate-notes --latest --repo ${input.repo}` : "";
-  const deployStep = input.stage === "main" ? "3" : "2";
+  const tenant2 = input.deployModel === "tenant-container";
+  const deployLine = tenant2 ? `  - deploy: dispatched by the train after the branch push; recover with \`mmi-cli runtime tenant redeploy ${input.repo} ${input.stage} --watch\` once the branch and release exist.` : `  - deploy: this repo is \`${input.deployModel ?? "not tenant-container"}\` \u2014 it has NO tenant runtime. Its own release/main-push workflows publish and deploy once the branch and Release exist. Do NOT run the tenant redeployer.`;
   return new Error(
     `${causeMessage}
 
-partial train state: tag ${input.tag} is already pushed; origin/${branch} has not been pushed; ${releaseState}; deploy not dispatched.
-Recovery sequence:
-  1. git push origin ${branch}` + releaseCommand + `
-  ${deployStep}. mmi-cli runtime tenant redeploy ${input.repo} ${input.stage} --watch
-Do not delete or force-move the pushed tag; rerun the train only after confirming the branch, release, and deploy states above.`
+partial train state for ${input.tag}:
+  - tag ${input.tag}: PUSHED to origin
+  - origin/${branch}: NOT pushed
+  - ${releaseState}
+` + deployLine + `
+
+The tag is public and correct \u2014 do not delete or force-move it.
+
+Resume it:  mmi-cli release --resume${input.stage === "main" ? "" : "   (main-stage partials only)"}
+
+That completes THIS release at ${input.tag} \u2014 branch push, GitHub Release, the deploy path named above, then the development roll-forward. It preserves the version and refuses unless the partial state is proven (tag on origin, not on origin/main, no Release).
+Do NOT rerun the train instead: with ${input.tag} on origin the cycle resolver returns the NEXT version, so a rerun cuts a second release rather than finishing this one \u2014 and MMI_RELEASE_VERSION cannot pin it back, because it refuses a version that is not ahead of the latest tag, which ${input.tag} now is.`
   );
 }
 async function probeRemoteTag(deps, tag) {
@@ -15349,6 +15773,10 @@ async function watchOwnWorkflowRuns(deps, repo, targets, since, headSha, enumera
   workflowRuns.push(...await discoverShaWorkflowRuns(deps, repo, headSha, seen));
   return workflowRuns;
 }
+async function enumerateOwnWorkflowRuns(deps, repo, headSha) {
+  const runs = await discoverShaWorkflowRuns(deps, repo, headSha, /* @__PURE__ */ new Set());
+  return runs.length ? runs : [{ workflow: `sha-enumeration(${headSha.slice(0, 7)}) no runs yet`, conclusion: "pending" }];
+}
 var NON_DEPLOY_EVENTS = /* @__PURE__ */ new Set([
   "pull_request",
   "pull_request_target",
@@ -15425,7 +15853,11 @@ async function dispatchDeploy(deps, ctx, stage, ref, model, watch, autoRunSince,
   }
   if (model === "registry-publish") {
     const note = ref === "rc" ? "no dispatch on rc: registry-publish repos have no rc-stage Release to publish from" : "no central dispatch: this repo's own publish.yml auto-fires on the published Release (#2428)";
-    if (ref === "rc" || !watch || !autoRunHeadSha) return { note, deployStatus: "pending" };
+    if (ref === "rc" || !autoRunHeadSha) return { note, deployStatus: "pending" };
+    if (!watch) {
+      const listed = await enumerateOwnWorkflowRuns(deps, ctx.repo, autoRunHeadSha);
+      return { note, workflowRuns: listed, deployStatus: aggregateWorkflowRuns(listed) };
+    }
     const since = autoRunSince ?? (deps.now ?? Date.now)();
     const workflowRuns = await watchOwnWorkflowRuns(
       deps,
@@ -15440,8 +15872,12 @@ async function dispatchDeploy(deps, ctx, stage, ref, model, watch, autoRunSince,
   }
   if (model === "hub-serverless") {
     const note = ref === "rc" ? "no manual dispatch: deploy.yml auto-fires on the rc push (rc stage)" : "no manual dispatch: deploy.yml + publish.yml auto-fire on the published Release (prod)";
-    if (!watch) return { note, deployStatus: "pending" };
     if (!autoRunHeadSha) return { note, deployStatus: "pending" };
+    if (!watch) {
+      if (ref === "rc") return { note, deployStatus: "pending" };
+      const listed = await enumerateOwnWorkflowRuns(deps, HUB_REPO3, autoRunHeadSha);
+      return { note, workflowRuns: listed, deployStatus: aggregateWorkflowRuns(listed) };
+    }
     const since = autoRunSince ?? (deps.now ?? Date.now)();
     const targets = ref === "rc" ? [{ workflow: "deploy.yml", event: "push", branch: "rc" }] : [
       { workflow: "deploy.yml", event: "release" },
@@ -15747,7 +16183,7 @@ async function completeMainRelease(deps, ctx, meta, deployModel, watch, options,
   try {
     checks = await waitForRequiredTrainChecks(deps, ctx, releaseSha, requiredChecks, tagPush.pushed ? tagPushSince : void 0);
   } catch (e) {
-    throw partialTrainRecoveryError(e, { repo: ctx.repo, tag, stage: "main" });
+    throw partialTrainRecoveryError(e, { repo: ctx.repo, tag, stage: "main", deployModel });
   }
   if (trueMergeGateNote) checks = `${trueMergeGateNote}; ${checks}`;
   await runGitPush(deps, ["push", "origin", "main"]);
@@ -15767,6 +16203,61 @@ async function completeMainRelease(deps, ctx, meta, deployModel, watch, options,
   }
   return { checks, releaseUrl, announceNote, dispatch };
 }
+async function runReleaseResume(deps, options = {}) {
+  const watch = options.watch ?? false;
+  const ctx = await buildTrainApplyContext(deps);
+  await requireCleanTree(deps);
+  await runGitRemoteRead(deps, ["fetch", "origin", "--tags"]);
+  const meta = requireProjectMetaForTrain(await loadProjectMeta(deps, ctx), ctx.repo);
+  const deployModel = await preflight(deps, ctx, "main", meta);
+  const tags = clean2(await deps.run("git", ["tag", "--list", "v*", "--sort=-v:refname"])).split("\n").map((t) => t.trim()).filter(Boolean);
+  const tag = tags[0];
+  if (!tag) throw new Error("release --resume: no v* tag found \u2014 there is no partial release to resume");
+  const tagSha = await probeRemoteTag(deps, tag);
+  if (!tagSha) {
+    throw new Error(
+      `release --resume: ${tag} is not on origin \u2014 nothing was partially released. A local-only tag is not a partial release; run the train normally.`
+    );
+  }
+  const base = { command: "release-resume", repo: ctx.repo, tag, tagSha, deployModel };
+  if (!await isStrayUnreleasedTag(deps, tag, tagSha, ctx.repo)) {
+    throw new Error(
+      `release --resume: ${tag} is NOT a resumable partial \u2014 it is either already reachable from origin/main or it already has a GitHub Release, which means that release completed. (This probe also answers "not resumable" when it cannot prove otherwise \u2014 an unreadable Release or a failed ancestry check is never treated as safe to resume.) Nothing was written.`
+    );
+  }
+  try {
+    await deps.run("git", ["merge-base", "--is-ancestor", "origin/main", tagSha]);
+  } catch {
+    throw new Error(
+      `release --resume: origin/main is not an ancestor of ${tag} (${tagSha.slice(0, 12)}) \u2014 main has moved on since the partial release, so finishing it here would not be a fast-forward. Resolve by hand; nothing was written.`
+    );
+  }
+  const steps = [];
+  await runGitPush(deps, ["push", "origin", `${tagSha}:refs/heads/main`]);
+  steps.push(`pushed ${tagSha.slice(0, 12)} to origin/main`);
+  const releaseUrl = clean2(await deps.run("gh", ["release", "create", tag, "--target", "main", "--generate-notes", "--latest", "--repo", ctx.repo])) || void 0;
+  steps.push(`created the GitHub Release for ${tag}`);
+  await verifyPublishedRelease(deps, ctx.repo, tag, "main", tagSha);
+  steps.push("verified the Release published against the tagged commit");
+  const announceNote = deps.announce ? (await deps.announce({ repo: ctx.repo, tag, summaryFile: options.announceSummaryFile })).note : void 0;
+  const autoRunSince = (deps.now ?? Date.now)();
+  const deployDispatch = await dispatchDeploy(deps, ctx, "main", "main", deployModel, watch, autoRunSince, tagSha, "report", meta.publishDir);
+  const publishDispatch = deployDispatch.deployStatus === "success" ? await dispatchPublishIfRequired(deps, ctx, meta, deployModel, "main", tag, watch, "report") : null;
+  const dispatch = appendPublishDispatch(deployDispatch, publishDispatch);
+  steps.push(`dispatched the ${deployModel} deploy path`);
+  const devRollForward = await rollDevelopmentForward(deps, ctx, tag);
+  steps.push(`development roll-forward: ${devRollForward.status}`);
+  return {
+    ...base,
+    resumed: true,
+    steps,
+    releaseUrl,
+    announceNote,
+    dispatch,
+    devRollForward,
+    note: `resumed and completed ${tag} \u2014 the original version was preserved, not re-cut`
+  };
+}
 async function pushRcAlignment(deps) {
   try {
     await deps.run("git", ["push", "origin", "main:rc"]);
@@ -15815,7 +16306,7 @@ async function runTrainApplyPipeline(mode, input) {
     try {
       checks2 = await waitForRequiredTrainChecks(deps, ctx, rcSha, requiredChecks, tagPush.pushed ? tagPushSince : void 0);
     } catch (e) {
-      throw partialTrainRecoveryError(e, { repo: ctx.repo, tag: tag2, stage: "rc" });
+      throw partialTrainRecoveryError(e, { repo: ctx.repo, tag: tag2, stage: "rc", deployModel: deployModel2 });
     }
     const autoRunSince = (deps.now ?? Date.now)();
     await runGitPush(deps, ["push", "origin", "rc"]);
@@ -16132,14 +16623,14 @@ async function runTenantReconcile(deps, options) {
   };
 }
 function tenantControlWatches(action) {
-  return action === "status" || action === "retire" || action === "verify-secrets" || action === "verify-broker";
+  return action === "status" || action === "retire" || action === "verify-secrets" || action === "verify-broker" || action === "logs";
 }
 async function runTenantControl(deps, options) {
   const { repo, stage, action } = options;
   const watch = options.watch ?? tenantControlWatches(action);
   const base = { command: "tenant-control", repo, stage, action };
   const since = (deps.now ?? Date.now)();
-  const d = await deps.dispatchTenantControl({ repo, stage, action });
+  const d = await deps.dispatchTenantControl({ repo, stage, action, lines: options.lines });
   if (!d.ok) {
     const transport = d.category === "transport-failed";
     return {
@@ -16156,10 +16647,12 @@ async function runTenantControl(deps, options) {
   if (action === "retire") {
     result.category = conclusion === "success" ? "retired" : conclusion === "failure" ? "control-run-failed" : "wait-timeout";
   }
-  if (watch && runId != null && conclusion === "success" && (action === "status" || action === "verify-secrets" || action === "verify-broker")) {
+  if (watch && runId != null && conclusion === "success" && (action === "status" || action === "verify-secrets" || action === "verify-broker" || action === "logs")) {
     const output = extractControlOutputFromLog(await fetchControlRunLog(deps, runId));
     if (action === "status") {
       result.serviceState = parseStatusSnippet(output).serviceState;
+    } else if (action === "logs") {
+      result.logs = output;
     } else if (action === "verify-secrets") {
       result.secrets = parseVerifySecrets(output);
       result.secretsRaw = output;
@@ -21157,6 +21650,62 @@ function registerQueryCommands(program3) {
 
 // src/bootstrap-commands.ts
 var import_node_fs24 = require("node:fs");
+var import_node_os9 = require("node:os");
+var import_node_path23 = require("node:path");
+
+// src/bootstrap-drift.ts
+function byteComparableSeeds(manifest, cls) {
+  return manifest.seeds.filter((s) => s.ownership === "org" && s.source === "self" && s.classes.includes(cls));
+}
+function compareSeedBytes(hubContent, repoContent) {
+  if (repoContent === null) return "absent";
+  const normalize = (s) => s.replace(/\r\n/g, "\n");
+  return normalize(hubContent) === normalize(repoContent) ? "match" : "drift";
+}
+function auditRepoSeedDrift(repo, seeds, hubContents, repoReads) {
+  const byTarget = new Map(repoReads.map((r) => [r.target, r.content]));
+  const slug = repo.includes("/") ? repo.slice(repo.indexOf("/") + 1).toLowerCase() : repo.toLowerCase();
+  const findings = [];
+  for (const seed of seeds) {
+    const hub = hubContents.get(seed.target);
+    if (hub == null) {
+      findings.push({
+        repo,
+        target: seed.target,
+        state: "drift",
+        detail: `the Hub's own copy could not be read \u2014 the manifest declares a file MMI-Hub does not have`
+      });
+      continue;
+    }
+    const state = compareSeedBytes(hub, byTarget.get(seed.target) ?? null);
+    if (state === "match") continue;
+    const why = seed.waivers?.[slug];
+    if (why) {
+      findings.push({ repo, target: seed.target, state: "waived", detail: `${state} \u2014 waived: ${why}` });
+      continue;
+    }
+    findings.push({
+      repo,
+      target: seed.target,
+      state,
+      detail: state === "absent" ? "declared org-owned in the manifest but not present on the base branch" : "differs from MMI-Hub's copy \u2014 propagate with `mmi-cli bootstrap apply <repo> --only <target> --execute`, or, if this repo is RIGHT to differ, declare a waiver for it on the seed in the manifest (#3842)"
+    });
+  }
+  return findings;
+}
+function renderSeedDriftReport(findings, reposAudited, seedsPerRepo) {
+  const lines = [`org-seed drift: ${reposAudited} repo(s) audited, ${seedsPerRepo} byte-comparable seed(s) each`];
+  const waived = findings.filter((f) => f.state === "waived");
+  const real = findings.filter((f) => f.state !== "waived");
+  for (const f of waived) lines.push(`  WAIVED ${f.repo}  ${f.target} \u2014 ${f.detail}`);
+  if (!real.length) {
+    lines.push("  clean \u2014 every repo carries the Hub's bytes for every org-owned whole-file seed" + (waived.length ? ` (${waived.length} declared waiver(s) above)` : ""));
+    return lines.join("\n");
+  }
+  for (const f of real) lines.push(`  ${f.state.toUpperCase().padEnd(6)} ${f.repo}  ${f.target} \u2014 ${f.detail}`);
+  lines.push(`  \u2014 ${real.length} finding(s)${waived.length ? `, ${waived.length} waived` : ""}`);
+  return lines.join("\n");
+}
 
 // src/bootstrap-verify.ts
 var TRAIN_BRANCHES2 = ["development", "rc", "main"];
@@ -21757,12 +22306,76 @@ function registerBootstrapCommands(program3) {
     else console.log(renderOrgRulesetDriftReport(plan));
     if (plan.action !== "noop") process.exitCode = 1;
   });
-  bootstrap.command("apply <repo>").description("run from the MMI-Hub repo root: idempotent seed apply from skills/bootstrap/seeds/manifest.json; dry-run unless --execute (live, master-gated)").addOption(new Option("--class <class>", "deployable | content").default("deployable").choices(["deployable", "content"])).addOption(new Option("--project-type <type>", `${PROJECT_TYPES.join(" | ")} (capability shape)`).choices([...PROJECT_TYPES])).addOption(new Option("--deploy-model <model>", `${DEPLOY_MODELS.join(" | ")} (release/deploy path)`).choices([...DEPLOY_MODELS])).addOption(new Option("--release-track <track>", `${RELEASE_TRACKS.join(" | ")} (branch topology; direct skips rc)`).choices([...RELEASE_TRACKS])).option("--execute", "LIVE apply via gh (master-gated) \u2014 stamps seed files + labels into the repo").option("--var <KEY=VALUE...>", "placeholder values for repo-owned templates (repeatable)").option("--json", "machine-readable output").action(async (repo, cmdOpts) => {
+  bootstrap.command("drift").description("#3818: compare every org-owned whole-file seed against MMI-Hub's copy across the registry roster; read-only").option("--repo <owner/repo>", "audit one repo instead of the roster (never a fleet verdict)").option("--json", "machine-readable output").action(async () => {
+    const o = { repo: rawValue("--repo", ""), json: rawFlag("--json") };
+    const manifestPath = "skills/bootstrap/seeds/manifest.json";
+    if (!(0, import_node_fs24.existsSync)(manifestPath)) return fail(`bootstrap drift: ${manifestPath} not found; run from the MMI-Hub repo root \u2014 the Hub's copies ARE the reference this compares against`);
+    const manifest = loadBootstrapSeeds((0, import_node_fs24.readFileSync)(manifestPath, "utf8"));
+    const hubContents = /* @__PURE__ */ new Map();
+    for (const s of manifest.seeds) {
+      if (s.ownership !== "org" || s.source !== "self") continue;
+      hubContents.set(s.target, (0, import_node_fs24.existsSync)(s.target) ? (0, import_node_fs24.readFileSync)(s.target, "utf8") : null);
+    }
+    let targets;
+    let classOf = (_repo) => "deployable";
+    if (o.repo) {
+      targets = [o.repo];
+    } else {
+      const projects = await fetchProjectsList(registryClientDeps(await loadConfig()));
+      if (!projects || projects.length === 0) {
+        return failGraceful("bootstrap drift: the registry roster is unreadable or empty \u2014 refusing to report a fleet verdict from a scope this command could not establish (#3808)");
+      }
+      targets = collectRegistryRepos(projects);
+      const byRepo = /* @__PURE__ */ new Map();
+      for (const p of projects) for (const r of p.repos ?? []) byRepo.set((r.includes("/") ? r : `mutmutco/${r}`).toLowerCase(), p.class ?? "deployable");
+      classOf = (repo) => byRepo.get(repo.toLowerCase()) ?? "deployable";
+    }
+    const gh = async (args) => execFileP2("gh", args, { timeout: 2e4 });
+    const enc = (p) => p.split("/").map(encodeURIComponent).join("/");
+    const findings = [];
+    let seedsPerRepo = 0;
+    for (const repo of targets) {
+      const cls = classOf(repo);
+      const seeds = byteComparableSeeds(manifest, cls);
+      seedsPerRepo = Math.max(seedsPerRepo, seeds.length);
+      const baseBranch = cls === "content" ? "main" : "development";
+      const reads = [];
+      for (const seed of seeds) {
+        let content = null;
+        try {
+          const r = await gh(["api", `repos/${repo}/contents/${enc(seed.target)}?ref=${baseBranch}`]);
+          const parsed = JSON.parse(r.stdout);
+          content = parsed.encoding === "base64" && typeof parsed.content === "string" ? Buffer.from(parsed.content, "base64").toString("utf8") : null;
+        } catch {
+          content = null;
+        }
+        reads.push({ target: seed.target, content });
+      }
+      findings.push(...auditRepoSeedDrift(repo, seeds, hubContents, reads));
+    }
+    if (o.json) {
+      console.log(JSON.stringify({
+        // #3842: `ok` reflects real findings; waivers ride the payload so a consumer can see every
+        // standing exception without them counting as drift.
+        ok: findings.every((f) => f.state === "waived"),
+        scope: o.repo ? "single-repo" : "fleet",
+        reposAudited: targets.length,
+        seedsPerRepo,
+        waived: findings.filter((f) => f.state === "waived").length,
+        findings
+      }, null, 2));
+    } else {
+      console.log(renderSeedDriftReport(findings, targets.length, seedsPerRepo));
+    }
+    if (findings.some((f) => f.state !== "waived")) process.exitCode = 1;
+  });
+  bootstrap.command("apply <repo>").description("run from the MMI-Hub repo root: idempotent seed apply from skills/bootstrap/seeds/manifest.json; dry-run unless --execute (live, master-gated)").addOption(new Option("--class <class>", "deployable | content").default("deployable").choices(["deployable", "content"])).addOption(new Option("--project-type <type>", `${PROJECT_TYPES.join(" | ")} (capability shape)`).choices([...PROJECT_TYPES])).addOption(new Option("--deploy-model <model>", `${DEPLOY_MODELS.join(" | ")} (release/deploy path)`).choices([...DEPLOY_MODELS])).addOption(new Option("--release-track <track>", `${RELEASE_TRACKS.join(" | ")} (branch topology; direct skips rc)`).choices([...RELEASE_TRACKS])).option("--execute", "LIVE apply via gh (master-gated) \u2014 stamps seed files + labels into the repo").option("--only <target>", "deliver ONLY this manifest target (#3818) \u2014 one file, no labels/ruleset/registry writes").option("--var <KEY=VALUE...>", "placeholder values for repo-owned templates (repeatable)").option("--json", "machine-readable output").action(async (repo, cmdOpts) => {
     const o = {
       class: rawValue("--class", "deployable"),
       projectType: rawValue("--project-type", ""),
       deployModel: rawValue("--deploy-model", ""),
       releaseTrack: rawValue("--release-track", ""),
+      only: rawValue("--only", ""),
       execute: rawFlag("--execute"),
       json: rawFlag("--json")
     };
@@ -21782,9 +22395,28 @@ function registerBootstrapCommands(program3) {
     const manifest = loadBootstrapSeeds((0, import_node_fs24.readFileSync)(manifestPath, "utf8"));
     const baseBranch = o.class === "content" ? "main" : "development";
     const slug = parsedRepo.slug;
+    const onlyTarget = o.only.trim();
+    const seedsToApply = onlyTarget ? manifest.seeds.filter((s) => s.target === onlyTarget || s.target.replace("{{REPO_SLUG}}", slug) === onlyTarget) : manifest.seeds;
+    if (onlyTarget && !seedsToApply.length) {
+      const known = manifest.seeds.map((s) => s.target).join("\n  ");
+      return fail(`bootstrap apply: --only '${onlyTarget}' names no seed in ${manifestPath}. Declared targets:
+  ${known}`);
+    }
     const gh = async (args) => execFileP2("gh", args, { timeout: 2e4 });
     const readFile9 = (p) => (0, import_node_fs24.existsSync)(p) ? (0, import_node_fs24.readFileSync)(p, "utf8") : null;
     const enc = (p) => p.split("/").map(encodeURIComponent).join("/");
+    const putSeed = async (target, content, ref, sha) => {
+      const tmp = (0, import_node_path23.join)((0, import_node_os9.tmpdir)(), `mmi-seed-${process.pid}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}.json`);
+      (0, import_node_fs24.writeFileSync)(tmp, JSON.stringify(contentPutBody(target, content, ref, sha)), "utf8");
+      try {
+        await gh(contentPutInputArgs(repo, target, tmp));
+      } finally {
+        try {
+          (0, import_node_fs24.unlinkSync)(tmp);
+        } catch {
+        }
+      }
+    };
     const rawVars = {};
     for (const value of cmdOpts.var ?? []) {
       const eq = value.indexOf("=");
@@ -21849,7 +22481,7 @@ function registerBootstrapCommands(program3) {
       }
     }
     const docsForIndex = [];
-    for (const seed of manifest.seeds) {
+    for (const seed of seedsToApply) {
       if (!seed.classes.includes(o.class)) continue;
       if (!seedMatchesDeployModel(seed, applyDeployModel)) continue;
       if (!seedMatchesProjectType(seed, applyProjectType)) continue;
@@ -21881,12 +22513,12 @@ function registerBootstrapCommands(program3) {
         docsForIndex.push({ path: resolved.target, content: docBody });
       }
       if (o.execute && (action.action === "create" || action.action === "update")) {
-        await gh(contentPutArgs(repo, resolved.target, content, seedPlan.ref, action.action === "update" ? sha : void 0));
+        await putSeed(resolved.target, content, seedPlan.ref, action.action === "update" ? sha : void 0);
         applied.push(`${action.action} ${resolved.target}`);
         if (seedPlan.mode === "pr") seededToBranch++;
       }
     }
-    const indexContent = seededDocsIndex(docsForIndex);
+    const indexContent = onlyTarget ? null : seededDocsIndex(docsForIndex);
     if (indexContent) {
       let indexCurrent = null;
       try {
@@ -21903,7 +22535,7 @@ function registerBootstrapCommands(program3) {
         reason: indexCurrent === null ? "generated routing index (#3545)" : "routing index present \u2014 regenerate with `mmi-cli docs index --write`, which sees the whole tree"
       });
       if (o.execute && indexAction === "create") {
-        await gh(contentPutArgs(repo, DOCS_INDEX_PATH, indexContent, seedPlan.ref, void 0));
+        await putSeed(DOCS_INDEX_PATH, indexContent, seedPlan.ref, void 0);
         applied.push(`${indexAction} ${DOCS_INDEX_PATH}`);
         if (seedPlan.mode === "pr") seededToBranch++;
       }
@@ -21927,9 +22559,13 @@ function registerBootstrapCommands(program3) {
           "--head",
           seedPlan.branch,
           "--title",
-          `bootstrap: seed ${parsedRepo.name} (${baseBranch} is protected)`,
+          onlyTarget ? `chore: propagate org-owned ${onlyTarget} from MMI-Hub` : `bootstrap: seed ${parsedRepo.name} (${baseBranch} is protected)`,
           "--body",
-          `Auto-opened by \`mmi-cli bootstrap apply --execute ${repo}\` (#2286): \`${baseBranch}\` is protected (${seedPlan.reason}), so the org-managed seed files are delivered via this branch + PR \u2014 a direct contents PUT 409s on a protected base ("N of N required status checks are expected").`
+          onlyTarget ? `Auto-opened by \`mmi-cli bootstrap apply ${repo} --only ${onlyTarget} --execute\` (#3818).
+
+\`${onlyTarget}\` is an org-owned seed declared in MMI-Hub's \`skills/bootstrap/seeds/manifest.json\`; this PR brings this repo's copy to the Hub's. It carries that file and nothing else \u2014 no labels, ruleset, merge settings or registry META were touched.
+
+\`${baseBranch}\` is protected (${seedPlan.reason}), so delivery goes via this branch + PR \u2014 a direct contents PUT 409s on a protected base.` : `Auto-opened by \`mmi-cli bootstrap apply --execute ${repo}\` (#2286): \`${baseBranch}\` is protected (${seedPlan.reason}), so the org-managed seed files are delivered via this branch + PR \u2014 a direct contents PUT 409s on a protected base ("N of N required status checks are expected").`
         ]);
         seedPrUrl = created.url;
       }
@@ -21945,7 +22581,7 @@ function registerBootstrapCommands(program3) {
       });
       applied.push(autoMergeEnabled ? `seed: PR ${seedPrUrl} (base ${baseBranch} protected; auto-merge enabled)` : `seed: PR ${seedPrUrl} (base ${baseBranch} protected; auto-merge refused \u2014 PR is already clean. Land it: mmi-cli pr land <n> --repo ${repo})`);
     }
-    if (o.execute && o.class === "deployable") {
+    if (o.execute && !onlyTarget && o.class === "deployable") {
       try {
         await gh(["api", "-X", "PATCH", `repos/${repo}`, "-f", "allow_auto_merge=true", "-f", "allow_squash_merge=true", "-f", "delete_branch_on_merge=true"]);
         applied.push("merge settings: allow_auto_merge, squash, delete-branch-on-merge");
@@ -21974,7 +22610,7 @@ function registerBootstrapCommands(program3) {
         }
       }
     }
-    if (o.execute) {
+    if (o.execute && !onlyTarget) {
       for (const l of manifest.labels) {
         try {
           await gh(["label", "create", l.name, "--color", l.color, "--description", l.description, "--force", "-R", repo]);
@@ -21994,17 +22630,19 @@ function registerBootstrapCommands(program3) {
       }
     }
     const ddbWrites = [];
-    let registerPayload;
-    try {
-      registerPayload = buildRegisterPayload(repo, o.class, vars, {
-        projectType: o.projectType || void 0,
-        deployModel: o.deployModel || void 0,
-        releaseTrack: bootstrapReleaseTrack
-      });
-    } catch (e) {
-      return fail(`bootstrap apply: ${e.message}`);
+    let registerPayload = {};
+    if (!onlyTarget) {
+      try {
+        registerPayload = buildRegisterPayload(repo, o.class, vars, {
+          projectType: o.projectType || void 0,
+          deployModel: o.deployModel || void 0,
+          releaseTrack: bootstrapReleaseTrack
+        });
+      } catch (e) {
+        return fail(`bootstrap apply: ${e.message}`);
+      }
     }
-    if (o.execute) {
+    if (o.execute && !onlyTarget) {
       const cfg = await loadConfig();
       const res = await registerProject(registerPayload, registryClientDeps(cfg));
       if (res.ok) {
@@ -22015,7 +22653,7 @@ function registerBootstrapCommands(program3) {
         applied.push(`ddb register ${registerPayload.slug} (failed: ${why})`);
       }
     }
-    if (o.json) console.log(JSON.stringify({ repo, class: o.class, execute: o.execute, seedDelivery: seedPlan.mode, seedPrUrl, actions, applied, ddbWrites }, null, 2));
+    if (o.json) console.log(JSON.stringify({ repo, class: o.class, only: onlyTarget || null, execute: o.execute, seedDelivery: seedPlan.mode, seedPrUrl, actions, applied, ddbWrites }, null, 2));
     else {
       console.log(renderSeedPlan(actions));
       if (o.execute) console.log(`
@@ -22027,11 +22665,11 @@ LIVE apply to ${repo}:
 
 // src/stage-commands.ts
 var import_node_fs26 = require("node:fs");
-var import_node_path24 = require("node:path");
+var import_node_path25 = require("node:path");
 
 // src/port-registry.ts
 var import_node_fs25 = require("node:fs");
-var import_node_path23 = require("node:path");
+var import_node_path24 = require("node:path");
 
 // ../infra/port-geometry.mjs
 var PORT_BLOCK = 100;
@@ -22084,22 +22722,22 @@ function existingPortRange(repo, registry2) {
   return registry2[repo] ?? null;
 }
 function portRangeInfraAt(root, source) {
-  const registryPath = (0, import_node_path23.join)(root, "infra", "port-ranges.json");
-  const ddbScriptPath = (0, import_node_path23.join)(root, "infra", "port-ddb.mjs");
+  const registryPath = (0, import_node_path24.join)(root, "infra", "port-ranges.json");
+  const ddbScriptPath = (0, import_node_path24.join)(root, "infra", "port-ddb.mjs");
   if (!(0, import_node_fs25.existsSync)(registryPath) || !(0, import_node_fs25.existsSync)(ddbScriptPath)) return null;
   return { root, source, registryPath, ddbScriptPath };
 }
 function resolvePortRangeInfra(cwd, packageDir) {
   const direct = portRangeInfraAt(cwd, "cwd");
   if (direct) return direct;
-  for (let dir = cwd; ; dir = (0, import_node_path23.dirname)(dir)) {
-    const sibling = portRangeInfraAt((0, import_node_path23.join)(dir, "MMI-Hub"), "sibling-hub");
+  for (let dir = cwd; ; dir = (0, import_node_path24.dirname)(dir)) {
+    const sibling = portRangeInfraAt((0, import_node_path24.join)(dir, "MMI-Hub"), "sibling-hub");
     if (sibling) return sibling;
-    const parent = (0, import_node_path23.dirname)(dir);
+    const parent = (0, import_node_path24.dirname)(dir);
     if (parent === dir) break;
   }
   if (packageDir) {
-    const pkgRoot = (0, import_node_path23.join)(packageDir, "..", "..");
+    const pkgRoot = (0, import_node_path24.join)(packageDir, "..", "..");
     const pkgFrom = portRangeInfraAt(pkgRoot, "pkg-root");
     if (pkgFrom) return pkgFrom;
   }
@@ -22275,8 +22913,8 @@ function registerStageCommands(program3) {
     const portRange = portRangeMeta && typeof portRangeMeta.start === "number" && typeof portRangeMeta.end === "number" ? [portRangeMeta.start, portRangeMeta.end] : void 0;
     return decideStage({
       registry: { deployModel: project2?.deployModel, portRange, error: read.ok ? void 0 : read.error },
-      hasCompose: (0, import_node_fs26.existsSync)((0, import_node_path24.join)(process.cwd(), "docker-compose.yml")),
-      hasEnvExample: (0, import_node_fs26.existsSync)((0, import_node_path24.join)(process.cwd(), ".env.example"))
+      hasCompose: (0, import_node_fs26.existsSync)((0, import_node_path25.join)(process.cwd(), "docker-compose.yml")),
+      hasEnvExample: (0, import_node_fs26.existsSync)((0, import_node_path25.join)(process.cwd(), ".env.example"))
     });
   }
   async function fetchStageVaultEnvMerge() {
@@ -22716,8 +23354,8 @@ function registerBoardCommands(program3) {
 // src/merge-cleanup.ts
 var import_node_fs27 = require("node:fs");
 var import_promises7 = require("node:fs/promises");
-var import_node_path26 = require("node:path");
-var import_node_os9 = require("node:os");
+var import_node_path27 = require("node:path");
+var import_node_os10 = require("node:os");
 var import_node_child_process13 = require("node:child_process");
 
 // src/board-advance.ts
@@ -22804,7 +23442,7 @@ function boardAdvanceFailureMessage(result) {
 
 // src/deferred-registry-store.ts
 var import_promises6 = require("node:fs/promises");
-var import_node_path25 = require("node:path");
+var import_node_path26 = require("node:path");
 var sleep2 = (ms) => new Promise((resolve5) => setTimeout(resolve5, ms));
 async function atomicWrite(target, contents) {
   const tmp = `${target}.tmp-${process.pid}-${Math.random().toString(36).slice(2)}`;
@@ -22855,12 +23493,12 @@ function makeDeferredWorktreeStore(registryPath, lockOpts = {}) {
     },
     // Standalone atomic write — THROWS on failure (no best-effort swallow, #2846).
     write: async (entries) => {
-      await (0, import_promises6.mkdir)((0, import_node_path25.dirname)(registryPath), { recursive: true });
+      await (0, import_promises6.mkdir)((0, import_node_path26.dirname)(registryPath), { recursive: true });
       await atomicWrite(registryPath, serializeDeferredWorktrees(entries));
     },
     // Serialized read-modify-write under the repo-wide lock (#2846).
     update: async (mutate) => {
-      await (0, import_promises6.mkdir)((0, import_node_path25.dirname)(registryPath), { recursive: true });
+      await (0, import_promises6.mkdir)((0, import_node_path26.dirname)(registryPath), { recursive: true });
       const deadline = Date.now() + opts.maxWaitMs;
       for (; ; ) {
         const guard = await acquireLock(lockPath, opts, deadline);
@@ -23021,7 +23659,7 @@ async function applyGcPlan(plan, remote, opts = {}) {
   );
   const repoRoot2 = (await execFileP2("git", ["rev-parse", "--show-toplevel"], { timeout: GIT_TIMEOUT_MS }).catch(() => ({ stdout: "" }))).stdout.trim() || process.cwd();
   const worktreeGitRoot = await currentRepoWorktreeGitRoot(repoRoot2);
-  const primaryRepoRoot = worktreeGitRoot ? (0, import_node_path26.dirname)((0, import_node_path26.dirname)(worktreeGitRoot)) : repoRoot2;
+  const primaryRepoRoot = worktreeGitRoot ? (0, import_node_path27.dirname)((0, import_node_path27.dirname)(worktreeGitRoot)) : repoRoot2;
   const gcActor = describeActor({ env: process.env, surface: detectSurface(process.env), cwd: process.cwd() });
   const owners = readWorktreeOwners(primaryRepoRoot);
   const removalNow = Date.now();
@@ -23145,8 +23783,8 @@ async function composeOverrideBodyFile(prNumber, repoArgs, gh) {
     const commits = JSON.parse(raw).commits ?? [];
     const body = squashBodyWithOverride(commits.map((c) => ({ headline: c.messageHeadline ?? "", body: c.messageBody ?? "" })), process.cwd());
     if (!body) return void 0;
-    const dir = (0, import_node_fs27.mkdtempSync)((0, import_node_path26.join)((0, import_node_os9.tmpdir)(), "mmi-squash-body-"));
-    const path2 = (0, import_node_path26.join)(dir, "body.txt");
+    const dir = (0, import_node_fs27.mkdtempSync)((0, import_node_path27.join)((0, import_node_os10.tmpdir)(), "mmi-squash-body-"));
+    const path2 = (0, import_node_path27.join)(dir, "body.txt");
     (0, import_node_fs27.writeFileSync)(path2, `${body}
 `, "utf8");
     return { path: path2, cleanup: () => {
@@ -23542,7 +24180,7 @@ async function fetchRestCorePool(gh = defaultGhApi) {
 // src/worktree-lifecycle-commands.ts
 var import_node_fs28 = require("node:fs");
 var import_promises8 = require("node:fs/promises");
-var import_node_path27 = require("node:path");
+var import_node_path28 = require("node:path");
 var GH_TIMEOUT_MS = 2e4;
 var DEFAULT_BASE = "origin/development";
 var DEFAULT_REMOTE = "origin";
@@ -23678,7 +24316,7 @@ function classifyStaleLeaks(input) {
 var defaultOrphanDirScanDeps = {
   listDirs: (root) => {
     try {
-      return (0, import_node_fs28.readdirSync)(root, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => (0, import_node_path27.join)(root, e.name));
+      return (0, import_node_fs28.readdirSync)(root, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => (0, import_node_path28.join)(root, e.name));
     } catch {
       return [];
     }
@@ -23825,13 +24463,13 @@ function registerWorktreeCommands(program3) {
       const headBorn = await execFileP2("git", ["-C", wtPath || ".", "rev-parse", "--verify", "--quiet", "HEAD"], { timeout: GIT_TIMEOUT_MS }).then(() => true).catch(() => false);
       const branch = headBorn ? (await execFileP2("git", ["rev-parse", "--abbrev-ref", "HEAD"], { timeout: GIT_TIMEOUT_MS })).stdout.trim() : (await execFileP2("git", ["symbolic-ref", "--quiet", "--short", "HEAD"], { timeout: GIT_TIMEOUT_MS }).catch(() => ({ stdout: "" }))).stdout.trim();
       if (!wtPath || !branch) return fail("worktree land: not inside a git worktree");
-      const gitFile = (0, import_node_path27.join)(wtPath, ".git");
+      const gitFile = (0, import_node_path28.join)(wtPath, ".git");
       const isLinked = (0, import_node_fs28.existsSync)(gitFile) && (0, import_node_fs28.statSync)(gitFile).isFile();
       if (apply && !isLinked) {
         return fail("worktree land: run from inside the linked worktree you want to land (this is the primary checkout)");
       }
       const commonDir = (await execFileP2("git", ["rev-parse", "--git-common-dir"], { timeout: GIT_TIMEOUT_MS }).catch(() => ({ stdout: "" }))).stdout.trim();
-      const primaryCheckout = commonDir ? (0, import_node_path27.dirname)(commonDir) : wtPath;
+      const primaryCheckout = commonDir ? (0, import_node_path28.dirname)(commonDir) : wtPath;
       const localBranchNames = await execFileP2("git", ["-C", primaryCheckout, "for-each-ref", "--format=%(refname:short)", "refs/heads"], { timeout: GIT_TIMEOUT_MS }).then(({ stdout }) => new Set((stdout || "").split("\n").map((l) => l.trim()).filter(Boolean))).catch(() => void 0);
       const orphan = classifyOrphanedWorktree({
         branch,
@@ -24018,7 +24656,7 @@ async function gatherWorktreeContext() {
     if (s) stages.push({ path: wt.path, port: s.port });
   }
   const worktreeGitRoot = await currentRepoWorktreeGitRoot(repoRoot2);
-  const primaryRepoRoot = worktreeGitRoot ? (0, import_node_path27.dirname)((0, import_node_path27.dirname)(worktreeGitRoot)) : repoRoot2;
+  const primaryRepoRoot = worktreeGitRoot ? (0, import_node_path28.dirname)((0, import_node_path28.dirname)(worktreeGitRoot)) : repoRoot2;
   const wtRoot = siblingMmiWorktreesRoot(primaryRepoRoot);
   let orphanDirs = [];
   if ((0, import_node_fs28.existsSync)(wtRoot)) {
@@ -24047,6 +24685,14 @@ async function bestEffortGit(args, cwd, step, timeoutMs = GIT_TIMEOUT_MS) {
 var import_node_fs29 = require("node:fs");
 var import_node_crypto5 = require("node:crypto");
 var ghRunner = async (args, timeoutMs) => (await execFileP2("gh", args, { timeout: timeoutMs })).stdout;
+var ReparentConflictError = class extends Error {
+  constructor(message, payload) {
+    super(message);
+    this.payload = payload;
+    this.name = "ReparentConflictError";
+  }
+  payload;
+};
 async function editIssue(client, options, deps = {}) {
   const parsed = parseIssueRef(options.ref);
   const repo = parsed.repo ?? options.defaultRepo;
@@ -24095,7 +24741,12 @@ async function editIssue(client, options, deps = {}) {
   let parentResult;
   if (options.parent) {
     const run = deps.runGh ?? ghRunner;
-    parentResult = await linkSubIssue(run, options.parent, options.ref, repo);
+    try {
+      parentResult = await linkSubIssue(run, options.parent, options.ref, repo);
+    } catch (e) {
+      const conflict = await classifyReparentFailure(e, run, repo, parsed.number, options.parent, "--parent");
+      throw conflict ? new ReparentConflictError(conflict.message, conflict.payload) : e;
+    }
   }
   return {
     number: parsed.number,
@@ -24285,7 +24936,7 @@ ${spec.body ?? ""}`;
   const hash = (0, import_node_crypto5.createHash)("sha256").update(identity).digest("hex").slice(0, 16);
   return `${batchKey}:${hash}`;
 }
-var BATCH_SPEC_KEYS = /* @__PURE__ */ new Set(["type", "title", "body", "priority", "labels", "label", "parent", "repo"]);
+var BATCH_SPEC_KEYS = /* @__PURE__ */ new Set(["type", "title", "body", "priority", "labels", "label", "parent", "repo", "surface"]);
 function validateBatchSpecs(specs) {
   const errors = [];
   const validated = [];
@@ -24326,10 +24977,47 @@ function validateBatchSpecs(specs) {
       errors.push({ row, error: e.message });
       continue;
     }
+    if (spec.surface !== void 0) {
+      if (typeof spec.surface !== "string" || !spec.surface.trim()) {
+        errors.push({ row, error: "surface must be a non-empty string" });
+        continue;
+      }
+      if (!labelsCarrySurface(spec.labels)) spec.labels = [...spec.labels ?? [], surfaceLabel(spec.surface)];
+      delete spec.surface;
+    }
     validated.push({ row, spec, priority, type: spec.type });
   }
   return { ok: errors.length === 0, errors, validated };
 }
+async function preflightBatchSurfaces(validated, rowRepo, options) {
+  const applies = /* @__PURE__ */ new Map();
+  const appliesTo = async (repo) => {
+    if (!applies.has(repo)) applies.set(repo, await surfaceLabelApplies(repo));
+    return applies.get(repo);
+  };
+  if (options.surface) {
+    for (const { spec } of validated) {
+      if (labelsCarrySurface(spec.labels)) continue;
+      if (await appliesTo(rowRepo(spec))) spec.labels = [...spec.labels ?? [], surfaceLabel(options.surface)];
+    }
+  }
+  if (options.noSurface) return [];
+  const errors = [];
+  const cache = /* @__PURE__ */ new Map();
+  for (const { row, spec } of validated) {
+    const repo = rowRepo(spec);
+    const key = [repo, labelsCarrySurface(spec.labels) ? "has" : "none"].join("::");
+    let verdict = cache.get(key);
+    if (!verdict) {
+      verdict = await checkSurfaceRequirement({ repo, labels: spec.labels, command: "issue create --batch" });
+      cache.set(key, verdict);
+      if (verdict.warn) process.stderr.write(`${verdict.warn}
+`);
+    }
+    if (verdict.refusal) errors.push({ row, error: verdict.refusal.message });
+  }
+  return errors;
+}
 async function createIssuesBatch(specs, options, deps = {}) {
   const ensureLabels = deps.ensureLabels ?? ensureLabelsExist;
   const client = deps.client ?? defaultGitHubClient();
@@ -24345,6 +25033,12 @@ ${lines}`);
     throw new Error("could not resolve repo \u2014 pass --repo owner/repo or set repo per row");
   }
   const rowRepo = (spec) => spec.repo ?? defaultRepo;
+  const surfaceErrors = await preflightBatchSurfaces(validation.validated, rowRepo, options);
+  if (surfaceErrors.length) {
+    const lines = surfaceErrors.map((e) => `  row ${e.row}: ${e.error}`).join("\n");
+    throw new Error(`batch validation failed (${surfaceErrors.length} error(s)):
+${lines}`);
+  }
   const labelsByRepo = /* @__PURE__ */ new Map();
   for (const { spec } of validation.validated) {
     if (!spec.labels?.length) continue;
@@ -24451,7 +25145,10 @@ function registerIssueLifecycleCommands(program3, deps = {}) {
       });
       console.log(JSON.stringify(result));
     } catch (e) {
-      return failGraceful(`issue edit failed: ${e.message}`);
+      return failGracefulEnvelope(
+        `issue edit failed: ${e.message}`,
+        e instanceof ReparentConflictError ? e.payload : void 0
+      );
     }
   });
   mutating(
@@ -24580,14 +25277,28 @@ ${lines}`);
       }
       const batchParent = opts.parent;
       const batchPriority = opts.priority ? normalizePriority(opts.priority) : void 0;
+      const batchSurface = typeof opts.surface === "string" && opts.surface.trim() ? opts.surface : void 0;
+      const batchNoSurface = rawFlag("--no-surface");
       if (opts.dryRun || opts.validateOnly) {
+        const defaultRepo = await resolveRepo(opts.repo);
+        const planRowRepo = (spec) => spec.repo ?? defaultRepo;
+        const surfaceErrors = defaultRepo || validation.validated.every((v) => v.spec.repo) ? await preflightBatchSurfaces(validation.validated, planRowRepo, { surface: batchSurface, noSurface: batchNoSurface }) : [];
+        if (surfaceErrors.length) {
+          const lines = surfaceErrors.map((e) => `  row ${e.row}: ${e.error}`).join("\n");
+          return fail(`issue create --batch: validation failed (${surfaceErrors.length} error(s)):
+${lines}`, {
+            code: ERROR_CODES.ERR_MISSING_FLAG,
+            offending_flag: "--surface"
+          });
+        }
         const planned = validation.validated.map((v) => ({
           row: v.row,
           type: v.type,
           title: v.spec.title,
           priority: v.spec.priority ? v.priority : batchPriority ?? v.priority,
           repo: v.spec.repo,
-          ...v.spec.parent ?? batchParent ? { parent: v.spec.parent ?? batchParent } : {}
+          ...v.spec.parent ?? batchParent ? { parent: v.spec.parent ?? batchParent } : {},
+          ...v.spec.labels?.length ? { labels: v.spec.labels } : {}
         }));
         console.log(JSON.stringify(opts.validateOnly ? { ok: true, planned } : { dry_run: true, planned }));
         return;
@@ -24597,7 +25308,9 @@ ${lines}`);
           repo: opts.repo,
           idempotencyKey: opts.idempotencyKey,
           parent: batchParent,
-          priority: batchPriority
+          priority: batchPriority,
+          surface: batchSurface,
+          noSurface: batchNoSurface
         }, { attach: batchAttach });
         console.log(JSON.stringify(result));
         if (result.failures.length) process.exitCode = 1;
@@ -24625,7 +25338,7 @@ ${lines}`);
 
 // src/train-commands.ts
 var import_node_fs30 = require("node:fs");
-var import_node_path28 = require("node:path");
+var import_node_path29 = require("node:path");
 
 // src/train-status.ts
 function buildTrainStatusReport(input) {
@@ -24665,7 +25378,7 @@ function formatTrainStatus(r) {
 // src/train-commands.ts
 function readRepoVersion() {
   try {
-    return JSON.parse((0, import_node_fs30.readFileSync)((0, import_node_path28.join)(process.cwd(), ".claude-plugin", "plugin.json"), "utf8")).version || void 0;
+    return JSON.parse((0, import_node_fs30.readFileSync)((0, import_node_path29.join)(process.cwd(), ".claude-plugin", "plugin.json"), "utf8")).version || void 0;
   } catch {
     return void 0;
   }
@@ -24812,8 +25525,8 @@ function registerDeployCommands(program3) {
 
 // src/discovery-commands.ts
 var import_node_fs31 = require("node:fs");
-var import_node_os10 = require("node:os");
-var import_node_path29 = require("node:path");
+var import_node_os11 = require("node:os");
+var import_node_path30 = require("node:path");
 var GC_GH_TIMEOUT_MS3 = 2e4;
 async function collectStatus() {
   let branch = "";
@@ -24988,10 +25701,10 @@ async function collectOnboardStatus() {
     else if (top) nextCommand = `mmi-cli board claim ${top.number}  # ${top.title}`;
     else nextCommand = "mmi-cli board read \u2014 no claimable items found";
   }
-  const home = (0, import_node_os10.homedir)();
+  const home = (0, import_node_os11.homedir)();
   const plugin = onboardPluginGate({
-    readKnown: () => readFileSyncSafe((0, import_node_path29.join)(home, ...KNOWN_MARKETPLACES_RELATIVE), import_node_fs31.readFileSync),
-    readSettings: () => readFileSyncSafe((0, import_node_path29.join)(home, ".claude", "settings.json"), import_node_fs31.readFileSync)
+    readKnown: () => readFileSyncSafe((0, import_node_path30.join)(home, ...KNOWN_MARKETPLACES_RELATIVE), import_node_fs31.readFileSync),
+    readSettings: () => readFileSyncSafe((0, import_node_path30.join)(home, ".claude", "settings.json"), import_node_fs31.readFileSync)
   });
   return { track, board, registry: registry2, secrets, plugin, nextCommand };
 }
@@ -26564,8 +27277,8 @@ function ghAccountCaveat(announcedLogin, accounts) {
 
 // src/doctor-io.ts
 var import_node_fs32 = require("node:fs");
-var import_node_os11 = require("node:os");
-var import_node_path30 = require("node:path");
+var import_node_os12 = require("node:os");
+var import_node_path31 = require("node:path");
 var import_node_child_process14 = require("node:child_process");
 var import_node_util8 = require("node:util");
 var execFileP6 = (0, import_node_util8.promisify)(import_node_child_process14.execFile);
@@ -26573,7 +27286,7 @@ var MMI_PLUGIN_ID2 = "mmi@mutmutco";
 function installedClaudePluginVersion() {
   try {
     const file = JSON.parse(
-      (0, import_node_fs32.readFileSync)((0, import_node_path30.join)((0, import_node_os11.homedir)(), ".claude", "plugins", "installed_plugins.json"), "utf8")
+      (0, import_node_fs32.readFileSync)((0, import_node_path31.join)((0, import_node_os12.homedir)(), ".claude", "plugins", "installed_plugins.json"), "utf8")
     );
     const versions = (file.plugins?.[MMI_PLUGIN_ID2] ?? []).map((r) => r.version).filter((v) => Boolean(v));
     if (versions.length === 0) return void 0;
@@ -26613,7 +27326,7 @@ function worktreeRootSync() {
 }
 var gitignorePath = () => {
   const root = worktreeRootSync();
-  return root === null ? null : (0, import_node_path30.join)(root, ".gitignore");
+  return root === null ? null : (0, import_node_path31.join)(root, ".gitignore");
 };
 function readGitignore() {
   const path2 = gitignorePath();
@@ -26652,7 +27365,7 @@ async function repoRoot() {
 }
 function hasRepoLocalWorktrees() {
   const root = worktreeRootSync();
-  return root !== null && (0, import_node_fs32.existsSync)((0, import_node_path30.join)(root, ".worktrees"));
+  return root !== null && (0, import_node_fs32.existsSync)((0, import_node_path31.join)(root, ".worktrees"));
 }
 
 // src/index.ts
@@ -26667,7 +27380,8 @@ async function readDocsAuditFetch(repo) {
   const list = await fetchDocsAuditList(registryClientDeps(await loadConfig()));
   if ("notArmed" in list) return { notArmed: true };
   if (!list.ok) return { ok: false, error: list.error };
-  const row = list.rows.find((r) => r.repo === repo);
+  const wanted = repo.toLowerCase();
+  const row = list.rows.find((r) => String(r.repo ?? "").toLowerCase() === wanted);
   return {
     ok: true,
     verdict: row ? { repo: row.repo, date: row.date, shaRange: row.shaRange, outcome: row.outcome, checkerVendor: row.checkerVendor } : null
@@ -26696,12 +27410,12 @@ function ghMultiAccountCaveat(announcedLogin) {
 var ENV_HEAL_LOCK_STALE_MS = 10 * 6e4;
 var ENV_HEAL_LOCK_MAX_WAIT_MS = 2 * 6e4;
 function envHealLockPath(home) {
-  return (0, import_node_path31.join)(home, ".claude", "plugins", ".mmi-env-heal.lock");
+  return (0, import_node_path32.join)(home, ".claude", "plugins", ".mmi-env-heal.lock");
 }
 async function withEnvHealLock(what, run) {
   try {
     return await withFileLock(
-      envHealLockPath((0, import_node_os12.homedir)()),
+      envHealLockPath((0, import_node_os13.homedir)()),
       { staleMs: ENV_HEAL_LOCK_STALE_MS, maxWaitMs: ENV_HEAL_LOCK_MAX_WAIT_MS, label: "mmi env-heal lock" },
       run
     );
@@ -26804,7 +27518,7 @@ function mmiDoctorDeps(opts = {}) {
       const configRoot = surfaceConfigRoot(surface);
       const running = surface === "codex" ? installedActivePluginVersion(surface) : runningPluginVersion(process.env, resolveClientVersion());
       const plan = buildPluginCachePlan(
-        (0, import_node_os12.homedir)(),
+        (0, import_node_os13.homedir)(),
         running,
         pluginCacheFsDeps(configRoot, () => 0),
         { configRoot, includeStaging: surface !== "codex" }
@@ -26857,11 +27571,11 @@ function mmiDoctorDeps(opts = {}) {
     marketplaceRows: () => {
       try {
         if (detectSurface(process.env) === "codex") return [];
-        const home = (0, import_node_os12.homedir)();
+        const home = (0, import_node_os13.homedir)();
         return marketplaceRows(
           MMI_MARKETPLACE_NAME,
-          readFileSyncSafe((0, import_node_path31.join)(home, ...KNOWN_MARKETPLACES_RELATIVE), import_node_fs33.readFileSync),
-          readFileSyncSafe((0, import_node_path31.join)(home, ".claude", "settings.json"), import_node_fs33.readFileSync)
+          readFileSyncSafe((0, import_node_path32.join)(home, ...KNOWN_MARKETPLACES_RELATIVE), import_node_fs33.readFileSync),
+          readFileSyncSafe((0, import_node_path32.join)(home, ".claude", "settings.json"), import_node_fs33.readFileSync)
         );
       } catch {
         return [];
@@ -27067,7 +27781,7 @@ program2.hook("preAction", async (_thisCommand, actionCommand) => {
 });
 var rules = program2.command("rules").description("org-managed .gitignore delivery");
 rules.command("gitignore").option("--write", "upsert the managed block into .gitignore (default: check only, non-zero exit on drift)").option("--json", "machine-readable output").description("verify (or --write) this repo's org-managed .gitignore block matches the SSOT").action((opts) => {
-  const path2 = (0, import_node_path31.join)(process.cwd(), ".gitignore");
+  const path2 = (0, import_node_path32.join)(process.cwd(), ".gitignore");
   const current = (0, import_node_fs33.existsSync)(path2) ? (0, import_node_fs33.readFileSync)(path2, "utf8") : null;
   const plan = planManagedGitignore(current);
   const drift = [...plan.added.map((l) => `+${l}`), ...plan.removed.map((l) => `-${l}`)].join(", ") || "block normalize";
@@ -27234,7 +27948,7 @@ gcCmd.option("--dry-run", "show what would be deleted (default)").option("--appl
   if (!Number.isFinite(limit) || limit < 1) return fail("worktree gc: --limit must be a positive integer");
   let root;
   if (o.root !== void 0) {
-    root = (0, import_node_path31.resolve)(o.root);
+    root = (0, import_node_path32.resolve)(o.root);
     if (!(0, import_node_fs33.existsSync)(root) || !(0, import_node_fs33.statSync)(root).isDirectory()) return fail(`worktree gc: --root ${o.root} is not a directory`);
     const gcRepoRoot = (await execFileP2("git", ["rev-parse", "--show-toplevel"], { timeout: GIT_TIMEOUT_MS }).catch(() => ({ stdout: "" }))).stdout.trim() || process.cwd();
     if (isPathUnderDirectory(gcRepoRoot, root)) {
@@ -27335,7 +28049,7 @@ function acquireWorktreeSetupLock(worktreeRoot) {
     };
   };
   try {
-    (0, import_node_fs33.mkdirSync)((0, import_node_path31.dirname)(lockPath), { recursive: true });
+    (0, import_node_fs33.mkdirSync)((0, import_node_path32.dirname)(lockPath), { recursive: true });
     return take();
   } catch {
     try {
@@ -27376,11 +28090,25 @@ withExamples(mutating(
     }
     const repoRoot2 = await primaryCheckoutRoot(process.cwd()) ?? process.cwd();
     const wtPath = o.path ?? defaultWorktreePath(repoRoot2, branch);
-    const { base, fetchBranch } = resolveWorktreeBase(fromRef, o.remote);
+    const { base: fallbackBase, fetchBranch, preferRemote } = resolveWorktreeBase(fromRef, o.remote);
+    let base = fallbackBase;
     step = `fetch the base ref ${fromRef}`;
     if (fetchBranch) {
       const fetchErr = await execFileP2("git", ["fetch", o.remote, fetchBranch], { timeout: GH_MUTATION_TIMEOUT_MS }).then(() => void 0).catch((e) => (e instanceof Error ? e.message : String(e)).split("\n")[0]);
-      if (fetchErr) console.error(`  warning: could not fetch ${o.remote}/${fetchBranch} (${fetchErr}); base ${base} may be stale`);
+      if (fetchErr && !preferRemote) console.error(`  warning: could not fetch ${o.remote}/${fetchBranch} (${fetchErr}); base ${base} may be stale`);
+    }
+    const revParseRef = async (ref) => {
+      try {
+        return (await execFileP2("git", ["rev-parse", "--verify", ref], { timeout: GIT_TIMEOUT_MS })).stdout.trim() || void 0;
+      } catch {
+        return void 0;
+      }
+    };
+    if (preferRemote && await revParseRef(preferRemote)) base = preferRemote;
+    if (!o.json) {
+      const baseSha = (await revParseRef(base))?.slice(0, 12) ?? "unresolved";
+      const localOnly = preferRemote && base !== preferRemote ? ` (no ${preferRemote} \u2014 local ref)` : "";
+      console.error(`  base ${base} ${baseSha}${localOnly}`);
     }
     step = `git worktree add ${wtPath}`;
     await addWorktreeRobust(wtPath, branch, base, {
@@ -27642,12 +28370,27 @@ docsAudit.command("record").description("write a dated janitor verdict for one r
     await failGraceful(e.message);
   }
 });
-docsAudit.command("status").description("read the janitor dead-man verdict back for one repo \u2014 missing/stale/failed is RED; a not-yet-armed registry route is an informational exit 0").option("--repo <owner/name>", "the repo to check (default: the current repo)").action(async (o) => {
+docsAudit.command("status").description("read the janitor dead-man verdict back for one repo \u2014 missing/stale/failed is RED; a not-yet-armed registry route is an informational exit 0").option("--repo <owner/name>", "the repo to check (default: the current repo)").option("--json", "machine-readable output \u2014 the discrete state rather than the sentence").action(async (o) => {
   try {
     const repo = o.repo ?? await currentRepoFullName();
     const today = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
-    const result = docsAuditStatus(await readDocsAuditFetch(repo), { repo, today });
-    console.log(result.line);
+    const fetched = await readDocsAuditFetch(repo);
+    const result = docsAuditStatus(fetched, { repo, today });
+    if (o.json) {
+      const verdict = "ok" in fetched && fetched.ok ? fetched.verdict : null;
+      console.log(JSON.stringify({
+        repo,
+        armed: !("notArmed" in fetched),
+        ok: result.ok,
+        state: result.state,
+        date: verdict?.date ?? null,
+        outcome: verdict?.outcome ?? null,
+        checkerVendor: verdict?.checkerVendor ?? null,
+        line: result.line
+      }, null, 2));
+    } else {
+      console.log(result.line);
+    }
     if (!result.ok) process.exitCode = 1;
   } catch (e) {
     await failGraceful(e.message);
@@ -27663,17 +28406,25 @@ async function reportWrite(label, res) {
   return failGraceful(`${label}: HTTP ${res.status}${detail ? ` \u2014 ${detail}` : ""}`);
 }
 var tenant = program2.command("tenant").description("tenant runtime control through Hub authority");
-tenant.command("control <owner/repo> <stage> <action>").description("bounded tenant control plus value-free vault/broker verification; project-admin own dev/rc, master main").option("--watch", "block on the dispatched run and report its conclusion (status/retire/verify-secrets/verify-broker watch by default)").option("--json", "machine-readable output").action(async (repo, stage, action, o) => {
+tenant.command("control <owner/repo> <stage> <action>").description("bounded tenant control plus value-free vault/broker verification; project-admin own dev/rc, master main").option("--watch", "block on the dispatched run and report its conclusion (status/retire/verify-secrets/verify-broker/logs watch by default)").option("--lines <n>", "logs only: trailing lines of the tenant service to return (1-2000, default 200)").option("--json", "machine-readable output").action(async (repo, stage, action, o) => {
   try {
-    const result = await runTenantControl(trainApplyDeps(), { repo, stage, action, watch: o.watch });
+    let lines;
+    if (o.lines !== void 0) {
+      if (action !== "logs") return fail("runtime tenant control: --lines is valid only for the logs action");
+      lines = Number(o.lines);
+      if (!Number.isInteger(lines) || lines < 1 || lines > 2e3) return fail("runtime tenant control: --lines must be an integer between 1 and 2000");
+    }
+    const result = await runTenantControl(trainApplyDeps(), { repo, stage, action, watch: o.watch, lines });
     if (!o.json && action === "verify-secrets" && result.secrets) {
       const body = { ok: result.conclusion === "success", secrets: result.secrets, ssmStatus: result.conclusion === "success" ? "Success" : "Failed", raw: result.secretsRaw };
-      const { lines, failure } = renderVerifySecrets(body);
-      for (const line of lines) printLine(line);
+      const { lines: lines2, failure } = renderVerifySecrets(body);
+      for (const line of lines2) printLine(line);
       if (failure) return failGraceful(`runtime tenant control ${stage} verify-secrets: ${failure}`);
+    } else if (!o.json && action === "logs" && result.logs) {
+      printLine(result.logs);
     } else if (!o.json && action === "verify-broker" && result.broker) {
-      const { lines, failure } = renderVerifyBroker({ broker: result.broker, raw: result.brokerRaw });
-      for (const line of lines) printLine(line);
+      const { lines: lines2, failure } = renderVerifyBroker({ broker: result.broker, raw: result.brokerRaw });
+      for (const line of lines2) printLine(line);
       if (failure) return failGraceful(`runtime tenant control ${stage} verify-broker: ${failure}`);
     } else {
       printLine(o.json ? JSON.stringify(result, null, 2) : renderTenantControl(result));
@@ -28138,16 +28889,43 @@ function resolveCreateType(raw, command, labels) {
   }
   return raw;
 }
+function resolveCreateSurface(opts) {
+  return typeof opts.surface === "string" && opts.surface.trim() ? surfaceLabel(opts.surface) : void 0;
+}
+function surfaceWaived() {
+  return rawFlag("--no-surface");
+}
 var issue = program2.command("issue").description("issues \u2014 reliable create with structured output");
 withExamples(mutating(
-  issue.command("create").description("create an issue (type \u2192 label) and print {number,url,label} JSON").addOption(new Option("--type <type>", "bug | feature | task (sets the matching label; required unless --batch)").choices([...ISSUE_TYPES])).option("--title <title>", "issue title").option("--title-file <path|->", "read the issue title from a UTF-8 file, or from stdin with -").option("--body <body>", "issue body (markdown)").option("--body-file <path|->", "read issue body from a UTF-8 file. `-` (stdin) needs a heredoc, which the agent inline-body guard denies (#1473/#2125) \u2014 prefer a real path; a title with backticks or newlines needs --title-file for the same reason (#3381)").option("--priority <priority>", "urgent | high | medium | low (defaults to medium; sets the board Priority field only \u2014 never a priority:* label, #416)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--label <label...>", "extra label(s) to attach (repeatable; auto-created if missing)").option("--parent <ref>", "file as a native sub-issue of this parent (#123, owner/repo#123, or URL)").option("--no-related", "skip the auto related-issues comment"),
+  issue.command("create").description("create an issue (type \u2192 label) and print {number,url,label} JSON").addOption(new Option("--type <type>", "bug | feature | task (sets the matching label; required unless --batch)").choices([...ISSUE_TYPES])).option("--title <title>", "issue title").option("--title-file <path|->", "read the issue title from a UTF-8 file, or from stdin with -").option("--body <body>", "issue body (markdown)").option("--body-file <path|->", "read issue body from a UTF-8 file. `-` (stdin) needs a heredoc, which the agent inline-body guard denies (#1473/#2125) \u2014 prefer a real path; a title with backticks or newlines needs --title-file for the same reason (#3381)").option("--priority <priority>", "urgent | high | medium | low (defaults to medium; sets the board Priority field only \u2014 never a priority:* label, #416)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--label <label...>", "extra label(s) to attach (repeatable; auto-created if missing)").option("--surface <surface>", "issue surface, with or without the surface: prefix (#3789). Required when the target repo runs the one-surface-label board rule; any value satisfies it, so this is not a closed enum").option("--no-surface", "file without a surface label on a repo that requires one \u2014 for a genuinely exempt filing (e.g. a coop proof issue that spans every surface)").option("--parent <ref>", "file as a native sub-issue of this parent (#123, owner/repo#123, or URL)").option("--no-related", "skip the auto related-issues comment"),
   // --dry-run/--validate-only plan: validate --type + --priority (mirrors the action — a bad enum fails
   // ERR_BAD_ENUM, a missing priority defaults to medium) then echo the resolved create intent. Refs
   // (`--parent`) and title-source are validated by the action on a real run.
-  (opts) => {
+  async (opts) => {
     const type = resolveCreateType(opts.type, "issue create", opts.label);
     const priority = resolveCreatePriority(opts.priority, "issue create");
-    return { command: "issue create", type, title: opts.title ?? opts.titleFile, priority, repo: opts.repo };
+    const planLabels = opts.label ?? [];
+    const clash = conflictingSurfaceInputs(opts.surface, planLabels);
+    if (clash) fail(clash.message, clash.payload);
+    const planRepo = opts.batch || surfaceWaived() ? void 0 : await resolveRepo(opts.repo);
+    const surface = resolveCreateSurface(opts);
+    if (planRepo) {
+      const { refusal, warn } = await checkSurfaceRequirement({
+        repo: planRepo,
+        labels: [...planLabels, ...surface ? [surface] : []]
+      });
+      if (warn) process.stderr.write(`${warn}
+`);
+      if (refusal) fail(refusal.message, refusal.payload);
+    }
+    return {
+      command: "issue create",
+      type,
+      title: opts.title ?? opts.titleFile,
+      priority,
+      repo: opts.repo,
+      ...surface ? { surface } : {}
+    };
   }
 ).action(async (o) => {
   let args;
@@ -28157,6 +28935,7 @@ withExamples(mutating(
   let issueType;
   let extraLabels = [];
   let targetRepo2;
+  let surfaceFlagLabel;
   try {
     issueType = resolveCreateType(o.type, "issue create", o.label);
     title = await resolveIssueTitle({ title: o.title, titleFile: o.titleFile }, { readFile: import_promises10.readFile, readStdin });
@@ -28164,6 +28943,13 @@ withExamples(mutating(
     if (o.idempotencyKey) body = appendIdempotencyMarker(body, o.idempotencyKey);
     priority = resolveCreatePriority(o.priority, "issue create");
     extraLabels = [...o.label ?? []];
+    const clash = conflictingSurfaceInputs(typeof o.surface === "string" ? o.surface : void 0, extraLabels);
+    if (clash) return fail(clash.message, clash.payload);
+    const surfaceFromFlag = resolveCreateSurface(o);
+    if (surfaceFromFlag && !labelsCarrySurface(extraLabels)) {
+      extraLabels.push(surfaceFromFlag);
+      surfaceFlagLabel = surfaceFromFlag;
+    }
     targetRepo2 = await resolveRepo(o.repo);
     if (!targetRepo2) {
       return fail("issue create: could not resolve the target repo \u2014 run inside a git checkout or pass --repo <owner/repo>");
@@ -28180,6 +28966,27 @@ withExamples(mutating(
   } catch (e) {
     return fail(`issue create: ${e.message}`, e instanceof TextArgError ? { code: e.code, offending_flag: e.offendingFlag } : void 0);
   }
+  {
+    const { refusal, warn, enforcing } = await checkSurfaceRequirement({ repo: targetRepo2, labels: extraLabels });
+    if (warn) process.stderr.write(`${warn}
+`);
+    if (!enforcing && surfaceFlagLabel) {
+      extraLabels = extraLabels.filter((l) => l !== surfaceFlagLabel);
+      args = buildIssueArgs({
+        type: issueType,
+        title,
+        body,
+        priority,
+        repo: targetRepo2,
+        labels: extraLabels.length ? extraLabels : void 0
+      });
+      process.stderr.write(
+        `warning: --surface ${surfaceFlagLabel} was dropped \u2014 ${targetRepo2} defines no surface:* labels, and creating one here would switch the one-surface-label rule on for every later filing in it. Use --label ${surfaceFlagLabel} if you really mean to start that taxonomy.
+`
+      );
+    }
+    if (refusal && !surfaceWaived()) return fail(refusal.message, refusal.payload);
+  }
   await ensureLabelsExist(extraLabels, targetRepo2);
   const created = await ghCreate(args);
   const { projectItemId, onBoard } = await attachToProject(created.number, targetRepo2, priority);
@@ -28289,6 +29096,15 @@ jsonParity(issue.command("link-child <parent> <child>").description("link an exi
     const result = await linkSubIssue(ghRunner2, parentRef, childRef, defaultRepo);
     console.log(JSON.stringify(result));
   } catch (e) {
+    let conflict;
+    try {
+      const child2 = parseIssueRef(childRef);
+      const childRepo = child2.repo ?? defaultRepo;
+      if (childRepo) conflict = await classifyReparentFailure(e, ghRunner2, childRepo, child2.number, parentRef);
+    } catch {
+      conflict = void 0;
+    }
+    if (conflict) return fail(`issue link-child: ${conflict.message}`, conflict.payload);
     const err = e;
     const note = timeoutKillNote(e, GH_MUTATION_TIMEOUT_MS);
     return fail(`issue link-child: ${(err.stderr || err.message || String(e)).trim()}${note ? ` (${note})` : ""}`);
@@ -28380,6 +29196,9 @@ program2.command("report").description("file a friction report on the Hub board
   }
   const cfg = await loadConfig();
   if (!cfg.sagaApiUrl) return fail("report: Hub API URL not configured");
+  const { warn: surfaceWarn } = await preflightReportSurface();
+  if (surfaceWarn) process.stderr.write(`${surfaceWarn}
+`);
   const result = await fileReport(
     {
       apiUrl: cfg.sagaApiUrl,
@@ -28452,6 +29271,14 @@ program2.command("skill-lesson").description("file a skill-lesson on the Hub boa
       return console.log(JSON.stringify({ deduped: true, number: dup.number, url: dup.url, score: dup.score }));
     }
   }
+  const { warn: surfaceWarn } = await checkSurfaceRequirement({
+    repo: targetRepo2,
+    labels: [SKILL_LESSON_LABEL],
+    command: "skill-lesson",
+    waiver: { reason: "tooling lesson spans product surfaces \u2014 coop-proof class (#3789)" }
+  });
+  if (surfaceWarn) process.stderr.write(`${surfaceWarn}
+`);
   try {
     await execFileP2("gh", ["label", "create", SKILL_LESSON_LABEL, "--color", "c2e0c6", "--repo", targetRepo2], { timeout: GH_MUTATION_TIMEOUT_MS });
   } catch {
@@ -28501,11 +29328,11 @@ pr.command("view <number>").description("read a PR as structured JSON (merged st
   }
 });
 async function listCiWorkflowPaths(cwd = process.cwd()) {
-  const wfDir = (0, import_node_path31.join)(cwd, ".github", "workflows");
+  const wfDir = (0, import_node_path32.join)(cwd, ".github", "workflows");
   if (!(0, import_node_fs33.existsSync)(wfDir)) return [];
   return (0, import_node_fs33.readdirSync)(wfDir).filter((name) => /\.(ya?ml)$/i.test(name)).filter((name) => {
     try {
-      return workflowReportsPrChecks((0, import_node_fs33.readFileSync)((0, import_node_path31.join)(wfDir, name), "utf8"));
+      return workflowReportsPrChecks((0, import_node_fs33.readFileSync)((0, import_node_path32.join)(wfDir, name), "utf8"));
     } catch {
       return true;
     }
@@ -28537,16 +29364,16 @@ function ciAuditDeps() {
     // gate re-seed step is skipped gracefully rather than failing mid-run.
     readSeedFile: (path2) => {
       if (!root) return null;
-      const fullPath = (0, import_node_path31.join)(root, path2);
+      const fullPath = (0, import_node_path32.join)(root, path2);
       return (0, import_node_fs33.existsSync)(fullPath) ? (0, import_node_fs33.readFileSync)(fullPath, "utf8") : null;
     }
   };
 }
 function hubRoot() {
-  const fromPkg = (0, import_node_path31.join)(__dirname, "..", "..");
+  const fromPkg = (0, import_node_path32.join)(__dirname, "..", "..");
   const marker = "skills/bootstrap/seeds/manifest.json";
-  if ((0, import_node_fs33.existsSync)((0, import_node_path31.join)(fromPkg, marker))) return fromPkg;
-  if ((0, import_node_fs33.existsSync)((0, import_node_path31.join)(process.cwd(), marker))) return process.cwd();
+  if ((0, import_node_fs33.existsSync)((0, import_node_path32.join)(fromPkg, marker))) return fromPkg;
+  if ((0, import_node_fs33.existsSync)((0, import_node_path32.join)(process.cwd(), marker))) return process.cwd();
   return null;
 }
 pr.command("ci-policy").description("report merge CI policy: wait-for-checks vs no-ci (for grind/build agents)").option("--json", "machine-readable output").option("--repo <owner/repo>", "target repo (defaults to the current checkout)").action(async (o) => {
@@ -28934,8 +29761,8 @@ function trainApplyDeps() {
     // Hub-App-authority dispatch of the central tenant-control.yml (#1717) — the Hub fires the
     // workflow_dispatch with its App token. Never throws for an expected rejection: it returns the dispatch
     // outcome so runTenantControl can map a 5xx (transport-failed, retryable) vs a 4xx (rejected) vs ok.
-    dispatchTenantControl: async ({ repo, stage, action }) => {
-      const res = await tenantControl({ repo, stage, action }, registryClientDeps(await loadConfig()));
+    dispatchTenantControl: async ({ repo, stage, action, lines }) => {
+      const res = await tenantControl({ repo, stage, action, ...lines != null ? { lines } : {} }, registryClientDeps(await loadConfig()));
       if (res.ok) return { ok: true };
       const body = res.body;
       return { ok: false, category: body?.category, error: body?.error ?? res.error };
@@ -28983,9 +29810,19 @@ function renderDeployLine(d) {
   if (d.deployStatus === "success") parts.push("deploy: SUCCEEDED");
   else if (d.deployStatus === "failure") parts.push("deploy: FAILED (promotion stands; retry the deploy, do not re-tag)");
   else if (d.runId != null) parts.push(`deploy: UNVERIFIED \u2014 dispatched, not resolved (watch: gh run watch ${d.runId} --repo mutmutco/MMI-Hub --exit-status)`);
+  else if (d.workflowRuns?.length) parts.push("deploy: UNVERIFIED \u2014 the runs above are enumerated, not resolved; watch each to conclusion before calling this release healthy (#3322)");
   else parts.push("deploy: UNVERIFIED \u2014 no run correlated or watched; resolve every workflow run on the release SHA before calling this release healthy (#3322)");
   return parts.join("; ");
 }
+function renderReleaseResume(r) {
+  const lines = [`mmi-cli release --resume: ${r.repo} ${r.tag} (${r.tagSha.slice(0, 12)}) [${r.deployModel}] \u2014 ${r.note}`];
+  for (const step of r.steps) lines.push(`  - ${step}`);
+  if (r.releaseUrl) lines.push(`  release: ${r.releaseUrl}`);
+  if (r.announceNote) lines.push(`  announce: ${r.announceNote}`);
+  if (r.dispatch) lines.push(`  deploy: ${r.dispatch.note}`);
+  if (r.devRollForward) lines.push(`  development: ${r.devRollForward.note}`);
+  return lines.join("\n");
+}
 function renderTrainApply(commandName, r) {
   let base = `mmi-cli ${commandName}: promoted ${r.repo} \u2192 ${r.stage} at ${r.tag} [${r.deployModel}]; ${renderDeployLine(r)}`;
   if (r.versionFold) base = `${base}; ${r.versionFold}`;
@@ -29023,7 +29860,12 @@ for (const commandName of ["rcand", "release"]) {
   const RELEASE_ONLY_FLAGS = [
     { flags: "--announce-summary-file <path>", description: "agent-curated summary lines for the Hub Slack announcement (#883)" },
     { flags: "--ack <shas>", description: "comma-separated dev shas a human verified are in the candidate, overriding the hotfix-coverage guard for a conflicted port whose -x trailer was lost (#958)" },
-    { flags: "--dev", description: "full-track repos release development -> main directly, skipping rc (refuses if rc carries content not in development; no-op on direct-track repos) (#1062)" }
+    { flags: "--dev", description: "full-track repos release development -> main directly, skipping rc (refuses if rc carries content not in development; no-op on direct-track repos) (#1062)" },
+    // #3851: finish a release that pushed its tag and then stopped. NOT a rerun — a rerun would cut the
+    // NEXT version, because the cycle resolver advances past the pushed tag and MMI_RELEASE_VERSION
+    // refuses a version that is not ahead of the latest. This is the only path allowed to target an
+    // existing tag, and it proves the release is genuinely partial before writing anything.
+    { flags: "--resume", description: "finish a release whose tag was pushed but whose main push / Release / deploy never happened \u2014 preserves the original version, refuses unless the partial state is proven (#3851)" }
   ];
   for (const f of RELEASE_ONLY_FLAGS) {
     if (commandName === "release") {
@@ -29047,6 +29889,18 @@ for (const commandName of ["rcand", "release"]) {
     if (o.announceSummaryFile && commandName !== "release") {
       return fail(`${commandName}: --announce-summary-file applies only to release \u2014 rcand posts no Hub Slack announcement. Run: mmi-cli release --announce-summary-file <path>`);
     }
+    if (o.resume && commandName !== "release") {
+      return fail(`${commandName}: --resume applies only to release \u2014 it finishes a partially-released main. Run: mmi-cli release --resume`);
+    }
+    if (o.resume) {
+      if (o.apply) return fail("release: --resume and --apply are mutually exclusive \u2014 --apply cuts the NEXT version, --resume finishes the one whose tag is already pushed");
+      try {
+        const result = await runReleaseResume(trainApplyDeps(), { watch: o.watch, announceSummaryFile: o.announceSummaryFile });
+        return printLine(o.json ? JSON.stringify(result, null, 2) : renderReleaseResume(result));
+      } catch (e) {
+        return failGraceful(`release --resume: ${e.message}`);
+      }
+    }
     if (o.apply && o.repo) {
       const rerun = `mmi-cli ${commandName} --apply${o.watch ? " --watch" : ""}${o.dev ? " --dev" : ""}${o.json ? " --json" : ""}`;
       const guard = planTrainApplyRepoGuard(o.repo, await resolveRepo(), rerun);
@@ -29252,7 +30106,7 @@ function directoryBytes(path2) {
     return 0;
   }
   for (const entry of entries) {
-    const child2 = (0, import_node_path31.join)(path2, entry.name);
+    const child2 = (0, import_node_path32.join)(path2, entry.name);
     if (entry.isDirectory()) total += directoryBytes(child2);
     else {
       try {
@@ -29282,7 +30136,7 @@ function pluginCacheFsDeps(configRoot, dirBytes) {
     dirBytes,
     listStagingDirs: (root) => (0, import_node_fs33.readdirSync)(root, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => {
       try {
-        return { name: d.name, mtimeMs: newestMtimeMs((0, import_node_path31.join)(root, d.name), listDirEntries, (p) => (0, import_node_fs33.statSync)(p).mtimeMs) };
+        return { name: d.name, mtimeMs: newestMtimeMs((0, import_node_path32.join)(root, d.name), listDirEntries, (p) => (0, import_node_fs33.statSync)(p).mtimeMs) };
       } catch {
         return { name: d.name, mtimeMs: Date.now() };
       }
@@ -29296,7 +30150,7 @@ function stagingApplyFsGuard(configRoot) {
   return {
     referencedPaths: () => readInstalledPluginRefs(configRoot),
     mtimeMs: (name) => {
-      const p = (0, import_node_path31.join)(stagingRoot, name);
+      const p = (0, import_node_path32.join)(stagingRoot, name);
       if (!(0, import_node_fs33.existsSync)(p)) return null;
       try {
         return newestMtimeMs(p, listDirEntries, (q) => (0, import_node_fs33.statSync)(q).mtimeMs);
@@ -29319,7 +30173,7 @@ program2.command("plugin-prune").description(`prune stale cached MMI plugin vers
     return;
   }
   const plan = buildPluginCachePlan(
-    (0, import_node_os12.homedir)(),
+    (0, import_node_os13.homedir)(),
     running,
     pluginCacheFsDeps(configRoot, directoryBytes),
     { withBytes: true, configRoot, includeStaging: surface !== "codex" }