@mutmutco/cli 3.79.0 → 3.81.0

package/dist/main.cjs

@@ -3416,8 +3416,8 @@ var program = new Command();
 
 // src/index.ts
 var import_promises10 = require("node:fs/promises");
-var import_node_fs34 = require("node:fs");
-var import_node_child_process15 = require("node:child_process");
+var import_node_fs35 = require("node:fs");
+var import_node_child_process16 = require("node:child_process");
 
 // src/cli-shared.ts
 var import_node_child_process3 = require("node:child_process");
@@ -4483,6 +4483,7 @@ function trackedPathStatus(c, realPath, repoAnchor) {
   const gitPath = c.kind === "dir" ? `${rel.replace(/\/+$/, "")}/` : rel;
   try {
     (0, import_node_child_process4.execFileSync)("git", ["-C", repoAnchor, "rev-parse", "--is-inside-work-tree"], {
+      windowsHide: true,
       stdio: ["ignore", "ignore", "ignore"],
       timeout: 1e4
     });
@@ -4491,6 +4492,7 @@ function trackedPathStatus(c, realPath, repoAnchor) {
   }
   try {
     const out = (0, import_node_child_process4.execFileSync)("git", ["-C", repoAnchor, "ls-files", "-z", "--", gitPath], {
+      windowsHide: true,
       encoding: "utf8",
       stdio: ["ignore", "pipe", "ignore"],
       timeout: 1e4
@@ -6259,6 +6261,8 @@ function readSettingsAutoUpdate(raw, name) {
 var AUTO_UPDATE_TOGGLE_STEPS = "`/plugin` \u2192 Marketplaces tab \u2192 select the marketplace \u2192 Enable auto-update";
 var CATALOG_CONTENT_REF = "main";
 var CATALOG_REF_PIN_STEPS = `add \`"ref": "${CATALOG_CONTENT_REF}"\` to this marketplace's \`source\` in ~/.claude/plugins/known_marketplaces.json, then restart Claude`;
+var PIN_HEAL_COMMAND = "run `mmi-cli doctor --apply`";
+var ORG_MARKETPLACE_PINS = { autoUpdate: true, ref: CATALOG_CONTENT_REF };
 function resolveCatalogRef(probe) {
   const { name, registered, ref, autoUpdate } = probe;
   if (!registered) return void 0;
@@ -6281,7 +6285,7 @@ function resolveCatalogRef(probe) {
     reason: `no ref pinned \u2014 the catalog is served from the repo's default branch while plugin content is pinned to ${CATALOG_CONTENT_REF}`
   };
 }
-function checkMarketplaceAutoUpdate(probe) {
+function checkMarketplaceAutoUpdate(probe, healable = false) {
   if (!probe) return null;
   const evidence = [`${probe.name}: auto-update ${probe.effective ? "on" : "off"} \u2014 ${probe.reason}`];
   if (probe.effective) {
@@ -6292,11 +6296,11 @@ function checkMarketplaceAutoUpdate(probe) {
     ok: true,
     warn: true,
     label: `marketplace auto-update (${probe.name})`,
-    detail: `off \u2014 this machine will not pick up a new plugin release on its own; turn it on with ${AUTO_UPDATE_TOGGLE_STEPS}`,
+    detail: `off \u2014 this machine will not pick up a new plugin release on its own; ${healable ? `${PIN_HEAL_COMMAND} to turn it on` : `turn it on with ${AUTO_UPDATE_TOGGLE_STEPS}`}`,
     verbose: evidence
   };
 }
-function checkMarketplaceCatalogRef(probe) {
+function checkMarketplaceCatalogRef(probe, healable = false) {
   if (!probe) return null;
   const label = `marketplace catalog ref (${probe.name})`;
   const evidence = [`${probe.name}: ${probe.reason}`, `auto-update: ${probe.autoUpdate ? "on" : "off"}`];
@@ -6313,7 +6317,7 @@ function checkMarketplaceCatalogRef(probe) {
       // ✗ branch carried it in `fix` only because `renderCheckLine` discarded `detail` on failure — one
       // row, two conventions, decided by which field would actually print.
       detail: `${drift} while auto-update is ON`,
-      fix: `this machine installs plugin releases advertised by a branch nobody released; ${CATALOG_REF_PIN_STEPS}`,
+      fix: `this machine installs plugin releases advertised by a branch nobody released; ${healable ? `${PIN_HEAL_COMMAND} to pin it` : CATALOG_REF_PIN_STEPS}`,
       verbose: evidence
     };
   }
@@ -6322,11 +6326,11 @@ function checkMarketplaceCatalogRef(probe) {
     ok: true,
     warn: true,
     label,
-    detail: `${drift} \u2014 harmless while auto-update is off, and the thing to fix before turning it on; ${CATALOG_REF_PIN_STEPS}`,
+    detail: `${drift} \u2014 harmless while auto-update is off, and the thing to fix before turning it on; ${healable ? `${PIN_HEAL_COMMAND} to pin it` : CATALOG_REF_PIN_STEPS}`,
     verbose: evidence
   };
 }
-function marketplaceRows(name, known, settings) {
+function marketplaceRows(name, known, settings, healable = false) {
   const { registered, declared, ref } = readKnownMarketplace(known, name);
   const autoUpdate = resolveAutoUpdate({
     name,
@@ -6334,8 +6338,9 @@ function marketplaceRows(name, known, settings) {
     declared,
     settingsDeclared: readSettingsAutoUpdate(settings, name)
   });
-  const rows = [checkMarketplaceAutoUpdate(autoUpdate), checkMarketplaceCatalogRef(
-    resolveCatalogRef({ name, registered, ref, autoUpdate: autoUpdate.effective })
+  const rows = [checkMarketplaceAutoUpdate(autoUpdate, healable), checkMarketplaceCatalogRef(
+    resolveCatalogRef({ name, registered, ref, autoUpdate: autoUpdate.effective }),
+    healable
   )];
   return rows.filter((r) => r !== null);
 }
@@ -6432,7 +6437,7 @@ function scanInstallDirs(root, fs2 = realFsProbe) {
   return [factsFor(""), ...children.map(factsFor).filter((f) => f.hasPackageJson)];
 }
 function npmInstallTargets(dirs) {
-  return dirs.filter((d) => d.hasPackageJson && !d.hasNodeModules).map((d) => ({ dir: d.dir, command: d.hasLockfile ? "npm ci" : "npm install" }));
+  return dirs.filter((d) => d.hasPackageJson && !d.hasNodeModules).map((d) => ({ dir: d.dir, command: d.hasLockfile ? "npm ci" : "npm install --no-package-lock" }));
 }
 function isLinkedWorktree(root, fs2 = realFsProbe) {
   return fs2.isFile((0, import_node_path10.join)(root, ".git"));
@@ -6619,7 +6624,7 @@ function commandLadderHint() {
 }
 
 // src/index.ts
-var import_node_path33 = require("node:path");
+var import_node_path34 = require("node:path");
 
 // src/merge-ci-policy.ts
 function resolveMergeCiPolicy(input) {
@@ -9512,6 +9517,57 @@ async function runReleaseAbort(deps, options = {}) {
     note: `removed the unpublished ${tag} candidate and restored local main; repair development before recutting`
   };
 }
+async function runReleasePublishRetry(deps, runId, options = {}) {
+  if (!options.approved) {
+    throw new Error("release --retry-publish requires --apply after explicit approval; nothing was written");
+  }
+  if (!Number.isSafeInteger(runId) || runId <= 0) throw new Error(`invalid publish run id ${runId}`);
+  const ctx = await buildTrainApplyContext(deps);
+  if (!isHubControlRepo(ctx.repo)) {
+    throw new Error("release --retry-publish is limited to mutmutco/MMI-Hub");
+  }
+  await requireCleanTree(deps);
+  await runGitRemoteRead(deps, ["fetch", "origin", "--tags"]);
+  const readRun = async () => {
+    const raw = await deps.run("gh", ["run", "view", String(runId), "--repo", ctx.repo, "--json", "databaseId,workflowName,event,headBranch,headSha,status,conclusion,url"]);
+    try {
+      return JSON.parse(raw);
+    } catch {
+      throw new Error(`publish run ${runId} metadata was not valid JSON`);
+    }
+  };
+  const run = await readRun();
+  if (run.databaseId !== runId || run.workflowName !== "publish" || run.event !== "release" || run.status !== "completed" || run.conclusion !== "failure") {
+    throw new Error(`run ${runId} is not a completed failed Hub publish release run; nothing was written`);
+  }
+  const tag = run.headBranch ?? "";
+  const tagSha = run.headSha ?? "";
+  if (!/^v\d+\.\d+\.\d+$/.test(tag) || !/^[0-9a-f]{40}$/.test(tagSha)) {
+    throw new Error(`run ${runId} has invalid release identity (${tag || "(no tag)"} / ${tagSha || "(no sha)"}); nothing was written`);
+  }
+  if (await probeRemoteTag(deps, tag) !== tagSha) {
+    throw new Error(`run ${runId} does not match origin ${tag}; nothing was written`);
+  }
+  await verifyPublishedRelease(deps, ctx.repo, tag, "main", tagSha);
+  await deps.run("gh", ["run", "rerun", String(runId), "--repo", ctx.repo, "--failed"]);
+  if (options.watch) {
+    await deps.run("gh", ["run", "watch", String(runId), "--repo", ctx.repo, "--exit-status"]);
+    const completed = await readRun();
+    if (completed.status !== "completed" || completed.conclusion !== "success") {
+      throw new Error(`publish run ${runId} did not finish successfully after retry`);
+    }
+  }
+  return {
+    command: "release-retry-publish",
+    repo: ctx.repo,
+    tag,
+    tagSha,
+    runId,
+    runUrl: run.url ?? `https://github.com/${ctx.repo}/actions/runs/${runId}`,
+    status: options.watch ? "success" : "pending",
+    note: options.watch ? `publish run ${runId} retried and passed` : `publish run ${runId} failed jobs queued for retry`
+  };
+}
 async function runTrainApplyPipeline(mode, input) {
   const { deps, ctx, command, meta, branchHints, watch, options } = input;
   const directTrack = input.directTrack ?? false;
@@ -13389,6 +13445,7 @@ function spawnExitCode(status, signal) {
 function defaultSpawn(command, args, env) {
   const target = resolveSpawnTarget(command, args);
   const r = (0, import_node_child_process6.spawnSync)(target.cmd, target.args, {
+    windowsHide: true,
     stdio: "inherit",
     env,
     windowsVerbatimArguments: target.windowsVerbatimArguments
@@ -14552,9 +14609,10 @@ async function fetchNpmReleasedVersion() {
   }
 }
 var NPM_INSTALL_TIMEOUT_MS = 12e4;
-async function npmSelfUpdateCli(target) {
+async function npmSelfUpdateCli(target, onStep) {
   const command = cliUpdateCommand(target);
   try {
+    onStep?.(command);
     await runHostBin("npm", ["install", "-g", `@mutmutco/cli@${target ?? "latest"}`], { timeout: NPM_INSTALL_TIMEOUT_MS });
     return { ok: true, detail: `${command} exited 0` };
   } catch (e) {
@@ -14620,9 +14678,6 @@ function snapshotPluginGuardInput(surface = detectSurface(process.env), isOrgRep
     ) : (0, import_node_fs18.existsSync)((0, import_node_path16.join)(root, "plugins", "cache", "mutmutco", "mmi"))
   };
 }
-function activePluginGuardState(isOrgRepo) {
-  return buildPluginGuardDecision(snapshotPluginGuardInput(detectSurface(process.env), isOrgRepo)).state;
-}
 async function runClaudePlugin(args) {
   try {
     await runHostBin("claude", args, { timeout: CLAUDE_PLUGIN_TIMEOUT_MS });
@@ -14792,27 +14847,35 @@ async function applyPluginHeal(surface, log, opts) {
   if (restored) log(`  ${restored}`);
   return true;
 }
-async function healClaudePluginForDoctor(surface = detectSurface(process.env)) {
+async function healClaudePluginForDoctor(surface = detectSurface(process.env), onStep) {
   if (surfaceToken(surface) !== "claude") {
     return { ok: false, detail: `not a Claude surface (${surface}) \u2014 no Hub-shipped plugin to reinstall` };
   }
   const steps = [];
-  const ok = await applyPluginHeal(surface, (msg) => steps.push(msg.trim()));
+  const ok = await applyPluginHeal(surface, (msg) => {
+    const line = msg.trim();
+    steps.push(line);
+    if (line) onStep?.(line);
+  });
   const pinNote = steps.find((s) => s.startsWith("re-pinned ") || s.includes("re-pin by hand"));
   return {
     ok,
     detail: ok ? `marketplace remove \u2192 add \u2192 install succeeded${pinNote ? `; ${pinNote}` : ""}` : `\`claude plugin\` reinstall failed or was skipped${steps.length ? ` (${steps[steps.length - 1]})` : ""}`
   };
 }
-async function healActivePluginForDoctor(surface = detectSurface(process.env)) {
+async function healActivePluginForDoctor(surface = detectSurface(process.env), onStep) {
   const token = surfaceToken(surface);
   if (token !== "claude" && token !== "codex" && token !== "cursor" && token !== "kilo") {
     return { ok: false, detail: `not a supported plugin surface (${surface})` };
   }
-  if (token === "claude") return healClaudePluginForDoctor(surface);
+  if (token === "claude") return healClaudePluginForDoctor(surface, onStep);
   if (token === "cursor") return installCursorPluginCheckout();
   const steps = [];
-  const applied = await applyPluginHeal(surface, (msg) => steps.push(msg.trim()));
+  const applied = await applyPluginHeal(surface, (msg) => {
+    const line = msg.trim();
+    steps.push(line);
+    if (line) onStep?.(line);
+  });
   const snapshot = applied ? snapshotPluginGuardInput(surface, true) : void 0;
   const guardState = snapshot ? buildPluginGuardDecision(snapshot).state : "unresolved";
   const ok = applied && guardState === "healthy";
@@ -14835,7 +14898,7 @@ function readKnownMarketplacesFile(path2) {
     return void 0;
   }
 }
-function restoreMarketplacePinsOnDisk(path2, pins) {
+function writeMarketplacePinsOnDisk(path2, pins, succeeded, failedVerb) {
   if (pins.size === 0) return void 0;
   const after = readKnownMarketplacesFile(path2);
   const next = restoreMarketplacePins(after, pins);
@@ -14843,14 +14906,35 @@ function restoreMarketplacePinsOnDisk(path2, pins) {
   try {
     (0, import_node_fs18.writeFileSync)(path2, next, "utf8");
   } catch {
-    return `could NOT restore ${[...pins.keys()].join(", ")} \u2014 re-pin by hand`;
+    return `could NOT ${failedVerb} ${[...pins.keys()].join(", ")} \u2014 set it by hand`;
   }
   const verify = readKnownMarketplacesFile(path2);
   const failed = [...pins].filter(([name, want]) => {
     const got = readKnownMarketplace(verify, name);
     return typeof want.autoUpdate === "boolean" && got.declared !== want.autoUpdate || want.ref !== void 0 && got.ref !== want.ref;
   });
-  return failed.length ? `restore did NOT take for ${failed.map(([n]) => n).join(", ")} \u2014 re-pin by hand` : `re-pinned ${[...pins.keys()].join(", ")} (auto-update + catalog ref survive the reinstall)`;
+  return failed.length ? `${failedVerb} did NOT take for ${failed.map(([n]) => n).join(", ")} \u2014 set it by hand` : succeeded(pins);
+}
+function restoreMarketplacePinsOnDisk(path2, pins) {
+  return writeMarketplacePinsOnDisk(path2, pins, restoredPinsLine, "restore");
+}
+function applyOrgMarketplacePins(path2, names) {
+  return writeMarketplacePinsOnDisk(
+    path2,
+    new Map(names.map((name) => [name, ORG_MARKETPLACE_PINS])),
+    (pins) => `pinned ${[...pins.keys()].join(", ")} to ${ORG_MARKETPLACE_PINS.ref} with auto-update on`,
+    "pin"
+  );
+}
+function restoredPinsLine(pins) {
+  const named = [...pins].map(([name, want]) => {
+    const fields = [
+      ...typeof want.autoUpdate === "boolean" ? ["auto-update"] : [],
+      ...want.ref ? ["catalog ref"] : []
+    ];
+    return `${name} (${fields.join(" + ")})`;
+  });
+  return `re-pinned ${named.join(", ")} \u2014 restored across the reinstall`;
 }
 async function runGuard(readOrigin) {
   const surface = detectSurface(process.env);
@@ -16505,12 +16589,13 @@ var PRIMARY_GROUPS = [
   ["Plan and work", ["board", "issue", "worktree", "stage"]],
   ["Review and ship", ["pr", "ci", "rcand", "release", "hotfix", "train"]],
   // `tests` sits beside `docs` deliberately: both are deterministic, repo-local gates a workflow
-  // step invokes (`docs refs`, `tests policy`), not org-plane operations (#3605).
-  ["Setup and support", ["bootstrap", "secrets", "docs", "tests"]],
+  // step invokes (`docs refs`, `tests policy`), not org-plane operations (#3605). `spawn policy`
+  // joins them on the same footing (#3979).
+  ["Setup and support", ["bootstrap", "secrets", "docs", "tests", "spawn"]],
   ["Coordinate and improve", ["wave", "report", "skill-lesson"]]
 ];
 var OPERATIONAL_TOP_LEVEL = /* @__PURE__ */ new Set(["org", "runtime", "plugin"]);
-var SUPPORT_PRIMARY = /* @__PURE__ */ new Set(["doctor", "whoami", "commands", "explain", "docs", "tests", "wave", "report", "skill-lesson"]);
+var SUPPORT_PRIMARY = /* @__PURE__ */ new Set(["doctor", "whoami", "commands", "explain", "docs", "tests", "spawn", "wave", "report", "skill-lesson"]);
 var TOP_LEVEL_ORDER = /* @__PURE__ */ new Map();
 var HELP_GROUP_ORDER = /* @__PURE__ */ new Map();
 var topLevelPosition = 0;
@@ -16550,6 +16635,7 @@ var COMMAND_OWNERSHIP = {
   secrets: { module_owner: "cli/src/secrets-commands.ts", consumer: "authenticated-operator" },
   docs: { module_owner: "cli/src/docs-index-command.ts", consumer: "repo-gates" },
   tests: { module_owner: "cli/src/test-policy-core.ts", consumer: "repo-gates" },
+  spawn: { module_owner: "cli/src/spawn-policy-core.ts", consumer: "repo-gates" },
   wave: { module_owner: "cli/src/wave-land.ts", consumer: "campaign-orchestrator" },
   report: { module_owner: "cli/src/report.ts", consumer: "campaign-orchestrator" },
   "skill-lesson": { module_owner: "cli/src/skill-lesson.ts", consumer: "campaign-orchestrator" },
@@ -18841,10 +18927,115 @@ function runDocRefs(root, deps = {}) {
   };
 }
 
-// src/test-policy-core.ts
+// src/spawn-policy-core.ts
 var import_node_child_process11 = require("node:child_process");
 var import_node_fs21 = require("node:fs");
 var import_node_path19 = require("node:path");
+var SPAWNERS = ["spawn", "spawnSync", "exec", "execSync", "execFile", "execFileSync"];
+var CALL_SOURCE = String.raw`(^|[^.\w$])(${SPAWNERS.join("|")})\s*\(`;
+var SOURCE_EXT = /\.(ts|mts|cts|js|mjs|cjs)$/;
+var EXCLUDED = [
+  /(^|\/)node_modules\//,
+  /(^|\/)(dist|build|coverage)\//,
+  /(^|\/)(test|tests|__tests__|fixtures|__fixtures__)\//,
+  /\.(test|spec)\.[cm]?[jt]s$/,
+  /\.d\.[cm]?ts$/
+];
+function stripComments(src) {
+  return src.replace(/\/\*[\s\S]*?\*\//g, (m) => m.replace(/[^\n]/g, " ")).replace(/(^|[^:])\/\/[^\n]*/g, (m, p) => p + " ".repeat(m.length - p.length));
+}
+function callArgs(src, open2) {
+  let depth = 0;
+  for (let i = open2; i < src.length; i++) {
+    const c = src[i];
+    if (c === "(") depth++;
+    else if (c === ")") {
+      depth--;
+      if (depth === 0) return src.slice(open2, i + 1);
+    }
+  }
+  return "";
+}
+function findViolationsInSource(raw) {
+  if (!/from\s+["']node:child_process["']/.test(raw)) return [];
+  const importBlock = /import\s*(?:type\s*)?\{([^}]*)\}\s*from\s+["']node:child_process["']/.exec(raw);
+  const imported = new Set(
+    (importBlock?.[1] ?? "").split(",").map((s) => s.trim().split(/\s+as\s+/)[0].trim()).filter(Boolean)
+  );
+  if (imported.size === 0) return [];
+  const rawLines = raw.split("\n");
+  const src = stripComments(raw);
+  const call = new RegExp(CALL_SOURCE, "g");
+  const found = [];
+  let m;
+  while (m = call.exec(src)) {
+    const callee = m[2];
+    if (!imported.has(callee)) continue;
+    const open2 = m.index + m[0].length - 1;
+    const args = callArgs(src, open2);
+    if (!args) continue;
+    if (args.includes("windowsHide")) continue;
+    const line = src.slice(0, m.index + m[1].length).split("\n").length;
+    if (/windows-hide-exempt:/.test(rawLines[line - 2] ?? "")) continue;
+    if (/\.{3}\s*\w+/.test(args)) continue;
+    if (/\b(opts|options|spawnOptions)\b/.test(args)) continue;
+    const identifiers = new Set(args.match(/\b[A-Za-z_$][\w$]*\b/g) ?? []);
+    let satisfied = false;
+    for (const id of identifiers) {
+      if (SPAWNERS.includes(id)) continue;
+      const decl = new RegExp(String.raw`\b(?:const|let|var)\s+${id}\b[^;]*`, "s").exec(src);
+      if (decl && decl[0].includes("windowsHide")) {
+        satisfied = true;
+        break;
+      }
+      if (new RegExp(String.raw`\b${id}\s*:\s*\{[^}]*windowsHide`, "s").test(src)) {
+        satisfied = true;
+        break;
+      }
+    }
+    if (satisfied) continue;
+    found.push({ line, callee });
+  }
+  return found;
+}
+function policedFiles(root) {
+  const r = (0, import_node_child_process11.spawnSync)("git", ["ls-files", "-z", "--cached", "--others", "--exclude-standard"], {
+    cwd: root,
+    encoding: "utf8",
+    windowsHide: true,
+    maxBuffer: 32 * 1024 * 1024
+  });
+  if (r.status !== 0) {
+    throw new Error(`spawn policy: git ls-files failed: ${(r.stderr || "").trim() || `exit ${r.status}`}`);
+  }
+  return (r.stdout ?? "").split("\0").filter(Boolean).filter((f) => SOURCE_EXT.test(f)).filter((f) => !EXCLUDED.some((re) => re.test(f)));
+}
+function runSpawnPolicy(root) {
+  const files = policedFiles(root);
+  const findings = [];
+  for (const file of files) {
+    let raw;
+    try {
+      raw = (0, import_node_fs21.readFileSync)((0, import_node_path19.join)(root, file), "utf8");
+    } catch {
+      continue;
+    }
+    for (const v of findViolationsInSource(raw)) {
+      findings.push({
+        file,
+        line: v.line,
+        callee: v.callee,
+        detail: `${file}:${v.line} ${v.callee}(...) has no windowsHide`
+      });
+    }
+  }
+  return { ok: findings.length === 0, scannedCount: files.length, findings };
+}
+
+// src/test-policy-core.ts
+var import_node_child_process12 = require("node:child_process");
+var import_node_fs22 = require("node:fs");
+var import_node_path20 = require("node:path");
 var POLICY_FILE = "test-policy.json";
 var TEST_RE = /\.(?:test|spec)\.[cm]?[jt]sx?$/;
 var PY_TEST_RE = /(?:^|\/)test_[^/]*\.py$|_test\.py$/;
@@ -18897,7 +19088,7 @@ function isTestPath(path2) {
   return TEST_RE.test(path2) || PY_TEST_RE.test(path2);
 }
 function loadPolicy(root, readFile9 = readFileOrNull2) {
-  const raw = readFile9((0, import_node_path19.join)(root, POLICY_FILE));
+  const raw = readFile9((0, import_node_path20.join)(root, POLICY_FILE));
   if (raw == null) return { mandatory: [], declared: false };
   try {
     return { ...JSON.parse(raw), declared: true };
@@ -18907,7 +19098,7 @@ function loadPolicy(root, readFile9 = readFileOrNull2) {
 }
 function readFileOrNull2(path2) {
   try {
-    return (0, import_node_fs21.readFileSync)(path2, "utf8");
+    return (0, import_node_fs22.readFileSync)(path2, "utf8");
   } catch {
     return null;
   }
@@ -18934,12 +19125,12 @@ function classify(changed, policy, present = () => false) {
   const removedProtected = [...removed].filter((p) => protectedBy.has(p)).map((p) => ({ path: p, why: protectedBy.get(p) ?? "" }));
   return { mandatoryHits, untestedHits, testChanges, addedTests, removedProtected };
 }
-function unresolvedProtectedEntries(policy, root, exists = (path2) => (0, import_node_fs21.existsSync)(path2)) {
-  return (policy.protected ?? []).map((p) => p.path).filter((p) => !exists((0, import_node_path19.join)(root, p)));
+function unresolvedProtectedEntries(policy, root, exists = (path2) => (0, import_node_fs22.existsSync)(path2)) {
+  return (policy.protected ?? []).map((p) => p.path).filter((p) => !exists((0, import_node_path20.join)(root, p)));
 }
-function unresolvedSatisfiers(policy, root, exists = (path2) => (0, import_node_fs21.existsSync)(path2)) {
+function unresolvedSatisfiers(policy, root, exists = (path2) => (0, import_node_fs22.existsSync)(path2)) {
   const declared = (policy.mandatory ?? []).flatMap((m) => m.satisfiedBy ?? []);
-  return [...new Set(declared)].filter((p) => !exists((0, import_node_path19.join)(root, p)));
+  return [...new Set(declared)].filter((p) => !exists((0, import_node_path20.join)(root, p)));
 }
 function evaluate(changed, policy, present = () => false) {
   const { mandatoryHits, untestedHits, testChanges, addedTests, removedProtected } = classify(changed, policy, present);
@@ -18972,14 +19163,15 @@ function evaluate(changed, policy, present = () => false) {
   return findings;
 }
 function git(args, cwd) {
-  return (0, import_node_child_process11.execFileSync)("git", args, { cwd, encoding: "utf8", maxBuffer: 32 * 1024 * 1024 });
+  return (0, import_node_child_process12.execFileSync)("git", args, { windowsHide: true, cwd, encoding: "utf8", maxBuffer: 32 * 1024 * 1024 });
 }
 var COAUTHOR_KEY = "Co-authored-by";
 var GH_MESSAGE_SEPARATOR = /^-{5,}$/;
 var LIFTED_KEYS = new RegExp(`^(?:${TRAILER_KEY}|${COAUTHOR_KEY}):`, "i");
 function parseTrailers(message, cwd) {
   try {
-    return (0, import_node_child_process11.execFileSync)("git", ["interpret-trailers", "--parse", "--unfold"], {
+    return (0, import_node_child_process12.execFileSync)("git", ["interpret-trailers", "--parse", "--unfold"], {
+      windowsHide: true,
       cwd,
       input: message,
       encoding: "utf8",
@@ -19120,13 +19312,13 @@ function changedFilesSince(base, cwd) {
 }
 function runTestPolicy(root, deps = {}) {
   const policy = deps.policy ?? loadPolicy(root);
-  const exists = deps.exists ?? ((path2) => (0, import_node_fs21.existsSync)(path2));
+  const exists = deps.exists ?? ((path2) => (0, import_node_fs22.existsSync)(path2));
   const counts = { mandatoryCount: (policy.mandatory ?? []).length, protectedCount: (policy.protected ?? []).length };
   const base = deps.changed ? "(injected)" : resolveBase(root, deps.base);
   const refusal = deps.changed ? null : untrustworthyRange(root, base);
   const changed = deps.changed ?? (refusal ? [] : changedFilesSince(base, root));
   const lookup = deps.override !== void 0 ? { override: deps.override, refusals: [] } : !deps.changed && !refusal ? readOverride(base, root) : { override: null, refusals: [] };
-  const present = (path2) => exists((0, import_node_path19.join)(root, path2));
+  const present = (path2) => exists((0, import_node_path20.join)(root, path2));
   const removedByThisDiff = removedPaths(changed);
   const staleFindings = [];
   const unresolved = unresolvedProtectedEntries(policy, root, exists).filter((p) => !removedByThisDiff.has(p));
@@ -19282,8 +19474,8 @@ function docsAuditStatus(fetch2, opts) {
 }
 
 // src/project-info-sync.ts
-var import_node_fs22 = require("node:fs");
-var import_node_path20 = require("node:path");
+var import_node_fs23 = require("node:fs");
+var import_node_path21 = require("node:path");
 var UPDATE_PROJECT_INFO = `mutation($projectId: ID!, $shortDescription: String!, $readme: String!) {
   updateProjectV2(input: { projectId: $projectId, shortDescription: $shortDescription, readme: $readme }) {
     projectV2 { id }
@@ -19328,14 +19520,14 @@ function sharedName(entries, fallback) {
 }
 function buildProjectInfoSyncPlan(targetRepo2, project2, projects, repoRoot2) {
   if (!project2.projectId) throw new Error(`org project sync-info: ${targetRepo2} registry META has no projectId`);
-  const readmePath = (0, import_node_path20.join)(repoRoot2, "README.md");
-  if (!(0, import_node_fs22.existsSync)(readmePath)) throw new Error(`org project sync-info: ${targetRepo2} has no README.md`);
+  const readmePath = (0, import_node_path21.join)(repoRoot2, "README.md");
+  if (!(0, import_node_fs23.existsSync)(readmePath)) throw new Error(`org project sync-info: ${targetRepo2} has no README.md`);
   const entries = entriesFor(project2, projects);
   const memberRepos = [...new Set(entries.flatMap((entry) => entry.repos ?? []))].filter((repo) => /^[^/]+\/[^/]+$/.test(repo)).sort((a, b) => a.localeCompare(b));
   const projectName = sharedName(entries, project2.name?.trim() || targetRepo2.split("/").pop() || targetRepo2);
   if (!memberRepos.length) throw new Error(`org project sync-info: project ${projectName} has no registered member repos`);
   const entryNames = entries.map((entry) => entry.name?.trim()).filter((name) => Boolean(name));
-  const shortDescription = memberRepos.length === 1 ? shortDescriptionFromReadme((0, import_node_fs22.readFileSync)(readmePath, "utf8")) : `Shared work across ${new Intl.ListFormat("en", { type: "conjunction" }).format(entryNames)}.`;
+  const shortDescription = memberRepos.length === 1 ? shortDescriptionFromReadme((0, import_node_fs23.readFileSync)(readmePath, "utf8")) : `Shared work across ${new Intl.ListFormat("en", { type: "conjunction" }).format(entryNames)}.`;
   const lines = [
     `# ${projectName}`,
     "",
@@ -19354,8 +19546,8 @@ function buildProjectInfoSyncPlan(targetRepo2, project2, projects, repoRoot2) {
   const targetBase = `https://github.com/${targetRepo2}`;
   const targetBranch = branchFor(targetRepo2, projects);
   const orgDocs = [
-    (0, import_node_fs22.existsSync)((0, import_node_path20.join)(repoRoot2, "docs", "org-readme.md")) ? `- [Org identity](${targetBase}/blob/${targetBranch}/docs/org-readme.md)` : "",
-    (0, import_node_fs22.existsSync)((0, import_node_path20.join)(repoRoot2, "docs", "org-architecture.md")) ? `- [Org architecture](${targetBase}/blob/${targetBranch}/docs/org-architecture.md)` : ""
+    (0, import_node_fs23.existsSync)((0, import_node_path21.join)(repoRoot2, "docs", "org-readme.md")) ? `- [Org identity](${targetBase}/blob/${targetBranch}/docs/org-readme.md)` : "",
+    (0, import_node_fs23.existsSync)((0, import_node_path21.join)(repoRoot2, "docs", "org-architecture.md")) ? `- [Org architecture](${targetBase}/blob/${targetBranch}/docs/org-architecture.md)` : ""
   ].filter(Boolean);
   if (orgDocs.length) lines.push("", "## Organisation docs", "", ...orgDocs);
   return { projectId: project2.projectId, projectName, targetRepo: targetRepo2, memberRepos, shortDescription, readme: `${lines.join("\n")}
@@ -20214,8 +20406,8 @@ function writeError(res) {
 }
 
 // src/secrets-commands.ts
-var import_node_fs23 = require("node:fs");
-var import_node_path21 = require("node:path");
+var import_node_fs24 = require("node:fs");
+var import_node_path22 = require("node:path");
 var import_node_os8 = require("node:os");
 
 // src/project-runtime.ts
@@ -20339,18 +20531,18 @@ function collectMap(value, previous = []) {
   return [...previous, value];
 }
 async function decryptRailsCredentials(input) {
-  const appDir = (0, import_node_path21.resolve)(input.appDir ?? process.cwd());
+  const appDir = (0, import_node_path22.resolve)(input.appDir ?? process.cwd());
   const credentialsFile = input.credentialsFile ?? DEFAULT_RAILS_CREDENTIALS_FILE;
   const masterKeyFile = input.masterKeyFile ?? DEFAULT_RAILS_MASTER_KEY_FILE;
-  const credentialsPath = (0, import_node_path21.resolve)(appDir, credentialsFile);
-  const masterKeyPath = (0, import_node_path21.resolve)(appDir, masterKeyFile);
+  const credentialsPath = (0, import_node_path22.resolve)(appDir, credentialsFile);
+  const masterKeyPath = (0, import_node_path22.resolve)(appDir, masterKeyFile);
   const env = {
     ...process.env,
     MMI_RAILS_CREDENTIALS_FILE: credentialsPath,
     MMI_RAILS_MASTER_KEY_FILE: masterKeyPath
   };
-  if ((0, import_node_fs23.existsSync)(masterKeyPath)) {
-    env.RAILS_MASTER_KEY = (0, import_node_fs23.readFileSync)(masterKeyPath, "utf8").trim();
+  if ((0, import_node_fs24.existsSync)(masterKeyPath)) {
+    env.RAILS_MASTER_KEY = (0, import_node_fs24.readFileSync)(masterKeyPath, "utf8").trim();
   }
   const script = [
     'require "json"',
@@ -20360,9 +20552,9 @@ async function decryptRailsCredentials(input) {
     'config = ActiveSupport::EncryptedConfiguration.new(config_path: config_path, key_path: key_path, env_key: "RAILS_MASTER_KEY", raise_if_missing_key: true)',
     "puts JSON.generate(config.config)"
   ].join("\n");
-  const scriptDir = (0, import_node_fs23.mkdtempSync)((0, import_node_path21.join)((0, import_node_os8.tmpdir)(), "mmi-rails-decrypt-"));
-  const scriptPath = (0, import_node_path21.join)(scriptDir, "decrypt.rb");
-  (0, import_node_fs23.writeFileSync)(scriptPath, script, "utf8");
+  const scriptDir = (0, import_node_fs24.mkdtempSync)((0, import_node_path22.join)((0, import_node_os8.tmpdir)(), "mmi-rails-decrypt-"));
+  const scriptPath = (0, import_node_path22.join)(scriptDir, "decrypt.rb");
+  (0, import_node_fs24.writeFileSync)(scriptPath, script, "utf8");
   try {
     const args = ["exec", "ruby", scriptPath];
     const cmd = process.platform === "win32" ? "cmd.exe" : "bundle";
@@ -20374,7 +20566,7 @@ async function decryptRailsCredentials(input) {
     });
     return JSON.parse(stdout);
   } finally {
-    (0, import_node_fs23.rmSync)(scriptDir, { recursive: true, force: true });
+    (0, import_node_fs24.rmSync)(scriptDir, { recursive: true, force: true });
   }
 }
 async function readSecretStdin() {
@@ -20464,7 +20656,7 @@ function registerSecretsCommands(program3) {
     let body;
     if (o.file) {
       try {
-        body = (0, import_node_fs23.readFileSync)((0, import_node_path21.resolve)(o.file), "utf8");
+        body = (0, import_node_fs24.readFileSync)((0, import_node_path22.resolve)(o.file), "utf8");
       } catch (e) {
         return fail(`secrets org-catalog: cannot read --file ${o.file}: ${e.message}`);
       }
@@ -20569,7 +20761,7 @@ function registerSecretsCommands(program3) {
       {
         ...d,
         decryptRailsCredentials,
-        removeFile: (path2) => (0, import_node_fs23.unlinkSync)((0, import_node_path21.resolve)(o.appDir ?? process.cwd(), path2))
+        removeFile: (path2) => (0, import_node_fs24.unlinkSync)((0, import_node_path22.resolve)(o.appDir ?? process.cwd(), path2))
       },
       {
         repo: o.repo,
@@ -20763,7 +20955,7 @@ function checkGithubPools(probe) {
 }
 
 // src/box-commands.ts
-var import_node_fs24 = require("node:fs");
+var import_node_fs25 = require("node:fs");
 
 // src/box.ts
 var BOX_KEYS = {
@@ -20966,7 +21158,7 @@ function registerBoxCommands(program3) {
       }
       if (o.json) console.log(JSON.stringify({ box: found, incomplete }, null, 2));
       else if (o.ssh && o.script) {
-        (0, import_node_fs24.writeFileSync)(o.script, sshRecipeScript(found), "utf8");
+        (0, import_node_fs25.writeFileSync)(o.script, sshRecipeScript(found), "utf8");
         console.log(`wrote ${o.script} \u2014 run: bash "${o.script}"`);
       } else if (o.ssh) console.log(`${formatSshRecipe(found)}
 ${SSH_RECIPE_AGENT_NOTE}`);
@@ -20981,7 +21173,7 @@ ${SSH_RECIPE_AGENT_NOTE}`);
 
 // src/schedules-commands.ts
 var import_promises3 = require("node:fs/promises");
-var import_node_child_process12 = require("node:child_process");
+var import_node_child_process13 = require("node:child_process");
 var import_node_util7 = require("node:util");
 
 // src/schedules.ts
@@ -21421,7 +21613,7 @@ function assembleReconciliation(githubEntries2, readRepos, registry2, activeWork
 }
 
 // src/schedules-commands.ts
-var execFileP5 = (0, import_node_util7.promisify)(import_node_child_process12.execFile);
+var execFileP5 = (0, import_node_util7.promisify)(import_node_child_process13.execFile);
 var AWS_REGION = "eu-central-1";
 var AWS_TIMEOUT_MS = 3e4;
 var AWS_RETRY_DELAY_MS = 1500;
@@ -21658,7 +21850,7 @@ function registerSchedulesCommands(program3) {
 
 // src/file-lock.ts
 var import_promises4 = require("node:fs/promises");
-var import_node_path22 = require("node:path");
+var import_node_path23 = require("node:path");
 var sleep = (ms) => new Promise((resolve5) => setTimeout(resolve5, ms));
 var IMMEDIATE_RETRY_BUDGET = 3;
 var FileLockBusyError = class extends Error {
@@ -21743,7 +21935,7 @@ async function releaseFileLock(lockPath, guard) {
 }
 async function withFileLock(lockPath, opts, fn) {
   const resolved = resolveFileLockOpts(opts);
-  await (0, import_promises4.mkdir)((0, import_node_path22.dirname)(lockPath), { recursive: true }).catch(() => void 0);
+  await (0, import_promises4.mkdir)((0, import_node_path23.dirname)(lockPath), { recursive: true }).catch(() => void 0);
   const guard = await acquireFileLock(lockPath, resolved, Date.now() + resolved.maxWaitMs);
   try {
     return await fn();
@@ -21754,7 +21946,7 @@ async function withFileLock(lockPath, opts, fn) {
 
 // src/schedules-lift-command.ts
 var import_promises5 = require("node:fs/promises");
-var import_node_path23 = require("node:path");
+var import_node_path24 = require("node:path");
 
 // src/schedules-lift.ts
 var SCHEDULE_HEADER_FIELDS = ["schedule", "what", "owner", "cadence", "executor", "llm", "output", "breaks", "kill"];
@@ -21860,7 +22052,7 @@ async function readWorkflowFiles(dir) {
   const files = [];
   for (const name of names.sort()) {
     if (!/\.ya?ml$/.test(name)) continue;
-    files.push({ path: `.github/workflows/${name}`, text: await (0, import_promises5.readFile)((0, import_node_path23.join)(dir, name), "utf8") });
+    files.push({ path: `.github/workflows/${name}`, text: await (0, import_promises5.readFile)((0, import_node_path24.join)(dir, name), "utf8") });
   }
   return files;
 }
@@ -22402,9 +22594,9 @@ function registerQueryCommands(program3) {
 }
 
 // src/bootstrap-commands.ts
-var import_node_fs25 = require("node:fs");
+var import_node_fs26 = require("node:fs");
 var import_node_os9 = require("node:os");
-var import_node_path24 = require("node:path");
+var import_node_path25 = require("node:path");
 
 // src/bootstrap-drift.ts
 function byteComparableSeeds(manifest, cls) {
@@ -23018,13 +23210,13 @@ function registerBootstrapCommands(program3) {
       client: defaultGitHubClient(),
       projectMeta: meta,
       deployModel: typeof meta?.deployModel === "string" ? meta.deployModel : void 0,
-      readLocalFile: (path2) => path2 === "projects.json" && apiProjects != null ? apiProjects : (0, import_node_fs25.existsSync)(path2) ? (0, import_node_fs25.readFileSync)(path2, "utf8") : null,
+      readLocalFile: (path2) => path2 === "projects.json" && apiProjects != null ? apiProjects : (0, import_node_fs26.existsSync)(path2) ? (0, import_node_fs26.readFileSync)(path2, "utf8") : null,
       // requiredGcpApis is stored as an array by a JSON write, but `org project set --var KEY=VALUE` stores a raw
       // comma-string — accept either so the seeded value verifies regardless of how it was written.
       // #3689: the same committed map the org access audit reads (#3664), so a sanctioned admin is not a
       // permanent bootstrap failure on one surface and an intended state on the other. Absent file → no
       // sanction, which is the pre-#3664 behaviour.
-      sanctionedAdmins: (0, import_node_fs25.existsSync)("access-matrix.json") ? entriesValueByCanonicalRepo(loadSanctionedAdmins((0, import_node_fs25.readFileSync)("access-matrix.json", "utf8")), repo) : void 0,
+      sanctionedAdmins: (0, import_node_fs26.existsSync)("access-matrix.json") ? entriesValueByCanonicalRepo(loadSanctionedAdmins((0, import_node_fs26.readFileSync)("access-matrix.json", "utf8")), repo) : void 0,
       requiredGcpApis: (() => {
         const v = meta?.requiredGcpApis;
         if (Array.isArray(v)) return v;
@@ -23062,12 +23254,12 @@ function registerBootstrapCommands(program3) {
   bootstrap.command("drift").description("#3818: compare every org-owned whole-file seed against MMI-Hub's copy across the registry roster; read-only").option("--repo <owner/repo>", "audit one repo instead of the roster (never a fleet verdict)").option("--json", "machine-readable output").action(async () => {
     const o = { repo: rawValue("--repo", ""), json: rawFlag("--json") };
     const manifestPath = "skills/bootstrap/seeds/manifest.json";
-    if (!(0, import_node_fs25.existsSync)(manifestPath)) return fail(`bootstrap drift: ${manifestPath} not found; run from the MMI-Hub repo root \u2014 the Hub's copies ARE the reference this compares against`);
-    const manifest = loadBootstrapSeeds((0, import_node_fs25.readFileSync)(manifestPath, "utf8"));
+    if (!(0, import_node_fs26.existsSync)(manifestPath)) return fail(`bootstrap drift: ${manifestPath} not found; run from the MMI-Hub repo root \u2014 the Hub's copies ARE the reference this compares against`);
+    const manifest = loadBootstrapSeeds((0, import_node_fs26.readFileSync)(manifestPath, "utf8"));
     const hubContents = /* @__PURE__ */ new Map();
     for (const s of manifest.seeds) {
       if (s.ownership !== "org" || s.source !== "self") continue;
-      hubContents.set(s.target, (0, import_node_fs25.existsSync)(s.target) ? (0, import_node_fs25.readFileSync)(s.target, "utf8") : null);
+      hubContents.set(s.target, (0, import_node_fs26.existsSync)(s.target) ? (0, import_node_fs26.readFileSync)(s.target, "utf8") : null);
     }
     let targets;
     let classOf = (_repo) => "deployable";
@@ -23144,8 +23336,8 @@ function registerBootstrapCommands(program3) {
       return fail(`bootstrap apply: ${e.message}`);
     }
     const manifestPath = "skills/bootstrap/seeds/manifest.json";
-    if (!(0, import_node_fs25.existsSync)(manifestPath)) return fail(`bootstrap apply: ${manifestPath} not found; bootstrap runs from the MMI-Hub repo root by design \u2014 it stamps org-level resources (Project, Ruleset, secrets, access) through the GitHub App, which is only authorized from the Hub checkout`);
-    const manifest = loadBootstrapSeeds((0, import_node_fs25.readFileSync)(manifestPath, "utf8"));
+    if (!(0, import_node_fs26.existsSync)(manifestPath)) return fail(`bootstrap apply: ${manifestPath} not found; bootstrap runs from the MMI-Hub repo root by design \u2014 it stamps org-level resources (Project, Ruleset, secrets, access) through the GitHub App, which is only authorized from the Hub checkout`);
+    const manifest = loadBootstrapSeeds((0, import_node_fs26.readFileSync)(manifestPath, "utf8"));
     const baseBranch = o.class === "content" ? "main" : "development";
     const slug = parsedRepo.slug;
     const onlyTarget = o.only.trim();
@@ -23156,16 +23348,16 @@ function registerBootstrapCommands(program3) {
   ${known}`);
     }
     const gh = async (args) => execFileP2("gh", args, { timeout: 2e4 });
-    const readFile9 = (p) => (0, import_node_fs25.existsSync)(p) ? (0, import_node_fs25.readFileSync)(p, "utf8") : null;
+    const readFile9 = (p) => (0, import_node_fs26.existsSync)(p) ? (0, import_node_fs26.readFileSync)(p, "utf8") : null;
     const enc = (p) => p.split("/").map(encodeURIComponent).join("/");
     const putSeed = async (target, content, ref, sha) => {
-      const tmp = (0, import_node_path24.join)((0, import_node_os9.tmpdir)(), `mmi-seed-${process.pid}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}.json`);
-      (0, import_node_fs25.writeFileSync)(tmp, JSON.stringify(contentPutBody(target, content, ref, sha)), "utf8");
+      const tmp = (0, import_node_path25.join)((0, import_node_os9.tmpdir)(), `mmi-seed-${process.pid}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}.json`);
+      (0, import_node_fs26.writeFileSync)(tmp, JSON.stringify(contentPutBody(target, content, ref, sha)), "utf8");
       try {
         await gh(contentPutInputArgs(repo, target, tmp));
       } finally {
         try {
-          (0, import_node_fs25.unlinkSync)(tmp);
+          (0, import_node_fs26.unlinkSync)(tmp);
         } catch {
         }
       }
@@ -23417,12 +23609,12 @@ LIVE apply to ${repo}:
 }
 
 // src/stage-commands.ts
-var import_node_fs27 = require("node:fs");
-var import_node_path26 = require("node:path");
+var import_node_fs28 = require("node:fs");
+var import_node_path27 = require("node:path");
 
 // src/port-registry.ts
-var import_node_fs26 = require("node:fs");
-var import_node_path25 = require("node:path");
+var import_node_fs27 = require("node:fs");
+var import_node_path26 = require("node:path");
 
 // ../infra/port-geometry.mjs
 var PORT_BLOCK = 100;
@@ -23436,8 +23628,8 @@ function nextPortBlock(registry2) {
   return [base, base + PORT_SPAN];
 }
 function loadPortRegistry(path2) {
-  if (!(0, import_node_fs26.existsSync)(path2)) return {};
-  const raw = JSON.parse((0, import_node_fs26.readFileSync)(path2, "utf8"));
+  if (!(0, import_node_fs27.existsSync)(path2)) return {};
+  const raw = JSON.parse((0, import_node_fs27.readFileSync)(path2, "utf8"));
   const out = {};
   for (const [key, value] of Object.entries(raw)) {
     if (Array.isArray(value) && value.length === 2 && value.every((n) => typeof n === "number")) {
@@ -23451,9 +23643,9 @@ function ensurePortRange(repo, path2) {
   const existing = registry2[repo];
   if (existing) return existing;
   const range = nextPortBlock(registry2);
-  const raw = (0, import_node_fs26.existsSync)(path2) ? JSON.parse((0, import_node_fs26.readFileSync)(path2, "utf8")) : {};
+  const raw = (0, import_node_fs27.existsSync)(path2) ? JSON.parse((0, import_node_fs27.readFileSync)(path2, "utf8")) : {};
   raw[repo] = range;
-  (0, import_node_fs26.writeFileSync)(path2, JSON.stringify(raw, null, 2) + "\n", "utf8");
+  (0, import_node_fs27.writeFileSync)(path2, JSON.stringify(raw, null, 2) + "\n", "utf8");
   return range;
 }
 function portCursorSeed(registry2) {
@@ -23475,22 +23667,22 @@ function existingPortRange(repo, registry2) {
   return registry2[repo] ?? null;
 }
 function portRangeInfraAt(root, source) {
-  const registryPath = (0, import_node_path25.join)(root, "infra", "port-ranges.json");
-  const ddbScriptPath = (0, import_node_path25.join)(root, "infra", "port-ddb.mjs");
-  if (!(0, import_node_fs26.existsSync)(registryPath) || !(0, import_node_fs26.existsSync)(ddbScriptPath)) return null;
+  const registryPath = (0, import_node_path26.join)(root, "infra", "port-ranges.json");
+  const ddbScriptPath = (0, import_node_path26.join)(root, "infra", "port-ddb.mjs");
+  if (!(0, import_node_fs27.existsSync)(registryPath) || !(0, import_node_fs27.existsSync)(ddbScriptPath)) return null;
   return { root, source, registryPath, ddbScriptPath };
 }
 function resolvePortRangeInfra(cwd, packageDir) {
   const direct = portRangeInfraAt(cwd, "cwd");
   if (direct) return direct;
-  for (let dir = cwd; ; dir = (0, import_node_path25.dirname)(dir)) {
-    const sibling = portRangeInfraAt((0, import_node_path25.join)(dir, "MMI-Hub"), "sibling-hub");
+  for (let dir = cwd; ; dir = (0, import_node_path26.dirname)(dir)) {
+    const sibling = portRangeInfraAt((0, import_node_path26.join)(dir, "MMI-Hub"), "sibling-hub");
     if (sibling) return sibling;
-    const parent = (0, import_node_path25.dirname)(dir);
+    const parent = (0, import_node_path26.dirname)(dir);
     if (parent === dir) break;
   }
   if (packageDir) {
-    const pkgRoot = (0, import_node_path25.join)(packageDir, "..", "..");
+    const pkgRoot = (0, import_node_path26.join)(packageDir, "..", "..");
     const pkgFrom = portRangeInfraAt(pkgRoot, "pkg-root");
     if (pkgFrom) return pkgFrom;
   }
@@ -23666,8 +23858,8 @@ function registerStageCommands(program3) {
     const portRange = portRangeMeta && typeof portRangeMeta.start === "number" && typeof portRangeMeta.end === "number" ? [portRangeMeta.start, portRangeMeta.end] : void 0;
     return decideStage({
       registry: { deployModel: project2?.deployModel, portRange, error: read.ok ? void 0 : read.error },
-      hasCompose: (0, import_node_fs27.existsSync)((0, import_node_path26.join)(process.cwd(), "docker-compose.yml")),
-      hasEnvExample: (0, import_node_fs27.existsSync)((0, import_node_path26.join)(process.cwd(), ".env.example"))
+      hasCompose: (0, import_node_fs28.existsSync)((0, import_node_path27.join)(process.cwd(), "docker-compose.yml")),
+      hasEnvExample: (0, import_node_fs28.existsSync)((0, import_node_path27.join)(process.cwd(), ".env.example"))
     });
   }
   async function fetchStageVaultEnvMerge() {
@@ -24105,11 +24297,11 @@ function registerBoardCommands(program3) {
 }
 
 // src/merge-cleanup.ts
-var import_node_fs28 = require("node:fs");
+var import_node_fs29 = require("node:fs");
 var import_promises7 = require("node:fs/promises");
-var import_node_path28 = require("node:path");
+var import_node_path29 = require("node:path");
 var import_node_os10 = require("node:os");
-var import_node_child_process13 = require("node:child_process");
+var import_node_child_process14 = require("node:child_process");
 
 // src/board-advance.ts
 function repoOf2(ref) {
@@ -24195,7 +24387,7 @@ function boardAdvanceFailureMessage(result) {
 
 // src/deferred-registry-store.ts
 var import_promises6 = require("node:fs/promises");
-var import_node_path27 = require("node:path");
+var import_node_path28 = require("node:path");
 var sleep2 = (ms) => new Promise((resolve5) => setTimeout(resolve5, ms));
 async function atomicWrite(target, contents) {
   const tmp = `${target}.tmp-${process.pid}-${Math.random().toString(36).slice(2)}`;
@@ -24246,12 +24438,12 @@ function makeDeferredWorktreeStore(registryPath, lockOpts = {}) {
     },
     // Standalone atomic write — THROWS on failure (no best-effort swallow, #2846).
     write: async (entries) => {
-      await (0, import_promises6.mkdir)((0, import_node_path27.dirname)(registryPath), { recursive: true });
+      await (0, import_promises6.mkdir)((0, import_node_path28.dirname)(registryPath), { recursive: true });
       await atomicWrite(registryPath, serializeDeferredWorktrees(entries));
     },
     // Serialized read-modify-write under the repo-wide lock (#2846).
     update: async (mutate) => {
-      await (0, import_promises6.mkdir)((0, import_node_path27.dirname)(registryPath), { recursive: true });
+      await (0, import_promises6.mkdir)((0, import_node_path28.dirname)(registryPath), { recursive: true });
       const deadline = Date.now() + opts.maxWaitMs;
       for (; ; ) {
         const guard = await acquireLock(lockPath, opts, deadline);
@@ -24412,7 +24604,7 @@ async function applyGcPlan(plan, remote, opts = {}) {
   );
   const repoRoot2 = (await execFileP2("git", ["rev-parse", "--show-toplevel"], { timeout: GIT_TIMEOUT_MS }).catch(() => ({ stdout: "" }))).stdout.trim() || process.cwd();
   const worktreeGitRoot = await currentRepoWorktreeGitRoot(repoRoot2);
-  const primaryRepoRoot = worktreeGitRoot ? (0, import_node_path28.dirname)((0, import_node_path28.dirname)(worktreeGitRoot)) : repoRoot2;
+  const primaryRepoRoot = worktreeGitRoot ? (0, import_node_path29.dirname)((0, import_node_path29.dirname)(worktreeGitRoot)) : repoRoot2;
   const gcActor = describeActor({ env: process.env, surface: detectSurface(process.env), cwd: process.cwd() });
   const owners = readWorktreeOwners(primaryRepoRoot);
   const removalNow = Date.now();
@@ -24443,7 +24635,7 @@ async function applyGcPlan(plan, remote, opts = {}) {
       const cleanup = await cleanupPrMergeLocalBranch(branch.branch, {
         beforeWorktrees,
         startingPath: branch.worktreePath,
-        pathExists: (p) => (0, import_node_fs28.existsSync)(p),
+        pathExists: (p) => (0, import_node_fs29.existsSync)(p),
         execGit: async (args) => (await execFileP2("git", args, { timeout: GIT_TIMEOUT_MS })).stdout,
         teardownWorktreeStage,
         deferredStore,
@@ -24471,7 +24663,7 @@ async function applyGcPlan(plan, remote, opts = {}) {
   for (const wt of worktreeDirsToRemove) {
     try {
       const cleanupTarget = resolveSafeSiblingWorktreeCleanupTarget(wt.path, siblingRoot, {
-        realpath: (path2) => (0, import_node_fs28.realpathSync)(path2)
+        realpath: (path2) => (0, import_node_fs29.realpathSync)(path2)
       });
       if (!cleanupTarget.ok) {
         result.failed.push(`${wt.path}: ${cleanupTarget.reason}`);
@@ -24536,13 +24728,13 @@ async function composeOverrideBodyFile(prNumber, repoArgs, gh) {
     const commits = JSON.parse(raw).commits ?? [];
     const body = squashBodyWithOverride(commits.map((c) => ({ headline: c.messageHeadline ?? "", body: c.messageBody ?? "" })), process.cwd());
     if (!body) return void 0;
-    const dir = (0, import_node_fs28.mkdtempSync)((0, import_node_path28.join)((0, import_node_os10.tmpdir)(), "mmi-squash-body-"));
-    const path2 = (0, import_node_path28.join)(dir, "body.txt");
-    (0, import_node_fs28.writeFileSync)(path2, `${body}
+    const dir = (0, import_node_fs29.mkdtempSync)((0, import_node_path29.join)((0, import_node_os10.tmpdir)(), "mmi-squash-body-"));
+    const path2 = (0, import_node_path29.join)(dir, "body.txt");
+    (0, import_node_fs29.writeFileSync)(path2, `${body}
 `, "utf8");
     return { path: path2, cleanup: () => {
       try {
-        (0, import_node_fs28.rmSync)(dir, { recursive: true, force: true });
+        (0, import_node_fs29.rmSync)(dir, { recursive: true, force: true });
       } catch {
       }
     } };
@@ -24650,7 +24842,7 @@ async function remoteBranchExists2(branch, options = {}) {
 }
 var COMPOSE_TIMEOUT_MS = 12e4;
 function spawnDeferredGcSweep() {
-  spawnDetachedSelf(["worktree", "gc", "sweep-deferred", "--quiet"], { spawn: import_node_child_process13.spawn, execPath: process.execPath, scriptPath: process.argv[1] });
+  spawnDetachedSelf(["worktree", "gc", "sweep-deferred", "--quiet"], { spawn: import_node_child_process14.spawn, execPath: process.execPath, scriptPath: process.argv[1] });
 }
 async function createDeferredWorktreeStore() {
   try {
@@ -24664,13 +24856,13 @@ var realWorktreeDirRemover = {
   probe: (p) => {
     let st;
     try {
-      st = (0, import_node_fs28.lstatSync)(p);
+      st = (0, import_node_fs29.lstatSync)(p);
     } catch {
       return null;
     }
     if (st.isSymbolicLink()) return "link";
     try {
-      (0, import_node_fs28.readlinkSync)(p);
+      (0, import_node_fs29.readlinkSync)(p);
       return "link";
     } catch {
     }
@@ -24678,7 +24870,7 @@ var realWorktreeDirRemover = {
   },
   readdir: (p) => {
     try {
-      return (0, import_node_fs28.readdirSync)(p);
+      return (0, import_node_fs29.readdirSync)(p);
     } catch {
       return [];
     }
@@ -24687,9 +24879,9 @@ var realWorktreeDirRemover = {
   // leaving the target); a file symlink with unlink. rmdir first, fall back to unlink.
   detachLink: (p) => {
     try {
-      (0, import_node_fs28.rmdirSync)(p);
+      (0, import_node_fs29.rmdirSync)(p);
     } catch {
-      (0, import_node_fs28.unlinkSync)(p);
+      (0, import_node_fs29.unlinkSync)(p);
     }
   },
   removeTree: (p) => (0, import_promises7.rm)(p, { recursive: true, force: true, maxRetries: 5, retryDelay: 200 })
@@ -24722,9 +24914,9 @@ async function worktreeHasStageState(worktreePath) {
   }
 }
 function stageStateFileBelongsToWorktree(statePath, worktreePath) {
-  if (!(0, import_node_fs28.existsSync)(statePath)) return false;
+  if (!(0, import_node_fs29.existsSync)(statePath)) return false;
   try {
-    const state = JSON.parse((0, import_node_fs28.readFileSync)(statePath, "utf8"));
+    const state = JSON.parse((0, import_node_fs29.readFileSync)(statePath, "utf8"));
     const recordedCwd = typeof state.identity?.cwd === "string" ? state.identity.cwd : typeof state.cwd === "string" ? state.cwd : "";
     return Boolean(recordedCwd && isPathUnderDirectory(recordedCwd, worktreePath));
   } catch {
@@ -24931,9 +25123,9 @@ async function fetchRestCorePool(gh = defaultGhApi) {
 }
 
 // src/worktree-lifecycle-commands.ts
-var import_node_fs29 = require("node:fs");
+var import_node_fs30 = require("node:fs");
 var import_promises8 = require("node:fs/promises");
-var import_node_path29 = require("node:path");
+var import_node_path30 = require("node:path");
 var GH_TIMEOUT_MS = 2e4;
 var DEFAULT_BASE = "origin/development";
 var DEFAULT_REMOTE = "origin";
@@ -25069,7 +25261,7 @@ function classifyStaleLeaks(input) {
 var defaultOrphanDirScanDeps = {
   listDirs: (root) => {
     try {
-      return (0, import_node_fs29.readdirSync)(root, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => (0, import_node_path29.join)(root, e.name));
+      return (0, import_node_fs30.readdirSync)(root, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => (0, import_node_path30.join)(root, e.name));
     } catch {
       return [];
     }
@@ -25216,13 +25408,13 @@ function registerWorktreeCommands(program3) {
       const headBorn = await execFileP2("git", ["-C", wtPath || ".", "rev-parse", "--verify", "--quiet", "HEAD"], { timeout: GIT_TIMEOUT_MS }).then(() => true).catch(() => false);
       const branch = headBorn ? (await execFileP2("git", ["rev-parse", "--abbrev-ref", "HEAD"], { timeout: GIT_TIMEOUT_MS })).stdout.trim() : (await execFileP2("git", ["symbolic-ref", "--quiet", "--short", "HEAD"], { timeout: GIT_TIMEOUT_MS }).catch(() => ({ stdout: "" }))).stdout.trim();
       if (!wtPath || !branch) return fail("worktree land: not inside a git worktree");
-      const gitFile = (0, import_node_path29.join)(wtPath, ".git");
-      const isLinked = (0, import_node_fs29.existsSync)(gitFile) && (0, import_node_fs29.statSync)(gitFile).isFile();
+      const gitFile = (0, import_node_path30.join)(wtPath, ".git");
+      const isLinked = (0, import_node_fs30.existsSync)(gitFile) && (0, import_node_fs30.statSync)(gitFile).isFile();
       if (apply && !isLinked) {
         return fail("worktree land: run from inside the linked worktree you want to land (this is the primary checkout)");
       }
       const commonDir = (await execFileP2("git", ["rev-parse", "--git-common-dir"], { timeout: GIT_TIMEOUT_MS }).catch(() => ({ stdout: "" }))).stdout.trim();
-      const primaryCheckout = commonDir ? (0, import_node_path29.dirname)(commonDir) : wtPath;
+      const primaryCheckout = commonDir ? (0, import_node_path30.dirname)(commonDir) : wtPath;
       const localBranchNames = await execFileP2("git", ["-C", primaryCheckout, "for-each-ref", "--format=%(refname:short)", "refs/heads"], { timeout: GIT_TIMEOUT_MS }).then(({ stdout }) => new Set((stdout || "").split("\n").map((l) => l.trim()).filter(Boolean))).catch(() => void 0);
       const orphan = classifyOrphanedWorktree({
         branch,
@@ -25409,10 +25601,10 @@ async function gatherWorktreeContext() {
     if (s) stages.push({ path: wt.path, port: s.port });
   }
   const worktreeGitRoot = await currentRepoWorktreeGitRoot(repoRoot2);
-  const primaryRepoRoot = worktreeGitRoot ? (0, import_node_path29.dirname)((0, import_node_path29.dirname)(worktreeGitRoot)) : repoRoot2;
+  const primaryRepoRoot = worktreeGitRoot ? (0, import_node_path30.dirname)((0, import_node_path30.dirname)(worktreeGitRoot)) : repoRoot2;
   const wtRoot = siblingMmiWorktreesRoot(primaryRepoRoot);
   let orphanDirs = [];
-  if ((0, import_node_fs29.existsSync)(wtRoot)) {
+  if ((0, import_node_fs30.existsSync)(wtRoot)) {
     orphanDirs = scanOrphanDirs(wtRoot, worktreeGitRoot, {
       ...defaultOrphanDirScanDeps,
       listDirs: (root) => worktreeScanDirs(root, primaryRepoRoot, defaultOrphanDirScanDeps.listDirs, isRepoCheckoutDir)
@@ -25435,7 +25627,7 @@ async function bestEffortGit(args, cwd, step, timeoutMs = GIT_TIMEOUT_MS) {
 }
 
 // src/issue-commands.ts
-var import_node_fs30 = require("node:fs");
+var import_node_fs31 = require("node:fs");
 var import_node_crypto5 = require("node:crypto");
 var ghRunner = async (args, timeoutMs) => (await execFileP2("gh", args, { timeout: timeoutMs })).stdout;
 var ReparentConflictError = class extends Error {
@@ -25453,7 +25645,7 @@ async function editIssue(client, options, deps = {}) {
   const url = `https://github.com/${repo}/issues/${parsed.number}`;
   const patch = {};
   let bodyChanged = false;
-  const textDeps = () => deps.textDeps ?? { readFile: (p, e) => Promise.resolve((0, import_node_fs30.readFileSync)(p, e)), readStdin: () => Promise.resolve("") };
+  const textDeps = () => deps.textDeps ?? { readFile: (p, e) => Promise.resolve((0, import_node_fs31.readFileSync)(p, e)), readStdin: () => Promise.resolve("") };
   if (options.titleFile !== void 0) {
     patch.title = await resolveIssueTitle({ title: options.title, titleFile: options.titleFile }, textDeps());
   } else if (options.title !== void 0) {
@@ -26016,7 +26208,7 @@ function extendCreateCommand(issue2, batchAttach) {
     if (opts.batch) {
       let specs;
       try {
-        const raw = (0, import_node_fs30.readFileSync)(opts.batch, "utf8");
+        const raw = (0, import_node_fs31.readFileSync)(opts.batch, "utf8");
         specs = JSON.parse(raw);
         if (!Array.isArray(specs)) throw new Error("batch file must contain a JSON array");
       } catch (e) {
@@ -26090,8 +26282,8 @@ ${lines}`, {
 }
 
 // src/train-commands.ts
-var import_node_fs31 = require("node:fs");
-var import_node_path30 = require("node:path");
+var import_node_fs32 = require("node:fs");
+var import_node_path31 = require("node:path");
 
 // src/train-status.ts
 function buildTrainStatusReport(input) {
@@ -26131,7 +26323,7 @@ function formatTrainStatus(r) {
 // src/train-commands.ts
 function readRepoVersion() {
   try {
-    return JSON.parse((0, import_node_fs31.readFileSync)((0, import_node_path30.join)(process.cwd(), ".claude-plugin", "plugin.json"), "utf8")).version || void 0;
+    return JSON.parse((0, import_node_fs32.readFileSync)((0, import_node_path31.join)(process.cwd(), ".claude-plugin", "plugin.json"), "utf8")).version || void 0;
   } catch {
     return void 0;
   }
@@ -26277,9 +26469,9 @@ function registerDeployCommands(program3) {
 }
 
 // src/discovery-commands.ts
-var import_node_fs32 = require("node:fs");
+var import_node_fs33 = require("node:fs");
 var import_node_os11 = require("node:os");
-var import_node_path31 = require("node:path");
+var import_node_path32 = require("node:path");
 var GC_GH_TIMEOUT_MS3 = 2e4;
 async function collectStatus() {
   let branch = "";
@@ -26456,8 +26648,8 @@ async function collectOnboardStatus() {
   }
   const home = (0, import_node_os11.homedir)();
   const plugin = onboardPluginGate({
-    readKnown: () => readFileSyncSafe((0, import_node_path31.join)(home, ...KNOWN_MARKETPLACES_RELATIVE), import_node_fs32.readFileSync),
-    readSettings: () => readFileSyncSafe((0, import_node_path31.join)(home, ".claude", "settings.json"), import_node_fs32.readFileSync)
+    readKnown: () => readFileSyncSafe((0, import_node_path32.join)(home, ...KNOWN_MARKETPLACES_RELATIVE), import_node_fs33.readFileSync),
+    readSettings: () => readFileSyncSafe((0, import_node_path32.join)(home, ".claude", "settings.json"), import_node_fs33.readFileSync)
   });
   return { track, board, registry: registry2, secrets, plugin, nextCommand };
 }
@@ -27301,19 +27493,6 @@ function renderTally(checks) {
   const healthy = total - checks.filter((c) => !c.ok).length;
   return healthy === total ? `\u2713 all ${total} checks healthy` : `\u2713 ${healthy} of ${total} checks healthy`;
 }
-function renderDoctorText(checks, opts) {
-  const lines = [];
-  const shown = opts.verbose ? checks : checks.filter((c) => !c.ok || c.warn);
-  for (const check of shown) {
-    lines.push(renderCheckLine(check));
-    if (opts.verbose) {
-      for (const evidence of check.verbose ?? []) lines.push(`${VERBOSE_INDENT}${evidence}`);
-    }
-  }
-  lines.push(renderTally(checks));
-  if (opts.restartPending) lines.push(RESTART_LINE);
-  return lines.join("\n");
-}
 function doctorReportExitCode(checks) {
   return checks.some((c) => !c.ok && !c.reportOnly) ? 1 : 0;
 }
@@ -28003,7 +28182,8 @@ var DOCTOR_SURFACES = Object.freeze(
     installLocator: surface.install.locator,
     upgradeMechanism: surface.upgrade.mechanism,
     reload: surface.upgrade.reload,
-    repairOwner: surface.ownership.repair === "mmi-cli" ? "mmi-cli" : "operator"
+    repairOwner: surface.ownership.repair === "mmi-cli" ? "mmi-cli" : "operator",
+    trustOwner: surface.ownership.trust === "operator" ? "operator" : "host"
   }))
 );
 function doctorSurface(token) {
@@ -28036,11 +28216,8 @@ function diagnoseSurface(evidence) {
   return { ...base, state: "clean" };
 }
 function reloadInstruction(descriptor) {
-  if (descriptor.token === "claude") return "restart Claude";
-  if (descriptor.token === "codex") return "restart Codex";
-  if (descriptor.token === "kimi") return "restart Kimi Code CLI";
-  if (descriptor.token === "kilo") return "restart Kilo Code";
-  return descriptor.reload === "workspace" ? `reload ${descriptor.displayName}` : `restart ${descriptor.displayName}`;
+  const verb = descriptor.reload === "workspace" ? "reload" : "restart";
+  return `${verb} ${descriptor.displayName}`;
 }
 function planSurfaceRepair(diagnosis) {
   if (diagnosis.state === "clean" || diagnosis.state === "skipped" || diagnosis.state === "freshness-unknown") return null;
@@ -28085,10 +28262,16 @@ function buildSurfaceDoctorCheck(diagnosis) {
     detail: detailByState[state],
     ...plan ? { fix: plan.instruction } : state === "freshness-unknown" ? { fix: "check `mmi-cli --version` against `npm view @mutmutco/cli version`, then rerun doctor" } : {},
     verbose: [
+      // The three numbers the legacy builder used to print. They belong here now that this is the only
+      // plugin row, and a report that names a state without naming the versions behind it is not evidence.
+      `installed: ${diagnosis.installedVersion ?? "(none)"}`,
+      `released:  ${diagnosis.releasedVersion ?? "(not checked \u2014 offline or --fast)"}`,
+      `state: ${state}`,
       `registry surface: ${descriptor.token}`,
       `install: ${descriptor.installMechanism} (${descriptor.installLocator})`,
       `repair owner: ${descriptor.repairOwner}`,
-      `artifacts: ${descriptor.artifactIds.join(", ")}`
+      `artifacts: ${descriptor.artifactIds.join(", ")}`,
+      ...diagnosis.repairDetail ? [`heal: ${diagnosis.repairDetail}`] : []
     ]
   };
 }
@@ -28186,77 +28369,23 @@ function checkWorktreeRoots(probe) {
     verbose: evidence
   };
 }
-function pluginHealTrigger(probe) {
-  if (probe.guardState === "no-install" || probe.guardState === "unresolved") return "unresolved";
-  const behind = Boolean(probe.installed && probe.released) && compareVersions(probe.installed, probe.released) < 0;
-  return behind ? "behind" : null;
-}
-function checkClaudePlugin(probe) {
-  const { installed, released, guardState } = probe;
-  const codex = probe.surface === "codex";
-  const kilo = probe.surface === "kilo";
-  const cursor = probe.surface === "cursor";
-  const id = codex ? "codex-plugin" : kilo ? "kilo-plugin" : cursor ? "cursor-plugin" : "claude-plugin";
-  const label = codex ? "Codex plugin" : kilo ? "Kilo plugin" : cursor ? "Cursor plugin" : "Claude plugin";
-  const restart = codex ? "restart Codex" : kilo ? "reload Kilo" : cursor ? "reload Cursor" : "restart Claude";
-  const evidence = [
-    `installed: ${installed ?? "(none)"}`,
-    // #3485 item 7: when the value was reused from the banner's once-a-day cache, say so and say how old.
-    `released:  ${released ?? "(not checked \u2014 offline or --fast)"}${released && probe.releasedNote ? ` ${probe.releasedNote}` : ""}`,
-    `resolvable: ${guardState}`
-  ];
-  const trigger = pluginHealTrigger(probe);
-  if (trigger === "unresolved") {
-    return {
-      id,
-      ok: false,
-      label,
-      detail: guardState === "no-install" ? "not installed" : "unresolved (delivery/cache missing)",
-      fix: `run \`mmi-cli doctor --apply\` (or \`mmi-cli plugin heal\`) to reinstall the MMI plugin, then ${restart}`,
-      verbose: evidence
-    };
-  }
-  if (trigger === "behind") {
-    return {
-      id,
-      ok: false,
-      label,
-      detail: `${installed} \u2192 ${released}`,
-      // Name the CLI verb that actually fixes it, like every other red row — `/plugin` is the manual
-      // fallback, not the first resort (#3282).
-      fix: `run \`mmi-cli doctor --apply\` (or \`mmi-cli plugin heal\`) to reinstall it, then ${restart}`,
-      verbose: evidence
-    };
-  }
-  if (!released) {
-    return {
-      id,
-      ok: false,
-      reportOnly: true,
-      label,
-      detail: `${installed ?? "installed"} \u2014 freshness UNKNOWN, the published version could not be read`,
-      fix: "check it directly: `npm view @mutmutco/cli version`, then `mmi-cli plugin heal` if behind",
-      verbose: evidence
-    };
-  }
-  return { id, ok: true, label, ...installed ? { detail: installed } : {}, verbose: evidence };
-}
-function checkCodexHookTrust(probe) {
+function checkCodexHookTrust(probe, displayName = "Codex") {
   if (!probe?.applicable) return null;
   const evidence = [
     `stored approval rows: ${probe.trustedCount}/${probe.requiredCount}`,
     "current command hashes: verify interactively in /hooks"
   ];
+  const label = `${displayName} hook trust`;
   if (probe.trusted) {
-    return { id: "codex-hook-trust", ok: true, label: "Codex hook trust", detail: "trusted", verbose: evidence };
+    return { id: "codex-hook-trust", ok: true, label, detail: "trusted", verbose: evidence };
   }
   return {
     id: "codex-hook-trust",
     ok: true,
     warn: true,
-    label: "Codex hook trust",
+    label,
     detail: probe.requiredCount > 0 ? `${probe.trustedCount}/${probe.requiredCount} approval rows present \u2014 current hashes unverified` : "hook bundle could not be verified",
-    fix: probe.requiredCount > 0 ? "Codex does not allow silent hook approval; run `/hooks`, review the MMI commands, and trust them" : "run `mmi-cli plugin heal`, restart Codex, then review and trust MMI under `/hooks`",
+    fix: probe.requiredCount > 0 ? `${displayName} does not allow silent hook approval; run \`/hooks\`, review the MMI commands, and trust them` : `run \`mmi-cli plugin heal\`, restart ${displayName}, then review and trust MMI under \`/hooks\``,
     verbose: evidence
   };
 }
@@ -28481,6 +28610,12 @@ function gcReapable(plan) {
 async function runDoctorClean(opts, io, deps) {
   const applyEnv = Boolean(opts.apply) || Boolean(opts.preflight);
   const applyRepo = Boolean(opts.apply) && opts.repoWrites !== false;
+  const lane = {
+    banner: Boolean(opts.banner),
+    fast: Boolean(opts.fast),
+    preflight: Boolean(opts.preflight),
+    full: !opts.fast && !opts.banner && !opts.preflight
+  };
   const probeReleased = !opts.fast || Boolean(opts.self);
   const probeAws = !opts.fast && !opts.banner;
   const [login, isOrgRepo, released, callerArn, reach] = await Promise.all([
@@ -28495,108 +28630,69 @@ async function runDoctorClean(opts, io, deps) {
     opts.banner || opts.preflight || opts.fast && !opts.self ? Promise.resolve(void 0) : deps.githubRepoReach?.() ?? Promise.resolve(void 0)
   ]);
   const ghInstalled2 = login ? true : await deps.ghInstalled();
-  const registryEvidence = deps.surfaceEvidence?.(isOrgRepo);
-  const installed = registryEvidence?.installedVersion ?? deps.installedPluginVersion();
-  const pluginSurface = deps.pluginSurface?.() ?? "claude-cli";
-  const codexSurface = registryEvidence?.descriptor.token === "codex" || pluginSurface === "codex";
-  const cursorSurface = pluginSurface === "cursor";
-  const restartAction = registryEvidence ? surfaceRestartAction(registryEvidence.descriptor) : codexSurface ? "restart Codex" : cursorSurface ? "reload Cursor" : pluginSurface === "kilo" ? "restart Kilo Code" : "restart Claude";
+  const registryEvidence = deps.surfaceEvidence(isOrgRepo);
+  const restartAction = registryEvidence ? surfaceRestartAction(registryEvidence.descriptor) : "restart the agent host";
   const checks = [];
   let restartPending = false;
-  checks.push(checkGithubAuth({ login, ghInstalled: ghInstalled2, reach }));
-  if (!opts.fast && !opts.banner && !opts.preflight && deps.githubPools) {
-    checks.push(...checkGithubPools(await deps.githubPools()));
-  }
-  const aws = checkAwsIdentity({ isOrgRepo, probed: probeAws, callerArn });
-  if (aws) checks.push(aws);
-  checks.push(checkRepoWorktrees({ isOrgRepo, hasRepoLocalWorktrees: deps.hasRepoLocalWorktrees() }));
-  if (isOrgRepo) {
-    const current = deps.readGitignore();
-    const gi = planGitignore(current);
-    const giEvidence = [
-      `.gitignore: ${current === null ? "absent" : `${current.split("\n").length} lines`}`,
-      `managed block: ${gi.ok ? "present and current" : "missing or out of date"}`
-    ];
-    if (gi.ok) {
-      checks.push({ ok: true, id: "gitignore-block", label: "gitignore block", verbose: giEvidence });
-    } else if (applyRepo && gi.content && deps.writeGitignore(gi.content)) {
-      checks.push({ ok: true, id: "gitignore-block", label: "gitignore block", detail: "rewrote managed block", verbose: giEvidence });
-      restartPending = true;
-    } else {
-      checks.push({ ok: false, id: "gitignore-block", label: "gitignore block", fix: "run `mmi-cli doctor --apply` to write the org-managed .gitignore block", verbose: giEvidence });
-    }
-  }
-  const releasedNote = deps.releasedVersionNote?.();
-  const pluginProbe = {
-    installed,
-    released,
-    guardState: registryEvidence?.guardState ?? deps.pluginGuardState(isOrgRepo),
-    releasedNote,
-    surface: pluginSurface
+  const streamed = /* @__PURE__ */ new Set();
+  const worthPrinting = (c) => Boolean(opts.verbose) || !c.ok || Boolean(c.warn);
+  const emitNow = (check) => {
+    checks.push(check);
+    if (opts.json || !worthPrinting(check)) return;
+    streamed.add(check);
+    io.log(renderCheckLine(check));
+    if (opts.verbose) for (const evidence of check.verbose ?? []) io.log(`${VERBOSE_INDENT}${evidence}`);
   };
-  const registryDiagnosis = registryEvidence ? diagnoseSurface({ ...registryEvidence, releasedVersion: released }) : void 0;
-  const registryRepairPlan = registryDiagnosis ? planSurfaceRepair(registryDiagnosis) : null;
-  const healTrigger = registryDiagnosis ? registryRepairPlan?.supported ? registryDiagnosis.state : null : pluginHealTrigger(pluginProbe);
+  const healIntent = (line) => {
+    if (!opts.json) io.log(`\u21BB ${line}`);
+  };
+  const healStep = (message) => {
+    if (!opts.json) io.log(`${VERBOSE_INDENT}${message.trim()}`);
+  };
+  const releasedNote = deps.releasedVersionNote?.();
   let pluginHealed = false;
-  if (applyEnv && deps.healPlugin && healTrigger && (!registryRepairPlan || registryRepairPlan.supported)) {
-    const heal = await deps.healPlugin();
-    pluginHealed = heal.ok;
-    if (registryEvidence) {
-      const repairedDiagnosis = diagnoseSurface({
+  async function runPluginRow() {
+    if (!registryEvidence) return;
+    const diagnosis = diagnoseSurface({ ...registryEvidence, releasedVersion: released });
+    const repair = planSurfaceRepair(diagnosis);
+    if (applyEnv && deps.healPlugin && repair?.supported) {
+      const { descriptor } = registryEvidence;
+      healIntent(`${descriptor.displayName} plugin \u2014 healing via ${descriptor.installMechanism} (${descriptor.installLocator})`);
+      const heal = await deps.healPlugin(healStep);
+      pluginHealed = heal.ok;
+      const row = buildSurfaceDoctorCheck(diagnoseSurface({
         ...registryEvidence,
         releasedVersion: released,
         repair: { attempted: true, ok: heal.ok, detail: heal.detail }
-      });
-      const repairedCheck = buildSurfaceDoctorCheck(repairedDiagnosis);
-      if (heal.skipped) repairedCheck.reportOnly = true;
-      checks.push(repairedCheck);
-      if (!heal.skipped) restartPending = true;
-    } else {
-      const measured = healTrigger === "behind" ? `${installed} \u2192 ${released}` : "unresolved install";
-      const healEvidence = [
-        `installed: ${installed ?? "(none)"}`,
-        `released:  ${released ?? "(not checked \u2014 offline or --fast)"}`,
-        `resolvable: ${pluginProbe.guardState}`,
-        `heal: ${heal.detail}`
-      ];
-      checks.push(heal.ok ? {
-        id: codexSurface ? "codex-plugin" : pluginSurface === "kilo" ? "kilo-plugin" : cursorSurface ? "cursor-plugin" : "claude-plugin",
-        ok: true,
-        label: codexSurface ? "Codex plugin" : pluginSurface === "kilo" ? "Kilo plugin" : cursorSurface ? "Cursor plugin" : "Claude plugin",
-        detail: pluginSurface === "kilo" ? `${measured} \u2014 reinstalled via \`kilo plugin\` (the plugin provisions the skills on next load)` : cursorSurface ? `${measured} \u2014 replaced the managed local checkout (previous copy quarantined)` : `${measured} \u2014 reinstalled via the MMI marketplace (remove \u2192 add \u2192 ${codexSurface ? "add" : "install"})${codexSurface ? "; review trust in /hooks" : ""}`,
-        verbose: healEvidence
-      } : {
-        id: codexSurface ? "codex-plugin" : pluginSurface === "kilo" ? "kilo-plugin" : cursorSurface ? "cursor-plugin" : "claude-plugin",
-        ok: false,
-        label: codexSurface ? "Codex plugin" : pluginSurface === "kilo" ? "Kilo plugin" : cursorSurface ? "Cursor plugin" : "Claude plugin",
-        detail: measured,
-        // #3489: a heal skipped because another doctor holds the env-heal lock is a real ✗ — this run did
-        // not fix what it found — but it is not this invocation's to clear. The other process is doing it;
-        // waiting is the correct response and a re-run finds it healed. A heal that RAN and failed is a
-        // genuine gap and still gates.
-        ...heal.skipped ? { reportOnly: true } : {},
-        fix: heal.skipped ? `${heal.detail} \u2014 another doctor on this machine is healing it now; re-run once it finishes` : `auto-heal failed (${heal.detail}) \u2014 run \`mmi-cli plugin heal\`, then ${codexSurface ? "restart Codex" : pluginSurface === "kilo" ? "reload Kilo" : cursorSurface ? "reload Cursor" : "restart Claude"}`,
-        verbose: healEvidence
-      });
+      }));
+      if (heal.skipped) {
+        row.reportOnly = true;
+        row.fix = `${heal.detail} \u2014 another doctor on this machine is healing it now; re-run once it finishes`;
+      }
+      emitNow(row);
       if (!heal.skipped) restartPending = true;
+    } else if (diagnosis.state !== "skipped") {
+      const row = buildSurfaceDoctorCheck(diagnosis);
+      emitNow(row);
+      if (!row.ok && repair?.supported) restartPending = true;
+    }
+    if (registryEvidence.descriptor.trustOwner === "operator" && (registryEvidence.guardState === "healthy" || pluginHealed)) {
+      const trust = checkCodexHookTrust(deps.pluginTrustState?.(), registryEvidence.descriptor.displayName);
+      if (trust) emitNow(trust);
+    }
+  }
+  async function runCliRow() {
+    const cliInput = { currentVersion: deps.currentCliVersion(), releasedVersion: released };
+    const cliReport = buildVersionLagReport(cliInput);
+    if (!(applyEnv && deps.updateCli && versionAutoUpdateAction(cliReport) === "npm")) {
+      const cli = checkCliVersion(cliInput, releasedNote);
+      if (cli) emitNow(cli);
+      return;
     }
-  } else {
-    const plugin = registryDiagnosis ? buildSurfaceDoctorCheck(registryDiagnosis) : checkClaudePlugin(pluginProbe);
-    if (plugin) {
-      if (!("state" in plugin) || plugin.state !== "skipped") checks.push(plugin);
-      if (!plugin.ok && (registryDiagnosis ? Boolean(registryRepairPlan?.supported) : true)) restartPending = true;
-    }
-  }
-  if (codexSurface && (pluginProbe.guardState === "healthy" || pluginHealed)) {
-    const trust = checkCodexHookTrust(deps.pluginTrustState?.());
-    if (trust) checks.push(trust);
-  }
-  const cliInput = { currentVersion: deps.currentCliVersion(), releasedVersion: released };
-  const cliReport = buildVersionLagReport(cliInput);
-  if (applyEnv && deps.updateCli && versionAutoUpdateAction(cliReport) === "npm") {
-    const heal = await deps.updateCli(cliReport.releasedVersion);
+    healIntent(`mmi-cli \u2014 self-updating ${cliReport.currentVersion} \u2192 ${cliReport.releasedVersion} via npm install -g`);
+    const heal = await deps.updateCli(cliReport.releasedVersion, healStep);
     const healEvidence = [`running:  ${cliReport.currentVersion}`, `published: ${cliReport.releasedVersion}`, `heal: ${heal.detail}`];
-    checks.push(heal.ok ? {
+    emitNow(heal.ok ? {
       id: "cli-version",
       ok: true,
       label: "mmi-cli",
@@ -28612,17 +28708,54 @@ async function runDoctorClean(opts, io, deps) {
       fix: heal.skipped ? `${heal.detail} \u2014 another doctor on this machine is updating it now; re-run once it finishes` : `self-update failed (${heal.detail}) \u2014 run \`${cliUpdateCommand(cliReport.releasedVersion)}\``,
       verbose: healEvidence
     });
-  } else {
-    const cli = checkCliVersion(cliInput, releasedNote);
-    if (cli) checks.push(cli);
   }
-  checks.push(checkPluginCache(deps.pluginCache()));
-  if (deps.sessionPayload) {
+  async function runGithubAuthRow() {
+    emitNow(checkGithubAuth({ login, ghInstalled: ghInstalled2, reach }));
+  }
+  async function runGithubPoolsRows() {
+    for (const pool of checkGithubPools(await deps.githubPools())) emitNow(pool);
+  }
+  async function runAwsRow() {
+    const aws = checkAwsIdentity({ isOrgRepo, probed: probeAws, callerArn });
+    if (aws) emitNow(aws);
+  }
+  async function runRepoWorktreesRow() {
+    emitNow(checkRepoWorktrees({ isOrgRepo, hasRepoLocalWorktrees: deps.hasRepoLocalWorktrees() }));
+  }
+  async function runGitignoreRow() {
+    const current = deps.readGitignore();
+    const gi = planGitignore(current);
+    const giEvidence = [
+      `.gitignore: ${current === null ? "absent" : `${current.split("\n").length} lines`}`,
+      `managed block: ${gi.ok ? "present and current" : "missing or out of date"}`
+    ];
+    if (gi.ok) {
+      emitNow({ ok: true, id: "gitignore-block", label: "gitignore block", verbose: giEvidence });
+    } else if (applyRepo && gi.content && deps.writeGitignore(gi.content)) {
+      emitNow({ ok: true, id: "gitignore-block", label: "gitignore block", detail: "rewrote managed block", verbose: giEvidence });
+      restartPending = true;
+    } else {
+      emitNow({ ok: false, id: "gitignore-block", label: "gitignore block", fix: "run `mmi-cli doctor --apply` to write the org-managed .gitignore block", verbose: giEvidence });
+    }
+  }
+  async function runPluginCacheRow() {
+    emitNow(checkPluginCache(deps.pluginCache()));
+  }
+  async function runSessionPayloadRow() {
     const payload = checkSessionPayload(deps.sessionPayload());
-    if (payload) checks.push(payload);
+    if (payload) emitNow(payload);
+  }
+  async function runMarketplaceRows() {
+    if (applyEnv) {
+      const healed = deps.healMarketplacePins();
+      if (healed) {
+        healIntent(`marketplace pins \u2014 ${healed}`);
+        restartPending = true;
+      }
+    }
+    for (const row of deps.marketplaceRows()) emitNow(row);
   }
-  if (deps.marketplaceRows) checks.push(...deps.marketplaceRows());
-  if (!opts.fast && !opts.banner && !opts.preflight) {
+  async function runSchedulesRow() {
     const probe = await deps.schedulesNotebook().catch((e) => ({
       armed: 0,
       live: 0,
@@ -28631,32 +28764,32 @@ async function runDoctorClean(opts, io, deps) {
       drift: []
     }));
     const sched = checkSchedules(probe);
-    if (sched) checks.push(sched);
+    if (sched) emitNow(sched);
   }
-  if (!opts.fast && !opts.banner && !opts.preflight && deps.redactorLiveness) {
+  async function runRedactorRow() {
     const redactor = checkRedactorLiveness(deps.redactorLiveness());
-    if (redactor) checks.push(redactor);
+    if (redactor) emitNow(redactor);
   }
-  if (!opts.fast && !opts.banner && !opts.preflight && deps.docsAudit) {
+  async function runDocsAuditRow() {
     const probe = await deps.docsAudit().catch((e) => ({
       armed: true,
       ok: false,
       detail: `docs-audit probe failed \u2014 ${e.message}`
     }));
     const docsAudit2 = checkDocsAudit(probe);
-    if (docsAudit2) checks.push(docsAudit2);
+    if (docsAudit2) emitNow(docsAudit2);
   }
-  if (!opts.fast && !opts.banner && !opts.preflight && deps.worktreeRoots) {
+  async function runWorktreeRootsRow() {
     const probe = await deps.worktreeRoots().catch(() => void 0);
     const roots = checkWorktreeRoots(probe);
-    if (roots) checks.push(roots);
+    if (roots) emitNow(roots);
   }
-  if (isOrgRepo && !opts.fast && !opts.banner && !opts.preflight) {
+  async function runTrainSyncRow() {
     try {
-      checks.push(checkTrainSync(await deps.syncTrain()));
+      emitNow(checkTrainSync(await deps.syncTrain()));
     } catch (e) {
       const message = e instanceof Error ? e.message : String(e);
-      checks.push({
+      emitNow({
         ok: false,
         id: "train-branches",
         label: "train branches",
@@ -28664,6 +28797,8 @@ async function runDoctorClean(opts, io, deps) {
         verbose: [`sync threw: ${message}`, "no train branch was fast-forwarded this run"]
       });
     }
+  }
+  async function runHousekeeperRows() {
     const repoRoot2 = await deps.repoRoot();
     try {
       const plan = await deps.gcPlan("origin", 200);
@@ -28674,7 +28809,7 @@ async function runDoctorClean(opts, io, deps) {
         if (r.removedBranches.length || r.removedRemoteBranches.length) detailParts.push(`${r.removedBranches.length + r.removedRemoteBranches.length} merged branches`);
         if (r.removedWorktreeDirs.length) detailParts.push(`${r.removedWorktreeDirs.length} dead worktrees`);
         if (r.removedTrackingRefs.length) detailParts.push(`${r.removedTrackingRefs.length} stale refs`);
-        checks.push({
+        emitNow({
           id: "branches-worktrees",
           ok: true,
           label: "branches / worktrees",
@@ -28697,7 +28832,7 @@ async function runDoctorClean(opts, io, deps) {
           ...plan.trackingRefs.map((r) => `stale tracking ref: ${r.ref}`),
           ...plan.worktreeDirs.map((w) => `dead worktree: ${w.path} (${w.reason})`)
         ];
-        checks.push(n === 0 ? { id: "branches-worktrees", ok: true, label: "branches / worktrees", verbose: ["nothing reapable"] } : {
+        emitNow(n === 0 ? { id: "branches-worktrees", ok: true, label: "branches / worktrees", verbose: ["nothing reapable"] } : {
           id: "branches-worktrees",
           ok: false,
           label: "branches / worktrees",
@@ -28715,12 +28850,35 @@ async function runDoctorClean(opts, io, deps) {
     if (applyRepo && scratch.plan.safeAuto.length > 0) {
       const applied = deps.executeScratchGc(repoRoot2, { apply: true });
       const pruned = applied.applied?.pruned.length ?? 0;
-      checks.push({ id: "scratch", ok: true, label: "scratch", detail: pruned ? `removed ${pruned} aged item(s)` : "nothing stale", verbose: scratchEvidence });
+      emitNow({ id: "scratch", ok: true, label: "scratch", detail: pruned ? `removed ${pruned} aged item(s)` : "nothing stale", verbose: scratchEvidence });
       if (pruned) restartPending = true;
     } else {
-      checks.push(scratch.plan.safeAuto.length === 0 ? { id: "scratch", ok: true, label: "scratch", verbose: scratchEvidence } : { id: "scratch", ok: false, label: "scratch", detail: `${scratch.plan.safeAuto.length} aged item(s)`, fix: "run `mmi-cli doctor --apply`", verbose: scratchEvidence });
-    }
-  }
+      emitNow(scratch.plan.safeAuto.length === 0 ? { id: "scratch", ok: true, label: "scratch", verbose: scratchEvidence } : { id: "scratch", ok: false, label: "scratch", detail: `${scratch.plan.safeAuto.length} aged item(s)`, fix: "run `mmi-cli doctor --apply`", verbose: scratchEvidence });
+    }
+  }
+  const table = [
+    // Heals first: the slowest work starts at second zero, and a stale mmi-cli is the binary every row
+    // below is being measured with (#3954).
+    { id: "plugin", when: true, run: runPluginRow },
+    { id: "cli-version", when: true, run: runCliRow },
+    { id: "github-auth", when: true, run: runGithubAuthRow },
+    { id: "github-pools", when: lane.full, run: runGithubPoolsRows },
+    { id: "aws-identity", when: true, run: runAwsRow },
+    { id: "repo-worktrees", when: true, run: runRepoWorktreesRow },
+    { id: "gitignore-block", when: isOrgRepo, run: runGitignoreRow },
+    { id: "plugin-cache", when: true, run: runPluginCacheRow },
+    { id: "sessionstart-payload", when: true, run: runSessionPayloadRow },
+    { id: "marketplace", when: true, run: runMarketplaceRows },
+    { id: "schedules", when: lane.full, run: runSchedulesRow },
+    { id: "redactor-liveness", when: lane.full, run: runRedactorRow },
+    { id: "docs-audit", when: lane.full, run: runDocsAuditRow },
+    { id: "worktree-roots", when: lane.full, run: runWorktreeRootsRow },
+    // The two most expensive things in this file — a real `git fetch` plus train-branch fast-forward,
+    // and a `gh`-backed gc sweep with a 20s timeout — so org repos on the full lane only (#3485).
+    { id: "train-branches", when: isOrgRepo && lane.full, run: runTrainSyncRow },
+    { id: "housekeeper", when: isOrgRepo && lane.full, run: runHousekeeperRows }
+  ];
+  for (const entry of table) if (entry.when) await entry.run();
   const exitCode = doctorReportExitCode(checks);
   if (opts.json) {
     const payload = opts.verbose ? checks : checks.map(({ verbose: _evidence, ...check }) => check);
@@ -28733,7 +28891,7 @@ async function runDoctorClean(opts, io, deps) {
     return exitCode;
   }
   if (opts.banner) {
-    const actionable = checks.filter((c) => !c.ok || c.warn);
+    const actionable = checks.filter((c) => (!c.ok || c.warn) && !streamed.has(c));
     for (const c of actionable) {
       io.log(renderReport([c], { restartPending: false }));
       if (opts.verbose) for (const evidence of c.verbose ?? []) io.log(`${VERBOSE_INDENT}${evidence}`);
@@ -28741,10 +28899,16 @@ async function runDoctorClean(opts, io, deps) {
     if (restartPending) io.log(`\u21BB ${restartAction.charAt(0).toUpperCase()}${restartAction.slice(1)} to finish.`);
     return 0;
   }
-  const legacyRestart = restartAction === "restart Claude";
-  const rendered = renderDoctorText(checks, { verbose: Boolean(opts.verbose), restartPending: restartPending && legacyRestart });
-  io.log(restartPending && !legacyRestart ? `${rendered}
-\u21BB ${restartAction.charAt(0).toUpperCase()}${restartAction.slice(1)} to finish.` : rendered);
+  const rest = checks.filter((c) => !streamed.has(c));
+  const shown = opts.verbose ? rest : rest.filter((c) => !c.ok || c.warn);
+  const lines = [];
+  for (const check of shown) {
+    lines.push(renderCheckLine(check));
+    if (opts.verbose) for (const evidence of check.verbose ?? []) lines.push(`${VERBOSE_INDENT}${evidence}`);
+  }
+  lines.push(renderTally(checks));
+  if (restartPending) lines.push(`\u21BB ${restartAction.charAt(0).toUpperCase()}${restartAction.slice(1)} to finish.`);
+  io.log(lines.join("\n"));
   return exitCode;
 }
 
@@ -28767,17 +28931,17 @@ function parseOriginRepo(remoteUrl) {
 }
 function ghHostsConfigPath(env, platform2) {
   const sep2 = platform2 === "win32" ? "\\" : "/";
-  const join28 = (...parts) => parts.join(sep2);
+  const join29 = (...parts) => parts.join(sep2);
   const explicit = env.GH_CONFIG_DIR?.trim();
-  if (explicit) return join28(explicit, "hosts.yml");
+  if (explicit) return join29(explicit, "hosts.yml");
   if (platform2 === "win32") {
     const appData = (env.AppData ?? env.APPDATA)?.trim();
-    return appData ? join28(appData, "GitHub CLI", "hosts.yml") : void 0;
+    return appData ? join29(appData, "GitHub CLI", "hosts.yml") : void 0;
   }
   const xdg = env.XDG_CONFIG_HOME?.trim();
-  if (xdg) return join28(xdg, "gh", "hosts.yml");
+  if (xdg) return join29(xdg, "gh", "hosts.yml");
   const home = env.HOME?.trim();
-  return home ? join28(home, ".config", "gh", "hosts.yml") : void 0;
+  return home ? join29(home, ".config", "gh", "hosts.yml") : void 0;
 }
 function parseGhHostsAccounts(yaml, host = "github.com") {
   let hostIndent = null;
@@ -28827,17 +28991,17 @@ function ghAccountCaveat(announcedLogin, accounts) {
 }
 
 // src/doctor-io.ts
-var import_node_fs33 = require("node:fs");
+var import_node_fs34 = require("node:fs");
 var import_node_os12 = require("node:os");
-var import_node_path32 = require("node:path");
-var import_node_child_process14 = require("node:child_process");
+var import_node_path33 = require("node:path");
+var import_node_child_process15 = require("node:child_process");
 var import_node_util8 = require("node:util");
-var execFileP6 = (0, import_node_util8.promisify)(import_node_child_process14.execFile);
+var execFileP6 = (0, import_node_util8.promisify)(import_node_child_process15.execFile);
 var MMI_PLUGIN_ID2 = "mmi@mutmutco";
 function installedClaudePluginVersion() {
   try {
     const file = JSON.parse(
-      (0, import_node_fs33.readFileSync)((0, import_node_path32.join)((0, import_node_os12.homedir)(), ".claude", "plugins", "installed_plugins.json"), "utf8")
+      (0, import_node_fs34.readFileSync)((0, import_node_path33.join)((0, import_node_os12.homedir)(), ".claude", "plugins", "installed_plugins.json"), "utf8")
     );
     const versions = (file.plugins?.[MMI_PLUGIN_ID2] ?? []).map((r) => r.version).filter((v) => Boolean(v));
     if (versions.length === 0) return void 0;
@@ -28848,7 +29012,7 @@ function installedClaudePluginVersion() {
 }
 function manifestVersion(path2) {
   try {
-    const manifest = JSON.parse((0, import_node_fs33.readFileSync)(path2, "utf8"));
+    const manifest = JSON.parse((0, import_node_fs34.readFileSync)(path2, "utf8"));
     return typeof manifest.version === "string" && manifest.version.trim() ? manifest.version.trim() : void 0;
   } catch {
     return void 0;
@@ -28858,27 +29022,27 @@ function installedSurfacePluginVersion(surface) {
   const token = surfaceToken(surface);
   if (token === "kilo") {
     try {
-      const stamp = (0, import_node_fs33.readFileSync)((0, import_node_path32.join)((0, import_node_os12.homedir)(), ".kilo", ".mmi-kilo-version"), "utf8").trim();
+      const stamp = (0, import_node_fs34.readFileSync)((0, import_node_path33.join)((0, import_node_os12.homedir)(), ".kilo", ".mmi-kilo-version"), "utf8").trim();
       return stamp || void 0;
     } catch {
       return void 0;
     }
   }
   if (token === "cursor") {
-    return manifestVersion((0, import_node_path32.join)(cursorLocalPluginRoot(), ".cursor-plugin", "plugin.json"));
+    return manifestVersion((0, import_node_path33.join)(cursorLocalPluginRoot(), ".cursor-plugin", "plugin.json"));
   }
   if (token === "kimi") {
-    return manifestVersion((0, import_node_path32.join)(surfaceConfigRoot(surface), "plugins", "managed", "mmi", ".kimi-plugin", "plugin.json"));
+    return manifestVersion((0, import_node_path33.join)(surfaceConfigRoot(surface), "plugins", "managed", "mmi", ".kimi-plugin", "plugin.json"));
   }
   if (token === "claude") return installedClaudePluginVersion();
   if (token !== "codex") return void 0;
   try {
-    const raw = process.platform === "win32" ? (0, import_node_child_process14.execFileSync)("cmd.exe", ["/c", "codex", "plugin", "list", "--json"], {
+    const raw = process.platform === "win32" ? (0, import_node_child_process15.execFileSync)("cmd.exe", ["/c", "codex", "plugin", "list", "--json"], {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "ignore"],
       timeout: 15e3,
       windowsHide: true
-    }) : (0, import_node_child_process14.execFileSync)("codex", ["plugin", "list", "--json"], {
+    }) : (0, import_node_child_process15.execFileSync)("codex", ["plugin", "list", "--json"], {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "ignore"],
       timeout: 15e3,
@@ -28896,7 +29060,7 @@ function installedActivePluginVersion(surface = detectSurface(process.env)) {
 }
 function worktreeRootSync() {
   try {
-    const out = (0, import_node_child_process14.execFileSync)("git", ["rev-parse", "--show-toplevel"], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
+    const out = (0, import_node_child_process15.execFileSync)("git", ["rev-parse", "--show-toplevel"], { windowsHide: true, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
     let root = out.endsWith("\n") ? out.slice(0, -1) : out;
     if (process.platform === "win32" && root.endsWith("\r")) root = root.slice(0, -1);
     return root || null;
@@ -28906,13 +29070,13 @@ function worktreeRootSync() {
 }
 var gitignorePath = () => {
   const root = worktreeRootSync();
-  return root === null ? null : (0, import_node_path32.join)(root, ".gitignore");
+  return root === null ? null : (0, import_node_path33.join)(root, ".gitignore");
 };
 function readGitignore() {
   const path2 = gitignorePath();
   if (path2 === null) return null;
   try {
-    return (0, import_node_fs33.readFileSync)(path2, "utf8");
+    return (0, import_node_fs34.readFileSync)(path2, "utf8");
   } catch {
     return null;
   }
@@ -28921,7 +29085,7 @@ function writeGitignore(content) {
   const path2 = gitignorePath();
   if (path2 === null) return false;
   try {
-    (0, import_node_fs33.writeFileSync)(path2, content, "utf8");
+    (0, import_node_fs34.writeFileSync)(path2, content, "utf8");
     return true;
   } catch {
     return false;
@@ -28945,7 +29109,7 @@ async function repoRoot() {
 }
 function hasRepoLocalWorktrees() {
   const root = worktreeRootSync();
-  return root !== null && (0, import_node_fs33.existsSync)((0, import_node_path32.join)(root, ".worktrees"));
+  return root !== null && (0, import_node_fs34.existsSync)((0, import_node_path33.join)(root, ".worktrees"));
 }
 
 // src/index.ts
@@ -28981,8 +29145,8 @@ ${r.stderr ?? ""}`).catch(() => "");
 function ghMultiAccountCaveat(announcedLogin) {
   try {
     const hostsPath = ghHostsConfigPath(process.env, process.platform);
-    if (!hostsPath || !(0, import_node_fs34.existsSync)(hostsPath)) return void 0;
-    return ghAccountCaveat(announcedLogin, parseGhHostsAccounts((0, import_node_fs34.readFileSync)(hostsPath, "utf8")));
+    if (!hostsPath || !(0, import_node_fs35.existsSync)(hostsPath)) return void 0;
+    return ghAccountCaveat(announcedLogin, parseGhHostsAccounts((0, import_node_fs35.readFileSync)(hostsPath, "utf8")));
   } catch {
     return void 0;
   }
@@ -28990,7 +29154,7 @@ function ghMultiAccountCaveat(announcedLogin) {
 var ENV_HEAL_LOCK_STALE_MS = 10 * 6e4;
 var ENV_HEAL_LOCK_MAX_WAIT_MS = 2 * 6e4;
 function envHealLockPath(home) {
-  return (0, import_node_path33.join)(home, ".claude", "plugins", ".mmi-env-heal.lock");
+  return (0, import_node_path34.join)(home, ".claude", "plugins", ".mmi-env-heal.lock");
 }
 async function withEnvHealLock(what, run) {
   try {
@@ -29065,10 +29229,7 @@ function mmiDoctorDeps(opts = {}) {
     githubRepoReach: githubRepoReachProbe,
     awsCallerArn,
     isOrgRepo: () => isOrgRepoRoot(),
-    installedPluginVersion: installedActivePluginVersion,
     surfaceEvidence: surfaceEvidenceOnce,
-    pluginGuardState: activePluginGuardState,
-    pluginSurface: () => detectSurface(process.env),
     pluginTrustState: () => codexHookTrustState(),
     releasedVersion: throttled ? throttled.read : fetchNpmReleasedVersion,
     releasedVersionNote: throttled ? throttled.note : void 0,
@@ -29077,13 +29238,13 @@ function mmiDoctorDeps(opts = {}) {
     // marketplace clone + plugin cache) and neither is idempotent under concurrency. They share ONE lock
     // rather than one each, because they are not independent: the plugin heal reinstalls a bundle that
     // carries a CLI shim, so a concurrent npm global install races the same PATH surface.
-    updateCli: (target) => withEnvHealLock("npm global CLI self-update", () => npmSelfUpdateCli(target)),
+    updateCli: (target, onStep) => withEnvHealLock("npm global CLI self-update", () => npmSelfUpdateCli(target, onStep)),
     // #3282: the --apply self-heal for a stale/unresolved Claude plugin — the same marketplace reinstall
     // `mmi-cli plugin heal` drives. Takes effect on the next Claude reload, so the row asks for a restart.
-    healPlugin: () => {
+    healPlugin: (onStep) => {
       const surface = detectSurface(process.env);
-      const host = surface === "codex" ? "Codex" : surface === "kilo" ? "Kilo" : surface === "cursor" ? "Cursor" : "Claude";
-      return withEnvHealLock(`${host} plugin reinstall`, () => healActivePluginForDoctor(surface));
+      const host = surfaceEvidenceOnce(true)?.descriptor.displayName ?? surface;
+      return withEnvHealLock(`${host} plugin reinstall`, () => healActivePluginForDoctor(surface, onStep));
     },
     currentCliVersion: resolveClientVersion,
     readGitignore,
@@ -29179,12 +29340,25 @@ function mmiDoctorDeps(opts = {}) {
         const home = (0, import_node_os13.homedir)();
         return marketplaceRows(
           MMI_MARKETPLACE_NAME,
-          readFileSyncSafe((0, import_node_path33.join)(home, ...KNOWN_MARKETPLACES_RELATIVE), import_node_fs34.readFileSync),
-          readFileSyncSafe((0, import_node_path33.join)(home, ".claude", "settings.json"), import_node_fs34.readFileSync)
+          readFileSyncSafe((0, import_node_path34.join)(home, ...KNOWN_MARKETPLACES_RELATIVE), import_node_fs35.readFileSync),
+          readFileSyncSafe((0, import_node_path34.join)(home, ".claude", "settings.json"), import_node_fs35.readFileSync),
+          // #3974: this CLI heals these rows, so report mode names `doctor --apply` rather than the hand
+          // edit. Unconditional — it is a fact about mmi-cli, not about whether --apply was passed.
+          true
         );
       } catch {
         return [];
       }
+    },
+    // #3974: the heal behind those rows, under --apply only. Same Codex carve-out as the rows above —
+    // Codex keeps its registration in config.toml, so there is no ~/.claude registration to pin.
+    healMarketplacePins: () => {
+      try {
+        if (detectSurface(process.env) === "codex") return void 0;
+        return applyOrgMarketplacePins((0, import_node_path34.join)((0, import_node_os13.homedir)(), ...KNOWN_MARKETPLACES_RELATIVE), [MMI_MARKETPLACE_NAME]);
+      } catch {
+        return void 0;
+      }
     }
   };
 }
@@ -29386,19 +29560,19 @@ program2.hook("preAction", async (_thisCommand, actionCommand) => {
 });
 var rules = program2.command("rules").description("org-managed .gitignore delivery");
 rules.command("gitignore").option("--write", "upsert the managed block into .gitignore (default: check only, non-zero exit on drift)").option("--json", "machine-readable output").description("verify (or --write) this repo's org-managed .gitignore block matches the SSOT").action((opts) => {
-  const path2 = (0, import_node_path33.join)(process.cwd(), ".gitignore");
-  const current = (0, import_node_fs34.existsSync)(path2) ? (0, import_node_fs34.readFileSync)(path2, "utf8") : null;
+  const path2 = (0, import_node_path34.join)(process.cwd(), ".gitignore");
+  const current = (0, import_node_fs35.existsSync)(path2) ? (0, import_node_fs35.readFileSync)(path2, "utf8") : null;
   const plan = planManagedGitignore(current);
   const drift = [...plan.added.map((l) => `+${l}`), ...plan.removed.map((l) => `-${l}`)].join(", ") || "block normalize";
   if (opts.json) {
-    if (opts.write && plan.changed) (0, import_node_fs34.writeFileSync)(path2, plan.content, "utf8");
+    if (opts.write && plan.changed) (0, import_node_fs35.writeFileSync)(path2, plan.content, "utf8");
     console.log(JSON.stringify(plan, null, 2));
     if (!opts.write && plan.changed) process.exitCode = 1;
     return;
   }
   if (opts.write) {
     if (plan.changed) {
-      (0, import_node_fs34.writeFileSync)(path2, plan.content, "utf8");
+      (0, import_node_fs35.writeFileSync)(path2, plan.content, "utf8");
       console.log(`mmi-cli org rules gitignore: updated .gitignore (${drift})`);
     } else {
       console.log("mmi-cli org rules gitignore: up to date");
@@ -29553,8 +29727,8 @@ gcCmd.option("--dry-run", "show what would be deleted (default)").option("--appl
   if (!Number.isFinite(limit) || limit < 1) return fail("worktree gc: --limit must be a positive integer");
   let root;
   if (o.root !== void 0) {
-    root = (0, import_node_path33.resolve)(o.root);
-    if (!(0, import_node_fs34.existsSync)(root) || !(0, import_node_fs34.statSync)(root).isDirectory()) return fail(`worktree gc: --root ${o.root} is not a directory`);
+    root = (0, import_node_path34.resolve)(o.root);
+    if (!(0, import_node_fs35.existsSync)(root) || !(0, import_node_fs35.statSync)(root).isDirectory()) return fail(`worktree gc: --root ${o.root} is not a directory`);
     const gcRepoRoot = (await execFileP2("git", ["rev-parse", "--show-toplevel"], { timeout: GIT_TIMEOUT_MS }).catch(() => ({ stdout: "" }))).stdout.trim() || process.cwd();
     if (isPathUnderDirectory(gcRepoRoot, root)) {
       return fail(`worktree gc: --root ${root} contains this checkout \u2014 name a worktrees root, not the repo or an ancestor of it`);
@@ -29596,7 +29770,7 @@ function runWorktreeInstall(command, cwd, quiet) {
   const file = isWin2 ? "cmd.exe" : bin;
   const spawnArgs = isWin2 ? ["/c", bin, ...args] : args;
   return new Promise((resolve5, reject) => {
-    const child2 = (0, import_node_child_process15.spawn)(file, spawnArgs, { cwd, stdio: quiet ? "ignore" : "inherit", windowsHide: true });
+    const child2 = (0, import_node_child_process16.spawn)(file, spawnArgs, { cwd, stdio: quiet ? "ignore" : "inherit", windowsHide: true });
     const timer = setTimeout(() => {
       try {
         child2.kill();
@@ -29619,7 +29793,7 @@ async function primaryCheckoutRoot(from) {
   return primaryCheckoutRootOf(async (args) => (await execFileP2("git", ["-C", from, ...args], { timeout: GIT_TIMEOUT_MS })).stdout);
 }
 async function unprovenWorktreeReason(wtPath, repoRoot2) {
-  if (!(0, import_node_fs34.existsSync)(wtPath)) return `${wtPath} does not exist on disk`;
+  if (!(0, import_node_fs35.existsSync)(wtPath)) return `${wtPath} does not exist on disk`;
   const porcelain = (await execFileP2("git", ["-C", repoRoot2, "worktree", "list", "--porcelain"], { timeout: GIT_TIMEOUT_MS }).catch(() => ({ stdout: "" }))).stdout;
   const registered = parseWorktreePorcelainEntries(porcelain);
   if (!registered.length) {
@@ -29640,26 +29814,26 @@ function makeProvisionDeps(worktreeRoot, quiet, log) {
 function acquireWorktreeSetupLock(worktreeRoot) {
   const lockPath = repoRuntimeStatePath(worktreeRoot, "worktree-setup.lock");
   const take = () => {
-    const fd = (0, import_node_fs34.openSync)(lockPath, "wx");
+    const fd = (0, import_node_fs35.openSync)(lockPath, "wx");
     try {
-      (0, import_node_fs34.writeSync)(fd, String(Date.now()));
+      (0, import_node_fs35.writeSync)(fd, String(Date.now()));
     } finally {
-      (0, import_node_fs34.closeSync)(fd);
+      (0, import_node_fs35.closeSync)(fd);
     }
     return () => {
       try {
-        (0, import_node_fs34.rmSync)(lockPath, { force: true });
+        (0, import_node_fs35.rmSync)(lockPath, { force: true });
       } catch {
       }
     };
   };
   try {
-    (0, import_node_fs34.mkdirSync)((0, import_node_path33.dirname)(lockPath), { recursive: true });
+    (0, import_node_fs35.mkdirSync)((0, import_node_path34.dirname)(lockPath), { recursive: true });
     return take();
   } catch {
     try {
-      if (Date.now() - (0, import_node_fs34.statSync)(lockPath).mtimeMs > WORKTREE_SETUP_LOCK_TTL_MS) {
-        (0, import_node_fs34.rmSync)(lockPath, { force: true });
+      if (Date.now() - (0, import_node_fs35.statSync)(lockPath).mtimeMs > WORKTREE_SETUP_LOCK_TTL_MS) {
+        (0, import_node_fs35.rmSync)(lockPath, { force: true });
         return take();
       }
     } catch {
@@ -29882,7 +30056,7 @@ function scheduleRelatedDiscovery(o) {
   try {
     const args = ["issue", "discover-related", "--number", String(o.number), "--title", o.title, "--body", o.body, "--fail-soft"];
     if (o.repo) args.push("--repo", o.repo);
-    spawnDetachedSelf(args, { spawn: import_node_child_process15.spawn, execPath: process.execPath, scriptPath: process.argv[1] }, { cwd: process.cwd() });
+    spawnDetachedSelf(args, { spawn: import_node_child_process16.spawn, execPath: process.execPath, scriptPath: process.argv[1] }, { cwd: process.cwd() });
   } catch {
   }
 }
@@ -29932,6 +30106,29 @@ docs.command("refs").description("deterministic doc reference gate: every backti
     await failGraceful(e.message);
   }
 });
+var spawnCmd = program2.command("spawn").description("this repo's process-spawn contract \u2014 every child process must be unable to pop a console window");
+spawnCmd.command("policy").description("enforce the windowsHide contract across this repo's tracked source: a child_process call must set windowsHide, or take its options from a named constant, a type annotation, or a forwarded caller bag that does. Waive a call the scan cannot classify with a `// windows-hide-exempt: <reason>` comment on the line above it (#3979)").option("--json", "machine-readable result: { ok, scannedCount, findings[] }").action(async (o) => {
+  try {
+    const root = await repoRoot();
+    const result = runSpawnPolicy(root);
+    if (o.json) {
+      consoleIo.log(JSON.stringify(result, null, 2));
+      if (!result.ok) process.exitCode = 1;
+      return;
+    }
+    if (result.ok) {
+      console.log(`spawn policy: OK (${result.scannedCount} source file(s) scanned).`);
+      return;
+    }
+    for (const f of result.findings) console.error(`spawn policy: ${f.detail}`);
+    console.error(
+      "\nA process spawned without windowsHide allocates a console when it has none to inherit.\nWhere Windows Terminal is the default terminal, that console becomes a desktop window the\nhost never reaps \u2014 it outlives the process as an empty frame. Set windowsHide: true, or\nroute the call through a helper that does."
+    );
+    process.exitCode = 1;
+  } catch (e) {
+    await failGraceful(e.message);
+  }
+});
 var tests = program2.command("tests").description("a repo's test-policy.json \u2014 the opt-in test contract and its enforcement");
 tests.command("policy").description("enforce this repo's test-policy.json against the diff: a mandatory-zone change must carry a test, an unrequested new test file is refused, a `protected` test file may not be deleted or renamed away, and a `protected` entry naming a missing file is refused. Override any of them with a `Test-Policy-Override: <reason>` commit trailer (#3605)").option("--json", "machine-readable result: { ok, base, changedCount, findings[] }").option("--base <ref>", "comparison base (default: TEST_POLICY_BASE, then origin/development, then origin/main)").action(async (o) => {
   try {
@@ -30238,7 +30435,7 @@ project.command("set [owner/repo]").description("upsert project META (idempotent
   if (dupe) return fail(`org project set: KEY "${dupe}" was passed to both --var and --set; --set is an alias of --var, so pass each KEY once`);
   if (o.secretsFile) {
     try {
-      vars.push(`secrets=${(0, import_node_fs34.readFileSync)(o.secretsFile, "utf8")}`);
+      vars.push(`secrets=${(0, import_node_fs35.readFileSync)(o.secretsFile, "utf8")}`);
     } catch (e) {
       return fail(`org project set: cannot read --secrets-file ${o.secretsFile}: ${e.message}`);
     }
@@ -30986,11 +31183,11 @@ pr.command("view <number>").description("read a PR as structured JSON (merged st
   }
 });
 async function listCiWorkflowPaths(cwd = process.cwd()) {
-  const wfDir = (0, import_node_path33.join)(cwd, ".github", "workflows");
-  if (!(0, import_node_fs34.existsSync)(wfDir)) return [];
-  return (0, import_node_fs34.readdirSync)(wfDir).filter((name) => /\.(ya?ml)$/i.test(name)).filter((name) => {
+  const wfDir = (0, import_node_path34.join)(cwd, ".github", "workflows");
+  if (!(0, import_node_fs35.existsSync)(wfDir)) return [];
+  return (0, import_node_fs35.readdirSync)(wfDir).filter((name) => /\.(ya?ml)$/i.test(name)).filter((name) => {
     try {
-      return workflowReportsPrChecks((0, import_node_fs34.readFileSync)((0, import_node_path33.join)(wfDir, name), "utf8"));
+      return workflowReportsPrChecks((0, import_node_fs35.readFileSync)((0, import_node_path34.join)(wfDir, name), "utf8"));
     } catch {
       return true;
     }
@@ -31022,16 +31219,16 @@ function ciAuditDeps() {
     // gate re-seed step is skipped gracefully rather than failing mid-run.
     readSeedFile: (path2) => {
       if (!root) return null;
-      const fullPath = (0, import_node_path33.join)(root, path2);
-      return (0, import_node_fs34.existsSync)(fullPath) ? (0, import_node_fs34.readFileSync)(fullPath, "utf8") : null;
+      const fullPath = (0, import_node_path34.join)(root, path2);
+      return (0, import_node_fs35.existsSync)(fullPath) ? (0, import_node_fs35.readFileSync)(fullPath, "utf8") : null;
     }
   };
 }
 function hubRoot() {
-  const fromPkg = (0, import_node_path33.join)(__dirname, "..", "..");
+  const fromPkg = (0, import_node_path34.join)(__dirname, "..", "..");
   const marker = "skills/bootstrap/seeds/manifest.json";
-  if ((0, import_node_fs34.existsSync)((0, import_node_path33.join)(fromPkg, marker))) return fromPkg;
-  if ((0, import_node_fs34.existsSync)((0, import_node_path33.join)(process.cwd(), marker))) return process.cwd();
+  if ((0, import_node_fs35.existsSync)((0, import_node_path34.join)(fromPkg, marker))) return fromPkg;
+  if ((0, import_node_fs35.existsSync)((0, import_node_path34.join)(process.cwd(), marker))) return process.cwd();
   return null;
 }
 pr.command("ci-policy").description("report merge CI policy: wait-for-checks vs no-ci (for grind/build agents)").option("--json", "machine-readable output").option("--repo <owner/repo>", "target repo (defaults to the current checkout)").action(async (o) => {
@@ -31334,7 +31531,7 @@ jsonParity(pr.command("merge <number>").description("merge a PR (squash by defau
     localCleanup = await cleanupPrMergeLocalBranch(headRef, {
       beforeWorktrees,
       startingPath,
-      pathExists: (p) => (0, import_node_fs34.existsSync)(p),
+      pathExists: (p) => (0, import_node_fs35.existsSync)(p),
       execGit: async (args) => (await execFileP2("git", args, { timeout: GIT_TIMEOUT_MS })).stdout,
       teardownWorktreeStage,
       deferredStore,
@@ -31485,6 +31682,9 @@ function renderReleaseResume(r) {
 function renderReleaseAbort(r) {
   return `mmi-cli release --abort --apply: ${r.repo} ${r.tag} (${r.tagSha.slice(0, 12)}) \u2014 ${r.note}`;
 }
+function renderReleasePublishRetry(r) {
+  return `mmi-cli release --retry-publish: ${r.repo} ${r.tag} (${r.tagSha.slice(0, 12)}) \u2014 ${r.note}; ${r.runUrl}`;
+}
 function renderRcandResume(r) {
   return `mmi-cli rcand --resume: promoted ${r.repo} \u2192 rc at ${r.tag} (${r.tagSha.slice(0, 12)}) [${r.deployModel}]; ${renderDeployLine(r)}; ${r.note}`;
 }
@@ -31532,7 +31732,8 @@ for (const commandName of ["rcand", "release"]) {
     { flags: "--announce-summary-file <path>", description: "agent-curated 3-6 line Hub Slack summary; required for a new MMI-Hub --apply (#883/#3901)" },
     { flags: "--ack <shas>", description: "comma-separated dev shas a human verified are in the candidate, overriding the hotfix-coverage guard for a conflicted port whose -x trailer was lost (#958)" },
     { flags: "--dev", description: "full-track repos release development -> main directly, skipping rc (refuses if rc carries content not in development; no-op on direct-track repos) (#1062)" },
-    { flags: "--abort", description: "with --apply, delete only a proven unpublished failed Hub tag and restore local main for a clean recut (#3944)" }
+    { flags: "--abort", description: "with --apply, delete only a proven unpublished failed Hub tag and restore local main for a clean recut (#3944)" },
+    { flags: "--retry-publish <run-id>", description: "with --apply, retry failed jobs of one proven Hub publish release run (#3949)" }
   ];
   for (const f of RELEASE_ONLY_FLAGS) {
     if (commandName === "release") {
@@ -31559,6 +31760,25 @@ for (const commandName of ["rcand", "release"]) {
     if (o.abort && commandName !== "release") {
       return fail(`${commandName}: --abort applies only to release \u2014 it rolls back a proven unpublished Hub release tag. Run: mmi-cli release --abort --apply`);
     }
+    if (o.retryPublish && commandName !== "release") {
+      return fail(`${commandName}: --retry-publish applies only to release. Run: mmi-cli release --retry-publish <run-id> --apply --watch`);
+    }
+    if (o.retryPublish) {
+      if (o.resume || o.abort) return fail("release: --retry-publish cannot be combined with --resume or --abort");
+      if (!o.apply) return fail("release: --retry-publish requires --apply after explicit approval; nothing was written");
+      if (o.announceSummaryFile || o.ack || o.dev) return fail("release: --retry-publish accepts only --apply, --watch, --repo and --json");
+      if (o.repo) {
+        const guard = planTrainApplyRepoGuard(o.repo, await resolveRepo(), `mmi-cli release --retry-publish ${o.retryPublish} --apply${o.watch ? " --watch" : ""}`);
+        if (!guard.ok) return fail(`release: ${guard.message}`);
+      }
+      const runId = Number.parseInt(o.retryPublish, 10);
+      try {
+        const result = await runReleasePublishRetry(trainApplyDeps(), runId, { approved: true, watch: o.watch });
+        return printLine(o.json ? JSON.stringify(result, null, 2) : renderReleasePublishRetry(result));
+      } catch (e) {
+        return failGraceful(`release --retry-publish: ${e.message}`);
+      }
+    }
     if (o.abort) {
       if (o.resume) return fail("release: --abort and --resume are mutually exclusive \u2014 abort removes an unpublished tag while resume preserves and promotes it");
       if (!o.apply) return fail("release: --abort requires --apply after explicit approval; nothing was written");
@@ -31786,12 +32006,12 @@ access.command("audit").description("audit collaborator roles + train-branch pus
     targets = resolution.targets;
   }
   const derivedMatrix = registryProjects ? accessMatrixFromProjects(registryProjects) : {};
-  const fileMatrix = (0, import_node_fs34.existsSync)("access-matrix.json") ? loadAccessMatrix((0, import_node_fs34.readFileSync)("access-matrix.json", "utf8")) : {};
+  const fileMatrix = (0, import_node_fs35.existsSync)("access-matrix.json") ? loadAccessMatrix((0, import_node_fs35.readFileSync)("access-matrix.json", "utf8")) : {};
   const matrix = mergeAccessMatrix(fileMatrix, derivedMatrix);
   const derivedContracts = registryProjects ? dataAccessContractsFromProjects(registryProjects) : { consumers: {} };
-  const fileContracts = (0, import_node_fs34.existsSync)("data-access-contracts.json") ? loadDataAccessContracts((0, import_node_fs34.readFileSync)("data-access-contracts.json", "utf8")) : { consumers: {} };
+  const fileContracts = (0, import_node_fs35.existsSync)("data-access-contracts.json") ? loadDataAccessContracts((0, import_node_fs35.readFileSync)("data-access-contracts.json", "utf8")) : { consumers: {} };
   const dataAccess = mergeDataAccessContracts(fileContracts, derivedContracts);
-  const sanctioned = (0, import_node_fs34.existsSync)("access-matrix.json") ? loadSanctionedAdmins((0, import_node_fs34.readFileSync)("access-matrix.json", "utf8")) : {};
+  const sanctioned = (0, import_node_fs35.existsSync)("access-matrix.json") ? loadSanctionedAdmins((0, import_node_fs35.readFileSync)("access-matrix.json", "utf8")) : {};
   const report = await auditOrgAccess(targets, deps, matrix, dataAccess, sanctioned);
   console.log(o.json ? JSON.stringify(report, null, 2) : renderAccessReport(report));
   if (!report.ok) process.exitCode = 1;
@@ -31824,16 +32044,16 @@ function directoryBytes(path2) {
   let total = 0;
   let entries;
   try {
-    entries = (0, import_node_fs34.readdirSync)(path2, { withFileTypes: true });
+    entries = (0, import_node_fs35.readdirSync)(path2, { withFileTypes: true });
   } catch {
     return 0;
   }
   for (const entry of entries) {
-    const child2 = (0, import_node_path33.join)(path2, entry.name);
+    const child2 = (0, import_node_path34.join)(path2, entry.name);
     if (entry.isDirectory()) total += directoryBytes(child2);
     else {
       try {
-        total += (0, import_node_fs34.statSync)(child2).size;
+        total += (0, import_node_fs35.statSync)(child2).size;
       } catch {
       }
     }
@@ -31841,25 +32061,25 @@ function directoryBytes(path2) {
   return total;
 }
 function listDirEntries(dir) {
-  return (0, import_node_fs34.readdirSync)(dir, { withFileTypes: true }).map((d) => ({ name: d.name, isDirectory: d.isDirectory() }));
+  return (0, import_node_fs35.readdirSync)(dir, { withFileTypes: true }).map((d) => ({ name: d.name, isDirectory: d.isDirectory() }));
 }
 function readInstalledPluginRefs(configRoot) {
   const p = installedPluginsPathForConfig(configRoot);
-  if (!(0, import_node_fs34.existsSync)(p)) return [];
+  if (!(0, import_node_fs35.existsSync)(p)) return [];
   try {
-    return installedPluginPaths((0, import_node_fs34.readFileSync)(p, "utf8"));
+    return installedPluginPaths((0, import_node_fs35.readFileSync)(p, "utf8"));
   } catch {
     return null;
   }
 }
 function pluginCacheFsDeps(configRoot, dirBytes) {
   return {
-    exists: (p) => (0, import_node_fs34.existsSync)(p),
-    listVersionDirs: (root) => (0, import_node_fs34.readdirSync)(root, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name),
+    exists: (p) => (0, import_node_fs35.existsSync)(p),
+    listVersionDirs: (root) => (0, import_node_fs35.readdirSync)(root, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name),
     dirBytes,
-    listStagingDirs: (root) => (0, import_node_fs34.readdirSync)(root, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => {
+    listStagingDirs: (root) => (0, import_node_fs35.readdirSync)(root, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => {
       try {
-        return { name: d.name, mtimeMs: newestMtimeMs((0, import_node_path33.join)(root, d.name), listDirEntries, (p) => (0, import_node_fs34.statSync)(p).mtimeMs) };
+        return { name: d.name, mtimeMs: newestMtimeMs((0, import_node_path34.join)(root, d.name), listDirEntries, (p) => (0, import_node_fs35.statSync)(p).mtimeMs) };
       } catch {
         return { name: d.name, mtimeMs: Date.now() };
       }
@@ -31873,10 +32093,10 @@ function stagingApplyFsGuard(configRoot) {
   return {
     referencedPaths: () => readInstalledPluginRefs(configRoot),
     mtimeMs: (name) => {
-      const p = (0, import_node_path33.join)(stagingRoot, name);
-      if (!(0, import_node_fs34.existsSync)(p)) return null;
+      const p = (0, import_node_path34.join)(stagingRoot, name);
+      if (!(0, import_node_fs35.existsSync)(p)) return null;
       try {
-        return newestMtimeMs(p, listDirEntries, (q) => (0, import_node_fs34.statSync)(q).mtimeMs);
+        return newestMtimeMs(p, listDirEntries, (q) => (0, import_node_fs35.statSync)(q).mtimeMs);
       } catch {
         return null;
       }
@@ -31902,7 +32122,7 @@ program2.command("plugin-prune").description(`prune stale cached MMI plugin vers
     { withBytes: true, configRoot, includeStaging: surface !== "codex" }
   );
   const anythingToDelete = plan.prune.length > 0 || plan.staging.length > 0;
-  const result = o.apply && anythingToDelete ? applyPluginCachePlan(plan, (p) => (0, import_node_fs34.rmSync)(p, { recursive: true, force: true }), stagingApplyFsGuard(configRoot)) : void 0;
+  const result = o.apply && anythingToDelete ? applyPluginCachePlan(plan, (p) => (0, import_node_fs35.rmSync)(p, { recursive: true, force: true }), stagingApplyFsGuard(configRoot)) : void 0;
   const warnings = plan.prune.length > 0 ? [CONCURRENT_SESSION_WARNING] : [];
   if (o.json) console.log(JSON.stringify({ ...plan, warnings, applied: result ?? null }));
   else console.log(renderPluginCachePlan(plan, result));
@@ -31965,7 +32185,7 @@ program2.command("session-start").description("run the SessionStart verbs (whoam
   for (const line of scratchGcLines(process.cwd())) bannerIo.log(line);
   const worktreeBanner = worktreeAutoProvisionBanner(process.cwd());
   if (worktreeBanner) {
-    spawnDetachedSelf(["worktree", "setup", "--quiet"], { spawn: import_node_child_process15.spawn, execPath: process.execPath, scriptPath: process.argv[1] });
+    spawnDetachedSelf(["worktree", "setup", "--quiet"], { spawn: import_node_child_process16.spawn, execPath: process.execPath, scriptPath: process.argv[1] });
     bannerIo.log(worktreeBanner);
   }
   if (isLinkedWorktree(process.cwd())) {